@tangle-network/agent-runtime 6.0.6 → 6.0.7

package/dist/{workspace-streams-uB9rRbms.js.map → workspace-streams-B7yNMahl.js.map}

@@ -1 +1 @@
-{"version":3,"file":"workspace-streams-uB9rRbms.js","names":["sha256Bytes","canonicalCandidateDigest","canonicalCandidateBytes","sha256Bytes","canonicalCandidateBytes","fsConstants","sha256Bytes","canonicalCandidateBytes","canonicalCandidateDigest","sha256Bytes","canonicalCandidateBytes","sha256Bytes","fsConstants","canonicalCandidateBytes","canonicalCandidateBytes","canonicalCandidateDigest"],"sources":["../src/path-control-characters.ts","../src/candidate-execution/digest.ts","../src/candidate-execution/artifact-streams.ts","../src/candidate-execution/artifacts.ts","../src/candidate-execution/exact-object.ts","../src/candidate-execution/output-artifacts.ts","../src/candidate-execution/workspace-archive.ts","../src/candidate-execution/git-materialize.ts","../src/candidate-execution/workspace-archive-local.ts","../src/candidate-execution/workspace-streams.ts"],"sourcesContent":["/** Whether a serialized field contains an ASCII control or delete character. */\nexport function hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n","import { createHash } from 'node:crypto'\nimport {\n  type AgentCandidateEmbeddedArtifact,\n  canonicalCandidateBytes,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport type { CanonicalCandidateDocument } from './types'\n\nexport { canonicalCandidateBytes }\n\n/** Use native hashing for workspace archives. */\nexport function sha256Bytes(bytes: Uint8Array): Sha256Digest {\n  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`\n}\n\nexport function canonicalCandidateDigest(value: unknown): Sha256Digest {\n  return sha256Bytes(canonicalCandidateBytes(value))\n}\n\n/** Returns a detached, deeply frozen JSON value with canonical number normalization. */\nexport function immutableCandidateValue<T>(value: T): T {\n  return deepFreezeCandidate(\n    JSON.parse(Buffer.from(canonicalCandidateBytes(value)).toString('utf8')) as T,\n  )\n}\n\nexport function canonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  valueWithoutDigest: Omit<T, 'digest'>,\n): CanonicalCandidateDocument<T> {\n  const bytes = canonicalCandidateBytes(valueWithoutDigest)\n  const digest = sha256Bytes(bytes)\n  const value = deepFreezeCandidate({\n    ...JSON.parse(Buffer.from(bytes).toString('utf8')),\n    digest,\n  }) as T\n  return Object.freeze({\n    value,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n    digest,\n  })\n}\n\nexport function verifyCanonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  value: T,\n  label: string,\n): T {\n  if (canonicalCandidateDigest(omitTopLevelDigest(value)) !== value.digest) {\n    throw new Error(`${label} digest does not match`)\n  }\n  return immutableCandidateValue(value)\n}\n\nexport function embeddedCandidateArtifact(bytes: Uint8Array): AgentCandidateEmbeddedArtifact {\n  return {\n    encoding: 'base64',\n    content: Buffer.from(bytes).toString('base64'),\n    sha256: sha256Bytes(bytes),\n    byteLength: bytes.byteLength,\n  }\n}\n\nexport function omitTopLevelDigest<T extends { digest: Sha256Digest }>(\n  value: T,\n): Omit<T, 'digest'> {\n  const { digest: _digest, ...rest } = value\n  return rest\n}\n\nexport function deepFreezeCandidate<T>(value: T, seen = new Set<object>()): T {\n  if (\n    value === null ||\n    typeof value !== 'object' ||\n    ArrayBuffer.isView(value) ||\n    seen.has(value as object)\n  ) {\n    return value\n  }\n  seen.add(value as object)\n  for (const child of Object.values(value as Record<string, unknown>)) {\n    deepFreezeCandidate(child, seen)\n  }\n  return Object.freeze(value)\n}\n","import { createHash } from 'node:crypto'\nimport {\n  type AgentCandidateArtifactRef,\n  type AgentCandidateCapturedArtifact,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\nimport { immutableCandidateValue } from './digest'\nimport type {\n  AgentCandidateArtifactPort,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateOutputPurpose,\n} from './types'\n\n/** Verify the complete stream, including its final digest, before accepting its consumer's result. */\nexport async function* verifiedArtifactChunks(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  signal?.throwIfAborted()\n  if (!('content' in artifact) && !port.readStream) {\n    throw new Error('streaming workspace artifacts require readStream')\n  }\n  const chunks =\n    'content' in artifact\n      ? [Buffer.from(artifact.content, 'base64')]\n      : port.readStream!(artifact, { signal })\n  const hash = createHash('sha256')\n  let byteLength = 0\n  for await (const chunk of chunks) {\n    signal?.throwIfAborted()\n    if (!(chunk instanceof Uint8Array))\n      throw new Error('candidate artifact emitted a non-byte chunk')\n    byteLength += chunk.byteLength\n    if (byteLength > artifact.byteLength)\n      throw new Error('candidate artifact exceeds its declared length')\n    hash.update(chunk)\n    yield chunk\n  }\n  signal?.throwIfAborted()\n  if (byteLength !== artifact.byteLength || `sha256:${hash.digest('hex')}` !== artifact.sha256) {\n    throw new Error('candidate artifact failed digest or length verification')\n  }\n}\n\nconst selfVerifyingPuts = new WeakMap<object, object>()\n\n/**\n * Declare that this exact putStream resolves only after reading its stored object back from where\n * this exact readStream reads it, and matching its digest and length. The claim belongs to the\n * pair, so a wrapper that replaces either function never inherits it.\n */\nexport function markPutStreamVerified(putStream: object, readStream: object): void {\n  selfVerifyingPuts.set(putStream, readStream)\n}\n\n/** Whether a port's putStream already read back what its readStream will return. */\nexport function putStreamVerifiedBy(port: AgentCandidateOutputArtifactPort): boolean {\n  return (\n    port.putStream !== undefined &&\n    port.readStream !== undefined &&\n    selfVerifyingPuts.get(port.putStream) === port.readStream\n  )\n}\n\n/** Stream evaluator evidence into its existing store and verify durable readback before returning. */\nexport async function persistCandidateOutputArtifactStream(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    chunks: AsyncIterable<Uint8Array>\n    maxBytes: number\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  if (!port.putStream || !port.readStream) {\n    throw new Error('streaming workspace persistence requires putStream and readStream')\n  }\n  input.signal?.throwIfAborted()\n  const hash = createHash('sha256')\n  let byteLength = 0\n  let consumed = false\n  async function* checked(): AsyncGenerator<Uint8Array> {\n    for await (const chunk of input.chunks) {\n      input.signal?.throwIfAborted()\n      if (!(chunk instanceof Uint8Array))\n        throw new Error('candidate artifact emitted a non-byte chunk')\n      byteLength += chunk.byteLength\n      if (byteLength > input.maxBytes)\n        throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n      hash.update(chunk)\n      yield chunk\n    }\n    consumed = true\n    input.signal?.throwIfAborted()\n  }\n  const chunks = checked()\n  try {\n    const ref = agentCandidateArtifactRefSchema.parse(\n      await port.putStream({\n        executionId: input.executionId,\n        purpose: input.purpose,\n        chunks,\n        ...(input.signal ? { signal: input.signal } : {}),\n      }),\n    )\n    input.signal?.throwIfAborted()\n    if (\n      !consumed ||\n      ref.sha256 !== `sha256:${hash.digest('hex')}` ||\n      ref.byteLength !== byteLength\n    ) {\n      throw new Error('candidate output locator does not identify the submitted bytes')\n    }\n    // A port that already read its stored object back is not read a third time. Measured\n    // 2026-10-11: a critics tribunal on /mnt/traces re-read 1.1 GB/min of just-written workspace\n    // archives, each one written once and read back twice.\n    if (!putStreamVerifiedBy(port)) {\n      for await (const _chunk of verifiedArtifactChunks(ref, port, input.signal)) {\n        // Verification consumes the durable object without retaining it.\n      }\n    }\n    return immutableCandidateValue(ref)\n  } finally {\n    await chunks.return(undefined)\n  }\n}\n","import { createHash } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport { lstat, open, readdir, readlink, realpath } from 'node:fs/promises'\nimport { dirname, isAbsolute, relative, resolve, sep } from 'node:path'\n\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateProfilePlanMaterial,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\n\nexport function artifactCacheKey(artifact: AgentCandidateCapturedArtifact): string {\n  return `${artifact.sha256}:${artifact.byteLength}`\n}\n\nexport async function readVerifiedArtifact(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n): Promise<Uint8Array> {\n  const bytes =\n    'content' in artifact\n      ? Buffer.from(artifact.content, 'base64')\n      : await port.read(artifact as AgentCandidateArtifactRef)\n  verifyBytes(bytes, artifact.sha256, artifact.byteLength, 'candidate artifact')\n  return Uint8Array.from(bytes)\n}\n\nexport function verifyBytes(\n  bytes: Uint8Array,\n  digest: string,\n  byteLength: number,\n  label: string,\n): void {\n  if (bytes.byteLength !== byteLength) {\n    throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`)\n  }\n  const actual = sha256Bytes(bytes)\n  if (actual !== digest) {\n    throw new Error(`${label} digest ${actual} does not match ${digest}`)\n  }\n}\n\nexport async function verifyWorkspaceSnapshotArtifacts(\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  port: AgentCandidateArtifactPort,\n): Promise<{ manifest: Uint8Array; archive: Uint8Array }> {\n  const [manifest, archive] = await Promise.all([\n    readVerifiedArtifact(snapshot.manifest, port),\n    readVerifiedArtifact(snapshot.archive, port),\n  ])\n  const canonicalManifest = canonicalCandidateBytes(snapshot.material)\n  if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) {\n    throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n  }\n  if (sha256Bytes(canonicalManifest) !== snapshot.digest) {\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  }\n  return { manifest, archive }\n}\n\n/** The per-scan caps a bounded capture applies. */\nexport interface WorkspaceScanLimits {\n  readonly maxFiles: number\n  readonly maxFileBytes: number\n  readonly maxTotalFileBytes: number\n}\n\n/** A configured file-count or byte limit stopped workspace capture. */\nexport class WorkspaceScanLimitError extends Error {}\n\n/** What a workspace scan reads and how it records a file's permission bits. */\nexport interface WorkspaceScanOptions {\n  readonly signal?: AbortSignal\n  readonly ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[]\n  /**\n   * Root-relative files or directories left out, each by its exact path (`__retention__` or\n   * `__retention__/sessions/<id>`). A verify of the same root must name the same paths.\n   */\n  readonly excludedPaths?: readonly string[]\n  readonly limits?: WorkspaceScanLimits\n  /** Scan only these root-relative files, pruning every unrelated directory. */\n  readonly selectedPaths?: readonly string[]\n  /**\n   * Record Git's two file modes instead of the filesystem's exact permission bits: `0o755` when\n   * any execute bit is set, `0o644` otherwise. A checkout umask then cannot move a manifest\n   * digest, while a real permission change still does.\n   *\n   * This is the normalization `readCandidateGitTreeFiles` already applies to a Git tree\n   * (`100644`/`100755`), so one tree scanned from disk and the same tree read out of Git produce\n   * the same manifest. Off by default: the flag changes the digest, so a capture and the verify\n   * that checks it must agree on it.\n   */\n  readonly portableTree?: boolean\n}\n\n/**\n * Refuse a materialized workspace whose files, modes, or bytes are not the signed manifest.\n *\n * The scan streams, so the size of the largest file does not decide whether the check can run, and\n * the refusal names the one mismatch a caller can produce on its own: a capture and a verify that\n * disagree about `portableTree`.\n */\nexport async function verifyMaterializedWorkspace(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: Omit<WorkspaceScanOptions, 'limits'> = {},\n): Promise<void> {\n  assertWorkspaceManifest(await scanMaterializedWorkspaceManifest(root, options), expected)\n}\n\n/**\n * The canonical manifest of one materialized workspace, read without holding any file.\n *\n * Every file is digested by streaming, so the size of the largest file does not decide whether the\n * workspace can be described. `FileHandle.readFile` refuses anything above 2 GiB with\n * `ERR_FS_FILE_TOO_LARGE`, which made a workspace holding one such artifact impossible to verify\n * against a manifest it already matched. The digest is sha-256 over the same bytes either way, so\n * a manifest a buffered read produced is reproduced exactly.\n */\nexport async function scanMaterializedWorkspaceManifest(\n  root: string,\n  options: WorkspaceScanOptions = {},\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return workspaceManifestFromEntries(await walkWorkspace(root, options, false))\n}\n\n/**\n * Capture settings Runtime's own callers may add. `skipPythonBytecode` leaves out `__pycache__/`\n * directories and `*.pyc` files: the interpreter writes them beside the sources it runs, Git\n * ignores them, and each carries its source's modification time, so a digest that covered them\n * would change when a program was merely run and could not be reproduced from any checkout.\n */\ninterface WorkspaceCaptureOptions extends WorkspaceScanOptions {\n  readonly skipPythonBytecode?: boolean\n}\n\nexport async function captureMaterializedWorkspace(\n  root: string,\n  options: WorkspaceCaptureOptions = {},\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const entries = await walkWorkspace(root, options, true)\n  return {\n    manifest: workspaceManifestFromEntries(entries),\n    files: entries.map((entry) => ({\n      path: entry.path,\n      mode: entry.mode,\n      bytes: Uint8Array.from(capturedBytes(entry)),\n    })),\n  }\n}\n\n/** Capture exact verified regular-file bytes for fresh isolated materialization. */\nexport async function readMaterializedWorkspaceFiles(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: WorkspaceScanOptions = {},\n): Promise<ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>> {\n  const observed = await captureMaterializedWorkspace(root, options)\n  assertWorkspaceManifest(observed.manifest, expected)\n  return observed.files.map((file) =>\n    Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n  )\n}\n\n/**\n * Build the canonical manifest for files a caller already holds — the shape a remote executor\n * returns. Pass `portableTree` to record Git's two file modes instead of exact permission bits, and\n * pass the same flag to every verify that reads the result.\n */\nexport function candidateWorkspaceManifest(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  options: { portableTree?: boolean } = {},\n): AgentCandidateWorkspaceManifestMaterial {\n  return workspaceManifestFromEntries(\n    files.map((file) => ({\n      path: file.path,\n      mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,\n      sha256: sha256Bytes(file.bytes),\n      byteLength: file.bytes.byteLength,\n    })),\n  )\n}\n\nfunction workspaceManifestFromEntries(\n  entries: ReadonlyArray<{\n    path: string\n    mode: number\n    sha256: Sha256Digest\n    byteLength: number\n  }>,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    kind: 'agent-candidate-workspace-manifest',\n    files: entries\n      .map((entry) => ({\n        path: entry.path,\n        mode: entry.mode,\n        sha256: entry.sha256,\n        byteLength: entry.byteLength,\n      }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  }\n}\n\n/** Git records exactly two file modes, and a portable-tree scan records the same two. */\nfunction portableFileMode(mode: number): number {\n  return (mode & 0o111) !== 0 ? 0o755 : 0o644\n}\n\nfunction capturedBytes(entry: ScannedWorkspaceEntry): Buffer {\n  if (!entry.bytes) throw new Error(`workspace file was digested without its bytes: ${entry.path}`)\n  return entry.bytes\n}\n\nfunction assertWorkspaceManifest(\n  observed: AgentCandidateWorkspaceManifestMaterial,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) {\n    return\n  }\n  // The one mismatch a caller can produce by passing `portableTree` on one side of a\n  // capture/verify pair and not the other. Named, because the general refusal below reads as\n  // changed bytes and would send a reader looking for a file that never changed. Comparing the\n  // two manifests already in hand costs no second walk.\n  if (\n    Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(\n      canonicalCandidateBytes(withPortableModes(expected)),\n    )\n  ) {\n    throw new Error(\n      'materialized workspace files do not match the signed manifest: only the file modes differ, ' +\n        'so the capture and this verify disagree about portableTree',\n    )\n  }\n  throw new Error('materialized workspace files, modes, or bytes do not match the signed manifest')\n}\n\nfunction withPortableModes(\n  material: AgentCandidateWorkspaceManifestMaterial,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    ...material,\n    files: material.files.map((file) => ({ ...file, mode: portableFileMode(file.mode) })),\n  }\n}\n\nexport async function verifyMaterializedProfileWorkspace(\n  root: string,\n  expected: AgentCandidateProfilePlanMaterial,\n  fileRoot: 'workspace' | 'agent' = 'workspace',\n): Promise<void> {\n  const observed = await scanMaterializedWorkspaceManifest(root)\n  const observedProfile = observed.files.map(({ path, mode, sha256 }) => ({\n    relPath: path,\n    mode,\n    contentSha256: sha256,\n  }))\n  const expectedFiles = expected.files\n    .filter((file) => (file.root ?? 'workspace') === fileRoot)\n    .map(({ root: _root, ...file }) => file)\n  if (\n    !Buffer.from(canonicalCandidateBytes(observedProfile)).equals(\n      canonicalCandidateBytes(expectedFiles),\n    )\n  ) {\n    throw new Error(\n      `profile ${fileRoot} staging files, modes, or bytes do not match the signed profile plan`,\n    )\n  }\n}\n\ninterface ScannedWorkspaceEntry {\n  readonly path: string\n  readonly mode: number\n  readonly sha256: Sha256Digest\n  readonly byteLength: number\n  /** Present only when the walk was asked to keep bytes. */\n  readonly bytes?: Buffer\n}\n\nasync function walkWorkspace(\n  root: string,\n  options: WorkspaceCaptureOptions,\n  keepBytes: boolean,\n): Promise<ScannedWorkspaceEntry[]> {\n  const ignoredProtectedRootEntries = new Set<string>(options.ignoredProtectedRootEntries ?? [])\n  const excluded = new Set(options.excludedPaths ?? [])\n  for (const path of excluded) {\n    if (\n      !path ||\n      path.includes('\\\\') ||\n      path.includes('\\0') ||\n      isAbsolute(path) ||\n      path.split('/').some((part) => !part || part === '.' || part === '..')\n    ) {\n      throw new Error('workspace excluded path must be a safe relative path')\n    }\n  }\n  const limits = options.limits\n  const selected = options.selectedPaths ? new Set(options.selectedPaths) : undefined\n  const selectedDirectories = new Set<string>()\n  for (const path of selected ?? []) {\n    if (\n      !path ||\n      path.includes('\\\\') ||\n      path.includes('\\0') ||\n      isAbsolute(path) ||\n      path.split('/').some((part) => !part || part === '.' || part === '..')\n    ) {\n      throw new Error('workspace selected path must be a safe relative file path')\n    }\n    let parent = dirname(path)\n    while (parent !== '.') {\n      selectedDirectories.add(parent)\n      parent = dirname(parent)\n    }\n  }\n  // Scan the RESOLVED root. The property this guards is that every captured path lies under\n  // one real directory with no aliasing, which resolving satisfies directly — rejecting a\n  // symlinked prefix outright does not, and makes the scan impossible on macOS, where the\n  // OS itself hands out temp paths under /var, a symlink to /private/var. Symlinks INSIDE\n  // the workspace are still refused entry by entry below, with O_NOFOLLOW on every open.\n  const requestedRoot = resolve(root)\n  const rootStats = await lstat(requestedRoot)\n  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {\n    throw new Error('workspace root must be a real directory')\n  }\n  const absoluteRoot = await realpath(requestedRoot)\n  const resolvedStats = await lstat(absoluteRoot)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('workspace root must resolve to a real directory')\n  }\n  const scanned: ScannedWorkspaceEntry[] = []\n  let totalBytes = 0\n\n  async function visit(directory: string): Promise<void> {\n    options.signal?.throwIfAborted()\n    const entries = await readdir(directory, { withFileTypes: true })\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))\n    for (const entry of entries) {\n      options.signal?.throwIfAborted()\n      if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) {\n        continue\n      }\n      if (\n        options.skipPythonBytecode === true &&\n        ((entry.isDirectory() && entry.name === '__pycache__') ||\n          (entry.isFile() && entry.name.endsWith('.pyc')))\n      ) {\n        continue\n      }\n      const absolute = resolve(directory, entry.name)\n      const relPath = relative(absoluteRoot, absolute).split(sep).join('/')\n      if (!relPath || relPath.startsWith('../') || relPath.includes('/../')) {\n        throw new Error(`workspace entry escapes root: ${relPath}`)\n      }\n      if (excluded.has(relPath)) continue\n      if (selected && !selected.has(relPath) && !selectedDirectories.has(relPath)) continue\n      const stats = await lstat(absolute)\n      if (stats.isSymbolicLink()) {\n        throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot))\n      }\n      if (stats.isDirectory()) {\n        if (selected?.has(relPath))\n          throw new Error(`workspace selected file is a directory: ${relPath}`)\n        await visit(absolute)\n        continue\n      }\n      if (!stats.isFile()) {\n        throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n      }\n      if (limits && scanned.length >= limits.maxFiles) {\n        throw new WorkspaceScanLimitError('workspace exceeds maxFiles')\n      }\n      const descriptor = await open(\n        absolute,\n        fsConstants.O_RDONLY |\n          (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      )\n      try {\n        const openedStats = await descriptor.stat()\n        if (!openedStats.isFile()) {\n          throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n        }\n        if (openedStats.nlink !== 1) {\n          throw new Error(`workspace contains a hard-linked file: ${relPath}`)\n        }\n        const mode =\n          options.portableTree === true\n            ? portableFileMode(openedStats.mode)\n            : openedStats.mode & 0o777\n        if (limits && openedStats.size > limits.maxFileBytes) {\n          throw new WorkspaceScanLimitError(`workspace file exceeds maxFileBytes: ${relPath}`)\n        }\n        const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : undefined\n        if (remainingBytes !== undefined && openedStats.size > remainingBytes) {\n          throw new WorkspaceScanLimitError('workspace exceeds maxTotalFileBytes')\n        }\n        const read = await readWorkspaceFile(\n          descriptor,\n          limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : undefined,\n          keepBytes,\n          relPath,\n          options.signal,\n        )\n        totalBytes += read.byteLength\n        scanned.push({\n          path: relPath,\n          mode,\n          sha256: read.sha256,\n          byteLength: read.byteLength,\n          ...(read.bytes === undefined ? {} : { bytes: read.bytes }),\n        })\n      } finally {\n        await descriptor.close()\n      }\n    }\n  }\n\n  await visit(absoluteRoot)\n  if (selected && scanned.length !== selected.size) {\n    throw new Error('workspace selected files changed during capture')\n  }\n  return scanned\n}\n\n/**\n * Why one symbolic link is refused, in the terms that separate a portable link from a link that\n * reaches outside the tree.\n *\n * Every link is refused, in both mode policies. `AgentCandidateWorkspaceManifestMaterial` has no\n * representation for one — `mode`, `sha256` and `byteLength` describe a regular file — so a link\n * recorded as a file would let two different trees share one digest. The reason says which kind of\n * link it was, so a caller can tell a link it can rewrite from one it cannot.\n */\nasync function symlinkRefusal(\n  absolute: string,\n  relPath: string,\n  absoluteRoot: string,\n): Promise<string> {\n  const target = await readlink(absolute)\n  if (isAbsolute(target)) {\n    return `workspace contains an absolute symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, resolve(dirname(absolute), target))) {\n    return `workspace contains a symlink that escapes its tree: ${relPath} -> ${target}`\n  }\n  let physical: string\n  try {\n    physical = await realpath(absolute)\n  } catch {\n    return `workspace contains an unresolved symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, physical)) {\n    return `workspace contains a symlink that resolves outside its tree: ${relPath} -> ${target}`\n  }\n  return `workspace contains a symlink: ${relPath} -> ${target}`\n}\n\nfunction isWithin(root: string, path: string): boolean {\n  return path === root || path.startsWith(`${root}${sep}`)\n}\n\n/**\n * Read one open regular file into its digest, keeping the bytes only when the caller needs them.\n *\n * The content reaches the hash in 1 MiB chunks and is never held whole for a digest-only walk, so\n * the size of the largest file does not decide whether a workspace can be described.\n * `FileHandle.readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`. Hashing the\n * chunks in order equals hashing the whole buffer, so a manifest a buffered read produced is\n * reproduced byte for byte.\n */\nasync function readWorkspaceFile(\n  descriptor: Awaited<ReturnType<typeof open>>,\n  maxBytes: number | undefined,\n  keepBytes: boolean,\n  path: string,\n  signal?: AbortSignal,\n): Promise<{ sha256: Sha256Digest; byteLength: number; bytes?: Buffer }> {\n  const hash = createHash('sha256')\n  const buffer = Buffer.allocUnsafe(1024 * 1024)\n  const chunks: Buffer[] = []\n  let total = 0\n  while (true) {\n    signal?.throwIfAborted()\n    const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null)\n    if (bytesRead === 0) break\n    total += bytesRead\n    if (maxBytes !== undefined && total > maxBytes) {\n      throw new WorkspaceScanLimitError(`workspace file exceeds its capture limit: ${path}`)\n    }\n    const chunk = buffer.subarray(0, bytesRead)\n    hash.update(chunk)\n    // The read buffer is reused, so a kept chunk has to be copied out of it.\n    if (keepBytes) chunks.push(Buffer.from(chunk))\n  }\n  const sha256 = `sha256:${hash.digest('hex')}` as Sha256Digest\n  return keepBytes\n    ? { sha256, byteLength: total, bytes: Buffer.concat(chunks, total) }\n    : { sha256, byteLength: total }\n}\n","/** Reject unknown fields while requiring every declared non-optional field. */\nexport function assertExactObjectKeys(\n  value: unknown,\n  required: readonly string[],\n  label: string,\n  optional: readonly string[] = [],\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const allowed = new Set([...required, ...optional])\n  if (allowed.size !== required.length + optional.length) {\n    throw new Error(`${label} exact-key contract contains duplicate fields`)\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`${label} contains unknown field ${key}`)\n  }\n  for (const key of required) {\n    if (!(key in value)) throw new Error(`${label} is missing field ${key}`)\n  }\n}\n\n/**\n * Reject a string carrying a lone surrogate. A well-formed UTF-16 string round-trips through UTF-8\n * unchanged; a lone surrogate does not, so a value that passes here is safe to persist and re-read\n * as the same bytes.\n */\nexport function isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyBytes } from './artifacts'\nimport { immutableCandidateValue, sha256Bytes } from './digest'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose } from './types'\n\n/** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */\nexport async function persistCandidateOutputArtifact(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  input.signal?.throwIfAborted()\n  const bytes = Uint8Array.from(input.bytes)\n  const expectedDigest = sha256Bytes(bytes)\n  const ref = agentCandidateArtifactRefSchema.parse(\n    await port.put({\n      executionId: input.executionId,\n      purpose: input.purpose,\n      bytes: Uint8Array.from(bytes),\n      ...(input.signal ? { signal: input.signal } : {}),\n    }),\n  )\n  input.signal?.throwIfAborted()\n  if (ref.sha256 !== expectedDigest || ref.byteLength !== bytes.byteLength) {\n    throw new Error('candidate output locator does not identify the submitted bytes')\n  }\n  const stored = await port.read(ref)\n  input.signal?.throwIfAborted()\n  verifyBytes(stored, expectedDigest, bytes.byteLength, 'persisted candidate output')\n  return immutableCandidateValue(ref)\n}\n","import { isAbsolute, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\nimport { isRecord } from '@tangle-network/agent-core'\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { extract, type Pack, pack, type Extract as TarExtract } from 'tar-stream'\nimport { hasControlCharacter } from '../path-control-characters'\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport { isWellFormedUnicode } from './exact-object'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { AgentCandidateExecutorWorkspaceFile } from './types'\nimport type { CaptureAgentCandidateWorkspaceOptions } from './workspace-archive-local'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst repositoryIndexEntry = 'metadata/repository.index.json'\nconst repositoryIndexPrefix = 'index/'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\nexport interface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n  workingTree?: { files: Array<{ path: string; mode: number; bytes: Uint8Array }> }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n  workingTree?: { indexManifest: { sha256: `sha256:${string}`; byteLength: number } }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<\n    CaptureAgentCandidateWorkspaceOptions,\n    'includeRepository' | 'repositoryContents'\n  > = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nexport async function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Verify a portable archive before its source environment may be discarded. */\nexport async function verifyAgentCandidateWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}): Promise<void> {\n  await decodeVerifiedWorkspaceArchive({ ...input, limits: workspaceLimits(input.limits) })\n}\n\nexport async function decodeVerifiedWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<DecodedWorkspaceArchive> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  return decoded\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const indexManifest = repository.workingTree\n    ? canonicalCandidateBytes(candidateWorkspaceManifest(repository.workingTree.files))\n    : undefined\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n    ...(indexManifest\n      ? {\n          workingTree: {\n            indexManifest: {\n              sha256: sha256Bytes(indexManifest),\n              byteLength: indexManifest.byteLength,\n            },\n          },\n        }\n      : {}),\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n  if (repository.workingTree && indexManifest) {\n    await writeTarEntry(archive, repositoryIndexEntry, 0o600, indexManifest)\n    for (const file of repository.workingTree.files) {\n      await writeTarEntry(archive, `${repositoryIndexPrefix}${file.path}`, file.mode, file.bytes)\n    }\n  }\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  let repositoryIndex: Uint8Array | undefined\n  const indexFiles: DecodedWorkspaceArchive['files'] = []\n  const indexPaths = new Set<string>()\n  let previousIndexPath: string | undefined\n  let indexBytes = 0\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else if (name === repositoryIndexEntry) {\n        if (entry.header.mode !== 0o600 || repositoryIndex) {\n          throw new Error('candidate workspace archive repository index is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryIndex = await readTarEntry(\n          entry,\n          limits.maxArchiveBytes,\n          'candidate Git index manifest',\n        )\n        retainedEntryBytes += repositoryIndex.byteLength\n      } else if (name.startsWith(repositoryIndexPrefix)) {\n        if (\n          !repositoryMetadata?.workingTree ||\n          !repositoryIndex ||\n          indexFiles.length >= limits.maxFiles\n        ) {\n          throw new Error('candidate Git index evidence is incomplete or exceeds maxFiles')\n        }\n        const path = safeArchivePath(name.slice(repositoryIndexPrefix.length), limits.maxPathBytes)\n        if (entry.header.mode !== 0o644 && entry.header.mode !== 0o755) {\n          throw new Error('candidate Git index contains an unsupported mode')\n        }\n        assertWorkspacePathOrder(\n          path,\n          previousIndexPath,\n          indexPaths,\n          'candidate Git index paths must be unique and sorted',\n        )\n        previousIndexPath = path\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        if (\n          entry.header.size === undefined ||\n          entry.header.size > limits.maxTotalFileBytes - indexBytes\n        ) {\n          throw new Error('candidate Git index exceeds maxTotalFileBytes')\n        }\n        if (entry.header.size > limits.maxFileBytes)\n          throw new Error('candidate Git index exceeds maxFileBytes')\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `Git index file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        indexBytes += fileBytes.byteLength\n        indexFiles.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    if (Boolean(repositoryMetadata?.workingTree) !== Boolean(repositoryIndex)) {\n      throw new Error('candidate workspace archive repository index evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle, repositoryIndex, indexFiles)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    !['bundle,headCommit,headTree,kind', 'bundle,headCommit,headTree,kind,workingTree'].includes(\n      Object.keys(value).sort().join(','),\n    ) ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > limits.maxRepositoryBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  let workingTree: WorkspaceArchiveRepositoryMetadata['workingTree']\n  if ('workingTree' in value) {\n    const working = value.workingTree\n    if (\n      !isRecord(working) ||\n      Object.keys(working).join(',') !== 'indexManifest' ||\n      !isRecord(working.indexManifest) ||\n      Object.keys(working.indexManifest).sort().join(',') !== 'byteLength,sha256' ||\n      typeof working.indexManifest.sha256 !== 'string' ||\n      !/^sha256:[a-f0-9]{64}$/.test(working.indexManifest.sha256) ||\n      !Number.isSafeInteger(working.indexManifest.byteLength) ||\n      (working.indexManifest.byteLength as number) < 0 ||\n      (working.indexManifest.byteLength as number) > limits.maxArchiveBytes\n    ) {\n      throw new Error('candidate workspace archive repository index is invalid')\n    }\n    workingTree = {\n      indexManifest: {\n        sha256: working.indexManifest.sha256 as `sha256:${string}`,\n        byteLength: working.indexManifest.byteLength as number,\n      },\n    }\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n    ...(workingTree ? { workingTree } : {}),\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n  indexManifest: Uint8Array | undefined,\n  indexFiles: DecodedWorkspaceArchive['files'],\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  if (metadata.workingTree && indexManifest) {\n    verifyBytes(\n      indexManifest,\n      metadata.workingTree.indexManifest.sha256,\n      metadata.workingTree.indexManifest.byteLength,\n      'candidate Git index manifest',\n    )\n    if (\n      !Buffer.from(indexManifest).equals(\n        Buffer.from(canonicalCandidateBytes(candidateWorkspaceManifest(indexFiles))),\n      )\n    ) {\n      throw new Error('candidate Git index files do not match the captured manifest')\n    }\n  }\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n    ...(metadata.workingTree && indexManifest ? { workingTree: { files: indexFiles } } : {}),\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      workspaceTarHeader(name, mode, bytes.byteLength),\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\ntype TarEntry = TarExtract extends AsyncIterable<infer Entry> ? Entry : never\n\nasync function readTarEntry(entry: TarEntry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<unknown>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<unknown>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nexport function assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<\n    { path: string; mode: number } & ({ bytes: Uint8Array } | { byteLength: number })\n  >,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if ('bytes' in file && 'byteLength' in file)\n      throw new Error(`candidate workspace file has ambiguous length: ${path}`)\n    const byteLength = 'bytes' in file ? file.bytes.byteLength : file.byteLength\n    if (!Number.isSafeInteger(byteLength) || byteLength < 0 || byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nexport function workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nexport function safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nexport function assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nexport function assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n\n/** Shared canonical header for both archive encoders. */\nexport function workspaceTarHeader(name: string, mode: number, size: number) {\n  return {\n    name,\n    mode,\n    uid: 0,\n    gid: 0,\n    size,\n    mtime: fixedTarTime,\n    type: 'file' as const,\n    uname: '',\n    gname: '',\n  }\n}\n","import { spawn } from 'node:child_process'\nimport { mkdir, mkdtemp, readFile, realpath, rm, stat } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\nimport type {\n  AgentCandidateCode,\n  AgentCandidateGitHubRepository,\n  AgentCandidateGitHubResource,\n  AgentCandidateWorkspaceManifestMaterial,\n} from '@tangle-network/agent-interface'\nimport { hasControlCharacter } from '../path-control-characters'\n\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes } from './digest'\nimport type { AgentCandidateRepositoryPort } from './types'\n\ninterface GitResult {\n  stdout: Buffer\n  stderr: Buffer\n}\n\nexport async function verifyCandidateCode(\n  code: AgentCandidateCode,\n  repositories: AgentCandidateRepositoryPort,\n  patchBytes?: Uint8Array,\n): Promise<string | undefined> {\n  if (code.kind === 'disabled') return undefined\n  const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories)\n  await assertCommitAndBaseTree(repositoryRoot, code.baseCommit, code.baseTree)\n\n  if (code.kind === 'no-op') {\n    await assertSafeTree(repositoryRoot, code.baseTree)\n    return code.baseTree\n  }\n  if (!patchBytes) throw new Error('git-patch candidate is missing verified patch bytes')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-git-'))\n  try {\n    const indexFile = join(temporary, 'index')\n    await runCandidateGit(repositoryRoot, ['read-tree', code.baseTree], undefined, {\n      GIT_INDEX_FILE: indexFile,\n    })\n    await runCandidateGit(\n      repositoryRoot,\n      ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n      patchBytes,\n      { GIT_INDEX_FILE: indexFile },\n    )\n    const candidateTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, {\n        GIT_INDEX_FILE: indexFile,\n      })\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (candidateTree !== code.candidateTree) {\n      throw new Error(\n        `git patch materialized tree ${candidateTree} does not match ${code.candidateTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, candidateTree)\n    return candidateTree\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport async function readCandidateGitHubResource(\n  resource: AgentCandidateGitHubResource,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<Uint8Array> {\n  const repositoryRoot = await verifiedRepositoryRoot(resource.repository, repositories)\n  const commitType = (\n    await runCandidateGit(repositoryRoot, ['cat-file', '-t', resource.commit])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (commitType !== 'commit') {\n    throw new Error(`GitHub resource commit is not a commit object: ${resource.commit}`)\n  }\n  const listing = (\n    await runCandidateGit(repositoryRoot, ['ls-tree', '-z', resource.commit, '--', resource.path])\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length !== 1 || entries[0]?.path !== resource.path) {\n    throw new Error(`GitHub resource path is not one exact file: ${resource.path}`)\n  }\n  const entry = entries[0]\n  if (entry?.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n    throw new Error(`GitHub resource path is not a regular Git blob: ${resource.path}`)\n  }\n  const bytes = (await runCandidateGit(repositoryRoot, ['cat-file', 'blob', entry.object])).stdout\n  verifyBytes(bytes, resource.sha256, resource.byteLength, `GitHub resource ${resource.path}`)\n  return Uint8Array.from(bytes)\n}\n\nexport async function verifyTaskCheckout(\n  taskRoot: string,\n  expected: { baseCommit: string; baseTree: string },\n): Promise<void> {\n  const root = resolve(taskRoot)\n  const head = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim()\n  if (head !== expected.baseCommit) {\n    throw new Error(`task checkout HEAD ${head} does not match ${expected.baseCommit}`)\n  }\n  const tree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  if (tree !== expected.baseTree) {\n    throw new Error(`task checkout base tree ${tree} does not match ${expected.baseTree}`)\n  }\n}\n\n/**\n * Apply an evaluator-captured binary diff in a detached object database and\n * prove its result tree exactly matches the captured after-state manifest.\n */\nexport async function verifyTaskOutcomePatch(input: {\n  repositoryRoot: string\n  baseCommit: string\n  baseTree: string\n  resultTree: string\n  patch: Uint8Array\n  afterState: AgentCandidateWorkspaceManifestMaterial\n}): Promise<{ resultTree: string; resultCommit: string }> {\n  const repositoryRoot = resolve(input.repositoryRoot)\n  await verifyTaskCheckout(repositoryRoot, input)\n  const gitDir = resolve(\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('task Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'task repository')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-task-outcome-'))\n  try {\n    const objectDirectory = join(temporary, 'objects')\n    const indexFile = join(temporary, 'index')\n    await mkdir(objectDirectory)\n    const gitEnvironment = {\n      GIT_INDEX_FILE: indexFile,\n      GIT_OBJECT_DIRECTORY: objectDirectory,\n      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, 'objects'),\n    }\n    await runCandidateGit(repositoryRoot, ['read-tree', input.baseTree], undefined, gitEnvironment)\n    if (input.patch.byteLength > 0) {\n      await runCandidateGit(\n        repositoryRoot,\n        ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n        input.patch,\n        gitEnvironment,\n      )\n    }\n    const resultTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, gitEnvironment)\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (resultTree !== input.resultTree) {\n      throw new Error(\n        `task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, resultTree, gitEnvironment)\n    const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment)\n    if (\n      !Buffer.from(canonicalCandidateBytes(observed)).equals(\n        Buffer.from(canonicalCandidateBytes(input.afterState)),\n      )\n    ) {\n      throw new Error('task outcome after-state does not match the materialized result tree')\n    }\n    const resultCommit = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['commit-tree', resultTree, '-p', input.baseCommit],\n        Buffer.from('candidate task outcome\\n', 'utf8'),\n        {\n          ...gitEnvironment,\n          GIT_AUTHOR_NAME: 'Tangle Evaluator',\n          GIT_AUTHOR_EMAIL: 'evaluator@tangle.tools',\n          GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',\n          GIT_COMMITTER_NAME: 'Tangle Evaluator',\n          GIT_COMMITTER_EMAIL: 'evaluator@tangle.tools',\n          GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',\n        },\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    const committedTree = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['rev-parse', `${resultCommit}^{tree}`],\n        undefined,\n        gitEnvironment,\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (committedTree !== resultTree) {\n      throw new Error('task outcome evaluator commit does not bind the verified result tree')\n    }\n    return { resultTree, resultCommit }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function verifiedRepositoryRoot(\n  repository: AgentCandidateGitHubRepository,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<string> {\n  const repositoryRoot = resolve(await repositories.resolve(repository))\n  const rootStats = await stat(repositoryRoot)\n  if (!rootStats.isDirectory()) throw new Error('candidate repository path is not a directory')\n\n  const origin = (await runCandidateGit(repositoryRoot, ['remote', 'get-url', 'origin'])).stdout\n    .toString('utf8')\n    .trim()\n  const actual = parseGitHubRemote(origin)\n  if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) {\n    throw new Error(\n      `local repository origin ${origin || '<missing>'} does not match github.com/${repository.owner}/${repository.repo}`,\n    )\n  }\n\n  const gitDirText = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const gitDir = resolve(gitDirText)\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'candidate repository')\n  return repositoryRoot\n}\n\nexport async function assertNoGitIndirection(\n  repositoryRoot: string,\n  gitDir: string,\n  label: string,\n): Promise<void> {\n  const replacements = (\n    await runCandidateGit(repositoryRoot, ['for-each-ref', '--format=%(refname)', 'refs/replace'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (replacements) throw new Error(`${label} contains Git replace refs`)\n  // `--git-common-dir` answers relative to the worktree for an ordinary repository, so the\n  // path is resolved against a root the caller supplied and carries whatever symlinks that\n  // root carries. Read the object store through its RESOLVED path: the alternates below must\n  // be read at the real location, and a symlinked prefix is the OS's own doing on macOS,\n  // where a temp root lives under /var, a symlink to /private/var.\n  const commonDir = await realpath(\n    resolve(\n      repositoryRoot,\n      (await runCandidateGit(repositoryRoot, ['rev-parse', '--git-common-dir'])).stdout\n        .toString('utf8')\n        .trim(),\n    ),\n  )\n  if (commonDir.includes(':')) {\n    throw new Error(`${label} Git common directory has an unsupported path`)\n  }\n  for (const objectRoot of new Set([gitDir, commonDir])) {\n    for (const name of ['alternates', 'http-alternates']) {\n      const path = join(objectRoot, 'objects', 'info', name)\n      try {\n        const contents = await readFile(path, 'utf8')\n        if (contents.trim()) throw new Error(`${label} uses forbidden Git ${name}`)\n      } catch (error) {\n        if (!isNoEntry(error)) throw error\n      }\n    }\n  }\n}\n\nasync function assertCommitAndBaseTree(\n  repositoryRoot: string,\n  commit: string,\n  expectedTree: string,\n): Promise<void> {\n  const type = (await runCandidateGit(repositoryRoot, ['cat-file', '-t', commit])).stdout\n    .toString('utf8')\n    .trim()\n  if (type !== 'commit') throw new Error(`candidate base object is not a commit: ${commit}`)\n  const actualTree = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', `${commit}^{tree}`])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (actualTree !== expectedTree) {\n    throw new Error(`candidate base commit tree ${actualTree} does not match ${expectedTree}`)\n  }\n}\n\nasync function assertSafeTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n): Promise<void> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rz', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length === 0) throw new Error('candidate Git tree cannot be empty')\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(\n        `candidate Git tree contains a symlink, submodule, or non-blob: ${entry.path}`,\n      )\n    }\n    assertSafeGitPath(entry.path)\n  }\n}\n\nasync function workspaceManifestFromGitTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string>,\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return candidateWorkspaceManifest(\n    await readCandidateGitTreeFiles(repositoryRoot, tree, environment),\n  )\n}\n\nexport async function readCandidateGitTreeFiles(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n  limits?: { maxFiles: number; maxFileBytes: number; maxTotalFileBytes: number },\n): Promise<Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }>> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rzl', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const files: Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }> = []\n  const entries = parseTreeEntries(listing)\n  if (limits && entries.length > limits.maxFiles) {\n    throw new Error('candidate Git tree exceeds maxFiles')\n  }\n  let totalBytes = 0\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(`candidate Git tree contains a non-regular file: ${entry.path}`)\n    }\n    assertSafeGitPath(entry.path)\n    if (entry.size === undefined) {\n      throw new Error(`candidate Git tree is missing blob size: ${entry.path}`)\n    }\n    if (limits && entry.size > limits.maxFileBytes) {\n      throw new Error(`candidate Git tree file exceeds maxFileBytes: ${entry.path}`)\n    }\n    totalBytes += entry.size\n    if (limits && totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate Git tree exceeds maxTotalFileBytes')\n    }\n    const bytes = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['cat-file', 'blob', entry.object],\n        undefined,\n        environment,\n      )\n    ).stdout\n    if (bytes.byteLength !== entry.size) {\n      throw new Error(`candidate Git blob size changed: ${entry.path}`)\n    }\n    files.push({\n      path: entry.path,\n      mode: entry.mode === '100755' ? 0o755 : 0o644,\n      bytes: Uint8Array.from(bytes),\n    })\n  }\n  return files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n}\n\nfunction parseTreeEntries(bytes: Uint8Array): Array<{\n  mode: string\n  type: string\n  object: string\n  size?: number\n  path: string\n}> {\n  const raw = Buffer.from(bytes)\n  const decoded = raw.toString('utf8')\n  if (!Buffer.from(decoded, 'utf8').equals(raw)) {\n    throw new Error('candidate Git tree contains a non-UTF-8 path')\n  }\n  const rows = decoded.split('\\0').filter(Boolean)\n  return rows.map((row) => {\n    const tab = row.indexOf('\\t')\n    const header = row.slice(0, tab).split(' ').filter(Boolean)\n    const path = row.slice(tab + 1)\n    const [mode, type, object, sizeText] = header\n    if (tab < 1 || !mode || !type || !object || !path) {\n      throw new Error('malformed Git tree entry')\n    }\n    const size = sizeText && /^\\d+$/.test(sizeText) ? Number(sizeText) : undefined\n    if (size !== undefined && !Number.isSafeInteger(size)) {\n      throw new Error('candidate Git tree entry size exceeds the safe integer range')\n    }\n    return { mode, type, object, ...(size === undefined ? {} : { size }), path }\n  })\n}\n\nfunction assertSafeGitPath(path: string): void {\n  if (\n    !path ||\n    path.startsWith('/') ||\n    path.includes('\\\\') ||\n    path.includes('\\0') ||\n    hasControlCharacter(path) ||\n    path.split('/').some((part) => !part || part === '.' || part === '..') ||\n    path.split('/')[0]?.toLowerCase() === '.git'\n  ) {\n    throw new Error(`candidate Git tree contains an unsafe path: ${path}`)\n  }\n}\n\nfunction parseGitHubRemote(value: string): { owner: string; repo: string } | undefined {\n  const match = value.match(\n    /^(?:https?:\\/\\/github\\.com\\/|ssh:\\/\\/git@github\\.com\\/|git@github\\.com:)([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  )\n  if (!match?.[1] || !match[2]) return undefined\n  return { owner: match[1], repo: match[2] }\n}\n\nexport async function runCandidateGit(\n  repositoryRoot: string,\n  args: string[],\n  input?: Uint8Array,\n  extraEnv: Record<string, string> = {},\n  options: { maxOutputBytes?: number; readUserExclusions?: boolean } = {},\n): Promise<GitResult> {\n  if (\n    options.readUserExclusions &&\n    (args.length !== 7 ||\n      args.slice(0, 4).join(',') !== 'config,--includes,--path,--default' ||\n      args.slice(5).join(',') !== '--get,core.excludesFile')\n  ) {\n    throw new Error('user Git configuration may only supply the effective exclusion path')\n  }\n  if (\n    options.maxOutputBytes !== undefined &&\n    (!Number.isSafeInteger(options.maxOutputBytes) || options.maxOutputBytes < 0)\n  ) {\n    throw new Error('candidate Git maxOutputBytes must be a nonnegative safe integer')\n  }\n  const env = Object.fromEntries(\n    Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')),\n  ) as Record<string, string>\n  Object.assign(env, {\n    GIT_CONFIG_NOSYSTEM: '1',\n    GIT_CONFIG_GLOBAL: '/dev/null',\n    GIT_CONFIG_SYSTEM: '/dev/null',\n    GIT_TERMINAL_PROMPT: '0',\n    GIT_NO_REPLACE_OBJECTS: '1',\n    LC_ALL: 'C',\n    ...extraEnv,\n  })\n  // Only this read-only config query can consult user configuration. Commands which read blobs,\n  // bundle, or restore a repository retain isolation from credentials and executable settings.\n  if (options.readUserExclusions) {\n    for (const name of ['GIT_CONFIG_GLOBAL', 'GIT_CONFIG_SYSTEM', 'GIT_CONFIG_NOSYSTEM']) {\n      delete env[name]\n      if (process.env[name] !== undefined) env[name] = process.env[name]\n    }\n  }\n  const fullArgs = [\n    '-c',\n    'core.hooksPath=/dev/null',\n    '-c',\n    'core.fsmonitor=false',\n    '-c',\n    'core.untrackedCache=false',\n    '-c',\n    'protocol.file.allow=never',\n    '-C',\n    repositoryRoot,\n    ...args,\n  ]\n  return await new Promise((resolveResult, reject) => {\n    const child = spawn('git', fullArgs, { env, stdio: ['pipe', 'pipe', 'pipe'] })\n    const stdout: Buffer[] = []\n    const stderr: Buffer[] = []\n    let outputBytes = 0\n    let exceeded = false\n    function retain(chunks: Buffer[], chunk: Buffer): void {\n      if (exceeded) return\n      outputBytes += chunk.byteLength\n      if (options.maxOutputBytes !== undefined && outputBytes > options.maxOutputBytes) {\n        exceeded = true\n        child.kill('SIGKILL')\n        return\n      }\n      chunks.push(chunk)\n    }\n    child.stdout.on('data', (chunk: Buffer) => retain(stdout, chunk))\n    child.stderr.on('data', (chunk: Buffer) => retain(stderr, chunk))\n    child.on('error', reject)\n    child.stdin.on('error', reject)\n    child.on('close', (code, signal) => {\n      if (exceeded) {\n        reject(new Error('candidate Git command exceeds maxOutputBytes'))\n        return\n      }\n      const out = Buffer.concat(stdout)\n      const err = Buffer.concat(stderr)\n      if (code !== 0) {\n        reject(\n          new Error(\n            `git ${args[0] ?? '<command>'} failed (${signal ?? code}): ${err.toString('utf8').trim()}`,\n          ),\n        )\n        return\n      }\n      resolveResult({ stdout: out, stderr: err })\n    })\n    if (input) child.stdin.end(input)\n    else child.stdin.end()\n  })\n}\n\nfunction isNoEntry(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { code?: string }).code === 'ENOENT'\n  )\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { homedir, tmpdir } from 'node:os'\nimport { dirname, join, resolve, sep } from 'node:path'\nimport type { AgentCandidateWorkspaceSnapshotEvidence } from '@tangle-network/agent-interface'\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateWorkspacePort } from './types'\nimport {\n  type AgentCandidateWorkspaceArchiveLimits,\n  assertGitObjectId,\n  assertWorkspaceFilesWithinLimits,\n  type CapturedAgentCandidateWorkspace,\n  captureWorkspaceFiles,\n  decodeVerifiedWorkspaceArchive,\n  safeArchivePath,\n  type WorkspaceArchiveRepository,\n  workspaceLimits,\n} from './workspace-archive'\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  /**\n   * `working-tree` preserves tracked and unignored untracked regular files, deletions, exact modes,\n   * and the complete bounded Git index. Git-ignored files stay excluded. Requires includeRepository.\n   * The caller must hold the workspace lease against writers; observed drift fails capture.\n   * The manifest digest covers files, while the archive digest also binds HEAD and the index.\n   */\n  repositoryContents?: 'head' | 'working-tree'\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  if (\n    options.repositoryContents !== undefined &&\n    options.repositoryContents !== 'head' &&\n    options.repositoryContents !== 'working-tree'\n  ) {\n    throw new Error('candidate repositoryContents is invalid')\n  }\n  if (options.repositoryContents !== undefined && !options.includeRepository) {\n    throw new Error('candidate repositoryContents requires includeRepository')\n  }\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits, options.repositoryContents === 'working-tree')\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination, signal }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n        signal,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n  signal?: AbortSignal\n}): Promise<void> {\n  input.signal?.throwIfAborted()\n  const decoded = await decodeVerifiedWorkspaceArchive(input)\n  input.signal?.throwIfAborted()\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination, { createDestination: false })\n  input.signal?.throwIfAborted()\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    input.signal?.throwIfAborted()\n    await writeWorkspaceFiles(staging, decoded.files, input.signal)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging, input.limits, input.signal)\n    }\n    input.signal?.throwIfAborted()\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    input.signal?.throwIfAborted()\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function captureRepository(\n  requestedRoot: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  workingTree: boolean,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const requestedStats = await lstat(requestedRoot)\n  if (!requestedStats.isDirectory() || requestedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  // Capture the RESOLVED root. The property this guards is that capture starts at one real\n  // worktree root with no aliasing, which resolving satisfies directly — rejecting a symlinked\n  // prefix outright does not, and makes capture impossible on macOS, where the OS itself hands\n  // out temp paths under /var, a symlink to /private/var. Git reports a resolved path, so the\n  // worktree-root comparison below needs the resolved form on both sides.\n  const root = await realpath(requestedRoot)\n  const resolvedStats = await lstat(root)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must resolve to a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if ((await realpath(resolve(topLevel))) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const working = workingTree ? await captureRepositoryWorkingTree(root, limits) : undefined\n  const files = working?.files ?? (await readCandidateGitTreeFiles(root, headTree, {}, limits))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    if (working) {\n      const after = await readRepositoryWorkingState(root, limits)\n      if (\n        after.paths !== working.state.paths ||\n        after.index !== working.state.index ||\n        (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim() !==\n          headCommit\n      ) {\n        throw new Error('candidate repository changed during working-tree capture')\n      }\n      const presentPaths = await existingRepositoryPaths(root, after.paths, limits)\n      if (presentPaths.join('\\0') !== files.map((file) => file.path).join('\\0')) {\n        throw new Error('candidate repository files changed during working-tree capture')\n      }\n      await verifyMaterializedWorkspace(root, candidateWorkspaceManifest(files), {\n        ignoredProtectedRootEntries: ['.git'],\n        selectedPaths: files.map((file) => file.path),\n      })\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n        ...(working\n          ? {\n              workingTree: { files: working.state.files },\n            }\n          : {}),\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function readRepositoryWorkingState(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  paths: string\n  index: string\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const env = { GIT_OPTIONAL_LOCKS: '0' }\n  const listingLimit = Math.min(\n    limits.maxArchiveBytes,\n    limits.maxFiles * (limits.maxPathBytes + 256),\n  )\n  const index = new TextDecoder('utf-8', { fatal: true }).decode(\n    (\n      await runCandidateGit(root, ['ls-files', '--stage', '-z'], undefined, env, {\n        maxOutputBytes: listingLimit,\n      })\n    ).stdout,\n  )\n  const entries = index\n    .split('\\0')\n    .filter(Boolean)\n    .map((entry) => {\n      const match = /^(100644|100755) ([a-f0-9]{40}|[a-f0-9]{64}) 0\\t(.+)$/u.exec(entry)\n      if (!match)\n        throw new Error('candidate working-tree capture requires a resolved regular-file Git index')\n      const [, mode, object, path] = match\n      if (!object || !path) throw new Error('candidate Git index is invalid')\n      return {\n        path: safeArchivePath(path, limits.maxPathBytes),\n        mode: mode === '100755' ? 0o755 : 0o644,\n        object,\n      }\n    })\n  if (entries.length > limits.maxFiles) throw new Error('candidate Git index exceeds maxFiles')\n  const debugIndex = (\n    await runCandidateGit(root, ['ls-files', '--debug', '-z'], undefined, env, {\n      maxOutputBytes: listingLimit,\n    })\n  ).stdout.toString('utf8')\n  if ([...debugIndex.matchAll(/\\tflags: ([a-f0-9]+)\\n/gu)].some((match) => match[1] !== '0')) {\n    throw new Error('candidate working-tree capture does not support special Git index flags')\n  }\n  // Inspect every staged blob's size before reading any blob. A deleted or shortened working file\n  // must not conceal an oversized staged version, including highly compressible binary content.\n  const sizes = entries.length\n    ? (\n        await runCandidateGit(\n          root,\n          ['cat-file', '--batch-check'],\n          Buffer.from(entries.map((entry) => entry.object).join('\\n') + '\\n'),\n          env,\n          { maxOutputBytes: listingLimit },\n        )\n      ).stdout\n        .toString('utf8')\n        .trimEnd()\n        .split('\\n')\n    : []\n  if (sizes.length !== entries.length)\n    throw new Error('candidate Git index blob metadata is incomplete')\n  let totalBytes = 0\n  const byteLengths = entries.map((entry, index) => {\n    const match = /^([a-f0-9]{40}|[a-f0-9]{64}) blob (\\d+)$/u.exec(sizes[index] ?? '')\n    const size = Number(match?.[2])\n    if (!match || match[1] !== entry.object || !Number.isSafeInteger(size) || size < 0) {\n      throw new Error('candidate Git index blob metadata is invalid')\n    }\n    if (size > limits.maxFileBytes)\n      throw new Error(`candidate Git index file exceeds maxFileBytes: ${entry.path}`)\n    if (size > limits.maxTotalFileBytes - totalBytes)\n      throw new Error('candidate Git index exceeds maxTotalFileBytes')\n    totalBytes += size\n    return size\n  })\n  const files: Array<{ path: string; mode: number; bytes: Uint8Array }> = []\n  for (const [index, entry] of entries.entries()) {\n    const bytes = (\n      await runCandidateGit(root, ['cat-file', 'blob', entry.object], undefined, env, {\n        maxOutputBytes: limits.maxFileBytes,\n      })\n    ).stdout\n    if (bytes.byteLength !== byteLengths[index])\n      throw new Error('candidate Git index blob size changed')\n    files.push({ path: entry.path, mode: entry.mode, bytes: Uint8Array.from(bytes) })\n  }\n  files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const defaultExcludes = join(\n    process.env.XDG_CONFIG_HOME || join(homedir(), '.config'),\n    'git',\n    'ignore',\n  )\n  const excludes = new TextDecoder('utf-8', { fatal: true })\n    .decode(\n      (\n        await runCandidateGit(\n          root,\n          [\n            'config',\n            '--includes',\n            '--path',\n            '--default',\n            defaultExcludes,\n            '--get',\n            'core.excludesFile',\n          ],\n          undefined,\n          {},\n          { maxOutputBytes: limits.maxPathBytes, readUserExclusions: true },\n        )\n      ).stdout,\n    )\n    .replace(/\\n$/u, '')\n  const paths = new TextDecoder('utf-8', { fatal: true }).decode(\n    (\n      await runCandidateGit(\n        root,\n        [\n          '-c',\n          `core.excludesFile=${excludes}`,\n          'ls-files',\n          '--cached',\n          '--others',\n          '--exclude-standard',\n          '-z',\n        ],\n        undefined,\n        env,\n        { maxOutputBytes: listingLimit },\n      )\n    ).stdout,\n  )\n  for (const path of paths.split('\\0').filter(Boolean)) safeArchivePath(path, limits.maxPathBytes)\n  return { paths, index, files }\n}\n\nasync function captureRepositoryWorkingTree(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n) {\n  const state = await readRepositoryWorkingState(root, limits)\n  const selectedPaths = await existingRepositoryPaths(root, state.paths, limits)\n  const captured = await captureMaterializedWorkspace(root, {\n    ignoredProtectedRootEntries: ['.git'],\n    selectedPaths,\n    limits,\n  })\n  const files = [...captured.files].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))\n  return { state, files }\n}\n\nasync function existingRepositoryPaths(\n  root: string,\n  listing: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<string[]> {\n  const paths = [...new Set(listing.split('\\0').filter(Boolean))].sort()\n  if (paths.length > limits.maxFiles) throw new Error('candidate workspace exceeds maxFiles')\n  const selectedPaths: string[] = []\n  for (const path of paths) {\n    const safe = safeArchivePath(path, limits.maxPathBytes)\n    try {\n      await lstat(workspacePath(root, safe))\n      selectedPaths.push(safe)\n    } catch (error) {\n      if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) throw error\n    }\n  }\n  return selectedPaths\n}\n\nexport async function prepareEmptyDestination(\n  destination: string,\n  options: { createDestination?: boolean } = {},\n): Promise<void> {\n  await mkdir(options.createDestination === false ? dirname(destination) : destination, {\n    recursive: true,\n    mode: 0o700,\n  })\n  let stats\n  try {\n    stats = await lstat(destination)\n  } catch (error) {\n    if (options.createDestination === false && (error as NodeJS.ErrnoException).code === 'ENOENT')\n      return\n    throw error\n  }\n  if (!stats.isDirectory() || stats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  // A symlinked PREFIX is the OS's own doing on macOS, where temp paths live under /var, a\n  // symlink to /private/var. What must hold is that the destination itself is a real\n  // directory, which both this check and the lstat above require.\n  const resolvedDestination = await realpath(destination)\n  const resolvedStats = await lstat(resolvedDestination)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must resolve to a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  signal?: AbortSignal,\n): Promise<void> {\n  for (const file of files) {\n    signal?.throwIfAborted()\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      signal?.throwIfAborted()\n      await descriptor.writeFile(file.bytes, { signal })\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n      signal?.throwIfAborted()\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  signal?: AbortSignal,\n): Promise<void> {\n  signal?.throwIfAborted()\n  const git = async (\n    args: string[],\n    bytes?: Uint8Array,\n    options: { maxOutputBytes?: number } = {},\n  ) => {\n    signal?.throwIfAborted()\n    const result = await runCandidateGit(destination, args, bytes, {}, options)\n    signal?.throwIfAborted()\n    return result\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    signal?.throwIfAborted()\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600, signal })\n    await git([\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await git(['bundle', 'verify', bundlePath])\n    await git(['bundle', 'unbundle', bundlePath])\n    const objectType = (await git(['cat-file', '-t', repository.headCommit])).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (await git(['rev-parse', `${repository.headCommit}^{tree}`])).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await git(['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await git(['read-tree', repository.headTree])\n    if (repository.workingTree) {\n      // All staged content has passed archive limits and manifest verification before Git sees it.\n      // Rebuilding an index from explicit blobs avoids binary-patch expansion and diff configuration.\n      await git(['read-tree', '--empty'])\n      const entries: string[] = []\n      for (const file of repository.workingTree.files) {\n        const object = (\n          await git(['hash-object', '-w', '--stdin'], file.bytes, { maxOutputBytes: 256 })\n        ).stdout\n          .toString('utf8')\n          .trim()\n        assertGitObjectId(object, 'staged blob')\n        entries.push(`${file.mode === 0o755 ? '100755' : '100644'} ${object}\\t${file.path}\\0`)\n      }\n      if (entries.length)\n        await git(['update-index', '-z', '--index-info'], Buffer.from(entries.join('')))\n      const indexTree = (await git(['write-tree'])).stdout.toString('utf8').trim()\n      const observed = await readCandidateGitTreeFiles(destination, indexTree, {}, limits)\n      signal?.throwIfAborted()\n      if (\n        !Buffer.from(canonicalCandidateBytes(candidateWorkspaceManifest(observed))).equals(\n          Buffer.from(\n            canonicalCandidateBytes(candidateWorkspaceManifest(repository.workingTree.files)),\n          ),\n        )\n      )\n        throw new Error('candidate repository staged files do not match the captured index')\n      return\n    }\n\n    const status = (await git(['status', '--porcelain=v1', '--untracked-files=all'])).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport function workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n","import { createHash } from 'node:crypto'\nimport { constants } from 'node:fs'\nimport { mkdir, mkdtemp, open, realpath, rename, rm } from 'node:fs/promises'\nimport { dirname, resolve } from 'node:path'\nimport { Readable } from 'node:stream'\nimport { pipeline } from 'node:stream/promises'\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { extract, type Pack, pack } from 'tar-stream'\nimport { mapWithConcurrency } from '../runtime/util'\nimport { persistCandidateOutputArtifactStream, verifiedArtifactChunks } from './artifact-streams'\nimport { scanMaterializedWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes, canonicalCandidateDigest, deepFreezeCandidate } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\nimport {\n  type AgentCandidateWorkspaceArchiveLimits,\n  assertWorkspaceFilesWithinLimits,\n  workspaceLimits,\n  workspaceTarHeader,\n} from './workspace-archive'\nimport {\n  type CaptureAgentCandidateWorkspaceOptions,\n  prepareEmptyDestination,\n  workspacePath,\n} from './workspace-archive-local'\n\ntype WorkspaceFile = AgentCandidateWorkspaceManifestMaterial['files'][number]\n\n/**\n * Files a tree capture stores at once; each waits on a durable-store round trip of its own and on\n * four fsyncs. On drew-gtr-pro, with three 180 ms store requests per file, 64 at once\n * stored a 473-file workspace in 83 s and 110 s against 128 s and 139 s for 16 at once, in\n * alternating runs, holding the same 16 sync threads.\n */\nconst CAPTURE_FILES_AT_ONCE = 64\n\nexport interface CaptureAgentCandidateWorkspaceToArtifactsOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /**\n   * Root-relative files or directories to leave out of the capture, each by its exact path. A\n   * caller whose root holds data another capture already keeps, such as a provider's retained\n   * native session trees, or an environment it can rebuild, such as a virtualenv, names them here\n   * instead of storing them on every capture. The manifest then describes only what was kept.\n   */\n  excludedPaths?: readonly string[]\n  artifactPersistence: NonNullable<CaptureAgentCandidateWorkspaceOptions['artifactPersistence']>\n}\n\n/** Capture regular files to durable artifacts with memory bounded by the manifest and stream buffers. */\nexport async function captureAgentCandidateWorkspaceToArtifacts(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceToArtifactsOptions,\n): Promise<{ readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence }> {\n  const { outputArtifacts, executionId, signal } = options.artifactPersistence\n  if (!outputArtifacts.putStream || !outputArtifacts.readStream) {\n    throw new Error('streaming workspace persistence requires putStream and readStream')\n  }\n  if (!executionId.trim())\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  signal?.throwIfAborted()\n  const limits = workspaceLimits(options.limits)\n  const material = await scanMaterializedWorkspaceManifest(rootInput, {\n    limits,\n    signal,\n    excludedPaths: options.excludedPaths,\n  })\n  validateManifest(material, limits)\n  const root = await realpath(resolve(rootInput))\n  const manifest = canonicalCandidateBytes(material)\n  const manifestArtifact = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-manifest',\n    chunks: oneChunk(manifest),\n    maxBytes: manifest.byteLength,\n    signal,\n  })\n  const archiveArtifact = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-archive',\n    chunks: workspaceArchiveChunks(root, material, signal),\n    maxBytes: limits.maxArchiveBytes,\n    signal,\n  })\n  return Object.freeze({\n    snapshot: deepFreezeCandidate({\n      kind: 'agent-candidate-workspace-snapshot' as const,\n      digest: canonicalCandidateDigest(material),\n      material,\n      manifest: manifestArtifact,\n      archive: archiveArtifact,\n    }),\n  })\n}\n\n/**\n * A workspace stored as one content-addressed object per file plus the manifest that names them.\n *\n * Its digest is the manifest's, the same identity an archived capture of the same files has. Two\n * trees share every file they have in common, so storing one costs only the files no earlier\n * capture in the store holds: on Discovery Lab run terraform-dc-tokens-20261006d, the files a\n * director changed between two captures one to two minutes apart were 5.5 to 8.2 MB of a\n * 60 to 70 MB workspace.\n */\nexport interface AgentCandidateWorkspaceTree {\n  readonly kind: 'agent-candidate-workspace-tree'\n  /** The manifest's digest; the manifest is the object of this digest. */\n  readonly digest: Sha256Digest\n  readonly manifest: AgentCandidateArtifactRef\n  readonly files: number\n  /** The bytes of every file in the workspace. */\n  readonly bytes: number\n  /** The bytes this capture added to the store; every other file was already there. */\n  readonly storedBytes: number\n}\n\n/**\n * Store a workspace as a tree: each regular file the store does not already hold, then the\n * manifest. The store must find objects by content (`locate`) and stream them.\n */\nexport async function captureAgentCandidateWorkspaceTreeToArtifacts(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceToArtifactsOptions,\n): Promise<AgentCandidateWorkspaceTree> {\n  const { outputArtifacts, executionId, signal } = options.artifactPersistence\n  if (!outputArtifacts.putStream || !outputArtifacts.readStream || !outputArtifacts.locate) {\n    throw new Error('workspace tree persistence requires putStream, readStream and locate')\n  }\n  if (!executionId.trim())\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  signal?.throwIfAborted()\n  const limits = workspaceLimits(options.limits)\n  const material = await scanMaterializedWorkspaceManifest(rootInput, {\n    limits,\n    signal,\n    excludedPaths: options.excludedPaths,\n  })\n  validateManifest(material, limits)\n  const root = await realpath(resolve(rootInput))\n  const bytes = material.files.reduce((sum, file) => sum + file.byteLength, 0)\n  let storedBytes = 0\n  // Each file's put waits for its durable copy, so one file at a time costs a store round trip\n  // and its fsyncs per file: drew-gtr-pro's retire stored one 2 KB file per 1.8 s.\n  // Files with the same content are one object, stored once.\n  const distinct = [...new Map(material.files.map((file) => [file.sha256, file])).values()]\n  const locate = outputArtifacts.locate.bind(outputArtifacts)\n  await mapWithConcurrency(distinct, CAPTURE_FILES_AT_ONCE, async (file) => {\n    signal?.throwIfAborted()\n    const held = await locate(\n      { sha256: file.sha256, byteLength: file.byteLength },\n      signal === undefined ? undefined : { signal },\n    )\n    if (held !== undefined) return\n    const stored = await persistCandidateOutputArtifactStream(outputArtifacts, {\n      executionId,\n      purpose: 'candidate-workspace-file',\n      chunks: workspaceFileChunks(root, file, signal),\n      maxBytes: file.byteLength,\n      signal,\n    })\n    if (stored.sha256 !== file.sha256 || stored.byteLength !== file.byteLength)\n      throw new Error(`workspace file changed during capture: ${file.path}`)\n    storedBytes += file.byteLength\n  })\n  const manifestBytes = canonicalCandidateBytes(material)\n  const manifest = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-manifest',\n    chunks: oneChunk(manifestBytes),\n    maxBytes: manifestBytes.byteLength,\n    signal,\n  })\n  const digest = canonicalCandidateDigest(material)\n  if (manifest.sha256 !== digest)\n    throw new Error('candidate workspace manifest digest does not name its stored bytes')\n  return deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-tree' as const,\n    digest,\n    manifest,\n    files: material.files.length,\n    bytes,\n    storedBytes,\n  })\n}\n\n/**\n * Read a tree back by its digest and confirm the store holds every file it names. Returns the\n * manifest; reading a file is `artifacts.read` of what `locate` returns for its digest.\n */\nexport async function verifyAgentCandidateWorkspaceTree(\n  tree: Pick<AgentCandidateWorkspaceTree, 'digest' | 'manifest'>,\n  artifacts: AgentCandidateArtifactPort,\n  options: { limits?: Partial<AgentCandidateWorkspaceArchiveLimits>; signal?: AbortSignal } = {},\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  const { signal } = options\n  if (!artifacts.locate) throw new Error('workspace tree verification requires locate')\n  if (tree.manifest.sha256 !== tree.digest)\n    throw new Error('workspace tree digest does not name its manifest')\n  signal?.throwIfAborted()\n  // A durable store that holds evicted objects serves them as streams; its buffered read may refuse.\n  let bytes: Uint8Array\n  if (artifacts.readStream) {\n    const chunks: Uint8Array[] = []\n    for await (const chunk of verifiedArtifactChunks(tree.manifest, artifacts, signal))\n      chunks.push(chunk)\n    bytes = Buffer.concat(chunks)\n  } else bytes = await artifacts.read(tree.manifest)\n  verifyBytes(bytes, tree.manifest.sha256, tree.manifest.byteLength, 'workspace tree manifest')\n  const material = JSON.parse(\n    Buffer.from(bytes).toString('utf8'),\n  ) as AgentCandidateWorkspaceManifestMaterial\n  validateManifest(material, workspaceLimits(options.limits))\n  if (canonicalCandidateDigest(material) !== tree.digest)\n    throw new Error('workspace tree manifest is not canonical')\n  for (const file of material.files) {\n    signal?.throwIfAborted()\n    const held = await artifacts.locate(\n      { sha256: file.sha256, byteLength: file.byteLength },\n      signal === undefined ? undefined : { signal },\n    )\n    if (held === undefined) throw new Error(`workspace tree file is not in the store: ${file.path}`)\n  }\n  return material\n}\n\nexport interface AgentCandidateWorkspaceArtifactsOptions {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  artifacts: AgentCandidateArtifactPort\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  signal?: AbortSignal\n}\n\n/** Verify durable regular-file workspace evidence without retaining archive or file contents. */\nexport async function verifyAgentCandidateWorkspaceArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions,\n): Promise<void> {\n  await consumeWorkspaceArtifacts(input)\n}\n\n/** Read selected files only after the existing verifier has accepted the entire archive. */\nexport async function readAgentCandidateWorkspaceArtifactFiles(\n  input: AgentCandidateWorkspaceArtifactsOptions & {\n    readonly paths: readonly string[]\n    readonly maxReadBytes: number\n  },\n): Promise<ReadonlyMap<string, Uint8Array>> {\n  if (!Number.isSafeInteger(input.maxReadBytes) || input.maxReadBytes < 0)\n    throw new Error('workspace selective read requires a non-negative safe maxReadBytes')\n  const selected = new Map<string, Uint8Array[]>()\n  const files = new Map(input.snapshot.material.files.map((file) => [file.path, file]))\n  let bytes = 0\n  for (const path of input.paths) {\n    if (selected.has(path)) throw new Error('workspace selective read repeats a path')\n    const file = files.get(path)\n    if (!file) throw new Error(`workspace selective read names a missing file: ${path}`)\n    bytes += file.byteLength\n    if (!Number.isSafeInteger(bytes) || bytes > input.maxReadBytes)\n      throw new Error('workspace selective read exceeds maxReadBytes')\n    selected.set(path, [])\n  }\n  await consumeWorkspaceArtifacts(input, undefined, selected)\n  return new Map([...selected].map(([path, chunks]) => [path, Buffer.concat(chunks)]))\n}\n\n/** Restore regular files into an empty destination after complete verification; paths selects a subset. */\nexport async function materializeAgentCandidateWorkspaceFromArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions & {\n    destination: string\n    paths?: readonly string[]\n  },\n): Promise<void> {\n  input.signal?.throwIfAborted()\n  if (!input.artifacts.readStream)\n    throw new Error('streaming workspace artifacts require readStream')\n  const paths = input.paths === undefined ? undefined : new Set(input.paths)\n  if (paths && paths.size !== input.paths?.length)\n    throw new Error('workspace selection must name unique manifest files')\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await consumeWorkspaceArtifacts(input, staging, undefined, paths)\n    input.signal?.throwIfAborted()\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function consumeWorkspaceArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions,\n  destination?: string,\n  selected?: Map<string, Uint8Array[]>,\n  paths?: ReadonlySet<string>,\n): Promise<void> {\n  const { artifacts, signal } = input\n  const snapshot = deepFreezeCandidate(structuredClone(input.snapshot))\n  signal?.throwIfAborted()\n  if (!artifacts.readStream) throw new Error('streaming workspace artifacts require readStream')\n  const limits = workspaceLimits(input.limits)\n  validateManifest(snapshot.material, limits)\n  if (paths) {\n    const files = new Set(snapshot.material.files.map((file) => file.path))\n    if ([...paths].some((path) => !files.has(path)))\n      throw new Error('workspace selection must name unique manifest files')\n  }\n  if (snapshot.archive.byteLength > limits.maxArchiveBytes)\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  const manifest = canonicalCandidateBytes(snapshot.material)\n  verifyBytes(\n    manifest,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (canonicalCandidateDigest(snapshot.material) !== snapshot.digest)\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  let offset = 0\n  for await (const chunk of verifiedArtifactChunks(snapshot.manifest, artifacts, signal)) {\n    if (\n      !Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength).equals(\n        manifest.subarray(offset, offset + chunk.byteLength),\n      )\n    ) {\n      throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n    }\n    offset += chunk.byteLength\n  }\n\n  const parser = extract()\n  const canonical = pack()\n  const canonicalResult = digestChunks(canonical, limits.maxArchiveBytes, signal)\n  // Both drains start before writing, so tar-stream's backpressure bounds every queue.\n  const reading = pipeline(\n    Readable.from(verifiedArtifactChunks(snapshot.archive, artifacts, signal)),\n    parser as unknown as NodeJS.WritableStream,\n    { signal },\n  )\n  reading.catch(() => undefined)\n  canonicalResult.catch(() => undefined)\n  try {\n    let index = 0\n    for await (const entry of parser) {\n      signal?.throwIfAborted()\n      const expected = snapshot.material.files[index++]\n      if (\n        !expected ||\n        entry.header.type !== 'file' ||\n        entry.header.name !== `workspace/${expected.path}` ||\n        entry.header.mode !== expected.mode ||\n        entry.header.size !== expected.byteLength\n      ) {\n        throw new Error('candidate workspace archive does not match its snapshot manifest')\n      }\n      const file =\n        destination && (!paths || paths.has(expected.path))\n          ? await openDestination(destination, expected.path)\n          : undefined\n      try {\n        async function* checked(): AsyncGenerator<Uint8Array> {\n          const hash = createHash('sha256')\n          let byteLength = 0\n          for await (const chunk of entry) {\n            if (!(chunk instanceof Uint8Array))\n              throw new Error('workspace entry emitted a non-byte chunk')\n            signal?.throwIfAborted()\n            byteLength += chunk.byteLength\n            if (byteLength > expected!.byteLength)\n              throw new Error('workspace entry exceeds its manifest length')\n            hash.update(chunk)\n            if (file) await file.writeFile(chunk)\n            selected?.get(expected!.path)?.push(Uint8Array.from(chunk))\n            yield chunk\n          }\n          if (\n            byteLength !== expected!.byteLength ||\n            `sha256:${hash.digest('hex')}` !== expected!.sha256\n          ) {\n            throw new Error('candidate workspace archive does not match its snapshot manifest')\n          }\n        }\n        await appendTarFile(canonical, expected, checked(), signal)\n        if (file) await file.chmod(expected.mode)\n      } finally {\n        await file?.close()\n      }\n    }\n    if (index !== snapshot.material.files.length)\n      throw new Error('candidate workspace archive does not match its snapshot manifest')\n    await reading\n    canonical.finalize()\n    const observed = await canonicalResult\n    if (\n      observed.byteLength !== snapshot.archive.byteLength ||\n      observed.sha256 !== snapshot.archive.sha256\n    ) {\n      throw new Error('candidate workspace tar is not canonical')\n    }\n  } catch (error) {\n    parser.destroy(asError(error))\n    canonical.destroy(asError(error))\n    await Promise.allSettled([reading, canonicalResult])\n    throw error\n  }\n}\n\nasync function openDestination(destination: string, relativePath: string) {\n  const path = workspacePath(destination, relativePath)\n  await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n  return open(\n    path,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n    0o600,\n  )\n}\n\nasync function* workspaceArchiveChunks(\n  root: string,\n  material: AgentCandidateWorkspaceManifestMaterial,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  const archive = pack()\n  const writing = (async () => {\n    try {\n      for (const file of material.files) {\n        signal?.throwIfAborted()\n        await appendTarFile(archive, file, workspaceFileChunks(root, file, signal), signal)\n      }\n      archive.finalize()\n    } catch (error) {\n      archive.destroy(asError(error))\n      throw error\n    }\n  })()\n  writing.catch(() => undefined)\n  try {\n    for await (const chunk of archive) {\n      if (!(chunk instanceof Uint8Array))\n        throw new Error('workspace archive emitted a non-byte chunk')\n      signal?.throwIfAborted()\n      yield chunk\n    }\n    await writing\n  } finally {\n    archive.destroy()\n    await writing.catch(() => undefined)\n  }\n}\n\nasync function* workspaceFileChunks(\n  root: string,\n  expected: WorkspaceFile,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  const path = workspacePath(root, expected.path)\n  if ((await realpath(path)) !== path)\n    throw new Error(`workspace file path changed during capture: ${expected.path}`)\n  const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW)\n  try {\n    const stats = await file.stat()\n    if (\n      !stats.isFile() ||\n      stats.nlink !== 1 ||\n      stats.size !== expected.byteLength ||\n      (stats.mode & 0o777) !== expected.mode\n    ) {\n      throw new Error(`workspace file changed during capture: ${expected.path}`)\n    }\n    const hash = createHash('sha256')\n    let byteLength = 0\n    for await (const chunk of file.createReadStream({\n      autoClose: false,\n      highWaterMark: 64 * 1024,\n    })) {\n      signal?.throwIfAborted()\n      byteLength += chunk.byteLength\n      if (byteLength > expected.byteLength)\n        throw new Error(`workspace file changed during capture: ${expected.path}`)\n      hash.update(chunk)\n      yield chunk\n    }\n    if (byteLength !== expected.byteLength || `sha256:${hash.digest('hex')}` !== expected.sha256) {\n      throw new Error(`workspace file changed during capture: ${expected.path}`)\n    }\n  } finally {\n    await file.close()\n  }\n}\n\nasync function appendTarFile(\n  archive: Pack,\n  file: WorkspaceFile,\n  chunks: AsyncIterable<Uint8Array>,\n  signal?: AbortSignal,\n): Promise<void> {\n  const entry = archive.entry(\n    workspaceTarHeader(`workspace/${file.path}`, file.mode, file.byteLength),\n  )\n  await pipeline(Readable.from(chunks), entry as unknown as NodeJS.WritableStream, { signal })\n}\n\nasync function digestChunks(\n  chunks: AsyncIterable<unknown>,\n  maxBytes: number,\n  signal?: AbortSignal,\n) {\n  const hash = createHash('sha256')\n  let byteLength = 0\n  for await (const chunk of chunks) {\n    if (!(chunk instanceof Uint8Array))\n      throw new Error('workspace archive emitted a non-byte chunk')\n    signal?.throwIfAborted()\n    byteLength += chunk.byteLength\n    if (byteLength > maxBytes)\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    hash.update(chunk)\n  }\n  return { sha256: `sha256:${hash.digest('hex')}`, byteLength }\n}\n\nfunction validateManifest(\n  material: AgentCandidateWorkspaceManifestMaterial,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (material.kind !== 'agent-candidate-workspace-manifest')\n    throw new Error('candidate workspace has an invalid manifest kind')\n  assertWorkspaceFilesWithinLimits(material.files, limits)\n}\n\nasync function* oneChunk(bytes: Uint8Array): AsyncGenerator<Uint8Array> {\n  yield bytes\n}\nfunction asError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error))\n}\n"],"mappings":";;;;;;;;;;;;;;;AACA,SAAgB,oBAAoB,OAAwB;CAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;;;ACKA,SAAgBA,cAAY,OAAiC;CAC3D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAClE;AAEA,SAAgBC,2BAAyB,OAA8B;CACrE,OAAOD,cAAYE,0BAAwB,KAAK,CAAC;AACnD;;AAGA,SAAgB,wBAA2B,OAAa;CACtD,OAAO,oBACL,KAAK,MAAM,OAAO,KAAKA,0BAAwB,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,CACzE;AACF;AAEA,SAAgB,2BACd,oBAC+B;CAC/B,MAAM,QAAQA,0BAAwB,kBAAkB;CACxD,MAAM,SAASF,cAAY,KAAK;CAChC,MAAM,QAAQ,oBAAoB;EAChC,GAAG,KAAK,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC;EACjD;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;EACA;CACF,CAAC;AACH;AAEA,SAAgB,iCACd,OACA,OACG;CACH,IAAIC,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAChE,MAAM,IAAI,MAAM,GAAG,MAAM,uBAAuB;CAElD,OAAO,wBAAwB,KAAK;AACtC;AAEA,SAAgB,0BAA0B,OAAmD;CAC3F,OAAO;EACL,UAAU;EACV,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC7C,QAAQD,cAAY,KAAK;EACzB,YAAY,MAAM;CACpB;AACF;AAEA,SAAgB,mBACd,OACmB;CACnB,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;CACrC,OAAO;AACT;AAEA,SAAgB,oBAAuB,OAAU,uBAAO,IAAI,IAAY,GAAM;CAC5E,IACE,UAAU,QACV,OAAO,UAAU,YACjB,YAAY,OAAO,KAAK,KACxB,KAAK,IAAI,KAAe,GAExB,OAAO;CAET,KAAK,IAAI,KAAe;CACxB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAgC,GAChE,oBAAoB,OAAO,IAAI;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC5B;;;ACvEA,gBAAuB,uBACrB,UACA,MACA,QAC4B;CAC5B,QAAQ,eAAe;CACvB,IAAI,EAAE,aAAa,aAAa,CAAC,KAAK,YACpC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,MAAM,SACJ,aAAa,WACT,CAAC,OAAO,KAAK,SAAS,SAAS,QAAQ,CAAC,IACxC,KAAK,WAAY,UAAU,EAAE,OAAO,CAAC;CAC3C,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,QAAQ,eAAe;EACvB,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,6CAA6C;EAC/D,cAAc,MAAM;EACpB,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,gDAAgD;EAClE,KAAK,OAAO,KAAK;EACjB,MAAM;CACR;CACA,QAAQ,eAAe;CACvB,IAAI,eAAe,SAAS,cAAc,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAS,QACpF,MAAM,IAAI,MAAM,yDAAyD;AAE7E;AAEA,MAAM,oCAAoB,IAAI,QAAwB;;;;;;AAOtD,SAAgB,sBAAsB,WAAmB,YAA0B;CACjF,kBAAkB,IAAI,WAAW,UAAU;AAC7C;;AAGA,SAAgB,oBAAoB,MAAiD;CACnF,OACE,KAAK,cAAc,KAAA,KACnB,KAAK,eAAe,KAAA,KACpB,kBAAkB,IAAI,KAAK,SAAS,MAAM,KAAK;AAEnD;;AAGA,eAAsB,qCACpB,MACA,OAOoC;CACpC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAC3B,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,QAAQ,eAAe;CAC7B,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,IAAI,WAAW;CACf,gBAAgB,UAAsC;EACpD,WAAW,MAAM,SAAS,MAAM,QAAQ;GACtC,MAAM,QAAQ,eAAe;GAC7B,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,6CAA6C;GAC/D,cAAc,MAAM;GACpB,IAAI,aAAa,MAAM,UACrB,MAAM,IAAI,MAAM,qDAAqD;GACvE,KAAK,OAAO,KAAK;GACjB,MAAM;EACR;EACA,WAAW;EACX,MAAM,QAAQ,eAAe;CAC/B;CACA,MAAM,SAAS,QAAQ;CACvB,IAAI;EACF,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,UAAU;GACnB,aAAa,MAAM;GACnB,SAAS,MAAM;GACf;GACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EACjD,CAAC,CACH;EACA,MAAM,QAAQ,eAAe;EAC7B,IACE,CAAC,YACD,IAAI,WAAW,UAAU,KAAK,OAAO,KAAK,OAC1C,IAAI,eAAe,YAEnB,MAAM,IAAI,MAAM,gEAAgE;EAKlF,IAAI,CAAC,oBAAoB,IAAI,GAC3B,WAAW,MAAM,UAAU,uBAAuB,KAAK,MAAM,MAAM,MAAM;EAI3E,OAAO,wBAAwB,GAAG;CACpC,UAAU;EACR,MAAM,OAAO,OAAO,KAAA,CAAS;CAC/B;AACF;;AC9GA,SAAgB,iBAAiB,UAAkD;CACjF,OAAO,GAAG,SAAS,OAAO,GAAG,SAAS;AACxC;AAEA,eAAsB,qBACpB,UACA,MACqB;CACrB,MAAM,QACJ,aAAa,WACT,OAAO,KAAK,SAAS,SAAS,QAAQ,IACtC,MAAM,KAAK,KAAK,QAAqC;CAC3D,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,oBAAoB;CAC7E,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,SAAgB,YACd,OACA,QACA,YACA,OACM;CACN,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,GAAG,MAAM,eAAe,MAAM,WAAW,kBAAkB,YAAY;CAEzF,MAAM,SAASG,cAAY,KAAK;CAChC,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,GAAG,MAAM,UAAU,OAAO,kBAAkB,QAAQ;AAExE;AAEA,eAAsB,iCACpB,UACA,MACwD;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,qBAAqB,SAAS,UAAU,IAAI,GAC5C,qBAAqB,SAAS,SAAS,IAAI,CAC7C,CAAC;CACD,MAAM,oBAAoBC,0BAAwB,SAAS,QAAQ;CACnE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,iBAAiB,CAAC,GAC9D,MAAM,IAAI,MAAM,0EAA0E;CAE5F,IAAID,cAAY,iBAAiB,MAAM,SAAS,QAC9C,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;EAAE;EAAU;CAAQ;AAC7B;;AAUA,IAAa,0BAAb,cAA6C,MAAM,CAAC;;;;;;;;AAkCpD,eAAsB,4BACpB,MACA,UACA,UAAgD,CAAC,GAClC;CACf,wBAAwB,MAAM,kCAAkC,MAAM,OAAO,GAAG,QAAQ;AAC1F;;;;;;;;;;AAWA,eAAsB,kCACpB,MACA,UAAgC,CAAC,GACiB;CAClD,OAAO,6BAA6B,MAAM,cAAc,MAAM,SAAS,KAAK,CAAC;AAC/E;AAYA,eAAsB,6BACpB,MACA,UAAmC,CAAC,GAInC;CACD,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,IAAI;CACvD,OAAO;EACL,UAAU,6BAA6B,OAAO;EAC9C,OAAO,QAAQ,KAAK,WAAW;GAC7B,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,WAAW,KAAK,cAAc,KAAK,CAAC;EAC7C,EAAE;CACJ;AACF;;AAGA,eAAsB,+BACpB,MACA,UACA,UAAgC,CAAC,GAC0C;CAC3E,MAAM,WAAW,MAAM,6BAA6B,MAAM,OAAO;CACjE,wBAAwB,SAAS,UAAU,QAAQ;CACnD,OAAO,SAAS,MAAM,KAAK,SACzB,OAAO,OAAO;EAAE,MAAM,KAAK;EAAM,MAAM,KAAK;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CACxF;AACF;;;;;;AAOA,SAAgB,2BACd,OACA,UAAsC,CAAC,GACE;CACzC,OAAO,6BACL,MAAM,KAAK,UAAU;EACnB,MAAM,KAAK;EACX,MAAM,QAAQ,iBAAiB,OAAO,iBAAiB,KAAK,IAAI,IAAI,KAAK;EACzE,QAAQA,cAAY,KAAK,KAAK;EAC9B,YAAY,KAAK,MAAM;CACzB,EAAE,CACJ;AACF;AAEA,SAAS,6BACP,SAMyC;CACzC,OAAO;EACL,MAAM;EACN,OAAO,QACJ,KAAK,WAAW;GACf,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,YAAY,MAAM;EACpB,EAAE,CAAC,CACF,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACpE;AACF;;AAGA,SAAS,iBAAiB,MAAsB;CAC9C,QAAQ,OAAO,QAAW,IAAI,MAAQ;AACxC;AAEA,SAAS,cAAc,OAAsC;CAC3D,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,kDAAkD,MAAM,MAAM;CAChG,OAAO,MAAM;AACf;AAEA,SAAS,wBACP,UACA,UACM;CACN,IAAI,OAAO,KAAKC,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAAOA,0BAAwB,QAAQ,CAAC,GACzF;CAMF,IACE,OAAO,KAAKA,0BAAwB,kBAAkB,QAAQ,CAAC,CAAC,CAAC,CAAC,OAChEA,0BAAwB,kBAAkB,QAAQ,CAAC,CACrD,GAEA,MAAM,IAAI,MACR,uJAEF;CAEF,MAAM,IAAI,MAAM,gFAAgF;AAClG;AAEA,SAAS,kBACP,UACyC;CACzC,OAAO;EACL,GAAG;EACH,OAAO,SAAS,MAAM,KAAK,UAAU;GAAE,GAAG;GAAM,MAAM,iBAAiB,KAAK,IAAI;EAAE,EAAE;CACtF;AACF;AAEA,eAAsB,mCACpB,MACA,UACA,WAAkC,aACnB;CAEf,MAAM,mBAAkB,MADD,kCAAkC,IAAI,EAAA,CAC5B,MAAM,KAAK,EAAE,MAAM,MAAM,cAAc;EACtE,SAAS;EACT;EACA,eAAe;CACjB,EAAE;CACF,MAAM,gBAAgB,SAAS,MAC5B,QAAQ,UAAU,KAAK,QAAQ,iBAAiB,QAAQ,CAAC,CACzD,KAAK,EAAE,MAAM,OAAO,GAAG,WAAW,IAAI;CACzC,IACE,CAAC,OAAO,KAAKA,0BAAwB,eAAe,CAAC,CAAC,CAAC,OACrDA,0BAAwB,aAAa,CACvC,GAEA,MAAM,IAAI,MACR,WAAW,SAAS,qEACtB;AAEJ;AAWA,eAAe,cACb,MACA,SACA,WACkC;CAClC,MAAM,8BAA8B,IAAI,IAAY,QAAQ,+BAA+B,CAAC,CAAC;CAC7F,MAAM,WAAW,IAAI,IAAI,QAAQ,iBAAiB,CAAC,CAAC;CACpD,KAAK,MAAM,QAAQ,UACjB,IACE,CAAC,QACD,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,WAAW,IAAI,KACf,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAErE,MAAM,IAAI,MAAM,sDAAsD;CAG1E,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW,QAAQ,gBAAgB,IAAI,IAAI,QAAQ,aAAa,IAAI,KAAA;CAC1E,MAAM,sCAAsB,IAAI,IAAY;CAC5C,KAAK,MAAM,QAAQ,YAAY,CAAC,GAAG;EACjC,IACE,CAAC,QACD,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,WAAW,IAAI,KACf,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAErE,MAAM,IAAI,MAAM,2DAA2D;EAE7E,IAAI,SAAS,QAAQ,IAAI;EACzB,OAAO,WAAW,KAAK;GACrB,oBAAoB,IAAI,MAAM;GAC9B,SAAS,QAAQ,MAAM;EACzB;CACF;CAMA,MAAM,gBAAgB,QAAQ,IAAI;CAClC,MAAM,YAAY,MAAM,MAAM,aAAa;CAC3C,IAAI,CAAC,UAAU,YAAY,KAAK,UAAU,eAAe,GACvD,MAAM,IAAI,MAAM,yCAAyC;CAE3D,MAAM,eAAe,MAAM,SAAS,aAAa;CACjD,MAAM,gBAAgB,MAAM,MAAM,YAAY;CAC9C,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,UAAmC,CAAC;CAC1C,IAAI,aAAa;CAEjB,eAAe,MAAM,WAAkC;EACrD,QAAQ,QAAQ,eAAe;EAC/B,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAChE,QAAQ,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;EACvE,KAAK,MAAM,SAAS,SAAS;GAC3B,QAAQ,QAAQ,eAAe;GAC/B,IAAI,cAAc,gBAAgB,4BAA4B,IAAI,MAAM,IAAI,GAC1E;GAEF,IACE,QAAQ,uBAAuB,SAC7B,MAAM,YAAY,KAAK,MAAM,SAAS,iBACrC,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,MAAM,IAE/C;GAEF,MAAM,WAAW,QAAQ,WAAW,MAAM,IAAI;GAC9C,MAAM,UAAU,SAAS,cAAc,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;GACpE,IAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,KAAK,QAAQ,SAAS,MAAM,GAClE,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,IAAI,SAAS,IAAI,OAAO,GAAG;GAC3B,IAAI,YAAY,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,oBAAoB,IAAI,OAAO,GAAG;GAC7E,MAAM,QAAQ,MAAM,MAAM,QAAQ;GAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,MAAM,eAAe,UAAU,SAAS,YAAY,CAAC;GAEvE,IAAI,MAAM,YAAY,GAAG;IACvB,IAAI,UAAU,IAAI,OAAO,GACvB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IACtE,MAAM,MAAM,QAAQ;IACpB;GACF;GACA,IAAI,CAAC,MAAM,OAAO,GAChB,MAAM,IAAI,MAAM,2CAA2C,SAAS;GAEtE,IAAI,UAAU,QAAQ,UAAU,OAAO,UACrC,MAAM,IAAI,wBAAwB,4BAA4B;GAEhE,MAAM,aAAa,MAAM,KACvB,UACAC,UAAY,YACT,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,EAC3E;GACA,IAAI;IACF,MAAM,cAAc,MAAM,WAAW,KAAK;IAC1C,IAAI,CAAC,YAAY,OAAO,GACtB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IAEtE,IAAI,YAAY,UAAU,GACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS;IAErE,MAAM,OACJ,QAAQ,iBAAiB,OACrB,iBAAiB,YAAY,IAAI,IACjC,YAAY,OAAO;IACzB,IAAI,UAAU,YAAY,OAAO,OAAO,cACtC,MAAM,IAAI,wBAAwB,wCAAwC,SAAS;IAErF,MAAM,iBAAiB,SAAS,OAAO,oBAAoB,aAAa,KAAA;IACxE,IAAI,mBAAmB,KAAA,KAAa,YAAY,OAAO,gBACrD,MAAM,IAAI,wBAAwB,qCAAqC;IAEzE,MAAM,OAAO,MAAM,kBACjB,YACA,SAAS,KAAK,IAAI,OAAO,cAAc,kBAAkB,OAAO,YAAY,IAAI,KAAA,GAChF,WACA,SACA,QAAQ,MACV;IACA,cAAc,KAAK;IACnB,QAAQ,KAAK;KACX,MAAM;KACN;KACA,QAAQ,KAAK;KACb,YAAY,KAAK;KACjB,GAAI,KAAK,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM;IAC1D,CAAC;GACH,UAAU;IACR,MAAM,WAAW,MAAM;GACzB;EACF;CACF;CAEA,MAAM,MAAM,YAAY;CACxB,IAAI,YAAY,QAAQ,WAAW,SAAS,MAC1C,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO;AACT;;;;;;;;;;AAWA,eAAe,eACb,UACA,SACA,cACiB;CACjB,MAAM,SAAS,MAAM,SAAS,QAAQ;CACtC,IAAI,WAAW,MAAM,GACnB,OAAO,2CAA2C,QAAQ,MAAM;CAElE,IAAI,CAAC,SAAS,cAAc,QAAQ,QAAQ,QAAQ,GAAG,MAAM,CAAC,GAC5D,OAAO,uDAAuD,QAAQ,MAAM;CAE9E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,SAAS,QAAQ;CACpC,QAAQ;EACN,OAAO,6CAA6C,QAAQ,MAAM;CACpE;CACA,IAAI,CAAC,SAAS,cAAc,QAAQ,GAClC,OAAO,gEAAgE,QAAQ,MAAM;CAEvF,OAAO,iCAAiC,QAAQ,MAAM;AACxD;AAEA,SAAS,SAAS,MAAc,MAAuB;CACrD,OAAO,SAAS,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAK;AACzD;;;;;;;;;;AAWA,eAAe,kBACb,YACA,UACA,WACA,MACA,QACuE;CACvE,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,SAAS,OAAO,YAAY,OAAW;CAC7C,MAAM,SAAmB,CAAC;CAC1B,IAAI,QAAQ;CACZ,OAAO,MAAM;EACX,QAAQ,eAAe;EACvB,MAAM,EAAE,cAAc,MAAM,WAAW,KAAK,QAAQ,GAAG,OAAO,YAAY,IAAI;EAC9E,IAAI,cAAc,GAAG;EACrB,SAAS;EACT,IAAI,aAAa,KAAA,KAAa,QAAQ,UACpC,MAAM,IAAI,wBAAwB,6CAA6C,MAAM;EAEvF,MAAM,QAAQ,OAAO,SAAS,GAAG,SAAS;EAC1C,KAAK,OAAO,KAAK;EAEjB,IAAI,WAAW,OAAO,KAAK,OAAO,KAAK,KAAK,CAAC;CAC/C;CACA,MAAM,SAAS,UAAU,KAAK,OAAO,KAAK;CAC1C,OAAO,YACH;EAAE;EAAQ,YAAY;EAAO,OAAO,OAAO,OAAO,QAAQ,KAAK;CAAE,IACjE;EAAE;EAAQ,YAAY;CAAM;AAClC;;;AC7fA,SAAgB,sBACd,OACA,UACA,OACA,WAA8B,CAAC,GACzB;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,0BAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,IAAI,QAAQ,SAAS,SAAS,SAAS,SAAS,QAC9C,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B,KAAK;CAEjF,KAAK,MAAM,OAAO,UAChB,IAAI,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAM,GAAG,MAAM,oBAAoB,KAAK;AAE3E;;;;;;AAOA,SAAgB,oBAAoB,OAAwB;CAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;;;AC7BA,eAAsB,+BACpB,MACA,OAMoC;CACpC,MAAM,QAAQ,eAAe;CAC7B,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,MAAM,iBAAiBC,cAAY,KAAK;CACxC,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,IAAI;EACb,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,WAAW,KAAK,KAAK;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;CACjD,CAAC,CACH;CACA,MAAM,QAAQ,eAAe;CAC7B,IAAI,IAAI,WAAW,kBAAkB,IAAI,eAAe,MAAM,YAC5D,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;CAClC,MAAM,QAAQ,eAAe;CAC7B,YAAY,QAAQ,gBAAgB,MAAM,YAAY,4BAA4B;CAClF,OAAO,wBAAwB,GAAG;AACpC;;AChBA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB;CACjB,0BAA0B;CAC1B,UAAU;CACV,cAAc;CACd,mBAAmB;CACnB,cAAc;CACd,0BAA0B;AAC5B,CAAC;;AAoCD,eAAsB,oCACpB,OACA,UAGI,CAAC,GACqC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAsB,sBACpB,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAWC,0BAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;AAYA,eAAsB,+BAA+B,OAKhB;CACnC,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,OAAO;AACT;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,gBAAgB,WAAW,cAC7BD,0BAAwB,2BAA2B,WAAW,YAAY,KAAK,CAAC,IAChF,KAAA;CACJ,MAAM,WAAWA,0BAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;EACA,GAAI,gBACA,EACE,aAAa,EACX,eAAe;GACb,QAAQE,cAAY,aAAa;GACjC,YAAY,cAAc;EAC5B,EACF,EACF,IACA,CAAC;CACP,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;CAClF,IAAI,WAAW,eAAe,eAAe;EAC3C,MAAM,cAAc,SAAS,sBAAsB,KAAO,aAAa;EACvE,KAAK,MAAM,QAAQ,WAAW,YAAY,OACxC,MAAM,cAAc,SAAS,GAAG,wBAAwB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE9F;AACF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,aAA+C,CAAC;CACtD,MAAM,6BAAa,IAAI,IAAY;CACnC,IAAI;CACJ,IAAI,aAAa;CACjB,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,MAAM;GACpE,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OAAO,IAAI,SAAS,sBAAsB;IACxC,IAAI,MAAM,OAAO,SAAS,OAAS,iBACjC,MAAM,IAAI,MAAM,yDAAyD;IAE3E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,kBAAkB,MAAM,aACtB,OACA,OAAO,iBACP,8BACF;IACA,sBAAsB,gBAAgB;GACxC,OAAO,IAAI,KAAK,WAAW,qBAAqB,GAAG;IACjD,IACE,CAAC,oBAAoB,eACrB,CAAC,mBACD,WAAW,UAAU,OAAO,UAE5B,MAAM,IAAI,MAAM,gEAAgE;IAElF,MAAM,OAAO,gBAAgB,KAAK,MAAM,CAA4B,GAAG,OAAO,YAAY;IAC1F,IAAI,MAAM,OAAO,SAAS,OAAS,MAAM,OAAO,SAAS,KACvD,MAAM,IAAI,MAAM,kDAAkD;IAEpE,yBACE,MACA,mBACA,YACA,qDACF;IACA,oBAAoB;IACpB,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,IACE,MAAM,OAAO,SAAS,KAAA,KACtB,MAAM,OAAO,OAAO,OAAO,oBAAoB,YAE/C,MAAM,IAAI,MAAM,+CAA+C;IAEjE,IAAI,MAAM,OAAO,OAAO,OAAO,cAC7B,MAAM,IAAI,MAAM,0CAA0C;IAC5D,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,cAAc,UAAU;IACxB,WAAW,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GACrE,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,IAAI,QAAQ,oBAAoB,WAAW,MAAM,QAAQ,eAAe,GACtE,MAAM,IAAI,MAAM,qEAAqE;EAEvF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,kBAAkB,iBAAiB,UAAU,IACnF,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,QACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,CAAC,CAAC,mCAAmC,6CAA6C,CAAC,CAAC,SAClF,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CACpC,KACA,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,OAAO,0BAE7C,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAKF,0BAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,IAAI;CACJ,IAAI,iBAAiB,OAAO;EAC1B,MAAM,UAAU,MAAM;EACtB,IACE,CAAC,SAAS,OAAO,KACjB,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,GAAG,MAAM,mBACnC,CAAC,SAAS,QAAQ,aAAa,KAC/B,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBACxD,OAAO,QAAQ,cAAc,WAAW,YACxC,CAAC,wBAAwB,KAAK,QAAQ,cAAc,MAAM,KAC1D,CAAC,OAAO,cAAc,QAAQ,cAAc,UAAU,KACrD,QAAQ,cAAc,aAAwB,KAC9C,QAAQ,cAAc,aAAwB,OAAO,iBAEtD,MAAM,IAAI,MAAM,yDAAyD;EAE3E,cAAc,EACZ,eAAe;GACb,QAAQ,QAAQ,cAAc;GAC9B,YAAY,QAAQ,cAAc;EACpC,EACF;CACF;CACA,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;EACA,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CACvC;AACF;AAEA,SAAS,kBACP,UACA,QACA,eACA,YAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,IAAI,SAAS,eAAe,eAAe;EACzC,YACE,eACA,SAAS,YAAY,cAAc,QACnC,SAAS,YAAY,cAAc,YACnC,8BACF;EACA,IACE,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAC1B,OAAO,KAAKA,0BAAwB,2BAA2B,UAAU,CAAC,CAAC,CAC7E,GAEA,MAAM,IAAI,MAAM,8DAA8D;CAElF;CACA,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;EAC5C,GAAI,SAAS,eAAe,gBAAgB,EAAE,aAAa,EAAE,OAAO,WAAW,EAAE,IAAI,CAAC;CACxF;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN,mBAAmB,MAAM,MAAM,MAAM,UAAU,GAC/C,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAIA,eAAe,aAAa,OAAiB,UAAkB,OAAoC;CACjG,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgBA,0BAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACEC,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAKD,0BAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAgB,iCACd,OAGA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,WAAW,QAAQ,gBAAgB,MACrC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAC1E,MAAM,aAAa,WAAW,OAAO,KAAK,MAAM,aAAa,KAAK;EAClE,IAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,KAAK,aAAa,OAAO,cAC7E,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc;EACd,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAgB,gBACd,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAgB,gBAAgB,OAAgB,cAA8B;CAC5E,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAgB,yBACd,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAgB,kBAAkB,OAAe,OAAqB;CACpE,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY;;AAGvE,SAAgB,mBAAmB,MAAc,MAAc,MAAc;CAC3E,OAAO;EACL;EACA;EACA,KAAK;EACL,KAAK;EACL;EACA,OAAO;EACP,MAAM;EACN,OAAO;EACP,OAAO;CACT;AACF;;ACryBA,eAAsB,oBACpB,MACA,cACA,YAC6B;CAC7B,IAAI,KAAK,SAAS,YAAY,OAAO,KAAA;CACrC,MAAM,iBAAiB,MAAM,uBAAuB,KAAK,YAAY,YAAY;CACjF,MAAM,wBAAwB,gBAAgB,KAAK,YAAY,KAAK,QAAQ;CAE5E,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,eAAe,gBAAgB,KAAK,QAAQ;EAClD,OAAO,KAAK;CACd;CACA,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CAEtF,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;CACtE,IAAI;EACF,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,KAAK,QAAQ,GAAG,KAAA,GAAW,EAC7E,gBAAgB,UAClB,CAAC;EACD,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,YACA,EAAE,gBAAgB,UAAU,CAC9B;EACA,MAAM,iBACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,EAC/D,gBAAgB,UAClB,CAAC,EAAA,CACD,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,kBAAkB,KAAK,eACzB,MAAM,IAAI,MACR,+BAA+B,cAAc,kBAAkB,KAAK,eACtE;EAEF,MAAM,eAAe,gBAAgB,aAAa;EAClD,OAAO;CACT,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAsB,4BACpB,UACA,cACqB;CACrB,MAAM,iBAAiB,MAAM,uBAAuB,SAAS,YAAY,YAAY;CAMrF,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM,SAAS;CAAM,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UACjB,MAAM,IAAI,MAAM,kDAAkD,SAAS,QAAQ;CAErF,MAAM,WACJ,MAAM,gBAAgB,gBAAgB;EAAC;EAAW;EAAM,SAAS;EAAQ;EAAM,SAAS;CAAI,CAAC,EAAA,CAC7F;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,EAAE,SAAS,SAAS,MACxD,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAEhF,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACvE,MAAM,IAAI,MAAM,mDAAmD,SAAS,MAAM;CAEpF,MAAM,SAAS,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAQ,MAAM;CAAM,CAAC,EAAA,CAAG;CAC1F,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,mBAAmB,SAAS,MAAM;CAC3F,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,eAAsB,mBACpB,UACA,UACe;CACf,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK;CAC/F,IAAI,SAAS,SAAS,YACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,kBAAkB,SAAS,YAAY;CAEpF,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OACtE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,2BAA2B,KAAK,kBAAkB,SAAS,UAAU;AAEzF;;;;;AAMA,eAAsB,uBAAuB,OAOa;CACxD,MAAM,iBAAiB,QAAQ,MAAM,cAAc;CACnD,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,MAAM,SAAS,SACZ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,uBAAuB,gBAAgB,QAAQ,iBAAiB;CAEtE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC/E,IAAI;EACF,MAAM,kBAAkB,KAAK,WAAW,SAAS;EACjD,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,MAAM,eAAe;EAC3B,MAAM,iBAAiB;GACrB,gBAAgB;GAChB,sBAAsB;GACtB,kCAAkC,KAAK,QAAQ,SAAS;EAC1D;EACA,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,MAAM,QAAQ,GAAG,KAAA,GAAW,cAAc;EAC9F,IAAI,MAAM,MAAM,aAAa,GAC3B,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,MAAM,OACN,cACF;EAEF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,cAAc,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,eAAe,MAAM,YACvB,MAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB,MAAM,YAC7E;EAEF,MAAM,eAAe,gBAAgB,YAAY,cAAc;EAC/D,MAAM,WAAW,MAAM,6BAA6B,gBAAgB,YAAY,cAAc;EAC9F,IACE,CAAC,OAAO,KAAKG,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAC9C,OAAO,KAAKA,0BAAwB,MAAM,UAAU,CAAC,CACvD,GAEA,MAAM,IAAI,MAAM,sEAAsE;EAExF,MAAM,gBACJ,MAAM,gBACJ,gBACA;GAAC;GAAe;GAAY;GAAM,MAAM;EAAU,GAClD,OAAO,KAAK,4BAA4B,MAAM,GAC9C;GACE,GAAG;GACH,iBAAiB;GACjB,kBAAkB;GAClB,iBAAiB;GACjB,oBAAoB;GACpB,qBAAqB;GACrB,oBAAoB;EACtB,CACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EAWR,KATE,MAAM,gBACJ,gBACA,CAAC,aAAa,GAAG,aAAa,QAAQ,GACtC,KAAA,GACA,cACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KACa,MAAM,YACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;GAAE;GAAY;EAAa;CACpC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,YACA,cACiB;CACjB,MAAM,iBAAiB,QAAQ,MAAM,aAAa,QAAQ,UAAU,CAAC;CAErE,IAAI,EAAC,MADmB,KAAK,cAAc,EAAA,CAC5B,YAAY,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAE5F,MAAM,UAAU,MAAM,gBAAgB,gBAAgB;EAAC;EAAU;EAAW;CAAQ,CAAC,EAAA,CAAG,OACrF,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,SAAS,kBAAkB,MAAM;CACvC,IAAI,CAAC,UAAU,OAAO,UAAU,WAAW,SAAS,OAAO,SAAS,WAAW,MAC7E,MAAM,IAAI,MACR,2BAA2B,UAAU,YAAY,6BAA6B,WAAW,MAAM,GAAG,WAAW,MAC/G;CAGF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CAER,MAAM,uBAAuB,gBADd,QAAQ,UAC2B,GAAG,sBAAsB;CAC3E,OAAO;AACT;AAEA,eAAsB,uBACpB,gBACA,QACA,OACe;CAMf,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAgB;EAAuB;CAAc,CAAC,EAAA,CAC7F,OACC,SAAS,MAAM,CAAC,CAChB,KACY,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CAMtE,MAAM,YAAY,MAAM,SACtB,QACE,iBACC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,kBAAkB,CAAC,EAAA,CAAG,OACxE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV,CACF;CACA,IAAI,UAAU,SAAS,GAAG,GACxB,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,8BAAc,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC,GAClD,KAAK,MAAM,QAAQ,CAAC,cAAc,iBAAiB,GAAG;EACpD,MAAM,OAAO,KAAK,YAAY,WAAW,QAAQ,IAAI;EACrD,IAAI;GAEF,KAAI,MADmB,SAAS,MAAM,MAAM,EAAA,CAC/B,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,MAAM;EAC5E,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;AAEJ;AAEA,eAAe,wBACb,gBACA,QACA,cACe;CAIf,KAHc,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM;CAAM,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACI,MAAM,UAAU,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CACzF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,GAAG,OAAO,QAAQ,CAAC,EAAA,CACvE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,eAAe,cACjB,MAAM,IAAI,MAAM,8BAA8B,WAAW,kBAAkB,cAAc;AAE7F;AAEA,eAAe,eACb,gBACA,MACA,cAAsC,CAAC,GACxB;CACf,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAO;EAAe;CAAI,GACtC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,MAAM,oCAAoC;CAC9E,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MACR,kEAAkE,MAAM,MAC1E;EAEF,kBAAkB,MAAM,IAAI;CAC9B;AACF;AAEA,eAAe,6BACb,gBACA,MACA,aACkD;CAClD,OAAO,2BACL,MAAM,0BAA0B,gBAAgB,MAAM,WAAW,CACnE;AACF;AAEA,eAAsB,0BACpB,gBACA,MACA,cAAsC,CAAC,GACvC,QAC0E;CAC1E,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAQ;EAAe;CAAI,GACvC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,QAAyE,CAAC;CAChF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,UAAU,QAAQ,SAAS,OAAO,UACpC,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,aAAa;CACjB,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MAAM,mDAAmD,MAAM,MAAM;EAEjF,kBAAkB,MAAM,IAAI;EAC5B,IAAI,MAAM,SAAS,KAAA,GACjB,MAAM,IAAI,MAAM,4CAA4C,MAAM,MAAM;EAE1E,IAAI,UAAU,MAAM,OAAO,OAAO,cAChC,MAAM,IAAI,MAAM,iDAAiD,MAAM,MAAM;EAE/E,cAAc,MAAM;EACpB,IAAI,UAAU,aAAa,OAAO,mBAChC,MAAM,IAAI,MAAM,8CAA8C;EAEhE,MAAM,SACJ,MAAM,gBACJ,gBACA;GAAC;GAAY;GAAQ,MAAM;EAAM,GACjC,KAAA,GACA,WACF,EAAA,CACA;EACF,IAAI,MAAM,eAAe,MAAM,MAC7B,MAAM,IAAI,MAAM,oCAAoC,MAAM,MAAM;EAElE,MAAM,KAAK;GACT,MAAM,MAAM;GACZ,MAAM,MAAM,SAAS,WAAW,MAAQ;GACxC,OAAO,WAAW,KAAK,KAAK;EAC9B,CAAC;CACH;CACA,OAAO,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;AACnG;AAEA,SAAS,iBAAiB,OAMvB;CACD,MAAM,MAAM,OAAO,KAAK,KAAK;CAC7B,MAAM,UAAU,IAAI,SAAS,MAAM;CACnC,IAAI,CAAC,OAAO,KAAK,SAAS,MAAM,CAAC,CAAC,OAAO,GAAG,GAC1C,MAAM,IAAI,MAAM,8CAA8C;CAGhE,OADa,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAC9B,CAAC,CAAC,KAAK,QAAQ;EACvB,MAAM,MAAM,IAAI,QAAQ,GAAI;EAC5B,MAAM,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAC1D,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;EAC9B,MAAM,CAAC,MAAM,MAAM,QAAQ,YAAY;EACvC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAC3C,MAAM,IAAI,MAAM,0BAA0B;EAE5C,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,IAAI,KAAA;EACrE,IAAI,SAAS,KAAA,KAAa,CAAC,OAAO,cAAc,IAAI,GAClD,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GAAE;GAAM;GAAM;GAAQ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GAAI;EAAK;CAC7E,CAAC;AACH;AAEA,SAAS,kBAAkB,MAAoB;CAC7C,IACE,CAAC,QACD,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,oBAAoB,IAAI,KACxB,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACrE,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,MAAM,QAEtC,MAAM,IAAI,MAAM,+CAA+C,MAAM;AAEzE;AAEA,SAAS,kBAAkB,OAA4D;CACrF,MAAM,QAAQ,MAAM,MAClB,sGACF;CACA,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,OAAO,KAAA;CACrC,OAAO;EAAE,OAAO,MAAM;EAAI,MAAM,MAAM;CAAG;AAC3C;AAEA,eAAsB,gBACpB,gBACA,MACA,OACA,WAAmC,CAAC,GACpC,UAAqE,CAAC,GAClD;CACpB,IACE,QAAQ,uBACP,KAAK,WAAW,KACf,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,wCAC/B,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,4BAE9B,MAAM,IAAI,MAAM,qEAAqE;CAEvF,IACE,QAAQ,mBAAmB,KAAA,MAC1B,CAAC,OAAO,cAAc,QAAQ,cAAc,KAAK,QAAQ,iBAAiB,IAE3E,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,WAAW,MAAM,CAAC,CACzE;CACA,OAAO,OAAO,KAAK;EACjB,qBAAqB;EACrB,mBAAmB;EACnB,mBAAmB;EACnB,qBAAqB;EACrB,wBAAwB;EACxB,QAAQ;EACR,GAAG;CACL,CAAC;CAGD,IAAI,QAAQ,oBACV,KAAK,MAAM,QAAQ;EAAC;EAAqB;EAAqB;CAAqB,GAAG;EACpF,OAAO,IAAI;EACX,IAAI,QAAQ,IAAI,UAAU,KAAA,GAAW,IAAI,QAAQ,QAAQ,IAAI;CAC/D;CAEF,MAAM,WAAW;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL;CACA,OAAO,MAAM,IAAI,SAAS,eAAe,WAAW;EAClD,MAAM,QAAQ,MAAM,OAAO,UAAU;GAAE;GAAK,OAAO;IAAC;IAAQ;IAAQ;GAAM;EAAE,CAAC;EAC7E,MAAM,SAAmB,CAAC;EAC1B,MAAM,SAAmB,CAAC;EAC1B,IAAI,cAAc;EAClB,IAAI,WAAW;EACf,SAAS,OAAO,QAAkB,OAAqB;GACrD,IAAI,UAAU;GACd,eAAe,MAAM;GACrB,IAAI,QAAQ,mBAAmB,KAAA,KAAa,cAAc,QAAQ,gBAAgB;IAChF,WAAW;IACX,MAAM,KAAK,SAAS;IACpB;GACF;GACA,OAAO,KAAK,KAAK;EACnB;EACA,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,QAAQ,KAAK,CAAC;EAChE,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,QAAQ,KAAK,CAAC;EAChE,MAAM,GAAG,SAAS,MAAM;EACxB,MAAM,MAAM,GAAG,SAAS,MAAM;EAC9B,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,IAAI,UAAU;IACZ,uBAAO,IAAI,MAAM,8CAA8C,CAAC;IAChE;GACF;GACA,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,IAAI,SAAS,GAAG;IACd,uBACE,IAAI,MACF,OAAO,KAAK,MAAM,YAAY,WAAW,UAAU,KAAK,KAAK,IAAI,SAAS,MAAM,CAAC,CAAC,KAAK,GACzF,CACF;IACA;GACF;GACA,cAAc;IAAE,QAAQ;IAAK,QAAQ;GAAI,CAAC;EAC5C,CAAC;EACD,IAAI,OAAO,MAAM,MAAM,IAAI,KAAK;OAC3B,MAAM,MAAM,IAAI;CACvB,CAAC;AACH;AAEA,SAAS,UAAU,OAAyB;CAC1C,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS;AAE1C;;;AC9dA,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,IACE,QAAQ,uBAAuB,KAAA,KAC/B,QAAQ,uBAAuB,UAC/B,QAAQ,uBAAuB,gBAE/B,MAAM,IAAI,MAAM,yCAAyC;CAE3D,IAAI,QAAQ,uBAAuB,KAAA,KAAa,CAAC,QAAQ,mBACvD,MAAM,IAAI,MAAM,yDAAyD;CAE3E,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,QAAQ,QAAQ,uBAAuB,cAAc,IACnF,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAa7C,OAAO,OAAO,OAAO,EAXnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,aAAa,aAAa;EACvE,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAOhC;CAChB,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,MAAM,+BAA+B,KAAK;CAC1D,MAAM,QAAQ,eAAe;CAC7B,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,aAAa,EAAE,mBAAmB,MAAM,CAAC;CACvE,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,QAAQ,eAAe;EAC7B,MAAM,oBAAoB,SAAS,QAAQ,OAAO,MAAM,MAAM;EAC9D,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,SAAS,MAAM,QAAQ,MAAM,MAAM;EAErF,MAAM,QAAQ,eAAe;EAC7B,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,QAAQ,eAAe;EAC7B,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM;CACR;AACF;AAEA,eAAe,kBACb,eACA,QACA,aAIC;CACD,MAAM,iBAAiB,MAAM,MAAM,aAAa;CAChD,IAAI,CAAC,eAAe,YAAY,KAAK,eAAe,eAAe,GACjE,MAAM,IAAI,MAAM,oDAAoD;CAOtE,MAAM,OAAO,MAAM,SAAS,aAAa;CACzC,MAAM,gBAAgB,MAAM,MAAM,IAAI;CACtC,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,4DAA4D;CAE9E,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAK,MAAM,SAAS,QAAQ,QAAQ,CAAC,MAAO,MAC1C,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,UAAU,cAAc,MAAM,6BAA6B,MAAM,MAAM,IAAI,KAAA;CACjF,MAAM,QAAQ,SAAS,SAAU,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CAC3F,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,IAAI,SAAS;GACX,MAAM,QAAQ,MAAM,2BAA2B,MAAM,MAAM;GAC3D,IACE,MAAM,UAAU,QAAQ,MAAM,SAC9B,MAAM,UAAU,QAAQ,MAAM,UAC7B,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,MAChF,YAEF,MAAM,IAAI,MAAM,0DAA0D;GAG5E,KAAI,MADuB,wBAAwB,MAAM,MAAM,OAAO,MAAM,EAAA,CAC3D,KAAK,IAAI,MAAM,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,GACtE,MAAM,IAAI,MAAM,gEAAgE;GAElF,MAAM,4BAA4B,MAAM,2BAA2B,KAAK,GAAG;IACzE,6BAA6B,CAAC,MAAM;IACpC,eAAe,MAAM,KAAK,SAAS,KAAK,IAAI;GAC9C,CAAC;EACH;EACA,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQC,cAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;IACA,GAAI,UACA,EACE,aAAa,EAAE,OAAO,QAAQ,MAAM,MAAM,EAC5C,IACA,CAAC;GACP;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,2BACb,MACA,QAKC;CACD,MAAM,MAAM,EAAE,oBAAoB,IAAI;CACtC,MAAM,eAAe,KAAK,IACxB,OAAO,iBACP,OAAO,YAAY,OAAO,eAAe,IAC3C;CACA,MAAM,QAAQ,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,QAEpD,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAW;CAAI,GAAG,KAAA,GAAW,KAAK,EACzE,gBAAgB,aAClB,CAAC,EAAA,CACD,MACJ;CACA,MAAM,UAAU,MACb,MAAM,IAAI,CAAC,CACX,OAAO,OAAO,CAAC,CACf,KAAK,UAAU;EACd,MAAM,QAAQ,yDAAyD,KAAK,KAAK;EACjF,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,2EAA2E;EAC7F,MAAM,GAAG,MAAM,QAAQ,QAAQ;EAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,IAAI,MAAM,gCAAgC;EACtE,OAAO;GACL,MAAM,gBAAgB,MAAM,OAAO,YAAY;GAC/C,MAAM,SAAS,WAAW,MAAQ;GAClC;EACF;CACF,CAAC;CACH,IAAI,QAAQ,SAAS,OAAO,UAAU,MAAM,IAAI,MAAM,sCAAsC;CAM5F,IAAI,CAAC,IAJH,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAW;CAAI,GAAG,KAAA,GAAW,KAAK,EACzE,gBAAgB,aAClB,CAAC,EAAA,CACD,OAAO,SAAS,MACD,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC,CAAC,MAAM,UAAU,MAAM,OAAO,GAAG,GACvF,MAAM,IAAI,MAAM,yEAAyE;CAI3F,MAAM,QAAQ,QAAQ,UAEhB,MAAM,gBACJ,MACA,CAAC,YAAY,eAAe,GAC5B,OAAO,KAAK,QAAQ,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,GAClE,KACA,EAAE,gBAAgB,aAAa,CACjC,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,QAAQ,CAAC,CACT,MAAM,IAAI,IACb,CAAC;CACL,IAAI,MAAM,WAAW,QAAQ,QAC3B,MAAM,IAAI,MAAM,iDAAiD;CACnE,IAAI,aAAa;CACjB,MAAM,cAAc,QAAQ,KAAK,OAAO,UAAU;EAChD,MAAM,QAAQ,4CAA4C,KAAK,MAAM,UAAU,EAAE;EACjF,MAAM,OAAO,OAAO,QAAQ,EAAE;EAC9B,IAAI,CAAC,SAAS,MAAM,OAAO,MAAM,UAAU,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,GAC/E,MAAM,IAAI,MAAM,8CAA8C;EAEhE,IAAI,OAAO,OAAO,cAChB,MAAM,IAAI,MAAM,kDAAkD,MAAM,MAAM;EAChF,IAAI,OAAO,OAAO,oBAAoB,YACpC,MAAM,IAAI,MAAM,+CAA+C;EACjE,cAAc;EACd,OAAO;CACT,CAAC;CACD,MAAM,QAAkE,CAAC;CACzE,KAAK,MAAM,CAAC,OAAO,UAAU,QAAQ,QAAQ,GAAG;EAC9C,MAAM,SACJ,MAAM,gBAAgB,MAAM;GAAC;GAAY;GAAQ,MAAM;EAAM,GAAG,KAAA,GAAW,KAAK,EAC9E,gBAAgB,OAAO,aACzB,CAAC,EAAA,CACD;EACF,IAAI,MAAM,eAAe,YAAY,QACnC,MAAM,IAAI,MAAM,uCAAuC;EACzD,MAAM,KAAK;GAAE,MAAM,MAAM;GAAM,MAAM,MAAM;GAAM,OAAO,WAAW,KAAK,KAAK;EAAE,CAAC;CAClF;CACA,MAAM,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACrE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,kBAAkB,KACtB,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS,GACxD,OACA,QACF;CACA,MAAM,WAAW,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CACvD,QAEG,MAAM,gBACJ,MACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,KAAA,GACA,CAAC,GACD;EAAE,gBAAgB,OAAO;EAAc,oBAAoB;CAAK,CAClE,EAAA,CACA,MACJ,CAAC,CACA,QAAQ,QAAQ,EAAE;CACrB,MAAM,QAAQ,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,QAEpD,MAAM,gBACJ,MACA;EACE;EACA,qBAAqB;EACrB;EACA;EACA;EACA;EACA;CACF,GACA,KAAA,GACA,KACA,EAAE,gBAAgB,aAAa,CACjC,EAAA,CACA,MACJ;CACA,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,OAAO,GAAG,gBAAgB,MAAM,OAAO,YAAY;CAC/F,OAAO;EAAE;EAAO;EAAO;CAAM;AAC/B;AAEA,eAAe,6BACb,MACA,QACA;CACA,MAAM,QAAQ,MAAM,2BAA2B,MAAM,MAAM;CAQ3D,OAAO;EAAE;EAAO,OADF,CAAC,IAAG,MALK,6BAA6B,MAAM;GACxD,6BAA6B,CAAC,MAAM;GACpC,qBAH0B,wBAAwB,MAAM,MAAM,OAAO,MAAM;GAI3E;EACF,CAAC,EAAA,CAC0B,KAAK,CAAC,CAAC,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAC3E;CAAE;AACxB;AAEA,eAAe,wBACb,MACA,SACA,QACmB;CACnB,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK;CACrE,IAAI,MAAM,SAAS,OAAO,UAAU,MAAM,IAAI,MAAM,sCAAsC;CAC1F,MAAM,gBAA0B,CAAC;CACjC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,MAAM,OAAO,YAAY;EACtD,IAAI;GACF,MAAM,MAAM,cAAc,MAAM,IAAI,CAAC;GACrC,cAAc,KAAK,IAAI;EACzB,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,WAAW,MAAM;EACrF;CACF;CACA,OAAO;AACT;AAEA,eAAsB,wBACpB,aACA,UAA2C,CAAC,GAC7B;CACf,MAAM,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,WAAW,IAAI,aAAa;EACpF,WAAW;EACX,MAAM;CACR,CAAC;CACD,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,MAAM,WAAW;CACjC,SAAS,OAAO;EACd,IAAI,QAAQ,sBAAsB,SAAU,MAAgC,SAAS,UACnF;EACF,MAAM;CACR;CACA,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,GAC/C,MAAM,IAAI,MAAM,0DAA0D;CAK5E,MAAM,sBAAsB,MAAM,SAAS,WAAW;CACtD,MAAM,gBAAgB,MAAM,MAAM,mBAAmB;CACrD,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACA,QACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,QAAQ,eAAe;EACvB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAC,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,QAAQ,eAAe;GACvB,MAAM,WAAW,UAAU,KAAK,OAAO,EAAE,OAAO,CAAC;GACjD,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;GAChC,QAAQ,eAAe;EACzB,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACA,QACA,QACe;CACf,QAAQ,eAAe;CACvB,MAAM,MAAM,OACV,MACA,OACA,UAAuC,CAAC,MACrC;EACH,QAAQ,eAAe;EACvB,MAAM,SAAS,MAAM,gBAAgB,aAAa,MAAM,OAAO,CAAC,GAAG,OAAO;EAC1E,QAAQ,eAAe;EACvB,OAAO;CACT;CACA,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,QAAQ,eAAe;EACvB,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;GAAO;EAAO,CAAC;EACxF,MAAM,IAAI;GACR;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,IAAI;GAAC;GAAU;GAAU;EAAU,CAAC;EAC1C,MAAM,IAAI;GAAC;GAAU;GAAY;EAAU,CAAC;EAI5C,KAHoB,MAAM,IAAI;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAAG,OACvE,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAIxF,KAHsB,MAAM,IAAI,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CAAG,OAChF,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,IAAI;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EACrE,MAAM,IAAI,CAAC,aAAa,WAAW,QAAQ,CAAC;EAC5C,IAAI,WAAW,aAAa;GAG1B,MAAM,IAAI,CAAC,aAAa,SAAS,CAAC;GAClC,MAAM,UAAoB,CAAC;GAC3B,KAAK,MAAM,QAAQ,WAAW,YAAY,OAAO;IAC/C,MAAM,UACJ,MAAM,IAAI;KAAC;KAAe;KAAM;IAAS,GAAG,KAAK,OAAO,EAAE,gBAAgB,IAAI,CAAC,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;IACR,kBAAkB,QAAQ,aAAa;IACvC,QAAQ,KAAK,GAAG,KAAK,SAAS,MAAQ,WAAW,SAAS,GAAG,OAAO,IAAI,KAAK,KAAK,GAAG;GACvF;GACA,IAAI,QAAQ,QACV,MAAM,IAAI;IAAC;IAAgB;IAAM;GAAc,GAAG,OAAO,KAAK,QAAQ,KAAK,EAAE,CAAC,CAAC;GAEjF,MAAM,WAAW,MAAM,0BAA0B,cAD9B,MAAM,IAAI,CAAC,YAAY,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KACR,GAAW,CAAC,GAAG,MAAM;GACnF,QAAQ,eAAe;GACvB,IACE,CAAC,OAAO,KAAKC,0BAAwB,2BAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,OAC1E,OAAO,KACLA,0BAAwB,2BAA2B,WAAW,YAAY,KAAK,CAAC,CAClF,CACF,GAEA,MAAM,IAAI,MAAM,mEAAmE;GACrF;EACF;EAKA,KAHgB,MAAM,IAAI;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CAAG,OAC/E,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAgB,cAAc,MAAc,cAA8B;CACxE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;;;;;;;;ACliBA,MAAM,wBAAwB;;AAe9B,eAAsB,0CACpB,WACA,SACyE;CACzE,MAAM,EAAE,iBAAiB,aAAa,WAAW,QAAQ;CACzD,IAAI,CAAC,gBAAgB,aAAa,CAAC,gBAAgB,YACjD,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,YAAY,KAAK,GACpB,MAAM,IAAI,MAAM,kEAAkE;CACpF,QAAQ,eAAe;CACvB,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,MAAM,kCAAkC,WAAW;EAClE;EACA;EACA,eAAe,QAAQ;CACzB,CAAC;CACD,iBAAiB,UAAU,MAAM;CACjC,MAAM,OAAO,MAAM,SAAS,QAAQ,SAAS,CAAC;CAC9C,MAAM,WAAWC,0BAAwB,QAAQ;CACjD,MAAM,mBAAmB,MAAM,qCAAqC,iBAAiB;EACnF;EACA,SAAS;EACT,QAAQ,SAAS,QAAQ;EACzB,UAAU,SAAS;EACnB;CACF,CAAC;CACD,MAAM,kBAAkB,MAAM,qCAAqC,iBAAiB;EAClF;EACA,SAAS;EACT,QAAQ,uBAAuB,MAAM,UAAU,MAAM;EACrD,UAAU,OAAO;EACjB;CACF,CAAC;CACD,OAAO,OAAO,OAAO,EACnB,UAAU,oBAAoB;EAC5B,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAC,EACH,CAAC;AACH;;;;;AA2BA,eAAsB,8CACpB,WACA,SACsC;CACtC,MAAM,EAAE,iBAAiB,aAAa,WAAW,QAAQ;CACzD,IAAI,CAAC,gBAAgB,aAAa,CAAC,gBAAgB,cAAc,CAAC,gBAAgB,QAChF,MAAM,IAAI,MAAM,sEAAsE;CAExF,IAAI,CAAC,YAAY,KAAK,GACpB,MAAM,IAAI,MAAM,kEAAkE;CACpF,QAAQ,eAAe;CACvB,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,MAAM,kCAAkC,WAAW;EAClE;EACA;EACA,eAAe,QAAQ;CACzB,CAAC;CACD,iBAAiB,UAAU,MAAM;CACjC,MAAM,OAAO,MAAM,SAAS,QAAQ,SAAS,CAAC;CAC9C,MAAM,QAAQ,SAAS,MAAM,QAAQ,KAAK,SAAS,MAAM,KAAK,YAAY,CAAC;CAC3E,IAAI,cAAc;CAIlB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,SAAS,MAAM,KAAK,SAAS,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;CACxF,MAAM,SAAS,gBAAgB,OAAO,KAAK,eAAe;CAC1D,MAAM,mBAAmB,UAAU,uBAAuB,OAAO,SAAS;EACxE,QAAQ,eAAe;EAKvB,IAAI,MAJe,OACjB;GAAE,QAAQ,KAAK;GAAQ,YAAY,KAAK;EAAW,GACnD,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C,MACa,KAAA,GAAW;EACxB,MAAM,SAAS,MAAM,qCAAqC,iBAAiB;GACzE;GACA,SAAS;GACT,QAAQ,oBAAoB,MAAM,MAAM,MAAM;GAC9C,UAAU,KAAK;GACf;EACF,CAAC;EACD,IAAI,OAAO,WAAW,KAAK,UAAU,OAAO,eAAe,KAAK,YAC9D,MAAM,IAAI,MAAM,0CAA0C,KAAK,MAAM;EACvE,eAAe,KAAK;CACtB,CAAC;CACD,MAAM,gBAAgBD,0BAAwB,QAAQ;CACtD,MAAM,WAAW,MAAM,qCAAqC,iBAAiB;EAC3E;EACA,SAAS;EACT,QAAQ,SAAS,aAAa;EAC9B,UAAU,cAAc;EACxB;CACF,CAAC;CACD,MAAM,SAASC,2BAAyB,QAAQ;CAChD,IAAI,SAAS,WAAW,QACtB,MAAM,IAAI,MAAM,oEAAoE;CACtF,OAAO,oBAAoB;EACzB,MAAM;EACN;EACA;EACA,OAAO,SAAS,MAAM;EACtB;EACA;CACF,CAAC;AACH;;;;;AAMA,eAAsB,kCACpB,MACA,WACA,UAA4F,CAAC,GAC3C;CAClD,MAAM,EAAE,WAAW;CACnB,IAAI,CAAC,UAAU,QAAQ,MAAM,IAAI,MAAM,6CAA6C;CACpF,IAAI,KAAK,SAAS,WAAW,KAAK,QAChC,MAAM,IAAI,MAAM,kDAAkD;CACpE,QAAQ,eAAe;CAEvB,IAAI;CACJ,IAAI,UAAU,YAAY;EACxB,MAAM,SAAuB,CAAC;EAC9B,WAAW,MAAM,SAAS,uBAAuB,KAAK,UAAU,WAAW,MAAM,GAC/E,OAAO,KAAK,KAAK;EACnB,QAAQ,OAAO,OAAO,MAAM;CAC9B,OAAO,QAAQ,MAAM,UAAU,KAAK,KAAK,QAAQ;CACjD,YAAY,OAAO,KAAK,SAAS,QAAQ,KAAK,SAAS,YAAY,yBAAyB;CAC5F,MAAM,WAAW,KAAK,MACpB,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,MAAM,CACpC;CACA,iBAAiB,UAAU,gBAAgB,QAAQ,MAAM,CAAC;CAC1D,IAAIA,2BAAyB,QAAQ,MAAM,KAAK,QAC9C,MAAM,IAAI,MAAM,0CAA0C;CAC5D,KAAK,MAAM,QAAQ,SAAS,OAAO;EACjC,QAAQ,eAAe;EAKvB,IAAI,MAJe,UAAU,OAC3B;GAAE,QAAQ,KAAK;GAAQ,YAAY,KAAK;EAAW,GACnD,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C,MACa,KAAA,GAAW,MAAM,IAAI,MAAM,4CAA4C,KAAK,MAAM;CACjG;CACA,OAAO;AACT;;AAWA,eAAsB,uCACpB,OACe;CACf,MAAM,0BAA0B,KAAK;AACvC;;AAGA,eAAsB,yCACpB,OAI0C;CAC1C,IAAI,CAAC,OAAO,cAAc,MAAM,YAAY,KAAK,MAAM,eAAe,GACpE,MAAM,IAAI,MAAM,oEAAoE;CACtF,MAAM,2BAAW,IAAI,IAA0B;CAC/C,MAAM,QAAQ,IAAI,IAAI,MAAM,SAAS,SAAS,MAAM,KAAK,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;CACpF,IAAI,QAAQ;CACZ,KAAK,MAAM,QAAQ,MAAM,OAAO;EAC9B,IAAI,SAAS,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,yCAAyC;EACjF,MAAM,OAAO,MAAM,IAAI,IAAI;EAC3B,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kDAAkD,MAAM;EACnF,SAAS,KAAK;EACd,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,MAAM,cAChD,MAAM,IAAI,MAAM,+CAA+C;EACjE,SAAS,IAAI,MAAM,CAAC,CAAC;CACvB;CACA,MAAM,0BAA0B,OAAO,KAAA,GAAW,QAAQ;CAC1D,OAAO,IAAI,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,CAAC;AACrF;;AAGA,eAAsB,gDACpB,OAIe;CACf,MAAM,QAAQ,eAAe;CAC7B,IAAI,CAAC,MAAM,UAAU,YACnB,MAAM,IAAI,MAAM,kDAAkD;CACpE,MAAM,QAAQ,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,IAAI,IAAI,MAAM,KAAK;CACzE,IAAI,SAAS,MAAM,SAAS,MAAM,OAAO,QACvC,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,0BAA0B,OAAO,SAAS,KAAA,GAAW,KAAK;EAChE,MAAM,QAAQ,eAAe;EAC7B,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM;CACR;AACF;AAEA,eAAe,0BACb,OACA,aACA,UACA,OACe;CACf,MAAM,EAAE,WAAW,WAAW;CAC9B,MAAM,WAAW,oBAAoB,gBAAgB,MAAM,QAAQ,CAAC;CACpE,QAAQ,eAAe;CACvB,IAAI,CAAC,UAAU,YAAY,MAAM,IAAI,MAAM,kDAAkD;CAC7F,MAAM,SAAS,gBAAgB,MAAM,MAAM;CAC3C,iBAAiB,SAAS,UAAU,MAAM;CAC1C,IAAI,OAAO;EACT,MAAM,QAAQ,IAAI,IAAI,SAAS,SAAS,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;EACtE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,GAC5C,MAAM,IAAI,MAAM,qDAAqD;CACzE;CACA,IAAI,SAAS,QAAQ,aAAa,OAAO,iBACvC,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,WAAWD,0BAAwB,SAAS,QAAQ;CAC1D,YACE,UACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IAAIC,2BAAyB,SAAS,QAAQ,MAAM,SAAS,QAC3D,MAAM,IAAI,MAAM,0EAA0E;CAC5F,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,uBAAuB,SAAS,UAAU,WAAW,MAAM,GAAG;EACtF,IACE,CAAC,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC,CAAC,OAC7D,SAAS,SAAS,QAAQ,SAAS,MAAM,UAAU,CACrD,GAEA,MAAM,IAAI,MAAM,0EAA0E;EAE5F,UAAU,MAAM;CAClB;CAEA,MAAM,SAAS,QAAQ;CACvB,MAAM,YAAY,KAAK;CACvB,MAAM,kBAAkB,aAAa,WAAW,OAAO,iBAAiB,MAAM;CAE9E,MAAM,UAAU,SACd,SAAS,KAAK,uBAAuB,SAAS,SAAS,WAAW,MAAM,CAAC,GACzE,QACA,EAAE,OAAO,CACX;CACA,QAAQ,YAAY,KAAA,CAAS;CAC7B,gBAAgB,YAAY,KAAA,CAAS;CACrC,IAAI;EACF,IAAI,QAAQ;EACZ,WAAW,MAAM,SAAS,QAAQ;GAChC,QAAQ,eAAe;GACvB,MAAM,WAAW,SAAS,SAAS,MAAM;GACzC,IACE,CAAC,YACD,MAAM,OAAO,SAAS,UACtB,MAAM,OAAO,SAAS,aAAa,SAAS,UAC5C,MAAM,OAAO,SAAS,SAAS,QAC/B,MAAM,OAAO,SAAS,SAAS,YAE/B,MAAM,IAAI,MAAM,kEAAkE;GAEpF,MAAM,OACJ,gBAAgB,CAAC,SAAS,MAAM,IAAI,SAAS,IAAI,KAC7C,MAAM,gBAAgB,aAAa,SAAS,IAAI,IAChD,KAAA;GACN,IAAI;IACF,gBAAgB,UAAsC;KACpD,MAAM,OAAO,WAAW,QAAQ;KAChC,IAAI,aAAa;KACjB,WAAW,MAAM,SAAS,OAAO;MAC/B,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,0CAA0C;MAC5D,QAAQ,eAAe;MACvB,cAAc,MAAM;MACpB,IAAI,aAAa,SAAU,YACzB,MAAM,IAAI,MAAM,6CAA6C;MAC/D,KAAK,OAAO,KAAK;MACjB,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK;MACpC,UAAU,IAAI,SAAU,IAAI,CAAC,EAAE,KAAK,WAAW,KAAK,KAAK,CAAC;MAC1D,MAAM;KACR;KACA,IACE,eAAe,SAAU,cACzB,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAU,QAE7C,MAAM,IAAI,MAAM,kEAAkE;IAEtF;IACA,MAAM,cAAc,WAAW,UAAU,QAAQ,GAAG,MAAM;IAC1D,IAAI,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;GAC1C,UAAU;IACR,MAAM,MAAM,MAAM;GACpB;EACF;EACA,IAAI,UAAU,SAAS,SAAS,MAAM,QACpC,MAAM,IAAI,MAAM,kEAAkE;EACpF,MAAM;EACN,UAAU,SAAS;EACnB,MAAM,WAAW,MAAM;EACvB,IACE,SAAS,eAAe,SAAS,QAAQ,cACzC,SAAS,WAAW,SAAS,QAAQ,QAErC,MAAM,IAAI,MAAM,0CAA0C;CAE9D,SAAS,OAAO;EACd,OAAO,QAAQ,QAAQ,KAAK,CAAC;EAC7B,UAAU,QAAQ,QAAQ,KAAK,CAAC;EAChC,MAAM,QAAQ,WAAW,CAAC,SAAS,eAAe,CAAC;EACnD,MAAM;CACR;AACF;AAEA,eAAe,gBAAgB,aAAqB,cAAsB;CACxE,MAAM,OAAO,cAAc,aAAa,YAAY;CACpD,MAAM,MAAM,QAAQ,IAAI,GAAG;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CAC3D,OAAO,KACL,MACA,UAAU,WAAW,UAAU,UAAU,UAAU,SAAS,UAAU,YACtE,GACF;AACF;AAEA,gBAAgB,uBACd,MACA,UACA,QAC4B;CAC5B,MAAM,UAAU,KAAK;CACrB,MAAM,WAAW,YAAY;EAC3B,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,OAAO;IACjC,QAAQ,eAAe;IACvB,MAAM,cAAc,SAAS,MAAM,oBAAoB,MAAM,MAAM,MAAM,GAAG,MAAM;GACpF;GACA,QAAQ,SAAS;EACnB,SAAS,OAAO;GACd,QAAQ,QAAQ,QAAQ,KAAK,CAAC;GAC9B,MAAM;EACR;CACF,EAAA,CAAG;CACH,QAAQ,YAAY,KAAA,CAAS;CAC7B,IAAI;EACF,WAAW,MAAM,SAAS,SAAS;GACjC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,4CAA4C;GAC9D,QAAQ,eAAe;GACvB,MAAM;EACR;EACA,MAAM;CACR,UAAU;EACR,QAAQ,QAAQ;EAChB,MAAM,QAAQ,YAAY,KAAA,CAAS;CACrC;AACF;AAEA,gBAAgB,oBACd,MACA,UACA,QAC4B;CAC5B,MAAM,OAAO,cAAc,MAAM,SAAS,IAAI;CAC9C,IAAK,MAAM,SAAS,IAAI,MAAO,MAC7B,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAChF,MAAM,OAAO,MAAM,KAAK,MAAM,UAAU,WAAW,UAAU,UAAU;CACvE,IAAI;EACF,MAAM,QAAQ,MAAM,KAAK,KAAK;EAC9B,IACE,CAAC,MAAM,OAAO,KACd,MAAM,UAAU,KAChB,MAAM,SAAS,SAAS,eACvB,MAAM,OAAO,SAAW,SAAS,MAElC,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;EAE3E,MAAM,OAAO,WAAW,QAAQ;EAChC,IAAI,aAAa;EACjB,WAAW,MAAM,SAAS,KAAK,iBAAiB;GAC9C,WAAW;GACX,eAAe;EACjB,CAAC,GAAG;GACF,QAAQ,eAAe;GACvB,cAAc,MAAM;GACpB,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;GAC3E,KAAK,OAAO,KAAK;GACjB,MAAM;EACR;EACA,IAAI,eAAe,SAAS,cAAc,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAS,QACpF,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;CAE7E,UAAU;EACR,MAAM,KAAK,MAAM;CACnB;AACF;AAEA,eAAe,cACb,SACA,MACA,QACA,QACe;CACf,MAAM,QAAQ,QAAQ,MACpB,mBAAmB,aAAa,KAAK,QAAQ,KAAK,MAAM,KAAK,UAAU,CACzE;CACA,MAAM,SAAS,SAAS,KAAK,MAAM,GAAG,OAA2C,EAAE,OAAO,CAAC;AAC7F;AAEA,eAAe,aACb,QACA,UACA,QACA;CACA,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,4CAA4C;EAC9D,QAAQ,eAAe;EACvB,cAAc,MAAM;EACpB,IAAI,aAAa,UACf,MAAM,IAAI,MAAM,qDAAqD;EACvE,KAAK,OAAO,KAAK;CACnB;CACA,OAAO;EAAE,QAAQ,UAAU,KAAK,OAAO,KAAK;EAAK;CAAW;AAC9D;AAEA,SAAS,iBACP,UACA,QACM;CACN,IAAI,SAAS,SAAS,sCACpB,MAAM,IAAI,MAAM,kDAAkD;CACpE,iCAAiC,SAAS,OAAO,MAAM;AACzD;AAEA,gBAAgB,SAAS,OAA+C;CACtE,MAAM;AACR;AACA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE"}
+{"version":3,"file":"workspace-streams-B7yNMahl.js","names":["sha256Bytes","canonicalCandidateDigest","canonicalCandidateBytes","sha256Bytes","canonicalCandidateBytes","fsConstants","sha256Bytes","canonicalCandidateBytes","canonicalCandidateDigest","sha256Bytes","canonicalCandidateBytes","sha256Bytes","fsConstants","canonicalCandidateBytes","canonicalCandidateBytes","canonicalCandidateDigest"],"sources":["../src/path-control-characters.ts","../src/candidate-execution/digest.ts","../src/candidate-execution/artifact-streams.ts","../src/candidate-execution/artifacts.ts","../src/candidate-execution/exact-object.ts","../src/candidate-execution/output-artifacts.ts","../src/candidate-execution/workspace-archive.ts","../src/candidate-execution/git-materialize.ts","../src/candidate-execution/workspace-archive-local.ts","../src/candidate-execution/workspace-streams.ts"],"sourcesContent":["/** Whether a serialized field contains an ASCII control or delete character. */\nexport function hasControlCharacter(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code < 0x20 || code === 0x7f) return true\n  }\n  return false\n}\n","import { createHash } from 'node:crypto'\nimport {\n  type AgentCandidateEmbeddedArtifact,\n  canonicalCandidateBytes,\n  type Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport type { CanonicalCandidateDocument } from './types'\n\nexport { canonicalCandidateBytes }\n\n/** Use native hashing for workspace archives. */\nexport function sha256Bytes(bytes: Uint8Array): Sha256Digest {\n  return `sha256:${createHash('sha256').update(bytes).digest('hex')}`\n}\n\nexport function canonicalCandidateDigest(value: unknown): Sha256Digest {\n  return sha256Bytes(canonicalCandidateBytes(value))\n}\n\n/** Returns a detached, deeply frozen JSON value with canonical number normalization. */\nexport function immutableCandidateValue<T>(value: T): T {\n  return deepFreezeCandidate(\n    JSON.parse(Buffer.from(canonicalCandidateBytes(value)).toString('utf8')) as T,\n  )\n}\n\nexport function canonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  valueWithoutDigest: Omit<T, 'digest'>,\n): CanonicalCandidateDocument<T> {\n  const bytes = canonicalCandidateBytes(valueWithoutDigest)\n  const digest = sha256Bytes(bytes)\n  const value = deepFreezeCandidate({\n    ...JSON.parse(Buffer.from(bytes).toString('utf8')),\n    digest,\n  }) as T\n  return Object.freeze({\n    value,\n    get bytes(): Uint8Array {\n      return Uint8Array.from(bytes)\n    },\n    digest,\n  })\n}\n\nexport function verifyCanonicalCandidateDocument<T extends { digest: Sha256Digest }>(\n  value: T,\n  label: string,\n): T {\n  if (canonicalCandidateDigest(omitTopLevelDigest(value)) !== value.digest) {\n    throw new Error(`${label} digest does not match`)\n  }\n  return immutableCandidateValue(value)\n}\n\nexport function embeddedCandidateArtifact(bytes: Uint8Array): AgentCandidateEmbeddedArtifact {\n  return {\n    encoding: 'base64',\n    content: Buffer.from(bytes).toString('base64'),\n    sha256: sha256Bytes(bytes),\n    byteLength: bytes.byteLength,\n  }\n}\n\nexport function omitTopLevelDigest<T extends { digest: Sha256Digest }>(\n  value: T,\n): Omit<T, 'digest'> {\n  const { digest: _digest, ...rest } = value\n  return rest\n}\n\nexport function deepFreezeCandidate<T>(value: T, seen = new Set<object>()): T {\n  if (\n    value === null ||\n    typeof value !== 'object' ||\n    ArrayBuffer.isView(value) ||\n    seen.has(value as object)\n  ) {\n    return value\n  }\n  seen.add(value as object)\n  for (const child of Object.values(value as Record<string, unknown>)) {\n    deepFreezeCandidate(child, seen)\n  }\n  return Object.freeze(value)\n}\n","import { createHash } from 'node:crypto'\nimport {\n  type AgentCandidateArtifactRef,\n  type AgentCandidateCapturedArtifact,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\nimport { immutableCandidateValue } from './digest'\nimport type {\n  AgentCandidateArtifactPort,\n  AgentCandidateOutputArtifactPort,\n  AgentCandidateOutputPurpose,\n} from './types'\n\n/** Verify the complete stream, including its final digest, before accepting its consumer's result. */\nexport async function* verifiedArtifactChunks(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  signal?.throwIfAborted()\n  if (!('content' in artifact) && !port.readStream) {\n    throw new Error('streaming workspace artifacts require readStream')\n  }\n  const chunks =\n    'content' in artifact\n      ? [Buffer.from(artifact.content, 'base64')]\n      : port.readStream!(artifact, { signal })\n  const hash = createHash('sha256')\n  let byteLength = 0\n  for await (const chunk of chunks) {\n    signal?.throwIfAborted()\n    if (!(chunk instanceof Uint8Array))\n      throw new Error('candidate artifact emitted a non-byte chunk')\n    byteLength += chunk.byteLength\n    if (byteLength > artifact.byteLength)\n      throw new Error('candidate artifact exceeds its declared length')\n    hash.update(chunk)\n    yield chunk\n  }\n  signal?.throwIfAborted()\n  if (byteLength !== artifact.byteLength || `sha256:${hash.digest('hex')}` !== artifact.sha256) {\n    throw new Error('candidate artifact failed digest or length verification')\n  }\n}\n\nconst selfVerifyingPuts = new WeakMap<object, object>()\n\n/**\n * Declare that this exact putStream resolves only after reading its stored object back from where\n * this exact readStream reads it, and matching its digest and length. The claim belongs to the\n * pair, so a wrapper that replaces either function never inherits it.\n */\nexport function markPutStreamVerified(putStream: object, readStream: object): void {\n  selfVerifyingPuts.set(putStream, readStream)\n}\n\n/** Whether a port's putStream already read back what its readStream will return. */\nexport function putStreamVerifiedBy(port: AgentCandidateOutputArtifactPort): boolean {\n  return (\n    port.putStream !== undefined &&\n    port.readStream !== undefined &&\n    selfVerifyingPuts.get(port.putStream) === port.readStream\n  )\n}\n\n/** Stream evaluator evidence into its existing store and verify durable readback before returning. */\nexport async function persistCandidateOutputArtifactStream(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    chunks: AsyncIterable<Uint8Array>\n    maxBytes: number\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  if (!port.putStream || !port.readStream) {\n    throw new Error('streaming workspace persistence requires putStream and readStream')\n  }\n  input.signal?.throwIfAborted()\n  const hash = createHash('sha256')\n  let byteLength = 0\n  let consumed = false\n  async function* checked(): AsyncGenerator<Uint8Array> {\n    for await (const chunk of input.chunks) {\n      input.signal?.throwIfAborted()\n      if (!(chunk instanceof Uint8Array))\n        throw new Error('candidate artifact emitted a non-byte chunk')\n      byteLength += chunk.byteLength\n      if (byteLength > input.maxBytes)\n        throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n      hash.update(chunk)\n      yield chunk\n    }\n    consumed = true\n    input.signal?.throwIfAborted()\n  }\n  const chunks = checked()\n  try {\n    const ref = agentCandidateArtifactRefSchema.parse(\n      await port.putStream({\n        executionId: input.executionId,\n        purpose: input.purpose,\n        chunks,\n        ...(input.signal ? { signal: input.signal } : {}),\n      }),\n    )\n    input.signal?.throwIfAborted()\n    if (\n      !consumed ||\n      ref.sha256 !== `sha256:${hash.digest('hex')}` ||\n      ref.byteLength !== byteLength\n    ) {\n      throw new Error('candidate output locator does not identify the submitted bytes')\n    }\n    // A port that already read its stored object back is not read a third time. Measured\n    // 2026-10-11: a critics tribunal on /mnt/traces re-read 1.1 GB/min of just-written workspace\n    // archives, each one written once and read back twice.\n    if (!putStreamVerifiedBy(port)) {\n      for await (const _chunk of verifiedArtifactChunks(ref, port, input.signal)) {\n        // Verification consumes the durable object without retaining it.\n      }\n    }\n    return immutableCandidateValue(ref)\n  } finally {\n    await chunks.return(undefined)\n  }\n}\n","import { createHash } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport { lstat, open, readdir, readlink, realpath } from 'node:fs/promises'\nimport { dirname, isAbsolute, relative, resolve, sep } from 'node:path'\n\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateCapturedArtifact,\n  AgentCandidateProfilePlanMaterial,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\n\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\n\nexport function artifactCacheKey(artifact: AgentCandidateCapturedArtifact): string {\n  return `${artifact.sha256}:${artifact.byteLength}`\n}\n\nexport async function readVerifiedArtifact(\n  artifact: AgentCandidateCapturedArtifact,\n  port: AgentCandidateArtifactPort,\n): Promise<Uint8Array> {\n  const bytes =\n    'content' in artifact\n      ? Buffer.from(artifact.content, 'base64')\n      : await port.read(artifact as AgentCandidateArtifactRef)\n  verifyBytes(bytes, artifact.sha256, artifact.byteLength, 'candidate artifact')\n  return Uint8Array.from(bytes)\n}\n\nexport function verifyBytes(\n  bytes: Uint8Array,\n  digest: string,\n  byteLength: number,\n  label: string,\n): void {\n  if (bytes.byteLength !== byteLength) {\n    throw new Error(`${label} byte length ${bytes.byteLength} does not match ${byteLength}`)\n  }\n  const actual = sha256Bytes(bytes)\n  if (actual !== digest) {\n    throw new Error(`${label} digest ${actual} does not match ${digest}`)\n  }\n}\n\nexport async function verifyWorkspaceSnapshotArtifacts(\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n  port: AgentCandidateArtifactPort,\n): Promise<{ manifest: Uint8Array; archive: Uint8Array }> {\n  const [manifest, archive] = await Promise.all([\n    readVerifiedArtifact(snapshot.manifest, port),\n    readVerifiedArtifact(snapshot.archive, port),\n  ])\n  const canonicalManifest = canonicalCandidateBytes(snapshot.material)\n  if (!Buffer.from(manifest).equals(Buffer.from(canonicalManifest))) {\n    throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n  }\n  if (sha256Bytes(canonicalManifest) !== snapshot.digest) {\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  }\n  return { manifest, archive }\n}\n\n/** The per-scan caps a bounded capture applies. */\nexport interface WorkspaceScanLimits {\n  readonly maxFiles: number\n  readonly maxFileBytes: number\n  readonly maxTotalFileBytes: number\n}\n\n/** A configured file-count or byte limit stopped workspace capture. */\nexport class WorkspaceScanLimitError extends Error {}\n\n/** What a workspace scan reads and how it records a file's permission bits. */\nexport interface WorkspaceScanOptions {\n  readonly signal?: AbortSignal\n  readonly ignoredProtectedRootEntries?: readonly ('.git' | '.sidecar')[]\n  /**\n   * Root-relative files or directories left out, each by its exact path (`__retention__` or\n   * `__retention__/sessions/<id>`). A verify of the same root must name the same paths.\n   */\n  readonly excludedPaths?: readonly string[]\n  readonly limits?: WorkspaceScanLimits\n  /** Scan only these root-relative files, pruning every unrelated directory. */\n  readonly selectedPaths?: readonly string[]\n  /**\n   * Record Git's two file modes instead of the filesystem's exact permission bits: `0o755` when\n   * any execute bit is set, `0o644` otherwise. A checkout umask then cannot move a manifest\n   * digest, while a real permission change still does.\n   *\n   * This is the normalization `readCandidateGitTreeFiles` already applies to a Git tree\n   * (`100644`/`100755`), so one tree scanned from disk and the same tree read out of Git produce\n   * the same manifest. Off by default: the flag changes the digest, so a capture and the verify\n   * that checks it must agree on it.\n   */\n  readonly portableTree?: boolean\n}\n\n/**\n * Refuse a materialized workspace whose files, modes, or bytes are not the signed manifest.\n *\n * The scan streams, so the size of the largest file does not decide whether the check can run, and\n * the refusal names the one mismatch a caller can produce on its own: a capture and a verify that\n * disagree about `portableTree`.\n */\nexport async function verifyMaterializedWorkspace(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: Omit<WorkspaceScanOptions, 'limits'> = {},\n): Promise<void> {\n  assertWorkspaceManifest(await scanMaterializedWorkspaceManifest(root, options), expected)\n}\n\n/**\n * The canonical manifest of one materialized workspace, read without holding any file.\n *\n * Every file is digested by streaming, so the size of the largest file does not decide whether the\n * workspace can be described. `FileHandle.readFile` refuses anything above 2 GiB with\n * `ERR_FS_FILE_TOO_LARGE`, which made a workspace holding one such artifact impossible to verify\n * against a manifest it already matched. The digest is sha-256 over the same bytes either way, so\n * a manifest a buffered read produced is reproduced exactly.\n */\nexport async function scanMaterializedWorkspaceManifest(\n  root: string,\n  options: WorkspaceScanOptions = {},\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return workspaceManifestFromEntries(await walkWorkspace(root, options, false))\n}\n\n/**\n * Capture settings Runtime's own callers may add. `skipPythonBytecode` leaves out `__pycache__/`\n * directories and `*.pyc` files: the interpreter writes them beside the sources it runs, Git\n * ignores them, and each carries its source's modification time, so a digest that covered them\n * would change when a program was merely run and could not be reproduced from any checkout.\n */\ninterface WorkspaceCaptureOptions extends WorkspaceScanOptions {\n  readonly skipPythonBytecode?: boolean\n}\n\nexport async function captureMaterializedWorkspace(\n  root: string,\n  options: WorkspaceCaptureOptions = {},\n): Promise<{\n  manifest: AgentCandidateWorkspaceManifestMaterial\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const entries = await walkWorkspace(root, options, true)\n  return {\n    manifest: workspaceManifestFromEntries(entries),\n    files: entries.map((entry) => ({\n      path: entry.path,\n      mode: entry.mode,\n      bytes: Uint8Array.from(capturedBytes(entry)),\n    })),\n  }\n}\n\n/** Capture exact verified regular-file bytes for fresh isolated materialization. */\nexport async function readMaterializedWorkspaceFiles(\n  root: string,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n  options: WorkspaceScanOptions = {},\n): Promise<ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>> {\n  const observed = await captureMaterializedWorkspace(root, options)\n  assertWorkspaceManifest(observed.manifest, expected)\n  return observed.files.map((file) =>\n    Object.freeze({ path: file.path, mode: file.mode, bytes: Uint8Array.from(file.bytes) }),\n  )\n}\n\n/**\n * Build the canonical manifest for files a caller already holds — the shape a remote executor\n * returns. Pass `portableTree` to record Git's two file modes instead of exact permission bits, and\n * pass the same flag to every verify that reads the result.\n */\nexport function candidateWorkspaceManifest(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  options: { portableTree?: boolean } = {},\n): AgentCandidateWorkspaceManifestMaterial {\n  return workspaceManifestFromEntries(\n    files.map((file) => ({\n      path: file.path,\n      mode: options.portableTree === true ? portableFileMode(file.mode) : file.mode,\n      sha256: sha256Bytes(file.bytes),\n      byteLength: file.bytes.byteLength,\n    })),\n  )\n}\n\nfunction workspaceManifestFromEntries(\n  entries: ReadonlyArray<{\n    path: string\n    mode: number\n    sha256: Sha256Digest\n    byteLength: number\n  }>,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    kind: 'agent-candidate-workspace-manifest',\n    files: entries\n      .map((entry) => ({\n        path: entry.path,\n        mode: entry.mode,\n        sha256: entry.sha256,\n        byteLength: entry.byteLength,\n      }))\n      .sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0)),\n  }\n}\n\n/** Git records exactly two file modes, and a portable-tree scan records the same two. */\nfunction portableFileMode(mode: number): number {\n  return (mode & 0o111) !== 0 ? 0o755 : 0o644\n}\n\nfunction capturedBytes(entry: ScannedWorkspaceEntry): Buffer {\n  if (!entry.bytes) throw new Error(`workspace file was digested without its bytes: ${entry.path}`)\n  return entry.bytes\n}\n\nfunction assertWorkspaceManifest(\n  observed: AgentCandidateWorkspaceManifestMaterial,\n  expected: AgentCandidateWorkspaceManifestMaterial,\n): void {\n  if (Buffer.from(canonicalCandidateBytes(observed)).equals(canonicalCandidateBytes(expected))) {\n    return\n  }\n  // The one mismatch a caller can produce by passing `portableTree` on one side of a\n  // capture/verify pair and not the other. Named, because the general refusal below reads as\n  // changed bytes and would send a reader looking for a file that never changed. Comparing the\n  // two manifests already in hand costs no second walk.\n  if (\n    Buffer.from(canonicalCandidateBytes(withPortableModes(observed))).equals(\n      canonicalCandidateBytes(withPortableModes(expected)),\n    )\n  ) {\n    throw new Error(\n      'materialized workspace files do not match the signed manifest: only the file modes differ, ' +\n        'so the capture and this verify disagree about portableTree',\n    )\n  }\n  throw new Error('materialized workspace files, modes, or bytes do not match the signed manifest')\n}\n\nfunction withPortableModes(\n  material: AgentCandidateWorkspaceManifestMaterial,\n): AgentCandidateWorkspaceManifestMaterial {\n  return {\n    ...material,\n    files: material.files.map((file) => ({ ...file, mode: portableFileMode(file.mode) })),\n  }\n}\n\nexport async function verifyMaterializedProfileWorkspace(\n  root: string,\n  expected: AgentCandidateProfilePlanMaterial,\n  fileRoot: 'workspace' | 'agent' = 'workspace',\n): Promise<void> {\n  const observed = await scanMaterializedWorkspaceManifest(root)\n  const observedProfile = observed.files.map(({ path, mode, sha256 }) => ({\n    relPath: path,\n    mode,\n    contentSha256: sha256,\n  }))\n  const expectedFiles = expected.files\n    .filter((file) => (file.root ?? 'workspace') === fileRoot)\n    .map(({ root: _root, ...file }) => file)\n  if (\n    !Buffer.from(canonicalCandidateBytes(observedProfile)).equals(\n      canonicalCandidateBytes(expectedFiles),\n    )\n  ) {\n    throw new Error(\n      `profile ${fileRoot} staging files, modes, or bytes do not match the signed profile plan`,\n    )\n  }\n}\n\ninterface ScannedWorkspaceEntry {\n  readonly path: string\n  readonly mode: number\n  readonly sha256: Sha256Digest\n  readonly byteLength: number\n  /** Present only when the walk was asked to keep bytes. */\n  readonly bytes?: Buffer\n}\n\nasync function walkWorkspace(\n  root: string,\n  options: WorkspaceCaptureOptions,\n  keepBytes: boolean,\n): Promise<ScannedWorkspaceEntry[]> {\n  const ignoredProtectedRootEntries = new Set<string>(options.ignoredProtectedRootEntries ?? [])\n  const excluded = new Set(options.excludedPaths ?? [])\n  for (const path of excluded) {\n    if (\n      !path ||\n      path.includes('\\\\') ||\n      path.includes('\\0') ||\n      isAbsolute(path) ||\n      path.split('/').some((part) => !part || part === '.' || part === '..')\n    ) {\n      throw new Error('workspace excluded path must be a safe relative path')\n    }\n  }\n  const limits = options.limits\n  const selected = options.selectedPaths ? new Set(options.selectedPaths) : undefined\n  const selectedDirectories = new Set<string>()\n  for (const path of selected ?? []) {\n    if (\n      !path ||\n      path.includes('\\\\') ||\n      path.includes('\\0') ||\n      isAbsolute(path) ||\n      path.split('/').some((part) => !part || part === '.' || part === '..')\n    ) {\n      throw new Error('workspace selected path must be a safe relative file path')\n    }\n    let parent = dirname(path)\n    while (parent !== '.') {\n      selectedDirectories.add(parent)\n      parent = dirname(parent)\n    }\n  }\n  // Scan the RESOLVED root. The property this guards is that every captured path lies under\n  // one real directory with no aliasing, which resolving satisfies directly — rejecting a\n  // symlinked prefix outright does not, and makes the scan impossible on macOS, where the\n  // OS itself hands out temp paths under /var, a symlink to /private/var. Symlinks INSIDE\n  // the workspace are still refused entry by entry below, with O_NOFOLLOW on every open.\n  const requestedRoot = resolve(root)\n  const rootStats = await lstat(requestedRoot)\n  if (!rootStats.isDirectory() || rootStats.isSymbolicLink()) {\n    throw new Error('workspace root must be a real directory')\n  }\n  const absoluteRoot = await realpath(requestedRoot)\n  const resolvedStats = await lstat(absoluteRoot)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('workspace root must resolve to a real directory')\n  }\n  const scanned: ScannedWorkspaceEntry[] = []\n  let totalBytes = 0\n\n  async function visit(directory: string): Promise<void> {\n    options.signal?.throwIfAborted()\n    const entries = await readdir(directory, { withFileTypes: true })\n    entries.sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0))\n    for (const entry of entries) {\n      options.signal?.throwIfAborted()\n      if (directory === absoluteRoot && ignoredProtectedRootEntries.has(entry.name)) {\n        continue\n      }\n      if (\n        options.skipPythonBytecode === true &&\n        ((entry.isDirectory() && entry.name === '__pycache__') ||\n          (entry.isFile() && entry.name.endsWith('.pyc')))\n      ) {\n        continue\n      }\n      const absolute = resolve(directory, entry.name)\n      const relPath = relative(absoluteRoot, absolute).split(sep).join('/')\n      if (!relPath || relPath.startsWith('../') || relPath.includes('/../')) {\n        throw new Error(`workspace entry escapes root: ${relPath}`)\n      }\n      if (excluded.has(relPath)) continue\n      if (selected && !selected.has(relPath) && !selectedDirectories.has(relPath)) continue\n      const stats = await lstat(absolute)\n      if (stats.isSymbolicLink()) {\n        throw new Error(await symlinkRefusal(absolute, relPath, absoluteRoot))\n      }\n      if (stats.isDirectory()) {\n        if (selected?.has(relPath))\n          throw new Error(`workspace selected file is a directory: ${relPath}`)\n        await visit(absolute)\n        continue\n      }\n      if (!stats.isFile()) {\n        throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n      }\n      if (limits && scanned.length >= limits.maxFiles) {\n        throw new WorkspaceScanLimitError('workspace exceeds maxFiles')\n      }\n      const descriptor = await open(\n        absolute,\n        fsConstants.O_RDONLY |\n          (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      )\n      try {\n        const openedStats = await descriptor.stat()\n        if (!openedStats.isFile()) {\n          throw new Error(`workspace contains a non-regular entry: ${relPath}`)\n        }\n        if (openedStats.nlink !== 1) {\n          throw new Error(`workspace contains a hard-linked file: ${relPath}`)\n        }\n        const mode =\n          options.portableTree === true\n            ? portableFileMode(openedStats.mode)\n            : openedStats.mode & 0o777\n        if (limits && openedStats.size > limits.maxFileBytes) {\n          throw new WorkspaceScanLimitError(`workspace file exceeds maxFileBytes: ${relPath}`)\n        }\n        const remainingBytes = limits ? limits.maxTotalFileBytes - totalBytes : undefined\n        if (remainingBytes !== undefined && openedStats.size > remainingBytes) {\n          throw new WorkspaceScanLimitError('workspace exceeds maxTotalFileBytes')\n        }\n        const read = await readWorkspaceFile(\n          descriptor,\n          limits ? Math.min(limits.maxFileBytes, remainingBytes ?? limits.maxFileBytes) : undefined,\n          keepBytes,\n          relPath,\n          options.signal,\n        )\n        totalBytes += read.byteLength\n        scanned.push({\n          path: relPath,\n          mode,\n          sha256: read.sha256,\n          byteLength: read.byteLength,\n          ...(read.bytes === undefined ? {} : { bytes: read.bytes }),\n        })\n      } finally {\n        await descriptor.close()\n      }\n    }\n  }\n\n  await visit(absoluteRoot)\n  if (selected && scanned.length !== selected.size) {\n    throw new Error('workspace selected files changed during capture')\n  }\n  return scanned\n}\n\n/**\n * Why one symbolic link is refused, in the terms that separate a portable link from a link that\n * reaches outside the tree.\n *\n * Every link is refused, in both mode policies. `AgentCandidateWorkspaceManifestMaterial` has no\n * representation for one — `mode`, `sha256` and `byteLength` describe a regular file — so a link\n * recorded as a file would let two different trees share one digest. The reason says which kind of\n * link it was, so a caller can tell a link it can rewrite from one it cannot.\n */\nasync function symlinkRefusal(\n  absolute: string,\n  relPath: string,\n  absoluteRoot: string,\n): Promise<string> {\n  const target = await readlink(absolute)\n  if (isAbsolute(target)) {\n    return `workspace contains an absolute symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, resolve(dirname(absolute), target))) {\n    return `workspace contains a symlink that escapes its tree: ${relPath} -> ${target}`\n  }\n  let physical: string\n  try {\n    physical = await realpath(absolute)\n  } catch {\n    return `workspace contains an unresolved symlink: ${relPath} -> ${target}`\n  }\n  if (!isWithin(absoluteRoot, physical)) {\n    return `workspace contains a symlink that resolves outside its tree: ${relPath} -> ${target}`\n  }\n  return `workspace contains a symlink: ${relPath} -> ${target}`\n}\n\nfunction isWithin(root: string, path: string): boolean {\n  return path === root || path.startsWith(`${root}${sep}`)\n}\n\n/**\n * Read one open regular file into its digest, keeping the bytes only when the caller needs them.\n *\n * The content reaches the hash in 1 MiB chunks and is never held whole for a digest-only walk, so\n * the size of the largest file does not decide whether a workspace can be described.\n * `FileHandle.readFile` refuses anything above 2 GiB with `ERR_FS_FILE_TOO_LARGE`. Hashing the\n * chunks in order equals hashing the whole buffer, so a manifest a buffered read produced is\n * reproduced byte for byte.\n */\nasync function readWorkspaceFile(\n  descriptor: Awaited<ReturnType<typeof open>>,\n  maxBytes: number | undefined,\n  keepBytes: boolean,\n  path: string,\n  signal?: AbortSignal,\n): Promise<{ sha256: Sha256Digest; byteLength: number; bytes?: Buffer }> {\n  const hash = createHash('sha256')\n  const buffer = Buffer.allocUnsafe(1024 * 1024)\n  const chunks: Buffer[] = []\n  let total = 0\n  while (true) {\n    signal?.throwIfAborted()\n    const { bytesRead } = await descriptor.read(buffer, 0, buffer.byteLength, null)\n    if (bytesRead === 0) break\n    total += bytesRead\n    if (maxBytes !== undefined && total > maxBytes) {\n      throw new WorkspaceScanLimitError(`workspace file exceeds its capture limit: ${path}`)\n    }\n    const chunk = buffer.subarray(0, bytesRead)\n    hash.update(chunk)\n    // The read buffer is reused, so a kept chunk has to be copied out of it.\n    if (keepBytes) chunks.push(Buffer.from(chunk))\n  }\n  const sha256 = `sha256:${hash.digest('hex')}` as Sha256Digest\n  return keepBytes\n    ? { sha256, byteLength: total, bytes: Buffer.concat(chunks, total) }\n    : { sha256, byteLength: total }\n}\n","/** Reject unknown fields while requiring every declared non-optional field. */\nexport function assertExactObjectKeys(\n  value: unknown,\n  required: readonly string[],\n  label: string,\n  optional: readonly string[] = [],\n): void {\n  if (value === null || typeof value !== 'object' || Array.isArray(value)) {\n    throw new Error(`${label} must be an object`)\n  }\n  const allowed = new Set([...required, ...optional])\n  if (allowed.size !== required.length + optional.length) {\n    throw new Error(`${label} exact-key contract contains duplicate fields`)\n  }\n  for (const key of Object.keys(value)) {\n    if (!allowed.has(key)) throw new Error(`${label} contains unknown field ${key}`)\n  }\n  for (const key of required) {\n    if (!(key in value)) throw new Error(`${label} is missing field ${key}`)\n  }\n}\n\n/**\n * Reject a string carrying a lone surrogate. A well-formed UTF-16 string round-trips through UTF-8\n * unchanged; a lone surrogate does not, so a value that passes here is safe to persist and re-read\n * as the same bytes.\n */\nexport function isWellFormedUnicode(value: string): boolean {\n  for (let index = 0; index < value.length; index++) {\n    const code = value.charCodeAt(index)\n    if (code >= 0xd800 && code <= 0xdbff) {\n      const next = value.charCodeAt(index + 1)\n      if (!(next >= 0xdc00 && next <= 0xdfff)) return false\n      index++\n    } else if (code >= 0xdc00 && code <= 0xdfff) {\n      return false\n    }\n  }\n  return true\n}\n","import {\n  type AgentCandidateArtifactRef,\n  agentCandidateArtifactRefSchema,\n} from '@tangle-network/agent-interface'\n\nimport { verifyBytes } from './artifacts'\nimport { immutableCandidateValue, sha256Bytes } from './digest'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateOutputPurpose } from './types'\n\n/** Persist evaluator evidence, read it back, and bind the returned locator to the exact bytes. */\nexport async function persistCandidateOutputArtifact(\n  port: AgentCandidateOutputArtifactPort,\n  input: {\n    executionId: string\n    purpose: AgentCandidateOutputPurpose\n    bytes: Uint8Array\n    signal?: AbortSignal\n  },\n): Promise<AgentCandidateArtifactRef> {\n  input.signal?.throwIfAborted()\n  const bytes = Uint8Array.from(input.bytes)\n  const expectedDigest = sha256Bytes(bytes)\n  const ref = agentCandidateArtifactRefSchema.parse(\n    await port.put({\n      executionId: input.executionId,\n      purpose: input.purpose,\n      bytes: Uint8Array.from(bytes),\n      ...(input.signal ? { signal: input.signal } : {}),\n    }),\n  )\n  input.signal?.throwIfAborted()\n  if (ref.sha256 !== expectedDigest || ref.byteLength !== bytes.byteLength) {\n    throw new Error('candidate output locator does not identify the submitted bytes')\n  }\n  const stored = await port.read(ref)\n  input.signal?.throwIfAborted()\n  verifyBytes(stored, expectedDigest, bytes.byteLength, 'persisted candidate output')\n  return immutableCandidateValue(ref)\n}\n","import { isAbsolute, win32 } from 'node:path'\nimport { isAnyArrayBuffer, isSharedArrayBuffer } from 'node:util/types'\nimport { isRecord } from '@tangle-network/agent-core'\nimport type {\n  AgentCandidateCapturedArtifact,\n  AgentCandidateWorkspaceSnapshotEvidence,\n} from '@tangle-network/agent-interface'\nimport { extract, type Pack, pack, type Extract as TarExtract } from 'tar-stream'\nimport { hasControlCharacter } from '../path-control-characters'\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport {\n  canonicalCandidateBytes,\n  canonicalCandidateDigest,\n  deepFreezeCandidate,\n  embeddedCandidateArtifact,\n  sha256Bytes,\n} from './digest'\nimport { isWellFormedUnicode } from './exact-object'\nimport { persistCandidateOutputArtifact } from './output-artifacts'\nimport type { AgentCandidateExecutorWorkspaceFile } from './types'\nimport type { CaptureAgentCandidateWorkspaceOptions } from './workspace-archive-local'\n\nconst archiveKind = 'agent-candidate-workspace-archive' as const\nconst workspaceEntryPrefix = 'workspace/'\nconst repositoryMetadataEntry = 'metadata/repository.json'\nconst repositoryBundleEntry = 'metadata/repository.bundle'\nconst repositoryIndexEntry = 'metadata/repository.index.json'\nconst repositoryIndexPrefix = 'index/'\nconst fixedTarTime = new Date(0)\n\nexport interface AgentCandidateWorkspaceArchiveLimits {\n  maxArchiveBytes: number\n  maxEmbeddedArtifactBytes: number\n  maxFiles: number\n  maxFileBytes: number\n  maxTotalFileBytes: number\n  maxPathBytes: number\n  maxRepositoryBundleBytes: number\n}\n\nconst defaultLimits: AgentCandidateWorkspaceArchiveLimits = Object.freeze({\n  maxArchiveBytes: 512 * 1024 * 1024,\n  maxEmbeddedArtifactBytes: 1024 * 1024,\n  maxFiles: 50_000,\n  maxFileBytes: 128 * 1024 * 1024,\n  maxTotalFileBytes: 256 * 1024 * 1024,\n  maxPathBytes: 4_096,\n  maxRepositoryBundleBytes: 128 * 1024 * 1024,\n})\n\nexport interface WorkspaceArchiveRepository {\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n    bytes: Uint8Array\n  }\n  workingTree?: { files: Array<{ path: string; mode: number; bytes: Uint8Array }> }\n}\n\ninterface WorkspaceArchiveRepositoryMetadata {\n  kind: typeof archiveKind\n  headCommit: string\n  headTree: string\n  bundle: {\n    sha256: `sha256:${string}`\n    byteLength: number\n  }\n  workingTree?: { indexManifest: { sha256: `sha256:${string}`; byteLength: number } }\n}\n\ninterface DecodedWorkspaceArchive {\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository?: WorkspaceArchiveRepository\n}\n\nexport interface CapturedAgentCandidateWorkspace {\n  readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  /** Caller-owned bytes accepted by createAgentCandidateWorkspacePort. */\n  readonly archive: Uint8Array\n}\n\n/** Capture detached files returned by a remote executor into the standard archive. */\nexport async function captureAgentCandidateWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  options: Omit<\n    CaptureAgentCandidateWorkspaceOptions,\n    'includeRepository' | 'repositoryContents'\n  > = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const limits = workspaceLimits(options.limits)\n  return captureWorkspaceFiles(\n    normalizeWorkspaceFiles(input, limits),\n    undefined,\n    limits,\n    options.artifactPersistence,\n  )\n}\n\nexport async function captureWorkspaceFiles(\n  files: readonly AgentCandidateExecutorWorkspaceFile[],\n  repository: WorkspaceArchiveRepository | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  artifactPersistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<CapturedAgentCandidateWorkspace> {\n  const material = candidateWorkspaceManifest(files)\n  const manifest = canonicalCandidateBytes(material)\n  const archive = await encodeWorkspaceArchive(files, repository, limits.maxArchiveBytes)\n  if (\n    !artifactPersistence &&\n    (manifest.byteLength > limits.maxEmbeddedArtifactBytes ||\n      archive.byteLength > limits.maxEmbeddedArtifactBytes)\n  ) {\n    throw new Error(\n      'candidate workspace artifacts exceed maxEmbeddedArtifactBytes; artifactPersistence is required',\n    )\n  }\n  const manifestArtifact = await captureWorkspaceArtifact('manifest', manifest, artifactPersistence)\n  const archiveArtifact = await captureWorkspaceArtifact('archive', archive, artifactPersistence)\n  const snapshot = deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-snapshot',\n    digest: canonicalCandidateDigest(material),\n    material,\n    manifest: manifestArtifact,\n    archive: archiveArtifact,\n  } satisfies AgentCandidateWorkspaceSnapshotEvidence)\n  return Object.freeze({ snapshot, archive })\n}\n\nasync function captureWorkspaceArtifact(\n  kind: 'manifest' | 'archive',\n  bytes: Uint8Array,\n  persistence: CaptureAgentCandidateWorkspaceOptions['artifactPersistence'],\n): Promise<AgentCandidateCapturedArtifact> {\n  if (!persistence) return embeddedCandidateArtifact(bytes)\n  if (!persistence.executionId.trim()) {\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  }\n  return persistCandidateOutputArtifact(persistence.outputArtifacts, {\n    executionId: persistence.executionId,\n    purpose: kind === 'manifest' ? 'candidate-workspace-manifest' : 'candidate-workspace-archive',\n    bytes,\n    ...(persistence.signal ? { signal: persistence.signal } : {}),\n  })\n}\n\n/** Verify a portable archive before its source environment may be discarded. */\nexport async function verifyAgentCandidateWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}): Promise<void> {\n  await decodeVerifiedWorkspaceArchive({ ...input, limits: workspaceLimits(input.limits) })\n}\n\nexport async function decodeVerifiedWorkspaceArchive(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  limits: AgentCandidateWorkspaceArchiveLimits\n}): Promise<DecodedWorkspaceArchive> {\n  verifyBytes(\n    input.archive,\n    input.snapshot.archive.sha256,\n    input.snapshot.archive.byteLength,\n    'candidate workspace archive',\n  )\n  const decoded = await parseWorkspaceArchive(input.archive, input.limits)\n  if (decoded.repository && input.role !== 'task') {\n    throw new Error('only task workspaces may carry a Git repository')\n  }\n  assertArchiveMatchesSnapshot(decoded.files, input.snapshot)\n  return decoded\n}\n\nasync function encodeWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  maxArchiveBytes: number,\n): Promise<Uint8Array> {\n  const archive = pack()\n  const output = collectStream(archive, maxArchiveBytes, 'candidate workspace archive')\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    return await output\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await output.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function verifyCanonicalWorkspaceArchive(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n  expected: Uint8Array,\n  maxArchiveBytes: number,\n): Promise<void> {\n  const archive = pack()\n  const comparison = streamEqualsBytes(\n    archive,\n    expected,\n    maxArchiveBytes,\n    'candidate workspace archive',\n  )\n  try {\n    await writeWorkspaceArchiveEntries(archive, files, repository)\n    archive.finalize()\n    if (!(await comparison)) throw new Error('candidate workspace tar is not canonical')\n  } catch (error) {\n    archive.destroy(error instanceof Error ? error : new Error(String(error)))\n    await comparison.catch(() => undefined)\n    throw error\n  }\n}\n\nasync function writeWorkspaceArchiveEntries(\n  archive: Pack,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  repository: WorkspaceArchiveRepository | undefined,\n): Promise<void> {\n  for (const file of files) {\n    await writeTarEntry(archive, `${workspaceEntryPrefix}${file.path}`, file.mode, file.bytes)\n  }\n  if (!repository) return\n  const indexManifest = repository.workingTree\n    ? canonicalCandidateBytes(candidateWorkspaceManifest(repository.workingTree.files))\n    : undefined\n  const metadata = canonicalCandidateBytes({\n    kind: archiveKind,\n    headCommit: repository.headCommit,\n    headTree: repository.headTree,\n    bundle: {\n      sha256: repository.bundle.sha256,\n      byteLength: repository.bundle.byteLength,\n    },\n    ...(indexManifest\n      ? {\n          workingTree: {\n            indexManifest: {\n              sha256: sha256Bytes(indexManifest),\n              byteLength: indexManifest.byteLength,\n            },\n          },\n        }\n      : {}),\n  } satisfies WorkspaceArchiveRepositoryMetadata)\n  await writeTarEntry(archive, repositoryMetadataEntry, 0o600, metadata)\n  await writeTarEntry(archive, repositoryBundleEntry, 0o600, repository.bundle.bytes)\n  if (repository.workingTree && indexManifest) {\n    await writeTarEntry(archive, repositoryIndexEntry, 0o600, indexManifest)\n    for (const file of repository.workingTree.files) {\n      await writeTarEntry(archive, `${repositoryIndexPrefix}${file.path}`, file.mode, file.bytes)\n    }\n  }\n}\n\nasync function parseWorkspaceArchive(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<DecodedWorkspaceArchive> {\n  if (bytes.byteLength > limits.maxArchiveBytes) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  }\n  const parser = extract()\n  const files: DecodedWorkspaceArchive['files'] = []\n  const observedEntryNames = new Set<string>()\n  const observedPaths = new Set<string>()\n  let totalBytes = 0\n  let retainedEntryBytes = 0\n  let previousPath: string | undefined\n  let repositoryMetadata: WorkspaceArchiveRepositoryMetadata | undefined\n  let repositoryBundle: Uint8Array | undefined\n  let repositoryIndex: Uint8Array | undefined\n  const indexFiles: DecodedWorkspaceArchive['files'] = []\n  const indexPaths = new Set<string>()\n  let previousIndexPath: string | undefined\n  let indexBytes = 0\n  const decoded = (async () => {\n    for await (const entry of parser) {\n      const name = entry.header.name\n      if (\n        entry.header.type !== 'file' ||\n        typeof name !== 'string' ||\n        observedEntryNames.has(name)\n      ) {\n        throw new Error('candidate workspace tar contains an invalid entry')\n      }\n      observedEntryNames.add(name)\n      if (name.startsWith(workspaceEntryPrefix)) {\n        if (files.length >= limits.maxFiles) {\n          throw new Error('candidate workspace archive has an invalid file count')\n        }\n        const path = safeArchivePath(name.slice(workspaceEntryPrefix.length), limits.maxPathBytes)\n        if (!isWorkspaceFileMode(entry.header.mode)) {\n          throw new Error(`candidate workspace archive has an unsupported mode: ${path}`)\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `workspace file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        assertWorkspacePathOrder(\n          path,\n          previousPath,\n          observedPaths,\n          'candidate workspace archive paths must be unique and sorted',\n        )\n        previousPath = path\n        if (fileBytes.byteLength > limits.maxTotalFileBytes - totalBytes) {\n          throw new Error('candidate workspace archive exceeds maxTotalFileBytes')\n        }\n        totalBytes += fileBytes.byteLength\n        files.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else if (name === repositoryMetadataEntry) {\n        if (entry.header.mode !== 0o600 || repositoryMetadata) {\n          throw new Error('candidate workspace archive repository metadata is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        const metadataBytes = await readTarEntry(\n          entry,\n          limits.maxPathBytes,\n          'candidate repository metadata',\n        )\n        retainedEntryBytes += metadataBytes.byteLength\n        repositoryMetadata = parseRepositoryMetadata(metadataBytes, limits)\n      } else if (name === repositoryBundleEntry) {\n        if (entry.header.mode !== 0o600 || repositoryBundle) {\n          throw new Error('candidate workspace archive repository bundle is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryBundle = await readTarEntry(\n          entry,\n          limits.maxRepositoryBundleBytes,\n          'candidate Git bundle',\n        )\n        retainedEntryBytes += repositoryBundle.byteLength\n      } else if (name === repositoryIndexEntry) {\n        if (entry.header.mode !== 0o600 || repositoryIndex) {\n          throw new Error('candidate workspace archive repository index is invalid')\n        }\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        repositoryIndex = await readTarEntry(\n          entry,\n          limits.maxArchiveBytes,\n          'candidate Git index manifest',\n        )\n        retainedEntryBytes += repositoryIndex.byteLength\n      } else if (name.startsWith(repositoryIndexPrefix)) {\n        if (\n          !repositoryMetadata?.workingTree ||\n          !repositoryIndex ||\n          indexFiles.length >= limits.maxFiles\n        ) {\n          throw new Error('candidate Git index evidence is incomplete or exceeds maxFiles')\n        }\n        const path = safeArchivePath(name.slice(repositoryIndexPrefix.length), limits.maxPathBytes)\n        if (entry.header.mode !== 0o644 && entry.header.mode !== 0o755) {\n          throw new Error('candidate Git index contains an unsupported mode')\n        }\n        assertWorkspacePathOrder(\n          path,\n          previousIndexPath,\n          indexPaths,\n          'candidate Git index paths must be unique and sorted',\n        )\n        previousIndexPath = path\n        assertRetainedArchiveSize(bytes.byteLength, retainedEntryBytes, entry.header.size, limits)\n        if (\n          entry.header.size === undefined ||\n          entry.header.size > limits.maxTotalFileBytes - indexBytes\n        ) {\n          throw new Error('candidate Git index exceeds maxTotalFileBytes')\n        }\n        if (entry.header.size > limits.maxFileBytes)\n          throw new Error('candidate Git index exceeds maxFileBytes')\n        const fileBytes = await readTarEntry(entry, limits.maxFileBytes, `Git index file ${path}`)\n        retainedEntryBytes += fileBytes.byteLength\n        indexBytes += fileBytes.byteLength\n        indexFiles.push({ path, mode: entry.header.mode, bytes: fileBytes })\n      } else {\n        throw new Error(`candidate workspace tar contains an unsupported entry: ${name}`)\n      }\n    }\n    if (Boolean(repositoryMetadata) !== Boolean(repositoryBundle)) {\n      throw new Error('candidate workspace archive repository evidence is incomplete')\n    }\n    if (Boolean(repositoryMetadata?.workingTree) !== Boolean(repositoryIndex)) {\n      throw new Error('candidate workspace archive repository index evidence is incomplete')\n    }\n    const repository =\n      repositoryMetadata && repositoryBundle\n        ? repositoryFromTar(repositoryMetadata, repositoryBundle, repositoryIndex, indexFiles)\n        : undefined\n    return { files, ...(repository ? { repository } : {}) }\n  })()\n  parser.end(Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength))\n  const result = await decoded\n  await verifyCanonicalWorkspaceArchive(\n    result.files,\n    result.repository,\n    bytes,\n    limits.maxArchiveBytes,\n  )\n  return result\n}\n\nfunction assertRetainedArchiveSize(\n  archiveBytes: number,\n  retainedEntryBytes: number,\n  entryBytes: number | undefined,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (\n    !Number.isSafeInteger(entryBytes) ||\n    entryBytes === undefined ||\n    entryBytes < 0 ||\n    entryBytes > limits.maxArchiveBytes - archiveBytes - retainedEntryBytes\n  ) {\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes while decoding')\n  }\n}\n\nfunction parseRepositoryMetadata(\n  bytes: Uint8Array,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): WorkspaceArchiveRepositoryMetadata {\n  let value: unknown\n  try {\n    value = JSON.parse(new TextDecoder('utf-8', { fatal: true }).decode(bytes))\n  } catch (error) {\n    throw new Error('candidate workspace archive repository metadata is invalid', { cause: error })\n  }\n  if (\n    !isRecord(value) ||\n    !['bundle,headCommit,headTree,kind', 'bundle,headCommit,headTree,kind,workingTree'].includes(\n      Object.keys(value).sort().join(','),\n    ) ||\n    value.kind !== archiveKind ||\n    typeof value.headCommit !== 'string' ||\n    typeof value.headTree !== 'string' ||\n    !isRecord(value.bundle) ||\n    Object.keys(value.bundle).sort().join(',') !== 'byteLength,sha256' ||\n    typeof value.bundle.sha256 !== 'string' ||\n    !/^sha256:[a-f0-9]{64}$/.test(value.bundle.sha256) ||\n    !Number.isSafeInteger(value.bundle.byteLength) ||\n    (value.bundle.byteLength as number) <= 0 ||\n    (value.bundle.byteLength as number) > limits.maxRepositoryBundleBytes\n  ) {\n    throw new Error('candidate workspace archive repository is invalid')\n  }\n  if (!Buffer.from(canonicalCandidateBytes(value)).equals(Buffer.from(bytes))) {\n    throw new Error('candidate workspace archive repository metadata is not canonical')\n  }\n  assertGitObjectId(value.headCommit, 'repository HEAD')\n  assertGitObjectId(value.headTree, 'repository HEAD tree')\n  if (value.headCommit.length !== value.headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  let workingTree: WorkspaceArchiveRepositoryMetadata['workingTree']\n  if ('workingTree' in value) {\n    const working = value.workingTree\n    if (\n      !isRecord(working) ||\n      Object.keys(working).join(',') !== 'indexManifest' ||\n      !isRecord(working.indexManifest) ||\n      Object.keys(working.indexManifest).sort().join(',') !== 'byteLength,sha256' ||\n      typeof working.indexManifest.sha256 !== 'string' ||\n      !/^sha256:[a-f0-9]{64}$/.test(working.indexManifest.sha256) ||\n      !Number.isSafeInteger(working.indexManifest.byteLength) ||\n      (working.indexManifest.byteLength as number) < 0 ||\n      (working.indexManifest.byteLength as number) > limits.maxArchiveBytes\n    ) {\n      throw new Error('candidate workspace archive repository index is invalid')\n    }\n    workingTree = {\n      indexManifest: {\n        sha256: working.indexManifest.sha256 as `sha256:${string}`,\n        byteLength: working.indexManifest.byteLength as number,\n      },\n    }\n  }\n  return {\n    kind: archiveKind,\n    headCommit: value.headCommit,\n    headTree: value.headTree,\n    bundle: {\n      sha256: value.bundle.sha256 as `sha256:${string}`,\n      byteLength: value.bundle.byteLength as number,\n    },\n    ...(workingTree ? { workingTree } : {}),\n  }\n}\n\nfunction repositoryFromTar(\n  metadata: WorkspaceArchiveRepositoryMetadata,\n  bundle: Uint8Array,\n  indexManifest: Uint8Array | undefined,\n  indexFiles: DecodedWorkspaceArchive['files'],\n): WorkspaceArchiveRepository {\n  verifyBytes(bundle, metadata.bundle.sha256, metadata.bundle.byteLength, 'candidate Git bundle')\n  if (metadata.workingTree && indexManifest) {\n    verifyBytes(\n      indexManifest,\n      metadata.workingTree.indexManifest.sha256,\n      metadata.workingTree.indexManifest.byteLength,\n      'candidate Git index manifest',\n    )\n    if (\n      !Buffer.from(indexManifest).equals(\n        Buffer.from(canonicalCandidateBytes(candidateWorkspaceManifest(indexFiles))),\n      )\n    ) {\n      throw new Error('candidate Git index files do not match the captured manifest')\n    }\n  }\n  return {\n    headCommit: metadata.headCommit,\n    headTree: metadata.headTree,\n    bundle: { ...metadata.bundle, bytes: bundle },\n    ...(metadata.workingTree && indexManifest ? { workingTree: { files: indexFiles } } : {}),\n  }\n}\n\nasync function writeTarEntry(\n  archive: Pack,\n  name: string,\n  mode: number,\n  bytes: Uint8Array,\n): Promise<void> {\n  await new Promise<void>((resolveEntry, rejectEntry) => {\n    archive.entry(\n      workspaceTarHeader(name, mode, bytes.byteLength),\n      Buffer.from(bytes.buffer, bytes.byteOffset, bytes.byteLength),\n      (error) => (error ? rejectEntry(error) : resolveEntry()),\n    )\n  })\n}\n\ntype TarEntry = TarExtract extends AsyncIterable<infer Entry> ? Entry : never\n\nasync function readTarEntry(entry: TarEntry, maxBytes: number, label: string): Promise<Uint8Array> {\n  const size = entry.header.size\n  if (!Number.isSafeInteger(size) || size === undefined || size < 0 || size > maxBytes) {\n    throw new Error(`${label} has an invalid tar size`)\n  }\n  const bytes = await collectStream(entry, maxBytes, label)\n  if (bytes.byteLength !== size) throw new Error(`${label} differs from its tar size`)\n  return bytes\n}\n\nasync function collectStream(\n  stream: AsyncIterable<unknown>,\n  maxBytes: number,\n  label: string,\n): Promise<Uint8Array> {\n  const chunks: Buffer[] = []\n  let totalBytes = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - totalBytes) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const bytes = Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)\n    chunks.push(bytes)\n    totalBytes += bytes.byteLength\n  }\n  return Buffer.concat(chunks, totalBytes)\n}\n\nasync function streamEqualsBytes(\n  stream: AsyncIterable<unknown>,\n  expected: Uint8Array,\n  maxBytes: number,\n  label: string,\n): Promise<boolean> {\n  const expectedBuffer = Buffer.from(expected.buffer, expected.byteOffset, expected.byteLength)\n  let equal = true\n  let offset = 0\n  for await (const chunk of stream) {\n    if (!(chunk instanceof Uint8Array)) {\n      throw new Error(`${label} emitted a non-byte chunk`)\n    }\n    if (chunk.byteLength > maxBytes - offset) {\n      const error = new Error(`${label} exceeds its size limit`)\n      if ('destroy' in stream && typeof stream.destroy === 'function') stream.destroy(error)\n      throw error\n    }\n    const observed = Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength)\n    if (\n      offset + observed.byteLength > expectedBuffer.byteLength ||\n      !observed.equals(expectedBuffer.subarray(offset, offset + observed.byteLength))\n    ) {\n      equal = false\n    }\n    offset += observed.byteLength\n  }\n  return equal && offset === expectedBuffer.byteLength\n}\n\nfunction assertArchiveMatchesSnapshot(\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence,\n): void {\n  const material = candidateWorkspaceManifest(files)\n  const materialBytes = canonicalCandidateBytes(material)\n  verifyBytes(\n    materialBytes,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (\n    canonicalCandidateDigest(material) !== snapshot.digest ||\n    !Buffer.from(materialBytes).equals(Buffer.from(canonicalCandidateBytes(snapshot.material)))\n  ) {\n    throw new Error('candidate workspace archive does not match its snapshot manifest')\n  }\n}\n\nexport function assertWorkspaceFilesWithinLimits(\n  files: ReadonlyArray<\n    { path: string; mode: number } & ({ bytes: Uint8Array } | { byteLength: number })\n  >,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (files.length > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  let previousPath: string | undefined\n  const observedPaths = new Set<string>()\n  for (const file of files) {\n    const path = safeArchivePath(file.path, limits.maxPathBytes)\n    assertWorkspacePathOrder(\n      path,\n      previousPath,\n      observedPaths,\n      'candidate workspace paths must be unique and sorted',\n    )\n    previousPath = path\n    if (!isWorkspaceFileMode(file.mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    if ('bytes' in file && 'byteLength' in file)\n      throw new Error(`candidate workspace file has ambiguous length: ${path}`)\n    const byteLength = 'bytes' in file ? file.bytes.byteLength : file.byteLength\n    if (!Number.isSafeInteger(byteLength) || byteLength < 0 || byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    totalBytes += byteLength\n    if (totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n  }\n}\n\nfunction normalizeWorkspaceFiles(\n  input: readonly AgentCandidateExecutorWorkspaceFile[],\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): AgentCandidateExecutorWorkspaceFile[] {\n  if (!Array.isArray(input)) {\n    throw new Error('candidate workspace files must be an array')\n  }\n  const fileCount = input.length\n  if (fileCount > limits.maxFiles) {\n    throw new Error('candidate workspace exceeds maxFiles')\n  }\n  let totalBytes = 0\n  const files: AgentCandidateExecutorWorkspaceFile[] = []\n  for (let index = 0; index < fileCount; index++) {\n    const inputFile = input[index]\n    if (!isRecord(inputFile) || Object.keys(inputFile).sort().join(',') !== 'bytes,mode,path') {\n      throw new Error(`candidate workspace file ${index} is invalid`)\n    }\n    const descriptors = Object.getOwnPropertyDescriptors(inputFile)\n    if (\n      !('value' in (descriptors.path ?? {})) ||\n      !('value' in (descriptors.mode ?? {})) ||\n      !('value' in (descriptors.bytes ?? {}))\n    ) {\n      throw new Error(`candidate workspace file ${index} must use fixed values`)\n    }\n    const path = safeArchivePath(descriptors.path?.value, limits.maxPathBytes)\n    const mode = descriptors.mode?.value\n    const inputBytes = descriptors.bytes?.value\n    if (!isWorkspaceFileMode(mode)) {\n      throw new Error(`candidate workspace file has unsupported mode: ${path}`)\n    }\n    const view = inspectWorkspaceBytes(inputBytes, path)\n    if (view.byteLength > limits.maxFileBytes) {\n      throw new Error(`candidate workspace file exceeds maxFileBytes: ${path}`)\n    }\n    if (view.byteLength > limits.maxTotalFileBytes - totalBytes) {\n      throw new Error('candidate workspace exceeds maxTotalFileBytes')\n    }\n    if (view.byteLength > Math.max(0, limits.maxArchiveBytes - 1024)) {\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    }\n    totalBytes += view.byteLength\n    files.push({ path, mode, bytes: detachWorkspaceBytes(view) })\n  }\n  files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  return files\n}\n\nfunction isWorkspaceFileMode(value: unknown): value is number {\n  return Number.isSafeInteger(value) && (value as number) >= 0 && (value as number) <= 0o777\n}\n\nexport function workspaceLimits(\n  overrides: Partial<AgentCandidateWorkspaceArchiveLimits> | undefined,\n): AgentCandidateWorkspaceArchiveLimits {\n  const limits = { ...defaultLimits, ...overrides }\n  for (const [name, value] of Object.entries(limits)) {\n    if (!Number.isSafeInteger(value) || value <= 0) {\n      throw new Error(`candidate workspace ${name} must be a positive safe integer`)\n    }\n  }\n  return Object.freeze(limits)\n}\n\nexport function safeArchivePath(value: unknown, maxPathBytes: number): string {\n  if (\n    typeof value !== 'string' ||\n    !value ||\n    !isWellFormedUnicode(value) ||\n    Buffer.byteLength(value, 'utf8') > maxPathBytes ||\n    isAbsolute(value) ||\n    win32.isAbsolute(value) ||\n    value.includes('\\\\') ||\n    value.includes('\\0') ||\n    hasControlCharacter(value) ||\n    value.split('/').some((part) => !part || part === '.' || part === '..') ||\n    ['.git', '.sidecar'].includes(value.split('/')[0]?.toLowerCase() ?? '')\n  ) {\n    throw new Error(`candidate workspace archive contains an unsafe path: ${String(value)}`)\n  }\n  return value\n}\n\nexport function assertWorkspacePathOrder(\n  path: string,\n  previousPath: string | undefined,\n  observedPaths: Set<string>,\n  errorMessage: string,\n): void {\n  if (previousPath !== undefined && previousPath >= path) throw new Error(errorMessage)\n  for (let slash = path.indexOf('/'); slash !== -1; slash = path.indexOf('/', slash + 1)) {\n    if (observedPaths.has(path.slice(0, slash))) throw new Error(errorMessage)\n  }\n  observedPaths.add(path)\n}\n\nfunction inspectWorkspaceBytes(\n  input: unknown,\n  path: string,\n): { buffer: ArrayBuffer; byteOffset: number; byteLength: number } {\n  let buffer: ArrayBufferLike\n  let byteOffset: number\n  let byteLength: number\n  try {\n    buffer = typedArrayBufferGetter.call(input as Uint8Array) as ArrayBufferLike\n    byteOffset = typedArrayByteOffsetGetter.call(input as Uint8Array) as number\n    byteLength = typedArrayByteLengthGetter.call(input as Uint8Array) as number\n  } catch {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  if (isSharedArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file uses shared bytes: ${path}`)\n  }\n  if (!isAnyArrayBuffer(buffer)) {\n    throw new Error(`candidate workspace file bytes are invalid: ${path}`)\n  }\n  return { buffer, byteOffset, byteLength }\n}\n\nfunction detachWorkspaceBytes(input: {\n  buffer: ArrayBuffer\n  byteOffset: number\n  byteLength: number\n}): Uint8Array {\n  const { buffer, byteOffset, byteLength } = input\n  const copy = new Uint8Array(byteLength)\n  Uint8Array.prototype.set.call(copy, new Uint8Array(buffer, byteOffset, byteLength))\n  return copy\n}\n\nexport function assertGitObjectId(value: string, label: string): void {\n  if (!/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(value)) {\n    throw new Error(`candidate repository ${label} is not a Git object id`)\n  }\n}\n\ntype TypedArrayGetter = (this: Uint8Array) => unknown\n\nfunction requireTypedArrayGetter(name: 'buffer' | 'byteOffset' | 'byteLength'): TypedArrayGetter {\n  const typedArrayPrototype = Object.getPrototypeOf(Uint8Array.prototype) as object\n  const getter = Object.getOwnPropertyDescriptor(typedArrayPrototype, name)?.get\n  if (!getter) throw new Error(`typed array intrinsic ${name} accessor is unavailable`)\n  return getter\n}\n\nconst typedArrayBufferGetter = requireTypedArrayGetter('buffer')\nconst typedArrayByteOffsetGetter = requireTypedArrayGetter('byteOffset')\nconst typedArrayByteLengthGetter = requireTypedArrayGetter('byteLength')\n\n/** Shared canonical header for both archive encoders. */\nexport function workspaceTarHeader(name: string, mode: number, size: number) {\n  return {\n    name,\n    mode,\n    uid: 0,\n    gid: 0,\n    size,\n    mtime: fixedTarTime,\n    type: 'file' as const,\n    uname: '',\n    gname: '',\n  }\n}\n","import { spawn } from 'node:child_process'\nimport { mkdir, mkdtemp, readFile, realpath, rm, stat } from 'node:fs/promises'\nimport { tmpdir } from 'node:os'\nimport { join, resolve } from 'node:path'\nimport type {\n  AgentCandidateCode,\n  AgentCandidateGitHubRepository,\n  AgentCandidateGitHubResource,\n  AgentCandidateWorkspaceManifestMaterial,\n} from '@tangle-network/agent-interface'\nimport { hasControlCharacter } from '../path-control-characters'\n\nimport { candidateWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes } from './digest'\nimport type { AgentCandidateRepositoryPort } from './types'\n\ninterface GitResult {\n  stdout: Buffer\n  stderr: Buffer\n}\n\nexport async function verifyCandidateCode(\n  code: AgentCandidateCode,\n  repositories: AgentCandidateRepositoryPort,\n  patchBytes?: Uint8Array,\n): Promise<string | undefined> {\n  if (code.kind === 'disabled') return undefined\n  const repositoryRoot = await verifiedRepositoryRoot(code.repository, repositories)\n  await assertCommitAndBaseTree(repositoryRoot, code.baseCommit, code.baseTree)\n\n  if (code.kind === 'no-op') {\n    await assertSafeTree(repositoryRoot, code.baseTree)\n    return code.baseTree\n  }\n  if (!patchBytes) throw new Error('git-patch candidate is missing verified patch bytes')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-git-'))\n  try {\n    const indexFile = join(temporary, 'index')\n    await runCandidateGit(repositoryRoot, ['read-tree', code.baseTree], undefined, {\n      GIT_INDEX_FILE: indexFile,\n    })\n    await runCandidateGit(\n      repositoryRoot,\n      ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n      patchBytes,\n      { GIT_INDEX_FILE: indexFile },\n    )\n    const candidateTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, {\n        GIT_INDEX_FILE: indexFile,\n      })\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (candidateTree !== code.candidateTree) {\n      throw new Error(\n        `git patch materialized tree ${candidateTree} does not match ${code.candidateTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, candidateTree)\n    return candidateTree\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport async function readCandidateGitHubResource(\n  resource: AgentCandidateGitHubResource,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<Uint8Array> {\n  const repositoryRoot = await verifiedRepositoryRoot(resource.repository, repositories)\n  const commitType = (\n    await runCandidateGit(repositoryRoot, ['cat-file', '-t', resource.commit])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (commitType !== 'commit') {\n    throw new Error(`GitHub resource commit is not a commit object: ${resource.commit}`)\n  }\n  const listing = (\n    await runCandidateGit(repositoryRoot, ['ls-tree', '-z', resource.commit, '--', resource.path])\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length !== 1 || entries[0]?.path !== resource.path) {\n    throw new Error(`GitHub resource path is not one exact file: ${resource.path}`)\n  }\n  const entry = entries[0]\n  if (entry?.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n    throw new Error(`GitHub resource path is not a regular Git blob: ${resource.path}`)\n  }\n  const bytes = (await runCandidateGit(repositoryRoot, ['cat-file', 'blob', entry.object])).stdout\n  verifyBytes(bytes, resource.sha256, resource.byteLength, `GitHub resource ${resource.path}`)\n  return Uint8Array.from(bytes)\n}\n\nexport async function verifyTaskCheckout(\n  taskRoot: string,\n  expected: { baseCommit: string; baseTree: string },\n): Promise<void> {\n  const root = resolve(taskRoot)\n  const head = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim()\n  if (head !== expected.baseCommit) {\n    throw new Error(`task checkout HEAD ${head} does not match ${expected.baseCommit}`)\n  }\n  const tree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  if (tree !== expected.baseTree) {\n    throw new Error(`task checkout base tree ${tree} does not match ${expected.baseTree}`)\n  }\n}\n\n/**\n * Apply an evaluator-captured binary diff in a detached object database and\n * prove its result tree exactly matches the captured after-state manifest.\n */\nexport async function verifyTaskOutcomePatch(input: {\n  repositoryRoot: string\n  baseCommit: string\n  baseTree: string\n  resultTree: string\n  patch: Uint8Array\n  afterState: AgentCandidateWorkspaceManifestMaterial\n}): Promise<{ resultTree: string; resultCommit: string }> {\n  const repositoryRoot = resolve(input.repositoryRoot)\n  await verifyTaskCheckout(repositoryRoot, input)\n  const gitDir = resolve(\n    (await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('task Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'task repository')\n\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-task-outcome-'))\n  try {\n    const objectDirectory = join(temporary, 'objects')\n    const indexFile = join(temporary, 'index')\n    await mkdir(objectDirectory)\n    const gitEnvironment = {\n      GIT_INDEX_FILE: indexFile,\n      GIT_OBJECT_DIRECTORY: objectDirectory,\n      GIT_ALTERNATE_OBJECT_DIRECTORIES: join(gitDir, 'objects'),\n    }\n    await runCandidateGit(repositoryRoot, ['read-tree', input.baseTree], undefined, gitEnvironment)\n    if (input.patch.byteLength > 0) {\n      await runCandidateGit(\n        repositoryRoot,\n        ['apply', '--cached', '--binary', '--whitespace=nowarn', '-'],\n        input.patch,\n        gitEnvironment,\n      )\n    }\n    const resultTree = (\n      await runCandidateGit(repositoryRoot, ['write-tree'], undefined, gitEnvironment)\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (resultTree !== input.resultTree) {\n      throw new Error(\n        `task outcome patch materialized tree ${resultTree} does not match ${input.resultTree}`,\n      )\n    }\n    await assertSafeTree(repositoryRoot, resultTree, gitEnvironment)\n    const observed = await workspaceManifestFromGitTree(repositoryRoot, resultTree, gitEnvironment)\n    if (\n      !Buffer.from(canonicalCandidateBytes(observed)).equals(\n        Buffer.from(canonicalCandidateBytes(input.afterState)),\n      )\n    ) {\n      throw new Error('task outcome after-state does not match the materialized result tree')\n    }\n    const resultCommit = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['commit-tree', resultTree, '-p', input.baseCommit],\n        Buffer.from('candidate task outcome\\n', 'utf8'),\n        {\n          ...gitEnvironment,\n          GIT_AUTHOR_NAME: 'Tangle Evaluator',\n          GIT_AUTHOR_EMAIL: 'evaluator@tangle.tools',\n          GIT_AUTHOR_DATE: '2000-01-01T00:00:00Z',\n          GIT_COMMITTER_NAME: 'Tangle Evaluator',\n          GIT_COMMITTER_EMAIL: 'evaluator@tangle.tools',\n          GIT_COMMITTER_DATE: '2000-01-01T00:00:00Z',\n        },\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    const committedTree = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['rev-parse', `${resultCommit}^{tree}`],\n        undefined,\n        gitEnvironment,\n      )\n    ).stdout\n      .toString('utf8')\n      .trim()\n    if (committedTree !== resultTree) {\n      throw new Error('task outcome evaluator commit does not bind the verified result tree')\n    }\n    return { resultTree, resultCommit }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function verifiedRepositoryRoot(\n  repository: AgentCandidateGitHubRepository,\n  repositories: AgentCandidateRepositoryPort,\n): Promise<string> {\n  const repositoryRoot = resolve(await repositories.resolve(repository))\n  const rootStats = await stat(repositoryRoot)\n  if (!rootStats.isDirectory()) throw new Error('candidate repository path is not a directory')\n\n  const origin = (await runCandidateGit(repositoryRoot, ['remote', 'get-url', 'origin'])).stdout\n    .toString('utf8')\n    .trim()\n  const actual = parseGitHubRemote(origin)\n  if (!actual || actual.owner !== repository.owner || actual.repo !== repository.repo) {\n    throw new Error(\n      `local repository origin ${origin || '<missing>'} does not match github.com/${repository.owner}/${repository.repo}`,\n    )\n  }\n\n  const gitDirText = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', '--absolute-git-dir'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const gitDir = resolve(gitDirText)\n  await assertNoGitIndirection(repositoryRoot, gitDir, 'candidate repository')\n  return repositoryRoot\n}\n\nexport async function assertNoGitIndirection(\n  repositoryRoot: string,\n  gitDir: string,\n  label: string,\n): Promise<void> {\n  const replacements = (\n    await runCandidateGit(repositoryRoot, ['for-each-ref', '--format=%(refname)', 'refs/replace'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (replacements) throw new Error(`${label} contains Git replace refs`)\n  // `--git-common-dir` answers relative to the worktree for an ordinary repository, so the\n  // path is resolved against a root the caller supplied and carries whatever symlinks that\n  // root carries. Read the object store through its RESOLVED path: the alternates below must\n  // be read at the real location, and a symlinked prefix is the OS's own doing on macOS,\n  // where a temp root lives under /var, a symlink to /private/var.\n  const commonDir = await realpath(\n    resolve(\n      repositoryRoot,\n      (await runCandidateGit(repositoryRoot, ['rev-parse', '--git-common-dir'])).stdout\n        .toString('utf8')\n        .trim(),\n    ),\n  )\n  if (commonDir.includes(':')) {\n    throw new Error(`${label} Git common directory has an unsupported path`)\n  }\n  for (const objectRoot of new Set([gitDir, commonDir])) {\n    for (const name of ['alternates', 'http-alternates']) {\n      const path = join(objectRoot, 'objects', 'info', name)\n      try {\n        const contents = await readFile(path, 'utf8')\n        if (contents.trim()) throw new Error(`${label} uses forbidden Git ${name}`)\n      } catch (error) {\n        if (!isNoEntry(error)) throw error\n      }\n    }\n  }\n}\n\nasync function assertCommitAndBaseTree(\n  repositoryRoot: string,\n  commit: string,\n  expectedTree: string,\n): Promise<void> {\n  const type = (await runCandidateGit(repositoryRoot, ['cat-file', '-t', commit])).stdout\n    .toString('utf8')\n    .trim()\n  if (type !== 'commit') throw new Error(`candidate base object is not a commit: ${commit}`)\n  const actualTree = (\n    await runCandidateGit(repositoryRoot, ['rev-parse', `${commit}^{tree}`])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  if (actualTree !== expectedTree) {\n    throw new Error(`candidate base commit tree ${actualTree} does not match ${expectedTree}`)\n  }\n}\n\nasync function assertSafeTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n): Promise<void> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rz', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const entries = parseTreeEntries(listing)\n  if (entries.length === 0) throw new Error('candidate Git tree cannot be empty')\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(\n        `candidate Git tree contains a symlink, submodule, or non-blob: ${entry.path}`,\n      )\n    }\n    assertSafeGitPath(entry.path)\n  }\n}\n\nasync function workspaceManifestFromGitTree(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string>,\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  return candidateWorkspaceManifest(\n    await readCandidateGitTreeFiles(repositoryRoot, tree, environment),\n  )\n}\n\nexport async function readCandidateGitTreeFiles(\n  repositoryRoot: string,\n  tree: string,\n  environment: Record<string, string> = {},\n  limits?: { maxFiles: number; maxFileBytes: number; maxTotalFileBytes: number },\n): Promise<Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }>> {\n  const listing = (\n    await runCandidateGit(\n      repositoryRoot,\n      ['ls-tree', '-rzl', '--full-tree', tree],\n      undefined,\n      environment,\n    )\n  ).stdout\n  const files: Array<{ path: string; mode: 0o644 | 0o755; bytes: Uint8Array }> = []\n  const entries = parseTreeEntries(listing)\n  if (limits && entries.length > limits.maxFiles) {\n    throw new Error('candidate Git tree exceeds maxFiles')\n  }\n  let totalBytes = 0\n  for (const entry of entries) {\n    if (entry.type !== 'blob' || (entry.mode !== '100644' && entry.mode !== '100755')) {\n      throw new Error(`candidate Git tree contains a non-regular file: ${entry.path}`)\n    }\n    assertSafeGitPath(entry.path)\n    if (entry.size === undefined) {\n      throw new Error(`candidate Git tree is missing blob size: ${entry.path}`)\n    }\n    if (limits && entry.size > limits.maxFileBytes) {\n      throw new Error(`candidate Git tree file exceeds maxFileBytes: ${entry.path}`)\n    }\n    totalBytes += entry.size\n    if (limits && totalBytes > limits.maxTotalFileBytes) {\n      throw new Error('candidate Git tree exceeds maxTotalFileBytes')\n    }\n    const bytes = (\n      await runCandidateGit(\n        repositoryRoot,\n        ['cat-file', 'blob', entry.object],\n        undefined,\n        environment,\n      )\n    ).stdout\n    if (bytes.byteLength !== entry.size) {\n      throw new Error(`candidate Git blob size changed: ${entry.path}`)\n    }\n    files.push({\n      path: entry.path,\n      mode: entry.mode === '100755' ? 0o755 : 0o644,\n      bytes: Uint8Array.from(bytes),\n    })\n  }\n  return files.sort((left, right) => (left.path < right.path ? -1 : left.path > right.path ? 1 : 0))\n}\n\nfunction parseTreeEntries(bytes: Uint8Array): Array<{\n  mode: string\n  type: string\n  object: string\n  size?: number\n  path: string\n}> {\n  const raw = Buffer.from(bytes)\n  const decoded = raw.toString('utf8')\n  if (!Buffer.from(decoded, 'utf8').equals(raw)) {\n    throw new Error('candidate Git tree contains a non-UTF-8 path')\n  }\n  const rows = decoded.split('\\0').filter(Boolean)\n  return rows.map((row) => {\n    const tab = row.indexOf('\\t')\n    const header = row.slice(0, tab).split(' ').filter(Boolean)\n    const path = row.slice(tab + 1)\n    const [mode, type, object, sizeText] = header\n    if (tab < 1 || !mode || !type || !object || !path) {\n      throw new Error('malformed Git tree entry')\n    }\n    const size = sizeText && /^\\d+$/.test(sizeText) ? Number(sizeText) : undefined\n    if (size !== undefined && !Number.isSafeInteger(size)) {\n      throw new Error('candidate Git tree entry size exceeds the safe integer range')\n    }\n    return { mode, type, object, ...(size === undefined ? {} : { size }), path }\n  })\n}\n\nfunction assertSafeGitPath(path: string): void {\n  if (\n    !path ||\n    path.startsWith('/') ||\n    path.includes('\\\\') ||\n    path.includes('\\0') ||\n    hasControlCharacter(path) ||\n    path.split('/').some((part) => !part || part === '.' || part === '..') ||\n    path.split('/')[0]?.toLowerCase() === '.git'\n  ) {\n    throw new Error(`candidate Git tree contains an unsafe path: ${path}`)\n  }\n}\n\nfunction parseGitHubRemote(value: string): { owner: string; repo: string } | undefined {\n  const match = value.match(\n    /^(?:https?:\\/\\/github\\.com\\/|ssh:\\/\\/git@github\\.com\\/|git@github\\.com:)([^/]+)\\/([^/]+?)(?:\\.git)?$/,\n  )\n  if (!match?.[1] || !match[2]) return undefined\n  return { owner: match[1], repo: match[2] }\n}\n\nexport async function runCandidateGit(\n  repositoryRoot: string,\n  args: string[],\n  input?: Uint8Array,\n  extraEnv: Record<string, string> = {},\n  options: { maxOutputBytes?: number; readUserExclusions?: boolean } = {},\n): Promise<GitResult> {\n  if (\n    options.readUserExclusions &&\n    (args.length !== 7 ||\n      args.slice(0, 4).join(',') !== 'config,--includes,--path,--default' ||\n      args.slice(5).join(',') !== '--get,core.excludesFile')\n  ) {\n    throw new Error('user Git configuration may only supply the effective exclusion path')\n  }\n  if (\n    options.maxOutputBytes !== undefined &&\n    (!Number.isSafeInteger(options.maxOutputBytes) || options.maxOutputBytes < 0)\n  ) {\n    throw new Error('candidate Git maxOutputBytes must be a nonnegative safe integer')\n  }\n  const env = Object.fromEntries(\n    Object.entries(process.env).filter(([name]) => !name.startsWith('GIT_')),\n  ) as Record<string, string>\n  Object.assign(env, {\n    GIT_CONFIG_NOSYSTEM: '1',\n    GIT_CONFIG_GLOBAL: '/dev/null',\n    GIT_CONFIG_SYSTEM: '/dev/null',\n    GIT_TERMINAL_PROMPT: '0',\n    GIT_NO_REPLACE_OBJECTS: '1',\n    LC_ALL: 'C',\n    ...extraEnv,\n  })\n  // Only this read-only config query can consult user configuration. Commands which read blobs,\n  // bundle, or restore a repository retain isolation from credentials and executable settings.\n  if (options.readUserExclusions) {\n    for (const name of ['GIT_CONFIG_GLOBAL', 'GIT_CONFIG_SYSTEM', 'GIT_CONFIG_NOSYSTEM']) {\n      delete env[name]\n      if (process.env[name] !== undefined) env[name] = process.env[name]\n    }\n  }\n  const fullArgs = [\n    '-c',\n    'core.hooksPath=/dev/null',\n    '-c',\n    'core.fsmonitor=false',\n    '-c',\n    'core.untrackedCache=false',\n    '-c',\n    'protocol.file.allow=never',\n    '-C',\n    repositoryRoot,\n    ...args,\n  ]\n  return await new Promise((resolveResult, reject) => {\n    const child = spawn('git', fullArgs, { env, stdio: ['pipe', 'pipe', 'pipe'] })\n    const stdout: Buffer[] = []\n    const stderr: Buffer[] = []\n    let outputBytes = 0\n    let exceeded = false\n    function retain(chunks: Buffer[], chunk: Buffer): void {\n      if (exceeded) return\n      outputBytes += chunk.byteLength\n      if (options.maxOutputBytes !== undefined && outputBytes > options.maxOutputBytes) {\n        exceeded = true\n        child.kill('SIGKILL')\n        return\n      }\n      chunks.push(chunk)\n    }\n    child.stdout.on('data', (chunk: Buffer) => retain(stdout, chunk))\n    child.stderr.on('data', (chunk: Buffer) => retain(stderr, chunk))\n    child.on('error', reject)\n    child.stdin.on('error', reject)\n    child.on('close', (code, signal) => {\n      if (exceeded) {\n        reject(new Error('candidate Git command exceeds maxOutputBytes'))\n        return\n      }\n      const out = Buffer.concat(stdout)\n      const err = Buffer.concat(stderr)\n      if (code !== 0) {\n        reject(\n          new Error(\n            `git ${args[0] ?? '<command>'} failed (${signal ?? code}): ${err.toString('utf8').trim()}`,\n          ),\n        )\n        return\n      }\n      resolveResult({ stdout: out, stderr: err })\n    })\n    if (input) child.stdin.end(input)\n    else child.stdin.end()\n  })\n}\n\nfunction isNoEntry(error: unknown): boolean {\n  return (\n    typeof error === 'object' &&\n    error !== null &&\n    'code' in error &&\n    (error as { code?: string }).code === 'ENOENT'\n  )\n}\n","import { randomUUID } from 'node:crypto'\nimport { constants as fsConstants } from 'node:fs'\nimport {\n  lstat,\n  mkdir,\n  mkdtemp,\n  open,\n  readdir,\n  readFile,\n  realpath,\n  rename,\n  rm,\n  writeFile,\n} from 'node:fs/promises'\nimport { homedir, tmpdir } from 'node:os'\nimport { dirname, join, resolve, sep } from 'node:path'\nimport type { AgentCandidateWorkspaceSnapshotEvidence } from '@tangle-network/agent-interface'\nimport {\n  candidateWorkspaceManifest,\n  captureMaterializedWorkspace,\n  verifyMaterializedWorkspace,\n} from './artifacts'\nimport { canonicalCandidateBytes, sha256Bytes } from './digest'\nimport {\n  assertNoGitIndirection,\n  readCandidateGitTreeFiles,\n  runCandidateGit,\n} from './git-materialize'\nimport type { AgentCandidateOutputArtifactPort, AgentCandidateWorkspacePort } from './types'\nimport {\n  type AgentCandidateWorkspaceArchiveLimits,\n  assertGitObjectId,\n  assertWorkspaceFilesWithinLimits,\n  type CapturedAgentCandidateWorkspace,\n  captureWorkspaceFiles,\n  decodeVerifiedWorkspaceArchive,\n  safeArchivePath,\n  type WorkspaceArchiveRepository,\n  workspaceLimits,\n} from './workspace-archive'\n\nexport interface CaptureAgentCandidateWorkspaceOptions {\n  /** Include Git HEAD so task preparation can prove its exact commit and tree. */\n  includeRepository?: boolean\n  /**\n   * `working-tree` preserves tracked and unignored untracked regular files, deletions, exact modes,\n   * and the complete bounded Git index. Git-ignored files stay excluded. Requires includeRepository.\n   * The caller must hold the workspace lease against writers; observed drift fails capture.\n   * The manifest digest covers files, while the archive digest also binds HEAD and the index.\n   */\n  repositoryContents?: 'head' | 'working-tree'\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /** Use the evaluator-owned artifact store when manifest or archive bytes should not be embedded. */\n  artifactPersistence?: {\n    executionId: string\n    outputArtifacts: AgentCandidateOutputArtifactPort\n    signal?: AbortSignal\n  }\n}\n\nexport interface CreateAgentCandidateWorkspacePortOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n}\n\n/** Capture one exact regular-file workspace for immutable candidate execution. */\nexport async function captureAgentCandidateWorkspace(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceOptions = {},\n): Promise<CapturedAgentCandidateWorkspace> {\n  const root = resolve(rootInput)\n  const limits = workspaceLimits(options.limits)\n  if (\n    options.repositoryContents !== undefined &&\n    options.repositoryContents !== 'head' &&\n    options.repositoryContents !== 'working-tree'\n  ) {\n    throw new Error('candidate repositoryContents is invalid')\n  }\n  if (options.repositoryContents !== undefined && !options.includeRepository) {\n    throw new Error('candidate repositoryContents requires includeRepository')\n  }\n  const captured = options.includeRepository\n    ? await captureRepository(root, limits, options.repositoryContents === 'working-tree')\n    : await captureMaterializedWorkspace(root, {\n        limits: {\n          maxFiles: limits.maxFiles,\n          maxFileBytes: limits.maxFileBytes,\n          maxTotalFileBytes: limits.maxTotalFileBytes,\n        },\n      })\n  assertWorkspaceFilesWithinLimits(captured.files, limits)\n  const repository = 'repository' in captured ? captured.repository : undefined\n  return captureWorkspaceFiles(captured.files, repository, limits, options.artifactPersistence)\n}\n\n/** Create the standard bounded materializer for candidate execution ports. */\nexport function createAgentCandidateWorkspacePort(\n  options: CreateAgentCandidateWorkspacePortOptions = {},\n): AgentCandidateWorkspacePort {\n  const limits = workspaceLimits(options.limits)\n  const port: AgentCandidateWorkspacePort = {\n    materialize: async ({ role, snapshot, archive, destination, signal }) => {\n      await materializeAgentCandidateWorkspace({\n        role,\n        snapshot,\n        archive,\n        destination,\n        limits,\n        signal,\n      })\n    },\n  }\n  return Object.freeze(port)\n}\n\nasync function materializeAgentCandidateWorkspace(input: {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  archive: Uint8Array\n  destination: string\n  limits: AgentCandidateWorkspaceArchiveLimits\n  signal?: AbortSignal\n}): Promise<void> {\n  input.signal?.throwIfAborted()\n  const decoded = await decodeVerifiedWorkspaceArchive(input)\n  input.signal?.throwIfAborted()\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination, { createDestination: false })\n  input.signal?.throwIfAborted()\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    input.signal?.throwIfAborted()\n    await writeWorkspaceFiles(staging, decoded.files, input.signal)\n    if (decoded.repository) {\n      await materializeRepository(decoded.repository, staging, input.limits, input.signal)\n    }\n    input.signal?.throwIfAborted()\n    await verifyMaterializedWorkspace(staging, input.snapshot.material, {\n      ignoredProtectedRootEntries: decoded.repository ? ['.git'] : [],\n    })\n    input.signal?.throwIfAborted()\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function captureRepository(\n  requestedRoot: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  workingTree: boolean,\n): Promise<{\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n  repository: WorkspaceArchiveRepository\n}> {\n  const requestedStats = await lstat(requestedRoot)\n  if (!requestedStats.isDirectory() || requestedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must be a real directory')\n  }\n  // Capture the RESOLVED root. The property this guards is that capture starts at one real\n  // worktree root with no aliasing, which resolving satisfies directly — rejecting a symlinked\n  // prefix outright does not, and makes capture impossible on macOS, where the OS itself hands\n  // out temp paths under /var, a symlink to /private/var. Git reports a resolved path, so the\n  // worktree-root comparison below needs the resolved form on both sides.\n  const root = await realpath(requestedRoot)\n  const resolvedStats = await lstat(root)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate repository root must resolve to a real directory')\n  }\n  const topLevel = (await runCandidateGit(root, ['rev-parse', '--show-toplevel'])).stdout\n    .toString('utf8')\n    .trim()\n  if ((await realpath(resolve(topLevel))) !== root) {\n    throw new Error('candidate repository capture must start at the Git worktree root')\n  }\n  const gitDir = resolve(\n    (await runCandidateGit(root, ['rev-parse', '--absolute-git-dir'])).stdout\n      .toString('utf8')\n      .trim(),\n  )\n  if ((await realpath(gitDir)) !== gitDir || gitDir.includes(':')) {\n    throw new Error('candidate repository Git object store has an unsupported path')\n  }\n  await assertNoGitIndirection(root, gitDir, 'candidate repository')\n  const headCommit = (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout\n    .toString('utf8')\n    .trim()\n  const headTree = (await runCandidateGit(root, ['rev-parse', 'HEAD^{tree}'])).stdout\n    .toString('utf8')\n    .trim()\n  assertGitObjectId(headCommit, 'HEAD')\n  assertGitObjectId(headTree, 'HEAD tree')\n  if (headCommit.length !== headTree.length) {\n    throw new Error('candidate repository HEAD and tree use different object formats')\n  }\n  const working = workingTree ? await captureRepositoryWorkingTree(root, limits) : undefined\n  const files = working?.files ?? (await readCandidateGitTreeFiles(root, headTree, {}, limits))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const reachableBytesText = (\n    await runCandidateGit(root, ['rev-list', '--disk-usage', '--objects', 'HEAD'])\n  ).stdout\n    .toString('utf8')\n    .trim()\n  const reachableBytes = Number(reachableBytesText)\n  if (!Number.isSafeInteger(reachableBytes) || reachableBytes < 0) {\n    throw new Error('candidate repository reachable size is invalid')\n  }\n  if (reachableBytes > limits.maxRepositoryBundleBytes) {\n    throw new Error('candidate repository exceeds maxRepositoryBundleBytes')\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    await runCandidateGit(root, ['bundle', 'create', bundlePath, 'HEAD'])\n    const bundle = Uint8Array.from(await readFile(bundlePath))\n    if (bundle.byteLength > limits.maxRepositoryBundleBytes) {\n      throw new Error('candidate repository bundle exceeds maxRepositoryBundleBytes')\n    }\n    if (working) {\n      const after = await readRepositoryWorkingState(root, limits)\n      if (\n        after.paths !== working.state.paths ||\n        after.index !== working.state.index ||\n        (await runCandidateGit(root, ['rev-parse', 'HEAD'])).stdout.toString('utf8').trim() !==\n          headCommit\n      ) {\n        throw new Error('candidate repository changed during working-tree capture')\n      }\n      const presentPaths = await existingRepositoryPaths(root, after.paths, limits)\n      if (presentPaths.join('\\0') !== files.map((file) => file.path).join('\\0')) {\n        throw new Error('candidate repository files changed during working-tree capture')\n      }\n      await verifyMaterializedWorkspace(root, candidateWorkspaceManifest(files), {\n        ignoredProtectedRootEntries: ['.git'],\n        selectedPaths: files.map((file) => file.path),\n      })\n    }\n    return {\n      files,\n      repository: {\n        headCommit,\n        headTree,\n        bundle: {\n          sha256: sha256Bytes(bundle),\n          byteLength: bundle.byteLength,\n          bytes: bundle,\n        },\n        ...(working\n          ? {\n              workingTree: { files: working.state.files },\n            }\n          : {}),\n      },\n    }\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nasync function readRepositoryWorkingState(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<{\n  paths: string\n  index: string\n  files: Array<{ path: string; mode: number; bytes: Uint8Array }>\n}> {\n  const env = { GIT_OPTIONAL_LOCKS: '0' }\n  const listingLimit = Math.min(\n    limits.maxArchiveBytes,\n    limits.maxFiles * (limits.maxPathBytes + 256),\n  )\n  const index = new TextDecoder('utf-8', { fatal: true }).decode(\n    (\n      await runCandidateGit(root, ['ls-files', '--stage', '-z'], undefined, env, {\n        maxOutputBytes: listingLimit,\n      })\n    ).stdout,\n  )\n  const entries = index\n    .split('\\0')\n    .filter(Boolean)\n    .map((entry) => {\n      const match = /^(100644|100755) ([a-f0-9]{40}|[a-f0-9]{64}) 0\\t(.+)$/u.exec(entry)\n      if (!match)\n        throw new Error('candidate working-tree capture requires a resolved regular-file Git index')\n      const [, mode, object, path] = match\n      if (!object || !path) throw new Error('candidate Git index is invalid')\n      return {\n        path: safeArchivePath(path, limits.maxPathBytes),\n        mode: mode === '100755' ? 0o755 : 0o644,\n        object,\n      }\n    })\n  if (entries.length > limits.maxFiles) throw new Error('candidate Git index exceeds maxFiles')\n  const debugIndex = (\n    await runCandidateGit(root, ['ls-files', '--debug', '-z'], undefined, env, {\n      maxOutputBytes: listingLimit,\n    })\n  ).stdout.toString('utf8')\n  if ([...debugIndex.matchAll(/\\tflags: ([a-f0-9]+)\\n/gu)].some((match) => match[1] !== '0')) {\n    throw new Error('candidate working-tree capture does not support special Git index flags')\n  }\n  // Inspect every staged blob's size before reading any blob. A deleted or shortened working file\n  // must not conceal an oversized staged version, including highly compressible binary content.\n  const sizes = entries.length\n    ? (\n        await runCandidateGit(\n          root,\n          ['cat-file', '--batch-check'],\n          Buffer.from(entries.map((entry) => entry.object).join('\\n') + '\\n'),\n          env,\n          { maxOutputBytes: listingLimit },\n        )\n      ).stdout\n        .toString('utf8')\n        .trimEnd()\n        .split('\\n')\n    : []\n  if (sizes.length !== entries.length)\n    throw new Error('candidate Git index blob metadata is incomplete')\n  let totalBytes = 0\n  const byteLengths = entries.map((entry, index) => {\n    const match = /^([a-f0-9]{40}|[a-f0-9]{64}) blob (\\d+)$/u.exec(sizes[index] ?? '')\n    const size = Number(match?.[2])\n    if (!match || match[1] !== entry.object || !Number.isSafeInteger(size) || size < 0) {\n      throw new Error('candidate Git index blob metadata is invalid')\n    }\n    if (size > limits.maxFileBytes)\n      throw new Error(`candidate Git index file exceeds maxFileBytes: ${entry.path}`)\n    if (size > limits.maxTotalFileBytes - totalBytes)\n      throw new Error('candidate Git index exceeds maxTotalFileBytes')\n    totalBytes += size\n    return size\n  })\n  const files: Array<{ path: string; mode: number; bytes: Uint8Array }> = []\n  for (const [index, entry] of entries.entries()) {\n    const bytes = (\n      await runCandidateGit(root, ['cat-file', 'blob', entry.object], undefined, env, {\n        maxOutputBytes: limits.maxFileBytes,\n      })\n    ).stdout\n    if (bytes.byteLength !== byteLengths[index])\n      throw new Error('candidate Git index blob size changed')\n    files.push({ path: entry.path, mode: entry.mode, bytes: Uint8Array.from(bytes) })\n  }\n  files.sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))\n  assertWorkspaceFilesWithinLimits(files, limits)\n  const defaultExcludes = join(\n    process.env.XDG_CONFIG_HOME || join(homedir(), '.config'),\n    'git',\n    'ignore',\n  )\n  const excludes = new TextDecoder('utf-8', { fatal: true })\n    .decode(\n      (\n        await runCandidateGit(\n          root,\n          [\n            'config',\n            '--includes',\n            '--path',\n            '--default',\n            defaultExcludes,\n            '--get',\n            'core.excludesFile',\n          ],\n          undefined,\n          {},\n          { maxOutputBytes: limits.maxPathBytes, readUserExclusions: true },\n        )\n      ).stdout,\n    )\n    .replace(/\\n$/u, '')\n  const paths = new TextDecoder('utf-8', { fatal: true }).decode(\n    (\n      await runCandidateGit(\n        root,\n        [\n          '-c',\n          `core.excludesFile=${excludes}`,\n          'ls-files',\n          '--cached',\n          '--others',\n          '--exclude-standard',\n          '-z',\n        ],\n        undefined,\n        env,\n        { maxOutputBytes: listingLimit },\n      )\n    ).stdout,\n  )\n  for (const path of paths.split('\\0').filter(Boolean)) safeArchivePath(path, limits.maxPathBytes)\n  return { paths, index, files }\n}\n\nasync function captureRepositoryWorkingTree(\n  root: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n) {\n  const state = await readRepositoryWorkingState(root, limits)\n  const selectedPaths = await existingRepositoryPaths(root, state.paths, limits)\n  const captured = await captureMaterializedWorkspace(root, {\n    ignoredProtectedRootEntries: ['.git'],\n    selectedPaths,\n    limits,\n  })\n  const files = [...captured.files].sort((a, b) => (a.path < b.path ? -1 : a.path > b.path ? 1 : 0))\n  return { state, files }\n}\n\nasync function existingRepositoryPaths(\n  root: string,\n  listing: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): Promise<string[]> {\n  const paths = [...new Set(listing.split('\\0').filter(Boolean))].sort()\n  if (paths.length > limits.maxFiles) throw new Error('candidate workspace exceeds maxFiles')\n  const selectedPaths: string[] = []\n  for (const path of paths) {\n    const safe = safeArchivePath(path, limits.maxPathBytes)\n    try {\n      await lstat(workspacePath(root, safe))\n      selectedPaths.push(safe)\n    } catch (error) {\n      if (!(error instanceof Error && 'code' in error && error.code === 'ENOENT')) throw error\n    }\n  }\n  return selectedPaths\n}\n\nexport async function prepareEmptyDestination(\n  destination: string,\n  options: { createDestination?: boolean } = {},\n): Promise<void> {\n  await mkdir(options.createDestination === false ? dirname(destination) : destination, {\n    recursive: true,\n    mode: 0o700,\n  })\n  let stats\n  try {\n    stats = await lstat(destination)\n  } catch (error) {\n    if (options.createDestination === false && (error as NodeJS.ErrnoException).code === 'ENOENT')\n      return\n    throw error\n  }\n  if (!stats.isDirectory() || stats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must be a real directory')\n  }\n  // A symlinked PREFIX is the OS's own doing on macOS, where temp paths live under /var, a\n  // symlink to /private/var. What must hold is that the destination itself is a real\n  // directory, which both this check and the lstat above require.\n  const resolvedDestination = await realpath(destination)\n  const resolvedStats = await lstat(resolvedDestination)\n  if (!resolvedStats.isDirectory() || resolvedStats.isSymbolicLink()) {\n    throw new Error('candidate workspace destination must resolve to a real directory')\n  }\n  if ((await readdir(destination)).length > 0) {\n    throw new Error('candidate workspace destination must be empty')\n  }\n}\n\nasync function writeWorkspaceFiles(\n  destination: string,\n  files: ReadonlyArray<{ path: string; mode: number; bytes: Uint8Array }>,\n  signal?: AbortSignal,\n): Promise<void> {\n  for (const file of files) {\n    signal?.throwIfAborted()\n    const path = workspacePath(destination, file.path)\n    await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n    const descriptor = await open(\n      path,\n      fsConstants.O_WRONLY |\n        fsConstants.O_CREAT |\n        fsConstants.O_EXCL |\n        (typeof fsConstants.O_NOFOLLOW === 'number' ? fsConstants.O_NOFOLLOW : 0),\n      0o600,\n    )\n    try {\n      signal?.throwIfAborted()\n      await descriptor.writeFile(file.bytes, { signal })\n      const stats = await descriptor.stat()\n      if (!stats.isFile() || stats.nlink !== 1) {\n        throw new Error(`candidate workspace file identity changed while writing: ${file.path}`)\n      }\n      await descriptor.chmod(file.mode)\n      signal?.throwIfAborted()\n    } finally {\n      await descriptor.close()\n    }\n  }\n}\n\nasync function materializeRepository(\n  repository: WorkspaceArchiveRepository,\n  destination: string,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n  signal?: AbortSignal,\n): Promise<void> {\n  signal?.throwIfAborted()\n  const git = async (\n    args: string[],\n    bytes?: Uint8Array,\n    options: { maxOutputBytes?: number } = {},\n  ) => {\n    signal?.throwIfAborted()\n    const result = await runCandidateGit(destination, args, bytes, {}, options)\n    signal?.throwIfAborted()\n    return result\n  }\n  const temporary = await mkdtemp(join(tmpdir(), 'agent-candidate-workspace-bundle-'))\n  const bundlePath = join(temporary, `${randomUUID()}.bundle`)\n  try {\n    signal?.throwIfAborted()\n    await writeFile(bundlePath, repository.bundle.bytes, { flag: 'wx', mode: 0o600, signal })\n    await git([\n      'init',\n      '--quiet',\n      '--initial-branch=candidate',\n      `--object-format=${repository.headCommit.length === 64 ? 'sha256' : 'sha1'}`,\n    ])\n    await git(['bundle', 'verify', bundlePath])\n    await git(['bundle', 'unbundle', bundlePath])\n    const objectType = (await git(['cat-file', '-t', repository.headCommit])).stdout\n      .toString('utf8')\n      .trim()\n    if (objectType !== 'commit') throw new Error('candidate repository HEAD is not a commit')\n    const observedTree = (await git(['rev-parse', `${repository.headCommit}^{tree}`])).stdout\n      .toString('utf8')\n      .trim()\n    if (observedTree !== repository.headTree) {\n      throw new Error('candidate repository bundle HEAD tree changed')\n    }\n    await git(['update-ref', '--no-deref', 'HEAD', repository.headCommit])\n    await git(['read-tree', repository.headTree])\n    if (repository.workingTree) {\n      // All staged content has passed archive limits and manifest verification before Git sees it.\n      // Rebuilding an index from explicit blobs avoids binary-patch expansion and diff configuration.\n      await git(['read-tree', '--empty'])\n      const entries: string[] = []\n      for (const file of repository.workingTree.files) {\n        const object = (\n          await git(['hash-object', '-w', '--stdin'], file.bytes, { maxOutputBytes: 256 })\n        ).stdout\n          .toString('utf8')\n          .trim()\n        assertGitObjectId(object, 'staged blob')\n        entries.push(`${file.mode === 0o755 ? '100755' : '100644'} ${object}\\t${file.path}\\0`)\n      }\n      if (entries.length)\n        await git(['update-index', '-z', '--index-info'], Buffer.from(entries.join('')))\n      const indexTree = (await git(['write-tree'])).stdout.toString('utf8').trim()\n      const observed = await readCandidateGitTreeFiles(destination, indexTree, {}, limits)\n      signal?.throwIfAborted()\n      if (\n        !Buffer.from(canonicalCandidateBytes(candidateWorkspaceManifest(observed))).equals(\n          Buffer.from(\n            canonicalCandidateBytes(candidateWorkspaceManifest(repository.workingTree.files)),\n          ),\n        )\n      )\n        throw new Error('candidate repository staged files do not match the captured index')\n      return\n    }\n\n    const status = (await git(['status', '--porcelain=v1', '--untracked-files=all'])).stdout\n      .toString('utf8')\n      .trim()\n    if (status) throw new Error('candidate repository files do not exactly match HEAD')\n  } finally {\n    await rm(temporary, { recursive: true, force: true })\n  }\n}\n\nexport function workspacePath(root: string, relativePath: string): string {\n  const path = resolve(root, relativePath)\n  if (!path.startsWith(`${root}${sep}`)) {\n    throw new Error(`candidate workspace archive path escapes its destination: ${relativePath}`)\n  }\n  return path\n}\n","import { createHash } from 'node:crypto'\nimport { constants } from 'node:fs'\nimport { mkdir, mkdtemp, open, realpath, rename, rm } from 'node:fs/promises'\nimport { dirname, resolve } from 'node:path'\nimport { Readable } from 'node:stream'\nimport { pipeline } from 'node:stream/promises'\nimport type {\n  AgentCandidateArtifactRef,\n  AgentCandidateWorkspaceManifestMaterial,\n  AgentCandidateWorkspaceSnapshotEvidence,\n  Sha256Digest,\n} from '@tangle-network/agent-interface'\nimport { extract, type Pack, pack } from 'tar-stream'\nimport { mapWithConcurrency } from '../runtime/util'\nimport { persistCandidateOutputArtifactStream, verifiedArtifactChunks } from './artifact-streams'\nimport { scanMaterializedWorkspaceManifest, verifyBytes } from './artifacts'\nimport { canonicalCandidateBytes, canonicalCandidateDigest, deepFreezeCandidate } from './digest'\nimport type { AgentCandidateArtifactPort } from './types'\nimport {\n  type AgentCandidateWorkspaceArchiveLimits,\n  assertWorkspaceFilesWithinLimits,\n  workspaceLimits,\n  workspaceTarHeader,\n} from './workspace-archive'\nimport {\n  type CaptureAgentCandidateWorkspaceOptions,\n  prepareEmptyDestination,\n  workspacePath,\n} from './workspace-archive-local'\n\ntype WorkspaceFile = AgentCandidateWorkspaceManifestMaterial['files'][number]\n\n/**\n * Files a tree capture stores at once; each waits on a durable-store round trip of its own and on\n * four fsyncs. On drew-gtr-pro, with three 180 ms store requests per file, 64 at once\n * stored a 473-file workspace in 83 s and 110 s against 128 s and 139 s for 16 at once, in\n * alternating runs, holding the same 16 sync threads.\n */\nconst CAPTURE_FILES_AT_ONCE = 64\n\nexport interface CaptureAgentCandidateWorkspaceToArtifactsOptions {\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  /**\n   * Root-relative files or directories to leave out of the capture, each by its exact path. A\n   * caller whose root holds data another capture already keeps, such as a provider's retained\n   * native session trees, or an environment it can rebuild, such as a virtualenv, names them here\n   * instead of storing them on every capture. The manifest then describes only what was kept.\n   */\n  excludedPaths?: readonly string[]\n  artifactPersistence: NonNullable<CaptureAgentCandidateWorkspaceOptions['artifactPersistence']>\n}\n\n/** Capture regular files to durable artifacts with memory bounded by the manifest and stream buffers. */\nexport async function captureAgentCandidateWorkspaceToArtifacts(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceToArtifactsOptions,\n): Promise<{ readonly snapshot: AgentCandidateWorkspaceSnapshotEvidence }> {\n  const { outputArtifacts, executionId, signal } = options.artifactPersistence\n  if (!outputArtifacts.putStream || !outputArtifacts.readStream) {\n    throw new Error('streaming workspace persistence requires putStream and readStream')\n  }\n  if (!executionId.trim())\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  signal?.throwIfAborted()\n  const limits = workspaceLimits(options.limits)\n  const material = await scanMaterializedWorkspaceManifest(rootInput, {\n    limits,\n    signal,\n    excludedPaths: options.excludedPaths,\n  })\n  validateManifest(material, limits)\n  const root = await realpath(resolve(rootInput))\n  const manifest = canonicalCandidateBytes(material)\n  const manifestArtifact = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-manifest',\n    chunks: oneChunk(manifest),\n    maxBytes: manifest.byteLength,\n    signal,\n  })\n  const archiveArtifact = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-archive',\n    chunks: workspaceArchiveChunks(root, material, signal),\n    maxBytes: limits.maxArchiveBytes,\n    signal,\n  })\n  return Object.freeze({\n    snapshot: deepFreezeCandidate({\n      kind: 'agent-candidate-workspace-snapshot' as const,\n      digest: canonicalCandidateDigest(material),\n      material,\n      manifest: manifestArtifact,\n      archive: archiveArtifact,\n    }),\n  })\n}\n\n/**\n * A workspace stored as one content-addressed object per file plus the manifest that names them.\n *\n * Its digest is the manifest's, the same identity an archived capture of the same files has. Two\n * trees share every file they have in common, so storing one costs only the files no earlier\n * capture in the store holds: on Discovery Lab run terraform-dc-tokens-20261006d, the files a\n * director changed between two captures one to two minutes apart were 5.5 to 8.2 MB of a\n * 60 to 70 MB workspace.\n */\nexport interface AgentCandidateWorkspaceTree {\n  readonly kind: 'agent-candidate-workspace-tree'\n  /** The manifest's digest; the manifest is the object of this digest. */\n  readonly digest: Sha256Digest\n  readonly manifest: AgentCandidateArtifactRef\n  readonly files: number\n  /** The bytes of every file in the workspace. */\n  readonly bytes: number\n  /** The bytes this capture added to the store; every other file was already there. */\n  readonly storedBytes: number\n}\n\n/**\n * Store a workspace as a tree: each regular file the store does not already hold, then the\n * manifest. The store must find objects by content (`locate`) and stream them.\n */\nexport async function captureAgentCandidateWorkspaceTreeToArtifacts(\n  rootInput: string,\n  options: CaptureAgentCandidateWorkspaceToArtifactsOptions,\n): Promise<AgentCandidateWorkspaceTree> {\n  const { outputArtifacts, executionId, signal } = options.artifactPersistence\n  if (!outputArtifacts.putStream || !outputArtifacts.readStream || !outputArtifacts.locate) {\n    throw new Error('workspace tree persistence requires putStream, readStream and locate')\n  }\n  if (!executionId.trim())\n    throw new Error('candidate workspace artifact persistence requires an executionId')\n  signal?.throwIfAborted()\n  const limits = workspaceLimits(options.limits)\n  const material = await scanMaterializedWorkspaceManifest(rootInput, {\n    limits,\n    signal,\n    excludedPaths: options.excludedPaths,\n  })\n  validateManifest(material, limits)\n  const root = await realpath(resolve(rootInput))\n  const bytes = material.files.reduce((sum, file) => sum + file.byteLength, 0)\n  let storedBytes = 0\n  // Each file's put waits for its durable copy, so one file at a time costs a store round trip\n  // and its fsyncs per file: drew-gtr-pro's retire stored one 2 KB file per 1.8 s.\n  // Files with the same content are one object, stored once.\n  const distinct = [...new Map(material.files.map((file) => [file.sha256, file])).values()]\n  const locate = outputArtifacts.locate.bind(outputArtifacts)\n  await mapWithConcurrency(distinct, CAPTURE_FILES_AT_ONCE, async (file) => {\n    signal?.throwIfAborted()\n    const held = await locate(\n      { sha256: file.sha256, byteLength: file.byteLength },\n      signal === undefined ? undefined : { signal },\n    )\n    if (held !== undefined) return\n    const stored = await persistCandidateOutputArtifactStream(outputArtifacts, {\n      executionId,\n      purpose: 'candidate-workspace-file',\n      chunks: workspaceFileChunks(root, file, signal),\n      maxBytes: file.byteLength,\n      signal,\n    })\n    if (stored.sha256 !== file.sha256 || stored.byteLength !== file.byteLength)\n      throw new Error(`workspace file changed during capture: ${file.path}`)\n    storedBytes += file.byteLength\n  })\n  const manifestBytes = canonicalCandidateBytes(material)\n  const manifest = await persistCandidateOutputArtifactStream(outputArtifacts, {\n    executionId,\n    purpose: 'candidate-workspace-manifest',\n    chunks: oneChunk(manifestBytes),\n    maxBytes: manifestBytes.byteLength,\n    signal,\n  })\n  const digest = canonicalCandidateDigest(material)\n  if (manifest.sha256 !== digest)\n    throw new Error('candidate workspace manifest digest does not name its stored bytes')\n  return deepFreezeCandidate({\n    kind: 'agent-candidate-workspace-tree' as const,\n    digest,\n    manifest,\n    files: material.files.length,\n    bytes,\n    storedBytes,\n  })\n}\n\n/**\n * Read a tree back by its digest and confirm the store holds every file it names. Returns the\n * manifest; reading a file is `artifacts.read` of what `locate` returns for its digest.\n */\nexport async function verifyAgentCandidateWorkspaceTree(\n  tree: Pick<AgentCandidateWorkspaceTree, 'digest' | 'manifest'>,\n  artifacts: AgentCandidateArtifactPort,\n  options: { limits?: Partial<AgentCandidateWorkspaceArchiveLimits>; signal?: AbortSignal } = {},\n): Promise<AgentCandidateWorkspaceManifestMaterial> {\n  const { signal } = options\n  if (!artifacts.locate) throw new Error('workspace tree verification requires locate')\n  if (tree.manifest.sha256 !== tree.digest)\n    throw new Error('workspace tree digest does not name its manifest')\n  signal?.throwIfAborted()\n  // A durable store that holds evicted objects serves them as streams; its buffered read may refuse.\n  let bytes: Uint8Array\n  if (artifacts.readStream) {\n    const chunks: Uint8Array[] = []\n    for await (const chunk of verifiedArtifactChunks(tree.manifest, artifacts, signal))\n      chunks.push(chunk)\n    bytes = Buffer.concat(chunks)\n  } else bytes = await artifacts.read(tree.manifest)\n  verifyBytes(bytes, tree.manifest.sha256, tree.manifest.byteLength, 'workspace tree manifest')\n  const material = JSON.parse(\n    Buffer.from(bytes).toString('utf8'),\n  ) as AgentCandidateWorkspaceManifestMaterial\n  validateManifest(material, workspaceLimits(options.limits))\n  if (canonicalCandidateDigest(material) !== tree.digest)\n    throw new Error('workspace tree manifest is not canonical')\n  for (const file of material.files) {\n    signal?.throwIfAborted()\n    const held = await artifacts.locate(\n      { sha256: file.sha256, byteLength: file.byteLength },\n      signal === undefined ? undefined : { signal },\n    )\n    if (held === undefined) throw new Error(`workspace tree file is not in the store: ${file.path}`)\n  }\n  return material\n}\n\nexport interface AgentCandidateWorkspaceArtifactsOptions {\n  role: 'task' | 'candidate' | 'knowledge' | 'memory'\n  snapshot: AgentCandidateWorkspaceSnapshotEvidence\n  artifacts: AgentCandidateArtifactPort\n  limits?: Partial<AgentCandidateWorkspaceArchiveLimits>\n  signal?: AbortSignal\n}\n\n/** Verify durable regular-file workspace evidence without retaining archive or file contents. */\nexport async function verifyAgentCandidateWorkspaceArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions,\n): Promise<void> {\n  await consumeWorkspaceArtifacts(input)\n}\n\n/** Read selected files only after the existing verifier has accepted the entire archive. */\nexport async function readAgentCandidateWorkspaceArtifactFiles(\n  input: AgentCandidateWorkspaceArtifactsOptions & {\n    readonly paths: readonly string[]\n    readonly maxReadBytes: number\n  },\n): Promise<ReadonlyMap<string, Uint8Array>> {\n  if (!Number.isSafeInteger(input.maxReadBytes) || input.maxReadBytes < 0)\n    throw new Error('workspace selective read requires a non-negative safe maxReadBytes')\n  const selected = new Map<string, Uint8Array[]>()\n  const files = new Map(input.snapshot.material.files.map((file) => [file.path, file]))\n  let bytes = 0\n  for (const path of input.paths) {\n    if (selected.has(path)) throw new Error('workspace selective read repeats a path')\n    const file = files.get(path)\n    if (!file) throw new Error(`workspace selective read names a missing file: ${path}`)\n    bytes += file.byteLength\n    if (!Number.isSafeInteger(bytes) || bytes > input.maxReadBytes)\n      throw new Error('workspace selective read exceeds maxReadBytes')\n    selected.set(path, [])\n  }\n  await consumeWorkspaceArtifacts(input, undefined, selected)\n  return new Map([...selected].map(([path, chunks]) => [path, Buffer.concat(chunks)]))\n}\n\n/** Restore regular files into an empty destination after complete verification; paths selects a subset. */\nexport async function materializeAgentCandidateWorkspaceFromArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions & {\n    destination: string\n    paths?: readonly string[]\n  },\n): Promise<void> {\n  input.signal?.throwIfAborted()\n  if (!input.artifacts.readStream)\n    throw new Error('streaming workspace artifacts require readStream')\n  const paths = input.paths === undefined ? undefined : new Set(input.paths)\n  if (paths && paths.size !== input.paths?.length)\n    throw new Error('workspace selection must name unique manifest files')\n  const destination = resolve(input.destination)\n  await prepareEmptyDestination(destination)\n  const staging = await mkdtemp(`${destination}.materializing-`)\n  try {\n    await consumeWorkspaceArtifacts(input, staging, undefined, paths)\n    input.signal?.throwIfAborted()\n    await rename(staging, destination)\n  } catch (error) {\n    await rm(staging, { recursive: true, force: true })\n    throw error\n  }\n}\n\nasync function consumeWorkspaceArtifacts(\n  input: AgentCandidateWorkspaceArtifactsOptions,\n  destination?: string,\n  selected?: Map<string, Uint8Array[]>,\n  paths?: ReadonlySet<string>,\n): Promise<void> {\n  const { artifacts, signal } = input\n  const snapshot = deepFreezeCandidate(structuredClone(input.snapshot))\n  signal?.throwIfAborted()\n  if (!artifacts.readStream) throw new Error('streaming workspace artifacts require readStream')\n  const limits = workspaceLimits(input.limits)\n  validateManifest(snapshot.material, limits)\n  if (paths) {\n    const files = new Set(snapshot.material.files.map((file) => file.path))\n    if ([...paths].some((path) => !files.has(path)))\n      throw new Error('workspace selection must name unique manifest files')\n  }\n  if (snapshot.archive.byteLength > limits.maxArchiveBytes)\n    throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n  const manifest = canonicalCandidateBytes(snapshot.material)\n  verifyBytes(\n    manifest,\n    snapshot.manifest.sha256,\n    snapshot.manifest.byteLength,\n    'candidate workspace manifest',\n  )\n  if (canonicalCandidateDigest(snapshot.material) !== snapshot.digest)\n    throw new Error('workspace snapshot digest does not match its canonical manifest material')\n  let offset = 0\n  for await (const chunk of verifiedArtifactChunks(snapshot.manifest, artifacts, signal)) {\n    if (\n      !Buffer.from(chunk.buffer, chunk.byteOffset, chunk.byteLength).equals(\n        manifest.subarray(offset, offset + chunk.byteLength),\n      )\n    ) {\n      throw new Error('workspace manifest artifact is not the exact canonical manifest material')\n    }\n    offset += chunk.byteLength\n  }\n\n  const parser = extract()\n  const canonical = pack()\n  const canonicalResult = digestChunks(canonical, limits.maxArchiveBytes, signal)\n  // Both drains start before writing, so tar-stream's backpressure bounds every queue.\n  const reading = pipeline(\n    Readable.from(verifiedArtifactChunks(snapshot.archive, artifacts, signal)),\n    parser as unknown as NodeJS.WritableStream,\n    { signal },\n  )\n  reading.catch(() => undefined)\n  canonicalResult.catch(() => undefined)\n  try {\n    let index = 0\n    for await (const entry of parser) {\n      signal?.throwIfAborted()\n      const expected = snapshot.material.files[index++]\n      if (\n        !expected ||\n        entry.header.type !== 'file' ||\n        entry.header.name !== `workspace/${expected.path}` ||\n        entry.header.mode !== expected.mode ||\n        entry.header.size !== expected.byteLength\n      ) {\n        throw new Error('candidate workspace archive does not match its snapshot manifest')\n      }\n      const file =\n        destination && (!paths || paths.has(expected.path))\n          ? await openDestination(destination, expected.path)\n          : undefined\n      try {\n        async function* checked(): AsyncGenerator<Uint8Array> {\n          const hash = createHash('sha256')\n          let byteLength = 0\n          for await (const chunk of entry) {\n            if (!(chunk instanceof Uint8Array))\n              throw new Error('workspace entry emitted a non-byte chunk')\n            signal?.throwIfAborted()\n            byteLength += chunk.byteLength\n            if (byteLength > expected!.byteLength)\n              throw new Error('workspace entry exceeds its manifest length')\n            hash.update(chunk)\n            if (file) await file.writeFile(chunk)\n            selected?.get(expected!.path)?.push(Uint8Array.from(chunk))\n            yield chunk\n          }\n          if (\n            byteLength !== expected!.byteLength ||\n            `sha256:${hash.digest('hex')}` !== expected!.sha256\n          ) {\n            throw new Error('candidate workspace archive does not match its snapshot manifest')\n          }\n        }\n        await appendTarFile(canonical, expected, checked(), signal)\n        if (file) await file.chmod(expected.mode)\n      } finally {\n        await file?.close()\n      }\n    }\n    if (index !== snapshot.material.files.length)\n      throw new Error('candidate workspace archive does not match its snapshot manifest')\n    await reading\n    canonical.finalize()\n    const observed = await canonicalResult\n    if (\n      observed.byteLength !== snapshot.archive.byteLength ||\n      observed.sha256 !== snapshot.archive.sha256\n    ) {\n      throw new Error('candidate workspace tar is not canonical')\n    }\n  } catch (error) {\n    parser.destroy(asError(error))\n    canonical.destroy(asError(error))\n    await Promise.allSettled([reading, canonicalResult])\n    throw error\n  }\n}\n\nasync function openDestination(destination: string, relativePath: string) {\n  const path = workspacePath(destination, relativePath)\n  await mkdir(dirname(path), { recursive: true, mode: 0o700 })\n  return open(\n    path,\n    constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW,\n    0o600,\n  )\n}\n\nasync function* workspaceArchiveChunks(\n  root: string,\n  material: AgentCandidateWorkspaceManifestMaterial,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  const archive = pack()\n  const writing = (async () => {\n    try {\n      for (const file of material.files) {\n        signal?.throwIfAborted()\n        await appendTarFile(archive, file, workspaceFileChunks(root, file, signal), signal)\n      }\n      archive.finalize()\n    } catch (error) {\n      archive.destroy(asError(error))\n      throw error\n    }\n  })()\n  writing.catch(() => undefined)\n  try {\n    for await (const chunk of archive) {\n      if (!(chunk instanceof Uint8Array))\n        throw new Error('workspace archive emitted a non-byte chunk')\n      signal?.throwIfAborted()\n      yield chunk\n    }\n    await writing\n  } finally {\n    archive.destroy()\n    await writing.catch(() => undefined)\n  }\n}\n\nasync function* workspaceFileChunks(\n  root: string,\n  expected: WorkspaceFile,\n  signal?: AbortSignal,\n): AsyncGenerator<Uint8Array> {\n  const path = workspacePath(root, expected.path)\n  if ((await realpath(path)) !== path)\n    throw new Error(`workspace file path changed during capture: ${expected.path}`)\n  const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW)\n  try {\n    const stats = await file.stat()\n    if (\n      !stats.isFile() ||\n      stats.nlink !== 1 ||\n      stats.size !== expected.byteLength ||\n      (stats.mode & 0o777) !== expected.mode\n    ) {\n      throw new Error(`workspace file changed during capture: ${expected.path}`)\n    }\n    const hash = createHash('sha256')\n    let byteLength = 0\n    for await (const chunk of file.createReadStream({\n      autoClose: false,\n      highWaterMark: 64 * 1024,\n    })) {\n      signal?.throwIfAborted()\n      byteLength += chunk.byteLength\n      if (byteLength > expected.byteLength)\n        throw new Error(`workspace file changed during capture: ${expected.path}`)\n      hash.update(chunk)\n      yield chunk\n    }\n    if (byteLength !== expected.byteLength || `sha256:${hash.digest('hex')}` !== expected.sha256) {\n      throw new Error(`workspace file changed during capture: ${expected.path}`)\n    }\n  } finally {\n    await file.close()\n  }\n}\n\nasync function appendTarFile(\n  archive: Pack,\n  file: WorkspaceFile,\n  chunks: AsyncIterable<Uint8Array>,\n  signal?: AbortSignal,\n): Promise<void> {\n  const entry = archive.entry(\n    workspaceTarHeader(`workspace/${file.path}`, file.mode, file.byteLength),\n  )\n  await pipeline(Readable.from(chunks), entry as unknown as NodeJS.WritableStream, { signal })\n}\n\nasync function digestChunks(\n  chunks: AsyncIterable<unknown>,\n  maxBytes: number,\n  signal?: AbortSignal,\n) {\n  const hash = createHash('sha256')\n  let byteLength = 0\n  for await (const chunk of chunks) {\n    if (!(chunk instanceof Uint8Array))\n      throw new Error('workspace archive emitted a non-byte chunk')\n    signal?.throwIfAborted()\n    byteLength += chunk.byteLength\n    if (byteLength > maxBytes)\n      throw new Error('candidate workspace archive exceeds maxArchiveBytes')\n    hash.update(chunk)\n  }\n  return { sha256: `sha256:${hash.digest('hex')}`, byteLength }\n}\n\nfunction validateManifest(\n  material: AgentCandidateWorkspaceManifestMaterial,\n  limits: AgentCandidateWorkspaceArchiveLimits,\n): void {\n  if (material.kind !== 'agent-candidate-workspace-manifest')\n    throw new Error('candidate workspace has an invalid manifest kind')\n  assertWorkspaceFilesWithinLimits(material.files, limits)\n}\n\nasync function* oneChunk(bytes: Uint8Array): AsyncGenerator<Uint8Array> {\n  yield bytes\n}\nfunction asError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error))\n}\n"],"mappings":";;;;;;;;;;;;;;;AACA,SAAgB,oBAAoB,OAAwB;CAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,OAAO,MAAQ,SAAS,KAAM,OAAO;CAC3C;CACA,OAAO;AACT;;;ACKA,SAAgBA,cAAY,OAAiC;CAC3D,OAAO,UAAU,WAAW,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,OAAO,KAAK;AAClE;AAEA,SAAgBC,2BAAyB,OAA8B;CACrE,OAAOD,cAAYE,0BAAwB,KAAK,CAAC;AACnD;;AAGA,SAAgB,wBAA2B,OAAa;CACtD,OAAO,oBACL,KAAK,MAAM,OAAO,KAAKA,0BAAwB,KAAK,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,CACzE;AACF;AAEA,SAAgB,2BACd,oBAC+B;CAC/B,MAAM,QAAQA,0BAAwB,kBAAkB;CACxD,MAAM,SAASF,cAAY,KAAK;CAChC,MAAM,QAAQ,oBAAoB;EAChC,GAAG,KAAK,MAAM,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,MAAM,CAAC;EACjD;CACF,CAAC;CACD,OAAO,OAAO,OAAO;EACnB;EACA,IAAI,QAAoB;GACtB,OAAO,WAAW,KAAK,KAAK;EAC9B;EACA;CACF,CAAC;AACH;AAEA,SAAgB,iCACd,OACA,OACG;CACH,IAAIC,2BAAyB,mBAAmB,KAAK,CAAC,MAAM,MAAM,QAChE,MAAM,IAAI,MAAM,GAAG,MAAM,uBAAuB;CAElD,OAAO,wBAAwB,KAAK;AACtC;AAEA,SAAgB,0BAA0B,OAAmD;CAC3F,OAAO;EACL,UAAU;EACV,SAAS,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,QAAQ;EAC7C,QAAQD,cAAY,KAAK;EACzB,YAAY,MAAM;CACpB;AACF;AAEA,SAAgB,mBACd,OACmB;CACnB,MAAM,EAAE,QAAQ,SAAS,GAAG,SAAS;CACrC,OAAO;AACT;AAEA,SAAgB,oBAAuB,OAAU,uBAAO,IAAI,IAAY,GAAM;CAC5E,IACE,UAAU,QACV,OAAO,UAAU,YACjB,YAAY,OAAO,KAAK,KACxB,KAAK,IAAI,KAAe,GAExB,OAAO;CAET,KAAK,IAAI,KAAe;CACxB,KAAK,MAAM,SAAS,OAAO,OAAO,KAAgC,GAChE,oBAAoB,OAAO,IAAI;CAEjC,OAAO,OAAO,OAAO,KAAK;AAC5B;;;ACvEA,gBAAuB,uBACrB,UACA,MACA,QAC4B;CAC5B,QAAQ,eAAe;CACvB,IAAI,EAAE,aAAa,aAAa,CAAC,KAAK,YACpC,MAAM,IAAI,MAAM,kDAAkD;CAEpE,MAAM,SACJ,aAAa,WACT,CAAC,OAAO,KAAK,SAAS,SAAS,QAAQ,CAAC,IACxC,KAAK,WAAY,UAAU,EAAE,OAAO,CAAC;CAC3C,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,QAAQ,eAAe;EACvB,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,6CAA6C;EAC/D,cAAc,MAAM;EACpB,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,gDAAgD;EAClE,KAAK,OAAO,KAAK;EACjB,MAAM;CACR;CACA,QAAQ,eAAe;CACvB,IAAI,eAAe,SAAS,cAAc,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAS,QACpF,MAAM,IAAI,MAAM,yDAAyD;AAE7E;AAEA,MAAM,oCAAoB,IAAI,QAAwB;;;;;;AAOtD,SAAgB,sBAAsB,WAAmB,YAA0B;CACjF,kBAAkB,IAAI,WAAW,UAAU;AAC7C;;AAGA,SAAgB,oBAAoB,MAAiD;CACnF,OACE,KAAK,cAAc,KAAA,KACnB,KAAK,eAAe,KAAA,KACpB,kBAAkB,IAAI,KAAK,SAAS,MAAM,KAAK;AAEnD;;AAGA,eAAsB,qCACpB,MACA,OAOoC;CACpC,IAAI,CAAC,KAAK,aAAa,CAAC,KAAK,YAC3B,MAAM,IAAI,MAAM,mEAAmE;CAErF,MAAM,QAAQ,eAAe;CAC7B,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,IAAI,WAAW;CACf,gBAAgB,UAAsC;EACpD,WAAW,MAAM,SAAS,MAAM,QAAQ;GACtC,MAAM,QAAQ,eAAe;GAC7B,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,6CAA6C;GAC/D,cAAc,MAAM;GACpB,IAAI,aAAa,MAAM,UACrB,MAAM,IAAI,MAAM,qDAAqD;GACvE,KAAK,OAAO,KAAK;GACjB,MAAM;EACR;EACA,WAAW;EACX,MAAM,QAAQ,eAAe;CAC/B;CACA,MAAM,SAAS,QAAQ;CACvB,IAAI;EACF,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,UAAU;GACnB,aAAa,MAAM;GACnB,SAAS,MAAM;GACf;GACA,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EACjD,CAAC,CACH;EACA,MAAM,QAAQ,eAAe;EAC7B,IACE,CAAC,YACD,IAAI,WAAW,UAAU,KAAK,OAAO,KAAK,OAC1C,IAAI,eAAe,YAEnB,MAAM,IAAI,MAAM,gEAAgE;EAKlF,IAAI,CAAC,oBAAoB,IAAI,GAC3B,WAAW,MAAM,UAAU,uBAAuB,KAAK,MAAM,MAAM,MAAM;EAI3E,OAAO,wBAAwB,GAAG;CACpC,UAAU;EACR,MAAM,OAAO,OAAO,KAAA,CAAS;CAC/B;AACF;;AC9GA,SAAgB,iBAAiB,UAAkD;CACjF,OAAO,GAAG,SAAS,OAAO,GAAG,SAAS;AACxC;AAEA,eAAsB,qBACpB,UACA,MACqB;CACrB,MAAM,QACJ,aAAa,WACT,OAAO,KAAK,SAAS,SAAS,QAAQ,IACtC,MAAM,KAAK,KAAK,QAAqC;CAC3D,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,oBAAoB;CAC7E,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,SAAgB,YACd,OACA,QACA,YACA,OACM;CACN,IAAI,MAAM,eAAe,YACvB,MAAM,IAAI,MAAM,GAAG,MAAM,eAAe,MAAM,WAAW,kBAAkB,YAAY;CAEzF,MAAM,SAASG,cAAY,KAAK;CAChC,IAAI,WAAW,QACb,MAAM,IAAI,MAAM,GAAG,MAAM,UAAU,OAAO,kBAAkB,QAAQ;AAExE;AAEA,eAAsB,iCACpB,UACA,MACwD;CACxD,MAAM,CAAC,UAAU,WAAW,MAAM,QAAQ,IAAI,CAC5C,qBAAqB,SAAS,UAAU,IAAI,GAC5C,qBAAqB,SAAS,SAAS,IAAI,CAC7C,CAAC;CACD,MAAM,oBAAoBC,0BAAwB,SAAS,QAAQ;CACnE,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,OAAO,OAAO,KAAK,iBAAiB,CAAC,GAC9D,MAAM,IAAI,MAAM,0EAA0E;CAE5F,IAAID,cAAY,iBAAiB,MAAM,SAAS,QAC9C,MAAM,IAAI,MAAM,0EAA0E;CAE5F,OAAO;EAAE;EAAU;CAAQ;AAC7B;;AAUA,IAAa,0BAAb,cAA6C,MAAM,CAAC;;;;;;;;AAkCpD,eAAsB,4BACpB,MACA,UACA,UAAgD,CAAC,GAClC;CACf,wBAAwB,MAAM,kCAAkC,MAAM,OAAO,GAAG,QAAQ;AAC1F;;;;;;;;;;AAWA,eAAsB,kCACpB,MACA,UAAgC,CAAC,GACiB;CAClD,OAAO,6BAA6B,MAAM,cAAc,MAAM,SAAS,KAAK,CAAC;AAC/E;AAYA,eAAsB,6BACpB,MACA,UAAmC,CAAC,GAInC;CACD,MAAM,UAAU,MAAM,cAAc,MAAM,SAAS,IAAI;CACvD,OAAO;EACL,UAAU,6BAA6B,OAAO;EAC9C,OAAO,QAAQ,KAAK,WAAW;GAC7B,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,OAAO,WAAW,KAAK,cAAc,KAAK,CAAC;EAC7C,EAAE;CACJ;AACF;;AAGA,eAAsB,+BACpB,MACA,UACA,UAAgC,CAAC,GAC0C;CAC3E,MAAM,WAAW,MAAM,6BAA6B,MAAM,OAAO;CACjE,wBAAwB,SAAS,UAAU,QAAQ;CACnD,OAAO,SAAS,MAAM,KAAK,SACzB,OAAO,OAAO;EAAE,MAAM,KAAK;EAAM,MAAM,KAAK;EAAM,OAAO,WAAW,KAAK,KAAK,KAAK;CAAE,CAAC,CACxF;AACF;;;;;;AAOA,SAAgB,2BACd,OACA,UAAsC,CAAC,GACE;CACzC,OAAO,6BACL,MAAM,KAAK,UAAU;EACnB,MAAM,KAAK;EACX,MAAM,QAAQ,iBAAiB,OAAO,iBAAiB,KAAK,IAAI,IAAI,KAAK;EACzE,QAAQA,cAAY,KAAK,KAAK;EAC9B,YAAY,KAAK,MAAM;CACzB,EAAE,CACJ;AACF;AAEA,SAAS,6BACP,SAMyC;CACzC,OAAO;EACL,MAAM;EACN,OAAO,QACJ,KAAK,WAAW;GACf,MAAM,MAAM;GACZ,MAAM,MAAM;GACZ,QAAQ,MAAM;GACd,YAAY,MAAM;EACpB,EAAE,CAAC,CACF,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACpE;AACF;;AAGA,SAAS,iBAAiB,MAAsB;CAC9C,QAAQ,OAAO,QAAW,IAAI,MAAQ;AACxC;AAEA,SAAS,cAAc,OAAsC;CAC3D,IAAI,CAAC,MAAM,OAAO,MAAM,IAAI,MAAM,kDAAkD,MAAM,MAAM;CAChG,OAAO,MAAM;AACf;AAEA,SAAS,wBACP,UACA,UACM;CACN,IAAI,OAAO,KAAKC,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAAOA,0BAAwB,QAAQ,CAAC,GACzF;CAMF,IACE,OAAO,KAAKA,0BAAwB,kBAAkB,QAAQ,CAAC,CAAC,CAAC,CAAC,OAChEA,0BAAwB,kBAAkB,QAAQ,CAAC,CACrD,GAEA,MAAM,IAAI,MACR,uJAEF;CAEF,MAAM,IAAI,MAAM,gFAAgF;AAClG;AAEA,SAAS,kBACP,UACyC;CACzC,OAAO;EACL,GAAG;EACH,OAAO,SAAS,MAAM,KAAK,UAAU;GAAE,GAAG;GAAM,MAAM,iBAAiB,KAAK,IAAI;EAAE,EAAE;CACtF;AACF;AAEA,eAAsB,mCACpB,MACA,UACA,WAAkC,aACnB;CAEf,MAAM,mBAAkB,MADD,kCAAkC,IAAI,EAAA,CAC5B,MAAM,KAAK,EAAE,MAAM,MAAM,cAAc;EACtE,SAAS;EACT;EACA,eAAe;CACjB,EAAE;CACF,MAAM,gBAAgB,SAAS,MAC5B,QAAQ,UAAU,KAAK,QAAQ,iBAAiB,QAAQ,CAAC,CACzD,KAAK,EAAE,MAAM,OAAO,GAAG,WAAW,IAAI;CACzC,IACE,CAAC,OAAO,KAAKA,0BAAwB,eAAe,CAAC,CAAC,CAAC,OACrDA,0BAAwB,aAAa,CACvC,GAEA,MAAM,IAAI,MACR,WAAW,SAAS,qEACtB;AAEJ;AAWA,eAAe,cACb,MACA,SACA,WACkC;CAClC,MAAM,8BAA8B,IAAI,IAAY,QAAQ,+BAA+B,CAAC,CAAC;CAC7F,MAAM,WAAW,IAAI,IAAI,QAAQ,iBAAiB,CAAC,CAAC;CACpD,KAAK,MAAM,QAAQ,UACjB,IACE,CAAC,QACD,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,WAAW,IAAI,KACf,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAErE,MAAM,IAAI,MAAM,sDAAsD;CAG1E,MAAM,SAAS,QAAQ;CACvB,MAAM,WAAW,QAAQ,gBAAgB,IAAI,IAAI,QAAQ,aAAa,IAAI,KAAA;CAC1E,MAAM,sCAAsB,IAAI,IAAY;CAC5C,KAAK,MAAM,QAAQ,YAAY,CAAC,GAAG;EACjC,IACE,CAAC,QACD,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,WAAW,IAAI,KACf,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,GAErE,MAAM,IAAI,MAAM,2DAA2D;EAE7E,IAAI,SAAS,QAAQ,IAAI;EACzB,OAAO,WAAW,KAAK;GACrB,oBAAoB,IAAI,MAAM;GAC9B,SAAS,QAAQ,MAAM;EACzB;CACF;CAMA,MAAM,gBAAgB,QAAQ,IAAI;CAClC,MAAM,YAAY,MAAM,MAAM,aAAa;CAC3C,IAAI,CAAC,UAAU,YAAY,KAAK,UAAU,eAAe,GACvD,MAAM,IAAI,MAAM,yCAAyC;CAE3D,MAAM,eAAe,MAAM,SAAS,aAAa;CACjD,MAAM,gBAAgB,MAAM,MAAM,YAAY;CAC9C,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,iDAAiD;CAEnE,MAAM,UAAmC,CAAC;CAC1C,IAAI,aAAa;CAEjB,eAAe,MAAM,WAAkC;EACrD,QAAQ,QAAQ,eAAe;EAC/B,MAAM,UAAU,MAAM,QAAQ,WAAW,EAAE,eAAe,KAAK,CAAC;EAChE,QAAQ,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;EACvE,KAAK,MAAM,SAAS,SAAS;GAC3B,QAAQ,QAAQ,eAAe;GAC/B,IAAI,cAAc,gBAAgB,4BAA4B,IAAI,MAAM,IAAI,GAC1E;GAEF,IACE,QAAQ,uBAAuB,SAC7B,MAAM,YAAY,KAAK,MAAM,SAAS,iBACrC,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,MAAM,IAE/C;GAEF,MAAM,WAAW,QAAQ,WAAW,MAAM,IAAI;GAC9C,MAAM,UAAU,SAAS,cAAc,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,GAAG;GACpE,IAAI,CAAC,WAAW,QAAQ,WAAW,KAAK,KAAK,QAAQ,SAAS,MAAM,GAClE,MAAM,IAAI,MAAM,iCAAiC,SAAS;GAE5D,IAAI,SAAS,IAAI,OAAO,GAAG;GAC3B,IAAI,YAAY,CAAC,SAAS,IAAI,OAAO,KAAK,CAAC,oBAAoB,IAAI,OAAO,GAAG;GAC7E,MAAM,QAAQ,MAAM,MAAM,QAAQ;GAClC,IAAI,MAAM,eAAe,GACvB,MAAM,IAAI,MAAM,MAAM,eAAe,UAAU,SAAS,YAAY,CAAC;GAEvE,IAAI,MAAM,YAAY,GAAG;IACvB,IAAI,UAAU,IAAI,OAAO,GACvB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IACtE,MAAM,MAAM,QAAQ;IACpB;GACF;GACA,IAAI,CAAC,MAAM,OAAO,GAChB,MAAM,IAAI,MAAM,2CAA2C,SAAS;GAEtE,IAAI,UAAU,QAAQ,UAAU,OAAO,UACrC,MAAM,IAAI,wBAAwB,4BAA4B;GAEhE,MAAM,aAAa,MAAM,KACvB,UACAC,UAAY,YACT,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,EAC3E;GACA,IAAI;IACF,MAAM,cAAc,MAAM,WAAW,KAAK;IAC1C,IAAI,CAAC,YAAY,OAAO,GACtB,MAAM,IAAI,MAAM,2CAA2C,SAAS;IAEtE,IAAI,YAAY,UAAU,GACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS;IAErE,MAAM,OACJ,QAAQ,iBAAiB,OACrB,iBAAiB,YAAY,IAAI,IACjC,YAAY,OAAO;IACzB,IAAI,UAAU,YAAY,OAAO,OAAO,cACtC,MAAM,IAAI,wBAAwB,wCAAwC,SAAS;IAErF,MAAM,iBAAiB,SAAS,OAAO,oBAAoB,aAAa,KAAA;IACxE,IAAI,mBAAmB,KAAA,KAAa,YAAY,OAAO,gBACrD,MAAM,IAAI,wBAAwB,qCAAqC;IAEzE,MAAM,OAAO,MAAM,kBACjB,YACA,SAAS,KAAK,IAAI,OAAO,cAAc,kBAAkB,OAAO,YAAY,IAAI,KAAA,GAChF,WACA,SACA,QAAQ,MACV;IACA,cAAc,KAAK;IACnB,QAAQ,KAAK;KACX,MAAM;KACN;KACA,QAAQ,KAAK;KACb,YAAY,KAAK;KACjB,GAAI,KAAK,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,KAAK,MAAM;IAC1D,CAAC;GACH,UAAU;IACR,MAAM,WAAW,MAAM;GACzB;EACF;CACF;CAEA,MAAM,MAAM,YAAY;CACxB,IAAI,YAAY,QAAQ,WAAW,SAAS,MAC1C,MAAM,IAAI,MAAM,iDAAiD;CAEnE,OAAO;AACT;;;;;;;;;;AAWA,eAAe,eACb,UACA,SACA,cACiB;CACjB,MAAM,SAAS,MAAM,SAAS,QAAQ;CACtC,IAAI,WAAW,MAAM,GACnB,OAAO,2CAA2C,QAAQ,MAAM;CAElE,IAAI,CAAC,SAAS,cAAc,QAAQ,QAAQ,QAAQ,GAAG,MAAM,CAAC,GAC5D,OAAO,uDAAuD,QAAQ,MAAM;CAE9E,IAAI;CACJ,IAAI;EACF,WAAW,MAAM,SAAS,QAAQ;CACpC,QAAQ;EACN,OAAO,6CAA6C,QAAQ,MAAM;CACpE;CACA,IAAI,CAAC,SAAS,cAAc,QAAQ,GAClC,OAAO,gEAAgE,QAAQ,MAAM;CAEvF,OAAO,iCAAiC,QAAQ,MAAM;AACxD;AAEA,SAAS,SAAS,MAAc,MAAuB;CACrD,OAAO,SAAS,QAAQ,KAAK,WAAW,GAAG,OAAO,KAAK;AACzD;;;;;;;;;;AAWA,eAAe,kBACb,YACA,UACA,WACA,MACA,QACuE;CACvE,MAAM,OAAO,WAAW,QAAQ;CAChC,MAAM,SAAS,OAAO,YAAY,OAAW;CAC7C,MAAM,SAAmB,CAAC;CAC1B,IAAI,QAAQ;CACZ,OAAO,MAAM;EACX,QAAQ,eAAe;EACvB,MAAM,EAAE,cAAc,MAAM,WAAW,KAAK,QAAQ,GAAG,OAAO,YAAY,IAAI;EAC9E,IAAI,cAAc,GAAG;EACrB,SAAS;EACT,IAAI,aAAa,KAAA,KAAa,QAAQ,UACpC,MAAM,IAAI,wBAAwB,6CAA6C,MAAM;EAEvF,MAAM,QAAQ,OAAO,SAAS,GAAG,SAAS;EAC1C,KAAK,OAAO,KAAK;EAEjB,IAAI,WAAW,OAAO,KAAK,OAAO,KAAK,KAAK,CAAC;CAC/C;CACA,MAAM,SAAS,UAAU,KAAK,OAAO,KAAK;CAC1C,OAAO,YACH;EAAE;EAAQ,YAAY;EAAO,OAAO,OAAO,OAAO,QAAQ,KAAK;CAAE,IACjE;EAAE;EAAQ,YAAY;CAAM;AAClC;;;AC7fA,SAAgB,sBACd,OACA,UACA,OACA,WAA8B,CAAC,GACzB;CACN,IAAI,UAAU,QAAQ,OAAO,UAAU,YAAY,MAAM,QAAQ,KAAK,GACpE,MAAM,IAAI,MAAM,GAAG,MAAM,mBAAmB;CAE9C,MAAM,0BAAU,IAAI,IAAI,CAAC,GAAG,UAAU,GAAG,QAAQ,CAAC;CAClD,IAAI,QAAQ,SAAS,SAAS,SAAS,SAAS,QAC9C,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GACjC,IAAI,CAAC,QAAQ,IAAI,GAAG,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B,KAAK;CAEjF,KAAK,MAAM,OAAO,UAChB,IAAI,EAAE,OAAO,QAAQ,MAAM,IAAI,MAAM,GAAG,MAAM,oBAAoB,KAAK;AAE3E;;;;;;AAOA,SAAgB,oBAAoB,OAAwB;CAC1D,KAAK,IAAI,QAAQ,GAAG,QAAQ,MAAM,QAAQ,SAAS;EACjD,MAAM,OAAO,MAAM,WAAW,KAAK;EACnC,IAAI,QAAQ,SAAU,QAAQ,OAAQ;GACpC,MAAM,OAAO,MAAM,WAAW,QAAQ,CAAC;GACvC,IAAI,EAAE,QAAQ,SAAU,QAAQ,QAAS,OAAO;GAChD;EACF,OAAO,IAAI,QAAQ,SAAU,QAAQ,OACnC,OAAO;CAEX;CACA,OAAO;AACT;;;AC7BA,eAAsB,+BACpB,MACA,OAMoC;CACpC,MAAM,QAAQ,eAAe;CAC7B,MAAM,QAAQ,WAAW,KAAK,MAAM,KAAK;CACzC,MAAM,iBAAiBC,cAAY,KAAK;CACxC,MAAM,MAAM,gCAAgC,MAC1C,MAAM,KAAK,IAAI;EACb,aAAa,MAAM;EACnB,SAAS,MAAM;EACf,OAAO,WAAW,KAAK,KAAK;EAC5B,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;CACjD,CAAC,CACH;CACA,MAAM,QAAQ,eAAe;CAC7B,IAAI,IAAI,WAAW,kBAAkB,IAAI,eAAe,MAAM,YAC5D,MAAM,IAAI,MAAM,gEAAgE;CAElF,MAAM,SAAS,MAAM,KAAK,KAAK,GAAG;CAClC,MAAM,QAAQ,eAAe;CAC7B,YAAY,QAAQ,gBAAgB,MAAM,YAAY,4BAA4B;CAClF,OAAO,wBAAwB,GAAG;AACpC;;AChBA,MAAM,cAAc;AACpB,MAAM,uBAAuB;AAC7B,MAAM,0BAA0B;AAChC,MAAM,wBAAwB;AAC9B,MAAM,uBAAuB;AAC7B,MAAM,wBAAwB;AAC9B,MAAM,+BAAe,IAAI,KAAK,CAAC;AAY/B,MAAM,gBAAsD,OAAO,OAAO;CACxE,iBAAiB;CACjB,0BAA0B;CAC1B,UAAU;CACV,cAAc;CACd,mBAAmB;CACnB,cAAc;CACd,0BAA0B;AAC5B,CAAC;;AAoCD,eAAsB,oCACpB,OACA,UAGI,CAAC,GACqC;CAC1C,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,OAAO,sBACL,wBAAwB,OAAO,MAAM,GACrC,KAAA,GACA,QACA,QAAQ,mBACV;AACF;AAEA,eAAsB,sBACpB,OACA,YACA,QACA,qBAC0C;CAC1C,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,WAAWC,0BAAwB,QAAQ;CACjD,MAAM,UAAU,MAAM,uBAAuB,OAAO,YAAY,OAAO,eAAe;CACtF,IACE,CAAC,wBACA,SAAS,aAAa,OAAO,4BAC5B,QAAQ,aAAa,OAAO,2BAE9B,MAAM,IAAI,MACR,gGACF;CAEF,MAAM,mBAAmB,MAAM,yBAAyB,YAAY,UAAU,mBAAmB;CACjG,MAAM,kBAAkB,MAAM,yBAAyB,WAAW,SAAS,mBAAmB;CAC9F,MAAM,WAAW,oBAAoB;EACnC,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAmD;CACnD,OAAO,OAAO,OAAO;EAAE;EAAU;CAAQ,CAAC;AAC5C;AAEA,eAAe,yBACb,MACA,OACA,aACyC;CACzC,IAAI,CAAC,aAAa,OAAO,0BAA0B,KAAK;CACxD,IAAI,CAAC,YAAY,YAAY,KAAK,GAChC,MAAM,IAAI,MAAM,kEAAkE;CAEpF,OAAO,+BAA+B,YAAY,iBAAiB;EACjE,aAAa,YAAY;EACzB,SAAS,SAAS,aAAa,iCAAiC;EAChE;EACA,GAAI,YAAY,SAAS,EAAE,QAAQ,YAAY,OAAO,IAAI,CAAC;CAC7D,CAAC;AACH;AAYA,eAAsB,+BAA+B,OAKhB;CACnC,YACE,MAAM,SACN,MAAM,SAAS,QAAQ,QACvB,MAAM,SAAS,QAAQ,YACvB,6BACF;CACA,MAAM,UAAU,MAAM,sBAAsB,MAAM,SAAS,MAAM,MAAM;CACvE,IAAI,QAAQ,cAAc,MAAM,SAAS,QACvC,MAAM,IAAI,MAAM,iDAAiD;CAEnE,6BAA6B,QAAQ,OAAO,MAAM,QAAQ;CAC1D,OAAO;AACT;AAEA,eAAe,uBACb,OACA,YACA,iBACqB;CACrB,MAAM,UAAU,KAAK;CACrB,MAAM,SAAS,cAAc,SAAS,iBAAiB,6BAA6B;CACpF,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,OAAO,MAAM;CACf,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,OAAO,YAAY,KAAA,CAAS;EAClC,MAAM;CACR;AACF;AAEA,eAAe,gCACb,OACA,YACA,UACA,iBACe;CACf,MAAM,UAAU,KAAK;CACrB,MAAM,aAAa,kBACjB,SACA,UACA,iBACA,6BACF;CACA,IAAI;EACF,MAAM,6BAA6B,SAAS,OAAO,UAAU;EAC7D,QAAQ,SAAS;EACjB,IAAI,CAAE,MAAM,YAAa,MAAM,IAAI,MAAM,0CAA0C;CACrF,SAAS,OAAO;EACd,QAAQ,QAAQ,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC,CAAC;EACzE,MAAM,WAAW,YAAY,KAAA,CAAS;EACtC,MAAM;CACR;AACF;AAEA,eAAe,6BACb,SACA,OACA,YACe;CACf,KAAK,MAAM,QAAQ,OACjB,MAAM,cAAc,SAAS,GAAG,uBAAuB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE3F,IAAI,CAAC,YAAY;CACjB,MAAM,gBAAgB,WAAW,cAC7BD,0BAAwB,2BAA2B,WAAW,YAAY,KAAK,CAAC,IAChF,KAAA;CACJ,MAAM,WAAWA,0BAAwB;EACvC,MAAM;EACN,YAAY,WAAW;EACvB,UAAU,WAAW;EACrB,QAAQ;GACN,QAAQ,WAAW,OAAO;GAC1B,YAAY,WAAW,OAAO;EAChC;EACA,GAAI,gBACA,EACE,aAAa,EACX,eAAe;GACb,QAAQE,cAAY,aAAa;GACjC,YAAY,cAAc;EAC5B,EACF,EACF,IACA,CAAC;CACP,CAA8C;CAC9C,MAAM,cAAc,SAAS,yBAAyB,KAAO,QAAQ;CACrE,MAAM,cAAc,SAAS,uBAAuB,KAAO,WAAW,OAAO,KAAK;CAClF,IAAI,WAAW,eAAe,eAAe;EAC3C,MAAM,cAAc,SAAS,sBAAsB,KAAO,aAAa;EACvE,KAAK,MAAM,QAAQ,WAAW,YAAY,OACxC,MAAM,cAAc,SAAS,GAAG,wBAAwB,KAAK,QAAQ,KAAK,MAAM,KAAK,KAAK;CAE9F;AACF;AAEA,eAAe,sBACb,OACA,QACkC;CAClC,IAAI,MAAM,aAAa,OAAO,iBAC5B,MAAM,IAAI,MAAM,qDAAqD;CAEvE,MAAM,SAAS,QAAQ;CACvB,MAAM,QAA0C,CAAC;CACjD,MAAM,qCAAqB,IAAI,IAAY;CAC3C,MAAM,gCAAgB,IAAI,IAAY;CACtC,IAAI,aAAa;CACjB,IAAI,qBAAqB;CACzB,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,MAAM,aAA+C,CAAC;CACtD,MAAM,6BAAa,IAAI,IAAY;CACnC,IAAI;CACJ,IAAI,aAAa;CACjB,MAAM,WAAW,YAAY;EAC3B,WAAW,MAAM,SAAS,QAAQ;GAChC,MAAM,OAAO,MAAM,OAAO;GAC1B,IACE,MAAM,OAAO,SAAS,UACtB,OAAO,SAAS,YAChB,mBAAmB,IAAI,IAAI,GAE3B,MAAM,IAAI,MAAM,mDAAmD;GAErE,mBAAmB,IAAI,IAAI;GAC3B,IAAI,KAAK,WAAW,oBAAoB,GAAG;IACzC,IAAI,MAAM,UAAU,OAAO,UACzB,MAAM,IAAI,MAAM,uDAAuD;IAEzE,MAAM,OAAO,gBAAgB,KAAK,MAAM,EAA2B,GAAG,OAAO,YAAY;IACzF,IAAI,CAAC,oBAAoB,MAAM,OAAO,IAAI,GACxC,MAAM,IAAI,MAAM,wDAAwD,MAAM;IAEhF,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,yBACE,MACA,cACA,eACA,6DACF;IACA,eAAe;IACf,IAAI,UAAU,aAAa,OAAO,oBAAoB,YACpD,MAAM,IAAI,MAAM,uDAAuD;IAEzE,cAAc,UAAU;IACxB,MAAM,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GAChE,OAAO,IAAI,SAAS,yBAAyB;IAC3C,IAAI,MAAM,OAAO,SAAS,OAAS,oBACjC,MAAM,IAAI,MAAM,4DAA4D;IAE9E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,MAAM,gBAAgB,MAAM,aAC1B,OACA,OAAO,cACP,+BACF;IACA,sBAAsB,cAAc;IACpC,qBAAqB,wBAAwB,eAAe,MAAM;GACpE,OAAO,IAAI,SAAS,uBAAuB;IACzC,IAAI,MAAM,OAAO,SAAS,OAAS,kBACjC,MAAM,IAAI,MAAM,0DAA0D;IAE5E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,mBAAmB,MAAM,aACvB,OACA,OAAO,0BACP,sBACF;IACA,sBAAsB,iBAAiB;GACzC,OAAO,IAAI,SAAS,sBAAsB;IACxC,IAAI,MAAM,OAAO,SAAS,OAAS,iBACjC,MAAM,IAAI,MAAM,yDAAyD;IAE3E,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,kBAAkB,MAAM,aACtB,OACA,OAAO,iBACP,8BACF;IACA,sBAAsB,gBAAgB;GACxC,OAAO,IAAI,KAAK,WAAW,qBAAqB,GAAG;IACjD,IACE,CAAC,oBAAoB,eACrB,CAAC,mBACD,WAAW,UAAU,OAAO,UAE5B,MAAM,IAAI,MAAM,gEAAgE;IAElF,MAAM,OAAO,gBAAgB,KAAK,MAAM,CAA4B,GAAG,OAAO,YAAY;IAC1F,IAAI,MAAM,OAAO,SAAS,OAAS,MAAM,OAAO,SAAS,KACvD,MAAM,IAAI,MAAM,kDAAkD;IAEpE,yBACE,MACA,mBACA,YACA,qDACF;IACA,oBAAoB;IACpB,0BAA0B,MAAM,YAAY,oBAAoB,MAAM,OAAO,MAAM,MAAM;IACzF,IACE,MAAM,OAAO,SAAS,KAAA,KACtB,MAAM,OAAO,OAAO,OAAO,oBAAoB,YAE/C,MAAM,IAAI,MAAM,+CAA+C;IAEjE,IAAI,MAAM,OAAO,OAAO,OAAO,cAC7B,MAAM,IAAI,MAAM,0CAA0C;IAC5D,MAAM,YAAY,MAAM,aAAa,OAAO,OAAO,cAAc,kBAAkB,MAAM;IACzF,sBAAsB,UAAU;IAChC,cAAc,UAAU;IACxB,WAAW,KAAK;KAAE;KAAM,MAAM,MAAM,OAAO;KAAM,OAAO;IAAU,CAAC;GACrE,OACE,MAAM,IAAI,MAAM,0DAA0D,MAAM;EAEpF;EACA,IAAI,QAAQ,kBAAkB,MAAM,QAAQ,gBAAgB,GAC1D,MAAM,IAAI,MAAM,+DAA+D;EAEjF,IAAI,QAAQ,oBAAoB,WAAW,MAAM,QAAQ,eAAe,GACtE,MAAM,IAAI,MAAM,qEAAqE;EAEvF,MAAM,aACJ,sBAAsB,mBAClB,kBAAkB,oBAAoB,kBAAkB,iBAAiB,UAAU,IACnF,KAAA;EACN,OAAO;GAAE;GAAO,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EAAG;CACxD,EAAA,CAAG;CACH,OAAO,IAAI,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC;CACxE,MAAM,SAAS,MAAM;CACrB,MAAM,gCACJ,OAAO,OACP,OAAO,YACP,OACA,OAAO,eACT;CACA,OAAO;AACT;AAEA,SAAS,0BACP,cACA,oBACA,YACA,QACM;CACN,IACE,CAAC,OAAO,cAAc,UAAU,KAChC,eAAe,KAAA,KACf,aAAa,KACb,aAAa,OAAO,kBAAkB,eAAe,oBAErD,MAAM,IAAI,MAAM,oEAAoE;AAExF;AAEA,SAAS,wBACP,OACA,QACoC;CACpC,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;CAC5E,SAAS,OAAO;EACd,MAAM,IAAI,MAAM,8DAA8D,EAAE,OAAO,MAAM,CAAC;CAChG;CACA,IACE,CAAC,SAAS,KAAK,KACf,CAAC,CAAC,mCAAmC,6CAA6C,CAAC,CAAC,SAClF,OAAO,KAAK,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,CACpC,KACA,MAAM,SAAS,eACf,OAAO,MAAM,eAAe,YAC5B,OAAO,MAAM,aAAa,YAC1B,CAAC,SAAS,MAAM,MAAM,KACtB,OAAO,KAAK,MAAM,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBAC/C,OAAO,MAAM,OAAO,WAAW,YAC/B,CAAC,wBAAwB,KAAK,MAAM,OAAO,MAAM,KACjD,CAAC,OAAO,cAAc,MAAM,OAAO,UAAU,KAC5C,MAAM,OAAO,cAAyB,KACtC,MAAM,OAAO,aAAwB,OAAO,0BAE7C,MAAM,IAAI,MAAM,mDAAmD;CAErE,IAAI,CAAC,OAAO,KAAKF,0BAAwB,KAAK,CAAC,CAAC,CAAC,OAAO,OAAO,KAAK,KAAK,CAAC,GACxE,MAAM,IAAI,MAAM,kEAAkE;CAEpF,kBAAkB,MAAM,YAAY,iBAAiB;CACrD,kBAAkB,MAAM,UAAU,sBAAsB;CACxD,IAAI,MAAM,WAAW,WAAW,MAAM,SAAS,QAC7C,MAAM,IAAI,MAAM,iEAAiE;CAEnF,IAAI;CACJ,IAAI,iBAAiB,OAAO;EAC1B,MAAM,UAAU,MAAM;EACtB,IACE,CAAC,SAAS,OAAO,KACjB,OAAO,KAAK,OAAO,CAAC,CAAC,KAAK,GAAG,MAAM,mBACnC,CAAC,SAAS,QAAQ,aAAa,KAC/B,OAAO,KAAK,QAAQ,aAAa,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,uBACxD,OAAO,QAAQ,cAAc,WAAW,YACxC,CAAC,wBAAwB,KAAK,QAAQ,cAAc,MAAM,KAC1D,CAAC,OAAO,cAAc,QAAQ,cAAc,UAAU,KACrD,QAAQ,cAAc,aAAwB,KAC9C,QAAQ,cAAc,aAAwB,OAAO,iBAEtD,MAAM,IAAI,MAAM,yDAAyD;EAE3E,cAAc,EACZ,eAAe;GACb,QAAQ,QAAQ,cAAc;GAC9B,YAAY,QAAQ,cAAc;EACpC,EACF;CACF;CACA,OAAO;EACL,MAAM;EACN,YAAY,MAAM;EAClB,UAAU,MAAM;EAChB,QAAQ;GACN,QAAQ,MAAM,OAAO;GACrB,YAAY,MAAM,OAAO;EAC3B;EACA,GAAI,cAAc,EAAE,YAAY,IAAI,CAAC;CACvC;AACF;AAEA,SAAS,kBACP,UACA,QACA,eACA,YAC4B;CAC5B,YAAY,QAAQ,SAAS,OAAO,QAAQ,SAAS,OAAO,YAAY,sBAAsB;CAC9F,IAAI,SAAS,eAAe,eAAe;EACzC,YACE,eACA,SAAS,YAAY,cAAc,QACnC,SAAS,YAAY,cAAc,YACnC,8BACF;EACA,IACE,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAC1B,OAAO,KAAKA,0BAAwB,2BAA2B,UAAU,CAAC,CAAC,CAC7E,GAEA,MAAM,IAAI,MAAM,8DAA8D;CAElF;CACA,OAAO;EACL,YAAY,SAAS;EACrB,UAAU,SAAS;EACnB,QAAQ;GAAE,GAAG,SAAS;GAAQ,OAAO;EAAO;EAC5C,GAAI,SAAS,eAAe,gBAAgB,EAAE,aAAa,EAAE,OAAO,WAAW,EAAE,IAAI,CAAC;CACxF;AACF;AAEA,eAAe,cACb,SACA,MACA,MACA,OACe;CACf,MAAM,IAAI,SAAe,cAAc,gBAAgB;EACrD,QAAQ,MACN,mBAAmB,MAAM,MAAM,MAAM,UAAU,GAC/C,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,IAC3D,UAAW,QAAQ,YAAY,KAAK,IAAI,aAAa,CACxD;CACF,CAAC;AACH;AAIA,eAAe,aAAa,OAAiB,UAAkB,OAAoC;CACjG,MAAM,OAAO,MAAM,OAAO;CAC1B,IAAI,CAAC,OAAO,cAAc,IAAI,KAAK,SAAS,KAAA,KAAa,OAAO,KAAK,OAAO,UAC1E,MAAM,IAAI,MAAM,GAAG,MAAM,yBAAyB;CAEpD,MAAM,QAAQ,MAAM,cAAc,OAAO,UAAU,KAAK;CACxD,IAAI,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CACnF,OAAO;AACT;AAEA,eAAe,cACb,QACA,UACA,OACqB;CACrB,MAAM,SAAmB,CAAC;CAC1B,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,YAAY;GAC5C,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,QAAQ,OAAO,SAAS,KAAK,IAAI,QAAQ,OAAO,KAAK,KAAK;EAChE,OAAO,KAAK,KAAK;EACjB,cAAc,MAAM;CACtB;CACA,OAAO,OAAO,OAAO,QAAQ,UAAU;AACzC;AAEA,eAAe,kBACb,QACA,UACA,UACA,OACkB;CAClB,MAAM,iBAAiB,OAAO,KAAK,SAAS,QAAQ,SAAS,YAAY,SAAS,UAAU;CAC5F,IAAI,QAAQ;CACZ,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,GAAG,MAAM,0BAA0B;EAErD,IAAI,MAAM,aAAa,WAAW,QAAQ;GACxC,MAAM,wBAAQ,IAAI,MAAM,GAAG,MAAM,wBAAwB;GACzD,IAAI,aAAa,UAAU,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK;GACrF,MAAM;EACR;EACA,MAAM,WAAW,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU;EAC7E,IACE,SAAS,SAAS,aAAa,eAAe,cAC9C,CAAC,SAAS,OAAO,eAAe,SAAS,QAAQ,SAAS,SAAS,UAAU,CAAC,GAE9E,QAAQ;EAEV,UAAU,SAAS;CACrB;CACA,OAAO,SAAS,WAAW,eAAe;AAC5C;AAEA,SAAS,6BACP,OACA,UACM;CACN,MAAM,WAAW,2BAA2B,KAAK;CACjD,MAAM,gBAAgBA,0BAAwB,QAAQ;CACtD,YACE,eACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IACEC,2BAAyB,QAAQ,MAAM,SAAS,UAChD,CAAC,OAAO,KAAK,aAAa,CAAC,CAAC,OAAO,OAAO,KAAKD,0BAAwB,SAAS,QAAQ,CAAC,CAAC,GAE1F,MAAM,IAAI,MAAM,kEAAkE;AAEtF;AAEA,SAAgB,iCACd,OAGA,QACM;CACN,IAAI,MAAM,SAAS,OAAO,UACxB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,IAAI;CACJ,MAAM,gCAAgB,IAAI,IAAY;CACtC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,KAAK,MAAM,OAAO,YAAY;EAC3D,yBACE,MACA,cACA,eACA,qDACF;EACA,eAAe;EACf,IAAI,CAAC,oBAAoB,KAAK,IAAI,GAChC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,WAAW,QAAQ,gBAAgB,MACrC,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAC1E,MAAM,aAAa,WAAW,OAAO,KAAK,MAAM,aAAa,KAAK;EAClE,IAAI,CAAC,OAAO,cAAc,UAAU,KAAK,aAAa,KAAK,aAAa,OAAO,cAC7E,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,cAAc;EACd,IAAI,aAAa,OAAO,mBACtB,MAAM,IAAI,MAAM,+CAA+C;CAEnE;AACF;AAEA,SAAS,wBACP,OACA,QACuC;CACvC,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,MAAM,4CAA4C;CAE9D,MAAM,YAAY,MAAM;CACxB,IAAI,YAAY,OAAO,UACrB,MAAM,IAAI,MAAM,sCAAsC;CAExD,IAAI,aAAa;CACjB,MAAM,QAA+C,CAAC;CACtD,KAAK,IAAI,QAAQ,GAAG,QAAQ,WAAW,SAAS;EAC9C,MAAM,YAAY,MAAM;EACxB,IAAI,CAAC,SAAS,SAAS,KAAK,OAAO,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,GAAG,MAAM,mBACtE,MAAM,IAAI,MAAM,4BAA4B,MAAM,YAAY;EAEhE,MAAM,cAAc,OAAO,0BAA0B,SAAS;EAC9D,IACE,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,QAAQ,CAAC,OACnC,EAAE,YAAY,YAAY,SAAS,CAAC,KAEpC,MAAM,IAAI,MAAM,4BAA4B,MAAM,uBAAuB;EAE3E,MAAM,OAAO,gBAAgB,YAAY,MAAM,OAAO,OAAO,YAAY;EACzE,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,aAAa,YAAY,OAAO;EACtC,IAAI,CAAC,oBAAoB,IAAI,GAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,MAAM,OAAO,sBAAsB,YAAY,IAAI;EACnD,IAAI,KAAK,aAAa,OAAO,cAC3B,MAAM,IAAI,MAAM,kDAAkD,MAAM;EAE1E,IAAI,KAAK,aAAa,OAAO,oBAAoB,YAC/C,MAAM,IAAI,MAAM,+CAA+C;EAEjE,IAAI,KAAK,aAAa,KAAK,IAAI,GAAG,OAAO,kBAAkB,IAAI,GAC7D,MAAM,IAAI,MAAM,qDAAqD;EAEvE,cAAc,KAAK;EACnB,MAAM,KAAK;GAAE;GAAM;GAAM,OAAO,qBAAqB,IAAI;EAAE,CAAC;CAC9D;CACA,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;CAC1F,iCAAiC,OAAO,MAAM;CAC9C,OAAO;AACT;AAEA,SAAS,oBAAoB,OAAiC;CAC5D,OAAO,OAAO,cAAc,KAAK,KAAM,SAAoB,KAAM,SAAoB;AACvF;AAEA,SAAgB,gBACd,WACsC;CACtC,MAAM,SAAS;EAAE,GAAG;EAAe,GAAG;CAAU;CAChD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,SAAS,GAC3C,MAAM,IAAI,MAAM,uBAAuB,KAAK,iCAAiC;CAGjF,OAAO,OAAO,OAAO,MAAM;AAC7B;AAEA,SAAgB,gBAAgB,OAAgB,cAA8B;CAC5E,IACE,OAAO,UAAU,YACjB,CAAC,SACD,CAAC,oBAAoB,KAAK,KAC1B,OAAO,WAAW,OAAO,MAAM,IAAI,gBACnC,WAAW,KAAK,KAChB,MAAM,WAAW,KAAK,KACtB,MAAM,SAAS,IAAI,KACnB,MAAM,SAAS,IAAI,KACnB,oBAAoB,KAAK,KACzB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACtE,CAAC,QAAQ,UAAU,CAAC,CAAC,SAAS,MAAM,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,KAAK,EAAE,GAEtE,MAAM,IAAI,MAAM,wDAAwD,OAAO,KAAK,GAAG;CAEzF,OAAO;AACT;AAEA,SAAgB,yBACd,MACA,cACA,eACA,cACM;CACN,IAAI,iBAAiB,KAAA,KAAa,gBAAgB,MAAM,MAAM,IAAI,MAAM,YAAY;CACpF,KAAK,IAAI,QAAQ,KAAK,QAAQ,GAAG,GAAG,UAAU,IAAI,QAAQ,KAAK,QAAQ,KAAK,QAAQ,CAAC,GACnF,IAAI,cAAc,IAAI,KAAK,MAAM,GAAG,KAAK,CAAC,GAAG,MAAM,IAAI,MAAM,YAAY;CAE3E,cAAc,IAAI,IAAI;AACxB;AAEA,SAAS,sBACP,OACA,MACiE;CACjE,IAAI;CACJ,IAAI;CACJ,IAAI;CACJ,IAAI;EACF,SAAS,uBAAuB,KAAK,KAAmB;EACxD,aAAa,2BAA2B,KAAK,KAAmB;EAChE,aAAa,2BAA2B,KAAK,KAAmB;CAClE,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C,MAAM;CACvE;CACA,IAAI,oBAAoB,MAAM,GAC5B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,IAAI,CAAC,iBAAiB,MAAM,GAC1B,MAAM,IAAI,MAAM,+CAA+C,MAAM;CAEvE,OAAO;EAAE;EAAQ;EAAY;CAAW;AAC1C;AAEA,SAAS,qBAAqB,OAIf;CACb,MAAM,EAAE,QAAQ,YAAY,eAAe;CAC3C,MAAM,OAAO,IAAI,WAAW,UAAU;CACtC,WAAW,UAAU,IAAI,KAAK,MAAM,IAAI,WAAW,QAAQ,YAAY,UAAU,CAAC;CAClF,OAAO;AACT;AAEA,SAAgB,kBAAkB,OAAe,OAAqB;CACpE,IAAI,CAAC,kCAAkC,KAAK,KAAK,GAC/C,MAAM,IAAI,MAAM,wBAAwB,MAAM,wBAAwB;AAE1E;AAIA,SAAS,wBAAwB,MAAgE;CAC/F,MAAM,sBAAsB,OAAO,eAAe,WAAW,SAAS;CACtE,MAAM,SAAS,OAAO,yBAAyB,qBAAqB,IAAI,CAAC,EAAE;CAC3E,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,yBAAyB,KAAK,yBAAyB;CACpF,OAAO;AACT;AAEA,MAAM,yBAAyB,wBAAwB,QAAQ;AAC/D,MAAM,6BAA6B,wBAAwB,YAAY;AACvE,MAAM,6BAA6B,wBAAwB,YAAY;;AAGvE,SAAgB,mBAAmB,MAAc,MAAc,MAAc;CAC3E,OAAO;EACL;EACA;EACA,KAAK;EACL,KAAK;EACL;EACA,OAAO;EACP,MAAM;EACN,OAAO;EACP,OAAO;CACT;AACF;;ACryBA,eAAsB,oBACpB,MACA,cACA,YAC6B;CAC7B,IAAI,KAAK,SAAS,YAAY,OAAO,KAAA;CACrC,MAAM,iBAAiB,MAAM,uBAAuB,KAAK,YAAY,YAAY;CACjF,MAAM,wBAAwB,gBAAgB,KAAK,YAAY,KAAK,QAAQ;CAE5E,IAAI,KAAK,SAAS,SAAS;EACzB,MAAM,eAAe,gBAAgB,KAAK,QAAQ;EAClD,OAAO,KAAK;CACd;CACA,IAAI,CAAC,YAAY,MAAM,IAAI,MAAM,qDAAqD;CAEtF,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,sBAAsB,CAAC;CACtE,IAAI;EACF,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,KAAK,QAAQ,GAAG,KAAA,GAAW,EAC7E,gBAAgB,UAClB,CAAC;EACD,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,YACA,EAAE,gBAAgB,UAAU,CAC9B;EACA,MAAM,iBACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,EAC/D,gBAAgB,UAClB,CAAC,EAAA,CACD,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,kBAAkB,KAAK,eACzB,MAAM,IAAI,MACR,+BAA+B,cAAc,kBAAkB,KAAK,eACtE;EAEF,MAAM,eAAe,gBAAgB,aAAa;EAClD,OAAO;CACT,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAsB,4BACpB,UACA,cACqB;CACrB,MAAM,iBAAiB,MAAM,uBAAuB,SAAS,YAAY,YAAY;CAMrF,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM,SAAS;CAAM,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UACjB,MAAM,IAAI,MAAM,kDAAkD,SAAS,QAAQ;CAErF,MAAM,WACJ,MAAM,gBAAgB,gBAAgB;EAAC;EAAW;EAAM,SAAS;EAAQ;EAAM,SAAS;CAAI,CAAC,EAAA,CAC7F;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,KAAK,QAAQ,EAAE,EAAE,SAAS,SAAS,MACxD,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAEhF,MAAM,QAAQ,QAAQ;CACtB,IAAI,OAAO,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACvE,MAAM,IAAI,MAAM,mDAAmD,SAAS,MAAM;CAEpF,MAAM,SAAS,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAQ,MAAM;CAAM,CAAC,EAAA,CAAG;CAC1F,YAAY,OAAO,SAAS,QAAQ,SAAS,YAAY,mBAAmB,SAAS,MAAM;CAC3F,OAAO,WAAW,KAAK,KAAK;AAC9B;AAEA,eAAsB,mBACpB,UACA,UACe;CACf,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK;CAC/F,IAAI,SAAS,SAAS,YACpB,MAAM,IAAI,MAAM,sBAAsB,KAAK,kBAAkB,SAAS,YAAY;CAEpF,MAAM,QAAQ,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OACtE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,SAAS,SAAS,UACpB,MAAM,IAAI,MAAM,2BAA2B,KAAK,kBAAkB,SAAS,UAAU;AAEzF;;;;;AAMA,eAAsB,uBAAuB,OAOa;CACxD,MAAM,iBAAiB,QAAQ,MAAM,cAAc;CACnD,MAAM,mBAAmB,gBAAgB,KAAK;CAC9C,MAAM,SAAS,SACZ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,uBAAuB,gBAAgB,QAAQ,iBAAiB;CAEtE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,+BAA+B,CAAC;CAC/E,IAAI;EACF,MAAM,kBAAkB,KAAK,WAAW,SAAS;EACjD,MAAM,YAAY,KAAK,WAAW,OAAO;EACzC,MAAM,MAAM,eAAe;EAC3B,MAAM,iBAAiB;GACrB,gBAAgB;GAChB,sBAAsB;GACtB,kCAAkC,KAAK,QAAQ,SAAS;EAC1D;EACA,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,MAAM,QAAQ,GAAG,KAAA,GAAW,cAAc;EAC9F,IAAI,MAAM,MAAM,aAAa,GAC3B,MAAM,gBACJ,gBACA;GAAC;GAAS;GAAY;GAAY;GAAuB;EAAG,GAC5D,MAAM,OACN,cACF;EAEF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,YAAY,GAAG,KAAA,GAAW,cAAc,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EACR,IAAI,eAAe,MAAM,YACvB,MAAM,IAAI,MACR,wCAAwC,WAAW,kBAAkB,MAAM,YAC7E;EAEF,MAAM,eAAe,gBAAgB,YAAY,cAAc;EAC/D,MAAM,WAAW,MAAM,6BAA6B,gBAAgB,YAAY,cAAc;EAC9F,IACE,CAAC,OAAO,KAAKG,0BAAwB,QAAQ,CAAC,CAAC,CAAC,OAC9C,OAAO,KAAKA,0BAAwB,MAAM,UAAU,CAAC,CACvD,GAEA,MAAM,IAAI,MAAM,sEAAsE;EAExF,MAAM,gBACJ,MAAM,gBACJ,gBACA;GAAC;GAAe;GAAY;GAAM,MAAM;EAAU,GAClD,OAAO,KAAK,4BAA4B,MAAM,GAC9C;GACE,GAAG;GACH,iBAAiB;GACjB,kBAAkB;GAClB,iBAAiB;GACjB,oBAAoB;GACpB,qBAAqB;GACrB,oBAAoB;EACtB,CACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;EAWR,KATE,MAAM,gBACJ,gBACA,CAAC,aAAa,GAAG,aAAa,QAAQ,GACtC,KAAA,GACA,cACF,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,KACa,MAAM,YACpB,MAAM,IAAI,MAAM,sEAAsE;EAExF,OAAO;GAAE;GAAY;EAAa;CACpC,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,uBACb,YACA,cACiB;CACjB,MAAM,iBAAiB,QAAQ,MAAM,aAAa,QAAQ,UAAU,CAAC;CAErE,IAAI,EAAC,MADmB,KAAK,cAAc,EAAA,CAC5B,YAAY,GAAG,MAAM,IAAI,MAAM,8CAA8C;CAE5F,MAAM,UAAU,MAAM,gBAAgB,gBAAgB;EAAC;EAAU;EAAW;CAAQ,CAAC,EAAA,CAAG,OACrF,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,SAAS,kBAAkB,MAAM;CACvC,IAAI,CAAC,UAAU,OAAO,UAAU,WAAW,SAAS,OAAO,SAAS,WAAW,MAC7E,MAAM,IAAI,MACR,2BAA2B,UAAU,YAAY,6BAA6B,WAAW,MAAM,GAAG,WAAW,MAC/G;CAGF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,oBAAoB,CAAC,EAAA,CACzE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CAER,MAAM,uBAAuB,gBADd,QAAQ,UAC2B,GAAG,sBAAsB;CAC3E,OAAO;AACT;AAEA,eAAsB,uBACpB,gBACA,QACA,OACe;CAMf,KAJE,MAAM,gBAAgB,gBAAgB;EAAC;EAAgB;EAAuB;CAAc,CAAC,EAAA,CAC7F,OACC,SAAS,MAAM,CAAC,CAChB,KACY,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,2BAA2B;CAMtE,MAAM,YAAY,MAAM,SACtB,QACE,iBACC,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,kBAAkB,CAAC,EAAA,CAAG,OACxE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV,CACF;CACA,IAAI,UAAU,SAAS,GAAG,GACxB,MAAM,IAAI,MAAM,GAAG,MAAM,8CAA8C;CAEzE,KAAK,MAAM,8BAAc,IAAI,IAAI,CAAC,QAAQ,SAAS,CAAC,GAClD,KAAK,MAAM,QAAQ,CAAC,cAAc,iBAAiB,GAAG;EACpD,MAAM,OAAO,KAAK,YAAY,WAAW,QAAQ,IAAI;EACrD,IAAI;GAEF,KAAI,MADmB,SAAS,MAAM,MAAM,EAAA,CAC/B,KAAK,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,sBAAsB,MAAM;EAC5E,SAAS,OAAO;GACd,IAAI,CAAC,UAAU,KAAK,GAAG,MAAM;EAC/B;CACF;AAEJ;AAEA,eAAe,wBACb,gBACA,QACA,cACe;CAIf,KAHc,MAAM,gBAAgB,gBAAgB;EAAC;EAAY;EAAM;CAAM,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KACI,MAAM,UAAU,MAAM,IAAI,MAAM,0CAA0C,QAAQ;CACzF,MAAM,cACJ,MAAM,gBAAgB,gBAAgB,CAAC,aAAa,GAAG,OAAO,QAAQ,CAAC,EAAA,CACvE,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAI,eAAe,cACjB,MAAM,IAAI,MAAM,8BAA8B,WAAW,kBAAkB,cAAc;AAE7F;AAEA,eAAe,eACb,gBACA,MACA,cAAsC,CAAC,GACxB;CACf,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAO;EAAe;CAAI,GACtC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,QAAQ,WAAW,GAAG,MAAM,IAAI,MAAM,oCAAoC;CAC9E,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MACR,kEAAkE,MAAM,MAC1E;EAEF,kBAAkB,MAAM,IAAI;CAC9B;AACF;AAEA,eAAe,6BACb,gBACA,MACA,aACkD;CAClD,OAAO,2BACL,MAAM,0BAA0B,gBAAgB,MAAM,WAAW,CACnE;AACF;AAEA,eAAsB,0BACpB,gBACA,MACA,cAAsC,CAAC,GACvC,QAC0E;CAC1E,MAAM,WACJ,MAAM,gBACJ,gBACA;EAAC;EAAW;EAAQ;EAAe;CAAI,GACvC,KAAA,GACA,WACF,EAAA,CACA;CACF,MAAM,QAAyE,CAAC;CAChF,MAAM,UAAU,iBAAiB,OAAO;CACxC,IAAI,UAAU,QAAQ,SAAS,OAAO,UACpC,MAAM,IAAI,MAAM,qCAAqC;CAEvD,IAAI,aAAa;CACjB,KAAK,MAAM,SAAS,SAAS;EAC3B,IAAI,MAAM,SAAS,UAAW,MAAM,SAAS,YAAY,MAAM,SAAS,UACtE,MAAM,IAAI,MAAM,mDAAmD,MAAM,MAAM;EAEjF,kBAAkB,MAAM,IAAI;EAC5B,IAAI,MAAM,SAAS,KAAA,GACjB,MAAM,IAAI,MAAM,4CAA4C,MAAM,MAAM;EAE1E,IAAI,UAAU,MAAM,OAAO,OAAO,cAChC,MAAM,IAAI,MAAM,iDAAiD,MAAM,MAAM;EAE/E,cAAc,MAAM;EACpB,IAAI,UAAU,aAAa,OAAO,mBAChC,MAAM,IAAI,MAAM,8CAA8C;EAEhE,MAAM,SACJ,MAAM,gBACJ,gBACA;GAAC;GAAY;GAAQ,MAAM;EAAM,GACjC,KAAA,GACA,WACF,EAAA,CACA;EACF,IAAI,MAAM,eAAe,MAAM,MAC7B,MAAM,IAAI,MAAM,oCAAoC,MAAM,MAAM;EAElE,MAAM,KAAK;GACT,MAAM,MAAM;GACZ,MAAM,MAAM,SAAS,WAAW,MAAQ;GACxC,OAAO,WAAW,KAAK,KAAK;EAC9B,CAAC;CACH;CACA,OAAO,MAAM,MAAM,MAAM,UAAW,KAAK,OAAO,MAAM,OAAO,KAAK,KAAK,OAAO,MAAM,OAAO,IAAI,CAAE;AACnG;AAEA,SAAS,iBAAiB,OAMvB;CACD,MAAM,MAAM,OAAO,KAAK,KAAK;CAC7B,MAAM,UAAU,IAAI,SAAS,MAAM;CACnC,IAAI,CAAC,OAAO,KAAK,SAAS,MAAM,CAAC,CAAC,OAAO,GAAG,GAC1C,MAAM,IAAI,MAAM,8CAA8C;CAGhE,OADa,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAC9B,CAAC,CAAC,KAAK,QAAQ;EACvB,MAAM,MAAM,IAAI,QAAQ,GAAI;EAC5B,MAAM,SAAS,IAAI,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO;EAC1D,MAAM,OAAO,IAAI,MAAM,MAAM,CAAC;EAC9B,MAAM,CAAC,MAAM,MAAM,QAAQ,YAAY;EACvC,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,MAC3C,MAAM,IAAI,MAAM,0BAA0B;EAE5C,MAAM,OAAO,YAAY,QAAQ,KAAK,QAAQ,IAAI,OAAO,QAAQ,IAAI,KAAA;EACrE,IAAI,SAAS,KAAA,KAAa,CAAC,OAAO,cAAc,IAAI,GAClD,MAAM,IAAI,MAAM,8DAA8D;EAEhF,OAAO;GAAE;GAAM;GAAM;GAAQ,GAAI,SAAS,KAAA,IAAY,CAAC,IAAI,EAAE,KAAK;GAAI;EAAK;CAC7E,CAAC;AACH;AAEA,SAAS,kBAAkB,MAAoB;CAC7C,IACE,CAAC,QACD,KAAK,WAAW,GAAG,KACnB,KAAK,SAAS,IAAI,KAClB,KAAK,SAAS,IAAI,KAClB,oBAAoB,IAAI,KACxB,KAAK,MAAM,GAAG,CAAC,CAAC,MAAM,SAAS,CAAC,QAAQ,SAAS,OAAO,SAAS,IAAI,KACrE,KAAK,MAAM,GAAG,CAAC,CAAC,EAAE,EAAE,YAAY,MAAM,QAEtC,MAAM,IAAI,MAAM,+CAA+C,MAAM;AAEzE;AAEA,SAAS,kBAAkB,OAA4D;CACrF,MAAM,QAAQ,MAAM,MAClB,sGACF;CACA,IAAI,CAAC,QAAQ,MAAM,CAAC,MAAM,IAAI,OAAO,KAAA;CACrC,OAAO;EAAE,OAAO,MAAM;EAAI,MAAM,MAAM;CAAG;AAC3C;AAEA,eAAsB,gBACpB,gBACA,MACA,OACA,WAAmC,CAAC,GACpC,UAAqE,CAAC,GAClD;CACpB,IACE,QAAQ,uBACP,KAAK,WAAW,KACf,KAAK,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,wCAC/B,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,MAAM,4BAE9B,MAAM,IAAI,MAAM,qEAAqE;CAEvF,IACE,QAAQ,mBAAmB,KAAA,MAC1B,CAAC,OAAO,cAAc,QAAQ,cAAc,KAAK,QAAQ,iBAAiB,IAE3E,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,MAAM,OAAO,YACjB,OAAO,QAAQ,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,WAAW,MAAM,CAAC,CACzE;CACA,OAAO,OAAO,KAAK;EACjB,qBAAqB;EACrB,mBAAmB;EACnB,mBAAmB;EACnB,qBAAqB;EACrB,wBAAwB;EACxB,QAAQ;EACR,GAAG;CACL,CAAC;CAGD,IAAI,QAAQ,oBACV,KAAK,MAAM,QAAQ;EAAC;EAAqB;EAAqB;CAAqB,GAAG;EACpF,OAAO,IAAI;EACX,IAAI,QAAQ,IAAI,UAAU,KAAA,GAAW,IAAI,QAAQ,QAAQ,IAAI;CAC/D;CAEF,MAAM,WAAW;EACf;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA;EACA,GAAG;CACL;CACA,OAAO,MAAM,IAAI,SAAS,eAAe,WAAW;EAClD,MAAM,QAAQ,MAAM,OAAO,UAAU;GAAE;GAAK,OAAO;IAAC;IAAQ;IAAQ;GAAM;EAAE,CAAC;EAC7E,MAAM,SAAmB,CAAC;EAC1B,MAAM,SAAmB,CAAC;EAC1B,IAAI,cAAc;EAClB,IAAI,WAAW;EACf,SAAS,OAAO,QAAkB,OAAqB;GACrD,IAAI,UAAU;GACd,eAAe,MAAM;GACrB,IAAI,QAAQ,mBAAmB,KAAA,KAAa,cAAc,QAAQ,gBAAgB;IAChF,WAAW;IACX,MAAM,KAAK,SAAS;IACpB;GACF;GACA,OAAO,KAAK,KAAK;EACnB;EACA,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,QAAQ,KAAK,CAAC;EAChE,MAAM,OAAO,GAAG,SAAS,UAAkB,OAAO,QAAQ,KAAK,CAAC;EAChE,MAAM,GAAG,SAAS,MAAM;EACxB,MAAM,MAAM,GAAG,SAAS,MAAM;EAC9B,MAAM,GAAG,UAAU,MAAM,WAAW;GAClC,IAAI,UAAU;IACZ,uBAAO,IAAI,MAAM,8CAA8C,CAAC;IAChE;GACF;GACA,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,MAAM,MAAM,OAAO,OAAO,MAAM;GAChC,IAAI,SAAS,GAAG;IACd,uBACE,IAAI,MACF,OAAO,KAAK,MAAM,YAAY,WAAW,UAAU,KAAK,KAAK,IAAI,SAAS,MAAM,CAAC,CAAC,KAAK,GACzF,CACF;IACA;GACF;GACA,cAAc;IAAE,QAAQ;IAAK,QAAQ;GAAI,CAAC;EAC5C,CAAC;EACD,IAAI,OAAO,MAAM,MAAM,IAAI,KAAK;OAC3B,MAAM,MAAM,IAAI;CACvB,CAAC;AACH;AAEA,SAAS,UAAU,OAAyB;CAC1C,OACE,OAAO,UAAU,YACjB,UAAU,QACV,UAAU,SACT,MAA4B,SAAS;AAE1C;;;AC9dA,eAAsB,+BACpB,WACA,UAAiD,CAAC,GACR;CAC1C,MAAM,OAAO,QAAQ,SAAS;CAC9B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,IACE,QAAQ,uBAAuB,KAAA,KAC/B,QAAQ,uBAAuB,UAC/B,QAAQ,uBAAuB,gBAE/B,MAAM,IAAI,MAAM,yCAAyC;CAE3D,IAAI,QAAQ,uBAAuB,KAAA,KAAa,CAAC,QAAQ,mBACvD,MAAM,IAAI,MAAM,yDAAyD;CAE3E,MAAM,WAAW,QAAQ,oBACrB,MAAM,kBAAkB,MAAM,QAAQ,QAAQ,uBAAuB,cAAc,IACnF,MAAM,6BAA6B,MAAM,EACvC,QAAQ;EACN,UAAU,OAAO;EACjB,cAAc,OAAO;EACrB,mBAAmB,OAAO;CAC5B,EACF,CAAC;CACL,iCAAiC,SAAS,OAAO,MAAM;CACvD,MAAM,aAAa,gBAAgB,WAAW,SAAS,aAAa,KAAA;CACpE,OAAO,sBAAsB,SAAS,OAAO,YAAY,QAAQ,QAAQ,mBAAmB;AAC9F;;AAGA,SAAgB,kCACd,UAAoD,CAAC,GACxB;CAC7B,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAa7C,OAAO,OAAO,OAAO,EAXnB,aAAa,OAAO,EAAE,MAAM,UAAU,SAAS,aAAa,aAAa;EACvE,MAAM,mCAAmC;GACvC;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,EAEsB,CAAC;AAC3B;AAEA,eAAe,mCAAmC,OAOhC;CAChB,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,MAAM,+BAA+B,KAAK;CAC1D,MAAM,QAAQ,eAAe;CAC7B,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,aAAa,EAAE,mBAAmB,MAAM,CAAC;CACvE,MAAM,QAAQ,eAAe;CAC7B,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,QAAQ,eAAe;EAC7B,MAAM,oBAAoB,SAAS,QAAQ,OAAO,MAAM,MAAM;EAC9D,IAAI,QAAQ,YACV,MAAM,sBAAsB,QAAQ,YAAY,SAAS,MAAM,QAAQ,MAAM,MAAM;EAErF,MAAM,QAAQ,eAAe;EAC7B,MAAM,4BAA4B,SAAS,MAAM,SAAS,UAAU,EAClE,6BAA6B,QAAQ,aAAa,CAAC,MAAM,IAAI,CAAC,EAChE,CAAC;EACD,MAAM,QAAQ,eAAe;EAC7B,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM;CACR;AACF;AAEA,eAAe,kBACb,eACA,QACA,aAIC;CACD,MAAM,iBAAiB,MAAM,MAAM,aAAa;CAChD,IAAI,CAAC,eAAe,YAAY,KAAK,eAAe,eAAe,GACjE,MAAM,IAAI,MAAM,oDAAoD;CAOtE,MAAM,OAAO,MAAM,SAAS,aAAa;CACzC,MAAM,gBAAgB,MAAM,MAAM,IAAI;CACtC,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,4DAA4D;CAE9E,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,iBAAiB,CAAC,EAAA,CAAG,OAC9E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,IAAK,MAAM,SAAS,QAAQ,QAAQ,CAAC,MAAO,MAC1C,MAAM,IAAI,MAAM,kEAAkE;CAEpF,MAAM,SAAS,SACZ,MAAM,gBAAgB,MAAM,CAAC,aAAa,oBAAoB,CAAC,EAAA,CAAG,OAChE,SAAS,MAAM,CAAC,CAChB,KAAK,CACV;CACA,IAAK,MAAM,SAAS,MAAM,MAAO,UAAU,OAAO,SAAS,GAAG,GAC5D,MAAM,IAAI,MAAM,+DAA+D;CAEjF,MAAM,uBAAuB,MAAM,QAAQ,sBAAsB;CACjE,MAAM,cAAc,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OACrE,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,YAAY,MAAM,gBAAgB,MAAM,CAAC,aAAa,aAAa,CAAC,EAAA,CAAG,OAC1E,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,kBAAkB,YAAY,MAAM;CACpC,kBAAkB,UAAU,WAAW;CACvC,IAAI,WAAW,WAAW,SAAS,QACjC,MAAM,IAAI,MAAM,iEAAiE;CAEnF,MAAM,UAAU,cAAc,MAAM,6BAA6B,MAAM,MAAM,IAAI,KAAA;CACjF,MAAM,QAAQ,SAAS,SAAU,MAAM,0BAA0B,MAAM,UAAU,CAAC,GAAG,MAAM;CAC3F,iCAAiC,OAAO,MAAM;CAC9C,MAAM,sBACJ,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAgB;EAAa;CAAM,CAAC,EAAA,CAC7E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;CACR,MAAM,iBAAiB,OAAO,kBAAkB;CAChD,IAAI,CAAC,OAAO,cAAc,cAAc,KAAK,iBAAiB,GAC5D,MAAM,IAAI,MAAM,gDAAgD;CAElE,IAAI,iBAAiB,OAAO,0BAC1B,MAAM,IAAI,MAAM,uDAAuD;CAEzE,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,MAAM,gBAAgB,MAAM;GAAC;GAAU;GAAU;GAAY;EAAM,CAAC;EACpE,MAAM,SAAS,WAAW,KAAK,MAAM,SAAS,UAAU,CAAC;EACzD,IAAI,OAAO,aAAa,OAAO,0BAC7B,MAAM,IAAI,MAAM,8DAA8D;EAEhF,IAAI,SAAS;GACX,MAAM,QAAQ,MAAM,2BAA2B,MAAM,MAAM;GAC3D,IACE,MAAM,UAAU,QAAQ,MAAM,SAC9B,MAAM,UAAU,QAAQ,MAAM,UAC7B,MAAM,gBAAgB,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KAAK,MAChF,YAEF,MAAM,IAAI,MAAM,0DAA0D;GAG5E,KAAI,MADuB,wBAAwB,MAAM,MAAM,OAAO,MAAM,EAAA,CAC3D,KAAK,IAAI,MAAM,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC,CAAC,KAAK,IAAI,GACtE,MAAM,IAAI,MAAM,gEAAgE;GAElF,MAAM,4BAA4B,MAAM,2BAA2B,KAAK,GAAG;IACzE,6BAA6B,CAAC,MAAM;IACpC,eAAe,MAAM,KAAK,SAAS,KAAK,IAAI;GAC9C,CAAC;EACH;EACA,OAAO;GACL;GACA,YAAY;IACV;IACA;IACA,QAAQ;KACN,QAAQC,cAAY,MAAM;KAC1B,YAAY,OAAO;KACnB,OAAO;IACT;IACA,GAAI,UACA,EACE,aAAa,EAAE,OAAO,QAAQ,MAAM,MAAM,EAC5C,IACA,CAAC;GACP;EACF;CACF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,eAAe,2BACb,MACA,QAKC;CACD,MAAM,MAAM,EAAE,oBAAoB,IAAI;CACtC,MAAM,eAAe,KAAK,IACxB,OAAO,iBACP,OAAO,YAAY,OAAO,eAAe,IAC3C;CACA,MAAM,QAAQ,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,QAEpD,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAW;CAAI,GAAG,KAAA,GAAW,KAAK,EACzE,gBAAgB,aAClB,CAAC,EAAA,CACD,MACJ;CACA,MAAM,UAAU,MACb,MAAM,IAAI,CAAC,CACX,OAAO,OAAO,CAAC,CACf,KAAK,UAAU;EACd,MAAM,QAAQ,yDAAyD,KAAK,KAAK;EACjF,IAAI,CAAC,OACH,MAAM,IAAI,MAAM,2EAA2E;EAC7F,MAAM,GAAG,MAAM,QAAQ,QAAQ;EAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,MAAM,IAAI,MAAM,gCAAgC;EACtE,OAAO;GACL,MAAM,gBAAgB,MAAM,OAAO,YAAY;GAC/C,MAAM,SAAS,WAAW,MAAQ;GAClC;EACF;CACF,CAAC;CACH,IAAI,QAAQ,SAAS,OAAO,UAAU,MAAM,IAAI,MAAM,sCAAsC;CAM5F,IAAI,CAAC,IAJH,MAAM,gBAAgB,MAAM;EAAC;EAAY;EAAW;CAAI,GAAG,KAAA,GAAW,KAAK,EACzE,gBAAgB,aAClB,CAAC,EAAA,CACD,OAAO,SAAS,MACD,CAAC,CAAC,SAAS,0BAA0B,CAAC,CAAC,CAAC,MAAM,UAAU,MAAM,OAAO,GAAG,GACvF,MAAM,IAAI,MAAM,yEAAyE;CAI3F,MAAM,QAAQ,QAAQ,UAEhB,MAAM,gBACJ,MACA,CAAC,YAAY,eAAe,GAC5B,OAAO,KAAK,QAAQ,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC,KAAK,IAAI,IAAI,IAAI,GAClE,KACA,EAAE,gBAAgB,aAAa,CACjC,EAAA,CACA,OACC,SAAS,MAAM,CAAC,CAChB,QAAQ,CAAC,CACT,MAAM,IAAI,IACb,CAAC;CACL,IAAI,MAAM,WAAW,QAAQ,QAC3B,MAAM,IAAI,MAAM,iDAAiD;CACnE,IAAI,aAAa;CACjB,MAAM,cAAc,QAAQ,KAAK,OAAO,UAAU;EAChD,MAAM,QAAQ,4CAA4C,KAAK,MAAM,UAAU,EAAE;EACjF,MAAM,OAAO,OAAO,QAAQ,EAAE;EAC9B,IAAI,CAAC,SAAS,MAAM,OAAO,MAAM,UAAU,CAAC,OAAO,cAAc,IAAI,KAAK,OAAO,GAC/E,MAAM,IAAI,MAAM,8CAA8C;EAEhE,IAAI,OAAO,OAAO,cAChB,MAAM,IAAI,MAAM,kDAAkD,MAAM,MAAM;EAChF,IAAI,OAAO,OAAO,oBAAoB,YACpC,MAAM,IAAI,MAAM,+CAA+C;EACjE,cAAc;EACd,OAAO;CACT,CAAC;CACD,MAAM,QAAkE,CAAC;CACzE,KAAK,MAAM,CAAC,OAAO,UAAU,QAAQ,QAAQ,GAAG;EAC9C,MAAM,SACJ,MAAM,gBAAgB,MAAM;GAAC;GAAY;GAAQ,MAAM;EAAM,GAAG,KAAA,GAAW,KAAK,EAC9E,gBAAgB,OAAO,aACzB,CAAC,EAAA,CACD;EACF,IAAI,MAAM,eAAe,YAAY,QACnC,MAAM,IAAI,MAAM,uCAAuC;EACzD,MAAM,KAAK;GAAE,MAAM,MAAM;GAAM,MAAM,MAAM;GAAM,OAAO,WAAW,KAAK,KAAK;EAAE,CAAC;CAClF;CACA,MAAM,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAAE;CACrE,iCAAiC,OAAO,MAAM;CAC9C,MAAM,kBAAkB,KACtB,QAAQ,IAAI,mBAAmB,KAAK,QAAQ,GAAG,SAAS,GACxD,OACA,QACF;CACA,MAAM,WAAW,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CACvD,QAEG,MAAM,gBACJ,MACA;EACE;EACA;EACA;EACA;EACA;EACA;EACA;CACF,GACA,KAAA,GACA,CAAC,GACD;EAAE,gBAAgB,OAAO;EAAc,oBAAoB;CAAK,CAClE,EAAA,CACA,MACJ,CAAC,CACA,QAAQ,QAAQ,EAAE;CACrB,MAAM,QAAQ,IAAI,YAAY,SAAS,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,QAEpD,MAAM,gBACJ,MACA;EACE;EACA,qBAAqB;EACrB;EACA;EACA;EACA;EACA;CACF,GACA,KAAA,GACA,KACA,EAAE,gBAAgB,aAAa,CACjC,EAAA,CACA,MACJ;CACA,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,CAAC,CAAC,OAAO,OAAO,GAAG,gBAAgB,MAAM,OAAO,YAAY;CAC/F,OAAO;EAAE;EAAO;EAAO;CAAM;AAC/B;AAEA,eAAe,6BACb,MACA,QACA;CACA,MAAM,QAAQ,MAAM,2BAA2B,MAAM,MAAM;CAQ3D,OAAO;EAAE;EAAO,OADF,CAAC,IAAG,MALK,6BAA6B,MAAM;GACxD,6BAA6B,CAAC,MAAM;GACpC,qBAH0B,wBAAwB,MAAM,MAAM,OAAO,MAAM;GAI3E;EACF,CAAC,EAAA,CAC0B,KAAK,CAAC,CAAC,MAAM,GAAG,MAAO,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,CAC3E;CAAE;AACxB;AAEA,eAAe,wBACb,MACA,SACA,QACmB;CACnB,MAAM,QAAQ,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,IAAI,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK;CACrE,IAAI,MAAM,SAAS,OAAO,UAAU,MAAM,IAAI,MAAM,sCAAsC;CAC1F,MAAM,gBAA0B,CAAC;CACjC,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,OAAO,gBAAgB,MAAM,OAAO,YAAY;EACtD,IAAI;GACF,MAAM,MAAM,cAAc,MAAM,IAAI,CAAC;GACrC,cAAc,KAAK,IAAI;EACzB,SAAS,OAAO;GACd,IAAI,EAAE,iBAAiB,SAAS,UAAU,SAAS,MAAM,SAAS,WAAW,MAAM;EACrF;CACF;CACA,OAAO;AACT;AAEA,eAAsB,wBACpB,aACA,UAA2C,CAAC,GAC7B;CACf,MAAM,MAAM,QAAQ,sBAAsB,QAAQ,QAAQ,WAAW,IAAI,aAAa;EACpF,WAAW;EACX,MAAM;CACR,CAAC;CACD,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,MAAM,WAAW;CACjC,SAAS,OAAO;EACd,IAAI,QAAQ,sBAAsB,SAAU,MAAgC,SAAS,UACnF;EACF,MAAM;CACR;CACA,IAAI,CAAC,MAAM,YAAY,KAAK,MAAM,eAAe,GAC/C,MAAM,IAAI,MAAM,0DAA0D;CAK5E,MAAM,sBAAsB,MAAM,SAAS,WAAW;CACtD,MAAM,gBAAgB,MAAM,MAAM,mBAAmB;CACrD,IAAI,CAAC,cAAc,YAAY,KAAK,cAAc,eAAe,GAC/D,MAAM,IAAI,MAAM,kEAAkE;CAEpF,KAAK,MAAM,QAAQ,WAAW,EAAA,CAAG,SAAS,GACxC,MAAM,IAAI,MAAM,+CAA+C;AAEnE;AAEA,eAAe,oBACb,aACA,OACA,QACe;CACf,KAAK,MAAM,QAAQ,OAAO;EACxB,QAAQ,eAAe;EACvB,MAAM,OAAO,cAAc,aAAa,KAAK,IAAI;EACjD,MAAM,MAAM,QAAQ,IAAI,GAAG;GAAE,WAAW;GAAM,MAAM;EAAM,CAAC;EAC3D,MAAM,aAAa,MAAM,KACvB,MACAC,UAAY,WACVA,UAAY,UACZA,UAAY,UACX,OAAOA,UAAY,eAAe,WAAWA,UAAY,aAAa,IACzE,GACF;EACA,IAAI;GACF,QAAQ,eAAe;GACvB,MAAM,WAAW,UAAU,KAAK,OAAO,EAAE,OAAO,CAAC;GACjD,MAAM,QAAQ,MAAM,WAAW,KAAK;GACpC,IAAI,CAAC,MAAM,OAAO,KAAK,MAAM,UAAU,GACrC,MAAM,IAAI,MAAM,4DAA4D,KAAK,MAAM;GAEzF,MAAM,WAAW,MAAM,KAAK,IAAI;GAChC,QAAQ,eAAe;EACzB,UAAU;GACR,MAAM,WAAW,MAAM;EACzB;CACF;AACF;AAEA,eAAe,sBACb,YACA,aACA,QACA,QACe;CACf,QAAQ,eAAe;CACvB,MAAM,MAAM,OACV,MACA,OACA,UAAuC,CAAC,MACrC;EACH,QAAQ,eAAe;EACvB,MAAM,SAAS,MAAM,gBAAgB,aAAa,MAAM,OAAO,CAAC,GAAG,OAAO;EAC1E,QAAQ,eAAe;EACvB,OAAO;CACT;CACA,MAAM,YAAY,MAAM,QAAQ,KAAK,OAAO,GAAG,mCAAmC,CAAC;CACnF,MAAM,aAAa,KAAK,WAAW,GAAG,WAAW,EAAE,QAAQ;CAC3D,IAAI;EACF,QAAQ,eAAe;EACvB,MAAM,UAAU,YAAY,WAAW,OAAO,OAAO;GAAE,MAAM;GAAM,MAAM;GAAO;EAAO,CAAC;EACxF,MAAM,IAAI;GACR;GACA;GACA;GACA,mBAAmB,WAAW,WAAW,WAAW,KAAK,WAAW;EACtE,CAAC;EACD,MAAM,IAAI;GAAC;GAAU;GAAU;EAAU,CAAC;EAC1C,MAAM,IAAI;GAAC;GAAU;GAAY;EAAU,CAAC;EAI5C,KAHoB,MAAM,IAAI;GAAC;GAAY;GAAM,WAAW;EAAU,CAAC,EAAA,CAAG,OACvE,SAAS,MAAM,CAAC,CAChB,KACU,MAAM,UAAU,MAAM,IAAI,MAAM,2CAA2C;EAIxF,KAHsB,MAAM,IAAI,CAAC,aAAa,GAAG,WAAW,WAAW,QAAQ,CAAC,EAAA,CAAG,OAChF,SAAS,MAAM,CAAC,CAChB,KACY,MAAM,WAAW,UAC9B,MAAM,IAAI,MAAM,+CAA+C;EAEjE,MAAM,IAAI;GAAC;GAAc;GAAc;GAAQ,WAAW;EAAU,CAAC;EACrE,MAAM,IAAI,CAAC,aAAa,WAAW,QAAQ,CAAC;EAC5C,IAAI,WAAW,aAAa;GAG1B,MAAM,IAAI,CAAC,aAAa,SAAS,CAAC;GAClC,MAAM,UAAoB,CAAC;GAC3B,KAAK,MAAM,QAAQ,WAAW,YAAY,OAAO;IAC/C,MAAM,UACJ,MAAM,IAAI;KAAC;KAAe;KAAM;IAAS,GAAG,KAAK,OAAO,EAAE,gBAAgB,IAAI,CAAC,EAAA,CAC/E,OACC,SAAS,MAAM,CAAC,CAChB,KAAK;IACR,kBAAkB,QAAQ,aAAa;IACvC,QAAQ,KAAK,GAAG,KAAK,SAAS,MAAQ,WAAW,SAAS,GAAG,OAAO,IAAI,KAAK,KAAK,GAAG;GACvF;GACA,IAAI,QAAQ,QACV,MAAM,IAAI;IAAC;IAAgB;IAAM;GAAc,GAAG,OAAO,KAAK,QAAQ,KAAK,EAAE,CAAC,CAAC;GAEjF,MAAM,WAAW,MAAM,0BAA0B,cAD9B,MAAM,IAAI,CAAC,YAAY,CAAC,EAAA,CAAG,OAAO,SAAS,MAAM,CAAC,CAAC,KACR,GAAW,CAAC,GAAG,MAAM;GACnF,QAAQ,eAAe;GACvB,IACE,CAAC,OAAO,KAAKC,0BAAwB,2BAA2B,QAAQ,CAAC,CAAC,CAAC,CAAC,OAC1E,OAAO,KACLA,0BAAwB,2BAA2B,WAAW,YAAY,KAAK,CAAC,CAClF,CACF,GAEA,MAAM,IAAI,MAAM,mEAAmE;GACrF;EACF;EAKA,KAHgB,MAAM,IAAI;GAAC;GAAU;GAAkB;EAAuB,CAAC,EAAA,CAAG,OAC/E,SAAS,MAAM,CAAC,CAChB,KACM,GAAG,MAAM,IAAI,MAAM,sDAAsD;CACpF,UAAU;EACR,MAAM,GAAG,WAAW;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACtD;AACF;AAEA,SAAgB,cAAc,MAAc,cAA8B;CACxE,MAAM,OAAO,QAAQ,MAAM,YAAY;CACvC,IAAI,CAAC,KAAK,WAAW,GAAG,OAAO,KAAK,GAClC,MAAM,IAAI,MAAM,6DAA6D,cAAc;CAE7F,OAAO;AACT;;;;;;;;ACliBA,MAAM,wBAAwB;;AAe9B,eAAsB,0CACpB,WACA,SACyE;CACzE,MAAM,EAAE,iBAAiB,aAAa,WAAW,QAAQ;CACzD,IAAI,CAAC,gBAAgB,aAAa,CAAC,gBAAgB,YACjD,MAAM,IAAI,MAAM,mEAAmE;CAErF,IAAI,CAAC,YAAY,KAAK,GACpB,MAAM,IAAI,MAAM,kEAAkE;CACpF,QAAQ,eAAe;CACvB,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,MAAM,kCAAkC,WAAW;EAClE;EACA;EACA,eAAe,QAAQ;CACzB,CAAC;CACD,iBAAiB,UAAU,MAAM;CACjC,MAAM,OAAO,MAAM,SAAS,QAAQ,SAAS,CAAC;CAC9C,MAAM,WAAWC,0BAAwB,QAAQ;CACjD,MAAM,mBAAmB,MAAM,qCAAqC,iBAAiB;EACnF;EACA,SAAS;EACT,QAAQ,SAAS,QAAQ;EACzB,UAAU,SAAS;EACnB;CACF,CAAC;CACD,MAAM,kBAAkB,MAAM,qCAAqC,iBAAiB;EAClF;EACA,SAAS;EACT,QAAQ,uBAAuB,MAAM,UAAU,MAAM;EACrD,UAAU,OAAO;EACjB;CACF,CAAC;CACD,OAAO,OAAO,OAAO,EACnB,UAAU,oBAAoB;EAC5B,MAAM;EACN,QAAQC,2BAAyB,QAAQ;EACzC;EACA,UAAU;EACV,SAAS;CACX,CAAC,EACH,CAAC;AACH;;;;;AA2BA,eAAsB,8CACpB,WACA,SACsC;CACtC,MAAM,EAAE,iBAAiB,aAAa,WAAW,QAAQ;CACzD,IAAI,CAAC,gBAAgB,aAAa,CAAC,gBAAgB,cAAc,CAAC,gBAAgB,QAChF,MAAM,IAAI,MAAM,sEAAsE;CAExF,IAAI,CAAC,YAAY,KAAK,GACpB,MAAM,IAAI,MAAM,kEAAkE;CACpF,QAAQ,eAAe;CACvB,MAAM,SAAS,gBAAgB,QAAQ,MAAM;CAC7C,MAAM,WAAW,MAAM,kCAAkC,WAAW;EAClE;EACA;EACA,eAAe,QAAQ;CACzB,CAAC;CACD,iBAAiB,UAAU,MAAM;CACjC,MAAM,OAAO,MAAM,SAAS,QAAQ,SAAS,CAAC;CAC9C,MAAM,QAAQ,SAAS,MAAM,QAAQ,KAAK,SAAS,MAAM,KAAK,YAAY,CAAC;CAC3E,IAAI,cAAc;CAIlB,MAAM,WAAW,CAAC,GAAG,IAAI,IAAI,SAAS,MAAM,KAAK,SAAS,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;CACxF,MAAM,SAAS,gBAAgB,OAAO,KAAK,eAAe;CAC1D,MAAM,mBAAmB,UAAU,uBAAuB,OAAO,SAAS;EACxE,QAAQ,eAAe;EAKvB,IAAI,MAJe,OACjB;GAAE,QAAQ,KAAK;GAAQ,YAAY,KAAK;EAAW,GACnD,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C,MACa,KAAA,GAAW;EACxB,MAAM,SAAS,MAAM,qCAAqC,iBAAiB;GACzE;GACA,SAAS;GACT,QAAQ,oBAAoB,MAAM,MAAM,MAAM;GAC9C,UAAU,KAAK;GACf;EACF,CAAC;EACD,IAAI,OAAO,WAAW,KAAK,UAAU,OAAO,eAAe,KAAK,YAC9D,MAAM,IAAI,MAAM,0CAA0C,KAAK,MAAM;EACvE,eAAe,KAAK;CACtB,CAAC;CACD,MAAM,gBAAgBD,0BAAwB,QAAQ;CACtD,MAAM,WAAW,MAAM,qCAAqC,iBAAiB;EAC3E;EACA,SAAS;EACT,QAAQ,SAAS,aAAa;EAC9B,UAAU,cAAc;EACxB;CACF,CAAC;CACD,MAAM,SAASC,2BAAyB,QAAQ;CAChD,IAAI,SAAS,WAAW,QACtB,MAAM,IAAI,MAAM,oEAAoE;CACtF,OAAO,oBAAoB;EACzB,MAAM;EACN;EACA;EACA,OAAO,SAAS,MAAM;EACtB;EACA;CACF,CAAC;AACH;;;;;AAMA,eAAsB,kCACpB,MACA,WACA,UAA4F,CAAC,GAC3C;CAClD,MAAM,EAAE,WAAW;CACnB,IAAI,CAAC,UAAU,QAAQ,MAAM,IAAI,MAAM,6CAA6C;CACpF,IAAI,KAAK,SAAS,WAAW,KAAK,QAChC,MAAM,IAAI,MAAM,kDAAkD;CACpE,QAAQ,eAAe;CAEvB,IAAI;CACJ,IAAI,UAAU,YAAY;EACxB,MAAM,SAAuB,CAAC;EAC9B,WAAW,MAAM,SAAS,uBAAuB,KAAK,UAAU,WAAW,MAAM,GAC/E,OAAO,KAAK,KAAK;EACnB,QAAQ,OAAO,OAAO,MAAM;CAC9B,OAAO,QAAQ,MAAM,UAAU,KAAK,KAAK,QAAQ;CACjD,YAAY,OAAO,KAAK,SAAS,QAAQ,KAAK,SAAS,YAAY,yBAAyB;CAC5F,MAAM,WAAW,KAAK,MACpB,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,MAAM,CACpC;CACA,iBAAiB,UAAU,gBAAgB,QAAQ,MAAM,CAAC;CAC1D,IAAIA,2BAAyB,QAAQ,MAAM,KAAK,QAC9C,MAAM,IAAI,MAAM,0CAA0C;CAC5D,KAAK,MAAM,QAAQ,SAAS,OAAO;EACjC,QAAQ,eAAe;EAKvB,IAAI,MAJe,UAAU,OAC3B;GAAE,QAAQ,KAAK;GAAQ,YAAY,KAAK;EAAW,GACnD,WAAW,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,CAC9C,MACa,KAAA,GAAW,MAAM,IAAI,MAAM,4CAA4C,KAAK,MAAM;CACjG;CACA,OAAO;AACT;;AAWA,eAAsB,uCACpB,OACe;CACf,MAAM,0BAA0B,KAAK;AACvC;;AAGA,eAAsB,yCACpB,OAI0C;CAC1C,IAAI,CAAC,OAAO,cAAc,MAAM,YAAY,KAAK,MAAM,eAAe,GACpE,MAAM,IAAI,MAAM,oEAAoE;CACtF,MAAM,2BAAW,IAAI,IAA0B;CAC/C,MAAM,QAAQ,IAAI,IAAI,MAAM,SAAS,SAAS,MAAM,KAAK,SAAS,CAAC,KAAK,MAAM,IAAI,CAAC,CAAC;CACpF,IAAI,QAAQ;CACZ,KAAK,MAAM,QAAQ,MAAM,OAAO;EAC9B,IAAI,SAAS,IAAI,IAAI,GAAG,MAAM,IAAI,MAAM,yCAAyC;EACjF,MAAM,OAAO,MAAM,IAAI,IAAI;EAC3B,IAAI,CAAC,MAAM,MAAM,IAAI,MAAM,kDAAkD,MAAM;EACnF,SAAS,KAAK;EACd,IAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,MAAM,cAChD,MAAM,IAAI,MAAM,+CAA+C;EACjE,SAAS,IAAI,MAAM,CAAC,CAAC;CACvB;CACA,MAAM,0BAA0B,OAAO,KAAA,GAAW,QAAQ;CAC1D,OAAO,IAAI,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,KAAK,CAAC,MAAM,YAAY,CAAC,MAAM,OAAO,OAAO,MAAM,CAAC,CAAC,CAAC;AACrF;;AAGA,eAAsB,gDACpB,OAIe;CACf,MAAM,QAAQ,eAAe;CAC7B,IAAI,CAAC,MAAM,UAAU,YACnB,MAAM,IAAI,MAAM,kDAAkD;CACpE,MAAM,QAAQ,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,IAAI,IAAI,MAAM,KAAK;CACzE,IAAI,SAAS,MAAM,SAAS,MAAM,OAAO,QACvC,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,cAAc,QAAQ,MAAM,WAAW;CAC7C,MAAM,wBAAwB,WAAW;CACzC,MAAM,UAAU,MAAM,QAAQ,GAAG,YAAY,gBAAgB;CAC7D,IAAI;EACF,MAAM,0BAA0B,OAAO,SAAS,KAAA,GAAW,KAAK;EAChE,MAAM,QAAQ,eAAe;EAC7B,MAAM,OAAO,SAAS,WAAW;CACnC,SAAS,OAAO;EACd,MAAM,GAAG,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EAClD,MAAM;CACR;AACF;AAEA,eAAe,0BACb,OACA,aACA,UACA,OACe;CACf,MAAM,EAAE,WAAW,WAAW;CAC9B,MAAM,WAAW,oBAAoB,gBAAgB,MAAM,QAAQ,CAAC;CACpE,QAAQ,eAAe;CACvB,IAAI,CAAC,UAAU,YAAY,MAAM,IAAI,MAAM,kDAAkD;CAC7F,MAAM,SAAS,gBAAgB,MAAM,MAAM;CAC3C,iBAAiB,SAAS,UAAU,MAAM;CAC1C,IAAI,OAAO;EACT,MAAM,QAAQ,IAAI,IAAI,SAAS,SAAS,MAAM,KAAK,SAAS,KAAK,IAAI,CAAC;EACtE,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,SAAS,CAAC,MAAM,IAAI,IAAI,CAAC,GAC5C,MAAM,IAAI,MAAM,qDAAqD;CACzE;CACA,IAAI,SAAS,QAAQ,aAAa,OAAO,iBACvC,MAAM,IAAI,MAAM,qDAAqD;CACvE,MAAM,WAAWD,0BAAwB,SAAS,QAAQ;CAC1D,YACE,UACA,SAAS,SAAS,QAClB,SAAS,SAAS,YAClB,8BACF;CACA,IAAIC,2BAAyB,SAAS,QAAQ,MAAM,SAAS,QAC3D,MAAM,IAAI,MAAM,0EAA0E;CAC5F,IAAI,SAAS;CACb,WAAW,MAAM,SAAS,uBAAuB,SAAS,UAAU,WAAW,MAAM,GAAG;EACtF,IACE,CAAC,OAAO,KAAK,MAAM,QAAQ,MAAM,YAAY,MAAM,UAAU,CAAC,CAAC,OAC7D,SAAS,SAAS,QAAQ,SAAS,MAAM,UAAU,CACrD,GAEA,MAAM,IAAI,MAAM,0EAA0E;EAE5F,UAAU,MAAM;CAClB;CAEA,MAAM,SAAS,QAAQ;CACvB,MAAM,YAAY,KAAK;CACvB,MAAM,kBAAkB,aAAa,WAAW,OAAO,iBAAiB,MAAM;CAE9E,MAAM,UAAU,SACd,SAAS,KAAK,uBAAuB,SAAS,SAAS,WAAW,MAAM,CAAC,GACzE,QACA,EAAE,OAAO,CACX;CACA,QAAQ,YAAY,KAAA,CAAS;CAC7B,gBAAgB,YAAY,KAAA,CAAS;CACrC,IAAI;EACF,IAAI,QAAQ;EACZ,WAAW,MAAM,SAAS,QAAQ;GAChC,QAAQ,eAAe;GACvB,MAAM,WAAW,SAAS,SAAS,MAAM;GACzC,IACE,CAAC,YACD,MAAM,OAAO,SAAS,UACtB,MAAM,OAAO,SAAS,aAAa,SAAS,UAC5C,MAAM,OAAO,SAAS,SAAS,QAC/B,MAAM,OAAO,SAAS,SAAS,YAE/B,MAAM,IAAI,MAAM,kEAAkE;GAEpF,MAAM,OACJ,gBAAgB,CAAC,SAAS,MAAM,IAAI,SAAS,IAAI,KAC7C,MAAM,gBAAgB,aAAa,SAAS,IAAI,IAChD,KAAA;GACN,IAAI;IACF,gBAAgB,UAAsC;KACpD,MAAM,OAAO,WAAW,QAAQ;KAChC,IAAI,aAAa;KACjB,WAAW,MAAM,SAAS,OAAO;MAC/B,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,0CAA0C;MAC5D,QAAQ,eAAe;MACvB,cAAc,MAAM;MACpB,IAAI,aAAa,SAAU,YACzB,MAAM,IAAI,MAAM,6CAA6C;MAC/D,KAAK,OAAO,KAAK;MACjB,IAAI,MAAM,MAAM,KAAK,UAAU,KAAK;MACpC,UAAU,IAAI,SAAU,IAAI,CAAC,EAAE,KAAK,WAAW,KAAK,KAAK,CAAC;MAC1D,MAAM;KACR;KACA,IACE,eAAe,SAAU,cACzB,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAU,QAE7C,MAAM,IAAI,MAAM,kEAAkE;IAEtF;IACA,MAAM,cAAc,WAAW,UAAU,QAAQ,GAAG,MAAM;IAC1D,IAAI,MAAM,MAAM,KAAK,MAAM,SAAS,IAAI;GAC1C,UAAU;IACR,MAAM,MAAM,MAAM;GACpB;EACF;EACA,IAAI,UAAU,SAAS,SAAS,MAAM,QACpC,MAAM,IAAI,MAAM,kEAAkE;EACpF,MAAM;EACN,UAAU,SAAS;EACnB,MAAM,WAAW,MAAM;EACvB,IACE,SAAS,eAAe,SAAS,QAAQ,cACzC,SAAS,WAAW,SAAS,QAAQ,QAErC,MAAM,IAAI,MAAM,0CAA0C;CAE9D,SAAS,OAAO;EACd,OAAO,QAAQ,QAAQ,KAAK,CAAC;EAC7B,UAAU,QAAQ,QAAQ,KAAK,CAAC;EAChC,MAAM,QAAQ,WAAW,CAAC,SAAS,eAAe,CAAC;EACnD,MAAM;CACR;AACF;AAEA,eAAe,gBAAgB,aAAqB,cAAsB;CACxE,MAAM,OAAO,cAAc,aAAa,YAAY;CACpD,MAAM,MAAM,QAAQ,IAAI,GAAG;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CAC3D,OAAO,KACL,MACA,UAAU,WAAW,UAAU,UAAU,UAAU,SAAS,UAAU,YACtE,GACF;AACF;AAEA,gBAAgB,uBACd,MACA,UACA,QAC4B;CAC5B,MAAM,UAAU,KAAK;CACrB,MAAM,WAAW,YAAY;EAC3B,IAAI;GACF,KAAK,MAAM,QAAQ,SAAS,OAAO;IACjC,QAAQ,eAAe;IACvB,MAAM,cAAc,SAAS,MAAM,oBAAoB,MAAM,MAAM,MAAM,GAAG,MAAM;GACpF;GACA,QAAQ,SAAS;EACnB,SAAS,OAAO;GACd,QAAQ,QAAQ,QAAQ,KAAK,CAAC;GAC9B,MAAM;EACR;CACF,EAAA,CAAG;CACH,QAAQ,YAAY,KAAA,CAAS;CAC7B,IAAI;EACF,WAAW,MAAM,SAAS,SAAS;GACjC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,4CAA4C;GAC9D,QAAQ,eAAe;GACvB,MAAM;EACR;EACA,MAAM;CACR,UAAU;EACR,QAAQ,QAAQ;EAChB,MAAM,QAAQ,YAAY,KAAA,CAAS;CACrC;AACF;AAEA,gBAAgB,oBACd,MACA,UACA,QAC4B;CAC5B,MAAM,OAAO,cAAc,MAAM,SAAS,IAAI;CAC9C,IAAK,MAAM,SAAS,IAAI,MAAO,MAC7B,MAAM,IAAI,MAAM,+CAA+C,SAAS,MAAM;CAChF,MAAM,OAAO,MAAM,KAAK,MAAM,UAAU,WAAW,UAAU,UAAU;CACvE,IAAI;EACF,MAAM,QAAQ,MAAM,KAAK,KAAK;EAC9B,IACE,CAAC,MAAM,OAAO,KACd,MAAM,UAAU,KAChB,MAAM,SAAS,SAAS,eACvB,MAAM,OAAO,SAAW,SAAS,MAElC,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;EAE3E,MAAM,OAAO,WAAW,QAAQ;EAChC,IAAI,aAAa;EACjB,WAAW,MAAM,SAAS,KAAK,iBAAiB;GAC9C,WAAW;GACX,eAAe;EACjB,CAAC,GAAG;GACF,QAAQ,eAAe;GACvB,cAAc,MAAM;GACpB,IAAI,aAAa,SAAS,YACxB,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;GAC3E,KAAK,OAAO,KAAK;GACjB,MAAM;EACR;EACA,IAAI,eAAe,SAAS,cAAc,UAAU,KAAK,OAAO,KAAK,QAAQ,SAAS,QACpF,MAAM,IAAI,MAAM,0CAA0C,SAAS,MAAM;CAE7E,UAAU;EACR,MAAM,KAAK,MAAM;CACnB;AACF;AAEA,eAAe,cACb,SACA,MACA,QACA,QACe;CACf,MAAM,QAAQ,QAAQ,MACpB,mBAAmB,aAAa,KAAK,QAAQ,KAAK,MAAM,KAAK,UAAU,CACzE;CACA,MAAM,SAAS,SAAS,KAAK,MAAM,GAAG,OAA2C,EAAE,OAAO,CAAC;AAC7F;AAEA,eAAe,aACb,QACA,UACA,QACA;CACA,MAAM,OAAO,WAAW,QAAQ;CAChC,IAAI,aAAa;CACjB,WAAW,MAAM,SAAS,QAAQ;EAChC,IAAI,EAAE,iBAAiB,aACrB,MAAM,IAAI,MAAM,4CAA4C;EAC9D,QAAQ,eAAe;EACvB,cAAc,MAAM;EACpB,IAAI,aAAa,UACf,MAAM,IAAI,MAAM,qDAAqD;EACvE,KAAK,OAAO,KAAK;CACnB;CACA,OAAO;EAAE,QAAQ,UAAU,KAAK,OAAO,KAAK;EAAK;CAAW;AAC9D;AAEA,SAAS,iBACP,UACA,QACM;CACN,IAAI,SAAS,SAAS,sCACpB,MAAM,IAAI,MAAM,kDAAkD;CACpE,iCAAiC,SAAS,OAAO,MAAM;AACzD;AAEA,gBAAgB,SAAS,OAA+C;CACtE,MAAM;AACR;AACA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE"}