@theokit/sdk 4.63.4 → 5.0.0-next.2

package/dist/{executor-QSEC3MRH.js → executor-ZNDQDX6Q.js}

@@ -1,10 +1,12 @@
-import { WorkflowInputError, WorkflowStateError, getSnapshotStoreFor, WorkflowSnapshotNotFoundError, WorkflowResumeStepNotFoundError, WorkflowAlreadyRunningError, WorkflowOutputError, WorkflowMaxIterationsExceededError, WorkflowParallelError, WorkflowCompensateNotImplementedError } from './chunk-BZRFXJHA.js';
+import { WorkflowInputError, WorkflowStateError, getSnapshotStoreFor, WorkflowSnapshotNotFoundError, WorkflowResumeStepNotFoundError, WorkflowAlreadyRunningError, WorkflowOutputError, WorkflowMaxIterationsExceededError, WorkflowParallelError, WorkflowCompensateNotImplementedError } from './chunk-GBCVPKHE.js';
 import { getTracer, noopSpan } from './chunk-K2BQQ445.js';
-import { createSemaphore } from './chunk-4QZSA2HJ.js';
-import './chunk-2GUYQR5P.js';
-import { UnsupportedRunOperationError } from './chunk-ZZMZWBR6.js';
-import { redactSecrets } from './chunk-D4CUGAKZ.js';
-import { diag } from './chunk-XEQ3TM66.js';
+import './chunk-FD2UT76F.js';
+import './chunk-EH6XD3FY.js';
+import './chunk-UKMBRMGT.js';
+import { createSemaphore } from './chunk-G7BLGBRN.js';
+import './chunk-3JHIFQ4I.js';
+import { UnsupportedRunOperationError } from './chunk-ALUN2B4W.js';
+import { diag, redactSecrets } from './chunk-CZJ6Q7CW.js';
 
 // src/internal/workflow/ctx.ts
 var WorkflowSuspendedSentinel = class extends Error {
@@ -36,14 +38,9 @@ function makeStepContext(runId, signal, state) {
   };
 }
 function emit(level, runId, msg, attrs) {
-  const tag = `[workflow ${runId}]`;
-  if (attrs !== void 0) {
-    if (level === "warn") console.warn(tag, msg, attrs);
-    else console.log(tag, msg, attrs);
-  } else {
-    if (level === "warn") console.warn(tag, msg);
-    else console.log(tag, msg);
-  }
+  const suffix = attrs === void 0 ? "" : ` ${JSON.stringify(attrs)}`;
+  diag(redactSecrets(`[workflow ${runId}] ${level}: ${msg}${suffix}
+`));
 }
 function combineSignals(...signals) {
   const valid = signals.filter((s) => s !== void 0);
@@ -281,7 +278,7 @@ async function runAgentStep(step, input, ctx) {
 }
 
 // src/internal/workflow/step-branch.ts
-async function runBranchStep(step, input, ctx, options, prevStepResults, dispatch) {
+async function runBranchStep(step, input, exec) {
   const startedAt = Date.now();
   for (let i = 0; i < step.predicates.length; i += 1) {
     const pair = step.predicates[i];
@@ -299,7 +296,7 @@ async function runBranchStep(step, input, ctx, options, prevStepResults, dispatc
       );
     }
     if (matched) {
-      const r = await runInnerSequence(branch, input, ctx, options, prevStepResults, dispatch);
+      const r = await runInnerSequence(branch, input, exec);
       return {
         ...r,
         stepId: step.id,
@@ -309,7 +306,7 @@ async function runBranchStep(step, input, ctx, options, prevStepResults, dispatc
     }
   }
   if (step.fallback !== void 0) {
-    const r = await runInnerSequence(step.fallback, input, ctx, options, prevStepResults, dispatch);
+    const r = await runInnerSequence(step.fallback, input, exec);
     return {
       ...r,
       stepId: step.id,
@@ -326,11 +323,12 @@ async function runBranchStep(step, input, ctx, options, prevStepResults, dispatc
     output: input
   };
 }
-async function runInnerSequence(branch, input, ctx, options, prevStepResults, dispatch) {
+async function runInnerSequence(branch, input, exec) {
+  const { dispatch } = exec;
   let acc = input;
   let lastAttempts = 1;
   for (const inner of branch) {
-    const r = await dispatch(inner, acc, ctx, options, prevStepResults);
+    const r = await dispatch(inner, acc, exec);
     lastAttempts = r.attempts;
     if (r.status === "failed") {
       return {
@@ -355,7 +353,8 @@ async function runInnerSequence(branch, input, ctx, options, prevStepResults, di
 }
 
 // src/internal/workflow/step-dowhile.ts
-async function runDowhileStep(step, input, ctx, options, prevStepResults, dispatch) {
+async function runDowhileStep(step, input, exec) {
+  const { dispatch } = exec;
   const startedAt = Date.now();
   const maxIter = step.maxIterations ?? 100;
   let acc = input;
@@ -371,7 +370,7 @@ async function runDowhileStep(step, input, ctx, options, prevStepResults, dispat
         error: errToShape(new WorkflowMaxIterationsExceededError(step.id, maxIter))
       };
     }
-    const r = await dispatch(step.step, acc, ctx, options, prevStepResults);
+    const r = await dispatch(step.step, acc, exec);
     if (r.status === "failed") {
       return {
         stepId: step.id,
@@ -467,7 +466,8 @@ async function runFnStep(step, input, ctx) {
 }
 
 // src/internal/workflow/step-foreach.ts
-async function runForeachStep(step, _input, ctx, options, prevStepResults, dispatch) {
+async function runForeachStep(step, _input, exec) {
+  const { prevStepResults, dispatch } = exec;
   const startedAt = Date.now();
   const sourceResult = prevStepResults.find((r) => r.stepId === step.iterableFrom);
   if (sourceResult === void 0) {
@@ -517,7 +517,7 @@ async function runForeachStep(step, _input, ctx, options, prevStepResults, dispa
     items.map(async (item, idx) => {
       const release = await sem.acquire();
       try {
-        const r = await dispatch(step.step, item, ctx, options, prevStepResults);
+        const r = await dispatch(step.step, item, exec);
         if (r.status === "failed") {
           failures.push(new Error(`foreach item ${idx} failed: ${r.error?.message ?? "unknown"}`));
         } else {
@@ -551,7 +551,8 @@ async function runForeachStep(step, _input, ctx, options, prevStepResults, dispa
 }
 
 // src/internal/workflow/step-parallel.ts
-async function runParallelStep(step, input, ctx, options, _prevStepResults, dispatch) {
+async function runParallelStep(step, input, exec) {
+  const { ctx } = exec;
   const startedAt = Date.now();
   const policy = step.errorPolicy ?? "fail-fast";
   const branchCount = step.branches.length;
@@ -575,9 +576,7 @@ async function runParallelStep(step, input, ctx, options, _prevStepResults, disp
       return await runBranch(
         branch,
         input,
-        { ...ctx, signal: branchSignal },
-        options,
-        dispatch,
+        { ...exec, ctx: { ...ctx, signal: branchSignal }, prevStepResults: [] },
         branchIdx
       );
     } finally {
@@ -623,10 +622,11 @@ async function runParallelStep(step, input, ctx, options, _prevStepResults, disp
     output: outputs
   };
 }
-async function runBranch(branch, input, ctx, options, dispatch, branchIdx) {
+async function runBranch(branch, input, exec, branchIdx) {
+  const { dispatch } = exec;
   let acc = input;
   for (const inner of branch) {
-    const r = await dispatch(inner, acc, ctx, options, []);
+    const r = await dispatch(inner, acc, exec);
     if (r.status === "failed") {
       throw new Error(
         `parallel branch ${branchIdx} step "${inner.id}" failed: ${r.error?.message ?? "unknown"}`
@@ -757,7 +757,12 @@ async function runOneStep(args) {
   });
   let result;
   try {
-    result = await dispatchStep(args.step, args.acc, args.ctx, args.options, args.stepResults);
+    result = await dispatchStep(args.step, args.acc, {
+      ctx: args.ctx,
+      options: args.options,
+      prevStepResults: args.stepResults,
+      dispatch: dispatchStep
+    });
   } catch (err) {
     if (err instanceof WorkflowSuspendedSentinel) {
       const outcome = await handleSuspend(err, { ...args, stepSpan, stepCtx: args.ctx });
@@ -904,20 +909,21 @@ async function executeWorkflow(options, steps, input, runOpts) {
     flight.release();
   }
 }
-async function dispatchStep(step, input, ctx, options, prevStepResults) {
+async function dispatchStep(step, input, exec) {
+  const { ctx } = exec;
   switch (step.kind) {
     case "fn":
       return runFnStep(step, input, ctx);
     case "agent":
       return runAgentStep(step, input, ctx);
     case "parallel":
-      return runParallelStep(step, input, ctx, options, prevStepResults, dispatchStep);
+      return runParallelStep(step, input, exec);
     case "branch":
-      return runBranchStep(step, input, ctx, options, prevStepResults, dispatchStep);
+      return runBranchStep(step, input, exec);
     case "foreach":
-      return runForeachStep(step, input, ctx, options, prevStepResults, dispatchStep);
+      return runForeachStep(step, input, exec);
     case "dowhile":
-      return runDowhileStep(step, input, ctx, options, prevStepResults, dispatchStep);
+      return runDowhileStep(step, input, exec);
     case "sleep":
       return runSleepStep(step, input, ctx);
     case "suspend":
@@ -979,5 +985,5 @@ async function resumeWorkflow(opts) {
 }
 
 export { dispatchStep, executeWorkflow, resumeWorkflow };
-//# sourceMappingURL=executor-QSEC3MRH.js.map
-//# sourceMappingURL=executor-QSEC3MRH.js.map
+//# sourceMappingURL=executor-ZNDQDX6Q.js.map
+//# sourceMappingURL=executor-ZNDQDX6Q.js.map

package/dist/executor-ZNDQDX6Q.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/internal/workflow/ctx.ts","../src/internal/workflow/error-shape.ts","../src/internal/workflow/executor-helpers.ts","../src/internal/workflow/run-id.ts","../src/internal/workflow/single-flight.ts","../src/internal/workflow/retry-policy.ts","../src/internal/workflow/step-agent.ts","../src/internal/workflow/step-branch.ts","../src/internal/workflow/step-dowhile.ts","../src/internal/workflow/step-fn.ts","../src/internal/workflow/step-foreach.ts","../src/internal/workflow/step-parallel.ts","../src/internal/workflow/step-sleep.ts","../src/internal/workflow/telemetry.ts","../src/internal/workflow/executor.ts"],"names":["outputs","settled"],"mappings":";;;;;;;;;;;AAaO,IAAM,yBAAA,GAAN,cAAwC,KAAA,CAAM;AAAA,EAEnD,YAA4B,OAAA,EAAmB;AAC7C,IAAA,KAAA,CAAM,wBAAwB,CAAA;AADJ,IAAA,IAAA,CAAA,OAAA,GAAA,OAAA;AAAA,EAE5B;AAAA,EAF4B,OAAA;AAAA,EADV,IAAA,GAAO,2BAAA;AAI3B,CAAA;AAQO,SAAS,eAAA,CACd,KAAA,EACA,MAAA,EACA,KAAA,EACa;AACb,EAAA,OAAO;AAAA,IACL,KAAA;AAAA,IACA,MAAA;AAAA,IACA,GAAA,EAAK;AAAA,MACH,KAAA,EAAO,CAAC,GAAA,EAAK,KAAA,KAAU,KAAK,OAAA,EAAS,KAAA,EAAO,KAAK,KAAK,CAAA;AAAA,MACtD,IAAA,EAAM,CAAC,GAAA,EAAK,KAAA,KAAU,KAAK,MAAA,EAAQ,KAAA,EAAO,KAAK,KAAK,CAAA;AAAA,MACpD,IAAA,EAAM,CAAC,GAAA,EAAK,KAAA,KAAU,KAAK,MAAA,EAAQ,KAAA,EAAO,KAAK,KAAK;AAAA,KACtD;AAAA,IACA,OAAA,EAAS,OAAO,OAAA,KAAsB;AACpC,MAAA,MAAM,IAAI,0BAA0B,OAAO,CAAA;AAAA,IAC7C,CAAA;AAAA;AAAA;AAAA,IAGA,IAAI,KAAA,GAAiB;AACnB,MAAA,OAAO,MAAM,QAAA,EAAS;AAAA,IACxB,CAAA;AAAA,IACA,QAAA,EAAU,CAAC,IAAA,KAAwB,KAAA,CAAM,SAAS,IAAI;AAAA,GACxD;AACF;AAmBA,SAAS,IAAA,CACP,KAAA,EACA,KAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAM,MAAA,GAAS,UAAU,MAAA,GAAY,EAAA,GAAK,IAAI,IAAA,CAAK,SAAA,CAAU,KAAK,CAAC,CAAA,CAAA;AACnE,EAAA,IAAA,CAAK,aAAA,CAAc,aAAa,KAAK,CAAA,EAAA,EAAK,KAAK,CAAA,EAAA,EAAK,GAAG,GAAG,MAAM;AAAA,CAAI,CAAC,CAAA;AACvE;AAMO,SAAS,kBAAkB,OAAA,EAA8D;AAC9F,EAAA,MAAM,QAAQ,OAAA,CAAQ,MAAA,CAAO,CAAC,CAAA,KAAwB,MAAM,MAAS,CAAA;AACrE,EAAA,IAAI,MAAM,MAAA,KAAW,CAAA,EAAG,OAAO,IAAI,iBAAgB,CAAE,MAAA;AACrD,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,CAAA,EAAG,OAAO,MAAM,CAAC,CAAA;AACtC,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,EAAE,OAAA,EAAS;AACb,MAAA,IAAA,CAAK,KAAA,CAAM,EAAE,MAAM,CAAA;AACnB,MAAA;AAAA,IACF;AACA,IAAA,CAAA,CAAE,gBAAA,CAAiB,OAAA,EAAS,MAAM,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,MAAM,CAAA,EAAG,EAAE,IAAA,EAAM,IAAA,EAAM,CAAA;AAAA,EACxE;AACA,EAAA,OAAO,IAAA,CAAK,MAAA;AACd;;;ACxFO,SAAS,WAAW,GAAA,EAAiD;AAC1E,EAAA,IAAI,eAAe,KAAA,EAAO;AACxB,IAAA,OAAO,EAAE,IAAA,EAAM,GAAA,CAAI,IAAA,EAAM,OAAA,EAAS,IAAI,OAAA,EAAQ;AAAA,EAChD;AACA,EAAA,OAAO,EAAE,IAAA,EAAM,OAAA,EAAS,OAAA,EAAS,MAAA,CAAO,GAAG,CAAA,EAAE;AAC/C;;;ACWO,SAAS,YAAgB,MAAA,EAA6C;AAC3E,EAAA,OAAO;AAAA,IACL,IAAI,MAAA,CAAO,KAAA;AAAA,IACX,MAAM,MAAA,CAAO,IAAA;AAAA,IACb,QAAQ,MAAA,CAAO,MAAA;AAAA,IACf,WAAW,MAAA,CAAO,SAAA;AAAA,IAClB,OAAA,EAAS,KAAK,GAAA,EAAI;AAAA,IAClB,aAAa,MAAA,CAAO,WAAA;AAAA,IACpB,GAAI,OAAO,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,MAAA,CAAO,MAAA,EAAO,GAAI,EAAC;AAAA,IAC/D,GAAI,OAAO,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAM,GAAI;AAAC,GAC9D;AACF;AAEO,SAAS,QAAA,CACd,IAAA,EACA,KAAA,EACA,SAAA,EACA,aACA,MAAA,EACgB;AAChB,EAAA,OAAO,WAAA,CAAe;AAAA,IACpB,KAAA;AAAA,IACA,IAAA;AAAA,IACA,MAAA,EAAQ,WAAA;AAAA,IACR,WAAA;AAAA,IACA,SAAA;AAAA,IACA,KAAA,EAAO,EAAE,IAAA,EAAM,YAAA,EAAc,SAAS,MAAA,CAAO,MAAA,CAAO,MAAA,IAAU,SAAS,CAAA;AAAE,GAC1E,CAAA;AACH;AAMO,SAAS,sBAAA,CACd,QACA,KAAA,EACoB;AACpB,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAA,CAAO,UAAU,KAAK,CAAA;AAAA,EACjC,CAAA,CAAA,MAAQ;AAIN,IAAA,OAAO,gHAAA;AAAA,EACT;AACA,EAAA,IAAI,MAAA,CAAO,SAAS,OAAO,MAAA;AAC3B,EAAA,OAAO,OAAO,KAAA,CAAM,MAAA,CACjB,IAAI,CAAC,KAAA,KAAU,GAAG,KAAA,CAAM,IAAA,CAAK,KAAK,GAAG,CAAA,IAAK,QAAQ,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA,CACtE,KAAK,IAAI,CAAA;AACd;AAGO,SAAS,mBAAA,CAAoB,SAA0B,OAAA,EAAmC;AAC/F,EAAA,IAAI,OAAA,GAAU,OAAA;AACd,EAAA,OAAO;AAAA,IACL,UAAU,MAAM,OAAA;AAAA,IAChB,QAAA,EAAU,CAAC,IAAA,KAAkB;AAC3B,MAAA,MAAM,MAAA,GAAS,sBAAA,CAAuB,OAAA,CAAQ,WAAA,EAAa,IAAI,CAAA;AAC/D,MAAA,IAAI,WAAW,MAAA,EAAW,MAAM,IAAI,kBAAA,CAAmB,OAAA,CAAQ,MAAM,MAAM,CAAA;AAC3E,MAAA,OAAA,GAAU,IAAA;AAAA,IACZ;AAAA,GACF;AACF;;;AC/EO,SAAS,SAAA,GAAoB;AAClC,EAAA,OAAO,CAAA,IAAA,EAAO,UAAA,CAAW,MAAA,CAAO,UAAA,EAAW,CAAE,OAAA,CAAQ,IAAA,EAAM,EAAE,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,CAAC,CAAC,CAAA,CAAA;AAC5E;;;ACSA,IAAM,QAAA,uBAAe,GAAA,EAAoB;AAEzC,SAAS,GAAA,CAAI,YAAoB,KAAA,EAAuB;AACtD,EAAA,OAAO,CAAA,EAAG,UAAU,CAAA,CAAA,EAAI,KAAK,CAAA,CAAA;AAC/B;AAOO,SAAS,mBAAA,CACd,UAAA,EACA,KAAA,EACA,YAAA,EACgB;AAChB,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,UAAA,EAAY,KAAK,CAAA;AAC/B,EAAA,IAAI,QAAA,CAAS,GAAA,CAAI,CAAC,CAAA,EAAG;AACnB,IAAA,MAAM,IAAI,2BAAA,CAA4B,YAAA,EAAc,KAAK,CAAA;AAAA,EAC3D;AACA,EAAA,MAAM,UAAA,GAAa,IAAI,eAAA,EAAgB;AACvC,EAAA,QAAA,CAAS,GAAA,CAAI,CAAA,EAAG,EAAE,UAAA,EAAY,CAAA;AAC9B,EAAA,OAAO;AAAA,IACL,QAAQ,UAAA,CAAW,MAAA;AAAA,IACnB,SAAS,MAAM;AACb,MAAA,QAAA,CAAS,OAAO,CAAC,CAAA;AAAA,IACnB;AAAA,GACF;AACF;;;ACpCA,IAAM,qBAAA,GAAwB,CAAC,YAAA,EAAc,+BAAA,EAAiC,oBAAoB,CAAA;AAUlG,SAAS,wBAAwB,MAAA,EAAoC;AACnE,EAAA,OAAO;AAAA,IACL,KAAK,MAAA,CAAO,WAAA;AAAA,IACZ,IAAA,EAAM,OAAO,gBAAA,IAAoB,GAAA;AAAA,IACjC,IAAA,EAAM,OAAO,kBAAA,IAAsB,CAAA;AAAA,IACnC,GAAA,EAAK,OAAO,gBAAA,IAAoB,GAAA;AAAA,IAChC,YAAA,EAAc,IAAI,GAAA,CAAI,MAAA,CAAO,sBAAsB,qBAAqB;AAAA,GAC1E;AACF;AAEA,SAAS,eAAe,MAAA,EAA2B;AACjD,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,MAAM,IAAI,YAAA,CAAa,MAAA,CAAO,OAAO,MAAA,IAAU,SAAS,GAAG,YAAY,CAAA;AAAA,EACzE;AACF;AAEA,SAAS,aAAA,CAAc,GAAA,EAAc,OAAA,EAAiB,GAAA,EAA6B;AACjF,EAAA,MAAM,OAAA,GAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,IAAA,GAAO,OAAA;AAClD,EAAA,OAAO,IAAI,YAAA,CAAa,GAAA,CAAI,OAAO,CAAA,IAAK,YAAY,GAAA,CAAI,GAAA;AAC1D;AAEA,eAAe,OAAA,CACb,EAAA,EACA,OAAA,EACA,GAAA,EACA,MAAA,EAC6D;AAC7D,EAAA,IAAI;AACF,IAAA,MAAM,KAAA,GAAQ,MAAM,EAAA,EAAG;AACvB,IAAA,OAAO,EAAE,KAAA,EAAO,QAAA,EAAU,OAAA,EAAQ;AAAA,EACpC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,aAAA,CAAc,GAAA,EAAK,OAAA,EAAS,GAAG,GAAG,MAAM,GAAA;AAC5C,IAAA,MAAM,cAAA,CAAe,IAAA,CAAK,GAAA,CAAI,GAAA,CAAI,IAAA,GAAO,GAAA,CAAI,IAAA,KAAS,OAAA,GAAU,CAAA,CAAA,EAAI,GAAA,CAAI,GAAG,CAAA,EAAG,MAAM,CAAA;AACpF,IAAA,OAAO,EAAE,MAAM,OAAA,EAAQ;AAAA,EACzB;AACF;AAEA,eAAsB,SAAA,CACpB,EAAA,EACA,MAAA,EACA,MAAA,EACyC;AACzC,EAAA,MAAM,GAAA,GAAM,wBAAwB,MAAM,CAAA;AAC1C,EAAA,KAAA,IAAS,UAAU,CAAA,EAAG,OAAA,IAAW,GAAA,CAAI,GAAA,EAAK,WAAW,CAAA,EAAG;AACtD,IAAA,cAAA,CAAe,MAAM,CAAA;AACrB,IAAA,MAAM,SAAS,MAAM,OAAA,CAAQ,EAAA,EAAI,OAAA,EAAS,KAAK,MAAM,CAAA;AACrD,IAAA,IAAI,OAAA,IAAW,QAAQ,OAAO,MAAA;AAAA,EAChC;AAEA,EAAA,MAAM,IAAI,MAAM,gDAAgD,CAAA;AAClE;AAEA,eAAsB,cAAA,CAAe,IAAY,MAAA,EAAoC;AACnF,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,MAAM,IAAI,YAAA,CAAa,MAAA,CAAO,OAAO,MAAA,IAAU,SAAS,GAAG,YAAY,CAAA;AAAA,EACzE;AACA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAAC,OAAA,EAAS,MAAA,KAAW;AACtC,IAAA,MAAM,KAAA,GAAQ,WAAW,MAAM;AAC7B,MAAA,OAAA,EAAQ;AACR,MAAA,OAAA,EAAQ;AAAA,IACV,GAAG,EAAE,CAAA;AACL,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,OAAA,EAAQ;AACR,MAAA,MAAA,CAAO,IAAI,aAAa,MAAA,CAAO,MAAA,CAAO,UAAU,SAAS,CAAA,EAAG,YAAY,CAAC,CAAA;AAAA,IAC3E,CAAA;AACA,IAAA,MAAM,UAAU,MAAY;AAC1B,MAAA,MAAA,CAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC7C,CAAA;AACA,IAAA,MAAA,CAAO,iBAAiB,OAAA,EAAS,OAAA,EAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC1D,CAAC,CAAA;AACH;;;AC5EA,eAAsB,YAAA,CACpB,IAAA,EACA,KAAA,EACA,GAAA,EACqB;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAE3B,EAAA,MAAM,OAAA,GAAU,KAAK,KAAA,CAAM,OAAA;AAC3B,EAAA,IAAI,OAAO,OAAA,KAAY,QAAA,IAAY,OAAA,CAAQ,UAAA,CAAW,KAAK,CAAA,EAAG;AAC5D,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,UAAA;AAAA,QACL,IAAI,4BAAA;AAAA,UACF,CAAA,oEAAA,EACa,OAAO,CAAA,SAAA,EAAY,IAAA,CAAK,EAAE,CAAA,CAAA,CAAA;AAAA,UACvC;AAAA;AACF;AACF,KACF;AAAA,EACF;AAEA,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GACE,OAAO,KAAK,cAAA,KAAmB,QAAA,GAAW,KAAK,cAAA,GAAiB,IAAA,CAAK,eAAe,KAAK,CAAA;AAAA,EAC7F,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,WAAW,GAAG;AAAA,KACvB;AAAA,EACF;AACA,EAAA,IAAI,OAAO,MAAA,KAAW,QAAA,IAAY,MAAA,CAAO,WAAW,CAAA,EAAG;AACrD,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,UAAA;AAAA,QACL,IAAI,KAAA,CAAM,CAAA,WAAA,EAAc,IAAA,CAAK,EAAE,CAAA,6CAAA,CAA+C;AAAA;AAChF,KACF;AAAA,EACF;AAEA,EAAA,MAAM,OAAO,YAA6B;AAExC,IAAA,MAAM,GAAA,GAAM,MAAM,IAAA,CAAK,KAAA,CAAM,IAAA;AAAA,MAC3B,MAAA;AAAA,MACA,KAAK,MAAA,KAAW,MAAA,GAAY,EAAE,MAAA,EAAQ,IAAA,CAAK,QAAO,GAAI;AAAA,KACxD;AACA,IAAA,MAAM,MAAA,GAAS,MAAM,GAAA,CAAI,IAAA,EAAK;AAC9B,IAAA,IAAI,MAAA,CAAO,WAAW,UAAA,EAAY;AAChC,MAAA,OAAO,OAAO,MAAA,IAAU,EAAA;AAAA,IAC1B;AACA,IAAA,IAAI,MAAA,CAAO,WAAW,OAAA,EAAS;AAC7B,MAAA,MAAO,MAAA,CAA6B,KAAA,IAAS,IAAI,KAAA,CAAM,oBAAoB,CAAA;AAAA,IAC7E;AACA,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yBAAA,EAA4B,MAAA,CAAO,MAAM,CAAA,CAAE,CAAA;AAAA,EAC7D,CAAA;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,QAAA,EAAS,GACtB,KAAK,KAAA,KAAU,KAAA,CAAA,GACX,MAAM,SAAA,CAAU,IAAA,EAAM,KAAK,KAAA,EAAO,GAAA,CAAI,MAAM,CAAA,GAC5C,EAAE,OAAO,MAAM,IAAA,EAAK,EAAG,QAAA,EAAU,CAAA,EAAE;AACzC,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ,WAAA;AAAA,MACR,QAAA;AAAA,MACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,MAAA,EAAQ;AAAA,KACV;AAAA,EACF,SAAS,GAAA,EAAK;AAEZ,IAAA,IAAI,GAAA,YAAe,2BAA2B,MAAM,GAAA;AACpD,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,WAAW,GAAG;AAAA,KACvB;AAAA,EACF;AACF;;;AC/FA,eAAsB,aAAA,CACpB,IAAA,EACA,KAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAE3B,EAAA,KAAA,IAAS,IAAI,CAAA,EAAG,CAAA,GAAI,KAAK,UAAA,CAAW,MAAA,EAAQ,KAAK,CAAA,EAAG;AAClD,IAAA,MAAM,IAAA,GAAO,IAAA,CAAK,UAAA,CAAW,CAAC,CAAA;AAC9B,IAAA,MAAM,CAAC,SAAA,EAAW,MAAM,CAAA,GAAI,IAAA;AAE5B,IAAA,IAAI,OAAA,GAAU,KAAA;AACd,IAAA,IAAI;AACF,MAAA,OAAA,GAAU,MAAM,OAAA,CAAQ,OAAA,CAAQ,SAAA,CAAU,KAAK,CAAC,CAAA;AAAA,IAClD,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,UAAU,GAAA,YAAe,KAAA,GAAQ,GAAA,CAAI,OAAA,GAAU,OAAO,GAAG,CAAA;AAG/D,MAAA,IAAA;AAAA,QACE,aAAA;AAAA,UACE,sBAAsB,IAAA,CAAK,EAAE,CAAA,YAAA,EAAe,CAAC,iCAAiC,OAAO;AAAA;AAAA;AACvF,OACF;AAAA,IACF;AACA,IAAA,IAAI,OAAA,EAAS;AACX,MAAA,MAAM,CAAA,GAAI,MAAM,gBAAA,CAAiB,MAAA,EAAQ,OAAO,IAAI,CAAA;AACpD,MAAA,OAAO;AAAA,QACL,GAAG,CAAA;AAAA,QACH,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,IAAA,EAAM,QAAA;AAAA,QACN,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,OAC3B;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,IAAA,CAAK,aAAa,MAAA,EAAW;AAC/B,IAAA,MAAM,IAAI,MAAM,gBAAA,CAAiB,IAAA,CAAK,QAAA,EAAU,OAAO,IAAI,CAAA;AAC3D,IAAA,OAAO;AAAA,MACL,GAAG,CAAA;AAAA,MACH,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,QAAA;AAAA,MACN,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI;AAAA,KAC3B;AAAA,EACF;AAGA,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,EAAA;AAAA,IACb,IAAA,EAAM,QAAA;AAAA,IACN,MAAA,EAAQ,SAAA;AAAA,IACR,QAAA,EAAU,CAAA;AAAA,IACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,IACzB,MAAA,EAAQ;AAAA,GACV;AACF;AAEA,eAAe,gBAAA,CACb,MAAA,EACA,KAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,EAAE,UAAS,GAAI,IAAA;AACrB,EAAA,IAAI,GAAA,GAAe,KAAA;AACnB,EAAA,IAAI,YAAA,GAAe,CAAA;AACnB,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,KAAA,EAAO,KAAK,IAAI,CAAA;AACzC,IAAA,YAAA,GAAe,CAAA,CAAE,QAAA;AACjB,IAAA,IAAI,CAAA,CAAE,WAAW,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,QAAQ,KAAA,CAAM,EAAA;AAAA,QACd,IAAA,EAAM,QAAA;AAAA,QACN,MAAA,EAAQ,QAAA;AAAA,QACR,UAAU,CAAA,CAAE,QAAA;AAAA,QACZ,UAAA,EAAY,CAAA;AAAA,QACZ,OAAO,CAAA,CAAE,KAAA,IAAS,WAAW,IAAI,KAAA,CAAM,0BAA0B,CAAC;AAAA,OACpE;AAAA,IACF;AACA,IAAA,GAAA,GAAM,CAAA,CAAE,MAAA;AAAA,EACV;AACA,EAAA,OAAO;AAAA,IACL,MAAA,EAAQ,sBAAA;AAAA,IACR,IAAA,EAAM,QAAA;AAAA,IACN,MAAA,EAAQ,WAAA;AAAA,IACR,QAAA,EAAU,YAAA;AAAA,IACV,UAAA,EAAY,CAAA;AAAA,IACZ,MAAA,EAAQ;AAAA,GACV;AACF;;;AC1FA,eAAsB,cAAA,CACpB,IAAA,EACA,KAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,EAAE,UAAS,GAAI,IAAA;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,EAAA,MAAM,OAAA,GAAU,KAAK,aAAA,IAAiB,GAAA;AACtC,EAAA,IAAI,GAAA,GAAM,KAAA;AACV,EAAA,IAAI,CAAA,GAAI,CAAA;AACR,EAAA,OAAO,IAAA,EAAM;AACX,IAAA,IAAI,KAAK,OAAA,EAAS;AAChB,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,IAAA,EAAM,SAAA;AAAA,QACN,MAAA,EAAQ,QAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,QACzB,OAAO,UAAA,CAAW,IAAI,mCAAmC,IAAA,CAAK,EAAA,EAAI,OAAO,CAAC;AAAA,OAC5E;AAAA,IACF;AACA,IAAA,MAAM,IAAI,MAAM,QAAA,CAAS,IAAA,CAAK,IAAA,EAAM,KAAK,IAAI,CAAA;AAC7C,IAAA,IAAI,CAAA,CAAE,WAAW,QAAA,EAAU;AACzB,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,IAAA,EAAM,SAAA;AAAA,QACN,MAAA,EAAQ,QAAA;AAAA,QACR,UAAU,CAAA,GAAI,CAAA;AAAA,QACd,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,QACzB,OAAO,CAAA,CAAE;AAAA,OACX;AAAA,IACF;AACA,IAAA,GAAA,GAAM,CAAA,CAAE,MAAA;AACR,IAAA,CAAA,IAAK,CAAA;AACL,IAAA,IAAI,cAAA,GAAiB,KAAA;AACrB,IAAA,IAAI;AACF,MAAA,cAAA,GAAiB,MAAM,OAAA,CAAQ,OAAA,CAAQ,KAAK,MAAA,CAAO,GAAA,EAAK,CAAC,CAAC,CAAA;AAAA,IAC5D,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,IAAA,EAAM,SAAA;AAAA,QACN,MAAA,EAAQ,QAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,QACzB,KAAA,EAAO,WAAW,GAAG;AAAA,OACvB;AAAA,IACF;AACA,IAAA,IAAI,CAAC,cAAA,EAAgB;AAAA,EACvB;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,EAAA;AAAA,IACb,IAAA,EAAM,SAAA;AAAA,IACN,MAAA,EAAQ,WAAA;AAAA,IACR,QAAA,EAAU,CAAA;AAAA,IACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,IACzB,MAAA,EAAQ;AAAA,GACV;AACF;;;ACrDA,SAAS,cAAA,CACP,MAAA,EACA,QAAA,EACA,SAAA,EACA,GAAA,EACY;AACZ,EAAA,OAAO;AAAA,IACL,MAAA;AAAA,IACA,IAAA,EAAM,IAAA;AAAA,IACN,MAAA,EAAQ,QAAA;AAAA,IACR,QAAA;AAAA,IACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,IACzB,KAAA,EAAO,WAAW,GAAG;AAAA,GACvB;AACF;AAEA,SAAS,QAAA,CAAS,QAAwD,KAAA,EAAyB;AACjG,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,MAAA,CAAO,MAAM,KAAK,CAAA;AAClB,EAAA,OAAO,MAAA;AACT;AAEA,eAAe,aAAA,CACb,IAAA,EACA,KAAA,EACA,GAAA,EAC+C;AAC/C,EAAA,MAAM,IAAA,GAAO,YAA8B,IAAA,CAAK,EAAA,CAAG,OAAO,GAAG,CAAA;AAC7D,EAAA,IAAI,IAAA,CAAK,UAAU,MAAA,EAAW,OAAO,UAAU,IAAA,EAAM,IAAA,CAAK,KAAA,EAAO,GAAA,CAAI,MAAM,CAAA;AAC3E,EAAA,OAAO,EAAE,KAAA,EAAO,MAAM,IAAA,EAAK,EAAG,UAAU,CAAA,EAAE;AAC5C;AAEA,eAAsB,SAAA,CACpB,IAAA,EACA,KAAA,EACA,GAAA,EACqB;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAE3B,EAAA,IAAI,IAAA,CAAK,eAAe,MAAA,EAAW;AACjC,IAAA,OAAO,cAAA;AAAA,MACL,IAAA,CAAK,EAAA;AAAA,MACL,CAAA;AAAA,MACA,SAAA;AAAA,MACA,IAAI,qCAAA,CAAsC,IAAA,CAAK,EAAE;AAAA,KACnD;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,QAAA,CAAS,IAAA,CAAK,aAAa,KAAK,CAAA;AAAA,EAClC,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,EAAA,EAAI,CAAA,EAAG,WAAW,GAAG,CAAA;AAAA,EAClD;AAEA,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAO,QAAA,EAAS,GAAI,MAAM,aAAA,CAAc,IAAA,EAAM,OAAO,GAAG,CAAA;AAChE,IAAA,IAAI;AACF,MAAA,QAAA,CAAS,IAAA,CAAK,cAAc,KAAK,CAAA;AAAA,IACnC,SAAS,GAAA,EAAK;AACZ,MAAA,OAAO,cAAA,CAAe,IAAA,CAAK,EAAA,EAAI,QAAA,EAAU,WAAW,GAAG,CAAA;AAAA,IACzD;AACA,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,IAAA;AAAA,MACN,MAAA,EAAQ,WAAA;AAAA,MACR,QAAA;AAAA,MACA,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,MAAA,EAAQ;AAAA,KACV;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,2BAA2B,MAAM,GAAA;AACpD,IAAA,OAAO,cAAA,CAAe,IAAA,CAAK,EAAA,EAAI,CAAA,EAAG,WAAW,GAAG,CAAA;AAAA,EAClD;AACF;;;ACzEA,eAAsB,cAAA,CACpB,IAAA,EACA,MAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,EAAE,eAAA,EAAiB,QAAA,EAAS,GAAI,IAAA;AACtC,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAG3B,EAAA,MAAM,YAAA,GAAe,gBAAgB,IAAA,CAAK,CAAC,MAAM,CAAA,CAAE,MAAA,KAAW,KAAK,YAAY,CAAA;AAC/E,EAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,SAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,UAAA;AAAA,QACL,IAAI,KAAA;AAAA,UACF,CAAA,sBAAA,EAAyB,KAAK,YAAY,CAAA,iKAAA;AAAA;AAG5C;AACF,KACF;AAAA,EACF;AAEA,EAAA,MAAM,QAAQ,YAAA,CAAa,MAAA;AAC3B,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAK,CAAA,EAAG;AACzB,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,SAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,UAAA;AAAA,QACL,IAAI,KAAA;AAAA,UACF,CAAA,sBAAA,EAAyB,IAAA,CAAK,YAAY,CAAA,4BAAA,EAA+B,OAAO,KAAK,CAAA,CAAA;AAAA;AACvF;AACF,KACF;AAAA,EACF;AAEA,EAAA,IAAI,KAAA,CAAM,WAAW,CAAA,EAAG;AACtB,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,SAAA;AAAA,MACN,MAAA,EAAQ,WAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,QAAQ;AAAC,KACX;AAAA,EACF;AAEA,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,IAAe,CAAA;AACxC,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,GAAA,CAAI,WAAA,EAAa,KAAA,CAAM,MAAM,CAAC,CAAC,CAAA;AAC5E,EAAA,MAAM,WAAoB,EAAC;AAC3B,EAAA,MAAM,OAAA,GAAqB,IAAI,KAAA,CAAM,KAAA,CAAM,MAAM,CAAA;AAEjD,EAAA,MAAM,OAAA,CAAQ,GAAA;AAAA,IACZ,KAAA,CAAM,GAAA,CAAI,OAAO,IAAA,EAAM,GAAA,KAAQ;AAC7B,MAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,OAAA,EAAQ;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,QAAA,CAAS,IAAA,CAAK,IAAA,EAAM,MAAM,IAAI,CAAA;AAC9C,QAAA,IAAI,CAAA,CAAE,WAAW,QAAA,EAAU;AACzB,UAAA,QAAA,CAAS,IAAA,CAAK,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,GAAG,CAAA,SAAA,EAAY,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,SAAS,CAAA,CAAE,CAAC,CAAA;AAAA,QACzF,CAAA,MAAO;AACL,UAAA,OAAA,CAAQ,GAAG,IAAI,CAAA,CAAE,MAAA;AAAA,QACnB;AAAA,MACF,CAAA,SAAE;AACA,QAAA,OAAA,EAAQ;AAAA,MACV;AAAA,IACF,CAAC;AAAA,GACH;AAEA,EAAA,IAAI,QAAA,CAAS,SAAS,CAAA,EAAG;AACvB,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,SAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,UAAA;AAAA,QACL,IAAI,eAAe,QAAA,EAAU,CAAA,SAAA,EAAY,KAAK,EAAE,CAAA,MAAA,EAAS,QAAA,CAAS,MAAM,CAAA,WAAA,CAAa;AAAA;AACvF,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,EAAA;AAAA,IACb,IAAA,EAAM,SAAA;AAAA,IACN,MAAA,EAAQ,WAAA;AAAA,IACR,QAAA,EAAU,CAAA;AAAA,IACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,IACzB,MAAA,EAAQ;AAAA,GACV;AACF;;;ACzFA,eAAsB,eAAA,CACpB,IAAA,EACA,KAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAChB,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,EAAA,MAAM,MAAA,GAAS,KAAK,WAAA,IAAe,WAAA;AACnC,EAAA,MAAM,WAAA,GAAc,KAAK,QAAA,CAAS,MAAA;AAGlC,EAAA,IAAI,gBAAgB,CAAA,EAAG;AACrB,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,UAAA;AAAA,MACN,MAAA,EAAQ,WAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,QAAQ;AAAC,KACX;AAAA,EACF;AAEA,EAAA,MAAM,WAAA,GAAc,KAAK,WAAA,IAAe,WAAA;AACxC,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,IAAA,CAAK,GAAA,CAAI,CAAA,EAAG,KAAK,GAAA,CAAI,WAAA,EAAa,WAAW,CAAC,CAAC,CAAA;AAG3E,EAAA,MAAM,YAAA,GAAe,MAAA,KAAW,WAAA,GAAc,IAAI,iBAAgB,GAAI,MAAA;AACtE,EAAA,MAAM,YAAA,GACJ,WAAW,WAAA,GAAc,YAAA,CAAa,IAAI,MAAA,EAAQ,YAAA,CAAc,MAAM,CAAA,GAAI,GAAA,CAAI,MAAA;AAIhF,EAAA,MAAM,oBAAoB,IAAA,CAAK,QAAA,CAAS,GAAA,CAAI,OAAO,QAAQ,SAAA,KAAc;AACvE,IAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,OAAA,EAAQ;AAClC,IAAA,IAAI;AAGF,MAAA,OAAO,MAAM,SAAA;AAAA,QACX,MAAA;AAAA,QACA,KAAA;AAAA,QACA,EAAE,GAAG,IAAA,EAAM,GAAA,EAAK,EAAE,GAAG,GAAA,EAAK,MAAA,EAAQ,YAAA,EAAa,EAAG,eAAA,EAAiB,EAAC,EAAE;AAAA,QACtE;AAAA,OACF;AAAA,IACF,CAAA,SAAE;AACA,MAAA,OAAA,EAAQ;AAAA,IACV;AAAA,EACF,CAAC,CAAA;AAED,EAAA,IAAI,WAAW,WAAA,EAAa;AAC1B,IAAA,IAAI;AACF,MAAA,MAAMA,QAAAA,GAAU,MAAM,OAAA,CAAQ,GAAA,CAAI,iBAAiB,CAAA;AACnD,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,IAAA,EAAM,UAAA;AAAA,QACN,MAAA,EAAQ,WAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,QACzB,MAAA,EAAQA;AAAA,OACV;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,YAAA,EAAc,MAAM,GAAG,CAAA;AAEvB,MAAA,MAAMC,QAAAA,GAAU,MAAM,OAAA,CAAQ,UAAA,CAAW,iBAAiB,CAAA;AAC1D,MAAA,MAAM,MAAA,GAASA,SACZ,MAAA,CAAO,CAAC,MAAkC,CAAA,CAAE,MAAA,KAAW,UAAU,CAAA,CACjE,GAAA,CAAI,CAAC,MAAO,CAAA,CAAE,MAAA,YAAkB,KAAA,GAAQ,CAAA,CAAE,MAAA,GAAS,IAAI,MAAM,MAAA,CAAO,CAAA,CAAE,MAAM,CAAC,CAAE,CAAA;AAClF,MAAA,OAAO;AAAA,QACL,QAAQ,IAAA,CAAK,EAAA;AAAA,QACb,IAAA,EAAM,UAAA;AAAA,QACN,MAAA,EAAQ,QAAA;AAAA,QACR,QAAA,EAAU,CAAA;AAAA,QACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,QACzB,OAAO,UAAA,CAAW,IAAI,sBAAsB,MAAA,EAAQ,IAAA,CAAK,EAAE,CAAC,CAAA;AAAA,QAC5D,MAAA,EAAQ;AAAA,OACV;AAAA,IACF;AAAA,EACF;AAGA,EAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,UAAA,CAAW,iBAAiB,CAAA;AAC1D,EAAA,MAAM,UAAU,OAAA,CAAQ,GAAA;AAAA,IAAI,CAAC,CAAA,KAC3B,CAAA,CAAE,WAAW,WAAA,GACT,EAAE,IAAI,IAAA,EAAe,KAAA,EAAO,EAAE,KAAA,EAAM,GACpC,EAAE,EAAA,EAAI,KAAA,EAAgB,OAAO,UAAA,CAAW,CAAA,CAAE,MAAM,CAAA;AAAE,GACxD;AACA,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,EAAA;AAAA,IACb,IAAA,EAAM,UAAA;AAAA,IACN,MAAA,EAAQ,WAAA;AAAA,IACR,QAAA,EAAU,CAAA;AAAA,IACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,IACzB,MAAA,EAAQ;AAAA,GACV;AACF;AAEA,eAAe,SAAA,CACb,MAAA,EACA,KAAA,EACA,IAAA,EACA,SAAA,EACkB;AAClB,EAAA,MAAM,EAAE,UAAS,GAAI,IAAA;AACrB,EAAA,IAAI,GAAA,GAAe,KAAA;AACnB,EAAA,KAAA,MAAW,SAAS,MAAA,EAAQ;AAC1B,IAAA,MAAM,CAAA,GAAI,MAAM,QAAA,CAAS,KAAA,EAAO,KAAK,IAAI,CAAA;AACzC,IAAA,IAAI,CAAA,CAAE,WAAW,QAAA,EAAU;AACzB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,gBAAA,EAAmB,SAAS,CAAA,OAAA,EAAU,KAAA,CAAM,EAAE,CAAA,UAAA,EAAa,CAAA,CAAE,KAAA,EAAO,OAAA,IAAW,SAAS,CAAA;AAAA,OAC1F;AAAA,IACF;AACA,IAAA,GAAA,GAAM,CAAA,CAAE,MAAA;AAAA,EACV;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,YAAA,CAAa,GAAgB,CAAA,EAA6B;AACjE,EAAA,IAAI,CAAA,CAAE,SAAS,OAAO,CAAA;AACtB,EAAA,IAAI,CAAA,CAAE,SAAS,OAAO,CAAA;AACtB,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,EAAA,MAAM,QAAA,GAAW,MAAY,IAAA,CAAK,KAAA,CAAM,EAAE,MAAM,CAAA;AAChD,EAAA,MAAM,QAAA,GAAW,MAAY,IAAA,CAAK,KAAA,CAAM,EAAE,MAAM,CAAA;AAChD,EAAA,CAAA,CAAE,iBAAiB,OAAA,EAAS,QAAA,EAAU,EAAE,IAAA,EAAM,MAAM,CAAA;AACpD,EAAA,CAAA,CAAE,iBAAiB,OAAA,EAAS,QAAA,EAAU,EAAE,IAAA,EAAM,MAAM,CAAA;AACpD,EAAA,OAAO,IAAA,CAAK,MAAA;AACd;;;ACvIA,eAAsB,YAAA,CACpB,IAAA,EACA,KAAA,EACA,GAAA,EACqB;AACrB,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,EAAA,IAAI;AACF,IAAA,MAAM,cAAA,CAAe,IAAA,CAAK,UAAA,EAAY,GAAA,CAAI,MAAM,CAAA;AAChD,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ,WAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,MAAA,EAAQ;AAAA;AAAA,KACV;AAAA,EACF,SAAS,GAAA,EAAK;AACZ,IAAA,OAAO;AAAA,MACL,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,IAAA,EAAM,OAAA;AAAA,MACN,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA;AAAA,MACzB,KAAA,EAAO,WAAW,GAAG;AAAA,KACvB;AAAA,EACF;AACF;;;ACtBA,IAAM,WAAA,GAAc,uBAAA;AAEb,SAAS,qBAAqB,IAAA,EAAyD;AAC5F,EAAA,MAAM,MAAA,GAAS,UAAU,WAAW,CAAA;AACpC,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,QAAA;AACjC,EAAA,OAAO,MAAA,CAAO,UAAU,cAAA,EAAgB;AAAA,IACtC,UAAA,EAAY;AAAA,MACV,iBAAiB,IAAA,CAAK,YAAA;AAAA,MACtB,mBAAmB,IAAA,CAAK;AAAA;AAC1B,GACD,CAAA;AACH;AAEO,SAAS,sBAAsB,IAAA,EAIzB;AACX,EAAA,MAAM,MAAA,GAAS,UAAU,WAAW,CAAA;AACpC,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,QAAA;AACjC,EAAA,OAAO,MAAA,CAAO,SAAA,CAAU,CAAA,cAAA,EAAiB,IAAA,CAAK,MAAM,CAAA,CAAA,EAAI;AAAA,IACtD,UAAA,EAAY;AAAA,MACV,WAAW,IAAA,CAAK,MAAA;AAAA,MAChB,aAAa,IAAA,CAAK,IAAA;AAAA,MAClB,gBAAgB,IAAA,CAAK;AAAA;AACvB,GACD,CAAA;AACH;;;ACYA,eAAe,aAAA,CACb,KACA,GAAA,EAY4B;AAC5B,EAAA,IAAI;AACF,IAAA,MAAM,YAAA,CAAa;AAAA,MACjB,OAAO,GAAA,CAAI,KAAA;AAAA,MACX,YAAA,EAAc,IAAI,OAAA,CAAQ,IAAA;AAAA,MAC1B,aAAA,EAAe,IAAI,IAAA,CAAK,EAAA;AAAA,MACxB,kBAAkB,GAAA,CAAI,OAAA;AAAA,MACtB,aAAa,GAAA,CAAI,WAAA;AAAA,MACjB,kBAAkB,GAAA,CAAI,GAAA;AAAA,MACtB,KAAA,EAAO,IAAI,OAAA,CAAQ,KAAA;AAAA;AAAA,MACnB,SAAS,GAAA,CAAI;AAAA,KACd,CAAA;AAAA,EACH,SAAS,OAAA,EAAS;AAChB,IAAA,GAAA,CAAI,QAAA,CAAS,YAAA,CAAa,aAAA,EAAe,QAAQ,CAAA;AACjD,IAAA,GAAA,CAAI,SAAS,GAAA,EAAI;AACjB,IAAA,OAAO;AAAA,MACL,IAAA,EAAM,QAAA;AAAA,MACN,KAAK,WAAA,CAAe;AAAA,QAClB,OAAO,GAAA,CAAI,KAAA;AAAA,QACX,MAAM,GAAA,CAAI,IAAA;AAAA,QACV,MAAA,EAAQ,QAAA;AAAA,QACR,aAAa,GAAA,CAAI,WAAA;AAAA,QACjB,WAAW,GAAA,CAAI,SAAA;AAAA,QACf,KAAA,EAAO,WAAW,OAAO;AAAA,OAC1B;AAAA,KACH;AAAA,EACF;AACA,EAAA,GAAA,CAAI,QAAA,CAAS,YAAA,CAAa,aAAA,EAAe,WAAW,CAAA;AACpD,EAAA,GAAA,CAAI,SAAS,GAAA,EAAI;AACjB,EAAA,OAAO;AAAA,IACL,IAAA,EAAM,WAAA;AAAA,IACN,KAAK,WAAA,CAAe;AAAA,MAClB,OAAO,GAAA,CAAI,KAAA;AAAA,MACX,MAAM,GAAA,CAAI,IAAA;AAAA,MACV,MAAA,EAAQ,WAAA;AAAA,MACR,WAAA,EAAa;AAAA,QACX,GAAG,GAAA,CAAI,WAAA;AAAA,QACP;AAAA,UACE,MAAA,EAAQ,IAAI,IAAA,CAAK,EAAA;AAAA,UACjB,IAAA,EAAM,IAAI,IAAA,CAAK,IAAA;AAAA,UACf,MAAA,EAAQ,WAAA;AAAA,UACR,QAAA,EAAU,CAAA;AAAA,UACV,UAAA,EAAY,CAAA;AAAA,UACZ,MAAA,EAAQ;AAAA;AACV,OACF;AAAA,MACA,WAAW,GAAA,CAAI;AAAA,KAChB;AAAA,GACH;AACF;AAEA,eAAe,WAAc,IAAA,EAS+D;AAC1F,EAAA,MAAM,WAAW,qBAAA,CAAsB;AAAA,IACrC,MAAA,EAAQ,KAAK,IAAA,CAAK,EAAA;AAAA,IAClB,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,IAChB,OAAA,EAAS;AAAA,GACV,CAAA;AACD,EAAA,IAAI,MAAA;AACJ,EAAA,IAAI;AACF,IAAA,MAAA,GAAS,MAAM,YAAA,CAAa,IAAA,CAAK,IAAA,EAAM,KAAK,GAAA,EAAK;AAAA,MAC/C,KAAK,IAAA,CAAK,GAAA;AAAA,MACV,SAAS,IAAA,CAAK,OAAA;AAAA,MACd,iBAAiB,IAAA,CAAK,WAAA;AAAA,MACtB,QAAA,EAAU;AAAA,KACX,CAAA;AAAA,EACH,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,eAAe,yBAAA,EAA2B;AAC5C,MAAA,MAAM,OAAA,GAAU,MAAM,aAAA,CAAiB,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,QAAA,EAAU,OAAA,EAAS,IAAA,CAAK,GAAA,EAAK,CAAA;AACpF,MAAA,OAAO,EAAE,IAAA,EAAM,UAAA,EAAY,GAAA,EAAK,QAAQ,GAAA,EAAI;AAAA,IAC9C;AACA,IAAA,MAAA,GAAS;AAAA,MACP,MAAA,EAAQ,KAAK,IAAA,CAAK,EAAA;AAAA,MAClB,IAAA,EAAM,KAAK,IAAA,CAAK,IAAA;AAAA,MAChB,MAAA,EAAQ,QAAA;AAAA,MACR,QAAA,EAAU,CAAA;AAAA,MACV,UAAA,EAAY,CAAA;AAAA,MACZ,KAAA,EAAO,WAAW,GAAG;AAAA,KACvB;AAAA,EACF;AACA,EAAA,QAAA,CAAS,YAAA,CAAa,aAAA,EAAe,MAAA,CAAO,MAAM,CAAA;AAClD,EAAA,QAAA,CAAS,YAAA,CAAa,eAAA,EAAiB,MAAA,CAAO,QAAQ,CAAA;AACtD,EAAA,QAAA,CAAS,GAAA,EAAI;AACb,EAAA,OAAO,EAAE,IAAA,EAAM,IAAA,EAAM,MAAA,EAAO;AAC9B;AAiBA,SAAS,iBAAA,CACP,OAAA,EACA,IAAA,EACA,IAAA,EACA,WAAA,EACkD;AAClD,EAAA,IAAI,OAAA,CAAQ,SAAS,UAAA,EAAY;AAI/B,IAAA,IAAI,OAAA,CAAQ,GAAA,CAAI,MAAA,KAAW,WAAA,EAAa;AACtC,MAAA,WAAA,GAAc,EAAE,IAAA,EAAM,oBAAA,EAAsB,MAAA,EAAQ,IAAA,CAAK,IAAI,CAAA;AAAA,IAC/D;AACA,IAAA,OAAO,EAAE,QAAA,EAAU,OAAA,CAAQ,GAAA,EAAI;AAAA,EACjC;AACA,EAAA,IAAA,CAAK,WAAA,CAAY,IAAA,CAAK,OAAA,CAAQ,MAAM,CAAA;AACpC,EAAA,IAAI,OAAA,CAAQ,MAAA,CAAO,MAAA,KAAW,QAAA,EAAU;AACtC,IAAA,WAAA,GAAc;AAAA,MACZ,IAAA,EAAM,aAAA;AAAA,MACN,QAAQ,IAAA,CAAK,EAAA;AAAA,MACb,KAAA,EAAO,QAAQ,MAAA,CAAO,KAAA,IAAS,EAAE,IAAA,EAAM,mBAAA,EAAqB,SAAS,aAAA;AAAc,KACpF,CAAA;AACD,IAAA,OAAO;AAAA,MACL,UAAU,WAAA,CAAgB;AAAA,QACxB,OAAO,IAAA,CAAK,KAAA;AAAA,QACZ,MAAM,IAAA,CAAK,IAAA;AAAA,QACX,MAAA,EAAQ,QAAA;AAAA,QACR,aAAa,IAAA,CAAK,WAAA;AAAA,QAClB,WAAW,IAAA,CAAK,SAAA;AAAA,QAChB,KAAA,EAAO,QAAQ,MAAA,CAAO;AAAA,OACvB;AAAA,KACH;AAAA,EACF;AACA,EAAA,WAAA,GAAc,EAAE,IAAA,EAAM,gBAAA,EAAkB,MAAA,EAAQ,IAAA,CAAK,IAAI,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,MAAA,EAAQ,CAAA;AACxF,EAAA,OAAO,EAAE,GAAA,EAAK,OAAA,CAAQ,MAAA,CAAO,MAAA,EAAO;AACtC;AAEA,eAAe,aAAiB,MAAA,EAA8C;AAC5E,EAAA,MAAM,EAAE,SAAS,KAAA,EAAO,GAAA,EAAK,OAAO,SAAA,EAAW,MAAA,EAAQ,aAAY,GAAI,MAAA;AAEvE,EAAA,MAAM,cAA4B,CAAC,GAAI,MAAA,CAAO,kBAAA,IAAsB,EAAG,CAAA;AACvE,EAAA,MAAM,OAAO,EAAE,WAAA,EAAa,OAAO,IAAA,EAAM,OAAA,CAAQ,MAAM,SAAA,EAAU;AACjE,EAAA,IAAI,MAAe,MAAA,CAAO,KAAA;AAC1B,EAAA,KAAA,MAAW,QAAQ,KAAA,EAAO;AACxB,IAAA,IAAI,MAAA,CAAO,SAAS,OAAO,QAAA,CAAa,QAAQ,IAAA,EAAM,KAAA,EAAO,SAAA,EAAW,WAAA,EAAa,MAAM,CAAA;AAC3F,IAAA,WAAA,GAAc,EAAE,IAAA,EAAM,cAAA,EAAgB,MAAA,EAAQ,IAAA,CAAK,IAAI,CAAA;AACvD,IAAA,MAAM,OAAA,GAAU,MAAM,UAAA,CAAe;AAAA,MACnC,IAAA;AAAA,MACA,GAAA;AAAA,MACA,GAAA;AAAA,MACA,OAAA;AAAA,MACA,WAAA;AAAA,MACA,KAAA;AAAA,MACA,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd;AAAA,KACD,CAAA;AACD,IAAA,MAAM,OAAA,GAAU,iBAAA,CAAsB,OAAA,EAAS,IAAA,EAAM,MAAM,WAAW,CAAA;AACtE,IAAA,IAAI,UAAA,IAAc,OAAA,EAAS,OAAO,OAAA,CAAQ,QAAA;AAC1C,IAAA,GAAA,GAAM,OAAA,CAAQ,GAAA;AAAA,EAChB;AAEA,EAAA,MAAM,YAAA,GAAe,sBAAA,CAAuB,OAAA,CAAQ,YAAA,EAAc,GAAG,CAAA;AACrE,EAAA,IAAI,iBAAiB,MAAA,EAAW;AAC9B,IAAA,OAAO,WAAA,CAAgB;AAAA,MACrB,KAAA;AAAA,MACA,MAAM,OAAA,CAAQ,IAAA;AAAA,MACd,MAAA,EAAQ,QAAA;AAAA,MACR,WAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAO,UAAA,CAAW,IAAI,oBAAoB,OAAA,CAAQ,IAAA,EAAM,YAAY,CAAC;AAAA,KACtE,CAAA;AAAA,EACH;AACA,EAAA,WAAA,GAAc,EAAE,IAAA,EAAM,oBAAA,EAAsB,CAAA;AAC5C,EAAA,OAAO,WAAA,CAAgB;AAAA,IACrB,KAAA;AAAA,IACA,MAAM,OAAA,CAAQ,IAAA;AAAA,IACd,MAAA,EAAQ,WAAA;AAAA,IACR,MAAA,EAAQ,GAAA;AAAA,IACR,WAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAaA,eAAsB,eAAA,CACpB,OAAA,EACA,KAAA,EACA,KAAA,EACA,OAAA,EAC+B;AAC/B,EAAA,MAAM,KAAA,GAAQ,OAAA,EAAS,KAAA,IAAS,SAAA,EAAU;AAC1C,EAAA,MAAM,UAAA,GAAa,QAAQ,UAAA,IAAc,CAAA,OAAA,CAAA;AACzC,EAAA,MAAM,MAAA,GAAS,mBAAA,CAAoB,UAAA,EAAY,KAAA,EAAO,QAAQ,IAAI,CAAA;AAClE,EAAA,MAAM,SAAA,GAAY,KAAK,GAAA,EAAI;AAC3B,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,OAAA,EAAS,MAAA,EAAQ,OAAO,MAAM,CAAA;AAC5D,EAAA,MAAM,UAAU,oBAAA,CAAqB,EAAE,cAAc,OAAA,CAAQ,IAAA,EAAM,OAAO,CAAA;AAE1E,EAAA,IAAI,OAAO,OAAA,EAAS;AAClB,IAAA,MAAA,CAAO,OAAA,EAAQ;AACf,IAAA,OAAA,CAAQ,YAAA,CAAa,mBAAmB,WAAW,CAAA;AACnD,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,OAAO,SAAkB,OAAA,CAAQ,IAAA,EAAM,OAAO,SAAA,EAAW,IAAI,MAAM,CAAA;AAAA,EACrE;AAEA,EAAA,MAAM,QAAA,GAAW,OAAA;AAEjB,EAAA,MAAM,cACJ,QAAA,EAAU,aAAA,KAAkB,MAAA,GAAY,QAAA,CAAS,gBAAgB,OAAA,CAAQ,YAAA;AAC3E,EAAA,MAAM,eAAA,GAAkB,mBAAA,CAAoB,OAAA,EAAS,WAAW,CAAA;AAChE,EAAA,MAAM,GAAA,GAAmB,eAAA,CAAgB,KAAA,EAAO,MAAA,EAAQ,eAAe,CAAA;AACvE,EAAA,IAAI;AAEF,IAAA,MAAM,WAAA,GAAc,sBAAA,CAAuB,OAAA,CAAQ,WAAA,EAAa,KAAK,CAAA;AACrE,IAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAC7B,MAAA,OAAO,WAAA,CAAqB;AAAA,QAC1B,KAAA;AAAA,QACA,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,MAAA,EAAQ,QAAA;AAAA,QACR,aAAa,EAAC;AAAA,QACd,SAAA;AAAA,QACA,OAAO,UAAA,CAAW,IAAI,mBAAmB,OAAA,CAAQ,IAAA,EAAM,WAAW,CAAC;AAAA,OACpE,CAAA;AAAA,IACH;AAEA,IAAA,MAAM,cACJ,WAAA,KAAgB,KAAA,CAAA,GACZ,uBAAuB,OAAA,CAAQ,WAAA,EAAa,WAAW,CAAA,GACvD,KAAA,CAAA;AACN,IAAA,IAAI,gBAAgB,KAAA,CAAA,EAAW;AAC7B,MAAA,OAAO,WAAA,CAAqB;AAAA,QAC1B,KAAA;AAAA,QACA,MAAM,OAAA,CAAQ,IAAA;AAAA,QACd,MAAA,EAAQ,QAAA;AAAA,QACR,aAAa,EAAC;AAAA,QACd,SAAA;AAAA,QACA,OAAO,UAAA,CAAW,IAAI,mBAAmB,OAAA,CAAQ,IAAA,EAAM,WAAW,CAAC;AAAA,OACpE,CAAA;AAAA,IACH;AACA,IAAA,OAAO,MAAM,YAAA,CAAsB;AAAA,MACjC,OAAA;AAAA,MACA,KAAA;AAAA,MACA,KAAA;AAAA,MACA,GAAA;AAAA,MACA,KAAA;AAAA,MACA,SAAA;AAAA,MACA,MAAA;AAAA,MACA,GAAI,UAAU,kBAAA,KAAuB,KAAA,CAAA,GACjC,EAAE,kBAAA,EAAoB,QAAA,CAAS,kBAAA,EAAmB,GAClD,EAAC;AAAA,MACL,GAAI,UAAU,WAAA,KAAgB,KAAA,CAAA,GAAY,EAAE,WAAA,EAAa,QAAA,CAAS,WAAA,EAAY,GAAI;AAAC,KACpF,CAAA;AAAA,EACH,CAAA,SAAE;AACA,IAAA,OAAA,CAAQ,GAAA,EAAI;AACZ,IAAA,MAAA,CAAO,OAAA,EAAQ;AAAA,EACjB;AACF;AAKA,eAAsB,YAAA,CACpB,IAAA,EACA,KAAA,EACA,IAAA,EACqB;AACrB,EAAA,MAAM,EAAE,KAAI,GAAI,IAAA;AAChB,EAAA,QAAQ,KAAK,IAAA;AAAM,IACjB,KAAK,IAAA;AACH,MAAA,OAAO,SAAA,CAAU,IAAA,EAAM,KAAA,EAAO,GAAG,CAAA;AAAA,IACnC,KAAK,OAAA;AACH,MAAA,OAAO,YAAA,CAAa,IAAA,EAAM,KAAA,EAAO,GAAG,CAAA;AAAA,IACtC,KAAK,UAAA;AACH,MAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA;AAAA,IAC1C,KAAK,QAAA;AACH,MAAA,OAAO,aAAA,CAAc,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA;AAAA,IACxC,KAAK,SAAA;AACH,MAAA,OAAO,cAAA,CAAe,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA;AAAA,IACzC,KAAK,SAAA;AACH,MAAA,OAAO,cAAA,CAAe,IAAA,EAAM,KAAA,EAAO,IAAI,CAAA;AAAA,IACzC,KAAK,OAAA;AACH,MAAA,OAAO,YAAA,CAAa,IAAA,EAAM,KAAA,EAAO,GAAG,CAAA;AAAA,IACtC,KAAK,SAAA;AAEH,MAAA,MAAM,IAAI,0BAA0B,MAAS,CAAA;AAAA,IAC/C,SAAS;AACP,MAAA,MAAM,WAAA,GAAqB,IAAA;AAC3B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,mBAAA,EAAuB,WAAA,CAAqB,IAAI,CAAA,CAAE,CAAA;AAAA,IACpE;AAAA;AAEJ;AAcA,eAAe,aAAa,CAAA,EAAkC;AAC5D,EAAA,MAAM,QAAA,GAA6B;AAAA,IACjC,cAAA,EAAgB,CAAA;AAAA;AAAA,IAChB,OAAO,CAAA,CAAE,KAAA;AAAA,IACT,cAAc,CAAA,CAAE,YAAA;AAAA,IAChB,eAAe,CAAA,CAAE,aAAA;AAAA,IACjB,kBAAkB,CAAA,CAAE,gBAAA;AAAA,IACpB,aAAa,CAAA,CAAE,WAAA;AAAA,IACf,kBAAkB,CAAA,CAAE,gBAAA;AAAA,IACpB,GAAI,EAAE,KAAA,KAAU,MAAA,GAAY,EAAE,KAAA,EAAO,CAAA,CAAE,KAAA,EAAM,GAAI,EAAC;AAAA,IAClD,WAAA,EAAa,KAAK,GAAA;AAAI,GACxB;AACA,EAAA,MAAM,KAAA,GAAQ,mBAAA,CAAoB,CAAA,CAAE,OAAO,CAAA;AAC3C,EAAA,MAAM,KAAA,CAAM,KAAK,QAAQ,CAAA;AAC3B;AAIA,eAAsB,eAAmB,IAAA,EAAuD;AAO9F,EAAA,MAAM,aAAa,IAAA,CAAK,QAAA;AAKxB,EAAA,MAAM,UAAU,UAAA,CAAW,SAAA;AAC3B,EAAA,MAAM,QAAQ,UAAA,CAAW,OAAA;AACzB,EAAA,IAAI,OAAA,KAAY,MAAA,IAAa,KAAA,KAAU,MAAA,EAAW;AAChD,IAAA,MAAM,IAAI,MAAM,sEAAsE,CAAA;AAAA,EACxF;AACA,EAAA,MAAM,KAAA,GAAQ,oBAAoB,OAAO,CAAA;AACzC,EAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,IAAA,CAAK,KAAK,KAAK,CAAA;AAC5C,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,6BAAA,CAA8B,IAAA,CAAK,KAAK,CAAA;AAAA,EACpD;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,SAAA,CAAU,CAAC,MAAM,CAAA,CAAE,EAAA,KAAO,SAAS,aAAa,CAAA;AACtE,EAAA,IAAI,UAAU,CAAA,EAAG;AACf,IAAA,MAAM,IAAI,+BAAA,CAAgC,QAAA,CAAS,aAAA,EAAe,SAAS,YAAY,CAAA;AAAA,EACzF;AAGA,EAAA,MAAM,WAAA,GAAc,MAAM,OAAO,CAAA;AACjC,EAAA,IACE,gBAAgB,MAAA,IAChB,WAAA,CAAY,SAAS,SAAA,IACrB,WAAA,CAAY,kBAAkB,MAAA,EAC9B;AACA,IAAA,WAAA,CAAY,aAAA,CAAc,KAAA,CAAM,IAAA,CAAK,OAAO,CAAA;AAAA,EAC9C;AAOA,EAAA,MAAM,cAAc,IAAA,CAAK,OAAA,KAAY,MAAA,GAAY,IAAA,CAAK,UAAU,QAAA,CAAS,gBAAA;AACzE,EAAA,MAAM,cAAA,GAAiB,KAAA,CAAM,KAAA,CAAM,OAAA,GAAU,CAAC,CAAA;AAG9C,EAAA,MAAM,KAAA,CAAM,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA;AAE7B,EAAA,OAAO,eAAA,CAA6B,OAAA,EAAS,cAAA,EAAgB,WAAA,EAAa;AAAA,IACxE,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAO,IAAA,CAAK,KAAA;AAAA;AAAA,IAEZ,oBAAoB,QAAA,CAAS,WAAA;AAAA;AAAA;AAAA,IAG7B,GAAI,SAAS,KAAA,KAAU,MAAA,GAAY,EAAE,aAAA,EAAe,QAAA,CAAS,KAAA,EAAM,GAAI;AAAC,GACtD,CAAA;AACtB","file":"executor-ZNDQDX6Q.js","sourcesContent":["/**\n * Build the `StepContext` passed to every step.fn. The `suspend` method\n * throws a `WorkflowSuspendedSentinel` (defined here) that the executor\n * catches to persist a snapshot (D236).\n *\n * @internal\n */\n\nimport type { StepContext } from \"../../types/workflow.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { redactSecrets } from \"../security/index.js\";\n\n/** Sentinel thrown by `ctx.suspend()`; only the executor catches it. */\nexport class WorkflowSuspendedSentinel extends Error {\n  override readonly name = \"WorkflowSuspendedSentinel\";\n  constructor(public readonly payload?: unknown) {\n    super(\"__workflow_suspended__\");\n  }\n}\n\n/** SE29 — the per-run shared-state seam wired into `StepContext.state`/`setState`. */\nexport interface StateController {\n  getState: () => unknown;\n  setState: (next: unknown) => void;\n}\n\nexport function makeStepContext(\n  runId: string,\n  signal: AbortSignal,\n  state: StateController,\n): StepContext {\n  return {\n    runId,\n    signal,\n    log: {\n      debug: (msg, attrs) => emit(\"debug\", runId, msg, attrs),\n      info: (msg, attrs) => emit(\"info\", runId, msg, attrs),\n      warn: (msg, attrs) => emit(\"warn\", runId, msg, attrs),\n    },\n    suspend: async (payload?: unknown) => {\n      throw new WorkflowSuspendedSentinel(payload);\n    },\n    // SE29 — read reflects the current shared state; write goes through the\n    // controller (which validates against `stateSchema`).\n    get state(): unknown {\n      return state.getState();\n    },\n    setState: (next: unknown): void => state.setState(next),\n  };\n}\n\n/**\n * The logging surface every workflow step gets, on the interceptable channel.\n *\n * These were direct `console.warn` / `console.log` calls — the exact path theokit#147 exists to\n * close, in the words of `internal/diagnostics.ts`: \"those writes interleave with the render and\n * CORRUPT THE FRAME\" in a TUI host. `step-branch.ts`, in this same folder, was converted in that\n * sweep and routes its predicate warning through `diag`.\n *\n * `diagnostics.ts` allowlists \"the Workflow logger\" as a seam whose destination the CALLER chooses.\n * Measured before changing this: it does not. `types/workflow.ts` declares no logger option, and\n * `StepContext.log` is constructed here with no injection point, so a consumer had no way to\n * redirect it. The exemption described something that was never built.\n *\n * The level is formatted into the message rather than becoming a channel, matching the other\n * converted sites — `diag` is deliberately not a logger with levels, and inventing one here would be\n * the requirement nobody asked for that its own docblock warns against.\n */\nfunction emit(\n  level: \"debug\" | \"info\" | \"warn\",\n  runId: string,\n  msg: string,\n  attrs?: Record<string, unknown>,\n): void {\n  const suffix = attrs === undefined ? \"\" : ` ${JSON.stringify(attrs)}`;\n  diag(redactSecrets(`[workflow ${runId}] ${level}: ${msg}${suffix}\\n`));\n}\n\n/**\n * Combine the caller-supplied signal with the flight signal so abort on\n * either side cancels the workflow run.\n */\nexport function combineSignals(...signals: ReadonlyArray<AbortSignal | undefined>): AbortSignal {\n  const valid = signals.filter((s): s is AbortSignal => s !== undefined);\n  if (valid.length === 0) return new AbortController().signal;\n  if (valid.length === 1) return valid[0]!;\n  const ctrl = new AbortController();\n  for (const s of valid) {\n    if (s.aborted) {\n      ctrl.abort(s.reason);\n      break;\n    }\n    s.addEventListener(\"abort\", () => ctrl.abort(s.reason), { once: true });\n  }\n  return ctrl.signal;\n}\n","/**\n * Helper to normalize unknown thrown values to `{ name, message }` shape\n * for use in `StepResult.error` / `WorkflowRun.error`.\n *\n * @internal\n */\n\nexport function errToShape(err: unknown): { name: string; message: string } {\n  if (err instanceof Error) {\n    return { name: err.name, message: err.message };\n  }\n  return { name: \"Error\", message: String(err) };\n}\n","/**\n * Pure helpers extracted from the workflow executor (G8 focus): run assembly,\n * abort, whole-workflow schema validation (SE27), and the shared-state\n * controller (SE29). No executor-internal dependencies — safe to import both ways.\n *\n * @internal\n */\n\nimport type { ZodType } from \"zod\";\nimport type { StepResult, WorkflowOptions, WorkflowRun } from \"../../types/workflow.js\";\nimport { WorkflowStateError } from \"../../workflow-errors.js\";\nimport type { StateController } from \"./ctx.js\";\n\nexport interface AssembleParams<TO> {\n  runId: string;\n  name: string;\n  status: WorkflowRun[\"status\"];\n  stepResults: ReadonlyArray<StepResult>;\n  startedAt: number;\n  output?: TO;\n  error?: { name: string; message: string };\n}\n\nexport function assembleRun<TO>(params: AssembleParams<TO>): WorkflowRun<TO> {\n  return {\n    id: params.runId,\n    name: params.name,\n    status: params.status,\n    startedAt: params.startedAt,\n    endedAt: Date.now(),\n    stepResults: params.stepResults,\n    ...(params.output !== undefined ? { output: params.output } : {}),\n    ...(params.error !== undefined ? { error: params.error } : {}),\n  };\n}\n\nexport function abortRun<T>(\n  name: string,\n  runId: string,\n  startedAt: number,\n  stepResults: StepResult[],\n  signal: AbortSignal,\n): WorkflowRun<T> {\n  return assembleRun<T>({\n    runId,\n    name,\n    status: \"cancelled\",\n    stepResults,\n    startedAt,\n    error: { name: \"AbortError\", message: String(signal.reason ?? \"Aborted\") },\n  });\n}\n\n/**\n * SE27 — validate a value against a whole-workflow schema. Returns a compact\n * issues string on failure, `undefined` when the schema is absent or matches.\n */\nexport function validateWorkflowSchema(\n  schema: ZodType | undefined,\n  value: unknown,\n): string | undefined {\n  if (schema === undefined) return undefined;\n  let parsed: ReturnType<ZodType[\"safeParse\"]>;\n  try {\n    parsed = schema.safeParse(value);\n  } catch {\n    // A schema with an async refinement throws synchronously from safeParse\n    // (\"Encountered Promise during synchronous parse\"). Surface it as a\n    // validation issue (→ status:\"failed\") instead of escaping run() (never-throw).\n    return \"schema uses async refinements, which whole-workflow validation does not support (use a synchronous Zod schema)\";\n  }\n  if (parsed.success) return undefined;\n  return parsed.error.issues\n    .map((issue) => `${issue.path.join(\".\") || \"(root)\"}: ${issue.message}`)\n    .join(\"; \");\n}\n\n/** SE29 — the per-run shared-state holder; `setState` validates against `stateSchema`. */\nexport function makeStateController(options: WorkflowOptions, initial: unknown): StateController {\n  let current = initial;\n  return {\n    getState: () => current,\n    setState: (next: unknown) => {\n      const issues = validateWorkflowSchema(options.stateSchema, next);\n      if (issues !== undefined) throw new WorkflowStateError(options.name, issues);\n      current = next;\n    },\n  };\n}\n","/**\n * Generate a short, deterministic workflow run identifier.\n *\n * Format: `wfr-<8 hex chars>`. Used for span keys, snapshot filenames, and\n * single-flight registry keys.\n *\n * @internal\n */\n\nexport function mintRunId(): string {\n  return `wfr-${globalThis.crypto.randomUUID().replace(/-/g, \"\").slice(0, 8)}`;\n}\n","/**\n * Single-flight registry for in-flight workflow runs (ADR D242).\n *\n * Key = `${workflowId}:${runId}`. Throws `WorkflowAlreadyRunningError` on\n * duplicate. Process crash auto-releases (in-memory map). Pattern mirrors\n * `internal/eval/single-flight.ts` (D213).\n *\n * EC-5 absorbed: lock uses `workflowId` (minted at `.commit()`), not the\n * user-supplied `name`, so two `Workflow` instances sharing a name don't\n * collide on each other's locks.\n *\n * @internal\n */\n\nimport { WorkflowAlreadyRunningError } from \"../../workflow-errors.js\";\n\ninterface Flight {\n  controller: AbortController;\n}\n\nconst registry = new Map<string, Flight>();\n\nfunction key(workflowId: string, runId: string): string {\n  return `${workflowId}:${runId}`;\n}\n\nexport interface AcquiredFlight {\n  signal: AbortSignal;\n  release: () => void;\n}\n\nexport function acquireSingleFlight(\n  workflowId: string,\n  runId: string,\n  workflowName: string,\n): AcquiredFlight {\n  const k = key(workflowId, runId);\n  if (registry.has(k)) {\n    throw new WorkflowAlreadyRunningError(workflowName, runId);\n  }\n  const controller = new AbortController();\n  registry.set(k, { controller });\n  return {\n    signal: controller.signal,\n    release: () => {\n      registry.delete(k);\n    },\n  };\n}\n","/**\n * Retry wrapper with exponential backoff (ADR D237).\n *\n * `withRetry(fn, policy, signal)` retries on throw until success or\n * `maxAttempts` reached. Aborts mid-backoff when signal fires.\n * Non-retryable errors (by name) propagate immediately.\n *\n * @internal\n */\n\nimport type { RetryPolicy } from \"../../types/workflow.js\";\n\nconst DEFAULT_NON_RETRYABLE = [\"AbortError\", \"WorkflowSnapshotNotFoundError\", \"ConfigurationError\"];\n\ninterface BackoffConfig {\n  init: number;\n  coef: number;\n  cap: number;\n  nonRetryable: Set<string>;\n  max: number;\n}\n\nfunction backoffConfigFromPolicy(policy: RetryPolicy): BackoffConfig {\n  return {\n    max: policy.maxAttempts,\n    init: policy.initialBackoffMs ?? 1000,\n    coef: policy.backoffCoefficient ?? 2.0,\n    cap: policy.maximumBackoffMs ?? 30_000,\n    nonRetryable: new Set(policy.nonRetryableErrors ?? DEFAULT_NON_RETRYABLE),\n  };\n}\n\nfunction throwIfAborted(signal: AbortSignal): void {\n  if (signal.aborted) {\n    throw new DOMException(String(signal.reason ?? \"Aborted\"), \"AbortError\");\n  }\n}\n\nfunction shouldRethrow(err: unknown, attempt: number, cfg: BackoffConfig): boolean {\n  const errName = err instanceof Error ? err.name : \"Error\";\n  return cfg.nonRetryable.has(errName) || attempt === cfg.max;\n}\n\nasync function tryOnce<T>(\n  fn: () => Promise<T>,\n  attempt: number,\n  cfg: BackoffConfig,\n  signal: AbortSignal,\n): Promise<{ value: T; attempts: number } | { kind: \"retry\" }> {\n  try {\n    const value = await fn();\n    return { value, attempts: attempt };\n  } catch (err) {\n    if (shouldRethrow(err, attempt, cfg)) throw err;\n    await abortableSleep(Math.min(cfg.init * cfg.coef ** (attempt - 1), cfg.cap), signal);\n    return { kind: \"retry\" };\n  }\n}\n\nexport async function withRetry<T>(\n  fn: () => Promise<T>,\n  policy: RetryPolicy,\n  signal: AbortSignal,\n): Promise<{ value: T; attempts: number }> {\n  const cfg = backoffConfigFromPolicy(policy);\n  for (let attempt = 1; attempt <= cfg.max; attempt += 1) {\n    throwIfAborted(signal);\n    const result = await tryOnce(fn, attempt, cfg, signal);\n    if (\"value\" in result) return result;\n  }\n  // Unreachable: tryOnce throws on the final attempt when shouldRethrow returns true.\n  throw new Error(\"withRetry: exhausted attempts without throwing\");\n}\n\nexport async function abortableSleep(ms: number, signal: AbortSignal): Promise<void> {\n  if (signal.aborted) {\n    throw new DOMException(String(signal.reason ?? \"Aborted\"), \"AbortError\");\n  }\n  return new Promise((resolve, reject) => {\n    const timer = setTimeout(() => {\n      cleanup();\n      resolve();\n    }, ms);\n    const onAbort = (): void => {\n      clearTimeout(timer);\n      cleanup();\n      reject(new DOMException(String(signal.reason ?? \"Aborted\"), \"AbortError\"));\n    };\n    const cleanup = (): void => {\n      signal.removeEventListener(\"abort\", onAbort);\n    };\n    signal.addEventListener(\"abort\", onAbort, { once: true });\n  });\n}\n","/**\n * Execute an `AgentStep` — render the prompt template, call `agent.send`,\n * wait for completion, return the result text as step output (ADR D244,\n * D245).\n *\n * Cloud guard: agents marked as `CloudAgent` throw `UnsupportedRunOperationError`\n * (workflows are local-only in v1).\n *\n * @internal\n */\n\nimport { UnsupportedRunOperationError } from \"../../errors.js\";\nimport type { AgentStep, StepContext, StepResult } from \"../../types/workflow.js\";\nimport { WorkflowSuspendedSentinel } from \"./ctx.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport { withRetry } from \"./retry-policy.js\";\n\nexport async function runAgentStep(\n  step: AgentStep,\n  input: unknown,\n  ctx: StepContext,\n): Promise<StepResult> {\n  const startedAt = Date.now();\n  // D244: cloud guard — workflows are LocalAgent-only in v1.\n  const agentId = step.agent.agentId;\n  if (typeof agentId === \"string\" && agentId.startsWith(\"bc-\")) {\n    return {\n      stepId: step.id,\n      kind: \"agent\",\n      status: \"failed\",\n      attempts: 0,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(\n        new UnsupportedRunOperationError(\n          \"Workflow agent steps not supported on CloudAgent yet (D244).\" +\n            ` agent=\"${agentId}\", step=\"${step.id}\"`,\n          \"workflow\",\n        ),\n      ),\n    };\n  }\n\n  let prompt: string;\n  try {\n    prompt =\n      typeof step.promptTemplate === \"string\" ? step.promptTemplate : step.promptTemplate(input);\n  } catch (err) {\n    return {\n      stepId: step.id,\n      kind: \"agent\",\n      status: \"failed\",\n      attempts: 0,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(err),\n    };\n  }\n  if (typeof prompt !== \"string\" || prompt.length === 0) {\n    return {\n      stepId: step.id,\n      kind: \"agent\",\n      status: \"failed\",\n      attempts: 0,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(\n        new Error(`agentStep \"${step.id}\": rendered prompt must be a non-empty string`),\n      ),\n    };\n  }\n\n  const exec = async (): Promise<string> => {\n    // SE3 — forward the step's provenance onto the agent's turn (metadata-only).\n    const run = await step.agent.send(\n      prompt,\n      step.origin !== undefined ? { origin: step.origin } : undefined,\n    );\n    const result = await run.wait();\n    if (result.status === \"finished\") {\n      return result.result ?? \"\";\n    }\n    if (result.status === \"error\") {\n      throw (result as { error?: Error }).error ?? new Error(\"agent.send errored\");\n    }\n    throw new Error(`Unexpected agent status: ${result.status}`);\n  };\n\n  try {\n    const { value, attempts } =\n      step.retry !== undefined\n        ? await withRetry(exec, step.retry, ctx.signal)\n        : { value: await exec(), attempts: 1 };\n    return {\n      stepId: step.id,\n      kind: \"agent\",\n      status: \"completed\",\n      attempts,\n      durationMs: Date.now() - startedAt,\n      output: value,\n    };\n  } catch (err) {\n    // Re-throw suspend sentinel so the executor can persist a snapshot.\n    if (err instanceof WorkflowSuspendedSentinel) throw err;\n    return {\n      stepId: step.id,\n      kind: \"agent\",\n      status: \"failed\",\n      attempts: 1,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(err),\n    };\n  }\n}\n","/**\n * Execute a `BranchStep` — first-match-wins predicates + optional fallback.\n *\n * EC-2 absorbed: predicates that THROW are treated as \"no match\" + stderr\n * warn — user-code bugs in predicates don't take down the whole workflow.\n *\n * @internal\n */\n\nimport type { BranchStep, Step, StepResult } from \"../../types/workflow.js\";\nimport { diag } from \"../diagnostics.js\";\nimport { redactSecrets } from \"../security/redact.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport type { StepExecution } from \"./step-execution.js\";\n\nexport async function runBranchStep(\n  step: BranchStep,\n  input: unknown,\n  exec: StepExecution,\n): Promise<StepResult> {\n  const startedAt = Date.now();\n\n  for (let i = 0; i < step.predicates.length; i += 1) {\n    const pair = step.predicates[i]!;\n    const [predicate, branch] = pair;\n    // EC-2: predicate throw → warn + treat as no-match.\n    let matched = false;\n    try {\n      matched = await Promise.resolve(predicate(input));\n    } catch (err) {\n      const errText = err instanceof Error ? err.message : String(err);\n      // theokit#147 — the interceptable channel, so a workflow running under a TUI cannot\n      // corrupt its frame with a predicate warning.\n      diag(\n        redactSecrets(\n          `[workflow] branch \"${step.id}\" predicate ${i} threw, treating as no-match: ${errText}\\n`,\n        ),\n      );\n    }\n    if (matched) {\n      const r = await runInnerSequence(branch, input, exec);\n      return {\n        ...r,\n        stepId: step.id,\n        kind: \"branch\",\n        durationMs: Date.now() - startedAt,\n      };\n    }\n  }\n\n  if (step.fallback !== undefined) {\n    const r = await runInnerSequence(step.fallback, input, exec);\n    return {\n      ...r,\n      stepId: step.id,\n      kind: \"branch\",\n      durationMs: Date.now() - startedAt,\n    };\n  }\n\n  // No match, no fallback → pass input through unchanged.\n  return {\n    stepId: step.id,\n    kind: \"branch\",\n    status: \"skipped\",\n    attempts: 0,\n    durationMs: Date.now() - startedAt,\n    output: input,\n  };\n}\n\nasync function runInnerSequence(\n  branch: ReadonlyArray<Step>,\n  input: unknown,\n  exec: StepExecution,\n): Promise<StepResult> {\n  const { dispatch } = exec;\n  let acc: unknown = input;\n  let lastAttempts = 1;\n  for (const inner of branch) {\n    const r = await dispatch(inner, acc, exec);\n    lastAttempts = r.attempts;\n    if (r.status === \"failed\") {\n      return {\n        stepId: inner.id,\n        kind: \"branch\",\n        status: \"failed\",\n        attempts: r.attempts,\n        durationMs: 0,\n        error: r.error ?? errToShape(new Error(\"branch inner step failed\")),\n      };\n    }\n    acc = r.output;\n  }\n  return {\n    stepId: \"__branch-completed__\",\n    kind: \"branch\",\n    status: \"completed\",\n    attempts: lastAttempts,\n    durationMs: 0,\n    output: acc,\n  };\n}\n","/**\n * Execute a `DowhileStep` — loop the inner step until `condFn` returns\n * false or `maxIterations` is reached (default 100).\n *\n * @internal\n */\n\nimport type { DowhileStep, StepResult } from \"../../types/workflow.js\";\nimport { WorkflowMaxIterationsExceededError } from \"../../workflow-errors.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport type { StepExecution } from \"./step-execution.js\";\n\nexport async function runDowhileStep(\n  step: DowhileStep,\n  input: unknown,\n  exec: StepExecution,\n): Promise<StepResult> {\n  const { dispatch } = exec;\n  const startedAt = Date.now();\n  const maxIter = step.maxIterations ?? 100;\n  let acc = input;\n  let i = 0;\n  while (true) {\n    if (i >= maxIter) {\n      return {\n        stepId: step.id,\n        kind: \"dowhile\",\n        status: \"failed\",\n        attempts: i,\n        durationMs: Date.now() - startedAt,\n        error: errToShape(new WorkflowMaxIterationsExceededError(step.id, maxIter)),\n      };\n    }\n    const r = await dispatch(step.step, acc, exec);\n    if (r.status === \"failed\") {\n      return {\n        stepId: step.id,\n        kind: \"dowhile\",\n        status: \"failed\",\n        attempts: i + 1,\n        durationMs: Date.now() - startedAt,\n        error: r.error,\n      };\n    }\n    acc = r.output;\n    i += 1;\n    let shouldContinue = false;\n    try {\n      shouldContinue = await Promise.resolve(step.condFn(acc, i));\n    } catch (err) {\n      return {\n        stepId: step.id,\n        kind: \"dowhile\",\n        status: \"failed\",\n        attempts: i,\n        durationMs: Date.now() - startedAt,\n        error: errToShape(err),\n      };\n    }\n    if (!shouldContinue) break;\n  }\n  return {\n    stepId: step.id,\n    kind: \"dowhile\",\n    status: \"completed\",\n    attempts: i,\n    durationMs: Date.now() - startedAt,\n    output: acc,\n  };\n}\n","/**\n * Execute a `FnStep` — call the user-supplied function with `input` + `ctx`.\n * Wraps in `withRetry` if a retry policy is set (D237).\n *\n * Validates input/output via Zod when schemas are supplied. EC-4 / D229\n * pattern: empty/undefined input parses as `{}` only when schema is defined.\n *\n * @internal\n */\n\nimport type { FnStep, StepContext, StepResult } from \"../../types/workflow.js\";\nimport { WorkflowCompensateNotImplementedError } from \"../../workflow-errors.js\";\nimport { WorkflowSuspendedSentinel } from \"./ctx.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport { withRetry } from \"./retry-policy.js\";\n\nfunction failedFnResult(\n  stepId: string,\n  attempts: number,\n  startedAt: number,\n  err: unknown,\n): StepResult {\n  return {\n    stepId,\n    kind: \"fn\",\n    status: \"failed\",\n    attempts,\n    durationMs: Date.now() - startedAt,\n    error: errToShape(err),\n  };\n}\n\nfunction validate(schema: { parse: (v: unknown) => unknown } | undefined, value: unknown): unknown {\n  if (schema === undefined) return undefined;\n  schema.parse(value);\n  return undefined;\n}\n\nasync function execWithRetry(\n  step: FnStep,\n  input: unknown,\n  ctx: StepContext,\n): Promise<{ value: unknown; attempts: number }> {\n  const exec = async (): Promise<unknown> => step.fn(input, ctx);\n  if (step.retry !== undefined) return withRetry(exec, step.retry, ctx.signal);\n  return { value: await exec(), attempts: 1 };\n}\n\nexport async function runFnStep(\n  step: FnStep,\n  input: unknown,\n  ctx: StepContext,\n): Promise<StepResult> {\n  const startedAt = Date.now();\n  // D238: saga engine not implemented in v1 — surface intent loudly.\n  if (step.compensate !== undefined) {\n    return failedFnResult(\n      step.id,\n      0,\n      startedAt,\n      new WorkflowCompensateNotImplementedError(step.id),\n    );\n  }\n  try {\n    validate(step.inputSchema, input);\n  } catch (err) {\n    return failedFnResult(step.id, 0, startedAt, err);\n  }\n\n  try {\n    const { value, attempts } = await execWithRetry(step, input, ctx);\n    try {\n      validate(step.outputSchema, value);\n    } catch (err) {\n      return failedFnResult(step.id, attempts, startedAt, err);\n    }\n    return {\n      stepId: step.id,\n      kind: \"fn\",\n      status: \"completed\",\n      attempts,\n      durationMs: Date.now() - startedAt,\n      output: value,\n    };\n  } catch (err) {\n    if (err instanceof WorkflowSuspendedSentinel) throw err;\n    return failedFnResult(step.id, 1, startedAt, err);\n  }\n}\n","/**\n * Execute a `ForeachStep` — map a step over the output of an upstream step.\n *\n * EC-7 absorbed: `iterableFrom` MUST reference a top-level step (one of\n * `prevStepResults`). Inner steps from inside `.parallel` / `.branch` /\n * `.foreach` are not reachable.\n *\n * @internal\n */\n\nimport type { ForeachStep, StepResult } from \"../../types/workflow.js\";\nimport { createSemaphore } from \"../concurrency/async-semaphore.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport type { StepExecution } from \"./step-execution.js\";\n\nexport async function runForeachStep(\n  step: ForeachStep,\n  _input: unknown,\n  exec: StepExecution,\n): Promise<StepResult> {\n  const { prevStepResults, dispatch } = exec;\n  const startedAt = Date.now();\n\n  // EC-7: top-level step lookup only.\n  const sourceResult = prevStepResults.find((r) => r.stepId === step.iterableFrom);\n  if (sourceResult === undefined) {\n    return {\n      stepId: step.id,\n      kind: \"foreach\",\n      status: \"failed\",\n      attempts: 0,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(\n        new Error(\n          `foreach.iterableFrom \"${step.iterableFrom}\" not found in top-level steps. ` +\n            `It must reference an earlier top-level step ID — nested step IDs inside ` +\n            `parallel/branch/foreach blocks are not visible here.`,\n        ),\n      ),\n    };\n  }\n\n  const items = sourceResult.output;\n  if (!Array.isArray(items)) {\n    return {\n      stepId: step.id,\n      kind: \"foreach\",\n      status: \"failed\",\n      attempts: 0,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(\n        new Error(\n          `foreach.iterableFrom \"${step.iterableFrom}\" output must be Array, got ${typeof items}.`,\n        ),\n      ),\n    };\n  }\n\n  if (items.length === 0) {\n    return {\n      stepId: step.id,\n      kind: \"foreach\",\n      status: \"completed\",\n      attempts: 1,\n      durationMs: Date.now() - startedAt,\n      output: [],\n    };\n  }\n\n  const concurrency = step.concurrency ?? 4;\n  const sem = createSemaphore(Math.max(1, Math.min(concurrency, items.length)));\n  const failures: Error[] = [];\n  const outputs: unknown[] = new Array(items.length);\n\n  await Promise.all(\n    items.map(async (item, idx) => {\n      const release = await sem.acquire();\n      try {\n        const r = await dispatch(step.step, item, exec);\n        if (r.status === \"failed\") {\n          failures.push(new Error(`foreach item ${idx} failed: ${r.error?.message ?? \"unknown\"}`));\n        } else {\n          outputs[idx] = r.output;\n        }\n      } finally {\n        release();\n      }\n    }),\n  );\n\n  if (failures.length > 0) {\n    return {\n      stepId: step.id,\n      kind: \"foreach\",\n      status: \"failed\",\n      attempts: 1,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(\n        new AggregateError(failures, `foreach \"${step.id}\" had ${failures.length} failure(s)`),\n      ),\n    };\n  }\n\n  return {\n    stepId: step.id,\n    kind: \"foreach\",\n    status: \"completed\",\n    attempts: 1,\n    durationMs: Date.now() - startedAt,\n    output: outputs,\n  };\n}\n","/**\n * Execute a `ParallelStep` — run N branches concurrently.\n *\n * - `errorPolicy: \"fail-fast\"` (default): first branch error aborts the rest\n *   via a derived AbortSignal; `WorkflowParallelError` aggregates failures.\n * - `errorPolicy: \"collect\"`: all branches complete; output is array of\n *   `{ ok: true, value } | { ok: false, error }`.\n *\n * Concurrency: bounded by `step.concurrency ?? branches.length` (D240). All\n * branches run inside the same `AsyncSemaphore`.\n *\n * EC-6 absorbed: empty `branches[]` returns `output: []` without error.\n *\n * @internal\n */\n\nimport type { ParallelStep, Step, StepResult } from \"../../types/workflow.js\";\nimport { WorkflowParallelError } from \"../../workflow-errors.js\";\nimport { createSemaphore } from \"../concurrency/async-semaphore.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport type { StepExecution } from \"./step-execution.js\";\n\nexport async function runParallelStep(\n  step: ParallelStep,\n  input: unknown,\n  exec: StepExecution,\n): Promise<StepResult> {\n  const { ctx } = exec;\n  const startedAt = Date.now();\n  const policy = step.errorPolicy ?? \"fail-fast\";\n  const branchCount = step.branches.length;\n\n  // EC-6: empty branches → empty output, no error.\n  if (branchCount === 0) {\n    return {\n      stepId: step.id,\n      kind: \"parallel\",\n      status: \"completed\",\n      attempts: 1,\n      durationMs: Date.now() - startedAt,\n      output: [],\n    };\n  }\n\n  const concurrency = step.concurrency ?? branchCount;\n  const sem = createSemaphore(Math.max(1, Math.min(concurrency, branchCount)));\n\n  // Derived signal for fail-fast: aborts on first branch failure.\n  const failFastCtrl = policy === \"fail-fast\" ? new AbortController() : undefined;\n  const branchSignal =\n    policy === \"fail-fast\" ? mergeSignals(ctx.signal, failFastCtrl!.signal) : ctx.signal;\n\n  // Gate each branch through the semaphore — acquire BEFORE running so the\n  // permit cap is honored. (Eager-start would defeat concurrency limits.)\n  const semBranchPromises = step.branches.map(async (branch, branchIdx) => {\n    const release = await sem.acquire();\n    try {\n      // Each branch runs under a signal of its own (the run's, merged with this step's) and\n      // starts from an empty result history — the branches are siblings, not a sequence.\n      return await runBranch(\n        branch,\n        input,\n        { ...exec, ctx: { ...ctx, signal: branchSignal }, prevStepResults: [] },\n        branchIdx,\n      );\n    } finally {\n      release();\n    }\n  });\n\n  if (policy === \"fail-fast\") {\n    try {\n      const outputs = await Promise.all(semBranchPromises);\n      return {\n        stepId: step.id,\n        kind: \"parallel\",\n        status: \"completed\",\n        attempts: 1,\n        durationMs: Date.now() - startedAt,\n        output: outputs,\n      };\n    } catch (err) {\n      failFastCtrl?.abort(err);\n      // Collect any settled rejections so the aggregate has all errors.\n      const settled = await Promise.allSettled(semBranchPromises);\n      const errors = settled\n        .filter((s): s is PromiseRejectedResult => s.status === \"rejected\")\n        .map((s) => (s.reason instanceof Error ? s.reason : new Error(String(s.reason))));\n      return {\n        stepId: step.id,\n        kind: \"parallel\",\n        status: \"failed\",\n        attempts: 1,\n        durationMs: Date.now() - startedAt,\n        error: errToShape(new WorkflowParallelError(errors, step.id)),\n        output: undefined,\n      };\n    }\n  }\n\n  // collect mode\n  const settled = await Promise.allSettled(semBranchPromises);\n  const outputs = settled.map((s) =>\n    s.status === \"fulfilled\"\n      ? { ok: true as const, value: s.value }\n      : { ok: false as const, error: errToShape(s.reason) },\n  );\n  return {\n    stepId: step.id,\n    kind: \"parallel\",\n    status: \"completed\",\n    attempts: 1,\n    durationMs: Date.now() - startedAt,\n    output: outputs,\n  };\n}\n\nasync function runBranch(\n  branch: ReadonlyArray<Step>,\n  input: unknown,\n  exec: StepExecution,\n  branchIdx: number,\n): Promise<unknown> {\n  const { dispatch } = exec;\n  let acc: unknown = input;\n  for (const inner of branch) {\n    const r = await dispatch(inner, acc, exec);\n    if (r.status === \"failed\") {\n      throw new Error(\n        `parallel branch ${branchIdx} step \"${inner.id}\" failed: ${r.error?.message ?? \"unknown\"}`,\n      );\n    }\n    acc = r.output;\n  }\n  return acc;\n}\n\nfunction mergeSignals(a: AbortSignal, b: AbortSignal): AbortSignal {\n  if (a.aborted) return a;\n  if (b.aborted) return b;\n  const ctrl = new AbortController();\n  const onAbortA = (): void => ctrl.abort(a.reason);\n  const onAbortB = (): void => ctrl.abort(b.reason);\n  a.addEventListener(\"abort\", onAbortA, { once: true });\n  b.addEventListener(\"abort\", onAbortB, { once: true });\n  return ctrl.signal;\n}\n","/**\n * Execute a `SleepStep` — pause for `durationMs`. Aborts mid-sleep\n * when the signal fires (D245).\n *\n * @internal\n */\n\nimport type { SleepStep, StepContext, StepResult } from \"../../types/workflow.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport { abortableSleep } from \"./retry-policy.js\";\n\nexport async function runSleepStep(\n  step: SleepStep,\n  input: unknown,\n  ctx: StepContext,\n): Promise<StepResult> {\n  const startedAt = Date.now();\n  try {\n    await abortableSleep(step.durationMs, ctx.signal);\n    return {\n      stepId: step.id,\n      kind: \"sleep\",\n      status: \"completed\",\n      attempts: 1,\n      durationMs: Date.now() - startedAt,\n      output: input, // sleep is a pass-through\n    };\n  } catch (err) {\n    return {\n      stepId: step.id,\n      kind: \"sleep\",\n      status: \"failed\",\n      attempts: 1,\n      durationMs: Date.now() - startedAt,\n      error: errToShape(err),\n    };\n  }\n}\n","/**\n * OTel telemetry for workflows (ADR D241).\n *\n * Spans:\n *   - `workflow.run` — root span per `Workflow.run` invocation\n *   - `workflow.step.<id>` — child span per step (retry attempts share the kind)\n *\n * Attributes:\n *   - `workflow.name`, `workflow.run_id`, `step.kind`, `step.status`, `step.attempts`\n *\n * @internal\n */\n\nimport { getTracer, noopSpan, type SpanLike } from \"../telemetry/tracer-loader.js\";\n\nconst TRACER_NAME = \"@theokit/sdk/workflow\";\n\nexport function startWorkflowRunSpan(info: { workflowName: string; runId: string }): SpanLike {\n  const tracer = getTracer(TRACER_NAME);\n  if (tracer === undefined) return noopSpan;\n  return tracer.startSpan(\"workflow.run\", {\n    attributes: {\n      \"workflow.name\": info.workflowName,\n      \"workflow.run_id\": info.runId,\n    },\n  });\n}\n\nexport function startWorkflowStepSpan(info: {\n  stepId: string;\n  kind: string;\n  attempt: number;\n}): SpanLike {\n  const tracer = getTracer(TRACER_NAME);\n  if (tracer === undefined) return noopSpan;\n  return tracer.startSpan(`workflow.step.${info.stepId}`, {\n    attributes: {\n      \"step.id\": info.stepId,\n      \"step.kind\": info.kind,\n      \"step.attempt\": info.attempt,\n    },\n  });\n}\n","/**\n * Workflow executor (ADRs D230-D248).\n *\n * Walks `steps[]` sequentially, dispatching to per-kind handlers. Handles\n * suspend (sentinel pattern; D236), single-flight (D242), abort signal\n * boundaries (D245), and snapshot persistence opt-in (D235).\n *\n * @internal\n */\n\nimport type {\n  Step,\n  StepContext,\n  StepResult,\n  WorkflowEvent,\n  WorkflowOptions,\n  WorkflowResumeOptions,\n  WorkflowRun,\n  WorkflowRunOptions,\n  WorkflowSnapshot,\n} from \"../../types/workflow.js\";\nimport {\n  WorkflowInputError,\n  WorkflowOutputError,\n  WorkflowResumeStepNotFoundError,\n  WorkflowSnapshotNotFoundError,\n  WorkflowStateError,\n} from \"../../workflow-errors.js\";\nimport { combineSignals, makeStepContext, WorkflowSuspendedSentinel } from \"./ctx.js\";\nimport { errToShape } from \"./error-shape.js\";\nimport {\n  abortRun,\n  assembleRun,\n  makeStateController,\n  validateWorkflowSchema,\n} from \"./executor-helpers.js\";\nimport { mintRunId } from \"./run-id.js\";\nimport { acquireSingleFlight } from \"./single-flight.js\";\nimport { getSnapshotStoreFor } from \"./snapshot-store.js\";\nimport { runAgentStep } from \"./step-agent.js\";\nimport { runBranchStep } from \"./step-branch.js\";\nimport { runDowhileStep } from \"./step-dowhile.js\";\nimport type { StepExecution } from \"./step-execution.js\";\nimport { runFnStep } from \"./step-fn.js\";\nimport { runForeachStep } from \"./step-foreach.js\";\nimport { runParallelStep } from \"./step-parallel.js\";\nimport { runSleepStep } from \"./step-sleep.js\";\nimport { startWorkflowRunSpan, startWorkflowStepSpan } from \"./telemetry.js\";\n\ninterface SuspendOutcome<T> {\n  kind: \"suspended\" | \"failed\";\n  run: WorkflowRun<T>;\n}\n\nasync function handleSuspend<T>(\n  err: WorkflowSuspendedSentinel,\n  ctx: {\n    runId: string;\n    name: string;\n    step: Step;\n    stepResults: StepResult[];\n    acc: unknown;\n    options: WorkflowOptions;\n    startedAt: number;\n    stepSpan: ReturnType<typeof startWorkflowStepSpan>;\n    /** SE29 — the StepContext, read for its current shared `state`. */\n    stepCtx: StepContext;\n  },\n): Promise<SuspendOutcome<T>> {\n  try {\n    await saveSnapshot({\n      runId: ctx.runId,\n      workflowName: ctx.options.name,\n      currentStepId: ctx.step.id,\n      suspendedPayload: err.payload,\n      stepResults: ctx.stepResults,\n      accumulatedInput: ctx.acc,\n      state: ctx.stepCtx.state, // SE29 — capture the shared state at suspend\n      options: ctx.options,\n    });\n  } catch (snapErr) {\n    ctx.stepSpan.setAttribute(\"step.status\", \"failed\");\n    ctx.stepSpan.end();\n    return {\n      kind: \"failed\",\n      run: assembleRun<T>({\n        runId: ctx.runId,\n        name: ctx.name,\n        status: \"failed\",\n        stepResults: ctx.stepResults,\n        startedAt: ctx.startedAt,\n        error: errToShape(snapErr),\n      }),\n    };\n  }\n  ctx.stepSpan.setAttribute(\"step.status\", \"suspended\");\n  ctx.stepSpan.end();\n  return {\n    kind: \"suspended\",\n    run: assembleRun<T>({\n      runId: ctx.runId,\n      name: ctx.name,\n      status: \"suspended\",\n      stepResults: [\n        ...ctx.stepResults,\n        {\n          stepId: ctx.step.id,\n          kind: ctx.step.kind,\n          status: \"suspended\",\n          attempts: 1,\n          durationMs: 0,\n          output: undefined,\n        },\n      ],\n      startedAt: ctx.startedAt,\n    }),\n  };\n}\n\nasync function runOneStep<T>(args: {\n  step: Step;\n  acc: unknown;\n  ctx: StepContext;\n  options: WorkflowOptions;\n  stepResults: StepResult[];\n  runId: string;\n  name: string;\n  startedAt: number;\n}): Promise<{ kind: \"ok\"; result: StepResult } | { kind: \"terminal\"; run: WorkflowRun<T> }> {\n  const stepSpan = startWorkflowStepSpan({\n    stepId: args.step.id,\n    kind: args.step.kind,\n    attempt: 1,\n  });\n  let result: StepResult;\n  try {\n    result = await dispatchStep(args.step, args.acc, {\n      ctx: args.ctx,\n      options: args.options,\n      prevStepResults: args.stepResults,\n      dispatch: dispatchStep,\n    });\n  } catch (err) {\n    if (err instanceof WorkflowSuspendedSentinel) {\n      const outcome = await handleSuspend<T>(err, { ...args, stepSpan, stepCtx: args.ctx });\n      return { kind: \"terminal\", run: outcome.run };\n    }\n    result = {\n      stepId: args.step.id,\n      kind: args.step.kind,\n      status: \"failed\",\n      attempts: 1,\n      durationMs: 0,\n      error: errToShape(err),\n    };\n  }\n  stepSpan.setAttribute(\"step.status\", result.status);\n  stepSpan.setAttribute(\"step.attempts\", result.attempts);\n  stepSpan.end();\n  return { kind: \"ok\", result };\n}\n\ninterface LoopParams {\n  options: WorkflowOptions;\n  steps: ReadonlyArray<Step>;\n  input: unknown;\n  ctx: StepContext;\n  runId: string;\n  startedAt: number;\n  signal: AbortSignal;\n  /** M3 #62 — prior step outputs restored on resume (else resume is lossy). */\n  initialStepResults?: ReadonlyArray<StepResult>;\n  /** SE28 — sink for step-level stream events (top-level steps). */\n  onStepEvent?: (event: WorkflowEvent) => void;\n}\n\n/** Emit events + branch on one step's outcome. Returns a terminal run, or the new acc. */\nfunction handleStepOutcome<TO>(\n  outcome: { kind: \"ok\"; result: StepResult } | { kind: \"terminal\"; run: WorkflowRun<TO> },\n  step: Step,\n  loop: { stepResults: StepResult[]; runId: string; name: string; startedAt: number },\n  onStepEvent?: (event: WorkflowEvent) => void,\n): { terminal: WorkflowRun<TO> } | { acc: unknown } {\n  if (outcome.kind === \"terminal\") {\n    // A snapshot-SAVE failure also returns terminal (status \"failed\") — only emit\n    // workflow_suspended when the run actually suspended (else the consumer would\n    // resume a run with no snapshot). A failed terminal has no event; read `result`.\n    if (outcome.run.status === \"suspended\") {\n      onStepEvent?.({ type: \"workflow_suspended\", stepId: step.id });\n    }\n    return { terminal: outcome.run };\n  }\n  loop.stepResults.push(outcome.result);\n  if (outcome.result.status === \"failed\") {\n    onStepEvent?.({\n      type: \"step_failed\",\n      stepId: step.id,\n      error: outcome.result.error ?? { name: \"WorkflowStepError\", message: \"step failed\" },\n    });\n    return {\n      terminal: assembleRun<TO>({\n        runId: loop.runId,\n        name: loop.name,\n        status: \"failed\",\n        stepResults: loop.stepResults,\n        startedAt: loop.startedAt,\n        error: outcome.result.error,\n      }),\n    };\n  }\n  onStepEvent?.({ type: \"step_completed\", stepId: step.id, output: outcome.result.output });\n  return { acc: outcome.result.output };\n}\n\nasync function runStepsLoop<TO>(params: LoopParams): Promise<WorkflowRun<TO>> {\n  const { options, steps, ctx, runId, startedAt, signal, onStepEvent } = params;\n  // M3 #62 — seed with prior step outputs so a resumed workflow is not lossy.\n  const stepResults: StepResult[] = [...(params.initialStepResults ?? [])];\n  const loop = { stepResults, runId, name: options.name, startedAt };\n  let acc: unknown = params.input;\n  for (const step of steps) {\n    if (signal.aborted) return abortRun<TO>(options.name, runId, startedAt, stepResults, signal);\n    onStepEvent?.({ type: \"step_started\", stepId: step.id });\n    const outcome = await runOneStep<TO>({\n      step,\n      acc,\n      ctx,\n      options,\n      stepResults,\n      runId,\n      name: options.name,\n      startedAt,\n    });\n    const handled = handleStepOutcome<TO>(outcome, step, loop, onStepEvent);\n    if (\"terminal\" in handled) return handled.terminal;\n    acc = handled.acc;\n  }\n  // SE27 — validate the whole-workflow output only on the terminal completed path.\n  const outputIssues = validateWorkflowSchema(options.outputSchema, acc);\n  if (outputIssues !== undefined) {\n    return assembleRun<TO>({\n      runId,\n      name: options.name,\n      status: \"failed\",\n      stepResults,\n      startedAt,\n      error: errToShape(new WorkflowOutputError(options.name, outputIssues)),\n    });\n  }\n  onStepEvent?.({ type: \"workflow_completed\" });\n  return assembleRun<TO>({\n    runId,\n    name: options.name,\n    status: \"completed\",\n    output: acc as TO,\n    stepResults,\n    startedAt,\n  });\n}\n\n/** M3 #62 — internal-only resume seam: prior step outputs are NOT on the public\n * WorkflowRunOptions (a consumer must not inject fabricated results into a fresh run);\n * resumeWorkflow sets them via this cast. */\ntype InternalRunOpts = WorkflowRunOptions & {\n  readonly initialStepResults?: ReadonlyArray<StepResult>;\n  /** SE28 — internal step-event sink threaded by `Workflow.stream()`. */\n  readonly onStepEvent?: (event: WorkflowEvent) => void;\n  /** SE29 — shared state restored from a snapshot on resume. */\n  readonly restoredState?: unknown;\n};\n\nexport async function executeWorkflow<TInput, TOutput>(\n  options: WorkflowOptions,\n  steps: ReadonlyArray<Step>,\n  input: TInput,\n  runOpts?: WorkflowRunOptions,\n): Promise<WorkflowRun<TOutput>> {\n  const runId = runOpts?.runId ?? mintRunId();\n  const workflowId = options.workflowId ?? `wf-anon`;\n  const flight = acquireSingleFlight(workflowId, runId, options.name);\n  const startedAt = Date.now();\n  const signal = combineSignals(runOpts?.signal, flight.signal);\n  const runSpan = startWorkflowRunSpan({ workflowName: options.name, runId });\n\n  if (signal.aborted) {\n    flight.release();\n    runSpan.setAttribute(\"workflow.status\", \"cancelled\");\n    runSpan.end();\n    return abortRun<TOutput>(options.name, runId, startedAt, [], signal);\n  }\n\n  const internal = runOpts as InternalRunOpts | undefined;\n  // SE29 — seed shared state from the resume snapshot (if any) else initialState.\n  const seededState =\n    internal?.restoredState !== undefined ? internal.restoredState : options.initialState;\n  const stateController = makeStateController(options, seededState);\n  const ctx: StepContext = makeStepContext(runId, signal, stateController);\n  try {\n    // SE27 — validate the whole-workflow input BEFORE any step runs (fail-fast).\n    const inputIssues = validateWorkflowSchema(options.inputSchema, input);\n    if (inputIssues !== undefined) {\n      return assembleRun<TOutput>({\n        runId,\n        name: options.name,\n        status: \"failed\",\n        stepResults: [],\n        startedAt,\n        error: errToShape(new WorkflowInputError(options.name, inputIssues)),\n      });\n    }\n    // SE29 — validate the seeded state (fail-fast) before any step reads it.\n    const stateIssues =\n      seededState !== undefined\n        ? validateWorkflowSchema(options.stateSchema, seededState)\n        : undefined;\n    if (stateIssues !== undefined) {\n      return assembleRun<TOutput>({\n        runId,\n        name: options.name,\n        status: \"failed\",\n        stepResults: [],\n        startedAt,\n        error: errToShape(new WorkflowStateError(options.name, stateIssues)),\n      });\n    }\n    return await runStepsLoop<TOutput>({\n      options,\n      steps,\n      input,\n      ctx,\n      runId,\n      startedAt,\n      signal,\n      ...(internal?.initialStepResults !== undefined\n        ? { initialStepResults: internal.initialStepResults }\n        : {}),\n      ...(internal?.onStepEvent !== undefined ? { onStepEvent: internal.onStepEvent } : {}),\n    });\n  } finally {\n    runSpan.end();\n    flight.release();\n  }\n}\n\n/**\n * Dispatch single step to the right handler. Exhaustive over `step.kind`.\n */\nexport async function dispatchStep(\n  step: Step,\n  input: unknown,\n  exec: StepExecution,\n): Promise<StepResult> {\n  const { ctx } = exec;\n  switch (step.kind) {\n    case \"fn\":\n      return runFnStep(step, input, ctx);\n    case \"agent\":\n      return runAgentStep(step, input, ctx);\n    case \"parallel\":\n      return runParallelStep(step, input, exec);\n    case \"branch\":\n      return runBranchStep(step, input, exec);\n    case \"foreach\":\n      return runForeachStep(step, input, exec);\n    case \"dowhile\":\n      return runDowhileStep(step, input, exec);\n    case \"sleep\":\n      return runSleepStep(step, input, ctx);\n    case \"suspend\":\n      // Standalone suspend: throw sentinel so executor catches.\n      throw new WorkflowSuspendedSentinel(undefined);\n    default: {\n      const _exhaustive: never = step;\n      throw new Error(`Unknown step kind: ${(_exhaustive as Step).kind}`);\n    }\n  }\n}\n\ninterface SnapshotParams {\n  runId: string;\n  workflowName: string;\n  currentStepId: string;\n  suspendedPayload?: unknown;\n  stepResults: ReadonlyArray<StepResult>;\n  accumulatedInput: unknown;\n  /** SE29 — shared state captured at suspend. */\n  state: unknown;\n  options: WorkflowOptions;\n}\n\nasync function saveSnapshot(p: SnapshotParams): Promise<void> {\n  const snapshot: WorkflowSnapshot = {\n    _schemaVersion: 2, // SE29 — carries `state`\n    runId: p.runId,\n    workflowName: p.workflowName,\n    currentStepId: p.currentStepId,\n    suspendedPayload: p.suspendedPayload,\n    stepResults: p.stepResults,\n    accumulatedInput: p.accumulatedInput,\n    ...(p.state !== undefined ? { state: p.state } : {}),\n    suspendedAt: Date.now(),\n  };\n  const store = getSnapshotStoreFor(p.options);\n  await store.save(snapshot);\n}\n\n/* ─── Resume ─── */\n\nexport async function resumeWorkflow<TO>(opts: WorkflowResumeOptions): Promise<WorkflowRun<TO>> {\n  // We need access to the workflow's internal options/steps. The public\n  // resume API hands us a `workflow` reference exposing `.run` only — for\n  // v1 we accept the user re-running the same workflow with the snapshot's\n  // accumulated input + payload merged. Full resume-from-step support\n  // would require exposing `__steps` and `__options`; v1 ships a simpler\n  // \"re-run from input\" semantics gated by snapshot lookup.\n  const wfInternal = opts.workflow as {\n    __options?: WorkflowOptions;\n    __steps?: ReadonlyArray<Step>;\n    run: (input: unknown, runOpts?: WorkflowRunOptions) => Promise<WorkflowRun<TO>>;\n  };\n  const options = wfInternal.__options;\n  const steps = wfInternal.__steps;\n  if (options === undefined || steps === undefined) {\n    throw new Error(\"Workflow.resume requires an instance from Workflow.create().commit()\");\n  }\n  const store = getSnapshotStoreFor(options);\n  const snapshot = await store.load(opts.runId);\n  if (snapshot === undefined) {\n    throw new WorkflowSnapshotNotFoundError(opts.runId);\n  }\n  // EC-8: verify the currentStepId exists in the supplied workflow.\n  const stepIdx = steps.findIndex((s) => s.id === snapshot.currentStepId);\n  if (stepIdx < 0) {\n    throw new WorkflowResumeStepNotFoundError(snapshot.currentStepId, snapshot.workflowName);\n  }\n\n  // Validate payload if the suspend step declared a schema.\n  const suspendStep = steps[stepIdx];\n  if (\n    suspendStep !== undefined &&\n    suspendStep.kind === \"suspend\" &&\n    suspendStep.payloadSchema !== undefined\n  ) {\n    suspendStep.payloadSchema.parse(opts.payload);\n  }\n\n  // For v1: continue from stepIdx + 1 with `payload` (if any) as the new\n  // accumulated input. This is intentionally simpler than full state\n  // restoration; the snapshot's `accumulatedInput` is preserved for\n  // observability but the resume input is determined by the caller's\n  // payload (or the snapshot's accumulator if payload is undefined).\n  const resumeInput = opts.payload !== undefined ? opts.payload : snapshot.accumulatedInput;\n  const remainingSteps = steps.slice(stepIdx + 1);\n\n  // Drop snapshot once we begin (single-shot semantics).\n  await store.delete(opts.runId);\n\n  return executeWorkflow<unknown, TO>(options, remainingSteps, resumeInput, {\n    signal: opts.signal,\n    runId: opts.runId,\n    // M3 #62 — restore prior step outputs so the resumed run is not lossy (internal seam).\n    initialStepResults: snapshot.stepResults,\n    // SE29 — restore shared state (v2 snapshot). A v1 snapshot has no `state` →\n    // executeWorkflow falls back to `options.initialState`.\n    ...(snapshot.state !== undefined ? { restoredState: snapshot.state } : {}),\n  } as InternalRunOpts);\n}\n"]}

package/dist/filesystem/index.cjs

@@ -1,64 +1,62 @@
 'use strict';
 
-var chunkV2BOS4WF_cjs = require('../chunk-V2BOS4WF.cjs');
-require('../chunk-VKJ7V7EB.cjs');
-require('../chunk-4ZHTIJNE.cjs');
-require('../chunk-XL7Q7HB2.cjs');
-require('../chunk-EG4QM7ZJ.cjs');
+var chunk7A6535RA_cjs = require('../chunk-7A6535RA.cjs');
+require('../chunk-SA6K24NB.cjs');
+var chunkJ7J7J2GN_cjs = require('../chunk-J7J7J2GN.cjs');
+require('../chunk-6LHQPOMI.cjs');
 var promises = require('fs/promises');
 var path = require('path');
 
 // src/filesystem/types.ts
-var FilesystemSecurityError = class extends Error {
+var FilesystemSecurityError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
+  name = "FilesystemSecurityError";
   code = "filesystem_security";
   constructor(message) {
-    super(message);
-    this.name = "FilesystemSecurityError";
+    super(message, { code: "filesystem_security", isRetryable: false });
   }
 };
-var FilesystemReadOnlyError = class extends Error {
+var FilesystemReadOnlyError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
+  name = "FilesystemReadOnlyError";
   code = "filesystem_readonly";
   constructor(message) {
-    super(message);
-    this.name = "FilesystemReadOnlyError";
+    super(message, { code: "filesystem_readonly", isRetryable: false });
   }
 };
-var FileNotFoundError = class extends Error {
+var FileNotFoundError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   constructor(path) {
-    super(`File not found: ${path}`);
+    super(`File not found: ${path}`, { code: "filesystem_not_found", isRetryable: false });
     this.path = path;
-    this.name = "FileNotFoundError";
   }
   path;
+  name = "FileNotFoundError";
   code = "filesystem_not_found";
 };
-var FilesystemError = class extends Error {
+var FilesystemError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   constructor(path, cause) {
     super(
       `Filesystem operation failed on "${path}": ${cause?.message ?? cause}`,
-      {
-        cause
-      }
+      { cause, code: "filesystem_io", isRetryable: true }
     );
     this.path = path;
-    this.name = "FilesystemError";
   }
   path;
+  name = "FilesystemError";
   code = "filesystem_io";
 };
-var StaleFileError = class extends Error {
+var StaleFileError = class extends chunkJ7J7J2GN_cjs.TheokitAgentError {
   constructor(path, expectedMtime, actualMtime) {
     super(
-      `Stale write to "${path}": expected mtime ${expectedMtime}, found ${actualMtime} (file changed since last read \u2014 re-read before writing)`
+      `Stale write to "${path}": expected mtime ${expectedMtime}, found ${actualMtime} (file changed since last read \u2014 re-read before writing)`,
+      { code: "filesystem_stale", isRetryable: false }
     );
     this.path = path;
     this.expectedMtime = expectedMtime;
     this.actualMtime = actualMtime;
-    this.name = "StaleFileError";
   }
   path;
   expectedMtime;
   actualMtime;
+  name = "StaleFileError";
   code = "filesystem_stale";
 };
 var FilesystemBackend = class {
@@ -168,17 +166,17 @@ var LocalFilesystem = class extends FilesystemBackend {
   resolve(path) {
     let abs;
     try {
-      abs = chunkV2BOS4WF_cjs.safePathJoin(this._basePath, path);
+      abs = chunk7A6535RA_cjs.safePathJoin(this._basePath, path);
     } catch (err) {
-      if (err instanceof chunkV2BOS4WF_cjs.PathTraversalError) {
+      if (err instanceof chunk7A6535RA_cjs.PathTraversalError) {
         throw new FilesystemSecurityError(`Path escapes basePath: ${path}`);
       }
       throw err;
     }
     try {
-      chunkV2BOS4WF_cjs.assertNoSymlinkEscape(abs, this._basePath);
+      chunk7A6535RA_cjs.assertNoSymlinkEscape(abs, this._basePath);
     } catch (err) {
-      if (err instanceof chunkV2BOS4WF_cjs.PathTraversalError) {
+      if (err instanceof chunk7A6535RA_cjs.PathTraversalError) {
         throw new FilesystemSecurityError(`Path escapes basePath via symlink: ${path}`);
       }
       throw err;

package/dist/filesystem/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../src/filesystem/types.ts","../../src/filesystem/local-filesystem.ts"],"names":["fsReadFile","path","mkdir","dirname","fsWriteFile","readdir","fsStat","safePathJoin","PathTraversalError","assertNoSymlinkEscape"],"mappings":";;;;;;;;;;;AAyDO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACxC,IAAA,GAAO,qBAAA;AAAA,EAChB,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAGO,IAAM,uBAAA,GAAN,cAAsC,KAAA,CAAM;AAAA,EACxC,IAAA,GAAO,qBAAA;AAAA,EAChB,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,yBAAA;AAAA,EACd;AACF;AAGO,IAAM,iBAAA,GAAN,cAAgC,KAAA,CAAM;AAAA,EAE3C,YAA4B,IAAA,EAAc;AACxC,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAE,CAAA;AADL,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAE1B,IAAA,IAAA,CAAK,IAAA,GAAO,mBAAA;AAAA,EACd;AAAA,EAH4B,IAAA;AAAA,EADnB,IAAA,GAAO,sBAAA;AAKlB;AAQO,IAAM,eAAA,GAAN,cAA8B,KAAA,CAAM;AAAA,EAEzC,WAAA,CACkB,MAChB,KAAA,EACA;AACA,IAAA,KAAA;AAAA,MACE,CAAA,gCAAA,EAAmC,IAAI,CAAA,GAAA,EAAO,KAAA,EAAgC,WAAW,KAAK,CAAA,CAAA;AAAA,MAC9F;AAAA,QACE;AAAA;AACF,KACF;AARgB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAShB,IAAA,IAAA,CAAK,IAAA,GAAO,iBAAA;AAAA,EACd;AAAA,EAVkB,IAAA;AAAA,EAFT,IAAA,GAAO,eAAA;AAalB;AAMO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAExC,WAAA,CACkB,IAAA,EACA,aAAA,EACA,WAAA,EAChB;AACA,IAAA,KAAA;AAAA,MACE,CAAA,gBAAA,EAAmB,IAAI,CAAA,kBAAA,EAAqB,aAAa,WAAW,WAAW,CAAA,6DAAA;AAAA,KAEjF;AAPgB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAMhB,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AAAA,EACd;AAAA,EATkB,IAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EAJT,IAAA,GAAO,kBAAA;AAYlB;AAQO,IAAe,oBAAf,MAAiC;AAAA,EACnB,SAAA;AAAA,EACA,SAAA;AAAA,EAEnB,WAAA,CAAY,MAAA,GAA2B,EAAC,EAAG;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAChD,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,QAAA,IAAY,KAAA;AAAA,EACtC;AAAA;AAAA,EAoBA,MAAM,OAAO,IAAA,EAAgC;AAC3C,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,KAAK,IAAI,CAAA;AACpB,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,mBAAmB,OAAO,KAAA;AAC7C,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGU,cAAA,GAAuB;AAC/B,IAAA,IAAI,KAAK,SAAA,EAAW;AAClB,MAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,mCAAA,EAAsC,IAAA,CAAK,SAAS,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3F;AAAA,EACF;AAAA,EAEA,IAAI,QAAA,GAAoB;AACtB,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,IAAI,QAAA,GAAmB;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AACF;AAcA,eAAsB,iBAAA,CACpB,UACA,GAAA,EAC4B;AAC5B,EAAA,OAAO,QAAA,YAAoB,iBAAA,GAAoB,QAAA,GAAW,QAAA,CAAS,GAAG,CAAA;AACxE;;;AC1IO,IAAM,eAAA,GAAN,cAA8B,iBAAA,CAAkB;AAAA,EACrD,WAAA,CAAY,MAAA,GAA2B,EAAC,EAAG;AACzC,IAAA,KAAA,CAAM,MAAM,CAAA;AAAA,EACd;AAAA,EAEA,MAAM,SAAS,IAAA,EAA+B;AAC5C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI;AACF,MAAA,OAAO,MAAMA,iBAAA,CAAW,GAAA,EAAK,OAAO,CAAA;AAAA,IACtC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,MAAM,SAAA,CAAUC,MAAA,EAAc,OAAA,EAAiB,IAAA,EAA4C;AAGzF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQA,MAAI,CAAA;AAC7B,IAAA,IAAA,CAAK,cAAA,EAAe;AAGpB,IAAA,IAAI,IAAA,EAAM,kBAAkB,MAAA,EAAW;AACrC,MAAA,MAAM,IAAA,CAAK,cAAA,CAAeA,MAAA,EAAM,GAAA,EAAK,KAAK,aAAa,CAAA;AAAA,IACzD;AACA,IAAA,IAAI;AACF,MAAA,MAAMC,eAAMC,YAAA,CAAQ,GAAG,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC7C,MAAA,MAAMC,kBAAA,CAAY,GAAA,EAAK,OAAA,EAAS,OAAO,CAAA;AAAA,IACzC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAKH,MAAI,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAKA,MAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,KAAK,IAAA,EAAiC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,KAAK,IAAA,EAAiC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI;AACF,MAAA,OAAO,MAAMI,iBAAQ,GAAG,CAAA;AAAA,IAC1B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CAAQ,GAAA,EAAa,OAAA,EAAoC;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,MAAMC,aAAA,CAAO,GAAG,CAAA;AAC1B,MAAA,OAAO;AAAA,QACL,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,QACjB,WAAA,EAAa,EAAE,WAAA;AAAY,OAC7B;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,OAAO,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,cAAA,CAAe,OAAA,EAAiB,GAAA,EAAa,aAAA,EAAsC;AAC/F,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAA,CAAW,MAAMA,aAAA,CAAO,GAAG,CAAA,EAAG,OAAA;AAAA,IAChC,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAK,GAAA,CAA0B,SAAS,QAAA,EAAU;AAClD,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,OAAO,CAAA;AAAA,IAClC;AACA,IAAA,IAAI,YAAY,aAAA,EAAe;AAC7B,MAAA,MAAM,IAAI,cAAA,CAAe,OAAA,EAAS,aAAA,EAAe,OAAO,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,QAAQ,IAAA,EAAsB;AACpC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAMC,8BAAA,CAAa,IAAA,CAAK,SAAA,EAAW,IAAI,CAAA;AAAA,IACzC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAeC,oCAAA,EAAoB;AACrC,QAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAE,CAAA;AAAA,MACpE;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAAC,uCAAA,CAAsB,GAAA,EAAK,KAAK,SAAS,CAAA;AAAA,IAC3C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAeD,oCAAA,EAAoB;AACrC,QAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,mCAAA,EAAsC,IAAI,CAAA,CAAE,CAAA;AAAA,MAChF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEQ,QAAA,CAAS,KAAc,IAAA,EAAqB;AAClD,IAAA,IACE,eAAe,uBAAA,IACf,GAAA,YAAe,mBACf,GAAA,YAAe,iBAAA,IACf,eAAe,cAAA,EACf;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,IAAK,IAA0B,IAAA,KAAS,QAAA,EAAU,OAAO,IAAI,kBAAkB,IAAI,CAAA;AAGnF,IAAA,OAAO,IAAI,eAAA,CAAgB,IAAA,EAAM,GAAG,CAAA;AAAA,EACtC;AACF","file":"index.cjs","sourcesContent":["/**\n * Filesystem backend protocol — a pluggable file *storage* provider for agent\n * tools, the storage-side twin of {@link SandboxBackend} (execution-side).\n *\n * SE31 (a peer framework Workspaces comparison). Mirrors `SandboxBackend`'s shape: a small\n * set of abstract methods (`readFile` / `writeFile` / `stat` / `list`) with\n * `exists()` derived on the base class, a boundary `basePath`, a `readOnly`\n * flag, and typed errors. Unlike `SandboxBackend` (whose file ops shell out via\n * `execute`, requiring command execution and giving NO structured `stat`), a\n * `FilesystemBackend` serves a *filesystem-only* workspace with no sandbox and\n * exposes a real `stat().mtimeMs` — the primitive SE32's read-before-write\n * safety compares against. See ADR 0011.\n *\n * New backends (S3, GCS, in-memory) implement the four abstract methods; higher\n * level helpers derive on the base. This is the backend *seam* — it does NOT\n * ship agent-facing tools nor a bundled workspace (bring-your-own-tools stands).\n *\n * @public\n */\n\n/** Structured file metadata. `mtimeMs` is the read-before-write oracle (SE32). */\nexport interface FileStat {\n  readonly size: number;\n  readonly mtimeMs: number;\n  readonly isFile: boolean;\n  readonly isDirectory: boolean;\n}\n\n/** Options a write may carry. SE32 adds `expectedMtime` (stale-write guard). */\nexport interface WriteFileOptions {\n  /**\n   * SE32 — when set, the write fails with {@link StaleFileError} if the file's\n   * current `mtimeMs` differs (someone changed it since it was last read).\n   */\n  readonly expectedMtime?: number;\n}\n\n/**\n * Construction options shared by every {@link FilesystemBackend}.\n *\n * `basePath` is resolved ONCE, at construction, and defaults to `process.cwd()`. Omitting it does\n * not mean \"no boundary\" — it means the boundary is wherever the process happened to be standing,\n * which is rarely what the caller intended and never what a reviewer can verify. Pass it explicitly.\n *\n * The boundary rejects lexical traversal AND symlink escape, raising\n * {@link FilesystemSecurityError}. It is a boundary, not a sandbox: it constrains paths this\n * backend resolves, and constrains nothing else the process can do. For untrusted code, run it in a\n * container or VM.\n */\nexport interface FilesystemConfig {\n  /** Boundary root. Every path is resolved within it; escapes are rejected. */\n  readonly basePath?: string;\n  /** When true, every write throws {@link FilesystemReadOnlyError}. */\n  readonly readOnly?: boolean;\n}\n\n/** A path escaped the backend's `basePath` (traversal or symlink). */\nexport class FilesystemSecurityError extends Error {\n  readonly code = \"filesystem_security\" as const;\n  constructor(message: string) {\n    super(message);\n    this.name = \"FilesystemSecurityError\";\n  }\n}\n\n/** A write was attempted on a read-only backend. */\nexport class FilesystemReadOnlyError extends Error {\n  readonly code = \"filesystem_readonly\" as const;\n  constructor(message: string) {\n    super(message);\n    this.name = \"FilesystemReadOnlyError\";\n  }\n}\n\n/** A read/stat targeted a path that does not exist. */\nexport class FileNotFoundError extends Error {\n  readonly code = \"filesystem_not_found\" as const;\n  constructor(public readonly path: string) {\n    super(`File not found: ${path}`);\n    this.name = \"FileNotFoundError\";\n  }\n}\n\n/**\n * A filesystem I/O operation failed for a reason other than not-found /\n * read-only / stale / security (e.g. `ENOTDIR` — a path component is a file, or\n * `EACCES` / `ENOSPC`). Carries the original error as `cause` so no raw,\n * untyped Node `SystemError` ever escapes the backend (Unbreakable Rule 8).\n */\nexport class FilesystemError extends Error {\n  readonly code = \"filesystem_io\" as const;\n  constructor(\n    public readonly path: string,\n    cause: unknown,\n  ) {\n    super(\n      `Filesystem operation failed on \"${path}\": ${(cause as { message?: string })?.message ?? cause}`,\n      {\n        cause,\n      },\n    );\n    this.name = \"FilesystemError\";\n  }\n}\n\n/**\n * SE32 — a write's `expectedMtime` did not match the file's current mtime: the\n * file changed since it was last read, so the write would silently clobber.\n */\nexport class StaleFileError extends Error {\n  readonly code = \"filesystem_stale\" as const;\n  constructor(\n    public readonly path: string,\n    public readonly expectedMtime: number,\n    public readonly actualMtime: number,\n  ) {\n    super(\n      `Stale write to \"${path}\": expected mtime ${expectedMtime}, found ${actualMtime} ` +\n        `(file changed since last read — re-read before writing)`,\n    );\n    this.name = \"StaleFileError\";\n  }\n}\n\n/**\n * Pluggable filesystem backend. Implement the four abstract methods; `exists()`\n * and the `readOnly`/`basePath` accessors derive on the base class.\n *\n * @public\n */\nexport abstract class FilesystemBackend {\n  protected readonly _basePath: string;\n  protected readonly _readOnly: boolean;\n\n  constructor(config: FilesystemConfig = {}) {\n    this._basePath = config.basePath ?? process.cwd();\n    this._readOnly = config.readOnly ?? false;\n  }\n\n  /** Read a boundary-relative file as UTF-8. Throws {@link FileNotFoundError}. */\n  abstract readFile(path: string): Promise<string>;\n\n  /**\n   * Write UTF-8 content to a boundary-relative path (creating parents). Returns\n   * the new {@link FileStat}. Throws {@link FilesystemReadOnlyError} on a\n   * read-only backend and {@link StaleFileError} when `opts.expectedMtime`\n   * mismatches (SE32).\n   */\n  abstract writeFile(path: string, content: string, opts?: WriteFileOptions): Promise<FileStat>;\n\n  /** Structured metadata for a path. Throws {@link FileNotFoundError}. */\n  abstract stat(path: string): Promise<FileStat>;\n\n  /** Directory entry names (not recursive). Throws {@link FileNotFoundError}. */\n  abstract list(path: string): Promise<string[]>;\n\n  /** Derived — true iff `stat(path)` resolves (absent ⇒ false). */\n  async exists(path: string): Promise<boolean> {\n    try {\n      await this.stat(path);\n      return true;\n    } catch (err) {\n      if (err instanceof FileNotFoundError) return false;\n      throw err;\n    }\n  }\n\n  /** Throw {@link FilesystemReadOnlyError} when the backend is read-only. */\n  protected assertWritable(): void {\n    if (this._readOnly) {\n      throw new FilesystemReadOnlyError(`Filesystem is read-only (basePath: ${this._basePath})`);\n    }\n  }\n\n  get readOnly(): boolean {\n    return this._readOnly;\n  }\n\n  get basePath(): string {\n    return this._basePath;\n  }\n}\n\n/**\n * A backend OR a per-request resolver of one. A resolver runs at tool-execution\n * time (the request scope), so multi-tenant / multi-role agents get a distinct\n * root or permission set per request without a shared mutable backend.\n *\n * @public\n */\nexport type FilesystemProvider<Ctx = unknown> =\n  | FilesystemBackend\n  | ((ctx: Ctx) => FilesystemBackend | Promise<FilesystemBackend>);\n\n/** Resolve a {@link FilesystemProvider} to a concrete backend for `ctx`. */\nexport async function resolveFilesystem<Ctx>(\n  provider: FilesystemProvider<Ctx>,\n  ctx: Ctx,\n): Promise<FilesystemBackend> {\n  return provider instanceof FilesystemBackend ? provider : provider(ctx);\n}\n","/**\n * LocalFilesystem — a {@link FilesystemBackend} over the local process\n * filesystem (`node:fs/promises`), boundary-enforced against `basePath`.\n *\n * **This is NOT an isolation boundary** (same OS, same user). Its safety\n * affordances are path-boundary enforcement (traversal + symlink escape,\n * reusing the core `internal/security/path-guard` primitives) and the optional\n * `readOnly` flag. For untrusted code, run it inside a container/VM sandbox.\n *\n * The check-then-use gap between `assertNoSymlinkEscape` and the subsequent\n * `fs` call is a known TOCTOU: a local attacker could atomically swap an\n * in-boundary symlink after the check. Closing it needs `O_NOFOLLOW`, which\n * Node's `fs/promises` does not expose — accepted for same-user local contexts.\n *\n * SE31 (a peer framework Workspaces comparison). See ADR 0011.\n *\n * @public\n */\n\nimport {\n  readFile as fsReadFile,\n  stat as fsStat,\n  writeFile as fsWriteFile,\n  mkdir,\n  readdir,\n} from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nimport {\n  assertNoSymlinkEscape,\n  PathTraversalError,\n  safePathJoin,\n} from \"../internal/security/path-guard.js\";\nimport {\n  FileNotFoundError,\n  type FileStat,\n  FilesystemBackend,\n  type FilesystemConfig,\n  FilesystemError,\n  FilesystemSecurityError,\n  StaleFileError,\n  type WriteFileOptions,\n} from \"./types.js\";\n\n/**\n * {@link FilesystemBackend} over the real filesystem (`node:fs/promises`), with every path resolved\n * inside `basePath` and escapes rejected.\n *\n * ```ts\n * const fs = new LocalFilesystem({ basePath: \"/srv/workspace\", readOnly: false });\n * await fs.writeFile(\"notes/today.md\", \"hello\");   // /srv/workspace/notes/today.md\n * await fs.readFile(\"../../etc/passwd\");           // FilesystemSecurityError\n * ```\n *\n * Two things a caller gets wrong. First, the default `basePath` is `process.cwd()` — see\n * {@link FilesystemConfig}. Second, the security boundary is checked BEFORE the read-only flag, on\n * purpose: a traversal path against a read-only backend reports the security error, not the\n * read-only one, so the more serious condition is the one you see.\n *\n * Errors are normalised — a missing file, a stale `expectedMtime`, a boundary escape and a write to\n * a read-only backend each raise their own typed error rather than a raw `ENOENT`-shaped one.\n */\nexport class LocalFilesystem extends FilesystemBackend {\n  constructor(config: FilesystemConfig = {}) {\n    super(config);\n  }\n\n  async readFile(path: string): Promise<string> {\n    const abs = this.resolve(path);\n    try {\n      return await fsReadFile(abs, \"utf-8\");\n    } catch (err) {\n      throw this.mapError(err, path);\n    }\n  }\n\n  async writeFile(path: string, content: string, opts?: WriteFileOptions): Promise<FileStat> {\n    // Security boundary FIRST (a traversal path on a read-only backend must\n    // report the security error, not the read-only one — fail-clear).\n    const abs = this.resolve(path);\n    this.assertWritable();\n    // SE32 — stale-write guard: if the caller passed the mtime it last read,\n    // reject when the file changed underneath it (never a silent clobber).\n    if (opts?.expectedMtime !== undefined) {\n      await this.assertNotStale(path, abs, opts.expectedMtime);\n    }\n    try {\n      await mkdir(dirname(abs), { recursive: true });\n      await fsWriteFile(abs, content, \"utf-8\");\n    } catch (err) {\n      throw this.mapError(err, path);\n    }\n    return this.statAbs(abs, path);\n  }\n\n  async stat(path: string): Promise<FileStat> {\n    const abs = this.resolve(path);\n    return this.statAbs(abs, path);\n  }\n\n  async list(path: string): Promise<string[]> {\n    const abs = this.resolve(path);\n    try {\n      return await readdir(abs);\n    } catch (err) {\n      throw this.mapError(err, path);\n    }\n  }\n\n  private async statAbs(abs: string, relPath: string): Promise<FileStat> {\n    try {\n      const s = await fsStat(abs);\n      return {\n        size: s.size,\n        mtimeMs: s.mtimeMs,\n        isFile: s.isFile(),\n        isDirectory: s.isDirectory(),\n      };\n    } catch (err) {\n      throw this.mapError(err, relPath);\n    }\n  }\n\n  /** SE32 — compare the on-disk mtime against the caller's expected value. */\n  private async assertNotStale(relPath: string, abs: string, expectedMtime: number): Promise<void> {\n    let current: number | undefined;\n    try {\n      current = (await fsStat(abs)).mtimeMs;\n    } catch (err) {\n      // A brand-new file (does not exist yet) cannot be stale — allow the write.\n      if ((err as { code?: string }).code === \"ENOENT\") return;\n      throw this.mapError(err, relPath);\n    }\n    if (current !== expectedMtime) {\n      throw new StaleFileError(relPath, expectedMtime, current);\n    }\n  }\n\n  /**\n   * Resolve a boundary-relative path to an absolute one, rejecting lexical\n   * traversal (`..`, absolute, NUL) and symlink escape — both reusing the core\n   * path-guard primitives, remapped to {@link FilesystemSecurityError}.\n   */\n  private resolve(path: string): string {\n    let abs: string;\n    try {\n      abs = safePathJoin(this._basePath, path);\n    } catch (err) {\n      if (err instanceof PathTraversalError) {\n        throw new FilesystemSecurityError(`Path escapes basePath: ${path}`);\n      }\n      throw err;\n    }\n    try {\n      assertNoSymlinkEscape(abs, this._basePath);\n    } catch (err) {\n      if (err instanceof PathTraversalError) {\n        throw new FilesystemSecurityError(`Path escapes basePath via symlink: ${path}`);\n      }\n      throw err;\n    }\n    return abs;\n  }\n\n  private mapError(err: unknown, path: string): Error {\n    if (\n      err instanceof FilesystemSecurityError ||\n      err instanceof FilesystemError ||\n      err instanceof FileNotFoundError ||\n      err instanceof StaleFileError\n    ) {\n      return err;\n    }\n    if ((err as { code?: string }).code === \"ENOENT\") return new FileNotFoundError(path);\n    // ENOTDIR (a path component is a file), EACCES, ENOSPC, … — never leak a\n    // raw untyped Node SystemError (Rule 8); wrap with the original as cause.\n    return new FilesystemError(path, err);\n  }\n}\n"]}
+{"version":3,"sources":["../../src/filesystem/types.ts","../../src/filesystem/local-filesystem.ts"],"names":["TheokitAgentError","fsReadFile","path","mkdir","dirname","fsWriteFile","readdir","fsStat","safePathJoin","PathTraversalError","assertNoSymlinkEscape"],"mappings":";;;;;;;;;;AA0DO,IAAM,uBAAA,GAAN,cAAsCA,mCAAA,CAAkB;AAAA,EAC3C,IAAA,GAAO,yBAAA;AAAA,EACP,IAAA,GAAO,qBAAA;AAAA,EACzB,YAAY,OAAA,EAAiB;AAE3B,IAAA,KAAA,CAAM,SAAS,EAAE,IAAA,EAAM,qBAAA,EAAuB,WAAA,EAAa,OAAO,CAAA;AAAA,EACpE;AACF;AAGO,IAAM,uBAAA,GAAN,cAAsCA,mCAAA,CAAkB;AAAA,EAC3C,IAAA,GAAO,yBAAA;AAAA,EACP,IAAA,GAAO,qBAAA;AAAA,EACzB,YAAY,OAAA,EAAiB;AAE3B,IAAA,KAAA,CAAM,SAAS,EAAE,IAAA,EAAM,qBAAA,EAAuB,WAAA,EAAa,OAAO,CAAA;AAAA,EACpE;AACF;AAGO,IAAM,iBAAA,GAAN,cAAgCA,mCAAA,CAAkB;AAAA,EAGvD,YAA4B,IAAA,EAAc;AAExC,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,IAAI,CAAA,CAAA,EAAI,EAAE,MAAM,sBAAA,EAAwB,WAAA,EAAa,OAAO,CAAA;AAF3D,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAG5B;AAAA,EAH4B,IAAA;AAAA,EAFV,IAAA,GAAO,mBAAA;AAAA,EACP,IAAA,GAAO,sBAAA;AAK3B;AAQO,IAAM,eAAA,GAAN,cAA8BA,mCAAA,CAAkB;AAAA,EAGrD,WAAA,CACkB,MAChB,KAAA,EACA;AAEA,IAAA,KAAA;AAAA,MACE,CAAA,gCAAA,EAAmC,IAAI,CAAA,GAAA,EAAO,KAAA,EAAgC,WAAW,KAAK,CAAA,CAAA;AAAA,MAC9F,EAAE,KAAA,EAAO,IAAA,EAAM,eAAA,EAAiB,aAAa,IAAA;AAAK,KACpD;AAPgB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AAAA,EAQlB;AAAA,EARkB,IAAA;AAAA,EAHA,IAAA,GAAO,iBAAA;AAAA,EACP,IAAA,GAAO,eAAA;AAW3B;AAMO,IAAM,cAAA,GAAN,cAA6BA,mCAAA,CAAkB;AAAA,EAGpD,WAAA,CACkB,IAAA,EACA,aAAA,EACA,WAAA,EAChB;AAEA,IAAA,KAAA;AAAA,MACE,CAAA,gBAAA,EAAmB,IAAI,CAAA,kBAAA,EAAqB,aAAa,WAAW,WAAW,CAAA,6DAAA,CAAA;AAAA,MAE/E,EAAE,IAAA,EAAM,kBAAA,EAAoB,WAAA,EAAa,KAAA;AAAM,KACjD;AATgB,IAAA,IAAA,CAAA,IAAA,GAAA,IAAA;AACA,IAAA,IAAA,CAAA,aAAA,GAAA,aAAA;AACA,IAAA,IAAA,CAAA,WAAA,GAAA,WAAA;AAAA,EAQlB;AAAA,EAVkB,IAAA;AAAA,EACA,aAAA;AAAA,EACA,WAAA;AAAA,EALA,IAAA,GAAO,gBAAA;AAAA,EACP,IAAA,GAAO,kBAAA;AAa3B;AAQO,IAAe,oBAAf,MAAiC;AAAA,EACnB,SAAA;AAAA,EACA,SAAA;AAAA,EAEnB,WAAA,CAAY,MAAA,GAA2B,EAAC,EAAG;AACzC,IAAA,IAAA,CAAK,SAAA,GAAY,MAAA,CAAO,QAAA,IAAY,OAAA,CAAQ,GAAA,EAAI;AAChD,IAAA,IAAA,CAAK,SAAA,GAAY,OAAO,QAAA,IAAY,KAAA;AAAA,EACtC;AAAA;AAAA,EAoBA,MAAM,OAAO,IAAA,EAAgC;AAC3C,IAAA,IAAI;AACF,MAAA,MAAM,IAAA,CAAK,KAAK,IAAI,CAAA;AACpB,MAAA,OAAO,IAAA;AAAA,IACT,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,GAAA,YAAe,mBAAmB,OAAO,KAAA;AAC7C,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGU,cAAA,GAAuB;AAC/B,IAAA,IAAI,KAAK,SAAA,EAAW;AAClB,MAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,mCAAA,EAAsC,IAAA,CAAK,SAAS,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3F;AAAA,EACF;AAAA,EAEA,IAAI,QAAA,GAAoB;AACtB,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AAAA,EAEA,IAAI,QAAA,GAAmB;AACrB,IAAA,OAAO,IAAA,CAAK,SAAA;AAAA,EACd;AACF;AAcA,eAAsB,iBAAA,CACpB,UACA,GAAA,EAC4B;AAC5B,EAAA,OAAO,QAAA,YAAoB,iBAAA,GAAoB,QAAA,GAAW,QAAA,CAAS,GAAG,CAAA;AACxE;;;AC/IO,IAAM,eAAA,GAAN,cAA8B,iBAAA,CAAkB;AAAA,EACrD,WAAA,CAAY,MAAA,GAA2B,EAAC,EAAG;AACzC,IAAA,KAAA,CAAM,MAAM,CAAA;AAAA,EACd;AAAA,EAEA,MAAM,SAAS,IAAA,EAA+B;AAC5C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI;AACF,MAAA,OAAO,MAAMC,iBAAA,CAAW,GAAA,EAAK,OAAO,CAAA;AAAA,IACtC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,MAAM,SAAA,CAAUC,MAAA,EAAc,OAAA,EAAiB,IAAA,EAA4C;AAGzF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQA,MAAI,CAAA;AAC7B,IAAA,IAAA,CAAK,cAAA,EAAe;AAGpB,IAAA,IAAI,IAAA,EAAM,kBAAkB,MAAA,EAAW;AACrC,MAAA,MAAM,IAAA,CAAK,cAAA,CAAeA,MAAA,EAAM,GAAA,EAAK,KAAK,aAAa,CAAA;AAAA,IACzD;AACA,IAAA,IAAI;AACF,MAAA,MAAMC,eAAMC,YAAA,CAAQ,GAAG,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC7C,MAAA,MAAMC,kBAAA,CAAY,GAAA,EAAK,OAAA,EAAS,OAAO,CAAA;AAAA,IACzC,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAKH,MAAI,CAAA;AAAA,IAC/B;AACA,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAKA,MAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,KAAK,IAAA,EAAiC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,OAAO,IAAA,CAAK,OAAA,CAAQ,GAAA,EAAK,IAAI,CAAA;AAAA,EAC/B;AAAA,EAEA,MAAM,KAAK,IAAA,EAAiC;AAC1C,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,CAAQ,IAAI,CAAA;AAC7B,IAAA,IAAI;AACF,MAAA,OAAO,MAAMI,iBAAQ,GAAG,CAAA;AAAA,IAC1B,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,IAAI,CAAA;AAAA,IAC/B;AAAA,EACF;AAAA,EAEA,MAAc,OAAA,CAAQ,GAAA,EAAa,OAAA,EAAoC;AACrE,IAAA,IAAI;AACF,MAAA,MAAM,CAAA,GAAI,MAAMC,aAAA,CAAO,GAAG,CAAA;AAC1B,MAAA,OAAO;AAAA,QACL,MAAM,CAAA,CAAE,IAAA;AAAA,QACR,SAAS,CAAA,CAAE,OAAA;AAAA,QACX,MAAA,EAAQ,EAAE,MAAA,EAAO;AAAA,QACjB,WAAA,EAAa,EAAE,WAAA;AAAY,OAC7B;AAAA,IACF,SAAS,GAAA,EAAK;AACZ,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,OAAO,CAAA;AAAA,IAClC;AAAA,EACF;AAAA;AAAA,EAGA,MAAc,cAAA,CAAe,OAAA,EAAiB,GAAA,EAAa,aAAA,EAAsC;AAC/F,IAAA,IAAI,OAAA;AACJ,IAAA,IAAI;AACF,MAAA,OAAA,GAAA,CAAW,MAAMA,aAAA,CAAO,GAAG,CAAA,EAAG,OAAA;AAAA,IAChC,SAAS,GAAA,EAAK;AAEZ,MAAA,IAAK,GAAA,CAA0B,SAAS,QAAA,EAAU;AAClD,MAAA,MAAM,IAAA,CAAK,QAAA,CAAS,GAAA,EAAK,OAAO,CAAA;AAAA,IAClC;AACA,IAAA,IAAI,YAAY,aAAA,EAAe;AAC7B,MAAA,MAAM,IAAI,cAAA,CAAe,OAAA,EAAS,aAAA,EAAe,OAAO,CAAA;AAAA,IAC1D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,QAAQ,IAAA,EAAsB;AACpC,IAAA,IAAI,GAAA;AACJ,IAAA,IAAI;AACF,MAAA,GAAA,GAAMC,8BAAA,CAAa,IAAA,CAAK,SAAA,EAAW,IAAI,CAAA;AAAA,IACzC,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAeC,oCAAA,EAAoB;AACrC,QAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,uBAAA,EAA0B,IAAI,CAAA,CAAE,CAAA;AAAA,MACpE;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,IAAI;AACF,MAAAC,uCAAA,CAAsB,GAAA,EAAK,KAAK,SAAS,CAAA;AAAA,IAC3C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,eAAeD,oCAAA,EAAoB;AACrC,QAAA,MAAM,IAAI,uBAAA,CAAwB,CAAA,mCAAA,EAAsC,IAAI,CAAA,CAAE,CAAA;AAAA,MAChF;AACA,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,OAAO,GAAA;AAAA,EACT;AAAA,EAEQ,QAAA,CAAS,KAAc,IAAA,EAAqB;AAClD,IAAA,IACE,eAAe,uBAAA,IACf,GAAA,YAAe,mBACf,GAAA,YAAe,iBAAA,IACf,eAAe,cAAA,EACf;AACA,MAAA,OAAO,GAAA;AAAA,IACT;AACA,IAAA,IAAK,IAA0B,IAAA,KAAS,QAAA,EAAU,OAAO,IAAI,kBAAkB,IAAI,CAAA;AAGnF,IAAA,OAAO,IAAI,eAAA,CAAgB,IAAA,EAAM,GAAG,CAAA;AAAA,EACtC;AACF","file":"index.cjs","sourcesContent":["/**\n * Filesystem backend protocol — a pluggable file *storage* provider for agent\n * tools, the storage-side twin of {@link SandboxBackend} (execution-side).\n *\n * SE31 (a peer framework Workspaces comparison). Mirrors `SandboxBackend`'s shape: a small\n * set of abstract methods (`readFile` / `writeFile` / `stat` / `list`) with\n * `exists()` derived on the base class, a boundary `basePath`, a `readOnly`\n * flag, and typed errors. Unlike `SandboxBackend` (whose file ops shell out via\n * `execute`, requiring command execution and giving NO structured `stat`), a\n * `FilesystemBackend` serves a *filesystem-only* workspace with no sandbox and\n * exposes a real `stat().mtimeMs` — the primitive SE32's read-before-write\n * safety compares against. See ADR 0011.\n *\n * New backends (S3, GCS, in-memory) implement the four abstract methods; higher\n * level helpers derive on the base. This is the backend *seam* — it does NOT\n * ship agent-facing tools nor a bundled workspace (bring-your-own-tools stands).\n *\n * @public\n */\n\nimport { TheokitAgentError } from \"../errors.js\";\n/** Structured file metadata. `mtimeMs` is the read-before-write oracle (SE32). */\nexport interface FileStat {\n  readonly size: number;\n  readonly mtimeMs: number;\n  readonly isFile: boolean;\n  readonly isDirectory: boolean;\n}\n\n/** Options a write may carry. SE32 adds `expectedMtime` (stale-write guard). */\nexport interface WriteFileOptions {\n  /**\n   * SE32 — when set, the write fails with {@link StaleFileError} if the file's\n   * current `mtimeMs` differs (someone changed it since it was last read).\n   */\n  readonly expectedMtime?: number;\n}\n\n/**\n * Construction options shared by every {@link FilesystemBackend}.\n *\n * `basePath` is resolved ONCE, at construction, and defaults to `process.cwd()`. Omitting it does\n * not mean \"no boundary\" — it means the boundary is wherever the process happened to be standing,\n * which is rarely what the caller intended and never what a reviewer can verify. Pass it explicitly.\n *\n * The boundary rejects lexical traversal AND symlink escape, raising\n * {@link FilesystemSecurityError}. It is a boundary, not a sandbox: it constrains paths this\n * backend resolves, and constrains nothing else the process can do. For untrusted code, run it in a\n * container or VM.\n */\nexport interface FilesystemConfig {\n  /** Boundary root. Every path is resolved within it; escapes are rejected. */\n  readonly basePath?: string;\n  /** When true, every write throws {@link FilesystemReadOnlyError}. */\n  readonly readOnly?: boolean;\n}\n\n/** A path escaped the backend's `basePath` (traversal or symlink). */\nexport class FilesystemSecurityError extends TheokitAgentError {\n  override readonly name = \"FilesystemSecurityError\";\n  override readonly code = \"filesystem_security\" as const;\n  constructor(message: string) {\n    // not retryable: a path outside the root stays outside it\n    super(message, { code: \"filesystem_security\", isRetryable: false });\n  }\n}\n\n/** A write was attempted on a read-only backend. */\nexport class FilesystemReadOnlyError extends TheokitAgentError {\n  override readonly name = \"FilesystemReadOnlyError\";\n  override readonly code = \"filesystem_readonly\" as const;\n  constructor(message: string) {\n    // not retryable: the backend does not become writable\n    super(message, { code: \"filesystem_readonly\", isRetryable: false });\n  }\n}\n\n/** A read/stat targeted a path that does not exist. */\nexport class FileNotFoundError extends TheokitAgentError {\n  override readonly name = \"FileNotFoundError\";\n  override readonly code = \"filesystem_not_found\" as const;\n  constructor(public readonly path: string) {\n    // not retryable: a missing file is a fact about the request, not a transient condition\n    super(`File not found: ${path}`, { code: \"filesystem_not_found\", isRetryable: false });\n  }\n}\n\n/**\n * A filesystem I/O operation failed for a reason other than not-found /\n * read-only / stale / security (e.g. `ENOTDIR` — a path component is a file, or\n * `EACCES` / `ENOSPC`). Carries the original error as `cause` so no raw,\n * untyped Node `SystemError` ever escapes the backend (Unbreakable Rule 8).\n */\nexport class FilesystemError extends TheokitAgentError {\n  override readonly name = \"FilesystemError\";\n  override readonly code = \"filesystem_io\" as const;\n  constructor(\n    public readonly path: string,\n    cause: unknown,\n  ) {\n    // retryable: a lower-level I/O failure CAN be transient — EBUSY, EAGAIN, a full disk that frees\n    super(\n      `Filesystem operation failed on \"${path}\": ${(cause as { message?: string })?.message ?? cause}`,\n      { cause, code: \"filesystem_io\", isRetryable: true },\n    );\n  }\n}\n\n/**\n * SE32 — a write's `expectedMtime` did not match the file's current mtime: the\n * file changed since it was last read, so the write would silently clobber.\n */\nexport class StaleFileError extends TheokitAgentError {\n  override readonly name = \"StaleFileError\";\n  override readonly code = \"filesystem_stale\" as const;\n  constructor(\n    public readonly path: string,\n    public readonly expectedMtime: number,\n    public readonly actualMtime: number,\n  ) {\n    // not retryable: the caller must re-read first; retrying the same write reproduces the conflict\n    super(\n      `Stale write to \"${path}\": expected mtime ${expectedMtime}, found ${actualMtime} ` +\n        `(file changed since last read — re-read before writing)`,\n      { code: \"filesystem_stale\", isRetryable: false },\n    );\n  }\n}\n\n/**\n * Pluggable filesystem backend. Implement the four abstract methods; `exists()`\n * and the `readOnly`/`basePath` accessors derive on the base class.\n *\n * @public\n */\nexport abstract class FilesystemBackend {\n  protected readonly _basePath: string;\n  protected readonly _readOnly: boolean;\n\n  constructor(config: FilesystemConfig = {}) {\n    this._basePath = config.basePath ?? process.cwd();\n    this._readOnly = config.readOnly ?? false;\n  }\n\n  /** Read a boundary-relative file as UTF-8. Throws {@link FileNotFoundError}. */\n  abstract readFile(path: string): Promise<string>;\n\n  /**\n   * Write UTF-8 content to a boundary-relative path (creating parents). Returns\n   * the new {@link FileStat}. Throws {@link FilesystemReadOnlyError} on a\n   * read-only backend and {@link StaleFileError} when `opts.expectedMtime`\n   * mismatches (SE32).\n   */\n  abstract writeFile(path: string, content: string, opts?: WriteFileOptions): Promise<FileStat>;\n\n  /** Structured metadata for a path. Throws {@link FileNotFoundError}. */\n  abstract stat(path: string): Promise<FileStat>;\n\n  /** Directory entry names (not recursive). Throws {@link FileNotFoundError}. */\n  abstract list(path: string): Promise<string[]>;\n\n  /** Derived — true iff `stat(path)` resolves (absent ⇒ false). */\n  async exists(path: string): Promise<boolean> {\n    try {\n      await this.stat(path);\n      return true;\n    } catch (err) {\n      if (err instanceof FileNotFoundError) return false;\n      throw err;\n    }\n  }\n\n  /** Throw {@link FilesystemReadOnlyError} when the backend is read-only. */\n  protected assertWritable(): void {\n    if (this._readOnly) {\n      throw new FilesystemReadOnlyError(`Filesystem is read-only (basePath: ${this._basePath})`);\n    }\n  }\n\n  get readOnly(): boolean {\n    return this._readOnly;\n  }\n\n  get basePath(): string {\n    return this._basePath;\n  }\n}\n\n/**\n * A backend OR a per-request resolver of one. A resolver runs at tool-execution\n * time (the request scope), so multi-tenant / multi-role agents get a distinct\n * root or permission set per request without a shared mutable backend.\n *\n * @public\n */\nexport type FilesystemProvider<Ctx = unknown> =\n  | FilesystemBackend\n  | ((ctx: Ctx) => FilesystemBackend | Promise<FilesystemBackend>);\n\n/** Resolve a {@link FilesystemProvider} to a concrete backend for `ctx`. */\nexport async function resolveFilesystem<Ctx>(\n  provider: FilesystemProvider<Ctx>,\n  ctx: Ctx,\n): Promise<FilesystemBackend> {\n  return provider instanceof FilesystemBackend ? provider : provider(ctx);\n}\n","/**\n * LocalFilesystem — a {@link FilesystemBackend} over the local process\n * filesystem (`node:fs/promises`), boundary-enforced against `basePath`.\n *\n * **This is NOT an isolation boundary** (same OS, same user). Its safety\n * affordances are path-boundary enforcement (traversal + symlink escape,\n * reusing the core `internal/security/path-guard` primitives) and the optional\n * `readOnly` flag. For untrusted code, run it inside a container/VM sandbox.\n *\n * The check-then-use gap between `assertNoSymlinkEscape` and the subsequent\n * `fs` call is a known TOCTOU: a local attacker could atomically swap an\n * in-boundary symlink after the check. Closing it needs `O_NOFOLLOW`, which\n * Node's `fs/promises` does not expose — accepted for same-user local contexts.\n *\n * SE31 (a peer framework Workspaces comparison). See ADR 0011.\n *\n * @public\n */\n\nimport {\n  readFile as fsReadFile,\n  stat as fsStat,\n  writeFile as fsWriteFile,\n  mkdir,\n  readdir,\n} from \"node:fs/promises\";\nimport { dirname } from \"node:path\";\n\nimport {\n  assertNoSymlinkEscape,\n  PathTraversalError,\n  safePathJoin,\n} from \"../internal/security/path-guard.js\";\nimport {\n  FileNotFoundError,\n  type FileStat,\n  FilesystemBackend,\n  type FilesystemConfig,\n  FilesystemError,\n  FilesystemSecurityError,\n  StaleFileError,\n  type WriteFileOptions,\n} from \"./types.js\";\n\n/**\n * {@link FilesystemBackend} over the real filesystem (`node:fs/promises`), with every path resolved\n * inside `basePath` and escapes rejected.\n *\n * ```ts\n * const fs = new LocalFilesystem({ basePath: \"/srv/workspace\", readOnly: false });\n * await fs.writeFile(\"notes/today.md\", \"hello\");   // /srv/workspace/notes/today.md\n * await fs.readFile(\"../../etc/passwd\");           // FilesystemSecurityError\n * ```\n *\n * Two things a caller gets wrong. First, the default `basePath` is `process.cwd()` — see\n * {@link FilesystemConfig}. Second, the security boundary is checked BEFORE the read-only flag, on\n * purpose: a traversal path against a read-only backend reports the security error, not the\n * read-only one, so the more serious condition is the one you see.\n *\n * Errors are normalised — a missing file, a stale `expectedMtime`, a boundary escape and a write to\n * a read-only backend each raise their own typed error rather than a raw `ENOENT`-shaped one.\n */\nexport class LocalFilesystem extends FilesystemBackend {\n  constructor(config: FilesystemConfig = {}) {\n    super(config);\n  }\n\n  async readFile(path: string): Promise<string> {\n    const abs = this.resolve(path);\n    try {\n      return await fsReadFile(abs, \"utf-8\");\n    } catch (err) {\n      throw this.mapError(err, path);\n    }\n  }\n\n  async writeFile(path: string, content: string, opts?: WriteFileOptions): Promise<FileStat> {\n    // Security boundary FIRST (a traversal path on a read-only backend must\n    // report the security error, not the read-only one — fail-clear).\n    const abs = this.resolve(path);\n    this.assertWritable();\n    // SE32 — stale-write guard: if the caller passed the mtime it last read,\n    // reject when the file changed underneath it (never a silent clobber).\n    if (opts?.expectedMtime !== undefined) {\n      await this.assertNotStale(path, abs, opts.expectedMtime);\n    }\n    try {\n      await mkdir(dirname(abs), { recursive: true });\n      await fsWriteFile(abs, content, \"utf-8\");\n    } catch (err) {\n      throw this.mapError(err, path);\n    }\n    return this.statAbs(abs, path);\n  }\n\n  async stat(path: string): Promise<FileStat> {\n    const abs = this.resolve(path);\n    return this.statAbs(abs, path);\n  }\n\n  async list(path: string): Promise<string[]> {\n    const abs = this.resolve(path);\n    try {\n      return await readdir(abs);\n    } catch (err) {\n      throw this.mapError(err, path);\n    }\n  }\n\n  private async statAbs(abs: string, relPath: string): Promise<FileStat> {\n    try {\n      const s = await fsStat(abs);\n      return {\n        size: s.size,\n        mtimeMs: s.mtimeMs,\n        isFile: s.isFile(),\n        isDirectory: s.isDirectory(),\n      };\n    } catch (err) {\n      throw this.mapError(err, relPath);\n    }\n  }\n\n  /** SE32 — compare the on-disk mtime against the caller's expected value. */\n  private async assertNotStale(relPath: string, abs: string, expectedMtime: number): Promise<void> {\n    let current: number | undefined;\n    try {\n      current = (await fsStat(abs)).mtimeMs;\n    } catch (err) {\n      // A brand-new file (does not exist yet) cannot be stale — allow the write.\n      if ((err as { code?: string }).code === \"ENOENT\") return;\n      throw this.mapError(err, relPath);\n    }\n    if (current !== expectedMtime) {\n      throw new StaleFileError(relPath, expectedMtime, current);\n    }\n  }\n\n  /**\n   * Resolve a boundary-relative path to an absolute one, rejecting lexical\n   * traversal (`..`, absolute, NUL) and symlink escape — both reusing the core\n   * path-guard primitives, remapped to {@link FilesystemSecurityError}.\n   */\n  private resolve(path: string): string {\n    let abs: string;\n    try {\n      abs = safePathJoin(this._basePath, path);\n    } catch (err) {\n      if (err instanceof PathTraversalError) {\n        throw new FilesystemSecurityError(`Path escapes basePath: ${path}`);\n      }\n      throw err;\n    }\n    try {\n      assertNoSymlinkEscape(abs, this._basePath);\n    } catch (err) {\n      if (err instanceof PathTraversalError) {\n        throw new FilesystemSecurityError(`Path escapes basePath via symlink: ${path}`);\n      }\n      throw err;\n    }\n    return abs;\n  }\n\n  private mapError(err: unknown, path: string): Error {\n    if (\n      err instanceof FilesystemSecurityError ||\n      err instanceof FilesystemError ||\n      err instanceof FileNotFoundError ||\n      err instanceof StaleFileError\n    ) {\n      return err;\n    }\n    if ((err as { code?: string }).code === \"ENOENT\") return new FileNotFoundError(path);\n    // ENOTDIR (a path component is a file), EACCES, ENOSPC, … — never leak a\n    // raw untyped Node SystemError (Rule 8); wrap with the original as cause.\n    return new FilesystemError(path, err);\n  }\n}\n"]}