@cef-ai/cli 2.9.1 → 3.0.0

package/dist/lib/eval-auth.test.js

@@ -1,192 +0,0 @@
-import { mkdtemp, readdir, readFile, rm, stat } from "node:fs/promises";
-import os from "node:os";
-import path from "node:path";
-import { afterEach, beforeEach, describe, expect, it } from "vitest";
-import { CREDENTIAL_REFRESH_MARGIN_MS, ddcTokenCannotOpenStore, fileCredentialCache, mintGatewayCredentials, mintedCredentials, resolveGatewayAccess, } from "./eval-auth.js";
-let dir;
-beforeEach(async () => {
-    dir = await mkdtemp(path.join(os.tmpdir(), "cef-eval-auth-"));
-});
-afterEach(async () => {
-    await rm(dir, { recursive: true, force: true });
-});
-const HOUR = 3600_000;
-/** A mint that hands out `k1`, `k2`, … each valid for an hour from `now()`. */
-function minter(now) {
-    let n = 0;
-    const mint = async () => {
-        n++;
-        return { accessKeyId: `k${n}`, secretAccessKey: `s${n}`, expiresAt: now() + HOUR };
-    };
-    return { mint, count: () => n };
-}
-describe("a minted credential", () => {
-    it("is reused while it has time left, and replaced before it expires", async () => {
-        let t = 0;
-        const m = minter(() => t);
-        const source = mintedCredentials({ mint: m.mint, now: () => t });
-        expect((await source.get()).accessKeyId).toBe("k1");
-        t = HOUR - CREDENTIAL_REFRESH_MARGIN_MS - 1;
-        expect((await source.get()).accessKeyId).toBe("k1");
-        // Inside the margin: a long run must not carry it to the gateway's 403.
-        t = HOUR - CREDENTIAL_REFRESH_MARGIN_MS + 1;
-        expect((await source.get()).accessKeyId).toBe("k2");
-        expect(m.count()).toBe(2);
-    });
-    it("is minted once for callers asking at the same time", async () => {
-        const m = minter(() => 0);
-        const source = mintedCredentials({ mint: m.mint, now: () => 0 });
-        const got = await Promise.all([source.get(), source.get(), source.get()]);
-        expect(got.map((c) => c.accessKeyId)).toEqual(["k1", "k1", "k1"]);
-        expect(m.count()).toBe(1);
-    });
-    it("is replaced after the gateway refused it", async () => {
-        const m = minter(() => 0);
-        const source = mintedCredentials({ mint: m.mint, now: () => 0 });
-        await source.get();
-        expect(await source.invalidate()).toBe(true);
-        expect((await source.get()).accessKeyId).toBe("k2");
-    });
-    it("is shared between commands through an owner-only cache file", async () => {
-        const file = path.join(dir, "nested", "creds.json");
-        const t = Date.now();
-        const m = minter(() => t);
-        const first = mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "gw|alice") });
-        expect((await first.get()).accessKeyId).toBe("k1");
-        // A second command: same gateway and wallet, no new mint.
-        const second = mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "gw|alice") });
-        expect((await second.get()).accessKeyId).toBe("k1");
-        expect(m.count()).toBe(1);
-        // Another wallet does not get alice's.
-        const other = mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "gw|bob") });
-        expect((await other.get()).accessKeyId).toBe("k2");
-        expect((await stat(file)).mode & 0o777).toBe(0o600);
-        // A refused credential leaves the cache, so the next command does not pick it up again.
-        await second.invalidate();
-        expect(Object.keys(JSON.parse(await readFile(file, "utf8")))).toEqual(["gw|bob"]);
-    });
-    it("keeps every entry when several commands write the cache at once", async () => {
-        const file = path.join(dir, "creds.json");
-        const expiresAt = Date.now() + HOUR;
-        const wallets = Array.from({ length: 8 }, (_, i) => `gw|w${i}`);
-        // Each write is a read-modify-write of the whole file; unserialised, they drop each other's entries.
-        await Promise.all(wallets.map((k) => fileCredentialCache(file, k).write({ accessKeyId: k, secretAccessKey: "s", expiresAt })));
-        expect(Object.keys(JSON.parse(await readFile(file, "utf8"))).sort()).toEqual(wallets);
-        expect((await stat(file)).mode & 0o777).toBe(0o600);
-        expect((await readdir(dir)).sort()).toEqual(["creds.json"]);
-    });
-    it("is not reused from the cache when it is about to expire", async () => {
-        const file = path.join(dir, "creds.json");
-        let t = Date.now();
-        const m = minter(() => t);
-        await mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "k") }).get();
-        t += HOUR - CREDENTIAL_REFRESH_MARGIN_MS + 1;
-        expect((await mintedCredentials({ mint: m.mint, now: () => t, cache: fileCredentialCache(file, "k") }).get()).accessKeyId).toBe("k2");
-    });
-});
-describe("resolving gateway access", () => {
-    const signer = { address: "5Alice" };
-    it("mints through the source and keeps the bucket the AS pubkey names", async () => {
-        let n = 0;
-        const access = await resolveGatewayAccess({ asPubkey: `0x${"ab".repeat(32)}`, endpoint: "https://gw.example/" }, signer, {
-            cacheFile: null,
-            mint: async () => ({ endpoint: "x", bucket: "x", accessKeyId: `k${++n}`, secretAccessKey: "s", expiresAt: Date.now() + HOUR }),
-        });
-        expect(access).toMatchObject({ endpoint: "https://gw.example", bucket: `as-${"ab".repeat(30)}` });
-        expect((await access.credentials.get()).accessKeyId).toBe("k1");
-        expect(n).toBe(1);
-    });
-    it("serves explicit keys as given, and cannot replace them", async () => {
-        const access = await resolveGatewayAccess({ accessKey: "AK", secret: "SK", bucket: "b", endpoint: "https://gw" });
-        expect(await access.credentials.get()).toEqual({ accessKeyId: "AK", secretAccessKey: "SK" });
-        expect(await access.credentials.invalidate()).toBe(false);
-    });
-    it.each([
-        [{ accessKey: "AK" }, /--access-key is set but --secret \(or \$CEF_EVAL_SECRET\) is not/],
-        [{ secret: "SK" }, /--secret is set but --access-key \(or \$CEF_EVAL_KEY\) is not/],
-    ])("refuses half of an explicit key pair instead of falling through to the wallet (%o)", async (half, error) => {
-        const saved = { key: process.env.CEF_EVAL_KEY, secret: process.env.CEF_EVAL_SECRET };
-        delete process.env.CEF_EVAL_KEY;
-        delete process.env.CEF_EVAL_SECRET;
-        try {
-            // A wallet is present, so without the check this would quietly mint and ignore the flag.
-            await expect(resolveGatewayAccess({ asPubkey: `0x${"ab".repeat(32)}`, endpoint: "https://gw", ...half }, signer, {
-                cacheFile: null,
-                mint: async () => ({ endpoint: "x", bucket: "x", accessKeyId: "minted", secretAccessKey: "s", expiresAt: Date.now() + HOUR }),
-            })).rejects.toThrow(error);
-        }
-        finally {
-            if (saved.key !== undefined)
-                process.env.CEF_EVAL_KEY = saved.key;
-            if (saved.secret !== undefined)
-                process.env.CEF_EVAL_SECRET = saved.secret;
-        }
-    });
-});
-describe("choosing a credential when $CEF_DDC_ACCESS_TOKEN is set", () => {
-    const ENV = ["CEF_DDC_ACCESS_TOKEN", "CEF_KEYSTORE", "CEF_SECRET_PHRASE", "CEF_EVAL_KEY", "CEF_EVAL_SECRET"];
-    const saved = {};
-    let registryToken = "";
-    beforeEach(async () => {
-        for (const k of ENV) {
-            saved[k] = process.env[k];
-            delete process.env[k];
-        }
-        // What ROC's Access tab mints for `cef push`: full access, one bucket, no subject.
-        const ddc = (await import("@cere-ddc-sdk/ddc-client"));
-        const owner = new ddc.UriSigner("//cef-eval-test-owner");
-        await owner.isReady();
-        registryToken = (await ddc.AuthToken.fullAccess({ bucketId: 4044n }).sign(owner)).toString();
-        process.env.CEF_DDC_ACCESS_TOKEN = registryToken;
-    });
-    afterEach(() => {
-        for (const k of ENV) {
-            if (saved[k] === undefined)
-                delete process.env[k];
-            else
-                process.env[k] = saved[k];
-        }
-    });
-    const AS = `0x${"cd".repeat(32)}`;
-    const neverMint = async () => { throw new Error("must not mint"); };
-    it("refuses the token alone, naming its bucket, the dataset bucket, and what to use instead", async () => {
-        const err = await resolveGatewayAccess({ asPubkey: AS, endpoint: "https://gw" }, undefined, { cacheFile: null, mint: neverMint })
-            .then(() => undefined, (e) => e);
-        expect(err?.message).toMatch(/\$CEF_DDC_ACCESS_TOKEN .*cannot open dataset storage/);
-        expect(err?.message).toContain("limited to DDC bucket 4044");
-        expect(err?.message).toContain("cannot be delegated");
-        expect(err?.message).toContain(`as-${"cd".repeat(30)}`);
-        expect(err?.message).toContain("--access-key/--secret");
-    });
-    it("uses explicit keys over the token", async () => {
-        const access = await resolveGatewayAccess({ asPubkey: AS, accessKey: "AK", secret: "SK", endpoint: "https://gw" });
-        expect(await access.credentials.get()).toEqual({ accessKeyId: "AK", secretAccessKey: "SK" });
-    });
-    it("mints with a wallet when one is given beside the token", async () => {
-        let minted = 0;
-        const access = await resolveGatewayAccess({ asPubkey: AS, endpoint: "https://gw" }, { address: "5Alice" }, {
-            cacheFile: null,
-            mint: async () => ({ endpoint: "x", bucket: "x", accessKeyId: `k${++minted}`, secretAccessKey: "s", expiresAt: Date.now() + HOUR }),
-        });
-        expect((await access.credentials.get()).accessKeyId).toBe("k1");
-    });
-    it("still explains a string that is not a token", () => {
-        expect(ddcTokenCannotOpenStore("not a token!", "as-x").message).toMatch(/cannot open dataset storage: datasets live in the S3 gateway bucket as-x/);
-    });
-});
-describe("minting at the credential cap", () => {
-    it("says what to do instead of surfacing the gateway's 400", async () => {
-        const { UriSigner } = (await import("@cere-ddc-sdk/ddc-client"));
-        const wallet = new UriSigner("//Alice", { type: "ed25519" });
-        await wallet.isReady();
-        const fetchImpl = (async (url) => {
-            if (String(url).endsWith("/auth/info")) {
-                return new Response(JSON.stringify({ gateway_public_key: "11".repeat(32) }), { status: 200 });
-            }
-            return new Response("credential limit reached", { status: 400 });
-        });
-        await expect(mintGatewayCredentials({ endpoint: "https://gw", asPubKey: "0x00", signer: wallet, fetchImpl }))
-            .rejects.toThrow(/already holds as many live S3 credentials as the gateway allows.*--access-key\/--secret/s);
-    });
-});
-//# sourceMappingURL=eval-auth.test.js.map

package/dist/lib/eval-auth.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"eval-auth.test.js","sourceRoot":"","sources":["../../src/lib/eval-auth.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAErE,OAAO,EACL,4BAA4B,EAC5B,uBAAuB,EACvB,mBAAmB,EACnB,sBAAsB,EACtB,iBAAiB,EACjB,oBAAoB,GAGrB,MAAM,gBAAgB,CAAC;AAExB,IAAI,GAAW,CAAC;AAChB,UAAU,CAAC,KAAK,IAAI,EAAE;IACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAChE,CAAC,CAAC,CAAC;AACH,SAAS,CAAC,KAAK,IAAI,EAAE;IACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AAClD,CAAC,CAAC,CAAC;AAEH,MAAM,IAAI,GAAG,QAAQ,CAAC;AAEtB,+EAA+E;AAC/E,SAAS,MAAM,CAAC,GAAiB;IAC/B,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,MAAM,IAAI,GAAG,KAAK,IAAgC,EAAE;QAClD,CAAC,EAAE,CAAC;QACJ,OAAO,EAAE,WAAW,EAAE,IAAI,CAAC,EAAE,EAAE,eAAe,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;IACrF,CAAC,CAAC;IACF,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,kEAAkE,EAAE,KAAK,IAAI,EAAE;QAChF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,CAAC,GAAG,IAAI,GAAG,4BAA4B,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,wEAAwE;QACxE,CAAC,GAAG,IAAI,GAAG,4BAA4B,GAAG,CAAC,CAAC;QAC5C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,KAAK,IAAI,EAAE;QAClE,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAClE,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0CAA0C,EAAE,KAAK,IAAI,EAAE;QACxD,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QACjE,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,KAAK,IAAI,EAAE;QAC3E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC9G,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,0DAA0D;QAC1D,MAAM,MAAM,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/G,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,uCAAuC;QACvC,MAAM,KAAK,GAAG,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC,CAAC;QAC5G,MAAM,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,wFAAwF;QACxF,MAAM,MAAM,CAAC,UAAU,EAAE,CAAC;QAC1B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACpF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC1C,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACpC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChE,qGAAqG;QACrG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAClC,mBAAmB,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;QAC5F,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QACtF,MAAM,CAAC,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,CAAC,CAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QAC1C,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACnB,MAAM,CAAC,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;QACrG,CAAC,IAAI,IAAI,GAAG,4BAA4B,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,CAAC,MAAM,iBAAiB,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxI,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAgB,CAAC;IAEnD,EAAE,CAAC,mEAAmE,EAAE,KAAK,IAAI,EAAE;QACjF,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,MAAM,GAAG,MAAM,oBAAoB,CACvC,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,qBAAqB,EAAE,EACrE,MAAM,EACN;YACE,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;SAC/H,CACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,aAAa,CAAC,EAAE,QAAQ,EAAE,oBAAoB,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC;QAClG,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QAClH,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7F,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,IAAI,CAAC;QACN,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,kEAAkE,CAAC;QACzF,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,+DAA+D,CAAC;KACpF,CAAC,CAAC,oFAAoF,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;QAC7G,MAAM,KAAK,GAAG,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC;QACrF,OAAO,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACnC,IAAI,CAAC;YACH,yFAAyF;YACzF,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,QAAQ,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,IAAI,EAAE,EAAE,MAAM,EAAE;gBAC/G,SAAS,EAAE,IAAI;gBACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,QAAQ,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;aAC9H,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC;YAClE,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,KAAK,CAAC,MAAM,CAAC;QAC7E,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,yDAAyD,EAAE,GAAG,EAAE;IACvE,MAAM,GAAG,GAAG,CAAC,sBAAsB,EAAE,cAAc,EAAE,mBAAmB,EAAE,cAAc,EAAE,iBAAiB,CAAU,CAAC;IACtH,MAAM,KAAK,GAAuC,EAAE,CAAC;IACrD,IAAI,aAAa,GAAG,EAAE,CAAC;IACvB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,KAAK,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YAC1B,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACxB,CAAC;QACD,mFAAmF;QACnF,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAGpD,CAAC;QACF,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;QACtB,aAAa,GAAG,CAAC,MAAM,GAAG,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;QAC7F,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,aAAa,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,SAAS,CAAC,GAAG,EAAE;QACb,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;;gBAC7C,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,EAAE,GAAG,KAAK,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,KAAK,IAAoB,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpF,EAAE,CAAC,yFAAyF,EAAE,KAAK,IAAI,EAAE;QACvG,MAAM,GAAG,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;aAC9H,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC,CAAU,EAAE,EAAE,CAAC,CAAU,CAAC,CAAC;QACrD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,OAAO,CAAC,sDAAsD,CAAC,CAAC;QACrF,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,4BAA4B,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,qBAAqB,CAAC,CAAC;QACtD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,uBAAuB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,KAAK,IAAI,EAAE;QACjD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,CAAC,CAAC;QACnH,MAAM,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,IAAI,MAAM,GAAG,CAAC,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAgB,EAAE;YACvH,SAAS,EAAE,IAAI;YACf,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;SACpI,CAAC,CAAC;QACH,MAAM,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,uBAAuB,CAAC,cAAc,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,0EAA0E,CAAC,CAAC;IACtJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,+BAA+B,EAAE,GAAG,EAAE;IAC7C,EAAE,CAAC,wDAAwD,EAAE,KAAK,IAAI,EAAE;QACtE,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAE9D,CAAC;QACF,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC7D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,MAAM,SAAS,GAAG,CAAC,KAAK,EAAE,GAAiB,EAAE,EAAE;YAC7C,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;gBACvC,OAAO,IAAI,QAAQ,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;YAChG,CAAC;YACD,OAAO,IAAI,QAAQ,CAAC,0BAA0B,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC;QACnE,CAAC,CAAiB,CAAC;QACnB,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,QAAQ,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC;aAC1G,OAAO,CAAC,OAAO,CAAC,0FAA0F,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/lib/eval-store.d.ts

@@ -1,62 +0,0 @@
-/**
- * S3-gateway-backed `EvalStore`.
- *
- * Datasets live on the S3 gateway, NOT on the DDC content gateway that
- * `cef push` writes to. ROC's own `agentServiceAccess/wellKnown.ts` states why
- * these cannot be the same path: "the content gateway cannot resolve S3 keys:
- * the S3 gateway addresses objects through its own Postgres key->CID index,
- * which the CDN knows nothing about." They are two systems with two key spaces,
- * which is also why `cef eval push` is its own command rather than a flag on
- * `cef push`.
- */
-import { S3Client } from "@aws-sdk/client-s3";
-import type { EvalStore } from "@cef-ai/eval";
-import type { CredentialSource } from "./eval-auth.js";
-export interface S3StoreOptions {
-    bucket: string;
-    client: S3Client;
-    /** Key prefix within the bucket. Defaults to none. */
-    root?: string;
-    /**
-     * The gateway refused `failed`'s credential (403): a client with a fresh
-     * one, or undefined when there is none. Each request is retried once.
-     */
-    renew?: (failed: S3Client) => Promise<S3Client | undefined>;
-}
-/** A refused credential: expired, revoked, or never valid. */
-export declare function isAuthFailure(err: unknown): boolean;
-export declare function s3Store(opts: S3StoreOptions): EvalStore;
-/**
- * Build an S3 client for a gateway endpoint. With a `CredentialSource` the
- * client asks it for a credential, carrying its expiry, so the SDK asks again
- * inside its refresh window (5 min before expiry) and the source mints anew.
- */
-export declare function gatewayClient(cfg: {
-    endpoint: string;
-    region?: string;
-} & ({
-    accessKeyId: string;
-    secretAccessKey: string;
-    sessionToken?: string;
-    credentials?: never;
-} | {
-    credentials: CredentialSource;
-})): S3Client;
-/**
- * The store `cef eval` uses: a gateway client over a credential source, and
- * on a 403 one fresh client per refused credential — concurrent requests that
- * fail together share it instead of minting one each.
- */
-export declare function gatewayStore(opts: {
-    endpoint: string;
-    bucket: string;
-    region?: string;
-    credentials: CredentialSource;
-    root?: string;
-    makeClient?: (cfg: {
-        endpoint: string;
-        region?: string;
-        credentials: CredentialSource;
-    }) => S3Client;
-}): EvalStore;
-//# sourceMappingURL=eval-store.d.ts.map

package/dist/lib/eval-store.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"eval-store.d.ts","sourceRoot":"","sources":["../../src/lib/eval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAML,QAAQ,EAET,MAAM,oBAAoB,CAAC;AAC5B,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAE9C,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAEvD,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,QAAQ,CAAC;IACjB,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,QAAQ,KAAK,OAAO,CAAC,QAAQ,GAAG,SAAS,CAAC,CAAC;CAC7D;AAED,8DAA8D;AAC9D,wBAAgB,aAAa,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAInD;AAuBD,wBAAgB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,SAAS,CA8NvD;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,CACA;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,KAAK,CAAA;CAAE,GAC5F;IAAE,WAAW,EAAE,gBAAgB,CAAA;CAAE,CACpC,GAAG,QAAQ,CA+CX;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,CAAC,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,gBAAgB,CAAA;KAAE,KAAK,QAAQ,CAAC;CACtG,GAAG,SAAS,CAwBZ"}

package/dist/lib/eval-store.js

@@ -1,334 +0,0 @@
-/**
- * S3-gateway-backed `EvalStore`.
- *
- * Datasets live on the S3 gateway, NOT on the DDC content gateway that
- * `cef push` writes to. ROC's own `agentServiceAccess/wellKnown.ts` states why
- * these cannot be the same path: "the content gateway cannot resolve S3 keys:
- * the S3 gateway addresses objects through its own Postgres key->CID index,
- * which the CDN knows nothing about." They are two systems with two key spaces,
- * which is also why `cef eval push` is its own command rather than a flag on
- * `cef push`.
- */
-import { GetObjectCommand, ListObjectsV2Command, PutObjectCommand, S3Client, } from "@aws-sdk/client-s3";
-/** A refused credential: expired, revoked, or never valid. */
-export function isAuthFailure(err) {
-    const e = err;
-    return e?.$metadata?.httpStatusCode === 403
-        || e?.name === "InvalidAccessKeyId" || e?.name === "ExpiredToken" || e?.name === "AccessDenied";
-}
-/**
- * `listObjects` on the gateway caps a page at 1000 keys and does NOT signal
- * truncation to a naive caller — a known ceiling recorded in the design. So
- * this paginates explicitly with the continuation token rather than trusting a
- * single response, and every caller gets the whole prefix or an error.
- *
- * Silent truncation is the dangerous shape: a dataset that quietly
- * stops at 1000 cases cuts a version missing the rest, and the experiment
- * built from it looks complete.
- */
-/** The endpoint host, for a warning that has to say WHICH gateway misbehaved. */
-async function endpointLabel(client) {
-    try {
-        const endpoint = client.config
-            .endpoint;
-        return (await endpoint?.())?.hostname ?? "the S3 endpoint";
-    }
-    catch {
-        return "the S3 endpoint";
-    }
-}
-export function s3Store(opts) {
-    const { bucket } = opts;
-    let client = opts.client;
-    /*
-     * ONE RETRY ON A REFUSED CREDENTIAL. The client re-asks its credential
-     * provider before expiry on its own; this covers the rest (revoked, a clock
-     * that disagrees with the gateway's) without turning a real permission
-     * error into a loop.
-     */
-    const send = async (command) => {
-        const used = client;
-        try {
-            return (await used.send(command));
-        }
-        catch (err) {
-            if (!opts.renew || !isAuthFailure(err))
-                throw err;
-            const fresh = await opts.renew(used);
-            if (!fresh)
-                throw err;
-            client = fresh;
-            return (await fresh.send(command));
-        }
-    };
-    const root = opts.root ? opts.root.replace(/\/*$/, "/") : "";
-    const full = (key) => `${root}${key}`;
-    const get = async (key) => {
-        try {
-            const res = await send(new GetObjectCommand({ Bucket: bucket, Key: full(key) }));
-            return (await res.Body?.transformToString()) ?? null;
-        }
-        catch (err) {
-            const name = err.name;
-            // A genuinely absent object is `null`; anything else (auth, network,
-            // a bad bucket) must propagate — swallowing it would make `putCase`'s
-            // written-once check silently pass and overwrite a real case.
-            if (name === "NoSuchKey" || name === "NotFound")
-                return null;
-            throw err;
-        }
-    };
-    return {
-        async list(prefix) {
-            const keys = [];
-            let token;
-            do {
-                const page = await send(new ListObjectsV2Command({
-                    Bucket: bucket,
-                    Prefix: full(prefix),
-                    ContinuationToken: token,
-                }));
-                for (const obj of page.Contents ?? []) {
-                    if (obj.Key)
-                        keys.push(root ? obj.Key.slice(root.length) : obj.Key);
-                }
-                // Truncated with nowhere to continue from is the exact silent
-                // truncation this function exists to prevent: returning the short list
-                // reads as a complete one, and the version cut from it is missing cases
-                // nobody will notice are gone.
-                if (page.IsTruncated && !page.NextContinuationToken) {
-                    throw new Error(`[eval] listing "${full(prefix)}" in bucket "${bucket}" came back ` +
-                        `TRUNCATED after ${keys.length} key(s) with no ` +
-                        `NextContinuationToken, so the rest of the prefix cannot be ` +
-                        `fetched. Refusing to return a short list — a set that quietly ` +
-                        `stops cuts a version missing cases, and the experiment built ` +
-                        `from it looks complete.`);
-                }
-                token = page.IsTruncated ? page.NextContinuationToken : undefined;
-            } while (token);
-            return keys.sort();
-        },
-        /**
-         * Child prefixes through `Delimiter: "/"`, paged the same way and with the
-         * same refusal of a truncated page that has nowhere to continue — what
-         * lets `listDatasets`/`findExperiment` skip every run record in the bucket.
-         */
-        async listPrefixes(prefix) {
-            const out = new Set();
-            let token;
-            do {
-                const page = await send(new ListObjectsV2Command({
-                    Bucket: bucket,
-                    Prefix: full(prefix),
-                    Delimiter: "/",
-                    ContinuationToken: token,
-                }));
-                for (const p of page.CommonPrefixes ?? []) {
-                    if (p.Prefix)
-                        out.add(root ? p.Prefix.slice(root.length) : p.Prefix);
-                }
-                if (page.IsTruncated && !page.NextContinuationToken) {
-                    throw new Error(`[eval] listing the prefixes of "${full(prefix)}" in bucket "${bucket}" came back TRUNCATED ` +
-                        `with no NextContinuationToken — refusing to return a short list.`);
-                }
-                token = page.IsTruncated ? page.NextContinuationToken : undefined;
-            } while (token);
-            return [...out].sort();
-        },
-        get,
-        async put(key, body) {
-            await send(new PutObjectCommand({
-                Bucket: bucket,
-                Key: full(key),
-                Body: body,
-                ContentType: "application/json",
-            }));
-        },
-        /**
-         * Write-if-absent. A real compare-and-set on every store this runs against,
-         * including Cere's DDC S3 gateway — verified, not assumed.
-         *
-         * Two layers, in order:
-         *
-         * 1. READ FIRST, and return `false` without attempting any write. Catches
-         *    every collision older than one round trip, and — because it never
-         *    writes on that path — it is also what keeps a store that ignored the
-         *    header from corrupting rather than merely losing a cut.
-         *
-         * 2. `If-None-Match: "*"` on the PUT, with `412` read as "taken". This is
-         *    the part that actually closes the race, step 1 or no step 1.
-         *
-         * Step 2 was believed inert on the DDC gateway: it is a hand-written Go
-         * service whose documented PutObject path is "stream to DDC, then UPSERT
-         * the index row" with no precondition step, its published error model lists
-         * no `412`, and nothing in this repo or ROC had ever sent the header. Two
-         * company ADR paragraphs contradicted each other on it.
-         *
-         * Probed against dev rather than left as a caveat: the first conditional
-         * PUT succeeded, the SECOND returned `PreconditionFailed` / 412, and the
-         * stored bytes were still the first writer's. The gateway honours it, and
-         * the ADR paragraph claiming conditional writes exist is the correct one.
-         *
-         * The unconditional fallback below stays for a store that rejects the
-         * header outright with 501 — one unknown header must not be able to take
-         * `eval push --cut` down entirely — and step 1 still guards that path. NOT
-         * 400: that covers a malformed key, a bad body, a signing problem and much
-         * else, and downgrading on it would let two concurrent cutters both
-         * believe they won while step 2 was never really tried.
-         */
-        async putIfAbsent(key, body) {
-            if ((await get(key)) !== null)
-                return false;
-            const command = (conditional) => new PutObjectCommand({
-                Bucket: bucket,
-                Key: full(key),
-                Body: body,
-                ContentType: "application/json",
-                ...(conditional ? { IfNoneMatch: "*" } : {}),
-            });
-            try {
-                await send(command(true));
-                return true;
-            }
-            catch (err) {
-                const code = err.$metadata
-                    ?.httpStatusCode;
-                // 412: the key was taken. 409 (`ConditionalRequestConflict`) means a
-                // concurrent write collided and AWS says to retry — reporting it as
-                // "taken" sends the caller back to re-list and try the next number,
-                // which is the same recovery and is self-correcting if the key turns
-                // out to be free after all.
-                if (err.name === "PreconditionFailed")
-                    return false;
-                if (code === 412 || code === 409)
-                    return false;
-                // A server that does not IMPLEMENT the header must not take the whole
-                // feature down with it: `cef eval push --cut` has to keep working
-                // against a gateway that answers 501. 501 ONLY — a 400 is "your request
-                // was wrong", which covers a malformed key, a bad body, a signing
-                // problem and much else, and downgrading on it means two cutters both
-                // believe they won while step 2 was never really tried. And the
-                // downgrade is announced: a gateway that regresses out of conditional
-                // writes must be visible, not a comment nobody reads.
-                if (code === 501) {
-                    console.warn(`[eval] ${await endpointLabel(client)} answered 501 to a conditional ` +
-                        `PUT (If-None-Match: *) on "${full(key)}" — falling back to an ` +
-                        `UNCONDITIONAL write. The read check above still stands, but two ` +
-                        `concurrent writers can now both believe they won a version or a ` +
-                        `revision. This gateway no longer supports write-once.`);
-                    await send(command(false));
-                    return true;
-                }
-                throw err;
-            }
-        },
-        /**
-         * The claim `storeConformance` refuses to run without, and the one the
-         * doc comment above spends forty lines earning: the SERVER adjudicates,
-         * through `If-None-Match: "*"` with 412/409 read as "taken".
-         *
-         * Pinned, not asserted-by-comment: `eval-store.test.ts` drives this
-         * `putIfAbsent` and reads the header off the `PutObjectCommand` the store
-         * actually sent. Change the mechanism and that test goes red next to this
-         * word.
-         *
-         * One honest caveat, and it is wider than "one write": the 501 branch
-         * above is in a per-call `catch`, so against a gateway that answers 501 it
-         * fires on EVERY `putIfAbsent` for as long as that lasts. The whole
-         * process is writing unconditionally, with only step 1's read between two
-         * cutters and a silently replaced manifest. The per-call `console.warn` is
-         * the right mitigation precisely because of that — it names the endpoint
-         * every time rather than once — but nobody should read this as a single
-         * degraded write.
-         *
-         * The declaration stays `conditional-write` regardless, because it
-         * describes what this store SENDS. A store whose declared mechanism
-         * flipped mid-run would be a claim nobody could check against the code,
-         * which is the one thing the word has to be.
-         */
-        atomicity: "conditional-write",
-    };
-}
-/**
- * Build an S3 client for a gateway endpoint. With a `CredentialSource` the
- * client asks it for a credential, carrying its expiry, so the SDK asks again
- * inside its refresh window (5 min before expiry) and the source mints anew.
- */
-export function gatewayClient(cfg) {
-    const credentials = "credentials" in cfg && cfg.credentials
-        ? async () => {
-            const c = await cfg.credentials.get();
-            return {
-                accessKeyId: c.accessKeyId,
-                secretAccessKey: c.secretAccessKey,
-                ...(c.expiresAt !== undefined ? { expiration: new Date(c.expiresAt) } : {}),
-            };
-        }
-        : {
-            accessKeyId: cfg.accessKeyId,
-            secretAccessKey: cfg.secretAccessKey,
-            ...(cfg.sessionToken ? { sessionToken: cfg.sessionToken } : {}),
-        };
-    const config = {
-        endpoint: cfg.endpoint,
-        region: cfg.region ?? "us-east-1",
-        // The gateway addresses buckets by path, not by virtual host.
-        forcePathStyle: true,
-        credentials,
-    };
-    const client = new S3Client(config);
-    // The gateway routes on `/<bucket>/<key>` and reads the empty last segment of
-    // a bucket-level path (`/<bucket>/`, which is what the AWS SDK sends under
-    // `forcePathStyle`) as a key, answering `400 InvalidArgument: key is
-    // required`. Keyed commands are left alone: an object key may legitimately
-    // end in `/`. Keying off the command input rather than the path shape also
-    // survives a `--endpoint` that carries a path prefix, where `/s3/<bucket>/`
-    // is indistinguishable from a bucket-and-key path by pattern alone.
-    //
-    // ROC needs this too and has `removeTrailingBucketSlashForDdcGateway` in
-    // `browserBucketStorage.ts`; that one matches on the path shape, so it is the
-    // same behaviour for the bare-host endpoints both use.
-    client.middlewareStack.add((next) => (args) => {
-        const request = args.request;
-        const keyed = typeof args.input === "object" && args.input !== null && "Key" in args.input;
-        if (request?.path && request.path.length > 1 && request.path.endsWith("/") && !keyed) {
-            request.path = request.path.replace(/\/+$/, "");
-        }
-        return next(args);
-    }, { name: "removeTrailingBucketSlashForDdcGateway", step: "build" });
-    return client;
-}
-/**
- * The store `cef eval` uses: a gateway client over a credential source, and
- * on a 403 one fresh client per refused credential — concurrent requests that
- * fail together share it instead of minting one each.
- */
-export function gatewayStore(opts) {
-    const make = () => (opts.makeClient ?? gatewayClient)({
-        endpoint: opts.endpoint, ...(opts.region ? { region: opts.region } : {}), credentials: opts.credentials,
-    });
-    let current = make();
-    let renewing;
-    return s3Store({
-        bucket: opts.bucket,
-        client: current,
-        ...(opts.root ? { root: opts.root } : {}),
-        renew: async (failed) => {
-            if (failed !== current)
-                return current;
-            renewing ??= (async () => {
-                try {
-                    if (!(await opts.credentials.invalidate()))
-                        return undefined;
-                    current = make();
-                    return current;
-                }
-                finally {
-                    renewing = undefined;
-                }
-            })();
-            return renewing;
-        },
-    });
-}
-//# sourceMappingURL=eval-store.js.map

package/dist/lib/eval-store.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"eval-store.js","sourceRoot":"","sources":["../../src/lib/eval-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EACL,gBAAgB,EAEhB,oBAAoB,EAEpB,gBAAgB,EAChB,QAAQ,GAET,MAAM,oBAAoB,CAAC;AAiB5B,8DAA8D;AAC9D,MAAM,UAAU,aAAa,CAAC,GAAY;IACxC,MAAM,CAAC,GAAG,GAAiE,CAAC;IAC5E,OAAO,CAAC,EAAE,SAAS,EAAE,cAAc,KAAK,GAAG;WACtC,CAAC,EAAE,IAAI,KAAK,oBAAoB,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,IAAI,CAAC,EAAE,IAAI,KAAK,cAAc,CAAC;AACpG,CAAC;AAED;;;;;;;;;GASG;AACH,iFAAiF;AACjF,KAAK,UAAU,aAAa,CAAC,MAAgB;IAC3C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAI,MAAM,CAAC,MAA8D;aACpF,QAAQ,CAAC;QACZ,OAAO,CAAC,MAAM,QAAQ,EAAE,EAAE,CAAC,EAAE,QAAQ,IAAI,iBAAiB,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iBAAiB,CAAC;IAC3B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAoB;IAC1C,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IACzB;;;;;OAKG;IACH,MAAM,IAAI,GAAG,KAAK,EAAK,OAAmE,EAAc,EAAE;QACxG,MAAM,IAAI,GAAG,MAAM,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,OAAgB,CAAC,CAAM,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACrC,IAAI,CAAC,KAAK;gBAAE,MAAM,GAAG,CAAC;YACtB,MAAM,GAAG,KAAK,CAAC;YACf,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAgB,CAAC,CAAM,CAAC;QACnD,CAAC;IACH,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,IAAI,GAAG,GAAG,EAAE,CAAC;IAE9C,MAAM,GAAG,GAAG,KAAK,EAAE,GAAW,EAA0B,EAAE;QACxD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CACpB,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CACzD,CAAC;YACF,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,iBAAiB,EAAE,CAAC,IAAI,IAAI,CAAC;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAAyB,CAAC,IAAI,CAAC;YAC7C,qEAAqE;YACrE,sEAAsE;YACtE,8DAA8D;YAC9D,IAAI,IAAI,KAAK,WAAW,IAAI,IAAI,KAAK,UAAU;gBAAE,OAAO,IAAI,CAAC;YAC7D,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,IAAI,CAAC,MAAM;YACf,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,IAAI,KAAyB,CAAC;YAC9B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,IAAI,oBAAoB,CAAC;oBACvB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;oBACpB,iBAAiB,EAAE,KAAK;iBACzB,CAAC,CACH,CAAC;gBACF,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACtC,IAAI,GAAG,CAAC,GAAG;wBAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACtE,CAAC;gBACD,8DAA8D;gBAC9D,uEAAuE;gBACvE,wEAAwE;gBACxE,+BAA+B;gBAC/B,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,mBAAmB,IAAI,CAAC,MAAM,CAAC,gBAAgB,MAAM,cAAc;wBACjE,mBAAmB,IAAI,CAAC,MAAM,kBAAkB;wBAChD,6DAA6D;wBAC7D,gEAAgE;wBAChE,+DAA+D;wBAC/D,yBAAyB,CAC5B,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,CAAC,QAAQ,KAAK,EAAE;YAChB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;QACrB,CAAC;QAED;;;;WAIG;QACH,KAAK,CAAC,YAAY,CAAC,MAAM;YACvB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,IAAI,KAAyB,CAAC;YAC9B,GAAG,CAAC;gBACF,MAAM,IAAI,GAAG,MAAM,IAAI,CACrB,IAAI,oBAAoB,CAAC;oBACvB,MAAM,EAAE,MAAM;oBACd,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC;oBACpB,SAAS,EAAE,GAAG;oBACd,iBAAiB,EAAE,KAAK;iBACzB,CAAC,CACH,CAAC;gBACF,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,cAAc,IAAI,EAAE,EAAE,CAAC;oBAC1C,IAAI,CAAC,CAAC,MAAM;wBAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;gBACvE,CAAC;gBACD,IAAI,IAAI,CAAC,WAAW,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;oBACpD,MAAM,IAAI,KAAK,CACb,mCAAmC,IAAI,CAAC,MAAM,CAAC,gBAAgB,MAAM,wBAAwB;wBAC3F,kEAAkE,CACrE,CAAC;gBACJ,CAAC;gBACD,KAAK,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,SAAS,CAAC;YACpE,CAAC,QAAQ,KAAK,EAAE;YAChB,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,GAAG;QAEH,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI;YACjB,MAAM,IAAI,CACR,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,kBAAkB;aAChC,CAAC,CACH,CAAC;QACJ,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;WA+BG;QACH,KAAK,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI;YACzB,IAAI,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,IAAI;gBAAE,OAAO,KAAK,CAAC;YAC5C,MAAM,OAAO,GAAG,CAAC,WAAoB,EAAE,EAAE,CACvC,IAAI,gBAAgB,CAAC;gBACnB,MAAM,EAAE,MAAM;gBACd,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC;gBACd,IAAI,EAAE,IAAI;gBACV,WAAW,EAAE,kBAAkB;gBAC/B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC7C,CAAC,CAAC;YACL,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;gBAC1B,OAAO,IAAI,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,IAAI,GAAI,GAAmD,CAAC,SAAS;oBACzE,EAAE,cAAc,CAAC;gBACnB,qEAAqE;gBACrE,oEAAoE;gBACpE,oEAAoE;gBACpE,qEAAqE;gBACrE,4BAA4B;gBAC5B,IAAK,GAAyB,CAAC,IAAI,KAAK,oBAAoB;oBAAE,OAAO,KAAK,CAAC;gBAC3E,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;oBAAE,OAAO,KAAK,CAAC;gBAC/C,sEAAsE;gBACtE,kEAAkE;gBAClE,wEAAwE;gBACxE,kEAAkE;gBAClE,sEAAsE;gBACtE,gEAAgE;gBAChE,sEAAsE;gBACtE,sDAAsD;gBACtD,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;oBACjB,OAAO,CAAC,IAAI,CACV,UAAU,MAAM,aAAa,CAAC,MAAM,CAAC,iCAAiC;wBACpE,8BAA8B,IAAI,CAAC,GAAG,CAAC,yBAAyB;wBAChE,kEAAkE;wBAClE,kEAAkE;wBAClE,uDAAuD,CAC1D,CAAC;oBACF,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3B,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,CAAC;YACZ,CAAC;QACH,CAAC;QAED;;;;;;;;;;;;;;;;;;;;;;;WAuBG;QACH,SAAS,EAAE,mBAAmB;KAC/B,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,GAM7B;IACC,MAAM,WAAW,GAAkC,aAAa,IAAI,GAAG,IAAI,GAAG,CAAC,WAAW;QACxF,CAAC,CAAC,KAAK,IAAI,EAAE;YACX,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,CAAC;YACtC,OAAO;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW;gBAC1B,eAAe,EAAE,CAAC,CAAC,eAAe;gBAClC,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5E,CAAC;QACJ,CAAC;QACD,CAAC,CAAC;YACA,WAAW,EAAG,GAA+B,CAAC,WAAW;YACzD,eAAe,EAAG,GAAmC,CAAC,eAAe;YACrE,GAAG,CAAE,GAAiC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAG,GAAgC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7H,CAAC;IACJ,MAAM,MAAM,GAAmB;QAC7B,QAAQ,EAAE,GAAG,CAAC,QAAQ;QACtB,MAAM,EAAE,GAAG,CAAC,MAAM,IAAI,WAAW;QACjC,8DAA8D;QAC9D,cAAc,EAAE,IAAI;QACpB,WAAW;KACZ,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACpC,8EAA8E;IAC9E,2EAA2E;IAC3E,qEAAqE;IACrE,2EAA2E;IAC3E,2EAA2E;IAC3E,4EAA4E;IAC5E,oEAAoE;IACpE,EAAE;IACF,yEAAyE;IACzE,8EAA8E;IAC9E,uDAAuD;IACvD,MAAM,CAAC,eAAe,CAAC,GAAG,CACxB,CAAoD,IAAoB,EAAE,EAAE,CAC1E,CAAC,IAAO,EAAK,EAAE;QACb,MAAM,OAAO,GAAG,IAAI,CAAC,OAAwC,CAAC;QAC9D,MAAM,KAAK,GAAG,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC;QAC3F,IAAI,OAAO,EAAE,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YACrF,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC,EACH,EAAE,IAAI,EAAE,wCAAwC,EAAE,IAAI,EAAE,OAAO,EAAE,CAClE,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY,CAAC,IAO5B;IACC,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,IAAI,aAAa,CAAC,CAAC;QACpD,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;KACxG,CAAC,CAAC;IACH,IAAI,OAAO,GAAG,IAAI,EAAE,CAAC;IACrB,IAAI,QAAmD,CAAC;IACxD,OAAO,OAAO,CAAC;QACb,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,OAAO;QACf,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE;YACtB,IAAI,MAAM,KAAK,OAAO;gBAAE,OAAO,OAAO,CAAC;YACvC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;gBACvB,IAAI,CAAC;oBACH,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,UAAU,EAAE,CAAC;wBAAE,OAAO,SAAS,CAAC;oBAC7D,OAAO,GAAG,IAAI,EAAE,CAAC;oBACjB,OAAO,OAAO,CAAC;gBACjB,CAAC;wBAAS,CAAC;oBACT,QAAQ,GAAG,SAAS,CAAC;gBACvB,CAAC;YACH,CAAC,CAAC,EAAE,CAAC;YACL,OAAO,QAAQ,CAAC;QAClB,CAAC;KACF,CAAC,CAAC;AACL,CAAC"}

package/dist/lib/eval-store.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=eval-store.test.d.ts.map

package/dist/lib/eval-store.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"eval-store.test.d.ts","sourceRoot":"","sources":["../../src/lib/eval-store.test.ts"],"names":[],"mappings":""}