@pome-sh/cli 0.20.0 → 0.21.1

package/dist/chunk-D3GRORLQ.js

@@ -0,0 +1,1614 @@
+import { criterionSchema, finalizeResponseSchema, HostedDiscardRefusedError, HostedOrchError, HostedAuthError, HostedQuotaError, submitResultResponseSchema, createEvalSessionResponseSchema, createSessionResponseSchema, sessionPublicSchema } from './chunk-2Q7AYEUA.js';
+import { seedSchema, parseSeed, defaultSeedState as defaultSeedState$2 } from './chunk-OKDJRKJV.js';
+import { gmailSeedSchema, defaultSeedState } from './chunk-WVWV7DLA.js';
+import { linearSeedSchema, defaultSeedState as defaultSeedState$1 } from './chunk-APAS34RJ.js';
+import { isTwinName, TWIN_REGISTRY } from './chunk-OHKJGCWS.js';
+import { toTwinHttpEventRow } from './chunk-LZIPGCQJ.js';
+import { redactEvent, redactSecrets } from './chunk-SG6ZTIMT.js';
+import { mkdir, appendFile, writeFile, readFile } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import { join, basename, extname } from 'node:path';
+import { parse } from 'yaml';
+import { z } from 'zod';
+import { gzipSync } from 'node:zlib';
+import { spawn } from 'node:child_process';
+
+// src/recorder/specMeta.ts
+var META_SPEC_VERSION = 1;
+function resolveTwinPackageVersions(twinIds) {
+  const out = {};
+  for (const id of twinIds) {
+    if (isTwinName(id)) out[id] = TWIN_REGISTRY[id].version;
+  }
+  return out;
+}
+
+// src/recorder/artifacts.ts
+var toTwinHttpEvent = toTwinHttpEventRow;
+async function writeRunArtifactsCore(input) {
+  const runDir = join(input.artifactsDir, input.scenario.slug, input.runId);
+  await mkdir(runDir, { recursive: true });
+  await writeJson(join(runDir, "meta.json"), {
+    run_id: input.runId,
+    scenario: input.scenario.slug,
+    title: input.scenario.title,
+    started_at: input.startedAt,
+    completed_at: input.completedAt,
+    exit_code: input.exitCode,
+    twins: input.scenario.config.twins,
+    // D18.1 — the meta.json contract half: spec_version lets cloud's ingest
+    // (a parallel PR) validate the shape it's parsing; twin_versions lets it
+    // attribute the captured behavior to the exact twin build that produced
+    // it. Both additive — an older CLI's meta.json simply omits them.
+    spec_version: META_SPEC_VERSION,
+    twin_versions: resolveTwinPackageVersions(input.scenario.config.twins)
+  });
+  const existingIds = await readExistingEventIds(join(runDir, "events.jsonl"));
+  const freshEvents = input.events.filter((event) => {
+    const id = event.request_id;
+    const maybeEventId = event.event_id;
+    if (typeof maybeEventId === "string" && existingIds.has(maybeEventId)) return false;
+    if (existingIds.has(id)) return false;
+    return true;
+  });
+  const eventsPath = join(runDir, "events.jsonl");
+  if (freshEvents.length > 0) {
+    const eventsJsonl = freshEvents.map((event) => JSON.stringify(redactEvent(toTwinHttpEvent(event)))).join("\n") + "\n";
+    await appendFile(eventsPath, eventsJsonl);
+  } else if (!existsSync(eventsPath)) {
+    await writeFile(eventsPath, "");
+  }
+  await writeJson(join(runDir, "state_initial.json"), input.stateInitial);
+  await writeJson(join(runDir, "state_final.json"), input.stateFinal);
+  await writeFile(join(runDir, "stdout.txt"), redactText(input.stdout));
+  await writeFile(join(runDir, "stderr.log"), redactText(input.stderr));
+  await writeJson(join(input.artifactsDir, "latest.json"), {
+    run_id: input.runId,
+    task: input.scenario.slug,
+    run_dir: runDir
+  });
+  return { runId: input.runId, runDir };
+}
+async function readLatestRun(artifactsDir) {
+  const latestPath = join(artifactsDir, "latest.json");
+  if (!existsSync(latestPath)) return void 0;
+  return JSON.parse(await readFile(latestPath, "utf8"));
+}
+async function readMetaSummary(runDir) {
+  try {
+    const raw = await readFile(join(runDir, "meta.json"), "utf8");
+    const parsed = JSON.parse(raw);
+    const twins = Array.isArray(parsed.twins) ? parsed.twins.filter((t) => typeof t === "string") : [];
+    return { ...parsed, twins };
+  } catch (err) {
+    if (err.code === "ENOENT") return { twins: [] };
+    throw err;
+  }
+}
+async function writeJson(path, value) {
+  await writeFile(path, `${JSON.stringify(redactSecrets(value), null, 2)}
+`);
+}
+async function readExistingEventIds(eventsPath) {
+  const ids = /* @__PURE__ */ new Set();
+  if (!existsSync(eventsPath)) return ids;
+  try {
+    const raw = await readFile(eventsPath, "utf8");
+    for (const line of raw.split("\n")) {
+      if (!line.trim()) continue;
+      try {
+        const row = JSON.parse(line);
+        if (row.kind !== "TwinHttpEvent") continue;
+        if (typeof row.event_id === "string") ids.add(row.event_id);
+        if (typeof row.request_id === "string") ids.add(row.request_id);
+      } catch {
+      }
+    }
+  } catch (err) {
+    if (err.code !== "ENOENT") throw err;
+  }
+  return ids;
+}
+function redactText(value) {
+  return redactSecrets(value);
+}
+
+// src/task/githubSeedCompat.ts
+function normalizeLegacyGitHubSeed(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) return input;
+  const seed = input;
+  if (!Array.isArray(seed.repositories)) return input;
+  return {
+    ...seed,
+    repositories: seed.repositories.map((repo) => {
+      if (!repo || typeof repo !== "object" || Array.isArray(repo)) return repo;
+      const record = repo;
+      if (!Array.isArray(record.issues)) return repo;
+      return {
+        ...record,
+        issues: record.issues.map((issue) => normalizeLegacyIssueAssignee(issue))
+      };
+    })
+  };
+}
+function normalizeLegacyIssueAssignee(issue) {
+  if (!issue || typeof issue !== "object" || Array.isArray(issue)) return issue;
+  const record = issue;
+  if (!("assignee" in record) || "assignees" in record) return issue;
+  const { assignee, ...rest } = record;
+  if (assignee === null || assignee === void 0 || assignee === "") {
+    return { ...rest, assignees: [] };
+  }
+  if (typeof assignee === "string") {
+    return { ...rest, assignees: [assignee] };
+  }
+  return issue;
+}
+function parseGitHubSeedState(input) {
+  const seed = seedSchema.parse(parseSeed(normalizeLegacyGitHubSeed(input)));
+  if (seed.repositories.length === 0) {
+    throw new Error("GitHub seed must contain at least one repository");
+  }
+  return seed;
+}
+var taskConfigSchema = z.object({
+  twins: z.array(z.string()).default(["github"]),
+  timeout: z.number().int().positive().default(60),
+  runs: z.number().int().positive().default(1),
+  passThreshold: z.number().min(0).max(100).default(100)
+});
+var stripeFailureInjectionRuleSchema = z.object({
+  method: z.string().min(1),
+  path: z.string().min(1),
+  attempt: z.number().int().positive(),
+  mode: z.enum(["before_handler", "after_handler"]).default("after_handler"),
+  status: z.number().int().min(100).max(599),
+  body: z.unknown()
+});
+var stripeSeedStateSchema = z.object({
+  api_keys: z.array(
+    z.object({
+      key: z.string().min(1).default("sk_test_pome_default"),
+      sid: z.string().min(1).default("default"),
+      account_id: z.string().min(1).optional()
+    })
+  ).default([]),
+  customers: z.array(z.record(z.string(), z.unknown())).default([]),
+  products: z.array(z.record(z.string(), z.unknown())).default([]),
+  prices: z.array(z.record(z.string(), z.unknown())).default([]),
+  payment_intents: z.array(z.record(z.string(), z.unknown())).default([]),
+  charges: z.array(z.record(z.string(), z.unknown())).default([]),
+  events: z.array(z.record(z.string(), z.unknown())).default([]),
+  balances: z.array(z.record(z.string(), z.unknown())).default([]),
+  failure_injection: z.array(stripeFailureInjectionRuleSchema).default([])
+}).strict();
+var slackSeedStateSchema = z.object({
+  team: z.record(z.string(), z.unknown()).optional(),
+  users: z.array(z.record(z.string(), z.unknown())).default([]),
+  channels: z.array(z.record(z.string(), z.unknown())).default([])
+}).strict();
+var seedStateSchema = z.union([
+  gmailSeedSchema,
+  slackSeedStateSchema,
+  linearSeedSchema,
+  seedSchema,
+  stripeSeedStateSchema
+]);
+var seedEnvelopeSchema = z.record(z.string(), seedStateSchema);
+var taskSchema = z.object({
+  slug: z.string().min(1),
+  title: z.string().min(1),
+  setup: z.string().default(""),
+  prompt: z.string().min(1),
+  expectedBehavior: z.string().default(""),
+  criteria: z.array(criterionSchema).min(1),
+  config: taskConfigSchema,
+  // Flat single-twin seed OR the multi-twin per-twin envelope. Flat is tried
+  // first so single-twin seeds match their strict arms; the envelope only
+  // matches when the flat union can't (its keys are twin ids, not seed fields).
+  seedState: z.union([seedStateSchema, seedEnvelopeSchema])
+});
+
+// src/task/parseTask.ts
+async function parseTaskFile(path) {
+  const markdown = await readFile(path, "utf8");
+  const sidecarSeed = await readSidecarSeed(path);
+  return parseTask(markdown, slugFromPath(path), sidecarSeed, path);
+}
+function readConfigTwins(markdown) {
+  const configText = splitSections(markdown).get("config") ?? "";
+  const config = configText.trim() ? taskConfigSchema.parse(parseFencedYaml(configText)) : taskConfigSchema.parse({});
+  return config.twins;
+}
+function criteriaSection(sections) {
+  return sections.get("success criteria") ?? sections.get("checks") ?? "";
+}
+function readCodeCriteria(markdown) {
+  const criteriaText = criteriaSection(splitSections(markdown));
+  let twins;
+  try {
+    twins = readConfigTwins(markdown);
+  } catch {
+    twins = taskConfigSchema.parse({}).twins;
+  }
+  const primary = twins[0];
+  if (primary === void 0) return [];
+  const found = [];
+  for (const rawLine of criteriaText.split("\n")) {
+    const match = rawLine.trim().match(CRITERION_LINE_RE);
+    if (!match || match[1] !== "code") continue;
+    const tag = match[2];
+    found.push({
+      marker: `[code${tag ? `:${tag}` : ""}]`,
+      twin: tag ?? primary,
+      text: match[3].trim()
+    });
+  }
+  return found;
+}
+function parseTask(markdown, slug = "scenario", sidecarSeed, taskPath) {
+  const title = markdown.match(/^#\s+(.+)$/m)?.[1]?.trim() ?? slug;
+  const sections = splitSections(markdown);
+  const prompt = sections.get("prompt") ?? sections.get("task") ?? "";
+  const criteriaText = criteriaSection(sections);
+  const configText = sections.get("config") ?? "";
+  const seedText = sections.get("seed state") ?? "";
+  const config = configText.trim() ? taskConfigSchema.parse(parseFencedYaml(configText)) : taskConfigSchema.parse({});
+  const criteria = parseCriteria(criteriaText, config.twins);
+  const seedState = resolveSeedState({ sidecarSeed, seedText, config, taskPath });
+  return taskSchema.parse({
+    slug,
+    title,
+    setup: sections.get("setup") ?? "",
+    prompt,
+    expectedBehavior: sections.get("expected behavior") ?? "",
+    criteria,
+    config,
+    seedState
+  });
+}
+function resolveSeedState(args) {
+  if (args.config.twins.length > 1) {
+    return resolveMultiTwinSeedState(args);
+  }
+  if (args.sidecarSeed !== void 0) {
+    return parseSeedStateForTask(stripSidecarMeta(args.sidecarSeed), args.config);
+  }
+  if (args.seedText.trim()) {
+    const raw = stripFence(args.seedText);
+    if (!/^[\[{]/.test(raw)) {
+      throw new Error(missingSidecarMessage(args.taskPath));
+    }
+    try {
+      return parseSeedStateForTask(JSON.parse(raw), args.config);
+    } catch (err) {
+      if (err instanceof SyntaxError) {
+        throw new Error(`Inline JSON seed in ## Seed State is malformed: ${err.message}`);
+      }
+      throw err;
+    }
+  }
+  return defaultSeedStateForConfig(args.config.twins);
+}
+function resolveMultiTwinSeedState(args) {
+  const twins = args.config.twins;
+  let raw;
+  if (args.sidecarSeed !== void 0) {
+    raw = stripSidecarMeta(args.sidecarSeed);
+  } else if (args.seedText.trim()) {
+    const text = stripFence(args.seedText);
+    if (!/^[\[{]/.test(text)) {
+      throw new Error(missingSidecarMessage(args.taskPath));
+    }
+    try {
+      raw = JSON.parse(text);
+    } catch (err) {
+      if (err instanceof SyntaxError) {
+        throw new Error(`Inline JSON seed in ## Seed State is malformed: ${err.message}`);
+      }
+      throw err;
+    }
+  } else {
+    raw = void 0;
+  }
+  return buildSeedEnvelope(raw, twins);
+}
+function buildSeedEnvelope(raw, twins) {
+  const envelope = {};
+  if (raw === void 0) {
+    for (const twin of twins) envelope[twin] = defaultSeedForTwin(twin);
+    return envelope;
+  }
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error(
+      `Multi-twin tasks need a per-twin seed envelope { <twin>: <seed> } for twins [${twins.join(", ")}], not a bare seed object.`
+    );
+  }
+  const allowed = new Set(twins);
+  const provided = raw;
+  for (const key of Object.keys(provided)) {
+    if (!allowed.has(key)) {
+      throw new Error(
+        `Seed envelope key "${key}" is not one of the task's twins [${twins.join(", ")}].`
+      );
+    }
+  }
+  for (const twin of twins) {
+    envelope[twin] = twin in provided ? parseSeedForTwin(twin, provided[twin]) : defaultSeedForTwin(twin);
+  }
+  return envelope;
+}
+function parseSeedForTwin(twin, input) {
+  if (twin === "stripe") return stripeSeedStateSchema.parse(input);
+  if (twin === "slack") return slackSeedStateSchema.parse(input);
+  if (twin === "gmail") return gmailSeedSchema.parse(input);
+  if (twin === "linear") return linearSeedSchema.parse(input);
+  return parseGitHubSeedState(input);
+}
+function defaultSeedForTwin(twin) {
+  if (twin === "stripe") {
+    return stripeSeedStateSchema.parse({
+      api_keys: [{ key: "sk_test_pome_default", sid: "default", account_id: "acct_default" }]
+    });
+  }
+  if (twin === "slack") {
+    return slackSeedStateSchema.parse({});
+  }
+  if (twin === "gmail") {
+    return gmailSeedSchema.parse(defaultSeedState());
+  }
+  if (twin === "linear") {
+    return linearSeedSchema.parse(defaultSeedState$1());
+  }
+  return seedSchema.parse(defaultSeedState$2());
+}
+function missingSidecarMessage(taskPath) {
+  const pathLabel = taskPath ?? "<task>.md";
+  const sidecarLabel = taskPath ? taskPath.replace(/\.md$/i, ".seed.json") : "<task>.seed.json";
+  return [
+    `Task has a prose ## Seed State section but no compiled sidecar (${sidecarLabel}). Run:`,
+    "",
+    `    pome compile-seeds ${pathLabel}`,
+    "",
+    "then re-run the task. (See `pome docs scenarios-github`.)"
+  ].join("\n");
+}
+function stripSidecarMeta(seed) {
+  if (seed && typeof seed === "object" && !Array.isArray(seed)) {
+    const { _meta, ...rest } = seed;
+    return rest;
+  }
+  return seed;
+}
+async function readSidecarSeed(taskPath) {
+  const sidecarPath = taskPath.replace(/\.md$/i, ".seed.json");
+  if (sidecarPath === taskPath || !existsSync(sidecarPath)) return void 0;
+  const raw = await readFile(sidecarPath, "utf8");
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    throw new Error(`Sidecar seed ${sidecarPath} is not valid JSON: ${err.message}`);
+  }
+}
+function splitSections(markdown) {
+  const sections = /* @__PURE__ */ new Map();
+  const headingPattern = /^##\s+(.+)$/gm;
+  const headings = [...markdown.matchAll(headingPattern)].map((match) => ({
+    title: match[1].trim().toLowerCase(),
+    start: match.index + match[0].length
+  }));
+  for (let i = 0; i < headings.length; i += 1) {
+    const heading = headings[i];
+    const next = headings[i + 1]?.start;
+    const contentStart = heading.start;
+    const contentEnd = next ? markdown.lastIndexOf("##", next - 1) : markdown.length;
+    sections.set(heading.title, markdown.slice(contentStart, contentEnd).trim());
+  }
+  return sections;
+}
+var CRITERION_LINE_RE = /^[-*]\s+\[(code|model)(?::([a-z][a-z0-9_-]*))?\]\s+(.+)$/;
+var LEGACY_CRITERION_LINE_RE = /^[-*]\s+\[([DP])(?::([a-z][a-z0-9_-]*))?\]\s+(.+)$/;
+function parseCriteria(input, twins) {
+  const multiTwin = twins.length > 1;
+  const allowed = new Set(twins);
+  const primary = twins[0];
+  const criteria = [];
+  for (const rawLine of input.split("\n")) {
+    const line = rawLine.trim();
+    const legacy = line.match(LEGACY_CRITERION_LINE_RE);
+    if (legacy) {
+      const legacyMarker = `[${legacy[1]}${legacy[2] ? `:${legacy[2]}` : ""}]`;
+      throw new Error(
+        `Criterion "${legacyMarker} ${legacy[3].trim()}" uses a retired marker \u2014 markers were renamed [D]\u2192[code] and [P]\u2192[model] (tags carry over: [D:github]\u2192[code:github]).`
+      );
+    }
+    const match = line.match(CRITERION_LINE_RE);
+    if (!match) continue;
+    const kind = match[1];
+    const tag = match[2];
+    const text = match[3].trim();
+    const marker = `[${kind}${tag ? `:${tag}` : ""}]`;
+    if (tag !== void 0) {
+      if (!multiTwin) {
+        if (tag !== primary) {
+          throw new Error(
+            `Criterion "${marker} ${text}" tags twin "${tag}", but this single-twin task runs "${primary}". Drop the tag or set config.twins to include "${tag}".`
+          );
+        }
+      } else if (!allowed.has(tag)) {
+        throw new Error(
+          `Criterion "${marker} ${text}" tags twin "${tag}", which is not in the task's twins [${twins.join(", ")}].`
+        );
+      }
+    } else if (multiTwin && kind === "code") {
+      throw new Error(
+        `Criterion "${marker} ${text}" needs a twin tag ([code:<twin>]) in a multi-twin task (twins [${twins.join(", ")}]).`
+      );
+    }
+    criteria.push(
+      criterionSchema.parse(
+        tag !== void 0 ? { type: kind, text, twin: tag } : { type: kind, text }
+      )
+    );
+  }
+  return criteria;
+}
+function seedStateForTwin(scenario, twin) {
+  if (scenario.config.twins.length > 1) {
+    return scenario.seedState[twin];
+  }
+  return scenario.seedState;
+}
+function parseFencedYaml(input) {
+  return parse(stripFence(input));
+}
+function parseSeedStateForTask(input, config) {
+  if (isStripeOnly(config.twins)) return stripeSeedStateSchema.parse(input);
+  if (isSlackOnly(config.twins)) return slackSeedStateSchema.parse(input);
+  if (isGmailOnly(config.twins)) return gmailSeedSchema.parse(input);
+  if (isLinearOnly(config.twins)) return linearSeedSchema.parse(input);
+  return parseGitHubSeedState(input);
+}
+function defaultSeedStateForConfig(twins) {
+  if (isStripeOnly(twins)) {
+    return stripeSeedStateSchema.parse({
+      api_keys: [{ key: "sk_test_pome_default", sid: "default", account_id: "acct_default" }]
+    });
+  }
+  if (isSlackOnly(twins)) {
+    return slackSeedStateSchema.parse({});
+  }
+  if (isGmailOnly(twins)) {
+    return gmailSeedSchema.parse(defaultSeedState());
+  }
+  if (isLinearOnly(twins)) {
+    return linearSeedSchema.parse(defaultSeedState$1());
+  }
+  return seedSchema.parse(defaultSeedState$2());
+}
+function isStripeOnly(twins) {
+  return twins.length === 1 && twins[0] === "stripe";
+}
+function isSlackOnly(twins) {
+  return twins.length === 1 && twins[0] === "slack";
+}
+function isGmailOnly(twins) {
+  return twins.length === 1 && twins[0] === "gmail";
+}
+function isLinearOnly(twins) {
+  return twins.length === 1 && twins[0] === "linear";
+}
+function stripFence(input) {
+  const fence = input.match(/```(?:json|yaml)?\s*([\s\S]*?)```/i);
+  return (fence?.[1] ?? input).trim();
+}
+function slugFromPath(path) {
+  return basename(path, extname(path)).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "");
+}
+var PER_TWIN_PROVENANCE = /* @__PURE__ */ Symbol("pome.perTwinFromCloud");
+function markPerTwinProvenance(session, fromCloud) {
+  Object.defineProperty(session, PER_TWIN_PROVENANCE, {
+    value: fromCloud,
+    enumerable: false,
+    configurable: true
+  });
+  return session;
+}
+function perTwinReturnedByCloud(session) {
+  return session[PER_TWIN_PROVENANCE] === true;
+}
+function rawBodyHadPerTwin(raw) {
+  if (typeof raw !== "object" || raw === null) return false;
+  const pt = raw.per_twin;
+  return typeof pt === "object" && pt !== null;
+}
+var finalizeScoredResponseSchema = finalizeResponseSchema.strip();
+var finalizeStatusUrlSchema = z.string().min(1).refine(
+  (value) => {
+    if (value.startsWith("/") && !value.startsWith("//")) return true;
+    try {
+      new URL(value);
+      return true;
+    } catch {
+      return false;
+    }
+  },
+  { message: "Invalid status_url" }
+);
+var finalizeAcceptedResponseSchema = z.object({
+  evaluation_id: z.string().min(1),
+  run_id: z.string().min(1),
+  status: z.literal("queued"),
+  status_url: finalizeStatusUrlSchema
+}).strict();
+var finalizeStatusIdentitySchema = {
+  evaluation_id: z.string().min(1),
+  run_id: z.string().min(1)
+};
+var finalizeFailureErrorSchema = z.object({
+  type: z.string().min(1),
+  message: z.string().min(1),
+  details: z.record(z.string(), z.unknown()).optional()
+}).strict();
+var finalizeStatusResponseSchema = z.discriminatedUnion("status", [
+  z.object({
+    ...finalizeStatusIdentitySchema,
+    status: z.literal("queued")
+  }).strict(),
+  z.object({
+    ...finalizeStatusIdentitySchema,
+    status: z.literal("running")
+  }).strict(),
+  z.object({
+    ...finalizeStatusIdentitySchema,
+    status: z.literal("failed"),
+    error: finalizeFailureErrorSchema
+  }).strict(),
+  z.object({
+    ...finalizeStatusIdentitySchema,
+    status: z.literal("completed"),
+    result: finalizeScoredResponseSchema
+  }).strict()
+]);
+var RetryableFinalizeStatusError = class extends HostedOrchError {
+  constructor(error, retryAfterMs) {
+    super(error.message, error.requestId, error.status);
+    this.retryAfterMs = retryAfterMs;
+    this.name = "RetryableFinalizeStatusError";
+  }
+  retryAfterMs;
+};
+async function readDiscardRefusal(res) {
+  let body;
+  try {
+    body = await res.clone().json();
+  } catch {
+    return { kind: "none" };
+  }
+  const error = body?.error;
+  const details = error?.details;
+  if (!details || details.reason !== "ungraded_session") return { kind: "none" };
+  const discardToken = details.discard_token;
+  if (typeof discardToken !== "string" || discardToken.length === 0) {
+    return { kind: "unusable" };
+  }
+  return {
+    kind: "refusal",
+    refusal: {
+      message: typeof error?.message === "string" ? error.message : "",
+      sessionId: typeof details.session_id === "string" ? details.session_id : "",
+      state: typeof details.state === "string" ? details.state : "open",
+      taskName: typeof details.task_name === "string" ? details.task_name : null,
+      openSeconds: typeof details.open_seconds === "number" ? details.open_seconds : 0,
+      discardToken
+    }
+  };
+}
+function unusableRefusalError(sessionId) {
+  return new HostedOrchError(
+    `DELETE /v1/sessions/${sessionId} \u2192 409: the server refused to delete this session but sent no usable discard_token, so the session was NOT stopped. Retry, or stop it from the dashboard.`,
+    void 0,
+    409
+  );
+}
+function createHostedClient(config) {
+  const timeoutMs = config.timeoutMs ?? 3e4;
+  const finalizeTimeoutMs = config.finalizeTimeoutMs ?? 5 * 6e4;
+  const finalizePollInitialDelayMs = Math.max(
+    1,
+    config.finalizePollInitialDelayMs ?? 500
+  );
+  const finalizePollMaxDelayMs = Math.max(
+    finalizePollInitialDelayMs,
+    config.finalizePollMaxDelayMs ?? 5e3
+  );
+  const authHeaders = config.authScheme === "bearer" ? { authorization: `Bearer ${config.apiKey}` } : { "x-api-key": config.apiKey };
+  async function readResponse(res, parse) {
+    const text = await res.text();
+    let json;
+    try {
+      json = text.length ? JSON.parse(text) : {};
+    } catch {
+      throw new HostedOrchError(
+        `non-JSON response (status ${res.status})`,
+        void 0,
+        res.status
+      );
+    }
+    if (!res.ok) {
+      const cloudErr = json.error;
+      const twinErr = cloudErr ? null : json;
+      const cloudDetails = cloudErr?.details;
+      const msg = cloudErr?.message ?? twinErr?.message ?? `HTTP ${res.status}`;
+      const reqId = cloudErr?.request_id;
+      if (res.status === 401 || res.status === 403) {
+        throw new HostedAuthError(msg, reqId);
+      }
+      if (res.status === 402 || res.status === 429) {
+        throw new HostedQuotaError(msg, reqId, cloudDetails);
+      }
+      throw new HostedOrchError(msg, reqId, res.status, cloudErr?.type);
+    }
+    try {
+      return parse(json, res);
+    } catch (err) {
+      throw new HostedOrchError(
+        `unexpected response shape: ${err instanceof Error ? err.message : String(err)}`,
+        void 0,
+        res.status
+      );
+    }
+  }
+  async function postJson(path, body, parse, options) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(
+      () => ctrl.abort(),
+      options?.requestTimeoutMs ?? timeoutMs
+    );
+    const abortFromCaller = () => ctrl.abort(options?.signal?.reason);
+    options?.signal?.addEventListener("abort", abortFromCaller, { once: true });
+    if (options?.signal?.aborted) abortFromCaller();
+    try {
+      const res = await fetch(`${config.baseUrl}${path}`, {
+        method: "POST",
+        headers: {
+          ...authHeaders,
+          "content-type": "application/json",
+          ...options?.headers
+        },
+        body: JSON.stringify(body),
+        signal: ctrl.signal
+      });
+      if (res.ok && options?.acceptedStatuses && !options.acceptedStatuses.includes(res.status)) {
+        throw new HostedOrchError(
+          `unexpected HTTP status ${res.status}`,
+          void 0,
+          res.status
+        );
+      }
+      return await readResponse(res, parse);
+    } catch (err) {
+      if (err instanceof HostedAuthError || err instanceof HostedQuotaError || err instanceof HostedOrchError) {
+        throw err;
+      }
+      throw new HostedOrchError(
+        err instanceof Error ? err.message : "network error"
+      );
+    } finally {
+      clearTimeout(timer);
+      options?.signal?.removeEventListener("abort", abortFromCaller);
+    }
+  }
+  async function getJsonBearer(url, bearer, parse) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    let res;
+    try {
+      res = await fetch(url, {
+        method: "GET",
+        headers: { authorization: `Bearer ${bearer}` },
+        signal: ctrl.signal
+      });
+    } catch (err) {
+      throw new HostedOrchError(
+        err instanceof Error ? err.message : "network error"
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    return readResponse(res, parse);
+  }
+  async function getJsonWithApiKey(path, parse) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+    let res;
+    try {
+      res = await fetch(`${config.baseUrl}${path}`, {
+        method: "GET",
+        headers: authHeaders,
+        signal: ctrl.signal
+      });
+    } catch (err) {
+      throw new HostedOrchError(
+        err instanceof Error ? err.message : "network error"
+      );
+    } finally {
+      clearTimeout(timer);
+    }
+    return readResponse(res, parse);
+  }
+  function retryAfterMs(value) {
+    if (value === null) return null;
+    const seconds = Number(value);
+    if (Number.isFinite(seconds) && seconds >= 0) {
+      return seconds * 1e3;
+    }
+    const at = Date.parse(value);
+    return Number.isNaN(at) ? null : Math.max(0, at - Date.now());
+  }
+  function nextFinalizePollDelayMs(currentDelayMs, serverDelayMs) {
+    if (serverDelayMs !== null) {
+      return Math.max(serverDelayMs, finalizePollInitialDelayMs);
+    }
+    return Math.min(
+      Math.max(currentDelayMs * 2, finalizePollInitialDelayMs),
+      finalizePollMaxDelayMs
+    );
+  }
+  async function sleepForPoll(ms, signal) {
+    if (signal?.aborted) {
+      throw new HostedOrchError("finalize aborted");
+    }
+    if (ms <= 0) return;
+    await new Promise((resolve, reject) => {
+      let settled = false;
+      const timer = setTimeout(() => {
+        settled = true;
+        signal?.removeEventListener("abort", onAbort);
+        resolve();
+      }, ms);
+      const onAbort = () => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        signal?.removeEventListener("abort", onAbort);
+        reject(new HostedOrchError("finalize aborted"));
+      };
+      signal?.addEventListener("abort", onAbort, { once: true });
+      if (signal?.aborted) onAbort();
+    });
+  }
+  function resolveFinalizeStatusUrl(statusUrl) {
+    const apiOrigin = new URL(config.baseUrl).origin;
+    let resolved;
+    try {
+      resolved = new URL(statusUrl, apiOrigin);
+    } catch {
+      throw new HostedOrchError("finalize status_url is not a valid URL");
+    }
+    if (resolved.origin !== apiOrigin) {
+      throw new HostedOrchError(
+        "finalize status_url must use the configured API origin"
+      );
+    }
+    return resolved;
+  }
+  async function getFinalizeStatus(url, signal, requestTimeoutMs) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), requestTimeoutMs);
+    const abortFromCaller = () => ctrl.abort(signal?.reason);
+    signal?.addEventListener("abort", abortFromCaller, { once: true });
+    if (signal?.aborted) abortFromCaller();
+    try {
+      const res = await fetch(url, {
+        method: "GET",
+        headers: authHeaders,
+        signal: ctrl.signal,
+        // Node fetch preserves custom x-api-key headers across a cross-origin
+        // redirect. Refuse redirects so same-origin validation remains true
+        // for the server that actually receives tenant credentials.
+        redirect: "manual"
+      });
+      if (res.status >= 300 && res.status < 400) {
+        throw new HostedOrchError(
+          "finalize status request must not redirect",
+          void 0,
+          res.status
+        );
+      }
+      const delay = retryAfterMs(res.headers.get("retry-after"));
+      let status;
+      try {
+        status = await readResponse(
+          res,
+          (raw) => finalizeStatusResponseSchema.parse(raw)
+        );
+      } catch (err) {
+        if (err instanceof HostedOrchError && err.status !== void 0 && err.status >= 500) {
+          throw new RetryableFinalizeStatusError(err, delay);
+        }
+        throw err;
+      }
+      return { status, retryAfterMs: delay };
+    } catch (err) {
+      if (signal?.aborted) {
+        throw new HostedOrchError("finalize aborted");
+      }
+      if (err instanceof HostedAuthError || err instanceof HostedQuotaError || err instanceof HostedOrchError) {
+        throw err;
+      }
+      throw new HostedOrchError(
+        err instanceof Error ? err.message : "network error"
+      );
+    } finally {
+      clearTimeout(timer);
+      signal?.removeEventListener("abort", abortFromCaller);
+    }
+  }
+  async function pollFinalize(accepted, deadline, signal) {
+    const statusUrl = resolveFinalizeStatusUrl(accepted.status_url);
+    let delayMs = finalizePollInitialDelayMs;
+    while (true) {
+      const remainingBeforeDelay = deadline - Date.now();
+      if (remainingBeforeDelay <= 0) {
+        throw new HostedOrchError("asynchronous finalize timed out");
+      }
+      await sleepForPoll(Math.min(delayMs, remainingBeforeDelay), signal);
+      const remainingBeforeRequest = deadline - Date.now();
+      if (remainingBeforeRequest <= 0) {
+        throw new HostedOrchError("asynchronous finalize timed out");
+      }
+      let polled;
+      try {
+        polled = await getFinalizeStatus(
+          statusUrl,
+          signal,
+          Math.min(timeoutMs, remainingBeforeRequest)
+        );
+      } catch (err) {
+        if (signal?.aborted) throw err;
+        if (err instanceof HostedOrchError && (err.status === void 0 || err.status >= 500)) {
+          delayMs = nextFinalizePollDelayMs(
+            delayMs,
+            err instanceof RetryableFinalizeStatusError ? err.retryAfterMs : null
+          );
+          continue;
+        }
+        throw err;
+      }
+      if (polled.status.evaluation_id !== accepted.evaluation_id || polled.status.run_id !== accepted.run_id) {
+        throw new HostedOrchError(
+          "finalize status identifiers do not match the accepted evaluation"
+        );
+      }
+      if (polled.status.status === "completed") {
+        if (polled.status.result.run_id !== accepted.run_id) {
+          throw new HostedOrchError(
+            "finalize result run_id does not match the accepted evaluation"
+          );
+        }
+        return polled.status.result;
+      }
+      if (polled.status.status === "failed") {
+        const { type, message, details } = polled.status.error;
+        if (type === "quota_exceeded") {
+          throw new HostedQuotaError(message, void 0, details);
+        }
+        throw new HostedOrchError(`${type}: ${message}`);
+      }
+      delayMs = nextFinalizePollDelayMs(delayMs, polled.retryAfterMs);
+    }
+  }
+  return {
+    async createSession(input) {
+      const body = {
+        twins: input.twins,
+        scenario_source: Buffer.from(input.taskSource, "utf8").toString(
+          "base64"
+        )
+      };
+      if (input.idempotencyKey) {
+        body.idempotency_key = input.idempotencyKey;
+      }
+      if (input.agentId) {
+        body.agent_id = input.agentId;
+      }
+      if (input.agentVersion) {
+        body.agent_version = input.agentVersion;
+      }
+      if (input.seed !== void 0) {
+        body.seed = input.seed;
+      }
+      if (input.groupId) {
+        body.group_id = input.groupId;
+      }
+      return postJson(
+        "/v1/sessions",
+        body,
+        (raw) => markPerTwinProvenance(
+          createSessionResponseSchema.parse(raw),
+          rawBodyHadPerTwin(raw)
+        )
+      );
+    },
+    async abandonSession(sessionId, input) {
+      const body = {};
+      if (input?.errorCode) {
+        body.error_code = input.errorCode;
+      }
+      return postJson(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/abandon`,
+        body,
+        (raw) => {
+          if (typeof raw === "object" && raw !== null && typeof raw.session_id === "string" && typeof raw.state === "string" && typeof raw.abandoned === "boolean") {
+            const shaped = raw;
+            return {
+              session_id: shaped.session_id,
+              state: shaped.state,
+              error_code: typeof shaped.error_code === "string" ? shaped.error_code : null,
+              abandoned: shaped.abandoned
+            };
+          }
+          throw new HostedOrchError(
+            "POST /v1/sessions/:id/abandon returned unexpected shape"
+          );
+        }
+      );
+    },
+    async createEvalSession(input) {
+      return postJson(
+        "/v1/eval-sessions",
+        { agent: input.agent, task_name: input.taskName },
+        (raw) => createEvalSessionResponseSchema.parse(raw)
+      );
+    },
+    async listSessions(opts) {
+      const lim = opts?.limit ?? 50;
+      const q = `?limit=${encodeURIComponent(String(lim))}`;
+      return getJsonWithApiKey(`/v1/sessions${q}`, (raw) => {
+        if (!Array.isArray(raw)) {
+          throw new HostedOrchError("GET /v1/sessions expected a JSON array");
+        }
+        return raw.map((row) => sessionPublicSchema.parse(row));
+      });
+    },
+    async getSession(sessionId) {
+      return getJsonWithApiKey(
+        `/v1/sessions/${encodeURIComponent(sessionId)}`,
+        (raw) => sessionPublicSchema.parse(raw)
+      );
+    },
+    async fetchState(input) {
+      return getJsonBearer(
+        `${input.twinUrl}/_pome/state`,
+        input.agentToken,
+        // domain.exportState() shape varies per twin; pass through.
+        (raw) => raw
+      );
+    },
+    async fetchEvents(input) {
+      return getJsonBearer(
+        `${input.twinUrl}/_pome/events`,
+        input.agentToken,
+        (raw) => {
+          if (!Array.isArray(raw)) {
+            throw new HostedOrchError("twin /_pome/events returned non-array");
+          }
+          return raw;
+        }
+      );
+    },
+    async requestEventsUploadUrl(sessionId) {
+      return postJson(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/result-upload-url`,
+        {},
+        (raw) => {
+          if (typeof raw === "object" && raw !== null && typeof raw.url === "string" && typeof raw.key === "string") {
+            return raw;
+          }
+          throw new HostedOrchError(
+            "POST /v1/sessions/:id/result-upload-url returned unexpected shape"
+          );
+        }
+      );
+    },
+    async requestSignalsUploadUrl(sessionId) {
+      return postJson(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/signals-upload-url`,
+        {},
+        (raw) => {
+          if (typeof raw === "object" && raw !== null && typeof raw.url === "string" && typeof raw.key === "string") {
+            return raw;
+          }
+          throw new HostedOrchError(
+            "POST /v1/sessions/:id/signals-upload-url returned unexpected shape"
+          );
+        }
+      );
+    },
+    async requestMetaUploadUrl(sessionId) {
+      return postJson(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/meta-upload-url`,
+        {},
+        (raw) => {
+          if (typeof raw === "object" && raw !== null && typeof raw.url === "string" && typeof raw.key === "string") {
+            return raw;
+          }
+          throw new HostedOrchError(
+            "POST /v1/sessions/:id/meta-upload-url returned unexpected shape"
+          );
+        }
+      );
+    },
+    async requestStateUploadUrl(sessionId, twins) {
+      const body = twins && twins.length > 0 ? { twins } : {};
+      return postJson(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/state-upload-url`,
+        body,
+        (raw) => {
+          const isEntry = (x) => typeof x === "object" && x !== null && typeof x.url === "string" && typeof x.key === "string";
+          const isPair = (x) => typeof x === "object" && x !== null && isEntry(x.state_initial) && isEntry(x.state_final);
+          if (isPair(raw)) {
+            const perTwinRaw = raw.per_twin;
+            let perTwin;
+            if (typeof perTwinRaw === "object" && perTwinRaw !== null && !Array.isArray(perTwinRaw) && Object.values(perTwinRaw).every(isPair)) {
+              perTwin = perTwinRaw;
+            }
+            return { ...raw, per_twin: perTwin };
+          }
+          throw new HostedOrchError(
+            "POST /v1/sessions/:id/state-upload-url returned unexpected shape"
+          );
+        }
+      );
+    },
+    async finalize(sessionId, input, options) {
+      const deadline = Date.now() + finalizeTimeoutMs;
+      const body = {
+        stop_reason: input.stopReason,
+        exit_code: input.exitCode,
+        duration_ms: input.durationMs,
+        agent_model: input.agentModel,
+        agent_sdk: normalizeAgentSdk(input.agentSdk),
+        criteria: input.criteria,
+        scenario_name: input.taskName,
+        scenario_hash: input.taskHash,
+        scenario_prompt: input.taskPrompt,
+        expected_behavior: input.expectedBehavior
+      };
+      if (input.traceStorageKey !== void 0) {
+        body.trace_storage_key = input.traceStorageKey;
+      }
+      if (input.stateInitialStorageKey !== void 0) {
+        body.state_initial_storage_key = input.stateInitialStorageKey;
+      }
+      if (input.stateFinalStorageKey !== void 0) {
+        body.state_final_storage_key = input.stateFinalStorageKey;
+      }
+      if (input.signalsStorageKey !== void 0) {
+        body.signals_storage_key = input.signalsStorageKey;
+      }
+      if (input.perTwinStateKeys !== void 0 && Object.keys(input.perTwinStateKeys).length > 0) {
+        body.per_twin_state_keys = input.perTwinStateKeys;
+      }
+      const initial = await postJson(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/finalize`,
+        body,
+        (raw, response) => response.status === 202 ? finalizeAcceptedResponseSchema.parse(raw) : finalizeScoredResponseSchema.parse(raw),
+        {
+          headers: { prefer: "respond-async" },
+          signal: options?.signal,
+          acceptedStatuses: [200, 201, 202],
+          requestTimeoutMs: Math.min(timeoutMs, finalizeTimeoutMs)
+        }
+      );
+      return "status_url" in initial ? pollFinalize(initial, deadline, options?.signal) : initial;
+    },
+    async submitResult(sessionId, input) {
+      return postJson(
+        `/v1/sessions/${encodeURIComponent(sessionId)}/result`,
+        {
+          scenario_name: input.taskName,
+          scenario_hash: input.taskHash,
+          duration_ms: input.durationMs,
+          agent_model: input.agentModel,
+          satisfaction_score: input.satisfactionScore,
+          criteria_results: input.criteriaResults,
+          judge_model: input.judgeModel,
+          judge_tokens_in: input.judgeTokensIn,
+          judge_tokens_out: input.judgeTokensOut,
+          agent_sdk: normalizeAgentSdk(input.agentSdk),
+          lanes: input.lanes,
+          steps: input.steps,
+          fix_prompt: input.fixPrompt,
+          events_jsonl_url: input.eventsJsonlUrl,
+          trace_jsonl_b64: Buffer.from(input.traceJsonl, "utf8").toString(
+            "base64"
+          ),
+          state_initial_json_b64: Buffer.from(
+            input.stateInitialJson,
+            "utf8"
+          ).toString("base64"),
+          state_final_json_b64: Buffer.from(
+            input.stateFinalJson,
+            "utf8"
+          ).toString("base64")
+        },
+        (raw) => submitResultResponseSchema.parse(raw)
+      );
+    },
+    async deleteSession(sessionId, bestEffort = true, opts = {}) {
+      const attempt = async (confirmDiscard) => {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        const qs = confirmDiscard ? `?confirm_discard=${encodeURIComponent(confirmDiscard)}` : "";
+        try {
+          const res2 = await fetch(
+            `${config.baseUrl}/v1/sessions/${encodeURIComponent(sessionId)}${qs}`,
+            {
+              method: "DELETE",
+              // authHeaders, not a hardcoded x-api-key: demo teardown carries a
+              // bearer demo_token (FDRS-643 live-run finding — the hardcoded
+              // header made every demo DELETE an opaque 404, silently swallowed
+              // by best-effort).
+              headers: authHeaders,
+              signal: ctrl.signal
+            }
+          );
+          const read = res2.status === 409 ? await readDiscardRefusal(res2) : { kind: "none" };
+          return { res: res2, read };
+        } catch (err) {
+          if (bestEffort) return null;
+          throw new HostedOrchError(
+            err instanceof Error ? err.message : "network error"
+          );
+        } finally {
+          clearTimeout(timer);
+        }
+      };
+      let first = await attempt();
+      if (!first) return;
+      let res = first.res;
+      if (first.read.kind === "unusable") throw unusableRefusalError(sessionId);
+      if (first.read.kind === "refusal") {
+        const { refusal } = first.read;
+        if (!opts.discard) {
+          throw new HostedDiscardRefusedError(
+            refusal.message,
+            refusal.sessionId || sessionId,
+            refusal.state,
+            refusal.taskName,
+            refusal.openSeconds,
+            refusal.discardToken
+          );
+        }
+        const confirmed = await attempt(refusal.discardToken);
+        if (!confirmed) return;
+        res = confirmed.res;
+        if (confirmed.read.kind === "unusable") {
+          throw unusableRefusalError(sessionId);
+        }
+        if (confirmed.read.kind === "refusal") {
+          const stillRefused = confirmed.read.refusal;
+          throw new HostedDiscardRefusedError(
+            stillRefused.message,
+            stillRefused.sessionId || sessionId,
+            stillRefused.state,
+            stillRefused.taskName,
+            stillRefused.openSeconds,
+            stillRefused.discardToken
+          );
+        }
+      }
+      if (res.status === 204 || res.status === 200 || res.status === 409) return;
+      if (res.status === 404) {
+        if (bestEffort) return;
+        throw new HostedOrchError(
+          `DELETE /v1/sessions/${sessionId} \u2192 404 (not found)`
+        );
+      }
+      if (res.status === 401 || res.status === 403) {
+        throw new HostedAuthError(
+          `DELETE /v1/sessions/${sessionId} \u2192 ${res.status}`
+        );
+      }
+      throw new HostedOrchError(
+        `DELETE /v1/sessions/${sessionId} \u2192 ${res.status}`
+      );
+    }
+  };
+}
+function normalizeAgentSdk(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length > 0 ? trimmed : null;
+}
+
+// src/hosted/evalResultView.ts
+function outcomeOf(result) {
+  if (result.outcome) return result.outcome;
+  if (result.skipped) return "skipped";
+  return result.passed ? "passed" : "failed";
+}
+function scoreStatus(score, passThreshold) {
+  if (!score.evaluated || !score.can_pass) return "incomplete";
+  return score.satisfaction >= passThreshold ? "pass" : "fail";
+}
+function markerFor(outcome) {
+  switch (outcome) {
+    case "passed":
+      return "\u2713";
+    case "failed":
+      return "\u2717";
+    case "errored":
+      return "!";
+    default:
+      return "-";
+  }
+}
+function criterionMarkerLabel(criterion) {
+  return criterion.twin ? `[${criterion.type}:${criterion.twin}]` : `[${criterion.type}]`;
+}
+function twinSkipSuffix(result) {
+  const twin = result.criterion.twin;
+  if (!twin) return "";
+  const outcome = outcomeOf(result);
+  const twinRelated = outcome === "skipped" || outcome === "errored" || /no_matching_predicate|no matching predicate/i.test(result.reason);
+  return twinRelated ? ` (twin: ${twin})` : "";
+}
+function scoreCountsSummary(score) {
+  return `${score.passed ?? 0} passed, ${score.failed ?? 0} failed, ${score.skipped ?? 0} skipped, ${score.errored ?? 0} errored`;
+}
+function runScoreLine(score, passThreshold, unevaluatedNumericLabel) {
+  const status = scoreStatus(score, passThreshold);
+  if (status === "incomplete") {
+    const notEvaluated = score.skipped + score.errored;
+    const total = score.total_required + notEvaluated;
+    return `score: incomplete \u2014 ${notEvaluated} of ${total} criteria not evaluated; ${scoreCountsSummary(score)}; ${unevaluatedNumericLabel}: ${score.satisfaction}/100`;
+  }
+  return `score: ${score.satisfaction}/100`;
+}
+async function putBlob(url, body, contentType, label) {
+  const ctrl = new AbortController();
+  const timer = setTimeout(() => ctrl.abort(), 3e4);
+  try {
+    const putRes = await fetch(url, {
+      method: "PUT",
+      headers: {
+        "content-type": contentType,
+        "content-encoding": "gzip"
+      },
+      body: gzipSync(Buffer.from(body, "utf8")),
+      signal: ctrl.signal
+    });
+    if (!putRes.ok) {
+      console.warn(
+        `[pome] ${label} upload PUT ${url} \u2192 ${putRes.status}; continuing with key=null`
+      );
+      return false;
+    }
+    return true;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function uploadRunBlobs(client, sessionId, blobs) {
+  async function uploadEvents() {
+    try {
+      const upload = await client.requestEventsUploadUrl(sessionId);
+      const ok = await putBlob(
+        upload.url,
+        blobs.eventsJsonl,
+        "application/x-ndjson",
+        "events.jsonl"
+      );
+      return ok ? upload.key : null;
+    } catch (err) {
+      console.warn(
+        `[pome] events.jsonl upload skipped (${err instanceof Error ? err.message : String(err)}); continuing with events_jsonl_url=null`
+      );
+      return null;
+    }
+  }
+  async function uploadSignals() {
+    try {
+      if (blobs.signalsJsonl.trim().length === 0) {
+        return null;
+      }
+      const upload = await client.requestSignalsUploadUrl(sessionId);
+      const ok = await putBlob(
+        upload.url,
+        blobs.signalsJsonl,
+        "application/x-ndjson",
+        "signals.jsonl"
+      );
+      return ok ? upload.key : null;
+    } catch (err) {
+      console.warn(
+        `[pome] signals.jsonl upload skipped (${err instanceof Error ? err.message : String(err)}); continuing with signals_storage_key=null`
+      );
+      return null;
+    }
+  }
+  async function uploadStates() {
+    const multiTwin = (blobs.twins?.length ?? 0) > 1;
+    try {
+      const upload = await client.requestStateUploadUrl(
+        sessionId,
+        multiTwin ? blobs.twins : void 0
+      );
+      const [initialOk, finalOk] = await Promise.all([
+        putBlob(
+          upload.state_initial.url,
+          blobs.stateInitialJson,
+          "application/json",
+          "state_initial.json"
+        ),
+        putBlob(
+          upload.state_final.url,
+          blobs.stateFinalJson,
+          "application/json",
+          "state_final.json"
+        )
+      ]);
+      let perTwinStateKeys;
+      if (multiTwin && upload.per_twin) {
+        const collected = {};
+        for (const twin of blobs.twins ?? []) {
+          const pair = upload.per_twin[twin];
+          const state = blobs.perTwinState?.[twin];
+          if (!pair || !state) continue;
+          const [iOk, fOk] = await Promise.all([
+            putBlob(
+              pair.state_initial.url,
+              state.initialJson,
+              "application/json",
+              `state_initial.${twin}.json`
+            ),
+            putBlob(
+              pair.state_final.url,
+              state.finalJson,
+              "application/json",
+              `state_final.${twin}.json`
+            )
+          ]);
+          const entry = {};
+          if (iOk) entry.state_initial_key = pair.state_initial.key;
+          if (fOk) entry.state_final_key = pair.state_final.key;
+          if (entry.state_initial_key !== void 0 || entry.state_final_key !== void 0) {
+            collected[twin] = entry;
+          }
+        }
+        if (Object.keys(collected).length > 0) perTwinStateKeys = collected;
+      }
+      return {
+        initialKey: initialOk ? upload.state_initial.key : null,
+        finalKey: finalOk ? upload.state_final.key : null,
+        perTwinStateKeys
+      };
+    } catch (err) {
+      console.warn(
+        `[pome] state blob upload skipped (${err instanceof Error ? err.message : String(err)}); continuing with state_*_storage_key=null`
+      );
+      return { initialKey: null, finalKey: null };
+    }
+  }
+  async function uploadMeta() {
+    try {
+      const upload = await client.requestMetaUploadUrl(sessionId);
+      const ok = await putBlob(
+        upload.url,
+        blobs.metaJson,
+        "application/json",
+        "meta.json"
+      );
+      return ok ? upload.key : null;
+    } catch (err) {
+      console.warn(
+        `[pome] meta.json upload skipped (${err instanceof Error ? err.message : String(err)}); cloud will finalize without producing-twin metadata for this run`
+      );
+      return null;
+    }
+  }
+  const [eventsKey, stateKeys, signalsKey, metaKey] = await Promise.all([
+    uploadEvents(),
+    uploadStates(),
+    uploadSignals(),
+    uploadMeta()
+  ]);
+  return {
+    eventsKey,
+    stateInitialKey: stateKeys.initialKey,
+    stateFinalKey: stateKeys.finalKey,
+    perTwinStateKeys: stateKeys.perTwinStateKeys,
+    metaKey,
+    signalsKey
+  };
+}
+function scoreFromFinalizeResponse(finalized) {
+  const hasCriteriaResults = finalized.criteria_results !== void 0;
+  const results = finalized.criteria_results ?? [];
+  const passed = results.filter((r) => outcomeOf(r) === "passed").length;
+  const failed = results.filter((r) => outcomeOf(r) === "failed").length;
+  const errored = results.filter((r) => outcomeOf(r) === "errored").length;
+  const skipped = results.filter((r) => outcomeOf(r) === "skipped").length;
+  const totalRequired = passed + failed;
+  return {
+    satisfaction: finalized.score,
+    passed,
+    failed,
+    skipped,
+    errored,
+    total_required: totalRequired,
+    evaluated: hasCriteriaResults ? totalRequired > 0 : true,
+    can_pass: hasCriteriaResults ? totalRequired > 0 && skipped === 0 && errored === 0 : true,
+    results,
+    judge_model: finalized.judge_model ?? null,
+    judge_tokens_in: null,
+    judge_tokens_out: null
+  };
+}
+function redactJsonl(body) {
+  const lines = body.split("\n");
+  const redacted = lines.filter((line) => line.trim().length > 0).map((line) => {
+    try {
+      return JSON.stringify(redactSecrets(JSON.parse(line)));
+    } catch {
+      return redactSecrets(line);
+    }
+  });
+  return redacted.length > 0 ? `${redacted.join("\n")}
+` : "";
+}
+async function runAgentCommand(input) {
+  return new Promise((resolve) => {
+    const inheritAllEnv = process.env.POME_INHERIT_AGENT_ENV === "1";
+    const useShell = process.env.POME_TRUST_AGENT_COMMAND === "1";
+    const childEnv = buildAgentEnv(input.env, inheritAllEnv, Boolean(input.preflight));
+    const command = useShell ? null : splitCommand(input.command);
+    if (!useShell && !command) {
+      resolve({
+        stdout: "",
+        stderr: "Could not parse agent command. Use POME_TRUST_AGENT_COMMAND=1 to run it through a shell.\n",
+        exitCode: 2,
+        timedOut: false
+      });
+      return;
+    }
+    if (useShell) {
+      console.warn("[pome] POME_TRUST_AGENT_COMMAND=1: running agent command through a shell.");
+    }
+    if (inheritAllEnv) {
+      console.warn("[pome] POME_INHERIT_AGENT_ENV=1: passing the full parent environment to the agent.");
+    }
+    const child = useShell ? spawn(input.command, {
+      shell: true,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: childEnv
+    }) : spawn(command.file, command.args, {
+      shell: false,
+      stdio: ["ignore", "pipe", "pipe"],
+      env: childEnv
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let settled = false;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGTERM");
+      setTimeout(() => child.kill("SIGKILL"), 1e3).unref();
+    }, input.timeoutSeconds * 1e3);
+    child.stdout?.on("data", (chunk) => {
+      stdout += chunk.toString();
+    });
+    child.stderr?.on("data", (chunk) => {
+      stderr += chunk.toString();
+    });
+    child.on("error", (error) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({
+        stdout,
+        stderr: `${stderr}${error.message}
+`,
+        exitCode: 2,
+        timedOut
+      });
+    });
+    child.on("close", (exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve({ stdout, stderr, exitCode, timedOut });
+    });
+  });
+}
+var SAFE_PARENT_ENV = /* @__PURE__ */ new Set([
+  "PATH",
+  "HOME",
+  "USERPROFILE",
+  "SystemRoot",
+  "COMSPEC",
+  "TMPDIR",
+  "TEMP",
+  "TMP",
+  "LANG",
+  "LC_ALL"
+]);
+var DEFAULT_AGENT_ENV_ALLOWLIST = /* @__PURE__ */ new Set([
+  "AI_GATEWAY_API_KEY",
+  "ANTHROPIC_API_KEY",
+  // FDRS-667 — Claude subscription auth (`claude setup-token`). Without
+  // this the Claude Agent SDK inside the agent subprocess only sees an API
+  // key, and subscription-only users fail auth under `pome run` while the
+  // same agent works when launched by hand.
+  "CLAUDE_CODE_OAUTH_TOKEN",
+  "GOOGLE_API_KEY",
+  "GOOGLE_GENERATIVE_AI_API_KEY",
+  "OPENAI_API_KEY",
+  "OPENROUTER_API_KEY"
+]);
+function buildAgentEnv(inputEnv, inheritAll, preflight) {
+  const base = {};
+  if (inheritAll) {
+    Object.assign(base, process.env);
+  } else {
+    for (const key of [...SAFE_PARENT_ENV, ...DEFAULT_AGENT_ENV_ALLOWLIST]) {
+      const value = process.env[key];
+      if (value !== void 0) base[key] = value;
+    }
+    for (const key of (process.env.POME_AGENT_ENV_ALLOWLIST ?? "").split(",")) {
+      const trimmed = key.trim();
+      if (!trimmed) continue;
+      const value = process.env[trimmed];
+      if (value !== void 0) base[trimmed] = value;
+    }
+  }
+  return {
+    ...base,
+    ...inputEnv,
+    ...preflight ? { POME_PREFLIGHT: "1" } : {}
+  };
+}
+function splitCommand(command) {
+  const parts = [];
+  let current = "";
+  let quote = null;
+  let escaping = false;
+  for (const char of command.trim()) {
+    if (escaping) {
+      current += char;
+      escaping = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaping = true;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = null;
+      else current += char;
+      continue;
+    }
+    if (char === "'" || char === '"') {
+      quote = char;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current.length > 0) {
+        parts.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (escaping || quote) return null;
+  if (current.length > 0) parts.push(current);
+  const [file, ...args] = parts;
+  return file ? { file, args } : null;
+}
+
+export { createHostedClient, criterionMarkerLabel, markerFor, outcomeOf, parseGitHubSeedState, parseTaskFile, perTwinReturnedByCloud, readCodeCriteria, readConfigTwins, readLatestRun, readMetaSummary, redactJsonl, runAgentCommand, runScoreLine, scoreCountsSummary, scoreFromFinalizeResponse, scoreStatus, seedStateForTwin, toTwinHttpEvent, twinSkipSuffix, uploadRunBlobs, writeRunArtifactsCore };