@tangle-network/agent-eval 0.143.0 → 0.144.1

package/dist/single-run-lock-B-cFnnNn.js

@@ -0,0 +1,1799 @@
+import { c as ValidationError } from "./errors-D-LKuDhb.js";
+import { c as costForTokenPricing, i as CostLedger } from "./cost-ledger-DMFxsLKr.js";
+import { a as appendLedgerLine, d as tryAcquireAtomicFileLock, o as tryWithLedgerFileLock, u as probeAtomicFileLock } from "./ledger-core-Dxz0Rkwa.js";
+import { createRequire } from "node:module";
+import { appendFileSync, existsSync, readFileSync } from "node:fs";
+import { isAbsolute, join, resolve } from "node:path";
+import { createHash, randomBytes } from "node:crypto";
+import { constants as constants$1 } from "node:buffer";
+import { createServer } from "node:http";
+import { spawn } from "node:child_process";
+import { lstat, mkdtemp, open, rm, writeFile } from "node:fs/promises";
+import { tmpdir } from "node:os";
+//#region src/campaign/external-optimizer-contracts.ts
+const MAX_TIMER_DELAY_MS$1 = 2147483647;
+const MAXIMUM_JSON_BYTES = Math.min(constants$1.MAX_LENGTH - 1, constants$1.MAX_STRING_LENGTH);
+const DEFAULT_EXTERNAL_OPTIMIZER_PROCESS_LIMITS = Object.freeze({
+	maxInputBytes: 64 * 1024 * 1024,
+	maxResultBytes: 4 * 1024 * 1024,
+	maxOutputChars: 64e3
+});
+const DEFAULT_EXTERNAL_OPTIMIZER_CALLBACK_LIMITS = Object.freeze({
+	maxRequestBytes: 1e6,
+	maxResponseBytes: 4e6
+});
+function resolveExternalOptimizerProcessLimits(value, label = "external optimizer process limits") {
+	const resolved = {
+		...DEFAULT_EXTERNAL_OPTIMIZER_PROCESS_LIMITS,
+		...value
+	};
+	assertBoundedPositiveInteger(resolved.maxInputBytes, `${label}.maxInputBytes`, MAXIMUM_JSON_BYTES);
+	assertBoundedPositiveInteger(resolved.maxResultBytes, `${label}.maxResultBytes`, MAXIMUM_JSON_BYTES);
+	assertBoundedPositiveInteger(resolved.maxOutputChars, `${label}.maxOutputChars`, constants$1.MAX_STRING_LENGTH);
+	return resolved;
+}
+function resolveExternalOptimizerCallbackLimits(value, label = "external optimizer callback limits") {
+	const resolved = {
+		...DEFAULT_EXTERNAL_OPTIMIZER_CALLBACK_LIMITS,
+		...value
+	};
+	assertBoundedPositiveInteger(resolved.maxRequestBytes, `${label}.maxRequestBytes`, MAXIMUM_JSON_BYTES);
+	assertBoundedPositiveInteger(resolved.maxResponseBytes, `${label}.maxResponseBytes`, MAXIMUM_JSON_BYTES);
+	return resolved;
+}
+function isCandidateText(value, maxChars) {
+	return typeof value === "string" && value.trim().length > 0 && value.length <= maxChars;
+}
+function isExternalTextCandidate(value) {
+	if (typeof value === "string") return value.trim().length > 0;
+	if (!isRecord(value)) return false;
+	const entries = Object.entries(value);
+	return entries.length > 0 && entries.every(([name, content]) => name.trim().length > 0 && name.trim() === name && typeof content === "string");
+}
+function assertJsonValue(value, label, seen = /* @__PURE__ */ new Set()) {
+	if (value === null || typeof value === "string" || typeof value === "boolean") return;
+	if (typeof value === "number" && Number.isFinite(value)) return;
+	if (Array.isArray(value)) {
+		if (seen.has(value)) throw new Error(`${label} must be JSON-serializable`);
+		seen.add(value);
+		for (const item of value) assertJsonValue(item, label, seen);
+		seen.delete(value);
+		return;
+	}
+	if (typeof value === "object") {
+		if (seen.has(value)) throw new Error(`${label} must be JSON-serializable`);
+		const prototype = Object.getPrototypeOf(value);
+		if (prototype !== Object.prototype && prototype !== null) throw new Error(`${label} must be JSON-serializable`);
+		seen.add(value);
+		for (const item of Object.values(value)) assertJsonValue(item, label, seen);
+		seen.delete(value);
+		return;
+	}
+	throw new Error(`${label} must be JSON-serializable`);
+}
+function assertNoCredentialValues(value, path, credentialLocation = "runner.env") {
+	if (Array.isArray(value)) {
+		for (const [index, item] of value.entries()) assertNoCredentialValues(item, `${path}[${index}]`, credentialLocation);
+		return;
+	}
+	if (!isRecord(value)) return;
+	for (const [key, item] of Object.entries(value)) {
+		if (isCredentialKey(key)) throw new Error(`${path}.${key} must be supplied through ${credentialLocation}`);
+		assertNoCredentialValues(item, `${path}.${key}`, credentialLocation);
+	}
+}
+function removeCredentialEnvironment(environment) {
+	const sanitized = {};
+	for (const [key, value] of Object.entries(environment)) if (value !== void 0 && !isCredentialKey(key)) sanitized[key] = value;
+	return sanitized;
+}
+function assertExternalOptimizerModelBudget(value, label) {
+	if (!value || typeof value !== "object") throw new Error(`${label} is required`);
+	for (const [field, entry] of [["maxRequests", value.maxRequests], ["maxOutputTokensPerRequest", value.maxOutputTokensPerRequest]]) if (!Number.isSafeInteger(entry) || entry <= 0) throw new Error(`${label}.${field} must be a positive safe integer`);
+	assertBoundedPositiveInteger(value.maxRequestBytes, `${label}.maxRequestBytes`, MAXIMUM_JSON_BYTES);
+	assertBoundedPositiveInteger(value.maxResponseBytes, `${label}.maxResponseBytes`, MAXIMUM_JSON_BYTES);
+	if (value.maxReasoningTokensPerRequest !== void 0 && (!Number.isSafeInteger(value.maxReasoningTokensPerRequest) || value.maxReasoningTokensPerRequest < 0)) throw new Error(`${label}.maxReasoningTokensPerRequest must be a non-negative safe integer`);
+	if (value.maxCostUsd !== void 0 && (!Number.isFinite(value.maxCostUsd) || value.maxCostUsd <= 0)) throw new Error(`${label}.maxCostUsd must be positive and finite when supplied`);
+	if (value.requestTimeoutMs !== void 0 && (!Number.isSafeInteger(value.requestTimeoutMs) || value.requestTimeoutMs <= 0 || value.requestTimeoutMs > MAX_TIMER_DELAY_MS$1)) throw new Error(`${label}.requestTimeoutMs must be between 1 and ${MAX_TIMER_DELAY_MS$1}`);
+	if (value.pricing !== void 0) costForTokenPricing(value.pricing, {
+		inputTokens: 1,
+		outputTokens: 1
+	});
+	if (value.maxCostUsd !== void 0 && value.pricing === void 0) throw new Error(`${label}.pricing is required when maxCostUsd is supplied`);
+}
+function safePathComponent(value) {
+	return value.replace(/[^a-zA-Z0-9._-]/g, "_");
+}
+function assertBoundedPositiveInteger(value, label, maximum) {
+	if (!Number.isSafeInteger(value) || value <= 0 || value > maximum) throw new Error(`${label} must be an integer between 1 and ${maximum}`);
+}
+function isCredentialKey(key) {
+	return key.replace(/([a-z0-9])([A-Z])/g, "$1_$2").replace(/-/g, "_").toLowerCase().split("_").some((segment) => [
+		"auth",
+		"authorization",
+		"cookie",
+		"credential",
+		"credentials",
+		"key",
+		"password",
+		"secret",
+		"session",
+		"token"
+	].includes(segment));
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+//#endregion
+//#region src/verdict-cache.ts
+/**
+* Content-addressed judge-verdict caching.
+*
+* LAW: cache JUDGE VERDICTS only — judging the same artifact with the same
+* judge+rubric is pure. NEVER cache agent rollouts. (A router that cached
+* identical fanout prompts silently destroyed best-of-N diversity; rollout
+* caching reintroduces that failure class. Judging has no diversity to
+* destroy — same artifact + same rubric ⇒ same verdict is the desired
+* property, not a bug.)
+*
+* The cache key is a sha-256 over the canonical JSON of everything that can
+* change a verdict: the artifact content, the scenario id, the judge name,
+* the full dimension list (key + description — the description IS the rubric
+* text shown to the judge), and a caller-supplied `judgeVersion`.
+* `judgeVersion` is REQUIRED: a judge whose prompt/model/ensemble changes
+* without a version bump would otherwise silently serve stale verdicts.
+*
+* Strict canonicalization (`canonicalJson`) throws on undefined / function /
+* symbol / non-finite numbers — an artifact that cannot be unambiguously
+* serialized cannot be content-addressed, and coercing it would let two
+* different artifacts collide on one key.
+*/
+function canonicalizeAt(value, path) {
+	if (value === null) return "null";
+	switch (typeof value) {
+		case "boolean": return value ? "true" : "false";
+		case "number":
+			if (!Number.isFinite(value)) throw new Error(`canonicalJson: non-finite number (${value}) at ${path} — ambiguity is an error, not a coercion`);
+			return JSON.stringify(value);
+		case "string": return JSON.stringify(value);
+		case "undefined":
+		case "function":
+		case "symbol": throw new Error(`canonicalJson: ${typeof value} at ${path} — ambiguity is an error, not a coercion`);
+		case "bigint": throw new Error(`canonicalJson: bigint at ${path} — not representable in JSON`);
+		case "object": break;
+	}
+	const obj = value;
+	if (typeof obj.toJSON === "function") return canonicalizeAt(obj.toJSON(), path);
+	if (Array.isArray(obj)) return `[${obj.map((item, i) => canonicalizeAt(item, `${path}[${i}]`)).join(",")}]`;
+	if (obj instanceof Map || obj instanceof Set) throw new Error(`canonicalJson: ${obj instanceof Map ? "Map" : "Set"} at ${path} — would serialize as '{}'; convert to a plain object/array first`);
+	return `{${Object.keys(obj).sort().map((k) => `${JSON.stringify(k)}:${canonicalizeAt(obj[k], `${path}.${k}`)}`).join(",")}}`;
+}
+/**
+* Stable JSON stringify: object keys sorted recursively, so two semantically
+* equal values produce byte-identical output regardless of key insertion
+* order. Throws on undefined / function / symbol / NaN / ±Infinity / bigint /
+* Map / Set — anything JSON.stringify would coerce or drop silently.
+*
+* Distinct from `pre-registration.ts`'s `canonicalize`/`hashJson`, which are
+* permissive (coercion allowed) and async (web-crypto). Use THIS pair when a
+* hash collision or silent coercion would corrupt a cache key or attestation.
+*/
+function canonicalJson(value) {
+	return canonicalizeAt(value, "$");
+}
+/** Hex sha-256 over `canonicalJson(value)`. The content address used by the
+*  verdict cache and report attestation. */
+function contentHash(value) {
+	return createHash("sha256").update(canonicalJson(value)).digest("hex");
+}
+/** Process-local Map-backed store. */
+function inMemoryVerdictCache() {
+	const entries = /* @__PURE__ */ new Map();
+	return {
+		get: (key) => entries.get(key),
+		set: (key, score) => {
+			entries.set(key, score);
+		}
+	};
+}
+function parseCacheLine(line, path, lineNo) {
+	let parsed;
+	try {
+		parsed = JSON.parse(line);
+	} catch (err) {
+		throw new Error(`fileVerdictCache: corrupt JSONL at ${path}:${lineNo} — ${err instanceof Error ? err.message : String(err)}`);
+	}
+	const rec = parsed;
+	if (typeof rec !== "object" || rec === null || typeof rec.key !== "string" || typeof rec.score !== "object" || rec.score === null || typeof rec.score.composite !== "number" || typeof rec.score.dimensions !== "object") throw new Error(`fileVerdictCache: invalid record shape at ${path}:${lineNo} — expected {key, score:{dimensions, composite, notes}}`);
+	return rec;
+}
+/**
+* JSONL-file-backed store: the full file is loaded into an in-memory index at
+* construction; every `set` appends one line synchronously (durable before
+* the verdict is returned). A corrupt or malformed line throws at load with
+* file:line — a skipped line would silently re-judge (cost) or, worse, mask
+* a half-written file that needs operator attention.
+*/
+function fileVerdictCache(path) {
+	const entries = /* @__PURE__ */ new Map();
+	if (existsSync(path)) {
+		const lines = readFileSync(path, "utf8").split("\n");
+		for (let i = 0; i < lines.length; i++) {
+			const line = lines[i];
+			if (line === void 0 || line.trim() === "") continue;
+			const rec = parseCacheLine(line, path, i + 1);
+			entries.set(rec.key, rec.score);
+		}
+	}
+	return {
+		get: (key) => entries.get(key),
+		set: (key, score) => {
+			appendFileSync(path, `${JSON.stringify({
+				key,
+				score
+			})}\n`, "utf8");
+			entries.set(key, score);
+		}
+	};
+}
+/**
+* Wrap a `JudgeConfig` so repeat judgments of the same artifact are served
+* from the store instead of re-invoking `score()`. The wrapper is generic
+* over the judge's own type parameters and preserves `appliesTo` — it is a
+* drop-in replacement anywhere a `JudgeConfig` is accepted.
+*
+* A judge that throws is NOT cached: the error propagates and the next
+* attempt re-judges (caching a failure would pin a transient outage forever).
+*/
+function cachedJudge(judge, store, options) {
+	if (typeof options.judgeVersion !== "string" || options.judgeVersion.trim() === "") throw new Error("cachedJudge: judgeVersion is required and must be a non-empty string");
+	const stats = {
+		hits: 0,
+		misses: 0
+	};
+	const wrapped = {
+		name: judge.name,
+		dimensions: judge.dimensions,
+		judgeVersion: options.judgeVersion,
+		async score(input) {
+			const key = contentHash({
+				artifact: canonicalJson(input.artifact),
+				scenarioId: input.scenario.id,
+				judgeName: judge.name,
+				dimensions: judge.dimensions,
+				judgeVersion: options.judgeVersion
+			});
+			const cached = await store.get(key);
+			if (cached !== void 0) {
+				stats.hits += 1;
+				return cached;
+			}
+			const score = await judge.score(input);
+			await store.set(key, score);
+			stats.misses += 1;
+			return score;
+		},
+		stats: () => ({ ...stats })
+	};
+	if (judge.appliesTo) wrapped.appliesTo = judge.appliesTo;
+	return wrapped;
+}
+//#endregion
+//#region src/campaign/external-optimizer-http.ts
+function listenLocal(server) {
+	return new Promise((resolvePromise, reject) => {
+		server.once("error", reject);
+		server.listen(0, "127.0.0.1", () => {
+			server.off("error", reject);
+			const address = server.address();
+			if (!address || typeof address === "string") {
+				reject(/* @__PURE__ */ new Error("external optimizer callback did not bind a TCP port"));
+				return;
+			}
+			resolvePromise(address.port);
+		});
+	});
+}
+function closeServer(server) {
+	return new Promise((resolvePromise, reject) => {
+		server.close((error) => error ? reject(error) : resolvePromise());
+	});
+}
+function sendJson(response, status, body) {
+	response.writeHead(status, { "content-type": "application/json; charset=utf-8" });
+	response.end(JSON.stringify(body));
+}
+//#endregion
+//#region src/campaign/external-optimizer-model-proxy.ts
+const MODEL_PROXY_PATHS = /* @__PURE__ */ new Set(["/v1/chat/completions", "/v1/responses"]);
+/**
+* Put an OpenAI-compatible optimizer behind the shared cost ledger.
+*
+* The child process receives only a loopback URL and an ephemeral token. The
+* package that owns execution receives a validated immutable request through
+* `call`; Eval receives no provider credential. Every request reserves its
+* conservative byte-count input bound plus the declared output cap before the
+* owner is invoked exactly once.
+*/
+async function startExternalOptimizerModelProxy(args) {
+	assertModelProxyConfig(args);
+	args.signal?.throwIfAborted();
+	const token = randomLocalToken();
+	let requestCount = 0;
+	let successfulCompletionCount = 0;
+	let modelCallInvocations = 0;
+	let executionRecordCount = 0;
+	let executionSequence = 0;
+	const failures = [];
+	let totalRequestCount = args.initialUsage?.requests ?? 0;
+	let committedForBudget = args.initialUsage?.costUsd ?? 0;
+	let reservedForBudget = 0;
+	let accepting = true;
+	let closePromise;
+	const activeControllers = /* @__PURE__ */ new Set();
+	const activeHandlers = /* @__PURE__ */ new Set();
+	const server = createServer((request, response) => {
+		if (!accepting) {
+			sendJsonIfOpen$1(response, 503, { error: "external optimizer model proxy is closing" });
+			return;
+		}
+		const controller = new AbortController();
+		const abortRequest = () => {
+			request.destroy();
+			response.destroy();
+		};
+		activeControllers.add(controller);
+		controller.signal.addEventListener("abort", abortRequest, { once: true });
+		let handler;
+		handler = handleModelProxyRequest({
+			request,
+			response,
+			controller,
+			token,
+			args,
+			nextReservation: (maximumCostUsd) => {
+				if (totalRequestCount >= args.budget.maxRequests) return {
+					accepted: false,
+					reason: "optimizer model request limit reached"
+				};
+				if (args.budget.maxCostUsd !== void 0 && maximumCostUsd !== void 0 && committedForBudget + reservedForBudget + maximumCostUsd > args.budget.maxCostUsd + Number.EPSILON) return {
+					accepted: false,
+					reason: "optimizer model cost limit reached"
+				};
+				requestCount += 1;
+				totalRequestCount += 1;
+				reservedForBudget += maximumCostUsd ?? 0;
+				return { accepted: true };
+			},
+			settleReservation: (maximumCostUsd, chargedCostUsd) => {
+				reservedForBudget = Math.max(0, reservedForBudget - (maximumCostUsd ?? 0));
+				committedForBudget += chargedCostUsd ?? 0;
+			},
+			recordSuccessfulCompletion: () => {
+				successfulCompletionCount += 1;
+			},
+			recordExecutionReceipt: (observation) => {
+				try {
+					args.recordExecution({
+						...observation,
+						sequence: executionSequence + 1
+					});
+				} catch (error) {
+					throw new ModelExecutionPersistenceError(`optimizer model execution evidence was not persisted: ${toErrorMessage(error)}`);
+				}
+				executionSequence += 1;
+				executionRecordCount += 1;
+			},
+			recordModelCallInvocation: () => {
+				modelCallInvocations += 1;
+			},
+			recordFailure: (error) => {
+				failures.push(error);
+			}
+		}).finally(() => {
+			controller.signal.removeEventListener("abort", abortRequest);
+			activeControllers.delete(controller);
+			activeHandlers.delete(handler);
+		});
+		activeHandlers.add(handler);
+		handler.catch(() => void 0);
+	});
+	const port = await listenLocal(server);
+	const close = () => {
+		closePromise ??= closeModelProxy();
+		return closePromise;
+	};
+	const onAbort = () => {
+		for (const controller of activeControllers) controller.abort(args.signal?.reason);
+		close().catch(() => void 0);
+	};
+	args.signal?.addEventListener("abort", onAbort, { once: true });
+	if (args.signal?.aborted) onAbort();
+	const assertExecutionComplete = () => {
+		if (executionRecordCount !== modelCallInvocations) throw new Error(`external optimizer model callback returned ${executionRecordCount} execution records for ${modelCallInvocations} invoked calls`);
+	};
+	return {
+		baseUrl: `http://127.0.0.1:${port}/v1`,
+		apiKey: token,
+		requestAttempts: () => requestCount,
+		successfulCompletions: () => successfulCompletionCount,
+		assertExecutionComplete,
+		failures: () => [...failures],
+		close
+	};
+	async function closeModelProxy() {
+		args.signal?.removeEventListener("abort", onAbort);
+		accepting = false;
+		const closingServer = closeServer(server);
+		server.closeIdleConnections?.();
+		const [serverResult] = await Promise.allSettled([closingServer, waitForActiveHandlers$1(activeHandlers)]);
+		if (activeControllers.size !== 0 || activeHandlers.size !== 0) throw new Error("external optimizer model proxy closed with active request work");
+		let executionError;
+		try {
+			assertExecutionComplete();
+		} catch (error) {
+			executionError = error;
+		}
+		if (serverResult?.status === "rejected" && executionError !== void 0) throw new AggregateError([serverResult.reason, executionError], "external optimizer model proxy close and execution evidence both failed");
+		if (serverResult?.status === "rejected") throw serverResult.reason;
+		if (executionError !== void 0) throw executionError;
+	}
+}
+async function handleModelProxyRequest(args) {
+	const { controller, request, response } = args;
+	try {
+		const path = request.url ? new URL(request.url, "http://127.0.0.1").pathname : "";
+		if (request.method !== "POST" || !MODEL_PROXY_PATHS.has(path)) {
+			sendJsonIfOpen$1(response, 404, { error: "not found" });
+			return;
+		}
+		const modelPath = path;
+		if (request.headers.authorization !== `Bearer ${args.token}`) {
+			sendJsonIfOpen$1(response, 401, { error: "unauthorized" });
+			return;
+		}
+		const body = await readBody(request, args.args.budget.maxRequestBytes);
+		const parsed = parseModelProxyRequest(body, modelPath, args.args.model, args.args.budget);
+		const maximumUsage = conservativeMaximumUsage(body.byteLength, parsed.maxOutputTokens + (args.args.budget.maxReasoningTokensPerRequest ?? 0), args.args.budget.pricing);
+		const maximumCostUsd = args.args.budget.pricing ? costForTokenPricing(args.args.budget.pricing, maximumUsage) : void 0;
+		const reservation = args.nextReservation(maximumCostUsd);
+		if (!reservation.accepted) {
+			sendJsonIfOpen$1(response, 429, { error: reservation.reason });
+			return;
+		}
+		const timeout = setTimeout(() => controller.abort(), args.args.budget.requestTimeoutMs ?? 3e5);
+		let chargedForBudget = maximumCostUsd;
+		try {
+			const paid = await args.args.costLedger.runPaidCall({
+				...args.args.callId ? { callId: args.args.callId } : {},
+				channel: args.args.channel ?? "optimizer",
+				phase: args.args.phase,
+				actor: args.args.actor,
+				...args.args.tags ? { tags: args.args.tags } : {},
+				model: args.args.model,
+				...args.args.budget.pricing ? { maximumCharge: {
+					customTokenPricing: args.args.budget.pricing,
+					...maximumUsage
+				} } : {},
+				signal: controller.signal,
+				execute: async (paidCallSignal, paidCallId) => forwardModelProxyRequest({
+					call: args.args.call,
+					callId: paidCallId,
+					callRef: args.args.callRef,
+					recordExecutionReceipt: args.recordExecutionReceipt,
+					recordModelCallInvocation: args.recordModelCallInvocation,
+					path: modelPath,
+					request: parsed.request,
+					model: args.args.model,
+					maxOutputTokens: parsed.maxOutputTokens,
+					...args.args.budget.maxReasoningTokensPerRequest === void 0 ? {} : { maxReasoningTokens: args.args.budget.maxReasoningTokensPerRequest },
+					maxResponseBytes: args.args.budget.maxResponseBytes,
+					signal: paidCallSignal
+				}),
+				receipt: (result) => result.receipt,
+				receiptFromError: () => ({
+					model: args.args.model,
+					inputTokens: 0,
+					outputTokens: 0,
+					costUnknown: true,
+					usageUnknown: true
+				})
+			});
+			if (!paid.succeeded) {
+				args.recordFailure(paid.error);
+				chargedForBudget = paid.receipt ? paid.receipt.usageUnknown || paid.receipt.costUnknown ? maximumCostUsd : paid.receipt.costUsd : void 0;
+				sendJsonIfOpen$1(response, isAbortError(paid.error) ? 504 : paid.error instanceof ProviderResponseTooLargeError || paid.error instanceof MissingModelExecutionError || paid.error instanceof ModelExecutionPersistenceError || paid.error instanceof OwnerModelContractError ? 502 : 429, { error: paid.error.message });
+				return;
+			}
+			if (paid.value.modelCallFailed) {
+				sendJsonIfOpen$1(response, 502, { error: paid.value.modelCallFailed });
+				return;
+			}
+			chargedForBudget = paid.value.usageComplete ? paid.receipt.costUsd : maximumCostUsd;
+			if (paid.value.usageRejected) {
+				sendJsonIfOpen$1(response, 502, { error: paid.value.usageRejected });
+				return;
+			}
+			if (paid.value.status >= 200 && paid.value.status < 300) args.recordSuccessfulCompletion();
+			if (response.destroyed || response.writableEnded) return;
+			response.writeHead(paid.value.status, {
+				"content-type": paid.value.contentType,
+				"content-length": String(paid.value.body.byteLength)
+			});
+			response.end(paid.value.body);
+		} finally {
+			clearTimeout(timeout);
+			args.settleReservation(maximumCostUsd, chargedForBudget);
+		}
+	} catch (error) {
+		sendJsonIfOpen$1(response, error instanceof RequestBodyTooLargeError ? 413 : error instanceof Error && isAbortError(error) ? 503 : 400, { error: toErrorMessage(error) });
+	}
+}
+async function waitForActiveHandlers$1(activeHandlers) {
+	while (activeHandlers.size > 0) await Promise.allSettled([...activeHandlers]);
+}
+function sendJsonIfOpen$1(response, status, body) {
+	if (response.destroyed || response.writableEnded) return;
+	sendJson(response, status, body);
+}
+async function forwardModelProxyRequest(args) {
+	args.recordModelCallInvocation();
+	let called;
+	try {
+		called = await args.call({
+			callId: args.callId,
+			request: freezeJsonSnapshot(args.request, "optimizer model canonical request"),
+			endpointFormat: endpointFormat(args.path),
+			signal: args.signal
+		});
+	} catch (error) {
+		throw new MissingModelExecutionError(`optimizer model callback rejected without execution evidence: ${toErrorMessage(error)}`);
+	}
+	if (!called || typeof called !== "object" || typeof called.succeeded !== "boolean") throw new MissingModelExecutionError("optimizer model callback returned no typed success/failure outcome");
+	let execution;
+	try {
+		execution = freezeJsonSnapshot(called.execution, "optimizer model callback execution evidence");
+	} catch (error) {
+		throw new MissingModelExecutionError(`optimizer model callback returned invalid execution evidence: ${toErrorMessage(error)}`);
+	}
+	if (called.succeeded) {
+		let authoritativeReceipt;
+		let canonicalResponse;
+		try {
+			authoritativeReceipt = snapshotModelReceipt(called.receipt, args.model);
+			canonicalResponse = snapshotChatResponse(called.response, args.model);
+			assertResponseUsageMatchesReceipt(canonicalResponse, authoritativeReceipt);
+		} catch (error) {
+			args.recordExecutionReceipt({
+				callId: args.callId,
+				callRef: args.callRef,
+				path: args.path,
+				model: args.model,
+				succeeded: false,
+				error: toErrorMessage(error),
+				execution
+			});
+			throw error;
+		}
+		args.recordExecutionReceipt({
+			callId: args.callId,
+			callRef: args.callRef,
+			path: args.path,
+			model: args.model,
+			succeeded: true,
+			responseStatus: 200,
+			execution
+		});
+		const usageKnown = canonicalResponse.usage.captured !== false;
+		const reasoningTokens = canonicalResponse.usage.reasoningTokens ?? 0;
+		const completionTokens = canonicalResponse.usage.completionTokens - reasoningTokens;
+		const usageRejected = usageKnown && completionTokens > args.maxOutputTokens ? `optimizer model execution reported ${completionTokens} completion tokens, exceeding requested limit ${args.maxOutputTokens}` : usageKnown && args.maxReasoningTokens !== void 0 && reasoningTokens > args.maxReasoningTokens ? `optimizer model execution reported ${reasoningTokens} reasoning tokens, exceeding the declared budget ${args.maxReasoningTokens}` : void 0;
+		return {
+			status: 200,
+			contentType: "application/json",
+			body: encodeCanonicalModelResponse({
+				path: args.path,
+				callId: args.callId,
+				response: canonicalResponse,
+				receipt: authoritativeReceipt,
+				maxBytes: args.maxResponseBytes
+			}),
+			receipt: authoritativeReceipt,
+			usageComplete: authoritativeReceipt.usageUnknown !== true,
+			...usageRejected ? { usageRejected } : {}
+		};
+	} else {
+		if (typeof called.error !== "string" || !called.error.trim()) throw new MissingModelExecutionError("optimizer model callback failure did not return a public error");
+		args.recordExecutionReceipt({
+			callId: args.callId,
+			callRef: args.callRef,
+			path: args.path,
+			model: args.model,
+			succeeded: false,
+			error: called.error,
+			execution
+		});
+		const failedReceipt = snapshotModelReceipt(called.receipt, args.model);
+		return {
+			status: 502,
+			contentType: "application/json",
+			body: new TextEncoder().encode(JSON.stringify({ error: called.error })),
+			receipt: failedReceipt,
+			usageComplete: failedReceipt.usageUnknown !== true,
+			modelCallFailed: called.error
+		};
+	}
+}
+function snapshotModelReceipt(value, expectedModel) {
+	let snapshot;
+	try {
+		assertJsonValue(value, "optimizer model callback receipt");
+		snapshot = JSON.parse(canonicalJson(value));
+	} catch (error) {
+		throw new OwnerModelContractError(`optimizer model callback returned an invalid receipt: ${toErrorMessage(error)}`);
+	}
+	if (snapshot.model !== expectedModel) throw new OwnerModelContractError(`optimizer model callback receipt used '${snapshot.model}' instead of '${expectedModel}'`);
+	return snapshot;
+}
+function freezeJsonSnapshot(value, label) {
+	assertJsonValue(value, label);
+	return deepFreezeJson(JSON.parse(canonicalJson(value)));
+}
+function deepFreezeJson(value) {
+	if (value !== null && typeof value === "object") {
+		for (const child of Object.values(value)) deepFreezeJson(child);
+		Object.freeze(value);
+	}
+	return value;
+}
+function assertResponseUsageMatchesReceipt(response, receipt) {
+	if (response.usage.captured === false || receipt.usageUnknown === true) {
+		if (response.usage.captured !== false || receipt.usageUnknown !== true) throw new OwnerModelContractError("optimizer model response and execution receipt disagree about whether usage was captured");
+	} else {
+		const cachedTokens = response.usage.cachedPromptTokens ?? 0;
+		if (receipt.inputTokens + (receipt.cachedTokens ?? 0) !== response.usage.promptTokens) throw new OwnerModelContractError("optimizer model response promptTokens must equal receipt inputTokens plus cachedTokens");
+		if (cachedTokens !== (receipt.cachedTokens ?? 0)) throw new OwnerModelContractError("optimizer model response cachedPromptTokens disagrees with the execution receipt");
+		if (response.usage.completionTokens !== receipt.outputTokens) throw new OwnerModelContractError("optimizer model response completionTokens disagrees with the execution receipt");
+		if ((response.usage.reasoningTokens ?? 0) !== (receipt.reasoningTokens ?? 0)) throw new OwnerModelContractError("optimizer model response reasoningTokens disagrees with the execution receipt");
+	}
+	const receiptCostUsd = receipt.actualCostUsd ?? receipt.estimatedCostUsd ?? (receipt.customTokenPricing && receipt.usageUnknown !== true ? costForTokenPricing(receipt.customTokenPricing, receipt) : null);
+	if (response.costUsd !== receiptCostUsd) throw new OwnerModelContractError("optimizer model response billed cost disagrees with the execution receipt");
+}
+function parseModelProxyRequest(body, path, expectedModel, budget) {
+	let value;
+	try {
+		value = JSON.parse(Buffer.from(body).toString("utf8"));
+	} catch {
+		throw new Error("optimizer model request must be valid JSON");
+	}
+	if (!isRecord(value)) throw new Error("optimizer model request must be a JSON object");
+	if (value.model !== expectedModel) throw new Error(`optimizer model request must use configured model '${expectedModel}'`);
+	if (value.stream !== void 0 && value.stream !== false) throw new Error("streaming optimizer model requests are not supported");
+	for (const field of [
+		"n",
+		"best_of",
+		"candidate_count",
+		"num_candidates"
+	]) if (value[field] !== void 0 && value[field] !== 1) throw new Error(`optimizer model request ${field} must be 1 when supplied`);
+	if (value.reasoning !== void 0 || value.reasoning_effort !== void 0) throw new Error("optimizer model reasoning settings belong to the execution AgentProfile");
+	const maxOutputTokens = parseOutputMaximum(value, path === "/v1/responses" ? ["max_output_tokens"] : [
+		"max_tokens",
+		"max_completion_tokens",
+		"max_output_tokens"
+	]);
+	if (maxOutputTokens > budget.maxOutputTokensPerRequest) throw new Error("optimizer model request exceeds maxOutputTokensPerRequest");
+	return {
+		maxOutputTokens,
+		request: freezeJsonSnapshot(path === "/v1/chat/completions" ? parseChatCompletionsRequest(value, expectedModel, maxOutputTokens) : parseResponsesRequest(value, expectedModel, maxOutputTokens), "optimizer model canonical request")
+	};
+}
+function parseChatCompletionsRequest(body, model, maxTokens) {
+	assertAllowedKeys(body, [
+		"model",
+		"messages",
+		"max_tokens",
+		"max_completion_tokens",
+		"max_output_tokens",
+		"temperature",
+		"thinking",
+		"response_format",
+		"stream",
+		"n",
+		"best_of",
+		"candidate_count",
+		"num_candidates"
+	]);
+	return {
+		model,
+		messages: parseChatMessages(body.messages),
+		maxTokens,
+		...parseTemperature(body.temperature),
+		...parseThinking(body.thinking),
+		...parseChatResponseFormat(body.response_format)
+	};
+}
+function parseResponsesRequest(body, model, maxTokens) {
+	assertAllowedKeys(body, [
+		"model",
+		"input",
+		"instructions",
+		"max_output_tokens",
+		"temperature",
+		"thinking",
+		"text",
+		"stream",
+		"n",
+		"best_of",
+		"candidate_count",
+		"num_candidates"
+	]);
+	const instructions = body.instructions;
+	if (instructions !== void 0 && typeof instructions !== "string") throw new Error("optimizer Responses instructions must be a string");
+	return {
+		model,
+		messages: [...instructions === void 0 ? [] : [{
+			role: "system",
+			content: instructions
+		}], ...parseResponsesInput(body.input)],
+		maxTokens,
+		...parseTemperature(body.temperature),
+		...parseThinking(body.thinking),
+		...parseResponsesTextFormat(body.text)
+	};
+}
+function parseOutputMaximum(body, fields) {
+	const supplied = fields.flatMap((field) => body[field] === void 0 ? [] : [{
+		field,
+		value: body[field]
+	}]);
+	if (supplied.length === 0 || supplied.some(({ value }) => !Number.isSafeInteger(value) || value <= 0)) throw new Error("optimizer model request requires a positive output-token limit");
+	if (new Set(supplied.map(({ value }) => value)).size !== 1) throw new Error("optimizer model request supplied conflicting output-token limits");
+	return supplied[0].value;
+}
+function parseTemperature(value) {
+	if (value === void 0) return {};
+	if (typeof value !== "number" || !Number.isFinite(value)) throw new Error("optimizer model request temperature must be finite");
+	return { temperature: value };
+}
+function parseThinking(value) {
+	if (value === void 0) return {};
+	if (!isRecord(value)) throw new Error("optimizer model request thinking must be an object");
+	assertAllowedKeys(value, ["type"], "optimizer model request thinking");
+	if (value.type !== "enabled" && value.type !== "disabled") throw new Error("optimizer model request thinking.type must be enabled or disabled");
+	return { thinking: value.type };
+}
+function parseChatMessages(value) {
+	if (!Array.isArray(value)) throw new Error("optimizer chat request messages must be an array");
+	return value.map((message, index) => parseMessage(message, `optimizer chat message ${index}`));
+}
+function parseResponsesInput(value) {
+	if (typeof value === "string") return [{
+		role: "user",
+		content: value
+	}];
+	if (!Array.isArray(value) || value.length === 0) throw new Error("optimizer Responses request requires non-empty input");
+	return value.map((message, index) => {
+		if (!isRecord(message)) throw new Error(`optimizer Responses input ${index} must be a message object`);
+		assertAllowedKeys(message, [
+			"type",
+			"role",
+			"content"
+		], `optimizer Responses input ${index}`);
+		if (message.type !== void 0 && message.type !== "message") throw new Error(`optimizer Responses input ${index} type must be message`);
+		return parseMessage(message, `optimizer Responses input ${index}`, true);
+	});
+}
+function parseMessage(value, label, responsesContent = false) {
+	if (!isRecord(value)) throw new Error(`${label} must be an object`);
+	assertAllowedKeys(value, responsesContent ? [
+		"type",
+		"role",
+		"content"
+	] : ["role", "content"], label);
+	if (value.role !== "system" && value.role !== "user" && value.role !== "assistant") throw new Error(`${label} role must be system, user, or assistant`);
+	return {
+		role: value.role,
+		content: parseMessageContent(value.content, label, responsesContent)
+	};
+}
+function parseMessageContent(value, label, responsesContent) {
+	if (typeof value === "string") return value;
+	if (!Array.isArray(value) || value.length === 0) throw new Error(`${label} content must be text or a non-empty content array`);
+	return value.map((part, partIndex) => {
+		if (!isRecord(part)) throw new Error(`${label} content ${partIndex} must be an object`);
+		const partLabel = `${label} content ${partIndex}`;
+		if (part.type === "text" || responsesContent && part.type === "input_text") {
+			assertAllowedKeys(part, ["type", "text"], partLabel);
+			if (typeof part.text !== "string") throw new Error(`${partLabel} text must be a string`);
+			return {
+				type: "text",
+				text: part.text
+			};
+		}
+		if (responsesContent && part.type === "output_text") {
+			assertAllowedKeys(part, ["type", "text"], partLabel);
+			if (typeof part.text !== "string") throw new Error(`${partLabel} text must be a string`);
+			return {
+				type: "text",
+				text: part.text
+			};
+		}
+		if (part.type === "image_url") {
+			assertAllowedKeys(part, ["type", "image_url"], partLabel);
+			if (!isRecord(part.image_url) || typeof part.image_url.url !== "string") throw new Error(`${partLabel} image_url must contain a URL string`);
+			assertAllowedKeys(part.image_url, ["url", "detail"], `${partLabel} image_url`);
+			const detail = parseImageDetail(part.image_url.detail, partLabel);
+			return {
+				type: "image_url",
+				image_url: {
+					url: part.image_url.url,
+					...detail
+				}
+			};
+		}
+		if (responsesContent && part.type === "input_image") {
+			assertAllowedKeys(part, [
+				"type",
+				"image_url",
+				"detail"
+			], partLabel);
+			if (typeof part.image_url !== "string") throw new Error(`${partLabel} image_url must be a URL string`);
+			const detail = parseImageDetail(part.detail, partLabel);
+			return {
+				type: "image_url",
+				image_url: {
+					url: part.image_url,
+					...detail
+				}
+			};
+		}
+		throw new Error(`${partLabel} uses an unsupported content type`);
+	});
+}
+function parseImageDetail(value, label) {
+	if (value === void 0) return {};
+	if (value !== "auto" && value !== "low" && value !== "high") throw new Error(`${label} image detail must be auto, low, or high`);
+	return { detail: value };
+}
+function parseChatResponseFormat(value) {
+	if (value === void 0) return {};
+	if (!isRecord(value) || typeof value.type !== "string") throw new Error("optimizer chat response_format must be an object with a type");
+	if (value.type === "text") {
+		assertAllowedKeys(value, ["type"], "optimizer chat response_format");
+		return {};
+	}
+	if (value.type === "json_object") {
+		assertAllowedKeys(value, ["type"], "optimizer chat response_format");
+		return { jsonMode: true };
+	}
+	if (value.type !== "json_schema") throw new Error("optimizer chat response_format type is unsupported");
+	assertAllowedKeys(value, ["type", "json_schema"], "optimizer chat response_format");
+	return { jsonSchema: parseJsonSchema(value.json_schema, "optimizer chat response_format") };
+}
+function parseResponsesTextFormat(value) {
+	if (value === void 0) return {};
+	if (!isRecord(value)) throw new Error("optimizer Responses text must be an object");
+	assertAllowedKeys(value, ["format"], "optimizer Responses text");
+	if (value.format === void 0) return {};
+	if (!isRecord(value.format) || typeof value.format.type !== "string") throw new Error("optimizer Responses text.format must be an object with a type");
+	const format = value.format;
+	if (format.type === "text") {
+		assertAllowedKeys(format, ["type"], "optimizer Responses text.format");
+		return {};
+	}
+	if (format.type === "json_object") {
+		assertAllowedKeys(format, ["type"], "optimizer Responses text.format");
+		return { jsonMode: true };
+	}
+	if (format.type !== "json_schema") throw new Error("optimizer Responses text.format type is unsupported");
+	return { jsonSchema: parseJsonSchema(format, "optimizer Responses text.format", true) };
+}
+function parseJsonSchema(value, label, flat = false) {
+	if (!isRecord(value)) throw new Error(`${label} JSON schema must be an object`);
+	assertAllowedKeys(value, [
+		"name",
+		"schema",
+		"strict",
+		...flat ? ["type"] : []
+	], label);
+	if (typeof value.name !== "string" || !value.name.trim()) throw new Error(`${label} JSON schema name must be non-empty`);
+	if (!isRecord(value.schema)) throw new Error(`${label} JSON schema body must be an object`);
+	if (value.strict !== void 0 && value.strict !== true) throw new Error(`${label} JSON schema strict must be true when supplied`);
+	return {
+		name: value.name,
+		schema: freezeJsonSnapshot(value.schema, `${label} schema`)
+	};
+}
+function assertAllowedKeys(value, allowed, label = "optimizer model request") {
+	const allowedSet = new Set(allowed);
+	const unknown = Object.keys(value).filter((key) => !allowedSet.has(key));
+	if (unknown.length > 0) throw new Error(`${label} contains unsupported fields: ${unknown.join(", ")}`);
+}
+function snapshotChatResponse(value, expectedModel) {
+	if (!isRecord(value)) throw new OwnerModelContractError("optimizer model callback response must be an object");
+	if (typeof value.content !== "string") throw new OwnerModelContractError("optimizer model callback response content must be a string");
+	if (value.model !== expectedModel) throw new OwnerModelContractError(`optimizer model callback response used '${String(value.model)}' instead of '${expectedModel}'`);
+	if (!isNonnegativeFiniteNumber(value.durationMs)) throw new OwnerModelContractError("optimizer model callback response durationMs must be finite and non-negative");
+	if (value.costUsd !== null && !isNonnegativeFiniteNumber(value.costUsd)) throw new OwnerModelContractError("optimizer model callback response costUsd must be null or finite and non-negative");
+	if (value.finishReason !== void 0 && value.finishReason !== null && typeof value.finishReason !== "string") throw new OwnerModelContractError("optimizer model callback response finishReason must be a string or null");
+	if (value.contentEmpty !== void 0 && (typeof value.contentEmpty !== "boolean" || value.contentEmpty !== (value.content.trim().length === 0))) throw new OwnerModelContractError("optimizer model callback response contentEmpty must match content");
+	if (!isRecord(value.raw)) throw new OwnerModelContractError("optimizer model callback response raw must be an object");
+	if (!isRecord(value.usage)) throw new OwnerModelContractError("optimizer model callback response usage must be an object");
+	const usage = value.usage;
+	for (const field of [
+		"promptTokens",
+		"completionTokens",
+		"totalTokens"
+	]) if (!isNonnegativeSafeInteger(usage[field])) throw new OwnerModelContractError(`optimizer model callback response usage.${field} must be a non-negative safe integer`);
+	const promptTokens = usage.promptTokens;
+	const completionTokens = usage.completionTokens;
+	const totalTokens = usage.totalTokens;
+	if (totalTokens !== promptTokens + completionTokens) throw new OwnerModelContractError("optimizer model callback response totalTokens must equal promptTokens plus completionTokens");
+	if (usage.captured !== void 0 && typeof usage.captured !== "boolean") throw new OwnerModelContractError("optimizer model callback response usage.captured must be a boolean");
+	if (usage.cachedPromptTokens !== void 0 && (!isNonnegativeSafeInteger(usage.cachedPromptTokens) || usage.cachedPromptTokens > promptTokens)) throw new OwnerModelContractError("optimizer model callback response cachedPromptTokens must be a subset of promptTokens");
+	if (usage.reasoningTokens !== void 0 && (!isNonnegativeSafeInteger(usage.reasoningTokens) || usage.reasoningTokens > completionTokens)) throw new OwnerModelContractError("optimizer model callback response reasoningTokens must be a subset of completionTokens");
+	let raw;
+	try {
+		raw = freezeJsonSnapshot(value.raw, "optimizer model callback canonical response.raw");
+	} catch (error) {
+		throw new OwnerModelContractError(`optimizer model callback returned invalid raw response evidence: ${toErrorMessage(error)}`);
+	}
+	return deepFreezeJson({
+		content: value.content,
+		usage: {
+			promptTokens,
+			completionTokens,
+			totalTokens,
+			...usage.captured === void 0 ? {} : { captured: usage.captured },
+			...usage.reasoningTokens === void 0 ? {} : { reasoningTokens: usage.reasoningTokens },
+			...usage.cachedPromptTokens === void 0 ? {} : { cachedPromptTokens: usage.cachedPromptTokens }
+		},
+		costUsd: value.costUsd,
+		model: value.model,
+		durationMs: value.durationMs,
+		...value.finishReason === void 0 ? {} : { finishReason: value.finishReason },
+		...value.contentEmpty === void 0 ? {} : { contentEmpty: value.contentEmpty },
+		raw
+	});
+}
+function encodeCanonicalModelResponse(args) {
+	const usage = encodeProtocolUsage(args.path, args.response, args.receipt);
+	const finishReason = args.response.finishReason === void 0 ? "stop" : args.response.finishReason;
+	const body = args.path === "/v1/chat/completions" ? {
+		id: `chatcmpl-${args.callId}`,
+		object: "chat.completion",
+		created: 0,
+		model: args.response.model,
+		choices: [{
+			index: 0,
+			message: {
+				role: "assistant",
+				content: args.response.content
+			},
+			finish_reason: finishReason
+		}],
+		...usage ? { usage } : {}
+	} : {
+		id: `resp-${args.callId}`,
+		object: "response",
+		created_at: 0,
+		model: args.response.model,
+		status: finishReason === "length" ? "incomplete" : "completed",
+		error: null,
+		incomplete_details: finishReason === "length" ? { reason: "max_output_tokens" } : null,
+		output: [{
+			id: `msg-${args.callId}`,
+			type: "message",
+			status: finishReason === "length" ? "incomplete" : "completed",
+			role: "assistant",
+			content: [{
+				type: "output_text",
+				text: args.response.content,
+				annotations: []
+			}]
+		}],
+		output_text: args.response.content,
+		...usage ? { usage } : {}
+	};
+	const encoded = new TextEncoder().encode(JSON.stringify(body));
+	if (encoded.byteLength > args.maxBytes) throw new ProviderResponseTooLargeError();
+	return encoded;
+}
+function endpointFormat(path) {
+	return path === "/v1/responses" ? "responses" : "chat-completions";
+}
+function encodeProtocolUsage(path, response, receipt) {
+	if (response.usage.captured === false) return void 0;
+	const inputDetails = {
+		...receipt.cachedTokens === void 0 ? {} : { cached_tokens: receipt.cachedTokens },
+		...receipt.cacheWriteTokens === void 0 ? {} : path === "/v1/chat/completions" ? { cache_creation_tokens: receipt.cacheWriteTokens } : { cache_write_tokens: receipt.cacheWriteTokens }
+	};
+	const outputDetails = { ...receipt.reasoningTokens === void 0 ? {} : { reasoning_tokens: receipt.reasoningTokens } };
+	return path === "/v1/chat/completions" ? {
+		prompt_tokens: response.usage.promptTokens,
+		completion_tokens: response.usage.completionTokens,
+		total_tokens: response.usage.totalTokens,
+		...Object.keys(inputDetails).length > 0 ? { prompt_tokens_details: inputDetails } : {},
+		...Object.keys(outputDetails).length > 0 ? { completion_tokens_details: outputDetails } : {},
+		...receipt.actualCostUsd === void 0 ? {} : { cost: receipt.actualCostUsd }
+	} : {
+		input_tokens: response.usage.promptTokens,
+		output_tokens: response.usage.completionTokens,
+		total_tokens: response.usage.totalTokens,
+		...Object.keys(inputDetails).length > 0 ? { input_tokens_details: inputDetails } : {},
+		...Object.keys(outputDetails).length > 0 ? { output_tokens_details: outputDetails } : {},
+		...receipt.actualCostUsd === void 0 ? {} : { cost: receipt.actualCostUsd }
+	};
+}
+function isNonnegativeFiniteNumber(value) {
+	return typeof value === "number" && Number.isFinite(value) && value >= 0;
+}
+function isNonnegativeSafeInteger(value) {
+	return Number.isSafeInteger(value) && value >= 0;
+}
+function conservativeMaximumUsage(inputTokenUpperBound, outputTokenUpperBound, pricing) {
+	if (pricing === void 0) return {
+		inputTokens: inputTokenUpperBound,
+		outputTokens: outputTokenUpperBound
+	};
+	const inputRates = [pricing.inputUsdPerMillion, pricing.cachedInputUsdPerMillion ?? pricing.inputUsdPerMillion];
+	const mostExpensiveInputClass = inputRates.indexOf(Math.max(...inputRates));
+	return {
+		inputTokens: mostExpensiveInputClass === 0 ? inputTokenUpperBound : 0,
+		...mostExpensiveInputClass === 1 ? { cachedTokens: inputTokenUpperBound } : {},
+		cacheWriteTokens: inputTokenUpperBound,
+		outputTokens: outputTokenUpperBound
+	};
+}
+function assertModelProxyConfig(args) {
+	for (const [label, value] of [
+		["model", args.model],
+		["phase", args.phase],
+		["actor", args.actor]
+	]) if (typeof value !== "string" || !value.trim() || value.trim() !== value) throw new Error(`external optimizer model proxy: ${label} must be trimmed and non-empty`);
+	if (typeof args.call !== "function") throw new Error("external optimizer model proxy: call must be a function");
+	if (typeof args.callRef !== "string" || !args.callRef.trim() || args.callRef.trim() !== args.callRef) throw new Error("external optimizer model proxy: callRef must be trimmed and non-empty");
+	if (typeof args.recordExecution !== "function") throw new Error("external optimizer model proxy: recordExecution must be a function");
+	if (args.callId !== void 0) {
+		if (typeof args.callId !== "string" || !args.callId.trim() || args.callId !== args.callId.trim()) throw new Error("external optimizer model proxy: callId must be trimmed and non-empty");
+		if (args.budget.maxRequests !== 1) throw new Error("external optimizer model proxy: callId requires budget.maxRequests to be 1");
+	}
+	assertExternalOptimizerModelBudget(args.budget, "external optimizer model proxy: budget");
+	if (args.tags !== void 0) {
+		for (const [key, value] of Object.entries(args.tags)) if (!key.trim() || key.trim() !== key || !value.trim() || value.trim() !== value) throw new Error("external optimizer model proxy: tags must be trimmed and non-empty");
+	}
+	if (args.initialUsage !== void 0) {
+		if (!Number.isSafeInteger(args.initialUsage.requests) || args.initialUsage.requests < 0 || args.initialUsage.costUsd !== void 0 && (!Number.isFinite(args.initialUsage.costUsd) || args.initialUsage.costUsd < 0)) throw new Error("external optimizer model proxy: initialUsage must contain non-negative requests and cost");
+		if (args.initialUsage.requests > args.budget.maxRequests || args.budget.maxCostUsd !== void 0 && args.initialUsage.costUsd !== void 0 && args.initialUsage.costUsd > args.budget.maxCostUsd + Number.EPSILON) throw new Error("external optimizer model proxy: initialUsage exceeds the configured budget");
+	}
+}
+var RequestBodyTooLargeError = class extends Error {};
+var ProviderResponseTooLargeError = class extends Error {
+	constructor() {
+		super("optimizer model response exceeds maxResponseBytes");
+	}
+};
+var MissingModelExecutionError = class extends Error {};
+var ModelExecutionPersistenceError = class extends Error {};
+var OwnerModelContractError = class extends Error {};
+function readBody(request, maximumBytes) {
+	return new Promise((resolvePromise, reject) => {
+		let size = 0;
+		let tooLarge = false;
+		const chunks = [];
+		request.on("data", (chunk) => {
+			if (tooLarge) return;
+			size += chunk.byteLength;
+			if (size > maximumBytes) {
+				tooLarge = true;
+				chunks.length = 0;
+				return;
+			}
+			chunks.push(chunk);
+		});
+		request.on("error", reject);
+		request.on("end", () => {
+			if (tooLarge) {
+				reject(new RequestBodyTooLargeError("optimizer model request body too large"));
+				return;
+			}
+			resolvePromise(new Uint8Array(Buffer.concat(chunks)));
+		});
+	});
+}
+function randomLocalToken() {
+	return randomBytes(32).toString("hex");
+}
+function isAbortError(error) {
+	return error.name === "AbortError" || error.message.toLowerCase().includes("abort");
+}
+function toErrorMessage(error) {
+	return error instanceof Error ? error.message : String(error);
+}
+//#endregion
+//#region src/campaign/external-optimizer-resources.ts
+async function runWithCleanup(args) {
+	let value;
+	let operationError;
+	try {
+		value = await args.run();
+	} catch (cause) {
+		operationError = toError(cause);
+	}
+	let cleanupError;
+	try {
+		await args.cleanup();
+	} catch (cause) {
+		cleanupError = toError(cause);
+	}
+	if (operationError && cleanupError) throw new AggregateError([operationError, cleanupError], `${operationError.message}; ${args.label} cleanup failed: ${cleanupError.message}`);
+	if (operationError) throw operationError;
+	if (cleanupError) throw new Error(`${args.label} cleanup failed: ${cleanupError.message}`, { cause: cleanupError });
+	return value;
+}
+async function closeExternalOptimizerResources(args) {
+	const errors = (await Promise.allSettled([...args.modelProxy ? [args.modelProxy.close()] : [], args.callback.close()])).flatMap((result) => result.status === "rejected" ? [result.reason] : []);
+	if (errors.length > 0) throw new AggregateError(errors, `${args.label}: failed to close optimizer resources`);
+}
+function toError(cause) {
+	return cause instanceof Error ? cause : new Error(String(cause));
+}
+//#endregion
+//#region src/campaign/external-optimizer-subprocess.ts
+const PROCESS_TERMINATION_GRACE_MS = 5e3;
+const PROCESS_TERMINATION_POLL_MS = 25;
+const PROCESS_KILL_WAIT_MS = 1e3;
+const MAX_TIMER_DELAY_MS = 2147483647;
+async function runExternalOptimizerProcess(args) {
+	if (!Number.isSafeInteger(args.timeoutMs) || args.timeoutMs <= 0 || args.timeoutMs > MAX_TIMER_DELAY_MS) throw new Error(`${args.label} timeoutMs must be between 1 and ${MAX_TIMER_DELAY_MS}`);
+	const limits = resolveExternalOptimizerProcessLimits(args.runner?.limits);
+	if (process.platform === "win32") throw new Error(`${args.label} requires POSIX process-group cleanup; run the optimizer through WSL or Linux`);
+	throwIfAborted(args.signal, args.label);
+	const dir = await mkdtemp(join(tmpdir(), args.tempPrefix));
+	const inputPath = join(dir, "input.json");
+	const outputPath = join(dir, "output.json");
+	return runWithCleanup({
+		label: `${args.label} temporary directory`,
+		run: async () => {
+			const serializedInput = JSON.stringify(args.input);
+			if (serializedInput === void 0) throw new Error(`${args.label} input must be JSON-serializable`);
+			const inputJson = `${serializedInput}\n`;
+			const inputBytes = Buffer.byteLength(inputJson);
+			if (inputBytes > limits.maxInputBytes) throw new Error(`${args.label} input exceeds ${limits.maxInputBytes} bytes (${inputBytes})`);
+			await writeFile(inputPath, inputJson);
+			const command = resolveRunnerCommand(args.runner?.command ?? "python");
+			const commandArgs = [
+				...args.runner?.args ?? ["-m", args.module],
+				...args.additionalArgs ?? [],
+				"--input",
+				inputPath,
+				"--output",
+				outputPath
+			];
+			await runProcess({
+				label: args.label,
+				command,
+				args: commandArgs,
+				cwd: dir,
+				env: args.runner?.env,
+				timeoutMs: args.timeoutMs,
+				maxOutputChars: limits.maxOutputChars,
+				signal: args.signal
+			});
+			throwIfAborted(args.signal, args.label);
+			const raw = JSON.parse(await readBoundedTextFile(outputPath, limits.maxResultBytes, `${args.label} output`));
+			throwIfAborted(args.signal, args.label);
+			if (!isRecord(raw)) throw new Error(`${args.label} output must be a JSON object`);
+			return raw;
+		},
+		cleanup: () => rm(dir, {
+			recursive: true,
+			force: true
+		})
+	});
+}
+function resolveRunnerCommand(command) {
+	if (isAbsolute(command) || !command.includes("/") && !command.includes("\\")) return command;
+	return resolve(command);
+}
+async function readBoundedTextFile(path, maxBytes, label) {
+	if (!(await lstat(path)).isFile()) throw new Error(`${label} must be a regular file`);
+	const file = await open(path, "r");
+	try {
+		const buffer = Buffer.allocUnsafe(maxBytes + 1);
+		let bytesRead = 0;
+		while (bytesRead < buffer.byteLength) {
+			const chunk = await file.read(buffer, bytesRead, buffer.byteLength - bytesRead, bytesRead);
+			if (chunk.bytesRead === 0) break;
+			bytesRead += chunk.bytesRead;
+		}
+		if (bytesRead > maxBytes) throw new Error(`${label} exceeds ${maxBytes} bytes`);
+		return buffer.subarray(0, bytesRead).toString("utf8");
+	} finally {
+		await file.close();
+	}
+}
+function runProcess(args) {
+	throwIfAborted(args.signal, args.label);
+	return new Promise((resolvePromise, reject) => {
+		const child = spawn(args.command, args.args, {
+			cwd: args.cwd,
+			env: {
+				...safeProcessEnvironment(),
+				...args.env
+			},
+			stdio: [
+				"ignore",
+				"pipe",
+				"pipe"
+			],
+			detached: process.platform !== "win32",
+			windowsHide: true
+		});
+		const stdout = createProcessOutputCapture();
+		const stderr = createProcessOutputCapture();
+		let settled = false;
+		let timeout;
+		const onAbort = () => finish(abortReason(args.signal, args.label));
+		const finish = (error) => {
+			if (settled) return;
+			settled = true;
+			if (timeout) clearTimeout(timeout);
+			args.signal?.removeEventListener("abort", onAbort);
+			terminateProcessTree(child).then(() => {
+				if (error) reject(error);
+				else resolvePromise();
+			}, (cleanupError) => {
+				if (error) {
+					const cleanup = cleanupError instanceof Error ? cleanupError : new Error(String(cleanupError));
+					reject(new AggregateError([error, cleanup], `${error.message}; ${args.label} process cleanup failed: ${cleanup.message}`));
+					return;
+				}
+				reject(/* @__PURE__ */ new Error(`${args.label} process cleanup failed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}`));
+			});
+		};
+		timeout = setTimeout(() => {
+			finish(/* @__PURE__ */ new Error(`${args.label} exceeded ${args.timeoutMs}ms`));
+		}, args.timeoutMs);
+		args.signal?.addEventListener("abort", onAbort, { once: true });
+		if (args.signal?.aborted) onAbort();
+		child.stdout.on("data", (chunk) => {
+			appendProcessOutput(stdout, chunk, args.maxOutputChars);
+		});
+		child.stderr.on("data", (chunk) => {
+			appendProcessOutput(stderr, chunk, args.maxOutputChars);
+		});
+		child.on("error", (error) => {
+			finish(/* @__PURE__ */ new Error(`${args.label} could not start: ${error.message}`));
+		});
+		child.on("close", (code) => {
+			if (code === 0) {
+				finish();
+				return;
+			}
+			finish(/* @__PURE__ */ new Error(`${args.label} exited ${String(code)}. stderr=${summarizeProcessOutput(stderr)} stdout=${summarizeProcessOutput(stdout)}`));
+		});
+	});
+}
+function throwIfAborted(signal, label) {
+	if (signal?.aborted) throw abortReason(signal, label);
+}
+function abortReason(signal, label) {
+	return signal.reason instanceof Error ? signal.reason : new Error(`${label} aborted`, { cause: signal.reason });
+}
+function safeProcessEnvironment() {
+	return Object.fromEntries([
+		"PATH",
+		"HOME",
+		"USER",
+		"LOGNAME",
+		"SHELL",
+		"TMPDIR",
+		"TMP",
+		"TEMP",
+		"LANG",
+		"LANGUAGE",
+		"LC_ALL",
+		"VIRTUAL_ENV",
+		"PYTHONPATH",
+		"SYSTEMROOT",
+		"COMSPEC",
+		"PATHEXT",
+		"WINDIR"
+	].flatMap((name) => {
+		const value = process.env[name];
+		return value === void 0 ? [] : [[name, value]];
+	}));
+}
+async function terminateProcessTree(child) {
+	const pid = child.pid;
+	if (!pid) return;
+	if (process.platform === "win32") throw new Error("native Windows process-tree cleanup is unsupported");
+	if (!signalProcessGroup(pid, "SIGTERM")) return;
+	if (await waitForProcessGroupExit(pid, PROCESS_TERMINATION_GRACE_MS)) return;
+	if (!signalProcessGroup(pid, "SIGKILL")) return;
+	if (await waitForProcessGroupExit(pid, PROCESS_KILL_WAIT_MS)) return;
+	throw new Error(`process group ${pid} remained alive after SIGKILL`);
+}
+function signalProcessGroup(pid, signal) {
+	try {
+		process.kill(-pid, signal);
+		return true;
+	} catch (error) {
+		if (isMissingProcessError(error)) return false;
+		throw error;
+	}
+}
+async function waitForProcessGroupExit(pid, timeoutMs) {
+	const deadline = Date.now() + timeoutMs;
+	while (processGroupExists(pid)) {
+		const remainingMs = deadline - Date.now();
+		if (remainingMs <= 0) return false;
+		await new Promise((resolve) => setTimeout(resolve, Math.min(PROCESS_TERMINATION_POLL_MS, remainingMs)));
+	}
+	return true;
+}
+function processGroupExists(pid) {
+	try {
+		process.kill(-pid, 0);
+		return true;
+	} catch (error) {
+		if (isMissingProcessError(error)) return false;
+		throw error;
+	}
+}
+function isMissingProcessError(error) {
+	return typeof error === "object" && error !== null && "code" in error && error.code === "ESRCH";
+}
+function createProcessOutputCapture() {
+	return {
+		full: "",
+		head: "",
+		tail: "",
+		totalChars: 0
+	};
+}
+function appendProcessOutput(capture, chunk, maxOutputChars) {
+	const text = chunk.toString();
+	capture.totalChars += text.length;
+	const headChars = Math.floor(maxOutputChars / 2);
+	const tailChars = maxOutputChars - headChars;
+	if (capture.full !== void 0) {
+		const combined = `${capture.full}${text}`;
+		if (combined.length <= maxOutputChars) {
+			capture.full = combined;
+			return;
+		}
+		capture.head = combined.slice(0, headChars);
+		capture.tail = combined.slice(-tailChars);
+		capture.full = void 0;
+		return;
+	}
+	capture.tail = `${capture.tail}${text}`.slice(-tailChars);
+}
+function summarizeProcessOutput(capture, max = 4e3) {
+	const compact = (capture.full ?? `${capture.head}\n...[${capture.totalChars - capture.head.length - capture.tail.length} chars omitted]...\n${capture.tail}`).trim().replace(/\s+/g, " ");
+	if (compact.length <= max) return compact;
+	const headChars = Math.floor(max / 3);
+	const tailChars = max - headChars;
+	return `${compact.slice(0, headChars)}...[${compact.length - max} chars omitted]...${compact.slice(-tailChars)}`;
+}
+//#endregion
+//#region src/campaign/external-optimizer-callback.ts
+async function startExternalOptimizerCallback(args) {
+	assertCallbackConfig(args);
+	const limits = resolveExternalOptimizerCallbackLimits(args.limits);
+	args.signal?.throwIfAborted();
+	let evaluations = 0;
+	let accepting = true;
+	let closePromise;
+	const activeControllers = /* @__PURE__ */ new Set();
+	const activeHandlers = /* @__PURE__ */ new Set();
+	const proposedCandidateHashes = /* @__PURE__ */ new Set();
+	let observationSequence = 0;
+	const server = createServer((request, response) => {
+		if (!accepting) {
+			sendJsonIfOpen(response, 503, { error: "external optimizer callback is closing" });
+			return;
+		}
+		const controller = new AbortController();
+		const abortRequest = () => {
+			request.destroy();
+			response.destroy();
+		};
+		activeControllers.add(controller);
+		controller.signal.addEventListener("abort", abortRequest, { once: true });
+		let handler;
+		handler = handleCallback(request, response, controller.signal, args, limits, () => {
+			const accepted = args.acceptEvaluation ? args.acceptEvaluation() : evaluations + 1;
+			if (accepted === void 0) return void 0;
+			if (!Number.isSafeInteger(accepted) || accepted <= 0) throw new Error("external optimizer callback: invalid accepted evaluation count");
+			if (accepted > args.maxEvaluations) return void 0;
+			evaluations += 1;
+			return accepted;
+		}, (observation) => {
+			if (!args.observe) return;
+			args.observe({
+				...observation,
+				sequence: ++observationSequence
+			});
+		}, proposedCandidateHashes).finally(() => {
+			controller.signal.removeEventListener("abort", abortRequest);
+			activeControllers.delete(controller);
+			activeHandlers.delete(handler);
+		});
+		activeHandlers.add(handler);
+		handler.catch(() => void 0);
+	});
+	const port = await listenLocal(server);
+	const close = () => {
+		closePromise ??= closeCallbackServer();
+		return closePromise;
+	};
+	const onAbort = () => {
+		close().catch(() => void 0);
+	};
+	args.signal?.addEventListener("abort", onAbort, { once: true });
+	if (args.signal?.aborted) onAbort();
+	return {
+		url: `http://127.0.0.1:${port}/evaluate`,
+		token: args.token,
+		evaluations: () => evaluations,
+		close
+	};
+	async function closeCallbackServer() {
+		args.signal?.removeEventListener("abort", onAbort);
+		accepting = false;
+		const closingServer = closeServer(server);
+		server.closeIdleConnections?.();
+		for (const controller of activeControllers) controller.abort();
+		const [serverResult] = await Promise.allSettled([closingServer, waitForActiveHandlers(activeHandlers)]);
+		if (activeControllers.size !== 0 || activeHandlers.size !== 0) throw new Error("external optimizer callback closed with active request work");
+		if (serverResult?.status === "rejected") throw serverResult.reason;
+	}
+}
+async function handleCallback(request, response, signal, args, limits, nextEvaluation, observe, proposedCandidateHashes) {
+	try {
+		if (request.method !== "POST" || request.url !== "/evaluate") {
+			sendJsonIfOpen(response, 404, { error: "not found" });
+			return;
+		}
+		if (request.headers.authorization !== `Bearer ${args.token}`) {
+			sendJsonIfOpen(response, 401, { error: "unauthorized" });
+			return;
+		}
+		let body;
+		try {
+			body = await readJson(request, limits.maxRequestBytes);
+		} catch {
+			observe({
+				kind: "refusal",
+				reason: "invalid-request"
+			});
+			sendJsonIfOpen(response, 400, { error: "request body must be bounded valid JSON" });
+			return;
+		}
+		if (!isRecord(body) || !isExternalTextCandidate(body.candidate) || typeof body.exampleId !== "string") {
+			observe({
+				kind: "refusal",
+				reason: "invalid-request"
+			});
+			sendJsonIfOpen(response, 400, { error: "candidate and exampleId are required strings" });
+			return;
+		}
+		const candidate = cloneCandidate(body.candidate);
+		const candidateHash = contentHash({
+			kind: "external-text-candidate",
+			candidate
+		});
+		if (!proposedCandidateHashes.has(candidateHash)) {
+			observe({
+				kind: "proposal",
+				candidate,
+				candidateHash
+			});
+			proposedCandidateHashes.add(candidateHash);
+		}
+		const count = nextEvaluation();
+		if (count === void 0) {
+			observe({
+				kind: "refusal",
+				reason: "evaluation-limit",
+				candidate,
+				candidateHash,
+				exampleId: body.exampleId
+			});
+			sendJsonIfOpen(response, 429, { error: "evaluation limit reached" });
+			return;
+		}
+		let result;
+		try {
+			result = await args.evaluate({
+				candidate,
+				exampleId: body.exampleId
+			}, signal);
+		} catch {
+			observe({
+				kind: "refusal",
+				reason: "evaluation-failed",
+				candidate,
+				candidateHash,
+				exampleId: body.exampleId
+			});
+			sendJsonIfOpen(response, 500, { error: "evaluation failed" });
+			return;
+		}
+		let encoded;
+		try {
+			encoded = encodeJsonResponse(result);
+		} catch {
+			observe({
+				kind: "refusal",
+				reason: "evaluation-failed",
+				candidate,
+				candidateHash,
+				exampleId: body.exampleId
+			});
+			sendJsonIfOpen(response, 500, { error: "evaluation response must be valid JSON" });
+			return;
+		}
+		if (Buffer.byteLength(encoded) > limits.maxResponseBytes) {
+			observe({
+				kind: "refusal",
+				reason: "evaluation-failed",
+				candidate,
+				candidateHash,
+				exampleId: body.exampleId
+			});
+			sendJsonIfOpen(response, 413, { error: "evaluation response too large" });
+			return;
+		}
+		observe({
+			kind: "evaluation",
+			candidate,
+			candidateHash,
+			exampleId: body.exampleId,
+			evaluationNumber: count,
+			response: structuredClone(result)
+		});
+		sendEncodedJsonIfOpen(response, 200, encoded);
+	} catch {
+		sendJsonIfOpen(response, 500, { error: "evaluation failed" });
+	}
+}
+async function waitForActiveHandlers(activeHandlers) {
+	while (activeHandlers.size > 0) await Promise.allSettled([...activeHandlers]);
+}
+function sendJsonIfOpen(response, status, body) {
+	if (response.destroyed || response.writableEnded) return;
+	sendJson(response, status, body);
+}
+function readJson(request, maxRequestBytes) {
+	return new Promise((resolvePromise, reject) => {
+		let size = 0;
+		const chunks = [];
+		request.on("data", (chunk) => {
+			size += chunk.length;
+			if (size > maxRequestBytes) {
+				reject(/* @__PURE__ */ new Error("callback body too large"));
+				request.destroy();
+				return;
+			}
+			chunks.push(chunk);
+		});
+		request.on("error", reject);
+		request.on("end", () => {
+			try {
+				resolvePromise(JSON.parse(Buffer.concat(chunks).toString("utf8")));
+			} catch (error) {
+				reject(error);
+			}
+		});
+	});
+}
+function encodeJsonResponse(value) {
+	const encoded = JSON.stringify(value);
+	if (encoded === void 0) throw new Error("evaluation response must be JSON-serializable");
+	return encoded;
+}
+function sendEncodedJsonIfOpen(response, status, encoded) {
+	if (response.destroyed || response.writableEnded) return;
+	response.writeHead(status, {
+		"content-type": "application/json; charset=utf-8",
+		"content-length": String(Buffer.byteLength(encoded))
+	});
+	response.end(encoded);
+}
+function assertCallbackConfig(args) {
+	if (typeof args.token !== "string" || !args.token.trim()) throw new Error("external optimizer callback: token must be non-empty");
+	if (!Number.isSafeInteger(args.maxEvaluations) || args.maxEvaluations <= 0) throw new Error("external optimizer callback: maxEvaluations must be a positive safe integer");
+	if (args.acceptEvaluation !== void 0 && typeof args.acceptEvaluation !== "function") throw new Error("external optimizer callback: acceptEvaluation must be a function");
+	if (typeof args.evaluate !== "function") throw new Error("external optimizer callback: evaluate must be a function");
+	if (args.observe !== void 0 && typeof args.observe !== "function") throw new Error("external optimizer callback: observe must be a function");
+}
+function cloneCandidate(candidate) {
+	return typeof candidate === "string" ? candidate : { ...candidate };
+}
+//#endregion
+//#region src/campaign/search-ledger-errors.ts
+/** Base error for invalid search-ledger input or operations. */
+var SearchLedgerError = class extends ValidationError {};
+/** Error raised when durable search-ledger data fails an integrity check. */
+var SearchLedgerIntegrityError = class extends SearchLedgerError {};
+/** Error raised when an event identifier is reused with different content. */
+var SearchLedgerConflictError = class extends SearchLedgerError {};
+//#endregion
+//#region src/campaign/search-ledger-file.ts
+/** Campaign binding of the generic journal file layer to search-ledger errors. */
+const SEARCH_LEDGER_FILE_CONTEXT = {
+	subject: "search ledger",
+	integrityError: (message, options) => new SearchLedgerIntegrityError(message, options)
+};
+function appendSearchLedgerLine(path, line) {
+	appendLedgerLine(path, line, SEARCH_LEDGER_FILE_CONTEXT);
+}
+function tryWithSearchLedgerFileLock(ledgerPath, run) {
+	return tryWithLedgerFileLock(ledgerPath, SEARCH_LEDGER_FILE_CONTEXT, run);
+}
+//#endregion
+//#region src/campaign/storage.ts
+/** Node-filesystem storage — the default. Lazily requires `node:fs` so the
+*  module imports cleanly in non-Node runtimes (where the caller passes
+*  `inMemoryCampaignStorage` instead and never constructs this).
+*
+*  `createRequire(import.meta.url)` is the ESM-native lazy require — a bare
+*  `require` is a ReferenceError under `"type": "module"`, which is exactly
+*  the shape this package publishes. */
+function fsCampaignStorage() {
+	const { existsSync, mkdirSync, readFileSync, statSync, writeFileSync } = createRequire(import.meta.url)("node:fs");
+	return {
+		ensureDir(dir) {
+			if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+		},
+		exists(path) {
+			return existsSync(path);
+		},
+		read(path) {
+			try {
+				return readFileSync(path, "utf8");
+			} catch {
+				return;
+			}
+		},
+		write(path, content) {
+			writeFileSync(path, content);
+		},
+		append(path, content, expectedBytes) {
+			const result = tryWithSearchLedgerFileLock(path, () => {
+				let actualBytes = 0;
+				try {
+					actualBytes = statSync(path).size;
+				} catch (error) {
+					if (error.code !== "ENOENT") throw error;
+				}
+				if (actualBytes !== expectedBytes) return void 0;
+				appendSearchLedgerLine(path, content);
+				return expectedBytes + Buffer.byteLength(content);
+			});
+			return result.acquired ? result.value : void 0;
+		}
+	};
+}
+/** In-memory storage for filesystem-less runtimes. Artifacts + trace spans
+*  live in a `Map` for the duration of the run; the `CampaignResult` is
+*  fully populated, but nothing is persisted to disk. */
+function inMemoryCampaignStorage() {
+	const files = /* @__PURE__ */ new Map();
+	const dirs = /* @__PURE__ */ new Set();
+	return {
+		ensureDir(dir) {
+			dirs.add(dir);
+		},
+		exists(path) {
+			return files.has(path) || dirs.has(path);
+		},
+		read(path) {
+			const value = files.get(path);
+			if (value === void 0) return void 0;
+			return typeof value === "string" ? value : new TextDecoder().decode(value);
+		},
+		write(path, content) {
+			files.set(path, content);
+		},
+		append(path, content, expectedBytes) {
+			const current = files.get(path);
+			const currentText = current === void 0 ? "" : typeof current === "string" ? current : new TextDecoder().decode(current);
+			const currentBytes = new TextEncoder().encode(currentText).byteLength;
+			if (currentBytes !== expectedBytes) return void 0;
+			files.set(path, `${currentText}${content}`);
+			return currentBytes + new TextEncoder().encode(content).byteLength;
+		}
+	};
+}
+/** Open the durable spend account stored beside a logical run. */
+function createRunCostLedger(input) {
+	const path = join(input.runDir, "cost-ledger.jsonl");
+	if (input.ensureRunDir ?? true) input.storage.ensureDir(input.runDir);
+	return new CostLedger({
+		costCeilingUsd: input.costCeilingUsd,
+		persistence: {
+			read: () => {
+				const stored = input.storage.read(path);
+				if (stored === void 0 && input.storage.exists(path)) throw new Error(`CostLedger: cannot read existing event log '${path}'`);
+				const events = stored ?? "";
+				return {
+					revision: String(new TextEncoder().encode(events).byteLength),
+					events
+				};
+			},
+			append: (expectedRevision, event) => {
+				const expectedBytes = Number(expectedRevision);
+				if (!Number.isSafeInteger(expectedBytes) || expectedBytes < 0) throw new Error(`CostLedger: invalid storage revision '${expectedRevision}'`);
+				const next = input.storage.append(path, event, expectedBytes);
+				return next === void 0 ? void 0 : String(next);
+			}
+		}
+	});
+}
+//#endregion
+//#region src/campaign/single-run-lock.ts
+/**
+* Single-run lock for evaluations that share one mutable environment.
+*
+* Two concurrent runs against a shared stateful gym silently corrupt each
+* other: each resets/mutates environment state mid-cell of the other, and
+* every score from both becomes garbage that LOOKS like worker variance
+* (agent-lab R357 burned hours on flip-flopping scores before tracing them
+* to exactly this). The fix is a pid lockfile: refuse to start while a live
+* holder exists, reclaim stale locks whose pid is gone, release only if the
+* lock is still ours.
+*
+* `alsoCheck` exists because independent runners can guard the same shared
+* resource with differently named lockfiles; a runner must respect all of
+* them even though it writes only its own.
+*/
+function assertAvailable(path) {
+	const unavailable = probeAtomicFileLock({ lockPath: path });
+	if (unavailable) throw unavailableError(path, unavailable);
+}
+function unavailableError(path, unavailable) {
+	if (unavailable.reason === "recovery") return /* @__PURE__ */ new Error(`single-run lock recovery is already in progress (${path}); refusing a concurrent run`);
+	return /* @__PURE__ */ new Error(`single-run lock held by live pid ${unavailable.holder.pid} (${path}); refusing a concurrent run on the shared resource`);
+}
+/**
+* Acquire the lock or throw naming the live holder. A stale lock (holder pid
+* no longer running) is reclaimed by one contender. An interrupted reclaim
+* leaves a marker that fails closed instead of admitting overlapping runs.
+*/
+function acquireSingleRunLock(opts) {
+	const pid = opts.pid ?? process.pid;
+	if (!Number.isSafeInteger(pid) || pid <= 0) throw new Error("single-run lock pid must be a positive integer");
+	for (const path of opts.alsoCheck ?? []) assertAvailable(path);
+	const acquisition = tryAcquireAtomicFileLock({
+		lockPath: opts.lockPath,
+		pid
+	});
+	if (!acquisition.acquired) throw unavailableError(opts.lockPath, acquisition);
+	const releaseOnExit = opts.releaseOnExit ?? true;
+	let released = false;
+	const release = () => {
+		if (released) return;
+		released = true;
+		if (releaseOnExit) process.off("exit", release);
+		try {
+			acquisition.lock.release();
+		} catch {}
+	};
+	try {
+		for (const path of opts.alsoCheck ?? []) assertAvailable(path);
+	} catch (error) {
+		release();
+		throw error;
+	}
+	if (releaseOnExit) process.on("exit", release);
+	return { release };
+}
+//#endregion
+export { removeCredentialEnvironment as A, DEFAULT_EXTERNAL_OPTIMIZER_PROCESS_LIMITS as C, isCandidateText as D, assertNoCredentialValues as E, resolveExternalOptimizerProcessLimits as M, safePathComponent as N, isExternalTextCandidate as O, DEFAULT_EXTERNAL_OPTIMIZER_CALLBACK_LIMITS as S, assertJsonValue as T, cachedJudge as _, SEARCH_LEDGER_FILE_CONTEXT as a, fileVerdictCache as b, SearchLedgerIntegrityError as c, closeExternalOptimizerResources as d, runWithCleanup as f, sendJson as g, listenLocal as h, inMemoryCampaignStorage as i, resolveExternalOptimizerCallbackLimits as j, isRecord as k, startExternalOptimizerCallback as l, closeServer as m, createRunCostLedger as n, SearchLedgerConflictError as o, startExternalOptimizerModelProxy as p, fsCampaignStorage as r, SearchLedgerError as s, acquireSingleRunLock as t, runExternalOptimizerProcess as u, canonicalJson as v, assertExternalOptimizerModelBudget as w, inMemoryVerdictCache as x, contentHash as y };
+
+//# sourceMappingURL=single-run-lock-B-cFnnNn.js.map