@tuned-tensor/cli 0.24.0 → 0.25.0

package/dist/chunk-UCJCWJ6F.js

@@ -0,0 +1,2809 @@
+#!/usr/bin/env node
+
+// src/local-runtime/prefetch.ts
+import { createHash as createHash4 } from "crypto";
+import { createReadStream as createReadStream3 } from "fs";
+import { lstat as lstat3, mkdir as mkdir3, readFile as readFile3, readdir as readdir4, realpath as realpath3, stat as stat3 } from "fs/promises";
+import { isAbsolute as isAbsolute3, join as join6, relative as relative3, resolve as resolve7, sep as sep3 } from "path";
+
+// src/local-runtime/contracts.ts
+import { z } from "zod";
+import { pipelineDocumentSchema, isFoundationPipeline, parsePipeline } from "@tuned-tensor/pipeline-contract";
+
+// src/paths.ts
+import { existsSync } from "fs";
+import { homedir } from "os";
+import { isAbsolute, join, resolve } from "path";
+var TUNED_TENSOR_DIR = ".tuned-tensor";
+var DEFAULT_ARTIFACT_ROOT = `${TUNED_TENSOR_DIR}/artifacts`;
+var DEFAULT_PROJECT_STORE_ROOT = `${TUNED_TENSOR_DIR}/store`;
+var DEFAULT_FOUNDATION_RUNS_DIR = `${TUNED_TENSOR_DIR}/foundation-runs`;
+var DEFAULT_DECISION_RUNS_DIR = `${TUNED_TENSOR_DIR}/decision-runs`;
+function envHome(env = process.env) {
+  const home = env.HOME?.trim();
+  return home ? resolve(home) : homedir();
+}
+function expandUserPath(value, env = process.env, baseDirectory = process.cwd()) {
+  const trimmed = value.trim();
+  if (trimmed === "~") return envHome(env);
+  if (trimmed.startsWith("~/")) return resolve(envHome(env), trimmed.slice(2));
+  return isAbsolute(trimmed) ? resolve(trimmed) : resolve(baseDirectory, trimmed);
+}
+function getTunedTensorHome(env = process.env) {
+  const override = env.TUNED_TENSOR_HOME?.trim();
+  if (override) return expandUserPath(override, env);
+  return join(envHome(env), TUNED_TENSOR_DIR);
+}
+function legacyConfigDir(env) {
+  const configHome = env.XDG_CONFIG_HOME?.trim() ? resolve(env.XDG_CONFIG_HOME) : join(envHome(env), ".config");
+  return join(configHome, "tuned-tensor");
+}
+function getConfigDir(env = process.env) {
+  const next = getTunedTensorHome(env);
+  if (env.TUNED_TENSOR_HOME?.trim()) return next;
+  const legacy = legacyConfigDir(env);
+  if (!existsSync(join(next, "config.json")) && existsSync(join(legacy, "config.json"))) {
+    return legacy;
+  }
+  return next;
+}
+function getAgentConfigDir(env = process.env) {
+  const next = join(getTunedTensorHome(env), "agent");
+  if (env.TUNED_TENSOR_HOME?.trim()) return next;
+  const legacy = join(legacyConfigDir(env), "agent");
+  if (!existsSync(next) && existsSync(legacy)) return legacy;
+  return next;
+}
+function defaultStoreRoot(env = process.env) {
+  const override = env.TT_LOCAL_HOME?.trim();
+  if (override) return expandUserPath(override, env);
+  const next = join(getTunedTensorHome(env), "store");
+  if (env.TUNED_TENSOR_HOME?.trim()) return next;
+  const legacy = join(envHome(env), ".tuned-tensor-local");
+  if (!existsSync(next) && existsSync(legacy)) return legacy;
+  return next;
+}
+function defaultCacheRoot(env = process.env) {
+  return join(getTunedTensorHome(env), "cache");
+}
+function pythonEnvironmentPath(kind, hash, env = process.env) {
+  const next = join(defaultCacheRoot(env), kind, hash);
+  if (env.TUNED_TENSOR_HOME?.trim()) return next;
+  const cacheHome = env.XDG_CACHE_HOME?.trim() ? resolve(env.XDG_CACHE_HOME) : join(envHome(env), ".cache");
+  const legacy = join(cacheHome, "tuned-tensor-local", kind, hash);
+  if (!existsSync(next) && existsSync(legacy)) return legacy;
+  return next;
+}
+
+// src/local-runtime/model-registry.ts
+import { lstat as lstat2, readdir as readdir2 } from "fs/promises";
+import { resolve as resolve3 } from "path";
+import { fileURLToPath } from "url";
+
+// src/local-runtime/artifacts.ts
+import { createHash, randomUUID } from "crypto";
+import { createReadStream } from "fs";
+import { copyFile, lstat, mkdir, open, readFile, readdir, realpath, rename, stat, writeFile } from "fs/promises";
+import { dirname, isAbsolute as isAbsolute2, join as join2, relative, resolve as resolve2, sep } from "path";
+import { createGunzip } from "zlib";
+var RUN_OWNER_FILE = ".tt-local-run-owner.json";
+var ARTIFACT_WORKFLOW_LOCK_FILE = ".tt-local-workflow.lock";
+function fileUri(path) {
+  return `file://${resolve2(path)}`;
+}
+function defaultArtifactPrefix(input) {
+  return join2("users", input.userId, "specs", input.behaviorSpecId, "runs", input.runId);
+}
+function resolveRunArtifacts(args) {
+  const root = resolve2(args.artifactRoot);
+  const safePrefix = args.prefix.replace(/^[/\\]+/, "");
+  const runDir = resolve2(root, safePrefix);
+  const containment = relative(root, runDir);
+  if (containment === ".." || containment.startsWith(`..${sep}`) || isAbsolute2(containment)) {
+    throw new Error(`Artifact prefix escapes artifactRoot: ${args.prefix}`);
+  }
+  const trainingDir = join2(runDir, "training");
+  return {
+    root,
+    prefix: safePrefix,
+    runDir,
+    trainingJsonl: join2(runDir, "training.jsonl"),
+    stageMetadataJson: join2(runDir, "stage-metadata.json"),
+    trainingReportJson: join2(runDir, "training-report.json"),
+    baselineEvalJson: join2(runDir, "baseline-eval.json"),
+    candidateEvalJson: join2(runDir, "candidate-eval.json"),
+    generalBaselineEvalJson: join2(runDir, "general-baseline-eval.json"),
+    generalCandidateEvalJson: join2(runDir, "general-candidate-eval.json"),
+    runReportJson: join2(runDir, "run-report.json"),
+    artifactManifestJson: join2(runDir, "artifact-manifest.json"),
+    progressJsonl: join2(runDir, "progress.jsonl"),
+    trainingDir,
+    trainingInputDir: join2(trainingDir, "input", "data", "training"),
+    trainingConfigDir: join2(trainingDir, "input", "config"),
+    trainingOutputDir: join2(trainingDir, "output"),
+    trainingModelDir: join2(trainingDir, "model"),
+    trainingLog: join2(trainingDir, "training.log")
+  };
+}
+async function ensureSafeRunDirectory(artifacts) {
+  await mkdir(artifacts.root, { recursive: true });
+  const canonicalRoot = await realpath(artifacts.root);
+  const pathFromRoot = relative(artifacts.root, artifacts.runDir);
+  const segments = pathFromRoot ? pathFromRoot.split(sep).filter(Boolean) : [];
+  let current = artifacts.root;
+  for (const segment of segments) {
+    current = join2(current, segment);
+    let metadata = await lstat(current).catch((error) => {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    });
+    if (!metadata) {
+      await mkdir(current).catch((error) => {
+        if (error.code !== "EEXIST") throw error;
+      });
+      metadata = await lstat(current);
+    }
+    if (metadata.isSymbolicLink()) {
+      throw new Error(`Artifact path must not contain symbolic links: ${current}`);
+    }
+    if (!metadata.isDirectory()) {
+      throw new Error(`Artifact path component is not a directory: ${current}`);
+    }
+  }
+  const canonicalRunDir = await realpath(artifacts.runDir);
+  const containment = relative(canonicalRoot, canonicalRunDir);
+  if (containment === ".." || containment.startsWith(`..${sep}`) || isAbsolute2(containment)) {
+    throw new Error(`Artifact run directory escapes artifactRoot: ${artifacts.runDir}`);
+  }
+}
+async function claimRunArtifactDirectory(args) {
+  await ensureSafeRunDirectory(args.artifacts);
+  const ownerPath = join2(args.artifacts.runDir, RUN_OWNER_FILE);
+  const proposed = {
+    schema_version: 1,
+    run_id: args.runId,
+    user_id: args.userId,
+    behavior_spec_id: args.behaviorSpecId,
+    created_at: (/* @__PURE__ */ new Date()).toISOString()
+  };
+  try {
+    const handle = await open(ownerPath, "wx", 384);
+    try {
+      await handle.writeFile(`${JSON.stringify(proposed, null, 2)}
+`);
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+    return proposed;
+  } catch (error) {
+    if (error.code !== "EEXIST") throw error;
+  }
+  let existing;
+  try {
+    existing = JSON.parse(await readFile(ownerPath, "utf8"));
+  } catch (error) {
+    throw new Error(`Artifact run owner claim is unreadable: ${ownerPath}`, { cause: error });
+  }
+  if (existing.schema_version !== 1 || existing.run_id !== args.runId || existing.user_id !== args.userId || existing.behavior_spec_id !== args.behaviorSpecId) {
+    throw new Error(
+      `Artifact directory ${args.artifacts.runDir} is already owned by run ${existing.run_id ?? "unknown"}; run ${args.runId} must use a different artifacts.prefix.`
+    );
+  }
+  return existing;
+}
+async function prepareRunDirectories(artifacts) {
+  await ensureSafeRunDirectory(artifacts);
+  await Promise.all([
+    mkdir(artifacts.runDir, { recursive: true }),
+    mkdir(artifacts.trainingInputDir, { recursive: true }),
+    mkdir(artifacts.trainingConfigDir, { recursive: true }),
+    mkdir(artifacts.trainingOutputDir, { recursive: true }),
+    mkdir(artifacts.trainingModelDir, { recursive: true })
+  ]);
+}
+async function writeJson(path, value) {
+  await mkdir(dirname(path), { recursive: true });
+  await writeFile(path, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+}
+async function writeJsonAtomic(path, value) {
+  await writeFileAtomic(path, `${JSON.stringify(value, null, 2)}
+`);
+}
+async function writeFileAtomic(path, value) {
+  await mkdir(dirname(path), { recursive: true });
+  const temporary = `${path}.${process.pid}.${Date.now()}.${randomUUID()}.tmp`;
+  await writeFile(temporary, value);
+  await rename(temporary, path);
+}
+async function readJson(path) {
+  return JSON.parse(await readFile(path, "utf8"));
+}
+async function copyDatasetToTrainingChannel(artifacts) {
+  const destination = join2(artifacts.trainingInputDir, "training.jsonl");
+  await copyFile(artifacts.trainingJsonl, destination);
+  return destination;
+}
+var MANIFEST_IGNORED_PATHS = /* @__PURE__ */ new Set([
+  "artifact-manifest.json",
+  // These are append-only/control-plane files rather than immutable stage
+  // outputs. Including them would invalidate a manifest whenever the store
+  // records the next stage event or refreshes the canonical request copy.
+  "progress.jsonl",
+  "request.json",
+  RUN_OWNER_FILE,
+  ARTIFACT_WORKFLOW_LOCK_FILE
+]);
+function portableRelative(root, path) {
+  return relative(root, path).split(sep).join("/");
+}
+function shouldManifest(path) {
+  const atomicTemporary = /\.\d+\.\d+\.[0-9a-f-]{36}\.tmp$/i.test(path);
+  return !MANIFEST_IGNORED_PATHS.has(path) && !atomicTemporary;
+}
+async function listArtifactFiles(root, current = root) {
+  const files = [];
+  for (const entry of await readdir(current, { withFileTypes: true }).catch(() => [])) {
+    const absolute = join2(current, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Artifact tree must not contain symbolic links: ${absolute}`);
+    }
+    if (entry.isDirectory()) {
+      files.push(...await listArtifactFiles(root, absolute));
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const relativePath = portableRelative(root, absolute);
+    if (!shouldManifest(relativePath)) continue;
+    const metadata = await stat(absolute).catch(() => null);
+    if (metadata?.isFile()) files.push(relativePath);
+  }
+  return files.sort();
+}
+async function sha256File(path) {
+  const hash = createHash("sha256");
+  for await (const chunk of createReadStream(path)) hash.update(chunk);
+  return hash.digest("hex");
+}
+async function describeArtifactFile(root, path) {
+  const absolute = join2(root, path);
+  const metadata = await stat(absolute);
+  return {
+    path,
+    size_bytes: metadata.size,
+    sha256: await sha256File(absolute)
+  };
+}
+function assertManifestFiles(value, label) {
+  if (!Array.isArray(value)) throw new Error(`Artifact manifest ${label} must be an array.`);
+  const paths = /* @__PURE__ */ new Set();
+  for (const file of value) {
+    if (!file || typeof file.path !== "string" || !Number.isSafeInteger(file.size_bytes) || file.size_bytes < 0 || typeof file.sha256 !== "string" || !/^[a-f0-9]{64}$/.test(file.sha256)) {
+      throw new Error(`Artifact manifest contains an invalid ${label} entry.`);
+    }
+    const manifestPath2 = file.path;
+    const segments = manifestPath2.split("/");
+    if (!manifestPath2 || manifestPath2.includes("\\") || manifestPath2.includes("\0") || manifestPath2.startsWith("/") || /^[a-z]:/i.test(manifestPath2) || segments.some((segment) => !segment || segment === "." || segment === "..")) {
+      throw new Error(`Artifact manifest contains an unsafe ${label} path: ${manifestPath2}`);
+    }
+    if (paths.has(manifestPath2)) throw new Error(`Artifact manifest contains a duplicate ${label} path: ${manifestPath2}`);
+    paths.add(manifestPath2);
+  }
+}
+function hasPeftAdapterFiles(files) {
+  const names = new Set(
+    files.filter((file) => file.size_bytes > 0).map((file) => file.path.split("/").at(-1)?.toLowerCase())
+  );
+  return names.has("adapter_config.json") && (names.has("adapter_model.safetensors") || names.has("adapter_model.bin"));
+}
+function parseArtifactManifest(value) {
+  if (!value || typeof value !== "object") throw new Error("Artifact manifest must be an object.");
+  const candidate = value;
+  if (candidate.schema_version !== 1 || !Array.isArray(candidate.files)) {
+    throw new Error("Unsupported or invalid artifact manifest.");
+  }
+  assertManifestFiles(candidate.files, "file");
+  if (candidate.model) {
+    const model = candidate.model;
+    const allowedModelKeys = /* @__PURE__ */ new Set([
+      "artifact_kind",
+      "format",
+      "framework",
+      "base_model",
+      "base_model_revision",
+      "base_model_artifact_uri",
+      "base_model_fingerprint",
+      "artifact_uri",
+      "artifact_root",
+      "servable",
+      "files"
+    ]);
+    const hasBaseArtifact = model.base_model_artifact_uri !== void 0;
+    const hasBaseFingerprint = model.base_model_fingerprint !== void 0;
+    if (Object.keys(model).some((key) => !allowedModelKeys.has(key)) || model.artifact_kind !== "file" && model.artifact_kind !== "directory" || model.format !== "tar.gz" && model.format !== "huggingface-directory" || model.framework !== "transformers-peft" || typeof model.base_model !== "string" || model.base_model_revision !== void 0 && typeof model.base_model_revision !== "string" || model.base_model_artifact_uri !== void 0 && typeof model.base_model_artifact_uri !== "string" || model.base_model_fingerprint !== void 0 && typeof model.base_model_fingerprint !== "string" || hasBaseArtifact !== hasBaseFingerprint || typeof model.artifact_uri !== "string" || typeof model.artifact_root !== "string" || model.servable !== true || !Array.isArray(model.files) || model.files.length === 0 || model.artifact_kind === "file" && model.format !== "tar.gz" || model.artifact_kind === "directory" && model.format !== "huggingface-directory") {
+      throw new Error("Artifact manifest contains invalid model contract metadata.");
+    }
+    assertManifestFiles(model.files, "model file");
+    if (model.artifact_kind === "directory" && !hasPeftAdapterFiles(model.files)) {
+      throw new Error("PEFT model manifest requires adapter weights and adapter_config.json.");
+    }
+  }
+  return candidate;
+}
+async function writeArtifactManifest(artifacts, options = {}) {
+  const paths = await listArtifactFiles(artifacts.runDir);
+  let model;
+  if (options.model) {
+    if (options.model.framework !== "transformers-peft" || options.model.servable !== true || options.model.artifact_kind === "file" && options.model.format !== "tar.gz" || options.model.artifact_kind === "directory" && options.model.format !== "huggingface-directory") {
+      throw new Error("TT local model artifacts must be verified, servable Transformers PEFT adapters.");
+    }
+    if (options.model.base_model_artifact_uri === void 0 !== (options.model.base_model_fingerprint === void 0)) {
+      throw new Error("Model contracts must record a local base-model URI and fingerprint together.");
+    }
+    const modelRoot = resolve2(options.model.artifact_root);
+    const modelPaths = options.model.artifact_kind === "file" ? [portableRelative(dirname(modelRoot), modelRoot)] : await listArtifactFiles(modelRoot);
+    const checksumRoot = options.model.artifact_kind === "file" ? dirname(modelRoot) : modelRoot;
+    if (options.model.artifact_kind === "file") {
+      if (!modelRoot.toLowerCase().endsWith(".tar.gz")) {
+        throw new Error(`PEFT file artifacts must be .tar.gz archives: ${modelRoot}`);
+      }
+      const archive = await verifyTarGzipArchive(modelRoot);
+      if (archive.adapter_weight_entries === 0 || archive.adapter_weight_bytes === 0) {
+        throw new Error(`PEFT model archive contains no adapter_model.safetensors or adapter_model.bin: ${modelRoot}`);
+      }
+      if (archive.adapter_config_entries === 0) {
+        throw new Error(`PEFT model archive contains no adapter_config.json: ${modelRoot}`);
+      }
+    }
+    const modelFiles = await Promise.all(modelPaths.map((path) => describeArtifactFile(checksumRoot, path)));
+    if (options.model.artifact_kind === "directory" && !hasPeftAdapterFiles(modelFiles)) {
+      throw new Error(`PEFT model directory requires adapter weights and adapter_config.json: ${modelRoot}`);
+    }
+    model = {
+      ...options.model,
+      artifact_root: modelRoot,
+      files: modelFiles
+    };
+  }
+  const manifest = {
+    schema_version: 1,
+    generated_at: (/* @__PURE__ */ new Date()).toISOString(),
+    files: await Promise.all(paths.map((path) => describeArtifactFile(artifacts.runDir, path))),
+    ...model ? { model } : {}
+  };
+  await writeJsonAtomic(artifacts.artifactManifestJson, manifest);
+  return manifest;
+}
+async function verifyArtifactManifest(manifestPath2, options = {}) {
+  const root = dirname(resolve2(manifestPath2));
+  const manifest = parseArtifactManifest(JSON.parse(await readFile(manifestPath2, "utf8")));
+  const expected = new Map(manifest.files.map((file) => [file.path, file]));
+  const actualPaths = await listArtifactFiles(root);
+  const actual = new Set(actualPaths);
+  const missing = [];
+  const changed = [];
+  const normalizedRequired = (options.requiredPaths ?? []).map((path) => path.split(sep).join("/").replace(/^\.\//, ""));
+  const checkedEntries = options.scopeToRequired ? normalizedRequired.flatMap((path) => {
+    const entry = expected.get(path);
+    return entry ? [[path, entry]] : [];
+  }) : [...expected.entries()];
+  for (const [path, expectedFile] of checkedEntries) {
+    if (!actual.has(path)) {
+      missing.push(path);
+      continue;
+    }
+    const actualFile = await describeArtifactFile(root, path);
+    if (actualFile.size_bytes !== expectedFile.size_bytes || actualFile.sha256 !== expectedFile.sha256) {
+      changed.push(path);
+    }
+  }
+  for (const normalized of normalizedRequired) {
+    if (!expected.has(normalized) && !missing.includes(normalized)) missing.push(normalized);
+  }
+  const unexpected = options.allowUnexpected || options.scopeToRequired ? [] : actualPaths.filter((path) => !expected.has(path));
+  let modelChecked = 0;
+  if (manifest.model && (options.verifyModel ?? !options.scopeToRequired)) {
+    const modelRoot = resolve2(manifest.model.artifact_root);
+    const checksumRoot = manifest.model.artifact_kind === "file" ? dirname(modelRoot) : modelRoot;
+    const modelActualPaths = manifest.model.artifact_kind === "file" ? [portableRelative(checksumRoot, modelRoot)] : await listArtifactFiles(modelRoot);
+    const modelActual = new Set(modelActualPaths);
+    for (const expectedFile of manifest.model.files) {
+      const label = `model:${expectedFile.path}`;
+      if (!modelActual.has(expectedFile.path)) {
+        missing.push(label);
+        continue;
+      }
+      const actualFile = await describeArtifactFile(checksumRoot, expectedFile.path);
+      modelChecked += 1;
+      if (actualFile.size_bytes !== expectedFile.size_bytes || actualFile.sha256 !== expectedFile.sha256) {
+        changed.push(label);
+      }
+    }
+    if (!options.allowUnexpected) {
+      const expectedModelPaths = new Set(manifest.model.files.map((file) => file.path));
+      unexpected.push(...modelActualPaths.filter((path) => !expectedModelPaths.has(path)).map((path) => `model:${path}`));
+    }
+    if (manifest.model.artifact_kind === "file") {
+      try {
+        const archive = await verifyTarGzipArchive(modelRoot);
+        if (archive.adapter_weight_entries === 0 || archive.adapter_weight_bytes === 0) {
+          changed.push(`model:${portableRelative(checksumRoot, modelRoot)}:missing_adapter_weights`);
+        }
+        if (archive.adapter_config_entries === 0) {
+          changed.push(`model:${portableRelative(checksumRoot, modelRoot)}:missing_adapter_config`);
+        }
+      } catch {
+        changed.push(`model:${portableRelative(checksumRoot, modelRoot)}:invalid_archive`);
+      }
+    } else if (!hasPeftAdapterFiles(
+      await Promise.all(modelActualPaths.map((path) => describeArtifactFile(checksumRoot, path)))
+    )) {
+      changed.push("model:missing_peft_adapter");
+    }
+  }
+  return {
+    valid: missing.length === 0 && changed.length === 0 && unexpected.length === 0,
+    checked: checkedEntries.length + modelChecked,
+    missing: [...new Set(missing)].sort(),
+    changed: changed.sort(),
+    unexpected: unexpected.sort()
+  };
+}
+async function verifyTarGzipArchive(path) {
+  const maxEntries = 1e5;
+  const maxExpandedBytes = 20 * 1024 * 1024 * 1024;
+  const maxPaxBytes = 1024 * 1024;
+  const safeMemberPath = (value) => {
+    const normalized = value.replaceAll("\\", "/");
+    const segments = normalized.split("/").filter(Boolean);
+    if (!normalized || normalized.startsWith("/") || /^[a-z]:\//i.test(normalized) || segments.includes("..")) {
+      throw new Error(`Unsafe tar member path ${JSON.stringify(normalized)} in ${path}.`);
+    }
+    return normalized;
+  };
+  const parsePax = (payload, global) => {
+    let offset = 0;
+    let memberPath;
+    const allowedMetadata = /* @__PURE__ */ new Set(["mtime", "atime", "ctime", "uid", "gid", "uname", "gname"]);
+    while (offset < payload.length) {
+      const separator = payload.indexOf(32, offset);
+      if (separator < 0) throw new Error(`Malformed PAX record in ${path}.`);
+      const lengthText = payload.subarray(offset, separator).toString("ascii");
+      if (!/^[1-9][0-9]*$/.test(lengthText)) throw new Error(`Malformed PAX record length in ${path}.`);
+      const length = Number.parseInt(lengthText, 10);
+      const end = offset + length;
+      if (!Number.isSafeInteger(length) || end > payload.length || payload[end - 1] !== 10) {
+        throw new Error(`Truncated PAX record in ${path}.`);
+      }
+      const record = payload.subarray(separator + 1, end - 1).toString("utf8");
+      const equals = record.indexOf("=");
+      if (equals <= 0) throw new Error(`Malformed PAX key/value in ${path}.`);
+      const key = record.slice(0, equals);
+      const value = record.slice(equals + 1);
+      if (key === "path") {
+        if (global) throw new Error(`Global PAX path overrides are unsupported in ${path}.`);
+        memberPath = safeMemberPath(value);
+      } else if (!allowedMetadata.has(key)) {
+        throw new Error(`Unsupported PAX key ${JSON.stringify(key)} in ${path}.`);
+      }
+      offset = end;
+    }
+    return memberPath;
+  };
+  const gunzip = createReadStream(path).pipe(createGunzip());
+  let buffered = Buffer.alloc(0);
+  let payloadBytes = 0;
+  let paddingBytes = 0;
+  let paxType = null;
+  let paxChunks = [];
+  let pendingPaxPath;
+  let entries = 0;
+  let payloadEntries = 0;
+  let recognizedPayloadEntries = 0;
+  let recognizedPayloadBytes = 0;
+  let adapterWeightEntries = 0;
+  let adapterWeightBytes = 0;
+  let fullModelWeightEntries = 0;
+  let fullModelWeightBytes = 0;
+  let adapterConfigEntries = 0;
+  let expandedBytes = 0;
+  let zeroBlocks = 0;
+  let ended = false;
+  for await (const chunk of gunzip) {
+    buffered = Buffer.concat([buffered, Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk)]);
+    while (true) {
+      if (payloadBytes > 0) {
+        if (buffered.length === 0) break;
+        const consumed = Math.min(payloadBytes, buffered.length);
+        if (paxType) paxChunks.push(buffered.subarray(0, consumed));
+        buffered = buffered.subarray(consumed);
+        payloadBytes -= consumed;
+        continue;
+      }
+      if (paddingBytes > 0) {
+        if (buffered.length === 0) break;
+        const consumed = Math.min(paddingBytes, buffered.length);
+        buffered = buffered.subarray(consumed);
+        paddingBytes -= consumed;
+        continue;
+      }
+      if (paxType) {
+        const paxPath = parsePax(Buffer.concat(paxChunks), paxType === "g");
+        if (paxType === "x") pendingPaxPath = paxPath;
+        paxType = null;
+        paxChunks = [];
+        continue;
+      }
+      if (buffered.length < 512) break;
+      const header = buffered.subarray(0, 512);
+      buffered = buffered.subarray(512);
+      if (header.every((byte) => byte === 0)) {
+        zeroBlocks += 1;
+        if (zeroBlocks >= 2) ended = true;
+        continue;
+      }
+      if (ended) throw new Error(`Tar archive contains data after its end marker: ${path}.`);
+      zeroBlocks = 0;
+      const checksumText = header.subarray(148, 156).toString("ascii").replace(/\0/g, "").trim();
+      if (!/^[0-7]+$/.test(checksumText)) throw new Error(`Invalid tar checksum field in ${path}.`);
+      const expectedChecksum = Number.parseInt(checksumText, 8);
+      let actualChecksum = 0;
+      for (let index = 0; index < header.length; index += 1) {
+        actualChecksum += index >= 148 && index < 156 ? 32 : header[index];
+      }
+      if (actualChecksum !== expectedChecksum) throw new Error(`Tar member checksum mismatch in ${path}.`);
+      const sizeText = header.subarray(124, 136).toString("ascii").replace(/\0/g, "").trim();
+      if (sizeText && !/^[0-7]+$/.test(sizeText)) throw new Error(`Invalid tar member size in ${path}.`);
+      const size = sizeText ? Number.parseInt(sizeText, 8) : 0;
+      if (!Number.isSafeInteger(size) || size < 0) throw new Error(`Invalid tar member size in ${path}.`);
+      const type = String.fromCharCode(header[156] ?? 0);
+      if (type !== "\0" && type !== "0" && type !== "5" && type !== "x" && type !== "g") {
+        throw new Error(`Unsafe or unsupported tar member type ${JSON.stringify(type)} in ${path}.`);
+      }
+      const shortName = header.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+      const prefix = header.subarray(345, 500).toString("utf8").replace(/\0.*$/, "");
+      const headerPath = safeMemberPath(prefix ? `${prefix}/${shortName}` : shortName);
+      const memberPath = type === "x" || type === "g" ? headerPath : safeMemberPath(pendingPaxPath ?? headerPath);
+      if (type !== "x" && type !== "g") pendingPaxPath = void 0;
+      const segments = memberPath.split("/").filter(Boolean);
+      const name = segments.at(-1)?.toLowerCase();
+      const metadataOnly = name === "training-metrics.json" || name === "trainer_state.json" || name === "training_args.bin" || name === "config.json" || name === "generation_config.json" || name === "adapter_config.json" || name === "readme.md" || name?.startsWith("tokenizer") || name?.startsWith("special_tokens") || name?.startsWith("added_tokens") || name === "vocab.json" || name === "merges.txt";
+      const recognizedPayload = Boolean(name) && name !== "training_args.bin" && (name.endsWith(".safetensors") || name.endsWith(".bin"));
+      const adapterWeight = name === "adapter_model.safetensors" || name === "adapter_model.bin";
+      const fullModelWeight = Boolean(name) && (name.endsWith(".safetensors") && !name.startsWith("adapter_") || /^pytorch_model.*\.bin$/.test(name));
+      if (size > 0 && name === "adapter_config.json" && (type === "\0" || type === "0")) {
+        adapterConfigEntries += 1;
+      }
+      if ((type === "x" || type === "g") && size > maxPaxBytes) {
+        throw new Error(`PAX metadata exceeds 1 MiB in ${path}.`);
+      }
+      if (size > 0 && !metadataOnly && (type === "\0" || type === "0")) payloadEntries += 1;
+      if (size > 0 && recognizedPayload && (type === "\0" || type === "0")) {
+        recognizedPayloadEntries += 1;
+        recognizedPayloadBytes += size;
+      }
+      if (size > 0 && adapterWeight && (type === "\0" || type === "0")) {
+        adapterWeightEntries += 1;
+        adapterWeightBytes += size;
+      }
+      if (size > 0 && fullModelWeight && (type === "\0" || type === "0")) {
+        fullModelWeightEntries += 1;
+        fullModelWeightBytes += size;
+      }
+      expandedBytes += size;
+      if (expandedBytes > maxExpandedBytes) throw new Error(`Tar archive exceeds 20 GiB expanded size: ${path}.`);
+      payloadBytes = size;
+      paddingBytes = (512 - size % 512) % 512;
+      paxType = type === "x" || type === "g" ? type : null;
+      paxChunks = [];
+      entries += 1;
+      if (entries > maxEntries) throw new Error(`Tar archive exceeds ${maxEntries} members: ${path}.`);
+    }
+  }
+  if (payloadBytes !== 0 || paddingBytes !== 0 || paxType || buffered.some((byte) => byte !== 0)) {
+    throw new Error(`Truncated tar archive: ${path}.`);
+  }
+  if (pendingPaxPath) throw new Error(`PAX path override has no following member in ${path}.`);
+  if (!ended) throw new Error(`Tar archive is missing its end marker: ${path}.`);
+  if (entries === 0) throw new Error(`Empty tar archive: ${path}.`);
+  if (payloadEntries === 0) throw new Error(`Tar archive contains no model payload files: ${path}.`);
+  return {
+    entries,
+    payload_entries: payloadEntries,
+    recognized_payload_entries: recognizedPayloadEntries,
+    recognized_payload_bytes: recognizedPayloadBytes,
+    adapter_weight_entries: adapterWeightEntries,
+    adapter_weight_bytes: adapterWeightBytes,
+    full_model_weight_entries: fullModelWeightEntries,
+    full_model_weight_bytes: fullModelWeightBytes,
+    adapter_config_entries: adapterConfigEntries,
+    expanded_bytes: expandedBytes
+  };
+}
+async function assertArtifactManifest(manifestPath2, options = {}) {
+  const result = await verifyArtifactManifest(manifestPath2, options);
+  if (!result.valid) {
+    const details = [
+      result.missing.length ? `missing=${result.missing.join(",")}` : "",
+      result.changed.length ? `changed=${result.changed.join(",")}` : "",
+      result.unexpected.length ? `unexpected=${result.unexpected.join(",")}` : ""
+    ].filter(Boolean).join(" ");
+    throw new Error(`Artifact integrity verification failed${details ? `: ${details}` : "."}`);
+  }
+  return result;
+}
+
+// src/local-runtime/model-registry.ts
+var QWEN_3_5_2B_REVISION = "15852e8c16360a2fea060d615a32b45270f8a8fc";
+var NEMOTRON_BF16_REVISION = "ce38b6ab8b252b4b8ee7165b4605e93191cafd73";
+var MUSE_GLIMMER_BF16_REVISION = "a4e59da52a7bc87ae7251dd5545c0dd437c44b68";
+var TRAINING_MODELS = [
+  {
+    id: "Qwen/Qwen3.5-2B",
+    family: "qwen3_5",
+    defaultRevision: QWEN_3_5_2B_REVISION,
+    modelLoader: "causal_lm",
+    defaultLearningRate: 1e-5,
+    defaultPerDeviceBatchSize: 1,
+    defaultGradientAccumulationSteps: 8,
+    defaultLoraRank: 16,
+    defaultLoraAlpha: 32,
+    defaultLoraDropout: 0.05,
+    defaultMaxSeqLength: 2048,
+    loraTargetModules: "all-linear",
+    gradientCheckpointing: false
+  },
+  {
+    id: "nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-BF16",
+    family: "nemotron_h",
+    defaultRevision: NEMOTRON_BF16_REVISION,
+    modelLoader: "causal_lm",
+    defaultLearningRate: 1e-5,
+    defaultPerDeviceBatchSize: 1,
+    defaultGradientAccumulationSteps: 8,
+    defaultLoraRank: 16,
+    defaultLoraAlpha: 32,
+    defaultLoraDropout: 0.05,
+    defaultMaxSeqLength: 1024,
+    // Avoid one LoRA pair for every routed expert matrix. Adapt the shared
+    // attention (q/k/v/o) and Mamba input projections instead, keeping the
+    // adapter bounded. out_proj/conv1d are rejected by PEFT for Mamba models.
+    loraTargetModules: ["q_proj", "k_proj", "v_proj", "o_proj", "in_proj"],
+    gradientCheckpointing: true
+  },
+  {
+    id: "meta-models/Muse-Glimmer-30B",
+    family: "muse_glimmer",
+    defaultRevision: MUSE_GLIMMER_BF16_REVISION,
+    // Muse Glimmer is a vision-language model whose text tower is not exposed
+    // through the causal-LM auto mapping, so the bundled runtime loads the full
+    // conditional-generation checkpoint (vision tower frozen and unused) via
+    // AutoModelForImageTextToText for text-only SFT.
+    modelLoader: "image_text_to_text",
+    defaultLearningRate: 1e-5,
+    defaultPerDeviceBatchSize: 1,
+    defaultGradientAccumulationSteps: 8,
+    defaultLoraRank: 16,
+    defaultLoraAlpha: 32,
+    defaultLoraDropout: 0.05,
+    defaultMaxSeqLength: 2048,
+    loraTargetModules: "all-linear",
+    gradientCheckpointing: true
+  }
+];
+var HUGGING_FACE_REPO_ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/;
+function uncertifiedTrainingModel(id) {
+  return {
+    id,
+    family: "uncertified",
+    modelLoader: "causal_lm",
+    defaultLearningRate: 1e-4,
+    defaultPerDeviceBatchSize: 1,
+    defaultGradientAccumulationSteps: 8,
+    defaultLoraRank: 16,
+    defaultLoraAlpha: 32,
+    defaultLoraDropout: 0.05,
+    defaultMaxSeqLength: 2048,
+    loraTargetModules: "all-linear",
+    gradientCheckpointing: true
+  };
+}
+function findCertifiedTrainingModel(modelId) {
+  const normalized = modelId.trim().toLowerCase();
+  return TRAINING_MODELS.find((candidate) => candidate.id.toLowerCase() === normalized);
+}
+function isCertifiedTrainingModel(modelId) {
+  return findCertifiedTrainingModel(modelId) !== void 0;
+}
+function resolveTrainingModel(modelId) {
+  const model = findCertifiedTrainingModel(modelId);
+  if (model) return model;
+  const id = modelId.trim();
+  if (HUGGING_FACE_REPO_ID.test(id)) return uncertifiedTrainingModel(id);
+  throw new Error(
+    `Unsupported base model "${modelId}". Use a certified model (${TRAINING_MODELS.map((item) => item.id).join(", ")}) or a Hugging Face repo id such as owner/name.`
+  );
+}
+function uncertifiedRevisionError(modelId) {
+  return new Error(
+    `${modelId} is not a TT-certified base model. To fine-tune it anyway, set hyperparameters.base_model_revision to its 40-character commit SHA (see https://huggingface.co/${modelId}/commits/main). Uncertified models load as text causal LMs with safetensors weights and no remote code.`
+  );
+}
+function canonicalizeTrainingModel(modelId) {
+  return resolveTrainingModel(modelId).id;
+}
+function resolveRequestedBaseModelRevision(modelId, requestedRevision) {
+  const model = resolveTrainingModel(modelId);
+  if (!isCertifiedTrainingModel(model.id) && !requestedRevision) {
+    throw uncertifiedRevisionError(model.id);
+  }
+  if (model.defaultRevision && requestedRevision && requestedRevision !== model.defaultRevision) {
+    throw new Error(
+      `${model.id} must use certified revision ${model.defaultRevision}; got ${requestedRevision}.`
+    );
+  }
+  return requestedRevision ?? model.defaultRevision;
+}
+function defaultBaseModelRevision(modelId) {
+  return resolveTrainingModel(modelId).defaultRevision;
+}
+function resolveModelLoader(modelId) {
+  return resolveTrainingModel(modelId).modelLoader;
+}
+var CERTIFIED_QWEN_TEXT_CONFIG = {
+  model_type: "qwen3_5_text",
+  hidden_size: 2048,
+  num_hidden_layers: 24,
+  num_attention_heads: 8,
+  num_key_value_heads: 2,
+  intermediate_size: 6144,
+  vocab_size: 248320
+};
+var CERTIFIED_MUSE_GLIMMER_TEXT_CONFIG = {
+  model_type: "muse_glimmer_text",
+  hidden_size: 6656,
+  num_hidden_layers: 52,
+  num_attention_heads: 32,
+  num_key_value_heads: 2,
+  intermediate_size: 19968,
+  vocab_size: 202048
+};
+var CERTIFIED_NEMOTRON_CONFIG = {
+  hidden_size: 2688,
+  num_hidden_layers: 52,
+  num_attention_heads: 32,
+  num_key_value_heads: 2,
+  intermediate_size: 1856,
+  vocab_size: 131072,
+  n_routed_experts: 128,
+  num_experts_per_tok: 6,
+  num_nextn_predict_layers: 1,
+  max_position_embeddings: 262144
+};
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function hasArchitecture(config, architecture) {
+  const architectures = config.architectures;
+  return Array.isArray(architectures) && architectures.includes(architecture);
+}
+function assertCertifiedTextTowerConfig(config, label, certifiedModelId, architecture, certifiedTextConfig) {
+  if (!hasArchitecture(config, architecture)) {
+    throw new Error(`${label} is not the certified ${certifiedModelId} architecture.`);
+  }
+  const textConfig = config.text_config;
+  if (!isRecord(textConfig)) {
+    throw new Error(`${label} is not the certified ${certifiedModelId} architecture.`);
+  }
+  for (const [key, expected] of Object.entries(certifiedTextConfig)) {
+    if (textConfig[key] !== expected) {
+      throw new Error(
+        `${label} is not the certified ${certifiedModelId} architecture: text_config.${key} must be ${JSON.stringify(expected)}.`
+      );
+    }
+  }
+}
+function assertCertifiedBaseModelConfig(value, label = "base-model config.json", expectedModelId) {
+  if (!isRecord(value)) {
+    throw new Error(`${label} must contain a JSON object.`);
+  }
+  const config = value;
+  if (expectedModelId && !isCertifiedTrainingModel(expectedModelId)) return;
+  const expectedFamily = expectedModelId ? resolveTrainingModel(expectedModelId).family : void 0;
+  if (config.model_type === "qwen3_5") {
+    if (expectedFamily && expectedFamily !== "qwen3_5") {
+      throw new Error(`${label} does not match requested base model ${expectedModelId}.`);
+    }
+    assertCertifiedTextTowerConfig(
+      config,
+      label,
+      "Qwen/Qwen3.5-2B",
+      "Qwen3_5ForConditionalGeneration",
+      CERTIFIED_QWEN_TEXT_CONFIG
+    );
+    return;
+  }
+  if (config.model_type === "muse_glimmer") {
+    if (expectedFamily && expectedFamily !== "muse_glimmer") {
+      throw new Error(`${label} does not match requested base model ${expectedModelId}.`);
+    }
+    assertCertifiedTextTowerConfig(
+      config,
+      label,
+      "meta-models/Muse-Glimmer-30B",
+      "MuseGlimmerForConditionalGeneration",
+      CERTIFIED_MUSE_GLIMMER_TEXT_CONFIG
+    );
+    return;
+  }
+  if (config.model_type === "nemotron_h" && hasArchitecture(config, "NemotronHForCausalLM")) {
+    if (expectedFamily && expectedFamily !== "nemotron_h") {
+      throw new Error(`${label} does not match requested base model ${expectedModelId}.`);
+    }
+    for (const [key, expected] of Object.entries(CERTIFIED_NEMOTRON_CONFIG)) {
+      if (config[key] !== expected) {
+        throw new Error(
+          `${label} is not the certified nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-BF16 architecture: ${key} must be ${JSON.stringify(expected)}.`
+        );
+      }
+    }
+    return;
+  }
+  throw new Error(
+    `${label} is not a certified TT base-model architecture.`
+  );
+}
+function localModelArtifactPath(uri) {
+  if (uri.startsWith("file://")) return fileURLToPath(new URL(uri));
+  if (/^[a-z][a-z0-9+.-]*:/i.test(uri)) {
+    throw new Error(`Model artifact must be a local path or file URI: ${uri}`);
+  }
+  return resolve3(uri);
+}
+function adapterWeightName(name) {
+  const lower = name.toLowerCase();
+  return lower === "adapter_model.safetensors" || lower === "adapter_model.bin";
+}
+async function inspectAdapterDirectory(path) {
+  let count = 0;
+  let bytes = 0;
+  let hasConfig = false;
+  for (const entry of await readdir2(path, { withFileTypes: true })) {
+    const child = resolve3(path, entry.name);
+    if (entry.isSymbolicLink()) {
+      throw new Error(`Model artifact must not contain symbolic links: ${child}`);
+    }
+    if (entry.isDirectory()) {
+      const nested = await inspectAdapterDirectory(child);
+      count += nested.count;
+      bytes += nested.bytes;
+      hasConfig ||= nested.hasConfig;
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const metadata = await lstat2(child);
+    if (adapterWeightName(entry.name) && metadata.size > 0) {
+      count += 1;
+      bytes += metadata.size;
+    }
+    if (entry.name.toLowerCase() === "adapter_config.json" && metadata.size > 0) {
+      hasConfig = true;
+    }
+  }
+  return { count, bytes, hasConfig };
+}
+async function inspectModelArtifact(uri) {
+  const path = localModelArtifactPath(uri);
+  const metadata = await lstat2(path).catch(() => null);
+  if (!metadata) throw new Error(`Model artifact does not exist: ${path}`);
+  if (metadata.isSymbolicLink()) {
+    throw new Error(`Model artifact must not be a symbolic link: ${path}`);
+  }
+  if (metadata.isDirectory()) {
+    const adapter = await inspectAdapterDirectory(path);
+    return {
+      uri,
+      path,
+      kind: "directory",
+      adapter_weight_file_count: adapter.count,
+      adapter_weight_bytes: adapter.bytes,
+      has_adapter_config: adapter.hasConfig
+    };
+  }
+  if (!metadata.isFile() || !path.toLowerCase().endsWith(".tar.gz")) {
+    throw new Error(
+      `Model artifact must be a PEFT adapter directory or .tar.gz archive: ${path}`
+    );
+  }
+  const archive = await verifyTarGzipArchive(path);
+  return {
+    uri,
+    path,
+    kind: "file",
+    adapter_weight_file_count: archive.adapter_weight_entries,
+    adapter_weight_bytes: archive.adapter_weight_bytes,
+    has_adapter_config: archive.adapter_config_entries > 0
+  };
+}
+async function assertUsableModelArtifact(uri) {
+  const inspection = await inspectModelArtifact(uri);
+  if (inspection.adapter_weight_file_count === 0 || inspection.adapter_weight_bytes === 0) {
+    throw new Error(
+      `PEFT model artifact ${inspection.path} contains no non-empty adapter_model weights.`
+    );
+  }
+  if (!inspection.has_adapter_config) {
+    throw new Error(
+      `PEFT model artifact ${inspection.path} contains adapter weights but no non-empty adapter_config.json.`
+    );
+  }
+  return inspection;
+}
+
+// src/local-runtime/decision-models.ts
+var LAYA_REVISION = "55cf4c4ebb4ebe31b2550e8bdf3bd21b99753851";
+var DECISION_MODELS = [
+  {
+    id: "convaiinnovations/laya",
+    family: "laya",
+    revision: LAYA_REVISION,
+    parameters: "421M (ModernBERT-large encoder + typed decision head)",
+    license: "Apache-2.0",
+    defaultLearningRate: 2e-5,
+    defaultBatchSize: 8,
+    defaultEpochs: 3
+  }
+];
+var DEFAULT_DECISION_MODEL = DECISION_MODELS[0].id;
+function resolveDecisionModel(modelId) {
+  const normalized = modelId.trim().toLowerCase();
+  const model = DECISION_MODELS.find((candidate) => candidate.id.toLowerCase() === normalized);
+  if (!model) {
+    throw new Error(
+      `Unsupported decision model "${modelId}". Supported decision models: ${DECISION_MODELS.map((item) => item.id).join(", ")}`
+    );
+  }
+  return model;
+}
+function isDecisionModel(modelId) {
+  return DECISION_MODELS.some((candidate) => candidate.id.toLowerCase() === modelId.trim().toLowerCase());
+}
+function canonicalizeDecisionModel(modelId) {
+  return resolveDecisionModel(modelId).id;
+}
+
+// src/local-runtime/contracts.ts
+var datasetFormatSchema = z.literal("chat_jsonl");
+var baseModelRevisionSchema = z.string().regex(/^[0-9a-f]{40}$/i, "base_model_revision must be a 40-character Hugging Face commit SHA").transform((value) => value.toLowerCase());
+var behaviorSpecExampleSchema = z.object({
+  input: z.string().min(1),
+  output: z.string().min(1)
+}).strict();
+var behaviorSpecSchema = z.object({
+  name: z.string().min(1),
+  description: z.string().default(""),
+  system_prompt: z.string().default(""),
+  guidelines: z.array(z.string()).default([]),
+  examples: z.array(behaviorSpecExampleSchema).default([]),
+  constraints: z.array(z.string()).default([])
+}).strict();
+var specSnapshotSchema = behaviorSpecSchema.extend({
+  base_model: z.string().transform((value) => canonicalizeTrainingModel(value))
+});
+var foundationHyperparametersSchema = z.object({
+  vocab_size: z.number().int().min(64).max(65536).default(256),
+  max_chars: z.number().int().min(1e3).max(1e12).default(2e4),
+  depth: z.number().int().min(1).max(64).default(2),
+  pretrain_steps: z.number().int().min(1).max(1e7).default(2),
+  finetune_steps: z.number().int().min(1).max(1e7).default(2),
+  rl_steps: z.number().int().min(0).max(1e7).default(0),
+  batch_size: z.number().int().min(1).max(1024).default(2),
+  sequence_length: z.number().int().min(16).max(8192).default(64),
+  nproc_per_node: z.number().int().min(1).max(16).default(1),
+  corpus_path: z.string().min(1).optional(),
+  tokenizer_max_chars: z.number().int().min(1e3).max(1e12).optional(),
+  validation_path: z.string().min(1).optional(),
+  checkpoint_backup_dir: z.string().min(1).optional(),
+  seed: z.number().int().min(0).max(2147483647).optional(),
+  learning_rate: z.number().positive().max(1).optional(),
+  weight_decay: z.number().min(0).max(10).optional(),
+  warmup_steps: z.number().int().min(0).max(1e7).optional(),
+  min_lr_ratio: z.number().min(0).max(1).optional(),
+  gradient_accumulation_steps: z.number().int().min(1).max(1024).optional(),
+  gradient_clip: z.number().positive().max(1e3).optional(),
+  bf16: z.boolean().optional(),
+  checkpoint_interval_steps: z.number().int().min(1).max(1e7).optional(),
+  checkpoint_interval_seconds: z.number().int().min(1).max(86400).optional(),
+  keep_checkpoints: z.number().int().min(1).max(100).optional(),
+  log_interval_steps: z.number().int().min(1).max(1e6).optional()
+}).strict();
+var huggingFaceRepoIdSchema = z.string().regex(
+  /^[A-Za-z0-9][A-Za-z0-9._-]{0,95}\/[A-Za-z0-9][A-Za-z0-9._-]{0,95}$/,
+  "huggingface.repo must be a Hugging Face dataset id such as org/name"
+);
+var datasetColumnsSchema = z.union([
+  z.object({
+    input: z.string().min(1),
+    output: z.string().min(1)
+  }).strict(),
+  /** A chat column of `{role, content}` turns; its first user turn and reply become one example. */
+  z.object({ messages: z.string().min(1) }).strict()
+]);
+var huggingFaceDatasetSourceSchema = z.object({
+  repo: huggingFaceRepoIdSchema,
+  revision: baseModelRevisionSchema.optional(),
+  /**
+   * Field names for plain JSONL or Parquet records such as `{"text": ..., "label": ...}`,
+   * or `{messages}` for a chat column. Each record becomes a chat row with the
+   * spec's compiled system message. Omit for files that are already TT chat JSONL.
+   */
+  columns: datasetColumnsSchema.optional()
+}).strict();
+function isRepoRelativePath(value) {
+  if (/^(?:[A-Za-z]:|[/\\]|file:)/.test(value)) return false;
+  return value.split(/[/\\]/).every((part) => part !== "" && part !== "." && part !== "..");
+}
+var datasetPrebuiltSchema = z.object({
+  training: z.string().min(1),
+  validation: z.string().min(1).optional(),
+  test: z.string().min(1).optional(),
+  format: datasetFormatSchema.default("chat_jsonl"),
+  huggingface: huggingFaceDatasetSourceSchema.optional()
+}).strict().superRefine((dataset, context) => {
+  if (!dataset.validation && !dataset.test) {
+    context.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["validation"],
+      message: "Provide a distinct validation or test split for held-out evaluation"
+    });
+  }
+  if (!dataset.huggingface) return;
+  for (const key of ["training", "validation", "test"]) {
+    const value = dataset[key];
+    if (value === void 0) continue;
+    if (!isRepoRelativePath(value)) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [key],
+        message: `With dataset_prebuilt.huggingface, ${key} must be a file path inside the dataset repo, such as data/${key}.jsonl`
+      });
+    } else if (value.toLowerCase().endsWith(".parquet")) {
+      if (!dataset.huggingface.columns) {
+        context.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: [key],
+          message: `${key} is a Parquet file; set dataset_prebuilt.huggingface.columns to map its records`
+        });
+      }
+    } else if (!value.toLowerCase().endsWith(".jsonl")) {
+      context.addIssue({
+        code: z.ZodIssueCode.custom,
+        path: [key],
+        message: `${key} must be a .jsonl or .parquet file; CSV and other formats are not supported yet`
+      });
+    }
+  }
+});
+var datasetSourceFileSchema = z.object({
+  path: z.string().min(1),
+  size_bytes: z.number().int().nonnegative(),
+  sha256: z.string().regex(/^[a-f0-9]{64}$/)
+}).strict();
+var datasetConversionStatsSchema = z.object({
+  records: z.number().int().nonnegative(),
+  kept: z.number().int().nonnegative(),
+  skipped_missing_fields: z.number().int().nonnegative(),
+  dropped_duplicate_inputs: z.number().int().nonnegative(),
+  dropped_eval_overlap: z.number().int().nonnegative()
+}).strict();
+var datasetSourceSchema = z.object({
+  provider: z.literal("huggingface"),
+  repo: huggingFaceRepoIdSchema,
+  requested_revision: baseModelRevisionSchema.nullable(),
+  revision: baseModelRevisionSchema,
+  pinned: z.boolean(),
+  columns: datasetColumnsSchema.nullable(),
+  /** Per-split record accounting when `columns` converted plain JSONL records. */
+  conversion: z.object({
+    training: datasetConversionStatsSchema,
+    validation: datasetConversionStatsSchema.optional(),
+    test: datasetConversionStatsSchema.optional()
+  }).strict().nullable().optional(),
+  snapshot_path: z.string().min(1),
+  files: z.object({
+    training: datasetSourceFileSchema,
+    validation: datasetSourceFileSchema.optional(),
+    test: datasetSourceFileSchema.optional()
+  }).strict()
+}).strict();
+var fineTuneHyperparametersSchema = z.object({
+  n_epochs: z.number().int().min(1).max(20).default(1),
+  learning_rate: z.number().positive().optional(),
+  batch_size: z.number().int().min(1).optional(),
+  lora_rank: z.number().int().min(1).optional(),
+  lora_alpha: z.number().int().min(1).optional(),
+  lora_dropout: z.number().min(0).max(1).optional(),
+  max_seq_length: z.number().int().min(128).max(32768).optional(),
+  gradient_accumulation_steps: z.number().int().min(1).optional(),
+  max_eval_examples: z.number().int().min(1).optional(),
+  /** Immutable Hugging Face commit used by every stage of the run. */
+  base_model_revision: baseModelRevisionSchema.optional()
+}).strict();
+function requirePinnedUncertifiedModel(spec, context) {
+  const baseModel = "spec_snapshot" in spec ? spec.spec_snapshot.base_model : spec.base_model;
+  if (isCertifiedTrainingModel(baseModel) || spec.hyperparameters?.base_model_revision) return;
+  context.addIssue({
+    code: z.ZodIssueCode.custom,
+    path: ["hyperparameters", "base_model_revision"],
+    message: uncertifiedRevisionError(baseModel).message
+  });
+}
+var fineTuneRunRequestSchema = z.object({
+  run_id: z.string().uuid(),
+  user_id: z.string().min(1),
+  behavior_spec_id: z.string().uuid(),
+  run_number: z.number().int().min(1),
+  spec_snapshot: specSnapshotSchema,
+  hyperparameters: fineTuneHyperparametersSchema.default({ n_epochs: 1 }),
+  dataset_prebuilt: datasetPrebuiltSchema.optional(),
+  dataset_source: datasetSourceSchema.optional()
+}).strict().superRefine((request, context) => {
+  requirePinnedUncertifiedModel(request, context);
+  if (request.spec_snapshot.examples.length === 0 && !request.dataset_prebuilt) {
+    context.addIssue({
+      code: z.ZodIssueCode.custom,
+      path: ["spec_snapshot", "examples"],
+      message: "Add examples or provide dataset_prebuilt training and validation files"
+    });
+  }
+});
+var evalExampleResultSchema = z.object({
+  prompt: z.string(),
+  expected: z.string(),
+  actual: z.string(),
+  passed: z.boolean(),
+  score: z.number().min(0).max(1),
+  reasoning: z.string().nullable(),
+  latency_ms: z.number().int().nonnegative(),
+  scored_by: z.enum(["exact_match", "json_fields", "heuristic"]).optional()
+}).strict();
+var jsonFieldMetricsSchema = z.object({
+  fields: z.array(z.string()),
+  valid_json_count: z.number().int().nonnegative(),
+  valid_json_rate: z.number().min(0).max(1),
+  schema_match_count: z.number().int().nonnegative(),
+  schema_match_rate: z.number().min(0).max(1),
+  all_fields_match_count: z.number().int().nonnegative(),
+  all_fields_match_rate: z.number().min(0).max(1),
+  field_accuracy: z.record(z.string(), z.object({
+    correct: z.number().int().nonnegative(),
+    total: z.number().int().nonnegative(),
+    accuracy: z.number().min(0).max(1)
+  }).strict())
+}).strict();
+var evalSplitSchema = z.enum([
+  "spec_examples",
+  "spec_holdout",
+  "prebuilt_test",
+  "prebuilt_validation",
+  "general_regression"
+]);
+var evalReportSchema = z.object({
+  kind: z.enum(["baseline", "candidate"]),
+  model_id: z.string(),
+  total: z.number().int().nonnegative(),
+  eval_examples_total: z.number().int().nonnegative(),
+  eval_examples_used: z.number().int().nonnegative(),
+  eval_truncated: z.boolean(),
+  eval_split: evalSplitSchema.optional(),
+  eval_sample_seed: z.number().int().nullable().optional(),
+  avg_score: z.number().min(0).max(1),
+  pass_rate: z.number().min(0).max(1),
+  exact_match_rate: z.number().min(0).max(1),
+  avg_token_f1: z.number().min(0).max(1).optional(),
+  avg_latency_ms: z.number().int().nonnegative(),
+  cached: z.boolean().optional(),
+  cache_key: z.string().optional(),
+  results: z.array(evalExampleResultSchema),
+  artifact_uri: z.string(),
+  scoring_method: z.enum(["heuristic", "exact_match", "json_fields"]),
+  inference_provider: z.enum(["none", "transformers"]).optional(),
+  scoring_mode: z.enum(["exact_match", "json_fields"]).optional(),
+  json_field_metrics: jsonFieldMetricsSchema.optional(),
+  generation_config: z.record(z.string(), z.unknown()).optional(),
+  log_uri: z.string().optional()
+}).strict();
+var comparisonReportSchema = z.object({
+  avg_score_delta: z.number(),
+  pass_rate_delta: z.number(),
+  exact_match_rate_delta: z.number(),
+  token_f1_delta: z.number().optional(),
+  regressions: z.number().int().nonnegative(),
+  improvements: z.number().int().nonnegative(),
+  regressed_examples: z.array(z.object({
+    prompt: z.string(),
+    old_score: z.number(),
+    new_score: z.number()
+  }).strict())
+}).strict();
+var trainingReportSchema = z.object({
+  provider: z.enum(["local-uv", "aws-ssh"]),
+  training_job_name: z.string(),
+  model_artifact_uri: z.string().optional(),
+  base_model_artifact_uri: z.string().optional(),
+  metrics: z.record(z.string(), z.unknown()).nullable(),
+  exit_code: z.number().int().nullable(),
+  log_uri: z.string(),
+  command: z.array(z.string()).optional()
+}).strict();
+var runProvenanceSchema = z.object({
+  schema_version: z.literal(1),
+  recorded_at: z.string(),
+  software: z.object({
+    tt_version: z.string(),
+    node_version: z.string(),
+    platform: z.string(),
+    arch: z.string(),
+    runtime_fingerprint: z.string(),
+    python_lock_sha256: z.string().nullable()
+  }).strict(),
+  execution: z.object({
+    target: z.enum(["local", "aws"]),
+    training_backend: z.string(),
+    instance_id: z.string().optional(),
+    region: z.string().optional()
+  }).strict(),
+  spec: z.object({
+    behavior_spec_id: z.string(),
+    run_number: z.number().int(),
+    snapshot_sha256: z.string(),
+    system_prompt_sha256: z.string(),
+    file_path: z.string().optional(),
+    file_sha256: z.string().optional()
+  }).strict(),
+  base_model: z.object({
+    id: z.string(),
+    revision: z.string().nullable(),
+    fingerprint: z.string().nullable()
+  }).strict(),
+  data: z.object({
+    prebuilt: z.boolean(),
+    format: z.string().nullable(),
+    file_sha256: z.record(z.string(), z.string()),
+    compiled_training_sha256: z.string().nullable(),
+    training_examples: z.number().int().nonnegative().nullable(),
+    eval_split: z.string(),
+    eval_sample_seed: z.number().int(),
+    eval_examples_total: z.number().int().nonnegative(),
+    eval_examples_used: z.number().int().nonnegative()
+  }).strict(),
+  training: z.object({
+    hyperparameters: z.record(z.string(), z.unknown()),
+    exit_code: z.number().int().nullable(),
+    log_uri: z.string()
+  }).strict(),
+  /** Hash over request, runtime, preparation config and input digests. */
+  source_fingerprint: z.string()
+}).strict();
+var runReportSchema = z.object({
+  run_id: z.string().uuid(),
+  behavior_spec_id: z.string().uuid(),
+  user_id: z.string(),
+  run_number: z.number().int().min(1),
+  base_model: z.string(),
+  fine_tuned_model_id: z.string(),
+  status: z.enum(["completed", "failed"]),
+  baseline: evalReportSchema,
+  candidate: evalReportSchema,
+  comparison: comparisonReportSchema,
+  general_regression: z.object({
+    dataset_uri: z.string(),
+    dataset_sha256: z.string().regex(/^[a-f0-9]{64}$/),
+    baseline: evalReportSchema,
+    candidate: evalReportSchema,
+    comparison: comparisonReportSchema,
+    policy: z.object({
+      max_score_drop: z.number().min(0).max(1),
+      max_pass_rate_drop: z.number().min(0).max(1)
+    }).strict(),
+    passed: z.boolean(),
+    failures: z.array(z.string())
+  }).strict().optional(),
+  training: trainingReportSchema,
+  provenance: runProvenanceSchema.optional(),
+  artifact_uris: z.object({
+    dataset: z.string(),
+    baseline_eval: z.string(),
+    candidate_eval: z.string(),
+    general_baseline_eval: z.string().optional(),
+    general_candidate_eval: z.string().optional(),
+    report: z.string()
+  }).strict(),
+  run_metadata: z.object({
+    base_model: z.string(),
+    fine_tuned_model_id: z.string(),
+    dataset_prebuilt: z.boolean(),
+    dataset_format: datasetFormatSchema.nullable().optional(),
+    dataset_uri: z.string(),
+    dataset_source: datasetSourceSchema.optional(),
+    spec_example_count: z.number().int().nonnegative(),
+    training_example_count: z.number().int().nonnegative().nullable(),
+    eval_examples_total: z.number().int().nonnegative(),
+    eval_examples_used: z.number().int().nonnegative(),
+    eval_split: evalSplitSchema.optional(),
+    eval_sample_seed: z.number().int().nullable().optional(),
+    started_at: z.string(),
+    completed_at: z.string(),
+    elapsed_ms: z.number().int().nonnegative(),
+    elapsed_seconds: z.number().nonnegative()
+  }).strict(),
+  created_at: z.string()
+}).strict();
+var inferenceConfigSchema = z.object({
+  maxNewTokens: z.number().int().min(1).default(256),
+  temperature: z.number().min(0).default(0),
+  topP: z.number().min(0).max(1).default(1),
+  device: z.enum(["cuda", "cpu"]).default("cuda")
+}).strict();
+var scoringConfigSchema = z.object({
+  mode: z.enum(["exact_match", "json_fields"]).default("exact_match"),
+  fields: z.array(z.string().min(1)).optional()
+}).strict();
+var evaluationConfigSchema = z.object({
+  inference: inferenceConfigSchema.default({
+    maxNewTokens: 256,
+    temperature: 0,
+    topP: 1,
+    device: "cuda"
+  }),
+  scoring: scoringConfigSchema.default({ mode: "exact_match" }),
+  timeoutMs: z.number().int().min(100).default(18e5),
+  maxExamples: z.number().int().min(1).optional(),
+  sampleSeed: z.number().int().optional(),
+  baselineCache: z.boolean().default(true),
+  generalRegression: z.object({
+    dataset: z.string().min(1),
+    systemPrompt: z.string().optional(),
+    maxScoreDrop: z.number().min(0).max(1).default(0.03),
+    maxPassRateDrop: z.number().min(0).max(1).default(0.05)
+  }).strict().optional()
+}).strict();
+var localRunnerConfigSchema = z.object({
+  gpu: z.object({
+    provider: z.literal("aws"),
+    instanceId: z.string().regex(/^i-[a-f0-9]{8,17}$/),
+    profile: z.string().min(1).optional(),
+    region: z.string().min(1).optional(),
+    user: z.string().regex(/^[a-z_][a-z0-9_-]*$/i),
+    identityFile: z.string().min(1).optional(),
+    privateIp: z.boolean().default(false),
+    maxSeconds: z.number().int().min(60).max(604800).default(86400)
+  }).strict().optional(),
+  storeRoot: z.string().optional(),
+  artifactRoot: z.string().default(DEFAULT_ARTIFACT_ROOT),
+  dryRun: z.boolean().default(false),
+  paths: z.object({
+    baseModel: z.string().optional(),
+    modelCache: z.string().optional()
+  }).strict().default({}),
+  evaluation: evaluationConfigSchema.default({
+    inference: {
+      maxNewTokens: 256,
+      temperature: 0,
+      topP: 1,
+      device: "cuda"
+    },
+    scoring: { mode: "exact_match" },
+    timeoutMs: 18e5,
+    baselineCache: true
+  })
+}).strict();
+var projectRuntimeSchema = z.object({
+  gpu: localRunnerConfigSchema.shape.gpu,
+  artifactRoot: z.string().min(1).optional(),
+  storeRoot: z.string().min(1).optional(),
+  paths: z.object({ baseModel: z.string().min(1).optional(), modelCache: z.string().min(1).optional() }).strict().optional()
+}).strict();
+var projectWorkflowFields = {
+  evaluation: evaluationConfigSchema.optional(),
+  runtime: projectRuntimeSchema.optional(),
+  pipeline: pipelineDocumentSchema.optional()
+};
+var localFoundationSpecFileSchema = behaviorSpecSchema.extend({
+  ...projectWorkflowFields,
+  engine: z.literal("foundation"),
+  id: z.string().uuid().optional(),
+  examples: z.array(behaviorSpecExampleSchema).min(2),
+  foundation: foundationHyperparametersSchema
+});
+var localAdapterSpecFileSchema = specSnapshotSchema.extend({
+  ...projectWorkflowFields,
+  engine: z.literal("adapter").optional(),
+  id: z.string().uuid().optional(),
+  hyperparameters: fineTuneHyperparametersSchema.optional(),
+  dataset_prebuilt: datasetPrebuiltSchema.optional()
+}).strict().superRefine(requirePinnedUncertifiedModel);
+var decisionQuestionSchema = z.discriminatedUnion("type", [
+  z.object({
+    type: z.literal("choice"),
+    /** Answer label -> description the model reads. Key order is option order. */
+    criteria: z.record(z.string().min(1), z.string()).refine(
+      (criteria) => Object.keys(criteria).length >= 2 && Object.keys(criteria).length <= 32,
+      "A choice decision needs 2 to 32 labels."
+    )
+  }).strict(),
+  z.object({
+    type: z.literal("noul"),
+    criteria: z.object({ true: z.string().optional(), false: z.string().optional() }).strict().optional()
+  }).strict(),
+  z.object({
+    type: z.literal("score"),
+    /** Level descriptions, index 0 first; example outputs are level indices. */
+    criteria: z.array(z.string().min(1)).min(2).max(10)
+  }).strict()
+]);
+var decisionHyperparametersSchema = z.object({
+  n_epochs: z.number().int().min(1).max(50).optional(),
+  learning_rate: z.number().positive().max(1).optional(),
+  batch_size: z.number().int().min(1).max(256).optional(),
+  /** Train only the decision head; faster on CPU, usually less accurate. */
+  freeze_encoder: z.boolean().optional(),
+  /** Shuffle option order per training row so the head learns meaning, not position. */
+  shuffle_options: z.boolean().optional(),
+  seed: z.number().int().min(0).max(2147483647).optional(),
+  device: z.enum(["auto", "cpu", "cuda", "mps"]).optional()
+}).strict();
+var localDecisionSpecFileSchema = behaviorSpecSchema.extend({
+  ...projectWorkflowFields,
+  engine: z.literal("decision"),
+  id: z.string().uuid().optional(),
+  // Refine first: a union member must report an issue, not throw, for other engines' specs.
+  base_model: z.string().refine(isDecisionModel, `Unsupported decision model. Supported decision models: ${DECISION_MODELS.map((model) => model.id).join(", ")}`).transform((value) => canonicalizeDecisionModel(value)),
+  decision: decisionQuestionSchema,
+  hyperparameters: decisionHyperparametersSchema.optional()
+});
+function decisionLabels(question) {
+  if (question.type === "choice") return Object.keys(question.criteria);
+  if (question.type === "noul") return ["false", "true"];
+  return question.criteria.map((_, index) => String(index));
+}
+var localBehaviorSpecFileSchema = z.union([
+  localFoundationSpecFileSchema,
+  localDecisionSpecFileSchema,
+  localAdapterSpecFileSchema
+]).superRefine((spec, ctx) => {
+  if (spec.pipeline && isFoundationPipeline(parsePipeline(spec.pipeline)) !== (spec.engine === "foundation")) {
+    ctx.addIssue({ code: "custom", path: ["pipeline"], message: "Pipeline engine must match the spec engine." });
+  }
+  if (spec.engine === "foundation" && (spec.evaluation || spec.runtime?.storeRoot || spec.runtime?.paths)) {
+    ctx.addIssue({ code: "custom", path: ["runtime"], message: "Foundation uses foundation settings for evaluation and checkpoints; runtime.artifactRoot and runtime.gpu are supported." });
+  }
+  if (spec.engine === "decision" && (spec.evaluation || spec.runtime?.gpu || spec.runtime?.storeRoot || spec.runtime?.paths)) {
+    ctx.addIssue({ code: "custom", path: ["runtime"], message: "Decision specs support runtime.artifactRoot only; the device is set in hyperparameters.device." });
+  }
+});
+function isFoundationSpecFile(spec) {
+  return spec.engine === "foundation";
+}
+function isDecisionSpecFile(spec) {
+  return spec.engine === "decision";
+}
+
+// src/local-runtime/process-runner.ts
+import { createHash as createHash2 } from "crypto";
+import { spawn } from "child_process";
+import { constants, readFileSync } from "fs";
+import { mkdir as mkdir2, open as open2 } from "fs/promises";
+import { dirname as dirname3, join as join3, resolve as resolve5 } from "path";
+
+// src/local-runtime/run-reporter.ts
+function reportInBackground(action) {
+  try {
+    void Promise.resolve(action()).catch(() => void 0);
+  } catch {
+  }
+}
+async function withProgressHeartbeat(reporter, event, run) {
+  if (!reporter?.onEvent) return await run();
+  reportInBackground(() => reporter.onEvent(event));
+  const timer = setInterval(() => {
+    reportInBackground(() => reporter.onEvent({
+      stage: event.stage,
+      status: event.status,
+      message: `Still working: ${event.message}`
+    }));
+  }, 15e3);
+  timer.unref();
+  try {
+    return await run();
+  } finally {
+    clearInterval(timer);
+  }
+}
+function sanitizeLogLine(line) {
+  return line.replace(/(Bearer\s+)[A-Za-z0-9._~+/=-]+/gi, "$1[redacted]").replace(/((?:api[_-]?key|token|secret|password)=)[^\s]+/gi, "$1[redacted]");
+}
+function forwardStreamLines(stream, onLine) {
+  let buffered = "";
+  stream.setEncoding("utf8");
+  stream.on("data", (chunk) => {
+    buffered += chunk;
+    const lines = buffered.split(/\r\n|\n|\r/);
+    buffered = lines.pop() ?? "";
+    for (const line of lines) {
+      if (line.trim()) onLine(sanitizeLogLine(line));
+    }
+  });
+  stream.on("end", () => {
+    if (buffered.trim()) onLine(sanitizeLogLine(buffered));
+  });
+}
+
+// src/local-runtime/package-root.ts
+import { existsSync as existsSync2 } from "fs";
+import { dirname as dirname2, resolve as resolve4 } from "path";
+import { fileURLToPath as fileURLToPath2 } from "url";
+function localRuntimePackageRoot(moduleUrl) {
+  const moduleDirectory = dirname2(fileURLToPath2(moduleUrl));
+  const candidates = [
+    dirname2(moduleDirectory),
+    dirname2(dirname2(moduleDirectory))
+  ];
+  const root = candidates.find(
+    (candidate) => existsSync2(resolve4(candidate, "package.json")) && existsSync2(resolve4(candidate, "training/adapter"))
+  );
+  if (!root) {
+    throw new Error("Unable to locate the bundled Tuned Tensor local runtime assets.");
+  }
+  return root;
+}
+
+// src/local-runtime/progress-bar.ts
+var PROGRESS_PREFIX = "@@tt-progress ";
+function nonNegativeInteger(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.floor(value) : null;
+}
+function parseProgressLine(line) {
+  const start = line.indexOf(PROGRESS_PREFIX);
+  if (start !== 0) return null;
+  let value;
+  try {
+    value = JSON.parse(line.slice(PROGRESS_PREFIX.length));
+  } catch {
+    return null;
+  }
+  if (!value || typeof value !== "object" || Array.isArray(value)) return null;
+  const record = value;
+  const completed = nonNegativeInteger(record.completed_bytes);
+  const total = nonNegativeInteger(record.total_bytes);
+  if (completed === null || total === null) return null;
+  return {
+    label: typeof record.label === "string" ? record.label : "download",
+    phase: typeof record.phase === "string" ? record.phase : "download",
+    completed_bytes: completed,
+    total_bytes: total,
+    files_completed: nonNegativeInteger(record.files_completed) ?? 0,
+    files_total: nonNegativeInteger(record.files_total) ?? 0
+  };
+}
+function formatBytes(bytes) {
+  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
+  let value = bytes;
+  let unit = 0;
+  while (value >= 1024 && unit < units.length - 1) {
+    value /= 1024;
+    unit += 1;
+  }
+  return `${unit === 0 ? value.toFixed(0) : value.toFixed(value >= 100 ? 0 : value >= 10 ? 1 : 2)} ${units[unit]}`;
+}
+function formatDuration(seconds) {
+  if (!Number.isFinite(seconds) || seconds < 0) return "--";
+  const whole = Math.round(seconds);
+  const hours = Math.floor(whole / 3600);
+  const minutes = Math.floor(whole % 3600 / 60);
+  const rest = whole % 60;
+  if (hours > 0) return `${hours}h ${String(minutes).padStart(2, "0")}m`;
+  if (minutes > 0) return `${minutes}m ${String(rest).padStart(2, "0")}s`;
+  return `${rest}s`;
+}
+var RateTracker = class {
+  constructor(windowMs = 15e3) {
+    this.windowMs = windowMs;
+  }
+  samples = [];
+  add(at, bytes) {
+    const last = this.samples.at(-1);
+    if (last && bytes < last.bytes) this.samples = [];
+    this.samples.push({ at, bytes });
+    while (this.samples.length > 2 && at - this.samples[0].at > this.windowMs) this.samples.shift();
+  }
+  bytesPerSecond() {
+    const first = this.samples[0];
+    const last = this.samples.at(-1);
+    if (!first || !last || last.at - first.at < 500) return null;
+    return (last.bytes - first.bytes) / ((last.at - first.at) / 1e3);
+  }
+};
+function formatProgressLine(progress, rate, columns) {
+  const total = progress.total_bytes;
+  const fraction = total > 0 ? Math.min(1, progress.completed_bytes / total) : 1;
+  const fields = [
+    { text: `${(fraction * 100).toFixed(1).padStart(5)}%` },
+    { text: `${formatBytes(progress.completed_bytes)} / ${formatBytes(total)}` }
+  ];
+  const done = progress.completed_bytes >= total;
+  if (!done && rate !== null && rate > 0) {
+    fields.push(
+      { text: `${formatBytes(rate)}/s`, drop: 2 },
+      { text: `ETA ${formatDuration((total - progress.completed_bytes) / rate)}`, drop: 3 }
+    );
+  }
+  if (progress.files_total > 0) fields.push({ text: `${progress.files_completed}/${progress.files_total} files`, drop: 1 });
+  const prefix = `[tt] ${progress.label}: `;
+  const join7 = () => fields.map((field) => field.text).join("  ");
+  if (columns === void 0) return `${prefix}${join7()}`;
+  for (const rank of [1, 2, 3]) {
+    if (prefix.length + join7().length <= columns - 1) break;
+    const index = fields.findIndex((field) => field.drop === rank);
+    if (index !== -1) fields.splice(index, 1);
+  }
+  const text = join7();
+  const barWidth = Math.min(30, columns - 1 - prefix.length - text.length - 3);
+  if (barWidth < 10) return `${prefix}${text}`.slice(0, Math.max(0, columns - 1));
+  const filled = Math.round(fraction * barWidth);
+  return `${prefix}[${"#".repeat(filled)}${"-".repeat(barWidth - filled)}] ${text}`;
+}
+function createProgressRenderer(options) {
+  const now = options.now ?? (() => Date.now());
+  const rates = /* @__PURE__ */ new Map();
+  const lastLine = /* @__PURE__ */ new Map();
+  const completed = /* @__PURE__ */ new Set();
+  let drawn = false;
+  let lastDraw = Number.NEGATIVE_INFINITY;
+  const finished = (progress) => progress.phase === "downloaded" || progress.total_bytes > 0 && progress.completed_bytes >= progress.total_bytes;
+  return {
+    update(progress) {
+      const at = now();
+      const tracker = rates.get(progress.label) ?? new RateTracker();
+      rates.set(progress.label, tracker);
+      tracker.add(at, progress.completed_bytes);
+      const done = finished(progress);
+      if (options.tty) {
+        if (done && completed.has(progress.label)) return;
+        if (!done) completed.delete(progress.label);
+        if (!done && at - lastDraw < 100) return;
+        lastDraw = at;
+        const line = formatProgressLine(progress, tracker.bytesPerSecond(), Math.max(40, options.columns ?? 80));
+        options.write(`\r\x1B[2K${line}${done ? "\n" : ""}`);
+        drawn = !done;
+        if (done) {
+          rates.delete(progress.label);
+          completed.add(progress.label);
+        }
+        return;
+      }
+      const fraction = progress.total_bytes > 0 ? progress.completed_bytes / progress.total_bytes : 1;
+      const decile = Math.floor(fraction * 10);
+      const previous = lastLine.get(progress.label);
+      const interval = options.lineIntervalMs ?? 3e4;
+      if (previous && !done && decile <= previous.decile && at - previous.at < interval) return;
+      if (previous && done && previous.decile === 10) return;
+      lastLine.set(progress.label, { at, decile: done ? 10 : decile });
+      options.write(`${formatProgressLine(progress, tracker.bytesPerSecond())}
+`);
+    },
+    interrupt() {
+      if (!drawn) return;
+      options.write("\r\x1B[2K");
+      drawn = false;
+    }
+  };
+}
+function progressTty(env = process.env, stream = process.stderr) {
+  if (env.TT_PROGRESS_TTY === "0") return false;
+  return env.TT_PROGRESS_TTY === "1" || Boolean(stream.isTTY);
+}
+function progressColumns(env = process.env, stream = process.stderr) {
+  const hinted = Number(env.TT_PROGRESS_COLUMNS);
+  if (Number.isInteger(hinted) && hinted > 0) return hinted;
+  return stream.columns;
+}
+
+// src/local-runtime/process-runner.ts
+var packageRoot = localRuntimePackageRoot(import.meta.url);
+var bundledProject = join3(packageRoot, "training/adapter");
+var bundledRuntimeHash = (() => {
+  const hash = createHash2("sha256");
+  for (const name of ["pyproject.toml", "uv.lock"]) {
+    hash.update(readFileSync(join3(bundledProject, name)));
+  }
+  return hash.digest("hex").slice(0, 20);
+})();
+var BUNDLED_PYTHON_ENVIRONMENT = pythonEnvironmentPath("uv", bundledRuntimeHash);
+var foundationProject = join3(packageRoot, "training/foundation");
+var foundationRuntimeHash = (() => {
+  const hash = createHash2("sha256");
+  for (const name of ["pyproject.toml", "uv.lock"]) {
+    hash.update(readFileSync(join3(foundationProject, name)));
+  }
+  return hash.digest("hex").slice(0, 20);
+})();
+var FOUNDATION_PYTHON_ENVIRONMENT = pythonEnvironmentPath("uv-foundation", foundationRuntimeHash);
+var decisionProject = join3(packageRoot, "training/decision");
+var decisionRuntimeHash = (() => {
+  const hash = createHash2("sha256");
+  for (const name of ["pyproject.toml", "uv.lock"]) {
+    hash.update(readFileSync(join3(decisionProject, name)));
+  }
+  return hash.digest("hex").slice(0, 20);
+})();
+var DECISION_PYTHON_ENVIRONMENT = pythonEnvironmentPath("uv-decision", decisionRuntimeHash);
+function buildDecisionPythonCommand(entrypoint, args = []) {
+  const commandArgs = [
+    "run",
+    "--frozen",
+    "--quiet",
+    "--project",
+    decisionProject,
+    "python",
+    join3(decisionProject, "src", entrypoint),
+    ...args
+  ];
+  return { command: "uv", commandArgs, displayCommand: ["uv", ...commandArgs] };
+}
+function withDecisionPythonEnvironment(env) {
+  return { ...env, UV_PROJECT_ENVIRONMENT: DECISION_PYTHON_ENVIRONMENT };
+}
+function buildBundledPythonCommand(entrypoint, args = []) {
+  const target = entrypoint === "-c" ? entrypoint : join3(bundledProject, "src", entrypoint);
+  const commandArgs = [
+    "run",
+    "--frozen",
+    "--quiet",
+    "--project",
+    bundledProject,
+    "python",
+    target,
+    ...args
+  ];
+  return {
+    command: "uv",
+    commandArgs,
+    displayCommand: ["uv", ...commandArgs]
+  };
+}
+function withBundledPythonEnvironment(env) {
+  return {
+    ...env,
+    UV_PROJECT_ENVIRONMENT: BUNDLED_PYTHON_ENVIRONMENT
+  };
+}
+function buildFoundationPythonCommand(entrypoint, args = []) {
+  const target = entrypoint === "-c" ? entrypoint : join3(foundationProject, "src", entrypoint);
+  const commandArgs = [
+    "run",
+    "--frozen",
+    "--quiet",
+    "--project",
+    foundationProject,
+    "python",
+    target,
+    ...args
+  ];
+  return {
+    command: "uv",
+    commandArgs,
+    displayCommand: ["uv", ...commandArgs]
+  };
+}
+function withFoundationPythonEnvironment(env) {
+  return {
+    ...env,
+    UV_PROJECT_ENVIRONMENT: FOUNDATION_PYTHON_ENVIRONMENT
+  };
+}
+var ProcessCancelledError = class extends Error {
+  constructor(message = "Process cancelled.") {
+    super(message);
+    this.name = "ProcessCancelledError";
+  }
+};
+async function openProcessLog(path, exclusive, append) {
+  const flags = constants.O_WRONLY | constants.O_CREAT | (exclusive ? constants.O_EXCL : append ? constants.O_APPEND : constants.O_TRUNC) | (process.platform === "win32" ? 0 : constants.O_NOFOLLOW);
+  const handle = await open2(path, flags, 384);
+  try {
+    return handle.createWriteStream({ autoClose: true });
+  } catch (error) {
+    await handle.close();
+    throw error;
+  }
+}
+async function runLoggedProcess(args) {
+  if (args.logPath) await mkdir2(dirname3(args.logPath), { recursive: true });
+  const logStream = args.logPath ? await openProcessLog(args.logPath, args.exclusiveLog ?? false, args.appendLog ?? false) : null;
+  let stderr = "";
+  try {
+    const exitCode = await new Promise((resolvePromise, reject) => {
+      const child = spawn(args.command, args.commandArgs, {
+        cwd: args.cwd ? resolve5(args.cwd) : process.cwd(),
+        stdio: ["ignore", "pipe", "pipe"],
+        env: args.env ?? process.env,
+        detached: process.platform !== "win32"
+      });
+      let timedOut = false;
+      let cancelled = false;
+      let cancellationError;
+      let cancellationCheckRunning = false;
+      let forceKillTimer = null;
+      const killProcessGroup = (signal) => {
+        if (child.pid && process.platform !== "win32") {
+          try {
+            process.kill(-child.pid, signal);
+            return;
+          } catch {
+          }
+        }
+        child.kill(signal);
+      };
+      const requestStop = (signal = "SIGTERM") => {
+        killProcessGroup(signal);
+        if (!forceKillTimer) {
+          forceKillTimer = setTimeout(() => killProcessGroup("SIGKILL"), args.shutdownGraceMs ?? 5e3);
+          forceKillTimer.unref();
+        }
+      };
+      const onSigint = () => {
+        cancelled = true;
+        requestStop("SIGINT");
+      };
+      const onSigterm = () => {
+        cancelled = true;
+        requestStop("SIGTERM");
+      };
+      process.once("SIGINT", onSigint);
+      process.once("SIGTERM", onSigterm);
+      const timer = args.timeoutMs ? setTimeout(() => {
+        timedOut = true;
+        requestStop();
+      }, args.timeoutMs) : null;
+      const cancellationTimer = args.shouldCancel ? setInterval(() => {
+        if (cancellationCheckRunning || cancelled) return;
+        cancellationCheckRunning = true;
+        Promise.resolve(args.shouldCancel?.()).then((requested) => {
+          if (!requested || cancelled) return;
+          cancelled = true;
+          requestStop();
+        }).catch((error) => {
+          cancellationError = error;
+          requestStop();
+        }).finally(() => {
+          cancellationCheckRunning = false;
+        });
+      }, args.cancelPollMs ?? 250) : null;
+      cancellationTimer?.unref();
+      const clearProcessTimers = () => {
+        if (timer) clearTimeout(timer);
+        if (cancellationTimer) clearInterval(cancellationTimer);
+        if (forceKillTimer) clearTimeout(forceKillTimer);
+        process.off("SIGINT", onSigint);
+        process.off("SIGTERM", onSigterm);
+      };
+      if (logStream) {
+        child.stdout.pipe(logStream, { end: false });
+        child.stderr.pipe(logStream, { end: false });
+      }
+      forwardStreamLines(child.stdout, (line) => {
+        const progress = parseProgressLine(line);
+        if (progress) {
+          reportInBackground(() => args.reporter?.onProgress?.(progress));
+          return;
+        }
+        args.onLine?.(line, "stdout");
+        if (args.reporter?.verbose) {
+          reportInBackground(() => args.reporter?.onLog?.({ stage: args.stage, stream: "stdout", message: line }));
+        }
+      });
+      forwardStreamLines(child.stderr, (line) => {
+        stderr += `${line}
+`;
+        args.onLine?.(line, "stderr");
+        if (args.reporter?.verbose) {
+          reportInBackground(() => args.reporter?.onLog?.({ stage: args.stage, stream: "stderr", message: line }));
+        }
+      });
+      child.on("error", (error) => {
+        clearProcessTimers();
+        reject(timedOut ? new Error(args.timeoutMessage ?? `${args.command} timed out after ${args.timeoutMs}ms`) : error);
+      });
+      child.on("close", (code) => {
+        if (timedOut || cancelled || cancellationError || args.terminateProcessGroupOnExit) {
+          killProcessGroup("SIGKILL");
+        }
+        clearProcessTimers();
+        if (timedOut) {
+          reject(new Error(args.timeoutMessage ?? `${args.command} timed out after ${args.timeoutMs}ms`));
+          return;
+        }
+        if (cancellationError) {
+          reject(cancellationError);
+          return;
+        }
+        if (cancelled) {
+          reject(new ProcessCancelledError(`${args.stage} was cancelled.`));
+          return;
+        }
+        resolvePromise(code ?? 1);
+      });
+    });
+    return { exitCode, stderr };
+  } finally {
+    if (logStream) {
+      await new Promise((resolveEnd) => {
+        logStream.end(resolveEnd);
+      });
+    }
+  }
+}
+
+// src/local-runtime/assets.ts
+import { createHash as createHash3 } from "crypto";
+import { createReadStream as createReadStream2 } from "fs";
+import { readFile as readFile2, readdir as readdir3, realpath as realpath2, stat as stat2 } from "fs/promises";
+import { basename, dirname as dirname5, join as join5, relative as relative2, sep as sep2 } from "path";
+
+// src/local-runtime/huggingface-cache.ts
+import { homedir as homedir2 } from "os";
+import { dirname as dirname4, join as join4, resolve as resolve6 } from "path";
+function minimalMachineLearningEnvironment(env) {
+  const exact = /* @__PURE__ */ new Set([
+    "PATH",
+    "HOME",
+    "USER",
+    "LOGNAME",
+    "SHELL",
+    "TMPDIR",
+    "TEMP",
+    "TMP",
+    "LANG",
+    "LANGUAGE",
+    "LD_LIBRARY_PATH",
+    "DYLD_LIBRARY_PATH",
+    "XDG_CACHE_HOME",
+    "SSL_CERT_FILE",
+    "REQUESTS_CA_BUNDLE",
+    "CURL_CA_BUNDLE",
+    "NO_PROXY",
+    "no_proxy",
+    "UV_CACHE_DIR",
+    "UV_PYTHON",
+    "HF_HOME",
+    "HF_HUB_CACHE",
+    "HUGGINGFACE_HUB_CACHE",
+    "HF_ENDPOINT",
+    "HF_TOKEN",
+    "HF_HUB_OFFLINE",
+    "HF_HUB_DISABLE_TELEMETRY",
+    "TRANSFORMERS_OFFLINE",
+    "HF_HUB_ENABLE_HF_TRANSFER",
+    "HF_HUB_DOWNLOAD_TIMEOUT",
+    "HF_HUB_ETAG_TIMEOUT",
+    "TT_HF_DOWNLOAD_MAX_ATTEMPTS",
+    "PYTHONUTF8",
+    "PYTHONIOENCODING"
+  ]);
+  const prefixes = [
+    "LC_",
+    "CUDA_",
+    "NVIDIA_",
+    "NCCL_",
+    "OMP_",
+    "MKL_",
+    "TORCH_",
+    "PYTORCH_",
+    "TOKENIZERS_",
+    "HF_XET_"
+  ];
+  const result = Object.fromEntries(Object.entries(env).filter(
+    ([key]) => exact.has(key) || prefixes.some((prefix) => key.startsWith(prefix))
+  ));
+  result.TORCH_DISABLE_NATIVE_JIT ??= "1";
+  return result;
+}
+function resolveHuggingFaceCacheLayout(modelCache) {
+  const hfHome = resolve6(modelCache);
+  return {
+    hfHome,
+    hubCache: join4(hfHome, "hub")
+  };
+}
+function withHuggingFaceCacheEnvironment(env, modelCache) {
+  const inheritedHub = env.HF_HUB_CACHE ?? env.HUGGINGFACE_HUB_CACHE;
+  const canonicalHome = modelCache ?? env.HF_HOME ?? (inheritedHub ? dirname4(resolve6(inheritedHub)) : join4(homedir2(), ".cache", "huggingface"));
+  const layout = resolveHuggingFaceCacheLayout(canonicalHome);
+  const result = {
+    ...env,
+    HF_HOME: layout.hfHome,
+    HF_HUB_CACHE: layout.hubCache,
+    HUGGINGFACE_HUB_CACHE: layout.hubCache
+  };
+  delete result.TRANSFORMERS_CACHE;
+  delete result.PYTORCH_TRANSFORMERS_CACHE;
+  delete result.PYTORCH_PRETRAINED_BERT_CACHE;
+  return result;
+}
+function withOfflineHuggingFaceCacheEnvironment(env, modelCache) {
+  return {
+    ...withHuggingFaceCacheEnvironment(env, modelCache),
+    HF_HUB_OFFLINE: "1",
+    TRANSFORMERS_OFFLINE: "1"
+  };
+}
+
+// src/local-runtime/assets.ts
+var COMMIT_SHA = /^[0-9a-f]{40}$/;
+var SpecLockMismatchError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "SpecLockMismatchError";
+  }
+};
+function assetsRoot(env = process.env) {
+  return join5(getTunedTensorHome(env), "assets");
+}
+function snapshotDirectory(hubCache, kind, repo, revision) {
+  return join5(hubCache, `${kind}s--${repo.replaceAll("/", "--")}`, "snapshots", revision);
+}
+async function contentDigest(path, algorithm) {
+  const size = (await stat2(path)).size;
+  const hash = algorithm === "sha256" ? createHash3("sha256") : createHash3("sha1").update(`blob ${size}\0`);
+  for await (const chunk of createReadStream2(path, { highWaterMark: 8 * 1024 * 1024 })) hash.update(chunk);
+  return `${algorithm}:${hash.digest("hex")}`;
+}
+async function listFiles(root, directory = root) {
+  const files = [];
+  for (const entry of await readdir3(directory, { withFileTypes: true })) {
+    const child = join5(directory, entry.name);
+    if (entry.isDirectory()) files.push(...await listFiles(root, child));
+    else files.push(relative2(root, child).split(sep2).join("/"));
+  }
+  return files.sort();
+}
+async function snapshotDigests(snapshot, paths) {
+  const files = {};
+  let sizeBytes = 0;
+  for (const path of paths ?? await listFiles(snapshot)) {
+    const local = join5(snapshot, ...path.split("/"));
+    const target = await realpath2(local);
+    sizeBytes += (await stat2(target)).size;
+    const blob = target !== local && basename(dirname5(target)) === "blobs" ? basename(target).toLowerCase() : "";
+    files[path] = await contentDigest(target, /^[0-9a-f]{40}$/.test(blob) ? "git-sha1" : "sha256");
+    if (/^(?:[0-9a-f]{40}|[0-9a-f]{64})$/.test(blob) && files[path].split(":")[1] !== blob) {
+      throw new SpecLockMismatchError(`Cached file ${path} failed its checksum. Remove the corrupt blob ${target} and prefetch it again.`);
+    }
+  }
+  return { files, sizeBytes };
+}
+function manifestPath(kind, repo, revision, env) {
+  return join5(assetsRoot(env), `${kind}s`, repo.replaceAll("/", "--"), revision, "manifest.json");
+}
+async function recordAssetDownload(args) {
+  const path = manifestPath(args.kind, args.repo, args.revision, args.env);
+  let paths = args.paths;
+  if (paths) {
+    const previous = Object.keys((await readJsonIfPresent(path))?.files ?? {});
+    const stillCached = await Promise.all(previous.map(async (file) => await stat2(join5(args.snapshotPath, ...file.split("/"))).then(() => file, () => null)));
+    paths = [.../* @__PURE__ */ new Set([...stillCached.filter((file) => file !== null), ...paths])].sort();
+  }
+  const { files, sizeBytes } = await snapshotDigests(args.snapshotPath, paths);
+  const manifest = {
+    version: 1,
+    kind: args.kind,
+    repo: args.repo,
+    revision: args.revision,
+    fetched_at: (/* @__PURE__ */ new Date()).toISOString(),
+    snapshot_path: args.snapshotPath,
+    size_bytes: sizeBytes,
+    files
+  };
+  await writeJsonAtomic(path, manifest);
+  return { manifest, path };
+}
+async function readJsonIfPresent(path) {
+  try {
+    return JSON.parse(await readFile2(path, "utf8"));
+  } catch (error) {
+    if (error.code === "ENOENT") return void 0;
+    throw error;
+  }
+}
+async function listAssets(env) {
+  const root = assetsRoot(env);
+  const found = [];
+  for (const kind of ["datasets", "models"]) {
+    const repos = await readdir3(join5(root, kind)).catch(() => []);
+    for (const repo of repos) {
+      for (const revision of await readdir3(join5(root, kind, repo)).catch(() => [])) {
+        const path = join5(root, kind, repo, revision, "manifest.json");
+        const manifest = await readJsonIfPresent(path);
+        if (manifest) found.push({ ...manifest, manifest_path: path });
+      }
+    }
+  }
+  return found.sort((a, b) => b.fetched_at.localeCompare(a.fetched_at));
+}
+async function findAsset(reference, env) {
+  const [repo, revision] = reference.split("@");
+  const match = (await listAssets(env)).find((asset) => asset.repo === repo && (!revision || asset.revision.startsWith(revision.toLowerCase())));
+  if (!match) throw new Error(`No downloaded asset matches ${reference}. Run \`tt assets list\` to see downloads.`);
+  return match;
+}
+async function verifyAsset(manifest) {
+  const problems = [];
+  for (const [path, expected] of Object.entries(manifest.files)) {
+    const local = join5(manifest.snapshot_path, ...path.split("/"));
+    const target = await realpath2(local).catch(() => null);
+    if (!target) {
+      problems.push(`${path}: missing from ${manifest.snapshot_path}`);
+      continue;
+    }
+    const algorithm = expected.startsWith("git-sha1:") ? "git-sha1" : "sha256";
+    if (await contentDigest(target, algorithm) !== expected) problems.push(`${path}: content does not match ${expected}`);
+  }
+  return { ok: problems.length === 0, problems };
+}
+function specLockPath(specPath) {
+  const name = basename(specPath).replace(/^\.(.+)\.tt-(?:local|agent)-[^/\\]*\.json$/, "$1");
+  return join5(dirname5(specPath), `${name.replace(/\.json$/i, "")}.lock.json`);
+}
+async function readSpecLock(specPath) {
+  const path = specLockPath(specPath);
+  const lock = await readJsonIfPresent(path);
+  if (lock && lock.version !== 1) throw new Error(`${path} has unsupported version ${String(lock.version)}.`);
+  return lock;
+}
+async function writeSpecLockEntry(specPath, key, entry) {
+  const lock = await readSpecLock(specPath) ?? { version: 1 };
+  await writeJsonAtomic(specLockPath(specPath), { ...lock, version: 1, [key]: sortedEntry(entry) });
+}
+function sortedEntry(entry) {
+  return {
+    repo: entry.repo,
+    revision: entry.revision,
+    files: Object.fromEntries(Object.entries(entry.files).sort(([a], [b]) => a.localeCompare(b)))
+  };
+}
+var PREFETCH_COMMAND = {
+  dataset: "tt datasets prefetch",
+  base_model: "tt models prefetch"
+};
+async function checkSpecLock(specPath, key, actual) {
+  const locked = (await readSpecLock(specPath))?.[key];
+  if (!locked) {
+    await writeSpecLockEntry(specPath, key, actual);
+    return "recorded";
+  }
+  const lockFile = basename(specLockPath(specPath));
+  const update = `If this change is intended, run \`${PREFETCH_COMMAND[key]}\` with this spec to update ${lockFile}.`;
+  const label = key === "dataset" ? "dataset" : "base model";
+  if (locked.repo !== actual.repo || locked.revision !== actual.revision) {
+    throw new SpecLockMismatchError(
+      `The spec's ${label} is ${actual.repo}@${actual.revision}, but ${lockFile} pins ${locked.repo}@${locked.revision}. ${update}`
+    );
+  }
+  if (key === "base_model") {
+    for (const path of Object.keys(locked.files)) {
+      if (actual.files[path] === void 0) {
+        throw new SpecLockMismatchError(`base model file ${path} is missing from the cached snapshot. ${update}`);
+      }
+    }
+  }
+  for (const [path, digest] of Object.entries(actual.files)) {
+    if (locked.files[path] === void 0) {
+      throw new SpecLockMismatchError(`${label} file ${path} is not in ${lockFile}. ${update}`);
+    }
+    if (locked.files[path] !== digest) {
+      throw new SpecLockMismatchError(
+        `${label} file ${path} is ${digest}, but ${lockFile} expects ${locked.files[path]}. The cached file differs from the one this project was locked to. ${update}`
+      );
+    }
+  }
+  return "matched";
+}
+function lockedRevision(lock, key, repo) {
+  const entry = lock?.[key];
+  return entry?.repo === repo && COMMIT_SHA.test(entry.revision) ? entry.revision : void 0;
+}
+function applySpecLock(request, lock) {
+  const source = request.dataset_prebuilt?.huggingface;
+  if (!source || source.revision) return request;
+  const revision = lockedRevision(lock, "dataset", source.repo);
+  if (!revision) return request;
+  return { ...request, dataset_prebuilt: { ...request.dataset_prebuilt, huggingface: { ...source, revision } } };
+}
+async function enforceSpecLock(args) {
+  if (args.config.dryRun) return;
+  const dataset = args.request.dataset_source;
+  if (dataset) {
+    const paths = Object.values(dataset.files).flatMap((file) => file ? [file.path] : []);
+    const { files: files2 } = await snapshotDigests(dataset.snapshot_path, paths);
+    await checkSpecLock(args.specPath, "dataset", { repo: dataset.repo, revision: dataset.revision, files: files2 });
+  }
+  if (args.config.paths.baseModel || args.config.gpu) return;
+  const model = resolveTrainingModel(args.request.spec_snapshot.base_model);
+  const revision = resolveRequestedBaseModelRevision(model.id, args.request.hyperparameters.base_model_revision);
+  if (!revision) return;
+  const hubCache = withHuggingFaceCacheEnvironment(process.env, args.config.paths.modelCache).HF_HUB_CACHE;
+  const snapshot = snapshotDirectory(hubCache, "model", model.id, revision);
+  if (!await stat2(snapshot).then(() => true, () => false)) {
+    if ((await readSpecLock(args.specPath))?.base_model) {
+      throw new SpecLockMismatchError(
+        `Base model ${model.id}@${revision} is not downloaded (${snapshot}). Run \`tt models prefetch\` with this spec first.`
+      );
+    }
+    const { prefetchBaseModel: prefetchBaseModel2 } = await import("./prefetch-GP3OPUUL.js");
+    await prefetchBaseModel2({ request: args.request, config: args.config, reporter: args.reporter });
+  }
+  const { files } = await snapshotDigests(snapshot);
+  await checkSpecLock(args.specPath, "base_model", { repo: model.id, revision, files });
+}
+
+// src/local-runtime/prefetch.ts
+var NEMOTRON_BF16_FILE_DIGESTS = {
+  ".gitattributes": { algorithm: "sha1", digest: "fe3f694ce14b577c9833fca6e83c5e26a7119127" },
+  "LICENSE": { algorithm: "sha1", digest: "4d76cc87c9edb280753e3bee3b499ae461113835" },
+  "README.md": { algorithm: "sha1", digest: "8ec43ee9f3ee345202e4a6ef752c51b2619f7425" },
+  "accuracy_plot.png": { algorithm: "sha256", digest: "1397995f8a5d34d819a069d86c02914990e9ecfc2fce101e233924da9cf5ddcf" },
+  "agentic_coding_benchmarks.png": { algorithm: "sha256", digest: "06cf5486ae94ecd7cc6f91ae3b4bae21c7435253a294cb89f54f7ec42eda8847" },
+  "bias.md": { algorithm: "sha1", digest: "cdcc8055f965222fabddabcabf22885d3a8bacc1" },
+  "chat_template.jinja": { algorithm: "sha1", digest: "d85b0c772f8fe585063847c5f6bf5ec48eb210be" },
+  "config.json": { algorithm: "sha1", digest: "993b612989e6aa67da45f908ea5983cb777e7678" },
+  "explainability.md": { algorithm: "sha1", digest: "2435f23c865e7daba6a6eceef2f214b86df75d24" },
+  "generation_config.json": { algorithm: "sha1", digest: "a41201df53f9d0769947989353b5d02e70491c56" },
+  "model.safetensors.index.json": { algorithm: "sha1", digest: "3cd409443b1896d9adc5c3981af301841f85329a" },
+  "special_tokens_map.json": { algorithm: "sha1", digest: "0451f37912edb7f8a4bf04d77eef13f6130f0515" },
+  "tokenizer.json": { algorithm: "sha256", digest: "623c34567aebb18582765289fbe23d901c62704d6518d71866e0e58db892b5b7" },
+  "tokenizer_config.json": { algorithm: "sha1", digest: "c96e5ad00986bfa0b666d4bc425666f1c51d6d1b" },
+  "model-00001-of-00014.safetensors": { algorithm: "sha256", digest: "7a3e74d24969eac6657cb9b6422091fd062b7d30fd4bc90ecee6c3d7f692626a" },
+  "model-00002-of-00014.safetensors": { algorithm: "sha256", digest: "a80c3846e959f6dda34aa031cbb668b766643691ac7e5c9f43f62e6fb1221059" },
+  "model-00003-of-00014.safetensors": { algorithm: "sha256", digest: "996bf3a46668e14075cb82259390267c2b1f71446caeb3a5f1f9e0bd7a079ae7" },
+  "model-00004-of-00014.safetensors": { algorithm: "sha256", digest: "cce1d79e7ff2e2b746b9d97166156aa1dcec796116675cc7fd1aa70a8d73ccb2" },
+  "model-00005-of-00014.safetensors": { algorithm: "sha256", digest: "9338f59d3fd5f074288c71a9559452d5b5c581da00e9ccb9fe7aa2ce9b04d2ad" },
+  "model-00006-of-00014.safetensors": { algorithm: "sha256", digest: "e947fa4097c68263ba3d097fceb32a300a22cebd9d909fb5198af7d18a4022fe" },
+  "model-00007-of-00014.safetensors": { algorithm: "sha256", digest: "c7362630bf4256275ca58354ed8f31506cec67ffab30573e753703fd5ae48795" },
+  "model-00008-of-00014.safetensors": { algorithm: "sha256", digest: "1b33a5a6b5505b25b57c90ddda19e9cd1598176468917df0c56116fa6f6072cb" },
+  "model-00009-of-00014.safetensors": { algorithm: "sha256", digest: "fcc9b48caff427beaf1f87b78cf4ab42bc2a3c43b3c487bccb013ba22d7468b2" },
+  "model-00010-of-00014.safetensors": { algorithm: "sha256", digest: "d1924fd54d1b77a15aff8df591a317e8a82a58e46d6f5742fa21e90e0be3cfa6" },
+  "model-00011-of-00014.safetensors": { algorithm: "sha256", digest: "e9d0b83bcf04bd4d5758b94e6495a3f1595d121d82faffaa27ce6a884e2c8757" },
+  "model-00012-of-00014.safetensors": { algorithm: "sha256", digest: "fce184f112cb0b97024cadc60f993f6f660e365d04e21c240fb3c75747bd3a01" },
+  "model-00013-of-00014.safetensors": { algorithm: "sha256", digest: "f427d037d2a3e4d44323325aa38571e3551e8ad702f469c3dacc4e59ea2e50d1" },
+  "model-00014-of-00014.safetensors": { algorithm: "sha256", digest: "64577b275ca4e7e5266eae0903674f7f46ec2a8cbf4f4f1a3207f80d503cd1d0" },
+  "privacy.md": { algorithm: "sha1", digest: "e3bf30aa1c42a488298ef37383647dc99e1cd39e" },
+  "safety.md": { algorithm: "sha1", digest: "f53bf94a4635862eed5cf3e0bc799b93f81d20ac" }
+};
+var MUSE_GLIMMER_FILE_DIGESTS = {
+  ".gitattributes": { algorithm: "sha1", digest: "52373fe24473b1aa44333d318f578ae6bf04b49b" },
+  "LICENSE": { algorithm: "sha1", digest: "d645695673349e3947e8e5ae42332d0ac3164cd7" },
+  "README.md": { algorithm: "sha1", digest: "a25f87c1c1fbd88f367a552fd14427baa8cb947e" },
+  "USAGE_POLICY.md": { algorithm: "sha1", digest: "1a9ed6cffc54585daf9cc904c07cb6e436a9444b" },
+  "chat_template.jinja": { algorithm: "sha1", digest: "7507f3c9f38809152732c045df3977848f3916a6" },
+  "config.json": { algorithm: "sha1", digest: "190826dc834c13c86b8dc68e775a888a852d7c34" },
+  "generation_config.json": { algorithm: "sha1", digest: "b69a50a4239f42707d54a479e0143b8ee56c8bcc" },
+  "model.safetensors.index.json": { algorithm: "sha1", digest: "00b257ef0c8bce1b001a6266f6b1f66f4fe16a6b" },
+  "processor_config.json": { algorithm: "sha1", digest: "ec9a07be13ea1dadf7395131871753b13f406c26" },
+  "tokenizer_config.json": { algorithm: "sha1", digest: "fe7f0bb90fb0d0288e3a505974ae0e4baf1d3e61" },
+  "tokenizer.json": { algorithm: "sha256", digest: "c9dbee66967b58f31a7c27f723c3760da3526ccd0427578e8905b0abb0031c4d" },
+  "model-00001-of-00002.safetensors": { algorithm: "sha256", digest: "8eef61530e1283642c77ce2e6721feb5c6f348fa055c00e90f2844a136372694" },
+  "model-00002-of-00002.safetensors": { algorithm: "sha256", digest: "b58cc2144ba1ba1af4420f67f4ca3ced7f09298510b80464cc75018a0be14381" }
+};
+function certifiedFileDigests(modelId) {
+  switch (modelId) {
+    case "nvidia/NVIDIA-Nemotron-3.5-Lightning-30B-A3B-BF16":
+      return NEMOTRON_BF16_FILE_DIGESTS;
+    case "meta-models/Muse-Glimmer-30B":
+      return MUSE_GLIMMER_FILE_DIGESTS;
+    default:
+      return void 0;
+  }
+}
+async function certifiedFileDigest(path, expected) {
+  const metadata = await stat3(path);
+  const digest = createHash4(expected.algorithm);
+  if (expected.algorithm === "sha1") digest.update(`blob ${metadata.size}\0`);
+  for await (const chunk of createReadStream3(path, { highWaterMark: 8 * 1024 * 1024 })) digest.update(chunk);
+  return digest.digest("hex");
+}
+function isStrictPhysicalDescendant(parent, child) {
+  const candidate = relative3(parent, child);
+  return candidate !== "" && candidate !== ".." && !candidate.startsWith(`..${sep3}`) && !isAbsolute3(candidate);
+}
+async function verifySnapshotCacheLocation(path, modelId, revision, modelCache) {
+  const repository = `models--${modelId.replaceAll("/", "--")}`;
+  const layout = resolveHuggingFaceCacheLayout(modelCache);
+  const repositoryRoot = join6(layout.hubCache, repository);
+  const expectedPath = join6(repositoryRoot, "snapshots", revision);
+  const [
+    physicalCacheRoot,
+    physicalHubRoot,
+    physicalRepositoryRoot,
+    physicalBlobRoot,
+    physicalPath,
+    physicalExpectedPath
+  ] = await Promise.all([
+    realpath3(layout.hfHome).catch(() => null),
+    realpath3(layout.hubCache).catch(() => null),
+    realpath3(repositoryRoot).catch(() => null),
+    realpath3(join6(repositoryRoot, "blobs")).catch(() => null),
+    realpath3(path).catch(() => null),
+    realpath3(expectedPath).catch(() => null)
+  ]);
+  if (!physicalCacheRoot || !physicalHubRoot || !physicalRepositoryRoot || !physicalBlobRoot || !physicalPath || !physicalExpectedPath || physicalPath !== physicalExpectedPath) {
+    throw new Error(
+      `${modelId} must use the certified Hugging Face cache snapshot ${expectedPath}; got ${path}.`
+    );
+  }
+  if (!isStrictPhysicalDescendant(physicalCacheRoot, physicalHubRoot)) {
+    throw new Error(`Hugging Face hub cache escapes its configured cache root: ${layout.hubCache}`);
+  }
+  if (!isStrictPhysicalDescendant(physicalHubRoot, physicalRepositoryRoot)) {
+    throw new Error(`Hugging Face repository escapes its configured hub cache: ${repositoryRoot}`);
+  }
+  if (!isStrictPhysicalDescendant(physicalRepositoryRoot, physicalBlobRoot)) {
+    throw new Error(`Hugging Face blob store escapes its repository: ${join6(repositoryRoot, "blobs")}`);
+  }
+  if (!isStrictPhysicalDescendant(physicalRepositoryRoot, physicalExpectedPath)) {
+    throw new Error(`Hugging Face snapshot escapes its configured repository: ${expectedPath}`);
+  }
+  return { repositoryRoot, physicalBlobRoot };
+}
+async function requireReportedCachePath(label, reported, expected) {
+  const [physicalReported, physicalExpected] = await Promise.all([
+    reported ? realpath3(reported).catch(() => null) : null,
+    realpath3(expected).catch(() => null)
+  ]);
+  if (!physicalReported || !physicalExpected || physicalReported !== physicalExpected) {
+    throw new Error(`Model prefetch returned an unexpected ${label}: ${String(reported)}.`);
+  }
+}
+async function verifyModelPrefetchCacheReport(args) {
+  if (!args.output.snapshot_path) {
+    throw new Error("Model prefetch did not return a snapshot path.");
+  }
+  const effectiveHubCache = resolveHuggingFaceCacheLayout(args.modelCache).hubCache;
+  await Promise.all([
+    requireReportedCachePath("model cache", args.output.model_cache, args.modelCache),
+    requireReportedCachePath("HF home", args.output.hf_home, args.modelCache),
+    requireReportedCachePath("hub cache", args.output.hub_cache, effectiveHubCache)
+  ]);
+  await verifySnapshotCacheLocation(
+    args.output.snapshot_path,
+    args.modelId,
+    args.revision,
+    args.modelCache
+  );
+}
+async function verifyCertifiedLocalSnapshot(path, modelId, snapshotFiles, modelCache) {
+  const revision = defaultBaseModelRevision(modelId);
+  if (!revision) return;
+  const digests = certifiedFileDigests(modelId);
+  if (!digests) return;
+  if (!modelCache) {
+    throw new Error(`A certified local snapshot for ${modelId} requires paths.modelCache.`);
+  }
+  const { physicalBlobRoot } = await verifySnapshotCacheLocation(
+    path,
+    modelId,
+    revision,
+    modelCache
+  );
+  const physicalFiles = /* @__PURE__ */ new Map();
+  for (const file of snapshotFiles) {
+    const metadata = await lstat3(file);
+    const target = await realpath3(file);
+    if (metadata.isSymbolicLink()) {
+      if (!isStrictPhysicalDescendant(physicalBlobRoot, target)) {
+        throw new Error(`Certified snapshot symbolic link escapes its Hugging Face blob store: ${file}`);
+      }
+    }
+    physicalFiles.set(file, target);
+  }
+  const actualFiles = new Set(snapshotFiles.map((file) => relative3(path, file).split("\\").join("/")));
+  const expectedFiles = new Set(Object.keys(digests));
+  const unexpected = [...actualFiles].filter((name) => !expectedFiles.has(name)).sort();
+  if (unexpected.length > 0) {
+    throw new Error(`Certified snapshot contains unexpected file: ${join6(path, unexpected[0])}`);
+  }
+  for (const [name, expected] of Object.entries(digests)) {
+    if (!actualFiles.has(name)) {
+      throw new Error(`Certified snapshot file is missing: ${join6(path, name)}`);
+    }
+    const file = join6(path, name);
+    const physicalFile = physicalFiles.get(file);
+    if (await certifiedFileDigest(physicalFile, expected) !== expected.digest) {
+      throw new Error(`Certified snapshot file checksum mismatch: ${file}`);
+    }
+    if (await realpath3(file) !== physicalFile) {
+      throw new Error(`Certified snapshot file changed during verification: ${file}`);
+    }
+  }
+}
+function buildModelPrefetchPayload(request, config) {
+  const model = resolveTrainingModel(request.spec_snapshot.base_model);
+  const revision = resolveRequestedBaseModelRevision(
+    model.id,
+    request.hyperparameters.base_model_revision
+  );
+  return {
+    base_model: model.id,
+    ...revision ? { revision } : {},
+    ...config.paths.modelCache ? { model_cache: resolve7(config.paths.modelCache) } : {}
+  };
+}
+function buildModelSourcePrefetchPayload(source, config) {
+  const model = resolveTrainingModel(source.repo);
+  const revision = source.revision || isCertifiedTrainingModel(model.id) ? resolveRequestedBaseModelRevision(model.id, source.revision) : void 0;
+  return {
+    base_model: model.id,
+    ...revision ? { revision } : { resolve_latest: true },
+    ...config.paths.modelCache ? { model_cache: resolve7(config.paths.modelCache) } : {}
+  };
+}
+function safeName(value) {
+  return value.replace(/[^A-Za-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "model";
+}
+function transformersWeightName(name) {
+  const lower = name.split(/[\\/]/).at(-1)?.toLowerCase() ?? "";
+  return lower.endsWith(".safetensors") && !lower.startsWith("adapter_") || /^pytorch_model.*\.bin$/.test(lower);
+}
+async function verifyLocalBaseModel(path, expectedModelId, modelCache) {
+  const root = await lstat3(path).catch(() => null);
+  if (!root) throw new Error(`paths.baseModel is set to ${path}, but that path does not exist.`);
+  if (root.isSymbolicLink()) {
+    throw new Error(`paths.baseModel must not itself be a symbolic link: ${path}`);
+  }
+  if (!root.isDirectory()) {
+    throw new Error(
+      `paths.baseModel must be a Hugging Face snapshot directory, not a standalone file or archive: ${path}`
+    );
+  }
+  const files = [];
+  const visit = async (directory) => {
+    for (const entry of await readdir4(directory, { withFileTypes: true })) {
+      const child = join6(directory, entry.name);
+      if (entry.isSymbolicLink()) {
+        const metadata2 = await stat3(child);
+        if (!metadata2.isFile()) {
+          throw new Error(`Local base model contains a non-file symbolic link: ${child}`);
+        }
+        files.push({ path: child, size: metadata2.size });
+        continue;
+      }
+      if (entry.isDirectory()) {
+        await visit(child);
+        continue;
+      }
+      const metadata = await stat3(child);
+      if (metadata.isFile()) files.push({ path: child, size: metadata.size });
+    }
+  };
+  await visit(path);
+  const nonEmpty = files.filter((file) => file.size > 0);
+  const weights = nonEmpty.filter((file) => transformersWeightName(file.path));
+  if (weights.length === 0) {
+    throw new Error(`Local base-model directory contains no non-empty Transformers model weights: ${path}`);
+  }
+  const required = async (name) => {
+    const metadata = await stat3(join6(path, name)).catch(() => null);
+    return Boolean(metadata?.isFile() && metadata.size > 0);
+  };
+  if (!await required("config.json")) throw new Error(`Local base-model directory is missing config.json: ${path}`);
+  try {
+    const config = JSON.parse(await readFile3(join6(path, "config.json"), "utf8"));
+    assertCertifiedBaseModelConfig(
+      config,
+      `Local base-model config ${join6(path, "config.json")}`,
+      expectedModelId
+    );
+  } catch (error) {
+    const detail = error instanceof Error ? `: ${error.message}` : "";
+    throw new Error(
+      `Local base-model directory has an invalid or unsupported config.json: ${path}${detail}`,
+      { cause: error }
+    );
+  }
+  if (expectedModelId) {
+    await verifyCertifiedLocalSnapshot(
+      path,
+      expectedModelId,
+      files.map((file) => file.path),
+      modelCache
+    );
+  }
+  const vocabNames = [
+    "tokenizer.json",
+    "tokenizer.model",
+    "sentencepiece.bpe.model",
+    "spiece.model",
+    "vocab.json",
+    "tokenizer.tiktoken"
+  ];
+  if (!await required("tokenizer_config.json") || !(await Promise.all(vocabNames.map(required))).some(Boolean)) {
+    throw new Error(`Local base-model directory is missing tokenizer metadata or vocabulary: ${path}`);
+  }
+  const inventory = new Set(nonEmpty.map((file) => resolve7(file.path)));
+  for (const file of files.filter((candidate) => candidate.path.endsWith(".index.json"))) {
+    const parsed = JSON.parse(await readFile3(file.path, "utf8"));
+    if (!parsed.weight_map || typeof parsed.weight_map !== "object" || Array.isArray(parsed.weight_map)) {
+      throw new Error(`Local base-model weight index is invalid: ${file.path}`);
+    }
+    for (const shard of new Set(Object.values(parsed.weight_map))) {
+      if (typeof shard !== "string" || !shard || /^(?:[A-Za-z]:|[/\\])/.test(shard) || shard.split(/[/\\]/).includes("..")) {
+        throw new Error("Local base-model weight index has an invalid indexed weight shard path");
+      }
+      if (!inventory.has(resolve7(path, shard)) || !await required(shard)) {
+        throw new Error(`Local base-model directory is missing indexed weight shard: ${String(shard)}`);
+      }
+    }
+  }
+  return {
+    fileCount: files.length,
+    sizeBytes: files.reduce((total, file) => total + file.size, 0)
+  };
+}
+async function prefetchBaseModel(args) {
+  if (!args.request === !args.source) throw new Error("Model prefetch needs either a spec request or a source repo.");
+  const payload = {
+    ...args.source ? buildModelSourcePrefetchPayload(args.source, args.config) : buildModelPrefetchPayload(args.request, args.config),
+    ...args.localOnly ? { local_files_only: true } : {}
+  };
+  const artifactDir = resolve7(
+    args.config.artifactRoot,
+    args.localOnly ? "verify-base" : "prefetch",
+    `${safeName(payload.base_model)}-${(/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-")}`
+  );
+  await mkdir3(artifactDir, { recursive: true });
+  if (args.request && args.config.paths.baseModel) {
+    const localPath = resolve7(args.config.paths.baseModel);
+    const modelId = args.request.spec_snapshot.base_model;
+    const verified = await withProgressHeartbeat(args.reporter, {
+      stage: "model_prefetch",
+      status: "running",
+      message: "Verifying local model checksums. Large cached models can take several minutes."
+    }, () => verifyLocalBaseModel(
+      localPath,
+      modelId,
+      args.config.paths.modelCache
+    ));
+    return {
+      ok: true,
+      status: args.localOnly ? "completed" : "skipped",
+      base_model: args.request.spec_snapshot.base_model,
+      local_base_model_path: localPath,
+      file_count: verified.fileCount,
+      size_bytes: verified.sizeBytes,
+      artifact_dir: artifactDir,
+      reason: args.localOnly ? "Verified the configured local base-model artifact; no network access was used." : "paths.baseModel points at a verified local base-model artifact; no Hugging Face download is needed."
+    };
+  }
+  const inputPath = join6(artifactDir, "prefetch-input.json");
+  const outputPath = join6(artifactDir, "prefetch-output.json");
+  const logPath = join6(artifactDir, "prefetch.log");
+  await writeJson(inputPath, payload);
+  const entrypoint = buildBundledPythonCommand(
+    "prefetch.py",
+    ["--input", inputPath, "--output", outputPath]
+  );
+  const downloadEvent = {
+    stage: "model_prefetch",
+    status: "running",
+    message: args.localOnly ? "Verifying cached model files. Large models can take several minutes." : "Downloading and verifying model files. Cached files still need checksum verification; large models can take several minutes.",
+    details: {
+      base_model: payload.base_model,
+      model_cache: payload.model_cache ?? null,
+      command: entrypoint.displayCommand,
+      log_path: logPath
+    }
+  };
+  const cacheEnvironment = withHuggingFaceCacheEnvironment(
+    minimalMachineLearningEnvironment(process.env),
+    payload.model_cache
+  );
+  const effectiveModelCache = cacheEnvironment.HF_HOME;
+  const effectiveHubCache = resolveHuggingFaceCacheLayout(effectiveModelCache).hubCache;
+  const env = withBundledPythonEnvironment(cacheEnvironment);
+  const { exitCode } = await withProgressHeartbeat(args.reporter, downloadEvent, () => runLoggedProcess({
+    command: entrypoint.command,
+    commandArgs: entrypoint.commandArgs,
+    env,
+    logPath,
+    // A base model can be several gigabytes. Surface the downloader's progress
+    // by default; callers can still opt out by omitting the reporter (`--quiet`).
+    reporter: args.reporter ? { ...args.reporter, verbose: true } : void 0,
+    stage: "model_prefetch"
+  }));
+  if (exitCode !== 0) {
+    throw new Error(`Model prefetch exited with code ${exitCode}. See ${logPath}.`);
+  }
+  const output = JSON.parse(await readFile3(outputPath, "utf8"));
+  const snapshotRevision = baseModelRevisionSchema.safeParse(output.snapshot_revision);
+  if (!snapshotRevision.success) {
+    throw new Error(
+      "Model prefetch did not resolve the base model to a 40-character immutable commit SHA."
+    );
+  }
+  if (output.base_model !== payload.base_model) {
+    throw new Error(`Model prefetch returned ${String(output.base_model)} for requested model ${payload.base_model}.`);
+  }
+  if (payload.revision && snapshotRevision.data !== payload.revision.toLowerCase()) {
+    throw new Error(
+      `Model prefetch resolved a different revision (${snapshotRevision.data}) than requested (${payload.revision}).`
+    );
+  }
+  await verifyModelPrefetchCacheReport({
+    modelId: payload.base_model,
+    revision: snapshotRevision.data,
+    modelCache: effectiveModelCache,
+    output
+  });
+  if (defaultBaseModelRevision(payload.base_model)) {
+    await withProgressHeartbeat(args.reporter, {
+      stage: "model_prefetch",
+      status: "running",
+      message: "Checking model files against the certified revision's checksums."
+    }, () => verifyLocalBaseModel(
+      output.snapshot_path,
+      payload.base_model,
+      effectiveModelCache
+    ));
+  }
+  const recorded = args.localOnly ? void 0 : await withProgressHeartbeat(args.reporter, {
+    stage: "model_prefetch",
+    status: "running",
+    message: "Verifying model files and recording the local asset manifest."
+  }, () => recordAssetDownload({
+    kind: "model",
+    repo: payload.base_model,
+    revision: snapshotRevision.data,
+    snapshotPath: output.snapshot_path
+  }));
+  await args.reporter?.onEvent?.({
+    stage: "model_prefetch",
+    status: "completed",
+    message: "Base model is available in the local Hugging Face cache.",
+    details: {
+      base_model: output.base_model ?? payload.base_model,
+      hf_home: effectiveModelCache,
+      hub_cache: effectiveHubCache,
+      snapshot_path: output.snapshot_path ?? null,
+      snapshot_revision: snapshotRevision.data,
+      file_count: output.file_count ?? null,
+      size_bytes: output.size_bytes ?? null,
+      verified_blob_count: output.verified_blob_count ?? null
+    }
+  });
+  return {
+    ok: true,
+    status: "completed",
+    base_model: output.base_model ?? payload.base_model,
+    model_cache: effectiveModelCache,
+    hf_home: effectiveModelCache,
+    hub_cache: effectiveHubCache,
+    snapshot_path: output.snapshot_path,
+    snapshot_revision: snapshotRevision.data,
+    file_count: output.file_count,
+    size_bytes: output.size_bytes,
+    verified_blob_count: output.verified_blob_count,
+    artifact_dir: artifactDir,
+    input_path: inputPath,
+    output_path: outputPath,
+    log_uri: fileUri(logPath),
+    command: entrypoint.displayCommand,
+    ...recorded ? { manifest_path: recorded.path } : {}
+  };
+}
+
+export {
+  ARTIFACT_WORKFLOW_LOCK_FILE,
+  fileUri,
+  defaultArtifactPrefix,
+  resolveRunArtifacts,
+  claimRunArtifactDirectory,
+  prepareRunDirectories,
+  writeJson,
+  writeJsonAtomic,
+  writeFileAtomic,
+  readJson,
+  copyDatasetToTrainingChannel,
+  writeArtifactManifest,
+  assertArtifactManifest,
+  TRAINING_MODELS,
+  isCertifiedTrainingModel,
+  resolveTrainingModel,
+  resolveRequestedBaseModelRevision,
+  defaultBaseModelRevision,
+  resolveModelLoader,
+  localModelArtifactPath,
+  assertUsableModelArtifact,
+  DECISION_MODELS,
+  DEFAULT_DECISION_MODEL,
+  resolveDecisionModel,
+  DEFAULT_ARTIFACT_ROOT,
+  DEFAULT_PROJECT_STORE_ROOT,
+  DEFAULT_FOUNDATION_RUNS_DIR,
+  DEFAULT_DECISION_RUNS_DIR,
+  expandUserPath,
+  getTunedTensorHome,
+  getConfigDir,
+  getAgentConfigDir,
+  defaultStoreRoot,
+  pythonEnvironmentPath,
+  datasetFormatSchema,
+  baseModelRevisionSchema,
+  behaviorSpecExampleSchema,
+  behaviorSpecSchema,
+  specSnapshotSchema,
+  foundationHyperparametersSchema,
+  huggingFaceRepoIdSchema,
+  datasetColumnsSchema,
+  huggingFaceDatasetSourceSchema,
+  isRepoRelativePath,
+  datasetPrebuiltSchema,
+  datasetSourceSchema,
+  fineTuneHyperparametersSchema,
+  fineTuneRunRequestSchema,
+  evalExampleResultSchema,
+  jsonFieldMetricsSchema,
+  evalSplitSchema,
+  evalReportSchema,
+  comparisonReportSchema,
+  trainingReportSchema,
+  runProvenanceSchema,
+  runReportSchema,
+  localRunnerConfigSchema,
+  projectRuntimeSchema,
+  localFoundationSpecFileSchema,
+  localAdapterSpecFileSchema,
+  decisionQuestionSchema,
+  decisionHyperparametersSchema,
+  localDecisionSpecFileSchema,
+  decisionLabels,
+  localBehaviorSpecFileSchema,
+  isFoundationSpecFile,
+  isDecisionSpecFile,
+  reportInBackground,
+  withProgressHeartbeat,
+  sanitizeLogLine,
+  forwardStreamLines,
+  localRuntimePackageRoot,
+  createProgressRenderer,
+  progressTty,
+  progressColumns,
+  buildDecisionPythonCommand,
+  withDecisionPythonEnvironment,
+  buildBundledPythonCommand,
+  withBundledPythonEnvironment,
+  buildFoundationPythonCommand,
+  withFoundationPythonEnvironment,
+  ProcessCancelledError,
+  runLoggedProcess,
+  minimalMachineLearningEnvironment,
+  withHuggingFaceCacheEnvironment,
+  withOfflineHuggingFaceCacheEnvironment,
+  snapshotDigests,
+  recordAssetDownload,
+  listAssets,
+  findAsset,
+  verifyAsset,
+  specLockPath,
+  readSpecLock,
+  writeSpecLockEntry,
+  applySpecLock,
+  enforceSpecLock,
+  verifyModelPrefetchCacheReport,
+  buildModelPrefetchPayload,
+  buildModelSourcePrefetchPayload,
+  safeName,
+  verifyLocalBaseModel,
+  prefetchBaseModel
+};
+//# sourceMappingURL=chunk-UCJCWJ6F.js.map