agent-hitch 0.2.5 → 0.2.7

package/dist/src/evals/trial-publication-recovery.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trial-publication-recovery.js","sourceRoot":"","sources":["../../../src/evals/trial-publication-recovery.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAC1E,OAAO,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,sBAAsB,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAEzH,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,0BAA0B,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAG/F,MAAM,MAAM,GAAG,oBAAoB,CAAC;AAOpC,MAAM,CAAC,KAAK,UAAU,oCAAoC,CAAC,KAM1D;IACC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC;IAClC,MAAM,YAAY,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,IAAI,GAAG,EAAoC,CAAC;IAC3D,KAAK,MAAM,WAAW,IAAI,YAAY,EAAE,CAAC;QACvC,8BAA8B,CAAC,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACxD,MAAM,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;QAChG,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,WAAW,CAAC,KAAK,CAAC,EAAE;YACzE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE;YACpC,iBAAiB,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ;SACjD,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACtC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,KAAK,MAAM,GAAG,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5C,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAA6B,CAAC;QAC5D,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACvE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,iBAAiB,IAAI,KAAK,CAAC,KAAK,CAAC,kBAAkB,KAAK,OAAO,CAAC,CAAC;QAC1H,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,QAAQ,CAAC,kDAAkD,WAAW,CAAC,WAAW,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACnI,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,QAAQ,CAAC,2CAA2C,WAAW,CAAC,OAAO,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpH,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC;QAC9C,IAAI,CAAC,QAAQ;YAAE,SAAS;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;QAC7E,IAAI,OAAO,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,CAAC;YAAE,SAAS;QACpF,IAAI,OAAO,IAAI,QAAQ,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,QAAQ,CAAC,oDAAoD,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,IAAI,OAAO,EAAE,kBAAkB,KAAK,OAAO,EAAE,CAAC;YAC5C,MAAM,QAAQ,CAAC,4DAA4D,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC5G,CAAC;QACD,QAAQ,GAAG,QAAQ,CAAC,IAAI,KAAK,iBAAiB;YAC5C,CAAC,CAAC,+BAA+B,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;YAC3D,CAAC,CAAC,sBAAsB,CAAC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC;QACrD,SAAS,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,MAAM,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IACjF,KAAK,MAAM,IAAI,IAAI,SAAS;QAAE,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC;YAC7C,IAAI,EAAE,kCAAkC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,QAAQ;YACxF,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM;YACnF,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,kBAAkB,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU;SACnF,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC;AACjC,CAAC;AAED,KAAK,UAAU,yBAAyB,CAAC,IAAY,EAAE,MAAc;IACnE,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QAAC,OAAO,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;IAChF,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,CAAC;QAClE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAA6B,EAAE,CAAC;IAC5C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QAC/D,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,0BAA0B,CAAC,EAAE,IAAI,CAAC,CAAC;QAC7H,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,MAAM,CAAC;YAAE,SAAS;QAC9D,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc,EAAE,MAAc;IACnD,OAAO,OAAO,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;WACpE,KAAiC,CAAC,OAAO,KAAK,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,SAAS,8BAA8B,CAAC,WAAmC,EAAE,IAAyB;IACpG,IAAI,WAAW,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO;QAAE,MAAM,QAAQ,CAAC,2CAA2C,CAAC,CAAC;IACtG,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,KAAK,OAAO;QACzC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,CAAC;QAC7F,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,eAAe,KAAK,KAAK,CAAC,OAAO;eAClE,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC9E,IAAI,CAAC,OAAO;QAAE,MAAM,QAAQ,CAAC,4CAA4C,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,SAAS,WAAW,CAAC,KAAkD;IACrE,OAAO,GAAG,KAAK,CAAC,OAAO,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,QAAQ,CAAC,OAAe;IAC/B,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,iCAAiC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;AAC5F,CAAC"}

package/dist/src/evals/trial-publication.js

@@ -0,0 +1,25 @@
+import path from "node:path";
+import { atomicWriteJSON } from "../foundation/index.js";
+import { parseEvalTrialRef } from "./progress.js";
+const EVAL_ID = /^eval_[a-f0-9]{32}$/;
+export const EVAL_TRIAL_PUBLICATION_REF = path.join("eval", "publication.json");
+export async function writeEvalTrialPublication(runDirectory, evalId, mode, trial) {
+    await atomicWriteJSON(path.join(runDirectory, EVAL_TRIAL_PUBLICATION_REF), {
+        schema_version: "1", eval_id: evalId, mode, trial, created_at: new Date().toISOString(),
+    });
+}
+export function parseEvalTrialPublication(value, expectedRunId) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("eval trial publication must be an object");
+    const record = value;
+    if (record.schema_version !== "1" || typeof record.eval_id !== "string" || !EVAL_ID.test(record.eval_id)
+        || (record.mode !== "settle" && record.mode !== "replace-invalid")
+        || typeof record.created_at !== "string" || !Number.isFinite(Date.parse(record.created_at))) {
+        throw new TypeError("eval trial publication is invalid");
+    }
+    const trial = parseEvalTrialRef(record.trial, "eval trial publication trial");
+    if (expectedRunId !== undefined && trial.run_id !== expectedRunId)
+        throw new TypeError("eval trial publication run identity is invalid");
+    return { schema_version: "1", eval_id: record.eval_id, mode: record.mode, trial, created_at: record.created_at };
+}
+//# sourceMappingURL=trial-publication.js.map

package/dist/src/evals/trial-publication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"trial-publication.js","sourceRoot":"","sources":["../../../src/evals/trial-publication.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,MAAM,OAAO,GAAG,qBAAqB,CAAC;AAEtC,MAAM,CAAC,MAAM,0BAA0B,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;AAWhF,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,YAAoB,EACpB,MAAc,EACd,IAA8B,EAC9B,KAAqB;IAErB,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,0BAA0B,CAAC,EAAE;QACzE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxF,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAc,EAAE,aAAsB;IAC9E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACjI,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;WACnG,CAAC,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,KAAK,iBAAiB,CAAC;WAC/D,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAC9F,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,KAAK,GAAG,iBAAiB,CAAC,MAAM,CAAC,KAAK,EAAE,8BAA8B,CAAC,CAAC;IAC9E,IAAI,aAAa,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,KAAK,aAAa;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACzI,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC;AACnH,CAAC"}

package/dist/src/evals/verifier-diagnostics.js

@@ -0,0 +1,235 @@
+import { open, stat } from "node:fs/promises";
+import path from "node:path";
+import { atomicWriteJSON } from "../foundation/index.js";
+const MAX_LOG_BYTES = 256 * 1024;
+const VERIFIER_LOG_FILES = ["test-stdout.txt", "test-stderr.txt", "stdout.txt", "stderr.txt"];
+const INFRASTRUCTURE_PATTERNS = [
+    {
+        signal: "dns_resolution_failed",
+        patterns: [
+            /curl:\s*\(\d+\)\s*Could not resolve host:/i,
+            /Temporary failure in name resolution/i,
+            /Name or service not known/i,
+            /getaddrinfo\s+(?:EAI_AGAIN|ENOTFOUND)/i,
+            /Could not resolve hostname/i,
+        ],
+    },
+    {
+        signal: "network_unreachable",
+        patterns: [
+            /Network is unreachable/i,
+            /Failed to establish a new connection:[^\n]*(?:timed out|connection refused)/i,
+            /Could not connect to (?:host|server)/i,
+        ],
+    },
+    {
+        signal: "package_install_failed",
+        patterns: [
+            /Could not find a version that satisfies the requirement/i,
+            /No matching distribution found for/i,
+            /Failed to (?:download|fetch) [^\n]*(?:package|wheel|index)/i,
+            /error:\s*failed to (?:download|fetch|install)/i,
+        ],
+    },
+    {
+        signal: "test_runner_missing",
+        patterns: [
+            /(?:^|\n)[^\n]*(?:uvx|pytest|pipx|tox|nox): command not found(?:\n|$)/i,
+            /No module named ['"]?(?:pytest|unittest|tox|nox)['"]?/i,
+        ],
+    },
+    {
+        signal: "verifier_environment_missing",
+        patterns: [
+            /\/(?:root|home\/[^/]+)\/\.local\/bin\/env: No such file or directory/i,
+            /(?:^|\n)[^\n]*\/bin\/(?:python|python3|pytest|uv|uvx): No such file or directory(?:\n|$)/i,
+        ],
+    },
+];
+const TEST_EXECUTION_EVIDENCE = [
+    /test session starts/i,
+    /collected\s+\d+\s+items?/i,
+    /(?:^|\n)Ran\s+\d+\s+tests?/i,
+    /(?:^|\n)TAP version\s+\d+/i,
+    /={3,}[^\n]*(?:passed|failed|errors?|skipped)[^\n]*={3,}/i,
+];
+/**
+ * Detect a verifier that wrote a zero reward after its own bootstrap failed.
+ *
+ * Harbor treats reward.txt as authoritative even when a shell verifier masks
+ * an earlier command failure. We fail closed only when reward is exactly zero,
+ * no structured CTRF evidence exists, no test-runner evidence appears in the
+ * bounded logs, and a stable infrastructure signature is present.
+ */
+export async function detectVerifierInfrastructureFailure(trialDirectory, reward) {
+    const verifierDirectory = path.join(trialDirectory, "verifier");
+    const explicit = await readExplicitDiagnostic(path.join(verifierDirectory, "infrastructure-error.json"));
+    if (explicit)
+        return explicit;
+    if (reward !== 0)
+        return null;
+    if (await nonEmptyFile(path.join(verifierDirectory, "ctrf.json")))
+        return null;
+    const logs = [];
+    const sourceFiles = [];
+    for (const name of VERIFIER_LOG_FILES) {
+        const file = path.join(verifierDirectory, name);
+        const value = await readBoundedFile(file, MAX_LOG_BYTES);
+        if (value === null)
+            continue;
+        logs.push(value);
+        sourceFiles.push(`verifier/${name}`);
+    }
+    if (logs.length === 0)
+        return null;
+    const combined = logs.join("\n");
+    if (TEST_EXECUTION_EVIDENCE.some((pattern) => pattern.test(combined)))
+        return null;
+    const signals = INFRASTRUCTURE_PATTERNS
+        .filter(({ patterns }) => patterns.some((pattern) => pattern.test(combined)))
+        .map(({ signal }) => signal);
+    if (signals.length === 0)
+        return null;
+    return {
+        schema_version: "1",
+        code: "verifier_infrastructure_failure",
+        signals,
+        source_files: sourceFiles,
+    };
+}
+async function readExplicitDiagnostic(file) {
+    const raw = await readBoundedFile(file, MAX_LOG_BYTES);
+    if (raw === null)
+        return null;
+    let value;
+    try {
+        value = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const record = value;
+    if (record.schema_version !== "1" || record.code !== "verifier_infrastructure_failure")
+        return null;
+    const signals = infrastructureSignals(record.signals);
+    const sourceFiles = stringArray(record.source_files);
+    if (signals.length === 0 || sourceFiles.length === 0)
+        return null;
+    const attempts = Array.isArray(record.attempts)
+        ? record.attempts.flatMap((attempt) => {
+            if (!attempt || typeof attempt !== "object" || Array.isArray(attempt))
+                return [];
+            const item = attempt;
+            const number = item.attempt;
+            const itemSignals = infrastructureSignals(item.signals);
+            const itemSourceFiles = stringArray(item.source_files);
+            if (!Number.isSafeInteger(number) || number < 1 || itemSignals.length === 0 || itemSourceFiles.length === 0)
+                return [];
+            return [{ attempt: number, signals: itemSignals, source_files: itemSourceFiles }];
+        })
+        : [];
+    const maxRetries = record.max_retries;
+    const backoffMs = record.backoff_ms;
+    return {
+        schema_version: "1",
+        code: "verifier_infrastructure_failure",
+        signals,
+        source_files: sourceFiles,
+        ...(attempts.length > 0 ? { attempts } : {}),
+        ...(Number.isSafeInteger(maxRetries) && maxRetries >= 0 ? { max_retries: maxRetries } : {}),
+        ...(Number.isSafeInteger(backoffMs) && backoffMs >= 0 ? { backoff_ms: backoffMs } : {}),
+    };
+}
+function infrastructureSignals(value) {
+    if (!Array.isArray(value))
+        return [];
+    const allowed = new Set(INFRASTRUCTURE_PATTERNS.map(({ signal }) => signal));
+    return [...new Set(value.filter((entry) => typeof entry === "string" && allowed.has(entry)))];
+}
+function stringArray(value) {
+    return Array.isArray(value)
+        ? [...new Set(value.filter((entry) => typeof entry === "string" && entry.length > 0))]
+        : [];
+}
+export function verifierResult(trial) {
+    return trial.verifier_result && typeof trial.verifier_result === "object" && !Array.isArray(trial.verifier_result)
+        ? trial.verifier_result
+        : null;
+}
+export function primaryVerifierReward(trial) {
+    const rewards = (verifierResult(trial)?.rewards || {});
+    const preferred = rewards.reward;
+    if (typeof preferred === "number" && Number.isFinite(preferred))
+        return preferred;
+    return Object.values(rewards).find((value) => typeof value === "number" && Number.isFinite(value));
+}
+export function verifierObservation(input) {
+    const ref = input.verifierRef ? { verifier_result_ref: input.verifierRef } : {};
+    if (input.runStatus === "cancelled")
+        return { status: "invalid", invalid_reason: "cancelled", ...ref };
+    if (input.runStatus !== "succeeded" || input.recordStatus !== "valid")
+        return { status: "invalid", invalid_reason: "infrastructure_failure", ...ref };
+    if (input.trajectoryStatus !== "valid")
+        return { status: "invalid", invalid_reason: "trajectory_missing_or_corrupt", ...ref };
+    if (input.infrastructure)
+        return { status: "invalid", invalid_reason: "verifier_infrastructure_failure", ...ref };
+    // The candidate run and trajectory are already sealed and valid. A later
+    // Harbor exception belongs to verification/teardown and must never trigger
+    // a second candidate execution.
+    if (input.trial.exception_info)
+        return { status: "invalid", invalid_reason: "verifier_infrastructure_failure", ...ref };
+    const reward = primaryVerifierReward(input.trial);
+    if (reward === undefined || !input.verifierRef)
+        return { status: "invalid", invalid_reason: "verifier_result_missing" };
+    return { status: "valid", reward, verifier_result_ref: input.verifierRef };
+}
+export async function writeVerifierInfrastructureDiagnostic(runDirectory, diagnostic) {
+    await atomicWriteJSON(path.join(runDirectory, "verifier", "infrastructure-error.json"), {
+        ...diagnostic,
+        detected_at: new Date().toISOString(),
+    });
+}
+async function nonEmptyFile(file) {
+    try {
+        const info = await stat(file);
+        return info.isFile() && info.size > 0;
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return false;
+        throw error;
+    }
+}
+async function readBoundedFile(file, maxBytes) {
+    let handle;
+    try {
+        handle = await open(file, "r");
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return null;
+        throw error;
+    }
+    try {
+        const size = (await handle.stat()).size;
+        if (size === 0)
+            return "";
+        if (size <= maxBytes) {
+            const buffer = Buffer.alloc(size);
+            await handle.read(buffer, 0, size, 0);
+            return buffer.toString("utf8");
+        }
+        const half = Math.floor(maxBytes / 2);
+        const head = Buffer.alloc(half);
+        const tail = Buffer.alloc(maxBytes - half);
+        await handle.read(head, 0, head.length, 0);
+        await handle.read(tail, 0, tail.length, size - tail.length);
+        return `${head.toString("utf8")}\n[... verifier log truncated ...]\n${tail.toString("utf8")}`;
+    }
+    finally {
+        await handle.close();
+    }
+}
+//# sourceMappingURL=verifier-diagnostics.js.map

package/dist/src/evals/verifier-diagnostics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-diagnostics.js","sourceRoot":"","sources":["../../../src/evals/verifier-diagnostics.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,MAAM,aAAa,GAAG,GAAG,GAAG,IAAI,CAAC;AACjC,MAAM,kBAAkB,GAAG,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,YAAY,EAAE,YAAY,CAAU,CAAC;AAuBvG,MAAM,uBAAuB,GAGxB;IACH;QACE,MAAM,EAAE,uBAAuB;QAC/B,QAAQ,EAAE;YACR,4CAA4C;YAC5C,uCAAuC;YACvC,4BAA4B;YAC5B,wCAAwC;YACxC,6BAA6B;SAC9B;KACF;IACD;QACE,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE;YACR,yBAAyB;YACzB,8EAA8E;YAC9E,uCAAuC;SACxC;KACF;IACD;QACE,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE;YACR,0DAA0D;YAC1D,qCAAqC;YACrC,6DAA6D;YAC7D,gDAAgD;SACjD;KACF;IACD;QACE,MAAM,EAAE,qBAAqB;QAC7B,QAAQ,EAAE;YACR,uEAAuE;YACvE,wDAAwD;SACzD;KACF;IACD;QACE,MAAM,EAAE,8BAA8B;QACtC,QAAQ,EAAE;YACR,uEAAuE;YACvE,2FAA2F;SAC5F;KACF;CACF,CAAC;AAEF,MAAM,uBAAuB,GAAG;IAC9B,sBAAsB;IACtB,2BAA2B;IAC3B,6BAA6B;IAC7B,4BAA4B;IAC5B,0DAA0D;CAClD,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,cAAsB,EACtB,MAA0B;IAE1B,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC;IAChE,MAAM,QAAQ,GAAG,MAAM,sBAAsB,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,2BAA2B,CAAC,CAAC,CAAC;IACzG,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,IAAI,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,MAAM,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAE/E,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,WAAW,GAAa,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,iBAAiB,EAAE,IAAI,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACzD,IAAI,KAAK,KAAK,IAAI;YAAE,SAAS;QAC7B,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACjB,WAAW,CAAC,IAAI,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAEnF,MAAM,OAAO,GAAG,uBAAuB;SACpC,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;SAC5E,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,OAAO;QACL,cAAc,EAAE,GAAG;QACnB,IAAI,EAAE,iCAAiC;QACvC,OAAO;QACP,YAAY,EAAE,WAAW;KAC1B,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,sBAAsB,CAAC,IAAY;IAChD,MAAM,GAAG,GAAG,MAAM,eAAe,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACvD,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,MAAM,CAAC,IAAI,KAAK,iCAAiC;QAAE,OAAO,IAAI,CAAC;IACpG,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7C,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAClC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,OAAO,EAAE,CAAC;YACjF,MAAM,IAAI,GAAG,OAAkC,CAAC;YAChD,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC;YAC5B,MAAM,WAAW,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACxD,MAAM,eAAe,GAAG,WAAW,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACvD,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAK,MAAiB,GAAG,CAAC,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,EAAE,CAAC;YACnI,OAAO,CAAC,EAAE,OAAO,EAAE,MAAgB,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9F,CAAC,CAAC;QACJ,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC;IACpC,OAAO;QACL,cAAc,EAAE,GAAG;QACnB,IAAI,EAAE,iCAAiC;QACvC,OAAO;QACP,YAAY,EAAE,WAAW;QACzB,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,UAAU,CAAC,IAAK,UAAqB,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,GAAG,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAK,SAAoB,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9G,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,MAAM,OAAO,GAAG,IAAI,GAAG,CAA+B,uBAAuB,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3G,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAyC,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,KAAqC,CAAC,CAAC,CAAC,CAAC,CAAC;AACvK,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzB,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,KAA8B;IAC3D,OAAO,KAAK,CAAC,eAAe,IAAI,OAAO,KAAK,CAAC,eAAe,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,eAAe,CAAC;QAChH,CAAC,CAAC,KAAK,CAAC,eAA0C;QAClD,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAA8B;IAClE,MAAM,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,IAAI,EAAE,CAA4B,CAAC;IAClF,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC;IACjC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAClF,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC;AACtH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAOnC;IACC,MAAM,GAAG,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAChF,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,WAAW,EAAE,GAAG,GAAG,EAAE,CAAC;IACvG,IAAI,KAAK,CAAC,SAAS,KAAK,WAAW,IAAI,KAAK,CAAC,YAAY,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,wBAAwB,EAAE,GAAG,GAAG,EAAE,CAAC;IACtJ,IAAI,KAAK,CAAC,gBAAgB,KAAK,OAAO;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,+BAA+B,EAAE,GAAG,GAAG,EAAE,CAAC;IAC9H,IAAI,KAAK,CAAC,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,iCAAiC,EAAE,GAAG,GAAG,EAAE,CAAC;IAClH,yEAAyE;IACzE,2EAA2E;IAC3E,gCAAgC;IAChC,IAAI,KAAK,CAAC,KAAK,CAAC,cAAc;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,iCAAiC,EAAE,GAAG,GAAG,EAAE,CAAC;IACxH,MAAM,MAAM,GAAG,qBAAqB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,WAAW;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,yBAAyB,EAAE,CAAC;IACxH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC;AAC7E,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qCAAqC,CACzD,YAAoB,EACpB,UAA4C;IAE5C,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,2BAA2B,CAAC,EAAE;QACtF,GAAG,UAAU;QACb,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC,CAAC;AACL,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,IAAY;IACtC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACrE,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB;IAC3D,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,IAAI,CAAC;QACpE,MAAM,KAAK,CAAC;IACd,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;QACxC,IAAI,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1B,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YACtC,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC3C,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,uCAAuC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;IAChG,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/src/evals/work-item-artifacts.js

@@ -0,0 +1,23 @@
+import { HitchError } from "../foundation/index.js";
+export function preparedArtifactForWorkItem(artifacts, item) {
+    if (!item.artifact_id)
+        return artifacts.preparedArtifact;
+    const artifact = artifacts.preparedArtifacts?.get(item.artifact_id)
+        ?? (artifacts.preparedArtifact.artifact_id === item.artifact_id ? artifacts.preparedArtifact : undefined);
+    if (!artifact) {
+        throw new HitchError(`work item references an unavailable prepared artifact: ${item.artifact_id}`, {
+            code: "harbor_artifact_assignment_missing",
+            exitCode: 12,
+        });
+    }
+    if (artifact.storage === "harbor-artifact-cache-v2" && item.runtime_contract
+        && (artifact.platform !== item.runtime_contract.artifact_platform
+            || artifact.node_version !== item.runtime_contract.node_version)) {
+        throw new HitchError(`work item artifact does not match its runtime contract: ${item.work_id}`, {
+            code: "harbor_artifact_builder_contract_mismatch",
+            exitCode: 12,
+        });
+    }
+    return artifact;
+}
+//# sourceMappingURL=work-item-artifacts.js.map

package/dist/src/evals/work-item-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-item-artifacts.js","sourceRoot":"","sources":["../../../src/evals/work-item-artifacts.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,MAAM,UAAU,2BAA2B,CACzC,SAA8H,EAC9H,IAAuB;IAEvB,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC,gBAAgB,CAAC;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;WAC9D,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,IAAI,CAAC,WAAW,EAAE,EAAE;YACjG,IAAI,EAAE,oCAAoC;YAC1C,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,0BAA0B,IAAI,IAAI,CAAC,gBAAgB;WACvE,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB,CAAC,iBAAiB;eAC5D,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC,2DAA2D,IAAI,CAAC,OAAO,EAAE,EAAE;YAC9F,IAAI,EAAE,2CAA2C;YACjD,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/foundation/config.js

@@ -1,4 +1,5 @@
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import path from "node:path";
 import { invalidInput } from "./errors.js";
 export const SCHEMA_VERSION = "1";
@@ -46,9 +47,25 @@ export function statePaths(root) {
         workspaceLocks: path.join(root, "locks", "workspaces"),
         controllerRuntimeLocks: path.join(root, "locks", "controller-runtimes"),
         controllerRuntimes: path.join(root, "store", "controller-runtimes", "sha256"),
+        environmentImages: path.join(root, "store", "environment-images", "sha256"),
+        environmentImagePins: path.join(root, "store", "environment-image-pins", "sha256"),
+        environmentImageReferenceLocks: path.join(root, "locks", "environment-image-references"),
+        buildRecords: path.join(root, "store", "build-records", "sha256"),
+        buildLocks: path.join(root, "locks", "builds"),
+        buildIndexes: path.join(root, "indexes", "builds"),
+        trainingDataCandidates: path.join(root, "derived", "training-data-candidates", "sha256"),
+        workers: path.join(root, "workers"),
+        workerLocks: path.join(root, "locks", "workers"),
+        workerProtocol: path.join(root, "worker-protocol"),
+        workerProtocolLocks: path.join(root, "locks", "worker-protocol"),
+        workerStaging: path.join(root, "worker-staging"),
+        workerInputs: path.join(root, "store", "worker-inputs", "sha256"),
         workspaces: path.join(root, "workspaces"),
         temporary: path.join(root, "tmp"),
         indexes: path.join(root, "indexes"),
     };
 }
+export function hitchRootId(root) {
+    return createHash("sha256").update(statePaths(root).root).digest("hex").slice(0, 24);
+}
 //# sourceMappingURL=config.js.map

package/dist/src/foundation/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/foundation/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AA0BxC,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyC;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,YAAY,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAsB,EAAE,IAAY;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC;QACtD,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC;QACvE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,CAAC;QAC7E,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/foundation/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAuCxC,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyC;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,YAAY,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAsB,EAAE,IAAY;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC;QACtD,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC;QACvE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,CAAC;QAC7E,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC;QAC3E,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,CAAC;QAClF,8BAA8B,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,8BAA8B,CAAC;QACxF,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC;QACjE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC9C,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QAClD,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,0BAA0B,EAAE,QAAQ,CAAC;QACxF,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QACnC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAClD,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAChE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChD,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC;QACjE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/src/foundation/credential-redaction.js

@@ -0,0 +1,137 @@
+import { StringDecoder } from "node:string_decoder";
+import { Transform } from "node:stream";
+export const CREDENTIAL_REDACTION_MARKER = "[REDACTED]";
+export const PROVIDER_ENVIRONMENT_NAMES = [
+    "DEEPSEEK_API_KEY", "DEEPSEEK_BASE_URL", "OPENAI_API_KEY", "OPENAI_BASE_URL", "OPENAI_ORG_ID", "OPENAI_ORGANIZATION",
+    "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_OAUTH_TOKEN", "GOOGLE_API_KEY", "GEMINI_API_KEY",
+    "AZURE_OPENAI_API_KEY", "AZURE_OPENAI_ENDPOINT", "AZURE_OPENAI_API_VERSION", "AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY",
+    "AWS_SESSION_TOKEN", "AWS_REGION", "AWS_DEFAULT_REGION", "GITHUB_TOKEN", "GH_TOKEN",
+];
+const OVERSIZED_LINE_MARKER = "[REDACTED OVERSIZED LOG LINE]";
+const DEFAULT_MAX_LINE_BYTES = 1024 * 1024;
+const TEXT_RULES = [
+    { id: "authorization-bearer-v1", pattern: /\bBearer\s+[A-Za-z0-9._~+\/-]{8,}/gi, replacement: `Bearer ${CREDENTIAL_REDACTION_MARKER}` },
+    { id: "provider-api-key-v1", pattern: /\b(?:sk|rk|pk)-[A-Za-z0-9_-]{12,}\b/g, replacement: CREDENTIAL_REDACTION_MARKER },
+    { id: "secret-query-v1", pattern: /([?&](?:api[_-]?key|access[_-]?token|refresh[_-]?token|token|secret|password)=)[^&\s]+/gi, replacement: `$1${CREDENTIAL_REDACTION_MARKER}` },
+];
+const SECRET_HEADER = /^(\s*(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|x-[a-z0-9-]*(?:secret|token|api-key)[a-z0-9-]*)\s*:\s*).+$/gim;
+const NAMED_SECRET = /((?:"|')?(?:authorization|proxy-authorization|cookie|set-cookie|x-api-key|api[-_]?key|access[-_]?token|refresh[-_]?token|client[-_]?secret|secret|password|credential)(?:"|')?\s*[:=]\s*)("[^"]*"|'[^']*'|[^\s,;}\]]+)/gi;
+export function safeDiagnosticMessage(value, credentialValues = [], maxCharacters = 4_096) {
+    if (!Number.isSafeInteger(maxCharacters) || maxCharacters < 32)
+        throw new TypeError("diagnostic message limit is invalid");
+    const message = redactCredentialText(value?.message || String(value ?? ""), credentialValues).text;
+    const marker = "…[truncated]";
+    return message.length <= maxCharacters ? message : `${message.slice(0, maxCharacters - marker.length)}${marker}`;
+}
+export function redactCredentialText(value, credentialValues = []) {
+    const redactions = new Map();
+    let text = String(value);
+    const known = [...new Set(credentialValues.filter((entry) => entry.length > 0))]
+        .sort((left, right) => right.length - left.length || left.localeCompare(right));
+    if (known.length > 0) {
+        let count = 0;
+        const pattern = new RegExp(known.map(escapeRegExp).join("|"), "g");
+        text = text.replace(pattern, () => {
+            count += 1;
+            return CREDENTIAL_REDACTION_MARKER;
+        });
+        if (count > 0)
+            increment(redactions, "known-credential-value-v1", count);
+    }
+    // Structured token forms must run before the generic named-field rule. For
+    // example, treating `Authorization: Bearer ...` as a generic field first
+    // would redact only the word `Bearer` and leave the token behind.
+    for (const rule of TEXT_RULES) {
+        const count = text.match(rule.pattern)?.length ?? 0;
+        text = text.replace(rule.pattern, rule.replacement);
+        if (count > 0)
+            increment(redactions, rule.id, count);
+    }
+    text = text.replace(SECRET_HEADER, (_match, prefix) => {
+        increment(redactions, "sensitive-header-v1");
+        return `${prefix}${CREDENTIAL_REDACTION_MARKER}`;
+    });
+    text = text.replace(NAMED_SECRET, (_match, prefix, encoded) => {
+        increment(redactions, "sensitive-field-v1");
+        const quote = encoded.startsWith("\"") ? "\"" : encoded.startsWith("'") ? "'" : "";
+        return `${prefix}${quote}${CREDENTIAL_REDACTION_MARKER}${quote}`;
+    });
+    return { text, redactions };
+}
+export function credentialValuesFromEnv(names, env) {
+    const values = [];
+    for (const name of names) {
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            throw new TypeError(`invalid credential environment name: ${name}`);
+        const value = env[name];
+        if (value !== undefined && value.length > 0)
+            values.push(value);
+    }
+    return [...new Set(values)].sort((left, right) => right.length - left.length || left.localeCompare(right));
+}
+export function createCredentialRedactionTransform(credentialValues, maxLineBytes = DEFAULT_MAX_LINE_BYTES) {
+    if (!Number.isSafeInteger(maxLineBytes) || maxLineBytes < 1)
+        throw new TypeError("redaction max line bytes must be positive");
+    const decoder = new StringDecoder("utf8");
+    const streamingValues = [...new Set(credentialValues.flatMap((entry) => [entry, ...entry.split(/\r?\n/)]).filter((entry) => entry.length > 0))];
+    let buffer = "";
+    let discarding = false;
+    return new Transform({
+        transform(chunk, _encoding, callback) {
+            try {
+                buffer += typeof chunk === "string" ? chunk : decoder.write(chunk);
+                buffer = drain(this, buffer, streamingValues, maxLineBytes, () => discarding, (value) => { discarding = value; });
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+        flush(callback) {
+            try {
+                buffer += decoder.end();
+                if (!discarding && buffer.length > 0)
+                    this.push(redactCredentialText(buffer, streamingValues).text);
+                callback();
+            }
+            catch (error) {
+                callback(error);
+            }
+        },
+    });
+}
+function drain(stream, input, credentialValues, maxLineBytes, isDiscarding, setDiscarding) {
+    let buffer = input;
+    for (;;) {
+        const newline = buffer.indexOf("\n");
+        if (isDiscarding()) {
+            if (newline < 0)
+                return "";
+            buffer = buffer.slice(newline + 1);
+            setDiscarding(false);
+            continue;
+        }
+        if (newline >= 0) {
+            const line = buffer.slice(0, newline + 1);
+            buffer = buffer.slice(newline + 1);
+            if (Buffer.byteLength(line) > maxLineBytes)
+                stream.push(`${OVERSIZED_LINE_MARKER}\n`);
+            else
+                stream.push(redactCredentialText(line, credentialValues).text);
+            continue;
+        }
+        if (Buffer.byteLength(buffer) > maxLineBytes) {
+            stream.push(`${OVERSIZED_LINE_MARKER}\n`);
+            buffer = "";
+            setDiscarding(true);
+        }
+        return buffer;
+    }
+}
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}
+function increment(counts, rule, count = 1) {
+    counts.set(rule, (counts.get(rule) ?? 0) + count);
+}
+//# sourceMappingURL=credential-redaction.js.map

package/dist/src/foundation/credential-redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-redaction.js","sourceRoot":"","sources":["../../../src/foundation/credential-redaction.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAExC,MAAM,CAAC,MAAM,2BAA2B,GAAG,YAAY,CAAC;AACxD,MAAM,CAAC,MAAM,0BAA0B,GAAG;IACxC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,eAAe,EAAE,qBAAqB;IACpH,mBAAmB,EAAE,sBAAsB,EAAE,oBAAoB,EAAE,yBAAyB,EAAE,gBAAgB,EAAE,gBAAgB;IAChI,sBAAsB,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,mBAAmB,EAAE,uBAAuB;IACzH,mBAAmB,EAAE,YAAY,EAAE,oBAAoB,EAAE,cAAc,EAAE,UAAU;CAC3E,CAAC;AACX,MAAM,qBAAqB,GAAG,+BAA+B,CAAC;AAC9D,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,UAAU,GAAgE;IAC9E,EAAE,EAAE,EAAE,yBAAyB,EAAE,OAAO,EAAE,qCAAqC,EAAE,WAAW,EAAE,UAAU,2BAA2B,EAAE,EAAE;IACvI,EAAE,EAAE,EAAE,qBAAqB,EAAE,OAAO,EAAE,sCAAsC,EAAE,WAAW,EAAE,2BAA2B,EAAE;IACxH,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,0FAA0F,EAAE,WAAW,EAAE,KAAK,2BAA2B,EAAE,EAAE;CAChL,CAAC;AAEF,MAAM,aAAa,GAAG,qIAAqI,CAAC;AAC5J,MAAM,YAAY,GAAG,0NAA0N,CAAC;AAOhP,MAAM,UAAU,qBAAqB,CACnC,KAAc,EACd,mBAAsC,EAAE,EACxC,aAAa,GAAG,KAAK;IAErB,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,aAAa,CAAC,IAAI,aAAa,GAAG,EAAE;QAAE,MAAM,IAAI,SAAS,CAAC,qCAAqC,CAAC,CAAC;IAC3H,MAAM,OAAO,GAAG,oBAAoB,CAAE,KAAe,EAAE,OAAO,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC;IAC9G,MAAM,MAAM,GAAG,cAAc,CAAC;IAC9B,OAAO,OAAO,CAAC,MAAM,IAAI,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,EAAE,CAAC;AACnH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAa,EAAE,mBAAsC,EAAE;IAC1F,MAAM,UAAU,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC7C,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC;SAC7E,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAClF,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACrB,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QACnE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YAChC,KAAK,IAAI,CAAC,CAAC;YACX,OAAO,2BAA2B,CAAC;QACrC,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,2BAA2B,EAAE,KAAK,CAAC,CAAC;IAC3E,CAAC;IACD,2EAA2E;IAC3E,yEAAyE;IACzE,kEAAkE;IAClE,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,MAAM,IAAI,CAAC,CAAC;QACpD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,KAAK,GAAG,CAAC;YAAE,SAAS,CAAC,UAAU,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,EAAE;QAC5D,SAAS,CAAC,UAAU,EAAE,qBAAqB,CAAC,CAAC;QAC7C,OAAO,GAAG,MAAM,GAAG,2BAA2B,EAAE,CAAC;IACnD,CAAC,CAAC,CAAC;IACH,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,MAAM,EAAE,MAAc,EAAE,OAAe,EAAE,EAAE;QAC5E,SAAS,CAAC,UAAU,EAAE,oBAAoB,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QACnF,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,2BAA2B,GAAG,KAAK,EAAE,CAAC;IACnE,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,KAAwB,EAAE,GAAsB;IACtF,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;QAChH,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC;QACxB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,MAAM,UAAU,kCAAkC,CAChD,gBAAmC,EACnC,YAAY,GAAG,sBAAsB;IAErC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;IAC9H,MAAM,OAAO,GAAG,IAAI,aAAa,CAAC,MAAM,CAAC,CAAC;IAC1C,MAAM,eAAe,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,gBAAgB,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAChJ,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,OAAO,IAAI,SAAS,CAAC;QACnB,SAAS,CAAC,KAAsB,EAAE,SAAS,EAAE,QAAQ;YACnD,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACnE,MAAM,GAAG,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,eAAe,EAAE,YAAY,EAAE,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,EAAE,GAAG,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBAClH,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;QACD,KAAK,CAAC,QAAQ;YACZ,IAAI,CAAC;gBACH,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;gBACxB,IAAI,CAAC,UAAU,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;oBAAE,IAAI,CAAC,IAAI,CAAC,oBAAoB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,IAAI,CAAC,CAAC;gBACpG,QAAQ,EAAE,CAAC;YACb,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,QAAQ,CAAC,KAAc,CAAC,CAAC;YAAC,CAAC;QAC/C,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CACZ,MAAiB,EACjB,KAAa,EACb,gBAAmC,EACnC,YAAoB,EACpB,YAA2B,EAC3B,aAAuC;IAEvC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,SAAS,CAAC;QACR,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACrC,IAAI,YAAY,EAAE,EAAE,CAAC;YACnB,IAAI,OAAO,GAAG,CAAC;gBAAE,OAAO,EAAE,CAAC;YAC3B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,aAAa,CAAC,KAAK,CAAC,CAAC;YACrB,SAAS;QACX,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,CAAC;YAC1C,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;YACnC,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;;gBACjF,MAAM,CAAC,IAAI,CAAC,oBAAoB,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,IAAI,CAAC,CAAC;YACpE,SAAS;QACX,CAAC;QACD,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;YAC7C,MAAM,CAAC,IAAI,CAAC,GAAG,qBAAqB,IAAI,CAAC,CAAC;YAC1C,MAAM,GAAG,EAAE,CAAC;YACZ,aAAa,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,SAAS,CAAC,MAA2B,EAAE,IAAY,EAAE,KAAK,GAAG,CAAC;IACrE,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC;AACpD,CAAC"}

package/dist/src/foundation/environment-image-references.js

@@ -0,0 +1,59 @@
+import path from "node:path";
+import { atomicWriteJSON, readJSON } from "./fs.js";
+import { statePaths } from "./config.js";
+import { withFileLock } from "./locks.js";
+const REFERENCE_FILE = "environment-image-refs.json";
+export function withEnvironmentImageReferenceLock(root, operation) {
+    return withFileLock(statePaths(root).environmentImageReferenceLocks, "global", operation, {
+        timeoutCode: "environment_image_references_locked",
+        timeoutExitCode: 12,
+    });
+}
+export async function beginEvalEnvironmentImagePlanning(evalDirectory, evalId) {
+    return writeReferences(evalDirectory, evalId, "planning", []);
+}
+export async function writeEvalEnvironmentImageReferences(evalDirectory, evalId, images) {
+    if (!/^eval_[a-f0-9]{32}$/.test(evalId))
+        throw new TypeError("environment image reference eval identity is invalid");
+    const imageIds = [...new Set(images.map((image) => image.image_id))].sort(compare);
+    if (imageIds.some((imageId) => !/^sha256:[a-f0-9]{64}$/.test(imageId)))
+        throw new TypeError("environment image references are invalid");
+    return writeReferences(evalDirectory, evalId, "planned", imageIds);
+}
+async function writeReferences(evalDirectory, evalId, state, imageIds) {
+    if (!/^eval_[a-f0-9]{32}$/.test(evalId))
+        throw new TypeError("environment image reference eval identity is invalid");
+    const record = {
+        schema_version: "1",
+        eval_id: evalId,
+        state,
+        image_ids: imageIds,
+        updated_at: new Date().toISOString(),
+    };
+    await atomicWriteJSON(path.join(evalDirectory, REFERENCE_FILE), record);
+    return record;
+}
+export async function readEvalEnvironmentImageReferences(evalDirectory, expectedEvalId) {
+    const value = await readJSON(path.join(evalDirectory, REFERENCE_FILE), null);
+    if (value === null)
+        return null;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new TypeError("environment image references must be an object");
+    const record = value;
+    const imageIds = record.image_ids;
+    if (Object.keys(record).some((key) => !["schema_version", "eval_id", "state", "image_ids", "updated_at"].includes(key))
+        || record.schema_version !== "1" || record.eval_id !== expectedEvalId
+        || record.state !== "planning" && record.state !== "planned"
+        || !Array.isArray(imageIds) || imageIds.some((entry) => typeof entry !== "string" || !/^sha256:[a-f0-9]{64}$/.test(entry))
+        || new Set(imageIds).size !== imageIds.length
+        || !imageIds.every((entry, index) => index === 0 || compare(imageIds[index - 1], entry) < 0)
+        || typeof record.updated_at !== "string" || !Number.isFinite(Date.parse(record.updated_at))
+        || record.state === "planning" && imageIds.length !== 0) {
+        throw new TypeError("environment image references are invalid");
+    }
+    return record;
+}
+function compare(left, right) {
+    return Buffer.compare(Buffer.from(left), Buffer.from(right));
+}
+//# sourceMappingURL=environment-image-references.js.map

package/dist/src/foundation/environment-image-references.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-image-references.js","sourceRoot":"","sources":["../../../src/foundation/environment-image-references.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE1C,MAAM,cAAc,GAAG,6BAA6B,CAAC;AAUrD,MAAM,UAAU,iCAAiC,CAAI,IAAY,EAAE,SAA2B;IAC5F,OAAO,YAAY,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,8BAA8B,EAAE,QAAQ,EAAE,SAAS,EAAE;QACxF,WAAW,EAAE,qCAAqC;QAClD,eAAe,EAAE,EAAE;KACpB,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACrD,aAAqB,EACrB,MAAc;IAEd,OAAO,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACvD,aAAqB,EACrB,MAAc,EACd,MAAwC;IAExC,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IACrH,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnF,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IACxI,OAAO,eAAe,CAAC,aAAa,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC;AACrE,CAAC;AAED,KAAK,UAAU,eAAe,CAC5B,aAAqB,EACrB,MAAc,EACd,KAAgD,EAChD,QAAkB;IAElB,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IACrH,MAAM,MAAM,GAAqC;QAC/C,cAAc,EAAE,GAAG;QACnB,OAAO,EAAE,MAAM;QACf,KAAK;QACL,SAAS,EAAE,QAAQ;QACnB,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACrC,CAAC;IACF,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kCAAkC,CACtD,aAAqB,EACrB,cAAsB;IAEtB,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAiB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,CAAC;IAC7F,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,SAAS,CAAC,gDAAgD,CAAC,CAAC;IACvI,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,MAAM,QAAQ,GAAG,MAAM,CAAC,SAAS,CAAC;IAClC,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,gBAAgB,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,YAAY,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;WAClH,MAAM,CAAC,cAAc,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,KAAK,cAAc;WAClE,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;WACzD,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;WACvH,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,MAAM;WAC1C,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,KAAK,GAAG,CAAC,CAAW,EAAE,KAAe,CAAC,GAAG,CAAC,CAAC;WAC7G,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;WACxF,MAAM,CAAC,KAAK,KAAK,UAAU,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,SAAS,CAAC,0CAA0C,CAAC,CAAC;IAClE,CAAC;IACD,OAAO,MAAqD,CAAC;AAC/D,CAAC;AAED,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa;IAC1C,OAAO,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/D,CAAC"}