agent-hitch 0.2.6 → 0.2.8

package/dist/src/evals/verifier-only-rerun.js

@@ -0,0 +1,210 @@
+import { randomUUID } from "node:crypto";
+import { cp, mkdir, readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { parse as parseTOML } from "smol-toml";
+import { buildHarborRegradeConfig, runHarborRegrade } from "../backends/index.js";
+import { benchmarkTreeDigest } from "../benchmarks/index.js";
+import { useControllerRuntimeById } from "../controller-runtime/index.js";
+import { parseVerifierScores } from "../domain/index.js";
+import { HitchError, atomicWriteJSON, ensureDir, readJSON, sha256JSON, statePaths } from "../foundation/index.js";
+import { loadRunRecord, verifyResultBundleIndex } from "../runs/index.js";
+import { parseEvalExecutionPlan } from "./execution-plan.js";
+import { runtimeResourcesForTask } from "./execution-plan-resources.js";
+import { createExecutionLease } from "./execution-leases.js";
+import { dockerOwnershipLabelMap, dockerResourceOwnership } from "./docker-ownership.js";
+import { startDockerResourceObserver } from "./docker-resource-observer.js";
+import { reapOwnedDockerResources } from "./docker-reaper.js";
+import { replaceInvalidEvalProgressTrial, writeEvalProgress } from "./progress.js";
+import { regradeTreeDigest, sealRegradeAssessment } from "./regrade-evidence.js";
+import { evalRerunSemantics } from "./rerun-types.js";
+import { invalidTrialSlots, uniqueTasks } from "./rerun-slots.js";
+import { summarizeTrialRefs } from "./result-helpers.js";
+import { validateEvalTrialReferences } from "./trial-import.js";
+import { detectVerifierInfrastructureFailure, primaryVerifierReward, verifierObservation, verifierResult } from "./verifier-diagnostics.js";
+import { verifierRuntimeRepair } from "./verifier-runtime.js";
+import { loadBenchmarkAdapterManifest, scoreWithinRange } from "./benchmark-adapter-manifest.js";
+/** Validate the immutable compiled package, also restoring its public identity
+ * when the underlying local Harbor dataset has a different derived identity. */
+export async function frozenRerunBenchmark(evalDirectory) {
+    const pkg = await readJSON(path.join(evalDirectory, "benchmark/package.json"), null);
+    if (!pkg)
+        return null;
+    // These tasks were already compiled by the pinned source runtime. Validate
+    // its saved lock and bytes, without re-resolving them with today's loader.
+    const lock = await readJSON(path.join(evalDirectory, "benchmark/benchmark.lock.json"));
+    const compiled = await readJSON(path.join(path.dirname(pkg.tasks), "compiled.json"));
+    const compiler = ["harbor-package@3", "harbor-package@4", "harbor-package@5", "harbor-package@6"]
+        .find(value => compiled.digest === sha256JSON({ lock, compiler: value }));
+    if (lock.protocol !== "hitch-benchmark@1" || pkg.package_digest !== lock.package_digest
+        || lock.package_digest !== sha256JSON(lock.files) || lock.package_digest !== await benchmarkTreeDigest(pkg.source)
+        || compiled.digest !== pkg.compiled_digest
+        || !compiler
+        || compiled.tasks_digest !== await benchmarkTreeDigest(pkg.tasks))
+        throw unavailable("compiled benchmark identity changed");
+    if (compiler === "harbor-package@6") {
+        const manifest = await loadBenchmarkAdapterManifest(pkg.tasks);
+        if (!manifest || manifest.benchmark.id !== lock.benchmark_id)
+            throw unavailable("compiled benchmark manifest changed");
+        return { id: manifest.benchmark.id, revision: manifest.dataset_digest, tasks: pkg.tasks, standard: true, scoring: manifest.scoring };
+    }
+    return { id: lock.benchmark_id, revision: lock.package_digest, tasks: pkg.tasks, standard: false };
+}
+export async function verifierOnlyEvalRerun(input) {
+    const execution = parseEvalExecutionPlan(await readJSON(path.join(input.evalDirectory, "execution-plan.json")));
+    const benchmark = await frozenRerunBenchmark(input.evalDirectory);
+    if (!benchmark || execution.provider !== "local-docker" || execution.membership !== "known"
+        || execution.eval_id !== input.evalId || benchmark.id !== input.request.benchmark_id || benchmark.revision !== input.request.benchmark_revision) {
+        throw unavailable("verifier-only currently requires a frozen standard benchmark on local Docker");
+    }
+    const runtimeId = String(input.plan.controllerRuntime.runtime_id);
+    const runtime = await useControllerRuntimeById(statePaths(input.root), runtimeId.replace(/^sha256:/, ""));
+    if (runtime.runtime_id !== runtimeId || runtime.manifest_digest !== input.plan.controllerRuntime.manifest_digest)
+        throw unavailable("controller runtime changed");
+    const verifierRuntime = input.verifierRuntimeId
+        ? await useControllerRuntimeById(statePaths(input.root), input.verifierRuntimeId.slice(7)) : runtime;
+    const runtimeRepair = verifierRuntimeRepair(runtime, verifierRuntime);
+    let progress = input.progress;
+    const repaired = [];
+    const sources = [];
+    for (const slot of input.selectedTrials) {
+        if (input.signal?.aborted)
+            throw unavailable("verifier-only was aborted");
+        const original = progress.trials.find(ref => ref.task_id === slot.task_id && ref.attempt === slot.attempt);
+        if (!original || original.run_group || original.assessment || original.observation_status !== "invalid"
+            || !["verifier_infrastructure_failure", "verifier_result_missing"].includes(original.invalid_reason ?? ""))
+            throw unavailable("selected slot has no verifier-invalid original candidate");
+        await validateEvalTrialReferences(input.root, input.evalId, [original], { benchmarkId: benchmark.id, benchmarkRevision: benchmark.revision });
+        const runDirectory = path.join(statePaths(input.root).runs, original.run_id);
+        const bundleIndex = await verifyResultBundleIndex(runDirectory);
+        const trustedResult = await readJSON(path.join(runDirectory, "result.json"));
+        const candidate = await loadRunRecord(runDirectory, { verifyTrajectory: true });
+        if (candidate.record.status !== "succeeded" || candidate.record_status !== "valid" || candidate.trajectory_status !== "valid")
+            throw unavailable("candidate evidence is incomplete or corrupt");
+        const plannedSlot = execution.slots.find(s => s.task_id === slot.task_id && s.attempt === slot.attempt);
+        const work = plannedSlot && execution.work_items.find(w => w.slots.includes(plannedSlot.slot_id));
+        if (!work || work.task_ids.length !== 1)
+            throw unavailable("source has no isolated work item");
+        const workDirectory = path.join(input.evalDirectory, "harbor/work-items", work.work_id);
+        let sourceDirectory;
+        for (const epoch of (await readdir(workDirectory)).filter(name => /^epoch-[0-9]{6}$/.test(name)).sort().reverse()) {
+            const possible = path.join(workDirectory, epoch, "job", original.trial_id);
+            const result = await readJSON(path.join(possible, "result.json"), null);
+            if (result?.trial_name === original.trial_id) {
+                sourceDirectory = possible;
+                break;
+            }
+        }
+        if (!sourceDirectory)
+            throw unavailable("original Harbor trial outputs are missing");
+        const sourceConfig = await readJSON(path.join(sourceDirectory, "config.json"));
+        const sourceResult = await readJSON(path.join(sourceDirectory, "result.json"));
+        const agentResult = sourceResult.agent_result;
+        if (agentResult?.metadata?.hitch_run_id !== original.run_id)
+            throw unavailable("Harbor source candidate identity mismatch");
+        if (runtimeRepair && agentResult.metadata.controller_runtime_id !== runtimeId)
+            throw unavailable("Harbor source controller runtime identity mismatch");
+        const taskPath = path.join(benchmark.tasks, slot.task_id);
+        if (sourceConfig.task?.path !== taskPath)
+            throw unavailable("Harbor task identity mismatch");
+        const task = parseTOML(await readFile(path.join(taskPath, "task.toml"), "utf8"));
+        const taskName = task.task?.name ?? slot.task_id;
+        if (sourceResult.task_name !== taskName)
+            throw unavailable("Harbor task name mismatch");
+        const verifier = task.verifier;
+        if (task.steps || verifier?.environment_mode !== "separate")
+            throw unavailable("artifact regrade requires a single-step task with its original separate verifier");
+        const sourceDigest = await regradeTreeDigest(sourceDirectory);
+        const taskDigest = await regradeTreeDigest(taskPath);
+        const artifactsDigest = await regradeTreeDigest(path.join(sourceDirectory, "artifacts"));
+        const assessmentId = `assessment_${randomUUID().replaceAll("-", "")}`;
+        const directory = path.join(await ensureDir(path.join(input.evalDirectory, "assessments")), assessmentId);
+        await mkdir(directory);
+        const evidence = await ensureDir(path.join(directory, "evidence"));
+        const artifactSnapshot = path.join(evidence, "source-artifacts");
+        await cp(path.join(sourceDirectory, "artifacts"), artifactSnapshot, { recursive: true, force: false, errorOnExist: true });
+        if (await regradeTreeDigest(artifactSnapshot) !== artifactsDigest)
+            throw unavailable("source artifacts changed during capture");
+        const source = { trial_id: original.trial_id, run_id: original.run_id, work_id: work.work_id,
+            controller_runtime_id: runtimeId,
+            backend_directory: path.relative(input.evalDirectory, path.dirname(path.dirname(sourceDirectory))).split(path.sep).join("/"),
+            bundle_index_digest: sha256JSON(bundleIndex), trial_tree_digest: sourceDigest, artifacts_digest: artifactsDigest, task_tree_digest: taskDigest,
+            artifact_capture_at: new Date().toISOString() };
+        await atomicWriteJSON(path.join(evidence, "source.json"), source);
+        if (runtimeRepair)
+            await atomicWriteJSON(path.join(evidence, "runtime-repair.json"), runtimeRepair);
+        sources.push({ source_trial_id: original.trial_id, source_run_id: original.run_id, source_work_id: work.work_id, source_backend_directory: source.backend_directory });
+        const lease = await createExecutionLease({ evalDirectory: input.evalDirectory, evalId: input.evalId,
+            workId: `work_${randomUUID().replaceAll("-", "")}`, worker: { workerId: "local-regrade", provider: "local-docker", collisionDomainId: "local-docker" },
+            reservation: work.reservation, ttlMs: 45_000 });
+        const ownership = dockerResourceOwnership(input.root, lease.current(), slot.task_id);
+        const resources = runtimeResourcesForTask(execution, slot.task_id, work.reservation);
+        const env = input.env ?? process.env;
+        const controller = new AbortController();
+        const signal = input.signal ? AbortSignal.any([input.signal, controller.signal]) : controller.signal;
+        const heartbeat = setInterval(() => { void lease.heartbeat().catch(() => controller.abort()); }, 10_000);
+        heartbeat.unref();
+        const observer = startDockerResourceObserver({ ownership, workerId: "local-regrade", collisionDomainId: "local-docker", reservation: work.reservation,
+            mainLimits: resources.mainLimits, sidecarLimits: resources.sidecarLimits, env, intervalMs: 1000 });
+        const trialName = `${slot.task_id.slice(0, 32)}__regrade_${assessmentId.slice(-12)}`;
+        let config;
+        let outcome;
+        try {
+            config = buildHarborRegradeConfig({ sourceConfig, sourceResult, sourceDirectory, outputDirectory: path.join(evidence, "trials"), trialName, ownershipLabels: dockerOwnershipLabelMap(ownership) });
+            await lease.markRunning();
+            outcome = await runHarborRegrade({ root: input.root, directory: evidence, config, runtimeDirectory: verifierRuntime.directory, env, trustedResult,
+                ...(input.harborExecutable ? { harborExecutable: input.harborExecutable } : {}), signal });
+        }
+        finally {
+            clearInterval(heartbeat);
+            await atomicWriteJSON(path.join(evidence, "execution.json"), await observer.stop());
+            await lease.release();
+            await atomicWriteJSON(path.join(evidence, "cleanup.json"), await reapOwnedDockerResources({ root: input.root, env, leaseIds: [lease.leaseId] }));
+        }
+        if (sourceDigest !== await regradeTreeDigest(sourceDirectory) || taskDigest !== await regradeTreeDigest(taskPath)
+            || sha256JSON(await verifyResultBundleIndex(runDirectory)) !== source.bundle_index_digest)
+            throw unavailable("regrade source changed during verification");
+        const trialDirectory = path.join(String(config.trials_dir), trialName);
+        if (outcome.trial.trial_name !== trialName || outcome.trial.task_name !== taskName
+            || sha256JSON(outcome.trial.agent_result) !== sha256JSON(sourceResult.agent_result))
+            throw unavailable("regrade result candidate identity changed");
+        const result = verifierResult(outcome.trial);
+        if (result)
+            await atomicWriteJSON(path.join(evidence, "verifier-result.json"), result);
+        const observation = verifierObservation({ trial: outcome.backend.process_exit_code === 0 ? outcome.trial : { ...outcome.trial, exception_info: "harbor-process-failed" },
+            runStatus: candidate.record.status, trajectoryStatus: candidate.trajectory_status, recordStatus: candidate.record_status,
+            verifierRef: result ? "evidence/verifier-result.json" : undefined,
+            infrastructure: await detectVerifierInfrastructureFailure(trialDirectory, primaryVerifierReward(outcome.trial)) });
+        const scores = observation.status === "valid" && benchmark.standard ? parseVerifierScores(result) : undefined;
+        if (observation.status === "valid" && benchmark.standard && (!scores || scores.normalization !== "standard" || scores.process_score !== undefined
+            || !benchmark.scoring || !scoreWithinRange(scores.total_score, benchmark.scoring.total_score))) {
+            throw unavailable("regraded standardized score contract is invalid");
+        }
+        const assessment = await sealRegradeAssessment(directory, { eval_id: input.evalId, task_id: slot.task_id, attempt: slot.attempt, rerun_id: input.rerunId,
+            source, controller_runtime_id: verifierRuntime.runtime_id, ...(runtimeRepair ? { runtime_repair: runtimeRepair } : {}),
+            backend: outcome.backend, observation, completed_at: new Date().toISOString() });
+        if (observation.status === "valid") {
+            const ref = { trial_id: original.trial_id, run_id: original.run_id, task_id: slot.task_id, attempt: slot.attempt,
+                observation_status: "valid", reward: observation.reward, verifier_result_ref: observation.verifier_result_ref, assessment,
+                ...(scores === undefined ? {} : { scores }) };
+            await validateEvalTrialReferences(input.root, input.evalId, [ref], { benchmarkId: benchmark.id, benchmarkRevision: benchmark.revision });
+            progress = replaceInvalidEvalProgressTrial(progress, ref);
+            await writeEvalProgress(input.evalDirectory, progress);
+            repaired.push(slot);
+        }
+    }
+    const remaining = invalidTrialSlots(input.plan.tasks, input.plan.attempts, progress);
+    const completed = new Date().toISOString();
+    const output = { schema_version: "1", kind: "eval-rerun", rerun_id: input.rerunId, rerun_type: "verifier-only", semantics: evalRerunSemantics("verifier-only"),
+        eval_id: input.evalId, status: "completed", selected_tasks: uniqueTasks(input.selectedTrials), selected_trials: input.selectedTrials,
+        repaired_tasks: uniqueTasks(repaired), repaired_trials: repaired, remaining_invalid_tasks: uniqueTasks(remaining), remaining_invalid_trials: remaining, sources,
+        eval_status: remaining.length ? "failed" : "succeeded", started_at: input.startedAt, completed_at: completed };
+    const result = { ...input.previousResult, status: output.eval_status, exit_code: remaining.length ? 13 : 0, generation: progress.generation,
+        trials: progress.trials, summary: summarizeTrialRefs(progress.trials), completed_at: completed };
+    if (!remaining.length)
+        delete result.error;
+    await atomicWriteJSON(path.join(input.evalDirectory, "result.json"), result);
+    await atomicWriteJSON(path.join(input.rerunDirectory, "state.json"), { ...output, tasks: output.selected_tasks, trials: input.selectedTrials, updated_at: completed });
+    return output;
+}
+function unavailable(message) { return new HitchError(message, { code: "eval_verifier_only_unavailable", exitCode: 2 }); }
+//# sourceMappingURL=verifier-only-rerun.js.map

package/dist/src/evals/verifier-only-rerun.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-only-rerun.js","sourceRoot":"","sources":["../../../src/evals/verifier-only-rerun.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,KAAK,IAAI,SAAS,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,wBAAwB,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAClF,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7D,OAAO,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAC1E,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AAEzD,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAClH,OAAO,EAAE,aAAa,EAAE,uBAAuB,EAAE,MAAM,kBAAkB,CAAC;AAC1E,OAAO,EAAE,sBAAsB,EAAE,MAAM,qBAAqB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AACzF,OAAO,EAAE,2BAA2B,EAAE,MAAM,+BAA+B,CAAC;AAC5E,OAAO,EAAE,wBAAwB,EAAE,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,+BAA+B,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAEjF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,iBAAiB,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,2BAA2B,EAAE,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,mCAAmC,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC5I,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAC9D,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAUjG;gFACgF;AAChF,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,aAAqB;IAC9D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAA4F,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,wBAAwB,CAAC,EAAE,IAAI,CAAC,CAAC;IAChL,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAkB,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,+BAA+B,CAAC,CAAC,CAAC;IACxG,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAA2C,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,eAAe,CAAC,CAAC,CAAC;IAC/H,MAAM,QAAQ,GAAG,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,EAAE,kBAAkB,CAAC;SAC9F,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,QAAQ,KAAK,mBAAmB,IAAI,GAAG,CAAC,cAAc,KAAK,IAAI,CAAC,cAAc;WAClF,IAAI,CAAC,cAAc,KAAK,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,cAAc,KAAK,MAAM,mBAAmB,CAAC,GAAG,CAAC,MAAM,CAAC;WAC/G,QAAQ,CAAC,MAAM,KAAK,GAAG,CAAC,eAAe;WACvC,CAAC,QAAQ;WACT,QAAQ,CAAC,YAAY,KAAK,MAAM,mBAAmB,CAAC,GAAG,CAAC,KAAK,CAAC;QAAE,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;IAC9H,IAAI,QAAQ,KAAK,kBAAkB,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAG,MAAM,4BAA4B,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,IAAI,CAAC,YAAY;YAAE,MAAM,WAAW,CAAC,qCAAqC,CAAC,CAAC;QACvH,OAAO,EAAE,EAAE,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACvI,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;AACrG,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,KAAY;IACtD,MAAM,SAAS,GAAG,sBAAsB,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC;IAChH,MAAM,SAAS,GAAG,MAAM,oBAAoB,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAClE,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,cAAc,IAAI,SAAS,CAAC,UAAU,KAAK,OAAO;WACtF,SAAS,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,IAAI,SAAS,CAAC,EAAE,KAAK,KAAK,CAAC,OAAO,CAAC,YAAY,IAAI,SAAS,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAClJ,MAAM,WAAW,CAAC,8EAA8E,CAAC,CAAC;IACpG,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC;IAC1G,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,eAAe,KAAK,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,eAAe;QAAE,MAAM,WAAW,CAAC,4BAA4B,CAAC,CAAC;IAClK,MAAM,eAAe,GAAG,KAAK,CAAC,iBAAiB;QAC7C,CAAC,CAAC,MAAM,wBAAwB,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACvG,MAAM,aAAa,GAAG,qBAAqB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACtE,IAAI,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;IAC9B,MAAM,QAAQ,GAAoB,EAAE,CAAC;IACrC,MAAM,OAAO,GAA4C,EAAE,CAAC;IAC5D,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,cAAc,EAAE,CAAC;QACxC,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,WAAW,CAAC,2BAA2B,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3G,IAAI,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,QAAQ,CAAC,UAAU,IAAI,QAAQ,CAAC,kBAAkB,KAAK,SAAS;eAClG,CAAC,CAAC,iCAAiC,EAAE,yBAAyB,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,cAAc,IAAI,EAAE,CAAC;YAAE,MAAM,WAAW,CAAC,0DAA0D,CAAC,CAAC;QAC5L,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC9I,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC7E,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAChE,MAAM,aAAa,GAAG,MAAM,QAAQ,CAA0B,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC,CAAC;QACtG,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,YAAY,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;QAChF,IAAI,SAAS,CAAC,MAAM,CAAC,MAAM,KAAK,WAAW,IAAI,SAAS,CAAC,aAAa,KAAK,OAAO,IAAI,SAAS,CAAC,iBAAiB,KAAK,OAAO;YAAE,MAAM,WAAW,CAAC,6CAA6C,CAAC,CAAC;QAChM,MAAM,WAAW,GAAG,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,WAAW,IAAI,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC;QAClG,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,WAAW,CAAC,kCAAkC,CAAC,CAAC;QAC/F,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,mBAAmB,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxF,IAAI,eAAmC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC;YAClH,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC3E,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAiC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,IAAI,CAAC,CAAC;YACxG,IAAI,MAAM,EAAE,UAAU,KAAK,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBAAC,eAAe,GAAG,QAAQ,CAAC;gBAAC,MAAM;YAAC,CAAC;QACtF,CAAC;QACD,IAAI,CAAC,eAAe;YAAE,MAAM,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACrF,MAAM,YAAY,GAAG,MAAM,QAAQ,CAA0B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;QACxG,MAAM,YAAY,GAAG,MAAM,QAAQ,CAA0B,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;QACxG,MAAM,WAAW,GAAG,YAAY,CAAC,YAAoG,CAAC;QACtI,IAAI,WAAW,EAAE,QAAQ,EAAE,YAAY,KAAK,QAAQ,CAAC,MAAM;YAAE,MAAM,WAAW,CAAC,2CAA2C,CAAC,CAAC;QAC5H,IAAI,aAAa,IAAI,WAAW,CAAC,QAAQ,CAAC,qBAAqB,KAAK,SAAS;YAAE,MAAM,WAAW,CAAC,oDAAoD,CAAC,CAAC;QACvJ,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QAC1D,IAAK,YAAY,CAAC,IAA0B,EAAE,IAAI,KAAK,QAAQ;YAAE,MAAM,WAAW,CAAC,+BAA+B,CAAC,CAAC;QACpH,MAAM,IAAI,GAAG,SAAS,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,MAAM,QAAQ,GAAI,IAAI,CAAC,IAA4C,EAAE,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC;QAC1F,IAAI,YAAY,CAAC,SAAS,KAAK,QAAQ;YAAE,MAAM,WAAW,CAAC,2BAA2B,CAAC,CAAC;QACxF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAA+C,CAAC;QACtE,IAAI,IAAI,CAAC,KAAK,IAAI,QAAQ,EAAE,gBAAgB,KAAK,UAAU;YAAE,MAAM,WAAW,CAAC,kFAAkF,CAAC,CAAC;QACnK,MAAM,YAAY,GAAG,MAAM,iBAAiB,CAAC,eAAe,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,MAAM,iBAAiB,CAAC,QAAQ,CAAC,CAAC;QACrD,MAAM,eAAe,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,CAAC,CAAC;QACzF,MAAM,YAAY,GAAG,cAAc,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,CAAC;QACtE,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC;QAC1G,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;QACvB,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC;QACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;QACjE,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,WAAW,CAAC,EAAE,gBAAgB,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3H,IAAI,MAAM,iBAAiB,CAAC,gBAAgB,CAAC,KAAK,eAAe;YAAE,MAAM,WAAW,CAAC,yCAAyC,CAAC,CAAC;QAChI,MAAM,MAAM,GAAG,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;YAC1F,qBAAqB,EAAE,SAAS;YAChC,iBAAiB,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,aAAa,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;YAC5H,mBAAmB,EAAE,UAAU,CAAC,WAAW,CAAC,EAAE,iBAAiB,EAAE,YAAY,EAAE,gBAAgB,EAAE,eAAe,EAAE,gBAAgB,EAAE,UAAU;YAC9I,mBAAmB,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QAClD,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAClE,IAAI,aAAa;YAAE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,qBAAqB,CAAC,EAAE,aAAa,CAAC,CAAC;QACpG,OAAO,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,OAAO,EAAE,wBAAwB,EAAE,MAAM,CAAC,iBAAiB,EAAE,CAAC,CAAC;QACvK,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,EAAE,aAAa,EAAE,KAAK,CAAC,aAAa,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM;YACjG,MAAM,EAAE,QAAQ,UAAU,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,iBAAiB,EAAE,cAAc,EAAE;YACtJ,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAClD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACrF,MAAM,SAAS,GAAG,uBAAuB,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACrF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;QACrC,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC;QACrG,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;QACzG,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,QAAQ,GAAG,2BAA2B,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,eAAe,EAAE,iBAAiB,EAAE,cAAc,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW;YACnJ,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,aAAa,EAAE,SAAS,CAAC,aAAa,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;QACrG,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,YAAY,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QACrF,IAAI,MAA+B,CAAC;QACpC,IAAI,OAAqD,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,GAAG,wBAAwB,CAAC,EAAE,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,uBAAuB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnM,MAAM,KAAK,CAAC,WAAW,EAAE,CAAC;YAC1B,OAAO,GAAG,MAAM,gBAAgB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,gBAAgB,EAAE,eAAe,CAAC,SAAS,EAAE,GAAG,EAAE,aAAa;gBAC/I,GAAG,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,KAAK,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/F,CAAC;gBAAS,CAAC;YACT,aAAa,CAAC,SAAS,CAAC,CAAC;YACzB,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;YACpF,MAAM,KAAK,CAAC,OAAO,EAAE,CAAC;YACtB,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,wBAAwB,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACnJ,CAAC;QACD,IAAI,YAAY,KAAK,MAAM,iBAAiB,CAAC,eAAe,CAAC,IAAI,UAAU,KAAK,MAAM,iBAAiB,CAAC,QAAQ,CAAC;eAC5G,UAAU,CAAC,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC,KAAK,MAAM,CAAC,mBAAmB;YAAE,MAAM,WAAW,CAAC,4CAA4C,CAAC,CAAC;QAC7J,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,SAAS,CAAC,CAAC;QACvE,IAAI,OAAO,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,KAAK,QAAQ;eAC7E,UAAU,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,UAAU,CAAC,YAAY,CAAC,YAAY,CAAC;YAAE,MAAM,WAAW,CAAC,2CAA2C,CAAC,CAAC;QACtJ,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;QAC7C,IAAI,MAAM;YAAE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,sBAAsB,CAAC,EAAE,MAAM,CAAC,CAAC;QACvF,MAAM,WAAW,GAAG,mBAAmB,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,CAAC,KAAK,EAAE,cAAc,EAAE,uBAAuB,EAAE;YACtK,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,CAAC,iBAAiB,EAAE,YAAY,EAAE,SAAS,CAAC,aAAa;YACxH,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC,CAAC,SAAS;YACjE,cAAc,EAAE,MAAM,mCAAmC,CAAC,cAAc,EAAE,qBAAqB,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;QACrH,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9G,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,IAAI,SAAS,CAAC,QAAQ,IAAI,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,UAAU,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS;eAC5I,CAAC,SAAS,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC;YACjG,MAAM,WAAW,CAAC,iDAAiD,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,UAAU,GAAG,MAAM,qBAAqB,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO;YACtJ,MAAM,EAAE,qBAAqB,EAAE,eAAe,CAAC,UAAU,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtH,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;QACnF,IAAI,WAAW,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;YACnC,MAAM,GAAG,GAAmB,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO;gBAC9H,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,CAAC,MAAO,EAAE,mBAAmB,EAAE,WAAW,CAAC,mBAAoB,EAAE,UAAU;gBAC3H,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;YAChD,MAAM,2BAA2B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,EAAE,iBAAiB,EAAE,SAAS,CAAC,QAAQ,EAAE,CAAC,CAAC;YACzI,QAAQ,GAAG,+BAA+B,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAC1D,MAAM,iBAAiB,CAAC,KAAK,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YACvD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACrF,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAoB,EAAE,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,SAAS,EAAE,kBAAkB,CAAC,eAAe,CAAC;QAC7K,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,WAAW,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc;QACpI,cAAc,EAAE,WAAW,CAAC,QAAQ,CAAC,EAAE,eAAe,EAAE,QAAQ,EAAE,uBAAuB,EAAE,WAAW,CAAC,SAAS,CAAC,EAAE,wBAAwB,EAAE,SAAS,EAAE,OAAO;QAC/J,WAAW,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACjH,MAAM,MAAM,GAAG,EAAE,GAAG,KAAK,CAAC,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU;QACzI,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,OAAO,EAAE,kBAAkB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,SAAS,EAAE,CAAC;IACnG,IAAI,CAAC,SAAS,CAAC,MAAM;QAAE,OAAQ,MAAkC,CAAC,KAAK,CAAC;IACxE,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;IAC7E,MAAM,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,YAAY,CAAC,EAAE,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,EAAE,KAAK,CAAC,cAAc,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,CAAC;IACvK,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAAC,OAAe,IAAgB,OAAO,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,IAAI,EAAE,gCAAgC,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC"}

package/dist/src/evals/verifier-runtime.js

@@ -0,0 +1,61 @@
+import { chmod, copyFile, mkdir, mkdtemp, rm } from "node:fs/promises";
+import path from "node:path";
+import { ensureControllerRuntime, PACKAGE_ROOT, useControllerRuntimeById } from "../controller-runtime/index.js";
+import { ensureDir, invalidInput, sha256JSON, statePaths } from "../foundation/index.js";
+export const VERIFIER_ENVIRONMENT_PROVIDER = "integrations/harbor/hitch_harbor_environment.py";
+/** Runtime changes for artifact-only regrades are restricted to one provider.
+ * The complete file membership, grader, normalizer, candidate and CLI stay fixed. */
+export function verifierRuntimeRepair(source, replacement) {
+    if (source.runtime_id === replacement.runtime_id)
+        return null;
+    const before = source.manifest, after = replacement.manifest;
+    if (before.schema_version !== after.schema_version || before.node_range !== after.node_range
+        || sha256JSON(before.entrypoints) !== sha256JSON(after.entrypoints)
+        || before.files.length !== after.files.length)
+        throw invalidInput("verifier runtime repair changes its execution contract");
+    const changed = before.files.filter(file => {
+        const other = after.files.find(candidate => candidate.path === file.path);
+        if (!other || other.executable !== file.executable)
+            throw invalidInput("verifier runtime repair changes file membership or permissions");
+        return sha256JSON(file) !== sha256JSON(other);
+    });
+    if (changed.length !== 1 || changed[0].path !== VERIFIER_ENVIRONMENT_PROVIDER) {
+        throw invalidInput("verifier runtime repair may change only the Docker environment provider");
+    }
+    return {
+        schema_version: "1", kind: "verifier-environment-runtime-repair",
+        source_runtime_id: source.runtime_id, replacement_runtime_id: replacement.runtime_id,
+        path: VERIFIER_ENVIRONMENT_PROVIDER, source_sha256: changed[0].sha256,
+        replacement_sha256: after.files.find(file => file.path === VERIFIER_ENVIRONMENT_PROVIDER).sha256,
+        unchanged_file_count: before.files.length - 1,
+    };
+}
+/** Build a new immutable runtime without writing into the original CAS entry. */
+export async function prepareVerifierEnvironmentRuntime(options) {
+    if (!/^sha256:[a-f0-9]{64}$/.test(options.sourceRuntimeId))
+        throw invalidInput("invalid source controller runtime ID");
+    const paths = statePaths(options.root);
+    const source = await useControllerRuntimeById(paths, options.sourceRuntimeId.slice(7));
+    if (!source.manifest.files.some(file => file.path === VERIFIER_ENVIRONMENT_PROVIDER))
+        throw invalidInput("source runtime has no Docker environment provider");
+    const staging = await mkdtemp(path.join(await ensureDir(paths.temporary), "verifier-runtime-"));
+    try {
+        for (const file of source.manifest.files) {
+            const target = path.join(staging, file.path);
+            await mkdir(path.dirname(target), { recursive: true });
+            await copyFile(path.join(source.directory, "payload", file.path), target);
+            await chmod(target, file.executable ? 0o755 : 0o644);
+        }
+        await copyFile(options.providerPath ?? path.join(PACKAGE_ROOT, VERIFIER_ENVIRONMENT_PROVIDER), path.join(staging, VERIFIER_ENVIRONMENT_PROVIDER));
+        await chmod(path.join(staging, VERIFIER_ENVIRONMENT_PROVIDER), source.manifest.files.find(file => file.path === VERIFIER_ENVIRONMENT_PROVIDER).executable ? 0o755 : 0o644);
+        const replacement = await ensureControllerRuntime({ root: options.root, payloadRoot: staging,
+            rules: source.manifest.files.map(file => ({ path: file.path, executable: file.executable })) });
+        verifierRuntimeRepair(source, replacement);
+        await useControllerRuntimeById(paths, options.sourceRuntimeId.slice(7));
+        return replacement;
+    }
+    finally {
+        await rm(staging, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=verifier-runtime.js.map

package/dist/src/evals/verifier-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-runtime.js","sourceRoot":"","sources":["../../../src/evals/verifier-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,uBAAuB,EAAE,YAAY,EAAE,wBAAwB,EAAE,MAAM,gCAAgC,CAAC;AAEjH,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEzF,MAAM,CAAC,MAAM,6BAA6B,GAAG,iDAAiD,CAAC;AAE/F;qFACqF;AACrF,MAAM,UAAU,qBAAqB,CAAC,MAAkC,EAAE,WAAuC;IAC/G,IAAI,MAAM,CAAC,UAAU,KAAK,WAAW,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAC9D,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,EAAE,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC;IAC7D,IAAI,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,cAAc,IAAI,MAAM,CAAC,UAAU,KAAK,KAAK,CAAC,UAAU;WACvF,UAAU,CAAC,MAAM,CAAC,WAAW,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC;WAChE,MAAM,CAAC,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,wDAAwD,CAAC,CAAC;IAC9H,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1E,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC,UAAU;YAAE,MAAM,YAAY,CAAC,gEAAgE,CAAC,CAAC;QACzI,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAE,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;QAC/E,MAAM,YAAY,CAAC,yEAAyE,CAAC,CAAC;IAChG,CAAC;IACD,OAAO;QACL,cAAc,EAAE,GAAG,EAAE,IAAI,EAAE,qCAAqC;QAChE,iBAAiB,EAAE,MAAM,CAAC,UAAU,EAAE,sBAAsB,EAAE,WAAW,CAAC,UAAU;QACpF,IAAI,EAAE,6BAA6B,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC,CAAE,CAAC,MAAM;QACtE,kBAAkB,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,6BAA6B,CAAE,CAAC,MAAM;QACjG,oBAAoB,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;KAC9C,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,KAAK,UAAU,iCAAiC,CAAC,OAEvD;IACC,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC;QAAE,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,6BAA6B,CAAC;QAAE,MAAM,YAAY,CAAC,mDAAmD,CAAC,CAAC;IAC9J,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,mBAAmB,CAAC,CAAC,CAAC;IAChG,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;YACzC,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;YAC1E,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACvD,CAAC;QACD,MAAM,QAAQ,CAAC,OAAO,CAAC,YAAY,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,6BAA6B,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC,CAAC;QAClJ,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,6BAA6B,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,6BAA6B,CAAE,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC5K,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO;YAC1F,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,qBAAqB,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3C,MAAM,wBAAwB,CAAC,KAAK,EAAE,OAAO,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,OAAO,WAAW,CAAC;IACrB,CAAC;YAAS,CAAC;QAAC,MAAM,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,CAAC;AACpE,CAAC"}

package/dist/src/evals/verifier-score-artifacts.js

@@ -0,0 +1,119 @@
+import { realpath } from "node:fs/promises";
+import path from "node:path";
+import { MAX_VERIFIER_FEEDBACK_BYTES, MAX_VERIFIER_PROCESS_BYTES, assertVerifierScoreEvidenceConsistency, parseVerifierFeedback, parseVerifierProcessEvidence, parseVerifierScores, } from "../domain/index.js";
+import { atomicWriteJSON, openContainedRegularFile, safeDiagnosticMessage, sha256Bytes } from "../foundation/index.js";
+import { sanitizeVerifierJson } from "../runs/index.js";
+import { loadBenchmarkAdapterManifest, scoreWithinRange } from "./benchmark-adapter-manifest.js";
+/**
+ * Validate and persist only the two standard structured verifier artifacts.
+ * Arbitrary files in the verifier directory remain private and inaccessible.
+ */
+export async function captureVerifierScoreEvidence(input) {
+    try {
+        throwIfAborted(input.signal);
+        const adapterManifest = input.dataset === undefined ? null : await loadBenchmarkAdapterManifest(input.dataset);
+        if (adapterManifest && adapterManifest.dataset_digest !== input.benchmarkRevision) {
+            throw new TypeError("benchmark adapter manifest changed after eval admission");
+        }
+        const root = await realpath(input.trialDirectory);
+        const processSource = await optionalJson(root, "process.json", MAX_VERIFIER_PROCESS_BYTES, input.signal);
+        const feedbackSource = await optionalJson(root, "feedback.json", MAX_VERIFIER_FEEDBACK_BYTES, input.signal);
+        const scores = parseVerifierScores(input.verifierResult);
+        let processEvidence = processSource === undefined ? undefined : parseVerifierProcessEvidence(processSource.value);
+        let feedback = feedbackSource === undefined ? undefined : parseVerifierFeedback(feedbackSource.value, processEvidence);
+        assertVerifierScoreEvidenceConsistency({
+            scores,
+            ...(processEvidence === undefined ? {} : { process: processEvidence }),
+            ...(feedback === undefined ? {} : { feedback }),
+        });
+        if (adapterManifest) {
+            if (!scores || scores.normalization !== "standard")
+                throw new TypeError("standardized benchmark requires total_score");
+            if (!scoreWithinRange(scores.total_score, adapterManifest.scoring.total_score))
+                throw new TypeError("total_score is outside the benchmark range");
+            const processDefinition = adapterManifest.scoring.process_score;
+            if ((scores.process_score !== undefined) !== (processDefinition !== undefined)) {
+                throw new TypeError("process_score availability differs from the benchmark manifest");
+            }
+            if (processDefinition && scores.process_score !== undefined && !scoreWithinRange(scores.process_score, processDefinition)) {
+                throw new TypeError("process_score is outside the benchmark range");
+            }
+            if (processDefinition && processEvidence?.metric !== processDefinition.source_metric) {
+                throw new TypeError("process evidence metric differs from the benchmark manifest");
+            }
+        }
+        // Sanitize while credentials are still available, before sealing the run.
+        // Revalidate both artifacts before writing either: a redacted identifier or
+        // reference must fail closed instead of persisting an invalid contract.
+        const credentials = input.credentialValues ?? [];
+        processEvidence = processEvidence === undefined ? undefined : parseVerifierProcessEvidence(sanitizeVerifierJson(processEvidence, credentials).value);
+        feedback = feedback === undefined ? undefined : parseVerifierFeedback(sanitizeVerifierJson(feedback, credentials).value, processEvidence);
+        const structuredArtifacts = {};
+        if (processEvidence) {
+            const target = path.join(input.runDirectory, "verifier", "process.json");
+            await atomicWriteJSON(target, processEvidence);
+            structuredArtifacts.process = artifact("verifier/process.json", encoded(processEvidence));
+        }
+        if (feedback) {
+            const target = path.join(input.runDirectory, "verifier", "feedback.json");
+            await atomicWriteJSON(target, feedback);
+            structuredArtifacts.feedback = artifact("verifier/feedback.json", encoded(feedback));
+        }
+        return {
+            ...(scores === undefined ? {} : { scores }),
+            ...(processEvidence === undefined ? {} : { process: processEvidence }),
+            ...(feedback === undefined ? {} : { feedback }),
+            ...(Object.keys(structuredArtifacts).length === 0 ? {} : { structured_artifacts: structuredArtifacts }),
+        };
+    }
+    catch (error) {
+        if (input.signal?.aborted || error?.name === "AbortError")
+            throw error;
+        return {
+            issue: safeDiagnosticMessage(error, input.credentialValues ?? []).slice(0, 1024),
+        };
+    }
+}
+async function optionalJson(root, name, maximumBytes, signal) {
+    let safe;
+    try {
+        safe = await openContainedRegularFile(root, `verifier/${name}`, maximumBytes);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw new TypeError(`unsafe structured verifier artifact: ${name}`, { cause: error });
+    }
+    try {
+        throwIfAborted(signal);
+        const bytes = await safe.handle.readFile();
+        await safe.assertUnchanged();
+        const value = JSON.parse(bytes.toString("utf8"));
+        if (!isJsonValue(value))
+            throw new TypeError(`${name} is not JSON data`);
+        return { value, bytes };
+    }
+    finally {
+        await safe.handle.close();
+    }
+}
+function artifact(ref, bytes) {
+    return { ref, bytes: bytes.length, sha256: sha256Bytes(bytes) };
+}
+function encoded(value) {
+    return Buffer.from(`${JSON.stringify(value, null, 2)}\n`, "utf8");
+}
+function isJsonValue(value) {
+    if (value === null || typeof value === "string" || typeof value === "boolean")
+        return true;
+    if (typeof value === "number")
+        return Number.isFinite(value);
+    if (Array.isArray(value))
+        return value.every(isJsonValue);
+    return Boolean(value) && typeof value === "object" && Object.values(value).every(isJsonValue);
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted)
+        throw signal.reason ?? new DOMException("The operation was aborted", "AbortError");
+}
+//# sourceMappingURL=verifier-score-artifacts.js.map

package/dist/src/evals/verifier-score-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verifier-score-artifacts.js","sourceRoot":"","sources":["../../../src/evals/verifier-score-artifacts.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAS7B,OAAO,EACL,2BAA2B,EAC3B,0BAA0B,EAC1B,sCAAsC,EACtC,qBAAqB,EACrB,4BAA4B,EAC5B,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,wBAAwB,EAAE,qBAAqB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACxD,OAAO,EAAE,4BAA4B,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAajG;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAAC,KAQlD;IACC,IAAI,CAAC;QACH,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,eAAe,GAAG,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,4BAA4B,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC/G,IAAI,eAAe,IAAI,eAAe,CAAC,cAAc,KAAK,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAClF,MAAM,IAAI,SAAS,CAAC,yDAAyD,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,cAAc,EAAE,0BAA0B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QACzG,MAAM,cAAc,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,eAAe,EAAE,2BAA2B,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5G,MAAM,MAAM,GAAG,mBAAmB,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC;QACzD,IAAI,eAAe,GAAG,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;QAClH,IAAI,QAAQ,GAAG,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CAAC,cAAc,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;QACvH,sCAAsC,CAAC;YACrC,MAAM;YACN,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;SAChD,CAAC,CAAC;QACH,IAAI,eAAe,EAAE,CAAC;YACpB,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,aAAa,KAAK,UAAU;gBAAE,MAAM,IAAI,SAAS,CAAC,6CAA6C,CAAC,CAAC;YACvH,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,CAAC,OAAO,CAAC,WAAW,CAAC;gBAAE,MAAM,IAAI,SAAS,CAAC,4CAA4C,CAAC,CAAC;YAClJ,MAAM,iBAAiB,GAAG,eAAe,CAAC,OAAO,CAAC,aAAa,CAAC;YAChE,IAAI,CAAC,MAAM,CAAC,aAAa,KAAK,SAAS,CAAC,KAAK,CAAC,iBAAiB,KAAK,SAAS,CAAC,EAAE,CAAC;gBAC/E,MAAM,IAAI,SAAS,CAAC,gEAAgE,CAAC,CAAC;YACxF,CAAC;YACD,IAAI,iBAAiB,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,iBAAiB,CAAC,EAAE,CAAC;gBAC1H,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;YACtE,CAAC;YACD,IAAI,iBAAiB,IAAI,eAAe,EAAE,MAAM,KAAK,iBAAiB,CAAC,aAAa,EAAE,CAAC;gBACrF,MAAM,IAAI,SAAS,CAAC,6DAA6D,CAAC,CAAC;YACrF,CAAC;QACH,CAAC;QACD,0EAA0E;QAC1E,4EAA4E;QAC5E,wEAAwE;QACxE,MAAM,WAAW,GAAG,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC;QACjD,eAAe,GAAG,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,4BAA4B,CACxF,oBAAoB,CAAC,eAAuC,EAAE,WAAW,CAAC,CAAC,KAAK,CACjF,CAAC;QACF,QAAQ,GAAG,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,qBAAqB,CACnE,oBAAoB,CAAC,QAAgC,EAAE,WAAW,CAAC,CAAC,KAAK,EACzE,eAAe,CAChB,CAAC;QACF,MAAM,mBAAmB,GAAyE,EAAE,CAAC;QACrG,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,cAAc,CAAC,CAAC;YACzE,MAAM,eAAe,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;YAC/C,mBAAmB,CAAC,OAAO,GAAG,QAAQ,CAAC,uBAAuB,EAAE,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAC5F,CAAC;QACD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;YAC1E,MAAM,eAAe,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YACxC,mBAAmB,CAAC,QAAQ,GAAG,QAAQ,CAAC,wBAAwB,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACvF,CAAC;QACD,OAAO;YACL,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;YAC3C,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,CAAC;YACtE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;YAC/C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;SACxG,CAAC;IACJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,MAAM,EAAE,OAAO,IAAK,KAAe,EAAE,IAAI,KAAK,YAAY;YAAE,MAAM,KAAK,CAAC;QAClF,OAAO;YACL,KAAK,EAAE,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC;SACjF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,YAAY,CACzB,IAAY,EACZ,IAAsC,EACtC,YAAoB,EACpB,MAAoB;IAEpB,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,wBAAwB,CAAC,IAAI,EAAE,YAAY,IAAI,EAAE,EAAE,YAAY,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QACzE,MAAM,IAAI,SAAS,CAAC,wCAAwC,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,CAAC;QACH,cAAc,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAY,CAAC;QAC5D,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,SAAS,CAAC,GAAG,IAAI,mBAAmB,CAAC,CAAC;QACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAC1B,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;IAC5B,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,GAAwC,EAAE,KAAa;IACvE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC,KAAK,CAAW,EAAE,CAAC;AAC5E,CAAC;AAED,SAAS,OAAO,CAAC,KAAc;IAC7B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3F,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7D,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1D,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;AAC3H,CAAC;AAED,SAAS,cAAc,CAAC,MAAoB;IAC1C,IAAI,MAAM,EAAE,OAAO;QAAE,MAAM,MAAM,CAAC,MAAM,IAAI,IAAI,YAAY,CAAC,2BAA2B,EAAE,YAAY,CAAC,CAAC;AAC1G,CAAC"}

package/dist/src/evals/work-item-artifacts.js

@@ -0,0 +1,23 @@
+import { HitchError } from "../foundation/index.js";
+export function preparedArtifactForWorkItem(artifacts, item) {
+    if (!item.artifact_id)
+        return artifacts.preparedArtifact;
+    const artifact = artifacts.preparedArtifacts?.get(item.artifact_id)
+        ?? (artifacts.preparedArtifact.artifact_id === item.artifact_id ? artifacts.preparedArtifact : undefined);
+    if (!artifact) {
+        throw new HitchError(`work item references an unavailable prepared artifact: ${item.artifact_id}`, {
+            code: "harbor_artifact_assignment_missing",
+            exitCode: 12,
+        });
+    }
+    if (artifact.storage === "harbor-artifact-cache-v2" && item.runtime_contract
+        && (artifact.platform !== item.runtime_contract.artifact_platform
+            || artifact.node_version !== item.runtime_contract.node_version)) {
+        throw new HitchError(`work item artifact does not match its runtime contract: ${item.work_id}`, {
+            code: "harbor_artifact_builder_contract_mismatch",
+            exitCode: 12,
+        });
+    }
+    return artifact;
+}
+//# sourceMappingURL=work-item-artifacts.js.map

package/dist/src/evals/work-item-artifacts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"work-item-artifacts.js","sourceRoot":"","sources":["../../../src/evals/work-item-artifacts.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,MAAM,UAAU,2BAA2B,CACzC,SAA8H,EAC9H,IAAuB;IAEvB,IAAI,CAAC,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC,gBAAgB,CAAC;IACzD,MAAM,QAAQ,GAAG,SAAS,CAAC,iBAAiB,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC;WAC9D,CAAC,SAAS,CAAC,gBAAgB,CAAC,WAAW,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC,gBAAgB,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC5G,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,UAAU,CAAC,0DAA0D,IAAI,CAAC,WAAW,EAAE,EAAE;YACjG,IAAI,EAAE,oCAAoC;YAC1C,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,IAAI,QAAQ,CAAC,OAAO,KAAK,0BAA0B,IAAI,IAAI,CAAC,gBAAgB;WACvE,CAAC,QAAQ,CAAC,QAAQ,KAAK,IAAI,CAAC,gBAAgB,CAAC,iBAAiB;eAC5D,QAAQ,CAAC,YAAY,KAAK,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACrE,MAAM,IAAI,UAAU,CAAC,2DAA2D,IAAI,CAAC,OAAO,EAAE,EAAE;YAC9F,IAAI,EAAE,2CAA2C;YACjD,QAAQ,EAAE,EAAE;SACb,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/src/foundation/config.js

@@ -1,4 +1,5 @@
 import { homedir } from "node:os";
+import { createHash } from "node:crypto";
 import path from "node:path";
 import { invalidInput } from "./errors.js";
 export const SCHEMA_VERSION = "1";
@@ -46,9 +47,25 @@ export function statePaths(root) {
         workspaceLocks: path.join(root, "locks", "workspaces"),
         controllerRuntimeLocks: path.join(root, "locks", "controller-runtimes"),
         controllerRuntimes: path.join(root, "store", "controller-runtimes", "sha256"),
+        environmentImages: path.join(root, "store", "environment-images", "sha256"),
+        environmentImagePins: path.join(root, "store", "environment-image-pins", "sha256"),
+        environmentImageReferenceLocks: path.join(root, "locks", "environment-image-references"),
+        buildRecords: path.join(root, "store", "build-records", "sha256"),
+        buildLocks: path.join(root, "locks", "builds"),
+        buildIndexes: path.join(root, "indexes", "builds"),
+        trainingDataCandidates: path.join(root, "derived", "training-data-candidates", "sha256"),
+        workers: path.join(root, "workers"),
+        workerLocks: path.join(root, "locks", "workers"),
+        workerProtocol: path.join(root, "worker-protocol"),
+        workerProtocolLocks: path.join(root, "locks", "worker-protocol"),
+        workerStaging: path.join(root, "worker-staging"),
+        workerInputs: path.join(root, "store", "worker-inputs", "sha256"),
         workspaces: path.join(root, "workspaces"),
         temporary: path.join(root, "tmp"),
         indexes: path.join(root, "indexes"),
     };
 }
+export function hitchRootId(root) {
+    return createHash("sha256").update(statePaths(root).root).digest("hex").slice(0, 24);
+}
 //# sourceMappingURL=config.js.map

package/dist/src/foundation/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/foundation/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AA0BxC,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyC;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,YAAY,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAsB,EAAE,IAAY;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC;QACtD,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC;QACvE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,CAAC;QAC7E,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;KACpC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/foundation/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,CAAC;AACjC,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,CAAC;AAuCxC,MAAM,UAAU,WAAW;IACzB,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC;AAChF,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAyC;IACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,EAAE;QAAE,OAAO,CAAC,CAAC;IACpE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACtE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,8BAA8B,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,MAAM,YAAY,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;IAC7D,MAAM,KAAK,GAA2B,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC;IACnF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAsB,EAAE,IAAY;IAClE,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,YAAY,CAAC,GAAG,IAAI,6BAA6B,CAAC,CAAC;IAC3D,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,OAAO;QACL,IAAI;QACJ,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACtC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC;QACtC,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QAClC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAC3C,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC;QAC/B,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC;QAC/C,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,WAAW,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,YAAY,CAAC;QACtD,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,CAAC;QACvE,kBAAkB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,qBAAqB,EAAE,QAAQ,CAAC;QAC7E,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,oBAAoB,EAAE,QAAQ,CAAC;QAC3E,oBAAoB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,wBAAwB,EAAE,QAAQ,CAAC;QAClF,8BAA8B,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,8BAA8B,CAAC;QACxF,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC;QACjE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC;QAC9C,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;QAClD,sBAAsB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,0BAA0B,EAAE,QAAQ,CAAC;QACxF,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QACnC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC;QAChD,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC;QAClD,mBAAmB,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC;QAChE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,gBAAgB,CAAC;QAChD,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,eAAe,EAAE,QAAQ,CAAC;QACjE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC;QACzC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;QACjC,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;KACpC,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACvF,CAAC"}

package/dist/src/foundation/contained-file.js

@@ -0,0 +1,85 @@
+import { constants } from "node:fs";
+import { lstat, open, realpath } from "node:fs/promises";
+import path from "node:path";
+/** Open an untrusted relative file without following any directory or file symlink. */
+export async function openContainedRegularFile(root, relative, maximumBytes = Number.MAX_SAFE_INTEGER) {
+    const segments = normalizedSegments(relative);
+    const canonicalRoot = await realpath(root);
+    if (canonicalRoot !== path.resolve(root))
+        throw new TypeError("contained file root must be canonical");
+    const parents = [];
+    let directory = canonicalRoot;
+    parents.push({ path: directory, stats: await safeDirectory(directory) });
+    for (const segment of segments.slice(0, -1)) {
+        directory = path.join(directory, segment);
+        const info = await safeDirectory(directory);
+        if (!isWithin(canonicalRoot, await realpath(directory)))
+            throw new TypeError("contained file parent escapes its root");
+        parents.push({ path: directory, stats: info });
+    }
+    const target = path.join(canonicalRoot, ...segments);
+    const before = await lstat(target);
+    if (before.isSymbolicLink() || !before.isFile() || before.nlink !== 1)
+        throw new TypeError("contained file is not a safe regular file");
+    const handle = await open(target, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const opened = await handle.stat();
+        const after = await lstat(target);
+        await assertParentsUnchanged(parents);
+        if (!sameFile(opened, before) || !sameFile(opened, after) || !isWithin(canonicalRoot, await realpath(target))) {
+            throw new TypeError("contained file identity changed while opening");
+        }
+        await assertParentsUnchanged(parents);
+        if (opened.size > maximumBytes)
+            throw new TypeError("contained file exceeds its limit");
+        return {
+            handle,
+            size: opened.size,
+            assertUnchanged: async () => {
+                const current = await handle.stat();
+                const pathname = await lstat(target);
+                await assertParentsUnchanged(parents);
+                if (!sameFile(opened, current) || !sameFile(opened, pathname)
+                    || current.size !== opened.size || current.mtimeMs !== opened.mtimeMs
+                    || !isWithin(canonicalRoot, await realpath(target))) {
+                    throw new TypeError("contained file changed while being read");
+                }
+                await assertParentsUnchanged(parents);
+            },
+        };
+    }
+    catch (error) {
+        await handle.close();
+        throw error;
+    }
+}
+async function safeDirectory(directory) {
+    const info = await lstat(directory);
+    if (info.isSymbolicLink() || !info.isDirectory())
+        throw new TypeError("contained file parent is unsafe");
+    return info;
+}
+async function assertParentsUnchanged(parents) {
+    for (const parent of parents) {
+        const current = await safeDirectory(parent.path);
+        if (current.dev !== parent.stats.dev || current.ino !== parent.stats.ino) {
+            throw new TypeError("contained file parent changed while opening");
+        }
+    }
+}
+function normalizedSegments(relative) {
+    if (!relative || relative.includes("\\") || relative.startsWith("/"))
+        throw new TypeError("contained file path is invalid");
+    const segments = relative.split("/");
+    if (segments.some((segment) => !segment || segment === "." || segment === ".."))
+        throw new TypeError("contained file path is invalid");
+    return segments;
+}
+function sameFile(left, right) {
+    return left.dev === right.dev && left.ino === right.ino && left.isFile() && right.isFile() && right.nlink === 1;
+}
+function isWithin(root, candidate) {
+    const relative = path.relative(root, candidate);
+    return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}
+//# sourceMappingURL=contained-file.js.map