agent-hitch 0.2.6 → 0.2.8

package/dist/src/benchmarks/loader.js

@@ -0,0 +1,271 @@
+import { lstat, readdir, readFile } from "node:fs/promises";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { atomicWriteJSON, invalidInput, sha256Bytes, sha256JSON } from "../foundation/index.js";
+import { parseBenchmarkToml } from "./toml.js";
+import { fields, object, parseManifest, parseProfile, parseTask, relativePath, unsupported } from "./validation.js";
+const RESOLVER_VERSION = "1";
+export async function loadBenchmark(directory) {
+    directory = path.resolve(directory);
+    const files = await inventory(directory);
+    const available = new Set(files.map((f) => f.path));
+    const required = (name) => {
+        relativePath(name);
+        if (!available.has(name))
+            throw invalidInput(`required package file missing: ${name}`);
+        return path.join(directory, name);
+    };
+    const read = async (name) => JSON.parse(await readFile(required(name), "utf8"));
+    const manifest = parseManifest(parseBenchmarkToml(await readFile(required("benchmark.toml"), "utf8")));
+    const profile = parseProfile(await read(manifest.default_profile));
+    if (profile.track !== manifest.publication.track)
+        throw invalidInput("profile and publication tracks differ");
+    const sourceManifest = await read("source-manifest.json");
+    const provenance = object(sourceManifest, "source manifest");
+    const transformations = [];
+    if (provenance.transformations !== undefined && !Array.isArray(provenance.transformations))
+        throw invalidInput("source transformations must be an array");
+    for (const transformation of (provenance.transformations ?? [])) {
+        const entry = fields(transformation, ["kind", "before_path", "after_path"], "source transformation");
+        if (typeof entry.kind !== "string")
+            throw invalidInput("invalid transformation kind");
+        required(relativePath(entry.before_path));
+        required(relativePath(entry.after_path));
+        transformations.push({ kind: entry.kind, before: files.find((f) => f.path === entry.before_path).digest, after: files.find((f) => f.path === entry.after_path).digest });
+    }
+    let sourceAdapter;
+    if (provenance.adapter !== undefined) {
+        const adapter = object(provenance.adapter, "source adapter provenance");
+        if (typeof adapter.id !== "string" || typeof adapter.version !== "string")
+            throw invalidInput("invalid source adapter provenance");
+        if (adapter.path !== undefined) {
+            const adapterPath = relativePath(adapter.path);
+            required(adapterPath);
+            sourceAdapter = { id: adapter.id, version: adapter.version, code_digest: files.find((f) => f.path === adapterPath).digest };
+        }
+    }
+    const treeDigest = (prefix) => {
+        const subset = files.filter((f) => f.path === prefix || f.path.startsWith(`${prefix}/`));
+        if (!subset.length)
+            throw invalidInput(`empty or missing package component: ${prefix}`);
+        return sha256JSON(subset.map((f) => ({ ...f, path: f.path.slice(prefix.length) })));
+    };
+    const components = manifest.runtime_components.map((c) => ({ id: c.id, protocol: c.protocol, content_digest: treeDigest(c.path) }));
+    const tasks = [];
+    const lockedTasks = [];
+    const sourceIds = new Set();
+    const actualTaskIds = (await readdir(path.join(directory, manifest.task_root), { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name).sort();
+    if (JSON.stringify(actualTaskIds) !== JSON.stringify([...manifest.task_ids].sort()))
+        throw invalidInput("task directory membership differs from manifest task_ids");
+    for (const id of [...manifest.task_ids].sort()) {
+        const taskPath = `${manifest.task_root}/${id}`;
+        const config = parseTask(await read(`${taskPath}/task.hitch.json`), manifest);
+        if (sourceIds.has(config.source_task_id))
+            throw invalidInput("duplicate source_task_id");
+        sourceIds.add(config.source_task_id);
+        const harbor = parseBenchmarkToml(await readFile(required(`${taskPath}/task.toml`), "utf8"));
+        validateHarbor(harbor, config);
+        required(`${taskPath}/tests/test.sh`);
+        let tools = [];
+        if (config.driver.kind === "model-call") {
+            if (!config.driver.config.input.startsWith(`${taskPath}/environment/`))
+                throw invalidInput("model input must be in the candidate environment");
+            required(config.driver.config.input);
+        }
+        if (config.driver.kind === "tool-server") {
+            required(`${taskPath}/environment/docker-compose.yaml`);
+            required(`${taskPath}/tests/Dockerfile`);
+            const schema = await read(config.driver.config.schema);
+            validateTools(schema);
+            tools = schema;
+        }
+        required(`${taskPath}/instruction.md`);
+        for (const cap of config.requirements)
+            if (!profile.tool_policy.allowed.includes(cap))
+                throw invalidInput(`profile does not grant required capability: ${cap}`);
+        if (config.driver.kind === "tool-server" && config.driver.config.native_phases
+            && config.driver.config.native_phases.shutdown_timeout_ms > profile.budget.collection_timeout_ms)
+            throw invalidInput("native phase shutdown exceeds profile collection allowance");
+        if (config.driver.kind === "tool-server" && config.driver.config.native_phases?.protocol === "hitch-native-phase-control@2"
+            && config.driver.config.native_phases.finalization_timeout_ms > profile.budget.collection_timeout_ms)
+            throw invalidInput("native finalization exceeds profile collection allowance");
+        for (const [phase, hook] of Object.entries(config.lifecycle)) {
+            const limit = phase === "prepare" ? profile.budget.setup_timeout_ms : phase === "cleanup" ? profile.budget.cleanup_grace_ms : profile.budget.collection_timeout_ms;
+            if (hook.timeout_ms > limit)
+                throw invalidInput(`hook ${phase} timeout exceeds profile phase budget`);
+        }
+        const taskDigest = sha256JSON({ tree: treeDigest(taskPath), components, tools: sha256JSON(tools) });
+        const environments = [];
+        for (const area of ["environment", "tests"]) {
+            const baseImages = new Set();
+            const dockerfiles = files.filter((f) => f.path.startsWith(`${taskPath}/${area}/`) && /^Dockerfile(?:\.|$)/.test(path.basename(f.path)));
+            for (const dockerfile of dockerfiles) {
+                const stages = new Set();
+                let continued = false;
+                for (const line of (await readFile(required(dockerfile.path), "utf8")).split(/\r?\n/)) {
+                    const continuation = continued;
+                    if (line.trim() && !line.trimStart().startsWith("#"))
+                        continued = line.trimEnd().endsWith("\\");
+                    if (continuation)
+                        continue;
+                    const match = /^\s*FROM\s+(?:--platform=linux\/amd64\s+)?(\S+)(?:\s+AS\s+(\S+))?\s*$/i.exec(line);
+                    if (!match) {
+                        if (/^\s*FROM\b/i.test(line))
+                            unsupported("unsupported Docker FROM syntax");
+                        continue;
+                    }
+                    const image = match[1];
+                    if (image !== "scratch" && !stages.has(image)) {
+                        const digest = /@sha256:([a-f0-9]{64})$/.exec(image);
+                        if (!digest)
+                            throw invalidInput(`unresolved base image: ${image}`);
+                        baseImages.add(`sha256:${digest[1]}`);
+                    }
+                    if (match[2])
+                        stages.add(match[2]);
+                }
+            }
+            environments.push({ role: area, kind: "build", context_digest: treeDigest(`${taskPath}/${area}`), base_image_digests: [...baseImages].sort(), platform: "linux/amd64" });
+        }
+        lockedTasks.push({ task_id: id, source_task_id: config.source_task_id, path: taskPath, task_digest: taskDigest, input_digest: treeDigest(`${taskPath}/instruction.md`), grader_digest: sha256JSON({ tests: treeDigest(`${taskPath}/tests`), components }), environment_refs: environments });
+        tasks.push({ id, path: taskPath, config, harbor, tools });
+    }
+    // Values, modes and paths participate in identity; host directory and mtime do not.
+    const packageDigest = sha256JSON(files);
+    const resolverFiles = await Promise.all(["loader", "validation", "toml", "metrics"].map(async (name) => sha256Bytes(await readFile(new URL(`./${name}.js`, import.meta.url)))));
+    resolverFiles.push(sha256JSON(await inventory(path.dirname(fileURLToPath(import.meta.resolve("smol-toml"))))));
+    const lock = {
+        schema_version: "1", protocol: "hitch-benchmark@1", benchmark_id: manifest.id, release: manifest.release,
+        package_digest: packageDigest,
+        source: {
+            kind: manifest.source.kind,
+            uri: manifest.source.kind === "local" ? `cas:${packageDigest}` : manifest.source.uri,
+            resolved_revision: manifest.source.kind === "local" ? packageDigest : manifest.source.resolved_revision,
+            access: manifest.source.access ?? "public", manifest_digest: sha256JSON(sourceManifest),
+        },
+        resolver: { id: "hitch-benchmark", version: RESOLVER_VERSION, code_digest: sha256JSON(resolverFiles) },
+        ...(sourceAdapter ? { source_adapter: sourceAdapter } : {}),
+        components: components.map((c) => ({ role: c.id, uri: `cas:${c.content_digest}`, resolved_revision: c.content_digest, digest: c.content_digest })),
+        task_dialect: manifest.task_format, runtime_components: components, tasks: lockedTasks,
+        profile_digest: sha256JSON(profile), required_capabilities: [...new Set(tasks.flatMap((t) => t.config.requirements))].sort(),
+        metric_spec_digest: sha256JSON({ primary: manifest.primary_metric, metrics: manifest.metrics }), files, transformations,
+    };
+    return { directory, manifest, profile, tasks, lock };
+}
+export async function benchmarkTreeDigest(directory) {
+    return sha256JSON(await inventory(directory));
+}
+export async function validateBenchmark(directory) {
+    const loaded = await loadBenchmark(directory);
+    return { valid: true, protocol: loaded.lock.protocol, benchmark_id: loaded.manifest.id, package_digest: loaded.lock.package_digest, tasks: loaded.lock.tasks, required_capabilities: loaded.lock.required_capabilities };
+}
+export async function lockBenchmark(directory, output = path.join(directory, "benchmark.lock.json")) {
+    // A custom lock file outside the package avoids changing package identity.
+    const inside = path.relative(path.resolve(directory), path.resolve(output));
+    if (!inside.startsWith("..") && !path.isAbsolute(inside) && inside !== "benchmark.lock.json")
+        throw invalidInput("an in-package lock must be named benchmark.lock.json");
+    const loaded = await loadBenchmark(directory);
+    await atomicWriteJSON(output, loaded.lock);
+    return loaded.lock;
+}
+export async function loadBenchmarkLock(file, directory = path.dirname(file)) {
+    const lock = JSON.parse(await readFile(file, "utf8"));
+    const loaded = await loadBenchmark(directory);
+    if (sha256JSON(lock) !== sha256JSON(loaded.lock))
+        throw invalidInput("benchmark lock does not match the current package/resolver; create a new lock explicitly");
+    return loaded;
+}
+async function inventory(directory, prefix = "") {
+    const files = [];
+    const info = await lstat(directory);
+    if (!info.isDirectory() || info.isSymbolicLink())
+        throw invalidInput("package directory must be a real directory");
+    for (const entry of (await readdir(directory, { withFileTypes: true })).sort((a, b) => a.name < b.name ? -1 : 1)) {
+        const name = prefix ? `${prefix}/${entry.name}` : entry.name;
+        if (!prefix && entry.name === "benchmark.lock.json" && entry.isFile())
+            continue;
+        relativePath(name);
+        const absolute = path.join(directory, entry.name);
+        const stat = await lstat(absolute);
+        if (stat.isSymbolicLink() || (!stat.isDirectory() && !stat.isFile()))
+            unsupported(`package special files/symlinks are unsupported: ${name}`);
+        if (stat.isDirectory())
+            files.push(...await inventory(absolute, name));
+        else
+            files.push({ path: name, digest: sha256Bytes(await readFile(absolute)), bytes: stat.size, mode: stat.mode & 0o777 });
+    }
+    return files;
+}
+function validateTools(value) {
+    if (!Array.isArray(value) || !value.length)
+        throw invalidInput("tool schema must be a nonempty array");
+    const names = new Set();
+    for (const tool of value) {
+        const item = fields(tool, ["name", "description", "inputSchema"], "tool");
+        if (typeof item.name !== "string" || !/^[A-Za-z_][A-Za-z0-9_.-]*$/.test(item.name) || names.has(item.name))
+            throw invalidInput("invalid or duplicate tool name");
+        if (typeof item.description !== "string")
+            throw invalidInput("missing tool description");
+        const schema = object(item.inputSchema, "tool inputSchema");
+        if (schema.type !== "object")
+            unsupported("tool inputSchema must describe an object");
+        names.add(item.name);
+    }
+}
+function validateHarbor(h, task) {
+    if (task.driver.kind !== "tool-server") {
+        // Preserve the native Harbor task rather than imposing the sidecar dialect.
+        // The existing Harbor inspector validates the full resource/config model.
+        fields(h, ["schema_version", "version", "task", "metadata", "agent", "environment", "verifier", "artifacts", "solution", "source"], "Harbor task");
+        if (h.schema_version !== undefined && h.schema_version !== "1.4")
+            unsupported("unsupported Harbor task schema");
+        const agent = object(h.agent, "Harbor agent");
+        if (typeof agent.timeout_sec !== "number" || agent.timeout_sec <= 0)
+            throw invalidInput("task agent timeout must be positive");
+        const environment = object(h.environment, "Harbor environment");
+        if (environment.network_mode !== undefined && environment.network_mode !== "public")
+            unsupported("terminal profile requires public network");
+        const verifier = object(h.verifier, "Harbor verifier");
+        const mode = verifier.environment_mode ?? "shared";
+        if (!["shared", "separate"].includes(String(mode)))
+            unsupported("unsupported verifier mode");
+        if (!task.requirements.includes(`${mode}-verifier`))
+            throw invalidInput("verifier isolation must be declared in requirements");
+        if (task.submission.final_response && mode !== "separate")
+            throw invalidInput("canonical final response requires a separate verifier");
+        if (mode === "separate" && task.submission.kind !== "artifacts")
+            throw invalidInput("separate verifier requires explicit artifacts");
+        const artifacts = h.artifacts ?? [];
+        if (!Array.isArray(artifacts))
+            throw invalidInput("invalid Harbor artifacts");
+        const paths = artifacts.map(a => typeof a === "string" ? a : object(a, "artifact").source);
+        if (task.submission.kind === "artifacts" && JSON.stringify([...paths].sort()) !== JSON.stringify([...task.submission.paths].sort()))
+            throw invalidInput("submission paths and Harbor artifacts differ");
+        return;
+    }
+    const service = task.driver.config.service, paths = task.submission.paths;
+    fields(h, ["schema_version", "metadata", "agent", "environment", "verifier", "artifacts"], "Harbor task");
+    if (h.schema_version !== "1.4")
+        unsupported("unsupported Harbor task schema");
+    const agent = fields(h.agent, ["timeout_sec"], "Harbor agent");
+    if (typeof agent.timeout_sec !== "number" || agent.timeout_sec <= 0)
+        throw invalidInput("task agent timeout must be positive");
+    const environment = fields(h.environment, ["cpus", "memory_mb", "storage_mb", "build_timeout_sec", "workdir", "network_mode"], "Harbor environment");
+    if (environment.network_mode !== "public")
+        unsupported("MVP task network must be explicitly public");
+    const verifier = fields(h.verifier, ["timeout_sec", "environment_mode", "environment"], "Harbor verifier");
+    if (verifier.environment_mode !== "separate")
+        unsupported("tool-server tasks require a separate verifier");
+    fields(verifier.environment, ["cpus", "memory_mb", "storage_mb", "build_timeout_sec", "network_mode"], "Harbor verifier environment");
+    if (!Array.isArray(h.artifacts))
+        throw invalidInput("missing authoritative artifacts");
+    const sources = h.artifacts.map((a) => {
+        const artifact = fields(a, ["source", "service"], "artifact");
+        if (artifact.service !== service)
+            unsupported("tool-server snapshots must originate from the declared sidecar");
+        return artifact.source;
+    });
+    if (JSON.stringify([...sources].sort()) !== JSON.stringify([...paths].sort()))
+        throw invalidInput("submission paths and Harbor artifacts differ");
+}
+//# sourceMappingURL=loader.js.map

package/dist/src/benchmarks/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/benchmarks/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AAEzC,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,kBAAkB,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,YAAY,EAAE,SAAS,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,iBAAiB,CAAC;AAEpH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB;IACnD,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACpD,MAAM,QAAQ,GAAG,CAAC,IAAY,EAAU,EAAE;QACxC,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,YAAY,CAAC,kCAAkC,IAAI,EAAE,CAAC,CAAC;QACvF,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC;IACpC,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,KAAK,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;IACnG,MAAM,QAAQ,GAAG,aAAa,CAAC,kBAAkB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IACvG,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACnE,IAAI,OAAO,CAAC,KAAK,KAAK,QAAQ,CAAC,WAAW,CAAC,KAAK;QAAE,MAAM,YAAY,CAAC,uCAAuC,CAAC,CAAC;IAC9G,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,sBAAsB,CAAC,CAAC;IAC1D,MAAM,UAAU,GAAG,MAAM,CAAC,cAAc,EAAE,iBAAiB,CAAC,CAAC;IAC7D,MAAM,eAAe,GAAuC,EAAE,CAAC;IAC/D,IAAI,UAAU,CAAC,eAAe,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,MAAM,YAAY,CAAC,yCAAyC,CAAC,CAAC;IAC1J,KAAK,MAAM,cAAc,IAAI,CAAC,UAAU,CAAC,eAAe,IAAI,EAAE,CAAc,EAAE,CAAC;QAC7E,MAAM,KAAK,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,YAAY,CAAC,EAAE,uBAAuB,CAAC,CAAC;QACrG,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,6BAA6B,CAAC,CAAC;QACtF,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC;QAAC,QAAQ,CAAC,YAAY,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;QACpF,eAAe,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,WAAW,CAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC,UAAU,CAAE,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7K,CAAC;IACD,IAAI,aAAgD,CAAC;IACrD,IAAI,UAAU,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACrC,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;QACxE,IAAI,OAAO,OAAO,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,mCAAmC,CAAC,CAAC;QACnI,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC/B,MAAM,WAAW,GAAG,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;YACtE,aAAa,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAE,CAAC,MAAM,EAAE,CAAC;QAC/H,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,CAAC,MAAc,EAAU,EAAE;QAC5C,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,GAAG,CAAC,CAAC,CAAC;QACzF,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,YAAY,CAAC,uCAAuC,MAAM,EAAE,CAAC,CAAC;QACxF,OAAO,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtF,CAAC,CAAC;IACF,MAAM,UAAU,GAAG,QAAQ,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;IACpI,MAAM,KAAK,GAA+B,EAAE,CAAC;IAC7C,MAAM,WAAW,GAA6B,EAAE,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,GAAG,EAAU,CAAC;IACpC,MAAM,aAAa,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IAClK,IAAI,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,YAAY,CAAC,0DAA0D,CAAC,CAAC;IACpK,KAAK,MAAM,EAAE,IAAI,CAAC,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,QAAQ,GAAG,GAAG,QAAQ,CAAC,SAAS,IAAI,EAAE,EAAE,CAAC;QAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,IAAI,CAAC,GAAG,QAAQ,kBAAkB,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9E,IAAI,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC;YAAE,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;QACzF,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,GAAG,QAAQ,YAAY,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7F,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/B,QAAQ,CAAC,GAAG,QAAQ,gBAAgB,CAAC,CAAC;QACtC,IAAI,KAAK,GAAc,EAAE,CAAC;QAC1B,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACxC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,QAAQ,eAAe,CAAC;gBAAE,MAAM,YAAY,CAAC,kDAAkD,CAAC,CAAC;YAC/I,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;YACzC,QAAQ,CAAC,GAAG,QAAQ,kCAAkC,CAAC,CAAC;YACxD,QAAQ,CAAC,GAAG,QAAQ,mBAAmB,CAAC,CAAC;YACzC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YACvD,aAAa,CAAC,MAAM,CAAC,CAAC;YAAC,KAAK,GAAG,MAAM,CAAC;QACxC,CAAC;QACD,QAAQ,CAAC,GAAG,QAAQ,iBAAiB,CAAC,CAAC;QACvC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,YAAY;YAAE,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,MAAM,YAAY,CAAC,+CAA+C,GAAG,EAAE,CAAC,CAAC;QAChK,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa;eACzE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAAE,MAAM,YAAY,CAAC,4DAA4D,CAAC,CAAC;QACrL,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,QAAQ,KAAK,8BAA8B;eACtH,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,uBAAuB,GAAG,OAAO,CAAC,MAAM,CAAC,qBAAqB;YAAE,MAAM,YAAY,CAAC,0DAA0D,CAAC,CAAC;QACvL,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC;YACnK,IAAI,IAAI,CAAC,UAAU,GAAG,KAAK;gBAAE,MAAM,YAAY,CAAC,QAAQ,KAAK,uCAAuC,CAAC,CAAC;QACxG,CAAC;QACD,MAAM,UAAU,GAAG,UAAU,CAAC,EAAE,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,YAAY,GAAgC,EAAE,CAAC;QACrD,KAAK,MAAM,IAAI,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,IAAI,GAAG,EAAU,CAAC;YACrC,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,QAAQ,IAAI,IAAI,GAAG,CAAC,IAAI,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACxI,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;gBACrC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;gBACjC,IAAI,SAAS,GAAG,KAAK,CAAC;gBACtB,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtF,MAAM,YAAY,GAAG,SAAS,CAAC;oBAC/B,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;wBAAE,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;oBAChG,IAAI,YAAY;wBAAE,SAAS;oBAC3B,MAAM,KAAK,GAAG,wEAAwE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAClG,IAAI,CAAC,KAAK,EAAE,CAAC;wBAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC;4BAAE,WAAW,CAAC,gCAAgC,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;oBACtG,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC;oBACxB,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;wBAC9C,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBACrD,IAAI,CAAC,MAAM;4BAAE,MAAM,YAAY,CAAC,0BAA0B,KAAK,EAAE,CAAC,CAAC;wBACnE,UAAU,CAAC,GAAG,CAAC,UAAU,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACxC,CAAC;oBACD,IAAI,KAAK,CAAC,CAAC,CAAC;wBAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrC,CAAC;YACH,CAAC;YACD,YAAY,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,EAAE,UAAU,CAAC,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,GAAG,UAAU,CAAC,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,aAAa,EAAE,CAAC,CAAC;QAC3K,CAAC;QACD,WAAW,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,cAAc,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,CAAC,GAAG,QAAQ,iBAAiB,CAAC,EAAE,aAAa,EAAE,UAAU,CAAC,EAAE,KAAK,EAAE,UAAU,CAAC,GAAG,QAAQ,QAAQ,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,gBAAgB,EAAE,YAAY,EAAE,CAAC,CAAC;QAC7R,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;IACD,oFAAoF;IACpF,MAAM,aAAa,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,MAAM,aAAa,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,MAAM,QAAQ,CAAC,IAAI,GAAG,CAAC,KAAK,IAAI,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChL,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/G,MAAM,IAAI,GAAoB;QAC5B,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,mBAAmB,EAAE,YAAY,EAAE,QAAQ,CAAC,EAAE,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO;QACxG,cAAc,EAAE,aAAa;QAC7B,MAAM,EAAE;YACN,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI;YAC1B,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,aAAa,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAI;YACrF,iBAAiB,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,iBAAkB;YACxG,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,IAAI,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,cAAc,CAAC;SACxF;QACD,QAAQ,EAAE,EAAE,EAAE,EAAE,iBAAiB,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,UAAU,CAAC,aAAa,CAAC,EAAE;QACtG,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,aAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,UAAU,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,iBAAiB,EAAE,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC;QAClJ,YAAY,EAAE,QAAQ,CAAC,WAAW,EAAE,kBAAkB,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW;QACtF,cAAc,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAC5H,kBAAkB,EAAE,UAAU,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,cAAc,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,KAAK,EAAE,eAAe;KACxH,CAAC;IACF,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,OAAO,UAAU,CAAC,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IACvD,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,cAAc,EAAE,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,qBAAqB,EAAE,MAAM,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;AAC3N,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,qBAAqB,CAAC;IACzG,2EAA2E;IAC3E,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,KAAK,qBAAqB;QAAE,MAAM,YAAY,CAAC,sDAAsD,CAAC,CAAC;IACzK,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,eAAe,CAAC,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;IAC3C,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAY,EAAE,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAClF,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IACjE,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;IAC9C,IAAI,UAAU,CAAC,IAAI,CAAC,KAAK,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,YAAY,CAAC,0FAA0F,CAAC,CAAC;IACjK,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,SAAiB,EAAE,MAAM,GAAG,EAAE;IACrD,MAAM,KAAK,GAAsB,EAAE,CAAC;IACpC,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACpC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,YAAY,CAAC,4CAA4C,CAAC,CAAC;IACnH,KAAK,MAAM,KAAK,IAAI,CAAC,MAAM,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC;QAC7D,IAAI,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,qBAAqB,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAChF,YAAY,CAAC,IAAI,CAAC,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YAAE,WAAW,CAAC,mDAAmD,IAAI,EAAE,CAAC,CAAC;QAC7I,IAAI,IAAI,CAAC,WAAW,EAAE;YAAE,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;;YAClE,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,KAAK,EAAE,CAAC,CAAC;IAC5H,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM;QAAE,MAAM,YAAY,CAAC,sCAAsC,CAAC,CAAC;IACvG,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAC,EAAE,MAAM,CAAC,CAAC;QAC1E,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,MAAM,YAAY,CAAC,gCAAgC,CAAC,CAAC;QACjK,IAAI,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;YAAE,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;QACzF,MAAM,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ;YAAE,WAAW,CAAC,0CAA0C,CAAC,CAAC;QACtF,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,CAA0B,EAAE,IAAqB;IACvE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;QACvC,4EAA4E;QAC5E,0EAA0E;QAC1E,MAAM,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,aAAa,CAAC,CAAC;QACnJ,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,IAAI,CAAC,CAAC,cAAc,KAAK,KAAK;YAAE,WAAW,CAAC,gCAAgC,CAAC,CAAC;QAChH,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC;YAAE,MAAM,YAAY,CAAC,qCAAqC,CAAC,CAAC;QAC/H,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAChE,IAAI,WAAW,CAAC,YAAY,KAAK,SAAS,IAAI,WAAW,CAAC,YAAY,KAAK,QAAQ;YAAE,WAAW,CAAC,0CAA0C,CAAC,CAAC;QAC7I,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;QACvD,MAAM,IAAI,GAAG,QAAQ,CAAC,gBAAgB,IAAI,QAAQ,CAAC;QACnD,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAAE,WAAW,CAAC,2BAA2B,CAAC,CAAC;QAC7F,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,IAAI,WAAW,CAAC;YAAE,MAAM,YAAY,CAAC,qDAAqD,CAAC,CAAC;QAC/H,IAAI,IAAI,CAAC,UAAU,CAAC,cAAc,IAAI,IAAI,KAAK,UAAU;YAAE,MAAM,YAAY,CAAC,uDAAuD,CAAC,CAAC;QACvI,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,WAAW;YAAE,MAAM,YAAY,CAAC,+CAA+C,CAAC,CAAC;QACrI,MAAM,SAAS,GAAG,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;QAC9E,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;YAAE,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;QACxM,OAAO;IACT,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;IAC1E,MAAM,CAAC,CAAC,EAAE,CAAC,gBAAgB,EAAE,UAAU,EAAE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,aAAa,CAAC,CAAC;IAC1G,IAAI,CAAC,CAAC,cAAc,KAAK,KAAK;QAAE,WAAW,CAAC,gCAAgC,CAAC,CAAC;IAC9E,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,aAAa,CAAC,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,WAAW,IAAI,CAAC;QAAE,MAAM,YAAY,CAAC,qCAAqC,CAAC,CAAC;IAC/H,MAAM,WAAW,GAAG,MAAM,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,SAAS,EAAE,cAAc,CAAC,EAAE,oBAAoB,CAAC,CAAC;IACrJ,IAAI,WAAW,CAAC,YAAY,KAAK,QAAQ;QAAE,WAAW,CAAC,4CAA4C,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,aAAa,EAAE,kBAAkB,EAAE,aAAa,CAAC,EAAE,iBAAiB,CAAC,CAAC;IAC3G,IAAI,QAAQ,CAAC,gBAAgB,KAAK,UAAU;QAAE,WAAW,CAAC,+CAA+C,CAAC,CAAC;IAC3G,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,cAAc,CAAC,EAAE,6BAA6B,CAAC,CAAC;IACtI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;QAAE,MAAM,YAAY,CAAC,iCAAiC,CAAC,CAAC;IACvF,MAAM,OAAO,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,UAAU,CAAC,CAAC;QAC9D,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO;YAAE,WAAW,CAAC,gEAAgE,CAAC,CAAC;QAChH,OAAO,QAAQ,CAAC,MAAM,CAAC;IACzB,CAAC,CAAC,CAAC;IACH,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;QAAE,MAAM,YAAY,CAAC,8CAA8C,CAAC,CAAC;AACpJ,CAAC"}

package/dist/src/benchmarks/metrics.js

@@ -0,0 +1,16 @@
+import { HitchError } from "../foundation/index.js";
+export function mapBenchmarkMetrics(raw, manifest, task) {
+    const metrics = {};
+    for (const [name, spec] of Object.entries(manifest.metrics)) {
+        const field = task.grading.metric_map[name];
+        const value = raw && typeof raw === "object" && !Array.isArray(raw) ? raw[field] : undefined;
+        if (value === undefined)
+            throw new HitchError(`missing required grader metric: ${field}`, { code: "metric_missing", exitCode: 12 });
+        if (typeof value !== "number" || !Number.isFinite(value) || value < spec.range[0] || value > spec.range[1] || (spec.type === "binary" && value !== 0 && value !== 1)) {
+            throw new HitchError(`invalid grader metric: ${field}`, { code: "metric_invalid", exitCode: 12 });
+        }
+        metrics[name] = value;
+    }
+    return { primary: metrics[manifest.primary_metric], metrics };
+}
+//# sourceMappingURL=metrics.js.map

package/dist/src/benchmarks/metrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"metrics.js","sourceRoot":"","sources":["../../../src/benchmarks/metrics.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AAEpD,MAAM,UAAU,mBAAmB,CAAC,GAAY,EAAE,QAA6B,EAAE,IAAqB;IACpG,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAA+B,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC1H,IAAI,KAAK,KAAK,SAAS;YAAE,MAAM,IAAI,UAAU,CAAC,mCAAmC,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACpI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;YACrK,MAAM,IAAI,UAAU,CAAC,0BAA0B,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC,CAAC;QACpG,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAE,EAAE,OAAO,EAAE,CAAC;AACjE,CAAC"}

package/dist/src/benchmarks/toml.js

@@ -0,0 +1,13 @@
+import { parse } from "smol-toml";
+import { invalidInput } from "../foundation/index.js";
+/** Native Harbor tasks use multiline strings and nested array tables. Keep TOML
+ * parsing separate from protocol and capability validation. */
+export function parseBenchmarkToml(text) {
+    try {
+        return parse(text);
+    }
+    catch (error) {
+        throw invalidInput(`invalid benchmark TOML: ${error.message}`);
+    }
+}
+//# sourceMappingURL=toml.js.map

package/dist/src/benchmarks/toml.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toml.js","sourceRoot":"","sources":["../../../src/benchmarks/toml.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAEtD;+DAC+D;AAC/D,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC;QAAC,OAAO,KAAK,CAAC,IAAI,CAA4B,CAAC;IAAC,CAAC;IACtD,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,YAAY,CAAC,2BAA4B,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAAC,CAAC;AAC9F,CAAC"}

package/dist/src/benchmarks/validation.js

@@ -0,0 +1,242 @@
+import { HitchError, invalidInput } from "../foundation/index.js";
+export const BENCHMARK_CAPABILITIES = new Set([
+    "shell", "artifact-export", "separate-verifier", "shared-verifier", "compose", "tool-server@1", "http-json-cli", "hitch-hook@1",
+    "model-call@1", "native-image-input", "no-tools", "tool-result-images@1", "native-phases@1",
+]);
+export function unsupported(message) {
+    throw new HitchError(message, { code: "unsupported_feature", exitCode: 2 });
+}
+export function object(value, label) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw invalidInput(`${label} must be an object`);
+    return value;
+}
+export function fields(value, allowed, label) {
+    const result = object(value, label);
+    for (const key of Object.keys(result))
+        if (!allowed.includes(key))
+            unsupported(`${label}.${key} is unsupported`);
+    return result;
+}
+export function nonempty(value, label) {
+    if (typeof value !== "string" || !value.trim() || /[\0\r\n]/.test(value))
+        throw invalidInput(`${label} must be a nonempty string`);
+}
+export function strings(value, label) {
+    if (!Array.isArray(value))
+        throw invalidInput(`${label} must be an array`);
+    value.forEach((item) => nonempty(item, label));
+    if (new Set(value).size !== value.length)
+        throw invalidInput(`${label} contains duplicates`);
+}
+export function positive(value, label) {
+    if (!Number.isSafeInteger(value) || Number(value) < 1)
+        throw invalidInput(`${label} must be a positive integer`);
+}
+export function relativePath(value) {
+    nonempty(value, "package path");
+    if (/[\x00-\x1f\x7f\\:]/.test(value) || value.startsWith("/") || value.split("/").some((part) => ["", ".", ".."].includes(part))) {
+        throw invalidInput(`invalid package-relative path: ${value}`);
+    }
+    return value;
+}
+export function parseManifest(value) {
+    const m = fields(value, ["schema_version", "protocol", "id", "release", "task_root", "task_ids", "default_profile", "primary_metric", "task_format", "source", "metrics", "publication", "runtime_components", "extensions"], "manifest");
+    if (m.schema_version !== "1" || m.protocol !== "hitch-benchmark@1")
+        unsupported("unsupported benchmark protocol");
+    for (const key of ["id", "release", "primary_metric"])
+        nonempty(m[key], key);
+    relativePath(m.task_root);
+    relativePath(m.default_profile);
+    strings(m.task_ids, "task_ids");
+    if (!m.task_ids.length || m.task_ids.some((id) => !/^[a-zA-Z0-9][a-zA-Z0-9_.-]*$/.test(id)))
+        throw invalidInput("invalid or empty task membership");
+    const dialect = fields(m.task_format, ["name", "schema_version"], "task_format");
+    if (dialect.name !== "harbor" || dialect.schema_version !== "1.4")
+        unsupported("only Harbor schema 1.4 is supported");
+    const source = fields(m.source, ["kind", "path", "uri", "resolved_revision", "license", "access"], "source");
+    nonempty(source.license, "source.license");
+    if (source.access !== undefined && !["public", "private", "gated"].includes(String(source.access)))
+        throw invalidInput("invalid source access");
+    if (source.kind === "git") {
+        nonempty(source.uri, "source.uri");
+        let uri;
+        try {
+            uri = new URL(source.uri);
+        }
+        catch {
+            throw invalidInput("Git source requires a credential-free HTTPS URI");
+        }
+        if (uri.protocol !== "https:" || uri.username || uri.password || uri.search || uri.hash || source.path !== undefined)
+            throw invalidInput("Git source requires a credential-free HTTPS URI without a host path");
+        if (!/^[a-f0-9]{40}$/.test(String(source.resolved_revision)))
+            throw invalidInput("Git source requires a full resolved commit");
+    }
+    else if (source.kind !== "local")
+        unsupported("unsupported source kind");
+    else if (source.path !== "." || source.uri !== undefined || source.resolved_revision !== undefined)
+        throw invalidInput("local source must name package root '.'; its content identity is resolved by Hitch");
+    const metrics = object(m.metrics, "metrics");
+    if (!Object.hasOwn(metrics, m.primary_metric))
+        throw invalidInput("primary_metric must name a declared metric");
+    for (const [name, value] of Object.entries(metrics)) {
+        nonempty(name, "metric name");
+        const metric = fields(value, ["type", "direction", "range", "reducer"], `metrics.${name}`);
+        if (!["binary", "scalar"].includes(String(metric.type)) || !["maximize", "minimize"].includes(String(metric.direction)) || metric.reducer !== "task_macro_mean")
+            unsupported(`unsupported metric definition: ${name}`);
+        if (!Array.isArray(metric.range) || metric.range.length !== 2 || !metric.range.every((v) => typeof v === "number" && Number.isFinite(v)) || metric.range[0] > metric.range[1])
+            throw invalidInput(`invalid metric range: ${name}`);
+        if (metric.type === "binary" && JSON.stringify(metric.range) !== "[0,1]")
+            throw invalidInput("binary metrics require range [0,1]");
+    }
+    const publication = fields(m.publication, ["track", "training_eligible"], "publication");
+    if (!["custom", "public-subset"].includes(String(publication.track)) || publication.training_eligible !== false)
+        unsupported("MVP packages require custom/public-subset track and training_eligible=false");
+    m.runtime_components ??= [];
+    if (!Array.isArray(m.runtime_components))
+        throw invalidInput("runtime_components must be an array");
+    const ids = new Set();
+    for (const value of m.runtime_components) {
+        const component = fields(value, ["id", "protocol", "path"], "runtime component");
+        nonempty(component.id, "component.id");
+        nonempty(component.protocol, "component.protocol");
+        relativePath(component.path);
+        if (ids.has(component.id))
+            throw invalidInput("duplicate runtime component id");
+        ids.add(component.id);
+    }
+    return m;
+}
+export function parseProfile(value) {
+    const p = fields(value, ["schema_version", "id", "track", "input_mode", "tool_policy", "budget", "sampling", "grading", "extensions"], "profile");
+    if (p.schema_version !== "1" || p.input_mode !== "instruction")
+        unsupported("unsupported profile version/input mode");
+    nonempty(p.id, "profile.id");
+    if (!["custom", "public-subset"].includes(String(p.track)))
+        unsupported("unsupported profile track");
+    const policy = fields(p.tool_policy, ["id", "allowed", "network", "enforcement"], "tool_policy");
+    nonempty(policy.id, "tool_policy.id");
+    strings(policy.allowed, "tool_policy.allowed");
+    if (policy.network !== "open" || policy.enforcement !== "required")
+        unsupported("this backend profile currently supports explicit open network only");
+    if (policy.allowed.some((c) => !BENCHMARK_CAPABILITIES.has(c)))
+        unsupported("unknown allowed tool capability");
+    const budget = fields(p.budget, ["agent_timeout", "setup_timeout_ms", "collection_timeout_ms", "cleanup_grace_ms"], "budget");
+    const timeout = fields(budget.agent_timeout, ["source"], "agent_timeout");
+    if (timeout.source !== "task")
+        unsupported("agent timeout must inherit task");
+    for (const key of ["setup_timeout_ms", "collection_timeout_ms", "cleanup_grace_ms"])
+        positive(budget[key], key);
+    const sampling = fields(p.sampling, ["attempts_per_task", "seed"], "sampling");
+    positive(sampling.attempts_per_task, "attempts_per_task");
+    if (!Number.isSafeInteger(sampling.seed))
+        throw invalidInput("seed must be an integer");
+    const grading = fields(p.grading, ["on_agent_budget_exhausted", "on_missing_submission", "infrastructure_retries"], "grading");
+    if (grading.on_agent_budget_exhausted !== "grade_final_state" || grading.on_missing_submission !== "error")
+        unsupported("unsupported grading policy");
+    if (!Number.isSafeInteger(grading.infrastructure_retries) || Number(grading.infrastructure_retries) < 0)
+        throw invalidInput("invalid grading retries");
+    return p;
+}
+export function parseTask(value, manifest) {
+    const t = fields(value, ["schema_version", "source_task_id", "driver", "requirements", "lifecycle", "submission", "grading", "extensions"], "task");
+    if (t.schema_version !== "1")
+        unsupported("unsupported task extension version");
+    nonempty(t.source_task_id, "source_task_id");
+    strings(t.requirements, "requirements");
+    for (const cap of t.requirements)
+        if (!BENCHMARK_CAPABILITIES.has(cap))
+            unsupported(`required capability unavailable: ${cap}`);
+    const driver = fields(t.driver, ["kind", "protocol_version", "config"], "driver");
+    if (!["tool-server", "terminal", "model-call"].includes(String(driver.kind)) || driver.protocol_version !== "1")
+        unsupported("unsupported driver protocol");
+    const required = driver.kind === "model-call" ? ["model-call@1", "native-image-input", "no-tools", "artifact-export", "separate-verifier"] : driver.kind === "terminal" ? ["shell"] : ["shell", "tool-server@1", "http-json-cli", "hitch-hook@1", "separate-verifier", "compose", "artifact-export"];
+    for (const cap of required)
+        if (!t.requirements.includes(cap))
+            throw invalidInput(`${driver.kind} driver requires capability ${cap}`);
+    if (t.requirements.includes("tool-result-images@1") && (driver.kind !== "tool-server" || !t.requirements.includes("native-image-input")))
+        throw invalidInput("tool-result-images@1 requires a tool-server driver and native-image-input");
+    if (driver.kind !== "tool-server") {
+        const config = fields(driver.config, driver.kind === "model-call" ? ["input"] : [], "driver.config");
+        if (driver.kind === "model-call")
+            relativePath(config.input);
+        if (driver.kind !== "model-call" && t.requirements.includes("no-tools"))
+            unsupported("only the trusted model-call runner enforces no-tools");
+        fields(t.lifecycle, [], "native lifecycle (Harbor owns the lifecycle)");
+    }
+    else {
+        const config = fields(driver.config, ["transport", "endpoint", "schema", "service", "native_phases"], "driver.config");
+        if (config.transport !== "http-json-cli")
+            unsupported("unsupported tool-server transport");
+        nonempty(config.service, "tool service");
+        if (!/^[a-z][a-z0-9_-]*$/.test(config.service) || config.service === "main")
+            throw invalidInput("tool service must be a sidecar");
+        nonempty(config.endpoint, "tool endpoint");
+        const url = new URL(config.endpoint);
+        if (url.protocol !== "http:" || url.hostname !== config.service || url.username || url.password || url.search || url.hash || url.pathname !== "/")
+            throw invalidInput("tool endpoint must target the declared isolated Compose service root");
+        relativePath(config.schema);
+        if (config.native_phases !== undefined) {
+            const phases = fields(config.native_phases, ["protocol", "argv", "audit_path", "shutdown_timeout_ms", "finalization_timeout_ms"], "native_phases");
+            if (!["hitch-native-phase-control@1", "hitch-native-phase-control@2"].includes(String(phases.protocol)))
+                unsupported("unsupported native phase protocol");
+            if (phases.protocol === "hitch-native-phase-control@2")
+                positive(phases.finalization_timeout_ms, "native finalization timeout");
+            else if (phases.finalization_timeout_ms !== undefined)
+                throw invalidInput("native finalization requires control protocol v2");
+            if (!Array.isArray(phases.argv) || !phases.argv.length || phases.argv.length > 32)
+                throw invalidInput("invalid native phase controller argv");
+            phases.argv.forEach(arg => { nonempty(arg, "native phase argv"); if (arg.length > 8192)
+                throw invalidInput("native phase argv too long"); });
+            positive(phases.shutdown_timeout_ms, "phase shutdown timeout");
+            if (phases.shutdown_timeout_ms > 600000)
+                throw invalidInput("native phase shutdown allowance too large");
+            nonempty(phases.audit_path, "native phase audit path");
+            if (!phases.audit_path.startsWith("/") || phases.audit_path.slice(1).split("/").some(p => !p || p === "." || p === "..") || /[\\\x00-\x1f\x7f]/.test(phases.audit_path))
+                throw invalidInput("invalid native phase audit path");
+            for (const cap of ["native-phases@1", "native-image-input", "tool-result-images@1"])
+                if (!t.requirements.includes(cap))
+                    throw invalidInput(`native phases require ${cap}`);
+        }
+        const lifecycle = fields(t.lifecycle, ["prepare", "quiesce", "snapshot", "cleanup"], "lifecycle");
+        for (const phase of ["prepare", "quiesce", "snapshot", "cleanup"]) {
+            const hook = fields(lifecycle[phase], ["protocol", "target", "argv", "timeout_ms"], `hook.${phase}`);
+            if (hook.protocol !== "hitch-hook@1" || hook.target !== `environment:${config.service}`)
+                unsupported(`unsupported hook target/protocol: ${phase}`);
+            // Repeated argv values are valid, unlike membership lists.
+            if (!Array.isArray(hook.argv) || !hook.argv.length)
+                throw invalidInput(`missing hook argv: ${phase}`);
+            hook.argv.forEach((arg) => nonempty(arg, "hook argv"));
+            positive(hook.timeout_ms, "hook timeout");
+        }
+    }
+    if (t.requirements.includes("native-phases@1") && (driver.kind !== "tool-server" || !driver.config.native_phases))
+        throw invalidInput("native-phases@1 requires a native phase controller");
+    const submission = fields(t.submission, ["kind", "paths", "max_bytes", "final_response"], "submission");
+    if (submission.kind !== "artifacts" && !(driver.kind === "terminal" && submission.kind === "environment"))
+        unsupported("unsupported submission");
+    strings(submission.paths, "submission.paths");
+    positive(submission.max_bytes, "submission.max_bytes");
+    if ((submission.kind === "artifacts" && !submission.paths.length) || submission.paths.some((p) => !p.startsWith("/") || p.split("/").includes("..")))
+        throw invalidInput("submission paths must be absolute safe container paths");
+    if (submission.kind === "environment" && submission.paths.length)
+        throw invalidInput("environment submission uses the upstream verifier's live workspace, not artifact paths");
+    if (driver.kind === "tool-server") {
+        const phases = driver.config.native_phases;
+        if (phases && !submission.paths.some(p => phases.audit_path === p || phases.audit_path.startsWith(p.replace(/\/$/, "") + "/")))
+            throw invalidInput("native audit must be in a declared controller snapshot");
+    }
+    if (submission.final_response !== undefined && (submission.final_response !== "/hitch-evidence/final-response.json" || !submission.paths.includes(submission.final_response) || driver.kind === "tool-server"))
+        throw invalidInput("invalid final response export");
+    if (driver.kind === "model-call" && !submission.final_response)
+        throw invalidInput("model-call requires canonical final response export");
+    const grading = fields(t.grading, ["kind", "entrypoint", "metric_map"], "grading");
+    if ((grading.kind !== "command" && !(driver.kind === "terminal" && grading.kind === "harbor")) || JSON.stringify(grading.entrypoint) !== '["bash","/tests/test.sh"]')
+        unsupported("unsupported grader command");
+    const mapping = object(grading.metric_map, "metric_map");
+    if (Object.keys(mapping).sort().join("\0") !== Object.keys(manifest.metrics).sort().join("\0"))
+        throw invalidInput("metric_map must cover exactly the declared metrics");
+    Object.values(mapping).forEach((v) => nonempty(v, "metric mapping"));
+    return t;
+}
+//# sourceMappingURL=validation.js.map