openpond-sdk 0.12.10 → 0.12.12

package/LEARNING.md

@@ -154,3 +154,14 @@ or known eligible boundaries. Changed originals require a new policy.
 false when unreadable originals are excluded. `coverage.excludedSessions` retains
 their count. These fields establish inventory reconciliation only; reconstructed
 tasks still need their own starting-state and grader qualification.
+
+### Bounded tool episode records
+
+`openpond-sdk/tool-learning` exports `assembleToolLearningEpisode`. Episode reads
+retain the original events plus an `assembly` with structural application/tool
+version groups and an explicit `incomplete`, `ambiguous`, or
+`awaiting_owner_review` state. Missing observations stay incomplete; contradictory
+terminal observations or mismatched call references stay ambiguous. Delivery
+order does not select a preferred outcome. The SDK checks assembly against the
+returned events. These records grant neither verification nor learning authority;
+owner review and canonical grading/admission remain separate.

package/README.md

@@ -1,5 +1,7 @@
 # `openpond-sdk`
 
+See [tool learning](./TOOL_LEARNING.md) for scoped tool capture, private recovery evidence, and metered specialist consultation.
+
 See [task evidence and learning](./LEARNING.md) for reusable Rewards, task-format publication, SDK/HTTP intake, grading, review and approved batches.
 
 The OpenPond SDK is the server-side TypeScript client for running agentic work in OpenPond sandboxes. It gives Node.js applications, Next.js route handlers, workers, and backend services a small API for creating sandboxes, executing commands, managing files and runtimes, and running a model/tool loop in an isolated workspace.

package/dist/advanced-refiner-evaluations.js

@@ -12,18 +12,18 @@ import {
   sealAdvancedRefinerEvaluationPin,
   sealAdvancedRefinerReviewReceipt,
   verifyAdvancedRefinerEvaluationPin
-} from "./chunk-ZZZU6XER.js";
-import "./chunk-LKKKTBLL.js";
+} from "./chunk-UWY5PUHR.js";
+import "./chunk-O3NOGKMT.js";
 import "./chunk-3B5KSH3V.js";
 import "./chunk-H3367ISL.js";
-import "./chunk-GIEST52U.js";
+import "./chunk-LHHHJIDR.js";
 import "./chunk-O6FKHAWN.js";
-import "./chunk-HDKP6KE2.js";
-import "./chunk-IIQENUOK.js";
-import "./chunk-LT2YQCZI.js";
-import "./chunk-BQ2C2Y54.js";
-import "./chunk-B3ZHJ2KK.js";
+import "./chunk-C4W2MEFP.js";
+import "./chunk-ZYDDHHZZ.js";
+import "./chunk-RLW4Y5ZV.js";
+import "./chunk-UOV2LEXS.js";
 import "./chunk-CL3IOOVL.js";
+import "./chunk-B3ZHJ2KK.js";
 import "./chunk-H3JZ3P5T.js";
 import "./chunk-YLJ4XMA6.js";
 export {

package/dist/candidate-evaluations.js

@@ -5,14 +5,14 @@ import {
   CandidateEvaluationPreparationSchema,
   CandidateEvaluationRequestSchema,
   createCandidateEvaluationClient
-} from "./chunk-XJKGCU2K.js";
-import "./chunk-7FYPFHCQ.js";
-import "./chunk-HDKP6KE2.js";
-import "./chunk-IIQENUOK.js";
-import "./chunk-LT2YQCZI.js";
-import "./chunk-BQ2C2Y54.js";
-import "./chunk-B3ZHJ2KK.js";
+} from "./chunk-CNREFTAV.js";
+import "./chunk-K54BDIKL.js";
+import "./chunk-C4W2MEFP.js";
+import "./chunk-ZYDDHHZZ.js";
+import "./chunk-RLW4Y5ZV.js";
+import "./chunk-UOV2LEXS.js";
 import "./chunk-CL3IOOVL.js";
+import "./chunk-B3ZHJ2KK.js";
 import "./chunk-H3JZ3P5T.js";
 import "./chunk-YLJ4XMA6.js";
 export {

package/dist/{chunk-QQ444G6A.js → chunk-2LVR24GU.js}

@@ -6,7 +6,7 @@ import {
   ExperimentImprovementTestRecipeSchema,
   verifyExperimentImprovementHumanOptions,
   verifyExperimentImprovementState
-} from "./chunk-LKKKTBLL.js";
+} from "./chunk-O3NOGKMT.js";
 import {
   fetchConnectedJson
 } from "./chunk-O6FKHAWN.js";
@@ -157,4 +157,4 @@ export {
   HostedProfileCandidateCommandSchema,
   ExperimentImprovementClient
 };
-//# sourceMappingURL=chunk-QQ444G6A.js.map
+//# sourceMappingURL=chunk-2LVR24GU.js.map

package/dist/{chunk-5QMREXMU.js → chunk-7BYLH47N.js}

@@ -1,9 +1,9 @@
 import {
   RunExperimentSchema
-} from "./chunk-7FYPFHCQ.js";
+} from "./chunk-K54BDIKL.js";
 import {
   HostedModelProjectSummarySchema
-} from "./chunk-BQ2C2Y54.js";
+} from "./chunk-UOV2LEXS.js";
 import {
   OpenPondProtocolError,
   canonicalSha256
@@ -295,4 +295,4 @@ export {
   HostedTrainingPolicyControlSchema,
   TrainingHandoffOriginSchema2 as TrainingHandoffOriginSchema
 };
-//# sourceMappingURL=chunk-5QMREXMU.js.map
+//# sourceMappingURL=chunk-7BYLH47N.js.map

package/dist/{chunk-RYDUAY52.js → chunk-C3TS766N.js}

@@ -2,60 +2,16 @@ import {
   OpenPondLearningError
 } from "./chunk-U2KGUAIS.js";
 import {
-  ReleaseIdSchema
-} from "./chunk-H3JZ3P5T.js";
-
-// src/learning-credentials.ts
-import { z } from "zod";
-import { LearningRevisionRefSchema } from "@openpond/evals/learning";
-import { TaskSplitSchema } from "@openpond/evals/tasksets";
-var LearningSourceCredentialSchema = z.object({
-  id: ReleaseIdSchema,
-  scope: ReleaseIdSchema,
-  sourceId: ReleaseIdSchema,
-  name: z.string().trim().min(1).max(100),
-  keyPrefix: z.string().min(1).max(100),
-  createdAt: z.iso.datetime(),
-  expiresAt: z.iso.datetime(),
-  revokedAt: z.iso.datetime().nullable()
-}).strict();
-var LearningSourceCredentialSecretSchema = z.string().regex(/^opk_key_[A-Za-z0-9]{16}_[A-Za-z0-9]{48}$/);
-var LearningSourceCredentialRequestSchema = z.discriminatedUnion("action", [
-  z.object({ action: z.literal("create"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, name: z.string().trim().min(1).max(100), expiresAt: z.iso.datetime(), operationId: ReleaseIdSchema, apiKey: LearningSourceCredentialSecretSchema }).strict(),
-  z.object({ action: z.literal("list"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, afterId: ReleaseIdSchema.optional(), limit: z.number().int().min(1).max(100).default(30) }).strict(),
-  z.object({ action: z.literal("revoke"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, id: ReleaseIdSchema }).strict()
-]);
-var LearningSourceCredentialCreatedSchema = z.object({ credential: LearningSourceCredentialSchema, apiKey: LearningSourceCredentialSecretSchema }).strict();
-var LearningSourceCredentialPageSchema = z.object({ items: z.array(LearningSourceCredentialSchema).max(100), nextCursor: ReleaseIdSchema.nullable() }).strict();
-var LearningSourceConfigurationRequestSchema = z.object({ scope: ReleaseIdSchema, sourceId: ReleaseIdSchema }).strict();
-var LearningSourceConfigurationSchema = z.object({
-  scope: ReleaseIdSchema,
-  source: LearningRevisionRefSchema,
-  taskDefinition: LearningRevisionRefSchema,
-  enabled: z.boolean(),
-  allowedSplits: z.array(TaskSplitSchema).min(1).max(4)
-}).strict();
-function createSourceCredentialRequest(input) {
-  return { ...input, operationId: crypto.randomUUID(), apiKey: `opk_key_${randomToken(16)}_${randomToken(48)}` };
-}
-function randomToken(length) {
-  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
-  let value = "";
-  while (value.length < length) {
-    for (const byte of crypto.getRandomValues(new Uint8Array(64))) {
-      if (byte < 248) value += alphabet[byte % 62];
-      if (value.length === length) return value;
-    }
-  }
-  return value;
-}
-function assertLearningCredentialExpiry(expiresAt, now) {
-  const expires = Date.parse(z.iso.datetime().parse(expiresAt));
-  if (expires <= now.getTime() || expires > now.getTime() + 90 * 24 * 60 * 60 * 1e3) throw new Error("Source credentials must expire within 90 days.");
-}
+  LearningSourceConfigurationRequestSchema,
+  LearningSourceConfigurationSchema,
+  LearningSourceCredentialCreatedSchema,
+  LearningSourceCredentialPageSchema,
+  LearningSourceCredentialRequestSchema,
+  LearningSourceCredentialSchema
+} from "./chunk-IZ26ZCGU.js";
 
 // src/learning-client.ts
-import { z as z2 } from "zod";
+import { z } from "zod";
 import {
   LearningCommandRequestSchema,
   LearningOperationResultSchema,
@@ -68,17 +24,17 @@ import {
   learningResourceSchemas
 } from "@openpond/evals/learning";
 import { assertBoundedTaskJson } from "@openpond/evals/task-schema";
-var LearningBatchPublicationSchema = z2.object({
-  batchId: z2.string().trim().min(1).max(500),
-  modelProjectId: z2.string().trim().min(1).max(500)
+var LearningBatchPublicationSchema = z.object({
+  batchId: z.string().trim().min(1).max(500),
+  modelProjectId: z.string().trim().min(1).max(500)
 }).strict();
-var LearningBatchPublicationResultSchema = z2.object({
-  batchId: z2.string().min(1),
-  projectId: z2.string().min(1),
-  tasksetId: z2.string().min(1),
-  releaseId: z2.string().min(1),
-  revision: z2.number().int().positive(),
-  contentHash: z2.string().regex(/^[a-f0-9]{64}$/)
+var LearningBatchPublicationResultSchema = z.object({
+  batchId: z.string().min(1),
+  projectId: z.string().min(1),
+  tasksetId: z.string().min(1),
+  releaseId: z.string().min(1),
+  revision: z.number().int().positive(),
+  contentHash: z.string().regex(/^[a-f0-9]{64}$/)
 }).strict();
 var OpenPondLearningClient = class {
   #options;
@@ -158,7 +114,7 @@ var OpenPondLearningClient = class {
   }
   async list(kind, query = {}, options = {}) {
     const request = LearningReadRequestSchema.parse({ action: "list", scope: this.#options.scope, kind, ...query });
-    return z2.object({ items: z2.array(learningResourceSchemas[kind]).max(100), nextCursor: z2.string().nullable() }).strict().parse(await this.#request("read", request, options));
+    return z.object({ items: z.array(learningResourceSchemas[kind]).max(100), nextCursor: z.string().nullable() }).strict().parse(await this.#request("read", request, options));
   }
   /** Hosted publication only: stores an immutable package and attaches it, without starting training. */
   async publishBatch(input, options = {}) {
@@ -178,7 +134,7 @@ var OpenPondLearningClient = class {
     });
     const payload = await readBoundedLearningResponse(response);
     if (!response.ok) {
-      const error = z2.object({ code: z2.string().optional(), error: z2.string().optional() }).passthrough().safeParse(payload);
+      const error = z.object({ code: z.string().optional(), error: z.string().optional() }).passthrough().safeParse(payload);
       throw new OpenPondLearningError(response.status, error.success ? error.data.code ?? "learning_request_failed" : "learning_request_failed", error.success ? error.data.error ?? `Learning request failed (${response.status}).` : `Learning request failed (${response.status}).`, payload);
     }
     return payload;
@@ -210,18 +166,9 @@ async function readBoundedLearningResponse(response) {
 }
 
 export {
-  LearningSourceCredentialSchema,
-  LearningSourceCredentialSecretSchema,
-  LearningSourceCredentialRequestSchema,
-  LearningSourceCredentialCreatedSchema,
-  LearningSourceCredentialPageSchema,
-  LearningSourceConfigurationRequestSchema,
-  LearningSourceConfigurationSchema,
-  createSourceCredentialRequest,
-  assertLearningCredentialExpiry,
   LearningBatchPublicationSchema,
   LearningBatchPublicationResultSchema,
   OpenPondLearningClient,
   readBoundedLearningResponse
 };
-//# sourceMappingURL=chunk-RYDUAY52.js.map
+//# sourceMappingURL=chunk-C3TS766N.js.map

package/dist/chunk-C3TS766N.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/learning-client.ts"],"sourcesContent":["import { OpenPondLearningError } from \"./learning-error.js\";\nexport { OpenPondLearningError } from \"./learning-error.js\";\nimport { z } from \"zod\";\nimport {\n  LearningCommandRequestSchema, LearningOperationResultSchema, LearningReadRequestSchema,\n  TaskEvidenceInspectionResultSchema, sameLearningRef, type LearningRevisionRef,\n  LearningPolicyInspectionResultSchema,\n  LearningTaskQueueInspectionSchema,\n  assertLearningRequestJson,\n  learningResourceSchemas, type LearningCommand, type LearningOperationResult,\n  type LearningResourceFor, type LearningResourceKind, type LearningResourcePage,\n  type LearningResourceQuery, type TaskExampleSubmission, type TaskFeedbackSubmission,\n} from \"@openpond/evals/learning\";\nimport { assertBoundedTaskJson } from \"@openpond/evals/task-schema\";\nimport { LearningSourceCredentialSchema, LearningSourceCredentialRequestSchema, LearningSourceCredentialCreatedSchema, LearningSourceCredentialPageSchema, LearningSourceConfigurationRequestSchema, LearningSourceConfigurationSchema, type LearningSourceCredentialRequest } from \"./learning-credentials.js\";\n\nexport interface OpenPondLearningClientOptions {\n  apiKey: string;\n  baseUrl: string;\n  /** Local profile or hosted team scope. The server checks the credential's ownership. */\n  scope: string;\n  fetch?: typeof globalThis.fetch;\n}\nexport interface LearningRequestOptions { signal?: AbortSignal }\nexport const LearningBatchPublicationSchema = z.object({\n  batchId: z.string().trim().min(1).max(500), modelProjectId: z.string().trim().min(1).max(500),\n}).strict();\nexport const LearningBatchPublicationResultSchema = z.object({\n  batchId: z.string().min(1), projectId: z.string().min(1), tasksetId: z.string().min(1),\n  releaseId: z.string().min(1), revision: z.number().int().positive(), contentHash: z.string().regex(/^[a-f0-9]{64}$/),\n}).strict();\n/** The same portable commands are sent to the local and hosted execution owner. */\nexport class OpenPondLearningClient {\n  readonly #options: OpenPondLearningClientOptions;\n  constructor(options: OpenPondLearningClientOptions) {\n    if (!options.apiKey.trim() || !options.scope.trim()) throw new Error(\"Learning API key and scope are required.\");\n    const url = new URL(options.baseUrl);\n    if (![\"http:\", \"https:\"].includes(url.protocol) || url.username || url.password || url.search || url.hash) throw new Error(\"Learning base URL must be an HTTP(S) endpoint without credentials, query, or fragment.\");\n    this.#options = { ...options, baseUrl: url.toString().replace(/\\/+$/, \"\") };\n  }\n\n  async command(command: LearningCommand, options: LearningRequestOptions = {}): Promise<LearningOperationResult> {\n    assertLearningRequestJson(command);\n    const request = LearningCommandRequestSchema.parse({ scope: this.#options.scope, command });\n    const result = LearningOperationResultSchema.parse(await this.#request(\"commands\", request, options));\n    if (result.operationId !== command.operationId) throw new OpenPondLearningError(502, \"operation_identity_mismatch\", \"Learning response did not match the submitted operation.\", null);\n    return result;\n  }\n\n  submitExample(example: TaskExampleSubmission, options: LearningRequestOptions = {}) {\n    return this.command({ action: \"submit_example\", operationId: example.idempotencyKey, example }, options);\n  }\n\n  submitFeedback(feedback: TaskFeedbackSubmission, options: LearningRequestOptions = {}) {\n    return this.command({ action: \"submit_feedback\", operationId: feedback.idempotencyKey, feedback }, options);\n  }\n\n  async get<K extends LearningResourceKind>(kind: K, id: string, revision?: number, options: LearningRequestOptions = {}): Promise<LearningResourceFor<K>> {\n    const request = LearningReadRequestSchema.parse({ action: \"get\", scope: this.#options.scope, kind, id, ...(revision === undefined ? {} : { revision }) });\n    return learningResourceSchemas[kind].parse(await this.#request(\"read\", request, options)) as LearningResourceFor<K>;\n  }\n\n  async inspectEvidence(evidence: LearningRevisionRef, options: LearningRequestOptions = {}) {\n    const request = LearningReadRequestSchema.parse({ action: \"inspect_evidence\", scope: this.#options.scope, evidence });\n    const result = TaskEvidenceInspectionResultSchema.parse(await this.#request(\"read\", request, options));\n    if (!sameLearningRef(result.evidence, evidence)) throw new OpenPondLearningError(502, \"evidence_identity_mismatch\", \"Inspection did not match the requested evidence release.\", null);\n    return result;\n  }\n\n  /** Read current shared eligibility and budget without reserving or launching work. */\n  async inspectTaskQueue(modelProjectId: string | null = null, options: LearningRequestOptions = {}) {\n    const request = LearningReadRequestSchema.parse({ action: \"inspect_task_queue\", scope: this.#options.scope, modelProjectId });\n    const result = LearningTaskQueueInspectionSchema.parse(await this.#request(\"read\", request, options));\n    if (result.modelProjectId !== modelProjectId) throw new OpenPondLearningError(502, \"model_identity_mismatch\", \"Task queue did not match the requested Model.\", null);\n    return result;\n  }\n\n  /** Read current shared eligibility and budget without reserving or launching work. */\n  async inspectPolicy(policy: LearningRevisionRef, options: LearningRequestOptions = {}) {\n    const request = LearningReadRequestSchema.parse({ action: \"inspect_policy\", scope: this.#options.scope, policy });\n    const result = LearningPolicyInspectionResultSchema.parse(await this.#request(\"read\", request, options));\n    if (!sameLearningRef(result.policy, policy)) throw new OpenPondLearningError(502, \"policy_identity_mismatch\", \"Inspection did not match the requested policy release.\", null);\n    return result;\n  }\n\n  /** Prepare once with createSourceCredentialRequest and reuse it for retries. */\n  async createSourceCredential(input: Omit<Extract<LearningSourceCredentialRequest, { action: \"create\" }>, \"action\" | \"scope\">, options: LearningRequestOptions = {}) {\n    const request = LearningSourceCredentialRequestSchema.parse({ ...input, action: \"create\", scope: this.#options.scope });\n    const result = LearningSourceCredentialCreatedSchema.parse(await this.#request(\"credentials\", request, options));\n    this.#assertCredentialScope(result.credential, input.sourceId);\n    if (result.apiKey !== input.apiKey || !input.apiKey.startsWith(`${result.credential.keyPrefix}_`)) throw new OpenPondLearningError(502, \"credential_identity_mismatch\", \"Credential response did not match the prepared credential.\", null);\n    return result;\n  }\n\n  async listSourceCredentials(sourceId: string, query: { afterId?: string; limit?: number } = {}, options: LearningRequestOptions = {}) {\n    const request = LearningSourceCredentialRequestSchema.parse({ ...query, action: \"list\", scope: this.#options.scope, sourceId });\n    const result = LearningSourceCredentialPageSchema.parse(await this.#request(\"credentials\", request, options));\n    if (result.items.length > (query.limit ?? 30)) throw new OpenPondLearningError(502, \"credential_page_invalid\", \"Credential response exceeded the requested page size.\", null);\n    for (const item of result.items) this.#assertCredentialScope(item, sourceId);\n    return result;\n  }\n\n  async revokeSourceCredential(sourceId: string, id: string, options: LearningRequestOptions = {}) {\n    const request = LearningSourceCredentialRequestSchema.parse({ action: \"revoke\", scope: this.#options.scope, sourceId, id });\n    const result = LearningSourceCredentialSchema.parse(await this.#request(\"credentials\", request, options));\n    this.#assertCredentialScope(result, sourceId);\n    if (result.id !== id || result.revokedAt === null) throw new OpenPondLearningError(502, \"credential_revocation_mismatch\", \"Credential revocation did not match the requested credential.\", null);\n    return result;\n  }\n\n  async sourceConfiguration(sourceId: string, options: LearningRequestOptions = {}) {\n    const request = LearningSourceConfigurationRequestSchema.parse({ scope: this.#options.scope, sourceId });\n    const result = LearningSourceConfigurationSchema.parse(await this.#request(\"source-config\", request, options));\n    if (result.scope !== this.#options.scope || result.source.id !== sourceId) throw new OpenPondLearningError(502, \"source_identity_mismatch\", \"Source configuration did not match the requested source.\", null);\n    return result;\n  }\n\n  #assertCredentialScope(value: { scope: string; sourceId: string }, sourceId: string) {\n    if (value.scope !== this.#options.scope || value.sourceId !== sourceId) throw new OpenPondLearningError(502, \"credential_scope_mismatch\", \"Credential response did not match the requested source.\", null);\n  }\n\n  async list<K extends LearningResourceKind>(kind: K, query: Partial<LearningResourceQuery> = {}, options: LearningRequestOptions = {}): Promise<LearningResourcePage<K>> {\n    const request = LearningReadRequestSchema.parse({ action: \"list\", scope: this.#options.scope, kind, ...query });\n    return z.object({ items: z.array(learningResourceSchemas[kind]).max(100), nextCursor: z.string().nullable() }).strict().parse(await this.#request(\"read\", request, options)) as LearningResourcePage<K>;\n  }\n\n  /** Hosted publication only: stores an immutable package and attaches it, without starting training. */\n  async publishBatch(input: z.infer<typeof LearningBatchPublicationSchema>, options: LearningRequestOptions = {}) {\n    const request = LearningBatchPublicationSchema.parse(input);\n    const result = LearningBatchPublicationResultSchema.parse(await this.#request(\"publish-batch\", { ...request, scope: this.#options.scope }, options));\n    if (result.batchId !== request.batchId) throw new OpenPondLearningError(502, \"batch_identity_mismatch\", \"Published batch response did not match the requested batch.\", null);\n    return result;\n  }\n\n  async #request(endpoint: \"commands\" | \"read\" | \"publish-batch\" | \"credentials\" | \"source-config\", body: unknown, options: LearningRequestOptions): Promise<unknown> {\n    assertBoundedTaskJson(body, 16_777_216);\n    const response = await (this.#options.fetch ?? globalThis.fetch)(`${this.#options.baseUrl}/v1/learning/${endpoint}`, {\n      method: \"POST\", headers: { Authorization: `Bearer ${this.#options.apiKey}`, \"Content-Type\": \"application/json\", Accept: \"application/json\", \"X-OpenPond-Team-Id\": this.#options.scope }, body: JSON.stringify(body), signal: options.signal,\n      redirect: \"error\",\n    });\n    const payload = await readBoundedLearningResponse(response);\n    if (!response.ok) {\n      const error = z.object({ code: z.string().optional(), error: z.string().optional() }).passthrough().safeParse(payload);\n      throw new OpenPondLearningError(response.status, error.success ? error.data.code ?? \"learning_request_failed\" : \"learning_request_failed\", error.success ? error.data.error ?? `Learning request failed (${response.status}).` : `Learning request failed (${response.status}).`, payload);\n    }\n    return payload;\n  }\n}\n\nexport async function readBoundedLearningResponse(response: Response): Promise<unknown> {\n  const maximumBytes = 16_777_216;\n  const reader = response.body?.getReader();\n  if (!reader) throw new OpenPondLearningError(response.status, \"empty_response\", \"Learning response was empty.\", null);\n  const decoder = new TextDecoder();\n  let bytes = 0;\n  let text = \"\";\n  try {\n    while (true) {\n      const next = await reader.read();\n      if (next.done) break;\n      bytes += next.value.byteLength;\n      if (bytes > maximumBytes) throw new OpenPondLearningError(response.status, \"response_too_large\", \"Learning response exceeded 16 MiB; request a smaller page.\", null);\n      text += decoder.decode(next.value, { stream: true });\n    }\n    text += decoder.decode();\n    const value: unknown = JSON.parse(text);\n    assertBoundedTaskJson(value, maximumBytes);\n    return value;\n  } finally {\n    await reader.cancel();\n    reader.releaseLock();\n  }\n}\n"],"mappings":";;;;;;;;;;;;;AAEA,SAAS,SAAS;AAClB;AAAA,EACE;AAAA,EAA8B;AAAA,EAA+B;AAAA,EAC7D;AAAA,EAAoC;AAAA,EACpC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;AACP,SAAS,6BAA6B;AAW/B,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAAG,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAC9F,CAAC,EAAE,OAAO;AACH,IAAM,uCAAuC,EAAE,OAAO;AAAA,EAC3D,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAAG,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAAG,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EACrF,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC;AAAA,EAAG,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAAG,aAAa,EAAE,OAAO,EAAE,MAAM,gBAAgB;AACrH,CAAC,EAAE,OAAO;AAEH,IAAM,yBAAN,MAA6B;AAAA,EACzB;AAAA,EACT,YAAY,SAAwC;AAClD,QAAI,CAAC,QAAQ,OAAO,KAAK,KAAK,CAAC,QAAQ,MAAM,KAAK,EAAG,OAAM,IAAI,MAAM,0CAA0C;AAC/G,UAAM,MAAM,IAAI,IAAI,QAAQ,OAAO;AACnC,QAAI,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAAK,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,KAAM,OAAM,IAAI,MAAM,wFAAwF;AACnN,SAAK,WAAW,EAAE,GAAG,SAAS,SAAS,IAAI,SAAS,EAAE,QAAQ,QAAQ,EAAE,EAAE;AAAA,EAC5E;AAAA,EAEA,MAAM,QAAQ,SAA0B,UAAkC,CAAC,GAAqC;AAC9G,8BAA0B,OAAO;AACjC,UAAM,UAAU,6BAA6B,MAAM,EAAE,OAAO,KAAK,SAAS,OAAO,QAAQ,CAAC;AAC1F,UAAM,SAAS,8BAA8B,MAAM,MAAM,KAAK,SAAS,YAAY,SAAS,OAAO,CAAC;AACpG,QAAI,OAAO,gBAAgB,QAAQ,YAAa,OAAM,IAAI,sBAAsB,KAAK,+BAA+B,4DAA4D,IAAI;AACpL,WAAO;AAAA,EACT;AAAA,EAEA,cAAc,SAAgC,UAAkC,CAAC,GAAG;AAClF,WAAO,KAAK,QAAQ,EAAE,QAAQ,kBAAkB,aAAa,QAAQ,gBAAgB,QAAQ,GAAG,OAAO;AAAA,EACzG;AAAA,EAEA,eAAe,UAAkC,UAAkC,CAAC,GAAG;AACrF,WAAO,KAAK,QAAQ,EAAE,QAAQ,mBAAmB,aAAa,SAAS,gBAAgB,SAAS,GAAG,OAAO;AAAA,EAC5G;AAAA,EAEA,MAAM,IAAoC,MAAS,IAAY,UAAmB,UAAkC,CAAC,GAAoC;AACvJ,UAAM,UAAU,0BAA0B,MAAM,EAAE,QAAQ,OAAO,OAAO,KAAK,SAAS,OAAO,MAAM,IAAI,GAAI,aAAa,SAAY,CAAC,IAAI,EAAE,SAAS,EAAG,CAAC;AACxJ,WAAO,wBAAwB,IAAI,EAAE,MAAM,MAAM,KAAK,SAAS,QAAQ,SAAS,OAAO,CAAC;AAAA,EAC1F;AAAA,EAEA,MAAM,gBAAgB,UAA+B,UAAkC,CAAC,GAAG;AACzF,UAAM,UAAU,0BAA0B,MAAM,EAAE,QAAQ,oBAAoB,OAAO,KAAK,SAAS,OAAO,SAAS,CAAC;AACpH,UAAM,SAAS,mCAAmC,MAAM,MAAM,KAAK,SAAS,QAAQ,SAAS,OAAO,CAAC;AACrG,QAAI,CAAC,gBAAgB,OAAO,UAAU,QAAQ,EAAG,OAAM,IAAI,sBAAsB,KAAK,8BAA8B,4DAA4D,IAAI;AACpL,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,iBAAiB,iBAAgC,MAAM,UAAkC,CAAC,GAAG;AACjG,UAAM,UAAU,0BAA0B,MAAM,EAAE,QAAQ,sBAAsB,OAAO,KAAK,SAAS,OAAO,eAAe,CAAC;AAC5H,UAAM,SAAS,kCAAkC,MAAM,MAAM,KAAK,SAAS,QAAQ,SAAS,OAAO,CAAC;AACpG,QAAI,OAAO,mBAAmB,eAAgB,OAAM,IAAI,sBAAsB,KAAK,2BAA2B,iDAAiD,IAAI;AACnK,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,cAAc,QAA6B,UAAkC,CAAC,GAAG;AACrF,UAAM,UAAU,0BAA0B,MAAM,EAAE,QAAQ,kBAAkB,OAAO,KAAK,SAAS,OAAO,OAAO,CAAC;AAChH,UAAM,SAAS,qCAAqC,MAAM,MAAM,KAAK,SAAS,QAAQ,SAAS,OAAO,CAAC;AACvG,QAAI,CAAC,gBAAgB,OAAO,QAAQ,MAAM,EAAG,OAAM,IAAI,sBAAsB,KAAK,4BAA4B,0DAA0D,IAAI;AAC5K,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,uBAAuB,OAAiG,UAAkC,CAAC,GAAG;AAClK,UAAM,UAAU,sCAAsC,MAAM,EAAE,GAAG,OAAO,QAAQ,UAAU,OAAO,KAAK,SAAS,MAAM,CAAC;AACtH,UAAM,SAAS,sCAAsC,MAAM,MAAM,KAAK,SAAS,eAAe,SAAS,OAAO,CAAC;AAC/G,SAAK,uBAAuB,OAAO,YAAY,MAAM,QAAQ;AAC7D,QAAI,OAAO,WAAW,MAAM,UAAU,CAAC,MAAM,OAAO,WAAW,GAAG,OAAO,WAAW,SAAS,GAAG,EAAG,OAAM,IAAI,sBAAsB,KAAK,gCAAgC,8DAA8D,IAAI;AAC1O,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,UAAkB,QAA8C,CAAC,GAAG,UAAkC,CAAC,GAAG;AACpI,UAAM,UAAU,sCAAsC,MAAM,EAAE,GAAG,OAAO,QAAQ,QAAQ,OAAO,KAAK,SAAS,OAAO,SAAS,CAAC;AAC9H,UAAM,SAAS,mCAAmC,MAAM,MAAM,KAAK,SAAS,eAAe,SAAS,OAAO,CAAC;AAC5G,QAAI,OAAO,MAAM,UAAU,MAAM,SAAS,IAAK,OAAM,IAAI,sBAAsB,KAAK,2BAA2B,yDAAyD,IAAI;AAC5K,eAAW,QAAQ,OAAO,MAAO,MAAK,uBAAuB,MAAM,QAAQ;AAC3E,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,uBAAuB,UAAkB,IAAY,UAAkC,CAAC,GAAG;AAC/F,UAAM,UAAU,sCAAsC,MAAM,EAAE,QAAQ,UAAU,OAAO,KAAK,SAAS,OAAO,UAAU,GAAG,CAAC;AAC1H,UAAM,SAAS,+BAA+B,MAAM,MAAM,KAAK,SAAS,eAAe,SAAS,OAAO,CAAC;AACxG,SAAK,uBAAuB,QAAQ,QAAQ;AAC5C,QAAI,OAAO,OAAO,MAAM,OAAO,cAAc,KAAM,OAAM,IAAI,sBAAsB,KAAK,kCAAkC,iEAAiE,IAAI;AAC/L,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,oBAAoB,UAAkB,UAAkC,CAAC,GAAG;AAChF,UAAM,UAAU,yCAAyC,MAAM,EAAE,OAAO,KAAK,SAAS,OAAO,SAAS,CAAC;AACvG,UAAM,SAAS,kCAAkC,MAAM,MAAM,KAAK,SAAS,iBAAiB,SAAS,OAAO,CAAC;AAC7G,QAAI,OAAO,UAAU,KAAK,SAAS,SAAS,OAAO,OAAO,OAAO,SAAU,OAAM,IAAI,sBAAsB,KAAK,4BAA4B,4DAA4D,IAAI;AAC5M,WAAO;AAAA,EACT;AAAA,EAEA,uBAAuB,OAA4C,UAAkB;AACnF,QAAI,MAAM,UAAU,KAAK,SAAS,SAAS,MAAM,aAAa,SAAU,OAAM,IAAI,sBAAsB,KAAK,6BAA6B,2DAA2D,IAAI;AAAA,EAC3M;AAAA,EAEA,MAAM,KAAqC,MAAS,QAAwC,CAAC,GAAG,UAAkC,CAAC,GAAqC;AACtK,UAAM,UAAU,0BAA0B,MAAM,EAAE,QAAQ,QAAQ,OAAO,KAAK,SAAS,OAAO,MAAM,GAAG,MAAM,CAAC;AAC9G,WAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,wBAAwB,IAAI,CAAC,EAAE,IAAI,GAAG,GAAG,YAAY,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,OAAO,EAAE,MAAM,MAAM,KAAK,SAAS,QAAQ,SAAS,OAAO,CAAC;AAAA,EAC7K;AAAA;AAAA,EAGA,MAAM,aAAa,OAAuD,UAAkC,CAAC,GAAG;AAC9G,UAAM,UAAU,+BAA+B,MAAM,KAAK;AAC1D,UAAM,SAAS,qCAAqC,MAAM,MAAM,KAAK,SAAS,iBAAiB,EAAE,GAAG,SAAS,OAAO,KAAK,SAAS,MAAM,GAAG,OAAO,CAAC;AACnJ,QAAI,OAAO,YAAY,QAAQ,QAAS,OAAM,IAAI,sBAAsB,KAAK,2BAA2B,+DAA+D,IAAI;AAC3K,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,SAAS,UAAmF,MAAe,SAAmD;AAClK,0BAAsB,MAAM,QAAU;AACtC,UAAM,WAAW,OAAO,KAAK,SAAS,SAAS,WAAW,OAAO,GAAG,KAAK,SAAS,OAAO,gBAAgB,QAAQ,IAAI;AAAA,MACnH,QAAQ;AAAA,MAAQ,SAAS,EAAE,eAAe,UAAU,KAAK,SAAS,MAAM,IAAI,gBAAgB,oBAAoB,QAAQ,oBAAoB,sBAAsB,KAAK,SAAS,MAAM;AAAA,MAAG,MAAM,KAAK,UAAU,IAAI;AAAA,MAAG,QAAQ,QAAQ;AAAA,MACrO,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,UAAU,MAAM,4BAA4B,QAAQ;AAC1D,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,EAAE,YAAY,EAAE,UAAU,OAAO;AACrH,YAAM,IAAI,sBAAsB,SAAS,QAAQ,MAAM,UAAU,MAAM,KAAK,QAAQ,4BAA4B,2BAA2B,MAAM,UAAU,MAAM,KAAK,SAAS,4BAA4B,SAAS,MAAM,OAAO,4BAA4B,SAAS,MAAM,MAAM,OAAO;AAAA,IAC3R;AACA,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,4BAA4B,UAAsC;AACtF,QAAM,eAAe;AACrB,QAAM,SAAS,SAAS,MAAM,UAAU;AACxC,MAAI,CAAC,OAAQ,OAAM,IAAI,sBAAsB,SAAS,QAAQ,kBAAkB,gCAAgC,IAAI;AACpH,QAAM,UAAU,IAAI,YAAY;AAChC,MAAI,QAAQ;AACZ,MAAI,OAAO;AACX,MAAI;AACF,WAAO,MAAM;AACX,YAAM,OAAO,MAAM,OAAO,KAAK;AAC/B,UAAI,KAAK,KAAM;AACf,eAAS,KAAK,MAAM;AACpB,UAAI,QAAQ,aAAc,OAAM,IAAI,sBAAsB,SAAS,QAAQ,sBAAsB,8DAA8D,IAAI;AACnK,cAAQ,QAAQ,OAAO,KAAK,OAAO,EAAE,QAAQ,KAAK,CAAC;AAAA,IACrD;AACA,YAAQ,QAAQ,OAAO;AACvB,UAAM,QAAiB,KAAK,MAAM,IAAI;AACtC,0BAAsB,OAAO,YAAY;AACzC,WAAO;AAAA,EACT,UAAE;AACA,UAAM,OAAO,OAAO;AACpB,WAAO,YAAY;AAAA,EACrB;AACF;","names":[]}

package/dist/{chunk-HDKP6KE2.js → chunk-C4W2MEFP.js}

@@ -1,7 +1,7 @@
 import {
   HarnessExperimentPolicySchema,
   ModelTasksetRunRequestSchema
-} from "./chunk-IIQENUOK.js";
+} from "./chunk-ZYDDHHZZ.js";
 import {
   contentHash
 } from "./chunk-H3JZ3P5T.js";
@@ -172,4 +172,4 @@ export {
   verifyExperimentDefinition,
   experimentDefinitionRef
 };
-//# sourceMappingURL=chunk-HDKP6KE2.js.map
+//# sourceMappingURL=chunk-C4W2MEFP.js.map

package/dist/{chunk-XJKGCU2K.js → chunk-CNREFTAV.js}

@@ -1,6 +1,6 @@
 import {
   RunExperimentSchema
-} from "./chunk-7FYPFHCQ.js";
+} from "./chunk-K54BDIKL.js";
 import {
   contentHash
 } from "./chunk-H3JZ3P5T.js";
@@ -136,4 +136,4 @@ export {
   CandidateEvaluationPreparationSchema,
   CandidateEvaluationControlSchema
 };
-//# sourceMappingURL=chunk-XJKGCU2K.js.map
+//# sourceMappingURL=chunk-CNREFTAV.js.map

package/dist/{chunk-UAYXORU5.js → chunk-GHPCQXG5.js}

@@ -11,7 +11,7 @@ import {
   TasksetPreferenceComparisonBindingSchema,
   TasksetPurposeSchema,
   TasksetSourceRefSchema
-} from "./chunk-7WKCQ4V5.js";
+} from "./chunk-IFBCLRBM.js";
 import {
   ModelTasksetDraftPreparationSchema
 } from "./chunk-TK3DXH7A.js";
@@ -910,4 +910,4 @@ export {
   computeTasksetHash,
   validatePortability
 };
-//# sourceMappingURL=chunk-UAYXORU5.js.map
+//# sourceMappingURL=chunk-GHPCQXG5.js.map

package/dist/{chunk-WOD72SFI.js → chunk-GJRXJL6G.js}

@@ -7,7 +7,7 @@ import {
 import {
   TrainingHandoffOriginSchema,
   createPostTrainingClient
-} from "./chunk-5QMREXMU.js";
+} from "./chunk-7BYLH47N.js";
 import {
   validateHarnessPolicySourcePackage,
   validateHarnessSourcePackage
@@ -20,7 +20,7 @@ import {
   TrainingEstimateReviewSchema,
   TrainingGpuCatalogSchema,
   TrainingGpuSelectionSchema
-} from "./chunk-BQ2C2Y54.js";
+} from "./chunk-UOV2LEXS.js";
 import {
   OpenPondProtocolError,
   TRAINING_API_RESPONSE_MAX_BYTES,
@@ -1525,4 +1525,4 @@ export {
   TrainingCapabilitiesSchema,
   createTrainingClient
 };
-//# sourceMappingURL=chunk-WOD72SFI.js.map
+//# sourceMappingURL=chunk-GJRXJL6G.js.map

package/dist/{chunk-GRQWKATA.js → chunk-HAQPGTQ4.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-3B5KSH3V.js";
 import {
   RunExperimentSchema
-} from "./chunk-7FYPFHCQ.js";
+} from "./chunk-K54BDIKL.js";
 import {
   ImmutableReleaseRefSchema,
   assertContentHash,
@@ -171,4 +171,4 @@ export {
   ExperimentEvaluationScheduleCommandSchema,
   OpenPondExperimentEvaluationScheduleClient
 };
-//# sourceMappingURL=chunk-GRQWKATA.js.map
+//# sourceMappingURL=chunk-HAQPGTQ4.js.map

package/dist/{chunk-7WKCQ4V5.js → chunk-IFBCLRBM.js}

@@ -6,7 +6,7 @@ import {
 } from "./chunk-H3367ISL.js";
 import {
   ModelProjectVersionedRefSchema
-} from "./chunk-BQ2C2Y54.js";
+} from "./chunk-UOV2LEXS.js";
 import {
   canonicalJson as canonicalJson2
 } from "./chunk-B3ZHJ2KK.js";
@@ -8942,4 +8942,4 @@ export {
   createTasksetPackage,
   resolveTasksetWorkOutputs
 };
-//# sourceMappingURL=chunk-7WKCQ4V5.js.map
+//# sourceMappingURL=chunk-IFBCLRBM.js.map

package/dist/chunk-IZ26ZCGU.js

@@ -0,0 +1,65 @@
+import {
+  ReleaseIdSchema
+} from "./chunk-H3JZ3P5T.js";
+
+// src/learning-credentials.ts
+import { z } from "zod";
+import { LearningRevisionRefSchema } from "@openpond/evals/learning";
+import { TaskSplitSchema } from "@openpond/evals/tasksets";
+var LearningSourceCredentialSchema = z.object({
+  id: ReleaseIdSchema,
+  scope: ReleaseIdSchema,
+  sourceId: ReleaseIdSchema,
+  name: z.string().trim().min(1).max(100),
+  keyPrefix: z.string().min(1).max(100),
+  createdAt: z.iso.datetime(),
+  expiresAt: z.iso.datetime(),
+  revokedAt: z.iso.datetime().nullable()
+}).strict();
+var LearningSourceCredentialSecretSchema = z.string().regex(/^opk_key_[A-Za-z0-9]{16}_[A-Za-z0-9]{48}$/);
+var LearningSourceCredentialRequestSchema = z.discriminatedUnion("action", [
+  z.object({ action: z.literal("create"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, name: z.string().trim().min(1).max(100), expiresAt: z.iso.datetime(), operationId: ReleaseIdSchema, apiKey: LearningSourceCredentialSecretSchema }).strict(),
+  z.object({ action: z.literal("list"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, afterId: ReleaseIdSchema.optional(), limit: z.number().int().min(1).max(100).default(30) }).strict(),
+  z.object({ action: z.literal("revoke"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, id: ReleaseIdSchema }).strict()
+]);
+var LearningSourceCredentialCreatedSchema = z.object({ credential: LearningSourceCredentialSchema, apiKey: LearningSourceCredentialSecretSchema }).strict();
+var LearningSourceCredentialPageSchema = z.object({ items: z.array(LearningSourceCredentialSchema).max(100), nextCursor: ReleaseIdSchema.nullable() }).strict();
+var LearningSourceConfigurationRequestSchema = z.object({ scope: ReleaseIdSchema, sourceId: ReleaseIdSchema }).strict();
+var LearningSourceConfigurationSchema = z.object({
+  scope: ReleaseIdSchema,
+  source: LearningRevisionRefSchema,
+  taskDefinition: LearningRevisionRefSchema,
+  enabled: z.boolean(),
+  allowedSplits: z.array(TaskSplitSchema).min(1).max(4)
+}).strict();
+function createSourceCredentialRequest(input) {
+  return { ...input, operationId: crypto.randomUUID(), apiKey: `opk_key_${randomToken(16)}_${randomToken(48)}` };
+}
+function randomToken(length) {
+  const alphabet = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789";
+  let value = "";
+  while (value.length < length) {
+    for (const byte of crypto.getRandomValues(new Uint8Array(64))) {
+      if (byte < 248) value += alphabet[byte % 62];
+      if (value.length === length) return value;
+    }
+  }
+  return value;
+}
+function assertLearningCredentialExpiry(expiresAt, now) {
+  const expires = Date.parse(z.iso.datetime().parse(expiresAt));
+  if (expires <= now.getTime() || expires > now.getTime() + 90 * 24 * 60 * 60 * 1e3) throw new Error("Source credentials must expire within 90 days.");
+}
+
+export {
+  LearningSourceCredentialSchema,
+  LearningSourceCredentialSecretSchema,
+  LearningSourceCredentialRequestSchema,
+  LearningSourceCredentialCreatedSchema,
+  LearningSourceCredentialPageSchema,
+  LearningSourceConfigurationRequestSchema,
+  LearningSourceConfigurationSchema,
+  createSourceCredentialRequest,
+  assertLearningCredentialExpiry
+};
+//# sourceMappingURL=chunk-IZ26ZCGU.js.map

package/dist/chunk-IZ26ZCGU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/learning-credentials.ts"],"sourcesContent":["import { z } from \"zod\";\nimport { ReleaseIdSchema } from \"@openpond/harness\";\nimport { LearningRevisionRefSchema } from \"@openpond/evals/learning\";\nimport { TaskSplitSchema } from \"@openpond/evals/tasksets\";\n\n/** Source credentials can submit evidence and feedback for one source only. */\nexport const LearningSourceCredentialSchema = z.object({\n  id: ReleaseIdSchema,\n  scope: ReleaseIdSchema,\n  sourceId: ReleaseIdSchema,\n  name: z.string().trim().min(1).max(100),\n  keyPrefix: z.string().min(1).max(100),\n  createdAt: z.iso.datetime(),\n  expiresAt: z.iso.datetime(),\n  revokedAt: z.iso.datetime().nullable(),\n}).strict();\nexport type LearningSourceCredential = z.infer<typeof LearningSourceCredentialSchema>;\nexport const LearningSourceCredentialSecretSchema = z.string().regex(/^opk_key_[A-Za-z0-9]{16}_[A-Za-z0-9]{48}$/);\n\nexport const LearningSourceCredentialRequestSchema = z.discriminatedUnion(\"action\", [\n  z.object({ action: z.literal(\"create\"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, name: z.string().trim().min(1).max(100), expiresAt: z.iso.datetime(), operationId: ReleaseIdSchema, apiKey: LearningSourceCredentialSecretSchema }).strict(),\n  z.object({ action: z.literal(\"list\"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, afterId: ReleaseIdSchema.optional(), limit: z.number().int().min(1).max(100).default(30) }).strict(),\n  z.object({ action: z.literal(\"revoke\"), scope: ReleaseIdSchema, sourceId: ReleaseIdSchema, id: ReleaseIdSchema }).strict(),\n]);\nexport type LearningSourceCredentialRequest = z.infer<typeof LearningSourceCredentialRequestSchema>;\nexport const LearningSourceCredentialCreatedSchema = z.object({ credential: LearningSourceCredentialSchema, apiKey: LearningSourceCredentialSecretSchema }).strict();\nexport const LearningSourceCredentialPageSchema = z.object({ items: z.array(LearningSourceCredentialSchema).max(100), nextCursor: ReleaseIdSchema.nullable() }).strict();\nexport const LearningSourceConfigurationRequestSchema = z.object({ scope: ReleaseIdSchema, sourceId: ReleaseIdSchema }).strict();\nexport const LearningSourceConfigurationSchema = z.object({\n  scope: ReleaseIdSchema, source: LearningRevisionRefSchema, taskDefinition: LearningRevisionRefSchema,\n  enabled: z.boolean(), allowedSplits: z.array(TaskSplitSchema).min(1).max(4),\n}).strict();\n\n/** Keep this request in memory for retries. Hosts persist hashes, never its secret. */\nexport function createSourceCredentialRequest(input: { sourceId: string; name: string; expiresAt: string }) {\n  return { ...input, operationId: crypto.randomUUID(), apiKey: `opk_key_${randomToken(16)}_${randomToken(48)}` };\n}\n\nfunction randomToken(length: number): string {\n  const alphabet = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\n  let value = \"\";\n  while (value.length < length) {\n    for (const byte of crypto.getRandomValues(new Uint8Array(64))) {\n      // Rejection sampling avoids modulo bias in the 62-character alphabet.\n      if (byte < 248) value += alphabet[byte % 62];\n      if (value.length === length) return value;\n    }\n  }\n  return value;\n}\n\n/** Hosts enforce expiry when issuing and authenticating; tokens are never permanent. */\nexport function assertLearningCredentialExpiry(expiresAt: string, now: Date): void {\n  const expires = Date.parse(z.iso.datetime().parse(expiresAt));\n  if (expires <= now.getTime() || expires > now.getTime() + 90 * 24 * 60 * 60 * 1_000) throw new Error(\"Source credentials must expire within 90 days.\");\n}\n"],"mappings":";;;;;AAAA,SAAS,SAAS;AAElB,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB;AAGzB,IAAM,iCAAiC,EAAE,OAAO;AAAA,EACrD,IAAI;AAAA,EACJ,OAAO;AAAA,EACP,UAAU;AAAA,EACV,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACtC,WAAW,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EACpC,WAAW,EAAE,IAAI,SAAS;AAAA,EAC1B,WAAW,EAAE,IAAI,SAAS;AAAA,EAC1B,WAAW,EAAE,IAAI,SAAS,EAAE,SAAS;AACvC,CAAC,EAAE,OAAO;AAEH,IAAM,uCAAuC,EAAE,OAAO,EAAE,MAAM,2CAA2C;AAEzG,IAAM,wCAAwC,EAAE,mBAAmB,UAAU;AAAA,EAClF,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,OAAO,iBAAiB,UAAU,iBAAiB,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,GAAG,WAAW,EAAE,IAAI,SAAS,GAAG,aAAa,iBAAiB,QAAQ,qCAAqC,CAAC,EAAE,OAAO;AAAA,EACtP,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,MAAM,GAAG,OAAO,iBAAiB,UAAU,iBAAiB,SAAS,gBAAgB,SAAS,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,EAAE,OAAO;AAAA,EAC5L,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,GAAG,OAAO,iBAAiB,UAAU,iBAAiB,IAAI,gBAAgB,CAAC,EAAE,OAAO;AAC3H,CAAC;AAEM,IAAM,wCAAwC,EAAE,OAAO,EAAE,YAAY,gCAAgC,QAAQ,qCAAqC,CAAC,EAAE,OAAO;AAC5J,IAAM,qCAAqC,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,8BAA8B,EAAE,IAAI,GAAG,GAAG,YAAY,gBAAgB,SAAS,EAAE,CAAC,EAAE,OAAO;AAChK,IAAM,2CAA2C,EAAE,OAAO,EAAE,OAAO,iBAAiB,UAAU,gBAAgB,CAAC,EAAE,OAAO;AACxH,IAAM,oCAAoC,EAAE,OAAO;AAAA,EACxD,OAAO;AAAA,EAAiB,QAAQ;AAAA,EAA2B,gBAAgB;AAAA,EAC3E,SAAS,EAAE,QAAQ;AAAA,EAAG,eAAe,EAAE,MAAM,eAAe,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC;AAC5E,CAAC,EAAE,OAAO;AAGH,SAAS,8BAA8B,OAA8D;AAC1G,SAAO,EAAE,GAAG,OAAO,aAAa,OAAO,WAAW,GAAG,QAAQ,WAAW,YAAY,EAAE,CAAC,IAAI,YAAY,EAAE,CAAC,GAAG;AAC/G;AAEA,SAAS,YAAY,QAAwB;AAC3C,QAAM,WAAW;AACjB,MAAI,QAAQ;AACZ,SAAO,MAAM,SAAS,QAAQ;AAC5B,eAAW,QAAQ,OAAO,gBAAgB,IAAI,WAAW,EAAE,CAAC,GAAG;AAE7D,UAAI,OAAO,IAAK,UAAS,SAAS,OAAO,EAAE;AAC3C,UAAI,MAAM,WAAW,OAAQ,QAAO;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,+BAA+B,WAAmB,KAAiB;AACjF,QAAM,UAAU,KAAK,MAAM,EAAE,IAAI,SAAS,EAAE,MAAM,SAAS,CAAC;AAC5D,MAAI,WAAW,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,IAAI,KAAK,KAAK,KAAK,KAAK,IAAO,OAAM,IAAI,MAAM,gDAAgD;AACvJ;","names":[]}

package/dist/{chunk-ICFFZ4WC.js → chunk-JBYFD3QS.js}

@@ -2,7 +2,7 @@ import {
   TasksetSchema,
   computeTasksetHash,
   createTasksetDraft
-} from "./chunk-UAYXORU5.js";
+} from "./chunk-GHPCQXG5.js";
 import {
   GraderFixtureSchema,
   GraderSpecSchema,
@@ -11,7 +11,7 @@ import {
   decodeTasksetPackageFile,
   resolveTasksetPackageInstructions,
   validateTasksetPackage
-} from "./chunk-7WKCQ4V5.js";
+} from "./chunk-IFBCLRBM.js";
 import {
   contentHash
 } from "./chunk-H3JZ3P5T.js";
@@ -266,4 +266,4 @@ export {
   prepareImportedTasksetPackage,
   tasksetPackageSourceId
 };
-//# sourceMappingURL=chunk-ICFFZ4WC.js.map
+//# sourceMappingURL=chunk-JBYFD3QS.js.map

package/dist/{chunk-4L556MYM.js → chunk-JDQVAG3R.js}

@@ -5,10 +5,10 @@ import {
   computeTasksetHash,
   draftPublishIssues,
   validateTaskset
-} from "./chunk-UAYXORU5.js";
+} from "./chunk-GHPCQXG5.js";
 import {
   TaskDataRecordSchema
-} from "./chunk-7WKCQ4V5.js";
+} from "./chunk-IFBCLRBM.js";
 import {
   TasksetDraftFileContentSchema,
   TasksetDraftFileMutationSchema,
@@ -487,4 +487,4 @@ export {
   tasksetDraftFromTaskset,
   publishTasksetDraft
 };
-//# sourceMappingURL=chunk-4L556MYM.js.map
+//# sourceMappingURL=chunk-JDQVAG3R.js.map

package/dist/{chunk-7FYPFHCQ.js → chunk-K54BDIKL.js}

@@ -1,9 +1,9 @@
 import {
   ExperimentGraderSelectionSchema
-} from "./chunk-HDKP6KE2.js";
+} from "./chunk-C4W2MEFP.js";
 import {
   ModelTasksetRunRequestSchema
-} from "./chunk-IIQENUOK.js";
+} from "./chunk-ZYDDHHZZ.js";
 
 // src/experiment-run-contracts.ts
 import { z } from "zod";
@@ -28,4 +28,4 @@ var RunExperimentSchema = z.object({
 export {
   RunExperimentSchema
 };
-//# sourceMappingURL=chunk-7FYPFHCQ.js.map
+//# sourceMappingURL=chunk-K54BDIKL.js.map

package/dist/{chunk-ESW25WSD.js → chunk-KOJC3TH4.js}

@@ -1,13 +1,13 @@
 import {
   validateTasksetPackage
-} from "./chunk-7WKCQ4V5.js";
+} from "./chunk-IFBCLRBM.js";
 import {
   RunExperimentSchema
-} from "./chunk-7FYPFHCQ.js";
+} from "./chunk-K54BDIKL.js";
 import {
   ExperimentScoringRequestSchema,
   verifyExperimentScoringPass
-} from "./chunk-GIEST52U.js";
+} from "./chunk-LHHHJIDR.js";
 import {
   fetchConnectedJson
 } from "./chunk-O6FKHAWN.js";
@@ -18,13 +18,13 @@ import {
   ExperimentListQuerySchema,
   PrepareHarnessExperimentSchema,
   PreparedHarnessExperimentSchema
-} from "./chunk-HDKP6KE2.js";
+} from "./chunk-C4W2MEFP.js";
 import {
   ModelTasksetRunDetailsSchema,
   ModelTasksetRunRequestSchema,
   verifyHarnessExperimentManifest,
   verifyModelTasksetRunDetails
-} from "./chunk-IIQENUOK.js";
+} from "./chunk-ZYDDHHZZ.js";
 import {
   ImmutableReleaseRefSchema,
   contentHash
@@ -652,4 +652,4 @@ export {
   ProfileEvaluationDiscoveryRequestSchema,
   OpenPondProfileEvaluationDiscoveryClient
 };
-//# sourceMappingURL=chunk-ESW25WSD.js.map
+//# sourceMappingURL=chunk-KOJC3TH4.js.map

package/dist/{chunk-GIEST52U.js → chunk-LHHHJIDR.js}

@@ -1,7 +1,7 @@
 import {
   ExperimentFieldMappingsSchema,
   ExperimentGraderPinSchema
-} from "./chunk-HDKP6KE2.js";
+} from "./chunk-C4W2MEFP.js";
 import {
   ImmutableReleaseRefSchema,
   contentHash
@@ -67,4 +67,4 @@ export {
   ExperimentScoringPassSchema,
   verifyExperimentScoringPass
 };
-//# sourceMappingURL=chunk-GIEST52U.js.map
+//# sourceMappingURL=chunk-LHHHJIDR.js.map

package/dist/{chunk-FC56EMHT.js → chunk-NKF5NIML.js}

@@ -3,20 +3,20 @@ import {
   validateModelStarterExecution,
   validateModelTasksetPackage,
   validateTasksetPackage
-} from "./chunk-7WKCQ4V5.js";
+} from "./chunk-IFBCLRBM.js";
 import {
   ModelProjectBaseModelSchema,
   ModelProjectRecipeDocumentSchema,
   ModelProjectTrainingMethodSchema,
   ModelProjectTrainingSetupSchema,
   ModelProjectVersionedRefSchema
-} from "./chunk-BQ2C2Y54.js";
-import {
-  canonicalSha256
-} from "./chunk-B3ZHJ2KK.js";
+} from "./chunk-UOV2LEXS.js";
 import {
   ModelInitialLearningSchema
 } from "./chunk-CL3IOOVL.js";
+import {
+  canonicalSha256
+} from "./chunk-B3ZHJ2KK.js";
 import {
   contentHash
 } from "./chunk-H3JZ3P5T.js";
@@ -336,4 +336,4 @@ export {
   previewModelStarter,
   validateResolvedModelStarter
 };
-//# sourceMappingURL=chunk-FC56EMHT.js.map
+//# sourceMappingURL=chunk-NKF5NIML.js.map

package/dist/{chunk-LKKKTBLL.js → chunk-O3NOGKMT.js}

@@ -1,6 +1,6 @@
 import {
   ExperimentScoringRequestSchema
-} from "./chunk-GIEST52U.js";
+} from "./chunk-LHHHJIDR.js";
 import {
   ImmutableReleaseRefSchema,
   contentHash
@@ -141,4 +141,4 @@ export {
   verifyExperimentImprovementHumanOptions,
   sealExperimentImprovementHumanOptions
 };
-//# sourceMappingURL=chunk-LKKKTBLL.js.map
+//# sourceMappingURL=chunk-O3NOGKMT.js.map