orizu 0.5.19 → 0.5.21

package/dist/run-event-digest.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Shared compact per-event digest renderer for workbench-run tails (ALI-1045).
+ *
+ * Used by BOTH `orizu run tail` (human mode) and the `--tail` attached to
+ * `orizu session start --hosted`, so the operator watching a live hosted run
+ * can see at a glance what the agent said, which tool it called with what
+ * args, and what came back — enough to spot a stall, an unanswerable question,
+ * or a misdirection within seconds, without a second terminal.
+ *
+ * THREAT MODEL: the sandboxed agent AUTHORS these payloads and this renderer
+ * writes to the OPERATOR'S terminal — treat every field as hostile.
+ *
+ * Contract:
+ *   - ONE line per event, prefixed `#<sequence> <eventType>`.
+ *   - Every field that reaches the output is capped (FIELD_MAX for tool /
+ *     status / eventType, TOKEN_TEXT_MAX for prose/output, SUMMARY_MAX for
+ *     args/JSON) and the WHOLE assembled line is bounded by LINE_MAX.
+ *   - The final line is sanitized as the LAST step: all C0/C1 control bytes
+ *     (ESC, BEL, backspace, CR/LF, DEL, 0x80-0x9F, …) are stripped, so a
+ *     hostile payload can never emit terminal escape sequences (OSC-52
+ *     clipboard writes, CSI clear/spoof) or extra lines at the operator; the
+ *     same pass strips Unicode bidi controls, U+2028/U+2029 separators, and
+ *     zero-width characters, so a payload cannot visually reorder, split, or
+ *     spoof the line either (see CONTROL_CHARS).
+ *   - Bounded work per event: raw strings are sliced to a working window of
+ *     WORK_FACTOR x the display cap BEFORE any regex normalization; JSON
+ *     summaries first take a BOUNDED PROJECTION of the payload (max
+ *     PROJECTION_MAX_ITEMS entries per level, PROJECTION_MAX_DEPTH deep,
+ *     PROJECTION_MAX_NODES containers) so JSON.stringify never traverses a
+ *     payload-sized structure, then slice oversized string fields via the
+ *     replacer — a megabyte payload costs O(display size), not O(payload).
+ *   - NEVER throws: malformed payloads degrade to the bare `#<seq> <type>`
+ *     line; hostile objects (throwing getters) degrade to `#? unknown`. Full
+ *     fidelity stays in the JSON streams (`--json` on either command).
+ *
+ * Event payload shapes come from the hosted harness seam
+ * (hosted-harness-{claude,opencode}.ts → hosted-run-event-sink.ts):
+ *   agent_token        { messageId, text }                  (coalesced snapshot)
+ *   agent_tool_call    { tool, args, callId, status }
+ *   agent_tool_result  { callId, status, output[, tool] }
+ *   agent_step_finish  { cost, tokens, reason }             (tokens shape varies)
+ */
+/** Max chars of streamed agent text / tool output shown per digest line. */
+export declare const TOKEN_TEXT_MAX = 120;
+/** Max chars of arg/JSON summaries shown per digest line. */
+export declare const SUMMARY_MAX = 160;
+/** Max chars for short identifier-ish fields: tool names, statuses, eventType. */
+export declare const FIELD_MAX = 60;
+/** Hard backstop for a whole assembled digest line (prefix + segments + slack). */
+export declare const LINE_MAX = 360;
+interface ProjectionState {
+    nodes: number;
+    seen: WeakSet<object>;
+}
+/**
+ * Build a bounded clone of a hostile payload BEFORE serialization, so
+ * JSON.stringify never traverses payload-sized structures (huge arrays, many
+ * properties, deep nesting): at most PROJECTION_MAX_ITEMS entries per level,
+ * PROJECTION_MAX_DEPTH levels, PROJECTION_MAX_NODES containers total. Cut
+ * points and repeated/cyclic references become the '…' marker. Exported for
+ * tests only.
+ */
+export declare function boundedJsonProjection(value: unknown, depth?: number, state?: ProjectionState): unknown;
+/** The old (pre-ALI-1045) types-only line — kept for `--quiet`. */
+export declare function formatRunEventTypeLine(event: unknown): string;
+/**
+ * One compact human line for a workbench-run event: `#<seq> <type>  <digest>`.
+ * Never throws; degrades to the bare `#<seq> <type>` line on any malformed or
+ * missing payload field, and to `#? unknown` when the envelope itself is
+ * hostile (throwing getters, revoked proxies).
+ */
+export declare function formatRunEventDigest(event: unknown): string;
+export {};
+//# sourceMappingURL=run-event-digest.d.ts.map

package/dist/run-event-digest.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-event-digest.d.ts","sourceRoot":"","sources":["../src/run-event-digest.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyCG;AAEH,4EAA4E;AAC5E,eAAO,MAAM,cAAc,MAAM,CAAA;AACjC,6DAA6D;AAC7D,eAAO,MAAM,WAAW,MAAM,CAAA;AAC9B,kFAAkF;AAClF,eAAO,MAAM,SAAS,KAAK,CAAA;AAC3B,mFAAmF;AACnF,eAAO,MAAM,QAAQ,MAAM,CAAA;AAyD3B,UAAU,eAAe;IACvB,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;CACtB;AAED;;;;;;;GAOG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,EACd,KAAK,SAAI,EACT,KAAK,GAAE,eAAmD,GACzD,OAAO,CA+BT;AA+ID,mEAAmE;AACnE,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAO7D;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAkB3D"}

package/dist/runner-dir-verify.d.ts

@@ -0,0 +1,66 @@
+/**
+ * ALI-1159 (ADR-007): ad-hoc `--runner-dir` bytes may only execute when they
+ * ARE a registered runner version. Runs that execute local runner bytes stamp
+ * a registered `runner_version_id` into every result record; before this
+ * guard, nothing tied those bytes to that version — a run could produce live
+ * Orizu records from runner bytes that were never registered or committed
+ * anywhere (the GEPA-adapter loss on orizu-workbench-demo). The check is the
+ * same deterministic-zip content sha the push paths record: identical
+ * directory bytes hash to the registered version's `content_sha256`.
+ *
+ * Lives outside index.ts per the CLI line ratchet (ALI-976).
+ */
+/** Test seam; defaults to the authenticated CLI fetcher. */
+export interface VerifyRunnerDirInput {
+    runnerVersionId: string;
+    dir: string;
+    /** The CLI flag the dir arrived on (for the error message). */
+    flag: string;
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+}
+export interface VerifiedRunnerSnapshot {
+    /**
+     * Temp directory holding EXACTLY the verified file set, materialized from
+     * the same in-memory bytes the hash covered (codex round 4 on #1447):
+     * execution from here is immune to post-hash mutation of the original dir,
+     * and hash-excluded entries (.env, .git, .orizu, caches, symlinks) simply
+     * do not exist at runtime.
+     */
+    snapshotDir: string;
+    cleanup: () => void;
+}
+export declare function verifyRunnerDirRegistered(input: VerifyRunnerDirInput): Promise<VerifiedRunnerSnapshot>;
+/**
+ * The runner contract executes `manifest.json`'s `command` with cwd at the
+ * artifact root. Every command entry must stay INSIDE the snapshot: absolute
+ * entries and `..` escapes are refused (a bare program name like `node` is
+ * PATH-resolved — interpreters are environment, not artifact bytes). Missing
+ * or malformed manifests are refused here too, so no snapshot can outlive a
+ * runner that could never execute.
+ */
+export declare function assertSnapshotManifestConfined(snapshotDir: string, flag: string): void;
+/** Extract a flag value accepting BOTH argparse forms: `--flag value` and
+ * `--flag=value` (codex P1 on #1447 — the equals form bypassed `getArg`). */
+export declare function extractFlagValue(args: string[], flag: string): string | null;
+export interface GepaVerifiedArgs {
+    /** The forwarded argv with each runner-dir flag REWRITTEN to its verified
+     * snapshot path — Python executes the hashed bytes, not the mutable dir. */
+    args: string[];
+    /** The snapshot dirs, for the ORIZU_VERIFIED_RUNNER_DIRS handshake. */
+    verifiedDirs: string[];
+    cleanup: () => void;
+}
+/**
+ * Verify the run-gepa wrapper's two ad-hoc runner dirs (candidate + scorer)
+ * against the FORWARDED argv before the Python optimizer is spawned —
+ * scanning the same tokens Python will parse, in both argparse forms, so no
+ * spelling of the flags can slip past verification. FAIL-CLOSED: if either
+ * half of a pair is present but the pair is incomplete, the wrapper refuses
+ * here rather than forwarding an unverified pair to argparse. A pair that is
+ * entirely absent is left to the Python CLI's required-argument validation —
+ * it cannot execute without both. On success each dir flag is REWRITTEN to
+ * the verified snapshot (codex round 4): the optimizer runs the exact hashed
+ * bytes, immune to post-hash mutation of the original dirs.
+ */
+export declare function verifyGepaRunnerDirsFromArgs(args: string[], fetcher?: (path: string, init?: RequestInit) => Promise<Response>): Promise<GepaVerifiedArgs>;
+//# sourceMappingURL=runner-dir-verify.d.ts.map

package/dist/runner-dir-verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-dir-verify.d.ts","sourceRoot":"","sources":["../src/runner-dir-verify.ts"],"names":[],"mappings":"AAYA;;;;;;;;;;;GAWG;AAEH,4DAA4D;AAC5D,MAAM,WAAW,oBAAoB;IACnC,eAAe,EAAE,MAAM,CAAA;IACvB,GAAG,EAAE,MAAM,CAAA;IACX,+DAA+D;IAC/D,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AA6DD,MAAM,WAAW,sBAAsB;IACrC;;;;;;OAMG;IACH,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED,wBAAsB,yBAAyB,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,sBAAsB,CAAC,CA4F5G;AAonBD;;;;;;;GAOG;AACH,wBAAgB,8BAA8B,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CA0EtF;AAYD;6EAC6E;AAC7E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAY5E;AAoBD,MAAM,WAAW,gBAAgB;IAC/B;gFAC4E;IAC5E,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,uEAAuE;IACvE,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,GAChE,OAAO,CAAC,gBAAgB,CAAC,CAmD3B"}

package/dist/runner-instruction-set-contract.d.ts

@@ -0,0 +1,24 @@
+import { type SyncSet } from './instruction-sets-cli.js';
+export interface RunnerInstructionSet {
+    name: string;
+    modelConfig: Record<string, unknown>;
+    shape: string[];
+    profileVersionId: string;
+    modelConfigSettingsVersionId?: string;
+    versionNumber: number;
+    promptComponentKey?: string;
+    components: Record<string, string>;
+    pinnedComponents?: Record<string, {
+        repoPath: string;
+        contentSha: string;
+        commitSha: string;
+    }>;
+}
+export declare function runnerInstructionSetSyncSet(instructionSet: RunnerInstructionSet): SyncSet;
+export declare function runnerInputPrompt(promptContext: {
+    body?: string | null;
+    bodyKind: string;
+    providerSettings: Record<string, unknown>;
+}): Record<string, unknown>;
+export declare function runnerInputInstructionSet(instructionSet: RunnerInstructionSet): Record<string, unknown>;
+//# sourceMappingURL=runner-instruction-set-contract.d.ts.map

package/dist/runner-instruction-set-contract.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runner-instruction-set-contract.d.ts","sourceRoot":"","sources":["../src/runner-instruction-set-contract.ts"],"names":[],"mappings":"AAAA,OAAO,EAAsB,KAAK,OAAO,EAAE,MAAM,2BAA2B,CAAA;AAE5E,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACpC,KAAK,EAAE,MAAM,EAAE,CAAA;IACf,gBAAgB,EAAE,MAAM,CAAA;IACxB,4BAA4B,CAAC,EAAE,MAAM,CAAA;IACrC,aAAa,EAAE,MAAM,CAAA;IACrB,kBAAkB,CAAC,EAAE,MAAM,CAAA;IAC3B,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAClC,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC/F;AAED,wBAAgB,2BAA2B,CAAC,cAAc,EAAE,oBAAoB,GAAG,OAAO,CAwBzF;AAED,wBAAgB,iBAAiB,CAC/B,aAAa,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GACnG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASzB;AAED,wBAAgB,yBAAyB,CAAC,cAAc,EAAE,oBAAoB,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAUvG"}

package/dist/runner-instruction-set-contract.js

@@ -0,0 +1,50 @@
+export function runnerInstructionSetSyncSet(instructionSet) {
+    const modelConfigIdentity = typeof instructionSet.modelConfig.identity === 'string'
+        ? instructionSet.modelConfig.identity
+        : '';
+    if (!modelConfigIdentity)
+        throw new Error('Runner exec context instruction set has no model config identity');
+    const missingKey = instructionSet.shape.find(key => !(key in instructionSet.components) && !(key in (instructionSet.pinnedComponents || {})));
+    if (missingKey)
+        throw new Error('instruction_set_tuple_incomplete');
+    const components = Object.fromEntries(Object.entries(instructionSet.components).map(([key, body]) => [key, { body }]));
+    for (const [key, pin] of Object.entries(instructionSet.pinnedComponents || {}))
+        components[key] = pin;
+    const material = {
+        profileVersionId: instructionSet.profileVersionId,
+        versionNumber: instructionSet.versionNumber,
+        modelConfigIdentity,
+        // syncToDisk's long-lived manifest requires provenance; this execution
+        // path has no resolver decision to expose, only an exact profile version.
+        resolvedFrom: 'exact_profile_version',
+        components,
+    };
+    return {
+        name: instructionSet.name,
+        shape: instructionSet.shape,
+        default: material,
+        profiles: [{ modelConfigIdentity, resolvedFrom: 'exact_profile_version', production: material }],
+    };
+}
+export function runnerInputPrompt(promptContext) {
+    const prompt = {
+        body_kind: promptContext.bodyKind,
+        provider_settings: promptContext.providerSettings,
+    };
+    // The route owns this decision. Preserve its response shape exactly so an
+    // implicit wrapped prompt remains compatible with existing runners.
+    if ('body' in promptContext)
+        prompt.body = promptContext.body;
+    return prompt;
+}
+export function runnerInputInstructionSet(instructionSet) {
+    return {
+        name: instructionSet.name,
+        model_config: instructionSet.modelConfig,
+        shape: instructionSet.shape,
+        ...(instructionSet.modelConfigSettingsVersionId ? { model_config_settings_version_id: instructionSet.modelConfigSettingsVersionId } : {}),
+        ...(instructionSet.promptComponentKey ? { prompt_component_key: instructionSet.promptComponentKey } : {}),
+        components: instructionSet.components,
+        ...(Object.keys(instructionSet.pinnedComponents || {}).length > 0 ? { pinned_components: instructionSet.pinnedComponents } : {}),
+    };
+}

package/dist/sandbox-hygiene.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Provider-neutral sandbox token-hygiene sweep (ALI-973 / ALI-1050).
+ *
+ * Extracted out of `daytona-slice.ts` so the hygiene helper carries NO Daytona
+ * coupling: it works against any `SandboxProvider`/`SandboxSession` (ADR-003
+ * seam) and is imported by the shipped hosted-bootstrap path (`hosted-bootstrap
+ * .ts`) as well as the founder-only Daytona slice. Keeping it here means the
+ * shipped code never transitively reaches the optional `@daytonaio/sdk`.
+ */
+import type { SandboxSession } from './sandbox-provider.js';
+export interface HygieneFinding {
+    location: string;
+    marker: string;
+}
+export interface HygieneProbe {
+    location: string;
+    /** Shell command whose stdout is scanned for tokens + markers. */
+    command: string;
+}
+/**
+ * The list of places a short-lived git token can leak inside a sandbox after a
+ * transient clone+push. List-driven so it is trivial to extend. `${repo}` is
+ * substituted with the repo path. Ordered from the repo-local stores outward to
+ * global config, the credential cache, the reflog, shell history, and the live
+ * process listing / argv — the exact surfaces the Daytona-support question names.
+ */
+export declare function tokenLeakProbes(repoPath: string): HygieneProbe[];
+/**
+ * Grep the sandbox filesystem + process table for token values and the
+ * `x-access-token` marker across every known leak surface (see `tokenLeakProbes`).
+ * Returns every finding; an empty array means the transient operations left no
+ * residue. This is the load-bearing check the whole slice exists to make.
+ *
+ * NOTE (local-sim): the reflog/config/credential-store/history probes run
+ * meaningfully in local-sim, but `ps`/argv coverage is only decisive on the live
+ * Daytona run (local-sim runs the git clone via a child process on the host, not
+ * inside an isolated PID namespace). The WS-F memo marks that probe live-only.
+ */
+export declare function sweepForTokenResidue(session: SandboxSession, opts: {
+    tokens: string[];
+    repoPath: string;
+    markers?: string[];
+    probes?: HygieneProbe[];
+}): Promise<HygieneFinding[]>;
+//# sourceMappingURL=sandbox-hygiene.d.ts.map

package/dist/sandbox-hygiene.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-hygiene.d.ts","sourceRoot":"","sources":["../src/sandbox-hygiene.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AAE3D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,MAAM,CAAA;IAChB,kEAAkE;IAClE,OAAO,EAAE,MAAM,CAAA;CAChB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,EAAE,CAYhE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,oBAAoB,CACxC,OAAO,EAAE,cAAc,EACvB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,EAAE,CAAA;CAAE,GACxF,OAAO,CAAC,cAAc,EAAE,CAAC,CAoB3B"}

package/dist/sandbox-provider.d.ts

@@ -0,0 +1,193 @@
+/**
+ * Orizu-owned sandbox provider seam (ALI-973 / WS-F, per ADR-003).
+ *
+ * ADR-003 requires every provider call (GitHub, Daytona) to sit behind an
+ * Orizu-owned interface so the durable contracts never couple to whichever SDK
+ * wins the quarter. This module defines `SandboxProvider` / `SandboxSession` and
+ * ships two implementations:
+ *
+ *   - `createDaytonaProvider(config)` — a THIN adapter over the Daytona
+ *     TypeScript SDK (`@daytonaio/sdk`). The SDK is imported LAZILY (dynamic
+ *     import through a non-literal specifier) so the CLI works without it
+ *     installed, the app build never resolves it, and tests never load it.
+ *   - `createLocalSimProvider(config)` — a temp-dir + real-`git`-subprocess
+ *     simulation used by the unit tests AND by the no-credentials local-sim
+ *     rehearsal. It is a genuine rehearsal (real clone/commit/push against a
+ *     local bare repo), not a mock.
+ *
+ * SDK-vs-docs note (verified against daytona.io/docs, 2026-07-02): the real
+ * `git.clone` signature is
+ *   clone(url, path, branch?, commitId?, username?, password?, insecureSkipTls?)
+ * i.e. a `commitId` argument sits BETWEEN `branch` and `username` — the ALI-973
+ * brief documented `clone(url, path, branch, username, password)`. The adapter
+ * passes `undefined` for `commitId` so the Orizu seam keeps its clean per-call
+ * credential shape. `git.push(path, username?, password?)` matches the brief.
+ */
+export interface ExecResult {
+    stdout: string;
+    exitCode: number;
+    /** Captured standard error, when the provider exposes it — surfaced so a
+     *  failed git clone/push does not vanish behind a masked exit code. */
+    stderr?: string;
+}
+export interface GitCloneParams {
+    url: string;
+    path: string;
+    branch?: string;
+    username?: string;
+    password?: string;
+}
+export interface GitPushParams {
+    path: string;
+    username?: string;
+    password?: string;
+}
+/**
+ * A single request transform a provider firewall applies to matching egress
+ * (the credential-brokering seam: inject a header at the proxy so the raw
+ * secret never enters the sandbox). Structurally identical to @vercel/sandbox's
+ * `NetworkPolicyRule` so a Vercel adapter can pass it straight through, but
+ * declared here so the Orizu seam owns the shape (ADR-003).
+ */
+export interface SandboxEgressRule {
+    transform?: {
+        headers?: Record<string, string>;
+    }[];
+}
+/**
+ * Provider-neutral egress/network policy, wired to the sandbox firewall AT
+ * CREATE. G5 (ALI-1006) owns the allowlist CONTENT; this slice only plumbs the
+ * option so the orchestrator can pass a policy (incl. a credential-injection
+ * transform for a model endpoint). `'allow-all'` is the provider default when
+ * omitted. Structurally compatible with @vercel/sandbox's `NetworkPolicy`.
+ */
+export type SandboxEgressPolicy = 'allow-all' | 'deny-all' | {
+    allow?: string[] | Record<string, SandboxEgressRule[]>;
+    subnets?: {
+        allow?: string[];
+        deny?: string[];
+    };
+};
+export interface SandboxCreateOpts {
+    language?: string;
+    snapshot?: string;
+    envVars?: Record<string, string>;
+    labels?: Record<string, string>;
+    /** Sandbox auto-terminate timeout (ms). Honored where the provider supports a
+     *  configurable session length (Vercel); ignored by providers that do not. */
+    timeoutMs?: number;
+    /** Provider runtime image hint (e.g. Vercel 'node24'); provider-specific. */
+    runtime?: string;
+    /**
+     * Provider custom-image ref (e.g. Vercel VCR 'orizu-hosted-runtime:<tag>').
+     * When set, the provider creates the sandbox from this pre-baked image instead
+     * of the base runtime (ALI-1017). Provider-specific — Vercel honors it; other
+     * providers ignore it. `runtime` is still the base-runtime hint when no image
+     * is given.
+     */
+    image?: string;
+    /** vCPUs to allocate (memory scales with vCPUs on Vercel: 2048 MiB each). */
+    vcpus?: number;
+    /** Ports to expose from the sandbox (provider-specific; up to 4 on Vercel). */
+    ports?: number[];
+    /** Egress/firewall policy applied at create (G5 supplies content). */
+    egressPolicy?: SandboxEgressPolicy;
+}
+/**
+ * A live sandbox. Per-call git credentials mirror Daytona's contract (and
+ * OpenInspect's credential-helper shape): the token is handed to each operation,
+ * never written once per session.
+ */
+export interface SandboxSession {
+    readonly id: string;
+    gitClone(params: GitCloneParams): Promise<void>;
+    gitPush(params: GitPushParams): Promise<void>;
+    exec(command: string, opts?: {
+        cwd?: string;
+    }): Promise<ExecResult>;
+    readFile(path: string): Promise<string>;
+    writeFile(path: string, content: string): Promise<void>;
+    fileExists(path: string): Promise<boolean>;
+    destroy(): Promise<void>;
+    /**
+     * Extend the sandbox's auto-terminate timeout by `durationMs` (keepalive).
+     * OPTIONAL: only providers with a configurable session length implement it
+     * (Vercel). Host-side token rotation uses it to keep a long session alive
+     * beyond the provider's default. Absent on local-sim / Daytona.
+     */
+    extendTimeout?(durationMs: number): Promise<void>;
+    /**
+     * Snapshot the running sandbox's filesystem state and RETURN the snapshot id
+     * (ALI-1017). A new sandbox can then boot from it via `createSandbox({ snapshot })`
+     * — the zero-Docker "prebaked runtime" path (parallel to a VCR `image`).
+     * OPTIONAL: only providers with a snapshot API implement it (Vercel); absent on
+     * local-sim / Daytona. NOTE: the provider may STOP this sandbox as part of the
+     * snapshot (Vercel does), so treat the session as spent afterwards.
+     *
+     * `expiration` is an optional TTL (ms) for the snapshot; 0 = never expire.
+     */
+    snapshot?(opts?: {
+        expiration?: number;
+    }): Promise<string>;
+}
+export type SandboxProviderKind = 'daytona' | 'local-sim' | 'vercel';
+export interface SandboxProvider {
+    readonly kind: SandboxProviderKind;
+    createSandbox(opts?: SandboxCreateOpts): Promise<SandboxSession>;
+}
+export interface DaytonaProviderConfig {
+    apiKey: string;
+    apiUrl?: string;
+    target?: string;
+}
+interface DaytonaSdkSandbox {
+    id: string;
+    git: {
+        clone(url: string, path: string, branch?: string, commitId?: string, username?: string, password?: string, insecureSkipTls?: boolean): Promise<void>;
+        push(path: string, username?: string, password?: string): Promise<void>;
+    };
+    process: {
+        executeCommand(command: string, cwd?: string, env?: Record<string, string>, timeout?: number): Promise<{
+            exitCode?: number;
+            result?: string;
+            stderr?: string;
+            artifacts?: {
+                stdout?: string;
+                stderr?: string;
+            };
+        }>;
+    };
+    fs: {
+        downloadFile(remotePath: string): Promise<Uint8Array | Buffer | string>;
+        uploadFile(file: Uint8Array, remotePath: string): Promise<void>;
+        getFileDetails(path: string): Promise<unknown>;
+    };
+    delete(timeout?: number): Promise<void>;
+}
+interface DaytonaSdkClient {
+    create(params?: Record<string, unknown>, options?: {
+        timeout: number;
+    }): Promise<DaytonaSdkSandbox>;
+}
+export interface DaytonaSdkModule {
+    Daytona: new (config: {
+        apiKey: string;
+        apiUrl?: string;
+        target?: string;
+    }) => DaytonaSdkClient;
+}
+/** Test seam: inject a fake SDK module so the adapter's request mapping can be
+ *  exercised without the real package installed or a network. */
+export interface DaytonaProviderDeps {
+    loadModule?: () => Promise<DaytonaSdkModule>;
+}
+export declare function createDaytonaProvider(config: DaytonaProviderConfig, deps?: DaytonaProviderDeps): SandboxProvider;
+export interface LocalSimProviderConfig {
+    /** Parent directory for per-sandbox temp dirs (defaults to the OS tmpdir). */
+    rootDir?: string;
+    /** Skip filesystem teardown on destroy() (used by --keep for debugging). */
+    keepOnDestroy?: boolean;
+}
+export declare function createLocalSimProvider(config?: LocalSimProviderConfig): SandboxProvider;
+export {};
+//# sourceMappingURL=sandbox-provider.d.ts.map

package/dist/sandbox-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox-provider.d.ts","sourceRoot":"","sources":["../src/sandbox-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAOH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB;2EACuE;IACvE,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,cAAc;IAC7B,GAAG,EAAE,MAAM,CAAA;IACX,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;CAClB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,SAAS,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,EAAE,CAAA;CACnD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,mBAAmB,GAC3B,WAAW,GACX,UAAU,GACV;IACE,KAAK,CAAC,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAA;IACtD,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAA;CAChD,CAAA;AAEL,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B;kFAC8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB;;;;;;OAMG;IACH,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,6EAA6E;IAC7E,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,EAAE,CAAA;IAChB,sEAAsE;IACtE,YAAY,CAAC,EAAE,mBAAmB,CAAA;CACnC;AAED;;;;GAIG;AACH,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;IACnB,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC/C,OAAO,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7C,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE;QAAE,GAAG,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,UAAU,CAAC,CAAA;IACnE,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;IACvC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACvD,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC1C,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;IACxB;;;;;OAKG;IACH,aAAa,CAAC,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;IACjD;;;;;;;;;OASG;IACH,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAA;CAC3D;AAED,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;AAEpE,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,mBAAmB,CAAA;IAClC,aAAa,CAAC,IAAI,CAAC,EAAE,iBAAiB,GAAG,OAAO,CAAC,cAAc,CAAC,CAAA;CACjE;AAID,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAID,UAAU,iBAAiB;IACzB,EAAE,EAAE,MAAM,CAAA;IACV,GAAG,EAAE;QACH,KAAK,CACH,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,MAAM,CAAC,EAAE,MAAM,EACf,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,QAAQ,CAAC,EAAE,MAAM,EACjB,eAAe,CAAC,EAAE,OAAO,GACxB,OAAO,CAAC,IAAI,CAAC,CAAA;QAChB,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;KACxE,CAAA;IACD,OAAO,EAAE;QACP,cAAc,CACZ,OAAO,EAAE,MAAM,EACf,GAAG,CAAC,EAAE,MAAM,EACZ,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC5B,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC;YAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAC;YAAC,SAAS,CAAC,EAAE;gBAAE,MAAM,CAAC,EAAE,MAAM,CAAC;gBAAC,MAAM,CAAC,EAAE,MAAM,CAAA;aAAE,CAAA;SAAE,CAAC,CAAA;KACtH,CAAA;IACD,EAAE,EAAE;QACF,YAAY,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,MAAM,GAAG,MAAM,CAAC,CAAA;QACvE,UAAU,CAAC,IAAI,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;QAC/D,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;KAC/C,CAAA;IACD,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAA;CACxC;AAED,UAAU,gBAAgB;IACxB,MAAM,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAA;CACpG;AAED,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,KAAK,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,KAAK,gBAAgB,CAAA;CAChG;AAED;iEACiE;AACjE,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,gBAAgB,CAAC,CAAA;CAC7C;AAyGD,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,qBAAqB,EAC7B,IAAI,GAAE,mBAAwB,GAC7B,eAAe,CA0CjB;AAID,MAAM,WAAW,sBAAsB;IACrC,8EAA8E;IAC9E,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,4EAA4E;IAC5E,aAAa,CAAC,EAAE,OAAO,CAAA;CACxB;AAkFD,wBAAgB,sBAAsB,CAAC,MAAM,GAAE,sBAA2B,GAAG,eAAe,CAY3F"}

package/dist/scorer-draft-push.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ADR-007 P5 (ALI-1074): the session-scoped, commit-first scorer push.
+ *
+ * `orizu scorers register --session <id>` creates the version through
+ * POST /api/cli/scorers/drafts: the server commits the scorer's canonical
+ * `manifest.json` to the session's `orizu/session-*` branch (one Git Data API
+ * commit) and then writes a DRAFT row pinning
+ * repo_path/content_sha/commit_sha. The draft seals — and gets its version
+ * number — when the session branch merges via `orizu session finish` +
+ * promotion-manifest apply.
+ *
+ * The git filename is ALWAYS `manifest.json`: the server read side
+ * (lib/artifact-git-read.ts SCORER_MANIFEST_FILENAMES) prefers that name.
+ *
+ * Lives outside index.ts per the CLI line ratchet (ALI-976); mirrors
+ * prompt-draft-push.ts.
+ */
+/** index.ts helpers injected by the command dispatcher (report-comments-cli
+ * precedent: command modules receive a ctx instead of importing the CLI
+ * entrypoint). */
+export interface ScorersRegisterContext {
+    getArg: (name: string) => string | null;
+    resolveProjectSlug: (projectArg: string | null) => Promise<string>;
+    readJsonFile: (pathArg: string) => Record<string, unknown>;
+    hasJsonFlag: () => boolean;
+    printJson: (value: Record<string, unknown>) => void;
+    printLine: (message?: string) => void;
+    parseJsonResponse: (response: Response, label: string) => Promise<Record<string, unknown>>;
+}
+/** The full `orizu scorers register` command (moved out of index.ts for the
+ * CLI line ratchet): --session takes the ADR-007 P5 commit-first draft path,
+ * sessionless stays on the legacy create endpoint. */
+export declare function runScorersRegister(ctx: ScorersRegisterContext): Promise<void>;
+export interface PushScorerDraftInput {
+    project: string;
+    sessionId: string;
+    name: string;
+    /** The parsed scorer manifest (the artifact's canonical bytes). */
+    manifest: Record<string, unknown>;
+    promptVersionId?: string;
+    runnerVersionId?: string;
+    /** Test seam; defaults to the authenticated CLI fetcher. */
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+}
+export interface PushScorerDraftResult {
+    data: Record<string, unknown>;
+    message: string;
+}
+export declare function pushScorerDraft(input: PushScorerDraftInput): Promise<PushScorerDraftResult>;
+//# sourceMappingURL=scorer-draft-push.d.ts.map

package/dist/scorer-draft-push.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorer-draft-push.d.ts","sourceRoot":"","sources":["../src/scorer-draft-push.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;GAgBG;AAEH;;kBAEkB;AAClB,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACvC,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,YAAY,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC1D,WAAW,EAAE,MAAM,OAAO,CAAA;IAC1B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnD,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,iBAAiB,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;CAC3F;AAED;;sDAEsD;AACtD,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAyDnF;AAED,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,mEAAmE;IACnE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IACjC,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC7B,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,qBAAqB,CAAC,CAsCjG"}

package/dist/scorers-cli.d.ts

@@ -0,0 +1,20 @@
+/**
+ * The `orizu scorers` subcommand router (ALI-1554).
+ *
+ * The five historical branches lived inline in index.ts; folding them here
+ * reclaims the headroom the CLI line ratchet (ALI-976) requires before a new
+ * subcommand may be added. Behaviour is unchanged: each handler is the same
+ * function index.ts already called, and an unrecognised subcommand returns
+ * null so main() still falls through to printUsage().
+ */
+export interface ScorersCommandIo {
+    list: () => Promise<void>;
+    register: () => Promise<void>;
+    detail: () => Promise<void>;
+    labelsSet: () => Promise<void>;
+    exec: () => Promise<void>;
+    verifyParity: (args: string[]) => Promise<number>;
+}
+/** Returns the process exit code, or null when the subcommand is not ours. */
+export declare function scorersCommand(args: string[], io: ScorersCommandIo): Promise<number | null>;
+//# sourceMappingURL=scorers-cli.d.ts.map

package/dist/scorers-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorers-cli.d.ts","sourceRoot":"","sources":["../src/scorers-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,QAAQ,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC7B,MAAM,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC3B,SAAS,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IAC9B,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAA;IACzB,YAAY,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAClD;AAED,8EAA8E;AAC9E,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,gBAAgB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAoBjG"}

package/dist/scorers-cli.js

@@ -0,0 +1,22 @@
+/** Returns the process exit code, or null when the subcommand is not ours. */
+export async function scorersCommand(args, io) {
+    const subcommand = args[1];
+    // A Map, not an object literal: `scorers constructor` must not resolve to
+    // an Object.prototype member and be treated as a known subcommand.
+    const handlers = new Map([
+        ['list', io.list], ['register', io.register], ['detail', io.detail], ['exec', io.exec],
+    ]);
+    const handler = subcommand === undefined ? undefined : handlers.get(subcommand);
+    if (handler) {
+        await handler();
+        return 0;
+    }
+    if (subcommand === 'labels' && args[2] === 'set') {
+        await io.labelsSet();
+        return 0;
+    }
+    if (subcommand === 'verify-parity') {
+        return io.verifyParity(args.slice(2));
+    }
+    return null;
+}

package/dist/scorers-verify-parity-bridge.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The customer-side half of `orizu scorers verify-parity` (ALI-1554).
+ *
+ * Embedded as a string constant and written to a temp file at run time on
+ * purpose: no packaging (`files`/`vendor`) change, so there is nothing for the
+ * published tarball to lose. It runs in the CUSTOMER's interpreter and the
+ * customer's unscrubbed environment — it is their metric in their process.
+ *
+ * Contract: reads `{rows: [{row_id, row, model_output}]}` from
+ * ORIZU_PARITY_INPUT_PATH, calls `<module>:<function>(row, model_output)` per
+ * row, and writes `{scores: [{row_id, score} | {row_id, error}]}` to
+ * ORIZU_PARITY_OUTPUT_PATH. Exit 2 (with the reason on stderr) means the check
+ * could not run at all; a per-row exception is that row's error, not an abort.
+ */
+export declare const PARITY_BRIDGE_SOURCE = "import json, math, os, sys, traceback\n\n\ndef fail(message):\n    sys.stderr.write(message + \"\\n\")\n    sys.exit(2)\n\n\ndef last_line(text):\n    lines = [line for line in text.strip().splitlines() if line.strip()]\n    return lines[-1] if lines else \"unknown error\"\n\n\ndef extract(value):\n    # Mirrors orizu_gepa.optimizer._score_from_scorer, minus the clamp: the\n    # CLI clamps both sides so the compared number is what GEPA optimizes.\n    # bool is deliberately NOT rejected: measured, _score_from_scorer(extra=\n    # {'score': True}) -> (1.0, None) and False -> (0.0, None), because bool is an\n    # int subclass and Python's numeric branch accepts it. An exact-match DSPy\n    # metric returning True must compare, not error.\n    if isinstance(value, (int, float)):\n        raw = value\n    elif isinstance(value, dict):\n        raw = value.get(\"score\")\n        if raw is None and isinstance(value.get(\"model_response\"), dict):\n            raw = value[\"model_response\"].get(\"score\")\n    elif hasattr(value, \"score\"):\n        # official GEPA's EvaluationResult NamedTuple and friends;\n        # objective_scores is deliberately ignored.\n        raw = value.score\n    else:\n        raise TypeError(\"scorer result must be a number, a dict with a numeric 'score', or an object with a numeric .score attribute\")\n    if isinstance(raw, str):\n        raw = float(raw)\n    if not isinstance(raw, (int, float)):\n        raise TypeError(\"scorer result must include a numeric score\")\n    raw = float(raw)\n    if not math.isfinite(raw):\n        raise ValueError(\"scorer result score must be finite\")\n    return raw\n\n\ntarget = os.environ.get(\"ORIZU_PARITY_ORIGINAL\", \"\")\nmodule_name, separator, function_name = target.partition(\":\")\nif not separator or not module_name or not function_name:\n    fail(\"--original must be <module>:<function> (got %r)\" % target)\n\n# The customer's metric lives beside the command's cwd, not beside this\n# generated bridge file, so cwd must win over the script directory.\nsys.path.insert(0, os.getcwd())\ntry:\n    import importlib\n\n    module = importlib.import_module(module_name)\nexcept Exception:\n    fail(\"Failed to import original metric module '%s': %s\" % (module_name, last_line(traceback.format_exc())))\n\nif not hasattr(module, function_name):\n    fail(\"Original metric module '%s' has no attribute '%s'\" % (module_name, function_name))\nmetric = getattr(module, function_name)\nif not callable(metric):\n    fail(\"Original metric '%s:%s' is not callable\" % (module_name, function_name))\n\nwith open(os.environ[\"ORIZU_PARITY_INPUT_PATH\"], encoding=\"utf-8\") as handle:\n    payload = json.load(handle)\n\nscores = []\nfor item in payload[\"rows\"]:\n    try:\n        scores.append({\"row_id\": item[\"row_id\"], \"score\": extract(metric(item[\"row\"], item[\"model_output\"]))})\n    except Exception:\n        scores.append({\"row_id\": item[\"row_id\"], \"error\": last_line(traceback.format_exc())})\n\nwith open(os.environ[\"ORIZU_PARITY_OUTPUT_PATH\"], \"w\", encoding=\"utf-8\") as handle:\n    json.dump({\"scores\": scores}, handle)\n";
+//# sourceMappingURL=scorers-verify-parity-bridge.d.ts.map

package/dist/scorers-verify-parity-bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scorers-verify-parity-bridge.d.ts","sourceRoot":"","sources":["../src/scorers-verify-parity-bridge.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,oBAAoB,8lGA2EhC,CAAA"}