pome-sh 0.6.6

package/dist/src/hosted/client.js

@@ -0,0 +1,312 @@
+// SPDX-License-Identifier: Apache-2.0
+import { createEvalSessionResponseSchema, createSessionResponseSchema, finalizeResponseSchema, sessionPublicSchema, submitResultResponseSchema, } from "../types/shared.js";
+import { HostedAuthError, HostedOrchError, HostedQuotaError, } from "./errors.js";
+export function createHostedClient(config) {
+    const timeoutMs = config.timeoutMs ?? 30_000;
+    const authHeaders = config.authScheme === "bearer"
+        ? { authorization: `Bearer ${config.apiKey}` }
+        : { "x-api-key": config.apiKey };
+    async function readResponse(res, parse) {
+        const text = await res.text();
+        let json;
+        try {
+            json = text.length ? JSON.parse(text) : {};
+        }
+        catch {
+            throw new HostedOrchError(`non-JSON response (status ${res.status})`);
+        }
+        if (!res.ok) {
+            // Cloud's REST envelope is `{ error: { type, message, request_id } }`.
+            // The twin pod's bearer-auth middleware uses Hono's default 401 shape:
+            // `{ message: "Forbidden", documentation_url: "" }`. Handle both.
+            const cloudErr = json.error;
+            const twinErr = cloudErr ? null : json;
+            const cloudDetails = cloudErr?.details;
+            const msg = cloudErr?.message ?? twinErr?.message ?? `HTTP ${res.status}`;
+            const reqId = cloudErr?.request_id;
+            if (res.status === 401 || res.status === 403) {
+                throw new HostedAuthError(msg, reqId);
+            }
+            if (res.status === 402 || res.status === 429) {
+                // FDRS-643 — carry the machine-readable envelope details (e.g.
+                // `kind: "daily_judge_cap"`) so `pome demo` can render an honest
+                // labeled at-capacity state instead of a generic quota message.
+                throw new HostedQuotaError(msg, reqId, cloudDetails);
+            }
+            throw new HostedOrchError(msg, reqId, res.status);
+        }
+        try {
+            return parse(json);
+        }
+        catch (err) {
+            throw new HostedOrchError(`unexpected response shape: ${err instanceof Error ? err.message : String(err)}`);
+        }
+    }
+    async function postJson(path, body, parse) {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(`${config.baseUrl}${path}`, {
+                method: "POST",
+                headers: {
+                    ...authHeaders,
+                    "content-type": "application/json",
+                },
+                body: JSON.stringify(body),
+                signal: ctrl.signal,
+            });
+        }
+        catch (err) {
+            throw new HostedOrchError(err instanceof Error ? err.message : "network error");
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        return readResponse(res, parse);
+    }
+    async function getJsonBearer(url, bearer, parse) {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(url, {
+                method: "GET",
+                headers: { authorization: `Bearer ${bearer}` },
+                signal: ctrl.signal,
+            });
+        }
+        catch (err) {
+            throw new HostedOrchError(err instanceof Error ? err.message : "network error");
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        return readResponse(res, parse);
+    }
+    async function getJsonWithApiKey(path, parse) {
+        const ctrl = new AbortController();
+        const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+        let res;
+        try {
+            res = await fetch(`${config.baseUrl}${path}`, {
+                method: "GET",
+                headers: authHeaders,
+                signal: ctrl.signal,
+            });
+        }
+        catch (err) {
+            throw new HostedOrchError(err instanceof Error ? err.message : "network error");
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        return readResponse(res, parse);
+    }
+    return {
+        async createSession(input) {
+            const body = {
+                twins: input.twins,
+                scenario_source: Buffer.from(input.scenarioSource, "utf8").toString("base64"),
+            };
+            if (input.idempotencyKey) {
+                body.idempotency_key = input.idempotencyKey;
+            }
+            if (input.agentId) {
+                body.agent_id = input.agentId;
+            }
+            if (input.seed !== undefined) {
+                body.seed = input.seed;
+            }
+            if (input.groupId) {
+                body.group_id = input.groupId;
+            }
+            return postJson("/v1/sessions", body, (raw) => createSessionResponseSchema.parse(raw));
+        },
+        async abandonSession(sessionId, input) {
+            const body = {};
+            if (input?.errorCode) {
+                body.error_code = input.errorCode;
+            }
+            return postJson(`/v1/sessions/${encodeURIComponent(sessionId)}/abandon`, body, (raw) => {
+                if (typeof raw === "object" &&
+                    raw !== null &&
+                    typeof raw.session_id === "string" &&
+                    typeof raw.state === "string" &&
+                    typeof raw.abandoned === "boolean") {
+                    const shaped = raw;
+                    return {
+                        session_id: shaped.session_id,
+                        state: shaped.state,
+                        error_code: typeof shaped.error_code === "string" ? shaped.error_code : null,
+                        abandoned: shaped.abandoned,
+                    };
+                }
+                throw new HostedOrchError("POST /v1/sessions/:id/abandon returned unexpected shape");
+            });
+        },
+        async createEvalSession(input) {
+            // 404 from an older control plane surfaces as HostedOrchError with the
+            // cloud's own message; `pome eval` adds the upgrade hint at the CLI
+            // layer.
+            return postJson("/v1/eval-sessions", { agent: input.agent, task_name: input.taskName }, (raw) => createEvalSessionResponseSchema.parse(raw));
+        },
+        async listSessions(opts) {
+            const lim = opts?.limit ?? 50;
+            const q = `?limit=${encodeURIComponent(String(lim))}`;
+            return getJsonWithApiKey(`/v1/sessions${q}`, (raw) => {
+                if (!Array.isArray(raw)) {
+                    throw new HostedOrchError("GET /v1/sessions expected a JSON array");
+                }
+                return raw.map((row) => sessionPublicSchema.parse(row));
+            });
+        },
+        async getSession(sessionId) {
+            return getJsonWithApiKey(`/v1/sessions/${encodeURIComponent(sessionId)}`, (raw) => sessionPublicSchema.parse(raw));
+        },
+        async fetchState(input) {
+            return getJsonBearer(`${input.twinUrl}/_pome/state`, input.agentToken, 
+            // domain.exportState() shape varies per twin; pass through.
+            (raw) => raw);
+        },
+        async fetchEvents(input) {
+            return getJsonBearer(`${input.twinUrl}/_pome/events`, input.agentToken, (raw) => {
+                if (!Array.isArray(raw)) {
+                    throw new HostedOrchError("twin /_pome/events returned non-array");
+                }
+                return raw;
+            });
+        },
+        async requestEventsUploadUrl(sessionId) {
+            return postJson(`/v1/sessions/${encodeURIComponent(sessionId)}/result-upload-url`, {}, (raw) => {
+                if (typeof raw === "object" &&
+                    raw !== null &&
+                    typeof raw.url === "string" &&
+                    typeof raw.key === "string") {
+                    return raw;
+                }
+                throw new HostedOrchError("POST /v1/sessions/:id/result-upload-url returned unexpected shape");
+            });
+        },
+        async requestSignalsUploadUrl(sessionId) {
+            return postJson(`/v1/sessions/${encodeURIComponent(sessionId)}/signals-upload-url`, {}, (raw) => {
+                if (typeof raw === "object" &&
+                    raw !== null &&
+                    typeof raw.url === "string" &&
+                    typeof raw.key === "string") {
+                    return raw;
+                }
+                throw new HostedOrchError("POST /v1/sessions/:id/signals-upload-url returned unexpected shape");
+            });
+        },
+        async requestStateUploadUrl(sessionId) {
+            return postJson(`/v1/sessions/${encodeURIComponent(sessionId)}/state-upload-url`, {}, (raw) => {
+                const isEntry = (x) => typeof x === "object" &&
+                    x !== null &&
+                    typeof x.url === "string" &&
+                    typeof x.key === "string";
+                if (typeof raw === "object" &&
+                    raw !== null &&
+                    isEntry(raw.state_initial) &&
+                    isEntry(raw.state_final)) {
+                    return raw;
+                }
+                throw new HostedOrchError("POST /v1/sessions/:id/state-upload-url returned unexpected shape");
+            });
+        },
+        async finalize(sessionId, input) {
+            const body = {
+                stop_reason: input.stopReason,
+                exit_code: input.exitCode,
+                duration_ms: input.durationMs,
+                agent_model: input.agentModel,
+                agent_sdk: normalizeAgentSdk(input.agentSdk),
+                criteria: input.criteria,
+                scenario_name: input.scenarioName,
+                scenario_hash: input.scenarioHash,
+                scenario_prompt: input.scenarioPrompt,
+                expected_behavior: input.expectedBehavior,
+            };
+            if (input.traceStorageKey !== undefined) {
+                body.trace_storage_key = input.traceStorageKey;
+            }
+            if (input.stateInitialStorageKey !== undefined) {
+                body.state_initial_storage_key = input.stateInitialStorageKey;
+            }
+            if (input.stateFinalStorageKey !== undefined) {
+                body.state_final_storage_key = input.stateFinalStorageKey;
+            }
+            if (input.signalsStorageKey !== undefined) {
+                body.signals_storage_key = input.signalsStorageKey;
+            }
+            return postJson(`/v1/sessions/${encodeURIComponent(sessionId)}/finalize`, body, (raw) => finalizeResponseSchema.parse(raw));
+        },
+        async submitResult(sessionId, input) {
+            return postJson(`/v1/sessions/${encodeURIComponent(sessionId)}/result`, {
+                scenario_name: input.scenarioName,
+                scenario_hash: input.scenarioHash,
+                duration_ms: input.durationMs,
+                agent_model: input.agentModel,
+                satisfaction_score: input.satisfactionScore,
+                criteria_results: input.criteriaResults,
+                judge_model: input.judgeModel,
+                judge_tokens_in: input.judgeTokensIn,
+                judge_tokens_out: input.judgeTokensOut,
+                agent_sdk: normalizeAgentSdk(input.agentSdk),
+                lanes: input.lanes,
+                steps: input.steps,
+                fix_prompt: input.fixPrompt,
+                events_jsonl_url: input.eventsJsonlUrl,
+                trace_jsonl_b64: Buffer.from(input.traceJsonl, "utf8").toString("base64"),
+                state_initial_json_b64: Buffer.from(input.stateInitialJson, "utf8").toString("base64"),
+                state_final_json_b64: Buffer.from(input.stateFinalJson, "utf8").toString("base64"),
+            }, (raw) => submitResultResponseSchema.parse(raw));
+        },
+        async deleteSession(sessionId, bestEffort = true) {
+            const ctrl = new AbortController();
+            const timer = setTimeout(() => ctrl.abort(), timeoutMs);
+            let res;
+            try {
+                res = await fetch(`${config.baseUrl}/v1/sessions/${encodeURIComponent(sessionId)}`, {
+                    method: "DELETE",
+                    // authHeaders, not a hardcoded x-api-key: demo teardown carries a
+                    // bearer demo_token (FDRS-643 live-run finding — the hardcoded
+                    // header made every demo DELETE an opaque 404, silently swallowed
+                    // by best-effort).
+                    headers: authHeaders,
+                    signal: ctrl.signal,
+                });
+            }
+            catch (err) {
+                if (bestEffort)
+                    return;
+                throw new HostedOrchError(err instanceof Error ? err.message : "network error");
+            }
+            finally {
+                clearTimeout(timer);
+            }
+            // Cloud spec (pome-cloud docs/05-api-spec.md): 204 on success. Accept
+            // 200 too in case a future control-plane returns a body. 409 keeps
+            // best-effort teardown idempotent when a concurrent reaper already
+            // closed the row.
+            if (res.status === 204 || res.status === 200 || res.status === 409)
+                return;
+            if (res.status === 404) {
+                if (bestEffort)
+                    return;
+                throw new HostedOrchError(`DELETE /v1/sessions/${sessionId} → 404 (not found)`);
+            }
+            if (res.status === 401 || res.status === 403) {
+                throw new HostedAuthError(`DELETE /v1/sessions/${sessionId} → ${res.status}`);
+            }
+            // 404 / 5xx — log via thrown but caller can swallow if mid-teardown.
+            throw new HostedOrchError(`DELETE /v1/sessions/${sessionId} → ${res.status}`);
+        },
+    };
+}
+function normalizeAgentSdk(value) {
+    if (typeof value !== "string")
+        return null;
+    const trimmed = value.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}

package/dist/src/hosted/errors.d.ts

@@ -0,0 +1,36 @@
+export declare class HostedAuthError extends Error {
+    readonly requestId?: string | undefined;
+    constructor(message: string, requestId?: string | undefined);
+}
+export declare class HostedQuotaError extends Error {
+    readonly requestId?: string | undefined;
+    readonly details?: Record<string, unknown> | undefined;
+    /** `details` mirrors the cloud error envelope's machine-readable details
+     *  (e.g. `{ kind: "daily_judge_cap" }`) so `pome demo` (FDRS-643/662) can
+     *  render honest labeled at-capacity states. Optional: older responses and
+     *  the twin-pod 401 shape carry none. */
+    constructor(message: string, requestId?: string | undefined, details?: Record<string, unknown> | undefined);
+}
+export declare class HostedOrchError extends Error {
+    readonly requestId?: string | undefined;
+    readonly status?: number | undefined;
+    /** `status` is the HTTP status that produced this error, when one exists
+     *  (network/parse failures leave it undefined). `pome eval` uses it to
+     *  scope its reaped-session retry to 404/410 only (FDRS-656 review). */
+    constructor(message: string, requestId?: string | undefined, status?: number | undefined);
+}
+/** Bad invocation — missing scenario file, unknown flag value, etc. Maps
+ *  to documented exit code 5 ("usage error"). F0-5a. */
+export declare class HostedUsageError extends Error {
+    constructor(message: string);
+}
+/** FDRS-636 — a group trial errored before a cloud verdict existed
+ *  (preflight failure, agent timeout, agent crash). The session was
+ *  abandoned (POST /v1/sessions/:id/abandon) with `errorCode`; the group
+ *  runner renders the trial as an errored row EXCLUDED from the verdict
+ *  fraction. `message` is the short human reason shown on that row. */
+export declare class HostedTrialError extends Error {
+    readonly errorCode: string;
+    constructor(message: string, errorCode: string);
+}
+export declare function exitCodeFor(err: unknown): number;

package/dist/src/hosted/errors.js

@@ -0,0 +1,91 @@
+// SPDX-License-Identifier: Apache-2.0
+// Cloud → CLI exit-code mapping per docs/05-api-spec.md §1 "pome run".
+//   0 — pass; 1 — below pass-threshold; 2 — twin/orch error;
+//   3 — auth (401/403); 4 — quota (402/429); 5 — usage error.
+//
+// Session A (Linear FDRS-423) audit confirmed cloud-side responses map
+// cleanly: 401 only from `lib/auth.ts` (CLI exit 3), 402/429 = quota (CLI
+// exit 4), 502 = downstream/gateway (CLI exit 2), 410/426 are not auth
+// errors (CLI exit 2). F0-5 covers the CLI-side mapping gaps the test
+// plan walkthrough surfaced:
+//   - F0-5a: `pome run /does/not/exist.md` was returning exit 2 instead
+//     of 5 because file-not-found threw a plain Error.
+//   - F0-5c: `pome logout && pome run` was returning exit 2 instead of 3
+//     because credential-resolution failure threw a plain Error.
+//   - F18: hosted sub-threshold runs sometimes returned exit 3 because
+//     `runScenarioHosted.ts` mapped any non-zero agent exit to exit 3,
+//     stealing the auth slot.
+//
+// FDRS-636 — trial groups (`pome run -n k`, k>1) map the WHOLE GROUP to one
+// exit code ([DECISION 2026-07-05]):
+//   0 — at least one trial completed AND every completed trial passed;
+//   1 — at least one completed trial failed its pass threshold;
+//   2 — no trial completed (every trial errored/was abandoned).
+// Errored trials are excluded from the verdict fraction and never lower a
+// passing group below 0 on their own. Single-run (k=1) semantics above are
+// untouched.
+export class HostedAuthError extends Error {
+    requestId;
+    constructor(message, requestId) {
+        super(message);
+        this.requestId = requestId;
+        this.name = "HostedAuthError";
+    }
+}
+export class HostedQuotaError extends Error {
+    requestId;
+    details;
+    /** `details` mirrors the cloud error envelope's machine-readable details
+     *  (e.g. `{ kind: "daily_judge_cap" }`) so `pome demo` (FDRS-643/662) can
+     *  render honest labeled at-capacity states. Optional: older responses and
+     *  the twin-pod 401 shape carry none. */
+    constructor(message, requestId, details) {
+        super(message);
+        this.requestId = requestId;
+        this.details = details;
+        this.name = "HostedQuotaError";
+    }
+}
+export class HostedOrchError extends Error {
+    requestId;
+    status;
+    /** `status` is the HTTP status that produced this error, when one exists
+     *  (network/parse failures leave it undefined). `pome eval` uses it to
+     *  scope its reaped-session retry to 404/410 only (FDRS-656 review). */
+    constructor(message, requestId, status) {
+        super(message);
+        this.requestId = requestId;
+        this.status = status;
+        this.name = "HostedOrchError";
+    }
+}
+/** Bad invocation — missing scenario file, unknown flag value, etc. Maps
+ *  to documented exit code 5 ("usage error"). F0-5a. */
+export class HostedUsageError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "HostedUsageError";
+    }
+}
+/** FDRS-636 — a group trial errored before a cloud verdict existed
+ *  (preflight failure, agent timeout, agent crash). The session was
+ *  abandoned (POST /v1/sessions/:id/abandon) with `errorCode`; the group
+ *  runner renders the trial as an errored row EXCLUDED from the verdict
+ *  fraction. `message` is the short human reason shown on that row. */
+export class HostedTrialError extends Error {
+    errorCode;
+    constructor(message, errorCode) {
+        super(message);
+        this.errorCode = errorCode;
+        this.name = "HostedTrialError";
+    }
+}
+export function exitCodeFor(err) {
+    if (err instanceof HostedAuthError)
+        return 3;
+    if (err instanceof HostedQuotaError)
+        return 4;
+    if (err instanceof HostedUsageError)
+        return 5;
+    return 2;
+}

package/dist/src/hosted/uploadAndFinalize.d.ts

@@ -0,0 +1,52 @@
+import type { HostedClient } from "./client.js";
+import type { FinalizeResponse } from "../types/shared.js";
+import type { Score } from "../score/view.js";
+/** The narrow client surface the upload orchestration needs. `pome eval`
+ *  mocks exactly this in tests instead of the full HostedClient. */
+export type UploadClient = Pick<HostedClient, "requestEventsUploadUrl" | "requestStateUploadUrl" | "requestSignalsUploadUrl">;
+export interface RunBlobs {
+    eventsJsonl: string;
+    stateInitialJson: string;
+    stateFinalJson: string;
+    /** Pre-redacted JSONL. Empty / whitespace-only skips the signals upload
+     *  entirely so cloud doesn't allocate storage for "{}" payloads (F0-4 / L7). */
+    signalsJsonl: string;
+}
+export interface UploadedBlobKeys {
+    eventsKey: string | null;
+    stateInitialKey: string | null;
+    stateFinalKey: string | null;
+    signalsKey: string | null;
+}
+/**
+ * Upload events.jsonl + state blobs + adapter signals.jsonl to cloud storage
+ * in parallel. /finalize defaults the trace storage key to the conventional
+ * `team-<>/session-<>/events.jsonl` path, so cloud's judge finds the trace
+ * without an explicit override. State blobs and signals have no conventional
+ * fallback today — without an explicit override the judge sees "{}" for
+ * state files (FDRS-395) and skips the adapter-rich correlator (F0-4 / L7).
+ * All four uploads are best-effort: any failure leaves the corresponding
+ * blob missing (`null` key), the judge still runs against whatever it does
+ * have, and the dashboard handles nulls gracefully.
+ */
+export declare function uploadRunBlobs(client: UploadClient, sessionId: string, blobs: RunBlobs): Promise<UploadedBlobKeys>;
+/**
+ * Synthesize a Score shape backed by the cloud-authoritative satisfaction.
+ * F0-3 / L5 — Session A added `criteria_results[]` to /finalize so the CLI
+ * can render per-criterion verdicts on hosted runs (`pome inspect`,
+ * `pome fix-prompt`) without a follow-up cloud round-trip. Older cloud
+ * builds (pre-Session A) omit the field; default to an empty array — the
+ * fix-prompt action still bails cleanly when results are missing.
+ *
+ * A1 CAVEAT (FDRS-618): `satisfaction` here is the CLOUD-authoritative
+ * score (`finalized.score`) — the hosted judge does NOT yet implement the
+ * FDRS-591/611 outcome semantics, so `evaluated`/`can_pass` are derived
+ * locally only when /finalize returns per-criterion results. Older cloud
+ * builds omit `criteria_results`; for those, preserve the cloud score as
+ * renderable instead of inventing an empty local A5 verdict.
+ */
+export declare function scoreFromFinalizeResponse(finalized: FinalizeResponse): Score;
+/** Redact a JSONL payload line-by-line before upload. Lines that fail to
+ *  parse as JSON are redacted as raw strings. Moved verbatim from
+ *  runScenarioHosted.ts (FDRS-656). */
+export declare function redactJsonl(body: string): string;

package/dist/src/hosted/uploadAndFinalize.js

@@ -0,0 +1,159 @@
+// SPDX-License-Identifier: Apache-2.0
+//
+// Shared presigned-upload + finalize-score orchestration for cloud sessions
+// (ADR-013). Extracted verbatim from runScenarioHosted.ts (FDRS-656) so
+// `pome eval <run-dir>` reuses the exact same best-effort PUT semantics
+// without duplicating them. Behavior-preserving for the hosted run path:
+// warning text, the 30s PUT timeout, and the null-key fallbacks all match
+// the pre-extraction runner.
+import { outcomeOf } from "../score/view.js";
+import { redactSecrets } from "../recorder/redaction.js";
+async function putBlob(url, body, contentType, label) {
+    const ctrl = new AbortController();
+    const timer = setTimeout(() => ctrl.abort(), 30_000);
+    try {
+        const putRes = await fetch(url, {
+            method: "PUT",
+            headers: { "content-type": contentType },
+            body,
+            signal: ctrl.signal,
+        });
+        if (!putRes.ok) {
+            console.warn(`[pome] ${label} upload PUT ${url} → ${putRes.status}; continuing with key=null`);
+            return false;
+        }
+        return true;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+/**
+ * Upload events.jsonl + state blobs + adapter signals.jsonl to cloud storage
+ * in parallel. /finalize defaults the trace storage key to the conventional
+ * `team-<>/session-<>/events.jsonl` path, so cloud's judge finds the trace
+ * without an explicit override. State blobs and signals have no conventional
+ * fallback today — without an explicit override the judge sees "{}" for
+ * state files (FDRS-395) and skips the adapter-rich correlator (F0-4 / L7).
+ * All four uploads are best-effort: any failure leaves the corresponding
+ * blob missing (`null` key), the judge still runs against whatever it does
+ * have, and the dashboard handles nulls gracefully.
+ */
+export async function uploadRunBlobs(client, sessionId, blobs) {
+    async function uploadEvents() {
+        try {
+            const upload = await client.requestEventsUploadUrl(sessionId);
+            const ok = await putBlob(upload.url, blobs.eventsJsonl, "application/x-ndjson", "events.jsonl");
+            return ok ? upload.key : null;
+        }
+        catch (err) {
+            console.warn(`[pome] events.jsonl upload skipped (${err instanceof Error ? err.message : String(err)}); continuing with events_jsonl_url=null`);
+            return null;
+        }
+    }
+    // F0-4 / L7 — upload adapter signals if the agent emitted any. When the
+    // payload is empty (no withPome() wrap, or no hooks fired), skip the
+    // upload entirely.
+    async function uploadSignals() {
+        try {
+            if (blobs.signalsJsonl.trim().length === 0) {
+                return null;
+            }
+            const upload = await client.requestSignalsUploadUrl(sessionId);
+            const ok = await putBlob(upload.url, blobs.signalsJsonl, "application/x-ndjson", "signals.jsonl");
+            return ok ? upload.key : null;
+        }
+        catch (err) {
+            console.warn(`[pome] signals.jsonl upload skipped (${err instanceof Error ? err.message : String(err)}); continuing with signals_storage_key=null`);
+            return null;
+        }
+    }
+    async function uploadStates() {
+        try {
+            const upload = await client.requestStateUploadUrl(sessionId);
+            const [initialOk, finalOk] = await Promise.all([
+                putBlob(upload.state_initial.url, blobs.stateInitialJson, "application/json", "state_initial.json"),
+                putBlob(upload.state_final.url, blobs.stateFinalJson, "application/json", "state_final.json"),
+            ]);
+            return {
+                initialKey: initialOk ? upload.state_initial.key : null,
+                finalKey: finalOk ? upload.state_final.key : null,
+            };
+        }
+        catch (err) {
+            console.warn(`[pome] state blob upload skipped (${err instanceof Error ? err.message : String(err)}); continuing with state_*_storage_key=null`);
+            return { initialKey: null, finalKey: null };
+        }
+    }
+    const [eventsKey, stateKeys, signalsKey] = await Promise.all([
+        uploadEvents(),
+        uploadStates(),
+        uploadSignals(),
+    ]);
+    return {
+        eventsKey,
+        stateInitialKey: stateKeys.initialKey,
+        stateFinalKey: stateKeys.finalKey,
+        signalsKey,
+    };
+}
+/**
+ * Synthesize a Score shape backed by the cloud-authoritative satisfaction.
+ * F0-3 / L5 — Session A added `criteria_results[]` to /finalize so the CLI
+ * can render per-criterion verdicts on hosted runs (`pome inspect`,
+ * `pome fix-prompt`) without a follow-up cloud round-trip. Older cloud
+ * builds (pre-Session A) omit the field; default to an empty array — the
+ * fix-prompt action still bails cleanly when results are missing.
+ *
+ * A1 CAVEAT (FDRS-618): `satisfaction` here is the CLOUD-authoritative
+ * score (`finalized.score`) — the hosted judge does NOT yet implement the
+ * FDRS-591/611 outcome semantics, so `evaluated`/`can_pass` are derived
+ * locally only when /finalize returns per-criterion results. Older cloud
+ * builds omit `criteria_results`; for those, preserve the cloud score as
+ * renderable instead of inventing an empty local A5 verdict.
+ */
+export function scoreFromFinalizeResponse(finalized) {
+    const hasCriteriaResults = finalized.criteria_results !== undefined;
+    const results = finalized.criteria_results ?? [];
+    const passed = results.filter((r) => outcomeOf(r) === "passed").length;
+    const failed = results.filter((r) => outcomeOf(r) === "failed").length;
+    const errored = results.filter((r) => outcomeOf(r) === "errored").length;
+    const skipped = results.filter((r) => outcomeOf(r) === "skipped").length;
+    const totalRequired = passed + failed;
+    return {
+        satisfaction: finalized.score,
+        passed,
+        failed,
+        skipped,
+        errored,
+        total_required: totalRequired,
+        evaluated: hasCriteriaResults ? totalRequired > 0 : true,
+        can_pass: hasCriteriaResults
+            ? totalRequired > 0 && skipped === 0 && errored === 0
+            : true,
+        results,
+        judge_model: finalized.judge_model ?? null,
+        judge_tokens_in: null,
+        judge_tokens_out: null,
+    };
+}
+/** Redact a JSONL payload line-by-line before upload. Lines that fail to
+ *  parse as JSON are redacted as raw strings. Moved verbatim from
+ *  runScenarioHosted.ts (FDRS-656). */
+export function redactJsonl(body) {
+    const lines = body.split("\n");
+    const redacted = lines
+        // Whitespace-only lines are dropped (not just empty ones) so validation
+        // (`validateJsonl`, which trims) and upload agree on what counts as a
+        // row — a " " line must never reach cloud as a non-JSON record.
+        .filter((line) => line.trim().length > 0)
+        .map((line) => {
+        try {
+            return JSON.stringify(redactSecrets(JSON.parse(line)));
+        }
+        catch {
+            return redactSecrets(line);
+        }
+    });
+    return redacted.length > 0 ? `${redacted.join("\n")}\n` : "";
+}