spawnfile 0.1.14 → 0.1.18

package/dist/cli/paideiaDelegation.js

@@ -0,0 +1,211 @@
+import { spawn } from "node:child_process";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+import { setTimeout as delay } from "node:timers/promises";
+import { fileURLToPath } from "node:url";
+import { trainingContextSchema } from "../compiler/training/index.js";
+import { launchTrainingContainer } from "../compiler/training/container/index.js";
+import { runTrainingDocker } from "../compiler/training/container/process.js";
+import { prepareTraining } from "../compiler/training/preparation/index.js";
+import { readBoundedJson } from "../compiler/training/preparation/inputs.js";
+import { SpawnfileError } from "../shared/index.js";
+const MAX_LINE_BYTES = 1024 * 1024;
+const validReceipt = (line, dryRun) => {
+    try {
+        const value = JSON.parse(line);
+        if (typeof value !== "object" || value === null)
+            return false;
+        const receipt = value;
+        return dryRun
+            ? receipt.schema === "paideia.training-cost-plan.v1" && receipt.modelCallsMade === 0
+            : receipt.status === "completed" && typeof receipt.index === "string" && receipt.index.length > 0;
+    }
+    catch {
+        return false;
+    }
+};
+const failure = (message) => new SpawnfileError("runtime_error", message);
+const runChild = (options, contextPath) => new Promise((resolve, reject) => {
+    if (options.signal?.aborted) {
+        resolve(130);
+        return;
+    }
+    // Node strips types in a source checkout; the packaged build selects its emitted JS.
+    const extension = path.extname(fileURLToPath(import.meta.url));
+    const supervisor = fileURLToPath(new URL(`./paideiaSupervisor${extension}`, import.meta.url));
+    const child = spawn(process.execPath, ["--experimental-strip-types", supervisor, options.command,
+        "train", "--spawnfile-context", contextPath, ...options.args], {
+        shell: false, detached: true, stdio: ["ignore", "pipe", "pipe", "ipc"]
+    });
+    const pid = child.pid;
+    let stdout = "", stderr = "", lastLine = "";
+    let stopCode, error, outcome;
+    let reaped = false, closed = false, finished = false;
+    let killTimer;
+    const kill = (signal) => {
+        if (pid === undefined || reaped)
+            return;
+        try {
+            process.kill(-pid, signal);
+        }
+        catch (caught) {
+            if (caught.code !== "ESRCH")
+                error = failure("Could not signal the owned Paideia process group");
+        }
+    };
+    const groupExists = () => {
+        if (pid === undefined)
+            return false;
+        try {
+            process.kill(-pid, 0);
+            return true;
+        }
+        catch (caught) {
+            return caught.code !== "ESRCH";
+        }
+    };
+    const stop = (code, cause) => {
+        if (stopCode !== undefined)
+            return;
+        stopCode = code;
+        error = cause;
+        kill("SIGTERM");
+        killTimer = setTimeout(() => kill("SIGKILL"), 1000);
+        killTimer.unref();
+    };
+    const interrupt = () => stop(130), terminate = () => stop(143), abort = () => stop(130);
+    const timer = setTimeout(() => stop(1, failure("Paideia training exceeded its command deadline")), options.timeoutMs);
+    timer.unref();
+    process.once("SIGINT", interrupt);
+    process.once("SIGTERM", terminate);
+    options.signal?.addEventListener("abort", abort, { once: true });
+    if (options.signal?.aborted)
+        abort();
+    const consume = (chunk, channel) => {
+        const lines = ((channel === "stdout" ? stdout : stderr) + chunk).split("\n");
+        const remainder = lines.pop();
+        if ([remainder, ...lines].some((line) => Buffer.byteLength(line, "utf8") > MAX_LINE_BYTES)) {
+            stop(1, failure("Paideia output exceeded the bounded JSON-line contract"));
+            return;
+        }
+        for (const raw of lines) {
+            const line = raw.replace(/\r$/u, "");
+            if (!line.trim())
+                continue;
+            if (channel === "stdout")
+                lastLine = line;
+            options.streams[channel](line);
+        }
+        if (channel === "stdout")
+            stdout = remainder;
+        else
+            stderr = remainder;
+    };
+    child.stdout.setEncoding("utf8").on("data", (chunk) => consume(chunk, "stdout"));
+    child.stderr.setEncoding("utf8").on("data", (chunk) => consume(chunk, "stderr"));
+    child.once("message", (message) => {
+        outcome = message;
+        if (message.type === "paideia.process.launch-error")
+            error = failure(`Could not start Paideia: ${message.message}`);
+        // The native child exited, but our supervisor still holds the group identity.
+        // Stop stragglers before permitting its leader to disappear or reporting completion.
+        kill("SIGKILL");
+    });
+    const finish = async () => {
+        if (finished)
+            return;
+        finished = true;
+        clearTimeout(timer);
+        clearTimeout(killTimer);
+        process.removeListener("SIGINT", interrupt);
+        process.removeListener("SIGTERM", terminate);
+        options.signal?.removeEventListener("abort", abort);
+        const deadline = Date.now() + 1500;
+        // Check only: never signal a numeric group identity after its supervisor was reaped.
+        while ((groupExists() || !closed) && Date.now() < deadline)
+            await delay(20);
+        if (groupExists() || !closed) {
+            error = failure("Paideia process cleanup is incomplete; group or output quiescence is unknown");
+            child.stdout.destroy();
+            child.stderr.destroy();
+        }
+        if (stdout.trim()) {
+            lastLine = stdout;
+            options.streams.stdout(stdout);
+        }
+        if (stderr.trim())
+            options.streams.stderr(stderr);
+        if (error) {
+            reject(error);
+            return;
+        }
+        if (stopCode !== undefined) {
+            resolve(stopCode);
+            return;
+        }
+        if (outcome?.type !== "paideia.process.exited") {
+            reject(failure("Paideia supervisor exited without a native outcome"));
+            return;
+        }
+        if (outcome.signal) {
+            resolve(outcome.signal === "SIGINT" ? 130 : outcome.signal === "SIGTERM" ? 143 : 1);
+            return;
+        }
+        const exitCode = outcome.code ?? 1;
+        if ((exitCode === 0 || exitCode === 1) && !validReceipt(lastLine, options.dryRun)) {
+            reject(failure("Paideia exited without the required final training receipt"));
+            return;
+        }
+        resolve(exitCode);
+    };
+    child.once("error", (caught) => { error = failure(`Could not start Paideia supervisor: ${caught.message}`); });
+    child.once("exit", () => { reaped = true; void finish(); });
+    child.once("close", () => { closed = true; void finish(); });
+});
+/** Delegates through the public CLI, never importing Paideia or selecting a fallback adapter. */
+export const delegatePaideiaTraining = async (options) => {
+    if (options.signal?.aborted)
+        return 130;
+    if (options.repairWitness && !options.repairMeasurements)
+        throw failure("--repair-witness requires --repair-measurements");
+    if (options.trainingConfig) {
+        const config = await readBoundedJson(options.trainingConfig);
+        // Image declarations go through preparation; lowered launch configurations go straight to Docker.
+        if (config.version === "spawnfile.training-container.v2" || (["spawnfile.training-container.v3", "spawnfile.training-container.v4"].includes(String(config.version)) && config.image !== undefined)) {
+            if (options.trainingImage && !options.execution)
+                throw failure("V2 owns its image declaration; --training-image is only for v1");
+            const prepared = await prepareTraining({ configPath: options.trainingConfig, context: options.context, args: options.args,
+                repairMeasurements: options.repairMeasurements, repairWitness: options.repairWitness,
+                execution: options.execution, outputOverride: options.execution?.output, imageOverride: options.execution ? options.trainingImage : undefined,
+                dryRun: options.dryRun, process: runTrainingDocker, timeoutMs: options.timeoutMs, signal: options.signal, streams: options.streams });
+            if (!("dryRun" in prepared))
+                return launchTrainingContainer({ ...prepared,
+                    timeoutMs: options.timeoutMs, signal: options.signal, streams: options.streams });
+            options.streams.stderr(`Training preparation plan ${prepared.digest}; no Docker, auth or filesystem mutations`);
+            options = { ...options, repairMeasurements: undefined, repairWitness: undefined };
+        }
+    }
+    if (options.repairMeasurements)
+        throw failure("Measurement repair requires the v2 preparation declaration");
+    if (!options.dryRun) {
+        if (!options.trainingImage || !options.trainingConfig)
+            throw failure("Actual training requires --training-image and --training-config; host execution is disabled");
+        return launchTrainingContainer({ image: options.trainingImage, configPath: options.trainingConfig,
+            context: options.context, args: options.args, execution: options.execution, timeoutMs: options.timeoutMs, streams: options.streams, signal: options.signal });
+    }
+    if (process.platform === "win32")
+        throw failure("Paideia delegation requires POSIX process-group supervision");
+    const bytes = JSON.stringify(trainingContextSchema.parse(options.context));
+    if (Buffer.byteLength(bytes, "utf8") > MAX_LINE_BYTES)
+        throw new SpawnfileError("validation_error", "Training context exceeds 1 MiB");
+    const temporary = await mkdtemp(path.join(os.tmpdir(), "spawnfile-training-"));
+    const contextPath = path.join(temporary, "context.json");
+    try {
+        await writeFile(contextPath, bytes, { mode: 0o600, flag: "wx" });
+        return await runChild(options, contextPath);
+    }
+    finally {
+        await rm(temporary, { recursive: true, force: true });
+    }
+};

package/dist/cli/paideiaSupervisor.d.ts

@@ -0,0 +1,17 @@
+import { type ChildProcess } from "node:child_process";
+export type PaideiaProcessOutcome = {
+    type: "paideia.process.exited";
+    code: number | null;
+    signal: NodeJS.Signals | null;
+} | {
+    type: "paideia.process.launch-error";
+    message: string;
+};
+type SupervisorProcess = Pick<NodeJS.Process, "send" | "pid" | "on" | "removeListener" | "kill" | "exit">;
+export interface PaideiaSupervisorHost {
+    process: SupervisorProcess;
+    launch(command: string, args: string[]): ChildProcess;
+}
+/** Remains the owned group leader until the parent closes the entire group. */
+export declare const supervisePaideia: (argv: readonly string[], host?: PaideiaSupervisorHost) => (() => void);
+export {};

package/dist/cli/paideiaSupervisor.js

@@ -0,0 +1,48 @@
+import { spawn } from "node:child_process";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+const defaultHost = {
+    process,
+    launch: (command, args) => spawn(command, args, { shell: false, stdio: ["ignore", "inherit", "inherit"] })
+};
+/** Remains the owned group leader until the parent closes the entire group. */
+export const supervisePaideia = (argv, host = defaultHost) => {
+    const [command, ...args] = argv;
+    if (!command || !host.process.send)
+        throw new Error("Paideia supervisor requires an executable and private IPC");
+    const hold = setInterval(() => undefined, 1000);
+    const ignore = () => undefined;
+    const disconnect = () => {
+        // This process is still alive: its own group identity cannot have been recycled.
+        try {
+            host.process.kill(-host.process.pid, "SIGKILL");
+        }
+        finally {
+            host.process.exit(1);
+        }
+    };
+    host.process.on("SIGINT", ignore).on("SIGTERM", ignore).on("disconnect", disconnect);
+    let reported = false;
+    const report = (outcome) => {
+        if (reported)
+            return;
+        reported = true;
+        host.process.send(outcome);
+    };
+    const child = host.launch(command, args);
+    child.once("error", (error) => report({ type: "paideia.process.launch-error", message: error.message }));
+    child.once("exit", (code, signal) => report({ type: "paideia.process.exited", code, signal }));
+    return () => {
+        clearInterval(hold);
+        host.process.removeListener("SIGINT", ignore).removeListener("SIGTERM", ignore).removeListener("disconnect", disconnect);
+    };
+};
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+    try {
+        supervisePaideia(process.argv.slice(2));
+    }
+    catch (error) {
+        process.stderr.write(`${error instanceof Error ? error.message : String(error)}\n`);
+        process.exitCode = 1;
+    }
+}

package/dist/cli/productStateCloneCommand.d.ts

@@ -0,0 +1,2 @@
+export declare const isProductStateCloneInvocation: (argv: readonly string[]) => boolean;
+export declare const runProductStateCloneCommand: (argv: readonly string[]) => Promise<number>;

package/dist/cli/productStateCloneCommand.js

@@ -0,0 +1,34 @@
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { z } from "zod";
+import { issueProductStateSourceSnapshot, runProductStateCloneWorkflow } from "../deployment/productStateClone.js";
+const requestSchema = z.object({ version: z.literal("spawnfile.product-state-clone-request.v1"), authority_receipt_path: z.string().min(1).max(4096), docker_command: z.string().min(1).max(4096), destination: z.string().min(1).max(4096), proof_path: z.string().min(1).max(4096), receipt_path: z.string().min(1).max(4096), candidate_run_id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9_.:-]{0,127}$/u) }).strict();
+const authorityRequestSchema = z.object({ version: z.literal("spawnfile.product-state-source-authority-request.v1"), docker_command: z.string().min(1).max(4096), container: z.string().min(1).max(255), source_run_id: z.string().min(1).max(128), mount_path: z.string().min(1).max(4096), candidate_volume_name: z.string().min(1).max(255), candidate_resource_identity: z.string().regex(/^sha256:[a-f0-9]{64}$/u), receipt_path: z.string().min(1).max(4096), proof_path: z.string().min(1).max(4096) }).strict();
+export const isProductStateCloneInvocation = (argv) => argv[0] === "product-state" && ["authority", "clone"].includes(argv[1] ?? "");
+export const runProductStateCloneCommand = async (argv) => {
+    try {
+        if (argv.length !== 3)
+            throw new Error("usage");
+        const bytes = await readFile(argv[2]);
+        if (bytes.length > 65_536)
+            throw new Error("oversized");
+        if (argv[1] === "authority") {
+            const request = authorityRequestSchema.parse(JSON.parse(bytes.toString("utf8"))), snapshot = await issueProductStateSourceSnapshot({ dockerCommand: request.docker_command, container: request.container, sourceRunId: request.source_run_id, mountPath: request.mount_path, candidateVolumeName: request.candidate_volume_name, candidateResourceIdentity: request.candidate_resource_identity });
+            await mkdir(path.dirname(request.receipt_path), { recursive: true, mode: 0o700 });
+            await writeFile(request.proof_path, `${JSON.stringify(snapshot.proof)}\n`, { flag: "wx", mode: 0o600 });
+            await writeFile(request.receipt_path, `${JSON.stringify(snapshot.authority)}\n`, { flag: "wx", mode: 0o600 });
+            process.stdout.write(`${JSON.stringify(snapshot.authority)}\n`);
+            return 0;
+        }
+        const request = requestSchema.parse(JSON.parse(bytes.toString("utf8")));
+        process.stdout.write(`${JSON.stringify(await runProductStateCloneWorkflow({ authorityReceiptPath: request.authority_receipt_path, dockerCommand: request.docker_command, destination: request.destination, proofPath: request.proof_path, receiptPath: request.receipt_path, candidateRunId: request.candidate_run_id }))}\n`);
+        return 0;
+    }
+    catch (error) {
+        // Carry the cause. A bare "failed" is undiagnosable in CI, where this runs
+        // against a different Docker and architecture than any developer machine.
+        const detail = error instanceof Error ? error.message : String(error);
+        process.stderr.write(`error: Product-state clone failed: ${detail}\n`);
+        return 1;
+    }
+};

package/dist/cli/recordCommands.d.ts

@@ -0,0 +1,17 @@
+import type { Command } from "commander";
+import { type RecordingDeploymentHandlers } from "../recording/index.js";
+import type { CliStreams } from "./runCli.js";
+import { type UsageCommandLiveHandlers } from "./usageCommandLive.js";
+export interface RecordSyncOptions {
+    deployment?: string;
+    out?: string;
+    dockerCommand?: string;
+    timeout?: string;
+}
+export type RecordCommandHandlers = UsageCommandLiveHandlers & RecordingDeploymentHandlers;
+export declare const executeRecordSyncCommand: (inputPath: string, options: RecordSyncOptions, handlers?: RecordCommandHandlers) => Promise<{
+    exitCode: 0 | 1 | 2;
+    output?: string;
+    error?: string;
+}>;
+export declare const registerRecordCommands: (program: Command, streams: CliStreams, setExitCode: (code: 0 | 1 | 2) => void, handlers?: RecordCommandHandlers) => void;

package/dist/cli/recordCommands.js

@@ -0,0 +1,43 @@
+import { resolveProjectOutputDirectory } from "../filesystem/index.js";
+import { syncDeploymentMoments } from "../recording/index.js";
+import { DEFAULT_OUTPUT_DIRECTORY, errorExitCode } from "../shared/index.js";
+import { selectUsageDeployment } from "./usageCommandLive.js";
+import { resolveUsageDeploymentSource } from "./usageDeploymentSource.js";
+export const executeRecordSyncCommand = async (inputPath, options, handlers = {}) => {
+    try {
+        const timeoutMs = options.timeout === undefined ? undefined : Number(options.timeout);
+        if (timeoutMs !== undefined && (!Number.isFinite(timeoutMs) || timeoutMs <= 0)) {
+            return { exitCode: 2, error: "--timeout must be a positive number of milliseconds" };
+        }
+        const outputDirectory = resolveProjectOutputDirectory(inputPath, options.out, DEFAULT_OUTPUT_DIRECTORY);
+        const source = await resolveUsageDeploymentSource(inputPath, options, handlers, outputDirectory);
+        const records = await source.loader(source.outputDirectory);
+        const record = selectUsageDeployment(records, options.deployment);
+        if ("error" in record)
+            return { exitCode: 2, error: record.error.replace("spawnfile usage", "spawnfile record sync") };
+        const recordPath = records.find((entry) => entry.record === record).path;
+        const result = await syncDeploymentMoments({ record, recordPath, timeoutMs, dockerCommand: options.dockerCommand }, handlers);
+        return {
+            exitCode: result.failures.length ? 1 : 0,
+            output: `Records: ${result.written} written / ${result.skipped} skipped / ${result.nonExact} non-exact`,
+            ...((result.failures.length || result.warnings.length) ? { error: [...result.failures, ...new Set(result.warnings)].join("\n") } : {})
+        };
+    }
+    catch (error) {
+        return { exitCode: errorExitCode(error), error: error instanceof Error ? error.message : String(error) };
+    }
+};
+export const registerRecordCommands = (program, streams, setExitCode, handlers = {}) => {
+    program.command("record").description("Compose training moment records from deployed wake evidence")
+        .command("sync").argument("[path]", "Project directory or Spawnfile path", process.cwd())
+        .option("--deployment <name>", "Deployment record name").option("--out <dir>", "Compile output directory")
+        .option("--docker-command <command>", "Docker command").option("--timeout <ms>", "Bound Docker reads in milliseconds")
+        .action(async (inputPath, options) => {
+        const result = await executeRecordSyncCommand(inputPath, options, handlers);
+        setExitCode(result.exitCode);
+        if (result.error)
+            streams.stderr(result.error);
+        if (result.output)
+            streams.stdout(result.output);
+    });
+};

package/dist/cli/releaseCommand.d.ts

@@ -0,0 +1,6 @@
+import type { Command } from "commander";
+import { type ReleaseDependencies } from "../release/index.js";
+import type { CliStreams } from "./runCli.js";
+/** `90s`, `30m`, `2h`, `500ms`. A bare number is refused: the unit is never guessed. */
+export declare const parseReleaseDuration: (value: string, flag: string) => number;
+export declare const registerReleaseCommand: (program: Command, streams: CliStreams, setExitCode: (code: number) => void, dependencies?: () => ReleaseDependencies) => void;

package/dist/cli/releaseCommand.js

@@ -0,0 +1,91 @@
+import { createDefaultReleaseDependencies, releaseExitCode, resolveNotifierConfig, resolvePostDeployHook, runRelease } from "../release/index.js";
+import { SpawnfileError } from "../shared/index.js";
+import { envFileAliasOption, resolveEnvFileOption, runtimeEnvFileOption } from "./envFileOption.js";
+const UNITS = { h: 3_600_000, m: 60_000, ms: 1, s: 1_000 };
+/** `90s`, `30m`, `2h`, `500ms`. A bare number is refused: the unit is never guessed. */
+export const parseReleaseDuration = (value, flag) => {
+    const match = /^(\d+)(ms|s|m|h)$/u.exec(value.trim());
+    if (!match)
+        throw new SpawnfileError("validation_error", `${flag} must be a duration like 90s, 30m or 2h`);
+    const ms = Number(match[1]) * UNITS[match[2]];
+    if (!Number.isSafeInteger(ms) || ms <= 0)
+        throw new SpawnfileError("validation_error", `${flag} must be positive`);
+    return ms;
+};
+export const registerReleaseCommand = (program, streams, setExitCode, dependencies = createDefaultReleaseDependencies) => {
+    program
+        .command("release")
+        .description("Build and deploy only when the image inputs changed, draining running turns first")
+        .argument("[path]", "Project directory or Spawnfile path", process.cwd())
+        .requiredOption("--deployment <name>", "Detached deployment to release into")
+        .addOption(runtimeEnvFileOption("Runtime secrets; must set SPAWNFILE_DAIMON_CONTROL_TOKEN to drain"))
+        .addOption(envFileAliasOption())
+        .option("--auth-profile <name>", "Local Spawnfile auth profile")
+        .option("--context <name>", "Docker context for the build and deployment target")
+        .option("--docker-command <command>", "Docker command")
+        .option("-o, --out <directory>", "Compile output directory")
+        .option("--image-repository <name>", "Repository for release image tags (default spawnfile-<project>)")
+        .option("--drain-timeout <duration>", "How long running turns may take to finish before the release is abandoned", "30m")
+        .option("--no-drain", "Deploy without draining (kills in-flight turns)")
+        .option("--force", "Release even when the running identity is unchanged")
+        .option("--dev-inputs", "Hash working-tree bundle inputs instead of requiring a clean commit")
+        .option("--notify-command <path>", "Executable run on failure; receives the notification JSON on stdin")
+        .option("--notify-webhook-env <name>", "Environment variable holding an https URL to POST the notification to")
+        .option("--notify-deferred-after <duration>", "Notify once when a release has been deferred this long", "24h")
+        .option("--post-deploy-command <path>", "Executable run (no shell) on the new container's host after it settled; non-zero fails the release")
+        .option("--post-deploy-arg <arg>", "Argument for --post-deploy-command (repeatable)", (value, previous = []) => [...previous, value])
+        .option("--post-deploy-timeout <duration>", "How long --post-deploy-command may run", "10m")
+        .action(async (inputPath, options) => {
+        let notifier;
+        try {
+            notifier = resolveNotifierConfig(options);
+        }
+        catch (error) {
+            throw new SpawnfileError("validation_error", error.message);
+        }
+        const envFile = resolveEnvFileOption(options);
+        let postDeploy;
+        try {
+            postDeploy = resolvePostDeployHook({ ...options, timeoutMs: parseReleaseDuration(options.postDeployTimeout, "--post-deploy-timeout") });
+        }
+        catch (error) {
+            throw new SpawnfileError("validation_error", error.message);
+        }
+        const drainTimeoutMs = parseReleaseDuration(options.drainTimeout, "--drain-timeout");
+        const notifyDeferredAfterMs = parseReleaseDuration(options.notifyDeferredAfter, "--notify-deferred-after");
+        const abort = new AbortController();
+        const onSignal = () => abort.abort();
+        process.once("SIGTERM", onSignal);
+        process.once("SIGINT", onSignal);
+        try {
+            const request = {
+                authProfileName: options.authProfile ?? null,
+                bundleIdentity: options.devInputs ? "dev" : "release",
+                deployment: options.deployment,
+                dockerCommand: options.dockerCommand ?? "docker",
+                ...(options.context ? { dockerContext: options.context } : {}),
+                drain: options.drain,
+                drainPollMs: 5_000,
+                drainTimeoutMs,
+                envFileEnv: {},
+                ...(envFile ? { envFilePath: envFile } : {}),
+                force: options.force === true,
+                ...(options.imageRepository ? { imageRepository: options.imageRepository } : {}),
+                inputPath,
+                log: streams.stdout,
+                notifier,
+                notifyDeferredAfterMs,
+                ...(options.out ? { outputDirectory: options.out } : {}),
+                postDeploy,
+                settle: { pollMs: 5_000, polls: 36, stablePolls: 3 },
+                signal: abort.signal
+            };
+            const outcome = await runRelease(request, dependencies());
+            setExitCode(releaseExitCode(outcome));
+        }
+        finally {
+            process.off("SIGTERM", onSignal);
+            process.off("SIGINT", onSignal);
+        }
+    });
+};

package/dist/cli/runCli.d.ts

@@ -1,9 +1,10 @@
-import { importClaudeCodeAuth, importCodexAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
-import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, initProject, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
+import { importClaudeCodeAuth, importCodexAuth, importGrokAuth, importEnvFile, initializeTargetSecretSourceLifecycle, provisionCredentials, requireAuthProfile } from "../auth/index.js";
+import { addAgentProject, addProjectSurface, addProjectModelFallback, addSubagentProject, addTeamProject, buildOrganizationView, buildCompilePlan, buildProject, buildUpReceipt, clearProjectModelFallbacks, compileProject, createTrainingContext, createTrainingPlan, loadTrainingProject, resolveTrainingPlan, materializeTrainingMoment, lowerTrainingExecution, allocateTrainingOutputParent, initProject, listInitTemplates, publishProject, upProject, removeProjectSurface, runProject, setProjectPrimaryModel, setProjectRuntime, setProjectSurfaceAccess, showProjectSurfaces, syncProjectAuth } from "../compiler/index.js";
 import { devActivityProject, devApplyProject, devRestartProject, devStopProject, devUpProject } from "../dev/index.js";
 import { consumeImageUp } from "../distribution/index.js";
-import { downDeployment, exportRunArtifacts } from "../deployment/index.js";
+import { createDockerProbeGateway, downDeployment, exportRunArtifacts, inspectDockerDeployment, listDeploymentRecords, listHomeDeploymentRecords } from "../deployment/index.js";
 import { listRuntimeAdapters } from "../runtime/index.js";
+import { delegatePaideiaTraining } from "./paideiaDelegation.js";
 export interface CliStreams {
     stderr: (message: string) => void;
     stdout: (message: string) => void;
@@ -14,6 +15,14 @@ export interface CliRenderEnvironment {
     stdoutIsTty: boolean;
 }
 export interface CliHandlers {
+    createTrainingContext: typeof createTrainingContext;
+    createTrainingPlan: typeof createTrainingPlan;
+    lowerTrainingExecution: typeof lowerTrainingExecution;
+    allocateTrainingOutputParent: typeof allocateTrainingOutputParent;
+    loadTrainingProject: typeof loadTrainingProject;
+    resolveTrainingPlan: typeof resolveTrainingPlan;
+    materializeTrainingMoment: typeof materializeTrainingMoment;
+    delegatePaideiaTraining: typeof delegatePaideiaTraining;
     buildCompilePlan: typeof buildCompilePlan;
     buildOrganizationView: typeof buildOrganizationView;
     buildProject: typeof buildProject;
@@ -27,12 +36,18 @@ export interface CliHandlers {
     clearProjectModelFallbacks: typeof clearProjectModelFallbacks;
     importClaudeCodeAuth: typeof importClaudeCodeAuth;
     importCodexAuth: typeof importCodexAuth;
+    importGrokAuth: typeof importGrokAuth;
     importEnvFile: typeof importEnvFile;
     initProject: typeof initProject;
+    listInitTemplates: typeof listInitTemplates;
     initializeTargetSecretSourceLifecycle: typeof initializeTargetSecretSourceLifecycle;
     provisionCredentials: typeof provisionCredentials;
     exportRunArtifacts: typeof exportRunArtifacts;
     downDeployment: typeof downDeployment;
+    createDockerProbeGateway: typeof createDockerProbeGateway;
+    inspectDockerDeployment: typeof inspectDockerDeployment;
+    listDeploymentRecords: typeof listDeploymentRecords;
+    listHomeDeploymentRecords: typeof listHomeDeploymentRecords;
     listRuntimeAdapters: typeof listRuntimeAdapters;
     removeProjectSurface: typeof removeProjectSurface;
     requireAuthProfile: typeof requireAuthProfile;
@@ -56,6 +71,7 @@ export interface RunCliOptions {
     renderEnvironment?: CliRenderEnvironment;
     stdin?: AsyncIterable<unknown>;
     streams?: CliStreams;
+    signal?: AbortSignal;
 }
 type RunCli = {
     (argv: string[], options?: RunCliOptions): Promise<number>;