spawnfile 0.1.14 → 0.1.18

package/dist/evidenceExportHelper/preparedBuilderTypes.d.ts

@@ -0,0 +1,19 @@
+import type { DockerArtifactExecutor } from "../target/dockerArtifactsProvider.js";
+export interface PrepareEvidenceHelperInput {
+    readonly baseImage: string;
+    readonly context: string;
+    readonly executor: DockerArtifactExecutor;
+    readonly privateRoot: string;
+    readonly signal?: AbortSignal;
+    /** Test-only fault injection at durable/mutation/receipt boundaries. */
+    readonly testHooks?: {
+        readonly afterBuild?: () => Promise<void> | void;
+        readonly afterComplete?: () => Promise<void> | void;
+        readonly afterReserve?: () => Promise<void> | void;
+        readonly beforeBuild?: () => Promise<void> | void;
+        readonly beforeComplete?: () => Promise<void> | void;
+        readonly beforeReceipt?: () => Promise<void> | void;
+        readonly beforeReserve?: () => Promise<void> | void;
+    };
+    readonly timeoutMs?: number;
+}

package/dist/evidenceExportHelper/preparedBuilderTypes.js

@@ -0,0 +1 @@
+export {};

package/dist/evidenceExportHelper/recipe.d.ts

@@ -0,0 +1,7 @@
+export declare const LOCAL_EVIDENCE_HELPER_RECIPE_VERSION: "spawnfile.local-evidence-export-helper.recipe.v1";
+export interface LocalEvidenceHelperRecipe {
+    readonly artifactManifestDigest: `sha256:${string}`;
+    readonly context: Uint8Array;
+    readonly recipeDigest: `sha256:${string}`;
+}
+export declare const loadLocalEvidenceHelperRecipe: () => Promise<LocalEvidenceHelperRecipe>;

package/dist/evidenceExportHelper/recipe.js

@@ -0,0 +1,83 @@
+import { createHash } from "node:crypto";
+import { readFile } from "node:fs/promises";
+import { EVIDENCE_EXPORT_HELPER_PATH } from "../target/evidenceExportProvider.js";
+export const LOCAL_EVIDENCE_HELPER_RECIPE_VERSION = "spawnfile.local-evidence-export-helper.recipe.v1";
+const BLOCK = 512;
+const MAX_SOURCE_BYTES = 65_536;
+const DIGEST = /^sha256:[a-f0-9]{64}$/u;
+const fail = () => { throw new Error("Local evidence-export helper recipe failed"); };
+const octal = (value, width) => {
+    const raw = value.toString(8);
+    if (!Number.isSafeInteger(value) || value < 0 || raw.length > width - 1)
+        return fail();
+    return Buffer.from(`${raw.padStart(width - 1, "0")}\0`, "ascii");
+};
+const checksum = (header) => {
+    header.fill(0x20, 148, 156);
+    let sum = 0;
+    for (const byte of header)
+        sum += byte;
+    if (sum > 0o777777)
+        return fail();
+    header.set(Buffer.from(`${sum.toString(8).padStart(6, "0")}\0 `, "ascii"), 148);
+};
+const archive = (entries) => {
+    const output = [];
+    for (const entry of [...entries].sort((left, right) => Buffer.compare(Buffer.from(left.path), Buffer.from(right.path)))) {
+        const name = Buffer.from(entry.path, "utf8");
+        if (name.byteLength < 1 || name.byteLength > 100
+            || entry.mode !== 0o444 && entry.mode !== 0o555)
+            return fail();
+        const header = Buffer.alloc(BLOCK);
+        header.set(name, 0);
+        header.set(octal(entry.mode, 8), 100);
+        header.set(octal(0, 8), 108);
+        header.set(octal(0, 8), 116);
+        header.set(octal(entry.bytes.byteLength, 12), 124);
+        header.set(octal(0, 12), 136);
+        header[156] = 48;
+        header.set(Buffer.from("ustar\0", "ascii"), 257);
+        header.set(Buffer.from("00", "ascii"), 263);
+        header.set(octal(0, 8), 329);
+        header.set(octal(0, 8), 337);
+        checksum(header);
+        output.push(header, Buffer.from(entry.bytes));
+        const padding = (BLOCK - entry.bytes.byteLength % BLOCK) % BLOCK;
+        if (padding > 0)
+            output.push(Buffer.alloc(padding));
+    }
+    output.push(Buffer.alloc(BLOCK), Buffer.alloc(BLOCK));
+    return Buffer.concat(output);
+};
+const dockerfile = Buffer.from([
+    "ARG SPAWNFILE_HELPER_BASE",
+    "FROM ${SPAWNFILE_HELPER_BASE} AS runtime",
+    "FROM scratch",
+    "COPY --from=runtime / /",
+    "COPY helperProgram.mjs /bin/spawnfile-export-helper",
+    "LABEL spawnfile.target.evidence-export.helper-contract=\"v1\"",
+    `ENV PATH=${EVIDENCE_EXPORT_HELPER_PATH}`,
+    "USER 65534:65534",
+    "ENTRYPOINT [\"/bin/spawnfile-export-helper\"]",
+    "CMD []",
+    "",
+].join("\n"), "utf8");
+const digest = (domain, bytes) => `sha256:${createHash("sha256")
+    .update(`spawnfile.local-evidence-export-helper.${domain}.v1\0`, "utf8")
+    .update(bytes)
+    .digest("hex")}`;
+export const loadLocalEvidenceHelperRecipe = async () => {
+    const source = await readFile(new URL("./helperProgram.mjs", import.meta.url));
+    if (source.byteLength < 1 || source.byteLength > MAX_SOURCE_BYTES
+        || !source.subarray(0, 22).toString("utf8").startsWith("#!/usr/local/bin/node"))
+        return fail();
+    const context = archive([
+        { bytes: dockerfile, mode: 0o444, path: "Dockerfile" },
+        { bytes: source, mode: 0o555, path: "helperProgram.mjs" },
+    ]);
+    const recipeDigest = digest("recipe", context);
+    const artifactManifestDigest = digest("artifact-manifest", recipeDigest);
+    if (!DIGEST.test(recipeDigest) || !DIGEST.test(artifactManifestDigest))
+        return fail();
+    return Object.freeze({ artifactManifestDigest, context, recipeDigest });
+};

package/dist/filesystem/durableWrite.d.ts

@@ -0,0 +1,10 @@
+export declare const syncDirectorySync: (directory: string) => void;
+export declare const syncDirectory: (directory: string) => Promise<void>;
+export declare const syncFileSync: (file: string) => void;
+export declare const syncFile: (file: string) => Promise<void>;
+/** The rename is visible, but directory durability could not be confirmed. */
+export declare class PublishedFileSyncError extends Error {
+}
+/** The caller creates the parent directory and holds its domain writer lock. */
+export declare const writeDurableFileSync: (file: string, bytes: string) => void;
+export declare const writeDurableFile: (file: string, bytes: string) => Promise<void>;

package/dist/filesystem/durableWrite.js

@@ -0,0 +1,87 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, fsyncSync, openSync, renameSync, rmSync, writeFileSync } from "node:fs";
+import { open, rename, rm } from "node:fs/promises";
+import path from "node:path";
+export const syncDirectorySync = (directory) => {
+    const fd = openSync(directory, "r");
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+};
+export const syncDirectory = async (directory) => {
+    const handle = await open(directory, "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+};
+export const syncFileSync = (file) => {
+    const fd = openSync(file, "r");
+    try {
+        fsyncSync(fd);
+    }
+    finally {
+        closeSync(fd);
+    }
+    syncDirectorySync(path.dirname(file));
+};
+export const syncFile = async (file) => {
+    const handle = await open(file, "r");
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+    await syncDirectory(path.dirname(file));
+};
+/** The rename is visible, but directory durability could not be confirmed. */
+export class PublishedFileSyncError extends Error {
+}
+/** The caller creates the parent directory and holds its domain writer lock. */
+export const writeDurableFileSync = (file, bytes) => {
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        const fd = openSync(temporary, "wx", 0o600);
+        try {
+            writeFileSync(fd, bytes, "utf8");
+            fsyncSync(fd);
+        }
+        finally {
+            closeSync(fd);
+        }
+        renameSync(temporary, file);
+        syncDirectorySync(path.dirname(file));
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+};
+export const writeDurableFile = async (file, bytes) => {
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        const handle = await open(temporary, "wx", 0o600);
+        try {
+            await handle.writeFile(bytes, "utf8");
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+        await rename(temporary, file);
+        try {
+            await syncDirectory(path.dirname(file));
+        }
+        catch (cause) {
+            throw new PublishedFileSyncError(`Published ${file}, but directory fsync failed`, { cause });
+        }
+    }
+    finally {
+        await rm(temporary, { force: true });
+    }
+};

package/dist/filesystem/index.d.ts

@@ -1,2 +1,4 @@
 export * from "./io.js";
 export * from "./paths.js";
+export * from "./retainedJsonl.js";
+export * from "./durableWrite.js";

package/dist/filesystem/index.js

@@ -1,2 +1,4 @@
 export * from "./io.js";
 export * from "./paths.js";
+export * from "./retainedJsonl.js";
+export * from "./durableWrite.js";

package/dist/filesystem/io.d.ts

@@ -3,9 +3,11 @@ export interface CopyDirectoryOptions {
 }
 export declare const copyDirectory: (sourcePath: string, destinationPath: string, options?: CopyDirectoryOptions) => Promise<void>;
 export declare const ensureDirectory: (directoryPath: string) => Promise<void>;
+export declare const ensurePrivateDirectory: (directoryPath: string) => Promise<void>;
 export declare const fileExists: (filePath: string) => Promise<boolean>;
 export declare const isSymlink: (filePath: string) => Promise<boolean>;
 export declare const readUtf8File: (filePath: string) => Promise<string>;
 export declare const ensureGitignoreEntry: (directoryPath: string, entry: string) => Promise<boolean>;
 export declare const removeDirectory: (directoryPath: string) => Promise<void>;
 export declare const writeUtf8File: (filePath: string, content: string) => Promise<void>;
+export declare const writePrivateUtf8File: (filePath: string, content: string) => Promise<void>;

package/dist/filesystem/io.js

@@ -1,5 +1,5 @@
 import path from "node:path";
-import { cp, mkdir, lstat, readFile, rm, stat, writeFile } from "node:fs/promises";
+import { chmod, cp, mkdir, lstat, open, readFile, rm, stat, writeFile } from "node:fs/promises";
 export const copyDirectory = async (sourcePath, destinationPath, options = {}) => {
     await cp(sourcePath, destinationPath, {
         filter: options.filter,
@@ -10,6 +10,10 @@ export const copyDirectory = async (sourcePath, destinationPath, options = {}) =
 export const ensureDirectory = async (directoryPath) => {
     await mkdir(directoryPath, { recursive: true });
 };
+export const ensurePrivateDirectory = async (directoryPath) => {
+    await mkdir(directoryPath, { recursive: true, mode: 0o700 });
+    await chmod(directoryPath, 0o700);
+};
 export const fileExists = async (filePath) => {
     try {
         await stat(filePath);
@@ -55,3 +59,14 @@ export const removeDirectory = async (directoryPath) => {
 export const writeUtf8File = async (filePath, content) => {
     await writeFile(filePath, content, "utf8");
 };
+export const writePrivateUtf8File = async (filePath, content) => {
+    const handle = await open(filePath, "w", 0o600);
+    try {
+        // Creation mode does not change an existing file's permissions.
+        await handle.chmod(0o600);
+        await handle.writeFile(content, "utf8");
+    }
+    finally {
+        await handle.close();
+    }
+};

package/dist/filesystem/retainedJsonl.d.ts

@@ -0,0 +1,23 @@
+export interface JsonlReadResult<T> {
+    entries: T[];
+    errors: string[];
+}
+/** Missing history is empty; unreadable or corrupt history is reported, never hidden. */
+export declare const readRetainedJsonl: <T>(file: string, isEntry: (value: unknown) => value is T) => JsonlReadResult<T>;
+/** Ties use the last appended entry. No chronological ordering of the input is assumed. */
+export declare const entryAt: <T>(entries: readonly T[], instant: string | Date, timeOf: (entry: T) => string) => T | null;
+/** The last state at the cutoff is needed even if it is arbitrarily old. */
+export declare const retainEntries: <T>(entries: readonly T[], cutoff: number, timeOf: (entry: T) => string) => T[];
+/**
+ * Caller MUST hold its domain's writer lock across append + prune. One append write,
+ * then fsync; retention uses an exclusive 0600 temporary file and atomic rename.
+ * Invalid complete lines survive pruning so readers can continue reporting them.
+ * A torn tail refuses append: never join a new entry onto a partial JSON record.
+ */
+export declare const appendRetainedJsonl: <T>(file: string, entry: T, options: {
+    keepMs: number;
+    now: Date;
+    timeOf: (entry: T) => string;
+    isEntry: (value: unknown) => value is T;
+    retain?: (entries: readonly T[], cutoff: number) => T[];
+}) => void;

package/dist/filesystem/retainedJsonl.js

@@ -0,0 +1,123 @@
+import { randomUUID } from "node:crypto";
+import { closeSync, constants, fchmodSync, fsyncSync, mkdirSync, openSync, readFileSync, renameSync, rmSync, writeSync } from "node:fs";
+import path from "node:path";
+import { syncDirectorySync } from "./durableWrite.js";
+const parseLines = (text, isEntry) => {
+    const raw = text.split("\n"), errors = [];
+    if (raw.at(-1) === "")
+        raw.pop();
+    const lines = raw.map((line, index) => {
+        try {
+            const value = JSON.parse(line);
+            if (!isEntry(value))
+                throw new Error("invalid entry");
+            return { line, entry: value };
+        }
+        catch {
+            errors.push(`line ${index + 1}: invalid JSON or entry`);
+            return { line };
+        }
+    });
+    return { lines, errors };
+};
+/** Missing history is empty; unreadable or corrupt history is reported, never hidden. */
+export const readRetainedJsonl = (file, isEntry) => {
+    let text;
+    try {
+        text = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        return { entries: [], errors: error.code === "ENOENT" ? [] : [`${file}: ${String(error)}`] };
+    }
+    const parsed = parseLines(text, isEntry);
+    return { entries: parsed.lines.flatMap(({ entry }) => entry === undefined ? [] : [entry]), errors: parsed.errors };
+};
+/** Ties use the last appended entry. No chronological ordering of the input is assumed. */
+export const entryAt = (entries, instant, timeOf) => {
+    const at = instant instanceof Date ? instant.getTime() : Date.parse(instant);
+    if (!Number.isFinite(at))
+        throw new Error("History lookup requires a valid instant");
+    let found = null, latest = -Infinity;
+    for (const entry of entries) {
+        const time = Date.parse(timeOf(entry));
+        if (time <= at && time >= latest) {
+            latest = time;
+            found = entry;
+        }
+    }
+    return found;
+};
+/** The last state at the cutoff is needed even if it is arbitrarily old. */
+export const retainEntries = (entries, cutoff, timeOf) => {
+    let boundary = -1, latest = -Infinity;
+    entries.forEach((entry, index) => {
+        const time = Date.parse(timeOf(entry));
+        if (time <= cutoff && time >= latest) {
+            latest = time;
+            boundary = index;
+        }
+    });
+    return entries.filter((entry, index) => index === boundary || Date.parse(timeOf(entry)) > cutoff);
+};
+const writeAndSync = (fd, text) => {
+    const bytes = Buffer.from(text, "utf8");
+    if (writeSync(fd, bytes) !== bytes.length)
+        throw new Error("Short recording log write");
+    fsyncSync(fd);
+};
+/**
+ * Caller MUST hold its domain's writer lock across append + prune. One append write,
+ * then fsync; retention uses an exclusive 0600 temporary file and atomic rename.
+ * Invalid complete lines survive pruning so readers can continue reporting them.
+ * A torn tail refuses append: never join a new entry onto a partial JSON record.
+ */
+export const appendRetainedJsonl = (file, entry, options) => {
+    if (!Number.isSafeInteger(options.keepMs) || options.keepMs <= 0 || !Number.isFinite(options.now.getTime())) {
+        throw new Error("Recording retention requires a positive safe duration and valid clock");
+    }
+    if (!options.isEntry(entry))
+        throw new Error("Refusing to append an invalid recording entry");
+    let previous = "";
+    try {
+        previous = readFileSync(file, "utf8");
+    }
+    catch (error) {
+        if (error.code !== "ENOENT")
+            throw error;
+    }
+    if (previous && !previous.endsWith("\n"))
+        throw new Error(`Recording log ${file} has an incomplete final line`);
+    const line = `${JSON.stringify(entry)}\n`;
+    mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    const fd = openSync(file, constants.O_WRONLY | constants.O_APPEND | constants.O_CREAT | constants.O_NOFOLLOW, 0o600);
+    try {
+        fchmodSync(fd, 0o600);
+        writeAndSync(fd, line);
+    }
+    finally {
+        closeSync(fd);
+    }
+    syncDirectorySync(path.dirname(file));
+    const parsed = parseLines(previous + line, options.isEntry);
+    const entries = parsed.lines.flatMap(({ entry: value }) => value === undefined ? [] : [value]);
+    const cutoff = options.now.getTime() - options.keepMs;
+    const retained = new Set(options.retain ? options.retain(entries, cutoff) : retainEntries(entries, cutoff, options.timeOf));
+    const kept = parsed.lines.filter(({ entry: value }) => value === undefined || retained.has(value));
+    if (kept.length === parsed.lines.length)
+        return;
+    const temporary = `${file}.${randomUUID()}.tmp`;
+    try {
+        const scratch = openSync(temporary, "wx", 0o600);
+        try {
+            writeAndSync(scratch, `${kept.map(({ line: raw }) => raw).join("\n")}\n`);
+        }
+        finally {
+            closeSync(scratch);
+        }
+        renameSync(temporary, file);
+        syncDirectorySync(path.dirname(file));
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+};

package/dist/manifest/commandSchemas.d.ts

@@ -0,0 +1,5 @@
+import { z } from "zod";
+/** A plain image reference (registry/repo[:tag]) pinned by digest; never anything Docker could read as an option. */
+export declare const pinnedImageSchema: z.ZodString;
+/** An argv: run directly, never through a shell. */
+export declare const argvSchema: z.ZodArray<z.ZodString>;

package/dist/manifest/commandSchemas.js

@@ -0,0 +1,5 @@
+import { z } from "zod";
+/** A plain image reference (registry/repo[:tag]) pinned by digest; never anything Docker could read as an option. */
+export const pinnedImageSchema = z.string().trim().regex(/^[a-zA-Z0-9][a-zA-Z0-9._/:-]*@sha256:[a-f0-9]{64}$/u, "image must be a reference pinned by @sha256 digest");
+/** An argv: run directly, never through a shell. */
+export const argvSchema = z.array(z.string().min(1)).min(1);

package/dist/manifest/executionSchemas.d.ts

@@ -1,10 +1,19 @@
 import { z } from "zod";
+/**
+ * The closed reasoning-effort vocabulary a brokered Daimon Grok worker accepts
+ * (`DAIMON_GROK_BROKER_REASONING_EFFORTS`). Only valid on a target that
+ * declares `auth.method: grok` itself; it is never inherited.
+ */
+export declare const MODEL_REASONING_EFFORTS: readonly ["low", "medium", "high"];
+/** Mirrors Daimon's ORGANIZATION_RUNTIME_CODEX_REASONING_EFFORTS contract. */
+export declare const CODEX_MODEL_REASONING_EFFORTS: readonly ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra", "persistent"];
 export declare const modelEntryAuthSchema: z.ZodObject<{
     key: z.ZodOptional<z.ZodString>;
     method: z.ZodOptional<z.ZodEnum<{
         api_key: "api_key";
         "claude-code": "claude-code";
         codex: "codex";
+        grok: "grok";
         none: "none";
     }>>;
 }, z.core.$strict>;
@@ -22,6 +31,7 @@ export declare const modelTargetSchema: z.ZodObject<{
             api_key: "api_key";
             "claude-code": "claude-code";
             codex: "codex";
+            grok: "grok";
             none: "none";
         }>>;
     }, z.core.$strict>>;
@@ -34,6 +44,17 @@ export declare const modelTargetSchema: z.ZodObject<{
     }, z.core.$strict>>;
     name: z.ZodString;
     provider: z.ZodString;
+    reasoning_effort: z.ZodOptional<z.ZodEnum<{
+        none: "none";
+        high: "high";
+        medium: "medium";
+        low: "low";
+        minimal: "minimal";
+        xhigh: "xhigh";
+        max: "max";
+        ultra: "ultra";
+        persistent: "persistent";
+    }>>;
 }, z.core.$strict>;
 export declare const executionSchema: z.ZodObject<{
     model: z.ZodOptional<z.ZodObject<{
@@ -42,12 +63,14 @@ export declare const executionSchema: z.ZodObject<{
                 api_key: "api_key";
                 "claude-code": "claude-code";
                 codex: "codex";
+                grok: "grok";
                 none: "none";
             }>>;
             methods: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<{
                 api_key: "api_key";
                 "claude-code": "claude-code";
                 codex: "codex";
+                grok: "grok";
                 none: "none";
             }>>>;
         }, z.core.$strict>>;
@@ -58,6 +81,7 @@ export declare const executionSchema: z.ZodObject<{
                     api_key: "api_key";
                     "claude-code": "claude-code";
                     codex: "codex";
+                    grok: "grok";
                     none: "none";
                 }>>;
             }, z.core.$strict>>;
@@ -70,6 +94,17 @@ export declare const executionSchema: z.ZodObject<{
             }, z.core.$strict>>;
             name: z.ZodString;
             provider: z.ZodString;
+            reasoning_effort: z.ZodOptional<z.ZodEnum<{
+                none: "none";
+                high: "high";
+                medium: "medium";
+                low: "low";
+                minimal: "minimal";
+                xhigh: "xhigh";
+                max: "max";
+                ultra: "ultra";
+                persistent: "persistent";
+            }>>;
         }, z.core.$strict>>>;
         primary: z.ZodObject<{
             auth: z.ZodOptional<z.ZodObject<{
@@ -78,6 +113,7 @@ export declare const executionSchema: z.ZodObject<{
                     api_key: "api_key";
                     "claude-code": "claude-code";
                     codex: "codex";
+                    grok: "grok";
                     none: "none";
                 }>>;
             }, z.core.$strict>>;
@@ -90,6 +126,17 @@ export declare const executionSchema: z.ZodObject<{
             }, z.core.$strict>>;
             name: z.ZodString;
             provider: z.ZodString;
+            reasoning_effort: z.ZodOptional<z.ZodEnum<{
+                none: "none";
+                high: "high";
+                medium: "medium";
+                low: "low";
+                minimal: "minimal";
+                xhigh: "xhigh";
+                max: "max";
+                ultra: "ultra";
+                persistent: "persistent";
+            }>>;
         }, z.core.$strict>;
     }, z.core.$strict>>;
     sandbox: z.ZodOptional<z.ZodObject<{

package/dist/manifest/executionSchemas.js

@@ -1,5 +1,13 @@
 import { z } from "zod";
-const modelAuthMethodSchema = z.enum(["api_key", "claude-code", "codex", "none"]);
+const modelAuthMethodSchema = z.enum(["api_key", "claude-code", "codex", "grok", "none"]);
+/**
+ * The closed reasoning-effort vocabulary a brokered Daimon Grok worker accepts
+ * (`DAIMON_GROK_BROKER_REASONING_EFFORTS`). Only valid on a target that
+ * declares `auth.method: grok` itself; it is never inherited.
+ */
+export const MODEL_REASONING_EFFORTS = ["low", "medium", "high"];
+/** Mirrors Daimon's ORGANIZATION_RUNTIME_CODEX_REASONING_EFFORTS contract. */
+export const CODEX_MODEL_REASONING_EFFORTS = ["none", "minimal", "low", "medium", "high", "xhigh", "max", "ultra", "persistent"];
 const modelEndpointCompatibilitySchema = z.enum(["anthropic", "openai"]);
 const modelAuthSchema = z
     .object({
@@ -58,10 +66,31 @@ export const modelTargetSchema = z
     auth: modelEntryAuthSchema.optional(),
     endpoint: modelEndpointSchema.optional(),
     name: z.string(),
-    provider: z.string()
+    provider: z.string(),
+    reasoning_effort: z.enum(CODEX_MODEL_REASONING_EFFORTS).optional()
 })
     .strict()
     .superRefine((value, context) => {
+    if (value.auth?.method === "grok" && (value.provider !== "xai" || value.endpoint)) {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "grok auth is only valid for provider xai without an endpoint"
+        });
+    }
+    if (value.reasoning_effort !== undefined && value.auth?.method === "grok") {
+        const effort = z.enum(MODEL_REASONING_EFFORTS).safeParse(value.reasoning_effort);
+        if (!effort.success) {
+            for (const issue of effort.error.issues) {
+                context.addIssue({ ...issue, path: ["reasoning_effort"] });
+            }
+        }
+    }
+    if (value.reasoning_effort !== undefined && value.auth?.method !== "grok" && value.auth?.method !== "codex") {
+        context.addIssue({
+            code: z.ZodIssueCode.custom,
+            message: "reasoning_effort is only valid on a model that declares auth.method grok or codex"
+        });
+    }
     const usesCustomEndpoint = value.provider === "custom" || value.provider === "local";
     if (usesCustomEndpoint && !value.endpoint) {
         context.addIssue({

package/dist/manifest/index.d.ts

@@ -4,3 +4,5 @@ export * from "./renderSpawnfile.js";
 export * from "./scaffold.js";
 export * from "./schemas.js";
 export * from "./skillFrontmatter.js";
+export * from "./trainingSchemas.js";
+export * from "./trainingDataSchemas.js";

package/dist/manifest/index.js

@@ -4,3 +4,5 @@ export * from "./renderSpawnfile.js";
 export * from "./scaffold.js";
 export * from "./schemas.js";
 export * from "./skillFrontmatter.js";
+export * from "./trainingSchemas.js";
+export * from "./trainingDataSchemas.js";

package/dist/manifest/loadManifest.js

@@ -1,9 +1,8 @@
 import path from "node:path";
-import { parse as parseYaml } from "yaml";
-import { z } from "zod";
 import { fileExists, isSymlink, readUtf8File, resolveProjectPath } from "../filesystem/index.js";
 import { SpawnfileError } from "../shared/index.js";
-import { isAgentManifest, isInlineAgentMember, isReferencedMember, isTeamManifest, manifestSchema } from "./schemas.js";
+import { isAgentManifest, isInlineAgentMember, isReferencedMember, isTeamManifest } from "./schemas.js";
+import { parseManifest } from "./parseManifest.js";
 import { parseSkillFrontmatter } from "./skillFrontmatter.js";
 const ensureUniqueNames = (names, label) => {
     const seen = new Set();
@@ -120,28 +119,6 @@ const validateLocalTeamManifest = async (manifestPath, manifest) => {
         }
     }
 };
-const parseManifest = (source) => {
-    let parsed;
-    try {
-        parsed = parseYaml(source);
-    }
-    catch (error) {
-        // A YAML syntax error is a malformed manifest, not a runtime failure — wrap
-        // it so it exits as a usage error instead of leaking the parser's wording.
-        const reason = error instanceof Error ? error.message : String(error);
-        throw new SpawnfileError("invalid_manifest", `Invalid Spawnfile manifest: ${reason}`);
-    }
-    try {
-        return manifestSchema.parse(parsed);
-    }
-    catch (error) {
-        if (error instanceof z.ZodError) {
-            const issue = error.issues[0];
-            throw new SpawnfileError("invalid_manifest", `Invalid Spawnfile manifest: ${issue.message}`);
-        }
-        throw error;
-    }
-};
 export const loadManifest = async (manifestPath) => {
     let source;
     try {
@@ -154,7 +131,7 @@ export const loadManifest = async (manifestPath) => {
         }
         throw error;
     }
-    const manifest = parseManifest(source);
+    const manifest = parseManifest(source, manifestPath);
     if (isAgentManifest(manifest)) {
         await validateLocalAgentManifest(manifestPath, manifest);
     }