spawnfile 0.1.24 → 0.1.27

package/dist/training/storage/index.js

@@ -0,0 +1,5 @@
+export { openExperimentStore } from './store.js';
+export { blobContentPath } from './content.js';
+export { externalizeEvaluationJson, hydrateEvaluationJson } from './evaluation-json.js';
+export { openJudgeCache } from './cache/index.js';
+//# sourceMappingURL=index.js.map

package/dist/training/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/training/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AACxF,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/training/storage/journal.d.ts

@@ -0,0 +1,11 @@
+import type { StoredEvent, Visibility } from './types.js';
+export interface JournalRead {
+    events: StoredEvent[];
+    ignoredTailBytes: number;
+    totalBytes: number;
+}
+export declare function readJournal(path: string): Promise<JournalRead>;
+export declare function appendJournal(path: string, event: {
+    id: string;
+    payload: unknown;
+}, visibility: Visibility, equivalent?: (left: unknown, right: unknown) => Promise<boolean>): Promise<'appended' | 'duplicate'>;

package/dist/training/storage/journal.js

@@ -0,0 +1,81 @@
+import { constants } from 'node:fs';
+import { dirname } from 'node:path';
+import { open, unlink } from 'node:fs/promises';
+import { assertIdentity, identity, jsonBytes } from './content.js';
+import { readStored, syncDirectory } from './filesystem.js';
+import { validateVisibility } from './permissions.js';
+export async function readJournal(path) {
+    let bytes;
+    try {
+        bytes = await readStored(path);
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { events: [], ignoredTailBytes: 0, totalBytes: 0 };
+        throw error;
+    }
+    const boundary = bytes.lastIndexOf(10) + 1;
+    const lines = bytes.subarray(0, boundary).toString('utf8').split('\n').slice(0, -1);
+    const events = [];
+    const ids = new Set();
+    for (const line of lines) {
+        let event;
+        try {
+            event = JSON.parse(line);
+        }
+        catch {
+            throw new Error('Corrupt complete journal line');
+        }
+        const { digest, ...body } = event;
+        if (identity(body) !== digest || event.sequence !== events.length + 1)
+            throw new Error('Journal integrity or persistence sequence mismatch');
+        assertIdentity(event.id);
+        validateVisibility(event.visibility);
+        if (ids.has(event.id))
+            throw new Error('Duplicate persisted event identity');
+        ids.add(event.id);
+        events.push(event);
+    }
+    return { events, ignoredTailBytes: bytes.length - boundary, totalBytes: bytes.length };
+}
+export async function appendJournal(path, event, visibility, equivalent) {
+    assertIdentity(event.id);
+    validateVisibility(visibility);
+    const lockPath = `${path}.lock`;
+    const lock = await open(lockPath, 'wx', 0o600).catch(error => {
+        if (error.code === 'EEXIST')
+            throw new Error('Journal writer is busy or requires stale-lock recovery');
+        throw error;
+    });
+    try {
+        const previous = await readJournal(path);
+        if (previous.ignoredTailBytes)
+            throw new Error('Journal has an interrupted tail; preserve evidence and recover explicitly');
+        const existing = previous.events.find(item => item.id === event.id);
+        if (existing) {
+            if (existing.visibility !== visibility || (jsonBytes(existing.payload) !== jsonBytes(event.payload) &&
+                !(await equivalent?.(existing.payload, event.payload))))
+                throw new Error('Conflicting replay of an event identity');
+            return 'duplicate';
+        }
+        const body = { id: event.id, sequence: previous.events.length + 1, visibility, payload: event.payload };
+        const line = `${jsonBytes({ ...body, digest: identity(body) })}\n`;
+        if (previous.totalBytes + Buffer.byteLength(line) > 67_108_864)
+            throw new Error('Journal exceeds 64 MiB');
+        const file = await open(path, constants.O_WRONLY | constants.O_CREAT | constants.O_APPEND | constants.O_NOFOLLOW, 0o600);
+        try {
+            await file.writeFile(line);
+            await file.sync();
+        }
+        finally {
+            await file.close();
+        }
+        await syncDirectory(dirname(path));
+        return 'appended';
+    }
+    finally {
+        await lock.close();
+        await unlink(lockPath);
+    }
+}
+//# sourceMappingURL=journal.js.map

package/dist/training/storage/journal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"journal.js","sourceRoot":"","sources":["../../../src/training/storage/journal.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACnE,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAC5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAGtD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAY;IAC5C,IAAI,KAAa,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IACvC,OAAO,KAAK,EAAE,CAAC;QACb,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,gBAAgB,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,EAAE,CAAC;QAClH,MAAM,KAAK,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACpF,MAAM,MAAM,GAAkB,EAAE,CAAC;IACjC,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,KAAkB,CAAC;QACvB,IAAI,CAAC;YAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;QAAC,CAAC;QAChD,MAAM,CAAC;YAAC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAAC,CAAC;QAC3D,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;QAClC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC,CAAC;QAC7I,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QACzB,kBAAkB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;QAC7E,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;AACzF,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY,EAAE,KAAuC,EAAE,UAAsB,EAC/G,UAAgE;IAChE,cAAc,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACzB,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,MAAM,QAAQ,GAAG,GAAG,IAAI,OAAO,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE;QAC3D,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAClI,MAAM,KAAK,CAAC;IACd,CAAC,CAAC,CAAC;IACH,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,QAAQ,CAAC,gBAAgB;YAAE,MAAM,IAAI,KAAK,CAAC,2EAA2E,CAAC,CAAC;QAC5H,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,KAAK,CAAC,EAAE,CAAC,CAAC;QACpE,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC/F,CAAC,CAAC,MAAM,UAAU,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;YACxH,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,MAAM,IAAI,GAAG,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;QACxG,MAAM,IAAI,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC;QACnE,IAAI,QAAQ,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC1G,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,OAAO,GAAG,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACzH,IAAI,CAAC;YAAC,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAAC,CAAC;gBAC9C,CAAC;YAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,CAAC;QAC/B,MAAM,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QACnC,OAAO,UAAU,CAAC;IACpB,CAAC;YAAS,CAAC;QAAC,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;AAC3D,CAAC"}

package/dist/training/storage/permissions.d.ts

@@ -0,0 +1,5 @@
+import type { ReadAccess, RunManifest, Visibility } from './types.js';
+export declare function validateManifest(manifest: RunManifest): void;
+export declare function validateVisibility(visibility: Visibility): void;
+export declare function assertRunAccess(manifest: RunManifest, access: ReadAccess): void;
+export declare function canReadVisibility(visibility: Visibility, access: ReadAccess): boolean;

package/dist/training/storage/permissions.js

@@ -0,0 +1,40 @@
+import { canonicalWireId } from '../contracts/index.js';
+import { assertIdentity } from './content.js';
+export function validateManifest(manifest) {
+    if (canonicalWireId(manifest.schema) !== 'spawnfile.training.run.v1')
+        throw new Error('Unsupported stored run schema');
+    for (const value of [manifest.id, manifest.datasetId, manifest.candidateId, manifest.planDigest])
+        assertIdentity(value);
+    if (!['train', 'validation', 'test'].includes(manifest.datasetRole))
+        throw new Error('Invalid dataset role');
+    for (const key of Object.keys(manifest))
+        if (!['schema', 'id', 'datasetId', 'datasetRole', 'candidateId', 'planDigest', 'recordId', 'metadata'].includes(key))
+            throw new Error(`Unknown manifest field: ${key}`);
+    if (manifest.recordId !== undefined)
+        assertIdentity(manifest.recordId);
+}
+export function validateVisibility(visibility) {
+    if (!['public', 'evaluator', 'raw'].includes(visibility))
+        throw new Error('Invalid visibility');
+}
+export function assertRunAccess(manifest, access) {
+    if (!['optimizer', 'evaluator', 'viewer', 'operator'].includes(access.audience) ||
+        !['training', 'validation', 'test', 'replay'].includes(access.phase))
+        throw new Error('Invalid read authorization');
+    if (access.audience === 'optimizer' && manifest.datasetRole !== 'train')
+        throw new Error('Optimizer cannot read validation or sealed test data');
+    if (manifest.datasetRole === 'test') {
+        const frozen = access.frozenCandidateIds?.includes(manifest.candidateId);
+        const phase = access.phase === 'test' || (access.phase === 'replay' && access.releaseTestResults === true);
+        if (!frozen || !phase)
+            throw new Error('Sealed test access requires an authorized frozen candidate and phase');
+        if (access.audience === 'viewer' && access.releaseTestResults !== true)
+            throw new Error('Sealed test results have not been released to the viewer');
+    }
+}
+export function canReadVisibility(visibility, access) {
+    validateVisibility(visibility);
+    return visibility === 'public' || access.audience === 'operator' ||
+        (visibility === 'evaluator' && access.audience === 'evaluator');
+}
+//# sourceMappingURL=permissions.js.map

package/dist/training/storage/permissions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"permissions.js","sourceRoot":"","sources":["../../../src/training/storage/permissions.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAE9C,MAAM,UAAU,gBAAgB,CAAC,QAAqB;IACpD,IAAI,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,2BAA2B;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACvH,KAAK,MAAM,KAAK,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,SAAS,EAAE,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,UAAU,CAAC;QAAE,cAAc,CAAC,KAAK,CAAC,CAAC;IACxH,IAAI,CAAC,CAAC,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;IAC7G,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC;QAAE,IAAI,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,WAAW,EAAE,aAAa,EAAE,aAAa,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,EAAE,CAAC,CAAC;IACjN,IAAI,QAAQ,CAAC,QAAQ,KAAK,SAAS;QAAE,cAAc,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACzE,CAAC;AACD,MAAM,UAAU,kBAAkB,CAAC,UAAsB;IACvD,IAAI,CAAC,CAAC,QAAQ,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;AAClG,CAAC;AACD,MAAM,UAAU,eAAe,CAAC,QAAqB,EAAE,MAAkB;IACvE,IAAI,CAAC,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;QAC7E,CAAC,CAAC,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IACtH,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,IAAI,QAAQ,CAAC,WAAW,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC;IACjJ,IAAI,QAAQ,CAAC,WAAW,KAAK,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,GAAG,MAAM,CAAC,kBAAkB,EAAE,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;QACzE,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI,CAAC,CAAC;QAC3G,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QAC/G,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,kBAAkB,KAAK,IAAI;YAAE,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IACtJ,CAAC;AACH,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,UAAsB,EAAE,MAAkB;IAC1E,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC/B,OAAO,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,UAAU;QAC9D,CAAC,UAAU,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC;AACpE,CAAC"}

package/dist/training/storage/store.d.ts

@@ -0,0 +1,2 @@
+import type { ExperimentStore } from './types.js';
+export declare function openExperimentStore(rootPath: string): Promise<ExperimentStore>;

package/dist/training/storage/store.js

@@ -0,0 +1,162 @@
+import { readdir } from 'node:fs/promises';
+import { assertIdentity, contentDigest, digestName, identity, jsonBytes } from './content.js';
+import { immutableWrite, initializeStoreRoot, readStored, safeStorePath } from './filesystem.js';
+import { appendJournal, readJournal } from './journal.js';
+import { assertRunAccess, canReadVisibility, validateManifest, validateVisibility } from './permissions.js';
+import { externalizeEvaluationJson, hydrateEvaluationJson } from './evaluation-json.js';
+const queues = new Map();
+function serialized(key, operation) {
+    const pending = (queues.get(key) ?? Promise.resolve()).catch(() => undefined).then(operation);
+    queues.set(key, pending);
+    void pending.finally(() => { if (queues.get(key) === pending)
+        queues.delete(key); }).catch(() => undefined);
+    return pending;
+}
+export async function openExperimentStore(rootPath) {
+    const root = await initializeStoreRoot(rootPath);
+    function runParts(runId) {
+        assertIdentity(runId);
+        return ['runs', digestName(contentDigest(runId))];
+    }
+    async function runPath(runId, ...suffix) {
+        return safeStorePath(root, [...runParts(runId), ...suffix]);
+    }
+    async function readRun(runId) {
+        const stored = JSON.parse((await readStored(await runPath(runId, 'manifest.json'))).toString('utf8'));
+        validateManifest(stored.manifest);
+        if (stored.manifest.id !== runId || identity(stored.manifest) !== stored.digest)
+            throw new Error('Stored run manifest integrity mismatch');
+        return stored.manifest;
+    }
+    async function authorize(runId, access) {
+        const manifest = await readRun(runId);
+        assertRunAccess(manifest, access);
+        return manifest;
+    }
+    const store = {
+        async createRun(manifest) {
+            validateManifest(manifest);
+            await immutableWrite(await runPath(manifest.id, 'manifest.json'), jsonBytes({ manifest, digest: identity(manifest) }));
+        },
+        async putBlob(runId, bytes, visibility = 'evaluator') {
+            await readRun(runId);
+            validateVisibility(visibility);
+            const content = Buffer.from(bytes);
+            const digest = contentDigest(content);
+            const body = { runId, digest, size: content.length, visibility };
+            const record = { ...body, id: identity(body) };
+            await immutableWrite(await safeStorePath(root, ['blobs', digestName(digest)]), content);
+            await immutableWrite(await runPath(runId, 'blobs', `${digestName(record.id)}.json`), jsonBytes(record));
+            return { runId, id: record.id, digest, size: content.length };
+        },
+        async listBlobs(runId, access) {
+            await authorize(runId, access);
+            let names;
+            try {
+                names = await readdir(await runPath(runId, 'blobs'));
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                names = [];
+            }
+            const references = [];
+            for (const name of names.filter(name => name.endsWith('.json')).sort()) {
+                const metadata = JSON.parse((await readStored(await runPath(runId, 'blobs', name))).toString('utf8'));
+                const { id, ...body } = metadata;
+                validateVisibility(metadata.visibility);
+                if (id !== identity(body) || name !== `${digestName(id)}.json` || metadata.runId !== runId ||
+                    !Number.isSafeInteger(metadata.size) || metadata.size < 0 || metadata.size > 67_108_864) {
+                    throw new Error('Blob reference integrity mismatch');
+                }
+                if (canReadVisibility(metadata.visibility, access))
+                    references.push({ runId, id, digest: metadata.digest, size: metadata.size, visibility: metadata.visibility });
+            }
+            return references;
+        },
+        async readBlob(reference, access) {
+            await authorize(reference.runId, access);
+            const metadata = JSON.parse((await readStored(await runPath(reference.runId, 'blobs', `${digestName(reference.id)}.json`))).toString('utf8'));
+            const { id, ...body } = metadata;
+            if (id !== identity(body) || id !== reference.id || metadata.runId !== reference.runId || metadata.digest !== reference.digest || metadata.size !== reference.size)
+                throw new Error('Blob reference integrity mismatch');
+            if (!canReadVisibility(metadata.visibility, access))
+                throw new Error('Protected blob access denied');
+            const bytes = await readStored(await safeStorePath(root, ['blobs', digestName(metadata.digest)]));
+            if (bytes.length !== metadata.size || contentDigest(bytes) !== metadata.digest)
+                throw new Error('Stored blob content is corrupt');
+            return bytes;
+        },
+        async appendEvent(runId, event, visibility = 'raw') {
+            const manifest = await readRun(runId);
+            jsonBytes(event.payload);
+            const path = await runPath(runId, 'events.jsonl');
+            const payload = await externalizeEvaluationJson(store, runId, event.payload, visibility);
+            return serialized(path, () => appendJournal(path, { ...event, payload }, visibility, async (left, right) => {
+                const access = { audience: 'operator', phase: 'test', frozenCandidateIds: [manifest.candidateId] };
+                return jsonBytes(await hydrateEvaluationJson(store, left, access)) === jsonBytes(await hydrateEvaluationJson(store, right, access));
+            }));
+        },
+        async appendEvaluation(runId, evaluation, visibility = 'evaluator') {
+            const manifest = await readRun(runId);
+            assertIdentity(evaluation.id);
+            jsonBytes(evaluation.report);
+            validateVisibility(visibility);
+            const path = await runPath(runId, 'evaluations', `${digestName(contentDigest(evaluation.id))}.json`);
+            let previous;
+            try {
+                previous = JSON.parse((await readStored(path)).toString('utf8'));
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+            }
+            if (previous) {
+                const { digest, ...body } = previous;
+                if (identity(body) !== digest || previous.id !== evaluation.id)
+                    throw new Error('Stored evaluation integrity mismatch');
+                const access = { audience: 'operator', phase: 'test', frozenCandidateIds: [manifest.candidateId] };
+                if (previous.visibility !== visibility || jsonBytes(await hydrateEvaluationJson(store, previous.report, access)) !== jsonBytes(evaluation.report)) {
+                    throw new Error('Immutable stored identity already has different bytes');
+                }
+                return;
+            }
+            const report = await externalizeEvaluationJson(store, runId, evaluation.report, visibility);
+            const body = { ...evaluation, report, visibility };
+            await immutableWrite(path, jsonBytes({ ...body, digest: identity(body) }));
+        },
+        async readReplay(runId, access) {
+            const manifest = await authorize(runId, access);
+            const journal = await readJournal(await runPath(runId, 'events.jsonl'));
+            const events = await Promise.all(journal.events.filter(event => canReadVisibility(event.visibility, access))
+                .map(async (event) => ({ ...event, payload: await hydrateEvaluationJson(store, event.payload, access) })));
+            const directory = await runPath(runId, 'evaluations');
+            let names;
+            try {
+                names = await readdir(directory);
+            }
+            catch (error) {
+                if (error.code !== 'ENOENT')
+                    throw error;
+                names = [];
+            }
+            const evaluations = [];
+            for (const name of names.filter(name => name.endsWith('.json')).sort()) {
+                const report = JSON.parse((await readStored(await runPath(runId, 'evaluations', name))).toString('utf8'));
+                const { digest, ...body } = report;
+                assertIdentity(report.id);
+                if (identity(body) !== digest || name !== `${digestName(contentDigest(report.id))}.json`)
+                    throw new Error('Stored evaluation integrity mismatch');
+                if (canReadVisibility(report.visibility, access))
+                    evaluations.push({ ...report,
+                        report: await hydrateEvaluationJson(store, report.report, access) });
+            }
+            const redactedMetadata = manifest.metadata !== undefined && !canReadVisibility('evaluator', access);
+            const { metadata: _metadata, ...publicManifest } = manifest;
+            return { manifest: redactedMetadata ? publicManifest : manifest, redactedMetadata, events, evaluations, completeness: journal.ignoredTailBytes ? 'torn-tail' : 'complete',
+                ignoredTailBytes: journal.ignoredTailBytes, redactedEvents: journal.events.length - events.length };
+        },
+    };
+    return store;
+}
+//# sourceMappingURL=store.js.map

package/dist/training/storage/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../../../src/training/storage/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAE3C,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAC9F,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAC5G,OAAO,EAAE,yBAAyB,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAGxF,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;AACnD,SAAS,UAAU,CAAI,GAAW,EAAE,SAA2B;IAC7D,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9F,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACzB,KAAK,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO;QAAE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC5G,OAAO,OAAO,CAAC;AACjB,CAAC;AACD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,QAAgB;IACxD,MAAM,IAAI,GAAG,MAAM,mBAAmB,CAAC,QAAQ,CAAC,CAAC;IACjD,SAAS,QAAQ,CAAC,KAAa;QAC7B,cAAc,CAAC,KAAK,CAAC,CAAC;QACtB,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,KAAK,UAAU,OAAO,CAAC,KAAa,EAAE,GAAG,MAAgB;QACvD,OAAO,aAAa,CAAC,IAAI,EAAE,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,MAAM,CAAC,CAAC,CAAC;IAC9D,CAAC;IACD,KAAK,UAAU,OAAO,CAAC,KAAa;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAA8C,CAAC;QACnJ,gBAAgB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,MAAM,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC3I,OAAO,MAAM,CAAC,QAAQ,CAAC;IACzB,CAAC;IACD,KAAK,UAAU,SAAS,CAAC,KAAa,EAAE,MAAkB;QACxD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;QACtC,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,MAAM,KAAK,GAAoB;QAC7B,KAAK,CAAC,SAAS,CAAC,QAAQ;YACtB,gBAAgB,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,cAAc,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,eAAe,CAAC,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;QACzH,CAAC;QACD,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,WAAW;YAClD,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACrB,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACnC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,UAAU,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/C,MAAM,cAAc,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACxF,MAAM,cAAc,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC;YACxG,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAChE,CAAC;QACD,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM;YAC3B,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBAAC,KAAK,GAAG,MAAM,OAAO,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;YAC7D,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAAC,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC;YAClG,MAAM,UAAU,GAAmD,EAAE,CAAC;YACtE,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,CAAC;gBACtH,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;gBACjC,kBAAkB,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;gBACxC,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,KAAK,GAAG,UAAU,CAAC,EAAE,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,KAAK,KAAK;oBACtF,CAAC,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,CAAC,IAAI,QAAQ,CAAC,IAAI,GAAG,UAAU,EAAE,CAAC;oBAC5F,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;gBACvD,CAAC;gBACD,IAAI,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;oBAAE,UAAU,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;YACpK,CAAC;YACD,OAAO,UAAU,CAAC;QACpB,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,SAAS,EAAE,MAAM;YAC9B,MAAM,SAAS,CAAC,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,OAAO,CAAC,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAiB,CAAC;YAC9J,MAAM,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;YACjC,IAAI,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,EAAE,IAAI,QAAQ,CAAC,KAAK,KAAK,SAAS,CAAC,KAAK,IAAI,QAAQ,CAAC,MAAM,KAAK,SAAS,CAAC,MAAM,IAAI,QAAQ,CAAC,IAAI,KAAK,SAAS,CAAC,IAAI;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YACzN,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;YACrG,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,MAAM,aAAa,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAClG,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,IAAI,aAAa,CAAC,KAAK,CAAC,KAAK,QAAQ,CAAC,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;YAClI,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,GAAG,KAAK;YAChD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACtC,SAAS,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;YAClD,MAAM,OAAO,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;YACzF,OAAO,UAAU,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE;gBACzG,MAAM,MAAM,GAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/G,OAAO,SAAS,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC;YACtI,CAAC,CAAC,CAAC,CAAC;QACN,CAAC;QACD,KAAK,CAAC,gBAAgB,CAAC,KAAK,EAAE,UAAU,EAAE,UAAU,GAAG,WAAW;YAChE,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;YACtC,cAAc,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAC9B,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;YAC7B,kBAAkB,CAAC,UAAU,CAAC,CAAC;YAC/B,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,UAAU,CAAC,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YACrG,IAAI,QAAsC,CAAC;YAC3C,IAAI,CAAC;gBACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqB,CAAC;YACvF,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACxF,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,QAAQ,CAAC;gBACrC,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,QAAQ,CAAC,EAAE,KAAK,UAAU,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBACxH,MAAM,MAAM,GAAe,EAAE,QAAQ,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC/G,IAAI,QAAQ,CAAC,UAAU,KAAK,UAAU,IAAI,SAAS,CAAC,MAAM,qBAAqB,CAAC,KAAK,EAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,KAAK,SAAS,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;oBAClJ,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;gBAC3E,CAAC;gBACD,OAAO;YACT,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YAC5F,MAAM,IAAI,GAAG,EAAE,GAAG,UAAU,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;YACnD,MAAM,cAAc,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC;QAC7E,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,KAAK,EAAE,MAAM;YAC5B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC,CAAC;YACxE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,iBAAiB,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;iBACzG,GAAG,CAAC,KAAK,EAAC,KAAK,EAAC,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3G,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YACtD,IAAI,KAAe,CAAC;YACpB,IAAI,CAAC;gBAAC,KAAK,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,CAAC;YAAC,CAAC;YACzC,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;gBAAC,KAAK,GAAG,EAAE,CAAC;YAAC,CAAC;YAClG,MAAM,WAAW,GAAuB,EAAE,CAAC;YAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;gBACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,OAAO,CAAC,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAqB,CAAC;gBAC9H,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;gBACnC,cAAc,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC1B,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,MAAM,IAAI,IAAI,KAAK,GAAG,UAAU,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,OAAO;oBAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;gBAClJ,IAAI,iBAAiB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC;oBAAE,WAAW,CAAC,IAAI,CAAC,EAAE,GAAG,MAAM;wBAC5E,MAAM,EAAE,MAAM,qBAAqB,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YACzE,CAAC;YACD,MAAM,gBAAgB,GAAG,QAAQ,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,iBAAiB,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACpG,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,cAAc,EAAE,GAAG,QAAQ,CAAC;YAC5D,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,QAAQ,EAAE,gBAAgB,EAAE,MAAM,EAAE,WAAW,EAAE,YAAY,EAAE,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU;gBACvK,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC;QACxG,CAAC;KACF,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/training/storage/types.d.ts

@@ -0,0 +1,67 @@
+export type DatasetRole = 'train' | 'validation' | 'test';
+export type Visibility = 'public' | 'evaluator' | 'raw';
+/** Trusted host authorization, never accepted directly from viewer request data. */
+export interface ReadAccess {
+    audience: 'optimizer' | 'evaluator' | 'viewer' | 'operator';
+    phase: 'training' | 'validation' | 'test' | 'replay';
+    frozenCandidateIds?: readonly string[];
+    releaseTestResults?: boolean;
+}
+export interface RunManifest {
+    schema: 'spawnfile.training.run.v1';
+    id: string;
+    datasetId: string;
+    datasetRole: DatasetRole;
+    candidateId: string;
+    planDigest: string;
+    recordId?: string;
+    /** Protected evaluator-only metadata; omitted from viewer/optimizer projections. */
+    metadata?: unknown;
+}
+export interface BlobReference {
+    runId: string;
+    id: string;
+    digest: string;
+    size: number;
+}
+export interface StoredEvent {
+    id: string;
+    /** Persistence order only. Native source/causal ordering remains in payload. */
+    sequence: number;
+    visibility: Visibility;
+    payload: unknown;
+    digest: string;
+}
+export interface StoredEvaluation {
+    id: string;
+    visibility: Visibility;
+    report: unknown;
+    digest: string;
+}
+export interface Replay {
+    manifest: RunManifest;
+    events: StoredEvent[];
+    evaluations: StoredEvaluation[];
+    completeness: 'complete' | 'torn-tail';
+    ignoredTailBytes: number;
+    redactedEvents: number;
+    redactedMetadata: boolean;
+}
+export interface ExperimentStore {
+    createRun(manifest: RunManifest): Promise<void>;
+    putBlob(runId: string, bytes: string | Uint8Array, visibility?: Visibility): Promise<BlobReference>;
+    readBlob(reference: BlobReference, access: ReadAccess): Promise<Buffer>;
+    /** Authorized metadata only; content still requires readBlob access. */
+    listBlobs(runId: string, access: ReadAccess): Promise<(BlobReference & {
+        visibility: Visibility;
+    })[]>;
+    appendEvent(runId: string, event: {
+        id: string;
+        payload: unknown;
+    }, visibility?: Visibility): Promise<'appended' | 'duplicate'>;
+    appendEvaluation(runId: string, evaluation: {
+        id: string;
+        report: unknown;
+    }, visibility?: Visibility): Promise<void>;
+    readReplay(runId: string, access: ReadAccess): Promise<Replay>;
+}

package/dist/training/storage/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/training/storage/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/training/storage/types.ts"],"names":[],"mappings":""}

package/dist/training/subjects/environment.d.ts

@@ -0,0 +1,2 @@
+export declare function canonicalProtectedPaths(paths?: readonly string[]): Promise<string[]>;
+export declare function within(parent: string, child: string): boolean;

package/dist/training/subjects/environment.js

@@ -0,0 +1,14 @@
+import { realpath } from 'node:fs/promises';
+import path from 'node:path';
+export async function canonicalProtectedPaths(paths = []) {
+    return Promise.all(paths.map(async (entry) => {
+        if (!path.isAbsolute(entry))
+            throw new Error('Protected paths must be absolute existing paths');
+        return realpath(entry);
+    }));
+}
+export function within(parent, child) {
+    const relative = path.relative(parent, child);
+    return relative === '' || (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative));
+}
+//# sourceMappingURL=environment.js.map

package/dist/training/subjects/environment.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.js","sourceRoot":"","sources":["../../../src/training/subjects/environment.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,QAA2B,EAAE;IACzE,OAAO,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE;QAC3C,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAChG,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC,CAAC,CAAC,CAAC;AACN,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,MAAc,EAAE,KAAa;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IAC9C,OAAO,QAAQ,KAAK,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;AACvH,CAAC"}

package/dist/training/subjects/index.d.ts

@@ -0,0 +1,3 @@
+export { canonicalProtectedPaths, within } from './environment.js';
+export { resolveSubjectAdapter, subjectHostInference } from './registry.js';
+export type { SubjectAdapterOptions, SubjectAdapterRegistration, SubjectAdapterRegistry } from './registry.js';

package/dist/training/subjects/index.js

@@ -0,0 +1,3 @@
+export { canonicalProtectedPaths, within } from './environment.js';
+export { resolveSubjectAdapter, subjectHostInference } from './registry.js';
+//# sourceMappingURL=index.js.map

package/dist/training/subjects/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/training/subjects/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,eAAe,CAAC"}

package/dist/training/subjects/registry.d.ts

@@ -0,0 +1,15 @@
+import type { InferenceGrantAuthority, SubjectAdapter } from '../contracts/index.js';
+export interface SubjectAdapterOptions {
+    model: string;
+    timeoutMs: number;
+}
+export interface SubjectAdapterRegistration {
+    create(options: SubjectAdapterOptions): SubjectAdapter;
+    /** Optional host-broker capability; implementation belongs to the subject adapter. */
+    hostInference?: {
+        grantAuthority(socketPath: string | undefined): Promise<InferenceGrantAuthority>;
+    };
+}
+export type SubjectAdapterRegistry = Readonly<Record<string, SubjectAdapterRegistration>>;
+export declare function resolveSubjectAdapter(registry: SubjectAdapterRegistry | undefined, id: string, options: SubjectAdapterOptions): SubjectAdapter;
+export declare function subjectHostInference(registry: SubjectAdapterRegistry | undefined): NonNullable<SubjectAdapterRegistration['hostInference']>;

package/dist/training/subjects/registry.js

@@ -0,0 +1,13 @@
+export function resolveSubjectAdapter(registry, id, options) {
+    const registration = registry && Object.hasOwn(registry, id) ? registry[id] : undefined;
+    if (!registration)
+        throw new Error(`Supported native runtimes: ${Object.keys(registry ?? {}).join(', ') || 'none registered'}; unknown subject ${id}`);
+    return registration.create(options);
+}
+export function subjectHostInference(registry) {
+    const capabilities = Object.values(registry ?? {}).flatMap(subject => subject.hostInference ? [subject.hostInference] : []);
+    if (capabilities.length !== 1)
+        throw new Error('Exactly one subject hostInference grant authority must be registered');
+    return capabilities[0];
+}
+//# sourceMappingURL=registry.js.map

package/dist/training/subjects/registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.js","sourceRoot":"","sources":["../../../src/training/subjects/registry.ts"],"names":[],"mappings":"AAWA,MAAM,UAAU,qBAAqB,CAAC,QAA4C,EAAE,EAAU,EAAE,OAA8B;IAC5H,MAAM,YAAY,GAAG,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACxF,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,iBAAiB,qBAAqB,EAAE,EAAE,CAAC,CAAC;IACvJ,OAAO,YAAY,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,QAA4C;IAC/E,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC5H,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;IACvH,OAAO,YAAY,CAAC,CAAC,CAAE,CAAC;AAC1B,CAAC"}

package/dist/training/testing/evidence.d.ts

@@ -0,0 +1,6 @@
+import type { EvaluationContext, EvaluationSnapshot, ArtifactSnapshot } from '../contracts/evaluation.js';
+import type { Observation } from '../contracts/execution.js';
+export declare function observation(overrides?: Partial<Observation>): Observation;
+export declare function artifact(value?: unknown): ArtifactSnapshot;
+export declare function snapshot(overrides?: Partial<EvaluationSnapshot>): EvaluationSnapshot;
+export declare function evaluationContext(overrides?: Partial<EvaluationContext>): EvaluationContext;

package/dist/training/testing/evidence.js

@@ -0,0 +1,21 @@
+export function observation(overrides = {}) {
+    return { id: 'dispatch', source: 'native', seq: 1, type: 'tool.dispatch',
+        timestamp: '2026-09-13T12:00:00Z', trialId: 'trial', wakeId: 'wake',
+        callId: 'call', tool: 'validate', args: { value: 'article' }, ...overrides };
+}
+export function artifact(value = { body: ['A precise report.'] }) {
+    return { name: 'article', checkpointId: 'checkpoint-1', digest: 'sha256:example',
+        bytes: JSON.stringify(value), value, provenance: 'test fixture', acceptedCallId: 'file' };
+}
+export function snapshot(overrides = {}) {
+    return { trialId: 'trial', recordId: 'record', closed: true, events: [],
+        coverage: [{ channel: 'tools', completeness: 'complete', ordering: 'source' },
+            { channel: 'output', completeness: 'complete', ordering: 'source' }],
+        artifacts: { article: artifact() }, output: '4', inputFiles: { packet: 'Source evidence' },
+        context: { edition: '2026-09-13' }, ...overrides };
+}
+export function evaluationContext(overrides = {}) {
+    return { snapshot: snapshot(), results: {}, scores: {}, judges: {}, embeddings: {},
+        readText: async () => { throw new Error('Sidecar not registered'); }, ...overrides };
+}
+//# sourceMappingURL=evidence.js.map

package/dist/training/testing/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../../src/training/testing/evidence.ts"],"names":[],"mappings":"AAGA,MAAM,UAAU,WAAW,CAAC,YAAkC,EAAE;IAC9D,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,eAAe;QACtE,SAAS,EAAE,sBAAsB,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM;QACnE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AACjF,CAAC;AACD,MAAM,UAAU,QAAQ,CAAC,QAAiB,EAAE,IAAI,EAAE,CAAC,mBAAmB,CAAC,EAAE;IACvE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,EAAE,gBAAgB;QAC9E,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC;AAC9F,CAAC;AACD,MAAM,UAAU,QAAQ,CAAC,YAAyC,EAAE;IAClE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE;QACrE,QAAQ,EAAE,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE;YAC3E,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC;QACtE,SAAS,EAAE,EAAE,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,iBAAiB,EAAE;QAC1F,OAAO,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,SAAS,EAAE,CAAC;AACvD,CAAC;AACD,MAAM,UAAU,iBAAiB,CAAC,YAAwC,EAAE;IAC1E,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE;QAChF,QAAQ,EAAE,KAAK,IAAI,EAAE,GAAG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,SAAS,EAAE,CAAC;AACzF,CAAC"}

package/dist/training/testing/index.d.ts

@@ -0,0 +1 @@
+export { observation, artifact, snapshot, evaluationContext } from './evidence.js';

package/dist/training/testing/index.js

@@ -0,0 +1,2 @@
+export { observation, artifact, snapshot, evaluationContext } from './evidence.js';
+//# sourceMappingURL=index.js.map

package/dist/training/testing/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/training/testing/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC"}

package/dist/training/viewer/cockpit/activity.d.ts

@@ -0,0 +1,2 @@
+import type { ViewerData } from '../types.js';
+export declare function liveActivity(data: ViewerData): string;

package/dist/training/viewer/cockpit/activity.js

@@ -0,0 +1,14 @@
+import { escapeHtml as e, percent } from './format.js';
+export function liveActivity(data) {
+    const activity = data.activity;
+    if (!activity)
+        return '';
+    return `<section class="panel"><h2 class="panel-title">Live measurements</h2><div class="panel-body">
+<strong>${e(activity.status)}</strong><p class="muted">${e(activity.phase)} · ${e(activity.caseId)}</p>
+<div class="budget-row"><span>Observed tools</span><strong>${activity.toolCalls}</strong></div>
+<div class="budget-row"><span>Judge attempts</span><strong>${activity.judgeCalls}</strong></div>
+<div class="activity-measurements">${activity.measurements.map(value => `<div class="budget-row"><span title="${e(value.stageId)}">${e(value.criterionId)}${value.weight === undefined ? '' : ` · ${value.weight}×`}</span>
+<strong>${value.kind === 'gate' ? e(value.status) : percent(value.score)}</strong></div>`).join('')}</div>
+</div></section>`;
+}
+//# sourceMappingURL=activity.js.map

package/dist/training/viewer/cockpit/activity.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"activity.js","sourceRoot":"","sources":["../../../../src/training/viewer/cockpit/activity.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,UAAU,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAEvD,MAAM,UAAU,YAAY,CAAC,IAAgB;IAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC;IAC/B,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,CAAC;IACzB,OAAO;UACC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC;6DACrC,QAAQ,CAAC,SAAS;6DAClB,QAAQ,CAAC,UAAU;qCAC3C,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CACnE,wCAAwC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,MAAM,GAAG;UACrI,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;iBAClF,CAAC;AAClB,CAAC"}

package/dist/training/viewer/cockpit/evidence.d.ts

@@ -0,0 +1,4 @@
+import type { ViewerCosts, ViewerData } from '../types.js';
+export declare function costView(costs: ViewerCosts | undefined): string;
+export declare function trialDetails(data: ViewerData): string;
+export declare function provenance(data: ViewerData): string;