spawnfile 0.1.25 → 0.1.27

package/dist/runtime/daimon/training/native/child/lifecycle.js

@@ -0,0 +1,391 @@
+import { canonicalWireId } from '../../../../../training/index.js';
+import { spawn } from 'node:child_process';
+import { dirname } from 'node:path';
+import { setTimeout as pause } from 'node:timers/promises';
+import { isGrokLaunch, nativeTrialArtifactsRoot, readPrivateFile } from '../receipt/index.js';
+import { admittedExecutions, declaredLimitStop, executionClosed, validateNativeFrame, AMBIGUOUS_NATIVE_EXECUTION } from '../worker/index.js';
+import { createNativeHttpClient, transportTerminalBinding } from '../transport/index.js';
+import { engineWakeTimeoutMs, parseTransportSource } from '../worker/index.js';
+import { ensureNativeTrialArtifacts, nativeChildArguments, nativeChildEnvironment, validateChildPaths } from './arguments.js';
+import { verifyChildSandbox } from './sandbox.js';
+import { childDiagnostics } from './diagnostics.js';
+/** One fresh worker process in the caller's existing container; no Docker or remote proof. */
+export async function startOwnedChild(execution, launch, trialId, timeoutMs, signal, startupMs = 60_000, protectedPaths = []) {
+    if (!Number.isSafeInteger(startupMs) || startupMs < 1 || startupMs > 3_600_000)
+        throw new Error('Invalid native startup deadline');
+    signal?.throwIfAborted();
+    const startup = new AbortController();
+    const abort = () => startup.abort();
+    signal?.addEventListener('abort', abort, { once: true });
+    const timer = setTimeout(abort, Math.min(startupMs, timeoutMs));
+    try {
+        if (execution.prepare)
+            await bounded(execution.prepare({ launch: structuredClone(launch), trialId, signal: startup.signal }), startup.signal);
+        startup.signal.throwIfAborted();
+        await validateChildPaths(launch);
+        await ensureNativeTrialArtifacts(launch, trialId);
+        const env = await nativeChildEnvironment(launch);
+        const token = (await readPrivateFile(launch.tokenFile, 4096)).trim();
+        return await launchChild(launch, trialId, timeoutMs, env, token, startup.signal, protectedPaths, execution.grokSlots);
+    }
+    finally {
+        clearTimeout(timer);
+        signal?.removeEventListener('abort', abort);
+    }
+}
+/**
+ * Every value a captured stream must never publish: the control token and every
+ * declared environment value (locale and path variables excepted, which are not
+ * secret and are useful in a diagnostic), plus the credential file paths.
+ */
+function childSecrets(launch, env, token) {
+    const safe = new Set(['HOME', 'PATH', 'LANG', 'LC_ALL', 'TZ']);
+    return [token, launch.tokenFile, launch.envFile,
+        ...Object.entries(env).filter(([key]) => !safe.has(key)).map(([, value]) => value ?? '')].filter(Boolean);
+}
+async function launchChild(launch, trialId, timeoutMs, env, token, startup, protectedPaths, grokSlots) {
+    const http = createNativeHttpClient(`http://${launch.host.bindHost}:${launch.host.port}`, token, launch.delivery);
+    const diagnostics = await childDiagnostics(nativeTrialArtifactsRoot(launch, trialId), trialId, launch.configSha256, childSecrets(launch, env, token));
+    const group = process.platform !== 'win32';
+    const child = spawn(process.execPath, nativeChildArguments(launch, trialId, timeoutMs), {
+        cwd: dirname(launch.workerRoot), env, detached: group, stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    const pid = child.pid;
+    let reaped = false;
+    let exited = false;
+    let exitCode = null;
+    let exitSignal = null;
+    let ready = false;
+    let failure = false;
+    let buffer = '';
+    let bytes = 0;
+    child.once('error', () => { failure = true; });
+    child.once('exit', () => { reaped = true; });
+    child.once('close', (code, signal) => { exited = true; exitCode = code; exitSignal = signal; });
+    const groupGone = () => {
+        // Only ESRCH proves absence. Unsupported inspection and EPERM stay unknown.
+        if (!group || pid === undefined)
+            return false;
+        try {
+            process.kill(-pid, 0);
+            return false;
+        }
+        catch (error) {
+            return error.code === 'ESRCH';
+        }
+    };
+    const send = (signal) => {
+        // Reaping ends signaling authority: a retained numeric PID/PGID can be reused.
+        if (pid === undefined || reaped)
+            return;
+        try {
+            process.kill(group ? -pid : pid, signal);
+        }
+        catch { /* Closure observation decides, never signal success. */ }
+    };
+    const consume = (chunk, stdout) => {
+        diagnostics.append(chunk, stdout);
+        bytes += chunk.length;
+        if (bytes > 1_048_576) {
+            failure = true;
+            send('SIGTERM');
+            return;
+        }
+        if (!stdout)
+            return;
+        buffer += chunk.toString('utf8');
+        for (;;) {
+            const end = buffer.indexOf('\n');
+            if (end < 0)
+                break;
+            const line = buffer.slice(0, end);
+            buffer = buffer.slice(end + 1);
+            try {
+                const row = JSON.parse(line);
+                if (canonicalWireId(row.schema) === 'spawnfile.training.daimon-native.ready.v1' && row.trialId === trialId && row.configSha256 === launch.configSha256 &&
+                    row.agentId === launch.agent.id && row.model === launch.agent.model && row.port === launch.host.port &&
+                    (!isGrokLaunch(launch) || row.engine === 'grok' && row.reasoningEffort === launch.agent.reasoningEffort))
+                    ready = true;
+            }
+            catch { /* Bootstrap may emit non-protocol logging; never treat it as readiness. */ }
+        }
+    };
+    child.stdout.on('data', (chunk) => consume(chunk, true));
+    child.stderr.on('data', (chunk) => consume(chunk, false));
+    let stopping;
+    /**
+     * One entry per delivery this trial made, in order: which wake it was, and why
+     * that wake's own frame cannot be scored from. `terminal-absent` is no frame at
+     * all for that delivery; `terminal-unbound` is a frame whose identity, closed
+     * trace or resolved execution disagreed, including one belonging to another
+     * trial; `terminal-ambiguous` is a frame whose named execution has more than
+     * one closed trace answering to it. Kept apart rather than collapsed, because
+     * they call for fixes in different places.
+     *
+     * A ledger rather than one verdict, because a trial whose subject defers runs
+     * several wakes and each one publishes its own frame. Holding only the newest
+     * meant a continuation that did not bind erased the account of a wake that HAD
+     * bound, over a closed trace, on a runtime the same stop proves quiet — and the
+     * trial then reported that it had no terminal evidence at all, which was false.
+     */
+    const wakes = [];
+    /**
+     * A fault that belongs to the TRIAL rather than to one of its wakes, and which
+     * therefore no other wake's frame may be scored past.
+     *
+     * Isolation is the property: a frame from another trial, agent, model, config
+     * or delivery, a foreign execution among the traces, or one execution answering
+     * to two closed traces all say that what this runtime published cannot be
+     * attributed, and attribution is exactly what selection would be doing. A wake
+     * that simply named no closed execution of its own is the other kind — that
+     * wake is unscorable and the trial's earlier frames are untouched.
+     */
+    let sealed;
+    let diagnosed;
+    /**
+     * Closure is one question — is anything still running or still spending? — and
+     * it is the conjunction of four independent live proofs: the runtime admits no
+     * execution of this agent's, it sealed and acknowledged its own stop, and the
+     * owned child exited cleanly, and its process group disappeared (decided below,
+     * after the kill escalation). Escaped descendants and remote work stay unknown.
+     *
+     * It used to demand a fourth: that the last delivery's terminal frame bind to a
+     * resolved execution. That was interrogating another service's inbox
+     * bookkeeping over HTTP — a fact about the last delivery's paperwork, derived
+     * from a snapshot the runtime had already published, which cannot say whether
+     * anything is spending NOW. Everything it could claim comes from the same
+     * runtime that answers `/v2/activity` live, so it added no authority while it
+     * did subtract scorable runs: across seven investigations this predicate failed
+     * a different way each time on a run that was healthy. The binding still
+     * happens and still rejects a foreign trial's frame; it reports as missing
+     * EVIDENCE instead.
+     *
+     * Each proof names itself on the receipt, which publishes durably with the
+     * turn, because the evidence that would identify a missing one lives in the
+     * worker's control root and a training slot puts that on tmpfs. The vocabulary
+     * is closed, so nothing here can leak a path, a token, a body or an error
+     * string.
+     */
+    const proveClosure = async () => {
+        if (!ready || exited)
+            return 'worker-unavailable';
+        // Read before the stop, so the query is answered by the runtime that owns the
+        // execution; a host the worker already stopped seals this projection instead.
+        let activity;
+        try {
+            activity = await http('/v2/activity', undefined, 1500);
+        }
+        catch {
+            return 'activity-unreadable';
+        }
+        // Requested even when the projection already refuses closure: a runtime that
+        // can still be told to stop should be, and the cause below names the busier
+        // fault first rather than whichever one this request happens to return.
+        let native;
+        try {
+            native = await http('/trial/stop', {}, 6000);
+        }
+        catch {
+            native = undefined;
+        }
+        // A projection with no execution authority, or carrying another agent's
+        // execution, cannot be counted at all; an unfinished runtime answers with the
+        // execution it is still running. Different faults, different names.
+        let admitted;
+        try {
+            admitted = admittedExecutions(activity, launch.agent.id);
+        }
+        catch {
+            return 'execution-unbound';
+        }
+        if (admitted > 0)
+            return 'activity-busy';
+        if (native?.state !== 'acknowledged')
+            return 'native-stop-unacknowledged';
+        return undefined;
+    };
+    const stop = (reason) => stopping ??= (async () => {
+        // The trial's own evidence, selected rather than taken from whichever delivery
+        // answered last: the most recent wake that bound is the most recent account of
+        // this trial, and it is named so a scored report can say which wake it read. A
+        // trial-wide fault outranks every frame, and with no admissible wake at all the
+        // refusal keeps the last delivery's own cause.
+        const scored = sealed ? undefined : [...wakes].reverse().find(entry => entry.unevidenced === undefined);
+        const last = wakes[wakes.length - 1];
+        const evidence = scored ? undefined : sealed ?? last?.unevidenced ?? 'terminal-absent';
+        let cause;
+        try {
+            cause = await proveClosure();
+        }
+        catch {
+            cause = 'activity-unreadable'; /* Uncertain native work requires outer-container termination. */
+        }
+        if (!exited)
+            send('SIGTERM');
+        const until = Date.now() + 2000;
+        while ((!exited || !groupGone()) && Date.now() < until)
+            await pause(20);
+        if (!exited || !groupGone()) {
+            send('SIGKILL');
+            const forced = Date.now() + 1000;
+            while ((!exited || !groupGone()) && Date.now() < forced)
+                await pause(20);
+        }
+        await diagnostics.save(exitCode, exitSignal);
+        cause ??= !exited || !groupGone() ? 'child-running' : exitCode === 0 ? undefined : 'child-exit';
+        const confirmed = cause === undefined;
+        // A worker that died mid-turn published nothing: startup owns the only
+        // other route this record takes, and the protected file it is built from
+        // lives on a slot tmpfs that dies with the container. Build it here so the
+        // durable event stream carries why the worker stopped answering — for a
+        // frame that never arrived as much as for an unproven closure, since its
+        // last words are exactly what explains a missing one.
+        if (!confirmed || evidence) {
+            try {
+                diagnosed = diagnostics.record(new Error(reason));
+            }
+            catch { /* never fails a stop */ }
+        }
+        return { state: confirmed ? 'acknowledged' : 'unknown', scope: 'native-handle', quiescence: confirmed ? 'confirmed' : 'unknown', remoteWork: 'unknown', reason,
+            ...(cause ? { unconfirmed: cause } : {}),
+            // Two separate questions, two separate names: a run can be provably quiet
+            // AND unscorable, and a report that cannot say which one it is sends the
+            // next investigation to the wrong layer.
+            ...(evidence ? { unevidenced: evidence } : {}),
+            // Which wake the verdict rests on, and every wake's own verdict beside it.
+            // Selection must not become suppression: a continuation that did not bind is
+            // a real account of that wake, and it travels here because the worker's own
+            // per-wake files live on a control root a training slot puts on tmpfs.
+            ...(scored ? { evidenced: scored.wakeId } : {}),
+            ...(wakes.length ? { wakes: wakes.map(entry => ({ wakeId: entry.wakeId, ...(entry.unevidenced ? { unevidenced: entry.unevidenced } : {}) })) } : {}),
+            detail: !confirmed ? `Native child closure unconfirmed (${cause}); caller must stop the shared container`
+                : evidence ? `Idle native runtime, acknowledged native stop, worker exit and process group gone; no terminal evidence to score this trial (${evidence})${last ? ` on wake ${last.wakeId}` : ''}`
+                    : `Closed native execution, idle runtime, acknowledged native stop, worker exit and process group gone${scored === last ? '' : `; scored from wake ${scored.wakeId}, not wake ${last.wakeId} (${last.unevidenced})`}` };
+    })();
+    try {
+        while (!ready) {
+            startup.throwIfAborted();
+            if (failure || exited)
+                throw new Error('Native worker exited or failed before readiness');
+            await pause(20);
+        }
+        const health = await http('/trial/health', undefined, 1000, startup);
+        if (health.version !== 'noopolis.daimon.organization-runtime-health.v1' || health.state !== 'running' || health.agents.length !== 1 || health.agents[0]?.agentId !== launch.agent.id)
+            throw new Error('Native worker readiness identity mismatch');
+        await verifyChildSandbox(launch, trialId, protectedPaths, startup, grokSlots);
+        startup.throwIfAborted();
+        const request = async (path, body, ms, signal) => {
+            if (failure || exited)
+                throw new Error('Owned native worker is no longer alive');
+            // Recorded before the call, so a delivery whose frame never arrives is still
+            // this trial's own wake with its own cause rather than a gap in the ledger.
+            const wake = path !== '/trial/run' || body === undefined ? undefined : named(body?.wakeId);
+            if (wake && launch.delivery === 'transport')
+                wake.source = parseTransportSource(body.source);
+            if (wake)
+                wakes.push(wake);
+            const result = await http(path, body, ms, signal);
+            if (wake)
+                bindTerminalEvidence(wake, result, launch, trialId, fault => { sealed ??= fault; }, engineWakeTimeoutMs(timeoutMs, launch));
+            return result;
+        };
+        return { name: `child:${child.pid}`, request, stop, diagnostic: () => diagnosed };
+    }
+    catch (error) {
+        // The protected capture lives on the control root, which a training slot puts on tmpfs; the thrown
+        // carrier holds the redacted record so the caller can persist the failure class durably.
+        await stop('Native child startup failed');
+        throw diagnostics.startupFailure(error);
+    }
+}
+/**
+ * The delivery's own wake name, at the bound the worker's gate admits.
+ *
+ * The receipt publishes durably and its vocabulary is closed, so the name a
+ * caller passed is either one of those bounded identifiers or it is not
+ * published at all: `unnamed` is a statement about the ledger entry, never a
+ * path, a token or a body smuggled onto the record by a caller's own string.
+ */
+const WAKE_NAME = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+function named(wakeId) {
+    return { wakeId: typeof wakeId === 'string' && WAKE_NAME.test(wakeId) ? wakeId : 'unnamed', unevidenced: 'terminal-absent' };
+}
+/**
+ * Whether ONE wake's frame can be scored from — never whether something is still
+ * spending, and never a verdict about the trial around it.
+ *
+ * A frame from another trial, agent, wake or config is not this trial's evidence,
+ * and that check lives here rather than in the closure predicate. The receipt has
+ * to name this trial's own delivery too: the frame's identity and the delivery the
+ * runtime answered for are one delivery, or the frame is accounting for somebody
+ * else's wake. Those are attribution failures, so they `seal` the whole trial:
+ * nothing this runtime published can be scored past one.
+ *
+ * A trial whose subject deferred runs its continuations as further wakes, and each
+ * one closes an execution of its own. The trace that answers for THIS frame is the
+ * one the frame names; the rest are this same trial's earlier, already-closed
+ * wakes, and counting them was refusing a healthy run for the arity of its own
+ * history. Nothing is admitted by position: an unnamed execution resolves to no
+ * trace at all, and that is this wake's own fault rather than the trial's.
+ *
+ * An identity conflict still throws, because it must fail the turn rather than
+ * pass as verified work; it only records what it was first. Two traces answering
+ * to the named execution is its own word: the frame is not unbound, it is
+ * unreadable, and that distinction is what sends the next look at it upstream
+ * instead of here.
+ */
+export function bindTerminalEvidence(wake, value, launch, trialId, seal, wakeTimeoutMs) {
+    const own = canonicalWireId(value.schema) === 'spawnfile.training.daimon-native.trial.v1' && value.trialId === trialId && value.agentId === launch.agent.id &&
+        value.model === launch.agent.model && value.configSha256 === launch.configSha256 &&
+        value.wakeId === wake.wakeId;
+    const binding = launch.delivery === 'transport' ? transportTerminalBinding(value, wake.source)
+        : value.receipt && value.activity && value.receipt.agent_id === launch.agent.id &&
+            value.receipt.delivery_id === `${trialId}:${value.wakeId}` ? 'bound' : 'conflict';
+    wake.unevidenced = 'terminal-unbound';
+    if (!own || binding === 'conflict') {
+        seal('terminal-unbound');
+        return;
+    }
+    try {
+        if (binding === 'incomplete') {
+            if (value.activity)
+                admittedExecutions(value.activity, launch.agent.id);
+            const ids = new Set();
+            for (const trace of value.native.traces) {
+                if (trace.agent_id !== launch.agent.id)
+                    throw new Error('Native execution evidence identity mismatch');
+                if (ids.has(trace.turn_id))
+                    throw new Error(AMBIGUOUS_NATIVE_EXECUTION);
+                ids.add(trace.turn_id);
+            }
+            return;
+        }
+        validateNativeFrame(value.activity, value.receipt, value.native.traces, launch.agent.id, value.executionId);
+        const trace = typeof value.executionId === 'string' ? value.native.traces.find(row => row.turn_id === value.executionId) : undefined;
+        // A failed trace binds only as the declared-limit stop the worker labelled and
+        // its own sealed usage row still states; any other failure stays unscorable.
+        const limited = value.limit !== undefined && declaredLimitStop(trace, value.native.usage, wakeTimeoutMs) === value.limit;
+        if (!trace || trace.status !== 'completed' && !limited)
+            return;
+        if (executionClosed(value.activity, value.receipt, value.native.traces, launch.agent.id, trace.turn_id) === value.executionId)
+            wake.unevidenced = undefined;
+    }
+    catch (conflict) {
+        const fault = conflict.message === AMBIGUOUS_NATIVE_EXECUTION ? 'terminal-ambiguous' : 'terminal-unbound';
+        wake.unevidenced = fault;
+        seal(fault);
+        throw conflict;
+    }
+}
+async function bounded(pending, signal) {
+    signal.throwIfAborted();
+    let abort;
+    const cancelled = new Promise((_resolve, reject) => { abort = () => reject(new Error('Native child preparation cancelled')); signal.addEventListener('abort', abort, { once: true }); });
+    try {
+        return await Promise.race([pending, cancelled]);
+    }
+    finally {
+        signal.removeEventListener('abort', abort);
+    }
+}
+//# sourceMappingURL=lifecycle.js.map

package/dist/runtime/daimon/training/native/child/lifecycle.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAA6B,MAAM,qBAAqB,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,0BAA0B,EACvF,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAA8B,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAgC,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9H,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAA+B,EAAE,MAA4B,EAAE,OAAe,EAClH,SAAiB,EAAE,MAAoB,EAAE,SAAS,GAAG,MAAM,EAAE,iBAAoC,EAAE;IACnG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnI,MAAM,EAAE,cAAc,EAAE,CAAC;IACzB,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAChE,IAAI,CAAC;QACH,IAAI,SAAS,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9I,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACxH,CAAC;YAAS,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;AACjF,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAA4B,EAAE,GAAsB,EAAE,KAAa;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO;QAC7C,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9G,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAA4B,EAAE,OAAe,EAAE,SAAiB,EAAE,GAAsB,EACjH,KAAa,EAAE,OAAoB,EAAE,cAAiC,EAAE,SAAkC;IAC1G,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClH,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAChH,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;QACtF,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAAC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAAC,IAAI,KAAK,GAAG,KAAK,CAAC;IAAC,IAAI,OAAO,GAAG,KAAK,CAAC;IAAC,IAAI,MAAM,GAAG,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAC7K,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,GAAY,EAAE;QAC9B,4EAA4E;QAC5E,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAC5C,OAAO,KAAK,EAAE,CAAC;YAAC,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;QAAC,CAAC;IAC7E,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAC5C,+EAA+E;QAC/E,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;IACtH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,MAAe,EAAE,EAAE;QACjD,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,MAAM;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;gBACxD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,2CAA2C,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;oBACpJ,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI;oBACpG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;oBAAE,KAAK,GAAG,IAAI,CAAC;YAC3H,CAAC;YAAC,MAAM,CAAC,CAAC,2EAA2E,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACpI,IAAI,QAA0C,CAAC;IAC/C;;;;;;;;;;;;;;OAcG;IACH,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC;;;;;;;;;;OAUG;IACH,IAAI,MAA2C,CAAC;IAChD,IAAI,SAA+C,CAAC;IACpD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,YAAY,GAAG,KAAK,IAA0C,EAAE;QACpE,IAAI,CAAC,KAAK,IAAI,MAAM;YAAE,OAAO,oBAAoB,CAAC;QAClD,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,IAAI,CAAiB,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC/E,MAAM,CAAC;YAAC,OAAO,qBAAqB,CAAC;QAAC,CAAC;QACvC,6EAA6E;QAC7E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,IAAI,CAAqB,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,SAAS,CAAC;QAAC,CAAC;QACvG,wEAAwE;QACxE,8EAA8E;QAC9E,oEAAoE;QACpE,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjE,MAAM,CAAC;YAAC,OAAO,mBAAmB,CAAC;QAAC,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC;QACzC,IAAI,MAAM,EAAE,KAAK,KAAK,cAAc;YAAE,OAAO,4BAA4B,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAwB,EAAE,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+CAA+C;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,WAAW,IAAI,iBAAiB,CAAC;QACvF,IAAI,KAAkC,CAAC;QACvC,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;QAAC,CAAC;QACrC,MAAM,CAAC;YAAC,KAAK,GAAG,qBAAqB,CAAC,CAAC,iEAAiE;QAAC,CAAC;QAC1G,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAChC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBAAE,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QAChG,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC;QACtC,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAAC,CAAC;QAC7H,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM;YAC5J,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,2EAA2E;YAC3E,6EAA6E;YAC7E,4EAA4E;YAC5E,uEAAuE;YACvE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpJ,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC,KAAK,0CAA0C;gBACvG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gIAAgI,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9L,CAAC,CAAC,sGAAsG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,MAAO,CAAC,MAAM,cAAc,IAAK,CAAC,MAAM,KAAK,IAAK,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC;IACnO,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC1F,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAoE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxI,IAAI,MAAM,CAAC,OAAO,KAAK,gDAAgD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACnP,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9E,OAAO,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAqC,KAAK,EAAK,IAAqD,EAAE,IAAc,EAAE,EAAW,EAAE,MAAoB,EAAE,EAAE;YACtK,IAAI,OAAO,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACjF,6EAA6E;YAC7E,4EAA4E;YAC5E,MAAM,IAAI,GAAG,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAE,IAA6B,EAAE,MAAM,CAAC,CAAC;YACrH,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;gBAAE,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAE,IAA6B,CAAC,MAAM,CAAC,CAAC;YACvH,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAI,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,IAAI;gBAAE,oBAAoB,CAAC,IAAI,EAAE,MAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1J,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mGAAmG;QACnG,yFAAyF;QACzF,MAAM,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC1C,MAAM,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC;IAC1C,CAAC;AACH,CAAC;AAKD;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,SAAS,KAAK,CAAC,MAAe;IAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;AAC/H,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAkB,EAAE,KAAuB,EAAE,MAA4B,EAAE,OAAe,EAC7H,IAA8C,EAAE,aAAsB;IACtE,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,2CAA2C,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;QACzJ,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;QAChF,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAC5F,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;YAC7E,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,GAAG,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IACtF,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzE,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,QAAQ;gBAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACvG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACxE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrI,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC;QACzH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,OAAO;YAAE,OAAO;QAC/D,IAAI,eAAe,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;IAChK,CAAC;IAAC,OAAO,QAAQ,EAAE,CAAC;QAClB,MAAM,KAAK,GAAI,QAAkB,CAAC,OAAO,KAAK,0BAA0B,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACrH,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,MAAM,QAAQ,CAAC;IACjB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,OAAmB,EAAE,MAAmB;IAChE,MAAM,CAAC,cAAc,EAAE,CAAC;IAAC,IAAI,KAAkB,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChM,IAAI,CAAC;QAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;AAClH,CAAC"}

package/dist/runtime/daimon/training/native/child/probe.d.ts

@@ -0,0 +1,2 @@
+/** Executed verbatim inside the native sandbox; success is an on-disk terminal marker. */
+export declare function nativeChildProbe(input: string, complete: string, denied: readonly string[], port: number): string;

package/dist/runtime/daimon/training/native/child/probe.js

@@ -0,0 +1,11 @@
+/** Executed verbatim inside the native sandbox; success is an on-disk terminal marker. */
+export function nativeChildProbe(input, complete, denied, port) {
+    return `const fs=require('node:fs'),net=require('node:net');
+if(fs.readFileSync(${JSON.stringify(input)},'utf8')!=='NATIVE_READ')throw Error('Workspace read failed');
+for(const p of ${JSON.stringify(denied)}){let fd;try{fd=fs.openSync(p,'r');}catch{continue;}fs.closeSync(fd);throw Error('Protected path readable');}
+let settled=false;const s=net.connect({host:'127.0.0.1',port:${port}});
+s.once('connect',()=>{settled=true;s.destroy();process.exitCode=1;});
+s.once('error',()=>{if(settled)return;settled=true;s.destroy();fs.writeFileSync(${JSON.stringify(complete)},'NATIVE_POLICY_COMPLETE');});
+s.setTimeout(750,()=>{settled=true;s.destroy();process.exitCode=1;});`;
+}
+//# sourceMappingURL=probe.js.map

package/dist/runtime/daimon/training/native/child/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/probe.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAyB,EAAE,IAAY;IACvG,OAAO;qBACY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;+DACwB,IAAI;;kFAEe,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;sEACpC,CAAC;AACvE,CAAC"}

package/dist/runtime/daimon/training/native/child/sandbox.d.ts

@@ -0,0 +1,4 @@
+import { type VerifiedNativeLaunch } from '../receipt/index.js';
+import type { GrokSlotFreshnessStore } from '../../services/index.js';
+/** Runs the actual owner-produced permission projection, not an approximate test profile. */
+export declare function verifyChildSandbox(launch: VerifiedNativeLaunch, trialId: string, protectedPaths: readonly string[], signal: AbortSignal, grokSlots?: GrokSlotFreshnessStore): Promise<void>;

package/dist/runtime/daimon/training/native/child/sandbox.js

@@ -0,0 +1,76 @@
+import { trainingEnvironment } from '../../../../../training/index.js';
+import { execFile } from 'node:child_process';
+import { promisify } from 'node:util';
+import { lstat, mkdir, mkdtemp, open, readFile, rm, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { createServer } from 'node:net';
+import { nativeChildProbe } from './probe.js';
+import { isGrokLaunch, nativeTrialArtifactsRoot, parseNativeSandboxReceipt, readPrivateFile } from '../receipt/index.js';
+import { verifyChildGrokSlot } from './grok.js';
+/** Runs the actual owner-produced permission projection, not an approximate test profile. */
+export async function verifyChildSandbox(launch, trialId, protectedPaths, signal, grokSlots) {
+    if (isGrokLaunch(launch))
+        return verifyChildGrokSlot(launch, trialId, protectedPaths, grokSlots);
+    const home = launch.projections.find(row => row.role === 'home').target;
+    const artifacts = nativeTrialArtifactsRoot(launch, trialId);
+    const receipt = parseNativeSandboxReceipt(JSON.parse(await readPrivateFile(join(artifacts, 'sandbox-projection.json'), 262144)), {
+        trialId, configSha256: launch.configSha256, agentId: launch.agent.id, workspacePath: launch.workspace.target, runtimeHomePath: home,
+    });
+    const scratch = await mkdtemp(join(launch.workspace.target, '.spawnfile-training-native-policy-'));
+    const owned = [];
+    const denied = [];
+    const server = createServer(socket => socket.destroy());
+    try {
+        // An absent configured secret has nothing to deny; the TypeSafe transport refuses it on use.
+        const secretFile = trainingEnvironment('SPAWNFILE_TRAINING_TYPESAFE_SECRET_FILE');
+        const evaluatorSecret = secretFile ? resolve(secretFile) : undefined;
+        const secretPresent = evaluatorSecret !== undefined && await lstat(evaluatorSecret).then(() => true, (error) => {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        });
+        for (const path of [...new Set([...protectedPaths, launch.controlRoot, launch.config, launch.tokenFile, launch.envFile,
+                ...(secretPresent ? [evaluatorSecret] : [])])]) {
+            const entry = await lstat(path);
+            if (!entry.isDirectory() && !entry.isFile())
+                throw new Error('Unsupported protected native path');
+            denied.push(path);
+        }
+        // Verify the declared auth/ingress rule with canaries only when no credential exists.
+        await mkdir(join(home, '.codex'), { recursive: true, mode: 0o700 });
+        await mkdir(join(home, '.daimon-inbound'), { recursive: true, mode: 0o700 });
+        for (const file of [join(home, '.codex/auth.json'), join(home, '.daimon-inbound/.spawnfile-training-canary')]) {
+            try {
+                const handle = await open(file, 'wx', 0o600);
+                await handle.writeFile('{}');
+                await handle.close();
+                owned.push(file);
+            }
+            catch (error) {
+                if (error.code !== 'EEXIST')
+                    throw error;
+            }
+            denied.push(file);
+        }
+        const input = join(scratch, 'input'), complete = join(scratch, 'complete');
+        await writeFile(input, 'NATIVE_READ');
+        await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
+        const port = server.address().port;
+        const code = nativeChildProbe(input, complete, denied, port);
+        await promisify(execFile)(receipt.projection.executablePath, [...receipt.projection.sandboxArgs, '--', process.execPath, '-e', code], {
+            cwd: launch.workspace.target, env: { PATH: process.env.PATH, HOME: home, CODEX_HOME: join(home, '.codex'), TMPDIR: '/tmp', LANG: 'C.UTF-8' }, signal, timeout: 15000, maxBuffer: 65536,
+        });
+        if (await readFile(complete, 'utf8') !== 'NATIVE_POLICY_COMPLETE')
+            throw new Error('Native sandbox did not finish enforcement checks');
+        await writeFile(join(artifacts, 'child-sandbox-preflight.json'), JSON.stringify({ schema: 'spawnfile.training.daimon-native.child-sandbox-preflight.v1',
+            trialId, configSha256: launch.configSha256, projectionSha256: receipt.projectionSha256, modelCallsMade: 0, workspaceReadWrite: true, protectedPathsDenied: true, networkDenied: true }), { flag: 'wx', mode: 0o600 });
+    }
+    catch (error) {
+        throw new Error('Exact native child sandbox failed before cognition', { cause: error });
+    }
+    finally {
+        server.close();
+        await Promise.all([...owned, scratch].map(path => rm(path, { recursive: true, force: true })));
+    }
+}
+//# sourceMappingURL=sandbox.js.map

package/dist/runtime/daimon/training/native/child/sandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,eAAe,EAA6B,MAAM,qBAAqB,CAAC;AACpJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGhD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAA4B,EAAE,OAAe,EAAE,cAAiC,EAAE,MAAmB,EAC5I,SAAkC;IAClC,IAAI,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC,MAAM,CAAC;IACzE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;QAC/H,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI;KACpI,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAa,EAAE,CAAC;IAAC,MAAM,MAAM,GAAa,EAAE,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,6FAA6F;QAC7F,MAAM,UAAU,GAAG,mBAAmB,CAAC,yCAAyC,CAAC,CAAC;QAClF,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,aAAa,GAAG,eAAe,KAAK,SAAS,IAAI,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAA4B,EAAE,EAAE;YACpI,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAAC,MAAM,KAAK,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO;gBACpH,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,sFAAsF;QACtF,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,4CAA4C,CAAC,CAAC,EAAE,CAAC;YAC9G,IAAI,CAAC;gBAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAC3H,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAClH,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;QACzD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACpI,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;SACvL,CAAC,CAAC;QACH,IAAI,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,wBAAwB;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACvI,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,6DAA6D;YACrJ,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1N,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;YACpG,CAAC;QAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC7H,CAAC"}

package/dist/runtime/daimon/training/native/child/types.d.ts

@@ -0,0 +1,15 @@
+import type { NativeChildExternalInputs } from '../index.js';
+import type { VerifiedNativeLaunch } from '../receipt/index.js';
+import type { GrokSlotFreshnessStore } from '../../services/index.js';
+export interface NativeChildExecution {
+    kind: 'child-process';
+    externalInputs?: NativeChildExternalInputs;
+    /** Caller-owned staging only; the package does not import subscription credentials. */
+    /** Required for Grok launches: the experiment's persisted slot recycle freshness (nonce and generation floor). */
+    grokSlots?: GrokSlotFreshnessStore;
+    prepare?(context: {
+        launch: VerifiedNativeLaunch;
+        trialId: string;
+        signal: AbortSignal;
+    }): Promise<void>;
+}

package/dist/runtime/daimon/training/native/child/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/runtime/daimon/training/native/child/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/types.ts"],"names":[],"mappings":""}

package/dist/runtime/daimon/training/native/container/docker.d.ts

@@ -0,0 +1,29 @@
+import { type VerifiedNativeLaunch } from '../receipt/index.js';
+export interface DockerResult {
+    code: number;
+    stdout: string;
+    stderr: string;
+}
+export type DockerCommand = (args: string[], options?: {
+    signal?: AbortSignal;
+    timeoutMs?: number;
+    stdin?: string;
+}) => Promise<DockerResult>;
+export interface ContainerInspection {
+    Id: string;
+    State: {
+        Running: boolean;
+        Status: string;
+        ExitCode: number;
+    };
+    Config: {
+        Labels?: Record<string, string>;
+        Image: string;
+    };
+}
+export declare const ownerLabel = "training.daimon-native.owner";
+export declare const trialLabel = "training.daimon-native.trial";
+export declare function dockerCommand(command?: string): DockerCommand;
+export declare function createContainerArguments(launch: VerifiedNativeLaunch, name: string, owner: string, trialId: string, timeoutMs: number, user?: string): string[];
+export declare function inspectOwned(run: DockerCommand, name: string, owner: string): Promise<ContainerInspection | undefined>;
+export declare function workerRequest<T>(run: DockerCommand, name: string, path: string, body?: unknown, timeoutMs?: number, signal?: AbortSignal, port?: number, tokenFile?: string): Promise<T>;