spawnfile 0.1.25 → 0.1.27

package/dist/runtime/daimon/training/providers/grok-broker/grant-home.js

@@ -0,0 +1,60 @@
+import { createHash } from 'node:crypto';
+import { lstat, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { grokGrantEnvKey } from './grants.js';
+import { InferenceFailure } from '../../../../../training/index.js';
+/**
+ * A private per-call GROK_HOME (0700, owned by this uid) under a caller-provisioned
+ * evaluator root, holding exactly the client config bytes whose sha256 equals the
+ * independent pin. Nothing from the ambient HOME, GROK_HOME or API-key variables
+ * reaches the child, so a desktop login can never be used instead of the grant.
+ */
+export async function prepareGrokGrantCall(root, authority, grant, prompt) {
+    const config = authority.renderClientConfig({ baseUrl: grant.baseUrl, model: grant.model, reasoningEffort: grant.reasoningEffort, envKey: authority.envKey });
+    const pin = authority.pinnedClientConfigSha256(grant.model, grant.reasoningEffort);
+    if (typeof pin !== 'string' || !/^[a-f0-9]{64}$/u.test(pin) || createHash('sha256').update(config).digest('hex') !== pin) {
+        throw new InferenceFailure('unsupported', 'Grok broker client configuration does not match its pinned digest');
+    }
+    // Exactly the key Daimon's renderer declares; any other name means the client config and the child environment disagree.
+    if (authority.envKey !== grokGrantEnvKey)
+        throw new InferenceFailure('unsupported', `Grok grant environment key must be ${grokGrantEnvKey}`);
+    const before = await privateDirectory(root, 'Grok grant home root');
+    const dir = await mkdtemp(path.join(root, 'grok-grant-'));
+    try {
+        // The root this call actually wrote into must still be the directory that passed the check.
+        const after = await privateDirectory(root, 'Grok grant home root');
+        if (after.dev !== before.dev || after.ino !== before.ino)
+            throw new InferenceFailure('unsupported', 'Grok grant home root changed while preparing the call');
+        await privateDirectory(dir, 'Grok grant call directory');
+        const home = path.join(dir, 'home'), work = path.join(dir, 'work');
+        await mkdir(home, { mode: 0o700 });
+        await mkdir(work, { mode: 0o700 });
+        await privateDirectory(home, 'Grok grant home');
+        await privateDirectory(work, 'Grok grant workspace');
+        await writeFile(path.join(home, 'config.toml'), config, { mode: 0o600, flag: 'wx' });
+        const promptFile = path.join(work, 'prompt.txt');
+        await writeFile(promptFile, prompt, { mode: 0o600, flag: 'wx' });
+        return { work, promptFile, cleanup: () => rm(dir, { recursive: true, force: true }),
+            env: { PATH: process.env['PATH'] ?? '/usr/local/bin:/usr/bin:/bin', HOME: work, TMPDIR: work, GROK_HOME: home, [authority.envKey]: grant.token } };
+    }
+    catch (error) {
+        await rm(dir, { recursive: true, force: true });
+        throw error;
+    }
+}
+/** Absolute, a real directory (never a symlink), mode exactly 0700 and owned by this uid. */
+async function privateDirectory(target, label) {
+    const uid = process.getuid?.();
+    let stat;
+    try {
+        stat = await lstat(target);
+    }
+    catch {
+        throw new InferenceFailure('unsupported', `${label} is unavailable`);
+    }
+    if (!path.isAbsolute(target) || !stat.isDirectory() || stat.isSymbolicLink() || (uid !== undefined && stat.uid !== uid) || (stat.mode & 0o777) !== 0o700) {
+        throw new InferenceFailure('unsupported', `${label} must be an absolute directory owned by this user with mode 0700`);
+    }
+    return stat;
+}
+//# sourceMappingURL=grant-home.js.map

package/dist/runtime/daimon/training/providers/grok-broker/grant-home.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-home.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/providers/grok-broker/grant-home.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxE,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,eAAe,EAA6D,MAAM,aAAa,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AAWpE;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,SAAsC,EAAE,KAAyB,EAAE,MAAc;IACxI,MAAM,MAAM,GAAG,SAAS,CAAC,kBAAkB,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE,MAAM,EAAE,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC9J,MAAM,GAAG,GAAG,SAAS,CAAC,wBAAwB,CAAC,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,eAAe,CAAC,CAAC;IACnF,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC;QACzH,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,mEAAmE,CAAC,CAAC;IACjH,CAAC;IACD,yHAAyH;IACzH,IAAI,SAAS,CAAC,MAAM,KAAK,eAAe;QAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,sCAAsC,eAAe,EAAE,CAAC,CAAC;IAC7I,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;IACpE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC;QACH,4FAA4F;QAC5F,MAAM,KAAK,GAAG,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACnE,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG,IAAI,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,uDAAuD,CAAC,CAAC;QAC7J,MAAM,gBAAgB,CAAC,GAAG,EAAE,2BAA2B,CAAC,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACnE,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAAC,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvE,MAAM,gBAAgB,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;QAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,sBAAsB,CAAC,CAAC;QACtG,MAAM,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACrF,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;QACjD,MAAM,SAAS,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YACjF,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,8BAA8B,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvJ,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC;IACd,CAAC;AACH,CAAC;AAED,6FAA6F;AAC7F,KAAK,UAAU,gBAAgB,CAAC,MAAc,EAAE,KAAa;IAC3D,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;IAC/B,IAAI,IAAW,CAAC;IAChB,IAAI,CAAC;QAAC,IAAI,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,GAAG,KAAK,iBAAiB,CAAC,CAAC;IAAC,CAAC;IACnH,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,GAAG,KAAK,SAAS,IAAI,IAAI,CAAC,GAAG,KAAK,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,KAAK,EAAE,CAAC;QACzJ,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,GAAG,KAAK,kEAAkE,CAAC,CAAC;IACxH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/runtime/daimon/training/providers/grok-broker/grant-pool.d.ts

@@ -0,0 +1,81 @@
+import { type GrokGrantModel, type GrokGrantPurpose, type GrokGrantReasoningEffort, type GrokInferenceGrant, type GrokInferenceGrantAuthority } from './grants.js';
+export interface GrokGrantKey {
+    model: GrokGrantModel;
+    reasoningEffort: GrokGrantReasoningEffort;
+    purpose: GrokGrantPurpose;
+}
+export interface GrokGrantPoolOptions {
+    /** Stable identity of the shared credential authority (e.g. the control socket); routes on it fail fast together. */
+    id: string;
+    /** Resolved once. A rejection means broker-grant is unavailable here and fails closed. */
+    authority: () => Promise<GrokInferenceGrantAuthority>;
+    /** Concurrent lanes (grants) per model/effort/purpose; matches the default judge check concurrency. */
+    lanesPerRoute?: number;
+    /** A lane idle this long releases its grant so other evaluators can use the broker's live-grant slot. */
+    idleReleaseMs?: number;
+    /** A grant is renewed when less than this margin plus the call budget remains before expiry. */
+    renewMarginMs?: number;
+    /** Tokens a single request may still spend (broker per-request usage bound); a lane renews before the grant ceiling. */
+    requestTokenReserve?: number;
+    /** Queue backoff while the broker's live-grant cap is reached. */
+    capBackoffMs?: readonly [initial: number, maximum: number];
+    /** Bound on one release exchange; failed releases retry `releaseAttempts` times with `releaseBackoffMs`. */
+    releaseTimeoutMs?: number;
+    releaseAttempts?: number;
+    releaseBackoffMs?: readonly [initial: number, maximum: number];
+    /** Bound on {@link GrokGrantPool.close} waiting for in-flight lanes and releases. */
+    closeTimeoutMs?: number;
+    now?: () => number;
+}
+export type GrokGrantOutcome = Readonly<{
+    ok: true;
+    tokens: number | null;
+}> | Readonly<{
+    ok: false;
+}>;
+export interface GrokGrantLease {
+    readonly authority: GrokInferenceGrantAuthority;
+    readonly grant: GrokInferenceGrant;
+    /** Time the CLI call may take without outliving the grant or the call deadline. */
+    readonly callTimeoutMs: number;
+    /** Exactly once: success keeps the grant for this lane's next call; failure releases it. */
+    settle(outcome: GrokGrantOutcome): Promise<void>;
+}
+/**
+ * One grant per concurrent lane, reused sequentially until it nears expiry or
+ * its request/token ceilings, then renewed. Never holds more grants than the
+ * broker's live-grant cap, counting released grants until the broker confirms
+ * them or they expire. On `grant_limit` a lane queues with backoff; every wait
+ * ends at the call deadline (`timeout`) or the caller's signal (`cancelled`).
+ * Grants are released on any failure, when idle, and on close.
+ */
+export declare class GrokGrantPool {
+    private readonly options;
+    readonly id: string;
+    private readonly lanes;
+    private waiters;
+    private resolved?;
+    private closed;
+    private readonly lanesPerRoute;
+    private readonly idleReleaseMs;
+    private readonly renewMarginMs;
+    private readonly reserve;
+    private readonly backoff;
+    private readonly closeTimeoutMs;
+    private readonly releases;
+    private readonly now;
+    constructor(options: GrokGrantPoolOptions);
+    /** `needMs` is the call's whole budget: waiting for a lane or grant spends it, and the CLI gets what remains. */
+    acquire(spec: GrokGrantKey, needMs: number, signal?: AbortSignal): Promise<GrokGrantLease>;
+    /** Release every grant, waiting (bounded) for in-flight lanes to settle and releases to be confirmed. */
+    close(): Promise<void>;
+    private authority;
+    private lease;
+    private usable;
+    /** Removes the lane; its grant stays counted until the broker confirms the release or the grant expires. */
+    private drop;
+    private changed;
+    /** Waits for `pending` unless the caller cancels or the deadline passes; a late grant is handed to `orphan`. */
+    private bound;
+    private wake;
+}

package/dist/runtime/daimon/training/providers/grok-broker/grant-pool.js

@@ -0,0 +1,221 @@
+import { GrokGrantRefusal } from './grants.js';
+import { InferenceFailure } from '../../../../../training/index.js';
+import { GrokGrantReleases } from './grant-releases.js';
+/**
+ * One grant per concurrent lane, reused sequentially until it nears expiry or
+ * its request/token ceilings, then renewed. Never holds more grants than the
+ * broker's live-grant cap, counting released grants until the broker confirms
+ * them or they expire. On `grant_limit` a lane queues with backoff; every wait
+ * ends at the call deadline (`timeout`) or the caller's signal (`cancelled`).
+ * Grants are released on any failure, when idle, and on close.
+ */
+export class GrokGrantPool {
+    options;
+    id;
+    lanes = [];
+    waiters = [];
+    resolved;
+    closed = false;
+    lanesPerRoute;
+    idleReleaseMs;
+    renewMarginMs;
+    reserve;
+    backoff;
+    closeTimeoutMs;
+    releases;
+    now;
+    constructor(options) {
+        this.options = options;
+        this.id = options.id;
+        this.lanesPerRoute = options.lanesPerRoute ?? 2;
+        this.idleReleaseMs = options.idleReleaseMs ?? 30_000;
+        this.renewMarginMs = options.renewMarginMs ?? 5_000;
+        this.reserve = options.requestTokenReserve ?? 500_000;
+        this.backoff = options.capBackoffMs ?? [250, 2_000];
+        this.closeTimeoutMs = options.closeTimeoutMs ?? 5_000;
+        this.now = options.now ?? Date.now;
+        if (!options.id.trim() || !Number.isSafeInteger(this.lanesPerRoute) || this.lanesPerRoute < 1 || this.lanesPerRoute > 8)
+            throw new Error('Invalid Grok grant pool policy');
+        this.releases = new GrokGrantReleases({ now: this.now, attempts: options.releaseAttempts ?? 4, backoffMs: options.releaseBackoffMs ?? [250, 2_000],
+            attemptTimeoutMs: options.releaseTimeoutMs ?? 2_000, onChange: () => this.wake() });
+    }
+    /** `needMs` is the call's whole budget: waiting for a lane or grant spends it, and the CLI gets what remains. */
+    async acquire(spec, needMs, signal) {
+        const deadline = this.now() + needMs;
+        const authority = await this.authority();
+        const key = `${spec.model}\0${spec.reasoningEffort}\0${spec.purpose}`;
+        for (;;) {
+            if (signal?.aborted)
+                throw cancelled();
+            if (this.closed)
+                throw new InferenceFailure('unavailable', 'Grok grant pool is closed');
+            if (this.now() >= deadline)
+                throw expired();
+            let lane = this.lanes.find(candidate => candidate.key === key && !candidate.busy);
+            if (lane === undefined && this.lanes.filter(candidate => candidate.key === key).length < this.lanesPerRoute) {
+                if (this.lanes.length + this.releases.count() < authority.maxLiveGrants) {
+                    lane = { key, spec, requests: 0, tokens: 0, busy: false };
+                    this.lanes.push(lane);
+                }
+                else {
+                    const evict = this.lanes.find(candidate => !candidate.busy);
+                    if (evict !== undefined) {
+                        await this.drop(evict);
+                        continue;
+                    }
+                }
+            }
+            if (lane === undefined) {
+                await this.bound(this.changed(), signal, deadline);
+                continue;
+            }
+            lane.busy = true;
+            clearTimeout(lane.idle);
+            try {
+                return await this.lease(authority, lane, deadline, signal);
+            }
+            catch (error) {
+                await this.drop(lane);
+                throw error;
+            }
+        }
+    }
+    /** Release every grant, waiting (bounded) for in-flight lanes to settle and releases to be confirmed. */
+    async close() {
+        this.closed = true;
+        const deadline = this.now() + this.closeTimeoutMs;
+        await Promise.all(this.lanes.filter(lane => !lane.busy).map(lane => this.drop(lane)));
+        this.wake();
+        const drained = (async () => { while (this.lanes.length)
+            await this.changed(); await this.releases.settled(); })();
+        await this.bound(drained, undefined, deadline).catch(() => undefined);
+    }
+    authority() {
+        this.resolved ??= this.options.authority().catch((error) => {
+            throw error instanceof InferenceFailure ? error : new InferenceFailure('unsupported', 'Grok broker-grant inference is unavailable (no broker control socket or client pin)');
+        });
+        return this.resolved;
+    }
+    async lease(authority, lane, deadline, signal) {
+        if (lane.grant !== undefined && !this.usable(lane, deadline)) {
+            const stale = lane.grant;
+            lane.grant = undefined;
+            await this.releases.release(authority, stale);
+        }
+        let delay = this.backoff[0];
+        while (lane.grant === undefined) {
+            try {
+                const grant = await this.bound(authority.request(lane.spec), signal, deadline, late => { void this.releases.release(authority, late); });
+                const expires = Date.parse(grant.expiresAt);
+                if (grant.model !== lane.spec.model || grant.reasoningEffort !== lane.spec.reasoningEffort || grant.purpose !== lane.spec.purpose ||
+                    !Number.isFinite(expires) || typeof grant.token !== 'string' || !grant.token) {
+                    await this.releases.release(authority, grant);
+                    throw new InferenceFailure('unavailable', 'Grok broker returned a grant that does not match the request');
+                }
+                lane.grant = grant;
+                lane.requests = 0;
+                lane.tokens = 0;
+            }
+            catch (error) {
+                if (error instanceof GrokGrantRefusal && error.code === 'grant_limit') {
+                    await this.bound(new Promise(resolve => setTimeout(resolve, delay)), signal, deadline);
+                    delay = Math.min(delay * 2, this.backoff[1]);
+                    continue;
+                }
+                throw classify(error);
+            }
+        }
+        const grant = lane.grant;
+        const now = this.now();
+        const callTimeoutMs = Math.min(deadline - now, Date.parse(grant.expiresAt) - now - this.renewMarginMs);
+        if (deadline - now < 1)
+            throw expired();
+        if (callTimeoutMs < 1)
+            throw new InferenceFailure('unavailable', 'Grok grant expires before the call could run', { detail: 'grant-expired' });
+        let settled = false;
+        return { authority, grant, callTimeoutMs, settle: async (outcome) => {
+                if (settled)
+                    return;
+                settled = true;
+                if (!outcome.ok || this.closed) {
+                    await this.drop(lane);
+                    return;
+                }
+                lane.requests += 1;
+                lane.tokens = outcome.tokens === null ? Number.POSITIVE_INFINITY : lane.tokens + outcome.tokens;
+                lane.busy = false;
+                // Unref'd: shutdown releases through close(), which training awaits on every exit path.
+                lane.idle = setTimeout(() => { void this.drop(lane); }, this.idleReleaseMs);
+                lane.idle.unref?.();
+                this.wake();
+            } };
+    }
+    usable(lane, deadline) {
+        const grant = lane.grant;
+        return Date.parse(grant.expiresAt) - this.renewMarginMs >= deadline &&
+            lane.requests < grant.limits.maxRequests &&
+            lane.tokens + Math.min(this.reserve, grant.limits.maxTokens) <= grant.limits.maxTokens;
+    }
+    /** Removes the lane; its grant stays counted until the broker confirms the release or the grant expires. */
+    async drop(lane) {
+        const index = this.lanes.indexOf(lane);
+        if (index >= 0)
+            this.lanes.splice(index, 1);
+        clearTimeout(lane.idle);
+        const grant = lane.grant;
+        lane.grant = undefined;
+        if (grant !== undefined && this.resolved !== undefined) {
+            const authority = await this.resolved.catch(() => undefined);
+            if (authority !== undefined)
+                await this.releases.release(authority, grant);
+        }
+        this.wake();
+    }
+    changed() { return new Promise(resolve => { this.waiters.push(resolve); }); }
+    /** Waits for `pending` unless the caller cancels or the deadline passes; a late grant is handed to `orphan`. */
+    bound(pending, signal, deadline, orphan) {
+        return new Promise((resolve, reject) => {
+            let done = false;
+            const finish = (settle) => {
+                if (done)
+                    return false;
+                done = true;
+                clearTimeout(timer);
+                signal?.removeEventListener('abort', abort);
+                settle();
+                return true;
+            };
+            const leave = (failure) => { if (finish(() => reject(failure)))
+                pending.then(value => orphan?.(value), () => undefined); };
+            const abort = () => leave(cancelled());
+            const timer = setTimeout(() => leave(expired()), Math.max(0, deadline - this.now()));
+            signal?.addEventListener('abort', abort, { once: true });
+            if (signal?.aborted)
+                abort();
+            pending.then(value => finish(() => resolve(value)), (error) => finish(() => reject(error)));
+        });
+    }
+    wake() { const waiters = this.waiters; this.waiters = []; for (const waiter of waiters)
+        waiter(); }
+}
+const cancelled = () => new InferenceFailure('cancelled', 'Grok grant wait cancelled');
+/** Routing treats `timeout` like other capacity failures: the next authored route may run inside the route budget. */
+const expired = () => new InferenceFailure('timeout', 'Grok grant capacity wait exceeded the call deadline');
+/**
+ * A refused grant, an expired credential realm and a broker that is simply down
+ * all used to leave the same `unavailable` and the same sentence. The refusal is
+ * a closed broker code, so the distinction is carried, not reconstructed later.
+ */
+function classify(error) {
+    if (error instanceof InferenceFailure)
+        return error;
+    if (error instanceof GrokGrantRefusal) {
+        if (error.code === 'auth_stale')
+            return new InferenceFailure('auth-stale', 'Grok broker credential realm is stale', { detail: 'grant-expired' });
+        if (error.code === 'invalid_request')
+            return new InferenceFailure('unsupported', 'Grok broker refused the grant request as invalid', { detail: 'grant-refused' });
+        return new InferenceFailure('unavailable', 'Grok broker refused the grant request', { detail: 'grant-refused' });
+    }
+    return new InferenceFailure('unavailable', 'Grok broker is unavailable');
+}
+//# sourceMappingURL=grant-pool.js.map

package/dist/runtime/daimon/training/providers/grok-broker/grant-pool.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-pool.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/providers/grok-broker/grant-pool.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EACoC,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,gBAAgB,EAAE,MAAM,kCAAkC,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAwCxD;;;;;;;GAOG;AACH,MAAM,OAAO,aAAa;IACP,OAAO,CAAuB;IACtC,EAAE,CAAS;IACH,KAAK,GAAW,EAAE,CAAC;IAC5B,OAAO,GAAmB,EAAE,CAAC;IAC7B,QAAQ,CAAwC;IAChD,MAAM,GAAG,KAAK,CAAC;IACN,aAAa,CAAS;IACtB,aAAa,CAAS;IACtB,aAAa,CAAS;IACtB,OAAO,CAAS;IAChB,OAAO,CAA4B;IACnC,cAAc,CAAS;IACvB,QAAQ,CAAoB;IAC5B,GAAG,CAAe;IAEnC,YAAY,OAA6B;QACvC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC;QACrB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,MAAM,CAAC;QACrD,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,KAAK,CAAC;QACpD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,mBAAmB,IAAI,OAAO,CAAC;QACtD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,YAAY,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,cAAc,IAAI,KAAK,CAAC;QACtD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACnC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC,IAAI,IAAI,CAAC,aAAa,GAAG,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;QAC3K,IAAI,CAAC,QAAQ,GAAG,IAAI,iBAAiB,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,CAAC,eAAe,IAAI,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,gBAAgB,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC;YAChJ,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,IAAI,KAAK,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACxF,CAAC;IAED,iHAAiH;IACjH,KAAK,CAAC,OAAO,CAAC,IAAkB,EAAE,MAAc,EAAE,MAAoB;QACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,KAAK,IAAI,CAAC,eAAe,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QACtE,SAAS,CAAC;YACR,IAAI,MAAM,EAAE,OAAO;gBAAE,MAAM,SAAS,EAAE,CAAC;YACvC,IAAI,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,2BAA2B,CAAC,CAAC;YACxF,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM,OAAO,EAAE,CAAC;YAC5C,IAAI,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClF,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC,SAAS,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;gBAC5G,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,GAAG,SAAS,CAAC,aAAa,EAAE,CAAC;oBACxE,IAAI,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;oBAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnF,CAAC;qBAAM,CAAC;oBACN,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;oBAC5D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;wBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;wBAAC,SAAS;oBAAC,CAAC;gBAChE,CAAC;YACH,CAAC;YACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAAC,SAAS;YAAC,CAAC;YACzF,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;YACjB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACxB,IAAI,CAAC;gBAAC,OAAO,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAAC,CAAC;YACnE,OAAO,KAAK,EAAE,CAAC;gBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,KAAK,CAAC;YAAC,CAAC;QACvD,CAAC;IACH,CAAC;IAED,yGAAyG;IACzG,KAAK,CAAC,KAAK;QACT,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,cAAc,CAAC;QAClD,MAAM,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACtF,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,MAAM,OAAO,GAAG,CAAC,KAAK,IAAI,EAAE,GAAG,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;YAAE,MAAM,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACnH,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxE,CAAC;IAEO,SAAS;QACf,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC,KAAK,CAAC,CAAC,KAAc,EAAE,EAAE;YAClE,MAAM,KAAK,YAAY,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,gBAAgB,CAAC,aAAa,EAAE,qFAAqF,CAAC,CAAC;QAC/K,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,SAAsC,EAAE,IAAU,EAAE,QAAgB,EAAE,MAAoB;QAC5G,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YAC7D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;YAAC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;YACjD,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAChD,CAAC;QACD,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,KAAK,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACzI,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;gBAC5C,IAAI,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,eAAe,KAAK,IAAI,CAAC,IAAI,CAAC,eAAe,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI,CAAC,IAAI,CAAC,OAAO;oBAC/H,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;oBAC/E,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;oBAC9C,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,8DAA8D,CAAC,CAAC;gBAC5G,CAAC;gBACD,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;gBAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;gBAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YACzD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,aAAa,EAAE,CAAC;oBACtE,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;oBACvF,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;oBAC7C,SAAS;gBACX,CAAC;gBACD,MAAM,QAAQ,CAAC,KAAK,CAAC,CAAC;YACxB,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,aAAa,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,CAAC;QACvG,IAAI,QAAQ,GAAG,GAAG,GAAG,CAAC;YAAE,MAAM,OAAO,EAAE,CAAC;QACxC,IAAI,aAAa,GAAG,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,aAAa,EAAE,8CAA8C,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9I,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,KAAK,EAAC,OAAO,EAAC,EAAE;gBAChE,IAAI,OAAO;oBAAE,OAAO;gBACpB,OAAO,GAAG,IAAI,CAAC;gBACf,IAAI,CAAC,OAAO,CAAC,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;oBAAC,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBAClE,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC;gBACnB,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;gBAChG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;gBAClB,wFAAwF;gBACxF,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC;gBAC5E,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;gBACpB,IAAI,CAAC,IAAI,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;IACN,CAAC;IAEO,MAAM,CAAC,IAAU,EAAE,QAAgB;QACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAM,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,aAAa,IAAI,QAAQ;YACjE,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,WAAW;YACxC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC;IAC3F,CAAC;IAED,4GAA4G;IACpG,KAAK,CAAC,IAAI,CAAC,IAAU;QAC3B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,KAAK,IAAI,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAC5C,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAAC,IAAI,CAAC,KAAK,GAAG,SAAS,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7D,IAAI,SAAS,KAAK,SAAS;gBAAE,MAAM,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAC7E,CAAC;QACD,IAAI,CAAC,IAAI,EAAE,CAAC;IACd,CAAC;IAEO,OAAO,KAAoB,OAAO,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAEpG,gHAAgH;IACxG,KAAK,CAAI,OAAmB,EAAE,MAA+B,EAAE,QAAgB,EAAE,MAA2B;QAClH,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACxC,IAAI,IAAI,GAAG,KAAK,CAAC;YACjB,MAAM,MAAM,GAAG,CAAC,MAAkB,EAAW,EAAE;gBAC7C,IAAI,IAAI;oBAAE,OAAO,KAAK,CAAC;gBACvB,IAAI,GAAG,IAAI,CAAC;gBAAC,YAAY,CAAC,KAAK,CAAC,CAAC;gBAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBAAC,MAAM,EAAE,CAAC;gBAAC,OAAO,IAAI,CAAC;YACvG,CAAC,CAAC;YACF,MAAM,KAAK,GAAG,CAAC,OAAyB,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;gBAAE,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YAC7I,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC,CAAC;YACvC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YACrF,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;YACzD,IAAI,MAAM,EAAE,OAAO;gBAAE,KAAK,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,KAAc,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACvG,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,KAAW,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC,KAAK,MAAM,MAAM,IAAI,OAAO;QAAE,MAAM,EAAE,CAAC,CAAC,CAAC;CAClH;AAED,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,WAAW,EAAE,2BAA2B,CAAC,CAAC;AACvF,sHAAsH;AACtH,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,IAAI,gBAAgB,CAAC,SAAS,EAAE,qDAAqD,CAAC,CAAC;AAE7G;;;;GAIG;AACH,SAAS,QAAQ,CAAC,KAAc;IAC9B,IAAI,KAAK,YAAY,gBAAgB;QAAE,OAAO,KAAK,CAAC;IACpD,IAAI,KAAK,YAAY,gBAAgB,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY;YAAE,OAAO,IAAI,gBAAgB,CAAC,YAAY,EAAE,uCAAuC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACjJ,IAAI,KAAK,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,IAAI,gBAAgB,CAAC,aAAa,EAAE,kDAAkD,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QAClK,OAAO,IAAI,gBAAgB,CAAC,aAAa,EAAE,uCAAuC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;IACnH,CAAC;IACD,OAAO,IAAI,gBAAgB,CAAC,aAAa,EAAE,4BAA4B,CAAC,CAAC;AAC3E,CAAC"}

package/dist/runtime/daimon/training/providers/grok-broker/grant-releases.d.ts

@@ -0,0 +1,31 @@
+import type { GrokInferenceGrant, GrokInferenceGrantAuthority } from './grants.js';
+export interface GrokGrantReleaseOptions {
+    now: () => number;
+    /** Release attempts before an unconfirmed grant simply waits out its TTL (still counted). */
+    attempts: number;
+    backoffMs: readonly [initial: number, maximum: number];
+    /** Bound on one release exchange with the broker. */
+    attemptTimeoutMs: number;
+    /** A counted grant stopped counting (confirmed or expired). */
+    onChange: () => void;
+}
+/**
+ * Grants handed back to the broker. Until the broker confirms a release (either
+ * answer: `released:false` means it no longer holds the grant) or the grant's
+ * TTL passes, it still occupies one of the broker's live-grant slots, so it stays
+ * counted against the local cap. Failed releases retry with bounded backoff.
+ */
+export declare class GrokGrantReleases {
+    private readonly options;
+    private readonly pending;
+    private readonly loops;
+    constructor(options: GrokGrantReleaseOptions);
+    /** Grants the broker may still count. */
+    count(): number;
+    /** Resolves after the first attempt; retries continue in the background (see {@link settled}). */
+    release(authority: GrokInferenceGrantAuthority, grant: Pick<GrokInferenceGrant, 'grantId' | 'expiresAt'>): Promise<void>;
+    /** Every release attempt sequence has finished (confirmed, exhausted or expired). */
+    settled(): Promise<void>;
+    private attempt;
+    private forget;
+}

package/dist/runtime/daimon/training/providers/grok-broker/grant-releases.js

@@ -0,0 +1,78 @@
+/**
+ * Grants handed back to the broker. Until the broker confirms a release (either
+ * answer: `released:false` means it no longer holds the grant) or the grant's
+ * TTL passes, it still occupies one of the broker's live-grant slots, so it stays
+ * counted against the local cap. Failed releases retry with bounded backoff.
+ */
+export class GrokGrantReleases {
+    options;
+    pending = new Map();
+    loops = new Set();
+    constructor(options) { this.options = options; }
+    /** Grants the broker may still count. */
+    count() {
+        const now = this.options.now();
+        for (const [grantId, entry] of this.pending)
+            if (entry.expires <= now)
+                this.forget(grantId);
+        return this.pending.size;
+    }
+    /** Resolves after the first attempt; retries continue in the background (see {@link settled}). */
+    release(authority, grant) {
+        const expires = Date.parse(grant.expiresAt);
+        const remaining = expires - this.options.now();
+        if (this.pending.has(grant.grantId) || !Number.isFinite(expires) || remaining <= 0)
+            return Promise.resolve();
+        // Expiry frees the broker slot even if no release was ever confirmed.
+        const timer = setTimeout(() => this.forget(grant.grantId), Math.min(remaining, 2_147_483_647));
+        timer.unref?.();
+        this.pending.set(grant.grantId, { expires, timer });
+        let firstAttempt;
+        const first = new Promise(resolve => { firstAttempt = resolve; });
+        const loop = (async () => {
+            let delay = this.options.backoffMs[0];
+            for (let attempt = 1; this.pending.has(grant.grantId); attempt++) {
+                const confirmed = await this.attempt(authority, grant.grantId);
+                if (attempt === 1)
+                    firstAttempt();
+                if (confirmed) {
+                    this.forget(grant.grantId);
+                    return;
+                }
+                if (attempt >= this.options.attempts || this.options.now() + delay >= expires)
+                    return;
+                await new Promise(resolve => setTimeout(resolve, delay));
+                delay = Math.min(delay * 2, this.options.backoffMs[1]);
+            }
+        })().finally(() => { firstAttempt(); this.loops.delete(loop); });
+        this.loops.add(loop);
+        return first;
+    }
+    /** Every release attempt sequence has finished (confirmed, exhausted or expired). */
+    async settled() {
+        while (this.loops.size)
+            await Promise.all([...this.loops]);
+    }
+    async attempt(authority, grantId) {
+        let timer;
+        try {
+            return await Promise.race([authority.release(grantId).then(() => true),
+                new Promise(resolve => { timer = setTimeout(() => resolve(false), this.options.attemptTimeoutMs); })]);
+        }
+        catch {
+            return false;
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    forget(grantId) {
+        const entry = this.pending.get(grantId);
+        if (entry === undefined)
+            return;
+        clearTimeout(entry.timer);
+        this.pending.delete(grantId);
+        this.options.onChange();
+    }
+}
+//# sourceMappingURL=grant-releases.js.map

package/dist/runtime/daimon/training/providers/grok-broker/grant-releases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grant-releases.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/providers/grok-broker/grant-releases.ts"],"names":[],"mappings":"AAaA;;;;;GAKG;AACH,MAAM,OAAO,iBAAiB;IACX,OAAO,CAA0B;IACjC,OAAO,GAAG,IAAI,GAAG,EAAqE,CAAC;IACvF,KAAK,GAAG,IAAI,GAAG,EAAiB,CAAC;IAElD,YAAY,OAAgC,IAAI,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC,CAAC;IAEzE,yCAAyC;IACzC,KAAK;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO;YAAE,IAAI,KAAK,CAAC,OAAO,IAAI,GAAG;gBAAE,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5F,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,kGAAkG;IAClG,OAAO,CAAC,SAAsC,EAAE,KAAwD;QACtG,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,SAAS,GAAG,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,CAAC;QAC7G,sEAAsE;QACtE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC,CAAC;QAC/F,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;QAChB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QACpD,IAAI,YAAyB,CAAC;QAC9B,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,GAAG,YAAY,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACxE,MAAM,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE;YACvB,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;YACtC,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;gBACjE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/D,IAAI,OAAO,KAAK,CAAC;oBAAE,YAAY,EAAE,CAAC;gBAClC,IAAI,SAAS,EAAE,CAAC;oBAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBAAC,OAAO;gBAAC,CAAC;gBACtD,IAAI,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,KAAK,IAAI,OAAO;oBAAE,OAAO;gBACtF,MAAM,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC;gBACzD,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;YACzD,CAAC;QACH,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,YAAY,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACrB,OAAO,KAAK,CAAC;IACf,CAAC;IAED,qFAAqF;IACrF,KAAK,CAAC,OAAO;QACX,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAC7D,CAAC;IAEO,KAAK,CAAC,OAAO,CAAC,SAAsC,EAAE,OAAe;QAC3E,IAAI,KAAgD,CAAC;QACrD,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;gBACpE,IAAI,OAAO,CAAU,OAAO,CAAC,EAAE,GAAG,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACpH,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,CAAC;IAC5D,CAAC;IAEO,MAAM,CAAC,OAAe;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;IAC1B,CAAC;CACF"}

package/dist/runtime/daimon/training/providers/grok-broker/grants.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Evaluator inference grants: a broker (Daimon's Grok engine broker) lends its
+ * credential to one sequential lane of judge or optimizer requests without the
+ * evaluator ever holding that credential. This is the runtime-neutral seam;
+ * the Daimon binding lives with the native adapter.
+ */
+export declare const grokGrantModels: readonly ["grok-4.6", "grok-4.5", "grok-build"];
+export declare const grokGrantReasoningEfforts: readonly ["low", "medium", "high"];
+export declare const grokGrantPurposes: readonly ["judge", "optimizer"];
+export declare const grokGrantRefusalCodes: readonly ["auth_stale", "grant_limit", "invalid_request", "unavailable"];
+export type GrokGrantModel = (typeof grokGrantModels)[number];
+export type GrokGrantReasoningEffort = (typeof grokGrantReasoningEfforts)[number];
+export type GrokGrantPurpose = (typeof grokGrantPurposes)[number];
+export type GrokGrantRefusalCode = (typeof grokGrantRefusalCodes)[number];
+/** The only environment variable a grant client reads its token from (Daimon's declared `env_key`). */
+export declare const grokGrantEnvKey = "DAIMON_INFERENCE_GRANT";
+export interface GrokInferenceGrant {
+    grantId: string;
+    /** Bearer for the broker proxy. Child-process environment only; never logged, persisted or put in argv. */
+    token: string;
+    baseUrl: string;
+    model: GrokGrantModel;
+    reasoningEffort: GrokGrantReasoningEffort;
+    purpose: GrokGrantPurpose;
+    /** ISO timestamp; the broker drops the grant at this instant. */
+    expiresAt: string;
+    limits: {
+        maxRequests: number;
+        maxTokens: number;
+        timeoutMs: number;
+    };
+}
+export interface GrokClientConfigInput {
+    baseUrl: string;
+    model: GrokGrantModel;
+    reasoningEffort: GrokGrantReasoningEffort;
+    envKey: string;
+}
+/** A closed broker refusal. Anything else a broker call throws means the broker is unavailable. */
+export declare class GrokGrantRefusal extends Error {
+    readonly code: GrokGrantRefusalCode;
+    constructor(code: GrokGrantRefusalCode);
+}
+export interface GrokInferenceGrantAuthority {
+    /** The only `--model` a grant client may run. */
+    readonly clientModelId: string;
+    /** The environment variable the rendered client config reads the grant token from. */
+    readonly envKey: string;
+    /** The broker's live-grant cap; a local pool never holds more. */
+    readonly maxLiveGrants: number;
+    request(input: {
+        model: GrokGrantModel;
+        reasoningEffort: GrokGrantReasoningEffort;
+        purpose: GrokGrantPurpose;
+    }): Promise<GrokInferenceGrant>;
+    release(grantId: string): Promise<boolean>;
+    /** Exact `config.toml` bytes for a private GROK_HOME. */
+    renderClientConfig(input: GrokClientConfigInput): string;
+    /** Independently pinned sha256 of those bytes for the production proxy; `undefined` means no pin (fail closed). */
+    pinnedClientConfigSha256(model: GrokGrantModel, reasoningEffort: GrokGrantReasoningEffort): string | undefined;
+}
+export declare const grokBrokerControlSocketEnv = "SPAWNFILE_TRAINING_GROK_BROKER_CONTROL_SOCKET";
+export declare const grokGrantHomeRootEnv = "SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT";

package/dist/runtime/daimon/training/providers/grok-broker/grants.js

@@ -0,0 +1,20 @@
+/**
+ * Evaluator inference grants: a broker (Daimon's Grok engine broker) lends its
+ * credential to one sequential lane of judge or optimizer requests without the
+ * evaluator ever holding that credential. This is the runtime-neutral seam;
+ * the Daimon binding lives with the native adapter.
+ */
+export const grokGrantModels = ['grok-4.6', 'grok-4.5', 'grok-build'];
+export const grokGrantReasoningEfforts = ['low', 'medium', 'high'];
+export const grokGrantPurposes = ['judge', 'optimizer'];
+export const grokGrantRefusalCodes = ['auth_stale', 'grant_limit', 'invalid_request', 'unavailable'];
+/** The only environment variable a grant client reads its token from (Daimon's declared `env_key`). */
+export const grokGrantEnvKey = 'DAIMON_INFERENCE_GRANT';
+/** A closed broker refusal. Anything else a broker call throws means the broker is unavailable. */
+export class GrokGrantRefusal extends Error {
+    code;
+    constructor(code) { super(`Grok inference grant refused (${code})`); this.code = code; this.name = 'GrokGrantRefusal'; }
+}
+export const grokBrokerControlSocketEnv = 'SPAWNFILE_TRAINING_GROK_BROKER_CONTROL_SOCKET';
+export const grokGrantHomeRootEnv = 'SPAWNFILE_TRAINING_GROK_GRANT_HOME_ROOT';
+//# sourceMappingURL=grants.js.map

package/dist/runtime/daimon/training/providers/grok-broker/grants.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/providers/grok-broker/grants.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,YAAY,CAAU,CAAC;AAC/E,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAU,CAAC;AAC5E,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,OAAO,EAAE,WAAW,CAAU,CAAC;AACjE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,CAAU,CAAC;AAO9G,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,wBAAwB,CAAC;AAsBxD,mGAAmG;AACnG,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAChC,IAAI,CAAuB;IACpC,YAAY,IAA0B,IAAI,KAAK,CAAC,iCAAiC,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC,CAAC,CAAC;CAC/I;AAiBD,MAAM,CAAC,MAAM,0BAA0B,GAAG,+CAA+C,CAAC;AAC1F,MAAM,CAAC,MAAM,oBAAoB,GAAG,yCAAyC,CAAC"}

package/dist/runtime/daimon/training/providers/grok-broker/index.d.ts

@@ -0,0 +1,3 @@
+export { createGrokBrokerInference, type GrokBrokerInferenceOptions } from './broker.js';
+export { GrokGrantPool, type GrokGrantKey, type GrokGrantLease, type GrokGrantOutcome, type GrokGrantPoolOptions } from './grant-pool.js';
+export * from './grants.js';

package/dist/runtime/daimon/training/providers/grok-broker/index.js

@@ -0,0 +1,4 @@
+export { createGrokBrokerInference } from './broker.js';
+export { GrokGrantPool } from './grant-pool.js';
+export * from './grants.js';
+//# sourceMappingURL=index.js.map

package/dist/runtime/daimon/training/providers/grok-broker/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/providers/grok-broker/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAmC,MAAM,aAAa,CAAC;AACzF,OAAO,EAAE,aAAa,EAA4F,MAAM,iBAAiB,CAAC;AAC1I,cAAc,aAAa,CAAC"}

package/dist/runtime/daimon/training/providers/grok-subscription/cli.d.ts

@@ -0,0 +1,21 @@
+import type { InferenceRequest, InferenceResult } from '../../../../../training/index.js';
+import { runProcess } from '../../../../../training/index.js';
+import { type GrokAuthMode } from './protocol.js';
+export type GrokReasoningEffort = 'low' | 'medium' | 'high' | 'xhigh';
+export interface GrokCliRun {
+    command: string;
+    cwd: string;
+    promptFile: string;
+    /** The complete child environment; nothing else is inherited. */
+    env: NodeJS.ProcessEnv;
+    timeoutMs: number;
+    /** `--model` argument: a catalog model for subscription, the pinned client model id for a grant. */
+    cliModel: string;
+    reasoningEffort: GrokReasoningEffort;
+    request: InferenceRequest;
+    responseSchema: InferenceRequest['responseSchema'];
+    mode: GrokAuthMode;
+    process?: typeof runProcess;
+}
+/** One tool-free Grok CLI call with init attestation before any further native frame is consumed. */
+export declare function runGrokCli(run: GrokCliRun): Promise<InferenceResult>;