spawnfile 0.1.33 → 0.1.34

package/dist/runtime/daimon/training/native/child/lifecycle.js

@@ -1,400 +0,0 @@
-import { canonicalWireId } from '../../../../../training/index.js';
-import { spawn } from 'node:child_process';
-import { dirname } from 'node:path';
-import { setTimeout as pause } from 'node:timers/promises';
-import { isGrokLaunch, nativeTrialArtifactsRoot, readPrivateFile } from '../receipt/index.js';
-import { admittedExecutions, declaredLimitStop, executionClosed, validateNativeFrame, AMBIGUOUS_NATIVE_EXECUTION } from '../worker/index.js';
-import { createNativeHttpClient, transportTerminalBinding } from '../transport/index.js';
-import { engineWakeTimeoutMs, parseTransportSource } from '../worker/index.js';
-import { ensureNativeTrialArtifacts, nativeChildArguments, nativeChildEnvironment, validateChildPaths } from './arguments.js';
-import { verifyChildSandbox } from './sandbox.js';
-import { recordNativeStartupClosure } from '../../services/index.js';
-import { childDiagnostics } from './diagnostics.js';
-/** One fresh worker process in the caller's existing container; no Docker or remote proof. */
-export async function startOwnedChild(execution, launch, trialId, timeoutMs, signal, startupMs = 60_000, protectedPaths = []) {
-    if (!Number.isSafeInteger(startupMs) || startupMs < 1 || startupMs > 3_600_000)
-        throw new Error('Invalid native startup deadline');
-    const startup = new AbortController();
-    const abort = () => startup.abort();
-    signal?.addEventListener('abort', abort, { once: true });
-    const timer = setTimeout(abort, Math.min(startupMs, timeoutMs));
-    let launched = false;
-    try {
-        signal?.throwIfAborted();
-        if (execution.prepare)
-            await bounded(execution.prepare({ launch: structuredClone(launch), trialId, signal: startup.signal }), startup.signal);
-        startup.signal.throwIfAborted();
-        await validateChildPaths(launch);
-        await ensureNativeTrialArtifacts(launch, trialId);
-        const env = await nativeChildEnvironment(launch);
-        const token = (await readPrivateFile(launch.tokenFile, 4096)).trim();
-        return await launchChild(launch, trialId, timeoutMs, env, token, startup.signal, protectedPaths, () => { launched = true; }, execution.grokSlots);
-    }
-    catch (error) {
-        throw recordNativeStartupClosure(error, !launched);
-    }
-    finally {
-        clearTimeout(timer);
-        signal?.removeEventListener('abort', abort);
-    }
-}
-/**
- * Every value a captured stream must never publish: the control token and every
- * declared environment value (locale and path variables excepted, which are not
- * secret and are useful in a diagnostic), plus the credential file paths.
- */
-function childSecrets(launch, env, token) {
-    const safe = new Set(['HOME', 'PATH', 'LANG', 'LC_ALL', 'TZ']);
-    return [token, launch.tokenFile, launch.envFile,
-        ...Object.entries(env).filter(([key]) => !safe.has(key)).map(([, value]) => value ?? '')].filter(Boolean);
-}
-async function launchChild(launch, trialId, timeoutMs, env, token, startup, protectedPaths, onSpawn, grokSlots) {
-    const http = createNativeHttpClient(`http://${launch.host.bindHost}:${launch.host.port}`, token, launch.delivery);
-    const diagnostics = await childDiagnostics(nativeTrialArtifactsRoot(launch, trialId), trialId, launch.configSha256, childSecrets(launch, env, token));
-    const group = process.platform !== 'win32';
-    const child = spawn(process.execPath, nativeChildArguments(launch, trialId, timeoutMs), {
-        cwd: dirname(launch.workerRoot), env, detached: group, stdio: ['ignore', 'pipe', 'pipe'],
-    });
-    const pid = child.pid;
-    // Preparation and synchronous spawn failures own no process. A returned pid
-    // is the boundary after which absence needs the ordinary closure proof.
-    if (pid !== undefined)
-        onSpawn();
-    let reaped = false;
-    let exited = false;
-    let exitCode = null;
-    let exitSignal = null;
-    let ready = false;
-    let failure = false;
-    let buffer = '';
-    let bytes = 0;
-    child.once('error', () => { failure = true; });
-    child.once('exit', () => { reaped = true; });
-    child.once('close', (code, signal) => { exited = true; exitCode = code; exitSignal = signal; });
-    const groupGone = () => {
-        // Only ESRCH proves absence. Unsupported inspection and EPERM stay unknown.
-        if (!group || pid === undefined)
-            return false;
-        try {
-            process.kill(-pid, 0);
-            return false;
-        }
-        catch (error) {
-            return error.code === 'ESRCH';
-        }
-    };
-    const send = (signal) => {
-        // Reaping ends signaling authority: a retained numeric PID/PGID can be reused.
-        if (pid === undefined || reaped)
-            return;
-        try {
-            process.kill(group ? -pid : pid, signal);
-        }
-        catch { /* Closure observation decides, never signal success. */ }
-    };
-    const consume = (chunk, stdout) => {
-        diagnostics.append(chunk, stdout);
-        bytes += chunk.length;
-        if (bytes > 1_048_576) {
-            failure = true;
-            send('SIGTERM');
-            return;
-        }
-        if (!stdout)
-            return;
-        buffer += chunk.toString('utf8');
-        for (;;) {
-            const end = buffer.indexOf('\n');
-            if (end < 0)
-                break;
-            const line = buffer.slice(0, end);
-            buffer = buffer.slice(end + 1);
-            try {
-                const row = JSON.parse(line);
-                if (canonicalWireId(row.schema) === 'spawnfile.training.daimon-native.ready.v1' && row.trialId === trialId && row.configSha256 === launch.configSha256 &&
-                    row.agentId === launch.agent.id && row.model === launch.agent.model && row.port === launch.host.port &&
-                    (!isGrokLaunch(launch) || row.engine === 'grok' && row.reasoningEffort === launch.agent.reasoningEffort))
-                    ready = true;
-            }
-            catch { /* Bootstrap may emit non-protocol logging; never treat it as readiness. */ }
-        }
-    };
-    child.stdout.on('data', (chunk) => consume(chunk, true));
-    child.stderr.on('data', (chunk) => consume(chunk, false));
-    let stopping;
-    /**
-     * One entry per delivery this trial made, in order: which wake it was, and why
-     * that wake's own frame cannot be scored from. `terminal-absent` is no frame at
-     * all for that delivery; `terminal-unbound` is a frame whose identity, closed
-     * trace or resolved execution disagreed, including one belonging to another
-     * trial; `terminal-ambiguous` is a frame whose named execution has more than
-     * one closed trace answering to it. Kept apart rather than collapsed, because
-     * they call for fixes in different places.
-     *
-     * A ledger rather than one verdict, because a trial whose subject defers runs
-     * several wakes and each one publishes its own frame. Holding only the newest
-     * meant a continuation that did not bind erased the account of a wake that HAD
-     * bound, over a closed trace, on a runtime the same stop proves quiet — and the
-     * trial then reported that it had no terminal evidence at all, which was false.
-     */
-    const wakes = [];
-    /**
-     * A fault that belongs to the TRIAL rather than to one of its wakes, and which
-     * therefore no other wake's frame may be scored past.
-     *
-     * Isolation is the property: a frame from another trial, agent, model, config
-     * or delivery, a foreign execution among the traces, or one execution answering
-     * to two closed traces all say that what this runtime published cannot be
-     * attributed, and attribution is exactly what selection would be doing. A wake
-     * that simply named no closed execution of its own is the other kind — that
-     * wake is unscorable and the trial's earlier frames are untouched.
-     */
-    let sealed;
-    let diagnosed;
-    /**
-     * Closure is one question — is anything still running or still spending? — and
-     * it is the conjunction of four independent live proofs: the runtime admits no
-     * execution of this agent's, it sealed and acknowledged its own stop, and the
-     * owned child exited cleanly, and its process group disappeared (decided below,
-     * after the kill escalation). Escaped descendants and remote work stay unknown.
-     *
-     * It used to demand a fourth: that the last delivery's terminal frame bind to a
-     * resolved execution. That was interrogating another service's inbox
-     * bookkeeping over HTTP — a fact about the last delivery's paperwork, derived
-     * from a snapshot the runtime had already published, which cannot say whether
-     * anything is spending NOW. Everything it could claim comes from the same
-     * runtime that answers `/v2/activity` live, so it added no authority while it
-     * did subtract scorable runs: across seven investigations this predicate failed
-     * a different way each time on a run that was healthy. The binding still
-     * happens and still rejects a foreign trial's frame; it reports as missing
-     * EVIDENCE instead.
-     *
-     * Each proof names itself on the receipt, which publishes durably with the
-     * turn, because the evidence that would identify a missing one lives in the
-     * worker's control root and a training slot puts that on tmpfs. The vocabulary
-     * is closed, so nothing here can leak a path, a token, a body or an error
-     * string.
-     */
-    const proveClosure = async () => {
-        if (!ready || exited)
-            return 'worker-unavailable';
-        // Read before the stop, so the query is answered by the runtime that owns the
-        // execution; a host the worker already stopped seals this projection instead.
-        let activity;
-        try {
-            activity = await http('/v2/activity', undefined, 1500);
-        }
-        catch {
-            return 'activity-unreadable';
-        }
-        // Requested even when the projection already refuses closure: a runtime that
-        // can still be told to stop should be, and the cause below names the busier
-        // fault first rather than whichever one this request happens to return.
-        let native;
-        try {
-            native = await http('/trial/stop', {}, 6000);
-        }
-        catch {
-            native = undefined;
-        }
-        // A projection with no execution authority, or carrying another agent's
-        // execution, cannot be counted at all; an unfinished runtime answers with the
-        // execution it is still running. Different faults, different names.
-        let admitted;
-        try {
-            admitted = admittedExecutions(activity, launch.agent.id);
-        }
-        catch {
-            return 'execution-unbound';
-        }
-        if (admitted > 0)
-            return 'activity-busy';
-        if (native?.state !== 'acknowledged')
-            return 'native-stop-unacknowledged';
-        return undefined;
-    };
-    const stop = (reason) => stopping ??= (async () => {
-        // The trial's own evidence, selected rather than taken from whichever delivery
-        // answered last: the most recent wake that bound is the most recent account of
-        // this trial, and it is named so a scored report can say which wake it read. A
-        // trial-wide fault outranks every frame, and with no admissible wake at all the
-        // refusal keeps the last delivery's own cause.
-        const scored = sealed ? undefined : [...wakes].reverse().find(entry => entry.unevidenced === undefined);
-        const last = wakes[wakes.length - 1];
-        const evidence = scored ? undefined : sealed ?? last?.unevidenced ?? 'terminal-absent';
-        let cause;
-        try {
-            cause = await proveClosure();
-        }
-        catch {
-            cause = 'activity-unreadable'; /* Uncertain native work requires outer-container termination. */
-        }
-        if (!exited)
-            send('SIGTERM');
-        const until = Date.now() + 2000;
-        while ((!exited || !groupGone()) && Date.now() < until)
-            await pause(20);
-        if (!exited || !groupGone()) {
-            send('SIGKILL');
-            const forced = Date.now() + 1000;
-            while ((!exited || !groupGone()) && Date.now() < forced)
-                await pause(20);
-        }
-        await diagnostics.save(exitCode, exitSignal);
-        cause ??= !exited || !groupGone() ? 'child-running' : exitCode === 0 ? undefined : 'child-exit';
-        const confirmed = cause === undefined;
-        // A worker that died mid-turn published nothing: startup owns the only
-        // other route this record takes, and the protected file it is built from
-        // lives on a slot tmpfs that dies with the container. Build it here so the
-        // durable event stream carries why the worker stopped answering — for a
-        // frame that never arrived as much as for an unproven closure, since its
-        // last words are exactly what explains a missing one.
-        if (!confirmed || evidence) {
-            try {
-                diagnosed = diagnostics.record(new Error(reason));
-            }
-            catch { /* never fails a stop */ }
-        }
-        return { state: confirmed ? 'acknowledged' : 'unknown', scope: 'native-handle', quiescence: confirmed ? 'confirmed' : 'unknown', remoteWork: 'unknown', reason,
-            ...(cause ? { unconfirmed: cause } : {}),
-            // Two separate questions, two separate names: a run can be provably quiet
-            // AND unscorable, and a report that cannot say which one it is sends the
-            // next investigation to the wrong layer.
-            ...(evidence ? { unevidenced: evidence } : {}),
-            // Which wake the verdict rests on, and every wake's own verdict beside it.
-            // Selection must not become suppression: a continuation that did not bind is
-            // a real account of that wake, and it travels here because the worker's own
-            // per-wake files live on a control root a training slot puts on tmpfs.
-            ...(scored ? { evidenced: scored.wakeId } : {}),
-            ...(wakes.length ? { wakes: wakes.map(entry => ({ wakeId: entry.wakeId, ...(entry.unevidenced ? { unevidenced: entry.unevidenced } : {}) })) } : {}),
-            detail: !confirmed ? `Native child closure unconfirmed (${cause}); caller must stop the shared container`
-                : evidence ? `Idle native runtime, acknowledged native stop, worker exit and process group gone; no terminal evidence to score this trial (${evidence})${last ? ` on wake ${last.wakeId}` : ''}`
-                    : `Closed native execution, idle runtime, acknowledged native stop, worker exit and process group gone${scored === last ? '' : `; scored from wake ${scored.wakeId}, not wake ${last.wakeId} (${last.unevidenced})`}` };
-    })();
-    try {
-        while (!ready) {
-            startup.throwIfAborted();
-            if (failure || exited)
-                throw new Error('Native worker exited or failed before readiness');
-            await pause(20);
-        }
-        const health = await http('/trial/health', undefined, 1000, startup);
-        if (health.version !== 'noopolis.daimon.organization-runtime-health.v1' || health.state !== 'running' || health.agents.length !== 1 || health.agents[0]?.agentId !== launch.agent.id)
-            throw new Error('Native worker readiness identity mismatch');
-        await verifyChildSandbox(launch, trialId, protectedPaths, startup, grokSlots);
-        startup.throwIfAborted();
-        const request = async (path, body, ms, signal) => {
-            if (failure || exited)
-                throw new Error('Owned native worker is no longer alive');
-            // Recorded before the call, so a delivery whose frame never arrives is still
-            // this trial's own wake with its own cause rather than a gap in the ledger.
-            const wake = path !== '/trial/run' || body === undefined ? undefined : named(body?.wakeId);
-            if (wake && launch.delivery === 'transport')
-                wake.source = parseTransportSource(body.source);
-            if (wake)
-                wakes.push(wake);
-            const result = await http(path, body, ms, signal);
-            if (wake)
-                bindTerminalEvidence(wake, result, launch, trialId, fault => { sealed ??= fault; }, engineWakeTimeoutMs(timeoutMs, launch));
-            return result;
-        };
-        return { name: `child:${child.pid}`, request, stop, diagnostic: () => diagnosed };
-    }
-    catch (error) {
-        // The protected capture lives on the control root, which a training slot puts on tmpfs; the thrown
-        // carrier holds the redacted record so the caller can persist the failure class durably.
-        const outcome = await stop('Native child startup failed');
-        throw recordNativeStartupClosure(diagnostics.startupFailure(error), outcome.state === 'acknowledged' && outcome.quiescence === 'confirmed');
-    }
-}
-/**
- * The delivery's own wake name, at the bound the worker's gate admits.
- *
- * The receipt publishes durably and its vocabulary is closed, so the name a
- * caller passed is either one of those bounded identifiers or it is not
- * published at all: `unnamed` is a statement about the ledger entry, never a
- * path, a token or a body smuggled onto the record by a caller's own string.
- */
-const WAKE_NAME = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
-function named(wakeId) {
-    return { wakeId: typeof wakeId === 'string' && WAKE_NAME.test(wakeId) ? wakeId : 'unnamed', unevidenced: 'terminal-absent' };
-}
-/**
- * Whether ONE wake's frame can be scored from — never whether something is still
- * spending, and never a verdict about the trial around it.
- *
- * A frame from another trial, agent, wake or config is not this trial's evidence,
- * and that check lives here rather than in the closure predicate. The receipt has
- * to name this trial's own delivery too: the frame's identity and the delivery the
- * runtime answered for are one delivery, or the frame is accounting for somebody
- * else's wake. Those are attribution failures, so they `seal` the whole trial:
- * nothing this runtime published can be scored past one.
- *
- * A trial whose subject deferred runs its continuations as further wakes, and each
- * one closes an execution of its own. The trace that answers for THIS frame is the
- * one the frame names; the rest are this same trial's earlier, already-closed
- * wakes, and counting them was refusing a healthy run for the arity of its own
- * history. Nothing is admitted by position: an unnamed execution resolves to no
- * trace at all, and that is this wake's own fault rather than the trial's.
- *
- * An identity conflict still throws, because it must fail the turn rather than
- * pass as verified work; it only records what it was first. Two traces answering
- * to the named execution is its own word: the frame is not unbound, it is
- * unreadable, and that distinction is what sends the next look at it upstream
- * instead of here.
- */
-export function bindTerminalEvidence(wake, value, launch, trialId, seal, wakeTimeoutMs) {
-    const own = canonicalWireId(value.schema) === 'spawnfile.training.daimon-native.trial.v1' && value.trialId === trialId && value.agentId === launch.agent.id &&
-        value.model === launch.agent.model && value.configSha256 === launch.configSha256 &&
-        value.wakeId === wake.wakeId;
-    const binding = launch.delivery === 'transport' ? transportTerminalBinding(value, wake.source)
-        : value.receipt && value.activity && value.receipt.agent_id === launch.agent.id &&
-            value.receipt.delivery_id === `${trialId}:${value.wakeId}` ? 'bound' : 'conflict';
-    wake.unevidenced = 'terminal-unbound';
-    if (!own || binding === 'conflict') {
-        seal('terminal-unbound');
-        return;
-    }
-    try {
-        if (binding === 'incomplete') {
-            if (value.activity)
-                admittedExecutions(value.activity, launch.agent.id);
-            const ids = new Set();
-            for (const trace of value.native.traces) {
-                if (trace.agent_id !== launch.agent.id)
-                    throw new Error('Native execution evidence identity mismatch');
-                if (ids.has(trace.turn_id))
-                    throw new Error(AMBIGUOUS_NATIVE_EXECUTION);
-                ids.add(trace.turn_id);
-            }
-            return;
-        }
-        validateNativeFrame(value.activity, value.receipt, value.native.traces, launch.agent.id, value.executionId);
-        const trace = typeof value.executionId === 'string' ? value.native.traces.find(row => row.turn_id === value.executionId) : undefined;
-        // A failed trace binds only as the declared-limit stop the worker labelled and
-        // its own sealed usage row still states; any other failure stays unscorable.
-        const limited = value.limit !== undefined && declaredLimitStop(trace, value.native.usage, wakeTimeoutMs) === value.limit;
-        if (!trace || trace.status !== 'completed' && !limited)
-            return;
-        if (executionClosed(value.activity, value.receipt, value.native.traces, launch.agent.id, trace.turn_id) === value.executionId)
-            wake.unevidenced = undefined;
-    }
-    catch (conflict) {
-        const fault = conflict.message === AMBIGUOUS_NATIVE_EXECUTION ? 'terminal-ambiguous' : 'terminal-unbound';
-        wake.unevidenced = fault;
-        seal(fault);
-        throw conflict;
-    }
-}
-async function bounded(pending, signal) {
-    signal.throwIfAborted();
-    let abort;
-    const cancelled = new Promise((_resolve, reject) => { abort = () => reject(new Error('Native child preparation cancelled')); signal.addEventListener('abort', abort, { once: true }); });
-    try {
-        return await Promise.race([pending, cancelled]);
-    }
-    finally {
-        signal.removeEventListener('abort', abort);
-    }
-}
-//# sourceMappingURL=lifecycle.js.map

package/dist/runtime/daimon/training/native/child/lifecycle.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"lifecycle.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/lifecycle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,UAAU,IAAI,KAAK,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,eAAe,EAA6B,MAAM,qBAAqB,CAAC;AACzH,OAAO,EAAE,kBAAkB,EAAE,iBAAiB,EAAE,eAAe,EAAE,mBAAmB,EAAE,0BAA0B,EACvF,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,sBAAsB,EAAE,wBAAwB,EAA8B,MAAM,uBAAuB,CAAC;AACrH,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAAgC,MAAM,oBAAoB,CAAC;AAC7G,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAC9H,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAGlD,OAAO,EAAE,0BAA0B,EAAE,MAAM,yBAAyB,CAAC;AACrE,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AAEpD,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAA+B,EAAE,MAA4B,EAAE,OAAe,EAClH,SAAiB,EAAE,MAAoB,EAAE,SAAS,GAAG,MAAM,EAAE,iBAAoC,EAAE;IACnG,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,IAAI,SAAS,GAAG,CAAC,IAAI,SAAS,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACnI,MAAM,OAAO,GAAG,IAAI,eAAe,EAAE,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;IAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAChE,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,CAAC;QACH,MAAM,EAAE,cAAc,EAAE,CAAC;QACzB,IAAI,SAAS,CAAC,OAAO;YAAE,MAAM,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9I,OAAO,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;QAChC,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;QACjC,MAAM,0BAA0B,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,GAAG,GAAG,MAAM,sBAAsB,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,CAAC,MAAM,eAAe,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACrE,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAC7F,GAAG,EAAE,GAAG,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;IACrD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,0BAA0B,CAAC,KAAK,EAAE,CAAC,QAAQ,CAAC,CAAC;IAAC,CAAC;YAC/D,CAAC;QAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,YAAY,CAAC,MAA4B,EAAE,GAAsB,EAAE,KAAa;IACvF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO;QAC7C,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;AAC9G,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,MAA4B,EAAE,OAAe,EAAE,SAAiB,EAAE,GAAsB,EACjH,KAAa,EAAE,OAAoB,EAAE,cAAiC,EAAE,OAAmB,EAAE,SAAkC;IAC/H,MAAM,IAAI,GAAG,sBAAsB,CAAC,UAAU,MAAM,CAAC,IAAI,CAAC,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClH,MAAM,WAAW,GAAG,MAAM,gBAAgB,CAAC,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,YAAY,EAChH,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;IACpC,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC;IAC3C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,oBAAoB,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE;QACtF,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KACzF,CAAC,CAAC;IACH,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC;IACtB,4EAA4E;IAC5E,wEAAwE;IACxE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,EAAE,CAAC;IACjC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,GAAG,KAAK,CAAC;IAAC,IAAI,QAAQ,GAAkB,IAAI,CAAC;IAAC,IAAI,UAAU,GAA0B,IAAI,CAAC;IAAC,IAAI,KAAK,GAAG,KAAK,CAAC;IAAC,IAAI,OAAO,GAAG,KAAK,CAAC;IAAC,IAAI,MAAM,GAAG,EAAE,CAAC;IAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAC7K,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,GAAG,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAChG,MAAM,SAAS,GAAG,GAAY,EAAE;QAC9B,4EAA4E;QAC5E,IAAI,CAAC,KAAK,IAAI,GAAG,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC9C,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAAC,OAAO,KAAK,CAAC;QAAC,CAAC;QAC5C,OAAO,KAAK,EAAE,CAAC;YAAC,OAAQ,KAA+B,CAAC,IAAI,KAAK,OAAO,CAAC;QAAC,CAAC;IAC7E,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAsB,EAAQ,EAAE;QAC5C,+EAA+E;QAC/E,IAAI,GAAG,KAAK,SAAS,IAAI,MAAM;YAAE,OAAO;QACxC,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wDAAwD,CAAC,CAAC;IACtH,CAAC,CAAC;IACF,MAAM,OAAO,GAAG,CAAC,KAAa,EAAE,MAAe,EAAE,EAAE;QACjD,WAAW,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAClC,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC;QACtB,IAAI,KAAK,GAAG,SAAS,EAAE,CAAC;YAAC,OAAO,GAAG,IAAI,CAAC;YAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YAAC,OAAO;QAAC,CAAC;QACnE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACjC,SAAS,CAAC;YACR,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAC,IAAI,GAAG,GAAG,CAAC;gBAAE,MAAM;YACrD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;YAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;YAClE,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;gBACxD,IAAI,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,2CAA2C,IAAI,GAAG,CAAC,OAAO,KAAK,OAAO,IAAI,GAAG,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;oBACpJ,GAAG,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,GAAG,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI;oBACpG,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,MAAM,IAAI,GAAG,CAAC,eAAe,KAAK,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC;oBAAE,KAAK,GAAG,IAAI,CAAC;YAC3H,CAAC;YAAC,MAAM,CAAC,CAAC,2EAA2E,CAAC,CAAC;QACzF,CAAC;IACH,CAAC,CAAC;IACF,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;IAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;IACpI,IAAI,QAA0C,CAAC;IAC/C;;;;;;;;;;;;;;OAcG;IACH,MAAM,KAAK,GAAmB,EAAE,CAAC;IACjC;;;;;;;;;;OAUG;IACH,IAAI,MAA2C,CAAC;IAChD,IAAI,SAA+C,CAAC;IACpD;;;;;;;;;;;;;;;;;;;;;;;OAuBG;IACH,MAAM,YAAY,GAAG,KAAK,IAA0C,EAAE;QACpE,IAAI,CAAC,KAAK,IAAI,MAAM;YAAE,OAAO,oBAAoB,CAAC;QAClD,8EAA8E;QAC9E,8EAA8E;QAC9E,IAAI,QAAwB,CAAC;QAC7B,IAAI,CAAC;YAAC,QAAQ,GAAG,MAAM,IAAI,CAAiB,cAAc,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAC/E,MAAM,CAAC;YAAC,OAAO,qBAAqB,CAAC;QAAC,CAAC;QACvC,6EAA6E;QAC7E,4EAA4E;QAC5E,wEAAwE;QACxE,IAAI,MAAsC,CAAC;QAC3C,IAAI,CAAC;YAAC,MAAM,GAAG,MAAM,IAAI,CAAqB,aAAa,EAAE,EAAE,EAAE,IAAI,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,MAAM,GAAG,SAAS,CAAC;QAAC,CAAC;QACvG,wEAAwE;QACxE,8EAA8E;QAC9E,oEAAoE;QACpE,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YAAC,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QACjE,MAAM,CAAC;YAAC,OAAO,mBAAmB,CAAC;QAAC,CAAC;QACrC,IAAI,QAAQ,GAAG,CAAC;YAAE,OAAO,eAAe,CAAC;QACzC,IAAI,MAAM,EAAE,KAAK,KAAK,cAAc;YAAE,OAAO,4BAA4B,CAAC;QAC1E,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,CAAC,MAAc,EAAwB,EAAE,CAAC,QAAQ,KAAK,CAAC,KAAK,IAAI,EAAE;QAC9E,+EAA+E;QAC/E,+EAA+E;QAC/E,+EAA+E;QAC/E,gFAAgF;QAChF,+CAA+C;QAC/C,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC;QACxG,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,IAAI,IAAI,EAAE,WAAW,IAAI,iBAAiB,CAAC;QACvF,IAAI,KAAkC,CAAC;QACvC,IAAI,CAAC;YAAC,KAAK,GAAG,MAAM,YAAY,EAAE,CAAC;QAAC,CAAC;QACrC,MAAM,CAAC;YAAC,KAAK,GAAG,qBAAqB,CAAC,CAAC,iEAAiE;QAAC,CAAC;QAC1G,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QAChC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK;YAAE,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QACxE,IAAI,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,SAAS,CAAC,CAAC;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;YACjC,OAAO,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM;gBAAE,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,WAAW,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC7C,KAAK,KAAK,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;QAChG,MAAM,SAAS,GAAG,KAAK,KAAK,SAAS,CAAC;QACtC,uEAAuE;QACvE,yEAAyE;QACzE,2EAA2E;QAC3E,wEAAwE;QACxE,yEAAyE;QACzE,sDAAsD;QACtD,IAAI,CAAC,SAAS,IAAI,QAAQ,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAAC,CAAC;QAC7H,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,SAAS,EAAE,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM;YAC5J,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,0EAA0E;YAC1E,yEAAyE;YACzE,yCAAyC;YACzC,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9C,2EAA2E;YAC3E,6EAA6E;YAC7E,4EAA4E;YAC5E,uEAAuE;YACvE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpJ,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,qCAAqC,KAAK,0CAA0C;gBACvG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,gIAAgI,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE;oBAC9L,CAAC,CAAC,sGAAsG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,sBAAsB,MAAO,CAAC,MAAM,cAAc,IAAK,CAAC,MAAM,KAAK,IAAK,CAAC,WAAW,GAAG,EAAE,EAAE,CAAC;IACnO,CAAC,CAAC,EAAE,CAAC;IACL,IAAI,CAAC;QACH,OAAO,CAAC,KAAK,EAAE,CAAC;YACd,OAAO,CAAC,cAAc,EAAE,CAAC;YACzB,IAAI,OAAO,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC1F,MAAM,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAoE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACxI,IAAI,MAAM,CAAC,OAAO,KAAK,gDAAgD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;QACnP,MAAM,kBAAkB,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QAC9E,OAAO,CAAC,cAAc,EAAE,CAAC;QACzB,MAAM,OAAO,GAAqC,KAAK,EAAK,IAAqD,EAAE,IAAc,EAAE,EAAW,EAAE,MAAoB,EAAE,EAAE;YACtK,IAAI,OAAO,IAAI,MAAM;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;YACjF,6EAA6E;YAC7E,4EAA4E;YAC5E,MAAM,IAAI,GAAG,IAAI,KAAK,YAAY,IAAI,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAE,IAA6B,EAAE,MAAM,CAAC,CAAC;YACrH,IAAI,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW;gBAAE,IAAI,CAAC,MAAM,GAAG,oBAAoB,CAAE,IAA6B,CAAC,MAAM,CAAC,CAAC;YACvH,IAAI,IAAI;gBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAI,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;YACrD,IAAI,IAAI;gBAAE,oBAAoB,CAAC,IAAI,EAAE,MAA0B,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,CAAC,EAAE,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,mBAAmB,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1J,OAAO,MAAM,CAAC;QAChB,CAAC,CAAC;QACF,OAAO,EAAE,IAAI,EAAE,SAAS,KAAK,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IACpF,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,mGAAmG;QACnG,yFAAyF;QACzF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,6BAA6B,CAAC,CAAC;QAC1D,MAAM,0BAA0B,CAAC,WAAW,CAAC,cAAc,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC,KAAK,KAAK,cAAc,IAAI,OAAO,CAAC,UAAU,KAAK,WAAW,CAAC,CAAC;IAC9I,CAAC;AACH,CAAC;AAKD;;;;;;;GAOG;AACH,MAAM,SAAS,GAAG,sCAAsC,CAAC;AACzD,SAAS,KAAK,CAAC,MAAe;IAC5B,OAAO,EAAE,MAAM,EAAE,OAAO,MAAM,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,iBAAiB,EAAE,CAAC;AAC/H,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAkB,EAAE,KAAuB,EAAE,MAA4B,EAAE,OAAe,EAC7H,IAA8C,EAAE,aAAsB;IACtE,MAAM,GAAG,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,2CAA2C,IAAI,KAAK,CAAC,OAAO,KAAK,OAAO,IAAI,KAAK,CAAC,OAAO,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;QACzJ,KAAK,CAAC,KAAK,KAAK,MAAM,CAAC,KAAK,CAAC,KAAK,IAAI,KAAK,CAAC,YAAY,KAAK,MAAM,CAAC,YAAY;QAChF,KAAK,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,KAAK,WAAW,CAAC,CAAC,CAAC,wBAAwB,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC;QAC5F,CAAC,CAAC,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;YAC7E,KAAK,CAAC,OAAO,CAAC,WAAW,KAAK,GAAG,OAAO,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;IACtF,IAAI,CAAC,WAAW,GAAG,kBAAkB,CAAC;IACtC,IAAI,CAAC,GAAG,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAAC,OAAO;IAAC,CAAC;IACzE,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC7B,IAAI,KAAK,CAAC,QAAQ;gBAAE,kBAAkB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YACxE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;YAC9B,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;gBACxC,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,CAAC,KAAK,CAAC,EAAE;oBAAE,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;gBACvG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;gBACxE,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACzB,CAAC;YACD,OAAO;QACT,CAAC;QACD,mBAAmB,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,WAAW,CAAC,CAAC;QAC9G,MAAM,KAAK,GAAG,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrI,+EAA+E;QAC/E,6EAA6E;QAC7E,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,KAAK,EAAE,aAAa,CAAC,KAAK,KAAK,CAAC,KAAK,CAAC;QACzH,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,CAAC,OAAO;YAAE,OAAO;QAC/D,IAAI,eAAe,CAAC,KAAK,CAAC,QAAS,EAAE,KAAK,CAAC,OAAQ,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,OAAO,CAAC,KAAK,KAAK,CAAC,WAAW;YAAE,IAAI,CAAC,WAAW,GAAG,SAAS,CAAC;IAChK,CAAC;IAAC,OAAO,QAAQ,EAAE,CAAC;QAClB,MAAM,KAAK,GAAI,QAAkB,CAAC,OAAO,KAAK,0BAA0B,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,kBAAkB,CAAC;QACrH,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;QACzB,IAAI,CAAC,KAAK,CAAC,CAAC;QACZ,MAAM,QAAQ,CAAC;IACjB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,OAAO,CAAI,OAAmB,EAAE,MAAmB;IAChE,MAAM,CAAC,cAAc,EAAE,CAAC;IAAC,IAAI,KAAkB,CAAC;IAChD,MAAM,SAAS,GAAG,IAAI,OAAO,CAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,GAAG,KAAK,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAChM,IAAI,CAAC;QAAC,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IAAC,CAAC;YAAS,CAAC;QAAC,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAAC,CAAC;AAClH,CAAC"}

package/dist/runtime/daimon/training/native/child/probe.d.ts

@@ -1,2 +0,0 @@
-/** Executed verbatim inside the native sandbox; success is an on-disk terminal marker. */
-export declare function nativeChildProbe(input: string, complete: string, denied: readonly string[], port: number): string;

package/dist/runtime/daimon/training/native/child/probe.js

@@ -1,11 +0,0 @@
-/** Executed verbatim inside the native sandbox; success is an on-disk terminal marker. */
-export function nativeChildProbe(input, complete, denied, port) {
-    return `const fs=require('node:fs'),net=require('node:net');
-if(fs.readFileSync(${JSON.stringify(input)},'utf8')!=='NATIVE_READ')throw Error('Workspace read failed');
-for(const p of ${JSON.stringify(denied)}){let fd;try{fd=fs.openSync(p,'r');}catch{continue;}fs.closeSync(fd);throw Error('Protected path readable');}
-let settled=false;const s=net.connect({host:'127.0.0.1',port:${port}});
-s.once('connect',()=>{settled=true;s.destroy();process.exitCode=1;});
-s.once('error',()=>{if(settled)return;settled=true;s.destroy();fs.writeFileSync(${JSON.stringify(complete)},'NATIVE_POLICY_COMPLETE');});
-s.setTimeout(750,()=>{settled=true;s.destroy();process.exitCode=1;});`;
-}
-//# sourceMappingURL=probe.js.map

package/dist/runtime/daimon/training/native/child/probe.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/probe.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,QAAgB,EAAE,MAAyB,EAAE,IAAY;IACvG,OAAO;qBACY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC;iBACzB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;+DACwB,IAAI;;kFAEe,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;sEACpC,CAAC;AACvE,CAAC"}

package/dist/runtime/daimon/training/native/child/sandbox.d.ts

@@ -1,4 +0,0 @@
-import { type VerifiedNativeLaunch } from '../receipt/index.js';
-import type { GrokSlotFreshnessStore } from '../../services/index.js';
-/** Runs the actual owner-produced permission projection, not an approximate test profile. */
-export declare function verifyChildSandbox(launch: VerifiedNativeLaunch, trialId: string, protectedPaths: readonly string[], signal: AbortSignal, grokSlots?: GrokSlotFreshnessStore): Promise<void>;

package/dist/runtime/daimon/training/native/child/sandbox.js

@@ -1,76 +0,0 @@
-import { trainingEnvironment } from '../../../../../training/index.js';
-import { execFile } from 'node:child_process';
-import { promisify } from 'node:util';
-import { lstat, mkdir, mkdtemp, open, readFile, rm, writeFile } from 'node:fs/promises';
-import { join, resolve } from 'node:path';
-import { createServer } from 'node:net';
-import { nativeChildProbe } from './probe.js';
-import { isGrokLaunch, nativeTrialArtifactsRoot, parseNativeSandboxReceipt, readPrivateFile } from '../receipt/index.js';
-import { verifyChildGrokSlot } from './grok.js';
-/** Runs the actual owner-produced permission projection, not an approximate test profile. */
-export async function verifyChildSandbox(launch, trialId, protectedPaths, signal, grokSlots) {
-    if (isGrokLaunch(launch))
-        return verifyChildGrokSlot(launch, trialId, protectedPaths, grokSlots);
-    const home = launch.projections.find(row => row.role === 'home').target;
-    const artifacts = nativeTrialArtifactsRoot(launch, trialId);
-    const receipt = parseNativeSandboxReceipt(JSON.parse(await readPrivateFile(join(artifacts, 'sandbox-projection.json'), 262144)), {
-        trialId, configSha256: launch.configSha256, agentId: launch.agent.id, workspacePath: launch.workspace.target, runtimeHomePath: home,
-    });
-    const scratch = await mkdtemp(join(launch.workspace.target, '.spawnfile-training-native-policy-'));
-    const owned = [];
-    const denied = [];
-    const server = createServer(socket => socket.destroy());
-    try {
-        // An absent configured secret has nothing to deny; the TypeSafe transport refuses it on use.
-        const secretFile = trainingEnvironment('SPAWNFILE_TRAINING_TYPESAFE_SECRET_FILE');
-        const evaluatorSecret = secretFile ? resolve(secretFile) : undefined;
-        const secretPresent = evaluatorSecret !== undefined && await lstat(evaluatorSecret).then(() => true, (error) => {
-            if (error.code === 'ENOENT')
-                return false;
-            throw error;
-        });
-        for (const path of [...new Set([...protectedPaths, launch.controlRoot, launch.config, launch.tokenFile, launch.envFile,
-                ...(secretPresent ? [evaluatorSecret] : [])])]) {
-            const entry = await lstat(path);
-            if (!entry.isDirectory() && !entry.isFile())
-                throw new Error('Unsupported protected native path');
-            denied.push(path);
-        }
-        // Verify the declared auth/ingress rule with canaries only when no credential exists.
-        await mkdir(join(home, '.codex'), { recursive: true, mode: 0o700 });
-        await mkdir(join(home, '.daimon-inbound'), { recursive: true, mode: 0o700 });
-        for (const file of [join(home, '.codex/auth.json'), join(home, '.daimon-inbound/.spawnfile-training-canary')]) {
-            try {
-                const handle = await open(file, 'wx', 0o600);
-                await handle.writeFile('{}');
-                await handle.close();
-                owned.push(file);
-            }
-            catch (error) {
-                if (error.code !== 'EEXIST')
-                    throw error;
-            }
-            denied.push(file);
-        }
-        const input = join(scratch, 'input'), complete = join(scratch, 'complete');
-        await writeFile(input, 'NATIVE_READ');
-        await new Promise(resolve => server.listen(0, '127.0.0.1', resolve));
-        const port = server.address().port;
-        const code = nativeChildProbe(input, complete, denied, port);
-        await promisify(execFile)(receipt.projection.executablePath, [...receipt.projection.sandboxArgs, '--', process.execPath, '-e', code], {
-            cwd: launch.workspace.target, env: { PATH: process.env.PATH, HOME: home, CODEX_HOME: join(home, '.codex'), TMPDIR: '/tmp', LANG: 'C.UTF-8' }, signal, timeout: 15000, maxBuffer: 65536,
-        });
-        if (await readFile(complete, 'utf8') !== 'NATIVE_POLICY_COMPLETE')
-            throw new Error('Native sandbox did not finish enforcement checks');
-        await writeFile(join(artifacts, 'child-sandbox-preflight.json'), JSON.stringify({ schema: 'spawnfile.training.daimon-native.child-sandbox-preflight.v1',
-            trialId, configSha256: launch.configSha256, projectionSha256: receipt.projectionSha256, modelCallsMade: 0, workspaceReadWrite: true, protectedPathsDenied: true, networkDenied: true }), { flag: 'wx', mode: 0o600 });
-    }
-    catch (error) {
-        throw new Error('Exact native child sandbox failed before cognition', { cause: error });
-    }
-    finally {
-        server.close();
-        await Promise.all([...owned, scratch].map(path => rm(path, { recursive: true, force: true })));
-    }
-}
-//# sourceMappingURL=sandbox.js.map

package/dist/runtime/daimon/training/native/child/sandbox.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"sandbox.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/sandbox.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,mBAAmB,EAAE,MAAM,kCAAkC,CAAC;AACvE,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACxF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,wBAAwB,EAAE,yBAAyB,EAAE,eAAe,EAA6B,MAAM,qBAAqB,CAAC;AACpJ,OAAO,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAGhD,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,MAA4B,EAAE,OAAe,EAAE,cAAiC,EAAE,MAAmB,EAC5I,SAAkC;IAClC,IAAI,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO,mBAAmB,CAAC,MAAM,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,CAAC,CAAC;IACjG,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,KAAK,MAAM,CAAE,CAAC,MAAM,CAAC;IACzE,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,SAAS,EAAE,yBAAyB,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE;QAC/H,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,aAAa,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,eAAe,EAAE,IAAI;KACpI,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,oCAAoC,CAAC,CAAC,CAAC;IACnG,MAAM,KAAK,GAAa,EAAE,CAAC;IAAC,MAAM,MAAM,GAAa,EAAE,CAAC;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC;QACH,6FAA6F;QAC7F,MAAM,UAAU,GAAG,mBAAmB,CAAC,yCAAyC,CAAC,CAAC;QAClF,MAAM,eAAe,GAAG,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACrE,MAAM,aAAa,GAAG,eAAe,KAAK,SAAS,IAAI,MAAM,KAAK,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC,KAA4B,EAAE,EAAE;YACpI,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAAC,MAAM,KAAK,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,EAAE,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,CAAC,OAAO;gBACpH,GAAG,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;YAClG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,sFAAsF;QACtF,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACpE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,kBAAkB,CAAC,EAAE,IAAI,CAAC,IAAI,EAAE,4CAA4C,CAAC,CAAC,EAAE,CAAC;YAC9G,IAAI,CAAC;gBAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;gBAAC,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAAC,CAAC;YAC3H,OAAO,KAAK,EAAE,CAAC;gBAAC,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;oBAAE,MAAM,KAAK,CAAC;YAAC,CAAC;YACtF,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;QAAC,MAAM,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;QAClH,MAAM,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;QAC3E,MAAM,IAAI,GAAI,MAAM,CAAC,OAAO,EAAuB,CAAC,IAAI,CAAC;QACzD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC7D,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,GAAG,OAAO,CAAC,UAAU,CAAC,WAAW,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YACpI,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK;SACvL,CAAC,CAAC;QACH,IAAI,MAAM,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,KAAK,wBAAwB;YAAE,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACvI,MAAM,SAAS,CAAC,IAAI,CAAC,SAAS,EAAE,8BAA8B,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,6DAA6D;YACrJ,OAAO,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,gBAAgB,EAAE,OAAO,CAAC,gBAAgB,EAAE,cAAc,EAAE,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,oBAAoB,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC1N,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,KAAK,CAAC,oDAAoD,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAAC,CAAC;YACpG,CAAC;QAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QAAC,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAAC,CAAC;AAC7H,CAAC"}

package/dist/runtime/daimon/training/native/child/types.d.ts

@@ -1,15 +0,0 @@
-import type { NativeChildExternalInputs } from '../index.js';
-import type { VerifiedNativeLaunch } from '../receipt/index.js';
-import type { GrokSlotFreshnessStore } from '../../services/index.js';
-export interface NativeChildExecution {
-    kind: 'child-process';
-    externalInputs?: NativeChildExternalInputs;
-    /** Caller-owned staging only; the package does not import subscription credentials. */
-    /** Required for Grok launches: the experiment's persisted slot recycle freshness (nonce and generation floor). */
-    grokSlots?: GrokSlotFreshnessStore;
-    prepare?(context: {
-        launch: VerifiedNativeLaunch;
-        trialId: string;
-        signal: AbortSignal;
-    }): Promise<void>;
-}

package/dist/runtime/daimon/training/native/child/types.js

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=types.js.map

package/dist/runtime/daimon/training/native/child/types.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../../../src/runtime/daimon/training/native/child/types.ts"],"names":[],"mappings":""}

package/dist/runtime/daimon/training/native/container/docker.d.ts

@@ -1,29 +0,0 @@
-import { type VerifiedNativeLaunch } from '../receipt/index.js';
-export interface DockerResult {
-    code: number;
-    stdout: string;
-    stderr: string;
-}
-export type DockerCommand = (args: string[], options?: {
-    signal?: AbortSignal;
-    timeoutMs?: number;
-    stdin?: string;
-}) => Promise<DockerResult>;
-export interface ContainerInspection {
-    Id: string;
-    State: {
-        Running: boolean;
-        Status: string;
-        ExitCode: number;
-    };
-    Config: {
-        Labels?: Record<string, string>;
-        Image: string;
-    };
-}
-export declare const ownerLabel = "training.daimon-native.owner";
-export declare const trialLabel = "training.daimon-native.trial";
-export declare function dockerCommand(command?: string): DockerCommand;
-export declare function createContainerArguments(launch: VerifiedNativeLaunch, name: string, owner: string, trialId: string, timeoutMs: number, user?: string): string[];
-export declare function inspectOwned(run: DockerCommand, name: string, owner: string): Promise<ContainerInspection | undefined>;
-export declare function workerRequest<T>(run: DockerCommand, name: string, path: string, body?: unknown, timeoutMs?: number, signal?: AbortSignal, port?: number, tokenFile?: string): Promise<T>;