@evomap/evolver-adapter-public 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/learningPacketFeedback.js

@@ -0,0 +1,104 @@
+import { assertHubUrlSecure, isHubUnreachableError } from './hubFetch.js';
+import { learningOpsAuthHeaders } from './learningPacketSink.js';
+/** Hub appendLearningFeedbackSchema closed enums (evomap-hub src/schemas/learningOps.js). */
+export const LEARNING_FEEDBACK_TYPES = ['outcome', 'rating', 'correction', 'governance', 'note'];
+export const LEARNING_FEEDBACK_DECISIONS = [
+    'accepted', 'rejected', 'needs_redaction', 'not_training_eligible', 'training_candidate', 'note',
+];
+function pickString(record, key) {
+    const value = record[key];
+    if (value === null)
+        return null;
+    return typeof value === 'string' ? value : undefined;
+}
+async function failureReason(res) {
+    const text = await res.text().catch(() => '');
+    return `hub ${res.status}${text ? `: ${text.slice(0, 200)}` : ''}`;
+}
+/**
+ * Feedback append + packet governance read-back against the hub Learning Ops API. Best-effort by the
+ * same contract as HubLearningPacketSink: this is observability/ops tooling, so every failure —
+ * network, auth, 4xx/5xx, unparseable body — returns { ok:false, reason } and never throws.
+ */
+export class HubLearningPacketFeedbackClient {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async submitFeedback(packetId, feedback) {
+        try {
+            const path = `/api/learning-packets/${encodeURIComponent(packetId)}/feedback`;
+            const url = `${this.opts.baseUrl}${path}`;
+            assertHubUrlSecure(url);
+            const headers = await learningOpsAuthHeaders(this.opts.auth, 'POST', path);
+            // Exactly the appendLearningFeedbackSchema fields (strict zod): optional keys are omitted, not nulled.
+            const res = await this.opts.fetchFn(url, {
+                method: 'POST',
+                headers,
+                redirect: 'manual',
+                body: JSON.stringify({
+                    decision: feedback.decision,
+                    ...(feedback.feedbackType !== undefined ? { feedbackType: feedback.feedbackType } : {}),
+                    ...(feedback.rating !== undefined ? { rating: feedback.rating } : {}),
+                    ...(feedback.scores !== undefined ? { scores: feedback.scores } : {}),
+                    ...(feedback.rationale !== undefined ? { rationale: feedback.rationale } : {}),
+                    ...(feedback.verifier !== undefined ? { verifier: feedback.verifier } : {}),
+                    ...(feedback.failureCategory !== undefined ? { failureCategory: feedback.failureCategory } : {}),
+                    ...(feedback.traceEventId !== undefined ? { traceEventId: feedback.traceEventId } : {}),
+                    ...(feedback.actorNodeId !== undefined ? { actorNodeId: feedback.actorNodeId } : {}),
+                }),
+            });
+            if (res.status === 201) {
+                const body = await res.json().catch(() => null);
+                const row = body && typeof body === 'object' ? body.feedback : undefined;
+                return { ok: true, ...(typeof row?.id === 'string' ? { feedbackId: row.id } : {}) };
+            }
+            return { ok: false, reason: await failureReason(res) };
+        }
+        catch (e) {
+            if (isHubUnreachableError(e))
+                return { ok: false, reason: 'hub_unreachable' };
+            return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+        }
+    }
+    async getPacket(packetId) {
+        try {
+            const path = `/api/learning-packets/${encodeURIComponent(packetId)}`;
+            const url = `${this.opts.baseUrl}${path}`;
+            assertHubUrlSecure(url);
+            const headers = await learningOpsAuthHeaders(this.opts.auth, 'GET', path);
+            const res = await this.opts.fetchFn(url, { method: 'GET', headers, redirect: 'manual' });
+            if (res.status !== 200)
+                return { ok: false, reason: await failureReason(res) };
+            const body = await res.json().catch(() => null);
+            const packet = body && typeof body === 'object' ? body.packet : undefined;
+            if (!packet || typeof packet !== 'object' || Array.isArray(packet)) {
+                return { ok: false, reason: 'hub 200: response missing packet object' };
+            }
+            const record = packet;
+            if (typeof record['id'] !== 'string' || record['id'].length === 0) {
+                return { ok: false, reason: 'hub 200: packet missing id' };
+            }
+            return {
+                ok: true,
+                packet: {
+                    id: record['id'],
+                    ...(pickString(record, 'status') !== undefined && pickString(record, 'status') !== null ? { status: record['status'] } : {}),
+                    ...(pickString(record, 'outcomeStatus') !== undefined ? { outcomeStatus: pickString(record, 'outcomeStatus') } : {}),
+                    ...(pickString(record, 'verifier') !== undefined ? { verifier: pickString(record, 'verifier') } : {}),
+                    ...(pickString(record, 'trainingEligibilityStatus') !== undefined ? { trainingEligibilityStatus: pickString(record, 'trainingEligibilityStatus') } : {}),
+                    ...(pickString(record, 'governanceStatus') !== undefined ? { governanceStatus: pickString(record, 'governanceStatus') } : {}),
+                    ...(typeof record['trainingEligible'] === 'boolean' ? { trainingEligible: record['trainingEligible'] } : {}),
+                    ...(pickString(record, 'consentStatus') !== undefined ? { consentStatus: pickString(record, 'consentStatus') } : {}),
+                    ...(pickString(record, 'redactionStatus') !== undefined ? { redactionStatus: pickString(record, 'redactionStatus') } : {}),
+                    ...(pickString(record, 'retentionPolicy') !== undefined ? { retentionPolicy: pickString(record, 'retentionPolicy') } : {}),
+                },
+            };
+        }
+        catch (e) {
+            if (isHubUnreachableError(e))
+                return { ok: false, reason: 'hub_unreachable' };
+            return { ok: false, reason: e instanceof Error ? e.message : String(e) };
+        }
+    }
+}

package/dist/learningPacketSink.d.ts

@@ -0,0 +1,48 @@
+import type { hub, trace } from '@evomap/evolver-core';
+import { type FetchLike } from './hubFetch.js';
+/** Hub traceEvents array cap (createLearningPacketSchema). Extra events are dropped, noted in metadata. */
+export declare const HUB_TRACE_EVENTS_MAX = 100;
+export interface HubLearningPacketSinkOptions {
+    baseUrl: string;
+    auth: hub.AuthProvider;
+    fetchFn: FetchLike;
+    /** Optional node identity recorded on the packet (hub nodeId column). */
+    nodeId?: () => string | undefined;
+}
+/**
+ * Deterministic content hash over the draft body (hub contentHash column, dedup aid).
+ *
+ * Bare 64-hex, NOT `sha256:`-prefixed: the hub column is VarChar(64), so a prefixed
+ * digest is 71 chars and every upload failed with a Prisma "value too long" 500. The
+ * hub schema now rejects over-64 at validation, which would make it a 400 instead —
+ * either way the algorithm is fixed at sha256 by this contract, so the prefix carried
+ * no information.
+ */
+export declare function learningPacketContentHash(draft: trace.LearningPacketDraft): string;
+/**
+ * Auth headers for the strict learning-packets routes (requireAuth reads Authorization only).
+ * A legacy body credential (bodyFields.node_secret) is promoted to Bearer — the strict schemas
+ * reject extra body fields, so credentials must never ride in the body here.
+ */
+export declare function learningOpsAuthHeaders(auth: hub.AuthProvider, method: string, path: string): Promise<Record<string, string>>;
+/** Map a core draft to the hub createLearningPacket body. Exported for tests and for the private adapter to reuse. */
+export declare function learningPacketWireBody(draft: trace.LearningPacketDraft, nodeId?: string): Record<string, unknown>;
+/**
+ * LearningPacketSink implementation against the public hub Learning Ops ingest API. Best-effort by
+ * contract: every failure returns { accepted: false, reason } (never throws) — the runtime treats packet
+ * delivery as observability, so a hub outage must never affect a task verdict. A 409 duplicate_source is
+ * reported as accepted (the packet is already there; the idempotency key did its job).
+ */
+export declare class HubLearningPacketSink implements trace.LearningPacketSink {
+    private readonly opts;
+    constructor(opts: HubLearningPacketSinkOptions);
+    submit(draft: trace.LearningPacketDraft): Promise<trace.LearningPacketSubmitResult>;
+}
+/** Fan-out: always deliver to `primary` (local file record), then best-effort to `secondary` (hub upload).
+ *  The composite result reflects the PRIMARY sink — the local record is the durability guarantee. */
+export declare class TeeLearningPacketSink implements trace.LearningPacketSink {
+    private readonly primary;
+    private readonly secondary;
+    constructor(primary: trace.LearningPacketSink, secondary: trace.LearningPacketSink);
+    submit(draft: trace.LearningPacketDraft): Promise<trace.LearningPacketSubmitResult>;
+}

package/dist/learningPacketSink.js

@@ -0,0 +1,194 @@
+// Learning Ops packet upload (slice 3) — the adapter half of core's LearningPacketSink port.
+// Maps a local LearningPacketDraft (learning_packet.v0, built by evolver-core/trace) onto the hub's
+// `POST /api/learning-packets` ingest contract (strict zod schema, requireAuth Bearer token).
+//
+// Deliberately NOT built on HubFetch: that helper injects sender_id/credential fields into every POST body
+// (the /a2a envelope convention), which the strict learning-packets schema rejects. This sink authenticates
+// via the injected AuthProvider (Authorization header only) and sends exactly the schema's fields.
+import { createHash } from 'node:crypto';
+import { assertHubUrlSecure, isHubUnreachableError } from './hubFetch.js';
+/** Hub traceEvents array cap (createLearningPacketSchema). Extra events are dropped, noted in metadata. */
+export const HUB_TRACE_EVENTS_MAX = 100;
+/** Hub failureCategory is a closed enum; runtime failureKind is looser. Only the sure mapping is direct. */
+function failureCategoryFor(failureKind) {
+    if (failureKind === null)
+        return undefined;
+    if (failureKind === 'permission_denied')
+        return 'permission_error';
+    if (failureKind === 'timeout' || failureKind === 'non_zero_exit' || failureKind === 'invalid_output')
+        return 'tool_error';
+    return 'other';
+}
+/**
+ * Map the runtime's outcome onto the hub OUTCOME_STATUSES enum, tiered by whether an
+ * external verifier actually adjudicated the run.
+ *
+ * A verified run gets a definite verdict (`succeeded` / `failed`). An unverified one
+ * gets `partially_succeeded` -- deliberately NOT `succeeded`, and no longer omitted:
+ *
+ * - Omitting it (the previous behaviour) threw the run away. The packet reached the
+ *   hub with no outcome at all, which is indistinguishable from a run nobody looked
+ *   at, so a consumer could not tell "we don't know" from "not recorded".
+ * - Calling it `succeeded` would be worse: the runtime only knows the turn loop
+ *   ended without crashing, which is not evidence the task was done correctly.
+ *   Training on that teaches format imitation.
+ *
+ * `partially_succeeded` says exactly what is true -- it ran to completion and nobody
+ * checked the result -- and pairs with `verifier` being absent, so a consumer filters
+ * on the verifier rather than having to infer trust from the status. Darwin's training
+ * path takes only rows with a real verifier; see docs/rsi-stage1-plan.md.
+ * @param status Runtime-side outcome.
+ * @param verified True when an external verifier ran (evaluation.placeholder === false).
+ * @returns A hub OUTCOME_STATUSES value.
+ */
+function outcomeStatusFor(status, verified) {
+    if (status === 'failed')
+        return 'failed';
+    if (status === 'success' && verified)
+        return 'succeeded';
+    // Ran to completion, unadjudicated -- or the runtime itself is unsure.
+    return 'partially_succeeded';
+}
+/**
+ * Deterministic content hash over the draft body (hub contentHash column, dedup aid).
+ *
+ * Bare 64-hex, NOT `sha256:`-prefixed: the hub column is VarChar(64), so a prefixed
+ * digest is 71 chars and every upload failed with a Prisma "value too long" 500. The
+ * hub schema now rejects over-64 at validation, which would make it a 400 instead —
+ * either way the algorithm is fixed at sha256 by this contract, so the prefix carried
+ * no information.
+ */
+export function learningPacketContentHash(draft) {
+    return createHash('sha256').update(JSON.stringify(draft)).digest('hex');
+}
+/**
+ * Auth headers for the strict learning-packets routes (requireAuth reads Authorization only).
+ * A legacy body credential (bodyFields.node_secret) is promoted to Bearer — the strict schemas
+ * reject extra body fields, so credentials must never ride in the body here.
+ */
+export async function learningOpsAuthHeaders(auth, method, path) {
+    const signed = await auth.authenticate({ method, path });
+    const headers = { 'content-type': 'application/json', ...(signed.headers ?? {}) };
+    const bodySecret = signed.bodyFields?.['node_secret'];
+    if (headers['authorization'] === undefined && bodySecret !== undefined)
+        headers['authorization'] = `Bearer ${String(bodySecret)}`;
+    return headers;
+}
+/** Map a core draft to the hub createLearningPacket body. Exported for tests and for the private adapter to reuse. */
+export function learningPacketWireBody(draft, nodeId) {
+    const truncated = draft.trajectory.length > HUB_TRACE_EVENTS_MAX;
+    const events = draft.trajectory.slice(0, HUB_TRACE_EVENTS_MAX);
+    const outcomeStatus = outcomeStatusFor(draft.evaluation.outcomeStatus, draft.evaluation.placeholder === false);
+    const failureCategory = failureCategoryFor(draft.evaluation.failureCategory);
+    return {
+        schemaVersion: draft.schemaVersion,
+        status: 'draft',
+        sourceRepo: draft.source.repo,
+        sourceRun: draft.source.run,
+        sourceType: draft.source.type,
+        sourceId: draft.source.id,
+        // One packet per run: the run id IS the idempotency key, so a retried submit dedups hub-side (409).
+        idempotencyKey: `${draft.source.repo}:${draft.source.run}`,
+        contentHash: learningPacketContentHash(draft),
+        ...(nodeId ? { nodeId } : {}),
+        outcomeStatus,
+        // evaluation fill-in (slice 6): a non-placeholder evaluation carries the runtime's external verifier
+        // ('automated_test' is in the hub VERIFIERS enum); passed/score details ride inside payload.evaluation.
+        ...(draft.evaluation.verifier !== null ? { verifier: draft.evaluation.verifier } : {}),
+        ...(failureCategory ? { failureCategory } : {}),
+        ...(draft.task.summary !== null ? { summary: draft.task.summary } : {}),
+        payload: {
+            task: draft.task,
+            context: draft.context,
+            artifacts: draft.artifacts,
+            evaluation: draft.evaluation,
+            governance: draft.governance,
+        },
+        metadata: {
+            ...(truncated ? { traceEventsTruncated: true, traceEventsTotal: draft.trajectory.length } : {}),
+            ...(draft.evaluation.failureCategory !== null ? { runtimeFailureKind: draft.evaluation.failureCategory } : {}),
+        },
+        redactionStatus: draft.governance.redactionStatus,
+        consentStatus: draft.governance.consentStatus,
+        retentionPolicy: draft.governance.retentionPolicy,
+        traceEvents: events.map((e) => ({
+            eventId: e.eventId,
+            schemaVersion: e.schemaVersion,
+            eventType: e.eventType,
+            occurredAt: e.occurredAt,
+            traceId: e.traceId,
+            ...(e.sessionId !== undefined ? { sessionId: e.sessionId } : {}),
+            ...(e.taskId !== undefined ? { taskId: e.taskId } : {}),
+            sequence: e.sequence,
+            payload: e.payload,
+            metadata: e.metadata,
+        })),
+    };
+}
+/**
+ * LearningPacketSink implementation against the public hub Learning Ops ingest API. Best-effort by
+ * contract: every failure returns { accepted: false, reason } (never throws) — the runtime treats packet
+ * delivery as observability, so a hub outage must never affect a task verdict. A 409 duplicate_source is
+ * reported as accepted (the packet is already there; the idempotency key did its job).
+ */
+export class HubLearningPacketSink {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    async submit(draft) {
+        try {
+            const url = `${this.opts.baseUrl}/api/learning-packets`;
+            assertHubUrlSecure(url);
+            const headers = await learningOpsAuthHeaders(this.opts.auth, 'POST', '/api/learning-packets');
+            const res = await this.opts.fetchFn(url, {
+                method: 'POST',
+                headers,
+                redirect: 'manual',
+                body: JSON.stringify(learningPacketWireBody(draft, this.opts.nodeId?.())),
+            });
+            // Hub route returns 201 Created. The public website BFF/proxy in front of
+            // /api/learning-packets has been observed to surface the same body as 200.
+            // Accept both when a packet id is present so a successful write is never
+            // reported as hub 200 rejection (which previously made every live upload
+            // look failed while the row was already stored).
+            if (res.status === 201 || res.status === 200) {
+                const body = await res.json().catch(() => null);
+                const packet = body && typeof body === 'object' ? body.packet : undefined;
+                if (typeof packet?.id === 'string') {
+                    return { accepted: true, reason: packet.id };
+                }
+                if (res.status === 201)
+                    return { accepted: true };
+                // Bare 200 without a packet body is not a create success we can claim.
+            }
+            if (res.status === 409)
+                return { accepted: true, reason: 'duplicate_source' };
+            const text = await res.text().catch(() => '');
+            return { accepted: false, reason: `hub ${res.status}${text ? `: ${text.slice(0, 200)}` : ''}` };
+        }
+        catch (e) {
+            if (isHubUnreachableError(e))
+                return { accepted: false, reason: 'hub_unreachable' };
+            return { accepted: false, reason: e instanceof Error ? e.message : String(e) };
+        }
+    }
+}
+/** Fan-out: always deliver to `primary` (local file record), then best-effort to `secondary` (hub upload).
+ *  The composite result reflects the PRIMARY sink — the local record is the durability guarantee. */
+export class TeeLearningPacketSink {
+    primary;
+    secondary;
+    constructor(primary, secondary) {
+        this.primary = primary;
+        this.secondary = secondary;
+    }
+    async submit(draft) {
+        const primary = await this.primary.submit(draft);
+        try {
+            await this.secondary.submit(draft);
+        }
+        catch { /* secondary is best-effort by contract; sinks should not throw, but never let one break the record */ }
+        return primary;
+    }
+}

package/dist/wireMap.d.ts

@@ -6,6 +6,8 @@ export declare function inboundToAgentEvent(m: Record<string, unknown>): hub.Age
  * payload.signals, #69)。text 不是 fetch 字段(自由文本走 semantic-search 端点, 见 hubCapability.search)。
  */
 export declare function searchQueryToFetchWire(q: hub.HubQuery): Record<string, unknown>;
+/** Free discovery phase on /a2a/fetch. Keep this separate from the paid/full fetch mapper. */
+export declare function searchQueryToSearchOnlyWire(q: hub.HubQuery): Record<string, unknown>;
 /** core AgentEvent(出站) → 公版 outbound 消息(id+type 必填). */
 export declare function agentEventToOutbound(e: hub.AgentEvent): Record<string, unknown>;
 /** Retry policy for a non-2xx hub status, shared by every money-touching caller (anti-drift, #177). */
@@ -25,4 +27,4 @@ export type AtpRetryClass = 'permanent' | 'cooldown' | 'recoverable';
  */
 export declare function atpRetryClass(status: number): AtpRetryClass;
 /** /a2a/publish 响应 → PublishReceipt. 200=accepted; 402/4xx=rejected 终态. */
-export declare function publishRespToReceipt(status: number, body: Record<string, unknown>): hub.PublishReceipt;
+export declare function publishRespToReceipt(status: number, body: Record<string, unknown>, retryAfterMs?: number): hub.PublishReceipt;

package/dist/wireMap.js

@@ -24,10 +24,16 @@ export function searchQueryToFetchWire(q) {
         out['category'] = q.category;
     if (q.gene)
         out['gene'] = q.gene;
+    if (q.domain)
+        out['domain'] = q.domain;
     if (q.limit !== undefined)
         out['limit'] = q.limit;
     return out;
 }
+/** Free discovery phase on /a2a/fetch. Keep this separate from the paid/full fetch mapper. */
+export function searchQueryToSearchOnlyWire(q) {
+    return { ...searchQueryToFetchWire(q), search_only: true };
+}
 /** core AgentEvent(出站) → 公版 outbound 消息(id+type 必填). */
 export function agentEventToOutbound(e) {
     return {
@@ -59,14 +65,20 @@ export function atpRetryClass(status) {
     return 'recoverable';
 }
 /** /a2a/publish 响应 → PublishReceipt. 200=accepted; 402/4xx=rejected 终态. */
-export function publishRespToReceipt(status, body) {
+export function publishRespToReceipt(status, body, retryAfterMs) {
     const payload = body['payload'] ?? body;
     const assetIds = payload['asset_ids'];
-    const assetId = payload['asset_id'] ?? body['asset_id'] ?? assetIds?.[0];
+    const targetAssetId = payload['target_asset_id']
+        ?? body['target_asset_id'];
+    const assetId = (status === 409 ? targetAssetId : undefined)
+        ?? payload['asset_id']
+        ?? body['asset_id']
+        ?? assetIds?.[0]
+        ?? targetAssetId;
     const bundleId = payload['bundle_id'];
     if (status >= 200 && status < 300) {
         const decision = String(payload['decision'] ?? payload['status'] ?? 'accepted');
-        const accepted = decision === 'accepted' || decision === 'approved' || decision === 'ok';
+        const accepted = decision === 'accept' || decision === 'accepted' || decision === 'approved' || decision === 'ok';
         return {
             receiptId: String(payload['receipt_id'] ?? bundleId ?? payload['id'] ?? assetId ?? 'unknown'),
             status: accepted ? 'accepted' : (decision === 'quarantine' ? 'quarantine' : 'rejected'),
@@ -80,12 +92,26 @@ export function publishRespToReceipt(status, body) {
     // M8-1: 按语义而非纯状态码区分(都终态不重试 = money-safety: 不反复打经济端点).
     // 402=creditShortage(余额不足) / 403=node 失效需 rebind / 409=duplicate / 422=payload 须修 / 429=cooldown.
     const reasonByStatus = { 402: 'credit_shortage', 403: 'node_unauthorized', 409: 'duplicate', 422: 'invalid_payload', 429: 'cooldown' };
+    const rejectionCodeByStatus = {
+        400: 'invalid_request',
+        402: 'credit_shortage',
+        403: 'node_unauthorized',
+        404: 'not_found',
+        409: 'duplicate',
+        422: 'invalid_payload',
+        429: 'cooldown',
+    };
     const receipt = {
         receiptId: String(payload['receipt_id'] ?? 'rejected'),
         status: 'rejected',
         reason: String(payload['reason'] ?? reasonByStatus[status] ?? `hub ${status}`),
         ...(assetId ? { assetId } : {}),
+        ...(assetIds ? { assetIds } : {}),
         terminal: true,
+        rejection: {
+            code: rejectionCodeByStatus[status] ?? 'hub_rejected',
+            ...(retryAfterMs !== undefined ? { retryAfterMs } : {}),
+        },
     };
     if (status === 402) {
         receipt.economic = {

package/package.json

@@ -1,8 +1,11 @@
 {
   "name": "@evomap/evolver-adapter-public",
-  "version": "2.0.0-beta.2",
+  "version": "2.0.0-beta.22",
   "private": false,
   "type": "module",
+  "engines": {
+    "node": "^22.13.0 || >=23.4.0"
+  },
   "description": "公版 hub 适配器 (积分/治理)",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -14,12 +17,16 @@
   },
   "dependencies": {
     "@evomap/atp-sdk": "^0.1.0",
-    "@evomap/evolver-core": "2.0.0-beta.2",
+    "@evomap/evolver-core": "2.0.0-beta.22",
     "undici": "^6.27.0"
   },
   "optionalDependencies": {
     "@napi-rs/keyring": "^1.1.6"
   },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/EvoMap/evolver.git"
+  },
   "publishConfig": {
     "access": "public",
     "tag": "v2-beta"