@openpond/evals 0.7.0 → 0.7.2

package/dist/learning/authoring-service.js

@@ -0,0 +1,49 @@
+import { assertBoundedTaskJson } from "../task-schema.js";
+import { AuthoringDraftSchema } from "./authoring.js";
+import { LearningDomainError } from "./errors.js";
+import { learningRef, sameLearningRef, sealLearningContent } from "./contracts.js";
+import { requireLearningRelease } from "./repository.js";
+export async function saveAuthoringDraft(tx, input, now) {
+    // A 100-record page remains below the common 16 MiB response limit.
+    assertBoundedTaskJson(input.draft, 131_072);
+    const previous = await tx.get("draft", input.draft.id);
+    if (previous && (previous.status !== "draft" || previous.targetId !== input.draft.targetId || previous.targetKind !== input.draft.targetKind || (previous.baseRelease === null ? input.draft.baseRelease !== null : input.draft.baseRelease === null || !sameLearningRef(previous.baseRelease, input.draft.baseRelease))))
+        throw new LearningDomainError("authoring_draft_identity_conflict", 409);
+    if (input.draft.baseRelease) {
+        if (input.draft.baseRelease.id !== input.draft.targetId)
+            throw new LearningDomainError("authoring_draft_base_mismatch", 422);
+        await requireLearningRelease(tx, input.draft.targetKind, input.draft.baseRelease);
+    }
+    const draft = AuthoringDraftSchema.parse(sealLearningContent({ ...input.draft, schemaVersion: "openpond.authoringDraft.v1", revision: input.expectedRevision + 1, status: "draft", publishedRelease: null, createdAt: previous?.createdAt ?? now, updatedAt: now }));
+    await tx.put("draft", draft, input.expectedRevision, { parentId: draft.targetKind, status: draft.status });
+    return { kind: "draft", id: draft.id, revision: draft.revision };
+}
+export async function archiveAuthoringDraft(tx, ref, now) {
+    const draft = await currentDraft(tx, ref);
+    const { contentHash: _hash, ...content } = draft;
+    const archived = AuthoringDraftSchema.parse(sealLearningContent({ ...content, revision: draft.revision + 1, status: "archived", updatedAt: now }));
+    await tx.put("draft", archived, draft.revision, { parentId: draft.targetKind, status: archived.status });
+    return { kind: "draft", id: archived.id, revision: archived.revision };
+}
+export async function finalizeAuthoringDraft(tx, input, published, now) {
+    const finalization = input.finalizeDraft;
+    if (!finalization)
+        return null;
+    const draft = await currentDraft(tx, finalization.draft);
+    if (draft.targetKind !== finalization.targetKind || draft.targetId !== finalization.release.id || finalization.release.revision !== (draft.baseRelease?.revision ?? 0) + 1 || !published.some(value => value.kind === finalization.targetKind && value.id === finalization.release.id && value.revision === finalization.release.revision))
+        throw new LearningDomainError("authoring_draft_publication_mismatch", 422);
+    await requireLearningRelease(tx, finalization.targetKind, finalization.release);
+    const { contentHash: _hash, ...content } = draft;
+    const completed = AuthoringDraftSchema.parse(sealLearningContent({ ...content, revision: draft.revision + 1, status: "published", publishedRelease: finalization.release, updatedAt: now }));
+    await tx.put("draft", completed, draft.revision, { parentId: draft.targetKind, status: completed.status });
+    return { kind: "draft", id: completed.id, revision: completed.revision };
+}
+async function currentDraft(tx, ref) {
+    const draft = await requireLearningRelease(tx, "draft", ref);
+    const current = await tx.get("draft", ref.id);
+    if (!current || !sameLearningRef(learningRef(current), ref))
+        throw new LearningDomainError("authoring_draft_revision_stale", 409);
+    if (draft.status !== "draft")
+        throw new LearningDomainError("authoring_draft_closed", 409);
+    return draft;
+}

package/dist/learning/authoring.js

@@ -0,0 +1,37 @@
+import { z } from "zod";
+import { ReleaseHashSchema, ReleaseIdSchema, ReleaseTimestampSchema } from "@openpond/harness";
+import { RewardBindingSourceSchema, RewardReleaseRefSchema } from "../rewards.js";
+import { LearningRevisionRefSchema } from "./contracts.js";
+/** Strings intentionally preserve incomplete JSON/code until explicit publication. */
+export const RewardAuthoringFieldsSchema = z.object({
+    name: z.string().max(500), description: z.string().max(10_000),
+    kind: z.enum(["custom_verifier", "state", "content", "schema", "artifact", "runtime_event", "model_judge", "learned_model", "human"]),
+    fields: z.string(), outputField: z.string(), expectedField: z.string(), expectedValue: z.string(),
+    schema: z.string(), reference: z.string(), events: z.string(), code: z.string(), exportName: z.string(), timeout: z.string(),
+    rubric: z.string(), providerId: z.string(), modelId: z.string(), modelRevision: z.string(), temperature: z.string(),
+    reviewerRole: z.string(), learnedId: z.string(), learnedHash: z.string(), inputContract: z.string(), minimum: z.string(), maximum: z.string(),
+}).strict();
+export const TaskFormatAuthoringFieldsSchema = z.object({
+    name: z.string().max(500), description: z.string().max(10_000), instructions: z.string().max(20_000),
+    input: z.string(), output: z.string(), familyNamespace: z.string(),
+    sources: z.array(RewardBindingSourceSchema).max(100), recipeRef: RewardReleaseRefSchema.optional(),
+}).strict();
+export const CombinedRewardAuthoringFieldsSchema = z.object({
+    name: z.string().max(500), description: z.string().max(10_000), sources: z.array(RewardBindingSourceSchema).max(100),
+}).strict();
+export const AuthoringTargetKindSchema = z.enum(["definition", "reward", "binding"]);
+const base = z.object({ id: ReleaseIdSchema, targetId: ReleaseIdSchema, baseRelease: LearningRevisionRefSchema.nullable(), editorVersion: z.literal("openpond.modelsEditor.v1") });
+export const AuthoringDraftInputSchema = z.discriminatedUnion("targetKind", [
+    base.extend({ targetKind: z.literal("definition"), fields: TaskFormatAuthoringFieldsSchema }).strict(),
+    base.extend({ targetKind: z.literal("reward"), fields: RewardAuthoringFieldsSchema }).strict(),
+    base.extend({ targetKind: z.literal("binding"), fields: CombinedRewardAuthoringFieldsSchema }).strict(),
+]);
+const history = {
+    schemaVersion: z.literal("openpond.authoringDraft.v1"), revision: z.number().int().positive(),
+    status: z.enum(["draft", "archived", "published"]), publishedRelease: LearningRevisionRefSchema.nullable(),
+    createdAt: ReleaseTimestampSchema, updatedAt: ReleaseTimestampSchema,
+};
+export const AuthoringDraftContentSchema = z.discriminatedUnion("targetKind", [AuthoringDraftInputSchema.options[0].extend(history).strict(), AuthoringDraftInputSchema.options[1].extend(history).strict(), AuthoringDraftInputSchema.options[2].extend(history).strict()]);
+export const AuthoringDraftSchema = z.discriminatedUnion("targetKind", [AuthoringDraftContentSchema.options[0].extend({ contentHash: ReleaseHashSchema }).strict(), AuthoringDraftContentSchema.options[1].extend({ contentHash: ReleaseHashSchema }).strict(), AuthoringDraftContentSchema.options[2].extend({ contentHash: ReleaseHashSchema }).strict()]);
+/** Exact draft and resulting release are finalized in the publication transaction. */
+export const AuthoringDraftFinalizationSchema = z.object({ draft: LearningRevisionRefSchema, targetKind: AuthoringTargetKindSchema, release: LearningRevisionRefSchema }).strict();

package/dist/learning/index.js

@@ -7,3 +7,4 @@ export * from "./service.js";
 export * from "./grade-worker.js";
 export * from "./transport.js";
 export * from "./errors.js";
+export * from "./authoring.js";

package/dist/learning/operations.js

@@ -2,9 +2,10 @@ import { z } from "zod";
 import { ReleaseIdSchema } from "@openpond/harness";
 import { LearningJsonObjectSchema, LearningRevisionRefSchema, LearningSourceContentSchema, TaskDefinitionContentSchema, TaskExampleSubmissionSchema, TaskFeedbackSubmissionSchema, LearningPolicyContentSchema } from "./contracts.js";
 import { RewardBindingContentSchema, RewardReleaseContentSchema } from "../rewards.js";
+import { AuthoringDraftInputSchema, AuthoringDraftFinalizationSchema } from "./authoring.js";
 import { LearningTextAssetContentSchema } from "./assets.js";
 const command = z.object({ operationId: ReleaseIdSchema });
-const publish = command.extend({ action: z.literal("publish"), expectedRevision: z.number().int().nonnegative() });
+const publish = command.extend({ action: z.literal("publish"), expectedRevision: z.number().int().nonnegative(), finalizeDraft: AuthoringDraftFinalizationSchema.optional() });
 export const PublishLearningResourceCommandSchema = z.discriminatedUnion("kind", [
     publish.extend({ kind: z.literal("asset"), content: LearningTextAssetContentSchema }).strict(),
     publish.extend({ kind: z.literal("definition"), content: TaskDefinitionContentSchema }).strict(),
@@ -15,7 +16,8 @@ export const PublishLearningResourceCommandSchema = z.discriminatedUnion("kind",
 ]);
 export const PublishLearningResourcesCommandSchema = command.extend({
     action: z.literal("publish_resources"),
-    resources: z.array(z.union(PublishLearningResourceCommandSchema.options.map((schema) => schema.omit({ operationId: true, action: true })))).min(1).max(20),
+    finalizeDraft: AuthoringDraftFinalizationSchema.optional(),
+    resources: z.array(z.union(PublishLearningResourceCommandSchema.options.map((schema) => schema.omit({ operationId: true, action: true, finalizeDraft: true })))).min(1).max(20),
 }).strict();
 export const SubmitTaskExampleCommandSchema = command.extend({ action: z.literal("submit_example"), example: TaskExampleSubmissionSchema }).strict();
 export const SubmitTaskFeedbackCommandSchema = command.extend({ action: z.literal("submit_feedback"), feedback: TaskFeedbackSubmissionSchema }).strict();
@@ -30,4 +32,6 @@ export const ReviewTaskEvidenceCommandSchema = command.extend({
 }).strict();
 export const SealTaskBatchCommandSchema = command.extend({ action: z.literal("seal_batch"), batchId: ReleaseIdSchema, taskDefinition: LearningRevisionRefSchema, purpose: z.enum(["supervised_training", "reward_training", "evaluation"]), evidence: z.array(LearningRevisionRefSchema).min(1).max(10_000), decisions: z.array(LearningRevisionRefSchema).min(1).max(10_000) }).strict();
 export const CancelTaskGradeCommandSchema = command.extend({ action: z.literal("cancel_grade"), gradeId: ReleaseIdSchema, expectedRevision: z.number().int().positive() }).strict();
-export const LearningCommandSchema = z.union([PublishLearningResourceCommandSchema, PublishLearningResourcesCommandSchema, SubmitTaskExampleCommandSchema, SubmitTaskFeedbackCommandSchema, ApplyTaskCorrectionCommandSchema, ResolveTaskFeedbackCommandSchema, QueueTaskGradeCommandSchema, ReviewTaskEvidenceCommandSchema, SealTaskBatchCommandSchema, CancelTaskGradeCommandSchema]);
+export const SaveAuthoringDraftCommandSchema = command.extend({ action: z.literal("save_draft"), expectedRevision: z.number().int().nonnegative(), draft: AuthoringDraftInputSchema }).strict();
+export const ArchiveAuthoringDraftCommandSchema = command.extend({ action: z.literal("archive_draft"), draft: LearningRevisionRefSchema }).strict();
+export const LearningCommandSchema = z.union([SaveAuthoringDraftCommandSchema, ArchiveAuthoringDraftCommandSchema, PublishLearningResourceCommandSchema, PublishLearningResourcesCommandSchema, SubmitTaskExampleCommandSchema, SubmitTaskFeedbackCommandSchema, ApplyTaskCorrectionCommandSchema, ResolveTaskFeedbackCommandSchema, QueueTaskGradeCommandSchema, ReviewTaskEvidenceCommandSchema, SealTaskBatchCommandSchema, CancelTaskGradeCommandSchema]);

package/dist/learning/repository.js

@@ -4,8 +4,10 @@ import { assertLearningContentHash, LearningSourceSchema, TaskAdmissionDecisionS
 import { RewardBindingSchema, RewardReleaseSchema } from "../rewards.js";
 import { TasksetReleaseSchema } from "../tasksets.js";
 import { LearningDomainError } from "./errors.js";
+import { AuthoringDraftSchema } from "./authoring.js";
 import { LearningTextAssetSchema } from "./assets.js";
 export const learningResourceSchemas = {
+    draft: AuthoringDraftSchema,
     asset: LearningTextAssetSchema,
     definition: TaskDefinitionSchema, reward: RewardReleaseSchema, binding: RewardBindingSchema,
     source: LearningSourceSchema, evidence: TaskEvidenceSchema, feedback: TaskFeedbackSchema,

package/dist/learning/service.js

@@ -1,3 +1,4 @@
+import { saveAuthoringDraft, archiveAuthoringDraft, finalizeAuthoringDraft } from "./authoring-service.js";
 import { LearningDomainError } from "./errors.js";
 import { contentHash } from "@openpond/harness";
 import { createRewardBinding, createRewardRelease, resolveBoundRewards } from "../rewards.js";
@@ -8,6 +9,7 @@ import { LearningCommandSchema } from "./operations.js";
 import { LearningConflictError, learningEvidenceId, learningOperationId, requireLearningRelease, requireLearningResource } from "./repository.js";
 import { validateSourceSubmission } from "./admission.js";
 import { LearningTextAssetSchema, verifyLearningTextAsset } from "./assets.js";
+import { LearningRevisionRefSchema } from "./contracts.js";
 export function createLearningService(repository, options = {}) {
     const now = options.now ?? (() => new Date().toISOString());
     async function command(context, raw) {
@@ -26,6 +28,12 @@ export function createLearningService(repository, options = {}) {
             }
             let pointers;
             switch (input.action) {
+                case "save_draft":
+                    pointers = [await saveAuthoringDraft(transaction, input, now())];
+                    break;
+                case "archive_draft":
+                    pointers = [await archiveAuthoringDraft(transaction, input.draft, now())];
+                    break;
                 case "publish":
                     pointers = [await publish(transaction, input)];
                     break;
@@ -60,6 +68,11 @@ export function createLearningService(repository, options = {}) {
                     pointers = await seal(transaction, input, context.actor.id);
                     break;
             }
+            if (input.action === "publish" || input.action === "publish_resources") {
+                const finalized = await finalizeAuthoringDraft(transaction, input, pointers, now());
+                if (finalized)
+                    pointers.push(finalized);
+            }
             await transaction.saveOperation(operationId, { requestHash, resources: pointers });
             return { operationId: input.operationId, resources: await Promise.all(pointers.map((pointer) => requireLearningResource(transaction, pointer.kind, pointer.id, pointer.revision))) };
         });
@@ -321,6 +334,15 @@ export function createLearningService(repository, options = {}) {
     }
     return {
         command,
+        async inspectEvidence(context, reference) {
+            authorizeRead(context);
+            const ref = LearningRevisionRefSchema.parse(reference);
+            return repository.transaction(context.scope, async (transaction) => {
+                const evidence = await requireLearningRelease(transaction, "evidence", ref);
+                const definition = await requireLearningRelease(transaction, "definition", evidence.submission.taskDefinition);
+                return { evidence: learningRef(evidence), definition: learningRef(definition), inspection: inspectTaskEvidence(evidence, definition) };
+            });
+        },
         async get(context, kind, id, revision) {
             authorizeRead(context);
             return repository.transaction(context.scope, (transaction) => requireLearningResource(transaction, kind, id, revision));

package/dist/learning/transport.js

@@ -4,6 +4,7 @@ import { LearningCommandSchema } from "./operations.js";
 import { LearningResourceKindSchema, learningResourceSchemas } from "./repository.js";
 import { assertBoundedTaskJson } from "../task-schema.js";
 import { LearningDomainError } from "./errors.js";
+import { LearningRevisionRefSchema } from "./contracts.js";
 /** Run before recursive schema parsing, including for non-TypeScript producers. */
 export function assertLearningRequestJson(raw) {
     try {
@@ -16,9 +17,18 @@ export function assertLearningRequestJson(raw) {
 /** Scope selection is never authorization; each host resolves its authenticated owner. */
 export const LearningCommandRequestSchema = z.object({ scope: ReleaseIdSchema, command: LearningCommandSchema }).strict();
 export const LearningReadRequestSchema = z.discriminatedUnion("action", [
+    z.object({ action: z.literal("inspect_evidence"), scope: ReleaseIdSchema, evidence: LearningRevisionRefSchema }).strict(),
     z.object({ action: z.literal("get"), scope: ReleaseIdSchema, kind: LearningResourceKindSchema, id: ReleaseIdSchema, revision: z.number().int().positive().optional() }).strict(),
     z.object({ action: z.literal("list"), scope: ReleaseIdSchema, kind: LearningResourceKindSchema, parentId: ReleaseIdSchema.optional(), status: z.string().min(1).max(200).optional(), afterId: ReleaseIdSchema.optional(), limit: z.number().int().min(1).max(100).default(50) }).strict(),
 ]);
+export const TaskEvidenceInspectionResultSchema = z.object({
+    evidence: LearningRevisionRefSchema,
+    definition: LearningRevisionRefSchema,
+    inspection: z.object({
+        evidenceValidity: z.enum(["valid", "invalid"]), taskReady: z.boolean(), observedOutputValid: z.boolean().nullable(),
+        issues: z.array(z.object({ path: z.string(), code: z.string(), message: z.string() }).strict()).max(100),
+    }).strict(),
+}).strict();
 export const LearningOperationResultSchema = z.object({
     operationId: ReleaseIdSchema,
     resources: z.array(z.union(Object.values(learningResourceSchemas))).max(100),

package/dist/task-schema-meta-validator.js

@@ -0,0 +1,2 @@
+// Generated by scripts/generate-task-schema-validator.ts. Do not edit.
+var E=(e,i)=>()=>{try{return i||e((i={exports:{}}).exports,i),i.exports}catch(m){throw i=0,m}};var C=E((z,N)=>{"use strict";N.exports=function e(i,m){if(i===m)return!0;if(i&&m&&typeof i=="object"&&typeof m=="object"){if(i.constructor!==m.constructor)return!1;var d,a,l;if(Array.isArray(i)){if(d=i.length,d!=m.length)return!1;for(a=d;a--!==0;)if(!e(i[a],m[a]))return!1;return!0}if(i.constructor===RegExp)return i.source===m.source&&i.flags===m.flags;if(i.valueOf!==Object.prototype.valueOf)return i.valueOf()===m.valueOf();if(i.toString!==Object.prototype.toString)return i.toString()===m.toString();if(l=Object.keys(i),d=l.length,d!==Object.keys(m).length)return!1;for(a=d;a--!==0;)if(!Object.prototype.hasOwnProperty.call(m,l[a]))return!1;for(a=d;a--!==0;){var t=l[a];if(!e(i[t],m[t]))return!1}return!0}return i!==i&&m!==m}});var S=E(j=>{"use strict";Object.defineProperty(j,"__esModule",{value:!0});var L=C();L.code='require("ajv/dist/runtime/equal").default';j.default=L});var G=p,H=p,T={$defs:{schemaMap:{type:"object",additionalProperties:{$ref:"#"}},schemaArray:{type:"array",items:{$ref:"#"},minItems:1,maxItems:32},stringArray:{type:"array",items:{type:"string"},uniqueItems:!0},natural:{type:"integer",minimum:0},schemaType:{enum:["array","boolean","integer","null","number","object","string"]}},type:["object","boolean"],additionalProperties:!1,properties:{$schema:{const:"https://json-schema.org/draft/2020-12/schema"},$ref:{type:"string"},$comment:{type:"string"},$defs:{$ref:"#/$defs/schemaMap"},properties:{$ref:"#/$defs/schemaMap"},dependentSchemas:{$ref:"#/$defs/schemaMap"},allOf:{$ref:"#/$defs/schemaArray"},anyOf:{$ref:"#/$defs/schemaArray"},oneOf:{$ref:"#/$defs/schemaArray"},prefixItems:{$ref:"#/$defs/schemaArray"},items:{$ref:"#"},additionalProperties:{$ref:"#"},not:{$ref:"#"},if:{$ref:"#"},then:{$ref:"#"},else:{$ref:"#"},contains:{$ref:"#"},unevaluatedProperties:{$ref:"#"},unevaluatedItems:{$ref:"#"},propertyNames:{$ref:"#"},type:{anyOf:[{$ref:"#/$defs/schemaType"},{type:"array",items:{$ref:"#/$defs/schemaType"},minItems:1,uniqueItems:!0}]},enum:{type:"array",minItems:1},const:!0,default:!0,title:{type:"string"},description:{type:"string"},examples:{type:"array"},readOnly:{type:"boolean"},writeOnly:{type:"boolean"},deprecated:{type:"boolean"},multipleOf:{type:"number",exclusiveMinimum:0},maximum:{type:"number"},exclusiveMaximum:{type:"number"},minimum:{type:"number"},exclusiveMinimum:{type:"number"},maxLength:{$ref:"#/$defs/natural"},minLength:{$ref:"#/$defs/natural"},maxItems:{$ref:"#/$defs/natural"},minItems:{$ref:"#/$defs/natural"},maxContains:{$ref:"#/$defs/natural"},minContains:{$ref:"#/$defs/natural"},maxProperties:{$ref:"#/$defs/natural"},minProperties:{$ref:"#/$defs/natural"},uniqueItems:{type:"boolean"},required:{$ref:"#/$defs/stringArray"},dependentRequired:{type:"object",additionalProperties:{$ref:"#/$defs/stringArray"}},contentEncoding:{type:"string"},contentMediaType:{type:"string"}}},F=Object.prototype.hasOwnProperty,R=S().default;var o={validate:p};function h(e,{instancePath:i="",parentData:m,parentDataProperty:d,rootData:a=e,dynamicAnchors:l={}}={}){let t=null,r=0,f=h.evaluated;if(f.dynamicProps&&(f.props=void 0),f.dynamicItems&&(f.items=void 0),r===0)if(e&&typeof e=="object"&&!Array.isArray(e))for(let g in e){let y=r;o.validate(e[g],{instancePath:i+"/"+g.replace(/~/g,"~0").replace(/\//g,"~1"),parentData:e,parentDataProperty:g,rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=y===r;if(!n)break}else return h.errors=[{instancePath:i,schemaPath:"#/type",keyword:"type",params:{type:"object"}}],!1;return h.errors=t,r===0}h.evaluated={props:!0,dynamicProps:!1,dynamicItems:!1};function v(e,{instancePath:i="",parentData:m,parentDataProperty:d,rootData:a=e,dynamicAnchors:l={}}={}){let t=null,r=0,f=v.evaluated;if(f.dynamicProps&&(f.props=void 0),f.dynamicItems&&(f.items=void 0),r===0)if(Array.isArray(e)){if(e.length>32)return v.errors=[{instancePath:i,schemaPath:"#/maxItems",keyword:"maxItems",params:{limit:32}}],!1;if(e.length<1)return v.errors=[{instancePath:i,schemaPath:"#/minItems",keyword:"minItems",params:{limit:1}}],!1;{var n=!0;let g=e.length;for(let y=0;y<g;y++){let b=r;o.validate(e[y],{instancePath:i+"/"+y,parentData:e,parentDataProperty:y,rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=b===r;if(!n)break}}}else return v.errors=[{instancePath:i,schemaPath:"#/type",keyword:"type",params:{type:"array"}}],!1;return v.errors=t,r===0}v.evaluated={items:!0,dynamicProps:!1,dynamicItems:!1};var A={enum:["array","boolean","integer","null","number","object","string"]};function I(e,{instancePath:i="",parentData:m,parentDataProperty:d,rootData:a=e,dynamicAnchors:l={}}={}){let t=null,r=0,f=I.evaluated;return f.dynamicProps&&(f.props=void 0),f.dynamicItems&&(f.items=void 0),e==="array"||e==="boolean"||e==="integer"||e==="null"||e==="number"||e==="object"||e==="string"?(I.errors=t,r===0):(I.errors=[{instancePath:i,schemaPath:"#/enum",keyword:"enum",params:{allowedValues:A.enum}}],!1)}I.evaluated={dynamicProps:!1,dynamicItems:!1};function u(e,{instancePath:i="",parentData:m,parentDataProperty:d,rootData:a=e,dynamicAnchors:l={}}={}){let t=null,r=0,f=u.evaluated;return f.dynamicProps&&(f.props=void 0),f.dynamicItems&&(f.items=void 0),typeof e=="number"&&!(e%1)&&!isNaN(e)&&isFinite(e)?r===0&&typeof e=="number"&&isFinite(e)&&(e<0||isNaN(e))?(u.errors=[{instancePath:i,schemaPath:"#/minimum",keyword:"minimum",params:{comparison:">=",limit:0}}],!1):(u.errors=t,r===0):(u.errors=[{instancePath:i,schemaPath:"#/type",keyword:"type",params:{type:"integer"}}],!1)}u.evaluated={dynamicProps:!1,dynamicItems:!1};function P(e,{instancePath:i="",parentData:m,parentDataProperty:d,rootData:a=e,dynamicAnchors:l={}}={}){let t=null,r=0,f=P.evaluated;if(f.dynamicProps&&(f.props=void 0),f.dynamicItems&&(f.items=void 0),r===0)if(Array.isArray(e)){var n=!0;let g=e.length;for(let y=0;y<g;y++){let b=r;if(typeof e[y]!="string")return P.errors=[{instancePath:i+"/"+y,schemaPath:"#/items/type",keyword:"type",params:{type:"string"}}],!1;var n=b===r;if(!n)break}if(n){let y=e.length,b;if(y>1){let D={};for(;y--;){let s=e[y];if(typeof s=="string"){if(typeof D[s]=="number"){return b=D[s],P.errors=[{instancePath:i,schemaPath:"#/uniqueItems",keyword:"uniqueItems",params:{i:y,j:b}}],!1;break}D[s]=y}}}}}else return P.errors=[{instancePath:i,schemaPath:"#/type",keyword:"type",params:{type:"array"}}],!1;return P.errors=t,r===0}P.evaluated={items:!0,dynamicProps:!1,dynamicItems:!1};function p(e,{instancePath:i="",parentData:m,parentDataProperty:d,rootData:a=e,dynamicAnchors:l={}}={}){let t=null,r=0,f=p.evaluated;if(f.dynamicProps&&(f.props=void 0),f.dynamicItems&&(f.items=void 0),!(e&&typeof e=="object"&&!Array.isArray(e))&&typeof e!="boolean")return p.errors=[{instancePath:i,schemaPath:"#/type",keyword:"type",params:{type:T.type}}],!1;if(r===0&&e&&typeof e=="object"&&!Array.isArray(e)){let D=r;for(let s in e)if(!F.call(T.properties,s)){return p.errors=[{instancePath:i,schemaPath:"#/additionalProperties",keyword:"additionalProperties",params:{additionalProperty:s}}],!1;break}if(D===r){if(e.$schema!==void 0){let s=r;if(e.$schema!=="https://json-schema.org/draft/2020-12/schema")return p.errors=[{instancePath:i+"/$schema",schemaPath:"#/properties/%24schema/const",keyword:"const",params:{allowedValue:"https://json-schema.org/draft/2020-12/schema"}}],!1;var n=s===r}else var n=!0;if(n){if(e.$ref!==void 0){let s=r;if(typeof e.$ref!="string")return p.errors=[{instancePath:i+"/$ref",schemaPath:"#/properties/%24ref/type",keyword:"type",params:{type:"string"}}],!1;var n=s===r}else var n=!0;if(n){if(e.$comment!==void 0){let s=r;if(typeof e.$comment!="string")return p.errors=[{instancePath:i+"/$comment",schemaPath:"#/properties/%24comment/type",keyword:"type",params:{type:"string"}}],!1;var n=s===r}else var n=!0;if(n){if(e.$defs!==void 0){let s=r;h(e.$defs,{instancePath:i+"/$defs",parentData:e,parentDataProperty:"$defs",rootData:a,dynamicAnchors:l})||(t=t===null?h.errors:t.concat(h.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.properties!==void 0){let s=r;h(e.properties,{instancePath:i+"/properties",parentData:e,parentDataProperty:"properties",rootData:a,dynamicAnchors:l})||(t=t===null?h.errors:t.concat(h.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.dependentSchemas!==void 0){let s=r;h(e.dependentSchemas,{instancePath:i+"/dependentSchemas",parentData:e,parentDataProperty:"dependentSchemas",rootData:a,dynamicAnchors:l})||(t=t===null?h.errors:t.concat(h.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.allOf!==void 0){let s=r;v(e.allOf,{instancePath:i+"/allOf",parentData:e,parentDataProperty:"allOf",rootData:a,dynamicAnchors:l})||(t=t===null?v.errors:t.concat(v.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.anyOf!==void 0){let s=r;v(e.anyOf,{instancePath:i+"/anyOf",parentData:e,parentDataProperty:"anyOf",rootData:a,dynamicAnchors:l})||(t=t===null?v.errors:t.concat(v.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.oneOf!==void 0){let s=r;v(e.oneOf,{instancePath:i+"/oneOf",parentData:e,parentDataProperty:"oneOf",rootData:a,dynamicAnchors:l})||(t=t===null?v.errors:t.concat(v.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.prefixItems!==void 0){let s=r;v(e.prefixItems,{instancePath:i+"/prefixItems",parentData:e,parentDataProperty:"prefixItems",rootData:a,dynamicAnchors:l})||(t=t===null?v.errors:t.concat(v.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.items!==void 0){let s=r;o.validate(e.items,{instancePath:i+"/items",parentData:e,parentDataProperty:"items",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.additionalProperties!==void 0){let s=r;o.validate(e.additionalProperties,{instancePath:i+"/additionalProperties",parentData:e,parentDataProperty:"additionalProperties",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.not!==void 0){let s=r;o.validate(e.not,{instancePath:i+"/not",parentData:e,parentDataProperty:"not",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.if!==void 0){let s=r;o.validate(e.if,{instancePath:i+"/if",parentData:e,parentDataProperty:"if",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.then!==void 0){let s=r;o.validate(e.then,{instancePath:i+"/then",parentData:e,parentDataProperty:"then",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.else!==void 0){let s=r;o.validate(e.else,{instancePath:i+"/else",parentData:e,parentDataProperty:"else",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.contains!==void 0){let s=r;o.validate(e.contains,{instancePath:i+"/contains",parentData:e,parentDataProperty:"contains",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.unevaluatedProperties!==void 0){let s=r;o.validate(e.unevaluatedProperties,{instancePath:i+"/unevaluatedProperties",parentData:e,parentDataProperty:"unevaluatedProperties",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.unevaluatedItems!==void 0){let s=r;o.validate(e.unevaluatedItems,{instancePath:i+"/unevaluatedItems",parentData:e,parentDataProperty:"unevaluatedItems",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.propertyNames!==void 0){let s=r;o.validate(e.propertyNames,{instancePath:i+"/propertyNames",parentData:e,parentDataProperty:"propertyNames",rootData:a,dynamicAnchors:l})||(t=t===null?o.validate.errors:t.concat(o.validate.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.type!==void 0){let s=e.type,c=r,w=r,_=!1,k=r;I(s,{instancePath:i+"/type",parentData:e,parentDataProperty:"type",rootData:a,dynamicAnchors:l})||(t=t===null?I.errors:t.concat(I.errors),r=t.length);var y=k===r;_=_||y;let q=r;if(r===q)if(Array.isArray(s))if(s.length<1){let x={instancePath:i+"/type",schemaPath:"#/properties/type/anyOf/1/minItems",keyword:"minItems",params:{limit:1}};t===null?t=[x]:t.push(x),r++}else{var g=!0;let x=s.length;for(let $=0;$<x;$++){let O=r;I(s[$],{instancePath:i+"/type/"+$,parentData:s,parentDataProperty:$,rootData:a,dynamicAnchors:l})||(t=t===null?I.errors:t.concat(I.errors),r=t.length);var g=O===r;if(!g)break}if(g){let $=s.length,O;if($>1){e:for(;$--;)for(O=$;O--;)if(R(s[$],s[O])){let M={instancePath:i+"/type",schemaPath:"#/properties/type/anyOf/1/uniqueItems",keyword:"uniqueItems",params:{i:$,j:O}};t===null?t=[M]:t.push(M),r++;break e}}}}else{let x={instancePath:i+"/type",schemaPath:"#/properties/type/anyOf/1/type",keyword:"type",params:{type:"array"}};t===null?t=[x]:t.push(x),r++}var y=q===r;if(_=_||y,_)r=w,t!==null&&(w?t.length=w:t=null);else{let x={instancePath:i+"/type",schemaPath:"#/properties/type/anyOf",keyword:"anyOf",params:{}};return t===null?t=[x]:t.push(x),r++,p.errors=t,!1}var n=c===r}else var n=!0;if(n){if(e.enum!==void 0){let s=e.enum,c=r;if(r===c)if(Array.isArray(s)){if(s.length<1)return p.errors=[{instancePath:i+"/enum",schemaPath:"#/properties/enum/minItems",keyword:"minItems",params:{limit:1}}],!1}else return p.errors=[{instancePath:i+"/enum",schemaPath:"#/properties/enum/type",keyword:"type",params:{type:"array"}}],!1;var n=c===r}else var n=!0;if(n){if(e.title!==void 0){let s=r;if(typeof e.title!="string")return p.errors=[{instancePath:i+"/title",schemaPath:"#/properties/title/type",keyword:"type",params:{type:"string"}}],!1;var n=s===r}else var n=!0;if(n){if(e.description!==void 0){let s=r;if(typeof e.description!="string")return p.errors=[{instancePath:i+"/description",schemaPath:"#/properties/description/type",keyword:"type",params:{type:"string"}}],!1;var n=s===r}else var n=!0;if(n){if(e.examples!==void 0){let s=r;if(!Array.isArray(e.examples))return p.errors=[{instancePath:i+"/examples",schemaPath:"#/properties/examples/type",keyword:"type",params:{type:"array"}}],!1;var n=s===r}else var n=!0;if(n){if(e.readOnly!==void 0){let s=r;if(typeof e.readOnly!="boolean")return p.errors=[{instancePath:i+"/readOnly",schemaPath:"#/properties/readOnly/type",keyword:"type",params:{type:"boolean"}}],!1;var n=s===r}else var n=!0;if(n){if(e.writeOnly!==void 0){let s=r;if(typeof e.writeOnly!="boolean")return p.errors=[{instancePath:i+"/writeOnly",schemaPath:"#/properties/writeOnly/type",keyword:"type",params:{type:"boolean"}}],!1;var n=s===r}else var n=!0;if(n){if(e.deprecated!==void 0){let s=r;if(typeof e.deprecated!="boolean")return p.errors=[{instancePath:i+"/deprecated",schemaPath:"#/properties/deprecated/type",keyword:"type",params:{type:"boolean"}}],!1;var n=s===r}else var n=!0;if(n){if(e.multipleOf!==void 0){let s=e.multipleOf,c=r;if(r===c)if(typeof s=="number"&&isFinite(s)){if(s<=0||isNaN(s))return p.errors=[{instancePath:i+"/multipleOf",schemaPath:"#/properties/multipleOf/exclusiveMinimum",keyword:"exclusiveMinimum",params:{comparison:">",limit:0}}],!1}else return p.errors=[{instancePath:i+"/multipleOf",schemaPath:"#/properties/multipleOf/type",keyword:"type",params:{type:"number"}}],!1;var n=c===r}else var n=!0;if(n){if(e.maximum!==void 0){let s=e.maximum,c=r;if(!(typeof s=="number"&&isFinite(s)))return p.errors=[{instancePath:i+"/maximum",schemaPath:"#/properties/maximum/type",keyword:"type",params:{type:"number"}}],!1;var n=c===r}else var n=!0;if(n){if(e.exclusiveMaximum!==void 0){let s=e.exclusiveMaximum,c=r;if(!(typeof s=="number"&&isFinite(s)))return p.errors=[{instancePath:i+"/exclusiveMaximum",schemaPath:"#/properties/exclusiveMaximum/type",keyword:"type",params:{type:"number"}}],!1;var n=c===r}else var n=!0;if(n){if(e.minimum!==void 0){let s=e.minimum,c=r;if(!(typeof s=="number"&&isFinite(s)))return p.errors=[{instancePath:i+"/minimum",schemaPath:"#/properties/minimum/type",keyword:"type",params:{type:"number"}}],!1;var n=c===r}else var n=!0;if(n){if(e.exclusiveMinimum!==void 0){let s=e.exclusiveMinimum,c=r;if(!(typeof s=="number"&&isFinite(s)))return p.errors=[{instancePath:i+"/exclusiveMinimum",schemaPath:"#/properties/exclusiveMinimum/type",keyword:"type",params:{type:"number"}}],!1;var n=c===r}else var n=!0;if(n){if(e.maxLength!==void 0){let s=r;u(e.maxLength,{instancePath:i+"/maxLength",parentData:e,parentDataProperty:"maxLength",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.minLength!==void 0){let s=r;u(e.minLength,{instancePath:i+"/minLength",parentData:e,parentDataProperty:"minLength",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.maxItems!==void 0){let s=r;u(e.maxItems,{instancePath:i+"/maxItems",parentData:e,parentDataProperty:"maxItems",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.minItems!==void 0){let s=r;u(e.minItems,{instancePath:i+"/minItems",parentData:e,parentDataProperty:"minItems",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.maxContains!==void 0){let s=r;u(e.maxContains,{instancePath:i+"/maxContains",parentData:e,parentDataProperty:"maxContains",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.minContains!==void 0){let s=r;u(e.minContains,{instancePath:i+"/minContains",parentData:e,parentDataProperty:"minContains",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.maxProperties!==void 0){let s=r;u(e.maxProperties,{instancePath:i+"/maxProperties",parentData:e,parentDataProperty:"maxProperties",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.minProperties!==void 0){let s=r;u(e.minProperties,{instancePath:i+"/minProperties",parentData:e,parentDataProperty:"minProperties",rootData:a,dynamicAnchors:l})||(t=t===null?u.errors:t.concat(u.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.uniqueItems!==void 0){let s=r;if(typeof e.uniqueItems!="boolean")return p.errors=[{instancePath:i+"/uniqueItems",schemaPath:"#/properties/uniqueItems/type",keyword:"type",params:{type:"boolean"}}],!1;var n=s===r}else var n=!0;if(n){if(e.required!==void 0){let s=r;P(e.required,{instancePath:i+"/required",parentData:e,parentDataProperty:"required",rootData:a,dynamicAnchors:l})||(t=t===null?P.errors:t.concat(P.errors),r=t.length);var n=s===r}else var n=!0;if(n){if(e.dependentRequired!==void 0){let s=e.dependentRequired,c=r;if(r===c)if(s&&typeof s=="object"&&!Array.isArray(s))for(let _ in s){let k=r;P(s[_],{instancePath:i+"/dependentRequired/"+_.replace(/~/g,"~0").replace(/\//g,"~1"),parentData:s,parentDataProperty:_,rootData:a,dynamicAnchors:l})||(t=t===null?P.errors:t.concat(P.errors),r=t.length);var b=k===r;if(!b)break}else return p.errors=[{instancePath:i+"/dependentRequired",schemaPath:"#/properties/dependentRequired/type",keyword:"type",params:{type:"object"}}],!1;var n=c===r}else var n=!0;if(n){if(e.contentEncoding!==void 0){let s=r;if(typeof e.contentEncoding!="string")return p.errors=[{instancePath:i+"/contentEncoding",schemaPath:"#/properties/contentEncoding/type",keyword:"type",params:{type:"string"}}],!1;var n=s===r}else var n=!0;if(n)if(e.contentMediaType!==void 0){let s=r;if(typeof e.contentMediaType!="string")return p.errors=[{instancePath:i+"/contentMediaType",schemaPath:"#/properties/contentMediaType/type",keyword:"type",params:{type:"string"}}],!1;var n=s===r}else var n=!0}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}}return p.errors=t,r===0}p.evaluated={props:!0,dynamicProps:!1,dynamicItems:!1};export{H as default,G as validate};

package/dist/task-schema-validation.js

@@ -0,0 +1,113 @@
+import validateMetaSchema from "./task-schema-meta-validator.js";
+export const TASK_JSON_SCHEMA_DIALECT = "https://json-schema.org/draft/2020-12/schema";
+export const TASK_VALUE_MAX_BYTES = 1_048_576;
+export const TASK_SCHEMA_MAX_BYTES = 32_768;
+const schemaMaps = new Set(["properties", "$defs", "dependentSchemas"]);
+const schemaArrays = new Set(["allOf", "anyOf", "oneOf", "prefixItems"]);
+const schemaChildren = new Set(["items", "additionalProperties", "not", "if", "then", "else", "contains", "unevaluatedProperties", "unevaluatedItems", "propertyNames"]);
+/** Bound producer-controlled JSON before hashing, schema compilation or validation. */
+export function assertBoundedTaskJson(value, maxBytes = TASK_VALUE_MAX_BYTES) {
+    const pending = [{ value, depth: 0 }];
+    const seen = new Set();
+    let nodes = 0;
+    while (pending.length) {
+        const item = pending.pop();
+        if (item.exit) {
+            seen.delete(item.value);
+            continue;
+        }
+        if (++nodes > 100_000 || item.depth > 48)
+            throw new Error("task_json_complexity_exceeded");
+        if (item.value === null || typeof item.value === "string" || typeof item.value === "boolean")
+            continue;
+        if (typeof item.value === "number" && Number.isFinite(item.value))
+            continue;
+        if (typeof item.value !== "object")
+            throw new Error("task_json_value_invalid");
+        if (seen.has(item.value))
+            throw new Error("task_json_cycle");
+        seen.add(item.value);
+        pending.push({ ...item, exit: true });
+        const prototype = Object.getPrototypeOf(item.value);
+        if (!Array.isArray(item.value) && prototype !== Object.prototype && prototype !== null)
+            throw new Error("task_json_object_invalid");
+        if (Object.getOwnPropertySymbols(item.value).length)
+            throw new Error("task_json_symbol_invalid");
+        if (Object.hasOwn(item.value, "toJSON"))
+            throw new Error("task_json_serializer_invalid");
+        if (Array.isArray(item.value) && (item.value.length > 10_000 || Object.keys(item.value).length !== item.value.length))
+            throw new Error("task_json_array_invalid");
+        for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(item.value))) {
+            if (descriptor.get || descriptor.set)
+                throw new Error("task_json_accessor_invalid");
+            if (Array.isArray(item.value) && key !== "length" && (!/^(0|[1-9]\d*)$/u.test(key) || Number(key) >= item.value.length))
+                throw new Error("task_json_array_invalid");
+            if (descriptor.enumerable)
+                pending.push({ value: descriptor.value, depth: item.depth + 1 });
+        }
+    }
+    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > maxBytes)
+        throw new Error("task_json_size_exceeded");
+}
+/** No remote resolution, custom code, data mutation, regex or format plugins. */
+export function validateTaskSchema(schema) {
+    try {
+        assertTaskSchema(schema);
+        return { valid: true, issues: [] };
+    }
+    catch (error) {
+        return { valid: false, issues: [{ path: "", code: "task_schema_invalid", message: error instanceof Error ? error.message : "Task schema is invalid." }] };
+    }
+}
+export function assertTaskSchema(schema) {
+    assertBoundedTaskJson(schema, TASK_SCHEMA_MAX_BYTES);
+    inspectSchema(schema, schema, new Set(), 0, { remaining: 2_048 });
+    if (!validateMetaSchema(schema)) {
+        const error = validateMetaSchema.errors?.[0];
+        throw new Error(`Task schema ${error?.instancePath || "/"} violates ${error?.keyword ?? "schema"}.`);
+    }
+}
+function inspectSchema(value, root, ancestors, depth, budget) {
+    if (--budget.remaining < 0)
+        throw new Error("Task schema reference expansion exceeds the validation budget.");
+    if (typeof value === "boolean")
+        return;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("A task schema must be an object or boolean.");
+    if (depth > 24 || ancestors.has(value))
+        throw new Error("Recursive or deeply nested task schemas are not supported.");
+    const next = new Set(ancestors).add(value);
+    const schema = value;
+    if (schema.$schema !== undefined && schema.$schema !== TASK_JSON_SCHEMA_DIALECT)
+        throw new Error(`Task schemas must use ${TASK_JSON_SCHEMA_DIALECT}.`);
+    for (const [key, child] of Object.entries(schema)) {
+        if (key === "$ref") {
+            if (typeof child !== "string" || !child.startsWith("#/$defs/"))
+                throw new Error("Task schema references must be local JSON pointers into $defs.");
+            let target = root;
+            for (const segment of child.slice(2).split("/")) {
+                if (/~(?![01])/u.test(segment))
+                    throw new Error("Invalid task schema JSON pointer.");
+                const decoded = segment.replaceAll("~1", "/").replaceAll("~0", "~");
+                if (!target || typeof target !== "object" || !Object.hasOwn(target, decoded))
+                    throw new Error(`Task schema reference ${child} is missing.`);
+                target = target[decoded];
+            }
+            inspectSchema(target, root, next, depth + 1, budget);
+        }
+        else if (schemaMaps.has(key)) {
+            if (!child || typeof child !== "object" || Array.isArray(child))
+                throw new Error(`Invalid schema map ${key}.`);
+            for (const entry of Object.values(child))
+                inspectSchema(entry, root, next, depth + 1, budget);
+        }
+        else if (schemaArrays.has(key)) {
+            if (!Array.isArray(child) || child.length > 32)
+                throw new Error(`Schema ${key} must contain at most 32 alternatives.`);
+            for (const entry of child)
+                inspectSchema(entry, root, next, depth + 1, budget);
+        }
+        else if (schemaChildren.has(key))
+            inspectSchema(child, root, next, depth + 1, budget);
+    }
+}

package/dist/task-schema.js

@@ -1,142 +1,4 @@
-import { Ajv2020 } from "ajv/dist/2020.js";
-import { contentHash } from "@openpond/harness";
-export const TASK_JSON_SCHEMA_DIALECT = "https://json-schema.org/draft/2020-12/schema";
-export const TASK_VALUE_MAX_BYTES = 1_048_576;
-export const TASK_SCHEMA_MAX_BYTES = 32_768;
-const validators = new Map();
-const schemaMaps = new Set(["properties", "$defs", "dependentSchemas"]);
-const schemaArrays = new Set(["allOf", "anyOf", "oneOf", "prefixItems"]);
-const schemaChildren = new Set(["items", "additionalProperties", "not", "if", "then", "else", "contains", "unevaluatedProperties", "unevaluatedItems", "propertyNames"]);
-const unsupported = new Set(["pattern", "patternProperties", "format", "$id", "$anchor", "$dynamicAnchor", "$dynamicRef", "$recursiveRef", "$recursiveAnchor", "$async", "$data", "contentSchema"]);
-/** Bound producer-controlled JSON before hashing, schema compilation or validation. */
-export function assertBoundedTaskJson(value, maxBytes = TASK_VALUE_MAX_BYTES) {
-    const pending = [{ value, depth: 0 }];
-    const seen = new Set();
-    let nodes = 0;
-    while (pending.length) {
-        const item = pending.pop();
-        if (item.exit) {
-            seen.delete(item.value);
-            continue;
-        }
-        if (++nodes > 100_000 || item.depth > 48)
-            throw new Error("task_json_complexity_exceeded");
-        if (item.value === null || typeof item.value === "string" || typeof item.value === "boolean")
-            continue;
-        if (typeof item.value === "number" && Number.isFinite(item.value))
-            continue;
-        if (typeof item.value !== "object")
-            throw new Error("task_json_value_invalid");
-        if (seen.has(item.value))
-            throw new Error("task_json_cycle");
-        seen.add(item.value);
-        pending.push({ ...item, exit: true });
-        const prototype = Object.getPrototypeOf(item.value);
-        if (!Array.isArray(item.value) && prototype !== Object.prototype && prototype !== null)
-            throw new Error("task_json_object_invalid");
-        if (Object.getOwnPropertySymbols(item.value).length)
-            throw new Error("task_json_symbol_invalid");
-        if (Object.hasOwn(item.value, "toJSON"))
-            throw new Error("task_json_serializer_invalid");
-        if (Array.isArray(item.value) && (item.value.length > 10_000 || Object.keys(item.value).length !== item.value.length))
-            throw new Error("task_json_array_invalid");
-        for (const [key, descriptor] of Object.entries(Object.getOwnPropertyDescriptors(item.value))) {
-            if (descriptor.get || descriptor.set)
-                throw new Error("task_json_accessor_invalid");
-            if (Array.isArray(item.value) && key !== "length" && (!/^(0|[1-9]\d*)$/u.test(key) || Number(key) >= item.value.length))
-                throw new Error("task_json_array_invalid");
-            if (descriptor.enumerable)
-                pending.push({ value: descriptor.value, depth: item.depth + 1 });
-        }
-    }
-    if (new TextEncoder().encode(JSON.stringify(value)).byteLength > maxBytes)
-        throw new Error("task_json_size_exceeded");
-}
-/** No remote resolution, custom code, data mutation, regex or format plugins. */
-export function validateTaskSchema(schema) {
-    try {
-        validator(schema);
-        return { valid: true, issues: [] };
-    }
-    catch (error) {
-        return { valid: false, issues: [{ path: "", code: "task_schema_invalid", message: error instanceof Error ? error.message : "Task schema is invalid." }] };
-    }
-}
-export function validateTaskValue(schema, value) {
-    try {
-        assertBoundedTaskJson(value);
-        const validate = validator(schema);
-        const valid = validate(value);
-        return {
-            valid,
-            issues: valid ? [] : (validate.errors ?? []).slice(0, 20).map((error) => ({
-                path: error.instancePath,
-                code: error.keyword,
-                message: error.message ?? "Value does not match the task schema.",
-            })),
-        };
-    }
-    catch (error) {
-        return { valid: false, issues: [{ path: "", code: "task_validation_unavailable", message: error instanceof Error ? error.message : "Task validation failed." }] };
-    }
-}
-function validator(schema) {
-    assertBoundedTaskJson(schema, TASK_SCHEMA_MAX_BYTES);
-    inspectSchema(schema, schema, new Set(), 0, { remaining: 2_048 });
-    const hash = contentHash(schema);
-    const cached = validators.get(hash);
-    if (cached)
-        return cached;
-    const ajv = new Ajv2020({ allErrors: false, ownProperties: true, strict: true, strictTypes: false, strictTuples: false, strictRequired: false, validateFormats: false, inlineRefs: false, loopRequired: 32, loopEnum: 32 });
-    const compiled = ajv.compile(schema);
-    if (validators.size >= 64)
-        validators.delete(validators.keys().next().value);
-    validators.set(hash, compiled);
-    return compiled;
-}
-function inspectSchema(value, root, ancestors, depth, budget) {
-    if (--budget.remaining < 0)
-        throw new Error("Task schema reference expansion exceeds the validation budget.");
-    if (typeof value === "boolean")
-        return;
-    if (!value || typeof value !== "object" || Array.isArray(value))
-        throw new Error("A task schema must be an object or boolean.");
-    if (depth > 24 || ancestors.has(value))
-        throw new Error("Recursive or deeply nested task schemas are not supported.");
-    const next = new Set(ancestors).add(value);
-    const schema = value;
-    if (schema.$schema !== undefined && schema.$schema !== TASK_JSON_SCHEMA_DIALECT)
-        throw new Error(`Task schemas must use ${TASK_JSON_SCHEMA_DIALECT}.`);
-    for (const [key, child] of Object.entries(schema)) {
-        if (unsupported.has(key))
-            throw new Error(`Task schema keyword ${key} is not supported by the bounded validator.`);
-        if (key === "$ref") {
-            if (typeof child !== "string" || !child.startsWith("#/$defs/"))
-                throw new Error("Task schema references must be local JSON pointers into $defs.");
-            let target = root;
-            for (const segment of child.slice(2).split("/")) {
-                if (/~(?![01])/u.test(segment))
-                    throw new Error("Invalid task schema JSON pointer.");
-                const decoded = segment.replaceAll("~1", "/").replaceAll("~0", "~");
-                if (!target || typeof target !== "object" || !Object.hasOwn(target, decoded))
-                    throw new Error(`Task schema reference ${child} is missing.`);
-                target = target[decoded];
-            }
-            inspectSchema(target, root, next, depth + 1, budget);
-        }
-        else if (schemaMaps.has(key)) {
-            if (!child || typeof child !== "object" || Array.isArray(child))
-                throw new Error(`Invalid schema map ${key}.`);
-            for (const entry of Object.values(child))
-                inspectSchema(entry, root, next, depth + 1, budget);
-        }
-        else if (schemaArrays.has(key)) {
-            if (!Array.isArray(child) || child.length > 32)
-                throw new Error(`Schema ${key} must contain at most 32 alternatives.`);
-            for (const entry of child)
-                inspectSchema(entry, root, next, depth + 1, budget);
-        }
-        else if (schemaChildren.has(key))
-            inspectSchema(child, root, next, depth + 1, budget);
-    }
-}
+// Keep schema authoring separate from the execution owner's runtime compiler so
+// browsers importing portable contracts can omit compiler code entirely.
+export { TASK_JSON_SCHEMA_DIALECT, TASK_VALUE_MAX_BYTES, TASK_SCHEMA_MAX_BYTES, assertBoundedTaskJson, validateTaskSchema, } from "./task-schema-validation.js";
+export { validateTaskValue } from "./task-value-validator.js";

package/dist/task-value-validator.js

@@ -0,0 +1,37 @@
+import { Ajv2020 } from "ajv/dist/2020.js";
+import { contentHash } from "@openpond/harness";
+import { assertBoundedTaskJson, assertTaskSchema } from "./task-schema-validation.js";
+const validators = new Map();
+export function validateTaskValue(schema, value) {
+    try {
+        assertBoundedTaskJson(value);
+        const validate = validator(schema);
+        const valid = validate(value);
+        return {
+            valid,
+            issues: valid ? [] : (validate.errors ?? []).slice(0, 20).map((error) => ({
+                path: error.instancePath,
+                code: error.keyword,
+                message: error.message ?? "Value does not match the task schema.",
+            })),
+        };
+    }
+    catch (error) {
+        return { valid: false, issues: [{ path: "", code: "task_validation_unavailable", message: error instanceof Error ? error.message : "Task validation failed." }] };
+    }
+}
+function validator(schema) {
+    assertTaskSchema(schema);
+    const hash = contentHash(schema);
+    const cached = validators.get(hash);
+    if (cached)
+        return cached;
+    // The precompiled meta-schema and bounded keyword profile are authoritative
+    // for schema validity. Ajv compiles values only on the execution owner.
+    const ajv = new Ajv2020({ allErrors: false, ownProperties: true, strict: true, strictSchema: false, strictTypes: false, strictTuples: false, strictRequired: false, validateFormats: false, validateSchema: false, inlineRefs: false, loopRequired: 32, loopEnum: 32 });
+    const compiled = ajv.compile(schema);
+    if (validators.size >= 64)
+        validators.delete(validators.keys().next().value);
+    validators.set(hash, compiled);
+    return compiled;
+}

package/dist/types/learning/authoring-service.d.ts

@@ -0,0 +1,25 @@
+import { type AuthoringDraftInput } from "./authoring.js";
+import { type LearningRevisionRef } from "./contracts.js";
+import { type LearningResourcePointer, type LearningTransaction } from "./repository.js";
+import type { LearningCommand } from "./operations.js";
+export declare function saveAuthoringDraft(tx: LearningTransaction, input: {
+    draft: AuthoringDraftInput;
+    expectedRevision: number;
+}, now: string): Promise<{
+    kind: "draft";
+    id: string;
+    revision: number;
+}>;
+export declare function archiveAuthoringDraft(tx: LearningTransaction, ref: LearningRevisionRef, now: string): Promise<{
+    kind: "draft";
+    id: string;
+    revision: number;
+}>;
+export declare function finalizeAuthoringDraft(tx: LearningTransaction, input: Extract<LearningCommand, {
+    action: "publish" | "publish_resources";
+}>, published: LearningResourcePointer[], now: string): Promise<{
+    kind: "draft";
+    id: string;
+    revision: number;
+} | null>;
+//# sourceMappingURL=authoring-service.d.ts.map

package/dist/types/learning/authoring-service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authoring-service.d.ts","sourceRoot":"","sources":["../../../../../src/learning/authoring-service.ts"],"names":[],"mappings":"AACA,OAAO,EAAwB,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAEhF,OAAO,EAAqD,KAAK,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AAC7G,OAAO,EAA0B,KAAK,uBAAuB,EAAE,KAAK,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACjH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvD,wBAAsB,kBAAkB,CAAC,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE;IAAE,KAAK,EAAE,mBAAmB,CAAC;IAAC,gBAAgB,EAAE,MAAM,CAAA;CAAE,EAAE,GAAG,EAAE,MAAM;;;;GAY7I;AAED,wBAAsB,qBAAqB,CAAC,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE,mBAAmB,EAAE,GAAG,EAAE,MAAM;;;;GAMzG;AAED,wBAAsB,sBAAsB,CAAC,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,OAAO,CAAC,eAAe,EAAE;IAAE,MAAM,EAAE,SAAS,GAAG,mBAAmB,CAAA;CAAE,CAAC,EAAE,SAAS,EAAE,uBAAuB,EAAE,EAAE,GAAG,EAAE,MAAM;;;;UAUpM"}