@oscharko-dev/keiko-server 0.2.0

package/dist/qualityIntelligence/uiRoutes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"uiRoutes.d.ts","sourceRoot":"","sources":["../../src/qualityIntelligence/uiRoutes.ts"],"names":[],"mappings":"AAgCA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC9D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAOhD,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,qBAAqB,MAAM,CAAC;AAoSzC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAkDpF;AAMD,wBAAgB,cAAc,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAmClF"}

package/dist/qualityIntelligence/uiRoutes.js

@@ -0,0 +1,336 @@
+// Quality Intelligence read-only UI BFF routes (Issue #280, Epic #270).
+//
+// Two additive HTTP handlers under `/api/quality-intelligence/runs*`:
+//   * GET /api/quality-intelligence/runs       — list run summaries
+//   * GET /api/quality-intelligence/runs/:id   — single run detail
+//
+// Hard constraints:
+//   * No raw prompts, model outputs, credentials, or unsafe markdown in responses.
+//   * Only refs, counts, and redacted summaries reach the browser.
+//   * Error JSON NEVER contains sensitive field values — only safe error codes.
+//   * No provider SDK imports; no outbound network calls from these handlers.
+//   * listQualityIntelligenceRuns / loadQualityIntelligenceRun are composed from
+//     keiko-evidence UNCHANGED (ADR-0023 D8).
+import { listQualityIntelligenceRuns, loadQualityIntelligenceRun, loadQualityIntelligenceCandidates, } from "@oscharko-dev/keiko-evidence";
+import { loadRunReviewState, candidateReviewStateOf, runReviewStateOf } from "./reviewStore.js";
+import { qiRunRegistry } from "./runRegistry.js";
+// Issue #646 — bound manifest loading on the run-list path. Default 100 keeps the local BFF
+// responsive on large evidence stores; the max cap of 500 mirrors the QI run-detail budget so
+// the UI cannot ask for an unbounded scan even with an explicit query parameter.
+export const QI_RUN_LIST_DEFAULT_LIMIT = 100;
+export const QI_RUN_LIST_MAX_LIMIT = 500;
+// ---------------------------------------------------------------------------
+// Evidence-dir resolution — mirrors the pattern from read-handlers.ts (no new logic)
+// ---------------------------------------------------------------------------
+function resolveEvidenceDir(deps) {
+    return deps.evidenceDir;
+}
+// ---------------------------------------------------------------------------
+// Projection helpers — build browser-safe wire shapes from manifest data.
+// NEVER include raw prompt, raw source content, credentials, or unsafe markdown.
+// ---------------------------------------------------------------------------
+function projectRunSummary(manifest, reviewState) {
+    if (manifest === undefined)
+        return null;
+    return {
+        id: manifest.runId,
+        status: manifest.status,
+        requestedAt: manifest.planAt,
+        completedAt: manifest.completedAt ?? null,
+        totals: {
+            candidates: manifest.totals.candidates,
+            findings: manifest.totals.findings,
+            exports: manifest.totals.exports,
+        },
+        reviewState,
+    };
+}
+// FIX A11y-2 (Issue #282) — resolve the run's overall review state for the list item so the hub list
+// can show a per-run lifecycle badge (AC1). Loads the small `.review.json` companion per listed run;
+// this is acceptable because the list path already loads a per-run manifest and the list is bounded
+// by the route limit. Defaults to "open" when no companion exists or no evidence dir is configured.
+function listReviewStateFor(runId, evidenceDir) {
+    if (evidenceDir === undefined)
+        return "open";
+    return runReviewStateOf(loadRunReviewState(runId, evidenceDir));
+}
+const CANDIDATE_TEXT_LIMITS = {
+    title: 240,
+    preconditions: 1_000,
+    steps: 1_000,
+    expectedResults: 1_000,
+    tags: 120,
+};
+const CANDIDATE_LIST_LIMITS = {
+    preconditions: 20,
+    steps: 50,
+    expectedResults: 50,
+    tags: 30,
+};
+function truncateTextForUi(value, limit) {
+    if (value.length <= limit)
+        return { value, truncated: false };
+    return { value: `${value.slice(0, Math.max(0, limit - 3))}...`, truncated: true };
+}
+function truncateListForUi(values, field) {
+    const maxItems = CANDIDATE_LIST_LIMITS[field];
+    const maxChars = CANDIDATE_TEXT_LIMITS[field];
+    const items = values.slice(0, maxItems);
+    let truncated = values.length > maxItems;
+    const projected = items.map((item) => {
+        const next = truncateTextForUi(item, maxChars);
+        if (next.truncated)
+            truncated = true;
+        return next.value;
+    });
+    return { value: projected, truncated };
+}
+function addTruncatedField(fields, field) {
+    if (!fields.includes(field))
+        fields.push(field);
+}
+/**
+ * Build a candidateId → weak-test flag map from the persisted test-quality findings (Epic #736).
+ * Only findings of kind "test-quality" that carry a candidateId contribute; the first finding wins
+ * per candidate (the judge emits at most one test-quality finding per candidate).
+ */
+function buildWeakTestFlags(manifest) {
+    const flags = new Map();
+    for (const f of manifest.findings) {
+        if (f.kind !== "test-quality" || f.candidateId === undefined)
+            continue;
+        if (flags.has(f.candidateId))
+            continue;
+        flags.set(f.candidateId, { severity: f.severity, rationale: f.summaryRedacted });
+    }
+    return flags;
+}
+function projectCandidate(row, reviewArtifact, weakTestFlags) {
+    const weakTestFlag = weakTestFlags.get(row.id);
+    const title = truncateTextForUi(row.title, CANDIDATE_TEXT_LIMITS.title);
+    const preconditions = truncateListForUi(row.preconditions, "preconditions");
+    const steps = truncateListForUi(row.steps, "steps");
+    const expectedResults = truncateListForUi(row.expectedResults, "expectedResults");
+    const tags = truncateListForUi(row.tags, "tags");
+    const qualityVerdict = row.qualityVerdict;
+    const truncatedFields = [];
+    if (title.truncated)
+        addTruncatedField(truncatedFields, "title");
+    if (preconditions.truncated)
+        addTruncatedField(truncatedFields, "preconditions");
+    if (steps.truncated)
+        addTruncatedField(truncatedFields, "steps");
+    if (expectedResults.truncated)
+        addTruncatedField(truncatedFields, "expectedResults");
+    if (tags.truncated)
+        addTruncatedField(truncatedFields, "tags");
+    const projected = {
+        id: row.id,
+        title: title.value,
+        preconditions: preconditions.value,
+        steps: steps.value,
+        expectedResults: expectedResults.value,
+        priority: row.priority,
+        riskClass: row.riskClass,
+        tags: tags.value,
+        status: row.status,
+        reviewState: candidateReviewStateOf(reviewArtifact, row.id),
+        derivedFromAtomIds: row.derivedFromAtomIds,
+        ...(qualityVerdict !== undefined ? { qualityVerdict } : {}),
+        ...(weakTestFlag !== undefined ? { weakTestFlag } : {}),
+        ...(truncatedFields.length > 0 ? { truncatedFields } : {}),
+    };
+    return projected;
+}
+function projectCoverageByAtom(manifest) {
+    if (manifest.coverageMatrix === undefined)
+        return Object.freeze([]);
+    return Object.freeze(manifest.coverageMatrix.map((row) => ({
+        atomId: row.atomId,
+        status: row.status,
+        confidence: row.confidence,
+        // Optional redacted excerpt (#790); absent on runs recorded before it existed.
+        ...(row.requirementExcerptRedacted !== undefined
+            ? { requirementExcerptRedacted: row.requirementExcerptRedacted }
+            : {}),
+    })));
+}
+function computeCoveragePercentage(coverageByAtom) {
+    if (coverageByAtom.length === 0)
+        return 0;
+    const covered = coverageByAtom.filter((r) => r.status === "covered").length;
+    return (covered / coverageByAtom.length) * 100;
+}
+function projectDriftMetadata(manifest, candidateRows) {
+    const sourceFingerprintCount = manifest.sourceFingerprints?.length ?? 0;
+    const atomFingerprintCount = manifest.atomFingerprints?.length ?? 0;
+    const supported = sourceFingerprintCount > 0 && candidateRows.length > 0;
+    return {
+        status: supported ? "not-checked" : "unavailable",
+        sourceFingerprintCount,
+        atomFingerprintCount,
+        reCheckSupported: supported,
+        regenerateStaleSupported: supported,
+    };
+}
+function projectRunDetail(inputs) {
+    const { manifest, candidateRows, reviewArtifact } = inputs;
+    const findingRefs = manifest.findings.map((f) => ({
+        id: f.id,
+        kind: f.kind,
+        severity: f.severity,
+        summaryRedacted: f.summaryRedacted,
+    }));
+    const weakTestFlags = buildWeakTestFlags(manifest);
+    const candidates = candidateRows.map((row) => projectCandidate(row, reviewArtifact, weakTestFlags));
+    const candidateIds = candidates.length > 0 ? candidates.map((c) => c.id) : [...manifest.provenanceRefs.envelopeIds];
+    const evidenceRefs = manifest.evidenceRefs.map((r) => ({
+        envelopeId: r.envelopeId,
+        atomId: r.atomId,
+    }));
+    const coverageByAtom = projectCoverageByAtom(manifest);
+    return {
+        id: manifest.runId,
+        status: manifest.status,
+        requestedAt: manifest.planAt,
+        completedAt: manifest.completedAt ?? null,
+        totals: {
+            candidates: manifest.totals.candidates,
+            findings: manifest.totals.findings,
+            exports: manifest.totals.exports,
+        },
+        findingRefs,
+        candidateIds,
+        candidates,
+        evidenceRefs,
+        reviewState: runReviewStateOf(reviewArtifact),
+        manifestSchemaVersion: manifest.qiEvidenceSchemaVersion,
+        coveragePercentage: computeCoveragePercentage(coverageByAtom),
+        coverageByAtom,
+        qualityScore: manifest.qualityScore ?? null,
+        drift: projectDriftMetadata(manifest, candidateRows),
+    };
+}
+function parseLimitParam(ctx) {
+    const raw = ctx.url.searchParams.get("limit");
+    if (raw === null) {
+        return { ok: true, limit: QI_RUN_LIST_DEFAULT_LIMIT };
+    }
+    // Strict integer parse: reject empty, leading zeros, signs, decimals, scientific notation,
+    // whitespace, NaN/Infinity. Anything that isn't a bare decimal positive integer 400s.
+    if (!/^[1-9]\d*$/.test(raw)) {
+        return {
+            ok: false,
+            response: {
+                status: 400,
+                body: { error: { code: "BAD_REQUEST", message: "limit must be a positive integer" } },
+            },
+        };
+    }
+    const value = Number(raw);
+    if (!Number.isInteger(value) || value < 1) {
+        return {
+            ok: false,
+            response: {
+                status: 400,
+                body: { error: { code: "BAD_REQUEST", message: "limit must be a positive integer" } },
+            },
+        };
+    }
+    return { ok: true, limit: Math.min(value, QI_RUN_LIST_MAX_LIMIT) };
+}
+export function handleListQiRuns(ctx, deps) {
+    const limitOutcome = parseLimitParam(ctx);
+    if (!limitOutcome.ok)
+        return limitOutcome.response;
+    const limit = limitOutcome.limit;
+    const evidenceDir = resolveEvidenceDir(deps);
+    try {
+        // In-flight runs (not yet persisted to evidence) appear first so a running run is visible
+        // immediately. Completed runs come from evidence (restart-safe).
+        const active = qiRunRegistry.listActiveSummaries();
+        const activeIds = new Set(active.map((r) => r.id));
+        const runIds = listQualityIntelligenceRuns({ evidenceDir }).filter((id) => !activeIds.has(id));
+        const totalRunIds = active.length + runIds.length;
+        const truncated = totalRunIds > limit;
+        const runs = [];
+        for (const summary of active) {
+            if (runs.length >= limit)
+                break;
+            runs.push(summary);
+        }
+        // Issue #646: stop iterating as soon as the bounded slice is full so we never load more
+        // manifests than the route promised. A single corrupt manifest still skips its slot, but
+        // we do NOT advance past `limit` to refill it — the goal is bounded work per request.
+        for (const id of runIds) {
+            if (runs.length >= limit)
+                break;
+            try {
+                const manifest = loadQualityIntelligenceRun(id, { evidenceDir });
+                const summary = projectRunSummary(manifest, listReviewStateFor(id, evidenceDir));
+                if (summary !== null)
+                    runs.push(summary);
+            }
+            catch {
+                // A single corrupt manifest must not prevent listing other runs: skip and continue. The
+                // store fails closed on a corrupt manifest (EvidenceReadError) so nothing unsafe is
+                // surfaced. Quarantine (`quarantineCorruptQualityIntelligenceManifest`) is a SEPARATE,
+                // explicitly-invoked maintenance step — it is intentionally NOT run from this read path
+                // (a GET must not rename files); its wiring is deferred with the retention orchestrator
+                // (Issue #274 follow-up).
+            }
+        }
+        const body = { runs, limit, totalRunIds, truncated };
+        return { status: 200, body };
+        // Static codes only — never echo OS fs error text (CWE-209).
+    }
+    catch {
+        return {
+            status: 500,
+            body: {
+                error: {
+                    code: "LIST_FAILED",
+                    message: "Failed to list Quality Intelligence runs",
+                },
+            },
+        };
+    }
+}
+// ---------------------------------------------------------------------------
+// GET /api/quality-intelligence/runs/:id
+// ---------------------------------------------------------------------------
+export function handleGetQiRun(ctx, deps) {
+    const { id } = ctx.params;
+    if (id === undefined || id.trim().length === 0) {
+        return { status: 400, body: { error: { code: "BAD_REQUEST", message: "Run id is required" } } };
+    }
+    const evidenceDir = resolveEvidenceDir(deps);
+    try {
+        const manifest = loadQualityIntelligenceRun(id, { evidenceDir });
+        if (manifest === undefined) {
+            return {
+                status: 404,
+                body: { error: { code: "NOT_FOUND", message: "Quality Intelligence run not found" } },
+            };
+        }
+        const candidatesArtifact = evidenceDir === undefined
+            ? undefined
+            : loadQualityIntelligenceCandidates(id, { evidenceDir });
+        const reviewArtifact = evidenceDir === undefined ? undefined : loadRunReviewState(id, evidenceDir);
+        const detail = projectRunDetail({
+            manifest,
+            candidateRows: candidatesArtifact?.candidates ?? [],
+            reviewArtifact,
+        });
+        return { status: 200, body: detail };
+        // Static codes only — never echo OS fs error text (CWE-209).
+    }
+    catch {
+        return {
+            status: 500,
+            body: {
+                error: { code: "INTERNAL", message: "Failed to load Quality Intelligence run" },
+            },
+        };
+    }
+}

package/dist/read-handlers.d.ts

@@ -0,0 +1,9 @@
+import type { RouteContext, RouteResult } from "./routes.js";
+import type { UiHandlerDeps } from "./deps.js";
+export declare function handleConfig(_ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleModels(_ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleWorkflows(): RouteResult;
+export declare function handleWorkspace(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleEvidenceList(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+export declare function handleEvidenceDetail(ctx: RouteContext, deps: UiHandlerDeps): RouteResult;
+//# sourceMappingURL=read-handlers.d.ts.map

package/dist/read-handlers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-handlers.d.ts","sourceRoot":"","sources":["../src/read-handlers.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAW/C,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAUjF;AAID,wBAAgB,YAAY,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAIjF;AAKD,wBAAgB,eAAe,IAAI,WAAW,CAyC7C;AAuID,wBAAgB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAUnF;AA+CD,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CAMtF;AAKD,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,WAAW,CA2BxF"}

package/dist/read-handlers.js

@@ -0,0 +1,265 @@
+// The six read-only BFF endpoints (ADR-0011 D5 routes 2,3,4,10,11,12). Each returns a redacted JSON
+// projection of already-safe data: config via `toSafeObject` (strips apiKey), configured model
+// capabilities, the workflow launch-form descriptors, the workspace summary built from the workspace
+// layer, and evidence list/detail served straight from the store (manifests are redacted-by-
+// construction on disk, served as-is per D9). No secret reaches any response; the config route
+// never leaks the config path even on a load failure (handled upstream in deps.ts, which yields
+// `config: undefined` rather than throwing).
+import { toSafeObject, listConfiguredCapabilities } from "@oscharko-dev/keiko-model-gateway";
+import { UNIT_TEST_WORKFLOW_DESCRIPTOR, BUG_INVESTIGATION_WORKFLOW_DESCRIPTOR, } from "@oscharko-dev/keiko-workflows";
+import { DEFAULT_LIMITS } from "@oscharko-dev/keiko-harness";
+import { listEvidence, loadEvidence, assertValidRunId, EvidenceReadError, EvidenceSchemaError, InvalidRunIdError, } from "@oscharko-dev/keiko-evidence";
+import { buildContextPackFromFiles, buildWorkspaceSummary, DEFAULT_CONTEXT_REQUEST, detectWorkspace, discoverWithStats, WORKSPACE_CODES, WorkspaceError, } from "@oscharko-dev/keiko-workspace";
+import { errorBody } from "./routes.js";
+import { currentGatewayConfig, currentGatewayConfigPresent, currentGroundingLimits, } from "./deps.js";
+import { validateProjectPath } from "./store/validation.js";
+// Route 2 — resolved config (SafeGatewayConfig, never apiKey/baseUrl) or null when no config was resolved.
+// effectiveGroundingLimits carries the runtime-resolved limits (file config + env) so the UI can
+// surface caps without a separate API call.
+export function handleConfig(_ctx, deps) {
+    const config = currentGatewayConfig(deps);
+    return {
+        status: 200,
+        body: {
+            config: config === undefined ? null : toSafeObject(config),
+            configPresent: currentGatewayConfigPresent(deps),
+            effectiveGroundingLimits: currentGroundingLimits(deps),
+        },
+    };
+}
+// Route 3 — models published by the resolved UI gateway config. If no config is resolved, no
+// model-backed run can start, so the endpoint returns an empty list.
+export function handleModels(_ctx, deps) {
+    const config = currentGatewayConfig(deps);
+    const models = config === undefined ? [] : listConfiguredCapabilities(config);
+    return { status: 200, body: { models } };
+}
+// Route 4 — launch-form metadata: the workflow descriptors plus the synthesized explain-plan and
+// verify inputs (both are harness tasks with no workflow descriptor — verify is BFF-only and runs
+// the deterministic verification orchestrator).
+export function handleWorkflows() {
+    return {
+        status: 200,
+        body: {
+            descriptors: [UNIT_TEST_WORKFLOW_DESCRIPTOR, BUG_INVESTIGATION_WORKFLOW_DESCRIPTOR],
+            explainPlan: {
+                inputs: [
+                    {
+                        name: "filePath",
+                        type: "string",
+                        required: true,
+                        description: "Path to the file to explain (read-only task).",
+                    },
+                    {
+                        name: "question",
+                        type: "string",
+                        required: false,
+                        description: "Optional focusing question for the explanation.",
+                    },
+                ],
+                defaultLimits: DEFAULT_LIMITS,
+            },
+            verify: {
+                inputs: [
+                    {
+                        name: "workspaceRoot",
+                        type: "string",
+                        required: true,
+                        description: "Project root to verify.",
+                    },
+                    {
+                        name: "targetFiles",
+                        type: "string[]",
+                        required: false,
+                        description: "Optional file subset to target tests for.",
+                    },
+                ],
+                defaultLimits: DEFAULT_LIMITS,
+            },
+        },
+    };
+}
+function parsePositiveBudget(value) {
+    if (value === null) {
+        return undefined;
+    }
+    if (!/^[1-9][0-9]*$/u.test(value)) {
+        throw new Error("invalid budget");
+    }
+    const parsed = Number.parseInt(value, 10);
+    if (!Number.isSafeInteger(parsed)) {
+        throw new Error("invalid budget");
+    }
+    return parsed;
+}
+function workspaceErrorResult(error) {
+    const status = error.code === WORKSPACE_CODES.NOT_FOUND
+        ? 404
+        : error.code === WORKSPACE_CODES.FILE_TOO_LARGE || error.code === WORKSPACE_CODES.READ_FAILED
+            ? 422
+            : 400;
+    return { status, body: errorBody(error.code, workspaceErrorMessage(error.code)) };
+}
+const WORKSPACE_ERROR_MESSAGES = {
+    [WORKSPACE_CODES.PATH_ESCAPE]: "The workspace path is outside the registered project.",
+    [WORKSPACE_CODES.PATH_DENIED]: "The workspace path is denied by policy.",
+    [WORKSPACE_CODES.NOT_FOUND]: "The workspace could not be found.",
+    [WORKSPACE_CODES.FILE_TOO_LARGE]: "The workspace file is too large.",
+    [WORKSPACE_CODES.READ_FAILED]: "The workspace could not be read.",
+    [WORKSPACE_CODES.REPO_SEARCH_INVALID_QUERY]: "The repository search query is invalid.",
+    [WORKSPACE_CODES.REPO_SEARCH_INVALID_RANGE]: "The repository search range or scope path is invalid.",
+    [WORKSPACE_CODES.REPO_SEARCH_UNSUPPORTED_FILE]: "The repository search does not support this file.",
+};
+function workspaceErrorMessage(code) {
+    return WORKSPACE_ERROR_MESSAGES[code];
+}
+function readWorkspaceRequest(q) {
+    let budget;
+    try {
+        budget = parsePositiveBudget(q.get("budget"));
+    }
+    catch {
+        return {
+            status: 400,
+            body: errorBody("BAD_REQUEST", "The budget query parameter must be a positive integer."),
+        };
+    }
+    const dir = q.get("dir");
+    if (dir === null) {
+        return {
+            status: 400,
+            body: errorBody("BAD_REQUEST", "The dir query parameter is required."),
+        };
+    }
+    return { dir, task: q.get("task") ?? undefined, budget };
+}
+function workspaceNotRegisteredResult() {
+    return {
+        status: 403,
+        body: errorBody("WORKSPACE_NOT_REGISTERED", "The workspace directory is not a registered project."),
+    };
+}
+function resolveRegisteredWorkspace(rawDir, deps) {
+    let normalized;
+    try {
+        normalized = validateProjectPath(rawDir, { mustExist: false });
+    }
+    catch {
+        return {
+            status: 400,
+            body: errorBody("BAD_REQUEST", "The dir query parameter must be a valid local project path."),
+        };
+    }
+    const registered = deps.store.listProjects().some((project) => project.path === normalized);
+    if (!registered) {
+        return workspaceNotRegisteredResult();
+    }
+    return { normalized };
+}
+function workspaceSummaryResult(request, registeredRoot, deps) {
+    try {
+        const workspace = detectWorkspace(registeredRoot);
+        if (workspace.root !== registeredRoot) {
+            return workspaceNotRegisteredResult();
+        }
+        const { files, stats } = discoverWithStats(workspace, DEFAULT_CONTEXT_REQUEST.discovery);
+        const wantsContext = request.task !== undefined || request.budget !== undefined;
+        const pack = wantsContext
+            ? buildContextPackFromFiles(workspace, {
+                ...DEFAULT_CONTEXT_REQUEST,
+                task: request.task,
+                budgetBytes: request.budget ?? DEFAULT_CONTEXT_REQUEST.budgetBytes,
+            }, files)
+            : undefined;
+        const summary = buildWorkspaceSummary(workspace, pack, stats);
+        const body = deps.redactor({ summary });
+        return { status: 200, body };
+    }
+    catch (error) {
+        if (error instanceof WorkspaceError) {
+            const result = workspaceErrorResult(error);
+            return { status: result.status, body: deps.redactor(result.body) };
+        }
+        throw error;
+    }
+}
+// Route 12 — workspace summary and optional context pack, built by the safe workspace layer.
+export function handleWorkspace(ctx, deps) {
+    const request = readWorkspaceRequest(ctx.url.searchParams);
+    if ("status" in request) {
+        return request;
+    }
+    const registered = resolveRegisteredWorkspace(request.dir, deps);
+    if ("status" in registered) {
+        return registered;
+    }
+    return workspaceSummaryResult(request, registered.normalized, deps);
+}
+function readFilters(url) {
+    const q = url.searchParams;
+    return {
+        workspace: q.get("workspace") ?? undefined,
+        date: q.get("date") ?? undefined,
+        workflow: q.get("workflow") ?? undefined,
+        model: q.get("model") ?? undefined,
+        outcome: q.get("outcome") ?? undefined,
+    };
+}
+// `EvidenceListEntry.startedAt` is epoch ms; the `date` filter matches the started-at calendar day
+// (UTC `YYYY-MM-DD`). `workspace` is a substring match to support path-fragment filtering, while
+// `model` is an exact model-id match.
+function matchesOptionalFilter(value, filter) {
+    return filter === undefined || value === filter;
+}
+function matchesDateFilter(entry, date) {
+    return date === undefined || new Date(entry.startedAt).toISOString().slice(0, 10) === date;
+}
+function matchesWorkspaceFilter(entry, workspace) {
+    return workspace === undefined || entry.workspaceRoot?.includes(workspace) === true;
+}
+function matchesFilters(entry, filters) {
+    return (matchesOptionalFilter(entry.taskType, filters.workflow) &&
+        matchesOptionalFilter(entry.outcome, filters.outcome) &&
+        matchesDateFilter(entry, filters.date) &&
+        matchesOptionalFilter(entry.modelId, filters.model) &&
+        matchesWorkspaceFilter(entry, filters.workspace));
+}
+// Route 10 — evidence list header projection, filtered server-side.
+export function handleEvidenceList(ctx, deps) {
+    const filters = readFilters(ctx.url);
+    const entries = listEvidence(deps.evidenceStore).filter((entry) => matchesFilters(entry, filters));
+    return { status: 200, body: { entries } };
+}
+// Route 11 — a single evidence manifest, served as-is (already redacted on disk). Invalid runId →
+// 400; absent → 404; an EvidenceSchemaError → 422; an EvidenceReadError → 422 (safe, pre-redacted
+// `.message`).
+export function handleEvidenceDetail(ctx, deps) {
+    const runId = ctx.params.runId ?? "";
+    try {
+        assertValidRunId(runId);
+    }
+    catch {
+        return { status: 400, body: errorBody("BAD_REQUEST", "The run id is not valid.") };
+    }
+    try {
+        const manifest = loadEvidence(deps.evidenceStore, runId);
+        if (manifest === undefined) {
+            return { status: 404, body: errorBody("NOT_FOUND", "No evidence for that run id.") };
+        }
+        return { status: 200, body: { manifest } };
+    }
+    catch (error) {
+        // Issue #622 — an over-long runId is rejected by the store with a static, path-free
+        // InvalidRunIdError before any fs read; surface it as a 400 (not a generic 500).
+        if (error instanceof InvalidRunIdError) {
+            return { status: 400, body: errorBody("BAD_REQUEST", error.message) };
+        }
+        if (error instanceof EvidenceSchemaError) {
+            return { status: 422, body: errorBody("EVIDENCE_SCHEMA", error.message) };
+        }
+        if (error instanceof EvidenceReadError) {
+            return { status: 422, body: errorBody("EVIDENCE_READ", error.message) };
+        }
+        throw error;
+    }
+}