@velum-labs/routekit-eval-setup 1.3.2 → 1.5.0

package/dist/services/repository-public-artifact/service.js

@@ -0,0 +1,330 @@
+import { createHash } from "node:crypto";
+import { Schema } from "effect";
+import { PipelineCheckpointDescriptorV2, decodePipelineCheckpointDescriptorV2, pipelineCheckpointDescriptorDigestV2 } from "../../case-pipeline-protocol-v2.js";
+import { RepositoryCandidateVisibleTaskV1 } from "../../repository-benchmark-protocol.js";
+import { compilePortableRepositoryBundleV2 } from "../repository-bundle/service.js";
+export const REPOSITORY_PUBLIC_ARTIFACT_PROJECTION_VERSION_V1 = 1;
+const Sha256 = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => /^[a-f0-9]{64}$/u.test(value) ? undefined : "must be a lowercase SHA-256 digest")));
+const CommitSha = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => /^[a-f0-9]{40}$/u.test(value) ? undefined : "must be a lowercase Git commit SHA")));
+const BoundedId = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => value.length >= 1 && value.length <= 256 && value.trim() === value
+    ? undefined
+    : "must be a trimmed identifier between 1 and 256 characters")));
+const PositiveInteger = Schema.Finite.pipe(Schema.check(Schema.makeFilter((value) => Number.isInteger(value) && value > 0 ? undefined : "must be a positive integer")));
+const NonNegativeInteger = Schema.Finite.pipe(Schema.check(Schema.makeFilter((value) => Number.isInteger(value) && value >= 0 ? undefined : "must be a non-negative integer")));
+const Timestamp = Schema.String.pipe(Schema.check(Schema.makeFilter((value) => {
+    const parsed = new Date(value);
+    return Number.isFinite(parsed.getTime()) && parsed.toISOString() === value
+        ? undefined
+        : "must be a canonical ISO-8601 timestamp with millisecond precision";
+})));
+const QUALITY_AXES = [
+    "authenticity",
+    "specification-sufficiency",
+    "oracle-adequacy",
+    "stability",
+    "distinctness",
+    "realism",
+    "leakage",
+    "triviality",
+    "coverage"
+];
+const ADMISSION_QUALITY_AXES = new Set(QUALITY_AXES.filter((axis) => axis !== "coverage"));
+export const RepositoryPublicArtifactQualityV1 = Schema.Struct({
+    axis: Schema.Literals(QUALITY_AXES),
+    outcome: Schema.Literals(["pass", "fail", "review-required"])
+}).annotate({ parseOptions: { onExcessProperty: "error" } });
+const RepositoryPublicArtifactQualitySetV1 = Schema.Array(RepositoryPublicArtifactQualityV1).pipe(Schema.check(Schema.makeFilter((quality) => {
+    const axes = quality.map(({ axis }) => axis);
+    if (quality.length !== QUALITY_AXES.length ||
+        new Set(axes).size !== quality.length ||
+        QUALITY_AXES.some((axis) => !axes.includes(axis))) {
+        return "admitted public artifacts require exactly one finding for every quality axis";
+    }
+    if (quality.some(({ axis, outcome }) => ADMISSION_QUALITY_AXES.has(axis) && outcome !== "pass")) {
+        return "admitted public artifacts require every admission quality axis to pass";
+    }
+    return undefined;
+})));
+export const RepositoryPublicArtifactTerminalCheckpointV1 = Schema.Struct({
+    ...PipelineCheckpointDescriptorV2.fields,
+    kind: Schema.Literal("terminal"),
+    stage: Schema.Literal("admit"),
+    createdAt: Timestamp
+}).annotate({ parseOptions: { onExcessProperty: "error" } });
+export const RepositoryPublicArtifactInputV1 = Schema.Struct({
+    version: Schema.Literal(REPOSITORY_PUBLIC_ARTIFACT_PROJECTION_VERSION_V1),
+    admitted: Schema.Literal(true),
+    caseId: BoundedId,
+    capabilityId: BoundedId,
+    familyId: BoundedId,
+    lane: Schema.Literals(["request", "repository-agent"]),
+    visible: RepositoryCandidateVisibleTaskV1,
+    sourceCommitSha: CommitSha,
+    coverageCellId: BoundedId,
+    basisDigest: Sha256,
+    behavioralFingerprint: BoundedId,
+    admissionDigest: Sha256,
+    terminalCheckpoint: RepositoryPublicArtifactTerminalCheckpointV1,
+    quality: RepositoryPublicArtifactQualitySetV1
+}).annotate({ parseOptions: { onExcessProperty: "error" } });
+const RepositoryPublicEvalDefinitionV1 = Schema.Struct({
+    version: Schema.Literal(1),
+    id: BoundedId,
+    capabilityId: BoundedId,
+    familyId: BoundedId,
+    lane: Schema.Literals(["request", "repository-agent"]),
+    task: RepositoryCandidateVisibleTaskV1
+});
+const RepositoryPublicMetadataV1 = Schema.Struct({
+    version: Schema.Literal(1),
+    admitted: Schema.Literal(true),
+    caseId: BoundedId,
+    sourceCommitSha: CommitSha,
+    coverageCellId: BoundedId,
+    basisDigest: Sha256,
+    admissionDigest: Sha256,
+    terminalCheckpoint: Schema.Struct({
+        identityDigest: Sha256,
+        descriptorDigest: Sha256,
+        sequence: PositiveInteger,
+        attemptGeneration: PositiveInteger
+    }),
+    quality: RepositoryPublicArtifactQualitySetV1
+});
+const stableValue = (value) => {
+    if (Array.isArray(value))
+        return value.map(stableValue);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => [key, stableValue(child)]));
+    }
+    return value;
+};
+const stableJson = (value) => `${JSON.stringify(stableValue(value), null, 2)}\n`;
+const digest = (value) => createHash("sha256").update(value, "utf8").digest("hex");
+const PRIVATE_MATERIAL_PATTERNS = [
+    /\bHIDDEN[_ -]?FIXTURE(?:S|[_ -]?CANARY)?\b/iu,
+    /\bORACLE[_ -]?(?:BODY(?:[_ -]?CANARY)?|CANARY)\b/iu,
+    /\bSOLUTION[_ -]?CANARY\b/iu,
+    /\bADVERSAR(?:Y|IES)[_ -]?CANARY\b/iu,
+    /\bRAW[_ -]?MODEL[_ -]?(?:RESPONSE|OUTPUT)(?:[_ -]?CANARY)?\b/iu,
+    /\bPROVIDER[_ -]?DIAGNOSTICS?(?:[_ -]?CANARY)?\b/iu,
+    /\bPRIVATE[_ -]?(?:CHECKPOINT|EVIDENCE)(?:[_ -]?CANARY)?\b/iu,
+    /\bPRIVATE[_ -]?CANARY\b/iu
+];
+const assertNoPrivateMaterial = (value) => {
+    const inspect = (child) => {
+        if (typeof child === "string") {
+            if (PRIVATE_MATERIAL_PATTERNS.some((pattern) => pattern.test(child))) {
+                throw new Error("public artifact material resembles private foundry evidence");
+            }
+            return;
+        }
+        if (Array.isArray(child)) {
+            for (const entry of child)
+                inspect(entry);
+            return;
+        }
+        if (child !== null && typeof child === "object") {
+            for (const entry of Object.values(child))
+                inspect(entry);
+        }
+    };
+    inspect(value);
+};
+export const repositoryPublicArtifactPathIdV1 = (caseId) => {
+    const slug = caseId
+        .normalize("NFKC")
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/gu, "-")
+        .replace(/^-+|-+$/gu, "")
+        .slice(0, 64);
+    return `${slug.length === 0 ? "case" : slug}-${digest(caseId).slice(0, 12)}`;
+};
+const decodePublicEvalDefinitionV1 = (content) => Schema.decodeUnknownSync(RepositoryPublicEvalDefinitionV1, { onExcessProperty: "error" })(JSON.parse(content));
+const decodePublicMetadataV1 = (content) => Schema.decodeUnknownSync(RepositoryPublicMetadataV1, { onExcessProperty: "error" })(JSON.parse(content));
+const RepositoryProjectedPublicArtifactV1Core = Schema.Struct({
+    path: Schema.String,
+    kind: Schema.Literals(["eval-definition", "public-metadata"]),
+    mediaType: Schema.Literal("application/json"),
+    content: Schema.String,
+    caseId: BoundedId,
+    admissionDigest: Sha256,
+    publicArtifactDigest: Sha256,
+    bytes: NonNegativeInteger,
+    visibility: Schema.Literal("public"),
+    fileType: Schema.Literal("regular")
+});
+export const RepositoryProjectedPublicArtifactV1 = RepositoryProjectedPublicArtifactV1Core.pipe(Schema.check(Schema.makeFilter((artifact) => {
+    if (artifact.publicArtifactDigest !== digest(artifact.content)) {
+        return "public artifact digest does not match its exact content";
+    }
+    if (artifact.bytes !== Buffer.byteLength(artifact.content, "utf8")) {
+        return "public artifact byte count does not match its exact content";
+    }
+    const id = repositoryPublicArtifactPathIdV1(artifact.caseId);
+    const expectedPath = artifact.kind === "eval-definition"
+        ? `.routekit/evals/cases/${id}.eval.json`
+        : `.routekit/evals/cases/${id}.metadata.json`;
+    if (artifact.path !== expectedPath) {
+        return "public artifact path does not match its immutable case identity";
+    }
+    try {
+        assertNoPrivateMaterial(artifact);
+        if (artifact.kind === "eval-definition") {
+            const definition = decodePublicEvalDefinitionV1(artifact.content);
+            if (definition.id !== artifact.caseId ||
+                definition.task.id !== artifact.caseId ||
+                definition.task.lane !== definition.lane) {
+                return "public eval definition substituted its immutable case identity";
+            }
+        }
+        else {
+            const metadata = decodePublicMetadataV1(artifact.content);
+            if (metadata.caseId !== artifact.caseId ||
+                metadata.admissionDigest !== artifact.admissionDigest) {
+                return "public metadata substituted its immutable admission identity";
+            }
+        }
+        compilePortableRepositoryBundleV2({
+            admitted: true,
+            sourceCommitSha: "0".repeat(40),
+            artifacts: [artifact]
+        });
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : "invalid public artifact content";
+    }
+    return undefined;
+}))).annotate({ parseOptions: { onExcessProperty: "error" } });
+export const repositoryPublicArtifactProjectionDigestV1 = (projection) => digest(stableJson({
+    ...projection,
+    artifacts: projection.artifacts.map(({ content: _content, ...descriptor }) => descriptor)
+}));
+const RepositoryPublicArtifactProjectionV1Core = Schema.Struct({
+    version: Schema.Literal(REPOSITORY_PUBLIC_ARTIFACT_PROJECTION_VERSION_V1),
+    admitted: Schema.Literal(true),
+    caseId: BoundedId,
+    sourceCommitSha: CommitSha,
+    admissionDigest: Sha256,
+    terminalCheckpointDigest: Sha256,
+    projectionDigest: Sha256,
+    artifacts: Schema.Array(RepositoryProjectedPublicArtifactV1)
+});
+export const RepositoryPublicArtifactProjectionV1 = RepositoryPublicArtifactProjectionV1Core.pipe(Schema.check(Schema.makeFilter((projection) => {
+    if (projection.artifacts.length !== 2 ||
+        projection.artifacts[0]?.kind !== "eval-definition" ||
+        projection.artifacts[1]?.kind !== "public-metadata") {
+        return "public projection requires exactly its sorted definition and metadata artifacts";
+    }
+    if (projection.artifacts.some(({ caseId, admissionDigest }) => caseId !== projection.caseId || admissionDigest !== projection.admissionDigest)) {
+        return "public projection artifacts substituted case or admission identity";
+    }
+    try {
+        const definition = decodePublicEvalDefinitionV1(projection.artifacts[0].content);
+        const metadata = decodePublicMetadataV1(projection.artifacts[1].content);
+        if (metadata.sourceCommitSha !== projection.sourceCommitSha ||
+            metadata.terminalCheckpoint.descriptorDigest !==
+                projection.terminalCheckpointDigest ||
+            definition.id !== metadata.caseId ||
+            (definition.task.lane === "repository-agent" &&
+                definition.task.checkoutCommit !== projection.sourceCommitSha)) {
+            return "public projection substituted pinned source or terminal identity";
+        }
+    }
+    catch (error) {
+        return error instanceof Error ? error.message : "invalid public projection content";
+    }
+    const { projectionDigest: _projectionDigest, ...core } = projection;
+    if (projection.projectionDigest !== repositoryPublicArtifactProjectionDigestV1(core)) {
+        return "public projection digest does not bind its exact admitted artifacts";
+    }
+    return undefined;
+}))).annotate({ parseOptions: { onExcessProperty: "error" } });
+export const decodeRepositoryPublicArtifactProjectionV1 = (value) => Schema.decodeUnknownSync(RepositoryPublicArtifactProjectionV1, {
+    onExcessProperty: "error"
+})(value);
+const projectedArtifact = (artifact, provenance) => ({
+    ...artifact,
+    caseId: provenance.caseId,
+    admissionDigest: provenance.admissionDigest,
+    publicArtifactDigest: digest(artifact.content),
+    bytes: Buffer.byteLength(artifact.content, "utf8"),
+    visibility: "public",
+    fileType: "regular"
+});
+/**
+ * Creates the only repository-visible representation of an admitted case.
+ *
+ * The input is an explicit strict public DTO, not a foundry result. Hidden
+ * fixtures, oracle bodies, solutions, adversaries, responses, diagnostics,
+ * credentials, and checkpoint payloads therefore have no representable field.
+ */
+export const makeRepositoryPublicArtifactProjectionV1 = (value) => {
+    const input = Schema.decodeUnknownSync(RepositoryPublicArtifactInputV1, {
+        onExcessProperty: "error"
+    })(value);
+    assertNoPrivateMaterial(input);
+    const terminalCheckpoint = decodePipelineCheckpointDescriptorV2(input.terminalCheckpoint);
+    const terminalCheckpointDigest = pipelineCheckpointDescriptorDigestV2(terminalCheckpoint);
+    if (input.visible.lane !== input.lane || input.visible.id !== input.caseId) {
+        throw new Error("public case identity does not match its visible task");
+    }
+    if (input.visible.lane === "repository-agent" &&
+        input.visible.checkoutCommit !== input.sourceCommitSha) {
+        throw new Error("public repository task is not pinned to the admitted source commit");
+    }
+    const quality = [...input.quality].sort((left, right) => left.axis.localeCompare(right.axis) || left.outcome.localeCompare(right.outcome));
+    const id = repositoryPublicArtifactPathIdV1(input.caseId);
+    const provenance = { caseId: input.caseId, admissionDigest: input.admissionDigest };
+    const definition = projectedArtifact({
+        path: `.routekit/evals/cases/${id}.eval.json`,
+        kind: "eval-definition",
+        mediaType: "application/json",
+        content: stableJson({
+            version: 1,
+            id: input.caseId,
+            capabilityId: input.capabilityId,
+            familyId: input.familyId,
+            lane: input.lane,
+            task: input.visible
+        })
+    }, provenance);
+    const metadata = projectedArtifact({
+        path: `.routekit/evals/cases/${id}.metadata.json`,
+        kind: "public-metadata",
+        mediaType: "application/json",
+        content: stableJson({
+            version: 1,
+            admitted: true,
+            caseId: input.caseId,
+            sourceCommitSha: input.sourceCommitSha,
+            coverageCellId: input.coverageCellId,
+            basisDigest: input.basisDigest,
+            admissionDigest: input.admissionDigest,
+            terminalCheckpoint: {
+                identityDigest: terminalCheckpoint.identityDigest,
+                descriptorDigest: terminalCheckpointDigest,
+                sequence: terminalCheckpoint.sequence,
+                attemptGeneration: terminalCheckpoint.attemptGeneration
+            },
+            quality
+        })
+    }, provenance);
+    const core = {
+        version: 1,
+        admitted: true,
+        caseId: input.caseId,
+        sourceCommitSha: input.sourceCommitSha,
+        admissionDigest: input.admissionDigest,
+        terminalCheckpointDigest,
+        artifacts: [definition, metadata]
+    };
+    return decodeRepositoryPublicArtifactProjectionV1({
+        ...core,
+        projectionDigest: repositoryPublicArtifactProjectionDigestV1(core)
+    });
+};
+export const repositoryPublicArtifactVisibleTaskV1 = (input) => input.visible;