@verdict-ai/api 0.0.0-stage → 0.1.0

package/LICENSE

@@ -0,0 +1,9 @@
+MIT License
+
+Copyright (c) 2026 Verdict contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

package/README.md

@@ -1,3 +1,22 @@
-# Temporary Holding Version
+# @verdict-ai/api
 
-This version is a temporary placeholder for this package. An operational version to replace this has been submitted for review and is awaiting a staged release.
+Hono REST API for Node and Cloudflare Workers.
+
+```bash
+npm install @verdict-ai/api @verdict-ai/core
+```
+
+```ts
+import { Engine, MemoryStore } from "@verdict-ai/core";
+import { createApp } from "@verdict-ai/api";
+const engine = new Engine({ store: new MemoryStore() });
+const app = createApp({ engine });
+const response = await app.request("/v1/health");
+console.log(response.status);
+console.log(await response.json());
+// Export app.fetch for a compatible HTTP runtime.
+// Configure authentication before exposing a public service.
+export default app;
+```
+
+Requires Node 20 or newer. [Documentation](https://verdict-docs.developerolim.workers.dev/reference/rest). MIT licensed.

package/dist/app.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Assembles authenticated REST routes around an injected engine.
+ * Request bodies are validated at the boundary; Workers imports must remain free of eager Node I/O.
+ */
+import { Engine } from "@verdict-ai/core";
+import { Hono } from "hono";
+export interface Auth {
+    /** Map an API key to a tenant id, or undefined to reject. Return "" for single-tenant open mode. */
+    resolve(apiKey: string | undefined): Promise<string | undefined> | string | undefined;
+}
+/** `VERDICT_API_KEYS="key1:tenantA,key2:tenantB"`; a bare key maps to tenant "default". Unset = open (single tenant). */
+export declare function envAuth(env?: Record<string, string | undefined>): Auth;
+/** Optional API-key management (backed by @verdict-ai/db's DrizzleAuth). Exposed under /v1/admin with VERDICT_ADMIN_KEY. */
+export interface KeyManager {
+    createKey(tenantId: string, name: string): Promise<{
+        id: string;
+        key: string;
+        prefix: string;
+    }>;
+    revokeKey(id: string, tenantId?: string): Promise<boolean>;
+    listKeys(tenantId: string): Promise<Array<{
+        id: string;
+        name: string;
+        prefix: string;
+        createdAt: string;
+        lastUsedAt: string | null;
+        revokedAt: string | null;
+    }>>;
+}
+export interface AppOptions {
+    engine: Engine;
+    auth?: Auth;
+    keys?: KeyManager;
+    /** Bearer token for /v1/admin/* (default: env VERDICT_ADMIN_KEY). Unset = admin routes disabled. */
+    adminKey?: string;
+    /** Return 202 immediately and finish in the background when the client asks (`"async": true`). */
+    background?: (promise: Promise<unknown>) => void;
+    allowAsync?: boolean;
+    log?: boolean;
+}
+export type Env = {
+    Variables: {
+        tenantId: string;
+    };
+};
+/** Builds the REST app around an engine; route failures are translated into HTTP error responses. */
+export declare function createApp({ engine, auth, keys, adminKey, allowAsync, background, log }: AppOptions): Hono<Env, import("hono/types").BlankSchema, "/">;
+export { present } from "./present.js";

package/dist/app.js

@@ -0,0 +1,68 @@
+/**
+ * Assembles authenticated REST routes around an injected engine.
+ * Request bodies are validated at the boundary; Workers imports must remain free of eager Node I/O.
+ */
+import { ConflictError, NotFoundError, ValidationError } from "@verdict-ai/core";
+import { Hono } from "hono";
+import { cors } from "hono/cors";
+import { HTTPException } from "hono/http-exception";
+import { logger } from "hono/logger";
+import { z } from "zod";
+import { openapi } from "./openapi.js";
+import { registerAdmin } from "./routes/admin.js";
+import { registerBatches } from "./routes/batches.js";
+import { registerEvaluations } from "./routes/evaluations.js";
+import { registerRubrics } from "./routes/rubrics.js";
+/** `VERDICT_API_KEYS="key1:tenantA,key2:tenantB"`; a bare key maps to tenant "default". Unset = open (single tenant). */
+export function envAuth(env = globalThis.process?.env ?? {}) {
+    const raw = env.VERDICT_API_KEYS?.trim();
+    if (!raw)
+        return { resolve: () => "default" };
+    const keys = new Map(raw.split(",").map((pair) => { const [k, t] = pair.trim().split(":"); return [k, t ?? "default"]; }));
+    return { resolve: (k) => (k ? keys.get(k) : undefined) };
+}
+/** Builds the REST app around an engine; route failures are translated into HTTP error responses. */
+export function createApp({ engine, auth = envAuth(), keys, adminKey = globalThis.process?.env?.VERDICT_ADMIN_KEY, allowAsync = true, background, log = false }) {
+    const app = new Hono();
+    if (log)
+        app.use(logger());
+    app.use("*", cors({ exposeHeaders: ["Idempotency-Replayed"] }));
+    app.get("/", (c) => c.json({ name: "verdict", version: "0.1.0", docs: "/v1/openapi.json" }));
+    app.get("/v1/health", (c) => c.json({ ok: true }));
+    app.get("/v1/openapi.json", (c) => c.json(openapi));
+    // why: admin routes use their own credential and must be registered before tenant authentication.
+    registerAdmin(app, { engine, keys, adminKey, allowAsync, background });
+    app.use("/v1/*", async (c, next) => {
+        if (c.req.path === "/v1/health" || c.req.path === "/v1/openapi.json" || c.req.path.startsWith("/v1/admin/"))
+            return next();
+        const header = c.req.header("authorization");
+        const key = header?.replace(/^Bearer\s+/i, "") ?? c.req.header("x-api-key");
+        const tenant = await auth.resolve(key);
+        if (tenant === undefined)
+            throw new HTTPException(401, { message: "invalid or missing API key" });
+        c.set("tenantId", tenant);
+        await next();
+    });
+    app.onError((err, c) => {
+        if (err instanceof HTTPException)
+            return c.json({ error: { type: "http", message: err.message } }, err.status);
+        if (err instanceof z.ZodError)
+            return c.json({ error: { type: "validation", message: "invalid request", issues: err.issues } }, 400);
+        if (err instanceof NotFoundError)
+            return c.json({ error: { type: "not_found", message: err.message } }, 404);
+        if (err instanceof ConflictError)
+            return c.json({ error: { type: "idempotency_conflict", message: err.message } }, 409);
+        if (err instanceof ValidationError)
+            return c.json({ error: { type: "validation", message: err.message } }, 400);
+        const message = err.message ?? "internal error";
+        // why: legacy rubric validators still throw plain errors; preserve their established 400 responses.
+        const status = /duplicate|unknown|requires|must/i.test(message) ? 400 : 500;
+        return c.json({ error: { type: status === 400 ? "validation" : "internal", message } }, status);
+    });
+    registerRubrics(app, { engine, keys, adminKey, allowAsync, background });
+    registerEvaluations(app, { engine, keys, adminKey, allowAsync, background });
+    registerBatches(app, { engine, keys, adminKey, allowAsync, background });
+    return app;
+}
+export { present } from "./present.js";
+//# sourceMappingURL=app.js.map

package/dist/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../src/app.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAU,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AACzF,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AACrC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAOtD,yHAAyH;AACzH,MAAM,UAAU,OAAO,CAAC,MAA2C,UAAyE,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE;IAC7J,MAAM,GAAG,GAAG,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;IAC9C,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAE,EAAE,CAAC,IAAI,SAAS,CAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACrI,OAAO,EAAE,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC;AAC3D,CAAC;AAuBD,qGAAqG;AACrG,MAAM,UAAU,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,GAAG,OAAO,EAAE,EAAE,IAAI,EAAE,QAAQ,GAAI,UAA6D,CAAC,OAAO,EAAE,GAAG,EAAE,iBAAiB,EAAE,UAAU,GAAG,IAAI,EAAE,UAAU,EAAE,GAAG,GAAG,KAAK,EAAc;IAC7N,MAAM,GAAG,GAAG,IAAI,IAAI,EAAO,CAAC;IAC5B,IAAI,GAAG;QAAE,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IAC3B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,aAAa,EAAE,CAAC,sBAAsB,CAAC,EAAE,CAAC,CAAC,CAAC;IAEhE,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,GAAG,CAAC,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;IACnD,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;IAEpD,kGAAkG;IAClG,aAAa,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAEvE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACjC,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,YAAY,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,kBAAkB,IAAI,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;YAAE,OAAO,IAAI,EAAE,CAAC;QAC3H,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QAC5E,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4BAA4B,EAAE,CAAC,CAAC;QAClG,CAAC,CAAC,GAAG,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC1B,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,CAAC,EAAE,EAAE;QACrB,IAAI,GAAG,YAAY,aAAa;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/G,IAAI,GAAG,YAAY,CAAC,CAAC,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,iBAAiB,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACrI,IAAI,GAAG,YAAY,aAAa;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7G,IAAI,GAAG,YAAY,aAAa;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,sBAAsB,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QACxH,IAAI,GAAG,YAAY,eAAe;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAChH,MAAM,OAAO,GAAI,GAAa,CAAC,OAAO,IAAI,gBAAgB,CAAC;QAC3D,oGAAoG;QACpG,MAAM,MAAM,GAAG,kCAAkC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;QAC5E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC;IAClG,CAAC,CAAC,CAAC;IAEH,eAAe,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzE,mBAAmB,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAE7E,eAAe,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,CAAC,CAAC;IAEzE,OAAO,GAAG,CAAC;AACb,CAAC;AAED,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Exports the package entry points without starting services.
+ * Consumers choose their runtime adapters explicitly; importing types must not open network or database connections.
+ */
+export { createApp, envAuth, present, type Auth, type AppOptions } from "./app.js";

package/dist/index.js

@@ -0,0 +1,6 @@
+/**
+ * Exports the package entry points without starting services.
+ * Consumers choose their runtime adapters explicitly; importing types must not open network or database connections.
+ */
+export { createApp, envAuth, present } from "./app.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAA8B,MAAM,UAAU,CAAC"}

package/dist/openapi.d.ts

@@ -0,0 +1,108 @@
+/**
+ * Describes the public REST operations for API discovery.
+ * The published paths mirror route registration; runtime validation remains owned by request schemas.
+ */
+export declare const openapi: {
+    openapi: string;
+    info: {
+        title: string;
+        version: string;
+        description: string;
+    };
+    servers: {
+        url: string;
+    }[];
+    security: {
+        bearer: never[];
+    }[];
+    components: {
+        securitySchemes: {
+            bearer: {
+                type: string;
+                scheme: string;
+            };
+        };
+    };
+    paths: {
+        "/v1/rubrics": {
+            post: {
+                summary: string;
+            };
+            get: {
+                summary: string;
+            };
+        };
+        "/v1/rubrics/validate": {
+            post: {
+                summary: string;
+            };
+        };
+        "/v1/rubrics/{id}": {
+            get: {
+                summary: string;
+            };
+            put: {
+                summary: string;
+            };
+            delete: {
+                summary: string;
+            };
+        };
+        "/v1/rubrics/{id}/calibration": {
+            get: {
+                summary: string;
+            };
+        };
+        "/v1/evaluations": {
+            post: {
+                summary: string;
+            };
+            get: {
+                summary: string;
+            };
+        };
+        "/v1/evaluations/{id}": {
+            get: {
+                summary: string;
+            };
+        };
+        "/v1/evaluations/{id}/retry": {
+            post: {
+                summary: string;
+            };
+        };
+        "/v1/evaluations/{id}/scores": {
+            post: {
+                summary: string;
+            };
+        };
+        "/v1/evaluations/{id}/aggregate": {
+            post: {
+                summary: string;
+            };
+        };
+        "/v1/tasks": {
+            get: {
+                summary: string;
+            };
+        };
+        "/v1/batches": {
+            post: {
+                summary: string;
+            };
+        };
+        "/v1/admin/keys": {
+            post: {
+                summary: string;
+            };
+            get: {
+                summary: string;
+            };
+        };
+        "/v1/admin/keys/{id}": {
+            delete: {
+                summary: string;
+            };
+        };
+    };
+};

package/dist/openapi.js

@@ -0,0 +1,27 @@
+/**
+ * Describes the public REST operations for API discovery.
+ * The published paths mirror route registration; runtime validation remains owned by request schemas.
+ */
+export const openapi = {
+    openapi: "3.1.0",
+    info: { title: "Verdict Evaluation API", version: "0.1.0", description: "Customizable rubrics, pluggable judges (LLM / human / benchmark), customizable aggregation." },
+    servers: [{ url: "/" }],
+    security: [{ bearer: [] }],
+    components: { securitySchemes: { bearer: { type: "http", scheme: "bearer" } } },
+    paths: {
+        "/v1/rubrics": { post: { summary: "Create rubric (JSON or YAML body)" }, get: { summary: "List rubrics" } },
+        "/v1/rubrics/validate": { post: { summary: "Validate a rubric without storing it" } },
+        "/v1/rubrics/{id}": { get: { summary: "Get rubric" }, put: { summary: "Replace rubric" }, delete: { summary: "Delete rubric" } },
+        "/v1/rubrics/{id}/calibration": { get: { summary: "Calibration report (`?target=0.8&buckets=5&limit=1000`)" } },
+        "/v1/evaluations": { post: { summary: "Evaluate a subject (sync; `async:true` for 202). Optional Idempotency-Key header (1–255 chars); replay 200, conflict 409, TTL 24h" }, get: { summary: "List evaluations" } },
+        "/v1/evaluations/{id}": { get: { summary: "Get evaluation (`?evidence=true` for full text)" } },
+        "/v1/evaluations/{id}/retry": { post: { summary: "Re-enqueue a failed evaluation (202; unknown 404; not failed 409)" } },
+        "/v1/evaluations/{id}/scores": { post: { summary: "Submit a human score for a pending criterion" } },
+        "/v1/evaluations/{id}/aggregate": { post: { summary: "Re-aggregate with a different aggregation config (no re-judging)" } },
+        "/v1/tasks": { get: { summary: "Pending human-rating tasks (`?rater=`)" } },
+        "/v1/batches": { post: { summary: "Evaluate many subjects against one rubric and rank them. Optional Idempotency-Key header (1–255 chars); replay 200, conflict 409, TTL 24h" } },
+        "/v1/admin/keys": { post: { summary: "Create an API key for a tenant (admin)" }, get: { summary: "List a tenant's keys (admin, `?tenant=`)" } },
+        "/v1/admin/keys/{id}": { delete: { summary: "Revoke a key (admin)" } },
+    },
+};
+//# sourceMappingURL=openapi.js.map

package/dist/openapi.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openapi.js","sourceRoot":"","sources":["../src/openapi.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,CAAC,MAAM,OAAO,GAAG;IACrB,OAAO,EAAE,OAAO;IAChB,IAAI,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,6FAA6F,EAAE;IACvK,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC;IACvB,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;IAC1B,UAAU,EAAE,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,EAAE,EAAE;IAC/E,KAAK,EAAE;QACL,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,mCAAmC,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,EAAE;QAC3G,sBAAsB,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,EAAE;QACrF,kBAAkB,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,YAAY,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,EAAE;QAChI,8BAA8B,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,yDAAyD,EAAE,EAAE;QAC/G,iBAAiB,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,mIAAmI,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,kBAAkB,EAAE,EAAE;QACnN,sBAAsB,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,iDAAiD,EAAE,EAAE;QAC/F,4BAA4B,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,mEAAmE,EAAE,EAAE;QACxH,6BAA6B,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,EAAE;QACpG,gCAAgC,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,kEAAkE,EAAE,EAAE;QAC3H,WAAW,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE;QAC3E,aAAa,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,2IAA2I,EAAE,EAAE;QACjL,gBAAgB,EAAE,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,wCAAwC,EAAE,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,EAAE;QAC/I,qBAAqB,EAAE,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,EAAE;KACvE;CACF,CAAC"}

package/dist/present.d.ts

@@ -0,0 +1,107 @@
+/**
+ * Projects stored evaluations into public REST representations.
+ * Evidence text and rating details are included only when requested; frozen rubric policy remains visible.
+ */
+import type { Evaluation } from "@verdict-ai/core";
+/** Public view of an evaluation: strip bulky evidence text unless asked. */
+export declare function present(ev: Evaluation, { evidence, ratings }?: {
+    evidence?: boolean | undefined;
+    ratings?: boolean | undefined;
+}): {
+    rubric: {
+        id: string | undefined;
+        name: string;
+        version: string;
+        aggregation: {
+            method: "min" | "max" | "formula" | "mean" | "median" | "weighted_mean" | "weighted_sum" | "geometric_mean";
+            rater: "min" | "max" | "mean" | "median" | "majority" | "trimmed_mean";
+            normalize: false | [number, number];
+            missing: "fail" | "exclude" | "zero";
+            gates: {
+                criterion: string;
+                min?: number | undefined;
+                max?: number | undefined;
+                message?: string | undefined;
+            }[];
+            precision: number;
+            formula?: string | undefined;
+            grades?: {
+                label: string;
+                min: number;
+            }[] | undefined;
+            passThreshold?: number | undefined;
+        };
+    };
+    evidence: import("@verdict-ai/core").Evidence[] | {
+        chars: number;
+        inputIndex: number;
+        kind: import("@verdict-ai/core").Input["type"];
+        label: string;
+        tags: string[];
+        json?: unknown;
+        source?: string;
+        truncated?: boolean;
+        stats: {
+            chars: number;
+            words: number;
+            lines: number;
+        };
+        warnings?: string[];
+    }[];
+    criteria: {
+        criterionId: string;
+        name: string;
+        weight: number;
+        group?: string;
+        status: "scored" | "pending" | "error" | "excluded";
+        choice?: string;
+        score?: number;
+        normalized?: number;
+        choices?: Record<string, number>;
+        pending: number;
+        gate?: {
+            passed: boolean;
+            message?: string;
+        };
+    }[];
+    job?: {
+        attempts: number;
+        maxAttempts: number;
+        lastError?: string;
+        nextAttemptAt?: string;
+        deadLettered?: boolean;
+    };
+    id: string;
+    tenantId?: string;
+    idempotencyKey?: string;
+    rubricId?: string;
+    subject: import("@verdict-ai/core").Subject;
+    status: import("@verdict-ai/core").EvaluationStatus;
+    aggregate: import("@verdict-ai/core").AggregateResult;
+    pendingTasks: Array<{
+        criterionId: string;
+        raterId?: string;
+        allowedRaters?: string[];
+        instructions?: string;
+    }>;
+    checks?: Array<{
+        id: string;
+        probability: number | null;
+        passed: boolean;
+        action: "abort" | "fail" | "flag";
+        message?: string;
+        error?: string;
+    }>;
+    error?: string;
+    usage: {
+        decisionCalls: number;
+        llmCalls: number;
+        inputTokens: number;
+        outputTokens: number;
+        durationMs: number;
+    };
+    metadata?: Record<string, unknown>;
+    webhook?: string;
+    createdAt: string;
+    updatedAt: string;
+};

package/dist/present.js

@@ -0,0 +1,10 @@
+/** Public view of an evaluation: strip bulky evidence text unless asked. */
+export function present(ev, { evidence = false, ratings = true } = {}) {
+    return {
+        ...ev,
+        rubric: { id: ev.rubric.id, name: ev.rubric.name, version: ev.rubric.version, aggregation: ev.rubric.aggregation },
+        evidence: evidence ? ev.evidence : ev.evidence.map(({ text, ...rest }) => ({ ...rest, chars: text.length })),
+        criteria: ratings ? ev.criteria : ev.criteria.map(({ ratings: _r, ...c }) => c),
+    };
+}
+//# sourceMappingURL=present.js.map

package/dist/present.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"present.js","sourceRoot":"","sources":["../src/present.ts"],"names":[],"mappings":"AAKA,4EAA4E;AAC5E,MAAM,UAAU,OAAO,CAAC,EAAc,EAAE,EAAE,QAAQ,GAAG,KAAK,EAAE,OAAO,GAAG,IAAI,EAAE,GAAG,EAAE;IAC/E,OAAO;QACL,GAAG,EAAE;QACL,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,EAAE;QAClH,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5G,QAAQ,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;KAChF,CAAC;AACJ,CAAC"}

package/dist/queue-cloudflare.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Adapts serializable engine jobs to a Cloudflare queue binding.
+ * Messages carry request data only; the consumer owns execution and retry policy.
+ */
+import type { Job, Queue } from "@verdict-ai/core";
+/** Sends jobs to the queue binding; enqueue rejects when the binding cannot accept a message. */
+export declare class CloudflareQueue implements Queue {
+    private binding;
+    constructor(binding: {
+        send(body: Job, options?: {
+            delaySeconds?: number;
+        }): Promise<unknown>;
+    });
+    enqueue(job: Job, opts?: {
+        delayMs?: number;
+    }): Promise<void>;
+}

package/dist/queue-cloudflare.js

@@ -0,0 +1,11 @@
+/** Sends jobs to the queue binding; enqueue rejects when the binding cannot accept a message. */
+export class CloudflareQueue {
+    binding;
+    constructor(binding) {
+        this.binding = binding;
+    }
+    async enqueue(job, opts) {
+        await this.binding.send(job, { delaySeconds: Math.ceil((opts?.delayMs ?? 0) / 1000) });
+    }
+}
+//# sourceMappingURL=queue-cloudflare.js.map

package/dist/queue-cloudflare.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"queue-cloudflare.js","sourceRoot":"","sources":["../src/queue-cloudflare.ts"],"names":[],"mappings":"AAMA,iGAAiG;AACjG,MAAM,OAAO,eAAe;IACN;IAApB,YAAoB,OAAmF;QAAnF,YAAO,GAAP,OAAO,CAA4E;IAAG,CAAC;IAC3G,KAAK,CAAC,OAAO,CAAC,GAAQ,EAAE,IAA2B;QACjD,MAAM,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,OAAO,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;CACF"}

package/dist/routes/admin.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from "hono";
+import type { AppOptions, Env } from "../app.js";
+/** Registers admin operations; handler failures propagate to the transport error boundary. */
+export declare function registerAdmin(app: Hono<Env>, { keys, adminKey }: AppOptions): void;

package/dist/routes/admin.js

@@ -0,0 +1,35 @@
+/**
+ * Defines admin request handling at the REST boundary.
+ * Tenant context flows to every engine/store operation; validation failures use the shared HTTP error mapper.
+ */
+import { NotFoundError, ValidationError } from "@verdict-ai/core";
+import { HTTPException } from "hono/http-exception";
+import { z } from "zod";
+/** Registers admin operations; handler failures propagate to the transport error boundary. */
+export function registerAdmin(app, { keys, adminKey }) {
+    /* ---------- admin: API keys ---------- */
+    app.use("/v1/admin/*", async (c, next) => {
+        if (!adminKey || !keys)
+            throw new HTTPException(404, { message: "admin API disabled (set VERDICT_ADMIN_KEY and a database-backed key store)" });
+        const header = c.req.header("authorization")?.replace(/^Bearer\s+/i, "");
+        if (header !== adminKey)
+            throw new HTTPException(401, { message: "invalid admin key" });
+        await next();
+    });
+    app.post("/v1/admin/keys", async (c) => {
+        const body = z.object({ tenantId: z.string().min(1), name: z.string().min(1) }).parse(await c.req.json());
+        return c.json(await keys.createKey(body.tenantId, body.name), 201);
+    });
+    app.get("/v1/admin/keys", async (c) => {
+        const tenantId = c.req.query("tenant");
+        if (!tenantId)
+            throw new ValidationError("query param `tenant` is required");
+        return c.json({ data: await keys.listKeys(tenantId) });
+    });
+    app.delete("/v1/admin/keys/:id", async (c) => {
+        if (!(await keys.revokeKey(c.req.param("id"))))
+            throw new NotFoundError(`key ${c.req.param("id")} not found`);
+        return c.body(null, 204);
+    });
+}
+//# sourceMappingURL=admin.js.map

package/dist/routes/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/routes/admin.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAElE,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,8FAA8F;AAC9F,MAAM,UAAU,aAAa,CAAC,GAAc,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAc;IAC1E,2CAA2C;IAC3C,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE;QACvC,IAAI,CAAC,QAAQ,IAAI,CAAC,IAAI;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4EAA4E,EAAE,CAAC,CAAC;QAChJ,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACzE,IAAI,MAAM,KAAK,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,mBAAmB,EAAE,CAAC,CAAC;QACxF,MAAM,IAAI,EAAE,CAAC;IACf,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC1G,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,IAAK,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,gBAAgB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpC,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACvC,IAAI,CAAC,QAAQ;YAAE,MAAM,IAAI,eAAe,CAAC,kCAAkC,CAAC,CAAC;QAC7E,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,IAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,MAAM,CAAC,oBAAoB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC,CAAC,MAAM,IAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/G,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AAEL,CAAC"}

package/dist/routes/batches.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from "hono";
+import type { AppOptions, Env } from "../app.js";
+/** Registers batches operations; handler failures propagate to the transport error boundary. */
+export declare function registerBatches(app: Hono<Env>, { engine }: AppOptions): void;

package/dist/routes/batches.js

@@ -0,0 +1,27 @@
+/**
+ * Tenant context flows to every engine/store operation; validation failures use the shared HTTP error mapper.
+ */
+import { Rubric, Subject } from "@verdict-ai/core";
+import { z } from "zod";
+import { present } from "../present.js";
+import { readIdempotencyKey, tenant } from "./shared.js";
+/** Registers batches operations; handler failures propagate to the transport error boundary. */
+export function registerBatches(app, { engine }) {
+    /* ---------- batches (leaderboards) ---------- */
+    app.post("/v1/batches", async (c) => {
+        const raw = z.record(z.string(), z.unknown()).parse(await c.req.json());
+        const idempotencyKey = readIdempotencyKey(c.req.raw);
+        const body = z.object({ rubric: z.union([z.string(), Rubric]), subjects: z.array(Subject).min(1), metadata: z.record(z.string(), z.unknown()).optional(), webhook: z.string().url().optional() }).parse(raw);
+        const opts = { tenantId: tenant(c), metadata: body.metadata, webhook: body.webhook };
+        // why: preserve the submitted body for conflict detection instead of hashing schema defaults.
+        const fingerprintBody = Object.fromEntries(["rubric", "subjects", "metadata", "webhook"].filter(k => k in raw).map(k => [k, raw[k]]));
+        const result = idempotencyKey === undefined
+            ? { ...await engine.evaluateBatch(body.rubric, body.subjects, opts), replayed: false }
+            : await engine.evaluateBatchIdempotent(body.rubric, body.subjects, { ...opts, idempotencyKey, fingerprintBody });
+        const { evaluations, ranking, replayed } = result;
+        if (replayed)
+            c.header("Idempotency-Replayed", "true");
+        return c.json({ ranking, evaluations: evaluations.map((e) => present(e, { ratings: false })) }, replayed ? 200 : 201);
+    });
+}
+//# sourceMappingURL=batches.js.map

package/dist/routes/batches.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"batches.js","sourceRoot":"","sources":["../../src/routes/batches.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAEnD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEzD,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,GAAc,EAAE,EAAE,MAAM,EAAc;IACpE,kDAAkD;IAClD,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,MAAM,cAAc,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACrD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC7M,MAAM,IAAI,GAAG,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACrF,8FAA8F;QAC9F,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACtI,MAAM,MAAM,GAAG,cAAc,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;YACtF,CAAC,CAAC,MAAM,MAAM,CAAC,uBAAuB,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,EAAE,GAAG,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QACnH,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;QAClD,IAAI,QAAQ;YAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACxH,CAAC,CAAC,CAAC;AAEL,CAAC"}

package/dist/routes/evaluations.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from "hono";
+import type { AppOptions, Env } from "../app.js";
+/** Registers evaluations operations; handler failures propagate to the transport error boundary. */
+export declare function registerEvaluations(app: Hono<Env>, { engine, allowAsync, background }: AppOptions): void;

package/dist/routes/evaluations.js

@@ -0,0 +1,104 @@
+/**
+ * Tenant context flows to every engine/store operation; validation failures use the shared HTTP error mapper.
+ */
+import { Aggregation, NotFoundError, Rubric, Subject, ValidationError } from "@verdict-ai/core";
+import { z } from "zod";
+import { present } from "../present.js";
+import { readIdempotencyKey, tenant } from "./shared.js";
+// why: the inbox is bounded independently of ordinary listings so pending tasks remain useful without unbounded reads.
+const TASK_INBOX_LIMIT = 500;
+/** Registers evaluations operations; handler failures propagate to the transport error boundary. */
+export function registerEvaluations(app, { engine, allowAsync, background }) {
+    /* ---------- evaluations ---------- */
+    app.post("/v1/evaluations", async (c) => {
+        const parsed = await parseEvaluateBody(c);
+        const { body } = parsed;
+        if (body.async && allowAsync)
+            return respondAsync(c, engine, parsed, background);
+        return respondSync(c, engine, parsed);
+    });
+    app.get("/v1/evaluations", async (c) => {
+        const list = await engine.store.listEvaluations({ tenantId: tenant(c), rubricId: c.req.query("rubric"), status: c.req.query("status"), limit: Number(c.req.query("limit") ?? 50) });
+        return c.json({ data: list.map((e) => present(e, { ratings: false })) });
+    });
+    app.get("/v1/evaluations/:id", async (c) => {
+        const ev = await engine.store.getEvaluation(c.req.param("id"), tenant(c));
+        if (!ev)
+            throw new NotFoundError(`evaluation ${c.req.param("id")} not found`);
+        return c.json(present(ev, { evidence: c.req.query("evidence") === "true" }));
+    });
+    app.post("/v1/evaluations/:id/retry", async (c) => {
+        const ev = await engine.retryEvaluation(c.req.param("id"), tenant(c));
+        return c.json({ id: ev.id, status: "queued", url: `/v1/evaluations/${ev.id}` }, 202);
+    });
+    const ScoreBody = z.object({ criterionId: z.string(), raterId: z.string(), score: z.union([z.number(), z.string()]), rationale: z.string().optional(), confidence: z.number().min(0).max(1).optional() });
+    app.post("/v1/evaluations/:id/scores", async (c) => {
+        const body = ScoreBody.parse(await c.req.json());
+        return c.json(present(await engine.submitScore(c.req.param("id"), body, tenant(c))));
+    });
+    /** Human task inbox: everything waiting on a rater. */
+    app.get("/v1/tasks", async (c) => {
+        const rater = c.req.query("rater");
+        const list = await engine.store.listEvaluations({ tenantId: tenant(c), status: "pending_human", limit: TASK_INBOX_LIMIT });
+        const tasks = list.flatMap((e) => e.pendingTasks.filter((t) => !rater || (t.raterId ? t.raterId === rater : !t.allowedRaters || t.allowedRaters.includes(rater))).map((t) => ({ evaluationId: e.id, rubric: e.rubric.name, subject: e.subject.name, ...t })));
+        return c.json({ data: tasks });
+    });
+    app.post("/v1/evaluations/:id/aggregate", async (c) => {
+        const body = z.object({ aggregation: Aggregation.partial(), persist: z.boolean().default(false) }).parse(await c.req.json());
+        return c.json(present(await engine.reaggregate(c.req.param("id"), body.aggregation, tenant(c), body.persist)));
+    });
+}
+const EvaluateBody = z.object({
+    rubric: z.union([z.string(), Rubric]),
+    subject: Subject.optional(),
+    /** Shorthand: inputs at top level instead of subject.inputs. */
+    inputs: Subject.shape.inputs.optional(),
+    name: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+    webhook: z.string().url().optional(),
+    async: z.boolean().optional(),
+    /** Include full evidence text in the response. */
+    includeEvidence: z.boolean().optional(),
+});
+async function parseEvaluateBody(c) {
+    const raw = z.record(z.string(), z.unknown()).parse(await c.req.json());
+    const body = EvaluateBody.parse(raw);
+    const idempotencyKey = readIdempotencyKey(c.req.raw);
+    // why: transport-only flags do not change evaluation identity; hash only scoring inputs and delivery metadata.
+    const fingerprintBody = Object.fromEntries(["rubric", "subject", "inputs", "name", "metadata", "webhook"].filter(k => k in raw).map(k => [k, raw[k]]));
+    const subject = body.subject ?? { name: body.name, inputs: body.inputs ?? [] };
+    if (!subject.inputs?.length)
+        throw new ValidationError("provide `subject.inputs` or `inputs`");
+    const req = { rubric: body.rubric, subject, tenantId: tenant(c), metadata: body.metadata, webhook: body.webhook };
+    return { body, req, idempotencyKey, fingerprintBody };
+}
+async function respondAsync(c, engine, { req, idempotencyKey, fingerprintBody }, background) {
+    // why: durable queues own retries; the background fallback is for deployments without a queue binding.
+    if (engine.queue) {
+        const result = idempotencyKey === undefined
+            ? { evaluation: await engine.enqueueEvaluation(req), replayed: false }
+            : await engine.enqueueEvaluationIdempotent({ ...req, idempotencyKey, fingerprintBody });
+        // why: a replay returns the existing resource with 200 instead of claiming a new job was accepted.
+        if (result.replayed)
+            c.header("Idempotency-Replayed", "true");
+        return c.json({ id: result.evaluation.id, status: result.evaluation.status, url: `/v1/evaluations/${result.evaluation.id}` }, result.replayed ? 200 : 202);
+    }
+    {
+        const result = await engine.evaluateBackground({ ...req, idempotencyKey, fingerprintBody }, background ?? (work => { void work.catch(error => console.error("Background evaluation failed", error)); }));
+        if (result.replayed)
+            c.header("Idempotency-Replayed", "true");
+        return c.json({ id: result.evaluation.id, status: result.replayed ? result.evaluation.status : "queued", url: `/v1/evaluations/${result.evaluation.id}` }, result.replayed ? 200 : 202);
+    }
+}
+async function respondSync(c, engine, { req, idempotencyKey, fingerprintBody, body }) {
+    const includeEvidence = body.includeEvidence;
+    if (idempotencyKey !== undefined) {
+        const { evaluation, replayed } = await engine.evaluateIdempotent({ ...req, idempotencyKey, fingerprintBody });
+        if (replayed)
+            c.header("Idempotency-Replayed", "true");
+        return c.json(present(evaluation, { evidence: includeEvidence }), replayed ? 200 : evaluation.status === "failed" ? 422 : 201);
+    }
+    const ev = await engine.evaluate(req);
+    return c.json(present(ev, { evidence: includeEvidence }), ev.status === "failed" ? 422 : 201);
+}
+//# sourceMappingURL=evaluations.js.map

package/dist/routes/evaluations.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evaluations.js","sourceRoot":"","sources":["../../src/routes/evaluations.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,WAAW,EAAU,aAAa,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAExG,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAEzD,uHAAuH;AACvH,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B,oGAAoG;AACpG,MAAM,UAAU,mBAAmB,CAAC,GAAc,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,UAAU,EAAc;IAChG,uCAAuC;IACvC,GAAG,CAAC,IAAI,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QACxB,IAAI,IAAI,CAAC,KAAK,IAAI,UAAU;YAAE,OAAO,YAAY,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QACjF,OAAO,WAAW,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;QACpL,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1E,IAAI,CAAC,EAAE;YAAE,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC9E,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,CAAC,KAAK,MAAM,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAC,CAAC,EAAC,EAAE;QAC9C,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,EAAE,mBAAmB,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1M,GAAG,CAAC,IAAI,CAAC,4BAA4B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACjD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IACH,uDAAuD;IACvD,GAAG,CAAC,GAAG,CAAC,WAAW,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC/B,MAAM,KAAK,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,gBAAgB,EAAE,CAAC,CAAC;QAC3H,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC9P,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,+BAA+B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACpD,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,WAAW,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QAC7H,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjH,CAAC,CAAC,CAAC;AAEL,CAAC;AAED,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC;IAC5B,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE;IAC3B,gEAAgE;IAChE,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,EAAE;IACvC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IACpC,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;IAC7B,kDAAkD;IAClD,eAAe,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC,CAAC;AAEH,KAAK,UAAU,iBAAiB,CAAC,CAAe;IAC9C,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;IACxE,MAAM,IAAI,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACrC,MAAM,cAAc,GAAG,kBAAkB,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACrD,+GAA+G;IAC/G,MAAM,eAAe,GAAG,MAAM,CAAC,WAAW,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACvJ,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IAC/E,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM;QAAE,MAAM,IAAI,eAAe,CAAC,sCAAsC,CAAC,CAAC;IAC/F,MAAM,GAAG,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAClH,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC;AACxD,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,CAAe,EAAE,MAAc,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,eAAe,EAAU,EAAE,UAAoC;IACjJ,uGAAuG;IACvG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,cAAc,KAAK,SAAS;YACzC,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE;YACtE,CAAC,CAAC,MAAM,MAAM,CAAC,2BAA2B,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QAC1F,mGAAmG;QACnG,IAAI,MAAM,CAAC,QAAQ;YAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,UAAU,CAAC,MAAM,EAAE,GAAG,EAAE,mBAAmB,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC7J,CAAC;IACD,CAAC;QACC,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,EAAE,UAAU,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,8BAA8B,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzM,IAAI,MAAM,CAAC,QAAQ;YAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,EAAE,mBAAmB,MAAM,CAAC,UAAU,CAAC,EAAE,EAAE,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IAC1L,CAAC;AAEH,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,CAAe,EAAE,MAAc,EAAE,EAAE,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,IAAI,EAAU;IAChH,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;IAC7C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,MAAM,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,EAAE,GAAG,GAAG,EAAE,cAAc,EAAE,eAAe,EAAE,CAAC,CAAC;QAC9G,IAAI,QAAQ;YAAE,CAAC,CAAC,MAAM,CAAC,sBAAsB,EAAE,MAAM,CAAC,CAAC;QACvD,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACjI,CAAC;IACD,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC,EAAE,EAAE,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;AAChG,CAAC"}

package/dist/routes/rubrics.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from "hono";
+import type { AppOptions, Env } from "../app.js";
+/** Registers rubrics operations; handler failures propagate to the transport error boundary. */
+export declare function registerRubrics(app: Hono<Env>, { engine }: AppOptions): void;

package/dist/routes/rubrics.js

@@ -0,0 +1,50 @@
+/**
+ * Tenant context flows to every engine/store operation; validation failures use the shared HTTP error mapper.
+ */
+import { NotFoundError, calibrate, parseRubric } from "@verdict-ai/core";
+import { z } from "zod";
+import { readRubricBody, tenant } from "./shared.js";
+/** Registers rubrics operations; handler failures propagate to the transport error boundary. */
+export function registerRubrics(app, { engine }) {
+    /* ---------- rubrics ---------- */
+    app.post("/v1/rubrics", async (c) => {
+        const body = await readRubricBody(c.req.raw);
+        const r = await engine.createRubric(body, tenant(c));
+        return c.json(r, 201);
+    });
+    app.post("/v1/rubrics/validate", async (c) => {
+        try {
+            const r = parseRubric(await readRubricBody(c.req.raw));
+            return c.json({ valid: true, rubric: r });
+        }
+        // why: validation is a diagnostic endpoint; invalid rubrics are successful diagnostic responses.
+        catch (e) {
+            return c.json({ valid: false, error: e instanceof z.ZodError ? e.issues : e.message }, 200);
+        }
+    });
+    app.get("/v1/rubrics", async (c) => c.json({ data: await engine.store.listRubrics({ tenantId: tenant(c), limit: Number(c.req.query("limit") ?? 100) }) }));
+    app.get("/v1/rubrics/:id", async (c) => {
+        const r = await engine.store.getRubric(c.req.param("id"), tenant(c));
+        if (!r)
+            throw new NotFoundError(`rubric ${c.req.param("id")} not found`);
+        return c.json(r);
+    });
+    app.get("/v1/rubrics/:id/calibration", async (c) => {
+        const rubricId = c.req.param("id"), tenantId = tenant(c);
+        if (!(await engine.store.getRubric(rubricId, tenantId)))
+            throw new NotFoundError(`rubric ${rubricId} not found`);
+        const options = z.object({
+            target: z.coerce.number().min(0).max(1).default(0.8),
+            buckets: z.coerce.number().int().min(1).max(1000).default(5),
+            limit: z.coerce.number().int().min(1).default(1000),
+        }).parse(c.req.query());
+        return c.json(calibrate(await engine.store.listEvaluations({ tenantId, rubricId, limit: options.limit }), options));
+    });
+    app.put("/v1/rubrics/:id", async (c) => c.json(await engine.updateRubric(c.req.param("id"), await readRubricBody(c.req.raw), tenant(c))));
+    app.delete("/v1/rubrics/:id", async (c) => {
+        if (!(await engine.store.deleteRubric(c.req.param("id"), tenant(c))))
+            throw new NotFoundError(`rubric ${c.req.param("id")} not found`);
+        return c.body(null, 204);
+    });
+}
+//# sourceMappingURL=rubrics.js.map

package/dist/routes/rubrics.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rubrics.js","sourceRoot":"","sources":["../../src/routes/rubrics.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAEzE,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErD,gGAAgG;AAChG,MAAM,UAAU,eAAe,CAAC,GAAc,EAAE,EAAE,MAAM,EAAc;IACpE,mCAAmC;IACnC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC7C,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrD,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,IAAI,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC3C,IAAI,CAAC;YAAC,MAAM,CAAC,GAAG,WAAW,CAAC,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;YAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC1G,iGAAiG;QACjG,OAAO,CAAC,EAAE,CAAC;YAAC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAE,CAAW,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;QAAC,CAAC;IACvH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC3J,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACrC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,IAAI,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,6BAA6B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACjD,MAAM,QAAQ,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QACzD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,UAAU,QAAQ,YAAY,CAAC,CAAC;QACjH,MAAM,OAAO,GAAG,CAAC,CAAC,MAAM,CAAC;YACvB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACpD,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC5D,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;SACpD,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACxB,OAAO,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;IACtH,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,cAAc,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1I,GAAG,CAAC,MAAM,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACxC,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,UAAU,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvI,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AAEL,CAAC"}

package/dist/routes/shared.d.ts

@@ -0,0 +1,8 @@
+/** Decodes JSON or YAML rubric bodies; rejects read, syntax and rubric validation failures. */
+export declare function readRubricBody(req: Request): Promise<unknown>;
+/** Returns an optional idempotency key; throws ZodError when its length is outside 1–255 characters. */
+export declare function readIdempotencyKey(req: Request): string | undefined;
+/** Returns the authenticated tenant, or undefined for open local deployments. */
+export declare const tenant: (c: {
+    get(k: "tenantId"): string;
+}) => string | undefined;

package/dist/routes/shared.js

@@ -0,0 +1,22 @@
+/**
+ * Defines shared request handling at the REST boundary.
+ * Tenant context flows to every engine/store operation; validation failures use the shared HTTP error mapper.
+ */
+import { loadRubricText } from "@verdict-ai/core";
+import { z } from "zod";
+/** Decodes JSON or YAML rubric bodies; rejects read, syntax and rubric validation failures. */
+export async function readRubricBody(req) {
+    const ct = req.headers.get("content-type") ?? "";
+    const text = await req.text();
+    if (ct.includes("yaml") || ct.includes("text/plain"))
+        return loadRubricText(text);
+    return JSON.parse(text);
+}
+/** Returns an optional idempotency key; throws ZodError when its length is outside 1–255 characters. */
+export function readIdempotencyKey(req) {
+    const key = req.headers.get("Idempotency-Key");
+    return key === null ? undefined : z.string().min(1).max(255).parse(key);
+}
+/** Returns the authenticated tenant, or undefined for open local deployments. */
+export const tenant = (c) => c.get("tenantId") || undefined;
+//# sourceMappingURL=shared.js.map

package/dist/routes/shared.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY;IAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAiC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC"}

package/dist/server.d.ts

@@ -0,0 +1,19 @@
+import { Engine, MemoryQueue, type Store } from "@verdict-ai/core";
+export interface ServerOptions {
+    port?: number;
+    dataDir?: string;
+    database?: string;
+    allowLocalFiles?: boolean;
+    store?: Store;
+    queue?: MemoryQueue;
+    loadDatabase?: (kind: "postgres" | "sqlite") => Promise<{
+        open: typeof import("@verdict-ai/db/postgres").fromPostgres | typeof import("@verdict-ai/db/sqlite").fromSqliteFile;
+    }>;
+}
+/** Starts the Node server using supplied or environment-selected adapters; startup failures reject. */
+export declare function startServer(opts?: ServerOptions): Promise<{
+    app: import("hono").Hono<import("./app.js").Env, import("hono/types").BlankSchema, "/">;
+    engine: Engine;
+    server: import("@hono/node-server").ServerType;
+    port: number;
+}>;

package/dist/server.js

@@ -0,0 +1,61 @@
+/**
+ * Starts the Node HTTP surface with environment-selected persistence.
+ * Database keys retain bootstrap authentication; shutdown drains queued work before exiting.
+ */
+import { serve } from "@hono/node-server";
+import { Engine, MemoryQueue, FileStore, MemoryStore } from "@verdict-ai/core";
+import { createApp, envAuth } from "./app.js";
+// Keep environment interpretation at startup so storage and queue dependencies can be supplied by tests.
+function serverConfig(opts, env = process.env) {
+    return {
+        port: opts.port ?? Number(env.PORT ?? 8787),
+        dataDir: opts.dataDir ?? env.VERDICT_DATA_DIR,
+        database: opts.database ?? env.VERDICT_DATABASE,
+        allowLocalFiles: opts.allowLocalFiles ?? env.VERDICT_ALLOW_LOCAL_FILES === "1",
+        log: env.VERDICT_LOG !== "0", apiKeys: env.VERDICT_API_KEYS, adminKey: env.VERDICT_ADMIN_KEY,
+    };
+}
+/** Starts the Node server using supplied or environment-selected adapters; startup failures reject. */
+export async function startServer(opts = {}) {
+    const config = serverConfig(opts);
+    const { port, dataDir, database } = config;
+    let store;
+    let auth = envAuth();
+    let keys;
+    if (opts.store)
+        store = opts.store;
+    else if (database) {
+        const kind = /^postgres(ql)?:\/\//.test(database) ? "postgres" : "sqlite";
+        const { open } = await (opts.loadDatabase ?? loadDatabase)(kind);
+        // Env keys stay valid as a bootstrap, but open mode (no VERDICT_API_KEYS) must not bypass the DB keys.
+        const h = await open(database, config.apiKeys ? envAuth() : undefined);
+        store = h.store;
+        auth = h.auth;
+        keys = h.auth;
+    }
+    else
+        store = dataDir ? new FileStore(dataDir) : new MemoryStore();
+    const queue = opts.queue ?? new MemoryQueue();
+    const engine = new Engine({ store, queue, ingest: { allowLocalFiles: config.allowLocalFiles } });
+    queue.engine = engine;
+    const app = createApp({ engine, auth, keys, log: config.log });
+    const server = serve({ fetch: app.fetch, port }, (info) => {
+        const storeName = database ? (/^postgres(ql)?:\/\//.test(database) ? "postgres" : `sqlite:${database}`) : dataDir ? `file:${dataDir}` : "memory";
+        console.log(`verdict api listening on http://localhost:${info.port}  (store: ${storeName}, auth: ${database ? "db + env keys" : config.apiKeys ? "env keys" : "open"}${config.adminKey && keys ? ", admin on" : ""})`);
+    });
+    process.once("SIGTERM", () => {
+        // why: retry timers are unreferenced; keep Node alive until delayed work drains during graceful shutdown.
+        const keepAlive = setInterval(() => { }, 1000);
+        server.close(() => { void queue.drain().then(() => { clearInterval(keepAlive); process.exit(0); }); });
+    });
+    return { app, engine, server, port };
+}
+// Driver imports belong at startup so the Node factory can be exercised without native modules.
+async function loadDatabase(kind) {
+    if (kind === "postgres")
+        return { open: (await import("@verdict-ai/db/postgres")).fromPostgres };
+    return { open: (await import("@verdict-ai/db/sqlite")).fromSqliteFile };
+}
+if (import.meta.url === `file://${process.argv[1]}`)
+    void startServer();
+//# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAc,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,OAAO,EAA8B,MAAM,UAAU,CAAC;AAQ1E,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAmB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,gBAAgB;QAC/C,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAC9E,GAAG,EAAE,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB;KAC7F,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB,EAAE;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC3C,IAAI,KAAY,CAAC;IACjB,IAAI,IAAI,GAAS,OAAO,EAAE,CAAC;IAC3B,IAAI,IAA4B,CAAC;IACjC,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;SAC9B,IAAI,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,uGAAuG;QACvG,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;;QAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACjG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjJ,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,CAAC,IAAI,aAAa,SAAS,WAAW,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzN,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;QAC3B,0GAA0G;QAC1G,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,YAAY,CAAC,IAA2B;IACrD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACjG,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AAC1E,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAAE,KAAK,WAAW,EAAE,CAAC"}

package/dist/worker.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Builds Workers-compatible engines and consumes Cloudflare queue messages.
+ * D1 reservations commit before judging; failed queue attempts must be acknowledged or retried explicitly.
+ */
+import { Engine, type Job } from "@verdict-ai/core";
+export interface Env {
+    [name: string]: unknown;
+    DB?: D1Database;
+    QUEUE?: Pick<Queue<Job>, "send">;
+    /** Workers AI binding: Clef / Clef-flash run in-network without a REST token. */
+    AI?: Pick<Ai, "run">;
+}
+/** Shared by HTTP producers and queue consumers. */
+export declare function buildEngine(env: Env): {
+    engine: Engine;
+    auth: import("./app.js").Auth;
+    keys: import("@verdict-ai/db").DrizzleAuth | undefined;
+    adminKey: string;
+};
+export interface JobMessage {
+    body: Job;
+    ack(): void;
+    retry(options: {
+        delaySeconds: number;
+    }): void;
+}
+/** Returns a queue consumer; retryable jobs retry and terminal jobs are acknowledged. */
+export declare function createQueueHandler(build?: typeof buildEngine): (batch: Pick<MessageBatch<Job>, "messages"> | {
+    messages: readonly JobMessage[];
+}, env: Env, _ctx?: ExecutionContext) => Promise<void>;
+export declare const queue: (batch: Pick<MessageBatch<Job>, "messages"> | {
+    messages: readonly JobMessage[];
+}, env: Env, _ctx?: ExecutionContext) => Promise<void>;
+declare const _default: {
+    fetch(request: Request, env: Env, ctx: Pick<ExecutionContext, "waitUntil">): Response | Promise<Response>;
+    queue: (batch: Pick<MessageBatch<Job>, "messages"> | {
+        messages: readonly JobMessage[];
+    }, env: Env, _ctx?: ExecutionContext) => Promise<void>;
+};
+export default _default;

package/dist/worker.js

@@ -0,0 +1,63 @@
+/**
+ * Builds Workers-compatible engines and consumes Cloudflare queue messages.
+ * D1 reservations commit before judging; failed queue attempts must be acknowledged or retried explicitly.
+ */
+import { Engine, MemoryStore, RetryableError, registerDecisionProvider } from "@verdict-ai/core";
+import { fromD1 } from "@verdict-ai/db";
+import { createApp, envAuth } from "./app.js";
+import { CloudflareQueue } from "./queue-cloudflare.js";
+const memory = new MemoryStore();
+/**
+ * Decision provider "cloudflare" backed by the Workers AI binding instead of the REST API.
+ * Same System One body (`model` selector, `state`, `questions`); the binding returns the inner result directly.
+ */
+function aiBindingProvider(ai) {
+    return {
+        name: "cloudflare",
+        async decide(req) {
+            const model = req.model ?? "@cf/cloudflare/clef-flash";
+            const extra = req.options?.request;
+            const body = { model: req.options?.selector ?? model.split("/").pop(), state: req.state, questions: req.questions, ...(extra && typeof extra === "object" ? extra : {}) };
+            const data = (await ai.run(model, body));
+            return { answers: data.answers ?? {}, model, usage: { inputTokens: data.usage?.input_tokens ?? data.usage?.prompt_tokens ?? 0, outputTokens: data.usage?.output_tokens ?? 0 }, raw: data };
+        },
+    };
+}
+/** Shared by HTTP producers and queue consumers. */
+export function buildEngine(env) {
+    const vars = Object.fromEntries(Object.entries(env).filter((entry) => typeof entry[1] === "string"));
+    const envKeys = envAuth(vars);
+    const d1 = env.DB ? fromD1(env.DB, vars.VERDICT_API_KEYS ? envKeys : undefined) : undefined;
+    if (env.AI)
+        registerDecisionProvider(aiBindingProvider(env.AI));
+    const engine = new Engine({ store: d1?.store ?? memory, queue: env.QUEUE ? new CloudflareQueue(env.QUEUE) : undefined, env: n => vars[n], webhookSecret: vars.VERDICT_WEBHOOK_SECRET });
+    return { engine, auth: d1?.auth ?? envKeys, keys: d1?.auth, adminKey: vars.VERDICT_ADMIN_KEY };
+}
+/** Returns a queue consumer; retryable jobs retry and terminal jobs are acknowledged. */
+export function createQueueHandler(build = buildEngine) {
+    return async (batch, env, _ctx) => {
+        const { engine } = build(env);
+        await Promise.all(batch.messages.map(async (message) => {
+            try {
+                await engine.processJob(message.body);
+                message.ack();
+            }
+            catch (error) {
+                if (error instanceof RetryableError)
+                    message.retry({ delaySeconds: Math.ceil((error.retryAfterMs ?? 0) / 1000) });
+                // why: permanent failures must not poison the queue through endless redelivery.
+                else
+                    message.ack();
+            }
+        }));
+    };
+}
+export const queue = createQueueHandler();
+export default {
+    fetch(request, env, ctx) {
+        const app = createApp({ ...buildEngine(env), background: promise => ctx.waitUntil(promise) });
+        return app.fetch(request);
+    },
+    queue,
+};
+//# sourceMappingURL=worker.js.map

package/dist/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAgE,MAAM,kBAAkB,CAAC;AAC/J,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AASxD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;AAEjC;;;GAGG;AACH,SAAS,iBAAiB,CAAC,EAA0B;IACnD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,2BAA2B,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;YACnC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAG,GAAG,CAAC,OAAO,EAAE,QAA+B,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/N,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAqJ,CAAC;YAC7L,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7L,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAChI,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,GAAG,CAAC,EAAE;QAAE,wBAAwB,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACxL,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;AACjG,CAAC;AAOD,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,WAAW;IACpD,OAAO,KAAK,EAAE,KAAgF,EAAE,GAAQ,EAAE,IAAuB,EAAE,EAAE;QACnI,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;YACnD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC;YAC7D,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,cAAc;oBAAE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClH,gFAAgF;;oBAC3E,OAAO,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;AAC1C,eAAe;IACb,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAwC;QACxE,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK;CACN,CAAC"}

package/package.json

@@ -1,6 +1,72 @@
 {
   "name": "@verdict-ai/api",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "0.1.0",
+  "description": "Verdict REST API (Hono). Runs on Node and Cloudflare Workers.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./server": {
+      "types": "./dist/server.d.ts",
+      "import": "./dist/server.js"
+    },
+    "./worker": {
+      "types": "./dist/worker.d.ts",
+      "import": "./dist/worker.js"
+    }
+  },
+  "dependencies": {
+    "@hono/node-server": "^2.1.6",
+    "hono": "^4.13.16",
+    "zod": "^4.6.7",
+    "@verdict-ai/core": "0.1.0",
+    "@verdict-ai/db": "0.1.0"
+  },
+  "devDependencies": {
+    "@cloudflare/workers-types": "^5.20261104.1"
+  },
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Ustay-coder/verdict.git",
+    "directory": "packages/api"
+  },
+  "homepage": "https://github.com/Ustay-coder/verdict#readme",
+  "bugs": {
+    "url": "https://github.com/Ustay-coder/verdict/issues"
+  },
+  "keywords": [
+    "evaluation",
+    "rubric",
+    "decision-model",
+    "jev",
+    "clef",
+    "scoring",
+    "llm-judge",
+    "mcp"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE",
+    "wrangler.example.toml"
+  ],
+  "sideEffects": false,
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "test": "vitest run",
+    "dev": "node --watch dist/server.js",
+    "start": "node dist/server.js"
+  }
 }

package/wrangler.example.toml

@@ -0,0 +1,36 @@
+# Cloudflare Workers deployment (copy to wrangler.toml). Build first: pnpm build
+name = "verdict-api"
+main = "dist/worker.js"
+compatibility_date = "2026-10-01"
+compatibility_flags = ["nodejs_compat"]
+
+# Persistence: Cloudflare D1 through Drizzle. Create with `wrangler d1 create verdict`, paste the id below, then
+#   wrangler d1 migrations apply verdict --local     # dev
+#   wrangler d1 migrations apply verdict --remote    # prod
+[[d1_databases]]
+binding = "DB"
+database_name = "verdict"
+database_id = "<paste-from-wrangler-d1-create>"
+migrations_dir = "../db/drizzle"
+
+# Secrets (wrangler secret put <NAME>):
+#   TYPESAFE_API_KEY         Jev (default judge)
+#   CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN   Clef / Clef-flash via Workers AI REST
+#   VERDICT_API_KEYS         bootstrap tenant keys, "key:tenant,..." (DB-managed keys take precedence)
+#   VERDICT_ADMIN_KEY        enables POST/GET/DELETE /v1/admin/keys
+#   VERDICT_WEBHOOK_SECRET   HMAC for webhook deliveries
+
+# Clef inference through the Worker binding (no REST token needed):
+[ai]
+binding = "AI"
+
+# Create verdict-jobs and verdict-dlq before enabling (Queues plan required):
+# [[queues.producers]]
+# binding = "QUEUE"
+# queue = "verdict-jobs"
+# [[queues.consumers]]
+# queue = "verdict-jobs"
+# max_retries = 5
+# max_batch_size = 10
+# max_concurrency = 4
+# dead_letter_queue = "verdict-dlq"