@verdict-ai/api 0.1.0 → 0.2.0

package/dist/routes/publications.js

@@ -0,0 +1,79 @@
+/**
+ * Publishing to the public hub (docs/design/hub.md §16). Authenticated: a tenant previews, publishes and withdraws its
+ * own publications. Preview and publish build the document with the same function, so what the author previews is
+ * what is stored. Public reads come later (P3-3) and read only the publications collection.
+ */
+import { buildPublication, hasPublications, NotFoundError, PUBLICATION_LIMITS, withdrawalNote } from "@verdict-ai/core";
+import { HTTPException } from "hono/http-exception";
+import { enforce } from "../rate-limit.js";
+import { tenant } from "./shared.js";
+/** Registers publication routes; requests are validated by `buildPublication`, never trusted as documents. */
+export function registerPublications(app, { engine, publisherOf = defaultPublisher, now = () => Date.now(), limits }) {
+    const store = () => {
+        if (!hasPublications(engine.store))
+            throw new HTTPException(501, { message: "this server's store cannot keep publications" });
+        return engine.store;
+    };
+    const build = async (raw, tenantId) => {
+        // Previews do the same work as publishing, so they count against the same per-account limit.
+        await enforce(limits?.publish, tenantId ?? "local", "publishing");
+        const text = await raw.text();
+        if (new TextEncoder().encode(text).length > PUBLICATION_LIMITS.bytes)
+            throw new HTTPException(413, { message: `a publication request may be at most ${PUBLICATION_LIMITS.bytes} bytes` });
+        const owner = await publisherOf(tenantId);
+        if (!owner)
+            throw new HTTPException(403, { message: "publishing needs a GitHub sign-in: run `verdict hub login`" });
+        const s = store();
+        let body;
+        try {
+            body = JSON.parse(text);
+        }
+        catch {
+            throw new HTTPException(400, { message: "the publication request must be JSON" });
+        }
+        return buildPublication(body, {
+            owner, tenantId,
+            findParent: async (versionId) => {
+                const [parent] = await s.listPublications({ versionId, limit: 1 });
+                return parent ? { id: parent.id, ref: parent.ref } : undefined;
+            },
+        });
+    };
+    // A diagnostic, like /v1/rubrics/validate: a rejected request is a successful answer listing its issues.
+    app.post("/v1/publications/preview", async (c) => c.json(await build(c.req.raw, tenant(c))));
+    app.post("/v1/publications", async (c) => {
+        const tenantId = tenant(c);
+        const result = await build(c.req.raw, tenantId);
+        if (!result.ok || !result.publication)
+            return c.json({ error: { type: "validation", message: "the publication was rejected", issues: result.issues } }, 400);
+        const s = store(), draft = result.publication;
+        // A renamed GitHub login can be taken by someone else: a ref stays with the account that first published under it.
+        const [first] = await s.listPublications({ owner: draft.owner, slug: draft.slug, includeWithdrawn: true, limit: 1 });
+        if (first && first.tenantId !== tenantId)
+            throw new HTTPException(409, { message: `${draft.ref} belongs to another account; choose another slug` });
+        const [existing] = await s.listPublications({ owner: draft.owner, slug: draft.slug, versionId: draft.version.id, includeWithdrawn: true, limit: 1 });
+        if (existing?.withdrawnAt)
+            throw new HTTPException(409, { message: `${withdrawalNote(existing)}; publish a new version instead` });
+        // Publishing the same version again is a no-op that returns the stored document.
+        if (existing)
+            return c.json({ publication: existing, warnings: result.warnings, created: false }, 200);
+        const publication = { id: `pub_${crypto.randomUUID().replace(/-/g, "").slice(0, 20)}`, ...draft, createdAt: new Date(now()).toISOString() };
+        await s.putPublication(publication);
+        return c.json({ publication, warnings: result.warnings, created: true }, 201);
+    });
+    app.get("/v1/publications", async (c) => {
+        // An open single-tenant server has no tenant: every publication on it is the caller's.
+        return c.json({ data: await store().listPublications({ tenantId: tenant(c), includeWithdrawn: true, limit: Number(c.req.query("limit") ?? 50) }) });
+    });
+    app.delete("/v1/publications/:id", async (c) => {
+        const id = c.req.param("id");
+        if (!(await store().withdrawPublication(id, tenant(c), new Date(now()).toISOString())))
+            throw new NotFoundError(`publication ${id} not found`);
+        return c.body(null, 204);
+    });
+}
+/** Until authors sign in with GitHub (P3-2), a tenant publishes under its own id; open single-tenant mode under "local". */
+function defaultPublisher(tenantId) {
+    return tenantId ?? "local";
+}
+//# sourceMappingURL=publications.js.map

package/dist/routes/publications.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"publications.js","sourceRoot":"","sources":["../../src/routes/publications.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,aAAa,EAAE,kBAAkB,EAAE,cAAc,EAA2C,MAAM,kBAAkB,CAAC;AAEjK,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAGpD,OAAO,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAErC,8GAA8G;AAC9G,MAAM,UAAU,oBAAoB,CAAC,GAAc,EAAE,EAAE,MAAM,EAAE,WAAW,GAAG,gBAAgB,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAE,MAAM,EAAc;IACzI,MAAM,KAAK,GAAG,GAAqB,EAAE;QACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,8CAA8C,EAAE,CAAC,CAAC;QAC9H,OAAO,MAAM,CAAC,KAAK,CAAC;IACtB,CAAC,CAAC;IAEF,MAAM,KAAK,GAAG,KAAK,EAAE,GAAY,EAAE,QAA4B,EAAE,EAAE;QACjE,6FAA6F;QAC7F,MAAM,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,IAAI,OAAO,EAAE,YAAY,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,kBAAkB,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,wCAAwC,kBAAkB,CAAC,KAAK,QAAQ,EAAE,CAAC,CAAC;QAC1L,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,4DAA4D,EAAE,CAAC,CAAC;QACpH,MAAM,CAAC,GAAG,KAAK,EAAE,CAAC;QAClB,IAAI,IAAa,CAAC;QAClB,IAAI,CAAC;YAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAAC,CAAC;QAChC,MAAM,CAAC;YAAC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC5F,OAAO,gBAAgB,CAAC,IAAI,EAAE;YAC5B,KAAK,EAAE,QAAQ;YACf,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE;gBAC9B,MAAM,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,gBAAgB,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;gBACnE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YACjE,CAAC;SACF,CAAC,CAAC;IACL,CAAC,CAAC;IAEF,yGAAyG;IACzG,GAAG,CAAC,IAAI,CAAC,0BAA0B,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAE7F,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACvC,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,8BAA8B,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC;QAC7J,MAAM,CAAC,GAAG,KAAK,EAAE,EAAE,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC;QAC9C,mHAAmH;QACnH,MAAM,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACrH,IAAI,KAAK,IAAI,KAAK,CAAC,QAAQ,KAAK,QAAQ;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,kDAAkD,EAAE,CAAC,CAAC;QACpJ,MAAM,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC,CAAC,gBAAgB,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACrJ,IAAI,QAAQ,EAAE,WAAW;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,iCAAiC,EAAE,CAAC,CAAC;QACnI,iFAAiF;QACjF,IAAI,QAAQ;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,CAAC,CAAC;QACvG,MAAM,WAAW,GAAgB,EAAE,EAAE,EAAE,OAAO,MAAM,CAAC,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,EAAE,SAAS,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;QACzJ,MAAM,CAAC,CAAC,cAAc,CAAC,WAAW,CAAC,CAAC;QACpC,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,kBAAkB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACtC,uFAAuF;QACvF,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,KAAK,EAAE,CAAC,gBAAgB,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtJ,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,MAAM,CAAC,sBAAsB,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC7C,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,mBAAmB,CAAC,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,eAAe,EAAE,YAAY,CAAC,CAAC;QAC/I,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,4HAA4H;AAC5H,SAAS,gBAAgB,CAAC,QAA4B;IACpD,OAAO,QAAQ,IAAI,OAAO,CAAC;AAC7B,CAAC"}

package/dist/routes/reports.d.ts

@@ -0,0 +1,4 @@
+import { Hono } from "hono";
+import type { AppOptions, Env } from "../app.js";
+/** Registers report routes. */
+export declare function registerReports(app: Hono<Env>, options: AppOptions): void;

package/dist/routes/reports.js

@@ -0,0 +1,84 @@
+/**
+ * Reports of runs and comparisons (docs/design/control-plane.md §7): numbers a team's CI sends about runs it made
+ * itself. The server cannot repeat a run, so every report is kept as reported by its author; it checks only that the
+ * run names a version it holds (or receives with the report) and that version's hashes.
+ */
+import { CONTROL_LIST_LIMIT, CONTROL_VERSION_BYTES, ComparisonReportRequest, comparisonReport, NotFoundError, projectVersion, runReport, RunReportRequest, ValidationError, } from "@verdict-ai/core";
+import { z } from "zod";
+import { ApiError, bare, controlContext, projectNotFound, readJson } from "./shared.js";
+const limit = z.coerce.number().int().min(1).max(CONTROL_LIST_LIMIT).default(CONTROL_LIST_LIMIT);
+const RunsQuery = z.object({ name: z.string().optional(), versionId: z.string().optional(), dataset: z.string().optional(), limit });
+const ComparisonsQuery = z.object({ name: z.string().optional(), head: z.string().optional(), limit });
+/** 404 for a project that is not there; otherwise the refusal the caller names. */
+async function missing(store, scope, otherwise) {
+    return (await store.getProject(scope.tenantId, scope.project)) ? otherwise : projectNotFound(scope.project);
+}
+/** Registers report routes. */
+export function registerReports(app, options) {
+    const { store, scope, allow, project, at, now } = controlContext(options);
+    const base = "/v1/projects/:project/reports";
+    /** The version a run report is about: the one sent with it, else the one kept under that name. */
+    const reportedVersion = async (s, request) => {
+        const id = request.run.rubricVersionId;
+        if (request.version) {
+            if (request.version.id !== id)
+                throw new ValidationError(`the report sends version ${request.version.id} with a run of ${id}`);
+            return projectVersion(request.version, s, request.name, now);
+        }
+        const kept = await store().getVersion(s, request.name, id);
+        if (!kept)
+            throw await missing(store(), s, new ApiError(400, "unknown_version", `version ${id} is not kept under ${request.name} in project ${s.project}; send it with the report`));
+        return kept;
+    };
+    app.post(`${base}/runs`, async (c) => {
+        const request = RunReportRequest.parse(await readJson(c.req.raw, CONTROL_VERSION_BYTES));
+        const s = scope(c);
+        // Covers the version sent along: a key that may report may bring the version its report is about.
+        await allow(c, "report.put", { project: s.project, name: request.name, versionId: request.run.rubricVersionId });
+        const version = await reportedVersion(s, request);
+        const report = runReport(request, version, { scope: s, actor: c.get("actor"), at: at() });
+        if (request.version && (await store().putVersion(version)) === "no_project")
+            throw projectNotFound(s.project);
+        const result = await store().putRunReport(report);
+        if (result === "no_project")
+            throw projectNotFound(s.project);
+        return c.json({ report: bare(result.report), created: result.created }, result.created ? 201 : 200);
+    });
+    app.get(`${base}/runs`, async (c) => {
+        const q = RunsQuery.parse(c.req.query());
+        await allow(c, "report.read", { project: c.req.param("project"), name: q.name, versionId: q.versionId });
+        const reports = await store().listRunReports(await project(c), { name: q.name, versionId: q.versionId, datasetName: q.dataset, limit: q.limit });
+        return c.json({ data: reports.map(bare) });
+    });
+    app.get(`${base}/runs/:runId`, async (c) => {
+        const s = scope(c), id = c.req.param("runId");
+        await allow(c, "report.read", { project: s.project });
+        const report = await store().getRunReport(s, id);
+        if (!report)
+            throw new NotFoundError(`no report of run ${id} in project ${s.project}`);
+        return c.json(bare(report));
+    });
+    app.post(`${base}/comparisons`, async (c) => {
+        const request = ComparisonReportRequest.parse(await readJson(c.req.raw));
+        const s = scope(c), { base: from, head } = request.comparison;
+        await allow(c, "report.put", { project: s.project, name: request.name, versionId: head.rubricVersionId });
+        for (const side of [from, head]) {
+            const run = await store().getRunReport(s, side.runId);
+            if (!run)
+                throw await missing(store(), s, new ApiError(400, "unknown_run", `run ${side.runId} has not been reported to project ${s.project}; report both runs first`));
+            if (run.summary.rubricVersionId !== side.rubricVersionId)
+                throw new ValidationError(`run ${side.runId} was reported as a run of ${run.summary.rubricVersionId}, not ${side.rubricVersionId}`);
+        }
+        const result = await store().putComparisonReport(await comparisonReport(request, { scope: s, actor: c.get("actor"), at: at() }));
+        if (result === "no_project")
+            throw projectNotFound(s.project);
+        return c.json({ report: bare(result.report), created: result.created }, result.created ? 201 : 200);
+    });
+    app.get(`${base}/comparisons`, async (c) => {
+        const q = ComparisonsQuery.parse(c.req.query());
+        await allow(c, "report.read", { project: c.req.param("project"), name: q.name, versionId: q.head });
+        const reports = await store().listComparisonReports(await project(c), { name: q.name, headVersionId: q.head, limit: q.limit });
+        return c.json({ data: reports.map(bare) });
+    });
+}
+//# sourceMappingURL=reports.js.map

package/dist/routes/reports.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reports.js","sourceRoot":"","sources":["../../src/routes/reports.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,kBAAkB,EAAE,qBAAqB,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,aAAa,EAAE,cAAc,EAAE,SAAS,EAAE,gBAAgB,EAAE,eAAe,GAElK,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AAExF,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;AACjG,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AACrI,MAAM,gBAAgB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;AAEvG,mFAAmF;AACnF,KAAK,UAAU,OAAO,CAAC,KAAmB,EAAE,KAAmB,EAAE,SAAgB;IAC/E,OAAO,CAAC,MAAM,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;AAC9G,CAAC;AAED,+BAA+B;AAC/B,MAAM,UAAU,eAAe,CAAC,GAAc,EAAE,OAAmB;IACjE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAC1E,MAAM,IAAI,GAAG,+BAA+B,CAAC;IAE7C,kGAAkG;IAClG,MAAM,eAAe,GAAG,KAAK,EAAE,CAAe,EAAE,OAA0C,EAA2B,EAAE;QACrH,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACvC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;YACpB,IAAI,OAAO,CAAC,OAAO,CAAC,EAAE,KAAK,EAAE;gBAAE,MAAM,IAAI,eAAe,CAAC,4BAA4B,OAAO,CAAC,OAAO,CAAC,EAAE,kBAAkB,EAAE,EAAE,CAAC,CAAC;YAC/H,OAAO,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/D,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,CAAC,IAAI;YAAE,MAAM,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,EAAE,iBAAiB,EAAE,WAAW,EAAE,sBAAsB,OAAO,CAAC,IAAI,eAAe,CAAC,CAAC,OAAO,2BAA2B,CAAC,CAAC,CAAC;QACrL,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;IAEF,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACnC,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC,CAAC;QACzF,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,kGAAkG;QAClG,MAAM,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,CAAC,CAAC;QACjH,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,OAAO,CAAC,OAAO,IAAI,CAAC,MAAM,KAAK,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,YAAY;YAAE,MAAM,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9G,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAClC,MAAM,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC;QACzG,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC,cAAc,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,WAAW,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QACjJ,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACtD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,aAAa,CAAC,oBAAoB,EAAE,eAAe,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACvF,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QAC1C,MAAM,OAAO,GAAG,uBAAuB,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzE,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,OAAO,CAAC,UAAU,CAAC;QAC9D,MAAM,KAAK,CAAC,CAAC,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,SAAS,EAAE,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAC1G,KAAK,MAAM,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,MAAM,KAAK,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACtD,IAAI,CAAC,GAAG;gBAAE,MAAM,MAAM,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,EAAE,IAAI,QAAQ,CAAC,GAAG,EAAE,aAAa,EAAE,OAAO,IAAI,CAAC,KAAK,qCAAqC,CAAC,CAAC,OAAO,0BAA0B,CAAC,CAAC,CAAC;YACvK,IAAI,GAAG,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI,CAAC,eAAe;gBAAE,MAAM,IAAI,eAAe,CAAC,OAAO,IAAI,CAAC,KAAK,6BAA6B,GAAG,CAAC,OAAO,CAAC,eAAe,SAAS,IAAI,CAAC,eAAe,EAAE,CAAC,CAAC;QAChM,CAAC;QACD,MAAM,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,mBAAmB,CAAC,MAAM,gBAAgB,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;QACjI,IAAI,MAAM,KAAK,YAAY;YAAE,MAAM,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QAC9D,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACtG,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;QACzC,MAAM,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QAChD,MAAM,KAAK,CAAC,CAAC,EAAE,aAAa,EAAE,EAAE,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpG,MAAM,OAAO,GAAG,MAAM,KAAK,EAAE,CAAC,qBAAqB,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/H,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/routes/shared.d.ts

@@ -1,3 +1,20 @@
+/**
+ * Defines shared request handling at the REST boundary.
+ * Tenant context flows to every engine/store operation; validation failures use the shared HTTP error mapper.
+ */
+import { type AccessTarget, type ControlAction, type ControlStore, type ProjectScope } from "@verdict-ai/core";
+import type { Context } from "hono";
+import type { ContentfulStatusCode } from "hono/utils/http-status";
+import type { AppOptions, Env } from "../app.js";
+/** A refusal clients can tell apart by `type`; `extra` is merged into the error object of the response. */
+export declare class ApiError extends Error {
+    readonly status: ContentfulStatusCode;
+    readonly type: string;
+    readonly extra: Record<string, unknown>;
+    constructor(status: ContentfulStatusCode, type: string, message: string, extra?: Record<string, unknown>);
+}
+/** Reads a JSON body of at most `maxBytes`; 413 when larger, 400 when it is not JSON. An empty body reads as `{}`. */
+export declare function readJson(req: Request, maxBytes?: number): Promise<unknown>;
 /** Decodes JSON or YAML rubric bodies; rejects read, syntax and rubric validation failures. */
 export declare function readRubricBody(req: Request): Promise<unknown>;
 /** Returns an optional idempotency key; throws ZodError when its length is outside 1–255 characters. */
@@ -6,3 +23,20 @@ export declare function readIdempotencyKey(req: Request): string | undefined;
 export declare const tenant: (c: {
     get(k: "tenantId"): string;
 }) => string | undefined;
+/** Documents leave without the tenant they are stored under. */
+export declare function bare<T extends {
+    tenantId?: string;
+}>(doc: T): Omit<T, "tenantId">;
+/**
+ * What every control-plane route works with: the store, the project a request is about, and `allow`, the one place a
+ * request is allowed or refused (docs/design/control-plane.md §9.1). Routes call `allow` before they read or write.
+ */
+export declare function controlContext({ engine, authorize, now }: AppOptions): {
+    store: () => ControlStore;
+    scope: (c: Context<Env>) => ProjectScope;
+    allow: (c: Context<Env>, action: ControlAction, target?: AccessTarget) => Promise<void>;
+    project: (c: Context<Env>) => Promise<ProjectScope>;
+    at: () => string;
+    now: () => number;
+};
+export declare const projectNotFound: (name: string) => ApiError;

package/dist/routes/shared.js

@@ -2,8 +2,35 @@
  * Defines shared request handling at the REST boundary.
  * Tenant context flows to every engine/store operation; validation failures use the shared HTTP error mapper.
  */
-import { loadRubricText } from "@verdict-ai/core";
+import { allowAll, hasControl, loadRubricText } from "@verdict-ai/core";
+import { HTTPException } from "hono/http-exception";
 import { z } from "zod";
+/** A refusal clients can tell apart by `type`; `extra` is merged into the error object of the response. */
+export class ApiError extends Error {
+    status;
+    type;
+    extra;
+    constructor(status, type, message, extra = {}) {
+        super(message);
+        this.status = status;
+        this.type = type;
+        this.extra = extra;
+    }
+}
+/** Reads a JSON body of at most `maxBytes`; 413 when larger, 400 when it is not JSON. An empty body reads as `{}`. */
+export async function readJson(req, maxBytes = 100_000) {
+    const text = await req.text();
+    if (new TextEncoder().encode(text).length > maxBytes)
+        throw new HTTPException(413, { message: `the request may be at most ${maxBytes} bytes` });
+    if (!text.trim())
+        return {};
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        throw new HTTPException(400, { message: "the request body must be JSON" });
+    }
+}
 /** Decodes JSON or YAML rubric bodies; rejects read, syntax and rubric validation failures. */
 export async function readRubricBody(req) {
     const ct = req.headers.get("content-type") ?? "";
@@ -19,4 +46,49 @@ export function readIdempotencyKey(req) {
 }
 /** Returns the authenticated tenant, or undefined for open local deployments. */
 export const tenant = (c) => c.get("tenantId") || undefined;
+/** Documents leave without the tenant they are stored under. */
+export function bare(doc) {
+    const { tenantId: _tenantId, ...rest } = doc;
+    return rest;
+}
+const REFUSAL_MESSAGES = {
+    forbidden: "this key is not allowed to do that",
+    limit_exceeded: "this account's plan does not allow that",
+    approval_required: "this change needs an approval first",
+};
+/** What a refusal adds to the error object. It never replaces what says which refusal this is. */
+function refusalDetails(details = {}) {
+    const { type: _type, message: _message, ...rest } = details;
+    return rest;
+}
+/**
+ * What every control-plane route works with: the store, the project a request is about, and `allow`, the one place a
+ * request is allowed or refused (docs/design/control-plane.md §9.1). Routes call `allow` before they read or write.
+ */
+export function controlContext({ engine, authorize = allowAll, now = () => Date.now() }) {
+    const store = () => {
+        if (!hasControl(engine.store))
+            throw new HTTPException(501, { message: "this server's store cannot keep projects" });
+        return engine.store.control;
+    };
+    const scope = (c) => {
+        const tenantId = tenant(c), project = c.req.param("project") ?? "";
+        return tenantId === undefined ? { project } : { tenantId, project };
+    };
+    const allow = async (c, action, target = {}) => {
+        const claims = c.get("claims");
+        const decision = await authorize({ principal: { tenantId: tenant(c), actor: c.get("actor"), ...(claims ? { claims } : {}) }, action, target });
+        if (!decision.allow)
+            throw new ApiError(403, decision.reason, decision.message ?? REFUSAL_MESSAGES[decision.reason], refusalDetails(decision.details));
+    };
+    /** 404 unless the project of the request exists. */
+    const project = async (c) => {
+        const s = scope(c);
+        if (!(await store().getProject(s.tenantId, s.project)))
+            throw projectNotFound(s.project);
+        return s;
+    };
+    return { store, scope, allow, project, at: () => new Date(now()).toISOString(), now };
+}
+export const projectNotFound = (name) => new ApiError(404, "not_found", `project ${name} not found`);
 //# sourceMappingURL=shared.js.map

package/dist/routes/shared.js.map

@@ -1 +1 @@
-{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY;IAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAiC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC"}
+{"version":3,"file":"shared.js","sourceRoot":"","sources":["../../src/routes/shared.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,cAAc,EAA+E,MAAM,kBAAkB,CAAC;AAErJ,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAIxB,2GAA2G;AAC3G,MAAM,OAAO,QAAS,SAAQ,KAAK;IACZ;IAAuC;IAAwC;IAApG,YAAqB,MAA4B,EAAW,IAAY,EAAE,OAAe,EAAW,QAAiC,EAAE;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAArI,WAAM,GAAN,MAAM,CAAsB;QAAW,SAAI,GAAJ,IAAI,CAAQ;QAA4B,UAAK,GAAL,KAAK,CAA8B;IAAoB,CAAC;CAC7J;AAED,sHAAsH;AACtH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAAC,GAAY,EAAE,QAAQ,GAAG,OAAO;IAC7D,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,QAAQ;QAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,8BAA8B,QAAQ,QAAQ,EAAE,CAAC,CAAC;IAChJ,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAAC,CAAC;IAChC,MAAM,CAAC;QAAC,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CAAC;IAAC,CAAC;AACvF,CAAC;AAED,+FAA+F;AAC/F,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,GAAY;IAC/C,MAAM,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC;IACjD,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,YAAY,CAAC;QAAE,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,wGAAwG;AACxG,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/C,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC1E,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,MAAM,GAAG,CAAC,CAAiC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,SAAS,CAAC;AAE5F,gEAAgE;AAChE,MAAM,UAAU,IAAI,CAAkC,GAAM;IAC1D,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,IAAI,EAAE,GAAG,GAAG,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,gBAAgB,GAAG;IACvB,SAAS,EAAE,oCAAoC;IAC/C,cAAc,EAAE,yCAAyC;IACzD,iBAAiB,EAAE,qCAAqC;CAChD,CAAC;AAEX,kGAAkG;AAClG,SAAS,cAAc,CAAC,UAAmC,EAAE;IAC3D,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,EAAE,MAAM,EAAE,SAAS,GAAG,QAAQ,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,EAAc;IACjG,MAAM,KAAK,GAAG,GAAiB,EAAE;QAC/B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,aAAa,CAAC,GAAG,EAAE,EAAE,OAAO,EAAE,0CAA0C,EAAE,CAAC,CAAC;QACrH,OAAO,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC;IAC9B,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,CAAC,CAAe,EAAgB,EAAE;QAC9C,MAAM,QAAQ,GAAG,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACnE,OAAO,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;IACtE,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,KAAK,EAAE,CAAe,EAAE,MAAqB,EAAE,SAAuB,EAAE,EAAE,EAAE;QACxF,MAAM,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;QAC/I,IAAI,CAAC,QAAQ,CAAC,KAAK;YAAE,MAAM,IAAI,QAAQ,CAAC,GAAG,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,OAAO,IAAI,gBAAgB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IACzJ,CAAC,CAAC;IACF,oDAAoD;IACpD,MAAM,OAAO,GAAG,KAAK,EAAE,CAAe,EAAyB,EAAE;QAC/D,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACnB,IAAI,CAAC,CAAC,MAAM,KAAK,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAAE,MAAM,eAAe,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACzF,OAAO,CAAC,CAAC;IACX,CAAC,CAAC;IACF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,GAAG,EAAE,CAAC;AACxF,CAAC;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,WAAW,EAAE,WAAW,IAAI,YAAY,CAAC,CAAC"}

package/dist/server.js

@@ -3,8 +3,8 @@
  * Database keys retain bootstrap authentication; shutdown drains queued work before exiting.
  */
 import { serve } from "@hono/node-server";
-import { Engine, MemoryQueue, FileStore, MemoryStore } from "@verdict-ai/core";
-import { createApp, envAuth } from "./app.js";
+import { lazyPlaywrightScreenshot, Engine, MemoryQueue, FileStore, MemoryStore } from "@verdict-ai/core";
+import { createApp, envAuth, routeGroups } from "./app.js";
 // Keep environment interpretation at startup so storage and queue dependencies can be supplied by tests.
 function serverConfig(opts, env = process.env) {
     return {
@@ -12,7 +12,11 @@ function serverConfig(opts, env = process.env) {
         dataDir: opts.dataDir ?? env.VERDICT_DATA_DIR,
         database: opts.database ?? env.VERDICT_DATABASE,
         allowLocalFiles: opts.allowLocalFiles ?? env.VERDICT_ALLOW_LOCAL_FILES === "1",
+        // why: a headless browser per request is costly and fetches arbitrary URLs; servers opt in explicitly.
+        screenshots: env.VERDICT_SCREENSHOTS === "1",
         log: env.VERDICT_LOG !== "0", apiKeys: env.VERDICT_API_KEYS, adminKey: env.VERDICT_ADMIN_KEY,
+        github: env.GITHUB_CLIENT_ID ? { clientId: env.GITHUB_CLIENT_ID, clientSecret: env.GITHUB_CLIENT_SECRET } : undefined,
+        routes: routeGroups(env.VERDICT_ROUTES),
     };
 }
 /** Starts the Node server using supplied or environment-selected adapters; startup failures reject. */
@@ -36,9 +40,9 @@ export async function startServer(opts = {}) {
     else
         store = dataDir ? new FileStore(dataDir) : new MemoryStore();
     const queue = opts.queue ?? new MemoryQueue();
-    const engine = new Engine({ store, queue, ingest: { allowLocalFiles: config.allowLocalFiles } });
+    const engine = new Engine({ store, queue, ingest: { allowLocalFiles: config.allowLocalFiles, screenshot: config.screenshots ? lazyPlaywrightScreenshot() : undefined } });
     queue.engine = engine;
-    const app = createApp({ engine, auth, keys, log: config.log });
+    const app = createApp({ engine, auth, keys, log: config.log, github: config.github, clientKey: socketAddress, routes: config.routes });
     const server = serve({ fetch: app.fetch, port }, (info) => {
         const storeName = database ? (/^postgres(ql)?:\/\//.test(database) ? "postgres" : `sqlite:${database}`) : dataDir ? `file:${dataDir}` : "memory";
         console.log(`verdict api listening on http://localhost:${info.port}  (store: ${storeName}, auth: ${database ? "db + env keys" : config.apiKeys ? "env keys" : "open"}${config.adminKey && keys ? ", admin on" : ""})`);
@@ -58,4 +62,8 @@ async function loadDatabase(kind) {
 }
 if (import.meta.url === `file://${process.argv[1]}`)
     void startServer();
+/** The Node server limits per socket address: behind a proxy that is the proxy's, so put limits at the proxy too. */
+function socketAddress(c) {
+    return c.env?.incoming?.socket?.remoteAddress ?? "anonymous";
+}
 //# sourceMappingURL=server.js.map

package/dist/server.js.map

@@ -1 +1 @@
-{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAc,MAAM,kBAAkB,CAAC;AAC3F,OAAO,EAAE,SAAS,EAAE,OAAO,EAA8B,MAAM,UAAU,CAAC;AAQ1E,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAmB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,gBAAgB;QAC/C,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAC9E,GAAG,EAAE,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB;KAC7F,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB,EAAE;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC3C,IAAI,KAAY,CAAC;IACjB,IAAI,IAAI,GAAS,OAAO,EAAE,CAAC;IAC3B,IAAI,IAA4B,CAAC;IACjC,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;SAC9B,IAAI,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,uGAAuG;QACvG,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;;QAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IACjG,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;IAC/D,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjJ,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,CAAC,IAAI,aAAa,SAAS,WAAW,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzN,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;QAC3B,0GAA0G;QAC1G,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,YAAY,CAAC,IAA2B;IACrD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACjG,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AAC1E,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAAE,KAAK,WAAW,EAAE,CAAC"}
+{"version":3,"file":"server.js","sourceRoot":"","sources":["../src/server.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC1C,OAAO,EAAE,wBAAwB,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,WAAW,EAAc,MAAM,kBAAkB,CAAC;AAErH,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAA8B,MAAM,UAAU,CAAC;AAQvF,yGAAyG;AACzG,SAAS,YAAY,CAAC,IAAmB,EAAE,GAAG,GAAG,OAAO,CAAC,GAAG;IAC1D,OAAO;QACL,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;QAC3C,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,GAAG,CAAC,gBAAgB;QAC7C,QAAQ,EAAE,IAAI,CAAC,QAAQ,IAAI,GAAG,CAAC,gBAAgB;QAC/C,eAAe,EAAE,IAAI,CAAC,eAAe,IAAI,GAAG,CAAC,yBAAyB,KAAK,GAAG;QAC9E,uGAAuG;QACvG,WAAW,EAAE,GAAG,CAAC,mBAAmB,KAAK,GAAG;QAC5C,GAAG,EAAE,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,OAAO,EAAE,GAAG,CAAC,gBAAgB,EAAE,QAAQ,EAAE,GAAG,CAAC,iBAAiB;QAC5F,MAAM,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,gBAAgB,EAAE,YAAY,EAAE,GAAG,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS;QACrH,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;KACxC,CAAC;AACJ,CAAC;AAED,uGAAuG;AACvG,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAAsB,EAAE;IACxD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAC3C,IAAI,KAAY,CAAC;IACjB,IAAI,IAAI,GAAS,OAAO,EAAE,CAAC;IAC3B,IAAI,IAA4B,CAAC;IACjC,IAAI,IAAI,CAAC,KAAK;QAAE,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;SAC9B,IAAI,QAAQ,EAAE,CAAC;QAClB,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC1E,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC,IAAI,CAAC,CAAC;QACjE,uGAAuG;QACvG,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACvE,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;QAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;QAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;IAChD,CAAC;;QAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAC;IACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,WAAW,EAAE,CAAC;IAC9C,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,eAAe,EAAE,MAAM,CAAC,eAAe,EAAE,UAAU,EAAE,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,wBAAwB,EAAE,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAC1K,KAAK,CAAC,MAAM,GAAG,MAAM,CAAC;IACtB,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACvI,MAAM,MAAM,GAAG,KAAK,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,IAAI,EAAE,EAAE;QACxD,MAAM,SAAS,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,qBAAqB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC;QACjJ,OAAO,CAAC,GAAG,CAAC,6CAA6C,IAAI,CAAC,IAAI,aAAa,SAAS,WAAW,QAAQ,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IACzN,CAAC,CAAC,CAAC;IACH,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE;QAC3B,0GAA0G;QAC1G,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,GAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,KAAK,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzG,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AACvC,CAAC;AAED,gGAAgG;AAChG,KAAK,UAAU,YAAY,CAAC,IAA2B;IACrD,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC;IACjG,OAAO,EAAE,IAAI,EAAE,CAAC,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;AAC1E,CAAC;AAED,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAAE,KAAK,WAAW,EAAE,CAAC;AAExE,qHAAqH;AACrH,SAAS,aAAa,CAAC,CAAU;IAC/B,OAAQ,CAAC,CAAC,GAA0E,EAAE,QAAQ,EAAE,MAAM,EAAE,aAAa,IAAI,WAAW,CAAC;AACvI,CAAC"}

package/dist/worker.d.ts

@@ -2,20 +2,38 @@
  * Builds Workers-compatible engines and consumes Cloudflare queue messages.
  * D1 reservations commit before judging; failed queue attempts must be acknowledged or retried explicitly.
  */
-import { Engine, type Job } from "@verdict-ai/core";
+import { Engine, type DecisionProviderAdapter, type Job } from "@verdict-ai/core";
+import { type CloudflareRateLimit, type HubLimits } from "./rate-limit.js";
 export interface Env {
     [name: string]: unknown;
     DB?: D1Database;
     QUEUE?: Pick<Queue<Job>, "send">;
     /** Workers AI binding: Clef / Clef-flash run in-network without a REST token. */
     AI?: Pick<Ai, "run">;
+    /** Workers Rate Limiting bindings for the hub; without them, counts are kept per isolate. */
+    HUB_LOGIN_LIMITER?: CloudflareRateLimit;
+    HUB_PUBLISH_LIMITER?: CloudflareRateLimit;
+    HUB_READ_LIMITER?: CloudflareRateLimit;
 }
+/** Hub limits: a Cloudflare binding where configured, else this isolate's counters. */
+export declare function hubLimits(env: Env): HubLimits;
+/**
+ * Decision provider "cloudflare" backed by the Workers AI binding instead of the REST API.
+ * Same System One body (`model` selector, `state`, `questions`); the binding returns the inner result directly.
+ */
+export declare function aiBindingProvider(ai: NonNullable<Env["AI"]>): DecisionProviderAdapter;
 /** Shared by HTTP producers and queue consumers. */
 export declare function buildEngine(env: Env): {
     engine: Engine;
-    auth: import("./app.js").Auth;
+    auth: import("./app.js").Auth | import("@verdict-ai/db").DrizzleAuth;
     keys: import("@verdict-ai/db").DrizzleAuth | undefined;
     adminKey: string;
+    github: {
+        clientId: string;
+        clientSecret: string;
+    } | undefined;
+    limits: HubLimits;
+    routes: readonly ("evaluations" | "rubrics" | "hub" | "control")[];
 };
 export interface JobMessage {
     body: Job;

package/dist/worker.js

@@ -2,22 +2,39 @@
  * Builds Workers-compatible engines and consumes Cloudflare queue messages.
  * D1 reservations commit before judging; failed queue attempts must be acknowledged or retried explicitly.
  */
-import { Engine, MemoryStore, RetryableError, registerDecisionProvider } from "@verdict-ai/core";
+import { CLEF_LIMITS, Engine, MemoryStore, RetryableError, checkClefImages, registerDecisionProvider } from "@verdict-ai/core";
 import { fromD1 } from "@verdict-ai/db";
-import { createApp, envAuth } from "./app.js";
+import { createApp, envAuth, routeGroups } from "./app.js";
 import { CloudflareQueue } from "./queue-cloudflare.js";
+import { cloudflareLimiter, defaultHubLimits } from "./rate-limit.js";
 const memory = new MemoryStore();
+// An app is built per request; the fallback counters must outlive it to count anything.
+const isolateLimits = defaultHubLimits();
+/** Hub limits: a Cloudflare binding where configured, else this isolate's counters. */
+export function hubLimits(env) {
+    return {
+        login: env.HUB_LOGIN_LIMITER ? cloudflareLimiter(env.HUB_LOGIN_LIMITER) : isolateLimits.login,
+        publish: env.HUB_PUBLISH_LIMITER ? cloudflareLimiter(env.HUB_PUBLISH_LIMITER) : isolateLimits.publish,
+        read: env.HUB_READ_LIMITER ? cloudflareLimiter(env.HUB_READ_LIMITER) : isolateLimits.read,
+    };
+}
 /**
  * Decision provider "cloudflare" backed by the Workers AI binding instead of the REST API.
  * Same System One body (`model` selector, `state`, `questions`); the binding returns the inner result directly.
  */
-function aiBindingProvider(ai) {
+export function aiBindingProvider(ai) {
     return {
         name: "cloudflare",
+        acceptsImages: true,
+        maxImages: CLEF_LIMITS.maxImages,
         async decide(req) {
             const model = req.model ?? "@cf/cloudflare/clef-flash";
             const extra = req.options?.request;
-            const body = { model: req.options?.selector ?? model.split("/").pop(), state: req.state, questions: req.questions, ...(extra && typeof extra === "object" ? extra : {}) };
+            const extras = extra && typeof extra === "object" && !Array.isArray(extra) ? { ...extra } : {};
+            // Same image rules as the REST adapter: rubric-supplied images first, then the evidence's own.
+            const images = [...(Array.isArray(extras.images) ? extras.images.filter((x) => typeof x === "string") : []), ...(req.images ?? [])];
+            checkClefImages(images);
+            const body = { model: req.options?.selector ?? model.split("/").pop(), state: req.state, questions: req.questions, ...extras, ...(images.length ? { images } : {}) };
             const data = (await ai.run(model, body));
             return { answers: data.answers ?? {}, model, usage: { inputTokens: data.usage?.input_tokens ?? data.usage?.prompt_tokens ?? 0, outputTokens: data.usage?.output_tokens ?? 0 }, raw: data };
         },
@@ -31,7 +48,8 @@ export function buildEngine(env) {
     if (env.AI)
         registerDecisionProvider(aiBindingProvider(env.AI));
     const engine = new Engine({ store: d1?.store ?? memory, queue: env.QUEUE ? new CloudflareQueue(env.QUEUE) : undefined, env: n => vars[n], webhookSecret: vars.VERDICT_WEBHOOK_SECRET });
-    return { engine, auth: d1?.auth ?? envKeys, keys: d1?.auth, adminKey: vars.VERDICT_ADMIN_KEY };
+    const github = vars.GITHUB_CLIENT_ID ? { clientId: vars.GITHUB_CLIENT_ID, clientSecret: vars.GITHUB_CLIENT_SECRET } : undefined;
+    return { engine, auth: d1?.auth ?? envKeys, keys: d1?.auth, adminKey: vars.VERDICT_ADMIN_KEY, github, limits: hubLimits(env), routes: routeGroups(vars.VERDICT_ROUTES) };
 }
 /** Returns a queue consumer; retryable jobs retry and terminal jobs are acknowledged. */
 export function createQueueHandler(build = buildEngine) {

package/dist/worker.js.map

@@ -1 +1 @@
-{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,wBAAwB,EAAgE,MAAM,kBAAkB,CAAC;AAC/J,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AASxD,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;AAEjC;;;GAGG;AACH,SAAS,iBAAiB,CAAC,EAA0B;IACnD,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,2BAA2B,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;YACnC,MAAM,IAAI,GAAG,EAAE,KAAK,EAAG,GAAG,CAAC,OAAO,EAAE,QAA+B,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC/N,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAqJ,CAAC;YAC7L,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7L,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAChI,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,GAAG,CAAC,EAAE;QAAE,wBAAwB,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACxL,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;AACjG,CAAC;AAOD,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,WAAW;IACpD,OAAO,KAAK,EAAE,KAAgF,EAAE,GAAQ,EAAE,IAAuB,EAAE,EAAE;QACnI,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;YACnD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC;YAC7D,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,cAAc;oBAAE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClH,gFAAgF;;oBAC3E,OAAO,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;AAC1C,eAAe;IACb,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAwC;QACxE,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK;CACN,CAAC"}
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../src/worker.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,eAAe,EAAE,wBAAwB,EAAgE,MAAM,kBAAkB,CAAC;AAC7L,OAAO,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAA4C,MAAM,iBAAiB,CAAC;AAahH,MAAM,MAAM,GAAG,IAAI,WAAW,EAAE,CAAC;AACjC,wFAAwF;AACxF,MAAM,aAAa,GAAG,gBAAgB,EAAE,CAAC;AAEzC,uFAAuF;AACvF,MAAM,UAAU,SAAS,CAAC,GAAQ;IAChC,OAAO;QACL,KAAK,EAAE,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK;QAC7F,OAAO,EAAE,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,OAAO;QACrG,IAAI,EAAE,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,IAAI;KAC1F,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAA0B;IAC1D,OAAO;QACL,IAAI,EAAE,YAAY;QAClB,aAAa,EAAE,IAAI;QACnB,SAAS,EAAE,WAAW,CAAC,SAAS;QAChC,KAAK,CAAC,MAAM,CAAC,GAAG;YACd,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,2BAA2B,CAAC;YACvD,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,EAAE,OAAO,CAAC;YACnC,MAAM,MAAM,GAA4B,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxH,+FAA+F;YAC/F,MAAM,MAAM,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,CAAC;YACjJ,eAAe,CAAC,MAAM,CAAC,CAAC;YACxB,MAAM,IAAI,GAAG,EAAE,KAAK,EAAG,GAAG,CAAC,OAAO,EAAE,QAA+B,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,GAAG,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC7L,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAqJ,CAAC;YAC7L,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,KAAK,EAAE,YAAY,IAAI,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,KAAK,EAAE,aAAa,IAAI,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7L,CAAC;KACF,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,WAAW,CAAC,GAAQ;IAClC,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC;IAChI,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC5F,IAAI,GAAG,CAAC,EAAE;QAAE,wBAAwB,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;IAChE,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,IAAI,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,sBAAsB,EAAE,CAAC,CAAC;IACxL,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,gBAAgB,EAAE,YAAY,EAAE,IAAI,CAAC,oBAAoB,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAChI,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,iBAAiB,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;AAC3K,CAAC;AAOD,yFAAyF;AACzF,MAAM,UAAU,kBAAkB,CAAC,KAAK,GAAG,WAAW;IACpD,OAAO,KAAK,EAAE,KAAgF,EAAE,GAAQ,EAAE,IAAuB,EAAE,EAAE;QACnI,MAAM,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAC,OAAO,EAAC,EAAE;YACnD,IAAI,CAAC;gBAAC,MAAM,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAAC,OAAO,CAAC,GAAG,EAAE,CAAC;YAAC,CAAC;YAC7D,OAAO,KAAK,EAAE,CAAC;gBACb,IAAI,KAAK,YAAY,cAAc;oBAAE,OAAO,CAAC,KAAK,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,YAAY,IAAI,CAAC,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC,CAAC;gBAClH,gFAAgF;;oBAC3E,OAAO,CAAC,GAAG,EAAE,CAAC;YACrB,CAAC;QACH,CAAC,CAAC,CAAC,CAAC;IACN,CAAC,CAAC;AACJ,CAAC;AACD,MAAM,CAAC,MAAM,KAAK,GAAG,kBAAkB,EAAE,CAAC;AAC1C,eAAe;IACb,KAAK,CAAC,OAAgB,EAAE,GAAQ,EAAE,GAAwC;QACxE,MAAM,GAAG,GAAG,SAAS,CAAC,EAAE,GAAG,WAAW,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IACD,KAAK;CACN,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@verdict-ai/api",
-  "version": "0.1.0",
+  "version": "0.2.0",
   "description": "Verdict REST API (Hono). Runs on Node and Cloudflare Workers.",
   "type": "module",
   "main": "./dist/index.js",
@@ -23,8 +23,8 @@
     "@hono/node-server": "^2.1.6",
     "hono": "^4.13.16",
     "zod": "^4.6.7",
-    "@verdict-ai/core": "0.1.0",
-    "@verdict-ai/db": "0.1.0"
+    "@verdict-ai/core": "0.2.0",
+    "@verdict-ai/db": "0.2.0"
   },
   "devDependencies": {
     "@cloudflare/workers-types": "^5.20261104.1"

package/wrangler.example.toml

@@ -17,8 +17,25 @@ migrations_dir = "../db/drizzle"
 #   TYPESAFE_API_KEY         Jev (default judge)
 #   CLOUDFLARE_ACCOUNT_ID, CLOUDFLARE_API_TOKEN   Clef / Clef-flash via Workers AI REST
 #   VERDICT_API_KEYS         bootstrap tenant keys, "key:tenant,..." (DB-managed keys take precedence)
-#   VERDICT_ADMIN_KEY        enables POST/GET/DELETE /v1/admin/keys
+#   VERDICT_ADMIN_KEY        enables /v1/admin/* (key management, hub takedowns)
 #   VERDICT_WEBHOOK_SECRET   HMAC for webhook deliveries
+#   GITHUB_CLIENT_ID         hub sign-in: OAuth App client id (enable "Device Flow" in the app's settings)
+#   GITHUB_CLIENT_SECRET     hub sign-in: lets the hub check a token was minted for this app (recommended)
+
+# Hub limits shared across isolates (Workers Rate Limiting API; period is 10 or 60 seconds; `wrangler dev` simulates them). Without these bindings the
+# same limits are counted per isolate, which is a floor, not a guarantee. namespace_id: any number unique in your account.
+# [[ratelimits]]
+# name = "HUB_LOGIN_LIMITER"
+# namespace_id = "1001"
+# simple = { limit = 10, period = 60 }
+# [[ratelimits]]
+# name = "HUB_PUBLISH_LIMITER"
+# namespace_id = "1002"
+# simple = { limit = 30, period = 60 }
+# [[ratelimits]]
+# name = "HUB_READ_LIMITER"
+# namespace_id = "1003"
+# simple = { limit = 300, period = 60 }
 
 # Clef inference through the Worker binding (no REST token needed):
 [ai]