enigma-memory 0.1.13 → 0.1.15

package/packages/passport/src/index.js

@@ -123,11 +123,14 @@ function candidateRelevanceTokens(candidate) {
   return tokens;
 }
 
-function hasTokenOverlap(left, right) {
-  for (const token of left) {
-    if (right.has(token)) return true;
+
+function tokenOverlapScore(queryTokens, memoryTokens) {
+  if (queryTokens.size === 0) return 0;
+  let overlap = 0;
+  for (const token of queryTokens) {
+    if (memoryTokens.has(token)) overlap += 1;
   }
-  return false;
+  return overlap / queryTokens.size;
 }
 
 function strictQueryRelevance(args) {
@@ -148,7 +151,8 @@ function relevanceCandidateSet(args, candidates) {
 
   const relevant = [];
   for (const candidate of candidates) {
-    if (hasTokenOverlap(queryTokens, candidateRelevanceTokens(candidate))) relevant.push(candidate);
+    const relevance = tokenOverlapScore(queryTokens, candidateRelevanceTokens(candidate));
+    if (relevance > 0) relevant.push({ ...candidate, importance: Math.max(candidate.importance ?? 0, relevance) });
   }
   if (relevant.length > 0) return relevant;
   return strictQueryRelevance(args) ? [] : candidates;

package/scripts/build-benchmark-proof-release.mjs

@@ -0,0 +1,391 @@
+#!/usr/bin/env node
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { basename, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import {
+  createBenchmarkAttestation,
+  createProofNetworkPacket,
+  sha256Json,
+  validateBenchmarkAttestation,
+  validateProofNetworkPacket,
+} from '../packages/proof-network/src/index.js';
+
+export const BENCHMARK_PROOF_RELEASE_SCHEMA = 'enigma.benchmark_proof_release.v1';
+export const SCORE_COMMITMENT_SCHEMA = 'enigma.benchmark_proof_release.score_commitment.v1';
+export const DEFAULT_BENCHMARK_PROOF_OUT_DIR = '.enigma/benchmark-proof-release';
+
+const ATTESTATION_FILE = 'benchmark-attestation.json';
+const PROOF_PACKET_FILE = 'benchmark-proof-packet.json';
+const RELEASE_MANIFEST_FILE = 'benchmark-proof-release.json';
+const SHA256_PREFIX = 'sha256:';
+const PUBLIC_REF_RE = /^[a-z0-9][a-z0-9._:/@+-]{2,191}$/u;
+const SCORE_KEY_RE = /^[a-z][a-z0-9_.:-]{1,63}$/u;
+const PRIVATE_REPORT_KEY_RE = /(?:^|_)(?:raw_memory|memory_plaintext|plaintext|plain_text|prompt|prompts|conversation|conversations|message|messages|content|body|payload|payloads|document|documents|transcript|transcripts|completion|completions|embedding|embeddings|provider_response|provider_responses|response_body|credential|credentials|api_key|secret|password|private_key|seed|seed_phrase|mnemonic|tenant_name|customer_name|organization_name|org_name|account_id)(?:$|_)/iu;
+const ALLOWED_FALSE_REPORT_KEYS = new Set([
+  'raw_private_memory_plaintext_included',
+  'raw_question_text_included',
+  'raw_answer_text_included',
+  'raw_conversation_text_included',
+  'public_question_text_included',
+  'public_answer_text_included',
+  'provider_deletion_claim',
+  'model_forgetting_claim',
+  'roi_or_provider_invoice_savings_claim',
+  'compliance_certification_claim',
+  'benchmark_leadership_claim',
+  'external_provider_calls',
+  'llm_answer_accuracy_scored',
+  'raw_benchmark_body_included',
+  'report_body_copied',
+  'raw_memory_included',
+  'prompts_included',
+  'transcripts_included',
+  'provider_responses_included',
+  'provider_answer_accuracy_claim',
+  'competitor_performance_claim',
+  'solana_submission_claim',
+  'roi_or_profit_claim',
+  'provider_invoice_savings_claim',
+  'hosted_saas_claim',
+]);
+const SECRET_VALUE_RE = /(?:Bearer\s+[A-Za-z0-9._~+/=-]{12,}|Basic\s+[A-Za-z0-9+/=-]{12,}|-----BEGIN [A-Z ]*PRIVATE KEY-----|https?:\/\/[^\s/@]+:[^\s/@]+@|sk-[A-Za-z0-9_-]{16,}|AKIA[0-9A-Z]{16}|(?:seed phrase|mnemonic phrase|raw memory|private prompt|full transcript|provider response|embedding vector))/iu;
+const ABSOLUTE_LOCAL_PATH_RE = /^(?:[A-Za-z]:[\\/]|\\\\|\/(?:Users|home|tmp|var|etc|mnt|Volumes)\b)/u;
+const CLAIM_SCORE_KEY_RE = /(?:provider|competitor|roi|profit|savings|solana|transaction|answer_accuracy|leaderboard)/iu;
+
+class UsageError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = 'UsageError';
+  }
+}
+
+function readRequiredValue(argv, index, flag) {
+  const value = argv[index + 1];
+  if (value === undefined || value.startsWith('--')) throw new UsageError(`${flag} requires a value`);
+  return value;
+}
+
+function publicString(value, label) {
+  if (typeof value !== 'string' || value.trim() === '') throw new UsageError(`${label} must be a non-empty public value`);
+  const normalized = value.trim();
+  if (SECRET_VALUE_RE.test(normalized)) throw new UsageError(`${label} contains private or secret-looking material`);
+  if (ABSOLUTE_LOCAL_PATH_RE.test(normalized)) throw new UsageError(`${label} must not be a local absolute path`);
+  return normalized;
+}
+
+function pathString(value, label) {
+  if (typeof value !== 'string' || value.trim() === '') throw new UsageError(`${label} must be a non-empty path`);
+  const normalized = value.trim();
+  if (SECRET_VALUE_RE.test(normalized)) throw new UsageError(`${label} contains private or secret-looking material`);
+  return normalized;
+}
+
+function publicRef(value, label) {
+  const normalized = publicString(value, label);
+  if (!PUBLIC_REF_RE.test(normalized)) throw new UsageError(`${label} must be a lowercase public ref using letters, numbers, . _ : / @ + or -`);
+  return normalized;
+}
+
+function parseScore(raw) {
+  const normalized = publicString(raw, 'score');
+  const equals = normalized.indexOf('=');
+  if (equals <= 0 || equals === normalized.length - 1) throw new UsageError('--score must use key=value');
+  const key = normalized.slice(0, equals).trim();
+  const value = normalized.slice(equals + 1).trim();
+  if (!SCORE_KEY_RE.test(key)) throw new UsageError('score key must be lowercase and use letters, numbers, . _ : or -');
+  if (CLAIM_SCORE_KEY_RE.test(key)) throw new UsageError('score key must not imply provider accuracy, competitor performance, Solana submission, ROI, savings, profit, or leaderboard claims');
+  publicString(value, `score ${key}`);
+  return Object.freeze({ key, value });
+}
+
+export function parseArgs(argv = process.argv.slice(2)) {
+  const args = {
+    report: undefined,
+    datasetRef: undefined,
+    runnerRef: undefined,
+    packageRef: undefined,
+    scores: [],
+    outDir: DEFAULT_BENCHMARK_PROOF_OUT_DIR,
+    help: false,
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const raw = argv[index];
+    const equalsIndex = raw.indexOf('=');
+    const flag = equalsIndex > 0 ? raw.slice(0, equalsIndex) : raw;
+    const inlineValue = equalsIndex > 0 ? raw.slice(equalsIndex + 1) : undefined;
+    const value = () => {
+      if (inlineValue !== undefined) return inlineValue;
+      const next = readRequiredValue(argv, index, flag);
+      index += 1;
+      return next;
+    };
+
+    if (flag === '--help' || flag === '-h') args.help = true;
+    else if (flag === '--report') args.report = pathString(value(), 'report path');
+    else if (flag === '--dataset-ref') args.datasetRef = publicRef(value(), 'dataset ref');
+    else if (flag === '--runner-ref') args.runnerRef = publicRef(value(), 'runner ref');
+    else if (flag === '--package-ref') args.packageRef = publicRef(value(), 'package ref');
+    else if (flag === '--score') args.scores.push(parseScore(value()));
+    else if (flag === '--out-dir') args.outDir = pathString(value(), 'out dir');
+    else throw new UsageError(`unknown option ${raw}; use --help`);
+  }
+
+  return Object.freeze({ ...args, scores: Object.freeze(args.scores) });
+}
+
+export function usage() {
+  return `Usage: node scripts/build-benchmark-proof-release.mjs --report <path> --dataset-ref <ref> --runner-ref <ref> --package-ref <ref> [--score key=value ...] [--out-dir <dir>]
+
+Builds a dependency-free, local benchmark proof release from an existing public-safe benchmark report. The report file is parsed for public-safety checks and hashed, but its body and local path are never copied into the attestation or proof packet. The generated artifacts are local benchmark attestation/proof only: no API calls, provider answer-accuracy claims, competitor performance claims, Solana submissions, hosted SaaS claims, ROI/profit/savings claims, raw memory, prompts, transcripts, embeddings, credentials, account ids, private keys, or provider responses are written.
+`;
+}
+
+function requireArgs(args) {
+  const missing = [];
+  if (args.report === undefined) missing.push('--report');
+  if (args.datasetRef === undefined) missing.push('--dataset-ref');
+  if (args.runnerRef === undefined) missing.push('--runner-ref');
+  if (args.packageRef === undefined) missing.push('--package-ref');
+  if (missing.length > 0) throw new UsageError(`missing required option(s): ${missing.join(', ')}`);
+}
+
+function sha256Buffer(buffer) {
+  return `${SHA256_PREFIX}${createHash('sha256').update(buffer).digest('hex')}`;
+}
+
+function isPlainObject(value) {
+  return value !== null && typeof value === 'object' && !Array.isArray(value);
+}
+
+function assertPublicReportPayload(value, path = 'report') {
+  if (typeof value === 'string') {
+    if (SECRET_VALUE_RE.test(value)) throw new UsageError(`${path} contains private or secret-looking material`);
+    if (ABSOLUTE_LOCAL_PATH_RE.test(value)) throw new UsageError(`${path} contains a local absolute path`);
+    return;
+  }
+  if (Array.isArray(value)) {
+    value.forEach((item, index) => assertPublicReportPayload(item, `${path}[${index}]`));
+    return;
+  }
+  if (!isPlainObject(value)) return;
+  for (const [key, child] of Object.entries(value)) {
+    if (PRIVATE_REPORT_KEY_RE.test(key)) {
+      if (!ALLOWED_FALSE_REPORT_KEYS.has(key) || child !== false) throw new UsageError(`${path}.${key} is not allowed in public benchmark proof artifacts`);
+    }
+    assertPublicReportPayload(child, `${path}.${key}`);
+  }
+}
+
+function parseJsonReport(bytes) {
+  try {
+    return JSON.parse(bytes.toString('utf8'));
+  } catch {
+    throw new UsageError('report must be valid JSON');
+  }
+}
+
+function reportSchema(report) {
+  if (!isPlainObject(report)) throw new UsageError('report must be a JSON object');
+  if (typeof report.schema !== 'string' || report.schema.trim() === '') throw new UsageError('report.schema must be a non-empty string');
+  if (report.public_safe !== true) throw new UsageError('report.public_safe must be true');
+  assertPublicReportPayload(report);
+  return report.schema;
+}
+
+function nonNegativeInteger(value) {
+  return Number.isInteger(value) && value >= 0 ? value : undefined;
+}
+
+function sampleCountFromReport(report) {
+  if (Array.isArray(report.datasets)) {
+    let total = 0;
+    for (const row of report.datasets) {
+      total += nonNegativeInteger(row?.question_count) ?? nonNegativeInteger(row?.item_count) ?? 0;
+    }
+    if (total > 0) return total;
+  }
+  return nonNegativeInteger(report.metrics?.qa?.question_count)
+    ?? nonNegativeInteger(report.fixture?.question_count)
+    ?? nonNegativeInteger(report.fixture?.session_count)
+    ?? 0;
+}
+
+function slugRefPart(value) {
+  return String(value).toLowerCase().replace(/[^a-z0-9._:/@+-]+/gu, '-').replace(/^-+|-+$/gu, '') || 'benchmark-report';
+}
+
+function scoreCommitments(scores, reportHash) {
+  if (scores.length === 0) {
+    const fallback = Object.freeze({
+      schema: SCORE_COMMITMENT_SCHEMA,
+      key: 'report_hash_only',
+      value: reportHash,
+      report_body_copied: false,
+    });
+    return Object.freeze([{ ...fallback, score_hash: sha256Json(fallback) }]);
+  }
+  return Object.freeze(scores.map((score) => {
+    const body = Object.freeze({
+      schema: SCORE_COMMITMENT_SCHEMA,
+      key: score.key,
+      value: score.value,
+      report_body_copied: false,
+    });
+    return Object.freeze({ ...body, score_hash: sha256Json(body) });
+  }));
+}
+
+function assertValidation(validation, label) {
+  if (validation?.ok !== true) throw new Error(`${label} validation failed: ${(validation?.errors ?? ['unknown error']).join('; ')}`);
+}
+
+function releaseManifest({ generatedAt, reportHash, schema, args, commitments, attestation, packet }) {
+  const manifest = {
+    schema: BENCHMARK_PROOF_RELEASE_SCHEMA,
+    generated_at: generatedAt,
+    local_benchmark_attestation_only: true,
+    api_calls_made: false,
+    report: {
+      report_hash: reportHash,
+      report_schema: schema,
+      report_public_safe: true,
+      report_body_copied: false,
+      report_path_copied: false,
+    },
+    refs: {
+      dataset_ref: args.datasetRef,
+      runner_ref: args.runnerRef,
+      package_ref: args.packageRef,
+    },
+    score_commitments: commitments,
+    claim_boundaries: {
+      provider_answer_accuracy_claim: false,
+      competitor_performance_claim: false,
+      solana_submission_claim: false,
+      transaction_submitted: false,
+      roi_or_profit_claim: false,
+      provider_invoice_savings_claim: false,
+      hosted_saas_claim: false,
+      raw_benchmark_body_included: false,
+      raw_memory_included: false,
+      prompts_included: false,
+      transcripts_included: false,
+      provider_responses_included: false,
+    },
+    artifacts: {
+      attestation_file: ATTESTATION_FILE,
+      attestation_hash: attestation.benchmark_attestation_hash,
+      proof_packet_file: PROOF_PACKET_FILE,
+      proof_packet_hash: packet.proof_network_packet_hash,
+    },
+  };
+  return manifest;
+}
+
+function outputLabel(outDir) {
+  const normalized = outDir.replace(/\\/gu, '/');
+  if (ABSOLUTE_LOCAL_PATH_RE.test(outDir) || normalized.split('/').includes('..')) return '<redacted-out-dir>';
+  return normalized;
+}
+
+async function readReportBytes(path) {
+  try {
+    return await readFile(path);
+  } catch {
+    throw new Error('failed to read benchmark report');
+  }
+}
+
+export async function buildBenchmarkProofRelease(args, options = {}) {
+  requireArgs(args);
+  const generatedAt = options.generated_at ?? options.generatedAt ?? new Date().toISOString();
+  const bytes = await readReportBytes(args.report);
+  const reportHash = sha256Buffer(bytes);
+  const report = parseJsonReport(bytes);
+  const schema = reportSchema(report);
+  const commitments = scoreCommitments(args.scores, reportHash);
+  const metricRoots = commitments.map((score) => score.score_hash);
+
+  const attestation = createBenchmarkAttestation({
+    attested_at: generatedAt,
+    benchmark_ref: `benchmark:${slugRefPart(schema)}`,
+    dataset_ref: args.datasetRef,
+    runner_ref: args.runnerRef,
+    package_ref: args.packageRef,
+    report_hash: reportHash,
+    metric_roots: metricRoots,
+    sample_count: sampleCountFromReport(report),
+    run_count: 1,
+  });
+  assertValidation(validateBenchmarkAttestation(attestation), 'benchmark attestation');
+
+  const packet = createProofNetworkPacket({
+    attestations: [attestation],
+    packet_ref: `benchmark-proof-release:${sha256Json([attestation.benchmark_attestation_hash, reportHash]).slice(SHA256_PREFIX.length, SHA256_PREFIX.length + 32)}`,
+    created_at: generatedAt,
+  });
+  assertValidation(validateProofNetworkPacket(packet), 'proof packet');
+
+  const manifest = releaseManifest({ generatedAt, reportHash, schema, args, commitments, attestation, packet });
+  assertPublicReportPayload(manifest, 'manifest');
+
+  return Object.freeze({
+    schema: BENCHMARK_PROOF_RELEASE_SCHEMA,
+    generated_at: generatedAt,
+    report_hash: reportHash,
+    report_schema: schema,
+    attestation,
+    packet,
+    manifest,
+  });
+}
+
+export async function writeBenchmarkProofRelease(release, outDir) {
+  const root = resolve(outDir);
+  try {
+    await mkdir(root, { recursive: true });
+    const attestationPath = resolve(root, ATTESTATION_FILE);
+    const packetPath = resolve(root, PROOF_PACKET_FILE);
+    const manifestPath = resolve(root, RELEASE_MANIFEST_FILE);
+    await writeFile(attestationPath, `${JSON.stringify(release.attestation, null, 2)}\n`, 'utf8');
+    await writeFile(packetPath, `${JSON.stringify(release.packet, null, 2)}\n`, 'utf8');
+    await writeFile(manifestPath, `${JSON.stringify(release.manifest, null, 2)}\n`, 'utf8');
+    return Object.freeze({
+      attestation_file: basename(attestationPath),
+      proof_packet_file: basename(packetPath),
+      release_manifest_file: basename(manifestPath),
+    });
+  } catch {
+    throw new Error('failed to write benchmark proof release artifacts');
+  }
+}
+
+export async function main(argv = process.argv.slice(2)) {
+  const args = parseArgs(argv);
+  if (args.help) {
+    process.stdout.write(usage());
+    return 0;
+  }
+  const release = await buildBenchmarkProofRelease(args);
+  const files = await writeBenchmarkProofRelease(release, args.outDir);
+  process.stdout.write(`${JSON.stringify({
+    ok: true,
+    schema: BENCHMARK_PROOF_RELEASE_SCHEMA,
+    out_dir: outputLabel(args.outDir),
+    ...files,
+    report_hash: release.report_hash,
+    report_body_copied: false,
+    api_calls_made: false,
+  }, null, 2)}\n`);
+  return 0;
+}
+
+if (process.argv[1] && fileURLToPath(import.meta.url) === resolve(process.argv[1])) {
+  main().catch((error) => {
+    process.stderr.write(`${error.name ?? 'Error'}: ${error.message ?? 'failed to build benchmark proof release'}\n`);
+    process.exitCode = 1;
+  });
+}

package/scripts/build-goal-completion-audit.mjs

@@ -119,9 +119,14 @@ async function readText(path) {
   return await readFile(path, 'utf8');
 }
 
-async function readJsonPath(path) {
+async function readJsonPath(path, label = 'JSON input') {
   if (!path) return null;
-  return JSON.parse(await readFile(resolve(path), 'utf8'));
+  try {
+    return JSON.parse(await readFile(resolve(path), 'utf8'));
+  } catch (error) {
+    if (error instanceof SyntaxError) throw new UsageError(`${label} JSON is invalid`);
+    throw new UsageError(`${label} JSON could not be read`);
+  }
 }
 
 function nextActionsForGoalAudit(nextActions, workerInspect) {
@@ -312,13 +317,13 @@ export async function buildGoalCompletionAudit(input = {}, options = {}) {
   const liveUrl = optionalText(input.liveUrl, domain ? `https://${domain}/` : null);
   const expectTitle = optionalText(input.expectTitle, 'Enigma');
   const accountId = optionalText(input.accountId, '<cloudflare-account-id>');
+  const workerInspect = await readJsonPath(input.workerInspect, 'worker inspection');
   const docs = await inspectDocs();
   const handoff = await buildProductionHandoffPacket({ site, projectName, domain, liveUrl, expectTitle, infrastructureReadiness: input.infrastructureReadiness, operatorAcceptancePacket: input.operatorAcceptancePacket, releaseAudit: input.releaseAudit }, {
     env,
     generated_at: generatedAt,
     fetchImpl: options.fetchImpl ?? globalThis.fetch,
   });
-  const workerInspect = await readJsonPath(input.workerInspect);
   const tokenPolicy = buildCloudflareTokenPolicy({
     mode: 'all',
     accountId,
@@ -392,7 +397,8 @@ if (process.argv[1] && import.meta.url === pathToFileURL(process.argv[1]).href)
     else process.stdout.write(`${JSON.stringify(result.json, null, 2)}\n`);
   } catch (error) {
     const message = error instanceof Error ? error.message : String(error);
-    process.stdout.write(`${JSON.stringify({ schema: GOAL_COMPLETION_AUDIT_SCHEMA, ok: false, error: { code: error instanceof UsageError ? 'USAGE_ERROR' : 'GOAL_COMPLETION_AUDIT_ERROR', message } }, null, 2)}\n`);
-    process.exitCode = error instanceof UsageError ? 2 : 1;
+    const usageError = error instanceof UsageError || error?.name === 'UsageError';
+    process.stdout.write(`${JSON.stringify({ schema: GOAL_COMPLETION_AUDIT_SCHEMA, ok: false, error: { code: usageError ? 'USAGE_ERROR' : 'GOAL_COMPLETION_AUDIT_ERROR', message } }, null, 2)}\n`);
+    process.exitCode = usageError ? 2 : 1;
   }
 }