me2lon 0.0.0-stage → 0.1.0

package/dist/safe-output.js

@@ -0,0 +1,770 @@
+import { Me2lonClientError } from "./errors.js";
+const forbiddenKeyPattern = /^(?:authorization|cookie|token|secret|source|sources|sourcecode|sourcecontent|sourcebody|sourceexcerpt|sourcetext|sourcefile|sourcefiles|content|contents|filecontent|filecontents|requestbody|responsebody|changes|replacements|patch|difftext|generatedrocq|generatedrocqsource|generatedsource|rocqsource|proof|prooftext|proofbody|proofsource|artifact|artifacts|artifactbody|artifactcontent)$/iu;
+const identifierPattern = /^[A-Za-z0-9][A-Za-z0-9._:@/-]{0,511}$/u;
+function record(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value)) {
+        return undefined;
+    }
+    return value;
+}
+function unwrap(raw, preferred = []) {
+    for (const key of [...preferred, "data"]) {
+        const nested = record(raw[key]);
+        if (nested) {
+            return nested;
+        }
+    }
+    return raw;
+}
+function safeString(value, maximum = 8_192) {
+    return typeof value === "string" ? value.slice(0, maximum) : undefined;
+}
+function safeScalar(value) {
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "boolean" ||
+        (typeof value === "number" && Number.isFinite(value))) {
+        return typeof value === "string" ? value.slice(0, 8_192) : value;
+    }
+    return undefined;
+}
+function selectedFields(input, names) {
+    const output = {};
+    for (const name of names) {
+        const value = safeScalar(input[name]);
+        if (value !== undefined) {
+            output[name] = value;
+        }
+    }
+    return output;
+}
+function safeStructured(value, depth = 0, policyData = false) {
+    if (depth > 8) {
+        return undefined;
+    }
+    const scalar = safeScalar(value);
+    if (scalar !== undefined) {
+        return scalar;
+    }
+    if (Array.isArray(value)) {
+        return value
+            .slice(0, 1_000)
+            .map((item) => safeStructured(item, depth + 1, policyData))
+            .filter((item) => item !== undefined);
+    }
+    const input = record(value);
+    if (!input) {
+        return undefined;
+    }
+    const output = {};
+    for (const [key, item] of Object.entries(input).slice(0, 250)) {
+        if (forbiddenKeyPattern.test(key)) {
+            continue;
+        }
+        if (!policyData && !/^(?:count|total|passed|failed|skipped|covered|percent|percentage|current|maximum|max|limit|maxChanges|maxFileBytes|maxTotalBytes|maxProjects|maxJobs|name|id|kind|status|code|severity|category|ruleId|digest|version|versions|framework|language|supported|enabled|value|label)$/u.test(key)) {
+            continue;
+        }
+        const safe = safeStructured(item, depth + 1, policyData);
+        if (safe !== undefined) {
+            output[key] = safe;
+        }
+    }
+    return output;
+}
+export function requireResourceId(raw, preferredContainers, idNames) {
+    const candidates = [raw, unwrap(raw, preferredContainers)];
+    const data = record(raw.data);
+    if (data) {
+        candidates.push(data);
+        for (const container of preferredContainers) {
+            const nested = record(data[container]);
+            if (nested) {
+                candidates.push(nested);
+            }
+        }
+    }
+    for (const candidate of candidates) {
+        for (const idName of idNames) {
+            const id = candidate[idName];
+            if (typeof id === "string" && identifierPattern.test(id)) {
+                return id;
+            }
+            if (typeof id === "number" && Number.isSafeInteger(id) && id >= 0) {
+                return String(id);
+            }
+        }
+    }
+    throw new Me2lonClientError("ME2LON_API_RESPONSE_INVALID", "The Me2lon API response did not include the expected resource id.");
+}
+export function projectCapabilities(raw, repository) {
+    const input = unwrap(raw, ["capabilities"]);
+    const output = selectedFields(input, [
+        "schemaVersion",
+        "apiVersion",
+        "version",
+        "status",
+        "service",
+        "brand",
+        "profile",
+    ]);
+    const source = record(input.source);
+    if (source) {
+        const sourceContract = selectedFields(source, [
+            "schemaVersion",
+            "baseRevision",
+            "snapshotBaseRevision",
+        ]);
+        const operations = stringArray(source.operations, 32);
+        if (operations !== undefined)
+            sourceContract.operations = operations;
+        const encodings = stringArray(source.encodings, 32);
+        if (encodings !== undefined)
+            sourceContract.encodings = encodings;
+        const supportedSchemas = stringArray(source.supportedSchemas, 8);
+        if (supportedSchemas !== undefined)
+            sourceContract.supportedSchemas = supportedSchemas;
+        output.sourceContract = sourceContract;
+    }
+    const limits = record(input.limits);
+    const sourceLimits = record(limits?.source);
+    if (sourceLimits) {
+        output.sourceLimits = selectedFields(sourceLimits, [
+            "maxChanges",
+            "maxFileBytes",
+            "maxTotalBytes",
+            "maxRetainedRevisions",
+            "maxRetainedBytes",
+        ]);
+    }
+    const translation = record(input.translation);
+    if (translation) {
+        output.translation = selectedFields(translation, [
+            "generatedRocqVisible",
+            "receiptOnly",
+        ]);
+    }
+    const policy = record(input.policy);
+    if (policy) {
+        output.policy = selectedFields(policy, [
+            "format",
+            "approvalRequiresCompleteCoverage",
+            "agentMayApprove",
+        ]);
+    }
+    const scopes = stringArray(input.scopes, 128);
+    if (scopes !== undefined)
+        output.scopes = scopes;
+    const supportedScopes = stringArray(input.supportedScopes, 128);
+    if (supportedScopes !== undefined)
+        output.supportedScopes = supportedScopes;
+    for (const key of [
+        "capabilities",
+        "jobKinds",
+        "sourceSchemaVersions",
+        "supportedFrameworks",
+        "supportedPolicyLanguages",
+    ]) {
+        const safe = safeStructured(input[key]);
+        if (safe !== undefined) {
+            output[key] = safe;
+        }
+    }
+    output.repositoryAuthorized = Boolean(repository);
+    if (repository) {
+        output.repository = selectedFields(repository, [
+            "id",
+            "repositoryId",
+            "name",
+            "fullName",
+            "provider",
+            "defaultBranch",
+        ]);
+    }
+    return output;
+}
+function diagnostic(value) {
+    const input = record(value);
+    if (!input) {
+        return undefined;
+    }
+    const output = selectedFields(input, [
+        "id",
+        "code",
+        "ruleId",
+        "kind",
+        "sourceRole",
+        "chapter",
+        "severity",
+        "category",
+        "message",
+        "detail",
+        "suggestion",
+        "path",
+        "line",
+        "column",
+        "endLine",
+        "endColumn",
+        "helpUrl",
+        "status",
+    ]);
+    for (const key of ["start", "end"]) {
+        const location = record(input[key]);
+        if (location) {
+            const safe = selectedFields(location, ["line", "column"]);
+            if (Object.keys(safe).length > 0) {
+                output[key] = safe;
+            }
+        }
+    }
+    return Object.keys(output).length > 0 ? output : undefined;
+}
+function stringArray(value, maximum = 1_000) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value
+        .slice(0, maximum)
+        .map((item) => safeString(item, 16_384))
+        .filter((item) => item !== undefined);
+}
+function projectedObjects(value, projector, maximum = 1_000) {
+    if (!Array.isArray(value))
+        return undefined;
+    return value
+        .slice(0, maximum)
+        .map(projector)
+        .filter((item) => item !== undefined);
+}
+function checkProject(value) {
+    const input = record(value);
+    if (!input)
+        return undefined;
+    const output = selectedFields(input, [
+        "id", "root", "name",
+        "projectId",
+        "completeContext",
+        "excludedInScopeFiles",
+        "filesChecked",
+        "diagnosticCount",
+        "workflowReadiness",
+        "workflowLimitationCount",
+    ]);
+    const eligibility = record(input.translationEligibility);
+    if (eligibility)
+        output.translationEligibility = {
+            ...selectedFields(eligibility, ["status"]),
+            blockers: stringArray(eligibility.blockers, 32) ?? [],
+        };
+    return Object.keys(output).length > 0 ? output : undefined;
+}
+function checkerProject(value) {
+    const input = record(value);
+    if (!input)
+        return undefined;
+    const output = selectedFields(input, ["schemaVersion", "projectId"]);
+    const context = record(input.context);
+    if (context) {
+        output.context = selectedFields(context, [
+            "status",
+            "prismaPreparation",
+            "limitation",
+        ]);
+    }
+    const scope = record(input.scope);
+    if (scope) {
+        output.scope = selectedFields(scope, [
+            "eligibleFiles",
+            "filesChecked",
+            "tsxFilesExcluded",
+            "applicationFilesChecked",
+            "testFilesChecked",
+            "toolingFilesChecked",
+        ]);
+    }
+    const summary = record(input.summary);
+    if (summary) {
+        const safeSummary = selectedFields(summary, ["rawDiagnostics", "uniqueSites"]);
+        for (const key of ["byChapter", "byCategory"]) {
+            const counts = safeStructured(summary[key]);
+            if (counts !== undefined)
+                safeSummary[key] = counts;
+        }
+        output.summary = safeSummary;
+    }
+    const readiness = record(input.workflowReadiness);
+    if (readiness) {
+        const safeReadiness = selectedFields(readiness, [
+            "route",
+            "status",
+            "blockingDiagnosticCount",
+        ]);
+        const limitations = projectedObjects(readiness.limitations, (value) => {
+            const limitation = record(value);
+            if (!limitation)
+                return undefined;
+            const projected = selectedFields(limitation, [
+                "code",
+                "capability",
+                "message",
+                "detail",
+                "suggestion",
+                "path",
+            ]);
+            for (const key of ["start", "end"]) {
+                const location = record(limitation[key]);
+                if (location)
+                    projected[key] = selectedFields(location, ["line", "column"]);
+            }
+            return Object.keys(projected).length > 0 ? projected : undefined;
+        }, 1_000);
+        if (limitations !== undefined)
+            safeReadiness.limitations = limitations;
+        output.workflowReadiness = safeReadiness;
+    }
+    return Object.keys(output).length > 0 ? output : undefined;
+}
+function propertyEvidence(value) {
+    const input = record(value);
+    if (!input)
+        return undefined;
+    const output = selectedFields(input, [
+        "propertyId",
+        "projectId",
+        "specificationOrigin",
+        "resultResolution",
+        "title",
+        "status",
+        "claimScope",
+        "evidenceMethod",
+        "evidenceClass",
+    ]);
+    const formalAttempt = record(input.formalAttempt);
+    if (formalAttempt) {
+        output.formalAttempt = selectedFields(formalAttempt, ["status", "reason"]);
+    }
+    const rationale = record(input.rationale);
+    if (rationale) {
+        output.rationale = {
+            ...selectedFields(rationale, ["summary", "conclusion"]),
+            steps: projectedObjects(rationale.steps, (value) => {
+                const step = record(value);
+                return step ? selectedFields(step, ["text"]) : undefined;
+            }, 64) ?? [],
+        };
+    }
+    else if (input.rationale === null)
+        output.rationale = null;
+    const limitations = stringArray(input.limitations, 256);
+    if (limitations !== undefined)
+        output.limitations = limitations;
+    return Object.keys(output).length > 0 ? output : undefined;
+}
+function routePolicy(value) {
+    const input = record(value);
+    if (!input)
+        return undefined;
+    const output = selectedFields(input, [
+        "schemaVersion",
+        "sourceIdentity",
+        "projectId",
+        "evidenceClass",
+        "routeCount",
+        "routesTruncated",
+    ]);
+    const policy = record(input.policy);
+    if (policy) {
+        output.policy = selectedFields(policy, [
+            "policyId",
+            "languageVersion",
+            "declaredReviewStatus",
+            "approvalStatus",
+        ]);
+    }
+    else if (input.policy === null) {
+        output.policy = null;
+    }
+    const coverage = record(input.coverage);
+    if (coverage) {
+        output.coverage = selectedFields(coverage, [
+            "totalRoutes",
+            "analyzedRoutes",
+            "limitedRoutes",
+            "blockedRoutes",
+        ]);
+    }
+    const routes = projectedObjects(input.routes, (routeValue) => {
+        const route = record(routeValue);
+        if (!route)
+            return undefined;
+        const safeRoute = selectedFields(route, [
+            "routeId",
+            "path",
+            "handler",
+            "analysisBasis",
+            "operationBinding",
+            "assessment",
+            "explanation",
+        ]);
+        for (const key of [
+            "methods",
+            "reachablePrismaOperationIds",
+            "relevantPolicyRuleIds",
+            "limitations",
+        ]) {
+            const values = stringArray(route[key], 10_000);
+            if (values !== undefined)
+                safeRoute[key] = values;
+        }
+        const formalEvidence = record(route.formalEvidence);
+        if (formalEvidence) {
+            safeRoute.formalEvidence = selectedFields(formalEvidence, [
+                "status",
+                "digest",
+                "evidenceClass",
+            ]);
+        }
+        return Object.keys(safeRoute).length > 0 ? safeRoute : undefined;
+    }, 100_000);
+    if (routes !== undefined)
+        output.routes = routes;
+    return Object.keys(output).length > 0 ? output : undefined;
+}
+function projectDiagnostics(value) {
+    const input = record(value);
+    if (!input)
+        return {};
+    const rawItems = Array.isArray(input.items)
+        ? input.items
+        : Array.isArray(input.diagnostics)
+            ? input.diagnostics
+            : [];
+    const diagnostics = rawItems
+        .slice(0, 2_000)
+        .map(diagnostic)
+        .filter((item) => item !== undefined);
+    const output = { diagnostics };
+    const total = safeScalar(input.total);
+    if (total !== undefined)
+        output.diagnosticsTotal = total;
+    output.diagnosticsReturned = diagnostics.length;
+    const nextCursor = safeScalar(input.nextCursor);
+    if (nextCursor !== undefined)
+        output.diagnosticsNextCursor = nextCursor;
+    if (typeof input.truncated === "boolean") {
+        output.diagnosticsTruncated = input.truncated;
+    }
+    return output;
+}
+export function projectJob(raw, diagnosticsResponse) {
+    const input = unwrap(raw, ["job", "checkJob", "translationJob", "verificationJob"]);
+    const output = selectedFields(input, [
+        "schemaVersion",
+        "id",
+        "jobId",
+        "kind",
+        "type",
+        "status",
+        "outcome",
+        "createdAt",
+        "requestedAt",
+        "startedAt",
+        "completedAt",
+        "finishedAt",
+        "cancelledAt",
+        "canceledAt",
+        "workspaceId",
+        "workspaceRevisionId",
+        "checkJobId",
+        "translationJobId",
+        "projectId",
+        "policySetDigest",
+        "expectedPolicySetDigest",
+        "resultDigest",
+        "summary",
+        "sourceIdentity",
+    ]);
+    output.jobStatus = safeScalar(input.status) ?? null;
+    const result = record(input.result);
+    output.resultStatus = safeScalar(result?.status ?? result?.outcome) ?? null;
+    if (result) {
+        Object.assign(output, selectedFields(result, [
+            "status",
+            "outcome",
+            "completion",
+            "summary",
+            "policySetDigest",
+            "resultDigest",
+            "projectId",
+            "selectionReason",
+            "selectionGuidance",
+            "sourceIdentity",
+            "modelDigest",
+            "sourceModelDigest",
+            "modelKind",
+            "resultResolution",
+            "generatedRocqVisible",
+            "policyCompliance",
+            "diagnosticsSeparate",
+            "responseTruncated",
+            "projectCount",
+            "checkerProjectCount",
+            "propertyCount",
+            "partial",
+            "routePolicyAnalysisCount",
+        ]));
+        const resultSchemaVersion = safeScalar(result.schemaVersion);
+        if (resultSchemaVersion !== undefined) {
+            output.resultSchemaVersion = resultSchemaVersion;
+        }
+        const limitations = stringArray(result.limitations, 1_000);
+        if (limitations !== undefined)
+            output.limitations = limitations;
+        const projectionLimitations = stringArray(result.projectionLimitations, 32);
+        if (projectionLimitations !== undefined) {
+            output.projectionLimitations = projectionLimitations;
+        }
+        const projects = projectedObjects(result.projects, checkProject);
+        if (projects !== undefined)
+            output.projects = projects;
+        const checkerProjects = projectedObjects(result.checker, checkerProject);
+        if (checkerProjects !== undefined)
+            output.checkerProjects = checkerProjects;
+        const models = projectedObjects(result.models, (value) => {
+            const input = record(value);
+            return input ? { ...selectedFields(input, ['projectId', 'state', 'modelKind', 'modelDigest', 'resultResolution']), limitations: stringArray(input.limitations, 64) ?? [] } : undefined;
+        });
+        if (models !== undefined)
+            output.models = models;
+        const properties = projectedObjects(result.properties, propertyEvidence, 1_000);
+        if (properties !== undefined)
+            output.properties = properties;
+        const routePolicyAnalyses = projectedObjects(result.routePolicyAnalyses, routePolicy, 1_000);
+        if (routePolicyAnalyses !== undefined) {
+            output.routePolicyAnalyses = routePolicyAnalyses;
+        }
+    }
+    const rawProgress = record(input.progress);
+    const progress = rawProgress ? selectedFields(rawProgress, ["stage", "state", "lastProgressAt", "lastHeartbeatAt", "retryReason", "completedStages", "reusedStages"]) : undefined;
+    if (progress !== undefined) {
+        output.progress = progress;
+    }
+    const coverage = safeStructured(result?.coverage ?? input.coverage);
+    if (coverage !== undefined) {
+        output.coverage = coverage;
+    }
+    if (diagnosticsResponse) {
+        Object.assign(output, projectDiagnostics(diagnosticsResponse));
+    }
+    else {
+        const inline = Array.isArray(input.diagnostics)
+            ? input.diagnostics
+            : Array.isArray(result?.diagnostics)
+                ? result.diagnostics
+                : Array.isArray(result?.checker)
+                    ? result.checker.flatMap((checkerValue) => {
+                        const checker = record(checkerValue);
+                        return Array.isArray(checker?.diagnostics)
+                            ? checker.diagnostics
+                            : [];
+                    })
+                    : [];
+        if (inline.length > 0) {
+            Object.assign(output, projectDiagnostics({
+                items: inline,
+                total: inline.length,
+                nextCursor: null,
+                truncated: inline.length > 2_000,
+            }));
+        }
+    }
+    const error = record(input.error);
+    if (error) {
+        const safeError = selectedFields(error, ["code", "message", "retryable"]);
+        if (Object.keys(safeError).length > 0) {
+            output.error = safeError;
+        }
+    }
+    return output;
+}
+function projectPolicyUnit(value) {
+    const input = record(value);
+    if (!input) {
+        return undefined;
+    }
+    const output = selectedFields(input, [
+        "id",
+        "policyUnitId",
+        "name",
+        "title",
+        "description",
+        "status",
+        "version",
+        "digest",
+        "policySetDigest",
+        "expectedPolicySetDigest",
+        "repositoryId",
+        "projectId",
+        "schemaPath",
+        "activeApprovalId",
+        "createdAt",
+        "updatedAt",
+        "ruleCount",
+        "language",
+    ]);
+    for (const key of ["definition", "rules", "parameters"]) {
+        const safe = safeStructured(input[key], 0, true);
+        if (safe !== undefined) {
+            output[key] = safe;
+        }
+    }
+    for (const key of [
+        "validationCapability",
+        "activeApproval",
+        "drafts",
+    ]) {
+        const safe = safeStructured(input[key], 0, true);
+        if (safe !== undefined)
+            output[key] = safe;
+    }
+    return Object.keys(output).length > 0 ? output : undefined;
+}
+export function projectPolicyUnits(raw) {
+    const input = unwrap(raw);
+    const units = Array.isArray(input.policyUnits)
+        ? input.policyUnits
+        : Array.isArray(input.items)
+            ? input.items
+            : [];
+    return {
+        policyUnits: units
+            .slice(0, 1_000)
+            .map(projectPolicyUnit)
+            .filter((item) => item !== undefined),
+    };
+}
+export function projectPolicy(raw) {
+    const input = unwrap(raw, ["policyUnit"]);
+    const unit = projectPolicyUnit(input);
+    return unit && !Array.isArray(unit) && typeof unit === "object"
+        ? unit
+        : {};
+}
+export function projectResource(raw, containers) {
+    const input = unwrap(raw, containers);
+    return selectedFields(input, [
+        "schemaVersion",
+        "id",
+        "workspaceId",
+        "workspaceRevisionId",
+        "jobId",
+        "draftId",
+        "revisionId",
+        "policyUnitId",
+        "repositoryId",
+        "projectId",
+        "kind",
+        "status",
+        "outcome",
+        "digest",
+        "revisionDigest",
+        "validationId",
+        "validationDigest",
+        "validationStatus",
+        "sourceIdentity",
+        "sourceModelDigest",
+        "translationModelDigest",
+        "validatorVersion",
+        "approvalEligible",
+        "ordinal",
+        "origin",
+        "policySetDigest",
+        "expectedPolicySetDigest",
+        "createdAt",
+        "updatedAt",
+        "submittedAt",
+        "summary",
+        "valid",
+    ]);
+}
+export function projectPolicyValidation(raw) {
+    const input = unwrap(raw, ["validation"]);
+    const output = selectedFields(input, [
+        "schemaVersion",
+        "id",
+        "revisionId",
+        "status",
+        "valid",
+        "sourceIdentity",
+        "sourceModelDigest",
+        "translationModelDigest",
+        "validationDigest",
+        "translationJobId",
+        "validatorVersion",
+        "approvalEligible",
+        "createdAt",
+    ]);
+    for (const key of ["coverage", "diagnostics", "assumptions"]) {
+        const safe = safeStructured(input[key], 0, true);
+        if (safe !== undefined)
+            output[key] = safe;
+    }
+    return output;
+}
+export function projectPolicyProposal(parts) {
+    const diffInput = unwrap(parts.diff, ["diff"]);
+    const diffSummary = selectedFields(diffInput, [
+        "schemaVersion",
+        "status",
+        "summary",
+        "basis",
+        "addedRuleCount",
+        "changedRuleCount",
+        "removedRuleCount",
+        "baseDigest",
+        "proposedDigest",
+        "revisionDigest",
+        "againstRevisionDigest",
+        "diffDigest",
+    ]);
+    const changes = safeStructured(diffInput.changes, 0, true);
+    if (changes !== undefined)
+        diffSummary.policyChanges = changes;
+    const limitations = stringArray(diffInput.limitations, 1_000);
+    if (limitations !== undefined)
+        diffSummary.limitations = limitations;
+    return {
+        draft: projectResource(parts.draft, ["draft"]),
+        revision: projectResource(parts.revision, ["revision"]),
+        validation: projectPolicyValidation(parts.validation),
+        diff: diffSummary,
+        ...(parts.submission
+            ? { submission: projectResource(parts.submission, ["submission"]) }
+            : {}),
+        submitted: parts.submitted,
+    };
+}
+export function repositoryFromList(raw, repositoryId) {
+    const input = unwrap(raw);
+    const repositories = Array.isArray(input.repositories)
+        ? input.repositories
+        : Array.isArray(input.items)
+            ? input.items
+            : [];
+    return repositories.find((candidate) => {
+        const item = record(candidate);
+        return item &&
+            (String(item.id ?? "") === repositoryId ||
+                String(item.repositoryId ?? "") === repositoryId)
+            ? true
+            : false;
+    });
+}
+export function safeJsonText(result) {
+    return JSON.stringify(result, null, 2);
+}
+export function assertNoForbiddenOutput(result) {
+    const serialized = JSON.stringify(result);
+    if (/"(?:authorization|cookie|token|secret|source|sources|sourceCode|sourceContent|sourceBody|sourceExcerpt|sourceText|sourceFile|sourceFiles|content|contents|fileContent|fileContents|requestBody|responseBody|changes|replacements|patch|diffText|generatedRocq|generatedRocqSource|generatedSource|rocqSource|proof|proofText|proofBody|proofSource|artifact|artifacts|artifactBody|artifactContent)"\s*:/iu.test(serialized)) {
+        throw new Me2lonClientError("ME2LON_OUTPUT_SAFETY_FAILURE", "A Me2lon response violated the source-non-disclosure boundary.");
+    }
+}
+//# sourceMappingURL=safe-output.js.map