openmerit 0.1.4 → 0.1.6-preview.0

package/dist/core/src/store.d.ts

@@ -0,0 +1,35 @@
+import type { EvidenceManifest, OpenMeritAuditEvent, OpenMeritProjectConfig, OpenMeritProjectState } from "../../protocol/src/index.ts";
+export declare const OPENMERIT_DIRECTORY = ".openmerit";
+export interface OpenMeritStore {
+    initialize(config: OpenMeritProjectConfig, state: OpenMeritProjectState): Promise<void>;
+    readConfig(): Promise<OpenMeritProjectConfig | undefined>;
+    writeConfig(config: OpenMeritProjectConfig): Promise<void>;
+    readState(): Promise<OpenMeritProjectState | undefined>;
+    writeState(state: OpenMeritProjectState): Promise<void>;
+    appendEvent(event: OpenMeritAuditEvent): Promise<void>;
+    writeEvidenceManifest(manifest: EvidenceManifest): Promise<string>;
+}
+export interface AuditEventExporter {
+    readonly id: string;
+    export(event: OpenMeritAuditEvent): Promise<void>;
+}
+export interface ProjectStoreOptions {
+    readonly eventExporters?: readonly AuditEventExporter[];
+}
+export declare class ProjectStore implements OpenMeritStore {
+    readonly directory: string;
+    readonly configPath: string;
+    readonly statePath: string;
+    readonly eventsPath: string;
+    readonly exportErrorsPath: string;
+    readonly evidenceDirectory: string;
+    private readonly eventExporters;
+    constructor(projectRoot: string, options?: ProjectStoreOptions);
+    initialize(config: OpenMeritProjectConfig, state: OpenMeritProjectState): Promise<void>;
+    readConfig(): Promise<OpenMeritProjectConfig | undefined>;
+    writeConfig(config: OpenMeritProjectConfig): Promise<void>;
+    readState(): Promise<OpenMeritProjectState | undefined>;
+    writeState(state: OpenMeritProjectState): Promise<void>;
+    appendEvent(event: OpenMeritAuditEvent): Promise<void>;
+    writeEvidenceManifest(manifest: EvidenceManifest): Promise<string>;
+}

package/dist/core/src/store.js

@@ -0,0 +1,102 @@
+import { appendFile, mkdir, readFile, rename, writeFile } from "node:fs/promises";
+import { dirname, join } from "node:path";
+export const OPENMERIT_DIRECTORY = ".openmerit";
+export class ProjectStore {
+    directory;
+    configPath;
+    statePath;
+    eventsPath;
+    exportErrorsPath;
+    evidenceDirectory;
+    eventExporters;
+    constructor(projectRoot, options = {}) {
+        this.directory = join(projectRoot, OPENMERIT_DIRECTORY);
+        this.configPath = join(this.directory, "config.json");
+        this.statePath = join(this.directory, "state.json");
+        this.eventsPath = join(this.directory, "events.jsonl");
+        this.exportErrorsPath = join(this.directory, "audit-export-errors.jsonl");
+        this.evidenceDirectory = join(this.directory, "evidence");
+        this.eventExporters = options.eventExporters ?? [];
+    }
+    async initialize(config, state) {
+        await mkdir(this.evidenceDirectory, { recursive: true });
+        await this.writeConfig(config);
+        await this.writeState(state);
+    }
+    async readConfig() {
+        return readJsonIfPresent(this.configPath);
+    }
+    async writeConfig(config) {
+        await atomicWriteJson(this.configPath, config);
+    }
+    async readState() {
+        return readJsonIfPresent(this.statePath);
+    }
+    async writeState(state) {
+        await atomicWriteJson(this.statePath, state);
+    }
+    async appendEvent(event) {
+        await mkdir(dirname(this.eventsPath), { recursive: true });
+        const safeEvent = redactSensitive(event);
+        await appendFile(this.eventsPath, `${JSON.stringify(safeEvent)}\n`, { encoding: "utf8", mode: 0o600 });
+        const results = await Promise.allSettled(this.eventExporters.map((exporter) => exporter.export(safeEvent)));
+        for (const [index, result] of results.entries()) {
+            if (result.status === "fulfilled")
+                continue;
+            await appendFile(this.exportErrorsPath, `${JSON.stringify({
+                occurredAt: new Date().toISOString(),
+                eventId: safeEvent.id,
+                exporterId: this.eventExporters[index]?.id ?? "unknown",
+                error: safeErrorMessage(result.reason),
+            })}\n`, { encoding: "utf8", mode: 0o600 });
+        }
+    }
+    async writeEvidenceManifest(manifest) {
+        const path = join(this.evidenceDirectory, `${safeFileComponent(manifest.id)}.json`);
+        await atomicWriteJson(path, redactSensitive(manifest));
+        return path;
+    }
+}
+const SENSITIVE_KEY = /(?:authorization|api[_-]?key|token|secret|password|cookie)/i;
+const SECRET_VALUE = /\b(?:sk-[a-zA-Z0-9_-]{12,}|apikey_[a-zA-Z0-9_-]{12,})\b/g;
+function redactSensitive(value, key) {
+    if (key && SENSITIVE_KEY.test(key))
+        return "[REDACTED]";
+    if (typeof value === "string")
+        return value.replaceAll(SECRET_VALUE, "[REDACTED]");
+    if (Array.isArray(value))
+        return value.map((item) => redactSensitive(item));
+    if (value && typeof value === "object") {
+        return Object.fromEntries(Object.entries(value).map(([childKey, child]) => [
+            childKey,
+            redactSensitive(child, childKey),
+        ]));
+    }
+    return value;
+}
+function safeErrorMessage(reason) {
+    const message = reason instanceof Error ? reason.message : String(reason);
+    return redactSensitive(message);
+}
+function safeFileComponent(value) {
+    const safe = value.replaceAll(/[^a-zA-Z0-9._-]/g, "-");
+    if (!safe || safe === "." || safe === "..")
+        throw new Error("Evidence manifest ID is not file-safe.");
+    return safe;
+}
+async function readJsonIfPresent(path) {
+    try {
+        return JSON.parse(await readFile(path, "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return undefined;
+        throw error;
+    }
+}
+async function atomicWriteJson(path, value) {
+    await mkdir(dirname(path), { recursive: true });
+    const temporaryPath = `${path}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    await writeFile(temporaryPath, `${JSON.stringify(value, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+    await rename(temporaryPath, path);
+}

package/dist/pi/src/index.d.ts

@@ -0,0 +1,32 @@
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent";
+import { type HarnessDescriptor, type ImprovementStage } from "../../protocol/src/index.ts";
+export declare const PI_HARNESS_DESCRIPTOR: HarnessDescriptor;
+export interface OpenMeritUiState {
+    proactiveNudgesPaused: boolean;
+    applicationTarget: "not_detected" | "detected" | "confirmed";
+    taskProfile: "not_configured" | "pending" | "configured";
+    metricReadiness: "not_assessed" | "pending" | "assessed";
+    evaluationReadiness: "not_assessed" | "pending" | "assessed";
+    activeIntent: string | null;
+    nextAssessment: string | null;
+    lifecycleStage: ImprovementStage | "not_initialized";
+    incumbentCandidate: string | null;
+    candidateCount: number;
+    assessmentCount: number;
+    evaluationSpend: number;
+    proposedCandidate: string | null;
+}
+export declare function createInitialUiState(): OpenMeritUiState;
+export declare function renderStatus(state: OpenMeritUiState): string;
+export interface DetectedApplicationLlmTarget {
+    readonly id: string;
+    readonly kind: "application_llm_call";
+    readonly name: string;
+    readonly applicationId: string;
+    readonly callSites: readonly string[];
+    readonly routeKey: string;
+    readonly configuredModelId?: string;
+}
+/** Bounded, adapter-local detection. It requires an actual application call pattern, not only an SDK dependency. */
+export declare function detectApplicationLlmTargets(projectRoot: string): readonly DetectedApplicationLlmTarget[];
+export default function openMeritExtension(pi: ExtensionAPI): void;