// Broken chamber sets, the way the SEAT3 review builds them: each breaks exactly one thing.
// Used only by scripts/broken.mjs to prove the suite fails on every one of them.
import * as ref from '../../src/reference.ts';
import type { Verdict } from '../../src/types.ts';

/** Turns a refusal whose reason matches re into a pass. */
const accept = <A extends any[]>(fn: (...a: A) => any, re: RegExp) => async (...a: A) => {
  const v: Verdict = await fn(...a);
  return !v.ok && re.test(v.reason) ? { ...v, ok: true, reason: 'accepted (broken)' } : v;
};
const acceptSync = <A extends any[]>(fn: (...a: A) => any, re: RegExp) => (...a: A) => {
  const v: Verdict = fn(...a);
  return !v.ok && re.test(v.reason) ? { ...v, ok: true, reason: 'accepted (broken)' } : v;
};

export function build(kind: string) {
  const fns: any = {
    createChallenge: ref.createChallenge, challengeMessage: ref.challengeMessage, verifyChallenge: ref.verifyChallenge,
    scoreAgent: ref.scoreAgent, screenIntent: ref.screenIntent, soulHandshake: ref.soulHandshake,
    issueSessionToken: ref.issueSessionToken, verifySessionToken: ref.verifySessionToken,
  };
  let runAirlock: any;
  switch (kind) {
    case 'identity-any-signer': fns.verifyChallenge = accept(ref.verifyChallenge, /not signed by|signature is malformed|owner address/); break;
    case 'identity-no-expiry': fns.verifyChallenge = accept(ref.verifyChallenge, /expired/); break;
    case 'identity-no-replay': fns.verifyChallenge = accept(ref.verifyChallenge, /replay/); break;
    case 'identity-no-tamper': fns.verifyChallenge = accept(ref.verifyChallenge, /tampered|malformed/); break;
    case 'trust-ignores-min-tier': { const a = ref.makeAirlock(fns); runAirlock = (i: any, o: any) => a({ ...i, minTier: undefined }, o); break; }
    case 'intent-accepts-all': fns.screenIntent = (i: any) => ({ ok: true, reason: 'clean (broken)', flags: [] }); break;
    case 'soul-accepts-all': fns.soulHandshake = () => ({ ok: true, reason: 'accepted (broken)' }); break;
    case 'session-no-expiry': fns.verifySessionToken = acceptSync(ref.verifySessionToken, /expired/); break;
    case 'session-no-mac': fns.verifySessionToken = acceptSync(ref.verifySessionToken, /tampered|MAC/); break;
    case 'session-no-job': fns.verifySessionToken = acceptSync(ref.verifySessionToken, /another job/); break;
    case 'airlock-no-stop': {
      const a = ref.makeAirlock(fns);
      runAirlock = async (i: any, o: any) => {
        const d = await a(i, o);
        if (d.passed) return d;
        // keeps going after the refusal: runs the remaining chambers and issues a token anyway
        const steps = [...d.steps];
        for (let n = d.steps.length + 1; n <= 5; n++) steps.push({ chamber: n, name: ['identity', 'trust', 'intent', 'soul', 'session'][n - 1], ok: true, reason: 'ran anyway' });
        const token = ref.issueSessionToken({ did: i.did, jobId: i.jobId, tier: d.tier ?? 'unproven', now: o.now, secret: o.secret });
        return { ...d, steps, token };
      };
      break;
    }
    default: throw new Error(`unknown broken set ${kind}`);
  }
  return { ...fns, runAirlock: runAirlock ?? ref.makeAirlock(fns) };
}

agentgate-source: code mirror on Cloudflare Pages. All repos