Quality & Access Control

import {
  addRAGEvaluationSuiteCase,
  buildRAGEvaluationLeaderboard,
  createRAGEvaluationSuite,
  evaluateRAGCollection,
  runRAGEvaluationSuite
} from '@absolutejs/rag/quality';

let suite = createRAGEvaluationSuite({
  id: 'docs-retrieval',
  input: { cases: [], topK: 6 },
  label: 'Docs retrieval'
});

// Every mutation returns a new suite and validates case ids.
suite = addRAGEvaluationSuiteCase({
  caseInput: {
    expectedDocumentIds: ['release-notes'],
    hardNegativeSources: ['docs/archive.md'],
    id: 'release-question',
    query: 'What changed in the latest release?'
  },
  suite
});

const run = await runRAGEvaluationSuite({
  evaluate: (input) => evaluateRAGCollection({ collection, input }),
  suite
});

// run.response.summary: averagePrecision, averageRecall, averageF1,
// averageLatencyMs + passingRate over pass/partial/fail cases.

// Ranks runs by passingRate desc, then averageF1 desc, then latency.
const leaderboard = buildRAGEvaluationLeaderboard([run]);

import {
  buildRAGRetrievalComparisonDecisionSummary,
  buildRAGRetrievalReleaseVerdict,
  compareRAGRetrievalStrategies
} from '@absolutejs/rag/quality';

const comparison = await compareRAGRetrievalStrategies({
  collection,
  retrievals: [
    { id: 'vector-baseline', retrieval: 'vector' },
    {
      id: 'hybrid-mmr',
      retrieval: { diversityStrategy: 'mmr', mode: 'hybrid' }
    }
  ],
  suite
});

// Gate the candidate against the baseline with explicit thresholds.
const decision = buildRAGRetrievalComparisonDecisionSummary({
  baselineRetrievalId: 'vector-baseline',
  candidateRetrievalId: 'hybrid-mmr',
  comparison,
  policy: {
    maxElapsedMsDelta: 250,
    minAverageF1Delta: 0,
    minPassingRateDelta: 0,
    severity: 'fail' // or 'warn' to downgrade gate misses
  }
});

// pass | warn | fail | needs_review : without a gate policy, any
// negative passing-rate / F1 / cue delta yields needs_review.
const verdict = buildRAGRetrievalReleaseVerdict({
  decisionSummary: decision
});

import { Elysia } from 'elysia';
import { ragChat } from '@absolutejs/rag';
import {
  applyRAGSQLiteStoreMigrations,
  createRAGSQLiteEvaluationHistoryStore,
  createRAGSQLiteGovernanceStores,
  persistRAGEvaluationSuiteRun
} from '@absolutejs/rag/quality';

// One call wires all fifteen governance stores (baselines, release
// decisions, incidents, lane handoffs, traces, ...) onto ragChat.
const governance = createRAGSQLiteGovernanceStores({
  path: './rag-governance.sqlite',
  tablePrefix: 'docs'
});

applyRAGSQLiteStoreMigrations({ path: './rag-governance.sqlite' });

new Elysia().use(ragChat({ ...governance, collection, provider }));

// Or persist runs yourself. File stores take a path string; SQLite
// stores take { db?, path?, tableName? } and default to ':memory:'.
const history = createRAGSQLiteEvaluationHistoryStore({
  path: './rag-history.sqlite'
});

await persistRAGEvaluationSuiteRun({ run, store: history });

import { Elysia } from 'elysia';
import { createRAGAccessControl, ragChat } from '@absolutejs/rag';

type Session = { role: 'admin' | 'member'; tenantId: string };

const accessControl = createRAGAccessControl<Session>({
  authorize: ({ action, context }) => {
    if (!context) {
      return { allowed: false, reason: 'Sign in required' };
    }
    if (action === 'reset' || action === 'clear_index') {
      return { allowed: context.role === 'admin', reason: 'Admins only' };
    }

    return true;
  },
  // Called once per Request (memoized in a WeakMap) and shared by
  // both the authorize and scope resolvers.
  resolveContext: (request) => loadSession(request),
  resolveScope: ({ context }) =>
    context
      ? {
          allowedSourcePrefixes: ['docs/'],
          requiredMetadata: { tenantId: context.tenantId }
        }
      : undefined
});

// Spreads authorizeRAGAction + resolveRAGAccessScope onto the plugin.
new Elysia().use(ragChat({ ...accessControl, collection, provider }));