@cef-ai/cli 2.9.0 → 3.0.0

package/dist/lib/eval-auth.js

@@ -1,47 +1,22 @@
 /**
- * Credentials for `cef eval`.
+ * The wallet `cef eval` signs vault-api requests with: the evaluations live in
+ * the vault (`eval-vault.ts`), and the same key publishes `workflow.start` and
+ * reads the run's events.
  *
- * THE STORE is the agent service's bucket on the DDC S3 gateway
- * (`as-<first 60 hex of the AS pubkey>`, the bucket ROC uses), reached with a
- * short-lived S3 credential minted for the owner's wallet: a DDC delegation
- * token naming the gateway as subject, signed by the wallet, registered at
- * `POST /auth/credentials`. The same mint ROC does in the browser. Explicit
- * credentials (`--access-key` / `--secret` / `--bucket`) skip it.
- *
- * THE WALLET comes from a keystore JSON (`--keystore` + `--password`, the
- * export of a Cere wallet) or a secret phrase (`--secret-phrase`). Both are
- * ed25519; the same key signs vault-api requests (publishing `workflow.start`,
- * reading the run's events).
- *
- * THE DDC ACCESS TOKEN `cef push` uses (`$CEF_DDC_ACCESS_TOKEN`, minted in
- * ROC's Access tab) CANNOT OPEN THE STORE, and no CLI-side delegation fixes
- * that — see {@link ddcTokenCannotOpenStore} for the three reasons. A person
- * who has only that token is told so, and what to use instead, rather than
- * being asked for a wallet they may not have.
- *
- * THE ORCHESTRATOR (deployments, jobs) takes the CLI access token
- * (`--access-token` / `$CEF_ACCESS_TOKEN`), as `cef deploy` does.
- *
- * A MINTED CREDENTIAL LIVES ONE HOUR, and a run can take longer. It is served
- * through a {@link CredentialSource}: re-minted before it expires (the S3
- * client asks again inside its own refresh window), re-minted once when the
- * gateway refuses it anyway (403), and kept in a 0600 file cache so the next
- * command reuses it instead of minting another — the gateway caps live
- * credentials per wallet, and one per command reaches that cap quickly.
+ * It comes from a keystore JSON (`--keystore` + `--password`, the export of a
+ * Cere wallet) or a secret phrase (`--secret-phrase`). Both are ed25519.
+ * Without one, `--access-token` carries vault-api requests instead.
  */
-import { chmod, mkdir, open, readFile, rename, rm, stat, writeFile } from "node:fs/promises";
+import { readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
-import { CredentialLimitError, registerCredential } from "@cef-ai/account";
-import { inspectAccessTokenScope, ss58Address } from "./access-token.js";
-import { envConfig } from "./env.js";
 async function ddcSdk() {
     try {
         return (await import("@cere-ddc-sdk/ddc-client"));
     }
     catch {
         throw new Error("[cef eval] signing with a wallet needs the optional dependency @cere-ddc-sdk/ddc-client; install it, "
-            + "or pass explicit gateway credentials (--access-key/--secret/--bucket)");
+            + "or pass --access-token instead");
     }
 }
 /** The wallet from options, then `$CEF_KEYSTORE`/`$CEF_KEYSTORE_PASSWORD`, then `$CEF_SECRET_PHRASE`; undefined when none. */
@@ -72,314 +47,4 @@ export async function loadWallet(opts) {
     }
     return undefined;
 }
-/** The AS bucket on the S3 gateway, as ROC derives it. */
-export function deriveAsBucketName(asPubKey) {
-    const hex = asPubKey.replace(/^0x/i, "").toLowerCase().replace(/[^0-9a-f]/g, "");
-    return `as-${hex.slice(0, 60)}`;
-}
-/** The gateway base URL: the env's auth-info URL minus `/auth/info`. */
-export function gatewayBaseUrl(env) {
-    return envConfig(env).s3GatewayAuthInfo.replace(/\/auth\/info\/?$/, "");
-}
-export const CREDENTIAL_TTL_SECONDS = 3600;
-/** A credential with less than this left is replaced before use. More than the S3 client's own 5 min refresh window. */
-export const CREDENTIAL_REFRESH_MARGIN_MS = 10 * 60_000;
-/** Explicit keys: served as given, never replaced. */
-export function staticCredentials(c) {
-    return { get: async () => c, invalidate: async () => false };
-}
-/**
- * Minted on demand: reused while it has more than `refreshMarginMs` left,
- * replaced (from the cache if another command already minted a fresh one,
- * else by minting) once it does not. Concurrent callers share one mint.
- */
-export function mintedCredentials(opts) {
-    const now = opts.now ?? Date.now;
-    const margin = opts.refreshMarginMs ?? CREDENTIAL_REFRESH_MARGIN_MS;
-    const fresh = (c) => !!c && (c.expiresAt === undefined || c.expiresAt - now() > margin);
-    let current;
-    let pending;
-    const replace = async () => {
-        const cached = await opts.cache?.read().catch(() => undefined);
-        if (fresh(cached))
-            return cached;
-        const minted = await opts.mint();
-        await opts.cache?.write(minted).catch(() => { });
-        return minted;
-    };
-    return {
-        async get() {
-            if (fresh(current))
-                return current;
-            pending ??= replace().then((c) => {
-                current = c;
-                pending = undefined;
-                return c;
-            }, (e) => {
-                pending = undefined;
-                throw e;
-            });
-            return pending;
-        },
-        async invalidate() {
-            const dropped = current;
-            current = undefined;
-            if (dropped)
-                await opts.cache?.clear(dropped.accessKeyId).catch(() => { });
-            return true;
-        },
-    };
-}
-/** The default cache file: `$CEF_EVAL_CREDENTIAL_CACHE`, else `~/.cef/eval-credentials.json`; `off` disables. */
-export function defaultCredentialCacheFile() {
-    const env = process.env.CEF_EVAL_CREDENTIAL_CACHE;
-    if (env === "off" || env === "0" || env === "false")
-        return undefined;
-    return env || path.join(os.homedir(), ".cef", "eval-credentials.json");
-}
-/** How long a cache update waits for another process's lock before going ahead without it. */
-export const CREDENTIAL_CACHE_LOCK_WAIT_MS = 2000;
-/** A lock older than this was left by a process that died holding it. */
-const CREDENTIAL_CACHE_LOCK_STALE_MS = 10_000;
-/**
- * Hold `<file>.lock` (created exclusively) while `fn` runs. A lock older than
- * the stale limit is taken over; one still held after the wait is ignored —
- * the cache only saves mints, so a rare lost entry beats a stuck command.
- */
-async function withFileLock(file, fn) {
-    const lock = `${file}.lock`;
-    const deadline = Date.now() + CREDENTIAL_CACHE_LOCK_WAIT_MS;
-    let held = false;
-    while (!held) {
-        try {
-            await (await open(lock, "wx", 0o600)).close();
-            held = true;
-        }
-        catch (e) {
-            if (e.code !== "EEXIST")
-                break;
-            const age = await stat(lock).then((st) => Date.now() - st.mtimeMs, () => 0);
-            if (age > CREDENTIAL_CACHE_LOCK_STALE_MS)
-                await rm(lock, { force: true });
-            else if (Date.now() >= deadline)
-                break;
-            else
-                await new Promise((r) => setTimeout(r, 5 + Math.random() * 20));
-        }
-    }
-    try {
-        return await fn();
-    }
-    finally {
-        if (held)
-            await rm(lock, { force: true });
-    }
-}
-/**
- * A JSON file of credentials keyed by `key` (gateway + wallet), readable by
- * its owner only. Each entry holds a secret that expires within the hour.
- *
- * SHARED BY CONCURRENT COMMANDS. Every change is a read-modify-write of the
- * whole file, so two `cef eval` processes writing at once would each drop the
- * other's entry — and a dropped entry means another mint, against a gateway
- * that caps live credentials per wallet. Each change therefore re-reads and
- * merges under an exclusive `<file>.lock`, and replaces the file by renaming a
- * fully written temp file, so a reader never sees half a file.
- */
-export function fileCredentialCache(file, key) {
-    const readAll = async () => {
-        try {
-            const raw = JSON.parse(await readFile(file, "utf8"));
-            return raw && typeof raw === "object" && !Array.isArray(raw) ? raw : {};
-        }
-        catch {
-            return {};
-        }
-    };
-    const update = async (change) => {
-        await mkdir(path.dirname(file), { recursive: true, mode: 0o700 });
-        await withFileLock(file, async () => {
-            const all = await readAll();
-            if (!change(all))
-                return;
-            const tmp = `${file}.${process.pid}.${Math.random().toString(36).slice(2)}.tmp`;
-            await writeFile(tmp, JSON.stringify(all, null, 2) + "\n", { mode: 0o600 });
-            await chmod(tmp, 0o600);
-            await rename(tmp, file);
-        });
-    };
-    return {
-        async read() {
-            const c = (await readAll())[key];
-            return c && typeof c.accessKeyId === "string" && typeof c.secretAccessKey === "string" ? c : undefined;
-        },
-        async write(c) {
-            await update((all) => {
-                const t = Date.now();
-                // Drop expired entries while here, so the file does not collect dead secrets.
-                for (const [k, v] of Object.entries(all))
-                    if (typeof v.expiresAt === "number" && v.expiresAt <= t)
-                        delete all[k];
-                all[key] = c;
-                return true;
-            });
-        },
-        async clear(accessKeyId) {
-            await update((all) => {
-                if (all[key]?.accessKeyId !== accessKeyId)
-                    return false;
-                delete all[key];
-                return true;
-            });
-        },
-    };
-}
-/** Mint a short-lived S3 credential for the wallet, as ROC does in the browser. */
-export async function mintGatewayCredentials(opts) {
-    const fetchImpl = opts.fetchImpl ?? fetch;
-    const endpoint = (opts.endpoint ?? gatewayBaseUrl(opts.env)).replace(/\/+$/, "");
-    const res = await fetchImpl(`${endpoint}/auth/info`);
-    if (!res.ok)
-        throw new Error(`[cef eval] ${endpoint}/auth/info answered ${res.status}`);
-    const info = (await res.json());
-    if (!info.gateway_public_key)
-        throw new Error(`[cef eval] ${endpoint}/auth/info named no gateway_public_key`);
-    const gatewayKey = info.gateway_public_key.replace(/^0x/i, "");
-    const subject = ss58Address(Uint8Array.from(gatewayKey.match(/../g).map((h) => Number.parseInt(h, 16))));
-    const { AuthToken } = await ddcSdk();
-    const token = AuthToken.fullAccess({ subject, canDelegate: true });
-    await token.sign(opts.signer);
-    const mintedAt = Date.now();
-    let cred;
-    try {
-        cred = await registerCredential({
-            gatewayUrl: endpoint,
-            signer: opts.signer,
-            delegationToken: token.toString(),
-            label: "cef-eval",
-            expiresInSeconds: CREDENTIAL_TTL_SECONDS,
-            fetchFn: fetchImpl,
-        });
-    }
-    catch (e) {
-        if (e instanceof CredentialLimitError) {
-            throw new Error(`[cef eval] the wallet ${opts.signer.address} already holds as many live S3 credentials as the gateway allows `
-                + `(${endpoint}). \`cef eval\` reuses its own for an hour (~/.cef/eval-credentials.json), but ROC and other `
-                + "tools mint theirs. Wait for older ones to expire, revoke unused ones, or pass explicit --access-key/--secret.", { cause: e });
-        }
-        throw e;
-    }
-    const expiresAt = cred.expiresAt ? Date.parse(cred.expiresAt) : NaN;
-    return {
-        endpoint,
-        bucket: deriveAsBucketName(opts.asPubKey),
-        accessKeyId: cred.accessKeyId,
-        secretAccessKey: cred.secretAccessKey,
-        ...(cred.region || info.region ? { region: cred.region || info.region } : {}),
-        expiresAt: Number.isFinite(expiresAt) ? expiresAt : mintedAt + CREDENTIAL_TTL_SECONDS * 1000,
-    };
-}
-/**
- * Why `cef push`'s DDC access token cannot be turned into an S3 credential,
- * as an error that says what to use instead.
- *
- * The gateway serves an object by minting a DDC token whose `prev` is the
- * delegation token the credential was registered with, scoped to the S3
- * bucket's own DDC bucket. For a ROC-minted registry token that chain cannot
- * verify, for three independent reasons:
- *
- *  1. BUCKET. The token is limited to the agent service's registry bucket
- *     (`CEF_BUCKET`); datasets live in the gateway bucket `as-<pubkey>`, which
- *     the gateway created as a separate DDC bucket. A chain whose hops name
- *     different buckets is refused (the gateway's own 403 says "re-register
- *     with a wallet-wide token").
- *  2. NO SUBJECT, NO DELEGATION. It is a bearer token (`canDelegate` false,
- *     no subject); the gateway's hop must be signed by the previous hop's
- *     subject, and the gateway's key is not it.
- *  3. WHO REGISTERS. `POST /auth/credentials` files the credential under the
- *     key that signs the request; only the owner's key yields an owner
- *     credential, and `/auth/credentials/delegated` takes only an on-chain
- *     proxy of the owner.
- */
-export function ddcTokenCannotOpenStore(token, bucket) {
-    let scope = "";
-    try {
-        const s = inspectAccessTokenScope(token);
-        const parts = [
-            s.bucketId !== undefined ? `limited to DDC bucket ${s.bucketId}` : "",
-            s.subject ? "" : "names no subject",
-            s.canDelegate ? "" : "cannot be delegated",
-        ].filter(Boolean);
-        if (parts.length > 0)
-            scope = ` (this one is ${parts.join(", ")})`;
-    }
-    catch {
-        // Not a readable token: the generic explanation still holds.
-    }
-    return new Error("[cef eval] $CEF_DDC_ACCESS_TOKEN authorizes `cef push` to the agent service's registry bucket, but it cannot "
-        + `open dataset storage${scope}: datasets live in the S3 gateway bucket ${bucket}, a different DDC bucket, `
-        + "and the gateway issues S3 credentials only for a key that signs the request and roots the delegation. "
-        + "Use an S3 access key/secret issued for the owner's wallet (--access-key/--secret, or "
-        + "$CEF_EVAL_KEY/$CEF_EVAL_SECRET), or the owner's wallet itself (--keystore/--password or --secret-phrase).");
-}
-/**
- * Gateway access, in this order:
- *
- *  1. explicit keys (`--access-key`/`--secret`, `$CEF_EVAL_KEY`/`$CEF_EVAL_SECRET`);
- *  2. a wallet (`--keystore`/`--secret-phrase` or their env vars): credentials
- *     minted on demand, cached across commands, refreshed before they expire;
- *  3. `$CEF_DDC_ACCESS_TOKEN` alone: refused, saying why and what to use —
- *     it cannot mint (see {@link ddcTokenCannotOpenStore}), so it is checked
- *     only when nothing that can is present.
- */
-export async function resolveGatewayAccess(opts, wallet, deps = {}) {
-    const accessKeyId = opts.accessKey ?? process.env.CEF_EVAL_KEY;
-    const secretAccessKey = opts.secret ?? process.env.CEF_EVAL_SECRET;
-    const endpoint = (opts.endpoint ?? process.env.CEF_EVAL_ENDPOINT ?? gatewayBaseUrl(opts.env)).replace(/\/+$/, "");
-    const asPubKey = opts.asPubkey ?? process.env.CEF_AS_PUBKEY;
-    const bucket = opts.bucket ?? process.env.CEF_EVAL_BUCKET ?? (asPubKey ? deriveAsBucketName(asPubKey) : undefined);
-    // Half a pair is a mistake, not a request for the wallet path: say which half is missing.
-    if (!!accessKeyId !== !!secretAccessKey) {
-        const given = accessKeyId
-            ? (opts.accessKey !== undefined ? "--access-key" : "$CEF_EVAL_KEY")
-            : (opts.secret !== undefined ? "--secret" : "$CEF_EVAL_SECRET");
-        const missing = accessKeyId ? "--secret (or $CEF_EVAL_SECRET)" : "--access-key (or $CEF_EVAL_KEY)";
-        throw new Error(`[cef eval] ${given} is set but ${missing} is not — explicit gateway credentials need both`);
-    }
-    if (accessKeyId && secretAccessKey) {
-        if (!bucket)
-            throw new Error("[cef eval] explicit gateway credentials need --bucket or --as-pubkey");
-        return {
-            endpoint,
-            bucket,
-            ...(opts.region ? { region: opts.region } : {}),
-            credentials: staticCredentials({ accessKeyId, secretAccessKey, ...(opts.region ? { region: opts.region } : {}) }),
-        };
-    }
-    if (!asPubKey || !bucket)
-        throw new Error("[cef eval] --as-pubkey (or $CEF_AS_PUBKEY) is required — it names the bucket");
-    const signer = wallet ?? (await loadWallet(opts));
-    if (!signer) {
-        const ddcToken = (process.env.CEF_DDC_ACCESS_TOKEN ?? "").trim();
-        if (ddcToken)
-            throw ddcTokenCannotOpenStore(ddcToken, bucket);
-        throw new Error("[cef eval] no credential for the S3 gateway — pass --keystore/--password or --secret-phrase "
-            + "(the agent service owner's wallet), or explicit --access-key/--secret");
-    }
-    const mint = deps.mint ?? mintGatewayCredentials;
-    const cacheFile = deps.cacheFile === undefined ? defaultCredentialCacheFile() : deps.cacheFile ?? undefined;
-    const credentials = mintedCredentials({
-        mint: async () => {
-            const m = await mint({ env: opts.env, endpoint, asPubKey, signer });
-            return {
-                accessKeyId: m.accessKeyId, secretAccessKey: m.secretAccessKey,
-                ...(m.region ? { region: m.region } : {}), ...(m.expiresAt !== undefined ? { expiresAt: m.expiresAt } : {}),
-            };
-        },
-        ...(cacheFile ? { cache: fileCredentialCache(cacheFile, `${endpoint}|${signer.address}`) } : {}),
-    });
-    // Mint (or load) now, so a missing wallet permission fails before any work starts.
-    const first = await credentials.get();
-    return { endpoint, bucket, ...(first.region ? { region: first.region } : {}), credentials };
-}
 //# sourceMappingURL=eval-auth.js.map

package/dist/lib/eval-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"eval-auth.js","sourceRoot":"","sources":["../../src/lib/eval-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7F,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,oBAAoB,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE3E,OAAO,EAAE,uBAAuB,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAuBrC,KAAK,UAAU,MAAM;IACnB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAsB,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uGAAuG;cACnG,uEAAuE,CAC5E,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,8HAA8H;AAC9H,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAmB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0C,CAAC;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,CAC3G,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC;IACjF,OAAO,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AAClC,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,cAAc,CAAC,GAAY;IACzC,OAAO,SAAS,CAAC,GAAG,CAAC,CAAC,iBAAiB,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC;AAC1E,CAAC;AAeD,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,wHAAwH;AACxH,MAAM,CAAC,MAAM,4BAA4B,GAAG,EAAE,GAAG,MAAM,CAAC;AAUxD,sDAAsD;AACtD,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,OAAO,EAAE,GAAG,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC,KAAK,EAAE,CAAC;AAC/D,CAAC;AAUD;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAKjC;IACC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,IAAI,4BAA4B,CAAC;IACpE,MAAM,KAAK,GAAG,CAAC,CAAgC,EAA0B,EAAE,CACzE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,IAAI,CAAC,CAAC,SAAS,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,CAAC;IACrE,IAAI,OAAsC,CAAC;IAC3C,IAAI,OAA+C,CAAC;IACpD,MAAM,OAAO,GAAG,KAAK,IAAgC,EAAE;QACrD,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC/D,IAAI,KAAK,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC;QACjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QACjC,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;QAChD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,GAAG;YACP,IAAI,KAAK,CAAC,OAAO,CAAC;gBAAE,OAAO,OAAO,CAAC;YACnC,OAAO,KAAK,OAAO,EAAE,CAAC,IAAI,CACxB,CAAC,CAAC,EAAE,EAAE;gBACJ,OAAO,GAAG,CAAC,CAAC;gBACZ,OAAO,GAAG,SAAS,CAAC;gBACpB,OAAO,CAAC,CAAC;YACX,CAAC,EACD,CAAC,CAAU,EAAE,EAAE;gBACb,OAAO,GAAG,SAAS,CAAC;gBACpB,MAAM,CAAC,CAAC;YACV,CAAC,CACF,CAAC;YACF,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,UAAU;YACd,MAAM,OAAO,GAAG,OAAO,CAAC;YACxB,OAAO,GAAG,SAAS,CAAC;YACpB,IAAI,OAAO;gBAAE,MAAM,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YAC1E,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;AACJ,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,0BAA0B;IACxC,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC;IAClD,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,GAAG,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IACtE,OAAO,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,uBAAuB,CAAC,CAAC;AACzE,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,MAAM,6BAA6B,GAAG,IAAI,CAAC;AAClD,yEAAyE;AACzE,MAAM,8BAA8B,GAAG,MAAM,CAAC;AAE9C;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAI,IAAY,EAAE,EAAoB;IAC/D,MAAM,IAAI,GAAG,GAAG,IAAI,OAAO,CAAC;IAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;IAC5D,IAAI,IAAI,GAAG,KAAK,CAAC;IACjB,OAAO,CAAC,IAAI,EAAE,CAAC;QACb,IAAI,CAAC;YACH,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;YAC9C,IAAI,GAAG,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM;YAC1D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAC5E,IAAI,GAAG,GAAG,8BAA8B;gBAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;iBACrE,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ;gBAAE,MAAM;;gBAClC,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,IAAI,IAAI;YAAE,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,GAAW;IAC3D,MAAM,OAAO,GAAG,KAAK,IAAgD,EAAE;QACrE,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;YAChE,OAAO,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,GAAyC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,EAAE,MAA2D,EAAiB,EAAE;QAClG,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;YAClC,MAAM,GAAG,GAAG,MAAM,OAAO,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC;gBAAE,OAAO;YACzB,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC;YAChF,MAAM,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC3E,MAAM,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACxB,MAAM,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,CAAC;IACL,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,IAAI;YACR,MAAM,CAAC,GAAG,CAAC,MAAM,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,OAAO,CAAC,CAAC,WAAW,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzG,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,CAAC;YACX,MAAM,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;gBACrB,8EAA8E;gBAC9E,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;oBAAE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,CAAC;wBAAE,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC;gBACjH,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBACb,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,WAAW;YACrB,MAAM,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE;gBACnB,IAAI,GAAG,CAAC,GAAG,CAAC,EAAE,WAAW,KAAK,WAAW;oBAAE,OAAO,KAAK,CAAC;gBACxD,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;gBAChB,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAM5C;IACC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAC1C,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACjF,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,QAAQ,YAAY,CAAC,CAAC;IACrD,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,uBAAuB,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACxF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAqD,CAAC;IACpF,IAAI,CAAC,IAAI,CAAC,kBAAkB;QAAE,MAAM,IAAI,KAAK,CAAC,cAAc,QAAQ,wCAAwC,CAAC,CAAC;IAC9G,MAAM,UAAU,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,SAAS,CAAC,UAAU,CAAC,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC5B,IAAI,IAAoD,CAAC;IACzD,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,kBAAkB,CAAC;YAC9B,UAAU,EAAE,QAAQ;YACpB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,eAAe,EAAE,KAAK,CAAC,QAAQ,EAAE;YACjC,KAAK,EAAE,UAAU;YACjB,gBAAgB,EAAE,sBAAsB;YACxC,OAAO,EAAE,SAAS;SACnB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC,YAAY,oBAAoB,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CACb,yBAAyB,IAAI,CAAC,MAAM,CAAC,OAAO,mEAAmE;kBAC3G,IAAI,QAAQ,+FAA+F;kBAC3G,+GAA+G,EACnH,EAAE,KAAK,EAAE,CAAC,EAAE,CACb,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,CAAC;IACV,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACpE,OAAO;QACL,QAAQ;QACR,MAAM,EAAE,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC;QACzC,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7E,SAAS,EAAE,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,GAAG,sBAAsB,GAAG,IAAI;KAC7F,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAa,EAAE,MAAc;IACnE,IAAI,KAAK,GAAG,EAAE,CAAC;IACf,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG;YACZ,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,yBAAyB,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE;YACrE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB;YACnC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB;SAC3C,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAClB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,KAAK,GAAG,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;IACrE,CAAC;IAAC,MAAM,CAAC;QACP,6DAA6D;IAC/D,CAAC;IACD,OAAO,IAAI,KAAK,CACd,+GAA+G;UAC3G,uBAAuB,KAAK,4CAA4C,MAAM,4BAA4B;UAC1G,wGAAwG;UACxG,uFAAuF;UACvF,2GAA2G,CAChH,CAAC;AACJ,CAAC;AAqBD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,IAAsB,EACtB,MAAmB,EACnB,OAA4E,EAAE;IAE9E,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC/D,MAAM,eAAe,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACnE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;IAC5D,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACnH,0FAA0F;IAC1F,IAAI,CAAC,CAAC,WAAW,KAAK,CAAC,CAAC,eAAe,EAAE,CAAC;QACxC,MAAM,KAAK,GAAG,WAAW;YACvB,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC;YACnE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAC,gCAAgC,CAAC,CAAC,CAAC,iCAAiC,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,eAAe,OAAO,kDAAkD,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,WAAW,IAAI,eAAe,EAAE,CAAC;QACnC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC;QACrG,OAAO;YACL,QAAQ;YACR,MAAM;YACN,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC/C,WAAW,EAAE,iBAAiB,CAAC,EAAE,WAAW,EAAE,eAAe,EAAE,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;SAClH,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,8EAA8E,CAAC,CAAC;IAC1H,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACjE,IAAI,QAAQ;YAAE,MAAM,uBAAuB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9D,MAAM,IAAI,KAAK,CACb,8FAA8F;cAC1F,uEAAuE,CAC5E,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,sBAAsB,CAAC;IACjD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,0BAA0B,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC;IAC5G,MAAM,WAAW,GAAG,iBAAiB,CAAC;QACpC,IAAI,EAAE,KAAK,IAAI,EAAE;YACf,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;YACpE,OAAO;gBACL,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,eAAe;gBAC9D,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5G,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,mBAAmB,CAAC,SAAS,EAAE,GAAG,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjG,CAAC,CAAC;IACH,mFAAmF;IACnF,MAAM,KAAK,GAAG,MAAM,WAAW,CAAC,GAAG,EAAE,CAAC;IACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC;AAC9F,CAAC"}
+{"version":3,"file":"eval-auth.js","sourceRoot":"","sources":["../../src/lib/eval-auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAiB7B,KAAK,UAAU,MAAM;IACnB,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAsB,CAAC;IACzE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CACb,uGAAuG;cACnG,gCAAgC,CACrC,CAAC;IACJ,CAAC;AACH,CAAC;AAQD,8HAA8H;AAC9H,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,IAAmB;IAClD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;IAC3D,MAAM,MAAM,GAAG,CAAC,IAAI,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjF,IAAI,QAAQ,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,4FAA4F,CAAC,CAAC;IAChH,CAAC;IACD,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,IAAI,EAAE,CAAC;QAC1E,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAC5G,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAA0C,CAAC;QAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;YACjC,MAAM,IAAI,KAAK,CACb,cAAc,QAAQ,kDAAkD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAAS,GAAG,CAC3G,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,IAAI,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;QAC1D,MAAM,MAAM,CAAC,OAAO,EAAE,CAAC;QACvB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/eval-vault.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Where `cef eval` keeps evaluations: the vault the workflow runs in, in the
+ * workflow's scope, through vault-api's object API (`…/scopes/<scope>/objects/
+ * evals/…`). The vault decides who may read and write them — a read grant on
+ * the scope reads, a write grant manages datasets and runs experiments — which
+ * is the same grant running the workflow needs.
+ *
+ * One connection serves both halves of a `run`: the store, and the target that
+ * publishes `workflow.start` and reads the run's events.
+ */
+import { type EvalStore, type VaultObjects } from "@cef-ai/eval";
+import { VaultHttpClient } from "@cef-ai/vault-sdk/internal";
+import { type EvalSigner, type WalletOptions } from "./eval-auth.js";
+export interface VaultAccessOptions extends WalletOptions {
+    env?: string;
+    /** Spelled as commander spells `--vault`. */
+    vault?: string;
+    vaultApi?: string;
+    accessToken?: string;
+}
+export interface VaultAccess {
+    http: VaultHttpClient;
+    vaultId: string;
+}
+/**
+ * vault-api, signed by the wallet when there is one, else carried by the CLI
+ * access token (a wallet-api delegation; it needs `ddc-read`/`ddc-write`). The
+ * vault is `--vault`, then `$CEF_VAULT_ID`, then the signer's own.
+ */
+export declare function openVault(o: VaultAccessOptions, wallet?: EvalSigner, fetchImpl?: typeof fetch): Promise<VaultAccess>;
+/** One scope's objects, addressed by path the way `vaultObjectStore` wants them. */
+export declare function scopeObjects(access: VaultAccess, scope: string): VaultObjects;
+/** The workflow's evaluations, in `scope` of the vault. */
+export declare function vaultEvalStore(access: VaultAccess, scope: string): EvalStore;
+//# sourceMappingURL=eval-vault.d.ts.map

package/dist/lib/eval-vault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-vault.d.ts","sourceRoot":"","sources":["../../src/lib/eval-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAoB,KAAK,SAAS,EAAE,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAEnF,OAAO,EAAW,eAAe,EAAU,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAc,KAAK,UAAU,EAAE,KAAK,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAGjF,MAAM,WAAW,kBAAmB,SAAQ,aAAa;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6CAA6C;IAC7C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,eAAe,CAAC;IACtB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;GAIG;AACH,wBAAsB,SAAS,CAC7B,CAAC,EAAE,kBAAkB,EACrB,MAAM,CAAC,EAAE,UAAU,EACnB,SAAS,CAAC,EAAE,OAAO,KAAK,GACvB,OAAO,CAAC,WAAW,CAAC,CAqBtB;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,YAAY,CAO7E;AAED,2DAA2D;AAC3D,wBAAgB,cAAc,CAAC,MAAM,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,CAE5E"}

package/dist/lib/eval-vault.js

@@ -0,0 +1,54 @@
+/**
+ * Where `cef eval` keeps evaluations: the vault the workflow runs in, in the
+ * workflow's scope, through vault-api's object API (`…/scopes/<scope>/objects/
+ * evals/…`). The vault decides who may read and write them — a read grant on
+ * the scope reads, a write grant manages datasets and runs experiments — which
+ * is the same grant running the workflow needs.
+ *
+ * One connection serves both halves of a `run`: the store, and the target that
+ * publishes `workflow.start` and reads the run's events.
+ */
+import { vaultObjectStore } from "@cef-ai/eval";
+import { DelegationAuthProvider, WalletAuthProvider } from "@cef-ai/vault-sdk";
+import { Objects, VaultHttpClient, Vaults } from "@cef-ai/vault-sdk/internal";
+import { loadWallet } from "./eval-auth.js";
+import { envConfig } from "./env.js";
+/**
+ * vault-api, signed by the wallet when there is one, else carried by the CLI
+ * access token (a wallet-api delegation; it needs `ddc-read`/`ddc-write`). The
+ * vault is `--vault`, then `$CEF_VAULT_ID`, then the signer's own.
+ */
+export async function openVault(o, wallet, fetchImpl) {
+    const signer = wallet ?? (await loadWallet(o));
+    const accessToken = o.accessToken ?? process.env.CEF_ACCESS_TOKEN;
+    const auth = signer
+        ? new WalletAuthProvider(signer)
+        : accessToken
+            ? new DelegationAuthProvider(accessToken)
+            : undefined;
+    if (!auth) {
+        throw new Error("[cef eval] evaluations live in the vault: pass a wallet (--keystore/--password or --secret-phrase) "
+            + "or a CLI access token (--access-token or $CEF_ACCESS_TOKEN)");
+    }
+    const http = new VaultHttpClient({
+        url: o.vaultApi ?? envConfig(o.env).vault,
+        auth,
+        ...(fetchImpl ? { fetch: fetchImpl } : {}),
+    });
+    const vaultId = o.vault ?? process.env.CEF_VAULT_ID ?? (await new Vaults(http).current()).vaultId;
+    return { http, vaultId };
+}
+/** One scope's objects, addressed by path the way `vaultObjectStore` wants them. */
+export function scopeObjects(access, scope) {
+    const objects = new Objects(access.http);
+    return {
+        upload: (path, data, opts) => objects.upload(access.vaultId, scope, path, data, opts),
+        get: (path) => objects.get(access.vaultId, scope, path),
+        list: (opts) => objects.list(access.vaultId, scope, opts),
+    };
+}
+/** The workflow's evaluations, in `scope` of the vault. */
+export function vaultEvalStore(access, scope) {
+    return vaultObjectStore(scopeObjects(access, scope));
+}
+//# sourceMappingURL=eval-vault.js.map

package/dist/lib/eval-vault.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval-vault.js","sourceRoot":"","sources":["../../src/lib/eval-vault.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,gBAAgB,EAAqC,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,sBAAsB,EAAE,kBAAkB,EAAe,MAAM,mBAAmB,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,MAAM,4BAA4B,CAAC;AAE9E,OAAO,EAAE,UAAU,EAAuC,MAAM,gBAAgB,CAAC;AACjF,OAAO,EAAE,SAAS,EAAE,MAAM,UAAU,CAAC;AAerC;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,CAAqB,EACrB,MAAmB,EACnB,SAAwB;IAExB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,MAAM,WAAW,GAAG,CAAC,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC;IAClE,MAAM,IAAI,GAAG,MAAM;QACjB,CAAC,CAAC,IAAI,kBAAkB,CAAC,MAAgB,CAAC;QAC1C,CAAC,CAAC,WAAW;YACX,CAAC,CAAC,IAAI,sBAAsB,CAAC,WAAW,CAAC;YACzC,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CACb,qGAAqG;cACjG,6DAA6D,CAClE,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,GAAG,EAAE,CAAC,CAAC,QAAQ,IAAI,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK;QACzC,IAAI;QACJ,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3C,CAAC,CAAC;IACH,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC;IAClG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,YAAY,CAAC,MAAmB,EAAE,KAAa;IAC7D,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACzC,OAAO;QACL,MAAM,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC;QACrF,GAAG,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;QACvD,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,cAAc,CAAC,MAAmB,EAAE,KAAa;IAC/D,OAAO,gBAAgB,CAAC,YAAY,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AACvD,CAAC"}

package/dist/lib/eval-workflow.d.ts

@@ -6,6 +6,8 @@ export interface LocalWorkflow {
     graph: unknown;
     /** Where it was read from, for messages. */
     from: string;
+    /** The first non-blank `requiredScopes` entry: the vault scope it runs in. */
+    scope?: string;
 }
 export interface LocalWorkflowOptions {
     cwd: string;
@@ -21,4 +23,13 @@ export declare function localWorkflows(opts: LocalWorkflowOptions): Promise<Loca
 export declare function resolveWorkflowId(explicit: string | undefined, opts: LocalWorkflowOptions): Promise<string>;
 /** The local graph of `workflowId` at `version`, when the project has that exact version. */
 export declare function localGraph(workflowId: string, version: string, opts: LocalWorkflowOptions): Promise<LocalWorkflow | undefined>;
+/** The default vault scope a workflow runs in. */
+export declare const DEFAULT_WORKFLOW_SCOPE = "default";
+/**
+ * The vault scope `workflowId` declares, as ROC reads it: the first
+ * `requiredScopes` entry the project declares for it (config first, then build
+ * output). Undefined when this project declares none for it — the caller
+ * decides what that means, and says so. Its evaluations live in that scope.
+ */
+export declare function localWorkflowScope(workflowId: string, opts: LocalWorkflowOptions): Promise<string | undefined>;
 //# sourceMappingURL=eval-workflow.d.ts.map

package/dist/lib/eval-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"eval-workflow.d.ts","sourceRoot":"","sources":["../../src/lib/eval-workflow.ts"],"names":[],"mappings":"AAgBA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1F,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;CACd;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtF;AAiDD,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEzF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWjH;AAED,6FAA6F;AAC7F,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAEpI"}
+{"version":3,"file":"eval-workflow.d.ts","sourceRoot":"","sources":["../../src/lib/eval-workflow.ts"],"names":[],"mappings":"AAgBA,OAAO,EAA6B,KAAK,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAE1F,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,uEAAuE;IACvE,KAAK,EAAE,OAAO,CAAC;IACf,4CAA4C;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,wEAAwE;IACxE,cAAc,CAAC,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;CACtF;AA2DD,+EAA+E;AAC/E,wBAAsB,cAAc,CAAC,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC,CAEzF;AAED;;;GAGG;AACH,wBAAsB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,CAAC,CAWjH;AAED,6FAA6F;AAC7F,wBAAsB,UAAU,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,aAAa,GAAG,SAAS,CAAC,CAEpI;AAED,kDAAkD;AAClD,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAEhD;;;;;GAKG;AACH,wBAAsB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAEpH"}

package/dist/lib/eval-workflow.js

@@ -19,7 +19,14 @@ function fromAgent(a, from) {
     const id = typeof a.alias === "string" && a.alias ? a.alias : typeof a.id === "string" ? a.id : undefined;
     if (!graph || !id)
         return undefined;
-    return { id, graph, from, ...(typeof a.version === "string" ? { version: a.version } : {}) };
+    const scope = Array.isArray(a.requiredScopes)
+        ? a.requiredScopes.find((s) => typeof s === "string" && s.trim() !== "")?.trim()
+        : undefined;
+    return {
+        id, graph, from,
+        ...(typeof a.version === "string" ? { version: a.version } : {}),
+        ...(scope ? { scope } : {}),
+    };
 }
 /** The workflows `cef.config.ts` declares; [] when there is none or it cannot be loaded. */
 async function fromConfig(opts) {
@@ -88,4 +95,15 @@ export async function resolveWorkflowId(explicit, opts) {
 export async function localGraph(workflowId, version, opts) {
     return (await localWorkflows(opts)).find((w) => w.id === workflowId && w.version === version);
 }
+/** The default vault scope a workflow runs in. */
+export const DEFAULT_WORKFLOW_SCOPE = "default";
+/**
+ * The vault scope `workflowId` declares, as ROC reads it: the first
+ * `requiredScopes` entry the project declares for it (config first, then build
+ * output). Undefined when this project declares none for it — the caller
+ * decides what that means, and says so. Its evaluations live in that scope.
+ */
+export async function localWorkflowScope(workflowId, opts) {
+    return (await localWorkflows(opts)).find((w) => w.id === workflowId && w.scope)?.scope;
+}
 //# sourceMappingURL=eval-workflow.js.map

package/dist/lib/eval-workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"eval-workflow.js","sourceRoot":"","sources":["../../src/lib/eval-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAiB1F,MAAM,MAAM,GAAG,KAAK,EAAE,CAAS,EAAoB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAE5F,SAAS,SAAS,CAAC,CAAyE,EAAE,IAAY;IACxG,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACpC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/F,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,IAA0B;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,OAAO,aAAa,CAAC,GAAG,CAAC;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA0B;IAC7D,OAAO,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAA4B,EAAE,IAA0B;IAC9F,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/H,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,OAAO,IAAI,CAAC,GAAG,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iFAAiF,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAChI,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB,EAAE,OAAe,EAAE,IAA0B;IAC9F,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;AAChG,CAAC"}
+{"version":3,"file":"eval-workflow.js","sourceRoot":"","sources":["../../src/lib/eval-workflow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAExC,OAAO,EAAE,aAAa,EAAE,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAmB1F,MAAM,MAAM,GAAG,KAAK,EAAE,CAAS,EAAoB,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;AAE5F,SAAS,SAAS,CAChB,CAAmG,EACnG,IAAY;IAEZ,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1G,IAAI,CAAC,KAAK,IAAI,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IACpC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE;QAC7F,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,EAAE,EAAE,KAAK,EAAE,IAAI;QACf,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,UAAU,CAAC,IAA0B;IAClD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IAClD,IAAI,CAAC,CAAC,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,cAAc,IAAI,UAAU,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtE,OAAO,aAAa,CAAC,GAAG,CAAC;aACtB,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC;aACzC,MAAM,CAAC,CAAC,CAAC,EAAsB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,+FAA+F;QAC/F,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,wCAAwC;AACxC,KAAK,UAAU,QAAQ,CAAC,GAAW;IACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACpC,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,EAAE,eAAe,CAAC,CAAC;QACjD,IAAI,CAAC;YACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;YAC5D,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,IAAI,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,qCAAqC;QACvC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,IAA0B;IAC7D,OAAO,CAAC,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,QAA4B,EAAE,IAA0B;IAC9F,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC9B,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC/H,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,GAAG,CAAC,CAAC,CAAE,CAAC;QACrC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,cAAc,IAAI,OAAO,IAAI,CAAC,GAAG,gCAAgC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;QAC7H,CAAC;IACH,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,iFAAiF,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC;AAChI,CAAC;AAED,6FAA6F;AAC7F,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,UAAkB,EAAE,OAAe,EAAE,IAA0B;IAC9F,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;AAChG,CAAC;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,sBAAsB,GAAG,SAAS,CAAC;AAEhD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,UAAkB,EAAE,IAA0B;IACrF,OAAO,CAAC,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,UAAU,IAAI,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;AACzF,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cef-ai/cli",
-  "version": "2.9.0",
+  "version": "3.0.0",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -15,18 +15,16 @@
     "access": "public"
   },
   "dependencies": {
-    "@aws-sdk/client-s3": "^3.700.0",
     "@noble/hashes": "^2.2.0",
     "commander": "^12.0.0",
     "esbuild": "^0.21.0",
     "json-schema-to-typescript": "^14.0.0",
     "typescript": "^5.4.0",
-    "@cef-ai/account": "2.0.0",
-    "@cef-ai/eval": "0.1.0",
-    "@cef-ai/widget-runtime": "2.4.3",
+    "@cef-ai/agent-sdk": "5.11.0",
+    "@cef-ai/eval": "0.2.0",
     "@cef-ai/transport": "1.1.0",
-    "@cef-ai/vault-sdk": "5.7.0",
-    "@cef-ai/agent-sdk": "5.9.0"
+    "@cef-ai/vault-sdk": "5.8.0",
+    "@cef-ai/widget-runtime": "2.4.4"
   },
   "optionalDependencies": {
     "@cere-ddc-sdk/ddc-client": "^2.16.1"

package/dist/lib/eval-auth.test.d.ts

@@ -1,2 +0,0 @@
-export {};
-//# sourceMappingURL=eval-auth.test.d.ts.map

package/dist/lib/eval-auth.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"eval-auth.test.d.ts","sourceRoot":"","sources":["../../src/lib/eval-auth.test.ts"],"names":[],"mappings":""}