@duckmind/dm-linux-x64 0.65.5 → 0.65.7

package/extensions/dm-mcp-adapter/init.js

@@ -1,6 +1,6 @@
 import { formatToolName, isServerDisabled, resolveToolPrefix } from "./types.js";
 import { existsSync } from "node:fs";
-import { cloneMcpConfig, loadMcpConfig } from "./config.js";
+import { cloneMcpConfig, loadMcpConfig, resolveConfiguredClaudePluginMcp } from "./config.js";
 import { ConsentManager } from "./consent-manager.js";
 import { McpLifecycleManager } from "./lifecycle.js";
 import {
@@ -21,7 +21,7 @@ import { McpServerManager, isTransientHttpConnectError } from "./server-manager.
 import { buildToolMetadata, totalToolCount } from "./tool-metadata.js";
 import { resourceNameToToolName } from "./resource-tools.js";
 import { UiResourceHandler } from "./ui-resource-handler.js";
-import { formatMcpStatus, openUrl, parallelLimit, sanitizeTerminalText } from "./utils.js";
+import { formatMcpFooterStatus, formatMcpStatus, openUrl, parallelLimit, sanitizeTerminalText } from "./utils.js";
 import { logger } from "./logger.js";
 import { throwIfAborted } from "./abort.js";
 import { getAuthStorageOptions } from "./mcp-auth.js";
@@ -34,6 +34,10 @@ import {
 } from "./runtime-owner.js";
 import { publishMcpStatusSnapshot } from "./mcp-status.js";
 import { FAILURE_BACKOFF_MS, getFailureAgeSeconds } from "./failure-backoff.js";
+import {
+  createSessionApprovalWriter,
+  restoreSessionApprovalState
+} from "./session-approvals.js";
 export { getFailureAgeSeconds, getFailureMessage, isServerInActiveFailureBackoff } from "./failure-backoff.js";
 const MAX_FAILURE_MESSAGE_CHARS = 8 * 1024;
 const failureExpiryTimers = new WeakMap;
@@ -83,13 +87,6 @@ export function recordFailure(state, serverName, message) {
   notifyToolMetadataUpdated(state, serverName, "failure-backoff-started");
   publishMcpStatusSnapshot(state);
 }
-export function formatMcpConnectionFailure(message) {
-  const sanitized = sanitizeTerminalText(message);
-  if (/endpoint returned .*\(401\).*authentication may be required/i.test(sanitized)) {
-    return "Authentication may be required (HTTP 401). Check the server credentials or OAuth sign-in, then reconnect.";
-  }
-  return sanitized;
-}
 export function isTuiMode(ctx) {
   return ctx.hasUI && ctx.mode === "tui";
 }
@@ -101,10 +98,23 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
   const rawUi = hasUI ? ctx.ui : undefined;
   const modelRegistry = ctx.modelRegistry;
   const initialSignal = ctx.signal;
+  let sessionManager;
+  try {
+    sessionManager = ctx.sessionManager;
+  } catch {}
+  let sessionBranch = [];
+  if (sessionManager) {
+    try {
+      sessionBranch = sessionManager.getBranch();
+    } catch (error) {
+      const detail = error instanceof Error ? error.message : String(error);
+      logger.debug(`MCP: could not read the active session branch for approval restore: ${detail}`);
+    }
+  }
   const ui = rawUi ? createOwnedUi(rawUi, owner) : undefined;
   const runtimeSignal = combineAbortSignals(owner.signal, initialSignal);
-  const config = options.config !== undefined ? cloneMcpConfig(options.config) : loadMcpConfig(configPath, cwd);
-  const authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd);
+  const config = options.config !== undefined ? resolveConfiguredClaudePluginMcp(cloneMcpConfig(options.config), cwd) : loadMcpConfig(configPath, cwd);
+  const authStorageOptions = getAuthStorageOptions(config.settings?.oauthDir, cwd, config.settings?.oauthCredentialStore);
   const ownsOAuthRuntime = options.oauthRuntime === undefined;
   const oauthRuntime = options.oauthRuntime ?? createOAuthRuntime(owner.signal);
   const manager = new McpServerManager(cwd);
@@ -132,6 +142,7 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
   }
   const lifecycle = new McpLifecycleManager(manager, (serverName) => hasPendingAuth(serverName, undefined, oauthRuntime));
   const toolMetadata = new Map;
+  const directToolCounts = new Map;
   const resourceCounts = new Map;
   const promptMetadata = new Map;
   const promptMetadataLive = new Set;
@@ -140,12 +151,19 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
   const failureMessages = new Map;
   const approvedToolCalls = new Map;
   const uiResourceHandler = new UiResourceHandler(manager, config);
-  const consentManager = new ConsentManager("once-per-server");
+  let appendEntry;
+  try {
+    const candidate = pi.appendEntry;
+    appendEntry = typeof candidate === "function" ? candidate.bind(pi) : undefined;
+  } catch {}
+  const persistSessionApproval = sessionManager && appendEntry ? createSessionApprovalWriter(appendEntry, () => owner.isActive()) : undefined;
+  const consentManager = new ConsentManager("once-per-server", persistSessionApproval);
   const state = {
     owner,
     manager,
     lifecycle,
     toolMetadata,
+    directToolCounts,
     resourceCounts,
     promptMetadata,
     promptMetadataLive,
@@ -157,6 +175,9 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
     failureTracker,
     failureMessages,
     approvedToolCalls,
+    approvedServers: new Map,
+    ...persistSessionApproval !== undefined ? { persistSessionApproval } : {},
+    ...sessionManager !== undefined ? { sessionManager } : {},
     approvalEvents: pi.events,
     uiResourceHandler,
     consentManager,
@@ -188,13 +209,15 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
     },
     ...options.statusEvents !== undefined ? { statusEvents: options.statusEvents } : {}
   };
+  if (sessionManager)
+    restoreSessionApprovalState(state, sessionBranch);
   if (ownsOAuthRuntime)
     owner.addCleanup(() => shutdownOAuth(oauthRuntime));
   manager.setMetadataListChangedListener?.((serverName, reason) => {
     if (!owner.isActive())
       return;
     updateServerMetadata(state, serverName);
-    updateMetadataCache(state, serverName, { preserveEmptyResources: false });
+    updateMetadataCache(state, serverName);
     notifyToolMetadataUpdated(state, serverName, reason);
     updateStatusBar(state);
   });
@@ -203,6 +226,9 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
       return;
     updateStatusBar(state);
   });
+  owner.addCleanup(() => {
+    state.approvedServers = new Map;
+  });
   owner.addCleanup(() => lifecycle.gracefulShutdown());
   owner.addCleanup(() => {
     if (state.uiServer) {
@@ -318,13 +344,8 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
     if (error || !connection) {
       if (initialSignal?.aborted)
         continue;
-      const displayError = formatMcpConnectionFailure(error ?? "Unknown connection failure");
-      if (error) {
-        recordFailure(state, name, displayError);
-        if (displayError !== sanitizeTerminalText(error)) {
-          logger.debug("MCP: startup connection probe diagnostic", { server: name, diagnostic: sanitizeTerminalText(error) });
-        }
-      }
+      if (error)
+        recordFailure(state, name, error);
       if (transient) {
         const notice = `MCP: ${name} temporarily unavailable (HTTP 503); retry later`;
         logger.debug(`MCP: startup connect hit transient upstream outage for ${name}; will retry`);
@@ -334,11 +355,11 @@ export async function initializeMcp(pi, ctx, owner = createMcpRuntimeOwner(), op
           console.error(notice);
         continue;
       }
+      const displayError = sanitizeTerminalText(error ?? "Unknown connection failure");
       if (ui) {
         ui.notify(`MCP: Failed to connect to ${name}: ${displayError}`, "error");
-      } else {
-        console.error(`MCP: Failed to connect to ${name}: ${displayError}`);
       }
+      console.error(`MCP: Failed to connect to ${name}: ${displayError}`);
       continue;
     }
     const { metadata, failedTools } = buildToolMetadata(connection.tools, connection.resources, definition, name, prefix, config.mcpServers, startupKnownMetadata, true);
@@ -462,8 +483,12 @@ export function markKeepAliveAfterConnect(state, serverName) {
 }
 export function updateServerMetadata(state, serverName) {
   const connection = state.manager.getConnection(serverName);
-  if (!connection || connection.status !== "connected")
+  if (!connection || connection.status !== "connected") {
+    state.toolMetadata.delete(serverName);
+    state.resourceCounts?.delete(serverName);
+    state.directToolCounts?.delete(serverName);
     return;
+  }
   const definition = state.config.mcpServers[serverName];
   if (!definition)
     return;
@@ -489,7 +514,9 @@ export function updateServerMetadata(state, serverName) {
     state.serverInstructions?.delete(serverName);
   }
 }
-export function updateMetadataCache(state, serverName, options = {}) {
+export function updateMetadataCache(state, serverName) {
+  if (state.provisionalInstalls?.has(serverName))
+    return;
   const connection = state.manager.getConnection(serverName);
   if (!connection || connection.status !== "connected")
     return;
@@ -502,7 +529,7 @@ export function updateMetadataCache(state, serverName, options = {}) {
   const tools = serializeTools(connection.tools);
   let resources = definition.exposeResources === false ? [] : serializeResources(connection.resources);
   const prompts = connection.promptDiscoveryFailed ? existingEntry?.configHash === configHash ? existingEntry.prompts : undefined : serializePrompts(connection.prompts ?? []);
-  if (definition.exposeResources !== false && resources.length === 0 && existingEntry?.resources?.length && existingEntry.configHash === configHash && options.preserveEmptyResources !== false) {
+  if (definition.exposeResources !== false && connection.resourceDiscoveryFailed === true && existingEntry?.resources?.length && isServerCacheValid(existingEntry, definition)) {
     resources = existingEntry.resources;
   }
   const entry = {
@@ -546,27 +573,11 @@ export function updateStatusBar(state) {
   const entries = Object.entries(state.config.mcpServers);
   const disabledCount = entries.filter(([, definition]) => isServerDisabled(definition)).length;
   const enabledCount = entries.length - disabledCount;
-  if (entries.length === 0) {
-    ui.setStatus("mcp", undefined);
-    return;
-  }
   const connectedCount = [...state.manager.getAllConnections()].filter(([name, connection]) => {
     const definition = state.config.mcpServers[name];
     return connection.status === "connected" && definition !== undefined && !isServerDisabled(definition);
   }).length;
-  const footerStatus = state.config.settings?.mcpFooterStatus ?? "full";
-  if (footerStatus === "off") {
-    ui.setStatus("mcp", undefined);
-    return;
-  }
-  let status = footerStatus === "compact" ? `MCP ${connectedCount}/${enabledCount}` : `${enabledCount} ${enabledCount === 1 ? "server" : "servers"} enabled`;
-  if (footerStatus === "full") {
-    if (connectedCount > 0)
-      status += ` (${connectedCount} connected)`;
-    if (disabledCount > 0)
-      status += ` (${disabledCount} disabled)`;
-  }
-  const formattedStatus = footerStatus === "compact" ? status : formatMcpStatus(state.config, status);
+  const formattedStatus = formatMcpFooterStatus(state.config, enabledCount, disabledCount, connectedCount);
   if (formattedStatus === undefined) {
     ui.setStatus("mcp", undefined);
     return;

package/extensions/dm-mcp-adapter/jev-client.js

@@ -0,0 +1,359 @@
+import { TypeSafeClient } from "@typesafe-ai/sdk";
+import { isServerDisabled } from "./types.js";
+import { combineAbortSignals } from "./runtime-owner.js";
+import { JEV_SDK_PATH, resolveJevCredential, resolveJevEndpoint } from "./jev-key-store.js";
+const DEFAULTS = {
+  semanticSearch: false,
+  scriptEvaluation: false,
+  allowedServers: [],
+  model: "jev-1.13.0",
+  requestTimeoutMs: 5000,
+  maxRetries: 0,
+  maxStateBytes: 262144,
+  maxQuestionsPerRequest: 64,
+  maxEvaluationsPerScript: 8,
+  maxEvaluationBytesPerScript: 524288,
+  maxEvaluationTokensPerScript: 32768,
+  semanticCandidateLimit: 127,
+  semanticMinProbability: 0.2
+};
+const DANGEROUS_KEYS = new Set(["__proto__", "constructor", "prototype"]);
+const hosts = new WeakMap;
+const credentials = new WeakMap;
+function resolveCredential(state, endpoint) {
+  const existing = credentials.get(state);
+  if (existing && existing.endpoint === endpoint.href)
+    return existing.credential;
+  const credential = resolveJevCredential(process.env, endpoint);
+  if (credential.status === "present")
+    credentials.set(state, { endpoint: endpoint.href, credential });
+  return credential;
+}
+function credentialForState(state) {
+  const resolution = resolveJevEndpoint();
+  return resolution.status === "unavailable" ? resolution : resolveCredential(state, resolution.endpoint);
+}
+export function areJevSourcesAllowed(state, settings, sources) {
+  for (const source of sources) {
+    const server = state.config.mcpServers[source];
+    if (!settings.allowedServers.includes(source) || !server || isServerDisabled(server))
+      return false;
+  }
+  return true;
+}
+function record(value, label) {
+  if (!value || typeof value !== "object" || Array.isArray(value))
+    throw new Error(`${label} must be an object`);
+  const prototype = Object.getPrototypeOf(value);
+  if (prototype !== Object.prototype && prototype !== null)
+    throw new Error(`${label} must be a plain object`);
+  return value;
+}
+function boolean(value, fallback, label) {
+  if (value === undefined)
+    return fallback;
+  if (typeof value !== "boolean")
+    throw new Error(`${label} must be a boolean`);
+  return value;
+}
+function integer(value, fallback, min, max, label) {
+  if (value === undefined)
+    return fallback;
+  if (!Number.isInteger(value) || value < min || value > max)
+    throw new Error(`${label} must be an integer from ${min} to ${max}`);
+  return value;
+}
+export function validateJevSettings(value) {
+  if (value === undefined || value === false)
+    return { ...DEFAULTS, allowedServers: [...DEFAULTS.allowedServers] };
+  const input = record(value, "settings.jev");
+  const allowed = new Set(Object.keys(DEFAULTS));
+  for (const key of Object.keys(input))
+    if (!allowed.has(key))
+      throw new Error(`settings.jev.${key} is not supported`);
+  if (input.allowedServers !== undefined && (!Array.isArray(input.allowedServers) || input.allowedServers.some((name) => typeof name !== "string" || name.length === 0 || DANGEROUS_KEYS.has(name) || /[\u0000-\u001f\u007f]/.test(name)))) {
+    throw new Error("settings.jev.allowedServers must contain non-empty safe server names");
+  }
+  const model = input.model ?? DEFAULTS.model;
+  if (typeof model !== "string" || model.length === 0 || model.length > 128 || /(?:latest|preview)/i.test(model))
+    throw new Error("settings.jev.model must be a pinned model name");
+  const probability = input.semanticMinProbability ?? DEFAULTS.semanticMinProbability;
+  if (typeof probability !== "number" || !Number.isFinite(probability) || probability < 0 || probability > 1)
+    throw new Error("settings.jev.semanticMinProbability must be from 0 to 1");
+  return {
+    semanticSearch: boolean(input.semanticSearch, DEFAULTS.semanticSearch, "settings.jev.semanticSearch"),
+    scriptEvaluation: boolean(input.scriptEvaluation, DEFAULTS.scriptEvaluation, "settings.jev.scriptEvaluation"),
+    allowedServers: [...new Set(input.allowedServers ?? DEFAULTS.allowedServers)],
+    model,
+    requestTimeoutMs: integer(input.requestTimeoutMs, DEFAULTS.requestTimeoutMs, 100, 30000, "settings.jev.requestTimeoutMs"),
+    maxRetries: integer(input.maxRetries, DEFAULTS.maxRetries, 0, 2, "settings.jev.maxRetries"),
+    maxStateBytes: integer(input.maxStateBytes, DEFAULTS.maxStateBytes, 1, 1048576, "settings.jev.maxStateBytes"),
+    maxQuestionsPerRequest: integer(input.maxQuestionsPerRequest, DEFAULTS.maxQuestionsPerRequest, 1, 128, "settings.jev.maxQuestionsPerRequest"),
+    maxEvaluationsPerScript: integer(input.maxEvaluationsPerScript, DEFAULTS.maxEvaluationsPerScript, 1, 32, "settings.jev.maxEvaluationsPerScript"),
+    maxEvaluationBytesPerScript: integer(input.maxEvaluationBytesPerScript, DEFAULTS.maxEvaluationBytesPerScript, 1, 4194304, "settings.jev.maxEvaluationBytesPerScript"),
+    maxEvaluationTokensPerScript: integer(input.maxEvaluationTokensPerScript, DEFAULTS.maxEvaluationTokensPerScript, 1, 1e6, "settings.jev.maxEvaluationTokensPerScript"),
+    semanticCandidateLimit: integer(input.semanticCandidateLimit, DEFAULTS.semanticCandidateLimit, 2, 127, "settings.jev.semanticCandidateLimit"),
+    semanticMinProbability: probability
+  };
+}
+export function resolveSemanticJevSettings(state, credentialResolver) {
+  const configured = state.config.settings?.jev;
+  const settings = validateJevSettings(configured);
+  if (configured === false || configured?.semanticSearch === false)
+    return settings;
+  const semanticSearch = settings.semanticSearch || (credentialResolver ? credentialResolver() : credentialForState(state)).status === "present";
+  const hasExplicitAllowlist = configured !== undefined && Object.hasOwn(configured, "allowedServers");
+  const allowedServers = hasExplicitAllowlist ? settings.allowedServers : Object.keys(state.config.mcpServers).filter((name) => !isServerDisabled(state.config.mcpServers[name]));
+  return { ...settings, semanticSearch, allowedServers };
+}
+function validateJson(value, path, seen = new Set) {
+  if (value === null || typeof value === "string" || typeof value === "boolean")
+    return;
+  if (typeof value === "number") {
+    if (Number.isFinite(value))
+      return;
+    throw new Error(`${path} contains a non-finite number`);
+  }
+  if (typeof value !== "object")
+    throw new Error(`${path} is not JSON-compatible`);
+  if (seen.has(value))
+    throw new Error(`${path} contains a cycle`);
+  seen.add(value);
+  if (Array.isArray(value))
+    value.forEach((item, index) => validateJson(item, `${path}[${index}]`, seen));
+  else {
+    const prototype = Object.getPrototypeOf(value);
+    if (prototype !== Object.prototype && prototype !== null)
+      throw new Error(`${path} contains a non-plain object`);
+    for (const [key, item] of Object.entries(value)) {
+      if (DANGEROUS_KEYS.has(key))
+        throw new Error(`${path} contains an unsafe key`);
+      validateJson(item, `${path}.${key}`, seen);
+    }
+  }
+  seen.delete(value);
+}
+function validateId(id, label) {
+  if (id.length === 0 || id.length > 128 || DANGEROUS_KEYS.has(id) || /[\u0000-\u001f\u007f]/.test(id))
+    throw new Error(`${label} contains an invalid identifier`);
+}
+function validateSource(source) {
+  if (source.length === 0 || DANGEROUS_KEYS.has(source) || /[\u0000-\u001f\u007f]/.test(source))
+    throw new Error("sources contains an invalid server name");
+}
+function exactKeys(value, allowed, label) {
+  if (Object.keys(value).some((key) => !allowed.includes(key)))
+    throw new Error(`${label} contains unsupported fields`);
+}
+export function validateJevEvaluateInput(value, limits) {
+  const input = record(value, "Jev evaluation input");
+  exactKeys(input, ["state", "questions", "sources"], "Jev evaluation input");
+  if (!("state" in input))
+    throw new Error("Jev evaluation input requires state");
+  validateJson(input.state, "state");
+  const stateBytes = Buffer.byteLength(JSON.stringify(input.state));
+  if (stateBytes > limits.maxStateBytes)
+    throw new Error("Jev state exceeds maxStateBytes");
+  const questions = record(input.questions, "questions");
+  const entries = Object.entries(questions);
+  if (entries.length < 1 || entries.length > limits.maxQuestionsPerRequest)
+    throw new Error("Jev question count is outside the configured limit");
+  for (const [id, raw] of entries) {
+    validateId(id, "questions");
+    const question = record(raw, `question ${id}`);
+    if (question.type === "choice") {
+      exactKeys(question, ["type", "instructions", "criteria"], `question ${id}`);
+      const criteria = record(question.criteria, `question ${id} criteria`);
+      const labels = Object.keys(criteria);
+      if (labels.length < 2 || labels.length > 128)
+        throw new Error(`question ${id} choice criteria must have 2 to 128 labels`);
+      for (const label of labels) {
+        validateId(label, `question ${id} criteria`);
+        validateJson(criteria[label], `question ${id} criteria.${label}`);
+      }
+    } else if (question.type === "score") {
+      exactKeys(question, ["type", "instructions", "criteria"], `question ${id}`);
+      if (!Array.isArray(question.criteria) || question.criteria.length < 2 || question.criteria.length > 16)
+        throw new Error(`question ${id} score criteria must have 2 to 16 entries`);
+      validateJson(question.criteria, `question ${id} criteria`);
+    } else if (question.type === "noul") {
+      exactKeys(question, ["type", "instructions", "criteria"], `question ${id}`);
+      if (question.criteria !== undefined) {
+        const criteria = record(question.criteria, `question ${id} criteria`);
+        exactKeys(criteria, ["true", "false"], `question ${id} criteria`);
+        validateJson(criteria, `question ${id} criteria`);
+      }
+    } else
+      throw new Error(`question ${id} has an invalid type`);
+    if (question.instructions !== undefined)
+      validateJson(question.instructions, `question ${id} instructions`);
+  }
+  let sources;
+  if (input.sources !== undefined) {
+    if (!Array.isArray(input.sources))
+      throw new Error("sources must be an array");
+    sources = input.sources.map((source, index) => {
+      if (typeof source !== "string")
+        throw new Error(`sources[${index}] must be a string`);
+      validateSource(source);
+      return source;
+    });
+    if (new Set(sources).size !== sources.length)
+      throw new Error("sources must not contain duplicates");
+  }
+  const normalized = { state: input.state, questions, ...sources ? { sources } : {} };
+  if (Buffer.byteLength(JSON.stringify(normalized)) > limits.maxEvaluationBytesPerScript)
+    throw new Error("Jev request exceeds the configured byte limit");
+  return normalized;
+}
+function safeNumber(value, label, integerOnly = false) {
+  if (typeof value !== "number" || !Number.isFinite(value) || value < 0 || integerOnly && !Number.isInteger(value))
+    throw new Error(`Invalid ${label}`);
+  return value;
+}
+function probability(value, label) {
+  const number = safeNumber(value, label);
+  if (number > 1)
+    throw new Error(`Invalid ${label}`);
+  return number;
+}
+function sameKeys(actual, expected) {
+  const keys = Object.keys(actual);
+  return keys.length === expected.length && expected.every((key) => Object.hasOwn(actual, key));
+}
+function validateResponse(value, input) {
+  const response = record(value, "response");
+  exactKeys(response, ["model", "answers", "usage"], "response");
+  const answers = record(response.answers, "response answers");
+  const questionNames = Object.keys(input.questions);
+  if (!sameKeys(answers, questionNames))
+    throw new Error("Response answer keys do not match questions");
+  const validated = {};
+  for (const name of questionNames) {
+    const question = input.questions[name];
+    const answer = record(answers[name], `answer ${name}`);
+    if (answer.type !== question.type)
+      throw new Error(`Answer ${name} type does not match`);
+    if (question.type === "choice") {
+      exactKeys(answer, ["type", "choice", "confidence", "probabilities"], `answer ${name}`);
+      const labels = Object.keys(question.criteria);
+      if (typeof answer.choice !== "string" || !Object.hasOwn(question.criteria, answer.choice))
+        throw new Error(`Answer ${name} choice is invalid`);
+      const probabilities = record(answer.probabilities, `answer ${name} probabilities`);
+      if (!sameKeys(probabilities, labels))
+        throw new Error(`Answer ${name} probability keys are invalid`);
+      validated[name] = { type: "choice", choice: answer.choice, confidence: probability(answer.confidence, "confidence"), probabilities: Object.fromEntries(labels.map((label) => [label, probability(probabilities[label], "probability")])) };
+    } else if (question.type === "score") {
+      exactKeys(answer, ["type", "score", "confidence", "probabilities", "legend"], `answer ${name}`);
+      const labels = question.criteria.map((_, index) => String(index));
+      const probabilities = record(answer.probabilities, `answer ${name} probabilities`);
+      if (!sameKeys(probabilities, labels))
+        throw new Error(`Answer ${name} probability keys are invalid`);
+      const score = safeNumber(answer.score, "score");
+      if (score > question.criteria.length - 1)
+        throw new Error(`Answer ${name} score is invalid`);
+      validated[name] = { type: "score", score, confidence: probability(answer.confidence, "confidence"), probabilities: Object.fromEntries(labels.map((label) => [label, probability(probabilities[label], "probability")])) };
+    } else {
+      exactKeys(answer, ["type", "noul"], `answer ${name}`);
+      validated[name] = { type: "noul", noul: probability(answer.noul, "noul") };
+    }
+  }
+  if (typeof response.model !== "string" || response.model.length === 0 || response.model.length > 128)
+    throw new Error("Invalid response model");
+  const usage = record(response.usage, "response usage");
+  if (!sameKeys(usage, ["input_tokens", "output_tokens"]))
+    throw new Error("Invalid response usage");
+  return { answers: validated, model: response.model, usage: { inputTokens: safeNumber(usage.input_tokens, "input tokens", true), outputTokens: safeNumber(usage.output_tokens, "output tokens", true) } };
+}
+function createPinnedEndpointFetch(endpoint) {
+  return (input, init) => {
+    const target = input.replace(JEV_SDK_PATH, () => endpoint.path);
+    const url = new URL(target);
+    if (url.origin !== endpoint.origin || url.pathname !== endpoint.path || url.search !== "" || url.hash !== "") {
+      throw new Error("Jev request endpoint rejected");
+    }
+    return fetch(target, { ...init, redirect: "error" });
+  };
+}
+function getHost(state, settings) {
+  const resolution = resolveJevEndpoint();
+  if (resolution.status === "unavailable")
+    return { ok: false, error: { code: "endpoint_unavailable", message: resolution.message } };
+  const { endpoint } = resolution;
+  const existing = hosts.get(state);
+  if (existing && existing.endpoint.href === endpoint.href)
+    return existing;
+  const credential = resolveCredential(state, endpoint);
+  if (credential.status === "missing")
+    return { ok: false, error: { code: "credential_missing", message: "Jev API key is not configured." } };
+  if (credential.status === "unavailable")
+    return { ok: false, error: { code: "credential_unavailable", message: credential.message } };
+  const host = { endpoint, client: new TypeSafeClient({ apiKey: credential.apiKey, baseURL: endpoint.origin, defaultModel: settings.model, logLevel: "off", retry: { maxRetries: settings.maxRetries }, timeout: settings.requestTimeoutMs, defaultHeaders: {}, fetch: createPinnedEndpointFetch(endpoint) }) };
+  hosts.set(state, host);
+  return host;
+}
+function failure(error, signal, timedOut) {
+  if (timedOut)
+    return { ok: false, error: { code: "timeout", message: "Jev evaluation timed out.", retryable: true } };
+  if (signal?.aborted || error instanceof Error && error.name === "APIUserAbortError")
+    return { ok: false, error: { code: "aborted", message: "Jev evaluation was aborted." } };
+  const status = typeof error === "object" && error !== null && "status" in error ? error.status : undefined;
+  if (status === 401 || status === 403)
+    return { ok: false, error: { code: "authentication_failed", message: "Jev authentication failed." } };
+  if (status === 402)
+    return { ok: false, error: { code: "payment_required", message: "Jev provider requires payment for this account." } };
+  if (status === 404 || status === 405 || status === 410)
+    return { ok: false, error: { code: "endpoint_unavailable", message: "Jev endpoint was not found; check SYSTEMONE_ENDPOINT." } };
+  if (status === 408)
+    return { ok: false, error: { code: "timeout", message: "Jev evaluation timed out.", retryable: true } };
+  if (status === 429)
+    return { ok: false, error: { code: "rate_limited", message: "Jev rate limit exceeded.", retryable: true } };
+  if (typeof status === "number" && status >= 500)
+    return { ok: false, error: { code: "service_unavailable", message: "Jev service is unavailable.", retryable: true } };
+  if (typeof status === "number" && status >= 400)
+    return { ok: false, error: { code: "invalid_request", message: `Jev rejected the evaluation request (HTTP ${status}).` } };
+  if (error instanceof Error && (error.name === "APIConnectionError" || error.name === "APITimeoutError"))
+    return { ok: false, error: { code: "service_unavailable", message: "Jev service is unavailable.", retryable: true } };
+  return { ok: false, error: { code: "invalid_response", message: "Jev returned an invalid response." } };
+}
+export async function evaluateJev(state, value, options) {
+  let settings;
+  let input;
+  try {
+    settings = options.purpose === "semantic-search" ? resolveSemanticJevSettings(state) : validateJevSettings(state.config.settings?.jev);
+    input = validateJevEvaluateInput(value, settings);
+  } catch {
+    return { ok: false, error: { code: "invalid_request", message: "Invalid Jev evaluation request or settings." } };
+  }
+  if (options.purpose === "script" && !settings.scriptEvaluation || options.purpose === "semantic-search" && !settings.semanticSearch)
+    return { ok: false, error: { code: "disabled", message: "Jev evaluation is disabled." } };
+  const sources = new Set([...input.sources ?? [], ...options.observedSources ?? []]);
+  if (!areJevSourcesAllowed(state, settings, sources))
+    return { ok: false, error: { code: "data_policy_denied", message: "Evaluation sources are not allowed by policy." } };
+  const bytes = Buffer.byteLength(JSON.stringify(input));
+  if (options.budget && !options.budget.consume(bytes))
+    return { ok: false, error: { code: "budget_exhausted", message: "Jev evaluation budget exhausted." } };
+  const resolved = getHost(state, settings);
+  if (!("client" in resolved))
+    return resolved;
+  const deadline = new AbortController;
+  let timedOut = false;
+  const timer = setTimeout(() => {
+    timedOut = true;
+    deadline.abort(new Error("Jev evaluation deadline exceeded"));
+  }, settings.requestTimeoutMs);
+  const signal = combineAbortSignals(options.signal, state.owner.signal, deadline.signal);
+  try {
+    const request = { state: input.state, questions: input.questions, model: settings.model };
+    const raw = await resolved.client.systemOne(request, { ...signal ? { signal } : {}, timeout: settings.requestTimeoutMs, retry: { maxRetries: settings.maxRetries } });
+    try {
+      return { ok: true, data: validateResponse(raw, input) };
+    } catch {
+      return { ok: false, error: { code: "invalid_response", message: "Jev returned an invalid response." } };
+    }
+  } catch (error) {
+    return failure(error, signal, timedOut);
+  } finally {
+    clearTimeout(timer);
+  }
+}