@evalops/maestro 0.10.10 → 0.10.11

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (30) hide show
  1. package/dist/cli/args.d.ts.map +1 -1
  2. package/dist/cli/args.js +2 -1
  3. package/dist/cli/args.js.map +1 -1
  4. package/dist/cli/commands/evalops.d.ts.map +1 -1
  5. package/dist/cli/commands/evalops.js +6 -1
  6. package/dist/cli/commands/evalops.js.map +1 -1
  7. package/dist/cli/commands/init.d.ts +4 -0
  8. package/dist/cli/commands/init.d.ts.map +1 -0
  9. package/dist/cli/commands/init.js +140 -0
  10. package/dist/cli/commands/init.js.map +1 -0
  11. package/dist/cli/help.d.ts.map +1 -1
  12. package/dist/cli/help.js +9 -1
  13. package/dist/cli/help.js.map +1 -1
  14. package/dist/cli.js +826 -283
  15. package/dist/evalops/agent-bootstrap.d.ts +73 -0
  16. package/dist/evalops/agent-bootstrap.d.ts.map +1 -0
  17. package/dist/evalops/agent-bootstrap.js +380 -0
  18. package/dist/evalops/agent-bootstrap.js.map +1 -0
  19. package/dist/main.d.ts.map +1 -1
  20. package/dist/main.js +5 -0
  21. package/dist/main.js.map +1 -1
  22. package/dist/mcp/platform-plugin.d.ts.map +1 -1
  23. package/dist/mcp/platform-plugin.js +40 -6
  24. package/dist/mcp/platform-plugin.js.map +1 -1
  25. package/dist/oauth/evalops.js +1 -1
  26. package/dist/oauth/evalops.js.map +1 -1
  27. package/dist/version.json +2 -2
  28. package/node_modules/@evalops/contracts/package.json +1 -1
  29. package/node_modules/@evalops/tui/package.json +1 -1
  30. package/package.json +3 -3
package/dist/oauth/evalops.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"evalops.js","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,eAAe,GAAG,oBAAoB,aAAa,EAAE,CAAC;AAC5D,MAAM,YAAY,GAAG,GAAG,eAAe,GAAG,aAAa,EAAE,CAAC;AAC1D,MAAM,oBAAoB,GAAG,uBAAuB,CAAC;AACrD,MAAM,0BAA0B,GAAG;IAClC,sBAAsB;IACtB,sBAAsB;CACb,CAAC;AACX,MAAM,iCAAiC,GAAG;IACzC,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AACX,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAC/C,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAChD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AA2E5C,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,wBAAwB,CAChC,OAAe,EACf,WAA8B,EAAE;IAEhC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,wBAAwB,CAC9B,WAAW,CAAC;QACX,GAAG,0BAA0B;QAC7B,GAAG,iCAAiC;KACpC,CAAC,IAAI,oBAAoB,EAC1B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC5B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,qCAAqC;QACrC,6BAA6B;KAC7B,CAAC,EACF,2BAA2B,CAC3B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC9B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,uCAAuC;QACvC,+BAA+B;KAC/B,CAAC,EACF,6BAA6B,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,eAAuB,EACvB,IAAY,EACZ,IAAiB;IAEjB,OAAO,eAAe,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE;QACzD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,oBAAoB,EAAE;QACjC,WAAW,EAAE,sBAAsB,EAAE;KACrC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IACnC,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,qCAAqC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QAC1B,yBAAyB;QACzB,6BAA6B;KAC7B,CAAC,CAAC;IACH,OAAO;QACN,QAAQ,EACP,WAAW,CAAC;YACX,0BAA0B;YAC1B,8BAA8B;SAC9B,CAAC,IAAI,6BAA6B;QACpC,WAAW,EACV,WAAW,CAAC;YACX,6BAA6B;YAC7B,iCAAiC;SACjC,CAAC,IAAI,gCAAgC;QACvC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC3C,OAAO,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACtB,KAAgC,EAChC,SAAiB;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C;IAE7C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAA6C;IAE7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,QAAQ,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ;QACzE,WAAW,EACV,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,WAAW;QACtE,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpD,CAAC,CAAC;gBACA,eAAe,EAAE,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;aAClE;YACF,CAAC,CAAC,QAAQ,CAAC,eAAe;gBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC;YAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;KACP,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,+BAA+B,CACvC,QAA6C;IAE7C,MAAM,cAAc,GACnB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC7C,2BAA2B,EAAE,CAAC;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACd,+FAA+F,CAC/F,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,QAAkC;IAElC,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAChC,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,MAIiE;IAEjE,OAAO;QACN,4BAA4B,EAAE,MAAM,CAAC,KAAK;QAC1C,sBAAsB,EAAE,MAAM,CAAC,cAAc;QAC7C,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACrD,2BAA2B,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW;QAC3D,GAAG,CAAC,MAAM,CAAC,OAAO;YACjB,CAAC,CAAC;gBACA,gBAAgB,EAAE,MAAM,CAAC,OAAO;gBAChC,wBAAwB,EAAE,MAAM,CAAC,OAAO;aACxC;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe;YACrC,CAAC,CAAC;gBACA,+BAA+B,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe;aACnE;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO;YAC7B,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAsC;IAEtC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAChD,eAAe,EACf,YAAY,CACZ,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,gBAAgB,EAC9C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA+C,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,OAAO,EAAE,KAAK,IAAI,yCAAyC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;QAC5C,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,cAAc,EAAE,+BAA+B,CAAC,QAAQ,CAAC;QACzD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QACtC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACvD,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QACzD,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;KACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB;IAIjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,aAAqD,CAAC;QAC1D,IAAI,YAAoC,CAAC;QAEzC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrE,aAAa,GAAG,GAAG,CAAC;YACpB,YAAY,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,sDAAsD,KAAK,qDAAqD,CAChH,CAAC;gBACF,YAAY,CAAC,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACR,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qIAAqI,CACrI,CAAC;gBACF,YAAY,CACX,IAAI,KAAK,CACR,+DAA+D,CAC/D,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,cAAc,CAC/B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CACzC,CAAC;gBACF,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;gBACnE,MAAM,qBAAqB,GAC1B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,qBAAqB;oBAC7C,CAAC,CAAC,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;oBAC7D,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qHAAqH,CACrH,CAAC;gBACF,aAAa,CAAC;oBACb,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,gBAAgB;oBAChB,YAAY;oBACZ,MAAM;iBACN,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CACtJ,CAAC;gBACF,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CACL,IAAI,KAAK,CACR,QAAQ,aAAa,uEAAuE,CAC5F,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC;gBACP,MAAM;gBACN,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa;aAC9B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,eAAuB,EACvB,cAAkC,EAClC,QAAmC;IAEnC,QAAQ,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,eAAe,EAC7C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,CAAC,cAAc,CAAC;SACxB,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACjD,IAAI,OAAO,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,qBAAqB,YAAY,8DAA8D,CAC/F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,+BAA+B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,iBAAiB,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,SAAgC,EAChC,QAAmC;IAEnC,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,2BAA2B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAChD,eAAe,EACf,cAAc,EACd,QAAQ,CACR,CAAC;QACF,QAAQ,EAAE,CAAC,0CAA0C,CAAC,CAAC;QACvD,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,SAAS,EAAE;YACX,IAAI,OAAO,CAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChD,UAAU,CACT,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAClE,CAAC,GAAG,EAAE,GAAG,IAAI,CACb,CAAC;YACH,CAAC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CACjD,eAAe,EACf,MAAM,CAAC,WAAW,EAClB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAC/B,CAAC;QAEF,MAAM,WAAW,GAAqB;YACrC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACT,eAAe;gBACf,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW;gBACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB;SACD,CAAC;QACF,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC/C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAC1C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,gBAAgB,GACrB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,IAAI,IAAI;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAEpD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,OAAO,EAAE,gBAAgB;QACzB,OAAO;QACP,QAAQ,EAAE;YACT,GAAG,QAAQ;YACX,eAAe;YACf,cAAc,EACb,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC;SAChE;KACD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,WAAW,EACzC;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CACD,CAAC;IAEF,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,6BAA6B,CAAC,CAAC;IAClE,CAAC;AACF,CAAC","sourcesContent":["import {\n\ttype IncomingMessage,\n\ttype Server,\n\ttype ServerResponse,\n\tcreateServer,\n} from \"node:http\";\nimport { PLATFORM_HTTP_ROUTES } from \"../platform/core-services.js\";\nimport { fetchDownstream } from \"../utils/downstream-http.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\tbuildDesktopDeviceProof,\n\tenrollDesktopDeviceIdentity,\n} from \"./device-identity.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth:evalops\");\n\nconst CALLBACK_PORT = 1460;\nconst CALLBACK_PATH = \"/auth/callback/evalops\";\nconst CALLBACK_ORIGIN = `http://127.0.0.1:${CALLBACK_PORT}`;\nconst CALLBACK_URI = `${CALLBACK_ORIGIN}${CALLBACK_PATH}`;\nconst DEFAULT_IDENTITY_URL = \"http://127.0.0.1:8080\";\nconst IDENTITY_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_IDENTITY_URL\",\n\t\"EVALOPS_IDENTITY_URL\",\n] as const;\nconst SHARED_PLATFORM_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\nconst DEFAULT_PROVIDER_REF_PROVIDER = \"openai\";\nconst DEFAULT_PROVIDER_REF_ENVIRONMENT = \"prod\";\nconst DEFAULT_IDENTITY_TIMEOUT_MS = 10_000;\nconst DEFAULT_IDENTITY_MAX_ATTEMPTS = 2;\nconst REQUIRED_SCOPE = \"llm_gateway:invoke\";\n\ninterface IdentityStartResponse {\n\tauthorization_url?: string;\n\terror?: string;\n}\n\ninterface IdentityRefreshResponse {\n\taccess_token?: string;\n\terror?: string;\n\texpires_at?: string;\n\torganization_id?: string;\n\trefresh_expires_at?: string;\n\trefresh_token?: string;\n\tscopes?: unknown;\n}\n\ninterface IdentityRevokeResponse {\n\terror?: string;\n\trevoked?: boolean;\n}\n\ninterface IdentityDelegationResponse {\n\tagent_id?: string;\n\terror?: string;\n\texpires_at?: string;\n\trun_id?: string;\n\tscopes_denied?: unknown;\n\tscopes_granted?: unknown;\n\tscopes_requested?: unknown;\n\ttoken?: string;\n\ttoken_type?: string;\n}\n\nexport interface EvalOpsProviderRef {\n\tprovider: string;\n\tenvironment: string;\n\tcredential_name?: string;\n\tteam_id?: string;\n}\n\ninterface EvalOpsCallbackResult {\n\taccessToken: string;\n\texpiresAt: number;\n\torganizationId: string;\n\trefreshExpiresAt?: number;\n\trefreshToken?: string;\n\tscopes: string[];\n}\n\nexport interface EvalOpsDelegationTokenRequest {\n\tagentId: string;\n\tagentType: string;\n\tcapabilities?: string[];\n\tmetadata?: Record<string, unknown>;\n\trunId: string;\n\tscopes?: string[];\n\tsurface: string;\n\ttoken?: string;\n\tttlSeconds?: number;\n}\n\nexport interface EvalOpsDelegationTokenResult {\n\tagentId: string;\n\texpiresAt: number;\n\torganizationId: string;\n\tproviderRef: EvalOpsProviderRef;\n\trunId: string;\n\tscopesDenied: string[];\n\tscopesGranted: string[];\n\tscopesRequested: string[];\n\ttoken: string;\n\ttokenType: string;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = process.env[name]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction normalizeIdentityBaseUrl(\n\tbaseUrl: string,\n\tsuffixes: readonly string[] = [],\n): string {\n\tlet normalized = baseUrl.trim().replace(/\\/+$/u, \"\");\n\tfor (const suffix of suffixes) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = normalized.slice(0, -suffix.length).replace(/\\/+$/u, \"\");\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction getIdentityBaseUrl(): string {\n\treturn normalizeIdentityBaseUrl(\n\t\tgetEnvValue([\n\t\t\t...IDENTITY_BASE_URL_ENV_VARS,\n\t\t\t...SHARED_PLATFORM_BASE_URL_ENV_VARS,\n\t\t]) ?? DEFAULT_IDENTITY_URL,\n\t\tObject.values(PLATFORM_HTTP_ROUTES.identity),\n\t);\n}\n\nfunction getIdentityTimeoutMs(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t\t\"EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_TIMEOUT_MS,\n\t);\n}\n\nfunction getIdentityMaxAttempts(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t\t\"EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_MAX_ATTEMPTS,\n\t);\n}\n\nfunction fetchIdentity(\n\tidentityBaseUrl: string,\n\tpath: string,\n\tinit: RequestInit,\n): Promise<Response> {\n\treturn fetchDownstream(`${identityBaseUrl}${path}`, init, {\n\t\tserviceName: \"EvalOps identity service\",\n\t\tfailureMode: \"required\",\n\t\ttimeoutMs: getIdentityTimeoutMs(),\n\t\tmaxAttempts: getIdentityMaxAttempts(),\n\t});\n}\n\nfunction getConfiguredOrganizationId(): string | undefined {\n\tconst organizationId = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]);\n\treturn organizationId;\n}\n\nfunction getProviderRef(): EvalOpsProviderRef {\n\tconst credentialName = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_CREDENTIAL_NAME\",\n\t\t\"MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME\",\n\t]);\n\tconst teamID = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_TEAM_ID\",\n\t\t\"MAESTRO_LLM_GATEWAY_TEAM_ID\",\n\t]);\n\treturn {\n\t\tprovider:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_PROVIDER\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_PROVIDER\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_PROVIDER,\n\t\tenvironment:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_ENVIRONMENT\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_ENVIRONMENT\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_ENVIRONMENT,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamID ? { team_id: teamID } : {}),\n\t};\n}\n\nfunction parseExpiresAt(value: string | null): number {\n\treturn parseTimestamp(value, \"expires_at\");\n}\n\nfunction parseTimestamp(\n\tvalue: string | null | undefined,\n\tfieldName: string,\n): number {\n\tif (!value) {\n\t\tthrow new Error(`Missing ${fieldName} in EvalOps response`);\n\t}\n\tconst expiresAt = Date.parse(value);\n\tif (Number.isNaN(expiresAt)) {\n\t\tthrow new Error(`Invalid ${fieldName} in EvalOps response: ${value}`);\n\t}\n\treturn expiresAt;\n}\n\nfunction parseScopes(value: string | null): string[] {\n\tif (!value) {\n\t\treturn [REQUIRED_SCOPE];\n\t}\n\treturn value\n\t\t.split(\" \")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction parseScopesPayload(value: unknown): string[] {\n\tif (!Array.isArray(value)) {\n\t\treturn [];\n\t}\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataNumber(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): number | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"number\" && Number.isFinite(value)\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataScopes(\n\tmetadata: Record<string, unknown> | undefined,\n): string[] {\n\treturn parseScopesPayload(metadata?.scopes);\n}\n\nfunction resolveProviderRef(\n\tmetadata: Record<string, unknown> | undefined,\n): EvalOpsProviderRef {\n\tconst fallback = getProviderRef();\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: undefined;\n\treturn {\n\t\tprovider: getMetadataString(providerRef, \"provider\") ?? fallback.provider,\n\t\tenvironment:\n\t\t\tgetMetadataString(providerRef, \"environment\") ?? fallback.environment,\n\t\t...(getMetadataString(providerRef, \"credential_name\")\n\t\t\t? {\n\t\t\t\t\tcredential_name: getMetadataString(providerRef, \"credential_name\"),\n\t\t\t\t}\n\t\t\t: fallback.credential_name\n\t\t\t\t? { credential_name: fallback.credential_name }\n\t\t\t\t: {}),\n\t\t...(getMetadataString(providerRef, \"team_id\")\n\t\t\t? { team_id: getMetadataString(providerRef, \"team_id\") }\n\t\t\t: fallback.team_id\n\t\t\t\t? { team_id: fallback.team_id }\n\t\t\t\t: {}),\n\t};\n}\n\nfunction resolveStoredEvalOpsMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, unknown> | undefined {\n\tif (metadata) {\n\t\treturn metadata;\n\t}\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\treturn stored?.metadata;\n}\n\nfunction resolveDelegationOrganizationId(\n\tmetadata: Record<string, unknown> | undefined,\n): string {\n\tconst organizationId =\n\t\tgetMetadataString(metadata, \"organizationId\") ??\n\t\tgetConfiguredOrganizationId();\n\tif (!organizationId) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires an organization id from /login evalops or MAESTRO_EVALOPS_ORG_ID.\",\n\t\t);\n\t}\n\treturn organizationId;\n}\n\nasync function getFreshEvalOpsAccessToken(\n\tmetadata?: Record<string, unknown>,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\tif (Date.now() < credentials.expires - 60_000) {\n\t\treturn credentials.access;\n\t}\n\tconst refreshed = await refreshEvalOpsToken(\n\t\tcredentials.refresh,\n\t\tmetadata ?? credentials.metadata,\n\t);\n\tsaveOAuthCredentials(\"evalops\", refreshed);\n\treturn refreshed.access;\n}\n\nexport function buildEvalOpsDelegationEnvironment(\n\tresult: Pick<\n\t\tEvalOpsDelegationTokenResult,\n\t\t\"organizationId\" | \"providerRef\" | \"token\"\n\t> &\n\t\tPartial<Pick<EvalOpsDelegationTokenResult, \"agentId\" | \"runId\">>,\n): Record<string, string> {\n\treturn {\n\t\tMAESTRO_EVALOPS_ACCESS_TOKEN: result.token,\n\t\tMAESTRO_EVALOPS_ORG_ID: result.organizationId,\n\t\tMAESTRO_EVALOPS_PROVIDER: result.providerRef.provider,\n\t\tMAESTRO_EVALOPS_ENVIRONMENT: result.providerRef.environment,\n\t\t...(result.agentId\n\t\t\t? {\n\t\t\t\t\tMAESTRO_AGENT_ID: result.agentId,\n\t\t\t\t\tMAESTRO_EVALOPS_AGENT_ID: result.agentId,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.runId ? { MAESTRO_EVALOPS_RUN_ID: result.runId } : {}),\n\t\t...(result.providerRef.credential_name\n\t\t\t? {\n\t\t\t\t\tMAESTRO_EVALOPS_CREDENTIAL_NAME: result.providerRef.credential_name,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.providerRef.team_id\n\t\t\t? { MAESTRO_EVALOPS_TEAM_ID: result.providerRef.team_id }\n\t\t\t: {}),\n\t};\n}\n\nexport async function issueEvalOpsDelegationToken(\n\trequest: EvalOpsDelegationTokenRequest,\n): Promise<EvalOpsDelegationTokenResult> {\n\tconst metadata = resolveStoredEvalOpsMetadata(request.metadata);\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildDesktopDeviceProof(\n\t\tidentityBaseUrl,\n\t\t\"delegation\",\n\t);\n\tconst token = request.token ?? (await getFreshEvalOpsAccessToken(metadata));\n\tif (!token) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires a valid access token. Run /login evalops first.\",\n\t\t);\n\t}\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.delegationTokens,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify({\n\t\t\t\tagent_id: request.agentId,\n\t\t\t\tagent_type: request.agentType,\n\t\t\t\t...(request.capabilities?.length\n\t\t\t\t\t? { capabilities: request.capabilities }\n\t\t\t\t\t: {}),\n\t\t\t\trun_id: request.runId,\n\t\t\t\t...(request.scopes?.length ? { scopes: request.scopes } : {}),\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t\tsurface: request.surface,\n\t\t\t\t...(request.ttlSeconds ? { ttl_seconds: request.ttlSeconds } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityDelegationResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityDelegationResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.token || !payload.expires_at) {\n\t\tthrow new Error(\n\t\t\tpayload?.error ?? \"EvalOps delegation token request failed\",\n\t\t);\n\t}\n\n\treturn {\n\t\tagentId: payload.agent_id ?? request.agentId,\n\t\texpiresAt: parseTimestamp(payload.expires_at, \"expires_at\"),\n\t\torganizationId: resolveDelegationOrganizationId(metadata),\n\t\tproviderRef: resolveProviderRef(metadata),\n\t\trunId: payload.run_id ?? request.runId,\n\t\tscopesDenied: parseScopesPayload(payload.scopes_denied),\n\t\tscopesGranted: parseScopesPayload(payload.scopes_granted),\n\t\tscopesRequested: parseScopesPayload(payload.scopes_requested),\n\t\ttoken: payload.token,\n\t\ttokenType: payload.token_type ?? \"Bearer\",\n\t};\n}\n\nasync function startCallbackServer(): Promise<{\n\tserver: Server;\n\tgetResult: () => Promise<EvalOpsCallbackResult>;\n}> {\n\treturn new Promise((resolve, reject) => {\n\t\tlet resultResolve: (value: EvalOpsCallbackResult) => void;\n\t\tlet resultReject: (error: Error) => void;\n\n\t\tconst resultPromise = new Promise<EvalOpsCallbackResult>((res, rej) => {\n\t\t\tresultResolve = res;\n\t\t\tresultReject = rej;\n\t\t});\n\n\t\tconst server = createServer((req: IncomingMessage, res: ServerResponse) => {\n\t\t\tconst requestUrl = new URL(req.url ?? \"\", CALLBACK_ORIGIN);\n\t\t\tif (requestUrl.pathname !== CALLBACK_PATH) {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst error = requestUrl.searchParams.get(\"error\");\n\t\t\tif (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>EvalOps Login Failed</h1><p>Error: ${error}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(new Error(`EvalOps identity login failed: ${error}`));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst accessToken = requestUrl.searchParams.get(\"access_token\");\n\t\t\tconst organizationId = requestUrl.searchParams.get(\"organization_id\");\n\t\t\tif (!accessToken || !organizationId) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Invalid Callback</h1><p>Missing access_token or organization_id.</p><p>You can close this window.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultReject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\"EvalOps callback was missing access_token or organization_id.\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst expiresAt = parseExpiresAt(\n\t\t\t\t\trequestUrl.searchParams.get(\"expires_at\"),\n\t\t\t\t);\n\t\t\t\tconst refreshToken =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_token\")?.trim() || undefined;\n\t\t\t\tconst refreshExpiresAtValue =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_expires_at\");\n\t\t\t\tconst refreshExpiresAt = refreshExpiresAtValue\n\t\t\t\t\t? parseTimestamp(refreshExpiresAtValue, \"refresh_expires_at\")\n\t\t\t\t\t: undefined;\n\t\t\t\tconst scopes = parseScopes(requestUrl.searchParams.get(\"scope\"));\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Authentication Successful</h1><p>You can close this window and return to Maestro.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultResolve({\n\t\t\t\t\taccessToken,\n\t\t\t\t\texpiresAt,\n\t\t\t\t\torganizationId,\n\t\t\t\t\trefreshExpiresAt,\n\t\t\t\t\trefreshToken,\n\t\t\t\t\tscopes,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>Invalid Callback</h1><p>${error instanceof Error ? error.message : String(error)}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"EADDRINUSE\") {\n\t\t\t\treject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t`Port ${CALLBACK_PORT} is already in use. Close the other process and retry /login evalops.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treject(error);\n\t\t});\n\n\t\tserver.listen(CALLBACK_PORT, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tgetResult: () => resultPromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve) => {\n\t\tserver.close(() => resolve());\n\t});\n}\n\nasync function startIdentityLogin(\n\tidentityBaseUrl: string,\n\torganizationId: string | undefined,\n\tonStatus?: (status: string) => void,\n): Promise<string> {\n\tonStatus?.(\"Requesting EvalOps managed login URL...\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.authGoogleStart,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tredirect_uri: CALLBACK_URI,\n\t\t\t\tresponse_mode: \"query\",\n\t\t\t\t...(organizationId ? { organization_id: organizationId } : {}),\n\t\t\t\tprompt: \"select_account\",\n\t\t\t\tscopes: [REQUIRED_SCOPE],\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityStartResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityStartResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic message below.\n\t}\n\n\tif (!response.ok || !payload?.authorization_url) {\n\t\tif (payload?.error === \"redirect_uri_not_allowed\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Identity rejected ${CALLBACK_URI}. Add it to IDENTITY_GOOGLE_ALLOWED_REDIRECT_URIS and retry.`,\n\t\t\t);\n\t\t}\n\t\tthrow new Error(payload?.error ?? \"EvalOps identity start failed\");\n\t}\n\n\treturn payload.authorization_url;\n}\n\nexport async function loginEvalOps(\n\tonAuthUrl: (url: string) => void,\n\tonStatus?: (status: string) => void,\n): Promise<void> {\n\tconst identityBaseUrl = getIdentityBaseUrl();\n\tconst organizationId = getConfiguredOrganizationId();\n\tconst providerRef = getProviderRef();\n\tconst { server, getResult } = await startCallbackServer();\n\n\ttry {\n\t\tconst authorizationUrl = await startIdentityLogin(\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId,\n\t\t\tonStatus,\n\t\t);\n\t\tonStatus?.(\"Waiting for EvalOps identity callback...\");\n\t\tonAuthUrl(authorizationUrl);\n\n\t\tconst result = await Promise.race([\n\t\t\tgetResult(),\n\t\t\tnew Promise<EvalOpsCallbackResult>((_, reject) => {\n\t\t\t\tsetTimeout(\n\t\t\t\t\t() => reject(new Error(\"EvalOps login timed out after 5 minutes\")),\n\t\t\t\t\t5 * 60 * 1000,\n\t\t\t\t);\n\t\t\t}),\n\t\t]);\n\n\t\tconst deviceId = await enrollDesktopDeviceIdentity(\n\t\t\tidentityBaseUrl,\n\t\t\tresult.accessToken,\n\t\t\tprocess.env.npm_package_version,\n\t\t);\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: result.accessToken,\n\t\t\trefresh: result.refreshToken ?? \"\",\n\t\t\texpires: result.expiresAt,\n\t\t\tmetadata: {\n\t\t\t\tidentityBaseUrl,\n\t\t\t\torganizationId: result.organizationId,\n\t\t\t\tproviderRef,\n\t\t\t\t...(deviceId ? { deviceId } : {}),\n\t\t\t\t...(result.refreshExpiresAt\n\t\t\t\t\t? { refreshExpiresAt: result.refreshExpiresAt }\n\t\t\t\t\t: {}),\n\t\t\t\tscopes: result.scopes,\n\t\t\t},\n\t\t};\n\t\tsaveOAuthCredentials(\"evalops\", credentials);\n\t\tlogger.info(\"EvalOps managed login successful\", {\n\t\t\torganizationId: result.organizationId,\n\t\t\tprovider: providerRef.provider,\n\t\t\tenvironment: providerRef.environment,\n\t\t});\n\t} finally {\n\t\tawait closeServer(server);\n\t}\n}\n\nexport async function refreshEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<OAuthCredentials> {\n\tif (!refreshToken) {\n\t\tthrow new Error(\"EvalOps refresh token missing. Run /login evalops again.\");\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildDesktopDeviceProof(identityBaseUrl, \"refresh\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRefresh,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\trefresh_token: refreshToken,\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityRefreshResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRefreshResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.access_token || !payload.expires_at) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token refresh failed\");\n\t}\n\n\tconst expires = parseTimestamp(payload.expires_at, \"expires_at\");\n\tconst nextRefreshToken =\n\t\ttypeof payload.refresh_token === \"string\" &&\n\t\tpayload.refresh_token.trim().length > 0\n\t\t\t? payload.refresh_token\n\t\t\t: refreshToken;\n\tconst scopes = parseScopesPayload(payload.scopes);\n\tconst refreshExpiresAt =\n\t\tpayload.refresh_expires_at != null\n\t\t\t? parseTimestamp(payload.refresh_expires_at, \"refresh_expires_at\")\n\t\t\t: getMetadataNumber(metadata, \"refreshExpiresAt\");\n\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess: payload.access_token,\n\t\trefresh: nextRefreshToken,\n\t\texpires,\n\t\tmetadata: {\n\t\t\t...metadata,\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId:\n\t\t\t\ttypeof payload.organization_id === \"string\" &&\n\t\t\t\tpayload.organization_id.length > 0\n\t\t\t\t\t? payload.organization_id\n\t\t\t\t\t: getMetadataString(metadata, \"organizationId\"),\n\t\t\t...(refreshExpiresAt ? { refreshExpiresAt } : {}),\n\t\t\tscopes: scopes.length > 0 ? scopes : getMetadataScopes(metadata),\n\t\t},\n\t};\n}\n\nexport async function revokeEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<void> {\n\tif (!refreshToken) {\n\t\treturn;\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRevoke,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({ refresh_token: refreshToken }),\n\t\t},\n\t);\n\n\tlet payload: IdentityRevokeResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRevokeResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token revoke failed\");\n\t}\n}\n"]}
1
+ {"version":3,"file":"evalops.js","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,2BAA2B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,eAAe,GAAG,oBAAoB,aAAa,EAAE,CAAC;AAC5D,MAAM,YAAY,GAAG,GAAG,eAAe,GAAG,aAAa,EAAE,CAAC;AAC1D,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAC5D,MAAM,0BAA0B,GAAG;IAClC,sBAAsB;IACtB,sBAAsB;CACb,CAAC;AACX,MAAM,iCAAiC,GAAG;IACzC,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AACX,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAC/C,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAChD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AA2E5C,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,wBAAwB,CAChC,OAAe,EACf,WAA8B,EAAE;IAEhC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,wBAAwB,CAC9B,WAAW,CAAC;QACX,GAAG,0BAA0B;QAC7B,GAAG,iCAAiC;KACpC,CAAC,IAAI,oBAAoB,EAC1B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC5B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,qCAAqC;QACrC,6BAA6B;KAC7B,CAAC,EACF,2BAA2B,CAC3B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC9B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,uCAAuC;QACvC,+BAA+B;KAC/B,CAAC,EACF,6BAA6B,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,eAAuB,EACvB,IAAY,EACZ,IAAiB;IAEjB,OAAO,eAAe,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE;QACzD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,oBAAoB,EAAE;QACjC,WAAW,EAAE,sBAAsB,EAAE;KACrC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IACnC,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,CAAC,CAAC;IACH,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,qCAAqC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QAC1B,yBAAyB;QACzB,6BAA6B;KAC7B,CAAC,CAAC;IACH,OAAO;QACN,QAAQ,EACP,WAAW,CAAC;YACX,0BAA0B;YAC1B,8BAA8B;SAC9B,CAAC,IAAI,6BAA6B;QACpC,WAAW,EACV,WAAW,CAAC;YACX,6BAA6B;YAC7B,iCAAiC;SACjC,CAAC,IAAI,gCAAgC;QACvC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC3C,OAAO,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACtB,KAAgC,EAChC,SAAiB;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C;IAE7C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAA6C;IAE7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,QAAQ,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ;QACzE,WAAW,EACV,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,WAAW;QACtE,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpD,CAAC,CAAC;gBACA,eAAe,EAAE,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;aAClE;YACF,CAAC,CAAC,QAAQ,CAAC,eAAe;gBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC;YAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;KACP,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,+BAA+B,CACvC,QAA6C;IAE7C,MAAM,cAAc,GACnB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC7C,2BAA2B,EAAE,CAAC;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACd,+FAA+F,CAC/F,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,QAAkC;IAElC,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAChC,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,MAIiE;IAEjE,OAAO;QACN,4BAA4B,EAAE,MAAM,CAAC,KAAK;QAC1C,sBAAsB,EAAE,MAAM,CAAC,cAAc;QAC7C,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACrD,2BAA2B,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW;QAC3D,GAAG,CAAC,MAAM,CAAC,OAAO;YACjB,CAAC,CAAC;gBACA,gBAAgB,EAAE,MAAM,CAAC,OAAO;gBAChC,wBAAwB,EAAE,MAAM,CAAC,OAAO;aACxC;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe;YACrC,CAAC,CAAC;gBACA,+BAA+B,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe;aACnE;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO;YAC7B,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAsC;IAEtC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAChD,eAAe,EACf,YAAY,CACZ,CAAC;IACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAC;IACH,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,gBAAgB,EAC9C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA+C,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,OAAO,EAAE,KAAK,IAAI,yCAAyC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;QAC5C,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,cAAc,EAAE,+BAA+B,CAAC,QAAQ,CAAC;QACzD,WAAW,EAAE,kBAAkB,CAAC,QAAQ,CAAC;QACzC,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QACtC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACvD,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QACzD,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;KACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB;IAIjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,aAAqD,CAAC;QAC1D,IAAI,YAAoC,CAAC;QAEzC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrE,aAAa,GAAG,GAAG,CAAC;YACpB,YAAY,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACzE,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,sDAAsD,KAAK,qDAAqD,CAChH,CAAC;gBACF,YAAY,CAAC,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACR,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qIAAqI,CACrI,CAAC;gBACF,YAAY,CACX,IAAI,KAAK,CACR,+DAA+D,CAC/D,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,cAAc,CAC/B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CACzC,CAAC;gBACF,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;gBACnE,MAAM,qBAAqB,GAC1B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,qBAAqB;oBAC7C,CAAC,CAAC,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;oBAC7D,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qHAAqH,CACrH,CAAC;gBACF,aAAa,CAAC;oBACb,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,gBAAgB;oBAChB,YAAY;oBACZ,MAAM;iBACN,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CACtJ,CAAC;gBACF,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CACL,IAAI,KAAK,CACR,QAAQ,aAAa,uEAAuE,CAC5F,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC;gBACP,MAAM;gBACN,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa;aAC9B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,eAAuB,EACvB,cAAkC,EAClC,QAAmC;IAEnC,QAAQ,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,eAAe,EAC7C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,CAAC,cAAc,CAAC;SACxB,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACjD,IAAI,OAAO,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,qBAAqB,YAAY,8DAA8D,CAC/F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,+BAA+B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,iBAAiB,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,SAAgC,EAChC,QAAmC;IAEnC,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,2BAA2B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAChD,eAAe,EACf,cAAc,EACd,QAAQ,CACR,CAAC;QACF,QAAQ,EAAE,CAAC,0CAA0C,CAAC,CAAC;QACvD,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,SAAS,EAAE;YACX,IAAI,OAAO,CAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChD,UAAU,CACT,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAClE,CAAC,GAAG,EAAE,GAAG,IAAI,CACb,CAAC;YACH,CAAC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CACjD,eAAe,EACf,MAAM,CAAC,WAAW,EAClB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAC/B,CAAC;QAEF,MAAM,WAAW,GAAqB;YACrC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACT,eAAe;gBACf,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW;gBACX,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjC,GAAG,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB;SACD,CAAC;QACF,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC/C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,uBAAuB,CAAC,eAAe,EAAE,SAAS,CAAC,CAAC;IAC9E,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAC1C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,gBAAgB,GACrB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,IAAI,IAAI;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAEpD,OAAO;QACN,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,OAAO,EAAE,gBAAgB;QACzB,OAAO;QACP,QAAQ,EAAE;YACT,GAAG,QAAQ;YACX,eAAe;YACf,cAAc,EACb,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC;SAChE;KACD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,WAAW,EACzC;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CACD,CAAC;IAEF,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,6BAA6B,CAAC,CAAC;IAClE,CAAC;AACF,CAAC","sourcesContent":["import {\n\ttype IncomingMessage,\n\ttype Server,\n\ttype ServerResponse,\n\tcreateServer,\n} from \"node:http\";\nimport { PLATFORM_HTTP_ROUTES } from \"../platform/core-services.js\";\nimport { fetchDownstream } from \"../utils/downstream-http.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\tbuildDesktopDeviceProof,\n\tenrollDesktopDeviceIdentity,\n} from \"./device-identity.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth:evalops\");\n\nconst CALLBACK_PORT = 1460;\nconst CALLBACK_PATH = \"/auth/callback/evalops\";\nconst CALLBACK_ORIGIN = `http://127.0.0.1:${CALLBACK_PORT}`;\nconst CALLBACK_URI = `${CALLBACK_ORIGIN}${CALLBACK_PATH}`;\nconst DEFAULT_IDENTITY_URL = \"https://identity.evalops.dev\";\nconst IDENTITY_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_IDENTITY_URL\",\n\t\"EVALOPS_IDENTITY_URL\",\n] as const;\nconst SHARED_PLATFORM_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\nconst DEFAULT_PROVIDER_REF_PROVIDER = \"openai\";\nconst DEFAULT_PROVIDER_REF_ENVIRONMENT = \"prod\";\nconst DEFAULT_IDENTITY_TIMEOUT_MS = 10_000;\nconst DEFAULT_IDENTITY_MAX_ATTEMPTS = 2;\nconst REQUIRED_SCOPE = \"llm_gateway:invoke\";\n\ninterface IdentityStartResponse {\n\tauthorization_url?: string;\n\terror?: string;\n}\n\ninterface IdentityRefreshResponse {\n\taccess_token?: string;\n\terror?: string;\n\texpires_at?: string;\n\torganization_id?: string;\n\trefresh_expires_at?: string;\n\trefresh_token?: string;\n\tscopes?: unknown;\n}\n\ninterface IdentityRevokeResponse {\n\terror?: string;\n\trevoked?: boolean;\n}\n\ninterface IdentityDelegationResponse {\n\tagent_id?: string;\n\terror?: string;\n\texpires_at?: string;\n\trun_id?: string;\n\tscopes_denied?: unknown;\n\tscopes_granted?: unknown;\n\tscopes_requested?: unknown;\n\ttoken?: string;\n\ttoken_type?: string;\n}\n\nexport interface EvalOpsProviderRef {\n\tprovider: string;\n\tenvironment: string;\n\tcredential_name?: string;\n\tteam_id?: string;\n}\n\ninterface EvalOpsCallbackResult {\n\taccessToken: string;\n\texpiresAt: number;\n\torganizationId: string;\n\trefreshExpiresAt?: number;\n\trefreshToken?: string;\n\tscopes: string[];\n}\n\nexport interface EvalOpsDelegationTokenRequest {\n\tagentId: string;\n\tagentType: string;\n\tcapabilities?: string[];\n\tmetadata?: Record<string, unknown>;\n\trunId: string;\n\tscopes?: string[];\n\tsurface: string;\n\ttoken?: string;\n\tttlSeconds?: number;\n}\n\nexport interface EvalOpsDelegationTokenResult {\n\tagentId: string;\n\texpiresAt: number;\n\torganizationId: string;\n\tproviderRef: EvalOpsProviderRef;\n\trunId: string;\n\tscopesDenied: string[];\n\tscopesGranted: string[];\n\tscopesRequested: string[];\n\ttoken: string;\n\ttokenType: string;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = process.env[name]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction normalizeIdentityBaseUrl(\n\tbaseUrl: string,\n\tsuffixes: readonly string[] = [],\n): string {\n\tlet normalized = baseUrl.trim().replace(/\\/+$/u, \"\");\n\tfor (const suffix of suffixes) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = normalized.slice(0, -suffix.length).replace(/\\/+$/u, \"\");\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction getIdentityBaseUrl(): string {\n\treturn normalizeIdentityBaseUrl(\n\t\tgetEnvValue([\n\t\t\t...IDENTITY_BASE_URL_ENV_VARS,\n\t\t\t...SHARED_PLATFORM_BASE_URL_ENV_VARS,\n\t\t]) ?? DEFAULT_IDENTITY_URL,\n\t\tObject.values(PLATFORM_HTTP_ROUTES.identity),\n\t);\n}\n\nfunction getIdentityTimeoutMs(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t\t\"EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_TIMEOUT_MS,\n\t);\n}\n\nfunction getIdentityMaxAttempts(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t\t\"EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_MAX_ATTEMPTS,\n\t);\n}\n\nfunction fetchIdentity(\n\tidentityBaseUrl: string,\n\tpath: string,\n\tinit: RequestInit,\n): Promise<Response> {\n\treturn fetchDownstream(`${identityBaseUrl}${path}`, init, {\n\t\tserviceName: \"EvalOps identity service\",\n\t\tfailureMode: \"required\",\n\t\ttimeoutMs: getIdentityTimeoutMs(),\n\t\tmaxAttempts: getIdentityMaxAttempts(),\n\t});\n}\n\nfunction getConfiguredOrganizationId(): string | undefined {\n\tconst organizationId = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]);\n\treturn organizationId;\n}\n\nfunction getProviderRef(): EvalOpsProviderRef {\n\tconst credentialName = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_CREDENTIAL_NAME\",\n\t\t\"MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME\",\n\t]);\n\tconst teamID = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_TEAM_ID\",\n\t\t\"MAESTRO_LLM_GATEWAY_TEAM_ID\",\n\t]);\n\treturn {\n\t\tprovider:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_PROVIDER\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_PROVIDER\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_PROVIDER,\n\t\tenvironment:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_ENVIRONMENT\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_ENVIRONMENT\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_ENVIRONMENT,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamID ? { team_id: teamID } : {}),\n\t};\n}\n\nfunction parseExpiresAt(value: string | null): number {\n\treturn parseTimestamp(value, \"expires_at\");\n}\n\nfunction parseTimestamp(\n\tvalue: string | null | undefined,\n\tfieldName: string,\n): number {\n\tif (!value) {\n\t\tthrow new Error(`Missing ${fieldName} in EvalOps response`);\n\t}\n\tconst expiresAt = Date.parse(value);\n\tif (Number.isNaN(expiresAt)) {\n\t\tthrow new Error(`Invalid ${fieldName} in EvalOps response: ${value}`);\n\t}\n\treturn expiresAt;\n}\n\nfunction parseScopes(value: string | null): string[] {\n\tif (!value) {\n\t\treturn [REQUIRED_SCOPE];\n\t}\n\treturn value\n\t\t.split(\" \")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction parseScopesPayload(value: unknown): string[] {\n\tif (!Array.isArray(value)) {\n\t\treturn [];\n\t}\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataNumber(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): number | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"number\" && Number.isFinite(value)\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataScopes(\n\tmetadata: Record<string, unknown> | undefined,\n): string[] {\n\treturn parseScopesPayload(metadata?.scopes);\n}\n\nfunction resolveProviderRef(\n\tmetadata: Record<string, unknown> | undefined,\n): EvalOpsProviderRef {\n\tconst fallback = getProviderRef();\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: undefined;\n\treturn {\n\t\tprovider: getMetadataString(providerRef, \"provider\") ?? fallback.provider,\n\t\tenvironment:\n\t\t\tgetMetadataString(providerRef, \"environment\") ?? fallback.environment,\n\t\t...(getMetadataString(providerRef, \"credential_name\")\n\t\t\t? {\n\t\t\t\t\tcredential_name: getMetadataString(providerRef, \"credential_name\"),\n\t\t\t\t}\n\t\t\t: fallback.credential_name\n\t\t\t\t? { credential_name: fallback.credential_name }\n\t\t\t\t: {}),\n\t\t...(getMetadataString(providerRef, \"team_id\")\n\t\t\t? { team_id: getMetadataString(providerRef, \"team_id\") }\n\t\t\t: fallback.team_id\n\t\t\t\t? { team_id: fallback.team_id }\n\t\t\t\t: {}),\n\t};\n}\n\nfunction resolveStoredEvalOpsMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, unknown> | undefined {\n\tif (metadata) {\n\t\treturn metadata;\n\t}\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\treturn stored?.metadata;\n}\n\nfunction resolveDelegationOrganizationId(\n\tmetadata: Record<string, unknown> | undefined,\n): string {\n\tconst organizationId =\n\t\tgetMetadataString(metadata, \"organizationId\") ??\n\t\tgetConfiguredOrganizationId();\n\tif (!organizationId) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires an organization id from /login evalops or MAESTRO_EVALOPS_ORG_ID.\",\n\t\t);\n\t}\n\treturn organizationId;\n}\n\nasync function getFreshEvalOpsAccessToken(\n\tmetadata?: Record<string, unknown>,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\tif (Date.now() < credentials.expires - 60_000) {\n\t\treturn credentials.access;\n\t}\n\tconst refreshed = await refreshEvalOpsToken(\n\t\tcredentials.refresh,\n\t\tmetadata ?? credentials.metadata,\n\t);\n\tsaveOAuthCredentials(\"evalops\", refreshed);\n\treturn refreshed.access;\n}\n\nexport function buildEvalOpsDelegationEnvironment(\n\tresult: Pick<\n\t\tEvalOpsDelegationTokenResult,\n\t\t\"organizationId\" | \"providerRef\" | \"token\"\n\t> &\n\t\tPartial<Pick<EvalOpsDelegationTokenResult, \"agentId\" | \"runId\">>,\n): Record<string, string> {\n\treturn {\n\t\tMAESTRO_EVALOPS_ACCESS_TOKEN: result.token,\n\t\tMAESTRO_EVALOPS_ORG_ID: result.organizationId,\n\t\tMAESTRO_EVALOPS_PROVIDER: result.providerRef.provider,\n\t\tMAESTRO_EVALOPS_ENVIRONMENT: result.providerRef.environment,\n\t\t...(result.agentId\n\t\t\t? {\n\t\t\t\t\tMAESTRO_AGENT_ID: result.agentId,\n\t\t\t\t\tMAESTRO_EVALOPS_AGENT_ID: result.agentId,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.runId ? { MAESTRO_EVALOPS_RUN_ID: result.runId } : {}),\n\t\t...(result.providerRef.credential_name\n\t\t\t? {\n\t\t\t\t\tMAESTRO_EVALOPS_CREDENTIAL_NAME: result.providerRef.credential_name,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.providerRef.team_id\n\t\t\t? { MAESTRO_EVALOPS_TEAM_ID: result.providerRef.team_id }\n\t\t\t: {}),\n\t};\n}\n\nexport async function issueEvalOpsDelegationToken(\n\trequest: EvalOpsDelegationTokenRequest,\n): Promise<EvalOpsDelegationTokenResult> {\n\tconst metadata = resolveStoredEvalOpsMetadata(request.metadata);\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildDesktopDeviceProof(\n\t\tidentityBaseUrl,\n\t\t\"delegation\",\n\t);\n\tconst token = request.token ?? (await getFreshEvalOpsAccessToken(metadata));\n\tif (!token) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires a valid access token. Run /login evalops first.\",\n\t\t);\n\t}\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.delegationTokens,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify({\n\t\t\t\tagent_id: request.agentId,\n\t\t\t\tagent_type: request.agentType,\n\t\t\t\t...(request.capabilities?.length\n\t\t\t\t\t? { capabilities: request.capabilities }\n\t\t\t\t\t: {}),\n\t\t\t\trun_id: request.runId,\n\t\t\t\t...(request.scopes?.length ? { scopes: request.scopes } : {}),\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t\tsurface: request.surface,\n\t\t\t\t...(request.ttlSeconds ? { ttl_seconds: request.ttlSeconds } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityDelegationResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityDelegationResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.token || !payload.expires_at) {\n\t\tthrow new Error(\n\t\t\tpayload?.error ?? \"EvalOps delegation token request failed\",\n\t\t);\n\t}\n\n\treturn {\n\t\tagentId: payload.agent_id ?? request.agentId,\n\t\texpiresAt: parseTimestamp(payload.expires_at, \"expires_at\"),\n\t\torganizationId: resolveDelegationOrganizationId(metadata),\n\t\tproviderRef: resolveProviderRef(metadata),\n\t\trunId: payload.run_id ?? request.runId,\n\t\tscopesDenied: parseScopesPayload(payload.scopes_denied),\n\t\tscopesGranted: parseScopesPayload(payload.scopes_granted),\n\t\tscopesRequested: parseScopesPayload(payload.scopes_requested),\n\t\ttoken: payload.token,\n\t\ttokenType: payload.token_type ?? \"Bearer\",\n\t};\n}\n\nasync function startCallbackServer(): Promise<{\n\tserver: Server;\n\tgetResult: () => Promise<EvalOpsCallbackResult>;\n}> {\n\treturn new Promise((resolve, reject) => {\n\t\tlet resultResolve: (value: EvalOpsCallbackResult) => void;\n\t\tlet resultReject: (error: Error) => void;\n\n\t\tconst resultPromise = new Promise<EvalOpsCallbackResult>((res, rej) => {\n\t\t\tresultResolve = res;\n\t\t\tresultReject = rej;\n\t\t});\n\n\t\tconst server = createServer((req: IncomingMessage, res: ServerResponse) => {\n\t\t\tconst requestUrl = new URL(req.url ?? \"\", CALLBACK_ORIGIN);\n\t\t\tif (requestUrl.pathname !== CALLBACK_PATH) {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst error = requestUrl.searchParams.get(\"error\");\n\t\t\tif (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>EvalOps Login Failed</h1><p>Error: ${error}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(new Error(`EvalOps identity login failed: ${error}`));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst accessToken = requestUrl.searchParams.get(\"access_token\");\n\t\t\tconst organizationId = requestUrl.searchParams.get(\"organization_id\");\n\t\t\tif (!accessToken || !organizationId) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Invalid Callback</h1><p>Missing access_token or organization_id.</p><p>You can close this window.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultReject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\"EvalOps callback was missing access_token or organization_id.\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst expiresAt = parseExpiresAt(\n\t\t\t\t\trequestUrl.searchParams.get(\"expires_at\"),\n\t\t\t\t);\n\t\t\t\tconst refreshToken =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_token\")?.trim() || undefined;\n\t\t\t\tconst refreshExpiresAtValue =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_expires_at\");\n\t\t\t\tconst refreshExpiresAt = refreshExpiresAtValue\n\t\t\t\t\t? parseTimestamp(refreshExpiresAtValue, \"refresh_expires_at\")\n\t\t\t\t\t: undefined;\n\t\t\t\tconst scopes = parseScopes(requestUrl.searchParams.get(\"scope\"));\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Authentication Successful</h1><p>You can close this window and return to Maestro.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultResolve({\n\t\t\t\t\taccessToken,\n\t\t\t\t\texpiresAt,\n\t\t\t\t\torganizationId,\n\t\t\t\t\trefreshExpiresAt,\n\t\t\t\t\trefreshToken,\n\t\t\t\t\tscopes,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>Invalid Callback</h1><p>${error instanceof Error ? error.message : String(error)}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"EADDRINUSE\") {\n\t\t\t\treject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t`Port ${CALLBACK_PORT} is already in use. Close the other process and retry /login evalops.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treject(error);\n\t\t});\n\n\t\tserver.listen(CALLBACK_PORT, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tgetResult: () => resultPromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve) => {\n\t\tserver.close(() => resolve());\n\t});\n}\n\nasync function startIdentityLogin(\n\tidentityBaseUrl: string,\n\torganizationId: string | undefined,\n\tonStatus?: (status: string) => void,\n): Promise<string> {\n\tonStatus?.(\"Requesting EvalOps managed login URL...\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.authGoogleStart,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tredirect_uri: CALLBACK_URI,\n\t\t\t\tresponse_mode: \"query\",\n\t\t\t\t...(organizationId ? { organization_id: organizationId } : {}),\n\t\t\t\tprompt: \"select_account\",\n\t\t\t\tscopes: [REQUIRED_SCOPE],\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityStartResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityStartResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic message below.\n\t}\n\n\tif (!response.ok || !payload?.authorization_url) {\n\t\tif (payload?.error === \"redirect_uri_not_allowed\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Identity rejected ${CALLBACK_URI}. Add it to IDENTITY_GOOGLE_ALLOWED_REDIRECT_URIS and retry.`,\n\t\t\t);\n\t\t}\n\t\tthrow new Error(payload?.error ?? \"EvalOps identity start failed\");\n\t}\n\n\treturn payload.authorization_url;\n}\n\nexport async function loginEvalOps(\n\tonAuthUrl: (url: string) => void,\n\tonStatus?: (status: string) => void,\n): Promise<void> {\n\tconst identityBaseUrl = getIdentityBaseUrl();\n\tconst organizationId = getConfiguredOrganizationId();\n\tconst providerRef = getProviderRef();\n\tconst { server, getResult } = await startCallbackServer();\n\n\ttry {\n\t\tconst authorizationUrl = await startIdentityLogin(\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId,\n\t\t\tonStatus,\n\t\t);\n\t\tonStatus?.(\"Waiting for EvalOps identity callback...\");\n\t\tonAuthUrl(authorizationUrl);\n\n\t\tconst result = await Promise.race([\n\t\t\tgetResult(),\n\t\t\tnew Promise<EvalOpsCallbackResult>((_, reject) => {\n\t\t\t\tsetTimeout(\n\t\t\t\t\t() => reject(new Error(\"EvalOps login timed out after 5 minutes\")),\n\t\t\t\t\t5 * 60 * 1000,\n\t\t\t\t);\n\t\t\t}),\n\t\t]);\n\n\t\tconst deviceId = await enrollDesktopDeviceIdentity(\n\t\t\tidentityBaseUrl,\n\t\t\tresult.accessToken,\n\t\t\tprocess.env.npm_package_version,\n\t\t);\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: result.accessToken,\n\t\t\trefresh: result.refreshToken ?? \"\",\n\t\t\texpires: result.expiresAt,\n\t\t\tmetadata: {\n\t\t\t\tidentityBaseUrl,\n\t\t\t\torganizationId: result.organizationId,\n\t\t\t\tproviderRef,\n\t\t\t\t...(deviceId ? { deviceId } : {}),\n\t\t\t\t...(result.refreshExpiresAt\n\t\t\t\t\t? { refreshExpiresAt: result.refreshExpiresAt }\n\t\t\t\t\t: {}),\n\t\t\t\tscopes: result.scopes,\n\t\t\t},\n\t\t};\n\t\tsaveOAuthCredentials(\"evalops\", credentials);\n\t\tlogger.info(\"EvalOps managed login successful\", {\n\t\t\torganizationId: result.organizationId,\n\t\t\tprovider: providerRef.provider,\n\t\t\tenvironment: providerRef.environment,\n\t\t});\n\t} finally {\n\t\tawait closeServer(server);\n\t}\n}\n\nexport async function refreshEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<OAuthCredentials> {\n\tif (!refreshToken) {\n\t\tthrow new Error(\"EvalOps refresh token missing. Run /login evalops again.\");\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildDesktopDeviceProof(identityBaseUrl, \"refresh\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRefresh,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\trefresh_token: refreshToken,\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityRefreshResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRefreshResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.access_token || !payload.expires_at) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token refresh failed\");\n\t}\n\n\tconst expires = parseTimestamp(payload.expires_at, \"expires_at\");\n\tconst nextRefreshToken =\n\t\ttypeof payload.refresh_token === \"string\" &&\n\t\tpayload.refresh_token.trim().length > 0\n\t\t\t? payload.refresh_token\n\t\t\t: refreshToken;\n\tconst scopes = parseScopesPayload(payload.scopes);\n\tconst refreshExpiresAt =\n\t\tpayload.refresh_expires_at != null\n\t\t\t? parseTimestamp(payload.refresh_expires_at, \"refresh_expires_at\")\n\t\t\t: getMetadataNumber(metadata, \"refreshExpiresAt\");\n\n\treturn {\n\t\ttype: \"oauth\",\n\t\taccess: payload.access_token,\n\t\trefresh: nextRefreshToken,\n\t\texpires,\n\t\tmetadata: {\n\t\t\t...metadata,\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId:\n\t\t\t\ttypeof payload.organization_id === \"string\" &&\n\t\t\t\tpayload.organization_id.length > 0\n\t\t\t\t\t? payload.organization_id\n\t\t\t\t\t: getMetadataString(metadata, \"organizationId\"),\n\t\t\t...(refreshExpiresAt ? { refreshExpiresAt } : {}),\n\t\t\tscopes: scopes.length > 0 ? scopes : getMetadataScopes(metadata),\n\t\t},\n\t};\n}\n\nexport async function revokeEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<void> {\n\tif (!refreshToken) {\n\t\treturn;\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRevoke,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({ refresh_token: refreshToken }),\n\t\t},\n\t);\n\n\tlet payload: IdentityRevokeResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRevokeResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token revoke failed\");\n\t}\n}\n"]}
package/dist/version.json CHANGED
@@ -1,4 +1,4 @@
1
1
  {
2
- "version": "0.10.10",
3
- "notes": "Maestro by EvalOps - Deterministic coding agent with TUI/CLI and Web UI for AI-assisted development v0.10.10 is now available."
2
+ "version": "0.10.11",
3
+ "notes": "Maestro by EvalOps - Deterministic coding agent with TUI/CLI and Web UI for AI-assisted development v0.10.11 is now available."
4
4
  }
package/node_modules/@evalops/contracts/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@evalops/contracts",
3
- "version": "0.10.10",
3
+ "version": "0.10.11",
4
4
  "description": "Shared Maestro contracts for frontend/backend integration",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
package/node_modules/@evalops/tui/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@evalops/tui",
3
- "version": "0.10.10",
3
+ "version": "0.10.11",
4
4
  "description": "Terminal UI library with differential rendering for Maestro",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@evalops/maestro",
3
3
  "description": "Maestro by EvalOps - Deterministic coding agent with TUI/CLI and Web UI for AI-assisted development",
4
- "version": "0.10.10",
4
+ "version": "0.10.11",
5
5
  "private": false,
6
6
  "type": "module",
7
7
  "workspaces": [
@@ -127,8 +127,8 @@
127
127
  "@aws-sdk/client-bedrock-runtime": "^3.1020.0",
128
128
  "@crosscopy/clipboard": "^0.2.8",
129
129
  "@daytonaio/sdk": "^0.155.0",
130
- "@evalops/contracts": "^0.10.10",
131
- "@evalops/tui": "^0.10.10",
130
+ "@evalops/contracts": "^0.10.11",
131
+ "@evalops/tui": "^0.10.11",
132
132
  "@modelcontextprotocol/sdk": "^1.29.0",
133
133
  "@opentelemetry/api": "^1.9.1",
134
134
  "@opentelemetry/auto-instrumentations-node": "^0.74.0",