@evalops/maestro 0.10.11 → 0.10.13

package/dist/evalops/agent-bootstrap.d.ts

@@ -38,15 +38,24 @@ export interface EvalOpsAgentMcpMetadata {
 export interface EvalOpsInitResult {
     agentId?: string;
     apiKeyCreated: boolean;
+    approvalPolicyAttached?: boolean;
+    authenticatedAs?: string;
+    consoleUrl?: string;
     endpoint: string;
+    evidenceEventPublished?: boolean;
+    evidenceEvents?: number;
+    governedActionsLoaded?: number;
+    governedInferenceCheckRan?: boolean;
     keyPrefix?: string;
     manifestUrl?: string;
     organizationId?: string;
     registryVisible?: boolean;
+    riskFindings?: number;
     runId?: string;
     scopesGranted?: string[];
     sessionExpiresAt?: string;
     stored: boolean;
+    traceIngestionStarted?: boolean;
 }
 export interface EvalOpsInitStatus {
     message: string;

package/dist/evalops/agent-bootstrap.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-bootstrap.d.ts","sourceRoot":"","sources":["../../src/evalops/agent-bootstrap.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,qBAAqB,CAAC;AAkB7B,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACvC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,gBAAgB,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,eAAe,CAAC,EAAE,OAAO,oBAAoB,CAAC;IAC9C,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,oBAAoB,CAAC;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAyFD,wBAAgB,gCAAgC,IAC7C,uBAAuB,GACvB,SAAS,CAEX;AAkTD,wBAAsB,qBAAqB,CAC1C,OAAO,GAAE,kBAAuB,EAChC,YAAY,GAAE,uBAA4B,GACxC,OAAO,CAAC,iBAAiB,CAAC,CAyH5B"}
+{"version":3,"file":"agent-bootstrap.d.ts","sourceRoot":"","sources":["../../src/evalops/agent-bootstrap.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AACzE,OAAO,EAAE,aAAa,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,mBAAmB,CAAC;AAC9E,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,EACpB,MAAM,qBAAqB,CAAC;AAqB7B,MAAM,WAAW,kBAAkB;IAClC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,uBAAuB;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,WAAW,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,OAAO,CAAC;IACvB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,MAAM,EAAE,OAAO,CAAC;IAChB,qBAAqB,CAAC,EAAE,OAAO,CAAC;CAChC;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,uBAAuB;IACvC,eAAe,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,KAAK,gBAAgB,CAAC;IAC9E,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,aAAa,CAAC,EAAE,OAAO,aAAa,CAAC;IACrC,mBAAmB,CAAC,EAAE,OAAO,mBAAmB,CAAC;IACjD,eAAe,CAAC,EAAE,OAAO,oBAAoB,CAAC;IAC9C,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAClC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,iBAAiB,KAAK,IAAI,CAAC;IAC/C,eAAe,CAAC,EAAE,OAAO,oBAAoB,CAAC;CAC9C;AAED,MAAM,WAAW,gBAAgB;IAChC,QAAQ,CACP,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC3B,OAAO,CAAC,cAAc,CAAC,CAAC;IAC3B,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAmHD,wBAAgB,gCAAgC,IAC7C,uBAAuB,GACvB,SAAS,CAEX;AAmgBD,wBAAsB,qBAAqB,CAC1C,OAAO,GAAE,kBAAuB,EAChC,YAAY,GAAE,uBAA4B,GACxC,OAAO,CAAC,iBAAiB,CAAC,CA+J5B"}

package/dist/evalops/agent-bootstrap.js

@@ -5,17 +5,20 @@ import { getOAuthToken, hasOAuthCredentials, login } from "../oauth/index.js";
 import { loadOAuthCredentials, saveOAuthCredentials, } from "../oauth/storage.js";
 import { getPackageVersion } from "../package-metadata.js";
 import { getEnvValue, normalizeBaseUrl } from "../platform/client.js";
+import { PLATFORM_HTTP_ROUTES } from "../platform/core-services.js";
 const DEFAULT_AGENT_MCP_BASE_URL = "https://app.evalops.dev";
+const DEFAULT_IDENTITY_BASE_URL = "https://identity.evalops.dev";
 const AGENT_MCP_MANIFEST_PATH = "/.well-known/evalops/agent-mcp.json";
 const AGENT_MCP_PATH = "/mcp";
 const DEFAULT_AGENT_TYPE = "maestro";
 const DEFAULT_SURFACE = "cli";
-const DEFAULT_REGISTER_SCOPES = ["llm_gateway:invoke"];
 const DEFAULT_API_KEY_SCOPES = [
     "agent:register",
     "agent:heartbeat",
     "governance:evaluate",
+    "llm_gateway:invoke",
     "memories:read",
+    "memories:write",
     "meter:record",
 ];
 function isRecord(value) {
@@ -96,6 +99,53 @@ function normalizeManifestUrl(url) {
     }
     return parsed.toString();
 }
+function resolveIdentityBaseUrl(credentials, endpoint) {
+    const configured = getEnvValue([
+        "MAESTRO_IDENTITY_URL",
+        "EVALOPS_IDENTITY_URL",
+        "MAESTRO_PLATFORM_BASE_URL",
+        "MAESTRO_EVALOPS_BASE_URL",
+        "EVALOPS_BASE_URL",
+    ]);
+    const stored = typeof credentials?.metadata?.identityBaseUrl === "string"
+        ? credentials.metadata.identityBaseUrl
+        : undefined;
+    const derived = identityBaseUrlFromMcpEndpoint(endpoint?.endpoint);
+    const storedBeforeDerived = endpoint
+        ? !endpoint.preferDerivedIdentity && isCustomMcpEndpoint(endpoint.endpoint)
+        : false;
+    return normalizeBaseUrl(configured ??
+        endpoint?.identityBaseUrl ??
+        (endpoint?.preferDerivedIdentity ? derived : undefined) ??
+        (storedBeforeDerived ? stored : undefined) ??
+        derived ??
+        stored ??
+        DEFAULT_IDENTITY_BASE_URL, Object.values(PLATFORM_HTTP_ROUTES.identity));
+}
+function isCustomMcpEndpoint(endpoint) {
+    const parsed = new URL(normalizeBaseUrl(endpoint));
+    return (parsed.hostname !== "app.evalops.dev" &&
+        parsed.hostname !== "staging.evalops.dev");
+}
+function identityBaseUrlFromMcpEndpoint(endpoint) {
+    if (!endpoint) {
+        return undefined;
+    }
+    const parsed = new URL(normalizeBaseUrl(endpoint));
+    if (parsed.hostname === "app.evalops.dev") {
+        return DEFAULT_IDENTITY_BASE_URL;
+    }
+    if (parsed.hostname === "staging.evalops.dev") {
+        return "https://api.staging.evalops.dev";
+    }
+    if (parsed.hostname.startsWith("app.")) {
+        parsed.hostname = `identity.${parsed.hostname.slice("app.".length)}`;
+    }
+    parsed.pathname = "";
+    parsed.search = "";
+    parsed.hash = "";
+    return normalizeBaseUrl(parsed.toString());
+}
 async function resolveEndpointFromManifest(manifestUrl, fetchImpl) {
     const response = await fetchImpl(manifestUrl, {
         headers: { accept: "application/json" },
@@ -104,18 +154,33 @@ async function resolveEndpointFromManifest(manifestUrl, fetchImpl) {
         throw new Error(`Failed to fetch EvalOps MCP manifest (${response.status} ${response.statusText})`);
     }
     const payload = (await response.json());
-    const protocol = isRecord(payload) && isRecord(payload.protocol)
-        ? payload.protocol
+    const payloadRecord = isRecord(payload) ? payload : undefined;
+    const protocol = payloadRecord && isRecord(payloadRecord.protocol)
+        ? payloadRecord.protocol
         : undefined;
     const endpoint = nonEmptyString(protocol?.endpoint);
     if (!endpoint) {
         throw new Error("EvalOps MCP manifest did not include protocol.endpoint");
     }
-    return { endpoint: normalizeMcpEndpoint(endpoint), manifestUrl };
+    const identity = payloadRecord?.identity;
+    const identityBaseUrl = nonEmptyString(isRecord(identity) ? identity.base_url : undefined) ??
+        nonEmptyString(isRecord(identity) ? identity.baseUrl : undefined) ??
+        nonEmptyString(isRecord(identity) ? identity.url : undefined) ??
+        nonEmptyString(payloadRecord?.identity_base_url) ??
+        nonEmptyString(payloadRecord?.identityBaseUrl);
+    return {
+        endpoint: normalizeMcpEndpoint(endpoint),
+        identityBaseUrl,
+        manifestUrl,
+        preferDerivedIdentity: true,
+    };
 }
 async function resolveAgentMcpEndpoint(options, deps) {
     if (options.mcpUrl) {
-        return { endpoint: normalizeMcpEndpoint(options.mcpUrl) };
+        return {
+            endpoint: normalizeMcpEndpoint(options.mcpUrl),
+            preferDerivedIdentity: true,
+        };
     }
     if (options.manifestUrl) {
         return resolveEndpointFromManifest(normalizeManifestUrl(options.manifestUrl), deps.fetch);
@@ -126,7 +191,10 @@ async function resolveAgentMcpEndpoint(options, deps) {
         "MAESTRO_EVALOPS_AGENT_MCP_URL",
     ]);
     if (configuredMcpUrl) {
-        return { endpoint: normalizeMcpEndpoint(configuredMcpUrl) };
+        return {
+            endpoint: normalizeMcpEndpoint(configuredMcpUrl),
+            preferDerivedIdentity: true,
+        };
     }
     const configuredManifestUrl = getEnvValue([
         "MAESTRO_PLATFORM_MCP_MANIFEST_URL",
@@ -171,19 +239,12 @@ function createDefaultMcpClient(endpoint, bearerToken) {
         connect: () => client.connect(transport),
     };
 }
-async function callMcpTool(createClient, endpoint, token, toolName, args) {
-    const client = createClient(endpoint, token);
-    await client.connect();
-    try {
-        const result = await client.callTool(toolName, args);
-        if (result.isError) {
-            throw new Error(`${toolName} returned an MCP error`);
-        }
-        return parseToolOutput(toolName, result);
-    }
-    finally {
-        await client.close().catch(() => undefined);
+async function callConnectedMcpTool(client, toolName, args) {
+    const result = await client.callTool(toolName, args);
+    if (result.isError) {
+        throw new Error(`${toolName} returned an MCP error`);
     }
+    return parseToolOutput(toolName, result);
 }
 function parseToolOutput(toolName, result) {
     const structuredContent = isRecord(result.structuredContent)
@@ -238,27 +299,55 @@ function buildKeyName(options, now) {
         .slice(0, 48);
     return `maestro-init-${host || "local"}-${now.toISOString().slice(0, 10)}`;
 }
-async function createAgentAPIKey(options, endpoint, oauthToken, createClient, now) {
-    const output = await callMcpTool(createClient, endpoint, "", "evalops_create_api_key", {
-        name: buildKeyName(options, now),
-        scopes: options.apiKeyScopes ?? DEFAULT_API_KEY_SCOPES,
-        user_token: oauthToken,
-        ...(positiveInteger(options.expiresInDays)
-            ? { expires_in_days: options.expiresInDays }
-            : {}),
+async function createAgentAPIKey(options, identityBaseUrl, oauthToken, fetchImpl, now) {
+    const expiresInDays = positiveInteger(options.expiresInDays);
+    const expiresAt = expiresInDays
+        ? new Date(now.getTime() + expiresInDays * 24 * 60 * 60 * 1000).toISOString()
+        : undefined;
+    const response = await fetchImpl(`${identityBaseUrl}${PLATFORM_HTTP_ROUTES.identity.apiKeys}`, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${oauthToken}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({
+            name: buildKeyName(options, now),
+            scopes: options.apiKeyScopes ?? DEFAULT_API_KEY_SCOPES,
+            ...(expiresAt ? { expires_at: expiresAt } : {}),
+        }),
     });
-    if (!nonEmptyString(output.api_key)) {
+    const output = (await response
+        .json()
+        .catch(() => ({})));
+    if (!response.ok) {
+        throw new Error(typeof output.error === "string" && output.error.trim()
+            ? output.error
+            : `EvalOps API key creation failed (${response.status})`);
+    }
+    const key = isRecord(output.key) ? output.key : undefined;
+    const normalized = {
+        api_key: nonEmptyString(output.api_key) ?? "",
+        expires_at: nonEmptyString(output.expires_at) ?? nonEmptyString(key?.expires_at),
+        key_id: nonEmptyString(output.key_id) ?? nonEmptyString(key?.id),
+        name: nonEmptyString(output.name) ?? nonEmptyString(key?.name),
+        prefix: nonEmptyString(output.prefix) ?? nonEmptyString(key?.prefix),
+        scopes: stringArray(output.scopes) ??
+            stringArray(key?.scopes) ??
+            stringArray(output.scopes_granted),
+    };
+    if (!nonEmptyString(normalized.api_key)) {
         throw new Error("EvalOps API key creation did not return api_key");
     }
-    return output;
+    return normalized;
 }
-async function registerAgent(options, endpoint, apiKey, createClient) {
-    const output = await callMcpTool(createClient, endpoint, "", "evalops_register", {
+async function registerAgent(options, client) {
+    const output = await callConnectedMcpTool(client, "evalops_register", {
         agent_type: options.agentType ?? DEFAULT_AGENT_TYPE,
         capabilities: ["maestro:init", "maestro:cli"],
-        scopes: options.registerScopes ?? DEFAULT_REGISTER_SCOPES,
+        ...(options.registerScopes?.length
+            ? { scopes: options.registerScopes }
+            : {}),
         surface: options.surface ?? DEFAULT_SURFACE,
-        user_token: apiKey,
         ...(positiveInteger(options.ttlSeconds)
             ? { ttl_seconds: options.ttlSeconds }
             : {}),
@@ -269,10 +358,91 @@ async function registerAgent(options, endpoint, apiKey, createClient) {
     }
     return output;
 }
+async function runGovernedInferenceCheck(client) {
+    return callConnectedMcpTool(client, "evalops_check_action", {
+        action_type: "llm_gateway.invoke",
+        action_payload: "maestro init first governed inference check",
+        declared_risk_level: "low",
+    });
+}
+async function loadControlPlaneSummary(client) {
+    return callConnectedMcpTool(client, "evalops_control_plane_summary", {});
+}
 function organizationIdFromCredentials(credentials) {
     return (nonEmptyString(credentials?.metadata?.organizationId) ??
         nonEmptyString(credentials?.metadata?.organization_id));
 }
+function authenticatedAsFromCredentials(credentials) {
+    const metadata = credentials?.metadata;
+    const user = isRecord(metadata?.user) ? metadata.user : undefined;
+    return (nonEmptyString(metadata?.email) ??
+        nonEmptyString(metadata?.preferred_username) ??
+        nonEmptyString(metadata?.preferredUsername) ??
+        nonEmptyString(metadata?.user) ??
+        nonEmptyString(user?.email) ??
+        nonEmptyString(user?.name));
+}
+function consoleUrlFromEndpoint(endpoint) {
+    const parsed = new URL(endpoint);
+    parsed.pathname = "/overview";
+    parsed.search = "";
+    parsed.hash = "";
+    const env = parsed.hostname === "app.evalops.dev"
+        ? "production"
+        : parsed.hostname === "staging.evalops.dev"
+            ? "staging"
+            : "local";
+    parsed.searchParams.set("env", env);
+    return parsed.toString();
+}
+function countHighRiskFindings(summary) {
+    const findings = Array.isArray(summary.findings) ? summary.findings : [];
+    const findingCount = findings.filter((finding) => {
+        const record = isRecord(finding) ? finding : undefined;
+        const severity = nonEmptyString(record?.severity)?.toLowerCase();
+        return severity === "critical" || severity === "high";
+    }).length;
+    const metricCount = summary.metrics?.high_risk_tools;
+    if (typeof metricCount === "number" && Number.isFinite(metricCount)) {
+        return Math.max(findingCount, Math.max(0, Math.trunc(metricCount)));
+    }
+    return findingCount;
+}
+function hasPolicyControl(summary) {
+    const approvalRequired = summary.metrics?.approval_required_tools ?? 0;
+    if (approvalRequired > 0) {
+        return true;
+    }
+    const controls = Array.isArray(summary.policy_controls)
+        ? summary.policy_controls
+        : [];
+    return controls.some((control) => {
+        const record = isRecord(control) ? control : undefined;
+        return /approval|policy|starter/i.test([
+            nonEmptyString(record?.label),
+            nonEmptyString(record?.value),
+            nonEmptyString(record?.detail),
+        ]
+            .filter(Boolean)
+            .join(" "));
+    });
+}
+function hasTraceEvidence(summary) {
+    const evidence = Array.isArray(summary.evidence) ? summary.evidence : [];
+    return evidence.some((entry) => {
+        const record = isRecord(entry) ? entry : undefined;
+        return Boolean(nonEmptyString(record?.trace) ??
+            nonEmptyString(record?.trace_id) ??
+            nonEmptyString(record?.traceId));
+    });
+}
+function governedActionCount(summary) {
+    const metricTotal = summary.metrics?.total_tools;
+    if (typeof metricTotal === "number" && Number.isFinite(metricTotal)) {
+        return Math.max(0, Math.trunc(metricTotal));
+    }
+    return Array.isArray(summary.tools) ? summary.tools.length : 0;
+}
 function saveBootstrapMetadata(credentials, agentMcp, saveCredentials) {
     saveCredentials("evalops", {
         ...credentials,
@@ -305,13 +475,14 @@ export async function bootstrapEvalOpsAgent(options = {}, dependencies = {}) {
     const endpoint = await resolveAgentMcpEndpoint(options, deps);
     const credentialsBeforeKey = deps.loadCredentials("evalops");
     const stored = getStoredAgentMcpMetadata(credentialsBeforeKey);
+    const identityBaseUrl = resolveIdentityBaseUrl(credentialsBeforeKey, endpoint);
     const now = deps.now();
     let apiKey = stored && !options.rotateKey ? stored.apiKey : undefined;
     let keyOutput;
     let apiKeyCreated = false;
     if (!apiKey) {
         deps.onStatus({ message: "Creating EvalOps agent API key" });
-        keyOutput = await createAgentAPIKey(options, endpoint.endpoint, oauthToken, deps.createMcpClient, now);
+        keyOutput = await createAgentAPIKey(options, identityBaseUrl, oauthToken, deps.fetch, now);
         apiKey = keyOutput.api_key;
         apiKeyCreated = true;
     }
@@ -320,8 +491,21 @@ export async function bootstrapEvalOpsAgent(options = {}, dependencies = {}) {
     }
     deps.onStatus({ message: "Registering Maestro with EvalOps agent MCP" });
     let registerOutput;
+    let client;
+    const openAndRegister = async (token) => {
+        const mcpClient = deps.createMcpClient(endpoint.endpoint, token);
+        await mcpClient.connect();
+        try {
+            const output = await registerAgent(options, mcpClient);
+            return { client: mcpClient, registerOutput: output };
+        }
+        catch (error) {
+            await mcpClient.close().catch(() => undefined);
+            throw error;
+        }
+    };
     try {
-        registerOutput = await registerAgent(options, endpoint.endpoint, apiKey, deps.createMcpClient);
+        ({ client, registerOutput } = await openAndRegister(apiKey));
     }
     catch (error) {
         if (apiKeyCreated) {
@@ -330,10 +514,35 @@ export async function bootstrapEvalOpsAgent(options = {}, dependencies = {}) {
         deps.onStatus({
             message: "Stored EvalOps agent API key failed; rotating and retrying",
         });
-        keyOutput = await createAgentAPIKey({ ...options, rotateKey: true }, endpoint.endpoint, oauthToken, deps.createMcpClient, now);
+        keyOutput = await createAgentAPIKey({ ...options, rotateKey: true }, identityBaseUrl, oauthToken, deps.fetch, now);
         apiKey = keyOutput.api_key;
         apiKeyCreated = true;
-        registerOutput = await registerAgent(options, endpoint.endpoint, apiKey, deps.createMcpClient);
+        ({ client, registerOutput } = await openAndRegister(apiKey));
+    }
+    let governedInferenceCheck = {};
+    let controlPlaneSummary = {};
+    try {
+        deps.onStatus({ message: "Running first governed inference check" });
+        governedInferenceCheck = await runGovernedInferenceCheck(client);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        deps.onStatus({
+            message: `EvalOps governed inference check unavailable; continuing bootstrap (${reason})`,
+        });
+    }
+    try {
+        deps.onStatus({ message: "Loading EvalOps control-plane proof" });
+        controlPlaneSummary = await loadControlPlaneSummary(client);
+    }
+    catch (error) {
+        const reason = error instanceof Error ? error.message : String(error);
+        deps.onStatus({
+            message: `EvalOps control-plane proof unavailable; continuing bootstrap (${reason})`,
+        });
+    }
+    finally {
+        await client.close().catch(() => undefined);
     }
     const credentials = deps.loadCredentials("evalops");
     if (!credentials) {
@@ -366,15 +575,24 @@ export async function bootstrapEvalOpsAgent(options = {}, dependencies = {}) {
     return {
         agentId: registerOutput.agent_id,
         apiKeyCreated,
+        approvalPolicyAttached: hasPolicyControl(controlPlaneSummary),
+        authenticatedAs: authenticatedAsFromCredentials(credentials),
+        consoleUrl: consoleUrlFromEndpoint(endpoint.endpoint),
         endpoint: endpoint.endpoint,
+        evidenceEventPublished: (controlPlaneSummary.evidence ?? []).length > 0,
+        evidenceEvents: (controlPlaneSummary.evidence ?? []).length,
+        governedActionsLoaded: governedActionCount(controlPlaneSummary),
+        governedInferenceCheckRan: Boolean(governedInferenceCheck.decision),
         keyPrefix,
         manifestUrl: endpoint.manifestUrl,
         organizationId: organizationIdFromCredentials(credentials),
         registryVisible: registerOutput.registry_visible,
+        riskFindings: countHighRiskFindings(controlPlaneSummary),
         runId: registerOutput.run_id,
         scopesGranted: registerOutput.scopes_granted,
         sessionExpiresAt: registerOutput.expires_at,
         stored: true,
+        traceIngestionStarted: hasTraceEvidence(controlPlaneSummary),
     };
 }
 //# sourceMappingURL=agent-bootstrap.js.map