@evalops/maestro 0.10.23 → 0.10.24

package/dist/app-server/plugin-bundle-api.js

@@ -0,0 +1,219 @@
+import { dirname, resolve } from "node:path";
+import { addConfiguredPackageSpecToConfig, getWritablePackageConfigPath, loadConfiguredPackageSpecs, removeConfiguredPackageSpecFromConfig, } from "../config/toml-config.js";
+import { parsePackageSpec } from "../packages/loader.js";
+import { loadConfiguredPackageResources } from "../packages/runtime.js";
+import { formatPackageSource, parsePackageSource, } from "../packages/sources.js";
+export class MaestroAppServerPluginBundleError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MaestroAppServerPluginBundleError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function stringValue(value) {
+    return typeof value === "string" && value.trim() ? value.trim() : undefined;
+}
+function booleanValue(value, fallback) {
+    return typeof value === "boolean" ? value : fallback;
+}
+function paramsRecord(params) {
+    if (params === undefined) {
+        return {};
+    }
+    if (isRecord(params)) {
+        return params;
+    }
+    throw new MaestroAppServerPluginBundleError(-32602, "Invalid params");
+}
+function projectRootFromParams(params, options) {
+    return resolve(stringValue(params.projectRoot) ?? options.projectRoot ?? process.cwd());
+}
+function scopeFromParams(params) {
+    const scope = stringValue(params.scope);
+    if (scope === "project" || scope === "local" || scope === "user") {
+        return scope;
+    }
+    if (scope !== undefined) {
+        throw new MaestroAppServerPluginBundleError(-32602, "Invalid plugin bundle scope");
+    }
+    return "local";
+}
+function packageSpecFromParams(params) {
+    const spec = params.spec ?? params.source;
+    if (typeof spec === "string" && spec.trim()) {
+        return spec.trim();
+    }
+    if (isRecord(spec) && typeof spec.source === "string" && spec.source.trim()) {
+        return spec;
+    }
+    throw new MaestroAppServerPluginBundleError(-32602, "Plugin bundle requires source or spec");
+}
+function sourceString(spec) {
+    return typeof spec === "string" ? spec : spec.source;
+}
+function resolvePackageSpecIdentity(spec, cwd) {
+    const [sourceSpec] = parsePackageSpec(spec, cwd);
+    return formatPackageSource(parsePackageSource(sourceSpec, cwd));
+}
+function tryResolvePackageSourceIdentity(sourceSpec, cwd) {
+    try {
+        return formatPackageSource(parsePackageSource(sourceSpec, cwd));
+    }
+    catch {
+        return null;
+    }
+}
+function configuredPackageMatches(entry, requestedSpec, requestedCwd) {
+    const [rawSourceSpec] = parsePackageSpec(entry.spec, entry.cwd);
+    if (rawSourceSpec === requestedSpec) {
+        return true;
+    }
+    const requestedIdentity = tryResolvePackageSourceIdentity(requestedSpec, requestedCwd);
+    if (!requestedIdentity) {
+        return false;
+    }
+    return (resolvePackageSpecIdentity(entry.spec, entry.cwd) === requestedIdentity);
+}
+function validateBundleInstall(projectRoot, scope, spec) {
+    const configPath = getWritablePackageConfigPath(scope, projectRoot);
+    const configDir = dirname(configPath);
+    const requestedIdentity = resolvePackageSpecIdentity(spec, projectRoot);
+    const duplicate = loadConfiguredPackageSpecs(projectRoot).find((entry) => entry.configPath === configPath &&
+        resolvePackageSpecIdentity(entry.spec, configDir) === requestedIdentity);
+    if (duplicate) {
+        const [sourceSpec] = parsePackageSpec(duplicate.spec, configDir);
+        throw new MaestroAppServerPluginBundleError(-32602, `Package "${sourceSpec}" already exists in ${configPath}.`);
+    }
+    return { configPath };
+}
+function resolveBundleRemoval(projectRoot, spec, scope) {
+    const requestedSpec = sourceString(spec);
+    const matches = loadConfiguredPackageSpecs(projectRoot).filter((entry) => (scope === undefined || entry.scope === scope) &&
+        configuredPackageMatches(entry, requestedSpec, projectRoot));
+    const orderedScopes = scope === undefined ? ["local", "project", "user"] : [scope];
+    for (const candidateScope of orderedScopes) {
+        const match = matches.find((entry) => entry.scope === candidateScope);
+        if (match) {
+            return { configPath: match.configPath, scope: match.scope };
+        }
+    }
+    const scopeMessage = scope === undefined ? "" : ` in ${scope} config`;
+    throw new MaestroAppServerPluginBundleError(-32602, `Configured package "${requestedSpec}" was not found${scopeMessage}.`);
+}
+function toBundleScope(scope) {
+    return scope;
+}
+function pluginBundleErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+function toPluginBundleInvalidParams(error) {
+    if (error instanceof MaestroAppServerPluginBundleError) {
+        return error;
+    }
+    return new MaestroAppServerPluginBundleError(-32602, pluginBundleErrorMessage(error));
+}
+export function createMaestroAppServerPluginBundleApi(options = {}) {
+    return {
+        async listBundles(params = {}) {
+            const normalizedParams = paramsRecord(params);
+            const projectRoot = projectRootFromParams(normalizedParams, options);
+            const resources = loadConfiguredPackageResources(projectRoot);
+            return {
+                bundles: loadConfiguredPackageSpecs(projectRoot).map((entry) => ({
+                    source: sourceString(entry.spec),
+                    scope: toBundleScope(entry.scope),
+                    configPath: entry.configPath,
+                })),
+                resources: {
+                    extensions: resources.extensions,
+                    skills: resources.skills,
+                    prompts: resources.prompts,
+                    themes: resources.themes,
+                },
+                errors: resources.errors,
+            };
+        },
+        async installBundle(params = {}) {
+            const normalizedParams = paramsRecord(params);
+            const projectRoot = projectRootFromParams(normalizedParams, options);
+            const spec = packageSpecFromParams(normalizedParams);
+            const source = sourceString(spec);
+            const scope = scopeFromParams(normalizedParams);
+            let validation;
+            try {
+                validation = validateBundleInstall(projectRoot, scope, spec);
+            }
+            catch (error) {
+                throw toPluginBundleInvalidParams(error);
+            }
+            const { configPath } = validation;
+            if (booleanValue(normalizedParams.dryRun, false)) {
+                return {
+                    source,
+                    scope,
+                    configPath,
+                    changed: false,
+                    message: "Plugin bundle install planned",
+                };
+            }
+            let result;
+            try {
+                result = addConfiguredPackageSpecToConfig({
+                    workspaceDir: projectRoot,
+                    scope,
+                    spec,
+                });
+            }
+            catch (error) {
+                throw toPluginBundleInvalidParams(error);
+            }
+            return {
+                source,
+                scope: result.scope,
+                configPath: result.path,
+                changed: true,
+                message: "Plugin bundle installed",
+            };
+        },
+        async removeBundle(params = {}) {
+            const normalizedParams = paramsRecord(params);
+            const projectRoot = projectRootFromParams(normalizedParams, options);
+            const spec = packageSpecFromParams(normalizedParams);
+            const scope = normalizedParams.scope === undefined
+                ? undefined
+                : scopeFromParams(normalizedParams);
+            const removal = resolveBundleRemoval(projectRoot, spec, scope);
+            if (booleanValue(normalizedParams.dryRun, false)) {
+                return {
+                    source: sourceString(spec),
+                    scope: removal.scope,
+                    configPath: removal.configPath,
+                    changed: false,
+                    message: "Plugin bundle removal planned",
+                };
+            }
+            let result;
+            try {
+                result = removeConfiguredPackageSpecFromConfig({
+                    workspaceDir: projectRoot,
+                    scope,
+                    spec: sourceString(spec),
+                });
+            }
+            catch (error) {
+                throw new MaestroAppServerPluginBundleError(-32602, pluginBundleErrorMessage(error));
+            }
+            return {
+                source: sourceString(spec),
+                scope: result.scope,
+                configPath: result.path,
+                changed: result.removedCount > 0,
+                message: `Removed ${result.removedCount} plugin bundle(s)`,
+            };
+        },
+    };
+}
+//# sourceMappingURL=plugin-bundle-api.js.map

package/dist/app-server/plugin-bundle-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"plugin-bundle-api.js","sourceRoot":"","sources":["../../src/app-server/plugin-bundle-api.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAM7C,OAAO,EAEN,gCAAgC,EAChC,4BAA4B,EAC5B,0BAA0B,EAC1B,qCAAqC,GACrC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AACzD,OAAO,EAAE,8BAA8B,EAAE,MAAM,wBAAwB,CAAC;AACxE,OAAO,EACN,mBAAmB,EACnB,kBAAkB,GAClB,MAAM,wBAAwB,CAAC;AAKhC,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAC3D,YACU,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IACjD,CAAC;CACD;AAkBD,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,QAAiB;IACtD,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACtD,CAAC;AAED,SAAS,YAAY,CAAC,MAAe;IACpC,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QACtB,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,iCAAiC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,qBAAqB,CAC7B,MAAqB,EACrB,OAA+C;IAE/C,OAAO,OAAO,CACb,WAAW,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,CACvE,CAAC;AACH,CAAC;AAED,SAAS,eAAe,CAAC,MAAqB;IAC7C,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;QAClE,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,IAAI,iCAAiC,CAC1C,CAAC,KAAK,EACN,6BAA6B,CAC7B,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,SAAS,qBAAqB,CAAC,MAAqB;IACnD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC;IAC1C,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7C,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC;IACpB,CAAC;IACD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QAC7E,OAAO,IAA8B,CAAC;IACvC,CAAC;IACD,MAAM,IAAI,iCAAiC,CAC1C,CAAC,KAAK,EACN,uCAAuC,CACvC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAiB;IACtC,OAAO,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;AACtD,CAAC;AAED,SAAS,0BAA0B,CAAC,IAAiB,EAAE,GAAW;IACjE,MAAM,CAAC,UAAU,CAAC,GAAG,gBAAgB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACjD,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,+BAA+B,CACvC,UAAkB,EAClB,GAAW;IAEX,IAAI,CAAC;QACJ,OAAO,mBAAmB,CAAC,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED,SAAS,wBAAwB,CAChC,KAA4D,EAC5D,aAAqB,EACrB,YAAoB;IAEpB,MAAM,CAAC,aAAa,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAChE,IAAI,aAAa,KAAK,aAAa,EAAE,CAAC;QACrC,OAAO,IAAI,CAAC;IACb,CAAC;IACD,MAAM,iBAAiB,GAAG,+BAA+B,CACxD,aAAa,EACb,YAAY,CACZ,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,CACN,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,KAAK,iBAAiB,CACvE,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC7B,WAAmB,EACnB,KAA2B,EAC3B,IAAiB;IAEjB,MAAM,UAAU,GAAG,4BAA4B,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;IACpE,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,iBAAiB,GAAG,0BAA0B,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC,IAAI,CAC7D,CAAC,KAAK,EAAE,EAAE,CACT,KAAK,CAAC,UAAU,KAAK,UAAU;QAC/B,0BAA0B,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,KAAK,iBAAiB,CACxE,CAAC;IACF,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,CAAC,UAAU,CAAC,GAAG,gBAAgB,CAAC,SAAS,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACjE,MAAM,IAAI,iCAAiC,CAC1C,CAAC,KAAK,EACN,YAAY,UAAU,uBAAuB,UAAU,GAAG,CAC1D,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,CAAC;AACvB,CAAC;AAED,SAAS,oBAAoB,CAC5B,WAAmB,EACnB,IAAiB,EACjB,KAA4B;IAE5B,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC,MAAM,CAC7D,CAAC,KAAK,EAAE,EAAE,CACT,CAAC,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC;QAC9C,wBAAwB,CAAC,KAAK,EAAE,aAAa,EAAE,WAAW,CAAC,CAC5D,CAAC;IACF,MAAM,aAAa,GAClB,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;IAC9D,KAAK,MAAM,cAAc,IAAI,aAAa,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,KAAK,KAAK,cAAc,CAAC,CAAC;QACtE,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;QAC7D,CAAC;IACF,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC;IACtE,MAAM,IAAI,iCAAiC,CAC1C,CAAC,KAAK,EACN,uBAAuB,aAAa,kBAAkB,YAAY,GAAG,CACrE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,KAA2B;IAE3B,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC/C,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,2BAA2B,CACnC,KAAc;IAEd,IAAI,KAAK,YAAY,iCAAiC,EAAE,CAAC;QACxD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,IAAI,iCAAiC,CAC3C,CAAC,KAAK,EACN,wBAAwB,CAAC,KAAK,CAAC,CAC/B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACpD,UAAkD,EAAE;IAEpD,OAAO;QACN,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE;YAC5B,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,SAAS,GAAG,8BAA8B,CAAC,WAAW,CAAC,CAAC;YAC9D,OAAO;gBACN,OAAO,EAAE,0BAA0B,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChE,MAAM,EAAE,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC;oBAChC,KAAK,EAAE,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC;oBACjC,UAAU,EAAE,KAAK,CAAC,UAAU;iBAC5B,CAAC,CAAC;gBACH,SAAS,EAAE;oBACV,UAAU,EAAE,SAAS,CAAC,UAAU;oBAChC,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,OAAO,EAAE,SAAS,CAAC,OAAO;oBAC1B,MAAM,EAAE,SAAS,CAAC,MAAM;iBACxB;gBACD,MAAM,EAAE,SAAS,CAAC,MAAM;aACxB,CAAC;QACH,CAAC;QAED,KAAK,CAAC,aAAa,CAAC,MAAM,GAAG,EAAE;YAC9B,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;YACrD,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,KAAK,GAAG,eAAe,CAAC,gBAAgB,CAAC,CAAC;YAChD,IAAI,UAAoD,CAAC;YACzD,IAAI,CAAC;gBACJ,UAAU,GAAG,qBAAqB,CAAC,WAAW,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;YAC9D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,MAAM,EAAE,UAAU,EAAE,GAAG,UAAU,CAAC;YAClC,IAAI,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACN,MAAM;oBACN,KAAK;oBACL,UAAU;oBACV,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,+BAA+B;iBACxC,CAAC;YACH,CAAC;YACD,IAAI,MAA2D,CAAC;YAChE,IAAI,CAAC;gBACJ,MAAM,GAAG,gCAAgC,CAAC;oBACzC,YAAY,EAAE,WAAW;oBACzB,KAAK;oBACL,IAAI;iBACJ,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,2BAA2B,CAAC,KAAK,CAAC,CAAC;YAC1C,CAAC;YACD,OAAO;gBACN,MAAM;gBACN,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,OAAO,EAAE,IAAI;gBACb,OAAO,EAAE,yBAAyB;aAClC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,YAAY,CAAC,MAAM,GAAG,EAAE;YAC7B,MAAM,gBAAgB,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;YAC9C,MAAM,WAAW,GAAG,qBAAqB,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;YACrE,MAAM,IAAI,GAAG,qBAAqB,CAAC,gBAAgB,CAAC,CAAC;YACrD,MAAM,KAAK,GACV,gBAAgB,CAAC,KAAK,KAAK,SAAS;gBACnC,CAAC,CAAC,SAAS;gBACX,CAAC,CAAC,eAAe,CAAC,gBAAgB,CAAC,CAAC;YACtC,MAAM,OAAO,GAAG,oBAAoB,CAAC,WAAW,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YAC/D,IAAI,YAAY,CAAC,gBAAgB,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClD,OAAO;oBACN,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;oBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;oBACpB,UAAU,EAAE,OAAO,CAAC,UAAU;oBAC9B,OAAO,EAAE,KAAK;oBACd,OAAO,EAAE,+BAA+B;iBACxC,CAAC;YACH,CAAC;YACD,IAAI,MAAgE,CAAC;YACrE,IAAI,CAAC;gBACJ,MAAM,GAAG,qCAAqC,CAAC;oBAC9C,YAAY,EAAE,WAAW;oBACzB,KAAK;oBACL,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;iBACxB,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,MAAM,IAAI,iCAAiC,CAC1C,CAAC,KAAK,EACN,wBAAwB,CAAC,KAAK,CAAC,CAC/B,CAAC;YACH,CAAC;YACD,OAAO;gBACN,MAAM,EAAE,YAAY,CAAC,IAAI,CAAC;gBAC1B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,UAAU,EAAE,MAAM,CAAC,IAAI;gBACvB,OAAO,EAAE,MAAM,CAAC,YAAY,GAAG,CAAC;gBAChC,OAAO,EAAE,WAAW,MAAM,CAAC,YAAY,mBAAmB;aAC1D,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import { dirname, resolve } from \"node:path\";\nimport type {\n\tMaestroAppServerPluginBundleListResult,\n\tMaestroAppServerPluginBundleMutationResult,\n\tMaestroAppServerPluginBundleScope,\n} from \"@evalops/contracts\";\nimport {\n\ttype WritablePackageScope,\n\taddConfiguredPackageSpecToConfig,\n\tgetWritablePackageConfigPath,\n\tloadConfiguredPackageSpecs,\n\tremoveConfiguredPackageSpecFromConfig,\n} from \"../config/toml-config.js\";\nimport { parsePackageSpec } from \"../packages/loader.js\";\nimport { loadConfiguredPackageResources } from \"../packages/runtime.js\";\nimport {\n\tformatPackageSource,\n\tparsePackageSource,\n} from \"../packages/sources.js\";\nimport type { PackageSpec } from \"../packages/types.js\";\n\ntype UnknownRecord = Record<string, unknown>;\n\nexport class MaestroAppServerPluginBundleError extends Error {\n\tconstructor(\n\t\treadonly code: number,\n\t\tmessage: string,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"MaestroAppServerPluginBundleError\";\n\t}\n}\n\nexport interface MaestroAppServerPluginBundleApi {\n\tlistBundles(\n\t\tparams?: UnknownRecord,\n\t): Promise<MaestroAppServerPluginBundleListResult>;\n\tinstallBundle(\n\t\tparams?: UnknownRecord,\n\t): Promise<MaestroAppServerPluginBundleMutationResult>;\n\tremoveBundle(\n\t\tparams?: UnknownRecord,\n\t): Promise<MaestroAppServerPluginBundleMutationResult>;\n}\n\nexport interface MaestroAppServerPluginBundleApiOptions {\n\tprojectRoot?: string;\n}\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction stringValue(value: unknown): string | undefined {\n\treturn typeof value === \"string\" && value.trim() ? value.trim() : undefined;\n}\n\nfunction booleanValue(value: unknown, fallback: boolean): boolean {\n\treturn typeof value === \"boolean\" ? value : fallback;\n}\n\nfunction paramsRecord(params: unknown): UnknownRecord {\n\tif (params === undefined) {\n\t\treturn {};\n\t}\n\tif (isRecord(params)) {\n\t\treturn params;\n\t}\n\tthrow new MaestroAppServerPluginBundleError(-32602, \"Invalid params\");\n}\n\nfunction projectRootFromParams(\n\tparams: UnknownRecord,\n\toptions: MaestroAppServerPluginBundleApiOptions,\n): string {\n\treturn resolve(\n\t\tstringValue(params.projectRoot) ?? options.projectRoot ?? process.cwd(),\n\t);\n}\n\nfunction scopeFromParams(params: UnknownRecord): WritablePackageScope {\n\tconst scope = stringValue(params.scope);\n\tif (scope === \"project\" || scope === \"local\" || scope === \"user\") {\n\t\treturn scope;\n\t}\n\tif (scope !== undefined) {\n\t\tthrow new MaestroAppServerPluginBundleError(\n\t\t\t-32602,\n\t\t\t\"Invalid plugin bundle scope\",\n\t\t);\n\t}\n\treturn \"local\";\n}\n\nfunction packageSpecFromParams(params: UnknownRecord): PackageSpec {\n\tconst spec = params.spec ?? params.source;\n\tif (typeof spec === \"string\" && spec.trim()) {\n\t\treturn spec.trim();\n\t}\n\tif (isRecord(spec) && typeof spec.source === \"string\" && spec.source.trim()) {\n\t\treturn spec as unknown as PackageSpec;\n\t}\n\tthrow new MaestroAppServerPluginBundleError(\n\t\t-32602,\n\t\t\"Plugin bundle requires source or spec\",\n\t);\n}\n\nfunction sourceString(spec: PackageSpec): string {\n\treturn typeof spec === \"string\" ? spec : spec.source;\n}\n\nfunction resolvePackageSpecIdentity(spec: PackageSpec, cwd: string): string {\n\tconst [sourceSpec] = parsePackageSpec(spec, cwd);\n\treturn formatPackageSource(parsePackageSource(sourceSpec, cwd));\n}\n\nfunction tryResolvePackageSourceIdentity(\n\tsourceSpec: string,\n\tcwd: string,\n): string | null {\n\ttry {\n\t\treturn formatPackageSource(parsePackageSource(sourceSpec, cwd));\n\t} catch {\n\t\treturn null;\n\t}\n}\n\nfunction configuredPackageMatches(\n\tentry: ReturnType<typeof loadConfiguredPackageSpecs>[number],\n\trequestedSpec: string,\n\trequestedCwd: string,\n): boolean {\n\tconst [rawSourceSpec] = parsePackageSpec(entry.spec, entry.cwd);\n\tif (rawSourceSpec === requestedSpec) {\n\t\treturn true;\n\t}\n\tconst requestedIdentity = tryResolvePackageSourceIdentity(\n\t\trequestedSpec,\n\t\trequestedCwd,\n\t);\n\tif (!requestedIdentity) {\n\t\treturn false;\n\t}\n\treturn (\n\t\tresolvePackageSpecIdentity(entry.spec, entry.cwd) === requestedIdentity\n\t);\n}\n\nfunction validateBundleInstall(\n\tprojectRoot: string,\n\tscope: WritablePackageScope,\n\tspec: PackageSpec,\n): { configPath: string } {\n\tconst configPath = getWritablePackageConfigPath(scope, projectRoot);\n\tconst configDir = dirname(configPath);\n\tconst requestedIdentity = resolvePackageSpecIdentity(spec, projectRoot);\n\tconst duplicate = loadConfiguredPackageSpecs(projectRoot).find(\n\t\t(entry) =>\n\t\t\tentry.configPath === configPath &&\n\t\t\tresolvePackageSpecIdentity(entry.spec, configDir) === requestedIdentity,\n\t);\n\tif (duplicate) {\n\t\tconst [sourceSpec] = parsePackageSpec(duplicate.spec, configDir);\n\t\tthrow new MaestroAppServerPluginBundleError(\n\t\t\t-32602,\n\t\t\t`Package \"${sourceSpec}\" already exists in ${configPath}.`,\n\t\t);\n\t}\n\treturn { configPath };\n}\n\nfunction resolveBundleRemoval(\n\tprojectRoot: string,\n\tspec: PackageSpec,\n\tscope?: WritablePackageScope,\n): { configPath: string; scope: WritablePackageScope } {\n\tconst requestedSpec = sourceString(spec);\n\tconst matches = loadConfiguredPackageSpecs(projectRoot).filter(\n\t\t(entry) =>\n\t\t\t(scope === undefined || entry.scope === scope) &&\n\t\t\tconfiguredPackageMatches(entry, requestedSpec, projectRoot),\n\t);\n\tconst orderedScopes: WritablePackageScope[] =\n\t\tscope === undefined ? [\"local\", \"project\", \"user\"] : [scope];\n\tfor (const candidateScope of orderedScopes) {\n\t\tconst match = matches.find((entry) => entry.scope === candidateScope);\n\t\tif (match) {\n\t\t\treturn { configPath: match.configPath, scope: match.scope };\n\t\t}\n\t}\n\tconst scopeMessage = scope === undefined ? \"\" : ` in ${scope} config`;\n\tthrow new MaestroAppServerPluginBundleError(\n\t\t-32602,\n\t\t`Configured package \"${requestedSpec}\" was not found${scopeMessage}.`,\n\t);\n}\n\nfunction toBundleScope(\n\tscope: WritablePackageScope,\n): MaestroAppServerPluginBundleScope {\n\treturn scope;\n}\n\nfunction pluginBundleErrorMessage(error: unknown): string {\n\treturn error instanceof Error ? error.message : String(error);\n}\n\nfunction toPluginBundleInvalidParams(\n\terror: unknown,\n): MaestroAppServerPluginBundleError {\n\tif (error instanceof MaestroAppServerPluginBundleError) {\n\t\treturn error;\n\t}\n\treturn new MaestroAppServerPluginBundleError(\n\t\t-32602,\n\t\tpluginBundleErrorMessage(error),\n\t);\n}\n\nexport function createMaestroAppServerPluginBundleApi(\n\toptions: MaestroAppServerPluginBundleApiOptions = {},\n): MaestroAppServerPluginBundleApi {\n\treturn {\n\t\tasync listBundles(params = {}) {\n\t\t\tconst normalizedParams = paramsRecord(params);\n\t\t\tconst projectRoot = projectRootFromParams(normalizedParams, options);\n\t\t\tconst resources = loadConfiguredPackageResources(projectRoot);\n\t\t\treturn {\n\t\t\t\tbundles: loadConfiguredPackageSpecs(projectRoot).map((entry) => ({\n\t\t\t\t\tsource: sourceString(entry.spec),\n\t\t\t\t\tscope: toBundleScope(entry.scope),\n\t\t\t\t\tconfigPath: entry.configPath,\n\t\t\t\t})),\n\t\t\t\tresources: {\n\t\t\t\t\textensions: resources.extensions,\n\t\t\t\t\tskills: resources.skills,\n\t\t\t\t\tprompts: resources.prompts,\n\t\t\t\t\tthemes: resources.themes,\n\t\t\t\t},\n\t\t\t\terrors: resources.errors,\n\t\t\t};\n\t\t},\n\n\t\tasync installBundle(params = {}) {\n\t\t\tconst normalizedParams = paramsRecord(params);\n\t\t\tconst projectRoot = projectRootFromParams(normalizedParams, options);\n\t\t\tconst spec = packageSpecFromParams(normalizedParams);\n\t\t\tconst source = sourceString(spec);\n\t\t\tconst scope = scopeFromParams(normalizedParams);\n\t\t\tlet validation: ReturnType<typeof validateBundleInstall>;\n\t\t\ttry {\n\t\t\t\tvalidation = validateBundleInstall(projectRoot, scope, spec);\n\t\t\t} catch (error) {\n\t\t\t\tthrow toPluginBundleInvalidParams(error);\n\t\t\t}\n\t\t\tconst { configPath } = validation;\n\t\t\tif (booleanValue(normalizedParams.dryRun, false)) {\n\t\t\t\treturn {\n\t\t\t\t\tsource,\n\t\t\t\t\tscope,\n\t\t\t\t\tconfigPath,\n\t\t\t\t\tchanged: false,\n\t\t\t\t\tmessage: \"Plugin bundle install planned\",\n\t\t\t\t};\n\t\t\t}\n\t\t\tlet result: ReturnType<typeof addConfiguredPackageSpecToConfig>;\n\t\t\ttry {\n\t\t\t\tresult = addConfiguredPackageSpecToConfig({\n\t\t\t\t\tworkspaceDir: projectRoot,\n\t\t\t\t\tscope,\n\t\t\t\t\tspec,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tthrow toPluginBundleInvalidParams(error);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsource,\n\t\t\t\tscope: result.scope,\n\t\t\t\tconfigPath: result.path,\n\t\t\t\tchanged: true,\n\t\t\t\tmessage: \"Plugin bundle installed\",\n\t\t\t};\n\t\t},\n\n\t\tasync removeBundle(params = {}) {\n\t\t\tconst normalizedParams = paramsRecord(params);\n\t\t\tconst projectRoot = projectRootFromParams(normalizedParams, options);\n\t\t\tconst spec = packageSpecFromParams(normalizedParams);\n\t\t\tconst scope =\n\t\t\t\tnormalizedParams.scope === undefined\n\t\t\t\t\t? undefined\n\t\t\t\t\t: scopeFromParams(normalizedParams);\n\t\t\tconst removal = resolveBundleRemoval(projectRoot, spec, scope);\n\t\t\tif (booleanValue(normalizedParams.dryRun, false)) {\n\t\t\t\treturn {\n\t\t\t\t\tsource: sourceString(spec),\n\t\t\t\t\tscope: removal.scope,\n\t\t\t\t\tconfigPath: removal.configPath,\n\t\t\t\t\tchanged: false,\n\t\t\t\t\tmessage: \"Plugin bundle removal planned\",\n\t\t\t\t};\n\t\t\t}\n\t\t\tlet result: ReturnType<typeof removeConfiguredPackageSpecFromConfig>;\n\t\t\ttry {\n\t\t\t\tresult = removeConfiguredPackageSpecFromConfig({\n\t\t\t\t\tworkspaceDir: projectRoot,\n\t\t\t\t\tscope,\n\t\t\t\t\tspec: sourceString(spec),\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tthrow new MaestroAppServerPluginBundleError(\n\t\t\t\t\t-32602,\n\t\t\t\t\tpluginBundleErrorMessage(error),\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tsource: sourceString(spec),\n\t\t\t\tscope: result.scope,\n\t\t\t\tconfigPath: result.path,\n\t\t\t\tchanged: result.removedCount > 0,\n\t\t\t\tmessage: `Removed ${result.removedCount} plugin bundle(s)`,\n\t\t\t};\n\t\t},\n\t};\n}\n"]}

package/dist/app-server/policy-control-api.d.ts

@@ -0,0 +1,14 @@
+import type { MaestroAppServerPolicyCheckResult, MaestroAppServerPolicyReadResult, MaestroAppServerRequirementsListResult } from "@evalops/contracts";
+type UnknownRecord = Record<string, unknown>;
+export declare class MaestroAppServerPolicyControlError extends Error {
+    readonly code: number;
+    constructor(code: number, message: string);
+}
+export interface MaestroAppServerPolicyControl {
+    readPolicy(): MaestroAppServerPolicyReadResult;
+    checkPolicy(params?: UnknownRecord): Promise<MaestroAppServerPolicyCheckResult>;
+    listRequirements(): MaestroAppServerRequirementsListResult;
+}
+export declare function createMaestroAppServerPolicyControl(): MaestroAppServerPolicyControl;
+export {};
+//# sourceMappingURL=policy-control-api.d.ts.map

package/dist/app-server/policy-control-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-control-api.d.ts","sourceRoot":"","sources":["../../src/app-server/policy-control-api.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAEX,iCAAiC,EACjC,gCAAgC,EAChC,sCAAsC,EACtC,MAAM,oBAAoB,CAAC;AAU5B,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAE7C,qBAAa,kCAAmC,SAAQ,KAAK;IAE3D,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,WAAW,6BAA6B;IAC7C,UAAU,IAAI,gCAAgC,CAAC;IAC/C,WAAW,CACV,MAAM,CAAC,EAAE,aAAa,GACpB,OAAO,CAAC,iCAAiC,CAAC,CAAC;IAC9C,gBAAgB,IAAI,sCAAsC,CAAC;CAC3D;AA2KD,wBAAgB,mCAAmC,IAAI,6BAA6B,CA+EnF"}

package/dist/app-server/policy-control-api.js

@@ -0,0 +1,200 @@
+import { checkModelPolicy, checkPolicy, checkSessionLimits, loadPolicy, } from "../safety/policy.js";
+export class MaestroAppServerPolicyControlError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MaestroAppServerPolicyControlError";
+    }
+}
+function readCurrentPolicy() {
+    try {
+        return loadPolicy();
+    }
+    catch (error) {
+        throw new MaestroAppServerPolicyControlError(-32000, `Failed to load managed policy: ${error instanceof Error ? error.message : "unknown error"}`);
+    }
+}
+function deepFreezeSnapshot(value) {
+    if (typeof value !== "object" || value === null) {
+        return value;
+    }
+    for (const key of Object.getOwnPropertyNames(value)) {
+        deepFreezeSnapshot(value[key]);
+    }
+    return Object.freeze(value);
+}
+function clonePolicySnapshot(policy) {
+    if (policy === null) {
+        return null;
+    }
+    return deepFreezeSnapshot(structuredClone(policy));
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function hasOwnKey(value, key) {
+    return Object.prototype.hasOwnProperty.call(value, key);
+}
+function optionalNonEmptyString(value, field) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (typeof value !== "string" || value.trim().length === 0) {
+        throw new MaestroAppServerPolicyControlError(-32602, `Invalid ${field}`);
+    }
+    return value.trim();
+}
+function parseUser(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (!isRecord(value)) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid user");
+    }
+    const id = optionalNonEmptyString(value.id, "user.id");
+    const orgId = optionalNonEmptyString(value.orgId, "user.orgId");
+    if (!id || !orgId) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid user");
+    }
+    return { id, orgId };
+}
+function parseSession(value, requireId) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (!isRecord(value)) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid session");
+    }
+    const id = optionalNonEmptyString(value.id, "session.id");
+    if (requireId && !id) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid session.id");
+    }
+    if (value.startedAt === undefined || value.startedAt === null) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid session.startedAt");
+    }
+    const startedAt = value.startedAt instanceof Date
+        ? new Date(value.startedAt.getTime())
+        : new Date(optionalNonEmptyString(value.startedAt, "session.startedAt") ?? "");
+    if (!Number.isFinite(startedAt.getTime())) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid session.startedAt");
+    }
+    return { id: id ?? "app-server-policy-check", startedAt };
+}
+function parseActionContext(value, fallbackSession) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (!isRecord(value)) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid action");
+    }
+    const toolName = optionalNonEmptyString(value.toolName, "action.toolName");
+    if (!toolName) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid action.toolName");
+    }
+    const actionSession = value.session === undefined || value.session === null
+        ? fallbackSession
+        : parseSession(value.session, false);
+    return {
+        toolName,
+        args: hasOwnKey(value, "args") ? value.args : {},
+        metadata: isRecord(value.metadata)
+            ? value.metadata
+            : undefined,
+        user: parseUser(value.user),
+        session: actionSession,
+        userIntent: optionalNonEmptyString(value.userIntent, "action.userIntent"),
+    };
+}
+function parseUsage(value) {
+    if (value === undefined || value === null) {
+        return undefined;
+    }
+    if (!isRecord(value)) {
+        throw new MaestroAppServerPolicyControlError(-32602, "Invalid usage");
+    }
+    const usage = {};
+    for (const key of ["tokenCount", "activeSessionCount"]) {
+        if (value[key] === undefined || value[key] === null) {
+            continue;
+        }
+        if (typeof value[key] !== "number" ||
+            !Number.isFinite(value[key]) ||
+            value[key] < 0) {
+            throw new MaestroAppServerPolicyControlError(-32602, `Invalid usage.${key}`);
+        }
+        usage[key] = value[key];
+    }
+    return usage;
+}
+function firstReason(checks) {
+    return checks.find((check) => !check.allowed)?.reason;
+}
+export function createMaestroAppServerPolicyControl() {
+    return {
+        readPolicy() {
+            const policy = readCurrentPolicy();
+            return {
+                loaded: policy !== null,
+                policy: clonePolicySnapshot(policy),
+            };
+        },
+        async checkPolicy(params = {}) {
+            if (!isRecord(params)) {
+                throw new MaestroAppServerPolicyControlError(-32602, "Invalid params");
+            }
+            const checks = [];
+            const session = parseSession(params.session, false);
+            const action = parseActionContext(params.action, session);
+            const sessionForLimits = action?.session ?? session;
+            if (action) {
+                const result = await checkPolicy(action);
+                checks.push({
+                    kind: "action",
+                    allowed: result.allowed,
+                    ...(result.reason ? { reason: result.reason } : {}),
+                });
+            }
+            const modelId = optionalNonEmptyString(params.modelId, "modelId");
+            if (modelId) {
+                const result = checkModelPolicy(modelId);
+                checks.push({
+                    kind: "model",
+                    allowed: result.allowed,
+                    ...(result.reason ? { reason: result.reason } : {}),
+                });
+            }
+            if (sessionForLimits) {
+                const result = checkSessionLimits(sessionForLimits, parseUsage(params.usage));
+                checks.push({
+                    kind: "session",
+                    allowed: result.allowed,
+                    ...(result.reason ? { reason: result.reason } : {}),
+                });
+            }
+            if (checks.length === 0) {
+                throw new MaestroAppServerPolicyControlError(-32602, "Missing policy check target");
+            }
+            const reason = firstReason(checks);
+            return {
+                allowed: checks.every((check) => check.allowed),
+                ...(reason ? { reason } : {}),
+                checks,
+            };
+        },
+        listRequirements() {
+            const policy = readCurrentPolicy();
+            const requiredSkills = deepFreezeSnapshot([
+                ...(policy?.skills?.required ?? []),
+            ]);
+            return {
+                requirements: requiredSkills.map((id) => ({
+                    kind: "skill",
+                    id,
+                    required: true,
+                })),
+                requiredSkills,
+            };
+        },
+    };
+}
+//# sourceMappingURL=policy-control-api.js.map

package/dist/app-server/policy-control-api.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy-control-api.js","sourceRoot":"","sources":["../../src/app-server/policy-control-api.ts"],"names":[],"mappings":"AAOA,OAAO,EAEN,gBAAgB,EAChB,WAAW,EACX,kBAAkB,EAClB,UAAU,GACV,MAAM,qBAAqB,CAAC;AAI7B,MAAM,OAAO,kCAAmC,SAAQ,KAAK;IAC5D,YACU,IAAY,EACrB,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAHN,SAAI,GAAJ,IAAI,CAAQ;QAIrB,IAAI,CAAC,IAAI,GAAG,oCAAoC,CAAC;IAClD,CAAC;CACD;AAUD,SAAS,iBAAiB;IACzB,IAAI,CAAC;QACJ,OAAO,UAAU,EAAE,CAAC;IACrB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,kCAAkC,CAC3C,CAAC,KAAK,EACN,kCAAkC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,EAAE,CAC5F,CAAC;IACH,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAAI,KAAQ;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACjD,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QACrD,kBAAkB,CAAE,KAAiC,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7D,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAA+B;IAE/B,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,OAAO,kBAAkB,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAgB;IACjD,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;AACzD,CAAC;AAED,SAAS,sBAAsB,CAC9B,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5D,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,WAAW,KAAK,EAAE,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACrB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAChC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;IAChE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACtE,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AACtB,CAAC;AAED,SAAS,YAAY,CACpB,KAAc,EACd,SAAkB;IAElB,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,iBAAiB,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,EAAE,GAAG,sBAAsB,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC1D,IAAI,SAAS,IAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,oBAAoB,CAAC,CAAC;IAC5E,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI,EAAE,CAAC;QAC/D,MAAM,IAAI,kCAAkC,CAC3C,CAAC,KAAK,EACN,2BAA2B,CAC3B,CAAC;IACH,CAAC;IACD,MAAM,SAAS,GACd,KAAK,CAAC,SAAS,YAAY,IAAI;QAC9B,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC;QACrC,CAAC,CAAC,IAAI,IAAI,CACR,sBAAsB,CAAC,KAAK,CAAC,SAAS,EAAE,mBAAmB,CAAC,IAAI,EAAE,CAClE,CAAC;IACL,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC;QAC3C,MAAM,IAAI,kCAAkC,CAC3C,CAAC,KAAK,EACN,2BAA2B,CAC3B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,EAAE,IAAI,yBAAyB,EAAE,SAAS,EAAE,CAAC;AAC3D,CAAC;AAED,SAAS,kBAAkB,CAC1B,KAAc,EACd,eAAkD;IAElD,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;IACxE,CAAC;IACD,MAAM,QAAQ,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,iBAAiB,CAAC,CAAC;IAC3E,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,IAAI,kCAAkC,CAC3C,CAAC,KAAK,EACN,yBAAyB,CACzB,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAClB,KAAK,CAAC,OAAO,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,IAAI;QACpD,CAAC,CAAC,eAAe;QACjB,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACvC,OAAO;QACN,QAAQ;QACR,IAAI,EAAE,SAAS,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;QAChD,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC;YACjC,CAAC,CAAE,KAAK,CAAC,QAA8C;YACvD,CAAC,CAAC,SAAS;QACZ,IAAI,EAAE,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC;QAC3B,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,sBAAsB,CAAC,KAAK,CAAC,UAAU,EAAE,mBAAmB,CAAC;KACzE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAClB,KAAc;IAEd,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAC3C,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,eAAe,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,KAAK,GAAyD,EAAE,CAAC;IACvE,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,oBAAoB,CAAU,EAAE,CAAC;QACjE,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC;YACrD,SAAS;QACV,CAAC;QACD,IACC,OAAO,KAAK,CAAC,GAAG,CAAC,KAAK,QAAQ;YAC9B,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC5B,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,EACb,CAAC;YACF,MAAM,IAAI,kCAAkC,CAC3C,CAAC,KAAK,EACN,iBAAiB,GAAG,EAAE,CACtB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CACnB,MAAyC;IAEzC,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;AACvD,CAAC;AAED,MAAM,UAAU,mCAAmC;IAClD,OAAO;QACN,UAAU;YACT,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACnC,OAAO;gBACN,MAAM,EAAE,MAAM,KAAK,IAAI;gBACvB,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC;aACnC,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,MAAM,GAAG,EAAE;YAC5B,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,kCAAkC,CAAC,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;YACxE,CAAC;YACD,MAAM,MAAM,GAAsC,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;YACpD,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC1D,MAAM,gBAAgB,GAAG,MAAM,EAAE,OAAO,IAAI,OAAO,CAAC;YACpD,IAAI,MAAM,EAAE,CAAC;gBACZ,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,QAAQ;oBACd,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC,CAAC;YACJ,CAAC;YAED,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;YAClE,IAAI,OAAO,EAAE,CAAC;gBACb,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;gBACzC,MAAM,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,OAAO;oBACb,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,gBAAgB,EAAE,CAAC;gBACtB,MAAM,MAAM,GAAG,kBAAkB,CAChC,gBAAgB,EAChB,UAAU,CAAC,MAAM,CAAC,KAAK,CAAC,CACxB,CAAC;gBACF,MAAM,CAAC,IAAI,CAAC;oBACX,IAAI,EAAE,SAAS;oBACf,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACnD,CAAC,CAAC;YACJ,CAAC;YAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACzB,MAAM,IAAI,kCAAkC,CAC3C,CAAC,KAAK,EACN,6BAA6B,CAC7B,CAAC;YACH,CAAC;YAED,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;YACnC,OAAO;gBACN,OAAO,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;gBAC/C,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC7B,MAAM;aACN,CAAC;QACH,CAAC;QAED,gBAAgB;YACf,MAAM,MAAM,GAAG,iBAAiB,EAAE,CAAC;YACnC,MAAM,cAAc,GAAG,kBAAkB,CAAC;gBACzC,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;YACH,OAAO;gBACN,YAAY,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;oBACzC,IAAI,EAAE,OAAO;oBACb,EAAE;oBACF,QAAQ,EAAE,IAAI;iBACd,CAAC,CAAC;gBACH,cAAc;aACd,CAAC;QACH,CAAC;KACD,CAAC;AACH,CAAC","sourcesContent":["import type {\n\tMaestroAppServerPolicyCheckItem,\n\tMaestroAppServerPolicyCheckResult,\n\tMaestroAppServerPolicyReadResult,\n\tMaestroAppServerRequirementsListResult,\n} from \"@evalops/contracts\";\nimport type { ActionApprovalContext } from \"../agent/action-approval.js\";\nimport {\n\ttype EnterprisePolicy,\n\tcheckModelPolicy,\n\tcheckPolicy,\n\tcheckSessionLimits,\n\tloadPolicy,\n} from \"../safety/policy.js\";\n\ntype UnknownRecord = Record<string, unknown>;\n\nexport class MaestroAppServerPolicyControlError extends Error {\n\tconstructor(\n\t\treadonly code: number,\n\t\tmessage: string,\n\t) {\n\t\tsuper(message);\n\t\tthis.name = \"MaestroAppServerPolicyControlError\";\n\t}\n}\n\nexport interface MaestroAppServerPolicyControl {\n\treadPolicy(): MaestroAppServerPolicyReadResult;\n\tcheckPolicy(\n\t\tparams?: UnknownRecord,\n\t): Promise<MaestroAppServerPolicyCheckResult>;\n\tlistRequirements(): MaestroAppServerRequirementsListResult;\n}\n\nfunction readCurrentPolicy() {\n\ttry {\n\t\treturn loadPolicy();\n\t} catch (error) {\n\t\tthrow new MaestroAppServerPolicyControlError(\n\t\t\t-32000,\n\t\t\t`Failed to load managed policy: ${error instanceof Error ? error.message : \"unknown error\"}`,\n\t\t);\n\t}\n}\n\nfunction deepFreezeSnapshot<T>(value: T): T {\n\tif (typeof value !== \"object\" || value === null) {\n\t\treturn value;\n\t}\n\tfor (const key of Object.getOwnPropertyNames(value)) {\n\t\tdeepFreezeSnapshot((value as Record<string, unknown>)[key]);\n\t}\n\treturn Object.freeze(value);\n}\n\nfunction clonePolicySnapshot(\n\tpolicy: EnterprisePolicy | null,\n): MaestroAppServerPolicyReadResult[\"policy\"] {\n\tif (policy === null) {\n\t\treturn null;\n\t}\n\treturn deepFreezeSnapshot(structuredClone(policy));\n}\n\nfunction isRecord(value: unknown): value is UnknownRecord {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction hasOwnKey(value: object, key: PropertyKey): boolean {\n\treturn Object.prototype.hasOwnProperty.call(value, key);\n}\n\nfunction optionalNonEmptyString(\n\tvalue: unknown,\n\tfield: string,\n): string | undefined {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (typeof value !== \"string\" || value.trim().length === 0) {\n\t\tthrow new MaestroAppServerPolicyControlError(-32602, `Invalid ${field}`);\n\t}\n\treturn value.trim();\n}\n\nfunction parseUser(value: unknown): ActionApprovalContext[\"user\"] | undefined {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (!isRecord(value)) {\n\t\tthrow new MaestroAppServerPolicyControlError(-32602, \"Invalid user\");\n\t}\n\tconst id = optionalNonEmptyString(value.id, \"user.id\");\n\tconst orgId = optionalNonEmptyString(value.orgId, \"user.orgId\");\n\tif (!id || !orgId) {\n\t\tthrow new MaestroAppServerPolicyControlError(-32602, \"Invalid user\");\n\t}\n\treturn { id, orgId };\n}\n\nfunction parseSession(\n\tvalue: unknown,\n\trequireId: boolean,\n): ActionApprovalContext[\"session\"] {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (!isRecord(value)) {\n\t\tthrow new MaestroAppServerPolicyControlError(-32602, \"Invalid session\");\n\t}\n\tconst id = optionalNonEmptyString(value.id, \"session.id\");\n\tif (requireId && !id) {\n\t\tthrow new MaestroAppServerPolicyControlError(-32602, \"Invalid session.id\");\n\t}\n\tif (value.startedAt === undefined || value.startedAt === null) {\n\t\tthrow new MaestroAppServerPolicyControlError(\n\t\t\t-32602,\n\t\t\t\"Invalid session.startedAt\",\n\t\t);\n\t}\n\tconst startedAt =\n\t\tvalue.startedAt instanceof Date\n\t\t\t? new Date(value.startedAt.getTime())\n\t\t\t: new Date(\n\t\t\t\t\toptionalNonEmptyString(value.startedAt, \"session.startedAt\") ?? \"\",\n\t\t\t\t);\n\tif (!Number.isFinite(startedAt.getTime())) {\n\t\tthrow new MaestroAppServerPolicyControlError(\n\t\t\t-32602,\n\t\t\t\"Invalid session.startedAt\",\n\t\t);\n\t}\n\treturn { id: id ?? \"app-server-policy-check\", startedAt };\n}\n\nfunction parseActionContext(\n\tvalue: unknown,\n\tfallbackSession?: ActionApprovalContext[\"session\"],\n): ActionApprovalContext | undefined {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (!isRecord(value)) {\n\t\tthrow new MaestroAppServerPolicyControlError(-32602, \"Invalid action\");\n\t}\n\tconst toolName = optionalNonEmptyString(value.toolName, \"action.toolName\");\n\tif (!toolName) {\n\t\tthrow new MaestroAppServerPolicyControlError(\n\t\t\t-32602,\n\t\t\t\"Invalid action.toolName\",\n\t\t);\n\t}\n\tconst actionSession =\n\t\tvalue.session === undefined || value.session === null\n\t\t\t? fallbackSession\n\t\t\t: parseSession(value.session, false);\n\treturn {\n\t\ttoolName,\n\t\targs: hasOwnKey(value, \"args\") ? value.args : {},\n\t\tmetadata: isRecord(value.metadata)\n\t\t\t? (value.metadata as ActionApprovalContext[\"metadata\"])\n\t\t\t: undefined,\n\t\tuser: parseUser(value.user),\n\t\tsession: actionSession,\n\t\tuserIntent: optionalNonEmptyString(value.userIntent, \"action.userIntent\"),\n\t};\n}\n\nfunction parseUsage(\n\tvalue: unknown,\n): { tokenCount?: number; activeSessionCount?: number } | undefined {\n\tif (value === undefined || value === null) {\n\t\treturn undefined;\n\t}\n\tif (!isRecord(value)) {\n\t\tthrow new MaestroAppServerPolicyControlError(-32602, \"Invalid usage\");\n\t}\n\tconst usage: { tokenCount?: number; activeSessionCount?: number } = {};\n\tfor (const key of [\"tokenCount\", \"activeSessionCount\"] as const) {\n\t\tif (value[key] === undefined || value[key] === null) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (\n\t\t\ttypeof value[key] !== \"number\" ||\n\t\t\t!Number.isFinite(value[key]) ||\n\t\t\tvalue[key] < 0\n\t\t) {\n\t\t\tthrow new MaestroAppServerPolicyControlError(\n\t\t\t\t-32602,\n\t\t\t\t`Invalid usage.${key}`,\n\t\t\t);\n\t\t}\n\t\tusage[key] = value[key];\n\t}\n\treturn usage;\n}\n\nfunction firstReason(\n\tchecks: MaestroAppServerPolicyCheckItem[],\n): string | undefined {\n\treturn checks.find((check) => !check.allowed)?.reason;\n}\n\nexport function createMaestroAppServerPolicyControl(): MaestroAppServerPolicyControl {\n\treturn {\n\t\treadPolicy() {\n\t\t\tconst policy = readCurrentPolicy();\n\t\t\treturn {\n\t\t\t\tloaded: policy !== null,\n\t\t\t\tpolicy: clonePolicySnapshot(policy),\n\t\t\t};\n\t\t},\n\n\t\tasync checkPolicy(params = {}) {\n\t\t\tif (!isRecord(params)) {\n\t\t\t\tthrow new MaestroAppServerPolicyControlError(-32602, \"Invalid params\");\n\t\t\t}\n\t\t\tconst checks: MaestroAppServerPolicyCheckItem[] = [];\n\t\t\tconst session = parseSession(params.session, false);\n\t\t\tconst action = parseActionContext(params.action, session);\n\t\t\tconst sessionForLimits = action?.session ?? session;\n\t\t\tif (action) {\n\t\t\t\tconst result = await checkPolicy(action);\n\t\t\t\tchecks.push({\n\t\t\t\t\tkind: \"action\",\n\t\t\t\t\tallowed: result.allowed,\n\t\t\t\t\t...(result.reason ? { reason: result.reason } : {}),\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tconst modelId = optionalNonEmptyString(params.modelId, \"modelId\");\n\t\t\tif (modelId) {\n\t\t\t\tconst result = checkModelPolicy(modelId);\n\t\t\t\tchecks.push({\n\t\t\t\t\tkind: \"model\",\n\t\t\t\t\tallowed: result.allowed,\n\t\t\t\t\t...(result.reason ? { reason: result.reason } : {}),\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (sessionForLimits) {\n\t\t\t\tconst result = checkSessionLimits(\n\t\t\t\t\tsessionForLimits,\n\t\t\t\t\tparseUsage(params.usage),\n\t\t\t\t);\n\t\t\t\tchecks.push({\n\t\t\t\t\tkind: \"session\",\n\t\t\t\t\tallowed: result.allowed,\n\t\t\t\t\t...(result.reason ? { reason: result.reason } : {}),\n\t\t\t\t});\n\t\t\t}\n\n\t\t\tif (checks.length === 0) {\n\t\t\t\tthrow new MaestroAppServerPolicyControlError(\n\t\t\t\t\t-32602,\n\t\t\t\t\t\"Missing policy check target\",\n\t\t\t\t);\n\t\t\t}\n\n\t\t\tconst reason = firstReason(checks);\n\t\t\treturn {\n\t\t\t\tallowed: checks.every((check) => check.allowed),\n\t\t\t\t...(reason ? { reason } : {}),\n\t\t\t\tchecks,\n\t\t\t};\n\t\t},\n\n\t\tlistRequirements() {\n\t\t\tconst policy = readCurrentPolicy();\n\t\t\tconst requiredSkills = deepFreezeSnapshot([\n\t\t\t\t...(policy?.skills?.required ?? []),\n\t\t\t]);\n\t\t\treturn {\n\t\t\t\trequirements: requiredSkills.map((id) => ({\n\t\t\t\t\tkind: \"skill\",\n\t\t\t\t\tid,\n\t\t\t\t\trequired: true,\n\t\t\t\t})),\n\t\t\t\trequiredSkills,\n\t\t\t};\n\t\t},\n\t};\n}\n"]}

package/dist/app-server/protocol-modes-api.d.ts

@@ -0,0 +1,22 @@
+import { type MaestroAppServerClientMethod, type MaestroAppServerProtocolModeId, type MaestroAppServerProtocolModeListResult, type MaestroAppServerProtocolModeSetResult } from "@evalops/contracts";
+type UnknownRecord = Record<string, unknown>;
+export declare class MaestroAppServerProtocolModesError extends Error {
+    readonly code: number;
+    constructor(code: number, message: string);
+}
+export interface MaestroAppServerProtocolModeDecision {
+    allowed: boolean;
+    reason?: string;
+}
+export interface MaestroAppServerProtocolModes {
+    listModes(params?: UnknownRecord): MaestroAppServerProtocolModeListResult;
+    setMode(params?: UnknownRecord): MaestroAppServerProtocolModeSetResult;
+    checkMethod(method: MaestroAppServerClientMethod): MaestroAppServerProtocolModeDecision;
+    activeMode(): MaestroAppServerProtocolModeId;
+}
+export interface MaestroAppServerProtocolModesOptions {
+    initialMode?: MaestroAppServerProtocolModeId;
+}
+export declare function createMaestroAppServerProtocolModes(options?: MaestroAppServerProtocolModesOptions): MaestroAppServerProtocolModes;
+export {};
+//# sourceMappingURL=protocol-modes-api.d.ts.map

package/dist/app-server/protocol-modes-api.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol-modes-api.d.ts","sourceRoot":"","sources":["../../src/app-server/protocol-modes-api.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,KAAK,4BAA4B,EAEjC,KAAK,8BAA8B,EACnC,KAAK,sCAAsC,EAC3C,KAAK,qCAAqC,EAI1C,MAAM,oBAAoB,CAAC;AAE5B,KAAK,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AA+B7C,qBAAa,kCAAmC,SAAQ,KAAK;IAE3D,QAAQ,CAAC,IAAI,EAAE,MAAM;gBAAZ,IAAI,EAAE,MAAM,EACrB,OAAO,EAAE,MAAM;CAKhB;AAED,MAAM,WAAW,oCAAoC;IACpD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,6BAA6B;IAC7C,SAAS,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,sCAAsC,CAAC;IAC1E,OAAO,CAAC,MAAM,CAAC,EAAE,aAAa,GAAG,qCAAqC,CAAC;IACvE,WAAW,CACV,MAAM,EAAE,4BAA4B,GAClC,oCAAoC,CAAC;IACxC,UAAU,IAAI,8BAA8B,CAAC;CAC7C;AAED,MAAM,WAAW,oCAAoC;IACpD,WAAW,CAAC,EAAE,8BAA8B,CAAC;CAC7C;AA2ED,wBAAgB,mCAAmC,CAClD,OAAO,GAAE,oCAAyC,GAChD,6BAA6B,CAsC/B"}

package/dist/app-server/protocol-modes-api.js

@@ -0,0 +1,124 @@
+import { maestroAppServerClientMethods, maestroAppServerProtocolModeIds, maestroAppServerServerMethods, } from "@evalops/contracts";
+const DEFAULT_MODE = "standard";
+const REVIEW_BLOCKED_METHODS = new Set([
+    "network/fetch",
+    "sandbox/proof/run",
+    "externalAgent/import",
+    "pluginBundle/install",
+    "pluginBundle/remove",
+    "remoteControl/lease/heartbeat",
+    "remoteControl/drain",
+    "command/exec",
+    "command/exec/write",
+    "command/exec/terminate",
+    "fs/writeFile",
+    "fs/createDirectory",
+    "fs/remove",
+    "fs/copy",
+    "fs/watch",
+    "thread/metadata/update",
+    "thread/name/set",
+    "thread/goal/set",
+    "thread/goal/clear",
+    "thread/start",
+    "thread/fork",
+    "thread/archive",
+    "thread/unarchive",
+    "thread/delete",
+]);
+export class MaestroAppServerProtocolModesError extends Error {
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "MaestroAppServerProtocolModesError";
+    }
+}
+function normalizeMode(value) {
+    if (value === undefined || value === null) {
+        throw new MaestroAppServerProtocolModesError(-32602, "Missing mode");
+    }
+    if (typeof value !== "string") {
+        throw new MaestroAppServerProtocolModesError(-32602, "Invalid mode");
+    }
+    if (maestroAppServerProtocolModeIds.includes(value)) {
+        return value;
+    }
+    throw new MaestroAppServerProtocolModesError(-32602, "Invalid mode");
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function paramsRecord(params) {
+    if (params === undefined) {
+        return {};
+    }
+    if (isRecord(params)) {
+        return params;
+    }
+    throw new MaestroAppServerProtocolModesError(-32602, "Invalid params");
+}
+function modeLabel(mode) {
+    switch (mode) {
+        case "review":
+            return "Review";
+        case "realtime":
+            return "Realtime";
+        case "standard":
+            return "Standard";
+    }
+}
+function isMethodAllowedInMode(mode, method) {
+    if (mode !== "review") {
+        return true;
+    }
+    return !REVIEW_BLOCKED_METHODS.has(method);
+}
+function describeMode(mode) {
+    const allowedMethods = maestroAppServerClientMethods.filter((method) => isMethodAllowedInMode(mode, method));
+    const blockedMethods = maestroAppServerClientMethods.filter((method) => !isMethodAllowedInMode(mode, method));
+    return {
+        id: mode,
+        label: modeLabel(mode),
+        readOnly: mode === "review",
+        realtime: mode === "realtime",
+        allowedMethods: [...allowedMethods],
+        blockedMethods: [...blockedMethods],
+        serverNotifications: mode === "realtime" ? [...maestroAppServerServerMethods] : [],
+    };
+}
+export function createMaestroAppServerProtocolModes(options = {}) {
+    let activeMode = options.initialMode === undefined
+        ? DEFAULT_MODE
+        : normalizeMode(options.initialMode);
+    return {
+        listModes(params) {
+            paramsRecord(params);
+            return {
+                activeMode,
+                defaultMode: DEFAULT_MODE,
+                modes: maestroAppServerProtocolModeIds.map(describeMode),
+            };
+        },
+        setMode(params) {
+            const normalizedParams = paramsRecord(params);
+            activeMode = normalizeMode(normalizedParams.mode);
+            return {
+                activeMode,
+                mode: describeMode(activeMode),
+            };
+        },
+        checkMethod(method) {
+            if (isMethodAllowedInMode(activeMode, method)) {
+                return { allowed: true };
+            }
+            return {
+                allowed: false,
+                reason: `${method} is blocked while protocol mode is ${activeMode}`,
+            };
+        },
+        activeMode() {
+            return activeMode;
+        },
+    };
+}
+//# sourceMappingURL=protocol-modes-api.js.map