@evalops/maestro 0.10.49 → 0.10.50

package/dist/cli-command-runtime.js

@@ -5,8 +5,8 @@ export async function runCliCommandRuntime(args) {
     }
     const { parseArgs } = await import("./cli/args.js");
     const parsed = parseArgs(args);
-    const { scrubLoadedSecurityOverrideEnv } = await import("./load-env.js");
-    scrubLoadedSecurityOverrideEnv();
+    const { finalizeLoadedEnv } = await import("./load-env.js");
+    finalizeLoadedEnv();
     if (parsed.error || !isDirectRuntimeCommand(parsed.command)) {
         return false;
     }

package/dist/cli-command-runtime.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-command-runtime.js","sourceRoot":"","sources":["../src/cli-command-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,kCAAkC,GAClC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc;IACxD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,8BAA8B,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACzE,8BAA8B,EAAE,CAAC;IACjC,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CACjD,iCAAiC,CACjC,CAAC;YACF,MAAM,yBAAyB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;gBACzD,WAAW,EAAE,MAAM,CAAC,IAAI;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACrE,MAAM,iBAAiB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,mBAAmB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAC/C,4BAA4B,CAC5B,CAAC;YACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,eAAe,GACpB,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ;gBACvC,CAAC,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;YACtD,MAAM,kBAAkB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;gBACrE,WAAW;gBACX,YAAY;aACZ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC","sourcesContent":["import {\n\tisDirectRuntimeCommand,\n\tshouldAttemptDirectRuntimeDispatch,\n} from \"./cli/direct-runtime-command.js\";\n\nexport async function runCliCommandRuntime(args: string[]): Promise<boolean> {\n\tif (!shouldAttemptDirectRuntimeDispatch(args)) {\n\t\treturn false;\n\t}\n\tconst { parseArgs } = await import(\"./cli/args.js\");\n\tconst parsed = parseArgs(args);\n\tconst { scrubLoadedSecurityOverrideEnv } = await import(\"./load-env.js\");\n\tscrubLoadedSecurityOverrideEnv();\n\tif (parsed.error || !isDirectRuntimeCommand(parsed.command)) {\n\t\treturn false;\n\t}\n\n\tswitch (parsed.command) {\n\t\tcase \"hosted-runner\": {\n\t\t\tconst { handleHostedRunnerCommand } = await import(\n\t\t\t\t\"./cli/commands/hosted-runner.js\"\n\t\t\t);\n\t\t\tawait handleHostedRunnerCommand(parsed.commandArgs ?? [], {\n\t\t\t\tdefaultPort: parsed.port,\n\t\t\t});\n\t\t\treturn true;\n\t\t}\n\t\tcase \"init\": {\n\t\t\tconst { handleInitCommand } = await import(\"./cli/commands/init.js\");\n\t\t\tawait handleInitCommand(parsed.commandArgs ?? []);\n\t\t\treturn true;\n\t\t}\n\t\tcase \"update\": {\n\t\t\tconst { handleUpdateCommand } = await import(\"./cli/commands/update.js\");\n\t\t\tawait handleUpdateCommand(parsed.commandArgs ?? []);\n\t\t\treturn true;\n\t\t}\n\t\tcase \"skill\": {\n\t\t\tconst { buildCliConfigOverrides } = await import(\n\t\t\t\t\"./config/runtime-config.js\"\n\t\t\t);\n\t\t\tconst { handleSkillCommand } = await import(\"./cli/commands/skill.js\");\n\t\t\tconst cliOverrides = buildCliConfigOverrides(parsed);\n\t\t\tconst overrideProfile =\n\t\t\t\ttypeof cliOverrides.profile === \"string\"\n\t\t\t\t\t? cliOverrides.profile\n\t\t\t\t\t: undefined;\n\t\t\tconst profileName = parsed.profile ?? overrideProfile;\n\t\t\tawait handleSkillCommand(parsed.subcommand, parsed.commandArgs ?? [], {\n\t\t\t\tprofileName,\n\t\t\t\tcliOverrides,\n\t\t\t});\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n"]}
+{"version":3,"file":"cli-command-runtime.js","sourceRoot":"","sources":["../src/cli-command-runtime.ts"],"names":[],"mappings":"AAAA,OAAO,EACN,sBAAsB,EACtB,kCAAkC,GAClC,MAAM,iCAAiC,CAAC;AAEzC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,IAAc;IACxD,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;IAC5D,iBAAiB,EAAE,CAAC;IACpB,IAAI,MAAM,CAAC,KAAK,IAAI,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7D,OAAO,KAAK,CAAC;IACd,CAAC;IAED,QAAQ,MAAM,CAAC,OAAO,EAAE,CAAC;QACxB,KAAK,eAAe,CAAC,CAAC,CAAC;YACtB,MAAM,EAAE,yBAAyB,EAAE,GAAG,MAAM,MAAM,CACjD,iCAAiC,CACjC,CAAC;YACF,MAAM,yBAAyB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;gBACzD,WAAW,EAAE,MAAM,CAAC,IAAI;aACxB,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YACrE,MAAM,iBAAiB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACf,MAAM,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,0BAA0B,CAAC,CAAC;YACzE,MAAM,mBAAmB,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;YACpD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,KAAK,OAAO,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,uBAAuB,EAAE,GAAG,MAAM,MAAM,CAC/C,4BAA4B,CAC5B,CAAC;YACF,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,yBAAyB,CAAC,CAAC;YACvE,MAAM,YAAY,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;YACrD,MAAM,eAAe,GACpB,OAAO,YAAY,CAAC,OAAO,KAAK,QAAQ;gBACvC,CAAC,CAAC,YAAY,CAAC,OAAO;gBACtB,CAAC,CAAC,SAAS,CAAC;YACd,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,IAAI,eAAe,CAAC;YACtD,MAAM,kBAAkB,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,WAAW,IAAI,EAAE,EAAE;gBACrE,WAAW;gBACX,YAAY;aACZ,CAAC,CAAC;YACH,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC","sourcesContent":["import {\n\tisDirectRuntimeCommand,\n\tshouldAttemptDirectRuntimeDispatch,\n} from \"./cli/direct-runtime-command.js\";\n\nexport async function runCliCommandRuntime(args: string[]): Promise<boolean> {\n\tif (!shouldAttemptDirectRuntimeDispatch(args)) {\n\t\treturn false;\n\t}\n\tconst { parseArgs } = await import(\"./cli/args.js\");\n\tconst parsed = parseArgs(args);\n\tconst { finalizeLoadedEnv } = await import(\"./load-env.js\");\n\tfinalizeLoadedEnv();\n\tif (parsed.error || !isDirectRuntimeCommand(parsed.command)) {\n\t\treturn false;\n\t}\n\n\tswitch (parsed.command) {\n\t\tcase \"hosted-runner\": {\n\t\t\tconst { handleHostedRunnerCommand } = await import(\n\t\t\t\t\"./cli/commands/hosted-runner.js\"\n\t\t\t);\n\t\t\tawait handleHostedRunnerCommand(parsed.commandArgs ?? [], {\n\t\t\t\tdefaultPort: parsed.port,\n\t\t\t});\n\t\t\treturn true;\n\t\t}\n\t\tcase \"init\": {\n\t\t\tconst { handleInitCommand } = await import(\"./cli/commands/init.js\");\n\t\t\tawait handleInitCommand(parsed.commandArgs ?? []);\n\t\t\treturn true;\n\t\t}\n\t\tcase \"update\": {\n\t\t\tconst { handleUpdateCommand } = await import(\"./cli/commands/update.js\");\n\t\t\tawait handleUpdateCommand(parsed.commandArgs ?? []);\n\t\t\treturn true;\n\t\t}\n\t\tcase \"skill\": {\n\t\t\tconst { buildCliConfigOverrides } = await import(\n\t\t\t\t\"./config/runtime-config.js\"\n\t\t\t);\n\t\t\tconst { handleSkillCommand } = await import(\"./cli/commands/skill.js\");\n\t\t\tconst cliOverrides = buildCliConfigOverrides(parsed);\n\t\t\tconst overrideProfile =\n\t\t\t\ttypeof cliOverrides.profile === \"string\"\n\t\t\t\t\t? cliOverrides.profile\n\t\t\t\t\t: undefined;\n\t\t\tconst profileName = parsed.profile ?? overrideProfile;\n\t\t\tawait handleSkillCommand(parsed.subcommand, parsed.commandArgs ?? [], {\n\t\t\t\tprofileName,\n\t\t\t\tcliOverrides,\n\t\t\t});\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n"]}

package/dist/cli-runtime.js

@@ -585,6 +585,9 @@ function defaultRuntimeEnv() {
   }
   return processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__;
 }
+function resetDefaultRuntimeEnv() {
+  Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_DEFAULT_RUNTIME_ENV__");
+}
 var EVALOPS_ORG_ID_VARS, EVALOPS_ACCESS_TOKEN_VARS, METER_BASE_URL_VARS, METER_ACCESS_TOKEN_VARS, METER_ORG_ID_VARS, processWithRuntimeEnvCache;
 var init_env = __esm({
   "dist/runtime/env.js"() {
@@ -13257,7 +13260,9 @@ var init_env_vars = __esm({
 // dist/load-env.js
 var load_env_exports = {};
 __export(load_env_exports, {
+  finalizeLoadedEnv: () => finalizeLoadedEnv,
   getLoadedEnvKeys: () => getLoadedEnvKeys,
+  loadAndFinalizeEnv: () => loadAndFinalizeEnv,
   loadEnv: () => loadEnv,
   scrubLoadedSecurityOverrideEnv: () => scrubLoadedSecurityOverrideEnv
 });
@@ -13318,11 +13323,20 @@ function scrubLoadedSecurityOverrideEnv() {
   }
   return scrubbed;
 }
+function finalizeLoadedEnv(loadedEnvKeys2 = []) {
+  const scrubbedEnvKeys = scrubLoadedSecurityOverrideEnv();
+  resetDefaultRuntimeEnv();
+  return { loadedEnvKeys: loadedEnvKeys2, scrubbedEnvKeys };
+}
+function loadAndFinalizeEnv() {
+  return finalizeLoadedEnv(loadEnv());
+}
 var ENV_FILES, BLOCKED_DOTENV_KEYS, DOTENV_SECURITY_OVERRIDE_KEYS, normalizeEnvKey, DOTENV_SECURITY_OVERRIDE_KEY_SET, DOTENV_SECURITY_OVERRIDE_PREFIXES, isDotenvSecurityOverrideKey, loadedEnvKeys;
 var init_load_env = __esm({
   "dist/load-env.js"() {
     "use strict";
     init_env_vars();
+    init_env();
     ENV_FILES = [".env.local", ".env"];
     BLOCKED_DOTENV_KEYS = /* @__PURE__ */ new Set([
       "HOME",
@@ -19773,8 +19787,8 @@ async function runCliCommandRuntime(args) {
   }
   const { parseArgs: parseArgs2 } = await Promise.resolve().then(() => (init_args2(), args_exports));
   const parsed = parseArgs2(args);
-  const { scrubLoadedSecurityOverrideEnv: scrubLoadedSecurityOverrideEnv2 } = await Promise.resolve().then(() => (init_load_env(), load_env_exports));
-  scrubLoadedSecurityOverrideEnv2();
+  const { finalizeLoadedEnv: finalizeLoadedEnv2 } = await Promise.resolve().then(() => (init_load_env(), load_env_exports));
+  finalizeLoadedEnv2();
   if (parsed.error || !isDirectRuntimeCommand(parsed.command)) {
     return false;
   }
@@ -127499,6 +127513,7 @@ __export(schema_exports, {
   hostedSessions: () => hostedSessions,
   modelApprovalStatusEnum: () => modelApprovalStatusEnum,
   modelApprovals: () => modelApprovals,
+  operatingLayerEvidence: () => operatingLayerEvidence,
   orgMemberships: () => orgMemberships,
   orgMembershipsRelations: () => orgMembershipsRelations,
   organizations: () => organizations,
@@ -127529,7 +127544,7 @@ __export(schema_exports, {
 });
 import { relations } from "drizzle-orm";
 import { bigint, bigserial, boolean, index, integer, jsonb, pgEnum, pgTable, text, timestamp, uniqueIndex, uuid, varchar } from "drizzle-orm/pg-core";
-var userRoleEnum, auditStatusEnum, alertSeverityEnum, modelApprovalStatusEnum, organizations, users, orgMemberships, roles, permissions, rolePermissions, sessions, sessionMessages, hostedSessions, hostedSessionEntries, auditLogs, modelApprovals, directoryAccessRules, alerts, apiKeys, revokedTokens, webhookDeliveryStatusEnum, webhookDeliveries, userRevocationTimestamps, totpRateLimits, sharedSessions, totpUsedCodes, distributedLocks, auditHashCache, usageMetrics, executionTraces, workspaceConfig, revenueAttribution, organizationsRelations, usersRelations, rolesRelations, orgMembershipsRelations, rolePermissionsRelations, permissionsRelations, sessionsRelations, sessionMessagesRelations, auditLogsRelations;
+var userRoleEnum, auditStatusEnum, alertSeverityEnum, modelApprovalStatusEnum, organizations, users, orgMemberships, roles, permissions, rolePermissions, sessions, sessionMessages, hostedSessions, hostedSessionEntries, operatingLayerEvidence, auditLogs, modelApprovals, directoryAccessRules, alerts, apiKeys, revokedTokens, webhookDeliveryStatusEnum, webhookDeliveries, userRevocationTimestamps, totpRateLimits, sharedSessions, totpUsedCodes, distributedLocks, auditHashCache, usageMetrics, executionTraces, workspaceConfig, revenueAttribution, organizationsRelations, usersRelations, rolesRelations, orgMembershipsRelations, rolePermissionsRelations, permissionsRelations, sessionsRelations, sessionMessagesRelations, auditLogsRelations;
 var init_schema = __esm({
   "dist/db/schema.js"() {
     "use strict";
@@ -127707,6 +127722,29 @@ var init_schema = __esm({
       sessionSequenceIdx: uniqueIndex("hosted_session_entry_session_sequence_idx").on(table.sessionId, table.sequence),
       sessionEntryTypeIdx: index("hosted_session_entry_type_idx").on(table.sessionId, table.entryType)
     }));
+    operatingLayerEvidence = pgTable("operating_layer_evidence", {
+      id: uuid("id").primaryKey().defaultRandom(),
+      orgId: uuid("org_id").references(() => organizations.id, {
+        onDelete: "cascade"
+      }),
+      sessionId: varchar("session_id", { length: 255 }),
+      capabilityId: varchar("capability_id", { length: 64 }).notNull(),
+      evidenceKind: varchar("evidence_kind", { length: 128 }).notNull(),
+      subject: varchar("subject", { length: 255 }).notNull(),
+      status: varchar("status", { length: 32 }).default("recorded").notNull(),
+      score: integer("score"),
+      blockers: jsonb("blockers").$type().default([]).notNull(),
+      warnings: jsonb("warnings").$type().default([]).notNull(),
+      evidence: jsonb("evidence").$type().notNull(),
+      metadata: jsonb("metadata").$type().default({}),
+      recordedAt: timestamp("recorded_at", { withTimezone: true }).defaultNow().notNull(),
+      expiresAt: timestamp("expires_at", { withTimezone: true })
+    }, (table) => ({
+      capabilityRecordedIdx: index("operating_layer_evidence_capability_recorded_idx").on(table.capabilityId, table.recordedAt),
+      orgRecordedIdx: index("operating_layer_evidence_org_recorded_idx").on(table.orgId, table.recordedAt),
+      sessionRecordedIdx: index("operating_layer_evidence_session_recorded_idx").on(table.sessionId, table.recordedAt),
+      expiryIdx: index("operating_layer_evidence_expiry_idx").on(table.expiresAt)
+    }));
     auditLogs = pgTable("audit_logs", {
       id: uuid("id").primaryKey().defaultRandom(),
       orgId: uuid("org_id").notNull().references(() => organizations.id, {
@@ -150501,11 +150539,10 @@ async function main(args) {
     originalStderrWrite(message.endsWith("\n") ? message : `${message}
 `);
   };
-  loadEnv();
+  loadAndFinalizeEnv();
   const startupProfiler = createStartupProfilerFromEnv();
   startupProfiler.checkpoint("process:start");
   const parsed = parseArgs(args);
-  scrubLoadedSecurityOverrideEnv();
   startupProfiler.checkpoint("cli:parsed");
   const startupTelemetry = Promise.resolve().then(() => (init_cli_startup(), cli_startup_exports)).then(({ recordCliStartupTelemetry: recordCliStartupTelemetry2 }) => recordCliStartupTelemetry2({
     args: parsed,

package/dist/cli.js

@@ -225,9 +225,8 @@ const run = async () => {
         let envLoaded = false;
         let loadedEnvKeys = [];
         if (immediateExit !== null) {
-            const { loadEnv, scrubLoadedSecurityOverrideEnv } = await import("./load-env.js");
-            loadedEnvKeys = loadEnv();
-            scrubLoadedSecurityOverrideEnv();
+            const { loadAndFinalizeEnv } = await import("./load-env.js");
+            ({ loadedEnvKeys } = loadAndFinalizeEnv());
             envLoaded = true;
         }
         if (shouldUseInstantCliExit(immediateExit, process.env)) {
@@ -235,9 +234,8 @@ const run = async () => {
             return;
         }
         if (!envLoaded) {
-            const { loadEnv, scrubLoadedSecurityOverrideEnv } = await import("./load-env.js");
-            loadedEnvKeys = loadEnv();
-            scrubLoadedSecurityOverrideEnv();
+            const { loadAndFinalizeEnv } = await import("./load-env.js");
+            ({ loadedEnvKeys } = loadAndFinalizeEnv());
         }
         await refreshInstalledCliOnStartup(args, loadedEnvKeys);
         if (shouldUseFastUnbundledExecRuntime(args)) {

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAIA,0DAA0D;AAC1D,sFAAsF;AACtF,OAAO,EAEN,mBAAmB,EACnB,uBAAuB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAGlC,CAAC;AACb,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,KAAsB,EAAE,GAAG,IAAe,EAAE,EAAE;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QACxB,IACC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,QAAQ,KAAK,IAAI;YACjB,MAAM,IAAI,QAAQ;YAClB,MAAM,IAAI,QAAQ;YACjB,QAA6C,CAAC,IAAI;gBAClD,oBAAoB;YACpB,QAA6C,CAAC,IAAI,KAAK,SAAS,EAChE,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,gCAAgC;QAC/C,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACrC,CAAC,CAAwB,CAAC;AAE1B,SAAS,oBAAoB,CAAC,IAAc;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IACC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,UAAU,EACzC,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,2CAA2C;AAC3C,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC9C,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,IAAI;IACJ,eAAe;IACf,UAAU;IACV,eAAe;IACf,WAAW;IACX,QAAQ;IACR,iBAAiB;IACjB,wBAAwB;IACxB,WAAW;IACX,iBAAiB;IACjB,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,uBAAuB;IACvB,SAAS;IACT,YAAY;IACZ,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,UAAU;IACV,mBAAmB;CACnB,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAuB;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,IAAI,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACxE,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,iCAAiC,CAAC,IAAuB;IACjE,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AACnD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC/C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,IAAI,CAAC,SAAS,CAAC;YACjB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,4BAA4B,OAAO,EAAE;YAC9C,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,OAAO;SACnB,CAAC,IAAI,CACN,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;IACtE,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,OAAO,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC;QACJ,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CACvE,aAAa,CACb,CAAC;QACF,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,WAAW,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,0EAA0E;IAC3E,CAAC;AACF,CAAC;AAED,KAAK,UAAU,4BAA4B,CAC1C,IAAc,EACd,iBAA2B,EAAE;IAE7B,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YAClC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,iBAAiB,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3E,IACC,GAAG,CAAC,2BAA2B;YAC/B,GAAG,CAAC,EAAE;YACN,GAAG,CAAC,QAAQ,KAAK,MAAM;YACvB,iBAAiB,KAAK,GAAG;YACzB,iBAAiB,KAAK,OAAO;YAC7B,iBAAiB,KAAK,KAAK;YAC3B,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;YACpB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EACpB,CAAC;YACF,OAAO;QACR,CAAC;QACD,MAAM,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,GACtE,MAAM,OAAO,CAAC,GAAG,CAAC;YACjB,MAAM,CAAC,uBAAuB,CAAC;YAC/B,MAAM,CAAC,6BAA6B,CAAC;SACrC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YAC1C,IAAI;YACJ,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,GAAG;YACH,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,8EAA8E;IAC/E,CAAC;AACF,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAsB;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,YAAY,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC/C,OAAO;IACR,CAAC;IAED,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,MAAM,CAAC,eAAe,CAAC;QACvB,MAAM,CAAC,uBAAuB,CAAC;KAC/B,CAAC,CAAC;IACH,SAAS,CAAC,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc;IAC1C,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACvE,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO;IACR,CAAC;IACD,MAAM,YAAY,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAC7C,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC3B,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;YACjC,IAAI,CAAC;gBACJ,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;QACF,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;QACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;IAClC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,8BAA8B;IAC5C,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,yBAAyB,GAAG,+BAA+B,GAAG,IAAI,CAAC;IACzE,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,EAAE,kCAAkC,EAAE,GAC3C,MAAM,8BAA8B,EAAE,CAAC;IACxC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAC/D,0BAA0B,CAC1B,CAAC;QACF,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAC;IAC5D,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAC/D,mBAAmB,CACnB,CAAC;IACF,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,IAAc;IACpD,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EAAE,6BAA6B,EAAE,GACtC,MAAM,8BAA8B,EAAE,CAAC;IACxC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE;IACtB,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,MAAM,MAAM,CAC/D,eAAe,CACf,CAAC;YACF,aAAa,GAAG,OAAO,EAAE,CAAC;YAC1B,8BAA8B,EAAE,CAAC;YACjC,SAAS,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,EAAE,OAAO,EAAE,8BAA8B,EAAE,GAAG,MAAM,MAAM,CAC/D,eAAe,CACf,CAAC;YACF,aAAa,GAAG,OAAO,EAAE,CAAC;YAC1B,8BAA8B,EAAE,CAAC;QAClC,CAAC;QACD,MAAM,4BAA4B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,iCAAiC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO;QACR,CAAC;QACD,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO;QACR,CAAC;QACD,IAAI,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO;QACR,CAAC;QACD,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACF,CAAC,CAAC;AAEF,wGAAwG;AACxG,KAAK,GAAG,EAAE,CAAC","sourcesContent":["#!/usr/bin/env node\n\ndeclare const MAESTRO_BUNDLE_RUNTIME: boolean | undefined;\n\n// Suppress punycode deprecation warning from dependencies\n// This warning comes from old dependencies still using the deprecated punycode module\nimport {\n\ttype ImmediateCliExit,\n\tgetImmediateCliExit,\n\tshouldUseInstantCliExit,\n} from \"./cli/instant-exit.js\";\n\nconst originalEmit = process.emit.bind(process) as (\n\tevent: string | symbol,\n\t...args: unknown[]\n) => boolean;\nprocess.emit = ((event: string | symbol, ...args: unknown[]) => {\n\tif (event === \"warning\") {\n\t\tconst [firstArg] = args;\n\t\tif (\n\t\t\ttypeof firstArg === \"object\" &&\n\t\t\tfirstArg !== null &&\n\t\t\t\"name\" in firstArg &&\n\t\t\t\"code\" in firstArg &&\n\t\t\t(firstArg as { name?: string; code?: string }).name ===\n\t\t\t\t\"DeprecationWarning\" &&\n\t\t\t(firstArg as { name?: string; code?: string }).code === \"DEP0040\"\n\t\t) {\n\t\t\treturn false; // Suppress punycode deprecation\n\t\t}\n\t}\n\treturn originalEmit(event, ...args);\n}) as typeof process.emit;\n\nfunction isHeadlessInvocation(args: string[]): boolean {\n\tfor (let i = 0; i < args.length; i++) {\n\t\tconst arg = args[i];\n\t\tif (arg === \"--headless\") {\n\t\t\treturn true;\n\t\t}\n\t\tif (arg === \"--mode\" && args[i + 1] === \"headless\") {\n\t\t\treturn true;\n\t\t}\n\t\tif (\n\t\t\targ?.startsWith(\"--mode=\") &&\n\t\t\targ.slice(\"--mode=\".length) === \"headless\"\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\n// Keep this detector local: importing the shared command runtime detector is the\n// pre-main work the exec fast path avoids.\nconst EXEC_RUNTIME_FLAGS_WITH_VALUES = new Set([\n\t\"--mode\",\n\t\"--provider\",\n\t\"--model\",\n\t\"-m\",\n\t\"--task-budget\",\n\t\"--models\",\n\t\"--models-file\",\n\t\"--api-key\",\n\t\"--port\",\n\t\"--system-prompt\",\n\t\"--append-system-prompt\",\n\t\"--session\",\n\t\"--approval-mode\",\n\t\"--auth\",\n\t\"--sandbox\",\n\t\"--output-schema\",\n\t\"--output-last-message\",\n\t\"--tools\",\n\t\"--composer\",\n\t\"--format\",\n\t\"--profile\",\n\t\"--config\",\n\t\"--junit\",\n\t\"--replay\",\n\t\"--record-scenario\",\n]);\n\nfunction getLauncherRuntimeCommand(args: readonly string[]): string | null {\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (!arg) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (EXEC_RUNTIME_FLAGS_WITH_VALUES.has(arg) && index + 1 < args.length) {\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"-\")) {\n\t\t\tcontinue;\n\t\t}\n\t\treturn arg;\n\t}\n\treturn null;\n}\n\nfunction shouldUseFastUnbundledExecRuntime(args: readonly string[]): boolean {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\treturn false;\n\t}\n\treturn getLauncherRuntimeCommand(args) === \"exec\";\n}\n\nfunction emitHeadlessStartupError(error: unknown): void {\n\tconst message = error instanceof Error ? error.message : String(error);\n\tconst stack = error instanceof Error ? error.stack : undefined;\n\ttry {\n\t\tprocess.stdout.write(\n\t\t\t`${JSON.stringify({\n\t\t\t\ttype: \"error\",\n\t\t\t\tmessage: `Headless startup failed: ${message}`,\n\t\t\t\tfatal: true,\n\t\t\t\terror_type: \"fatal\",\n\t\t\t})}\\n`,\n\t\t);\n\t} catch {\n\t\t// If stdout is unavailable there is no protocol channel left to use.\n\t}\n\tprocess.stderr.write(`${stack ?? message}\\n`);\n}\n\nasync function reportFatalCliError(error: unknown): Promise<void> {\n\ttry {\n\t\tconst { captureSentryException, flushSentry, initSentry } = await import(\n\t\t\t\"./sentry.js\"\n\t\t);\n\t\tinitSentry(\"maestro-cli\");\n\t\tcaptureSentryException(error);\n\t\tawait flushSentry();\n\t} catch {\n\t\t// Sentry reporting is best-effort and must not mask the original failure.\n\t}\n}\n\nasync function refreshInstalledCliOnStartup(\n\targs: string[],\n\tignoredEnvKeys: string[] = [],\n): Promise<void> {\n\ttry {\n\t\tconst env = { ...process.env };\n\t\tfor (const key of ignoredEnvKeys) {\n\t\t\tdelete env[key];\n\t\t}\n\t\tconst startupUpdateMode = env.MAESTRO_STARTUP_UPDATE?.trim().toLowerCase();\n\t\tif (\n\t\t\tenv.MAESTRO_SKIP_STARTUP_UPDATE ||\n\t\t\tenv.CI ||\n\t\t\tenv.NODE_ENV === \"test\" ||\n\t\t\tstartupUpdateMode === \"0\" ||\n\t\t\tstartupUpdateMode === \"false\" ||\n\t\t\tstartupUpdateMode === \"off\" ||\n\t\t\t!process.stdin.isTTY ||\n\t\t\t!process.stdout.isTTY\n\t\t) {\n\t\t\treturn;\n\t\t}\n\t\tconst [{ getPackageName, getPackageVersion }, { attemptStartupUpdate }] =\n\t\t\tawait Promise.all([\n\t\t\t\timport(\"./package-metadata.js\"),\n\t\t\t\timport(\"./update/startup-refresh.js\"),\n\t\t\t]);\n\t\tconst outcome = await attemptStartupUpdate({\n\t\t\targs,\n\t\t\tcurrentVersion: getPackageVersion(env),\n\t\t\tenv,\n\t\t\tpackageName: getPackageName(env),\n\t\t});\n\t\tif (outcome.status === \"restarted\") {\n\t\t\tprocess.exit(outcome.exitCode);\n\t\t}\n\t} catch {\n\t\t// Startup refresh is best-effort and must never prevent the CLI from booting.\n\t}\n}\n\nasync function runImmediateCliExit(exit: ImmediateCliExit): Promise<void> {\n\tif (exit.kind === \"version\") {\n\t\tconst { getPackageVersion } = await import(\"./package-metadata.js\");\n\t\tconsole.log(`Maestro v${getPackageVersion()}`);\n\t\treturn;\n\t}\n\n\tconst [{ printHelp }, { getPackageVersion }] = await Promise.all([\n\t\timport(\"./cli/help.js\"),\n\t\timport(\"./package-metadata.js\"),\n\t]);\n\tprintHelp(getPackageVersion(), { includeHidden: exit.includeHidden });\n}\n\nasync function runCliRuntime(args: string[]): Promise<void> {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\tconst { runCliRuntime: runRuntime } = await import(\"./cli-runtime.js\");\n\t\tawait runRuntime(args);\n\t\treturn;\n\t}\n\tconst runtimeEntry = \"./cli-runtime.\" + \"js\";\n\tconst { runCliRuntime: runRuntime } = await import(runtimeEntry);\n\tawait runRuntime(args);\n}\n\nasync function runMainRuntime(args: string[]): Promise<void> {\n\tconst loadMain = async () => {\n\t\tif (process.versions?.bun) {\n\t\t\tconst tsEntry = \"./main.\" + \"ts\";\n\t\t\ttry {\n\t\t\t\treturn await import(tsEntry);\n\t\t\t} catch {\n\t\t\t\treturn await import(\"./main.js\");\n\t\t\t}\n\t\t}\n\t\tconst mainEntry = \"./main.\" + \"js\";\n\t\treturn import(mainEntry);\n\t};\n\n\tconst { main } = await loadMain();\n\tawait main(args);\n}\n\nasync function loadDirectRuntimeCommandModule() {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\treturn import(\"./cli/direct-runtime-command.js\");\n\t}\n\tconst directRuntimeCommandEntry = \"./cli/direct-runtime-command.\" + \"js\";\n\treturn import(directRuntimeCommandEntry);\n}\n\nasync function runCliCommandRuntime(args: string[]): Promise<boolean> {\n\tconst { shouldAttemptDirectRuntimeDispatch } =\n\t\tawait loadDirectRuntimeCommandModule();\n\tif (!shouldAttemptDirectRuntimeDispatch(args)) {\n\t\treturn false;\n\t}\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\tconst { runCliCommandRuntime: runCommandRuntime } = await import(\n\t\t\t\"./cli-command-runtime.js\"\n\t\t);\n\t\treturn runCommandRuntime(args);\n\t}\n\tconst commandRuntimeEntry = \"./cli-command-runtime.\" + \"js\";\n\tconst { runCliCommandRuntime: runCommandRuntime } = await import(\n\t\tcommandRuntimeEntry\n\t);\n\treturn runCommandRuntime(args);\n}\n\nasync function runUnbundledMainRuntime(args: string[]): Promise<boolean> {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\treturn false;\n\t}\n\tconst { shouldUseUnbundledMainRuntime } =\n\t\tawait loadDirectRuntimeCommandModule();\n\tif (!shouldUseUnbundledMainRuntime(args)) {\n\t\treturn false;\n\t}\n\tawait runMainRuntime(args);\n\treturn true;\n}\n\nconst run = async () => {\n\ttry {\n\t\tconst args = process.argv.slice(2);\n\t\tconst immediateExit = getImmediateCliExit(args);\n\t\tlet envLoaded = false;\n\t\tlet loadedEnvKeys: string[] = [];\n\t\tif (immediateExit !== null) {\n\t\t\tconst { loadEnv, scrubLoadedSecurityOverrideEnv } = await import(\n\t\t\t\t\"./load-env.js\"\n\t\t\t);\n\t\t\tloadedEnvKeys = loadEnv();\n\t\t\tscrubLoadedSecurityOverrideEnv();\n\t\t\tenvLoaded = true;\n\t\t}\n\t\tif (shouldUseInstantCliExit(immediateExit, process.env)) {\n\t\t\tawait runImmediateCliExit(immediateExit);\n\t\t\treturn;\n\t\t}\n\n\t\tif (!envLoaded) {\n\t\t\tconst { loadEnv, scrubLoadedSecurityOverrideEnv } = await import(\n\t\t\t\t\"./load-env.js\"\n\t\t\t);\n\t\t\tloadedEnvKeys = loadEnv();\n\t\t\tscrubLoadedSecurityOverrideEnv();\n\t\t}\n\t\tawait refreshInstalledCliOnStartup(args, loadedEnvKeys);\n\t\tif (shouldUseFastUnbundledExecRuntime(args)) {\n\t\t\tawait runMainRuntime(args);\n\t\t\treturn;\n\t\t}\n\t\tif (await runCliCommandRuntime(args)) {\n\t\t\treturn;\n\t\t}\n\t\tif (await runUnbundledMainRuntime(args)) {\n\t\t\treturn;\n\t\t}\n\t\tawait runCliRuntime(args);\n\t} catch (err) {\n\t\tif (isHeadlessInvocation(process.argv.slice(2))) {\n\t\t\temitHeadlessStartupError(err);\n\t\t} else {\n\t\t\tconsole.error(err);\n\t\t}\n\t\tawait reportFatalCliError(err);\n\t\tprocess.exit(1);\n\t}\n};\n\n// Call without top-level await so Bun's bytecode compilation (which forbids TLA) can bundle this entry.\nvoid run();\n"]}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAIA,0DAA0D;AAC1D,sFAAsF;AACtF,OAAO,EAEN,mBAAmB,EACnB,uBAAuB,GACvB,MAAM,uBAAuB,CAAC;AAE/B,MAAM,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAGlC,CAAC;AACb,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,KAAsB,EAAE,GAAG,IAAe,EAAE,EAAE;IAC9D,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACzB,MAAM,CAAC,QAAQ,CAAC,GAAG,IAAI,CAAC;QACxB,IACC,OAAO,QAAQ,KAAK,QAAQ;YAC5B,QAAQ,KAAK,IAAI;YACjB,MAAM,IAAI,QAAQ;YAClB,MAAM,IAAI,QAAQ;YACjB,QAA6C,CAAC,IAAI;gBAClD,oBAAoB;YACpB,QAA6C,CAAC,IAAI,KAAK,SAAS,EAChE,CAAC;YACF,OAAO,KAAK,CAAC,CAAC,gCAAgC;QAC/C,CAAC;IACF,CAAC;IACD,OAAO,YAAY,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;AACrC,CAAC,CAAwB,CAAC;AAE1B,SAAS,oBAAoB,CAAC,IAAc;IAC3C,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,GAAG,KAAK,YAAY,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,UAAU,EAAE,CAAC;YACpD,OAAO,IAAI,CAAC;QACb,CAAC;QACD,IACC,GAAG,EAAE,UAAU,CAAC,SAAS,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,UAAU,EACzC,CAAC;YACF,OAAO,IAAI,CAAC;QACb,CAAC;IACF,CAAC;IACD,OAAO,KAAK,CAAC;AACd,CAAC;AAED,iFAAiF;AACjF,2CAA2C;AAC3C,MAAM,8BAA8B,GAAG,IAAI,GAAG,CAAC;IAC9C,QAAQ;IACR,YAAY;IACZ,SAAS;IACT,IAAI;IACJ,eAAe;IACf,UAAU;IACV,eAAe;IACf,WAAW;IACX,QAAQ;IACR,iBAAiB;IACjB,wBAAwB;IACxB,WAAW;IACX,iBAAiB;IACjB,QAAQ;IACR,WAAW;IACX,iBAAiB;IACjB,uBAAuB;IACvB,SAAS;IACT,YAAY;IACZ,UAAU;IACV,WAAW;IACX,UAAU;IACV,SAAS;IACT,UAAU;IACV,mBAAmB;CACnB,CAAC,CAAC;AAEH,SAAS,yBAAyB,CAAC,IAAuB;IACzD,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACxB,IAAI,CAAC,GAAG,EAAE,CAAC;YACV,SAAS;QACV,CAAC;QACD,IAAI,8BAA8B,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;YACxE,KAAK,EAAE,CAAC;YACR,SAAS;QACV,CAAC;QACD,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACzB,SAAS;QACV,CAAC;QACD,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,iCAAiC,CAAC,IAAuB;IACjE,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACd,CAAC;IACD,OAAO,yBAAyB,CAAC,IAAI,CAAC,KAAK,MAAM,CAAC;AACnD,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAc;IAC/C,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;IAC/D,IAAI,CAAC;QACJ,OAAO,CAAC,MAAM,CAAC,KAAK,CACnB,GAAG,IAAI,CAAC,SAAS,CAAC;YACjB,IAAI,EAAE,OAAO;YACb,OAAO,EAAE,4BAA4B,OAAO,EAAE;YAC9C,KAAK,EAAE,IAAI;YACX,UAAU,EAAE,OAAO;SACnB,CAAC,IAAI,CACN,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;IACtE,CAAC;IACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,OAAO,IAAI,CAAC,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,KAAc;IAChD,IAAI,CAAC;QACJ,MAAM,EAAE,sBAAsB,EAAE,WAAW,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CACvE,aAAa,CACb,CAAC;QACF,UAAU,CAAC,aAAa,CAAC,CAAC;QAC1B,sBAAsB,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,WAAW,EAAE,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACR,0EAA0E;IAC3E,CAAC;AACF,CAAC;AAED,KAAK,UAAU,4BAA4B,CAC1C,IAAc,EACd,iBAA2B,EAAE;IAE7B,IAAI,CAAC;QACJ,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC/B,KAAK,MAAM,GAAG,IAAI,cAAc,EAAE,CAAC;YAClC,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,iBAAiB,GAAG,GAAG,CAAC,sBAAsB,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAC3E,IACC,GAAG,CAAC,2BAA2B;YAC/B,GAAG,CAAC,EAAE;YACN,GAAG,CAAC,QAAQ,KAAK,MAAM;YACvB,iBAAiB,KAAK,GAAG;YACzB,iBAAiB,KAAK,OAAO;YAC7B,iBAAiB,KAAK,KAAK;YAC3B,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK;YACpB,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,EACpB,CAAC;YACF,OAAO;QACR,CAAC;QACD,MAAM,CAAC,EAAE,cAAc,EAAE,iBAAiB,EAAE,EAAE,EAAE,oBAAoB,EAAE,CAAC,GACtE,MAAM,OAAO,CAAC,GAAG,CAAC;YACjB,MAAM,CAAC,uBAAuB,CAAC;YAC/B,MAAM,CAAC,6BAA6B,CAAC;SACrC,CAAC,CAAC;QACJ,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC;YAC1C,IAAI;YACJ,cAAc,EAAE,iBAAiB,CAAC,GAAG,CAAC;YACtC,GAAG;YACH,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,8EAA8E;IAC/E,CAAC;AACF,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAC,IAAsB;IACxD,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;QACpE,OAAO,CAAC,GAAG,CAAC,YAAY,iBAAiB,EAAE,EAAE,CAAC,CAAC;QAC/C,OAAO;IACR,CAAC;IAED,MAAM,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,iBAAiB,EAAE,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QAChE,MAAM,CAAC,eAAe,CAAC;QACvB,MAAM,CAAC,uBAAuB,CAAC;KAC/B,CAAC,CAAC;IACH,SAAS,CAAC,iBAAiB,EAAE,EAAE,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,IAAc;IAC1C,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACvE,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,OAAO;IACR,CAAC;IACD,MAAM,YAAY,GAAG,gBAAgB,GAAG,IAAI,CAAC;IAC7C,MAAM,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;IACjE,MAAM,UAAU,CAAC,IAAI,CAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAc;IAC3C,MAAM,QAAQ,GAAG,KAAK,IAAI,EAAE;QAC3B,IAAI,OAAO,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAG,SAAS,GAAG,IAAI,CAAC;YACjC,IAAI,CAAC;gBACJ,OAAO,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC;YAC9B,CAAC;YAAC,MAAM,CAAC;gBACR,OAAO,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YAClC,CAAC;QACF,CAAC;QACD,MAAM,SAAS,GAAG,SAAS,GAAG,IAAI,CAAC;QACnC,OAAO,MAAM,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,QAAQ,EAAE,CAAC;IAClC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,8BAA8B;IAC5C,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,OAAO,MAAM,CAAC,iCAAiC,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,yBAAyB,GAAG,+BAA+B,GAAG,IAAI,CAAC;IACzE,OAAO,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAC1C,CAAC;AAED,KAAK,UAAU,oBAAoB,CAAC,IAAc;IACjD,MAAM,EAAE,kCAAkC,EAAE,GAC3C,MAAM,8BAA8B,EAAE,CAAC;IACxC,IAAI,CAAC,kCAAkC,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAC/D,0BAA0B,CAC1B,CAAC;QACF,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IACD,MAAM,mBAAmB,GAAG,wBAAwB,GAAG,IAAI,CAAC;IAC5D,MAAM,EAAE,oBAAoB,EAAE,iBAAiB,EAAE,GAAG,MAAM,MAAM,CAC/D,mBAAmB,CACnB,CAAC;IACF,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC;AAChC,CAAC;AAED,KAAK,UAAU,uBAAuB,CAAC,IAAc;IACpD,IAAI,OAAO,sBAAsB,KAAK,WAAW,IAAI,sBAAsB,EAAE,CAAC;QAC7E,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,EAAE,6BAA6B,EAAE,GACtC,MAAM,8BAA8B,EAAE,CAAC;IACxC,IAAI,CAAC,6BAA6B,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,OAAO,KAAK,CAAC;IACd,CAAC;IACD,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,GAAG,GAAG,KAAK,IAAI,EAAE;IACtB,IAAI,CAAC;QACJ,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACnC,MAAM,aAAa,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,aAAa,GAAa,EAAE,CAAC;QACjC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC7D,CAAC,EAAE,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAAC,CAAC;YAC3C,SAAS,GAAG,IAAI,CAAC;QAClB,CAAC;QACD,IAAI,uBAAuB,CAAC,aAAa,EAAE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,MAAM,mBAAmB,CAAC,aAAa,CAAC,CAAC;YACzC,OAAO;QACR,CAAC;QAED,IAAI,CAAC,SAAS,EAAE,CAAC;YAChB,MAAM,EAAE,kBAAkB,EAAE,GAAG,MAAM,MAAM,CAAC,eAAe,CAAC,CAAC;YAC7D,CAAC,EAAE,aAAa,EAAE,GAAG,kBAAkB,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,MAAM,4BAA4B,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;QACxD,IAAI,iCAAiC,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7C,MAAM,cAAc,CAAC,IAAI,CAAC,CAAC;YAC3B,OAAO;QACR,CAAC;QACD,IAAI,MAAM,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO;QACR,CAAC;QACD,IAAI,MAAM,uBAAuB,CAAC,IAAI,CAAC,EAAE,CAAC;YACzC,OAAO;QACR,CAAC;QACD,MAAM,aAAa,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACd,IAAI,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACpB,CAAC;QACD,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;QAC/B,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;AACF,CAAC,CAAC;AAEF,wGAAwG;AACxG,KAAK,GAAG,EAAE,CAAC","sourcesContent":["#!/usr/bin/env node\n\ndeclare const MAESTRO_BUNDLE_RUNTIME: boolean | undefined;\n\n// Suppress punycode deprecation warning from dependencies\n// This warning comes from old dependencies still using the deprecated punycode module\nimport {\n\ttype ImmediateCliExit,\n\tgetImmediateCliExit,\n\tshouldUseInstantCliExit,\n} from \"./cli/instant-exit.js\";\n\nconst originalEmit = process.emit.bind(process) as (\n\tevent: string | symbol,\n\t...args: unknown[]\n) => boolean;\nprocess.emit = ((event: string | symbol, ...args: unknown[]) => {\n\tif (event === \"warning\") {\n\t\tconst [firstArg] = args;\n\t\tif (\n\t\t\ttypeof firstArg === \"object\" &&\n\t\t\tfirstArg !== null &&\n\t\t\t\"name\" in firstArg &&\n\t\t\t\"code\" in firstArg &&\n\t\t\t(firstArg as { name?: string; code?: string }).name ===\n\t\t\t\t\"DeprecationWarning\" &&\n\t\t\t(firstArg as { name?: string; code?: string }).code === \"DEP0040\"\n\t\t) {\n\t\t\treturn false; // Suppress punycode deprecation\n\t\t}\n\t}\n\treturn originalEmit(event, ...args);\n}) as typeof process.emit;\n\nfunction isHeadlessInvocation(args: string[]): boolean {\n\tfor (let i = 0; i < args.length; i++) {\n\t\tconst arg = args[i];\n\t\tif (arg === \"--headless\") {\n\t\t\treturn true;\n\t\t}\n\t\tif (arg === \"--mode\" && args[i + 1] === \"headless\") {\n\t\t\treturn true;\n\t\t}\n\t\tif (\n\t\t\targ?.startsWith(\"--mode=\") &&\n\t\t\targ.slice(\"--mode=\".length) === \"headless\"\n\t\t) {\n\t\t\treturn true;\n\t\t}\n\t}\n\treturn false;\n}\n\n// Keep this detector local: importing the shared command runtime detector is the\n// pre-main work the exec fast path avoids.\nconst EXEC_RUNTIME_FLAGS_WITH_VALUES = new Set([\n\t\"--mode\",\n\t\"--provider\",\n\t\"--model\",\n\t\"-m\",\n\t\"--task-budget\",\n\t\"--models\",\n\t\"--models-file\",\n\t\"--api-key\",\n\t\"--port\",\n\t\"--system-prompt\",\n\t\"--append-system-prompt\",\n\t\"--session\",\n\t\"--approval-mode\",\n\t\"--auth\",\n\t\"--sandbox\",\n\t\"--output-schema\",\n\t\"--output-last-message\",\n\t\"--tools\",\n\t\"--composer\",\n\t\"--format\",\n\t\"--profile\",\n\t\"--config\",\n\t\"--junit\",\n\t\"--replay\",\n\t\"--record-scenario\",\n]);\n\nfunction getLauncherRuntimeCommand(args: readonly string[]): string | null {\n\tfor (let index = 0; index < args.length; index++) {\n\t\tconst arg = args[index];\n\t\tif (!arg) {\n\t\t\tcontinue;\n\t\t}\n\t\tif (EXEC_RUNTIME_FLAGS_WITH_VALUES.has(arg) && index + 1 < args.length) {\n\t\t\tindex++;\n\t\t\tcontinue;\n\t\t}\n\t\tif (arg.startsWith(\"-\")) {\n\t\t\tcontinue;\n\t\t}\n\t\treturn arg;\n\t}\n\treturn null;\n}\n\nfunction shouldUseFastUnbundledExecRuntime(args: readonly string[]): boolean {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\treturn false;\n\t}\n\treturn getLauncherRuntimeCommand(args) === \"exec\";\n}\n\nfunction emitHeadlessStartupError(error: unknown): void {\n\tconst message = error instanceof Error ? error.message : String(error);\n\tconst stack = error instanceof Error ? error.stack : undefined;\n\ttry {\n\t\tprocess.stdout.write(\n\t\t\t`${JSON.stringify({\n\t\t\t\ttype: \"error\",\n\t\t\t\tmessage: `Headless startup failed: ${message}`,\n\t\t\t\tfatal: true,\n\t\t\t\terror_type: \"fatal\",\n\t\t\t})}\\n`,\n\t\t);\n\t} catch {\n\t\t// If stdout is unavailable there is no protocol channel left to use.\n\t}\n\tprocess.stderr.write(`${stack ?? message}\\n`);\n}\n\nasync function reportFatalCliError(error: unknown): Promise<void> {\n\ttry {\n\t\tconst { captureSentryException, flushSentry, initSentry } = await import(\n\t\t\t\"./sentry.js\"\n\t\t);\n\t\tinitSentry(\"maestro-cli\");\n\t\tcaptureSentryException(error);\n\t\tawait flushSentry();\n\t} catch {\n\t\t// Sentry reporting is best-effort and must not mask the original failure.\n\t}\n}\n\nasync function refreshInstalledCliOnStartup(\n\targs: string[],\n\tignoredEnvKeys: string[] = [],\n): Promise<void> {\n\ttry {\n\t\tconst env = { ...process.env };\n\t\tfor (const key of ignoredEnvKeys) {\n\t\t\tdelete env[key];\n\t\t}\n\t\tconst startupUpdateMode = env.MAESTRO_STARTUP_UPDATE?.trim().toLowerCase();\n\t\tif (\n\t\t\tenv.MAESTRO_SKIP_STARTUP_UPDATE ||\n\t\t\tenv.CI ||\n\t\t\tenv.NODE_ENV === \"test\" ||\n\t\t\tstartupUpdateMode === \"0\" ||\n\t\t\tstartupUpdateMode === \"false\" ||\n\t\t\tstartupUpdateMode === \"off\" ||\n\t\t\t!process.stdin.isTTY ||\n\t\t\t!process.stdout.isTTY\n\t\t) {\n\t\t\treturn;\n\t\t}\n\t\tconst [{ getPackageName, getPackageVersion }, { attemptStartupUpdate }] =\n\t\t\tawait Promise.all([\n\t\t\t\timport(\"./package-metadata.js\"),\n\t\t\t\timport(\"./update/startup-refresh.js\"),\n\t\t\t]);\n\t\tconst outcome = await attemptStartupUpdate({\n\t\t\targs,\n\t\t\tcurrentVersion: getPackageVersion(env),\n\t\t\tenv,\n\t\t\tpackageName: getPackageName(env),\n\t\t});\n\t\tif (outcome.status === \"restarted\") {\n\t\t\tprocess.exit(outcome.exitCode);\n\t\t}\n\t} catch {\n\t\t// Startup refresh is best-effort and must never prevent the CLI from booting.\n\t}\n}\n\nasync function runImmediateCliExit(exit: ImmediateCliExit): Promise<void> {\n\tif (exit.kind === \"version\") {\n\t\tconst { getPackageVersion } = await import(\"./package-metadata.js\");\n\t\tconsole.log(`Maestro v${getPackageVersion()}`);\n\t\treturn;\n\t}\n\n\tconst [{ printHelp }, { getPackageVersion }] = await Promise.all([\n\t\timport(\"./cli/help.js\"),\n\t\timport(\"./package-metadata.js\"),\n\t]);\n\tprintHelp(getPackageVersion(), { includeHidden: exit.includeHidden });\n}\n\nasync function runCliRuntime(args: string[]): Promise<void> {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\tconst { runCliRuntime: runRuntime } = await import(\"./cli-runtime.js\");\n\t\tawait runRuntime(args);\n\t\treturn;\n\t}\n\tconst runtimeEntry = \"./cli-runtime.\" + \"js\";\n\tconst { runCliRuntime: runRuntime } = await import(runtimeEntry);\n\tawait runRuntime(args);\n}\n\nasync function runMainRuntime(args: string[]): Promise<void> {\n\tconst loadMain = async () => {\n\t\tif (process.versions?.bun) {\n\t\t\tconst tsEntry = \"./main.\" + \"ts\";\n\t\t\ttry {\n\t\t\t\treturn await import(tsEntry);\n\t\t\t} catch {\n\t\t\t\treturn await import(\"./main.js\");\n\t\t\t}\n\t\t}\n\t\tconst mainEntry = \"./main.\" + \"js\";\n\t\treturn import(mainEntry);\n\t};\n\n\tconst { main } = await loadMain();\n\tawait main(args);\n}\n\nasync function loadDirectRuntimeCommandModule() {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\treturn import(\"./cli/direct-runtime-command.js\");\n\t}\n\tconst directRuntimeCommandEntry = \"./cli/direct-runtime-command.\" + \"js\";\n\treturn import(directRuntimeCommandEntry);\n}\n\nasync function runCliCommandRuntime(args: string[]): Promise<boolean> {\n\tconst { shouldAttemptDirectRuntimeDispatch } =\n\t\tawait loadDirectRuntimeCommandModule();\n\tif (!shouldAttemptDirectRuntimeDispatch(args)) {\n\t\treturn false;\n\t}\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\tconst { runCliCommandRuntime: runCommandRuntime } = await import(\n\t\t\t\"./cli-command-runtime.js\"\n\t\t);\n\t\treturn runCommandRuntime(args);\n\t}\n\tconst commandRuntimeEntry = \"./cli-command-runtime.\" + \"js\";\n\tconst { runCliCommandRuntime: runCommandRuntime } = await import(\n\t\tcommandRuntimeEntry\n\t);\n\treturn runCommandRuntime(args);\n}\n\nasync function runUnbundledMainRuntime(args: string[]): Promise<boolean> {\n\tif (typeof MAESTRO_BUNDLE_RUNTIME !== \"undefined\" && MAESTRO_BUNDLE_RUNTIME) {\n\t\treturn false;\n\t}\n\tconst { shouldUseUnbundledMainRuntime } =\n\t\tawait loadDirectRuntimeCommandModule();\n\tif (!shouldUseUnbundledMainRuntime(args)) {\n\t\treturn false;\n\t}\n\tawait runMainRuntime(args);\n\treturn true;\n}\n\nconst run = async () => {\n\ttry {\n\t\tconst args = process.argv.slice(2);\n\t\tconst immediateExit = getImmediateCliExit(args);\n\t\tlet envLoaded = false;\n\t\tlet loadedEnvKeys: string[] = [];\n\t\tif (immediateExit !== null) {\n\t\t\tconst { loadAndFinalizeEnv } = await import(\"./load-env.js\");\n\t\t\t({ loadedEnvKeys } = loadAndFinalizeEnv());\n\t\t\tenvLoaded = true;\n\t\t}\n\t\tif (shouldUseInstantCliExit(immediateExit, process.env)) {\n\t\t\tawait runImmediateCliExit(immediateExit);\n\t\t\treturn;\n\t\t}\n\n\t\tif (!envLoaded) {\n\t\t\tconst { loadAndFinalizeEnv } = await import(\"./load-env.js\");\n\t\t\t({ loadedEnvKeys } = loadAndFinalizeEnv());\n\t\t}\n\t\tawait refreshInstalledCliOnStartup(args, loadedEnvKeys);\n\t\tif (shouldUseFastUnbundledExecRuntime(args)) {\n\t\t\tawait runMainRuntime(args);\n\t\t\treturn;\n\t\t}\n\t\tif (await runCliCommandRuntime(args)) {\n\t\t\treturn;\n\t\t}\n\t\tif (await runUnbundledMainRuntime(args)) {\n\t\t\treturn;\n\t\t}\n\t\tawait runCliRuntime(args);\n\t} catch (err) {\n\t\tif (isHeadlessInvocation(process.argv.slice(2))) {\n\t\t\temitHeadlessStartupError(err);\n\t\t} else {\n\t\t\tconsole.error(err);\n\t\t}\n\t\tawait reportFatalCliError(err);\n\t\tprocess.exit(1);\n\t}\n};\n\n// Call without top-level await so Bun's bytecode compilation (which forbids TLA) can bundle this entry.\nvoid run();\n"]}

package/dist/db/health.d.ts

@@ -1,4 +1,4 @@
-export declare const CRITICAL_DATABASE_TABLES: readonly ["_composer_migrations", "organizations", "users", "sessions", "webhook_deliveries", "distributed_locks", "usage_metrics", "execution_traces", "workspace_config", "revenue_attribution"];
+export declare const CRITICAL_DATABASE_TABLES: readonly ["_composer_migrations", "organizations", "users", "sessions", "webhook_deliveries", "distributed_locks", "usage_metrics", "execution_traces", "operating_layer_evidence", "workspace_config", "revenue_attribution"];
 export interface CriticalTableCheck {
     name: (typeof CRITICAL_DATABASE_TABLES)[number];
     exists: boolean;

package/dist/db/health.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/db/health.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,oMAW3B,CAAC;AAEX,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAuBD,wBAAsB,mBAAmB,CACxC,MAAM,GAAE,SAAS,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,EAA6B,GACrF,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqC/B"}
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/db/health.ts"],"names":[],"mappings":"AAGA,eAAO,MAAM,wBAAwB,gOAY3B,CAAC;AAEX,MAAM,WAAW,kBAAkB;IAClC,IAAI,EAAE,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAC;IAChD,MAAM,EAAE,OAAO,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC1B;AAgCD,wBAAsB,mBAAmB,CACxC,MAAM,GAAE,SAAS,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,EAA6B,GACrF,OAAO,CAAC,kBAAkB,EAAE,CAAC,CAqC/B"}

package/dist/db/health.js

@@ -9,6 +9,7 @@ export const CRITICAL_DATABASE_TABLES = [
     "distributed_locks",
     "usage_metrics",
     "execution_traces",
+    "operating_layer_evidence",
     "workspace_config",
     "revenue_attribution",
 ];
@@ -29,6 +30,15 @@ const CRITICAL_DATABASE_COLUMNS = {
         "delivered_at",
         "created_at",
     ],
+    operating_layer_evidence: [
+        "id",
+        "capability_id",
+        "evidence_kind",
+        "subject",
+        "status",
+        "evidence",
+        "recorded_at",
+    ],
 };
 export async function checkCriticalTables(tables = CRITICAL_DATABASE_TABLES) {
     const db = getDb();

package/dist/db/health.js.map

@@ -1 +1 @@
-{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/db/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACvC,sBAAsB;IACtB,eAAe;IACf,OAAO;IACP,UAAU;IACV,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,kBAAkB;IAClB,qBAAqB;CACZ,CAAC;AAQX,MAAM,yBAAyB,GAE3B;IACH,kBAAkB,EAAE;QACnB,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,SAAS;QACT,WAAW;QACX,QAAQ;QACR,UAAU;QACV,cAAc;QACd,eAAe;QACf,YAAY;QACZ,kBAAkB;QAClB,uBAAuB;QACvB,cAAc;QACd,YAAY;KACZ;CACD,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,SAA+D,wBAAwB;IAEvF,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,UAAU,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;wBACb,aAAa;GAClC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAmC,CAAC;QACnE,MAAM,eAAe,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;wBAIrB,SAAS;IAC7B,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAoC;iBAC3D,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;iBACnC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC5D,CAAC;YACF,cAAc,GAAG,eAAe,CAAC,MAAM,CACtC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CACtC,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI;YAC5B,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC","sourcesContent":["import { sql } from \"drizzle-orm\";\nimport { getDb } from \"./client.js\";\n\nexport const CRITICAL_DATABASE_TABLES = [\n\t\"_composer_migrations\",\n\t\"organizations\",\n\t\"users\",\n\t\"sessions\",\n\t\"webhook_deliveries\",\n\t\"distributed_locks\",\n\t\"usage_metrics\",\n\t\"execution_traces\",\n\t\"workspace_config\",\n\t\"revenue_attribution\",\n] as const;\n\nexport interface CriticalTableCheck {\n\tname: (typeof CRITICAL_DATABASE_TABLES)[number];\n\texists: boolean;\n\tmissingColumns?: string[];\n}\n\nconst CRITICAL_DATABASE_COLUMNS: Partial<\n\tRecord<(typeof CRITICAL_DATABASE_TABLES)[number], readonly string[]>\n> = {\n\twebhook_deliveries: [\n\t\t\"id\",\n\t\t\"org_id\",\n\t\t\"url\",\n\t\t\"payload\",\n\t\t\"signature\",\n\t\t\"status\",\n\t\t\"attempts\",\n\t\t\"max_attempts\",\n\t\t\"next_retry_at\",\n\t\t\"last_error\",\n\t\t\"last_status_code\",\n\t\t\"last_response_time_ms\",\n\t\t\"delivered_at\",\n\t\t\"created_at\",\n\t],\n};\n\nexport async function checkCriticalTables(\n\ttables: readonly (typeof CRITICAL_DATABASE_TABLES)[number][] = CRITICAL_DATABASE_TABLES,\n): Promise<CriticalTableCheck[]> {\n\tconst db = getDb();\n\tconst checks: CriticalTableCheck[] = [];\n\n\tfor (const tableName of tables) {\n\t\tconst qualifiedName = `public.${tableName}`;\n\t\tconst result = await db.execute(sql`\n\t\t\tSELECT to_regclass(${qualifiedName}) IS NOT NULL AS exists\n\t\t`);\n\t\tconst [row] = Array.from(result) as Array<Record<string, unknown>>;\n\t\tconst requiredColumns = CRITICAL_DATABASE_COLUMNS[tableName] ?? [];\n\t\tlet missingColumns: string[] = [];\n\t\tif (row?.exists === true && requiredColumns.length > 0) {\n\t\t\tconst columnsResult = await db.execute(sql`\n\t\t\t\tSELECT column_name\n\t\t\t\tFROM information_schema.columns\n\t\t\t\tWHERE table_schema = 'public'\n\t\t\t\t\tAND table_name = ${tableName}\n\t\t\t`);\n\t\t\tconst actualColumns = new Set(\n\t\t\t\t(Array.from(columnsResult) as Array<Record<string, unknown>>)\n\t\t\t\t\t.map((column) => column.column_name)\n\t\t\t\t\t.filter((name): name is string => typeof name === \"string\"),\n\t\t\t);\n\t\t\tmissingColumns = requiredColumns.filter(\n\t\t\t\t(column) => !actualColumns.has(column),\n\t\t\t);\n\t\t}\n\n\t\tchecks.push({\n\t\t\tname: tableName,\n\t\t\texists: row?.exists === true,\n\t\t\t...(missingColumns.length > 0 ? { missingColumns } : {}),\n\t\t});\n\t}\n\n\treturn checks;\n}\n"]}
+{"version":3,"file":"health.js","sourceRoot":"","sources":["../../src/db/health.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEpC,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACvC,sBAAsB;IACtB,eAAe;IACf,OAAO;IACP,UAAU;IACV,oBAAoB;IACpB,mBAAmB;IACnB,eAAe;IACf,kBAAkB;IAClB,0BAA0B;IAC1B,kBAAkB;IAClB,qBAAqB;CACZ,CAAC;AAQX,MAAM,yBAAyB,GAE3B;IACH,kBAAkB,EAAE;QACnB,IAAI;QACJ,QAAQ;QACR,KAAK;QACL,SAAS;QACT,WAAW;QACX,QAAQ;QACR,UAAU;QACV,cAAc;QACd,eAAe;QACf,YAAY;QACZ,kBAAkB;QAClB,uBAAuB;QACvB,cAAc;QACd,YAAY;KACZ;IACD,wBAAwB,EAAE;QACzB,IAAI;QACJ,eAAe;QACf,eAAe;QACf,SAAS;QACT,QAAQ;QACR,UAAU;QACV,aAAa;KACb;CACD,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,SAA+D,wBAAwB;IAEvF,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,MAAM,GAAyB,EAAE,CAAC;IAExC,KAAK,MAAM,SAAS,IAAI,MAAM,EAAE,CAAC;QAChC,MAAM,aAAa,GAAG,UAAU,SAAS,EAAE,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;wBACb,aAAa;GAClC,CAAC,CAAC;QACH,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,MAAM,CAAmC,CAAC;QACnE,MAAM,eAAe,GAAG,yBAAyB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;QACnE,IAAI,cAAc,GAAa,EAAE,CAAC;QAClC,IAAI,GAAG,EAAE,MAAM,KAAK,IAAI,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,aAAa,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,GAAG,CAAA;;;;wBAIrB,SAAS;IAC7B,CAAC,CAAC;YACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAC3B,KAAK,CAAC,IAAI,CAAC,aAAa,CAAoC;iBAC3D,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,WAAW,CAAC;iBACnC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,IAAI,KAAK,QAAQ,CAAC,CAC5D,CAAC;YACF,cAAc,GAAG,eAAe,CAAC,MAAM,CACtC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CACtC,CAAC;QACH,CAAC;QAED,MAAM,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,GAAG,EAAE,MAAM,KAAK,IAAI;YAC5B,GAAG,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACxD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC;AACf,CAAC","sourcesContent":["import { sql } from \"drizzle-orm\";\nimport { getDb } from \"./client.js\";\n\nexport const CRITICAL_DATABASE_TABLES = [\n\t\"_composer_migrations\",\n\t\"organizations\",\n\t\"users\",\n\t\"sessions\",\n\t\"webhook_deliveries\",\n\t\"distributed_locks\",\n\t\"usage_metrics\",\n\t\"execution_traces\",\n\t\"operating_layer_evidence\",\n\t\"workspace_config\",\n\t\"revenue_attribution\",\n] as const;\n\nexport interface CriticalTableCheck {\n\tname: (typeof CRITICAL_DATABASE_TABLES)[number];\n\texists: boolean;\n\tmissingColumns?: string[];\n}\n\nconst CRITICAL_DATABASE_COLUMNS: Partial<\n\tRecord<(typeof CRITICAL_DATABASE_TABLES)[number], readonly string[]>\n> = {\n\twebhook_deliveries: [\n\t\t\"id\",\n\t\t\"org_id\",\n\t\t\"url\",\n\t\t\"payload\",\n\t\t\"signature\",\n\t\t\"status\",\n\t\t\"attempts\",\n\t\t\"max_attempts\",\n\t\t\"next_retry_at\",\n\t\t\"last_error\",\n\t\t\"last_status_code\",\n\t\t\"last_response_time_ms\",\n\t\t\"delivered_at\",\n\t\t\"created_at\",\n\t],\n\toperating_layer_evidence: [\n\t\t\"id\",\n\t\t\"capability_id\",\n\t\t\"evidence_kind\",\n\t\t\"subject\",\n\t\t\"status\",\n\t\t\"evidence\",\n\t\t\"recorded_at\",\n\t],\n};\n\nexport async function checkCriticalTables(\n\ttables: readonly (typeof CRITICAL_DATABASE_TABLES)[number][] = CRITICAL_DATABASE_TABLES,\n): Promise<CriticalTableCheck[]> {\n\tconst db = getDb();\n\tconst checks: CriticalTableCheck[] = [];\n\n\tfor (const tableName of tables) {\n\t\tconst qualifiedName = `public.${tableName}`;\n\t\tconst result = await db.execute(sql`\n\t\t\tSELECT to_regclass(${qualifiedName}) IS NOT NULL AS exists\n\t\t`);\n\t\tconst [row] = Array.from(result) as Array<Record<string, unknown>>;\n\t\tconst requiredColumns = CRITICAL_DATABASE_COLUMNS[tableName] ?? [];\n\t\tlet missingColumns: string[] = [];\n\t\tif (row?.exists === true && requiredColumns.length > 0) {\n\t\t\tconst columnsResult = await db.execute(sql`\n\t\t\t\tSELECT column_name\n\t\t\t\tFROM information_schema.columns\n\t\t\t\tWHERE table_schema = 'public'\n\t\t\t\t\tAND table_name = ${tableName}\n\t\t\t`);\n\t\t\tconst actualColumns = new Set(\n\t\t\t\t(Array.from(columnsResult) as Array<Record<string, unknown>>)\n\t\t\t\t\t.map((column) => column.column_name)\n\t\t\t\t\t.filter((name): name is string => typeof name === \"string\"),\n\t\t\t);\n\t\t\tmissingColumns = requiredColumns.filter(\n\t\t\t\t(column) => !actualColumns.has(column),\n\t\t\t);\n\t\t}\n\n\t\tchecks.push({\n\t\t\tname: tableName,\n\t\t\texists: row?.exists === true,\n\t\t\t...(missingColumns.length > 0 ? { missingColumns } : {}),\n\t\t});\n\t}\n\n\treturn checks;\n}\n"]}

package/dist/db/migrations/0009_operating_layer_evidence.sql

@@ -0,0 +1,30 @@
+CREATE TABLE IF NOT EXISTS "operating_layer_evidence" (
+	"id" uuid PRIMARY KEY DEFAULT gen_random_uuid() NOT NULL,
+	"org_id" uuid,
+	"session_id" varchar(255),
+	"capability_id" varchar(64) NOT NULL,
+	"evidence_kind" varchar(128) NOT NULL,
+	"subject" varchar(255) NOT NULL,
+	"status" varchar(32) DEFAULT 'recorded' NOT NULL,
+	"score" integer,
+	"blockers" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"warnings" jsonb DEFAULT '[]'::jsonb NOT NULL,
+	"evidence" jsonb NOT NULL,
+	"metadata" jsonb DEFAULT '{}'::jsonb,
+	"recorded_at" timestamp with time zone DEFAULT now() NOT NULL,
+	"expires_at" timestamp with time zone,
+	CONSTRAINT "operating_layer_evidence_org_id_organizations_id_fk"
+		FOREIGN KEY ("org_id") REFERENCES "organizations"("id") ON DELETE cascade
+);
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "operating_layer_evidence_capability_recorded_idx"
+	ON "operating_layer_evidence" ("capability_id", "recorded_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "operating_layer_evidence_org_recorded_idx"
+	ON "operating_layer_evidence" ("org_id", "recorded_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "operating_layer_evidence_session_recorded_idx"
+	ON "operating_layer_evidence" ("session_id", "recorded_at");
+--> statement-breakpoint
+CREATE INDEX IF NOT EXISTS "operating_layer_evidence_expiry_idx"
+	ON "operating_layer_evidence" ("expires_at");

package/dist/db/migrations/meta/_journal.json

@@ -64,6 +64,13 @@
 			"when": 1777303800000,
 			"tag": "0008_reconcile_legacy_webhook_deliveries",
 			"breakpoints": true
+		},
+		{
+			"idx": 9,
+			"version": "7",
+			"when": 1781749800000,
+			"tag": "0009_operating_layer_evidence",
+			"breakpoints": true
 		}
 	]
 }

package/dist/db/schema.d.ts

@@ -1740,6 +1740,269 @@ export declare const hostedSessionEntries: import("drizzle-orm/pg-core").PgTable
     };
     dialect: "pg";
 }>;
+export declare const operatingLayerEvidence: import("drizzle-orm/pg-core").PgTableWithColumns<{
+    name: "operating_layer_evidence";
+    schema: undefined;
+    columns: {
+        id: import("drizzle-orm/pg-core").PgColumn<{
+            name: "id";
+            tableName: "operating_layer_evidence";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: true;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        orgId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "org_id";
+            tableName: "operating_layer_evidence";
+            dataType: "string";
+            columnType: "PgUUID";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        sessionId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "session_id";
+            tableName: "operating_layer_evidence";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        capabilityId: import("drizzle-orm/pg-core").PgColumn<{
+            name: "capability_id";
+            tableName: "operating_layer_evidence";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 64;
+        }>;
+        evidenceKind: import("drizzle-orm/pg-core").PgColumn<{
+            name: "evidence_kind";
+            tableName: "operating_layer_evidence";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 128;
+        }>;
+        subject: import("drizzle-orm/pg-core").PgColumn<{
+            name: "subject";
+            tableName: "operating_layer_evidence";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 255;
+        }>;
+        status: import("drizzle-orm/pg-core").PgColumn<{
+            name: "status";
+            tableName: "operating_layer_evidence";
+            dataType: "string";
+            columnType: "PgVarchar";
+            data: string;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            length: 32;
+        }>;
+        score: import("drizzle-orm/pg-core").PgColumn<{
+            name: "score";
+            tableName: "operating_layer_evidence";
+            dataType: "number";
+            columnType: "PgInteger";
+            data: number;
+            driverParam: string | number;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        blockers: import("drizzle-orm/pg-core").PgColumn<{
+            name: "blockers";
+            tableName: "operating_layer_evidence";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        warnings: import("drizzle-orm/pg-core").PgColumn<{
+            name: "warnings";
+            tableName: "operating_layer_evidence";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: string[];
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: string[];
+        }>;
+        evidence: import("drizzle-orm/pg-core").PgColumn<{
+            name: "evidence";
+            tableName: "operating_layer_evidence";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: unknown;
+            driverParam: unknown;
+            notNull: true;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: unknown;
+        }>;
+        metadata: import("drizzle-orm/pg-core").PgColumn<{
+            name: "metadata";
+            tableName: "operating_layer_evidence";
+            dataType: "json";
+            columnType: "PgJsonb";
+            data: Record<string, unknown>;
+            driverParam: unknown;
+            notNull: false;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {
+            $type: Record<string, unknown>;
+        }>;
+        recordedAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "recorded_at";
+            tableName: "operating_layer_evidence";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: true;
+            hasDefault: true;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        expiresAt: import("drizzle-orm/pg-core").PgColumn<{
+            name: "expires_at";
+            tableName: "operating_layer_evidence";
+            dataType: "date";
+            columnType: "PgTimestamp";
+            data: Date;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: undefined;
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+    };
+    dialect: "pg";
+}>;
 export declare const auditLogs: import("drizzle-orm/pg-core").PgTableWithColumns<{
     name: "audit_logs";
     schema: undefined;