@evalops/maestro 0.10.49 → 0.10.50

package/dist/node_modules/@evalops/contracts/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@evalops/contracts",
-	"version": "0.10.49",
+	"version": "0.10.50",
 	"description": "Shared Maestro contracts for frontend/backend integration",
 	"type": "module",
 	"main": "./dist/index.js",

package/dist/node_modules/@evalops/tui/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@evalops/tui",
-	"version": "0.10.49",
+	"version": "0.10.50",
 	"description": "Terminal UI library with differential rendering for Maestro",
 	"type": "module",
 	"main": "./dist/index.js",

package/dist/platform/operating-layer.d.ts

@@ -0,0 +1,127 @@
+export declare const MAESTRO_OPERATING_LAYER_VERSION = "evalops.maestro.operating-layer.v1";
+export type OperatingLayerCapabilityId = "protocol-boundary" | "policy-resolution" | "sync-outbox" | "approval-evidence" | "extension-governance" | "run-readiness" | "run-effectiveness" | "release-canary";
+export interface OperatingLayerCapability {
+    id: OperatingLayerCapabilityId;
+    name: string;
+    description: string;
+    evidenceKinds: string[];
+}
+export interface OperatingLayerManifest {
+    version: typeof MAESTRO_OPERATING_LAYER_VERSION;
+    capabilities: OperatingLayerCapability[];
+}
+export declare const OPERATING_LAYER_CAPABILITIES: OperatingLayerCapability[];
+export interface ProtocolBoundaryInput {
+    protocolId: string;
+    version: string;
+    owners?: string[];
+    contracts?: string[];
+    compatibility?: "experimental" | "stable" | "deprecated";
+}
+export interface ProtocolBoundaryDescriptor extends ProtocolBoundaryInput {
+    compatibility: "experimental" | "stable" | "deprecated";
+    reasons: string[];
+}
+export interface PolicyResolutionSource<T = unknown> {
+    layer: "default" | "runtime" | "user" | "workspace" | "project" | "organization" | "session";
+    id: string;
+    value: T;
+    reason?: string;
+}
+export interface PolicyResolutionExplanation<T = unknown> {
+    subject: string;
+    resolvedValue: T | undefined;
+    activeSource?: PolicyResolutionSource<T>;
+    chain: Array<PolicyResolutionSource<T> & {
+        overrides: string[];
+    }>;
+    reasons: string[];
+}
+export type SyncOutboxKind = "session_create" | "session_update" | "message" | "settings" | "artifact" | "approval";
+export interface SyncOutboxItem {
+    id: string;
+    kind: SyncOutboxKind;
+    sessionId?: string;
+    status: "pending" | "in_flight" | "succeeded" | "failed" | "blocked";
+    attempt: number;
+    maxAttempts: number;
+}
+export interface SyncOutcome {
+    ok: boolean;
+    statusCode?: number;
+    errorCode?: string;
+}
+export interface SyncOutboxDecision {
+    action: "complete" | "retry" | "self_heal_session" | "block";
+    reason: string;
+    nextAttempt: number;
+}
+export interface ApprovalDecisionInput {
+    requestId: string;
+    surface: "cli" | "tui" | "web" | "mcp" | "api";
+    mode: "suggest" | "ask" | "auto" | "deny";
+    decision: "approved" | "denied" | "expired";
+    toolNames?: string[];
+    policyRefs?: string[];
+}
+export interface ApprovalDecisionEvidence extends ApprovalDecisionInput {
+    approvedTools: string[];
+    blockedTools: string[];
+    reasons: string[];
+}
+export interface ExtensionCandidate {
+    id: string;
+    source: "builtin" | "marketplace" | "local" | "git";
+    publisher?: string;
+    signed?: boolean;
+    pinnedRef?: string;
+    requestedScopes?: string[];
+}
+export interface ExtensionGovernancePolicy {
+    allowedSources?: ExtensionCandidate["source"][];
+    trustedPublishers?: string[];
+    allowedScopes?: string[];
+    requireSignature?: boolean;
+    requirePinnedGitRef?: boolean;
+}
+export interface ExtensionGovernanceDecision {
+    allowed: boolean;
+    blockers: string[];
+    reasons: string[];
+}
+export interface OperatingLayerSignal {
+    id: string;
+    label: string;
+    status: "pass" | "warn" | "fail" | "unknown";
+    weight?: number;
+    evidence?: string[];
+}
+export interface OperatingLayerScoreReport {
+    version: typeof MAESTRO_OPERATING_LAYER_VERSION;
+    score: number;
+    blockers: string[];
+    warnings: string[];
+    signals: OperatingLayerSignal[];
+}
+export interface ReleaseCanaryStage {
+    id: string;
+    name: string;
+    requires: string[];
+    evidenceKinds: string[];
+}
+export interface ReleaseCanaryPlan {
+    version: typeof MAESTRO_OPERATING_LAYER_VERSION;
+    stages: ReleaseCanaryStage[];
+    blockers: string[];
+}
+export declare function buildOperatingLayerManifest(): OperatingLayerManifest;
+export declare function buildProtocolBoundaryDescriptor(input: ProtocolBoundaryInput): ProtocolBoundaryDescriptor;
+export declare function explainResolvedPolicy<T>(subject: string, sources: PolicyResolutionSource<T>[]): PolicyResolutionExplanation<T>;
+export declare function classifySyncOutcome(item: SyncOutboxItem, outcome: SyncOutcome): SyncOutboxDecision;
+export declare function buildApprovalDecisionEvidence(input: ApprovalDecisionInput): ApprovalDecisionEvidence;
+export declare function evaluateExtensionGovernance(candidate: ExtensionCandidate, policy?: ExtensionGovernancePolicy): ExtensionGovernanceDecision;
+export declare function buildRunReadinessReport(signals: OperatingLayerSignal[]): OperatingLayerScoreReport;
+export declare function buildRunEffectivenessReport(signals: OperatingLayerSignal[]): OperatingLayerScoreReport;
+export declare const DEFAULT_RELEASE_CANARY_STAGES: ReleaseCanaryStage[];
+export declare function buildReleaseCanaryPlan(stages?: ReleaseCanaryStage[]): ReleaseCanaryPlan;
+//# sourceMappingURL=operating-layer.d.ts.map

package/dist/platform/operating-layer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operating-layer.d.ts","sourceRoot":"","sources":["../../src/platform/operating-layer.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,+BAA+B,uCACP,CAAC;AAEtC,MAAM,MAAM,0BAA0B,GACnC,mBAAmB,GACnB,mBAAmB,GACnB,aAAa,GACb,mBAAmB,GACnB,sBAAsB,GACtB,eAAe,GACf,mBAAmB,GACnB,gBAAgB,CAAC;AAEpB,MAAM,WAAW,wBAAwB;IACxC,EAAE,EAAE,0BAA0B,CAAC;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,sBAAsB;IACtC,OAAO,EAAE,OAAO,+BAA+B,CAAC;IAChD,YAAY,EAAE,wBAAwB,EAAE,CAAC;CACzC;AAED,eAAO,MAAM,4BAA4B,EAAE,wBAAwB,EAoElE,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,aAAa,CAAC,EAAE,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;CACzD;AAED,MAAM,WAAW,0BAA2B,SAAQ,qBAAqB;IACxE,aAAa,EAAE,cAAc,GAAG,QAAQ,GAAG,YAAY,CAAC;IACxD,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB,CAAC,CAAC,GAAG,OAAO;IAClD,KAAK,EACF,SAAS,GACT,SAAS,GACT,MAAM,GACN,WAAW,GACX,SAAS,GACT,cAAc,GACd,SAAS,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,CAAC,CAAC;IACT,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B,CAAC,CAAC,GAAG,OAAO;IACvD,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,EAAE,CAAC,GAAG,SAAS,CAAC;IAC7B,YAAY,CAAC,EAAE,sBAAsB,CAAC,CAAC,CAAC,CAAC;IACzC,KAAK,EAAE,KAAK,CACX,sBAAsB,CAAC,CAAC,CAAC,GAAG;QAC3B,SAAS,EAAE,MAAM,EAAE,CAAC;KACpB,CACD,CAAC;IACF,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,MAAM,cAAc,GACvB,gBAAgB,GAChB,gBAAgB,GAChB,SAAS,GACT,UAAU,GACV,UAAU,GACV,UAAU,CAAC;AAEd,MAAM,WAAW,cAAc;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,cAAc,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,SAAS,GAAG,WAAW,GAAG,WAAW,GAAG,QAAQ,GAAG,SAAS,CAAC;IACrE,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,WAAW;IAC3B,EAAE,EAAE,OAAO,CAAC;IACZ,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IAClC,MAAM,EAAE,UAAU,GAAG,OAAO,GAAG,mBAAmB,GAAG,OAAO,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,GAAG,KAAK,CAAC;IAC/C,IAAI,EAAE,SAAS,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,QAAQ,EAAE,UAAU,GAAG,QAAQ,GAAG,SAAS,CAAC;IAC5C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,wBAAyB,SAAQ,qBAAqB;IACtE,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,SAAS,GAAG,aAAa,GAAG,OAAO,GAAG,KAAK,CAAC;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,yBAAyB;IACzC,cAAc,CAAC,EAAE,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC;IAChD,iBAAiB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC9B;AAED,MAAM,WAAW,2BAA2B;IAC3C,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,oBAAoB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,SAAS,CAAC;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,OAAO,+BAA+B,CAAC;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,OAAO,EAAE,oBAAoB,EAAE,CAAC;CAChC;AAED,MAAM,WAAW,kBAAkB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,iBAAiB;IACjC,OAAO,EAAE,OAAO,+BAA+B,CAAC;IAChD,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,QAAQ,EAAE,MAAM,EAAE,CAAC;CACnB;AAUD,wBAAgB,2BAA2B,IAAI,sBAAsB,CAKpE;AAED,wBAAgB,+BAA+B,CAC9C,KAAK,EAAE,qBAAqB,GAC1B,0BAA0B,CAiB5B;AAED,wBAAgB,qBAAqB,CAAC,CAAC,EACtC,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,sBAAsB,CAAC,CAAC,CAAC,EAAE,GAClC,2BAA2B,CAAC,CAAC,CAAC,CAkBhC;AAED,wBAAgB,mBAAmB,CAClC,IAAI,EAAE,cAAc,EACpB,OAAO,EAAE,WAAW,GAClB,kBAAkB,CAmCpB;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,qBAAqB,GAC1B,wBAAwB,CAe1B;AAED,wBAAgB,2BAA2B,CAC1C,SAAS,EAAE,kBAAkB,EAC7B,MAAM,GAAE,yBAA8B,GACpC,2BAA2B,CAuD7B;AAED,wBAAgB,uBAAuB,CACtC,OAAO,EAAE,oBAAoB,EAAE,GAC7B,yBAAyB,CAE3B;AAED,wBAAgB,2BAA2B,CAC1C,OAAO,EAAE,oBAAoB,EAAE,GAC7B,yBAAyB,CAE3B;AAqCD,eAAO,MAAM,6BAA6B,EAAE,kBAAkB,EA+B7D,CAAC;AAEF,wBAAgB,sBAAsB,CACrC,MAAM,CAAC,EAAE,kBAAkB,EAAE,GAC3B,iBAAiB,CAkCnB"}

package/dist/platform/operating-layer.js

@@ -0,0 +1,354 @@
+export const MAESTRO_OPERATING_LAYER_VERSION = "evalops.maestro.operating-layer.v1";
+export const OPERATING_LAYER_CAPABILITIES = [
+    {
+        id: "protocol-boundary",
+        name: "Protocol boundary",
+        description: "Treats versioned protocols as the product integration surface.",
+        evidenceKinds: ["protocol.version", "protocol.contract", "protocol.owner"],
+    },
+    {
+        id: "policy-resolution",
+        name: "Policy resolution",
+        description: "Explains the source and override chain for resolved settings.",
+        evidenceKinds: ["policy.subject", "policy.source", "policy.resolved_value"],
+    },
+    {
+        id: "sync-outbox",
+        name: "Sync outbox",
+        description: "Classifies cloud/session sync outcomes into durable retry actions.",
+        evidenceKinds: ["sync.item", "sync.outcome", "sync.next_action"],
+    },
+    {
+        id: "approval-evidence",
+        name: "Approval evidence",
+        description: "Normalizes permission decisions across tool and product surfaces.",
+        evidenceKinds: [
+            "approval.request",
+            "approval.decision",
+            "approval.surface",
+        ],
+    },
+    {
+        id: "extension-governance",
+        name: "Extension governance",
+        description: "Evaluates extensions against marketplace trust and scope policy.",
+        evidenceKinds: [
+            "extension.source",
+            "extension.signature",
+            "extension.scopes",
+        ],
+    },
+    {
+        id: "run-readiness",
+        name: "Run readiness",
+        description: "Scores whether a run has enough evidence to proceed or ship.",
+        evidenceKinds: ["readiness.signal", "readiness.score", "readiness.blocker"],
+    },
+    {
+        id: "run-effectiveness",
+        name: "Run effectiveness",
+        description: "Scores completed work against outcome and confidence signals.",
+        evidenceKinds: [
+            "effectiveness.signal",
+            "effectiveness.score",
+            "effectiveness.evidence",
+        ],
+    },
+    {
+        id: "release-canary",
+        name: "Release canary",
+        description: "Defines ordered gates for publish, smoke, replay, and notification.",
+        evidenceKinds: ["release.stage", "release.gate", "release.evidence"],
+    },
+];
+function unique(values) {
+    return [...new Set(values)];
+}
+function normalizedList(values) {
+    return unique((values ?? []).map((value) => value.trim()).filter(Boolean));
+}
+export function buildOperatingLayerManifest() {
+    return {
+        version: MAESTRO_OPERATING_LAYER_VERSION,
+        capabilities: OPERATING_LAYER_CAPABILITIES,
+    };
+}
+export function buildProtocolBoundaryDescriptor(input) {
+    const owners = normalizedList(input.owners);
+    const contracts = normalizedList(input.contracts);
+    const reasons = [
+        `protocol:${input.protocolId}`,
+        `version:${input.version}`,
+        ...owners.map((owner) => `owner:${owner}`),
+        ...contracts.map((contract) => `contract:${contract}`),
+    ];
+    return {
+        ...input,
+        owners,
+        contracts,
+        compatibility: input.compatibility ?? "experimental",
+        reasons,
+    };
+}
+export function explainResolvedPolicy(subject, sources) {
+    const activeSource = sources.at(-1);
+    return {
+        subject,
+        resolvedValue: activeSource?.value,
+        ...(activeSource ? { activeSource } : {}),
+        chain: sources.map((source, index) => ({
+            ...source,
+            overrides: sources.slice(0, index).map((prior) => prior.id),
+        })),
+        reasons: [
+            `subject:${subject}`,
+            ...(activeSource ? [`active_source:${activeSource.id}`] : []),
+            ...sources.flatMap((source) => source.reason ? [`reason:${source.id}:${source.reason}`] : []),
+        ],
+    };
+}
+export function classifySyncOutcome(item, outcome) {
+    const nextAttempt = item.attempt + 1;
+    if (outcome.ok) {
+        return {
+            action: "complete",
+            reason: "sync_ok",
+            nextAttempt,
+        };
+    }
+    if (item.attempt >= item.maxAttempts) {
+        return {
+            action: "block",
+            reason: outcome.errorCode ?? "max_attempts_exhausted",
+            nextAttempt,
+        };
+    }
+    if (item.kind !== "session_create" &&
+        item.sessionId &&
+        (outcome.statusCode === 404 || outcome.statusCode === 410)) {
+        return {
+            action: "self_heal_session",
+            reason: "remote_session_missing",
+            nextAttempt,
+        };
+    }
+    return {
+        action: "retry",
+        reason: outcome.errorCode ?? `http_${outcome.statusCode ?? "unknown"}`,
+        nextAttempt,
+    };
+}
+export function buildApprovalDecisionEvidence(input) {
+    const toolNames = normalizedList(input.toolNames);
+    const approved = input.decision === "approved";
+    return {
+        ...input,
+        toolNames,
+        policyRefs: normalizedList(input.policyRefs),
+        approvedTools: approved ? toolNames : [],
+        blockedTools: approved ? [] : toolNames,
+        reasons: [
+            `surface:${input.surface}`,
+            `mode:${input.mode}`,
+            `decision:${input.decision}`,
+        ],
+    };
+}
+export function evaluateExtensionGovernance(candidate, policy = {}) {
+    const blockers = [];
+    const reasons = [`source:${candidate.source}`];
+    const allowedSources = new Set(policy.allowedSources ?? []);
+    if (policy.allowedSources !== undefined &&
+        !allowedSources.has(candidate.source)) {
+        blockers.push(`source_not_allowed:${candidate.source}`);
+    }
+    if (policy.requireSignature && !candidate.signed) {
+        blockers.push("signature_required");
+    }
+    if (policy.requirePinnedGitRef &&
+        candidate.source === "git" &&
+        !candidate.pinnedRef) {
+        blockers.push("pinned_git_ref_required");
+    }
+    const trustedPublishers = new Set(policy.trustedPublishers ?? []);
+    if (candidate.source === "marketplace" &&
+        candidate.publisher &&
+        trustedPublishers.has(candidate.publisher)) {
+        reasons.push(`trusted_publisher:${candidate.publisher}`);
+    }
+    else if (policy.trustedPublishers !== undefined &&
+        candidate.source === "marketplace") {
+        blockers.push(`publisher_not_trusted:${candidate.publisher ?? "unknown"}`);
+    }
+    const allowedScopes = new Set(policy.allowedScopes ?? []);
+    const requestedScopes = normalizedList(candidate.requestedScopes);
+    for (const scope of requestedScopes) {
+        if (policy.allowedScopes !== undefined && !allowedScopes.has(scope)) {
+            blockers.push(`scope_not_allowed:${scope}`);
+        }
+    }
+    reasons.push(...requestedScopes.map((scope) => `scope:${scope}`));
+    if (candidate.signed) {
+        reasons.push("signed");
+    }
+    if (candidate.pinnedRef) {
+        reasons.push(`pinned_ref:${candidate.pinnedRef}`);
+    }
+    return {
+        allowed: blockers.length === 0,
+        blockers: unique(blockers),
+        reasons: unique(reasons),
+    };
+}
+export function buildRunReadinessReport(signals) {
+    return buildScoreReport(signals, "readiness");
+}
+export function buildRunEffectivenessReport(signals) {
+    return buildScoreReport(signals, "effectiveness");
+}
+function buildScoreReport(signals, prefix) {
+    let earned = 0;
+    let possible = 0;
+    const blockers = [];
+    const warnings = [];
+    for (const signal of signals) {
+        const weight = signal.weight ?? 1;
+        if (signal.status !== "unknown") {
+            possible += weight;
+        }
+        if (signal.status === "pass") {
+            earned += weight;
+        }
+        if (signal.status === "warn") {
+            earned += weight / 2;
+            warnings.push(`${prefix}:${signal.id}`);
+        }
+        if (signal.status === "fail") {
+            blockers.push(`${prefix}:${signal.id}`);
+        }
+    }
+    return {
+        version: MAESTRO_OPERATING_LAYER_VERSION,
+        score: possible === 0 ? 0 : Math.round((earned / possible) * 100),
+        blockers,
+        warnings,
+        signals,
+    };
+}
+export const DEFAULT_RELEASE_CANARY_STAGES = [
+    {
+        id: "local_release_gate",
+        name: "Local release gate",
+        requires: [],
+        evidenceKinds: ["lint", "test", "build", "release.check"],
+    },
+    {
+        id: "publish_package",
+        name: "Publish package",
+        requires: ["local_release_gate"],
+        evidenceKinds: ["npm.publish", "git.tag", "github.release"],
+    },
+    {
+        id: "registry_install_smoke",
+        name: "Registry install smoke",
+        requires: ["publish_package"],
+        evidenceKinds: ["npm.install", "cli.smoke"],
+    },
+    {
+        id: "published_replay_evidence",
+        name: "Published replay evidence",
+        requires: ["registry_install_smoke"],
+        evidenceKinds: ["replay.e2e", "evidence.verify"],
+    },
+    {
+        id: "release_notification",
+        name: "Release notification",
+        requires: ["published_replay_evidence"],
+        evidenceKinds: ["release.notes", "channel.notification"],
+    },
+];
+export function buildReleaseCanaryPlan(stages) {
+    const planStages = cloneReleaseCanaryStages(stages ?? DEFAULT_RELEASE_CANARY_STAGES);
+    const stageIds = new Set(planStages.map((stage) => stage.id));
+    const stageIndexes = new Map();
+    for (const [index, stage] of planStages.entries()) {
+        if (!stageIndexes.has(stage.id)) {
+            stageIndexes.set(stage.id, index);
+        }
+    }
+    const blockers = [
+        ...detectDuplicateReleaseCanaryStages(planStages),
+        ...planStages.flatMap((stage) => stage.requires
+            .filter((required) => !stageIds.has(required))
+            .map((required) => `missing_stage:${stage.id}:${required}`)),
+        ...planStages.flatMap((stage, index) => stage.requires
+            .filter((required) => {
+            const requiredIndex = stageIndexes.get(required);
+            return requiredIndex !== undefined && requiredIndex > index;
+        })
+            .map((required) => `out_of_order_stage:${stage.id}:${required}`)),
+        ...detectReleaseCanaryCycles(planStages),
+    ];
+    return {
+        version: MAESTRO_OPERATING_LAYER_VERSION,
+        stages: planStages,
+        blockers,
+    };
+}
+function cloneReleaseCanaryStages(stages) {
+    return stages.map((stage) => ({
+        ...stage,
+        requires: [...stage.requires],
+        evidenceKinds: [...stage.evidenceKinds],
+    }));
+}
+function detectDuplicateReleaseCanaryStages(stages) {
+    const seen = new Set();
+    const blockers = [];
+    for (const stage of stages) {
+        if (seen.has(stage.id)) {
+            blockers.push(`duplicate_stage:${stage.id}`);
+        }
+        seen.add(stage.id);
+    }
+    return unique(blockers);
+}
+function detectReleaseCanaryCycles(stages) {
+    const requirementsById = new Map();
+    for (const stage of stages) {
+        const requirements = requirementsById.get(stage.id) ?? new Set();
+        for (const required of stage.requires) {
+            requirements.add(required);
+        }
+        requirementsById.set(stage.id, requirements);
+    }
+    const visiting = new Set();
+    const visited = new Set();
+    const blockers = [];
+    function visit(stageId, path) {
+        if (visiting.has(stageId)) {
+            const cycleStart = path.indexOf(stageId);
+            const cycle = path.slice(cycleStart).join(">");
+            blockers.push(`cycle:${cycle}`);
+            return;
+        }
+        if (visited.has(stageId)) {
+            return;
+        }
+        const requirements = requirementsById.get(stageId);
+        if (!requirements) {
+            return;
+        }
+        visiting.add(stageId);
+        for (const required of requirements) {
+            visit(required, [...path, required]);
+        }
+        visiting.delete(stageId);
+        visited.add(stageId);
+    }
+    for (const stage of stages) {
+        visit(stage.id, [stage.id]);
+    }
+    return unique(blockers);
+}
+//# sourceMappingURL=operating-layer.js.map

package/dist/platform/operating-layer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operating-layer.js","sourceRoot":"","sources":["../../src/platform/operating-layer.ts"],"names":[],"mappings":"AAAA,MAAM,CAAC,MAAM,+BAA+B,GAC3C,oCAAoC,CAAC;AAwBtC,MAAM,CAAC,MAAM,4BAA4B,GAA+B;IACvE;QACC,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACV,gEAAgE;QACjE,aAAa,EAAE,CAAC,kBAAkB,EAAE,mBAAmB,EAAE,gBAAgB,CAAC;KAC1E;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACV,+DAA+D;QAChE,aAAa,EAAE,CAAC,gBAAgB,EAAE,eAAe,EAAE,uBAAuB,CAAC;KAC3E;IACD;QACC,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,aAAa;QACnB,WAAW,EACV,oEAAoE;QACrE,aAAa,EAAE,CAAC,WAAW,EAAE,cAAc,EAAE,kBAAkB,CAAC;KAChE;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACV,mEAAmE;QACpE,aAAa,EAAE;YACd,kBAAkB;YAClB,mBAAmB;YACnB,kBAAkB;SAClB;KACD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,sBAAsB;QAC5B,WAAW,EACV,kEAAkE;QACnE,aAAa,EAAE;YACd,kBAAkB;YAClB,qBAAqB;YACrB,kBAAkB;SAClB;KACD;IACD;QACC,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,eAAe;QACrB,WAAW,EAAE,8DAA8D;QAC3E,aAAa,EAAE,CAAC,kBAAkB,EAAE,iBAAiB,EAAE,mBAAmB,CAAC;KAC3E;IACD;QACC,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,mBAAmB;QACzB,WAAW,EACV,+DAA+D;QAChE,aAAa,EAAE;YACd,sBAAsB;YACtB,qBAAqB;YACrB,wBAAwB;SACxB;KACD;IACD;QACC,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gBAAgB;QACtB,WAAW,EACV,qEAAqE;QACtE,aAAa,EAAE,CAAC,eAAe,EAAE,cAAc,EAAE,kBAAkB,CAAC;KACpE;CACD,CAAC;AAyIF,SAAS,MAAM,CAAC,MAAgB;IAC/B,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,cAAc,CAAC,MAA4B;IACnD,OAAO,MAAM,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;AAC5E,CAAC;AAED,MAAM,UAAU,2BAA2B;IAC1C,OAAO;QACN,OAAO,EAAE,+BAA+B;QACxC,YAAY,EAAE,4BAA4B;KAC1C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,KAA4B;IAE5B,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,OAAO,GAAG;QACf,YAAY,KAAK,CAAC,UAAU,EAAE;QAC9B,WAAW,KAAK,CAAC,OAAO,EAAE;QAC1B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC;QAC1C,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,QAAQ,EAAE,CAAC;KACtD,CAAC;IAEF,OAAO;QACN,GAAG,KAAK;QACR,MAAM;QACN,SAAS;QACT,aAAa,EAAE,KAAK,CAAC,aAAa,IAAI,cAAc;QACpD,OAAO;KACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CACpC,OAAe,EACf,OAAoC;IAEpC,MAAM,YAAY,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpC,OAAO;QACN,OAAO;QACP,aAAa,EAAE,YAAY,EAAE,KAAK;QAClC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;YACtC,GAAG,MAAM;YACT,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,EAAE;YACR,WAAW,OAAO,EAAE;YACpB,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,iBAAiB,YAAY,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAC7B,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,MAAM,CAAC,EAAE,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAC7D;SACD;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAClC,IAAoB,EACpB,OAAoB;IAEpB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC,CAAC;IACrC,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO;YACN,MAAM,EAAE,UAAU;YAClB,MAAM,EAAE,SAAS;YACjB,WAAW;SACX,CAAC;IACH,CAAC;IAED,IAAI,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;QACtC,OAAO;YACN,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,OAAO,CAAC,SAAS,IAAI,wBAAwB;YACrD,WAAW;SACX,CAAC;IACH,CAAC;IAED,IACC,IAAI,CAAC,IAAI,KAAK,gBAAgB;QAC9B,IAAI,CAAC,SAAS;QACd,CAAC,OAAO,CAAC,UAAU,KAAK,GAAG,IAAI,OAAO,CAAC,UAAU,KAAK,GAAG,CAAC,EACzD,CAAC;QACF,OAAO;YACN,MAAM,EAAE,mBAAmB;YAC3B,MAAM,EAAE,wBAAwB;YAChC,WAAW;SACX,CAAC;IACH,CAAC;IAED,OAAO;QACN,MAAM,EAAE,OAAO;QACf,MAAM,EAAE,OAAO,CAAC,SAAS,IAAI,QAAQ,OAAO,CAAC,UAAU,IAAI,SAAS,EAAE;QACtE,WAAW;KACX,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,KAA4B;IAE5B,MAAM,SAAS,GAAG,cAAc,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAClD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,KAAK,UAAU,CAAC;IAC/C,OAAO;QACN,GAAG,KAAK;QACR,SAAS;QACT,UAAU,EAAE,cAAc,CAAC,KAAK,CAAC,UAAU,CAAC;QAC5C,aAAa,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACxC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS;QACvC,OAAO,EAAE;YACR,WAAW,KAAK,CAAC,OAAO,EAAE;YAC1B,QAAQ,KAAK,CAAC,IAAI,EAAE;YACpB,YAAY,KAAK,CAAC,QAAQ,EAAE;SAC5B;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,SAA6B,EAC7B,SAAoC,EAAE;IAEtC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,UAAU,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/C,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC;IAC5D,IACC,MAAM,CAAC,cAAc,KAAK,SAAS;QACnC,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,EACpC,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,sBAAsB,SAAS,CAAC,MAAM,EAAE,CAAC,CAAC;IACzD,CAAC;IACD,IAAI,MAAM,CAAC,gBAAgB,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;QAClD,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;IACrC,CAAC;IACD,IACC,MAAM,CAAC,mBAAmB;QAC1B,SAAS,CAAC,MAAM,KAAK,KAAK;QAC1B,CAAC,SAAS,CAAC,SAAS,EACnB,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,yBAAyB,CAAC,CAAC;IAC1C,CAAC;IAED,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,iBAAiB,IAAI,EAAE,CAAC,CAAC;IAClE,IACC,SAAS,CAAC,MAAM,KAAK,aAAa;QAClC,SAAS,CAAC,SAAS;QACnB,iBAAiB,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,EACzC,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,qBAAqB,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IAC1D,CAAC;SAAM,IACN,MAAM,CAAC,iBAAiB,KAAK,SAAS;QACtC,SAAS,CAAC,MAAM,KAAK,aAAa,EACjC,CAAC;QACF,QAAQ,CAAC,IAAI,CAAC,yBAAyB,SAAS,CAAC,SAAS,IAAI,SAAS,EAAE,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC1D,MAAM,eAAe,GAAG,cAAc,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC;IAClE,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACrC,IAAI,MAAM,CAAC,aAAa,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACrE,QAAQ,CAAC,IAAI,CAAC,qBAAqB,KAAK,EAAE,CAAC,CAAC;QAC7C,CAAC;IACF,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC;IAClE,IAAI,SAAS,CAAC,MAAM,EAAE,CAAC;QACtB,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC;QACzB,OAAO,CAAC,IAAI,CAAC,cAAc,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACN,OAAO,EAAE,QAAQ,CAAC,MAAM,KAAK,CAAC;QAC9B,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC;KACxB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACtC,OAA+B;IAE/B,OAAO,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;AAC/C,CAAC;AAED,MAAM,UAAU,2BAA2B,CAC1C,OAA+B;IAE/B,OAAO,gBAAgB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,gBAAgB,CACxB,OAA+B,EAC/B,MAAqC;IAErC,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACjC,QAAQ,IAAI,MAAM,CAAC;QACpB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,MAAM,CAAC;QAClB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,MAAM,IAAI,MAAM,GAAG,CAAC,CAAC;YACrB,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC9B,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;QACzC,CAAC;IACF,CAAC;IAED,OAAO;QACN,OAAO,EAAE,+BAA+B;QACxC,KAAK,EAAE,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC;QACjE,QAAQ;QACR,QAAQ;QACR,OAAO;KACP,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,6BAA6B,GAAyB;IAClE;QACC,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,EAAE;QACZ,aAAa,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,eAAe,CAAC;KACzD;IACD;QACC,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,CAAC,oBAAoB,CAAC;QAChC,aAAa,EAAE,CAAC,aAAa,EAAE,SAAS,EAAE,gBAAgB,CAAC;KAC3D;IACD;QACC,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,CAAC,iBAAiB,CAAC;QAC7B,aAAa,EAAE,CAAC,aAAa,EAAE,WAAW,CAAC;KAC3C;IACD;QACC,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,2BAA2B;QACjC,QAAQ,EAAE,CAAC,wBAAwB,CAAC;QACpC,aAAa,EAAE,CAAC,YAAY,EAAE,iBAAiB,CAAC;KAChD;IACD;QACC,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,CAAC,2BAA2B,CAAC;QACvC,aAAa,EAAE,CAAC,eAAe,EAAE,sBAAsB,CAAC;KACxD;CACD,CAAC;AAEF,MAAM,UAAU,sBAAsB,CACrC,MAA6B;IAE7B,MAAM,UAAU,GAAG,wBAAwB,CAC1C,MAAM,IAAI,6BAA6B,CACvC,CAAC;IACF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC/C,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC;QACnD,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACjC,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACnC,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG;QAChB,GAAG,kCAAkC,CAAC,UAAU,CAAC;QACjD,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC/B,KAAK,CAAC,QAAQ;aACZ,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;aAC7C,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,iBAAiB,KAAK,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CAC5D;QACD,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CACtC,KAAK,CAAC,QAAQ;aACZ,MAAM,CAAC,CAAC,QAAQ,EAAE,EAAE;YACpB,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YACjD,OAAO,aAAa,KAAK,SAAS,IAAI,aAAa,GAAG,KAAK,CAAC;QAC7D,CAAC,CAAC;aACD,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,sBAAsB,KAAK,CAAC,EAAE,IAAI,QAAQ,EAAE,CAAC,CACjE;QACD,GAAG,yBAAyB,CAAC,UAAU,CAAC;KACxC,CAAC;IAEF,OAAO;QACN,OAAO,EAAE,+BAA+B;QACxC,MAAM,EAAE,UAAU;QAClB,QAAQ;KACR,CAAC;AACH,CAAC;AAED,SAAS,wBAAwB,CAChC,MAA4B;IAE5B,OAAO,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAC7B,GAAG,KAAK;QACR,QAAQ,EAAE,CAAC,GAAG,KAAK,CAAC,QAAQ,CAAC;QAC7B,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC;KACvC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kCAAkC,CAC1C,MAA4B;IAE5B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC;YACxB,QAAQ,CAAC,IAAI,CAAC,mBAAmB,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,yBAAyB,CAAC,MAA4B;IAC9D,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAuB,CAAC;IACxD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,EAAU,CAAC;QACzE,KAAK,MAAM,QAAQ,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;YACvC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;QACD,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,YAAY,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAE9B,SAAS,KAAK,CAAC,OAAe,EAAE,IAAc;QAC7C,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC/C,QAAQ,CAAC,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC;YAChC,OAAO;QACR,CAAC;QACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC1B,OAAO;QACR,CAAC;QAED,MAAM,YAAY,GAAG,gBAAgB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACnD,IAAI,CAAC,YAAY,EAAE,CAAC;YACnB,OAAO;QACR,CAAC;QAED,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QACtB,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACrC,KAAK,CAAC,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,QAAQ,CAAC,CAAC,CAAC;QACtC,CAAC;QACD,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,KAAK,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IAC7B,CAAC;IAED,OAAO,MAAM,CAAC,QAAQ,CAAC,CAAC;AACzB,CAAC","sourcesContent":["export const MAESTRO_OPERATING_LAYER_VERSION =\n\t\"evalops.maestro.operating-layer.v1\";\n\nexport type OperatingLayerCapabilityId =\n\t| \"protocol-boundary\"\n\t| \"policy-resolution\"\n\t| \"sync-outbox\"\n\t| \"approval-evidence\"\n\t| \"extension-governance\"\n\t| \"run-readiness\"\n\t| \"run-effectiveness\"\n\t| \"release-canary\";\n\nexport interface OperatingLayerCapability {\n\tid: OperatingLayerCapabilityId;\n\tname: string;\n\tdescription: string;\n\tevidenceKinds: string[];\n}\n\nexport interface OperatingLayerManifest {\n\tversion: typeof MAESTRO_OPERATING_LAYER_VERSION;\n\tcapabilities: OperatingLayerCapability[];\n}\n\nexport const OPERATING_LAYER_CAPABILITIES: OperatingLayerCapability[] = [\n\t{\n\t\tid: \"protocol-boundary\",\n\t\tname: \"Protocol boundary\",\n\t\tdescription:\n\t\t\t\"Treats versioned protocols as the product integration surface.\",\n\t\tevidenceKinds: [\"protocol.version\", \"protocol.contract\", \"protocol.owner\"],\n\t},\n\t{\n\t\tid: \"policy-resolution\",\n\t\tname: \"Policy resolution\",\n\t\tdescription:\n\t\t\t\"Explains the source and override chain for resolved settings.\",\n\t\tevidenceKinds: [\"policy.subject\", \"policy.source\", \"policy.resolved_value\"],\n\t},\n\t{\n\t\tid: \"sync-outbox\",\n\t\tname: \"Sync outbox\",\n\t\tdescription:\n\t\t\t\"Classifies cloud/session sync outcomes into durable retry actions.\",\n\t\tevidenceKinds: [\"sync.item\", \"sync.outcome\", \"sync.next_action\"],\n\t},\n\t{\n\t\tid: \"approval-evidence\",\n\t\tname: \"Approval evidence\",\n\t\tdescription:\n\t\t\t\"Normalizes permission decisions across tool and product surfaces.\",\n\t\tevidenceKinds: [\n\t\t\t\"approval.request\",\n\t\t\t\"approval.decision\",\n\t\t\t\"approval.surface\",\n\t\t],\n\t},\n\t{\n\t\tid: \"extension-governance\",\n\t\tname: \"Extension governance\",\n\t\tdescription:\n\t\t\t\"Evaluates extensions against marketplace trust and scope policy.\",\n\t\tevidenceKinds: [\n\t\t\t\"extension.source\",\n\t\t\t\"extension.signature\",\n\t\t\t\"extension.scopes\",\n\t\t],\n\t},\n\t{\n\t\tid: \"run-readiness\",\n\t\tname: \"Run readiness\",\n\t\tdescription: \"Scores whether a run has enough evidence to proceed or ship.\",\n\t\tevidenceKinds: [\"readiness.signal\", \"readiness.score\", \"readiness.blocker\"],\n\t},\n\t{\n\t\tid: \"run-effectiveness\",\n\t\tname: \"Run effectiveness\",\n\t\tdescription:\n\t\t\t\"Scores completed work against outcome and confidence signals.\",\n\t\tevidenceKinds: [\n\t\t\t\"effectiveness.signal\",\n\t\t\t\"effectiveness.score\",\n\t\t\t\"effectiveness.evidence\",\n\t\t],\n\t},\n\t{\n\t\tid: \"release-canary\",\n\t\tname: \"Release canary\",\n\t\tdescription:\n\t\t\t\"Defines ordered gates for publish, smoke, replay, and notification.\",\n\t\tevidenceKinds: [\"release.stage\", \"release.gate\", \"release.evidence\"],\n\t},\n];\n\nexport interface ProtocolBoundaryInput {\n\tprotocolId: string;\n\tversion: string;\n\towners?: string[];\n\tcontracts?: string[];\n\tcompatibility?: \"experimental\" | \"stable\" | \"deprecated\";\n}\n\nexport interface ProtocolBoundaryDescriptor extends ProtocolBoundaryInput {\n\tcompatibility: \"experimental\" | \"stable\" | \"deprecated\";\n\treasons: string[];\n}\n\nexport interface PolicyResolutionSource<T = unknown> {\n\tlayer:\n\t\t| \"default\"\n\t\t| \"runtime\"\n\t\t| \"user\"\n\t\t| \"workspace\"\n\t\t| \"project\"\n\t\t| \"organization\"\n\t\t| \"session\";\n\tid: string;\n\tvalue: T;\n\treason?: string;\n}\n\nexport interface PolicyResolutionExplanation<T = unknown> {\n\tsubject: string;\n\tresolvedValue: T | undefined;\n\tactiveSource?: PolicyResolutionSource<T>;\n\tchain: Array<\n\t\tPolicyResolutionSource<T> & {\n\t\t\toverrides: string[];\n\t\t}\n\t>;\n\treasons: string[];\n}\n\nexport type SyncOutboxKind =\n\t| \"session_create\"\n\t| \"session_update\"\n\t| \"message\"\n\t| \"settings\"\n\t| \"artifact\"\n\t| \"approval\";\n\nexport interface SyncOutboxItem {\n\tid: string;\n\tkind: SyncOutboxKind;\n\tsessionId?: string;\n\tstatus: \"pending\" | \"in_flight\" | \"succeeded\" | \"failed\" | \"blocked\";\n\tattempt: number;\n\tmaxAttempts: number;\n}\n\nexport interface SyncOutcome {\n\tok: boolean;\n\tstatusCode?: number;\n\terrorCode?: string;\n}\n\nexport interface SyncOutboxDecision {\n\taction: \"complete\" | \"retry\" | \"self_heal_session\" | \"block\";\n\treason: string;\n\tnextAttempt: number;\n}\n\nexport interface ApprovalDecisionInput {\n\trequestId: string;\n\tsurface: \"cli\" | \"tui\" | \"web\" | \"mcp\" | \"api\";\n\tmode: \"suggest\" | \"ask\" | \"auto\" | \"deny\";\n\tdecision: \"approved\" | \"denied\" | \"expired\";\n\ttoolNames?: string[];\n\tpolicyRefs?: string[];\n}\n\nexport interface ApprovalDecisionEvidence extends ApprovalDecisionInput {\n\tapprovedTools: string[];\n\tblockedTools: string[];\n\treasons: string[];\n}\n\nexport interface ExtensionCandidate {\n\tid: string;\n\tsource: \"builtin\" | \"marketplace\" | \"local\" | \"git\";\n\tpublisher?: string;\n\tsigned?: boolean;\n\tpinnedRef?: string;\n\trequestedScopes?: string[];\n}\n\nexport interface ExtensionGovernancePolicy {\n\tallowedSources?: ExtensionCandidate[\"source\"][];\n\ttrustedPublishers?: string[];\n\tallowedScopes?: string[];\n\trequireSignature?: boolean;\n\trequirePinnedGitRef?: boolean;\n}\n\nexport interface ExtensionGovernanceDecision {\n\tallowed: boolean;\n\tblockers: string[];\n\treasons: string[];\n}\n\nexport interface OperatingLayerSignal {\n\tid: string;\n\tlabel: string;\n\tstatus: \"pass\" | \"warn\" | \"fail\" | \"unknown\";\n\tweight?: number;\n\tevidence?: string[];\n}\n\nexport interface OperatingLayerScoreReport {\n\tversion: typeof MAESTRO_OPERATING_LAYER_VERSION;\n\tscore: number;\n\tblockers: string[];\n\twarnings: string[];\n\tsignals: OperatingLayerSignal[];\n}\n\nexport interface ReleaseCanaryStage {\n\tid: string;\n\tname: string;\n\trequires: string[];\n\tevidenceKinds: string[];\n}\n\nexport interface ReleaseCanaryPlan {\n\tversion: typeof MAESTRO_OPERATING_LAYER_VERSION;\n\tstages: ReleaseCanaryStage[];\n\tblockers: string[];\n}\n\nfunction unique(values: string[]): string[] {\n\treturn [...new Set(values)];\n}\n\nfunction normalizedList(values: string[] | undefined): string[] {\n\treturn unique((values ?? []).map((value) => value.trim()).filter(Boolean));\n}\n\nexport function buildOperatingLayerManifest(): OperatingLayerManifest {\n\treturn {\n\t\tversion: MAESTRO_OPERATING_LAYER_VERSION,\n\t\tcapabilities: OPERATING_LAYER_CAPABILITIES,\n\t};\n}\n\nexport function buildProtocolBoundaryDescriptor(\n\tinput: ProtocolBoundaryInput,\n): ProtocolBoundaryDescriptor {\n\tconst owners = normalizedList(input.owners);\n\tconst contracts = normalizedList(input.contracts);\n\tconst reasons = [\n\t\t`protocol:${input.protocolId}`,\n\t\t`version:${input.version}`,\n\t\t...owners.map((owner) => `owner:${owner}`),\n\t\t...contracts.map((contract) => `contract:${contract}`),\n\t];\n\n\treturn {\n\t\t...input,\n\t\towners,\n\t\tcontracts,\n\t\tcompatibility: input.compatibility ?? \"experimental\",\n\t\treasons,\n\t};\n}\n\nexport function explainResolvedPolicy<T>(\n\tsubject: string,\n\tsources: PolicyResolutionSource<T>[],\n): PolicyResolutionExplanation<T> {\n\tconst activeSource = sources.at(-1);\n\treturn {\n\t\tsubject,\n\t\tresolvedValue: activeSource?.value,\n\t\t...(activeSource ? { activeSource } : {}),\n\t\tchain: sources.map((source, index) => ({\n\t\t\t...source,\n\t\t\toverrides: sources.slice(0, index).map((prior) => prior.id),\n\t\t})),\n\t\treasons: [\n\t\t\t`subject:${subject}`,\n\t\t\t...(activeSource ? [`active_source:${activeSource.id}`] : []),\n\t\t\t...sources.flatMap((source) =>\n\t\t\t\tsource.reason ? [`reason:${source.id}:${source.reason}`] : [],\n\t\t\t),\n\t\t],\n\t};\n}\n\nexport function classifySyncOutcome(\n\titem: SyncOutboxItem,\n\toutcome: SyncOutcome,\n): SyncOutboxDecision {\n\tconst nextAttempt = item.attempt + 1;\n\tif (outcome.ok) {\n\t\treturn {\n\t\t\taction: \"complete\",\n\t\t\treason: \"sync_ok\",\n\t\t\tnextAttempt,\n\t\t};\n\t}\n\n\tif (item.attempt >= item.maxAttempts) {\n\t\treturn {\n\t\t\taction: \"block\",\n\t\t\treason: outcome.errorCode ?? \"max_attempts_exhausted\",\n\t\t\tnextAttempt,\n\t\t};\n\t}\n\n\tif (\n\t\titem.kind !== \"session_create\" &&\n\t\titem.sessionId &&\n\t\t(outcome.statusCode === 404 || outcome.statusCode === 410)\n\t) {\n\t\treturn {\n\t\t\taction: \"self_heal_session\",\n\t\t\treason: \"remote_session_missing\",\n\t\t\tnextAttempt,\n\t\t};\n\t}\n\n\treturn {\n\t\taction: \"retry\",\n\t\treason: outcome.errorCode ?? `http_${outcome.statusCode ?? \"unknown\"}`,\n\t\tnextAttempt,\n\t};\n}\n\nexport function buildApprovalDecisionEvidence(\n\tinput: ApprovalDecisionInput,\n): ApprovalDecisionEvidence {\n\tconst toolNames = normalizedList(input.toolNames);\n\tconst approved = input.decision === \"approved\";\n\treturn {\n\t\t...input,\n\t\ttoolNames,\n\t\tpolicyRefs: normalizedList(input.policyRefs),\n\t\tapprovedTools: approved ? toolNames : [],\n\t\tblockedTools: approved ? [] : toolNames,\n\t\treasons: [\n\t\t\t`surface:${input.surface}`,\n\t\t\t`mode:${input.mode}`,\n\t\t\t`decision:${input.decision}`,\n\t\t],\n\t};\n}\n\nexport function evaluateExtensionGovernance(\n\tcandidate: ExtensionCandidate,\n\tpolicy: ExtensionGovernancePolicy = {},\n): ExtensionGovernanceDecision {\n\tconst blockers: string[] = [];\n\tconst reasons = [`source:${candidate.source}`];\n\tconst allowedSources = new Set(policy.allowedSources ?? []);\n\tif (\n\t\tpolicy.allowedSources !== undefined &&\n\t\t!allowedSources.has(candidate.source)\n\t) {\n\t\tblockers.push(`source_not_allowed:${candidate.source}`);\n\t}\n\tif (policy.requireSignature && !candidate.signed) {\n\t\tblockers.push(\"signature_required\");\n\t}\n\tif (\n\t\tpolicy.requirePinnedGitRef &&\n\t\tcandidate.source === \"git\" &&\n\t\t!candidate.pinnedRef\n\t) {\n\t\tblockers.push(\"pinned_git_ref_required\");\n\t}\n\n\tconst trustedPublishers = new Set(policy.trustedPublishers ?? []);\n\tif (\n\t\tcandidate.source === \"marketplace\" &&\n\t\tcandidate.publisher &&\n\t\ttrustedPublishers.has(candidate.publisher)\n\t) {\n\t\treasons.push(`trusted_publisher:${candidate.publisher}`);\n\t} else if (\n\t\tpolicy.trustedPublishers !== undefined &&\n\t\tcandidate.source === \"marketplace\"\n\t) {\n\t\tblockers.push(`publisher_not_trusted:${candidate.publisher ?? \"unknown\"}`);\n\t}\n\n\tconst allowedScopes = new Set(policy.allowedScopes ?? []);\n\tconst requestedScopes = normalizedList(candidate.requestedScopes);\n\tfor (const scope of requestedScopes) {\n\t\tif (policy.allowedScopes !== undefined && !allowedScopes.has(scope)) {\n\t\t\tblockers.push(`scope_not_allowed:${scope}`);\n\t\t}\n\t}\n\treasons.push(...requestedScopes.map((scope) => `scope:${scope}`));\n\tif (candidate.signed) {\n\t\treasons.push(\"signed\");\n\t}\n\tif (candidate.pinnedRef) {\n\t\treasons.push(`pinned_ref:${candidate.pinnedRef}`);\n\t}\n\n\treturn {\n\t\tallowed: blockers.length === 0,\n\t\tblockers: unique(blockers),\n\t\treasons: unique(reasons),\n\t};\n}\n\nexport function buildRunReadinessReport(\n\tsignals: OperatingLayerSignal[],\n): OperatingLayerScoreReport {\n\treturn buildScoreReport(signals, \"readiness\");\n}\n\nexport function buildRunEffectivenessReport(\n\tsignals: OperatingLayerSignal[],\n): OperatingLayerScoreReport {\n\treturn buildScoreReport(signals, \"effectiveness\");\n}\n\nfunction buildScoreReport(\n\tsignals: OperatingLayerSignal[],\n\tprefix: \"readiness\" | \"effectiveness\",\n): OperatingLayerScoreReport {\n\tlet earned = 0;\n\tlet possible = 0;\n\tconst blockers: string[] = [];\n\tconst warnings: string[] = [];\n\n\tfor (const signal of signals) {\n\t\tconst weight = signal.weight ?? 1;\n\t\tif (signal.status !== \"unknown\") {\n\t\t\tpossible += weight;\n\t\t}\n\t\tif (signal.status === \"pass\") {\n\t\t\tearned += weight;\n\t\t}\n\t\tif (signal.status === \"warn\") {\n\t\t\tearned += weight / 2;\n\t\t\twarnings.push(`${prefix}:${signal.id}`);\n\t\t}\n\t\tif (signal.status === \"fail\") {\n\t\t\tblockers.push(`${prefix}:${signal.id}`);\n\t\t}\n\t}\n\n\treturn {\n\t\tversion: MAESTRO_OPERATING_LAYER_VERSION,\n\t\tscore: possible === 0 ? 0 : Math.round((earned / possible) * 100),\n\t\tblockers,\n\t\twarnings,\n\t\tsignals,\n\t};\n}\n\nexport const DEFAULT_RELEASE_CANARY_STAGES: ReleaseCanaryStage[] = [\n\t{\n\t\tid: \"local_release_gate\",\n\t\tname: \"Local release gate\",\n\t\trequires: [],\n\t\tevidenceKinds: [\"lint\", \"test\", \"build\", \"release.check\"],\n\t},\n\t{\n\t\tid: \"publish_package\",\n\t\tname: \"Publish package\",\n\t\trequires: [\"local_release_gate\"],\n\t\tevidenceKinds: [\"npm.publish\", \"git.tag\", \"github.release\"],\n\t},\n\t{\n\t\tid: \"registry_install_smoke\",\n\t\tname: \"Registry install smoke\",\n\t\trequires: [\"publish_package\"],\n\t\tevidenceKinds: [\"npm.install\", \"cli.smoke\"],\n\t},\n\t{\n\t\tid: \"published_replay_evidence\",\n\t\tname: \"Published replay evidence\",\n\t\trequires: [\"registry_install_smoke\"],\n\t\tevidenceKinds: [\"replay.e2e\", \"evidence.verify\"],\n\t},\n\t{\n\t\tid: \"release_notification\",\n\t\tname: \"Release notification\",\n\t\trequires: [\"published_replay_evidence\"],\n\t\tevidenceKinds: [\"release.notes\", \"channel.notification\"],\n\t},\n];\n\nexport function buildReleaseCanaryPlan(\n\tstages?: ReleaseCanaryStage[],\n): ReleaseCanaryPlan {\n\tconst planStages = cloneReleaseCanaryStages(\n\t\tstages ?? DEFAULT_RELEASE_CANARY_STAGES,\n\t);\n\tconst stageIds = new Set(planStages.map((stage) => stage.id));\n\tconst stageIndexes = new Map<string, number>();\n\tfor (const [index, stage] of planStages.entries()) {\n\t\tif (!stageIndexes.has(stage.id)) {\n\t\t\tstageIndexes.set(stage.id, index);\n\t\t}\n\t}\n\tconst blockers = [\n\t\t...detectDuplicateReleaseCanaryStages(planStages),\n\t\t...planStages.flatMap((stage) =>\n\t\t\tstage.requires\n\t\t\t\t.filter((required) => !stageIds.has(required))\n\t\t\t\t.map((required) => `missing_stage:${stage.id}:${required}`),\n\t\t),\n\t\t...planStages.flatMap((stage, index) =>\n\t\t\tstage.requires\n\t\t\t\t.filter((required) => {\n\t\t\t\t\tconst requiredIndex = stageIndexes.get(required);\n\t\t\t\t\treturn requiredIndex !== undefined && requiredIndex > index;\n\t\t\t\t})\n\t\t\t\t.map((required) => `out_of_order_stage:${stage.id}:${required}`),\n\t\t),\n\t\t...detectReleaseCanaryCycles(planStages),\n\t];\n\n\treturn {\n\t\tversion: MAESTRO_OPERATING_LAYER_VERSION,\n\t\tstages: planStages,\n\t\tblockers,\n\t};\n}\n\nfunction cloneReleaseCanaryStages(\n\tstages: ReleaseCanaryStage[],\n): ReleaseCanaryStage[] {\n\treturn stages.map((stage) => ({\n\t\t...stage,\n\t\trequires: [...stage.requires],\n\t\tevidenceKinds: [...stage.evidenceKinds],\n\t}));\n}\n\nfunction detectDuplicateReleaseCanaryStages(\n\tstages: ReleaseCanaryStage[],\n): string[] {\n\tconst seen = new Set<string>();\n\tconst blockers: string[] = [];\n\tfor (const stage of stages) {\n\t\tif (seen.has(stage.id)) {\n\t\t\tblockers.push(`duplicate_stage:${stage.id}`);\n\t\t}\n\t\tseen.add(stage.id);\n\t}\n\treturn unique(blockers);\n}\n\nfunction detectReleaseCanaryCycles(stages: ReleaseCanaryStage[]): string[] {\n\tconst requirementsById = new Map<string, Set<string>>();\n\tfor (const stage of stages) {\n\t\tconst requirements = requirementsById.get(stage.id) ?? new Set<string>();\n\t\tfor (const required of stage.requires) {\n\t\t\trequirements.add(required);\n\t\t}\n\t\trequirementsById.set(stage.id, requirements);\n\t}\n\tconst visiting = new Set<string>();\n\tconst visited = new Set<string>();\n\tconst blockers: string[] = [];\n\n\tfunction visit(stageId: string, path: string[]): void {\n\t\tif (visiting.has(stageId)) {\n\t\t\tconst cycleStart = path.indexOf(stageId);\n\t\t\tconst cycle = path.slice(cycleStart).join(\">\");\n\t\t\tblockers.push(`cycle:${cycle}`);\n\t\t\treturn;\n\t\t}\n\t\tif (visited.has(stageId)) {\n\t\t\treturn;\n\t\t}\n\n\t\tconst requirements = requirementsById.get(stageId);\n\t\tif (!requirements) {\n\t\t\treturn;\n\t\t}\n\n\t\tvisiting.add(stageId);\n\t\tfor (const required of requirements) {\n\t\t\tvisit(required, [...path, required]);\n\t\t}\n\t\tvisiting.delete(stageId);\n\t\tvisited.add(stageId);\n\t}\n\n\tfor (const stage of stages) {\n\t\tvisit(stage.id, [stage.id]);\n\t}\n\n\treturn unique(blockers);\n}\n"]}

package/dist/version.json

@@ -1,4 +1,4 @@
 {
-  "version": "0.10.49",
-  "notes": "Maestro by EvalOps - Deterministic coding agent with TUI/CLI and Web UI for AI-assisted development v0.10.49 is now available."
+  "version": "0.10.50",
+  "notes": "Maestro by EvalOps - Deterministic coding agent with TUI/CLI and Web UI for AI-assisted development v0.10.50 is now available."
 }

package/dist/web-server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"web-server.d.ts","sourceRoot":"","sources":["../src/web-server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,cAAc,EAEnB,MAAM,WAAW,CAAC;AA+BnB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAiB5D,OAAO,KAAK,EACX,mBAAmB,EAEnB,MAAM,yBAAyB,CAAC;AAsBjC,UAAU,qBAAqB;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B;AA0FD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAsQrD,eAAO,MAAM,qBAAqB;iBACpB,eAAe;;;kBAbT,MAAM;iBAAW,MAAM;;CAgB1C,CAAC;AA+OF,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EACrC,aAAa,SAAiB,GAC5B,OAAO,CAET;AAkLD,wBAAsB,cAAc,CACnC,IAAI,SAAO,EACX,OAAO,GAAE,qBAA0B,iFA2SnC"}
+{"version":3,"file":"web-server.d.ts","sourceRoot":"","sources":["../src/web-server.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,EACN,KAAK,eAAe,EACpB,KAAK,cAAc,EAEnB,MAAM,WAAW,CAAC;AA+BnB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AASxD,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAgB5D,OAAO,KAAK,EACX,mBAAmB,EAEnB,MAAM,yBAAyB,CAAC;AAsBjC,UAAU,qBAAqB;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,YAAY,CAAC,EAAE,mBAAmB,CAAC;IACnC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACvC,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAC/B;AA0FD,OAAO,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAoQrD,eAAO,MAAM,qBAAqB;iBACpB,eAAe;;;kBAbT,MAAM;iBAAW,MAAM;;CAgB1C,CAAC;AA+OF,wBAAgB,wBAAwB,CACvC,MAAM,EAAE,MAAM,GAAG,MAAM,EAAE,GAAG,SAAS,EACrC,aAAa,SAAiB,GAC5B,OAAO,CAET;AAkLD,wBAAsB,cAAc,CACnC,IAAI,SAAO,EACX,OAAO,GAAE,qBAA0B,iFA2SnC"}

package/dist/web-server.js

@@ -14,7 +14,7 @@ import { detectRuntimeConstraintContext } from "./cli/system-prompt.js";
 import { resolveDefaultApprovalMode } from "./config/default-approval-mode.js";
 import { loadUnifiedContextManifest } from "./context/manifest.js";
 import { initLifecycle, shutdownLifecycle } from "./lifecycle.js";
-import { loadEnv, scrubLoadedSecurityOverrideEnv } from "./load-env.js";
+import { loadAndFinalizeEnv } from "./load-env.js";
 import { bootstrapLsp } from "./lsp/bootstrap.js";
 import { loadMcpConfig, mcpManager } from "./mcp/index.js";
 import { prefetchOfficialMcpRegistry } from "./mcp/official-registry.js";
@@ -27,7 +27,6 @@ import { resolveMaestroSystemPrompt } from "./prompts/system-prompt.js";
 import { getEnvVarsForProvider } from "./providers/api-keys.js";
 import { createAuthResolver, } from "./providers/auth.js";
 import { registerBackgroundTaskShutdownHooks } from "./runtime/background-task-hooks.js";
-import { resetDefaultRuntimeEnv } from "./runtime/env.js";
 import { configureSafeMode } from "./safety/safe-mode.js";
 import { HostedRunnerDrainReasonValue, HostedRunnerDrainStatusValue, drainHostedRunnerForShutdown, } from "./server/handlers/hosted-runner-drain.js";
 import { createWorkspaceConfigMiddleware } from "./services/workspace-config/middleware.js";
@@ -93,9 +92,7 @@ import { webComposerManagers } from "./server/web-composer-registry.js";
 import { resolveWebRoot } from "./server/web-root.js";
 // Re-export for existing test imports
 export { SseSession } from "./server/sse-session.js";
-loadEnv();
-scrubLoadedSecurityOverrideEnv();
-resetDefaultRuntimeEnv();
+loadAndFinalizeEnv();
 void initOpenTelemetry("composer-web-server");
 initSentry("maestro-web-server");
 // Global crash handlers