@evalops/maestro 0.10.49 → 0.10.51

package/dist/providers/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACN,gCAAgC,EAChC,6BAA6B,EAC7B,cAAc,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACN,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAoCjE,SAAS,gBAAgB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,cAAc;QAC7B,CAAC,UAAU,KAAK,QAAQ;YACvB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAChC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,UAAU,KAAK,cAAc,CAAC;AACtC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,oBAAoB,CACzE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACrD,OAAO,mCAAmC,CAAC,QAAQ,CAAC,EAAE,kBAAkB;QACvE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAG,MAAiB;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB;IAC7C,OAAO,mBAAmB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;aACJ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,yBAAyB,CACjC,QAAgB,EAChB,QAAkC;IAElC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,UAAU,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,kBAAkB,GACvB,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,gBAAgB,GACrB,CAAC,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,SAAS;QACzC,CAAC,CAAC,UAAU,CAAC,mBAAmB;QAChC,CAAC,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,kBAAkB;QAClB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,CAAC;IACV,MAAM,WAAW,GAChB,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,MAAM,CAAC;IACR,MAAM,cAAc,GACnB,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GACX,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO;QACN,QAAQ,EAAE,gBAAgB;QAC1B,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACrC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CACxC,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,CAAC,wBAAwB,CAAC,CAAC,CACxC,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,EACtE,aAAa,CACb,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,IAAI,UAAU,CAAC;IAC1C,MAAM,iBAAiB,GAAG,mBAAmB,CAC5C,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,YAAY,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAC5C,CAAC;IACF,MAAM,gBAAgB,GAAG,mBAAmB,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,YAAY,CAAC,CAAC,oBAAoB,CAAC,CAAC,EACpC,iBAAiB,CACjB,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,IAAI,gBAAgB,CAAC;IACxD,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,CAAC;QACZ,2BAA2B;QAC3B,mCAAmC;KACnC,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,YAAY,CAAC,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,GACZ,mBAAmB,CAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,CAC5D,IAAI,SAAS,CAAC;IAEhB,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,UAAU;QACxB,iBAAiB,EAAE,MAAM;QACzB,UAAU,EAAE,SAAS;QACrB,kBAAkB,EAAE,gBAAgB;QACpC,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,MAAM;QACf,YAAY,EAAE,UAAU;QACxB,QAAQ;KACR,CAAC,CAAC,MAAM,CACR,CAAC,KAAK,EAA6B,EAAE,CACpC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3D,CACD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAAgB,EAChB,KAAa,EACb,MAA4B,EAC5B,QAAkC,EAClC,MAAe;IAEf,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,QAAQ;QACR,KAAK;QACL,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACR,mBAAmB,EAAE,cAAc;SACnC;QACD,QAAQ;QACR,WAAW,EAAE;YACZ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ,CAAC;YACjD,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAC3D;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,KAAK,EAAE,QAAgB,EAAuC,EAAE;QACtE,IACC,6BAA6B,CAAC,QAAQ,CAAC;YACvC,CAAC,8BAA8B,EAAE,EAChC,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,WAAW,EAAE,CAAC;gBACjB,OAAO,sBAAsB,CAC5B,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,WAAW,EAAE,QAAQ,CACrB,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAC7D,OAAO,sBAAsB,CAC5B,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,CACvD,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACzD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;oBACpE,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9D,eAAe;YACf,MAAM,SAAS,GAAG,MAAM,6BAA6B,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAClC,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,2BAA2B;oBACnC,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,aAAa,GAClB,kBAAkB,KAAK,oBAAoB;gBAC1C,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,mBAAmB,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,SAAS,EAAE,CAAC;oBACf,OAAO;wBACN,QAAQ;wBACR,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;wBACvD,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;qBAC/B,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAC5B,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,EACb,SAAS,EACT,MAAM,CAAC,MAAM,CACb,CAAC;YACH,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Authentication Resolver - Unified Credential Resolution\n *\n * This module provides a unified authentication resolver that handles\n * multiple credential sources and authentication modes for all supported\n * AI providers. It abstracts the complexity of OAuth, API keys, and\n * environment variables into a single interface.\n *\n * ## Authentication Modes\n *\n * | Mode     | Description                                    |\n * |----------|------------------------------------------------|\n * | auto     | Try OAuth first, fallback to API keys (default)|\n * | api-key  | Only use API keys, skip OAuth                  |\n *\n * ## Credential Resolution Order\n *\n * 1. **Explicit API key**: Passed directly via options\n * 2. **OAuth tokens**: Provider-specific OAuth flows (if mode allows)\n * 3. **Environment variables**: Standard env var lookup\n * 4. **Custom providers**: From models registry configuration\n *\n * ## Credential Sources\n *\n * | Source              | Description                              |\n * |---------------------|------------------------------------------|\n * | explicit            | Passed directly to resolver              |\n * | env                 | From environment variable                |\n * | custom_literal      | Hardcoded in custom provider config      |\n * | custom_env          | Env var from custom provider config      |\n * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |\n * | openai_oauth_file   | OpenAI OAuth from stored credentials     |\n * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |\n * | google_oauth_file   | Google OAuth from stored credentials     |\n *\n * ## Example\n *\n * ```typescript\n * const resolver = createAuthResolver({ mode: 'auto' });\n * const credential = await resolver('anthropic');\n *\n * if (credential) {\n *   console.log(`Using ${credential.type} from ${credential.source}`);\n *   // Use credential.token for API requests\n * }\n * ```\n *\n * @module providers/auth\n */\n\nimport {\n\tEVALOPS_ORGANIZATION_ID_ENV_VARS,\n\tEVALOPS_WORKSPACE_ID_ENV_VARS,\n\treadEvalOpsEnv,\n} from \"../evalops/env-aliases.js\";\nimport { getOAuthToken } from \"../oauth/index.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { lookupApiKey } from \"./api-keys.js\";\nimport {\n\tgetEvalOpsManagedProviderDefinition,\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"./evalops-managed.js\";\nimport { getFreshOpenAIOAuthCredential } from \"./openai-auth.js\";\n\nexport type AuthMode = \"auto\" | \"api-key\";\n\nexport type AuthCredentialType = \"api-key\" | \"bearer-token\";\n\nexport type AuthCredentialSource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"evalops_agent_key_file\"\n\t| \"evalops_oauth_file\"\n\t| \"openai_oauth_file\"\n\t| \"openai_codex_oauth_file\"\n\t| \"google_oauth_file\"\n\t| \"github_copilot_oauth_file\";\n\nexport interface AuthCredential {\n\tprovider: string;\n\ttoken: string;\n\ttype: AuthCredentialType;\n\tsource: AuthCredentialSource;\n\tenvVar?: string;\n\theaders?: Record<string, string>;\n\tmetadata?: Record<string, unknown>;\n\trequestBody?: Record<string, unknown>;\n}\n\nexport interface AuthResolverOptions {\n\tmode: AuthMode;\n\texplicitApiKey?: string;\n}\n\ntype AuthResolver = (provider: string) => Promise<AuthCredential | undefined>;\n\nfunction isOpenAIProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized !== \"openai-codex\" &&\n\t\t(normalized === \"openai\" ||\n\t\t\tnormalized.startsWith(\"openai/\") ||\n\t\t\tnormalized.includes(\"openai-\"))\n\t);\n}\n\nfunction isOpenAICodexProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn normalized === \"openai-codex\";\n}\n\nfunction isGoogleGeminiCliProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized === \"google-gemini-cli\" || normalized === \"google-antigravity\"\n\t);\n}\n\nfunction isGitHubCopilotProvider(provider: string): boolean {\n\treturn provider.toLowerCase() === \"github-copilot\";\n}\n\nfunction resolveEvalOpsCredentialType(provider: string): AuthCredentialType {\n\treturn getEvalOpsManagedProviderDefinition(provider)?.usesAnthropicOAuth\n\t\t? \"bearer-token\"\n\t\t: \"api-key\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getNonEmptyString(value: unknown): string | undefined {\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction firstNonEmptyString(...values: unknown[]): string | undefined {\n\tfor (const value of values) {\n\t\tconst candidate = getNonEmptyString(value);\n\t\tif (candidate) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction readFirstEnv(names: readonly string[]): string | undefined {\n\treturn firstNonEmptyString(...names.map((name) => process.env[name]));\n}\n\nfunction getStringArray(value: unknown): string[] {\n\treturn Array.isArray(value)\n\t\t? value\n\t\t\t\t.map((entry) => (typeof entry === \"string\" ? entry.trim() : \"\"))\n\t\t\t\t.filter((entry) => entry.length > 0)\n\t\t: [];\n}\n\nfunction isFutureTimestamp(value: unknown): boolean {\n\tconst timestamp = getNonEmptyString(value);\n\treturn !timestamp || Date.parse(timestamp) > Date.now();\n}\n\nfunction resolveEvalOpsAgentMcpAPIKey(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst apiKey = getNonEmptyString(agentMcp?.apiKey);\n\tif (!apiKey || !isFutureTimestamp(agentMcp?.expiresAt)) {\n\t\treturn undefined;\n\t}\n\tconst scopes = getStringArray(agentMcp?.scopes);\n\tif (scopes.length > 0 && !scopes.includes(\"llm_gateway:invoke\")) {\n\t\treturn undefined;\n\t}\n\treturn apiKey;\n}\n\nfunction resolveEvalOpsOrganizationId(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst candidate = getNonEmptyString(metadata?.organizationId);\n\tif (candidate && candidate.trim().length > 0) {\n\t\treturn candidate.trim();\n\t}\n\treturn readEvalOpsEnv(process.env, EVALOPS_ORGANIZATION_ID_ENV_VARS);\n}\n\nfunction resolveEvalOpsProviderRef(\n\tprovider: string,\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: null;\n\tconst definition = getEvalOpsManagedProviderDefinition(provider);\n\tconst metadataProvider = getNonEmptyString(providerRef?.provider);\n\tconst configuredProvider =\n\t\tprocess.env.MAESTRO_EVALOPS_PROVIDER?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_PROVIDER?.trim();\n\tconst resolvedProvider =\n\t\t(definition && definition.id !== \"evalops\"\n\t\t\t? definition.providerRefProvider\n\t\t\t: undefined) ??\n\t\tmetadataProvider ??\n\t\tconfiguredProvider ??\n\t\tdefinition?.providerRefProvider ??\n\t\t\"openai\";\n\tconst environment =\n\t\tgetNonEmptyString(providerRef?.environment) ??\n\t\tprocess.env.MAESTRO_EVALOPS_ENVIRONMENT?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_ENVIRONMENT?.trim() ??\n\t\t\"prod\";\n\tconst credentialName =\n\t\tgetNonEmptyString(providerRef?.credential_name) ??\n\t\tprocess.env.MAESTRO_EVALOPS_CREDENTIAL_NAME?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME?.trim();\n\tconst teamId =\n\t\tgetNonEmptyString(providerRef?.team_id) ??\n\t\tprocess.env.MAESTRO_EVALOPS_TEAM_ID?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_TEAM_ID?.trim();\n\treturn {\n\t\tprovider: resolvedProvider,\n\t\tenvironment,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamId ? { team_id: teamId } : {}),\n\t};\n}\n\nfunction resolveEvalOpsRequestMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst agentID = firstNonEmptyString(\n\t\tmetadata?.agentId,\n\t\tmetadata?.agent_id,\n\t\tagentMcp?.agentId,\n\t\tagentMcp?.agent_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_AGENT_ID\", \"MAESTRO_AGENT_ID\"]),\n\t);\n\tconst platformRunID = firstNonEmptyString(\n\t\tmetadata?.runId,\n\t\tmetadata?.run_id,\n\t\tagentMcp?.runId,\n\t\tagentMcp?.run_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_RUN_ID\"]),\n\t);\n\tconst agentRunID = firstNonEmptyString(\n\t\tmetadata?.agentRunId,\n\t\tmetadata?.agent_run_id,\n\t\tagentMcp?.agentRunId,\n\t\tagentMcp?.agent_run_id,\n\t\treadFirstEnv([\"MAESTRO_AGENT_RUN_ID\", \"MAESTRO_EVALOPS_AGENT_RUN_ID\"]),\n\t\tplatformRunID,\n\t);\n\tconst runID = platformRunID ?? agentRunID;\n\tconst platformSessionID = firstNonEmptyString(\n\t\tmetadata?.sessionId,\n\t\tmetadata?.session_id,\n\t\tagentMcp?.sessionId,\n\t\tagentMcp?.session_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_SESSION_ID\"]),\n\t);\n\tconst maestroSessionID = firstNonEmptyString(\n\t\tmetadata?.maestroSessionId,\n\t\tmetadata?.maestro_session_id,\n\t\treadFirstEnv([\"MAESTRO_SESSION_ID\"]),\n\t\tplatformSessionID,\n\t);\n\tconst sessionID = platformSessionID ?? maestroSessionID;\n\tconst workspaceID = firstNonEmptyString(\n\t\tmetadata?.workspaceId,\n\t\tmetadata?.workspace_id,\n\t\tagentMcp?.workspaceId,\n\t\tagentMcp?.workspace_id,\n\t\treadEvalOpsEnv(process.env, EVALOPS_WORKSPACE_ID_ENV_VARS),\n\t);\n\tconst objectiveID = firstNonEmptyString(\n\t\tmetadata?.objectiveId,\n\t\tmetadata?.objective_id,\n\t\tagentMcp?.objectiveId,\n\t\tagentMcp?.objective_id,\n\t\treadFirstEnv([\"MAESTRO_OBJECTIVE_ID\", \"MAESTRO_EVALOPS_OBJECTIVE_ID\"]),\n\t);\n\tconst stepID = firstNonEmptyString(\n\t\tmetadata?.agentRunStepId,\n\t\tmetadata?.agent_run_step_id,\n\t\tmetadata?.stepId,\n\t\tmetadata?.step_id,\n\t\tagentMcp?.agentRunStepId,\n\t\tagentMcp?.agent_run_step_id,\n\t\treadFirstEnv([\n\t\t\t\"MAESTRO_AGENT_RUN_STEP_ID\",\n\t\t\t\"MAESTRO_EVALOPS_AGENT_RUN_STEP_ID\",\n\t\t]),\n\t);\n\tconst traceID = firstNonEmptyString(\n\t\tmetadata?.traceId,\n\t\tmetadata?.trace_id,\n\t\tagentMcp?.traceId,\n\t\tagentMcp?.trace_id,\n\t\treadFirstEnv([\"MAESTRO_TRACE_ID\", \"TRACE_ID\"]),\n\t);\n\tconst threadID = firstNonEmptyString(\n\t\tmetadata?.threadId,\n\t\tmetadata?.thread_id,\n\t\tagentMcp?.threadId,\n\t\tagentMcp?.thread_id,\n\t\treadFirstEnv([\"MAESTRO_THREAD_ID\", \"MAESTRO_EVALOPS_THREAD_ID\"]),\n\t);\n\tconst turnID = firstNonEmptyString(\n\t\tmetadata?.turnId,\n\t\tmetadata?.turn_id,\n\t\tagentMcp?.turnId,\n\t\tagentMcp?.turn_id,\n\t\treadFirstEnv([\"MAESTRO_TURN_ID\", \"MAESTRO_EVALOPS_TURN_ID\"]),\n\t);\n\tconst toolCallID = firstNonEmptyString(\n\t\tmetadata?.toolCallId,\n\t\tmetadata?.tool_call_id,\n\t\tagentMcp?.toolCallId,\n\t\tagentMcp?.tool_call_id,\n\t\treadFirstEnv([\"MAESTRO_TOOL_CALL_ID\", \"MAESTRO_EVALOPS_TOOL_CALL_ID\"]),\n\t);\n\tconst workload = firstNonEmptyString(\n\t\tmetadata?.workload,\n\t\tagentMcp?.workload,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_WORKLOAD\", \"MAESTRO_WORKLOAD\"]),\n\t);\n\tconst surface =\n\t\tfirstNonEmptyString(\n\t\t\tmetadata?.surface,\n\t\t\tagentMcp?.surface,\n\t\t\treadFirstEnv([\"MAESTRO_EVALOPS_SURFACE\", \"MAESTRO_SURFACE\"]),\n\t\t) ?? \"maestro\";\n\n\treturn Object.fromEntries(\n\t\tObject.entries({\n\t\t\tagent_id: agentID,\n\t\t\tworkspace_id: workspaceID,\n\t\t\tobjective_id: objectiveID,\n\t\t\trun_id: runID,\n\t\t\tagent_run_id: agentRunID,\n\t\t\tagent_run_step_id: stepID,\n\t\t\tsession_id: sessionID,\n\t\t\tmaestro_session_id: maestroSessionID,\n\t\t\tsurface,\n\t\t\ttrace_id: traceID,\n\t\t\tthread_id: threadID,\n\t\t\tturn_id: turnID,\n\t\t\ttool_call_id: toolCallID,\n\t\t\tworkload,\n\t\t}).filter(\n\t\t\t(entry): entry is [string, string] =>\n\t\t\t\ttypeof entry[1] === \"string\" && entry[1].trim().length > 0,\n\t\t),\n\t);\n}\n\nfunction buildEvalOpsCredential(\n\tprovider: string,\n\ttoken: string,\n\tsource: AuthCredentialSource,\n\tmetadata?: Record<string, unknown>,\n\tenvVar?: string,\n): AuthCredential | undefined {\n\tconst organizationId = resolveEvalOpsOrganizationId(metadata);\n\tif (!organizationId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tprovider,\n\t\ttoken,\n\t\ttype: resolveEvalOpsCredentialType(provider),\n\t\tsource,\n\t\tenvVar,\n\t\theaders: {\n\t\t\t\"X-Organization-ID\": organizationId,\n\t\t},\n\t\tmetadata,\n\t\trequestBody: {\n\t\t\tmetadata: resolveEvalOpsRequestMetadata(metadata),\n\t\t\tprovider_ref: resolveEvalOpsProviderRef(provider, metadata),\n\t\t},\n\t};\n}\n\nexport function createAuthResolver(options: AuthResolverOptions): AuthResolver {\n\tconst explicitKey = options.explicitApiKey?.trim();\n\treturn async (provider: string): Promise<AuthCredential | undefined> => {\n\t\tif (\n\t\t\tisKnownEvalOpsManagedProvider(provider) &&\n\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst normalizedProvider = provider.toLowerCase();\n\n\t\tif (explicitKey) {\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(provider, explicitKey, \"explicit\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: explicitKey,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: \"explicit\",\n\t\t\t};\n\t\t}\n\n\t\tif (isEvalOpsManagedProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst credentials = loadOAuthCredentials(\"evalops\");\n\t\t\tconst agentAPIKey = resolveEvalOpsAgentMcpAPIKey(credentials?.metadata);\n\t\t\tif (agentAPIKey) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tagentAPIKey,\n\t\t\t\t\t\"evalops_agent_key_file\",\n\t\t\t\t\tcredentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst oauthToken = await getOAuthToken(\"evalops\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst refreshedCredentials = loadOAuthCredentials(\"evalops\");\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\toauthToken,\n\t\t\t\t\t\"evalops_oauth_file\",\n\t\t\t\t\trefreshedCredentials?.metadata ?? credentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (isOpenAICodexProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"openai-codex\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"openai-codex\");\n\t\t\t\tconst accountId =\n\t\t\t\t\ttypeof credentials?.metadata?.accountId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.accountId\n\t\t\t\t\t\t: undefined;\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_codex_oauth_file\",\n\t\t\t\t\theaders: accountId ? { \"chatgpt-account-id\": accountId } : undefined,\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Handle OpenAI Auth\n\t\tif (isOpenAIProvider(provider) && options.mode !== \"api-key\") {\n\t\t\t// OpenAI OAuth\n\t\t\tconst oauthCred = await getFreshOpenAIOAuthCredential();\n\t\t\tif (oauthCred?.apiKey) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthCred.apiKey,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_oauth_file\",\n\t\t\t\t\tmetadata: { mode: oauthCred.mode },\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGitHubCopilotProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"github-copilot\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"github-copilot\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"github_copilot_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGoogleGeminiCliProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthProvider =\n\t\t\t\tnormalizedProvider === \"google-antigravity\"\n\t\t\t\t\t? \"google-antigravity\"\n\t\t\t\t\t: \"google-gemini-cli\";\n\t\t\tconst oauthToken = await getOAuthToken(oauthProvider);\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(oauthProvider);\n\t\t\t\tconst projectId =\n\t\t\t\t\ttypeof credentials?.metadata?.projectId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.projectId\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (projectId) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken: JSON.stringify({ token: oauthToken, projectId }),\n\t\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\t\tsource: \"google_oauth_file\",\n\t\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst lookup = lookupApiKey(provider, explicitKey);\n\t\tif (lookup.key) {\n\t\t\tif (lookup.source === \"missing\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tlookup.key,\n\t\t\t\t\tlookup.source,\n\t\t\t\t\tundefined,\n\t\t\t\t\tlookup.envVar,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: lookup.key,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: lookup.source,\n\t\t\t\tenvVar: lookup.envVar,\n\t\t\t};\n\t\t}\n\t\treturn undefined;\n\t};\n}\n"]}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/providers/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EACN,gCAAgC,EAChC,6BAA6B,EAC7B,cAAc,GACd,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAClD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EACN,mCAAmC,EACnC,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,6BAA6B,EAAE,MAAM,kBAAkB,CAAC;AAoCjE,SAAS,gBAAgB,CAAC,QAAgB;IACzC,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,cAAc;QAC7B,CAAC,UAAU,KAAK,QAAQ;YACvB,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC;YAChC,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAChC,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC9C,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,UAAU,KAAK,cAAc,CAAC;AACtC,CAAC;AAED,SAAS,yBAAyB,CAAC,QAAgB;IAClD,MAAM,UAAU,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;IAC1C,OAAO,CACN,UAAU,KAAK,mBAAmB,IAAI,UAAU,KAAK,oBAAoB,CACzE,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,QAAgB;IAChD,OAAO,QAAQ,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC;AACpD,CAAC;AAED,SAAS,4BAA4B,CAAC,QAAgB;IACrD,OAAO,mCAAmC,CAAC,QAAQ,CAAC,EAAE,kBAAkB;QACvE,CAAC,CAAC,cAAc;QAChB,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAG,MAAiB;IAChD,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QAC3C,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,YAAY,CAAC,KAAwB;IAC7C,OAAO,mBAAmB,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACvE,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACrC,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAC1B,CAAC,CAAC,KAAK;aACJ,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;aAC/D,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;QACtC,CAAC,CAAC,EAAE,CAAC;AACP,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACxC,MAAM,SAAS,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC3C,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;AACzD,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,IAAI,CAAC,iBAAiB,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC;QACxD,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAChD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,MAAM,SAAS,GAAG,iBAAiB,CAAC,QAAQ,EAAE,cAAc,CAAC,CAAC;IAC9D,IAAI,SAAS,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IACzB,CAAC;IACD,OAAO,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,gCAAgC,CAAC,CAAC;AACtE,CAAC;AAED,SAAS,yBAAyB,CACjC,QAAgB,EAChB,QAAkC;IAElC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,IAAI,CAAC;IACR,MAAM,UAAU,GAAG,mCAAmC,CAAC,QAAQ,CAAC,CAAC;IACjE,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IAClE,MAAM,kBAAkB,GACvB,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;QAC5C,OAAO,CAAC,GAAG,CAAC,4BAA4B,EAAE,IAAI,EAAE,CAAC;IAClD,MAAM,gBAAgB,GACrB,CAAC,UAAU,IAAI,UAAU,CAAC,EAAE,KAAK,SAAS;QACzC,CAAC,CAAC,UAAU,CAAC,mBAAmB;QAChC,CAAC,CAAC,SAAS,CAAC;QACb,gBAAgB;QAChB,kBAAkB;QAClB,UAAU,EAAE,mBAAmB;QAC/B,QAAQ,CAAC;IACV,MAAM,WAAW,GAChB,iBAAiB,CAAC,WAAW,EAAE,WAAW,CAAC;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,MAAM,CAAC;IACR,MAAM,cAAc,GACnB,iBAAiB,CAAC,WAAW,EAAE,eAAe,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,+BAA+B,EAAE,IAAI,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,mCAAmC,EAAE,IAAI,EAAE,CAAC;IACzD,MAAM,MAAM,GACX,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,uBAAuB,EAAE,IAAI,EAAE;QAC3C,OAAO,CAAC,GAAG,CAAC,2BAA2B,EAAE,IAAI,EAAE,CAAC;IACjD,OAAO;QACN,QAAQ,EAAE,gBAAgB;QAC1B,WAAW;QACX,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,6BAA6B,CACrC,QAAkC;IAElC,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9E,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,aAAa,GAAG,mBAAmB,CACxC,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,KAAK,EACf,QAAQ,EAAE,MAAM,EAChB,YAAY,CAAC,CAAC,wBAAwB,CAAC,CAAC,CACxC,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,EACtE,aAAa,CACb,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,IAAI,UAAU,CAAC;IAC1C,MAAM,iBAAiB,GAAG,mBAAmB,CAC5C,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,UAAU,EACpB,YAAY,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAC5C,CAAC;IACF,MAAM,gBAAgB,GAAG,mBAAmB,CAC3C,QAAQ,EAAE,gBAAgB,EAC1B,QAAQ,EAAE,kBAAkB,EAC5B,YAAY,CAAC,CAAC,oBAAoB,CAAC,CAAC,EACpC,iBAAiB,CACjB,CAAC;IACF,MAAM,SAAS,GAAG,iBAAiB,IAAI,gBAAgB,CAAC;IACxD,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,cAAc,CAAC,OAAO,CAAC,GAAG,EAAE,6BAA6B,CAAC,CAC1D,CAAC;IACF,MAAM,WAAW,GAAG,mBAAmB,CACtC,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,WAAW,EACrB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,cAAc,EACxB,QAAQ,EAAE,iBAAiB,EAC3B,YAAY,CAAC;QACZ,2BAA2B;QAC3B,mCAAmC;KACnC,CAAC,CACF,CAAC;IACF,MAAM,OAAO,GAAG,mBAAmB,CAClC,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAC9C,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,SAAS,EACnB,YAAY,CAAC,CAAC,mBAAmB,EAAE,2BAA2B,CAAC,CAAC,CAChE,CAAC;IACF,MAAM,MAAM,GAAG,mBAAmB,CACjC,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,iBAAiB,EAAE,yBAAyB,CAAC,CAAC,CAC5D,CAAC;IACF,MAAM,UAAU,GAAG,mBAAmB,CACrC,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,QAAQ,EAAE,UAAU,EACpB,QAAQ,EAAE,YAAY,EACtB,YAAY,CAAC,CAAC,sBAAsB,EAAE,8BAA8B,CAAC,CAAC,CACtE,CAAC;IACF,MAAM,QAAQ,GAAG,mBAAmB,CACnC,QAAQ,EAAE,QAAQ,EAClB,QAAQ,EAAE,QAAQ,EAClB,YAAY,CAAC,CAAC,0BAA0B,EAAE,kBAAkB,CAAC,CAAC,CAC9D,CAAC;IACF,MAAM,OAAO,GACZ,mBAAmB,CAClB,QAAQ,EAAE,OAAO,EACjB,QAAQ,EAAE,OAAO,EACjB,YAAY,CAAC,CAAC,yBAAyB,EAAE,iBAAiB,CAAC,CAAC,CAC5D,IAAI,SAAS,CAAC;IAEhB,OAAO,MAAM,CAAC,WAAW,CACxB,MAAM,CAAC,OAAO,CAAC;QACd,QAAQ,EAAE,OAAO;QACjB,YAAY,EAAE,WAAW;QACzB,YAAY,EAAE,WAAW;QACzB,MAAM,EAAE,KAAK;QACb,YAAY,EAAE,UAAU;QACxB,iBAAiB,EAAE,MAAM;QACzB,UAAU,EAAE,SAAS;QACrB,kBAAkB,EAAE,gBAAgB;QACpC,OAAO;QACP,QAAQ,EAAE,OAAO;QACjB,SAAS,EAAE,QAAQ;QACnB,OAAO,EAAE,MAAM;QACf,YAAY,EAAE,UAAU;QACxB,QAAQ;KACR,CAAC,CAAC,MAAM,CACR,CAAC,KAAK,EAA6B,EAAE,CACpC,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAC3D,CACD,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAAgB,EAChB,KAAa,EACb,MAA4B,EAC5B,QAAkC,EAClC,MAAe;IAEf,MAAM,cAAc,GAAG,4BAA4B,CAAC,QAAQ,CAAC,CAAC;IAC9D,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,OAAO;QACN,QAAQ;QACR,KAAK;QACL,IAAI,EAAE,4BAA4B,CAAC,QAAQ,CAAC;QAC5C,MAAM;QACN,MAAM;QACN,OAAO,EAAE;YACR,mBAAmB,EAAE,cAAc;SACnC;QACD,QAAQ;QACR,WAAW,EAAE;YACZ,QAAQ,EAAE,6BAA6B,CAAC,QAAQ,CAAC;YACjD,YAAY,EAAE,yBAAyB,CAAC,QAAQ,EAAE,QAAQ,CAAC;SAC3D;KACD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC9D,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC;IACnD,OAAO,KAAK,EAAE,QAAgB,EAAuC,EAAE;QACtE,IACC,6BAA6B,CAAC,QAAQ,CAAC;YACvC,CAAC,8BAA8B,EAAE,EAChC,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;QAED,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC;QAElD,IAAI,WAAW,EAAE,CAAC;YACjB,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAAC,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;YAClE,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,WAAW;gBAClB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,UAAU;aAClB,CAAC;QACH,CAAC;QAED,IAAI,wBAAwB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACtE,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACpD,MAAM,WAAW,GAAG,4BAA4B,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;YACxE,IAAI,WAAW,EAAE,CAAC;gBACjB,OAAO,sBAAsB,CAC5B,QAAQ,EACR,WAAW,EACX,wBAAwB,EACxB,WAAW,EAAE,QAAQ,CACrB,CAAC;YACH,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;YAClD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;gBAC7D,OAAO,sBAAsB,CAC5B,QAAQ,EACR,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EAAE,QAAQ,IAAI,WAAW,EAAE,QAAQ,CACvD,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,qBAAqB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACnE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;gBACzD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,yBAAyB;oBACjC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS;oBACpE,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,qBAAqB;QACrB,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC9D,eAAe;YACf,MAAM,SAAS,GAAG,MAAM,6BAA6B,EAAE,CAAC;YACxD,IAAI,SAAS,EAAE,MAAM,EAAE,CAAC;gBACvB,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,SAAS,CAAC,MAAM;oBACvB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,mBAAmB;oBAC3B,QAAQ,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE;iBAClC,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,uBAAuB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACrE,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,gBAAgB,CAAC,CAAC;YACzD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,gBAAgB,CAAC,CAAC;gBAC3D,OAAO;oBACN,QAAQ;oBACR,KAAK,EAAE,UAAU;oBACjB,IAAI,EAAE,SAAS;oBACf,MAAM,EAAE,2BAA2B;oBACnC,QAAQ,EAAE,WAAW,EAAE,QAAQ;iBAC/B,CAAC;YACH,CAAC;QACF,CAAC;QAED,IAAI,yBAAyB,CAAC,QAAQ,CAAC,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACvE,MAAM,aAAa,GAClB,kBAAkB,KAAK,oBAAoB;gBAC1C,CAAC,CAAC,oBAAoB;gBACtB,CAAC,CAAC,mBAAmB,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,aAAa,CAAC,aAAa,CAAC,CAAC;YACtD,IAAI,UAAU,EAAE,CAAC;gBAChB,MAAM,WAAW,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;gBACxD,MAAM,SAAS,GACd,OAAO,WAAW,EAAE,QAAQ,EAAE,SAAS,KAAK,QAAQ;oBACnD,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,SAAS;oBAChC,CAAC,CAAC,SAAS,CAAC;gBACd,IAAI,SAAS,EAAE,CAAC;oBACf,OAAO;wBACN,QAAQ;wBACR,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC;wBACvD,IAAI,EAAE,SAAS;wBACf,MAAM,EAAE,mBAAmB;wBAC3B,QAAQ,EAAE,WAAW,EAAE,QAAQ;qBAC/B,CAAC;gBACH,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QACnD,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,OAAO,SAAS,CAAC;YAClB,CAAC;YACD,IAAI,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACxC,OAAO,sBAAsB,CAC5B,QAAQ,EACR,MAAM,CAAC,GAAG,EACV,MAAM,CAAC,MAAM,EACb,SAAS,EACT,MAAM,CAAC,MAAM,CACb,CAAC;YACH,CAAC;YACD,OAAO;gBACN,QAAQ;gBACR,KAAK,EAAE,MAAM,CAAC,GAAG;gBACjB,IAAI,EAAE,SAAS;gBACf,MAAM,EAAE,MAAM,CAAC,MAAM;gBACrB,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC;QACH,CAAC;QACD,OAAO,SAAS,CAAC;IAClB,CAAC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Authentication Resolver - Unified Credential Resolution\n *\n * This module provides a unified authentication resolver that handles\n * multiple credential sources and authentication modes for all supported\n * AI providers. It abstracts the complexity of OAuth, API keys, and\n * environment variables into a single interface.\n *\n * ## Authentication Modes\n *\n * | Mode     | Description                                    |\n * |----------|------------------------------------------------|\n * | auto     | Try OAuth first, fallback to API keys (default)|\n * | api-key  | Only use API keys, skip OAuth                  |\n *\n * ## Credential Resolution Order\n *\n * 1. **Explicit API key**: Passed directly via options\n * 2. **OAuth tokens**: Provider-specific OAuth flows (if mode allows)\n * 3. **Environment variables**: Standard env var lookup\n * 4. **Custom providers**: From models registry configuration\n *\n * ## Credential Sources\n *\n * | Source              | Description                              |\n * |---------------------|------------------------------------------|\n * | explicit            | Passed directly to resolver              |\n * | env                 | From environment variable                |\n * | custom_literal      | Hardcoded in custom provider config      |\n * | custom_env          | Env var from custom provider config      |\n * | evalops_oauth_file  | EvalOps managed OAuth from stored credentials |\n * | openai_oauth_file   | OpenAI OAuth from stored credentials     |\n * | openai_codex_oauth_file | OpenAI Codex ChatGPT OAuth from stored credentials |\n * | google_oauth_file   | Google OAuth from stored credentials     |\n *\n * ## Example\n *\n * ```typescript\n * const resolver = createAuthResolver({ mode: 'auto' });\n * const credential = await resolver('anthropic');\n *\n * if (credential) {\n *   console.log(`Using ${credential.type} from ${credential.source}`);\n *   // Use credential.token for API requests\n * }\n * ```\n *\n * @module providers/auth\n */\n\nimport {\n\tEVALOPS_ORGANIZATION_ID_ENV_VARS,\n\tEVALOPS_WORKSPACE_ID_ENV_VARS,\n\treadEvalOpsEnv,\n} from \"../evalops/env-aliases.js\";\nimport { getOAuthToken } from \"../oauth/index.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { isRecord } from \"../utils/json.js\";\nimport { lookupApiKey } from \"./api-keys.js\";\nimport {\n\tgetEvalOpsManagedProviderDefinition,\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"./evalops-managed.js\";\nimport { getFreshOpenAIOAuthCredential } from \"./openai-auth.js\";\n\nexport type AuthMode = \"auto\" | \"api-key\";\n\nexport type AuthCredentialType = \"api-key\" | \"bearer-token\";\n\nexport type AuthCredentialSource =\n\t| \"explicit\"\n\t| \"env\"\n\t| \"custom_literal\"\n\t| \"custom_env\"\n\t| \"evalops_agent_key_file\"\n\t| \"evalops_oauth_file\"\n\t| \"openai_oauth_file\"\n\t| \"openai_codex_oauth_file\"\n\t| \"google_oauth_file\"\n\t| \"github_copilot_oauth_file\";\n\nexport interface AuthCredential {\n\tprovider: string;\n\ttoken: string;\n\ttype: AuthCredentialType;\n\tsource: AuthCredentialSource;\n\tenvVar?: string;\n\theaders?: Record<string, string>;\n\tmetadata?: Record<string, unknown>;\n\trequestBody?: Record<string, unknown>;\n}\n\nexport interface AuthResolverOptions {\n\tmode: AuthMode;\n\texplicitApiKey?: string;\n}\n\ntype AuthResolver = (provider: string) => Promise<AuthCredential | undefined>;\n\nfunction isOpenAIProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized !== \"openai-codex\" &&\n\t\t(normalized === \"openai\" ||\n\t\t\tnormalized.startsWith(\"openai/\") ||\n\t\t\tnormalized.includes(\"openai-\"))\n\t);\n}\n\nfunction isOpenAICodexProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn normalized === \"openai-codex\";\n}\n\nfunction isGoogleGeminiCliProvider(provider: string): boolean {\n\tconst normalized = provider.toLowerCase();\n\treturn (\n\t\tnormalized === \"google-gemini-cli\" || normalized === \"google-antigravity\"\n\t);\n}\n\nfunction isGitHubCopilotProvider(provider: string): boolean {\n\treturn provider.toLowerCase() === \"github-copilot\";\n}\n\nfunction resolveEvalOpsCredentialType(provider: string): AuthCredentialType {\n\treturn getEvalOpsManagedProviderDefinition(provider)?.usesAnthropicOAuth\n\t\t? \"bearer-token\"\n\t\t: \"api-key\";\n}\n\nfunction getNonEmptyString(value: unknown): string | undefined {\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction firstNonEmptyString(...values: unknown[]): string | undefined {\n\tfor (const value of values) {\n\t\tconst candidate = getNonEmptyString(value);\n\t\tif (candidate) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction readFirstEnv(names: readonly string[]): string | undefined {\n\treturn firstNonEmptyString(...names.map((name) => process.env[name]));\n}\n\nfunction getStringArray(value: unknown): string[] {\n\treturn Array.isArray(value)\n\t\t? value\n\t\t\t\t.map((entry) => (typeof entry === \"string\" ? entry.trim() : \"\"))\n\t\t\t\t.filter((entry) => entry.length > 0)\n\t\t: [];\n}\n\nfunction isFutureTimestamp(value: unknown): boolean {\n\tconst timestamp = getNonEmptyString(value);\n\treturn !timestamp || Date.parse(timestamp) > Date.now();\n}\n\nfunction resolveEvalOpsAgentMcpAPIKey(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst apiKey = getNonEmptyString(agentMcp?.apiKey);\n\tif (!apiKey || !isFutureTimestamp(agentMcp?.expiresAt)) {\n\t\treturn undefined;\n\t}\n\tconst scopes = getStringArray(agentMcp?.scopes);\n\tif (scopes.length > 0 && !scopes.includes(\"llm_gateway:invoke\")) {\n\t\treturn undefined;\n\t}\n\treturn apiKey;\n}\n\nfunction resolveEvalOpsOrganizationId(\n\tmetadata?: Record<string, unknown>,\n): string | undefined {\n\tconst candidate = getNonEmptyString(metadata?.organizationId);\n\tif (candidate && candidate.trim().length > 0) {\n\t\treturn candidate.trim();\n\t}\n\treturn readEvalOpsEnv(process.env, EVALOPS_ORGANIZATION_ID_ENV_VARS);\n}\n\nfunction resolveEvalOpsProviderRef(\n\tprovider: string,\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: null;\n\tconst definition = getEvalOpsManagedProviderDefinition(provider);\n\tconst metadataProvider = getNonEmptyString(providerRef?.provider);\n\tconst configuredProvider =\n\t\tprocess.env.MAESTRO_EVALOPS_PROVIDER?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_PROVIDER?.trim();\n\tconst resolvedProvider =\n\t\t(definition && definition.id !== \"evalops\"\n\t\t\t? definition.providerRefProvider\n\t\t\t: undefined) ??\n\t\tmetadataProvider ??\n\t\tconfiguredProvider ??\n\t\tdefinition?.providerRefProvider ??\n\t\t\"openai\";\n\tconst environment =\n\t\tgetNonEmptyString(providerRef?.environment) ??\n\t\tprocess.env.MAESTRO_EVALOPS_ENVIRONMENT?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_ENVIRONMENT?.trim() ??\n\t\t\"prod\";\n\tconst credentialName =\n\t\tgetNonEmptyString(providerRef?.credential_name) ??\n\t\tprocess.env.MAESTRO_EVALOPS_CREDENTIAL_NAME?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME?.trim();\n\tconst teamId =\n\t\tgetNonEmptyString(providerRef?.team_id) ??\n\t\tprocess.env.MAESTRO_EVALOPS_TEAM_ID?.trim() ??\n\t\tprocess.env.MAESTRO_LLM_GATEWAY_TEAM_ID?.trim();\n\treturn {\n\t\tprovider: resolvedProvider,\n\t\tenvironment,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamId ? { team_id: teamId } : {}),\n\t};\n}\n\nfunction resolveEvalOpsRequestMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, string> {\n\tconst agentMcp = isRecord(metadata?.agentMcp) ? metadata.agentMcp : undefined;\n\tconst agentID = firstNonEmptyString(\n\t\tmetadata?.agentId,\n\t\tmetadata?.agent_id,\n\t\tagentMcp?.agentId,\n\t\tagentMcp?.agent_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_AGENT_ID\", \"MAESTRO_AGENT_ID\"]),\n\t);\n\tconst platformRunID = firstNonEmptyString(\n\t\tmetadata?.runId,\n\t\tmetadata?.run_id,\n\t\tagentMcp?.runId,\n\t\tagentMcp?.run_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_RUN_ID\"]),\n\t);\n\tconst agentRunID = firstNonEmptyString(\n\t\tmetadata?.agentRunId,\n\t\tmetadata?.agent_run_id,\n\t\tagentMcp?.agentRunId,\n\t\tagentMcp?.agent_run_id,\n\t\treadFirstEnv([\"MAESTRO_AGENT_RUN_ID\", \"MAESTRO_EVALOPS_AGENT_RUN_ID\"]),\n\t\tplatformRunID,\n\t);\n\tconst runID = platformRunID ?? agentRunID;\n\tconst platformSessionID = firstNonEmptyString(\n\t\tmetadata?.sessionId,\n\t\tmetadata?.session_id,\n\t\tagentMcp?.sessionId,\n\t\tagentMcp?.session_id,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_SESSION_ID\"]),\n\t);\n\tconst maestroSessionID = firstNonEmptyString(\n\t\tmetadata?.maestroSessionId,\n\t\tmetadata?.maestro_session_id,\n\t\treadFirstEnv([\"MAESTRO_SESSION_ID\"]),\n\t\tplatformSessionID,\n\t);\n\tconst sessionID = platformSessionID ?? maestroSessionID;\n\tconst workspaceID = firstNonEmptyString(\n\t\tmetadata?.workspaceId,\n\t\tmetadata?.workspace_id,\n\t\tagentMcp?.workspaceId,\n\t\tagentMcp?.workspace_id,\n\t\treadEvalOpsEnv(process.env, EVALOPS_WORKSPACE_ID_ENV_VARS),\n\t);\n\tconst objectiveID = firstNonEmptyString(\n\t\tmetadata?.objectiveId,\n\t\tmetadata?.objective_id,\n\t\tagentMcp?.objectiveId,\n\t\tagentMcp?.objective_id,\n\t\treadFirstEnv([\"MAESTRO_OBJECTIVE_ID\", \"MAESTRO_EVALOPS_OBJECTIVE_ID\"]),\n\t);\n\tconst stepID = firstNonEmptyString(\n\t\tmetadata?.agentRunStepId,\n\t\tmetadata?.agent_run_step_id,\n\t\tmetadata?.stepId,\n\t\tmetadata?.step_id,\n\t\tagentMcp?.agentRunStepId,\n\t\tagentMcp?.agent_run_step_id,\n\t\treadFirstEnv([\n\t\t\t\"MAESTRO_AGENT_RUN_STEP_ID\",\n\t\t\t\"MAESTRO_EVALOPS_AGENT_RUN_STEP_ID\",\n\t\t]),\n\t);\n\tconst traceID = firstNonEmptyString(\n\t\tmetadata?.traceId,\n\t\tmetadata?.trace_id,\n\t\tagentMcp?.traceId,\n\t\tagentMcp?.trace_id,\n\t\treadFirstEnv([\"MAESTRO_TRACE_ID\", \"TRACE_ID\"]),\n\t);\n\tconst threadID = firstNonEmptyString(\n\t\tmetadata?.threadId,\n\t\tmetadata?.thread_id,\n\t\tagentMcp?.threadId,\n\t\tagentMcp?.thread_id,\n\t\treadFirstEnv([\"MAESTRO_THREAD_ID\", \"MAESTRO_EVALOPS_THREAD_ID\"]),\n\t);\n\tconst turnID = firstNonEmptyString(\n\t\tmetadata?.turnId,\n\t\tmetadata?.turn_id,\n\t\tagentMcp?.turnId,\n\t\tagentMcp?.turn_id,\n\t\treadFirstEnv([\"MAESTRO_TURN_ID\", \"MAESTRO_EVALOPS_TURN_ID\"]),\n\t);\n\tconst toolCallID = firstNonEmptyString(\n\t\tmetadata?.toolCallId,\n\t\tmetadata?.tool_call_id,\n\t\tagentMcp?.toolCallId,\n\t\tagentMcp?.tool_call_id,\n\t\treadFirstEnv([\"MAESTRO_TOOL_CALL_ID\", \"MAESTRO_EVALOPS_TOOL_CALL_ID\"]),\n\t);\n\tconst workload = firstNonEmptyString(\n\t\tmetadata?.workload,\n\t\tagentMcp?.workload,\n\t\treadFirstEnv([\"MAESTRO_EVALOPS_WORKLOAD\", \"MAESTRO_WORKLOAD\"]),\n\t);\n\tconst surface =\n\t\tfirstNonEmptyString(\n\t\t\tmetadata?.surface,\n\t\t\tagentMcp?.surface,\n\t\t\treadFirstEnv([\"MAESTRO_EVALOPS_SURFACE\", \"MAESTRO_SURFACE\"]),\n\t\t) ?? \"maestro\";\n\n\treturn Object.fromEntries(\n\t\tObject.entries({\n\t\t\tagent_id: agentID,\n\t\t\tworkspace_id: workspaceID,\n\t\t\tobjective_id: objectiveID,\n\t\t\trun_id: runID,\n\t\t\tagent_run_id: agentRunID,\n\t\t\tagent_run_step_id: stepID,\n\t\t\tsession_id: sessionID,\n\t\t\tmaestro_session_id: maestroSessionID,\n\t\t\tsurface,\n\t\t\ttrace_id: traceID,\n\t\t\tthread_id: threadID,\n\t\t\tturn_id: turnID,\n\t\t\ttool_call_id: toolCallID,\n\t\t\tworkload,\n\t\t}).filter(\n\t\t\t(entry): entry is [string, string] =>\n\t\t\t\ttypeof entry[1] === \"string\" && entry[1].trim().length > 0,\n\t\t),\n\t);\n}\n\nfunction buildEvalOpsCredential(\n\tprovider: string,\n\ttoken: string,\n\tsource: AuthCredentialSource,\n\tmetadata?: Record<string, unknown>,\n\tenvVar?: string,\n): AuthCredential | undefined {\n\tconst organizationId = resolveEvalOpsOrganizationId(metadata);\n\tif (!organizationId) {\n\t\treturn undefined;\n\t}\n\treturn {\n\t\tprovider,\n\t\ttoken,\n\t\ttype: resolveEvalOpsCredentialType(provider),\n\t\tsource,\n\t\tenvVar,\n\t\theaders: {\n\t\t\t\"X-Organization-ID\": organizationId,\n\t\t},\n\t\tmetadata,\n\t\trequestBody: {\n\t\t\tmetadata: resolveEvalOpsRequestMetadata(metadata),\n\t\t\tprovider_ref: resolveEvalOpsProviderRef(provider, metadata),\n\t\t},\n\t};\n}\n\nexport function createAuthResolver(options: AuthResolverOptions): AuthResolver {\n\tconst explicitKey = options.explicitApiKey?.trim();\n\treturn async (provider: string): Promise<AuthCredential | undefined> => {\n\t\tif (\n\t\t\tisKnownEvalOpsManagedProvider(provider) &&\n\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t) {\n\t\t\treturn undefined;\n\t\t}\n\n\t\tconst normalizedProvider = provider.toLowerCase();\n\n\t\tif (explicitKey) {\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(provider, explicitKey, \"explicit\");\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: explicitKey,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: \"explicit\",\n\t\t\t};\n\t\t}\n\n\t\tif (isEvalOpsManagedProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst credentials = loadOAuthCredentials(\"evalops\");\n\t\t\tconst agentAPIKey = resolveEvalOpsAgentMcpAPIKey(credentials?.metadata);\n\t\t\tif (agentAPIKey) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tagentAPIKey,\n\t\t\t\t\t\"evalops_agent_key_file\",\n\t\t\t\t\tcredentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t\tconst oauthToken = await getOAuthToken(\"evalops\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst refreshedCredentials = loadOAuthCredentials(\"evalops\");\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\toauthToken,\n\t\t\t\t\t\"evalops_oauth_file\",\n\t\t\t\t\trefreshedCredentials?.metadata ?? credentials?.metadata,\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\n\t\tif (isOpenAICodexProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"openai-codex\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"openai-codex\");\n\t\t\t\tconst accountId =\n\t\t\t\t\ttypeof credentials?.metadata?.accountId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.accountId\n\t\t\t\t\t\t: undefined;\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_codex_oauth_file\",\n\t\t\t\t\theaders: accountId ? { \"chatgpt-account-id\": accountId } : undefined,\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\t// Handle OpenAI Auth\n\t\tif (isOpenAIProvider(provider) && options.mode !== \"api-key\") {\n\t\t\t// OpenAI OAuth\n\t\t\tconst oauthCred = await getFreshOpenAIOAuthCredential();\n\t\t\tif (oauthCred?.apiKey) {\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthCred.apiKey,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"openai_oauth_file\",\n\t\t\t\t\tmetadata: { mode: oauthCred.mode },\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGitHubCopilotProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthToken = await getOAuthToken(\"github-copilot\");\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(\"github-copilot\");\n\t\t\t\treturn {\n\t\t\t\t\tprovider,\n\t\t\t\t\ttoken: oauthToken,\n\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\tsource: \"github_copilot_oauth_file\",\n\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t};\n\t\t\t}\n\t\t}\n\n\t\tif (isGoogleGeminiCliProvider(provider) && options.mode !== \"api-key\") {\n\t\t\tconst oauthProvider =\n\t\t\t\tnormalizedProvider === \"google-antigravity\"\n\t\t\t\t\t? \"google-antigravity\"\n\t\t\t\t\t: \"google-gemini-cli\";\n\t\t\tconst oauthToken = await getOAuthToken(oauthProvider);\n\t\t\tif (oauthToken) {\n\t\t\t\tconst credentials = loadOAuthCredentials(oauthProvider);\n\t\t\t\tconst projectId =\n\t\t\t\t\ttypeof credentials?.metadata?.projectId === \"string\"\n\t\t\t\t\t\t? credentials.metadata.projectId\n\t\t\t\t\t\t: undefined;\n\t\t\t\tif (projectId) {\n\t\t\t\t\treturn {\n\t\t\t\t\t\tprovider,\n\t\t\t\t\t\ttoken: JSON.stringify({ token: oauthToken, projectId }),\n\t\t\t\t\t\ttype: \"api-key\",\n\t\t\t\t\t\tsource: \"google_oauth_file\",\n\t\t\t\t\t\tmetadata: credentials?.metadata,\n\t\t\t\t\t};\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tconst lookup = lookupApiKey(provider, explicitKey);\n\t\tif (lookup.key) {\n\t\t\tif (lookup.source === \"missing\") {\n\t\t\t\treturn undefined;\n\t\t\t}\n\t\t\tif (isEvalOpsManagedProvider(provider)) {\n\t\t\t\treturn buildEvalOpsCredential(\n\t\t\t\t\tprovider,\n\t\t\t\t\tlookup.key,\n\t\t\t\t\tlookup.source,\n\t\t\t\t\tundefined,\n\t\t\t\t\tlookup.envVar,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn {\n\t\t\t\tprovider,\n\t\t\t\ttoken: lookup.key,\n\t\t\t\ttype: \"api-key\",\n\t\t\t\tsource: lookup.source,\n\t\t\t\tenvVar: lookup.envVar,\n\t\t\t};\n\t\t}\n\t\treturn undefined;\n\t};\n}\n"]}

package/dist/runtime/env.d.ts

@@ -60,6 +60,9 @@ export interface RuntimeEnv {
     readonly disableKeychain: boolean;
     readonly maestroHome: string;
     readonly maestroAgentDir: string | null;
+    readonly missionStoreDir: string | null;
+    readonly snapshotBlobDir: string | null;
+    readonly skillTrustStrict: boolean;
     /**
      * Tri-state parsed signal: true (opt-in), false (opt-out), null (no
      * signal). For diagnostics that need the raw user string, see
@@ -122,6 +125,9 @@ export interface RuntimeEnv {
     readonly meterBaseUrl: string | null;
     readonly meterAccessToken: string | null;
     readonly meterOrganizationId: string | null;
+    readonly ambientLearnerFile: string | null;
+    readonly ambientLearnerDefaultFile: string;
+    readonly ambientSocketFile: string;
 }
 export declare function parseOptionalBoolean(value: string | null): boolean | null;
 /**
@@ -146,6 +152,8 @@ export declare function createRuntimeEnv(raw: NodeJS.ProcessEnv): RuntimeEnv;
  * the migration.
  */
 export declare function defaultRuntimeEnv(): RuntimeEnv;
+export declare function markRuntimeEnvFinalized(): void;
+export declare function isRuntimeEnvFinalized(): boolean;
 /**
  * Drop the cached default snapshot so the next `defaultRuntimeEnv()` call
  * re-reads `process.env`.
@@ -155,5 +163,5 @@ export declare function defaultRuntimeEnv(): RuntimeEnv;
  * `process.env` before handing control to migrated modules.
  */
 export declare function resetDefaultRuntimeEnv(): void;
-export declare const resetDefaultRuntimeEnvForTests: typeof resetDefaultRuntimeEnv;
+export declare function resetDefaultRuntimeEnvForTests(): void;
 //# sourceMappingURL=env.d.ts.map

package/dist/runtime/env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/runtime/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,UAAU;IAE1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAGlC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAGxC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAGnD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAGpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;CAC5C;AAiED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,IAAI,CAMzE;AAkCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAqDnE;AAQD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAM9C;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAK7C;AAED,eAAO,MAAM,8BAA8B,+BAAyB,CAAC"}
+{"version":3,"file":"env.d.ts","sourceRoot":"","sources":["../../src/runtime/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAKH,MAAM,MAAM,QAAQ,GAAG,OAAO,GAAG,MAAM,GAAG,MAAM,GAAG,OAAO,CAAC;AAE3D,MAAM,WAAW,UAAU;IAE1B,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAGlC;;;;;;;OAOG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;OAGG;IACH,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAG3C,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IAGnC;;;;OAIG;IACH,QAAQ,CAAC,gBAAgB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1C;;;;;OAKG;IACH,QAAQ,CAAC,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,QAAQ,CAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;OAEG;IACH,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC;;OAEG;IACH,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,0BAA0B,EAAE,MAAM,GAAG,IAAI,CAAC;IAGnD;;;;OAIG;IACH,QAAQ,CAAC,WAAW,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IACxC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAGpC;;;;;;;;;;OAUG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;;OAMG;IACH,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAGzC,QAAQ,CAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAG5C,QAAQ,CAAC,kBAAkB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3C,QAAQ,CAAC,yBAAyB,EAAE,MAAM,CAAC;IAC3C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACnC;AAiED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,OAAO,GAAG,IAAI,CAMzE;AAiED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAkEnE;AAkCD;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,UAAU,CAO9C;AAED,wBAAgB,uBAAuB,IAAI,IAAI,CAM9C;AAED,wBAAgB,qBAAqB,IAAI,OAAO,CAE/C;AAED;;;;;;;GAOG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAK7C;AAED,wBAAgB,8BAA8B,IAAI,IAAI,CAUrD"}

package/dist/runtime/env.js

@@ -132,6 +132,31 @@ function resolveHomePath(value, raw) {
             : value;
     return resolve(expanded);
 }
+function homeFromEnv(raw) {
+    return trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();
+}
+function resolveDataLocalDir(raw) {
+    const home = homeFromEnv(raw);
+    if (process.platform === "darwin") {
+        return join(home, "Library", "Application Support");
+    }
+    if (process.platform === "win32") {
+        return (resolveHomePath(trim(raw.LOCALAPPDATA), raw) ??
+            resolveHomePath(trim(raw.APPDATA), raw) ??
+            join(home, "AppData", "Local"));
+    }
+    return (resolveHomePath(trim(raw.XDG_DATA_HOME), raw) ??
+        join(home, ".local", "share"));
+}
+function resolveRuntimeDir(raw) {
+    if (process.platform === "darwin") {
+        return resolveDataLocalDir(raw);
+    }
+    const xdgRuntimeDir = resolveHomePath(trim(raw.XDG_RUNTIME_DIR), raw);
+    if (xdgRuntimeDir)
+        return xdgRuntimeDir;
+    return resolveDataLocalDir(raw);
+}
 /**
  * Build an immutable snapshot of the env vars this codebase cares about.
  *
@@ -149,6 +174,9 @@ export function createRuntimeEnv(raw) {
         disableKeychain: parseBoolean(trim(raw.MAESTRO_DISABLE_KEYCHAIN)),
         maestroHome: trim(raw.MAESTRO_HOME) ?? join(homedir(), ".maestro"),
         maestroAgentDir: trim(raw.MAESTRO_AGENT_DIR),
+        missionStoreDir: resolveHomePath(trim(raw.MAESTRO_MISSION_STORE_DIR), raw),
+        snapshotBlobDir: resolveHomePath(trim(raw.MAESTRO_SNAPSHOT_BLOB_DIR), raw),
+        skillTrustStrict: parseBoolean(trim(raw.MAESTRO_SKILL_TRUST_STRICT)),
         telemetryEnabled: parseOptionalBoolean(trim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY)),
         telemetryFlag: trim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),
         beaconFile: resolveHomePath(trim(raw.MAESTRO_BEACON_FILE), raw),
@@ -175,9 +203,31 @@ export function createRuntimeEnv(raw) {
         meterBaseUrl: firstNonEmpty(raw, METER_BASE_URL_VARS),
         meterAccessToken: firstNonEmpty(raw, METER_ACCESS_TOKEN_VARS),
         meterOrganizationId: firstNonEmpty(raw, METER_ORG_ID_VARS),
+        ambientLearnerFile: resolveHomePath(trim(raw.MAESTRO_AMBIENT_LEARNER_FILE), raw),
+        ambientLearnerDefaultFile: join(resolveDataLocalDir(raw), "ambient-agent", "learner.json"),
+        ambientSocketFile: join(resolveRuntimeDir(raw), "ambient-agent.sock"),
     });
 }
 const processWithRuntimeEnvCache = process;
+function isTestProcess() {
+    return process.env.NODE_ENV === "test" || process.env.VITEST === "true";
+}
+function maybeReportEarlyRuntimeEnvAccess() {
+    if (processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__) {
+        return;
+    }
+    const message = "defaultRuntimeEnv() was read before loadAndFinalizeEnv() completed. " +
+        "Bootstrap entry points must finish dotenv loading and security scrubbing before runtime env snapshots are created.";
+    if (process.env.MAESTRO_RUNTIME_ENV_STRICT_BOOTSTRAP === "1") {
+        throw new Error(message);
+    }
+    if (isTestProcess() ||
+        processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__) {
+        return;
+    }
+    processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__ = true;
+    console.warn(`[maestro] ${message}`);
+}
 /**
  * Return the process-wide snapshot of `process.env`.
  *
@@ -192,12 +242,20 @@ const processWithRuntimeEnvCache = process;
  * the migration.
  */
 export function defaultRuntimeEnv() {
+    maybeReportEarlyRuntimeEnvAccess();
     if (!processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__) {
         processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__ =
             createRuntimeEnv(process.env);
     }
     return processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__;
 }
+export function markRuntimeEnvFinalized() {
+    processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ = true;
+    Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__");
+}
+export function isRuntimeEnvFinalized() {
+    return processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ === true;
+}
 /**
  * Drop the cached default snapshot so the next `defaultRuntimeEnv()` call
  * re-reads `process.env`.
@@ -209,5 +267,9 @@ export function defaultRuntimeEnv() {
 export function resetDefaultRuntimeEnv() {
     Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_DEFAULT_RUNTIME_ENV__");
 }
-export const resetDefaultRuntimeEnvForTests = resetDefaultRuntimeEnv;
+export function resetDefaultRuntimeEnvForTests() {
+    resetDefaultRuntimeEnv();
+    Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_RUNTIME_ENV_FINALIZED__");
+    Reflect.deleteProperty(processWithRuntimeEnvCache, "__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__");
+}
 //# sourceMappingURL=env.js.map

package/dist/runtime/env.js.map

@@ -1 +1 @@
-{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/runtime/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAsG1C,SAAS,IAAI,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CACrB,GAAsB,EACtB,KAAwB;IAExB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC3B,wBAAwB;IACxB,yBAAyB;IACzB,gBAAgB;IAChB,2BAA2B;CAClB,CAAC;AAEX,MAAM,yBAAyB,GAAG;IACjC,8BAA8B;IAC9B,eAAe;CACN,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC3B,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AAEX,MAAM,uBAAuB,GAAG;IAC/B,4BAA4B;IAC5B,GAAG,yBAAyB;CACnB,CAAC;AAEX,MAAM,iBAAiB,GAAG;IACzB,+BAA+B;IAC/B,GAAG,mBAAmB;CACb,CAAC;AAEX,SAAS,aAAa,CAAC,KAAoB;IAC1C,QAAQ,KAAK,EAAE,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO;YACX,OAAO,KAAK,CAAC;QACd;YACC,OAAO,MAAM,CAAC;IAChB,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACzC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACxD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAoB;IACpD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoB;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CACvB,KAAoB,EACpB,GAAsB;IAEtB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;IAClE,MAAM,QAAQ,GACb,KAAK,KAAK,GAAG;QACZ,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC,CAAC,KAAK,CAAC;IACX,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACpD,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvD,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAElE,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,kBAAkB,EAAE,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC;QAEjE,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACjE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC;QAClE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAE5C,gBAAgB,EAAE,oBAAoB,CACrC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC7D;QACD,aAAa,EACZ,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC;QAC/D,cAAc,EAAE,aAAa,CAAC,GAAG,EAAE;YAClC,yBAAyB;YACzB,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QACF,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC9C,eAAe,EAAE,wBAAwB,CACxC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CACnC;QACD,mBAAmB,EAAE,uBAAuB,CAC3C,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CACtC;QACD,0BAA0B,EAAE,IAAI,CAC/B,GAAG,CAAC,sCAAsC,CAC1C;QAED,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAE3C,YAAY,EACX,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC;YACtD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1D,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE;YACpC,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QAEF,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAC7D,mBAAmB,EAAE,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC;KAC1D,CAAC,CAAC;AACJ,CAAC;AAMD,MAAM,0BAA0B,GAAG,OAAqC,CAAC;AAEzE;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAChC,IAAI,CAAC,0BAA0B,CAAC,+BAA+B,EAAE,CAAC;QACjE,0BAA0B,CAAC,+BAA+B;YACzD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAAC,+BAA+B,CAAC;AACnE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACrC,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,iCAAiC,CACjC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,MAAM,8BAA8B,GAAG,sBAAsB,CAAC","sourcesContent":["/**\n * Runtime environment substrate.\n *\n * # Why this exists\n *\n * Ambient `process.env` reads scattered through library code are the root\n * cause of an entire class of flakes:\n *\n *  - Logger config frozen at setup-file import time (PR #2768/#2769).\n *  - Meter test passing on runner-2, failing on runner-1 because the CI\n *    runner's env had `EVALOPS_ORG_ID` set (PR #2763).\n *  - CLI integration test `prints providers summary for filter` flaking\n *    intermittently because OAuth keychain mode was captured by the first\n *    test in a vitest worker (PRs #2752, #2761, #2762, #2766).\n *  - CLI aggregator's `setInterval` outliving the test that started it,\n *    later reading the *next* test's env-driven buffer path (PR #2772).\n *\n * Every one of those was the same shape: shared mutable state with no\n * causal ordering between writers and readers and no owner.\n *\n * The substrate fix is to make environment a *parameter*, not a *global*.\n * Library code receives a `RuntimeEnv`. Tests construct one with a literal.\n * The single place that reads `process.env` is `createRuntimeEnv` —\n * everything else passes the typed result around.\n *\n * # Migration strategy\n *\n * `defaultRuntimeEnv()` is a one-call-per-process snapshot of\n * `process.env`. Code not yet migrated can pick it up incrementally. The\n * `scripts/check-env-reads.mjs` baseline prevents *new* direct reads from\n * `process.env` in `src/` without going through `RuntimeEnv` first.\n *\n * # What's typed here\n *\n * The fields below are the env vars that have produced production flakes,\n * security gaps, or cross-test pollution in the last quarter. Untyped\n * vars stay as ambient `process.env` reads for now — the scanner just\n * prevents new ones being added — and graduate into this type as their\n * consumers are migrated.\n */\n\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface RuntimeEnv {\n\t// --- Logger ---\n\treadonly logLevel: LogLevel;\n\treadonly logJsonFormat: boolean;\n\treadonly logSplitStreams: boolean;\n\n\t// --- EvalOps identity (the flake surface PR #2763 closed) ---\n\t/**\n\t * Organization id resolved across the documented alias list.\n\t * Source vars (first non-empty wins):\n\t *  - MAESTRO_EVALOPS_ORG_ID\n\t *  - EVALOPS_ORGANIZATION_ID\n\t *  - EVALOPS_ORG_ID\n\t *  - MAESTRO_ENTERPRISE_ORG_ID\n\t */\n\treadonly evalopsOrgId: string | null;\n\t/**\n\t * Access token resolved across the documented alias list.\n\t * Source vars: MAESTRO_EVALOPS_ACCESS_TOKEN, EVALOPS_TOKEN.\n\t */\n\treadonly evalopsAccessToken: string | null;\n\n\t// --- OAuth storage isolation (PRs #2752/#2761/#2762/#2766) ---\n\treadonly disableKeychain: boolean;\n\treadonly maestroHome: string;\n\treadonly maestroAgentDir: string | null;\n\n\t// --- CLI command aggregator / telemetry (PR #2772 timer leak) ---\n\t/**\n\t * Tri-state parsed signal: true (opt-in), false (opt-out), null (no\n\t * signal). For diagnostics that need the raw user string, see\n\t * `telemetryFlag` below.\n\t */\n\treadonly telemetryEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_TELEMETRY` (or `PLAYWRIGHT_TELEMETRY` fallback) string,\n\t * trimmed. Preserved separately from `telemetryEnabled` so diagnostic\n\t * surfaces (e.g. `getTelemetryStatus().flagValue`) can show the literal\n\t * user setting.\n\t */\n\treadonly telemetryFlag: string | null;\n\treadonly beaconFile: string | null;\n\treadonly beaconEndpoint: string | null;\n\treadonly beaconApiKey: string | null;\n\t/**\n\t * Beacon request timeout in ms. `null` means use the consumer's default.\n\t */\n\treadonly beaconTimeoutMs: number | null;\n\t/**\n\t * Telemetry sampling probability in `[0, 1]`. `null` means full sampling.\n\t */\n\treadonly telemetrySampleRate: number | null;\n\treadonly cliCommandBeaconBufferFile: string | null;\n\n\t// --- OpenTelemetry SDK boot (`src/opentelemetry.ts`) ---\n\t/**\n\t * Tri-state for `MAESTRO_OTEL`. `null` means no explicit signal —\n\t * the OTel boot logic infers enablement from the presence of an\n\t * exporter endpoint.\n\t */\n\treadonly otelEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_OTEL` string preserved for `getOpenTelemetryStatus`\n\t * reason-string diagnostics that distinguish \"MAESTRO_OTEL=1\" from\n\t * \"MAESTRO_OTEL=0\" in the human-readable reason.\n\t */\n\treadonly otelFlag: string | null;\n\treadonly otelServiceName: string | null;\n\treadonly otelSampler: string | null;\n\n\t// --- OpenTelemetry exporter (`src/telemetry.ts`) ---\n\t/**\n\t * Where the OTel exporter dumps a local log of telemetry events.\n\t * Source vars (first non-empty wins, tilde-expanded):\n\t *  - MAESTRO_TELEMETRY_FILE\n\t *  - PLAYWRIGHT_TELEMETRY_FILE\n\t *\n\t * This is separate from `beaconFile` (`MAESTRO_BEACON_FILE`) — the\n\t * OTel exporter writes structured events, the beacon writes one JSON\n\t * line per event. Users that set only one of the two expect the other\n\t * to remain off.\n\t */\n\treadonly exporterFile: string | null;\n\t/**\n\t * HTTP endpoint for the OTel exporter. Distinct from `beaconEndpoint`\n\t * because `MAESTRO_BEACON_ENDPOINT` is a beacon-specific override that\n\t * shouldn't redirect the OTel exporter.\n\t *  - MAESTRO_TELEMETRY_ENDPOINT\n\t *  - PLAYWRIGHT_TELEMETRY_ENDPOINT\n\t */\n\treadonly exporterEndpoint: string | null;\n\n\t// --- Meter remote-mirror gate (PR #2763 failure) ---\n\treadonly meterBaseUrl: string | null;\n\treadonly meterAccessToken: string | null;\n\treadonly meterOrganizationId: string | null;\n}\n\nfunction trim(value: unknown): string | null {\n\tif (typeof value !== \"string\") return null;\n\tconst t = value.trim();\n\treturn t.length > 0 ? t : null;\n}\n\nfunction firstNonEmpty(\n\traw: NodeJS.ProcessEnv,\n\tnames: readonly string[],\n): string | null {\n\tfor (const name of names) {\n\t\tconst v = trim(raw[name]);\n\t\tif (v) return v;\n\t}\n\treturn null;\n}\n\nconst EVALOPS_ORG_ID_VARS = [\n\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\"EVALOPS_ORGANIZATION_ID\",\n\t\"EVALOPS_ORG_ID\",\n\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n] as const;\n\nconst EVALOPS_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_EVALOPS_ACCESS_TOKEN\",\n\t\"EVALOPS_TOKEN\",\n] as const;\n\nconst METER_BASE_URL_VARS = [\n\t\"MAESTRO_METER_BASE\",\n\t\"MAESTRO_METER_SERVICE_URL\",\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\n\nconst METER_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_METER_ACCESS_TOKEN\",\n\t...EVALOPS_ACCESS_TOKEN_VARS,\n] as const;\n\nconst METER_ORG_ID_VARS = [\n\t\"MAESTRO_METER_ORGANIZATION_ID\",\n\t...EVALOPS_ORG_ID_VARS,\n] as const;\n\nfunction parseLogLevel(value: string | null): LogLevel {\n\tswitch (value) {\n\t\tcase \"debug\":\n\t\tcase \"info\":\n\t\tcase \"warn\":\n\t\tcase \"error\":\n\t\t\treturn value;\n\t\tdefault:\n\t\t\treturn \"info\";\n\t}\n}\n\nfunction parseBoolean(value: string | null): boolean {\n\treturn value === \"1\" || value === \"true\";\n}\n\nexport function parseOptionalBoolean(value: string | null): boolean | null {\n\tif (value === null) return null;\n\tconst normalized = value.toLowerCase();\n\tif (normalized === \"0\" || normalized === \"false\") return false;\n\tif (normalized === \"1\" || normalized === \"true\") return true;\n\treturn null;\n}\n\nfunction parseOptionalSampleRate(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseFloat(value);\n\tif (!Number.isFinite(parsed)) return null;\n\treturn Math.min(Math.max(parsed, 0), 1);\n}\n\nfunction parseOptionalPositiveInt(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseInt(value, 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : null;\n}\n\nfunction resolveHomePath(\n\tvalue: string | null,\n\traw: NodeJS.ProcessEnv,\n): string | null {\n\tif (value === null) return null;\n\t// Match the legacy `resolveEnvPath` chain: honor an overridden HOME\n\t// (or USERPROFILE on Windows) before falling back to `homedir()`. This\n\t// keeps tests and tools that pin HOME to a temp dir working as they did\n\t// when this read went through `src/utils/path-expansion.ts`.\n\tconst home = trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();\n\tconst expanded =\n\t\tvalue === \"~\"\n\t\t\t? home\n\t\t\t: value.startsWith(\"~/\") || value.startsWith(\"~\\\\\")\n\t\t\t\t? join(home, value.slice(2))\n\t\t\t\t: value;\n\treturn resolve(expanded);\n}\n\n/**\n * Build an immutable snapshot of the env vars this codebase cares about.\n *\n * Pure function: same input → same output. Call it once at process\n * startup (or in tests, with a literal) and thread the result through the\n * program. Do not call it on every operation — that defeats the purpose.\n */\nexport function createRuntimeEnv(raw: NodeJS.ProcessEnv): RuntimeEnv {\n\treturn Object.freeze({\n\t\tlogLevel: parseLogLevel(trim(raw.MAESTRO_LOG_LEVEL)),\n\t\tlogJsonFormat: parseBoolean(trim(raw.MAESTRO_LOG_JSON)),\n\t\tlogSplitStreams: parseBoolean(trim(raw.MAESTRO_LOG_SPLIT_STREAMS)),\n\n\t\tevalopsOrgId: firstNonEmpty(raw, EVALOPS_ORG_ID_VARS),\n\t\tevalopsAccessToken: firstNonEmpty(raw, EVALOPS_ACCESS_TOKEN_VARS),\n\n\t\tdisableKeychain: parseBoolean(trim(raw.MAESTRO_DISABLE_KEYCHAIN)),\n\t\tmaestroHome: trim(raw.MAESTRO_HOME) ?? join(homedir(), \".maestro\"),\n\t\tmaestroAgentDir: trim(raw.MAESTRO_AGENT_DIR),\n\n\t\ttelemetryEnabled: parseOptionalBoolean(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\t),\n\t\ttelemetryFlag:\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\tbeaconFile: resolveHomePath(trim(raw.MAESTRO_BEACON_FILE), raw),\n\t\tbeaconEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_BEACON_ENDPOINT\",\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\t\tbeaconApiKey: trim(raw.MAESTRO_BEACON_API_KEY),\n\t\tbeaconTimeoutMs: parseOptionalPositiveInt(\n\t\t\ttrim(raw.MAESTRO_BEACON_TIMEOUT_MS),\n\t\t),\n\t\ttelemetrySampleRate: parseOptionalSampleRate(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY_SAMPLE) ??\n\t\t\t\ttrim(raw.PLAYWRIGHT_TELEMETRY_SAMPLE),\n\t\t),\n\t\tcliCommandBeaconBufferFile: trim(\n\t\t\traw.MAESTRO_CLI_COMMAND_BEACON_BUFFER_FILE,\n\t\t),\n\n\t\totelEnabled: parseOptionalBoolean(trim(raw.MAESTRO_OTEL)),\n\t\totelFlag: trim(raw.MAESTRO_OTEL),\n\t\totelServiceName: trim(raw.MAESTRO_OTEL_SERVICE_NAME),\n\t\totelSampler: trim(raw.MAESTRO_OTEL_SAMPLER),\n\n\t\texporterFile:\n\t\t\tresolveHomePath(trim(raw.MAESTRO_TELEMETRY_FILE), raw) ??\n\t\t\tresolveHomePath(trim(raw.PLAYWRIGHT_TELEMETRY_FILE), raw),\n\t\texporterEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\n\t\tmeterBaseUrl: firstNonEmpty(raw, METER_BASE_URL_VARS),\n\t\tmeterAccessToken: firstNonEmpty(raw, METER_ACCESS_TOKEN_VARS),\n\t\tmeterOrganizationId: firstNonEmpty(raw, METER_ORG_ID_VARS),\n\t});\n}\n\ntype ProcessWithRuntimeEnvCache = typeof process & {\n\t__MAESTRO_DEFAULT_RUNTIME_ENV__?: RuntimeEnv;\n};\n\nconst processWithRuntimeEnvCache = process as ProcessWithRuntimeEnvCache;\n\n/**\n * Return the process-wide snapshot of `process.env`.\n *\n * Builds the snapshot lazily on first call so the timing of module load\n * doesn't matter — by the time anything calls this, env has finished\n * settling (CLI argv parsed, dotenv loaded, vitest setup files run). The\n * returned object is frozen and shared.\n *\n * Library code that's been migrated to the substrate should *not* call\n * this directly; it should accept a `RuntimeEnv` parameter. This export\n * exists as the bootstrap entry point and as a compatibility shim during\n * the migration.\n */\nexport function defaultRuntimeEnv(): RuntimeEnv {\n\tif (!processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__) {\n\t\tprocessWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__ =\n\t\t\tcreateRuntimeEnv(process.env);\n\t}\n\treturn processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__;\n}\n\n/**\n * Drop the cached default snapshot so the next `defaultRuntimeEnv()` call\n * re-reads `process.env`.\n *\n * Prefer constructing a `RuntimeEnv` with `createRuntimeEnv` and injecting it.\n * This reset is reserved for process bootstrap paths that intentionally mutate\n * `process.env` before handing control to migrated modules.\n */\nexport function resetDefaultRuntimeEnv(): void {\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_DEFAULT_RUNTIME_ENV__\",\n\t);\n}\n\nexport const resetDefaultRuntimeEnvForTests = resetDefaultRuntimeEnv;\n"]}
+{"version":3,"file":"env.js","sourceRoot":"","sources":["../../src/runtime/env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AA8G1C,SAAS,IAAI,CAAC,KAAc;IAC3B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,SAAS,aAAa,CACrB,GAAsB,EACtB,KAAwB;IAExB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC;YAAE,OAAO,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,mBAAmB,GAAG;IAC3B,wBAAwB;IACxB,yBAAyB;IACzB,gBAAgB;IAChB,2BAA2B;CAClB,CAAC;AAEX,MAAM,yBAAyB,GAAG;IACjC,8BAA8B;IAC9B,eAAe;CACN,CAAC;AAEX,MAAM,mBAAmB,GAAG;IAC3B,oBAAoB;IACpB,2BAA2B;IAC3B,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AAEX,MAAM,uBAAuB,GAAG;IAC/B,4BAA4B;IAC5B,GAAG,yBAAyB;CACnB,CAAC;AAEX,MAAM,iBAAiB,GAAG;IACzB,+BAA+B;IAC/B,GAAG,mBAAmB;CACb,CAAC;AAEX,SAAS,aAAa,CAAC,KAAoB;IAC1C,QAAQ,KAAK,EAAE,CAAC;QACf,KAAK,OAAO,CAAC;QACb,KAAK,MAAM,CAAC;QACZ,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO;YACX,OAAO,KAAK,CAAC;QACd;YACC,OAAO,MAAM,CAAC;IAChB,CAAC;AACF,CAAC;AAED,SAAS,YAAY,CAAC,KAAoB;IACzC,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,MAAM,CAAC;AAC1C,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAoB;IACxD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACvC,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IAC/D,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IAC7D,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAoB;IACpD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAoB;IACrD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC1C,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,eAAe,CACvB,KAAoB,EACpB,GAAsB;IAEtB,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,oEAAoE;IACpE,uEAAuE;IACvE,wEAAwE;IACxE,6DAA6D;IAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;IAClE,MAAM,QAAQ,GACb,KAAK,KAAK,GAAG;QACZ,CAAC,CAAC,IAAI;QACN,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC;YAClD,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC5B,CAAC,CAAC,KAAK,CAAC;IACX,OAAO,OAAO,CAAC,QAAQ,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,GAAsB;IAC1C,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,OAAO,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,mBAAmB,CAAC,GAAsB;IAClD,MAAM,IAAI,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAClC,OAAO,CACN,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC;YAC5C,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC;YACvC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAC9B,CAAC;IACH,CAAC;IACD,OAAO,CACN,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,CAAC;QAC7C,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAsB;IAChD,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACnC,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACjC,CAAC;IACD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,GAAG,CAAC,CAAC;IACtE,IAAI,aAAa;QAAE,OAAO,aAAa,CAAC;IACxC,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;AACjC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACtD,OAAO,MAAM,CAAC,MAAM,CAAC;QACpB,QAAQ,EAAE,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QACpD,aAAa,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACvD,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAElE,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,kBAAkB,EAAE,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC;QAEjE,eAAe,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC,CAAC;QACjE,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC;QAClE,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC;QAC5C,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1E,eAAe,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1E,gBAAgB,EAAE,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC;QAEpE,gBAAgB,EAAE,oBAAoB,CACrC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAC7D;QACD,aAAa,EACZ,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAC9D,UAAU,EAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,GAAG,CAAC;QAC/D,cAAc,EAAE,aAAa,CAAC,GAAG,EAAE;YAClC,yBAAyB;YACzB,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QACF,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC;QAC9C,eAAe,EAAE,wBAAwB,CACxC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,CACnC;QACD,mBAAmB,EAAE,uBAAuB,CAC3C,IAAI,CAAC,GAAG,CAAC,wBAAwB,CAAC;YACjC,IAAI,CAAC,GAAG,CAAC,2BAA2B,CAAC,CACtC;QACD,0BAA0B,EAAE,IAAI,CAC/B,GAAG,CAAC,sCAAsC,CAC1C;QAED,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC;QACzD,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC;QAChC,eAAe,EAAE,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC;QACpD,WAAW,EAAE,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAE3C,YAAY,EACX,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,sBAAsB,CAAC,EAAE,GAAG,CAAC;YACtD,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,yBAAyB,CAAC,EAAE,GAAG,CAAC;QAC1D,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE;YACpC,4BAA4B;YAC5B,+BAA+B;SAC/B,CAAC;QAEF,YAAY,EAAE,aAAa,CAAC,GAAG,EAAE,mBAAmB,CAAC;QACrD,gBAAgB,EAAE,aAAa,CAAC,GAAG,EAAE,uBAAuB,CAAC;QAC7D,mBAAmB,EAAE,aAAa,CAAC,GAAG,EAAE,iBAAiB,CAAC;QAC1D,kBAAkB,EAAE,eAAe,CAClC,IAAI,CAAC,GAAG,CAAC,4BAA4B,CAAC,EACtC,GAAG,CACH;QACD,yBAAyB,EAAE,IAAI,CAC9B,mBAAmB,CAAC,GAAG,CAAC,EACxB,eAAe,EACf,cAAc,CACd;QACD,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,oBAAoB,CAAC;KACrE,CAAC,CAAC;AACJ,CAAC;AAQD,MAAM,0BAA0B,GAAG,OAAqC,CAAC;AAEzE,SAAS,aAAa;IACrB,OAAO,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,KAAK,MAAM,CAAC;AACzE,CAAC;AAED,SAAS,gCAAgC;IACxC,IAAI,0BAA0B,CAAC,iCAAiC,EAAE,CAAC;QAClE,OAAO;IACR,CAAC;IACD,MAAM,OAAO,GACZ,sEAAsE;QACtE,oHAAoH,CAAC;IACtH,IAAI,OAAO,CAAC,GAAG,CAAC,oCAAoC,KAAK,GAAG,EAAE,CAAC;QAC9D,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC;IAC1B,CAAC;IACD,IACC,aAAa,EAAE;QACf,0BAA0B,CAAC,2CAA2C,EACrE,CAAC;QACF,OAAO;IACR,CAAC;IACD,0BAA0B,CAAC,2CAA2C,GAAG,IAAI,CAAC;IAC9E,OAAO,CAAC,IAAI,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAChC,gCAAgC,EAAE,CAAC;IACnC,IAAI,CAAC,0BAA0B,CAAC,+BAA+B,EAAE,CAAC;QACjE,0BAA0B,CAAC,+BAA+B;YACzD,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,0BAA0B,CAAC,+BAA+B,CAAC;AACnE,CAAC;AAED,MAAM,UAAU,uBAAuB;IACtC,0BAA0B,CAAC,iCAAiC,GAAG,IAAI,CAAC;IACpE,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,6CAA6C,CAC7C,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB;IACpC,OAAO,0BAA0B,CAAC,iCAAiC,KAAK,IAAI,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACrC,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,iCAAiC,CACjC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,8BAA8B;IAC7C,sBAAsB,EAAE,CAAC;IACzB,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,mCAAmC,CACnC,CAAC;IACF,OAAO,CAAC,cAAc,CACrB,0BAA0B,EAC1B,6CAA6C,CAC7C,CAAC;AACH,CAAC","sourcesContent":["/**\n * Runtime environment substrate.\n *\n * # Why this exists\n *\n * Ambient `process.env` reads scattered through library code are the root\n * cause of an entire class of flakes:\n *\n *  - Logger config frozen at setup-file import time (PR #2768/#2769).\n *  - Meter test passing on runner-2, failing on runner-1 because the CI\n *    runner's env had `EVALOPS_ORG_ID` set (PR #2763).\n *  - CLI integration test `prints providers summary for filter` flaking\n *    intermittently because OAuth keychain mode was captured by the first\n *    test in a vitest worker (PRs #2752, #2761, #2762, #2766).\n *  - CLI aggregator's `setInterval` outliving the test that started it,\n *    later reading the *next* test's env-driven buffer path (PR #2772).\n *\n * Every one of those was the same shape: shared mutable state with no\n * causal ordering between writers and readers and no owner.\n *\n * The substrate fix is to make environment a *parameter*, not a *global*.\n * Library code receives a `RuntimeEnv`. Tests construct one with a literal.\n * The single place that reads `process.env` is `createRuntimeEnv` —\n * everything else passes the typed result around.\n *\n * # Migration strategy\n *\n * `defaultRuntimeEnv()` is a one-call-per-process snapshot of\n * `process.env`. Code not yet migrated can pick it up incrementally. The\n * `scripts/check-env-reads.mjs` baseline prevents *new* direct reads from\n * `process.env` in `src/` without going through `RuntimeEnv` first.\n *\n * # What's typed here\n *\n * The fields below are the env vars that have produced production flakes,\n * security gaps, or cross-test pollution in the last quarter. Untyped\n * vars stay as ambient `process.env` reads for now — the scanner just\n * prevents new ones being added — and graduate into this type as their\n * consumers are migrated.\n */\n\nimport { homedir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\n\nexport type LogLevel = \"debug\" | \"info\" | \"warn\" | \"error\";\n\nexport interface RuntimeEnv {\n\t// --- Logger ---\n\treadonly logLevel: LogLevel;\n\treadonly logJsonFormat: boolean;\n\treadonly logSplitStreams: boolean;\n\n\t// --- EvalOps identity (the flake surface PR #2763 closed) ---\n\t/**\n\t * Organization id resolved across the documented alias list.\n\t * Source vars (first non-empty wins):\n\t *  - MAESTRO_EVALOPS_ORG_ID\n\t *  - EVALOPS_ORGANIZATION_ID\n\t *  - EVALOPS_ORG_ID\n\t *  - MAESTRO_ENTERPRISE_ORG_ID\n\t */\n\treadonly evalopsOrgId: string | null;\n\t/**\n\t * Access token resolved across the documented alias list.\n\t * Source vars: MAESTRO_EVALOPS_ACCESS_TOKEN, EVALOPS_TOKEN.\n\t */\n\treadonly evalopsAccessToken: string | null;\n\n\t// --- OAuth storage isolation (PRs #2752/#2761/#2762/#2766) ---\n\treadonly disableKeychain: boolean;\n\treadonly maestroHome: string;\n\treadonly maestroAgentDir: string | null;\n\treadonly missionStoreDir: string | null;\n\treadonly snapshotBlobDir: string | null;\n\treadonly skillTrustStrict: boolean;\n\n\t// --- CLI command aggregator / telemetry (PR #2772 timer leak) ---\n\t/**\n\t * Tri-state parsed signal: true (opt-in), false (opt-out), null (no\n\t * signal). For diagnostics that need the raw user string, see\n\t * `telemetryFlag` below.\n\t */\n\treadonly telemetryEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_TELEMETRY` (or `PLAYWRIGHT_TELEMETRY` fallback) string,\n\t * trimmed. Preserved separately from `telemetryEnabled` so diagnostic\n\t * surfaces (e.g. `getTelemetryStatus().flagValue`) can show the literal\n\t * user setting.\n\t */\n\treadonly telemetryFlag: string | null;\n\treadonly beaconFile: string | null;\n\treadonly beaconEndpoint: string | null;\n\treadonly beaconApiKey: string | null;\n\t/**\n\t * Beacon request timeout in ms. `null` means use the consumer's default.\n\t */\n\treadonly beaconTimeoutMs: number | null;\n\t/**\n\t * Telemetry sampling probability in `[0, 1]`. `null` means full sampling.\n\t */\n\treadonly telemetrySampleRate: number | null;\n\treadonly cliCommandBeaconBufferFile: string | null;\n\n\t// --- OpenTelemetry SDK boot (`src/opentelemetry.ts`) ---\n\t/**\n\t * Tri-state for `MAESTRO_OTEL`. `null` means no explicit signal —\n\t * the OTel boot logic infers enablement from the presence of an\n\t * exporter endpoint.\n\t */\n\treadonly otelEnabled: boolean | null;\n\t/**\n\t * Raw `MAESTRO_OTEL` string preserved for `getOpenTelemetryStatus`\n\t * reason-string diagnostics that distinguish \"MAESTRO_OTEL=1\" from\n\t * \"MAESTRO_OTEL=0\" in the human-readable reason.\n\t */\n\treadonly otelFlag: string | null;\n\treadonly otelServiceName: string | null;\n\treadonly otelSampler: string | null;\n\n\t// --- OpenTelemetry exporter (`src/telemetry.ts`) ---\n\t/**\n\t * Where the OTel exporter dumps a local log of telemetry events.\n\t * Source vars (first non-empty wins, tilde-expanded):\n\t *  - MAESTRO_TELEMETRY_FILE\n\t *  - PLAYWRIGHT_TELEMETRY_FILE\n\t *\n\t * This is separate from `beaconFile` (`MAESTRO_BEACON_FILE`) — the\n\t * OTel exporter writes structured events, the beacon writes one JSON\n\t * line per event. Users that set only one of the two expect the other\n\t * to remain off.\n\t */\n\treadonly exporterFile: string | null;\n\t/**\n\t * HTTP endpoint for the OTel exporter. Distinct from `beaconEndpoint`\n\t * because `MAESTRO_BEACON_ENDPOINT` is a beacon-specific override that\n\t * shouldn't redirect the OTel exporter.\n\t *  - MAESTRO_TELEMETRY_ENDPOINT\n\t *  - PLAYWRIGHT_TELEMETRY_ENDPOINT\n\t */\n\treadonly exporterEndpoint: string | null;\n\n\t// --- Meter remote-mirror gate (PR #2763 failure) ---\n\treadonly meterBaseUrl: string | null;\n\treadonly meterAccessToken: string | null;\n\treadonly meterOrganizationId: string | null;\n\n\t// --- Ambient agent evidence ---\n\treadonly ambientLearnerFile: string | null;\n\treadonly ambientLearnerDefaultFile: string;\n\treadonly ambientSocketFile: string;\n}\n\nfunction trim(value: unknown): string | null {\n\tif (typeof value !== \"string\") return null;\n\tconst t = value.trim();\n\treturn t.length > 0 ? t : null;\n}\n\nfunction firstNonEmpty(\n\traw: NodeJS.ProcessEnv,\n\tnames: readonly string[],\n): string | null {\n\tfor (const name of names) {\n\t\tconst v = trim(raw[name]);\n\t\tif (v) return v;\n\t}\n\treturn null;\n}\n\nconst EVALOPS_ORG_ID_VARS = [\n\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\"EVALOPS_ORGANIZATION_ID\",\n\t\"EVALOPS_ORG_ID\",\n\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n] as const;\n\nconst EVALOPS_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_EVALOPS_ACCESS_TOKEN\",\n\t\"EVALOPS_TOKEN\",\n] as const;\n\nconst METER_BASE_URL_VARS = [\n\t\"MAESTRO_METER_BASE\",\n\t\"MAESTRO_METER_SERVICE_URL\",\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\n\nconst METER_ACCESS_TOKEN_VARS = [\n\t\"MAESTRO_METER_ACCESS_TOKEN\",\n\t...EVALOPS_ACCESS_TOKEN_VARS,\n] as const;\n\nconst METER_ORG_ID_VARS = [\n\t\"MAESTRO_METER_ORGANIZATION_ID\",\n\t...EVALOPS_ORG_ID_VARS,\n] as const;\n\nfunction parseLogLevel(value: string | null): LogLevel {\n\tswitch (value) {\n\t\tcase \"debug\":\n\t\tcase \"info\":\n\t\tcase \"warn\":\n\t\tcase \"error\":\n\t\t\treturn value;\n\t\tdefault:\n\t\t\treturn \"info\";\n\t}\n}\n\nfunction parseBoolean(value: string | null): boolean {\n\treturn value === \"1\" || value === \"true\";\n}\n\nexport function parseOptionalBoolean(value: string | null): boolean | null {\n\tif (value === null) return null;\n\tconst normalized = value.toLowerCase();\n\tif (normalized === \"0\" || normalized === \"false\") return false;\n\tif (normalized === \"1\" || normalized === \"true\") return true;\n\treturn null;\n}\n\nfunction parseOptionalSampleRate(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseFloat(value);\n\tif (!Number.isFinite(parsed)) return null;\n\treturn Math.min(Math.max(parsed, 0), 1);\n}\n\nfunction parseOptionalPositiveInt(value: string | null): number | null {\n\tif (value === null) return null;\n\tconst parsed = Number.parseInt(value, 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : null;\n}\n\nfunction resolveHomePath(\n\tvalue: string | null,\n\traw: NodeJS.ProcessEnv,\n): string | null {\n\tif (value === null) return null;\n\t// Match the legacy `resolveEnvPath` chain: honor an overridden HOME\n\t// (or USERPROFILE on Windows) before falling back to `homedir()`. This\n\t// keeps tests and tools that pin HOME to a temp dir working as they did\n\t// when this read went through `src/utils/path-expansion.ts`.\n\tconst home = trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();\n\tconst expanded =\n\t\tvalue === \"~\"\n\t\t\t? home\n\t\t\t: value.startsWith(\"~/\") || value.startsWith(\"~\\\\\")\n\t\t\t\t? join(home, value.slice(2))\n\t\t\t\t: value;\n\treturn resolve(expanded);\n}\n\nfunction homeFromEnv(raw: NodeJS.ProcessEnv): string {\n\treturn trim(raw.HOME) ?? trim(raw.USERPROFILE) ?? homedir();\n}\n\nfunction resolveDataLocalDir(raw: NodeJS.ProcessEnv): string {\n\tconst home = homeFromEnv(raw);\n\tif (process.platform === \"darwin\") {\n\t\treturn join(home, \"Library\", \"Application Support\");\n\t}\n\tif (process.platform === \"win32\") {\n\t\treturn (\n\t\t\tresolveHomePath(trim(raw.LOCALAPPDATA), raw) ??\n\t\t\tresolveHomePath(trim(raw.APPDATA), raw) ??\n\t\t\tjoin(home, \"AppData\", \"Local\")\n\t\t);\n\t}\n\treturn (\n\t\tresolveHomePath(trim(raw.XDG_DATA_HOME), raw) ??\n\t\tjoin(home, \".local\", \"share\")\n\t);\n}\n\nfunction resolveRuntimeDir(raw: NodeJS.ProcessEnv): string {\n\tif (process.platform === \"darwin\") {\n\t\treturn resolveDataLocalDir(raw);\n\t}\n\tconst xdgRuntimeDir = resolveHomePath(trim(raw.XDG_RUNTIME_DIR), raw);\n\tif (xdgRuntimeDir) return xdgRuntimeDir;\n\treturn resolveDataLocalDir(raw);\n}\n\n/**\n * Build an immutable snapshot of the env vars this codebase cares about.\n *\n * Pure function: same input → same output. Call it once at process\n * startup (or in tests, with a literal) and thread the result through the\n * program. Do not call it on every operation — that defeats the purpose.\n */\nexport function createRuntimeEnv(raw: NodeJS.ProcessEnv): RuntimeEnv {\n\treturn Object.freeze({\n\t\tlogLevel: parseLogLevel(trim(raw.MAESTRO_LOG_LEVEL)),\n\t\tlogJsonFormat: parseBoolean(trim(raw.MAESTRO_LOG_JSON)),\n\t\tlogSplitStreams: parseBoolean(trim(raw.MAESTRO_LOG_SPLIT_STREAMS)),\n\n\t\tevalopsOrgId: firstNonEmpty(raw, EVALOPS_ORG_ID_VARS),\n\t\tevalopsAccessToken: firstNonEmpty(raw, EVALOPS_ACCESS_TOKEN_VARS),\n\n\t\tdisableKeychain: parseBoolean(trim(raw.MAESTRO_DISABLE_KEYCHAIN)),\n\t\tmaestroHome: trim(raw.MAESTRO_HOME) ?? join(homedir(), \".maestro\"),\n\t\tmaestroAgentDir: trim(raw.MAESTRO_AGENT_DIR),\n\t\tmissionStoreDir: resolveHomePath(trim(raw.MAESTRO_MISSION_STORE_DIR), raw),\n\t\tsnapshotBlobDir: resolveHomePath(trim(raw.MAESTRO_SNAPSHOT_BLOB_DIR), raw),\n\t\tskillTrustStrict: parseBoolean(trim(raw.MAESTRO_SKILL_TRUST_STRICT)),\n\n\t\ttelemetryEnabled: parseOptionalBoolean(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\t),\n\t\ttelemetryFlag:\n\t\t\ttrim(raw.MAESTRO_TELEMETRY) ?? trim(raw.PLAYWRIGHT_TELEMETRY),\n\t\tbeaconFile: resolveHomePath(trim(raw.MAESTRO_BEACON_FILE), raw),\n\t\tbeaconEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_BEACON_ENDPOINT\",\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\t\tbeaconApiKey: trim(raw.MAESTRO_BEACON_API_KEY),\n\t\tbeaconTimeoutMs: parseOptionalPositiveInt(\n\t\t\ttrim(raw.MAESTRO_BEACON_TIMEOUT_MS),\n\t\t),\n\t\ttelemetrySampleRate: parseOptionalSampleRate(\n\t\t\ttrim(raw.MAESTRO_TELEMETRY_SAMPLE) ??\n\t\t\t\ttrim(raw.PLAYWRIGHT_TELEMETRY_SAMPLE),\n\t\t),\n\t\tcliCommandBeaconBufferFile: trim(\n\t\t\traw.MAESTRO_CLI_COMMAND_BEACON_BUFFER_FILE,\n\t\t),\n\n\t\totelEnabled: parseOptionalBoolean(trim(raw.MAESTRO_OTEL)),\n\t\totelFlag: trim(raw.MAESTRO_OTEL),\n\t\totelServiceName: trim(raw.MAESTRO_OTEL_SERVICE_NAME),\n\t\totelSampler: trim(raw.MAESTRO_OTEL_SAMPLER),\n\n\t\texporterFile:\n\t\t\tresolveHomePath(trim(raw.MAESTRO_TELEMETRY_FILE), raw) ??\n\t\t\tresolveHomePath(trim(raw.PLAYWRIGHT_TELEMETRY_FILE), raw),\n\t\texporterEndpoint: firstNonEmpty(raw, [\n\t\t\t\"MAESTRO_TELEMETRY_ENDPOINT\",\n\t\t\t\"PLAYWRIGHT_TELEMETRY_ENDPOINT\",\n\t\t]),\n\n\t\tmeterBaseUrl: firstNonEmpty(raw, METER_BASE_URL_VARS),\n\t\tmeterAccessToken: firstNonEmpty(raw, METER_ACCESS_TOKEN_VARS),\n\t\tmeterOrganizationId: firstNonEmpty(raw, METER_ORG_ID_VARS),\n\t\tambientLearnerFile: resolveHomePath(\n\t\t\ttrim(raw.MAESTRO_AMBIENT_LEARNER_FILE),\n\t\t\traw,\n\t\t),\n\t\tambientLearnerDefaultFile: join(\n\t\t\tresolveDataLocalDir(raw),\n\t\t\t\"ambient-agent\",\n\t\t\t\"learner.json\",\n\t\t),\n\t\tambientSocketFile: join(resolveRuntimeDir(raw), \"ambient-agent.sock\"),\n\t});\n}\n\ntype ProcessWithRuntimeEnvCache = typeof process & {\n\t__MAESTRO_DEFAULT_RUNTIME_ENV__?: RuntimeEnv;\n\t__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__?: boolean;\n\t__MAESTRO_RUNTIME_ENV_FINALIZED__?: boolean;\n};\n\nconst processWithRuntimeEnvCache = process as ProcessWithRuntimeEnvCache;\n\nfunction isTestProcess(): boolean {\n\treturn process.env.NODE_ENV === \"test\" || process.env.VITEST === \"true\";\n}\n\nfunction maybeReportEarlyRuntimeEnvAccess(): void {\n\tif (processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__) {\n\t\treturn;\n\t}\n\tconst message =\n\t\t\"defaultRuntimeEnv() was read before loadAndFinalizeEnv() completed. \" +\n\t\t\"Bootstrap entry points must finish dotenv loading and security scrubbing before runtime env snapshots are created.\";\n\tif (process.env.MAESTRO_RUNTIME_ENV_STRICT_BOOTSTRAP === \"1\") {\n\t\tthrow new Error(message);\n\t}\n\tif (\n\t\tisTestProcess() ||\n\t\tprocessWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__\n\t) {\n\t\treturn;\n\t}\n\tprocessWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__ = true;\n\tconsole.warn(`[maestro] ${message}`);\n}\n\n/**\n * Return the process-wide snapshot of `process.env`.\n *\n * Builds the snapshot lazily on first call so the timing of module load\n * doesn't matter — by the time anything calls this, env has finished\n * settling (CLI argv parsed, dotenv loaded, vitest setup files run). The\n * returned object is frozen and shared.\n *\n * Library code that's been migrated to the substrate should *not* call\n * this directly; it should accept a `RuntimeEnv` parameter. This export\n * exists as the bootstrap entry point and as a compatibility shim during\n * the migration.\n */\nexport function defaultRuntimeEnv(): RuntimeEnv {\n\tmaybeReportEarlyRuntimeEnvAccess();\n\tif (!processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__) {\n\t\tprocessWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__ =\n\t\t\tcreateRuntimeEnv(process.env);\n\t}\n\treturn processWithRuntimeEnvCache.__MAESTRO_DEFAULT_RUNTIME_ENV__;\n}\n\nexport function markRuntimeEnvFinalized(): void {\n\tprocessWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ = true;\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__\",\n\t);\n}\n\nexport function isRuntimeEnvFinalized(): boolean {\n\treturn processWithRuntimeEnvCache.__MAESTRO_RUNTIME_ENV_FINALIZED__ === true;\n}\n\n/**\n * Drop the cached default snapshot so the next `defaultRuntimeEnv()` call\n * re-reads `process.env`.\n *\n * Prefer constructing a `RuntimeEnv` with `createRuntimeEnv` and injecting it.\n * This reset is reserved for process bootstrap paths that intentionally mutate\n * `process.env` before handing control to migrated modules.\n */\nexport function resetDefaultRuntimeEnv(): void {\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_DEFAULT_RUNTIME_ENV__\",\n\t);\n}\n\nexport function resetDefaultRuntimeEnvForTests(): void {\n\tresetDefaultRuntimeEnv();\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_RUNTIME_ENV_FINALIZED__\",\n\t);\n\tReflect.deleteProperty(\n\t\tprocessWithRuntimeEnvCache,\n\t\t\"__MAESTRO_RUNTIME_ENV_EARLY_ACCESS_WARNED__\",\n\t);\n}\n"]}

package/dist/safety/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAYH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAmBzE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sEAAsE;IACtE,KAAK,CAAC,EAAE;QACP,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,mDAAmD;IACnD,YAAY,CAAC,EAAE;QACd,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,0CAA0C;QAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,uDAAuD;QACvD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IAEF,oCAAoC;IACpC,KAAK,CAAC,EAAE;QACP,0EAA0E;QAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,kCAAkC;IAClC,OAAO,CAAC,EAAE;QACT,8DAA8D;QAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,iDAAiD;QACjD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,uEAAuE;QACvE,eAAe,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACR,oDAAoD;QACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,0CAA0C;QAC1C,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,yCAAyC;QACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACF;AAimBD,wBAAgB,UAAU,CAAC,KAAK,UAAQ,GAAG,gBAAgB,GAAG,IAAI,CAgDjE;AAoGD,wBAAsB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAuBD;AAqJD,qBAAa,WAAY,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CA0BA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,EAC5B,KAAK,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAmEA;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,IAAI,CASnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,GAAG,IAAI,CAM1D"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/safety/policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+FG;AAYH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,6BAA6B,CAAC;AAmBzE;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAChC,uEAAuE;IACvE,KAAK,CAAC,EAAE,MAAM,CAAC;IAEf,sEAAsE;IACtE,KAAK,CAAC,EAAE;QACP,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,sEAAsE;QACtE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,mDAAmD;IACnD,YAAY,CAAC,EAAE;QACd,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,4CAA4C;QAC5C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,gEAAgE;QAChE,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,0CAA0C;QAC1C,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,8DAA8D;IAC9D,MAAM,CAAC,EAAE;QACR,uDAAuD;QACvD,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;KACpB,CAAC;IAEF,oCAAoC;IACpC,KAAK,CAAC,EAAE;QACP,0EAA0E;QAC1E,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;QACnB,2DAA2D;QAC3D,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IAEF,kCAAkC;IAClC,OAAO,CAAC,EAAE;QACT,8DAA8D;QAC9D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,+DAA+D;QAC/D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,iDAAiD;QACjD,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,uEAAuE;QACvE,eAAe,CAAC,EAAE,OAAO,CAAC;KAC1B,CAAC;IAEF;;;;;;OAMG;IACH,MAAM,CAAC,EAAE;QACR,oDAAoD;QACpD,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAC7B,0CAA0C;QAC1C,yBAAyB,CAAC,EAAE,MAAM,CAAC;QACnC,yCAAyC;QACzC,qBAAqB,CAAC,EAAE,MAAM,CAAC;KAC/B,CAAC;CACF;AA6lBD,wBAAgB,UAAU,CAAC,KAAK,UAAQ,GAAG,gBAAgB,GAAG,IAAI,CAgDjE;AAoGD,wBAAsB,WAAW,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC;IAC1E,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC,CAuBD;AAqJD,qBAAa,WAAY,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI3B;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG;IAClD,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CA0BA;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CACjC,OAAO,EAAE;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,EAC5B,KAAK,CAAC,EAAE;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,kBAAkB,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D;IACF,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CAChB,CAmEA;AAED;;GAEG;AACH,wBAAgB,eAAe,IAAI,gBAAgB,CAAC,QAAQ,CAAC,GAAG,IAAI,CASnE;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,gBAAgB,GAAG,IAAI,CAM1D"}

package/dist/safety/policy.js

@@ -100,7 +100,7 @@ import { Type } from "@sinclair/typebox";
 import { parse as parseTOML } from "smol-toml";
 import { PATHS } from "../config/constants.js";
 import { extractDependencies } from "../utils/dependency-extractor.js";
-import { safeJsonParse } from "../utils/json.js";
+import { isRecord, safeJsonParse } from "../utils/json.js";
 import { createLogger } from "../utils/logger.js";
 import { getHomeDir, resolveEnvPath } from "../utils/path-expansion.js";
 import { uniquePaths } from "../utils/path-utils.js";
@@ -186,9 +186,6 @@ let cachedPolicy = null;
 let cachedPolicyKey = null;
 let cachedPolicyLayers = [];
 let policyWatchers = [];
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function getPolicySources() {
     const sources = [];
     const userPolicyPath = getEffectiveUserPolicyPath();