@evalops/maestro 0.10.50 → 0.10.53

package/dist/agent/types.js.map

@@ -1 +1 @@
-{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG","sourcesContent":["/**\n * @fileoverview Core Type Definitions for Maestro Agent\n *\n * This module defines the fundamental types used throughout the Maestro AI system,\n * including message formats, tool definitions, model configurations, and agent state.\n *\n * ## Type Categories\n *\n * ### Message Types\n * - {@link UserMessage} - Messages from the human user\n * - {@link AssistantMessage} - Responses from the AI assistant\n * - {@link ToolResultMessage} - Results from tool executions\n * - {@link Message} - Union of all message types\n *\n * ### Content Types\n * - {@link TextContent} - Plain text content blocks\n * - {@link ImageContent} - Base64-encoded images\n * - {@link ThinkingContent} - Extended reasoning traces\n * - {@link ToolCall} - Tool invocation requests\n *\n * ### Tool Types\n * - {@link Tool} - Tool definition schema (for API)\n * - {@link AgentTool} - Tool with execute function (for runtime)\n * - {@link AgentToolResult} - Return value from tool execution\n *\n * ### Configuration Types\n * - {@link Model} - LLM model configuration\n * - {@link AgentState} - Current state of an agent\n * - {@link AgentRunConfig} - Runtime configuration\n *\n * @module agent/types\n */\n\nimport type { GuardedFilesPolicySettings } from \"@evalops/contracts\";\nimport type { TSchema } from \"@sinclair/typebox\";\nimport type { PromptProjectDocManifest } from \"../config/index.js\";\nimport type { UnifiedContextManifest } from \"../context/manifest-types.js\";\nimport type { PromptMetadata } from \"../prompts/types.js\";\nimport type { SkillArtifactMetadata } from \"../skills/artifact-metadata.js\";\nimport type { CheckpointProfiler } from \"../utils/checkpoint-profiler.js\";\nimport type {\n\tActionApprovalDecision,\n\tActionApprovalRequest,\n} from \"./action-approval.js\";\nimport type { ToolCapabilityMetadata } from \"./tool-capability-types.js\";\nimport type { ToolRetryDecision, ToolRetryRequest } from \"./tool-retry.js\";\n\n/**\n * API format identifier for different LLM provider APIs.\n *\n * Each provider may support different API formats:\n * - `openai-completions` - OpenAI Chat Completions API\n * - `openai-responses` - OpenAI Responses API (newer format)\n * - `openai-codex-responses` - ChatGPT Codex Responses backend\n * - `openai-codex-app-server` - Local Codex app-server with ChatGPT sign-in\n * - `anthropic-messages` - Anthropic Messages API\n * - `google-generative-ai` - Google Generative AI (Gemini)\n * - `google-gemini-cli` - Google Cloud Code Assist (Gemini CLI)\n * - `bedrock-converse` - AWS Bedrock Converse API\n * - `scripted-replay` - Deterministic local scenario replay provider\n */\nexport type Api =\n\t| \"openai-completions\"\n\t| \"openai-responses\"\n\t| \"openai-codex-responses\"\n\t| \"openai-codex-app-server\"\n\t| \"anthropic-messages\"\n\t| \"google-generative-ai\"\n\t| \"google-gemini-cli\"\n\t| \"bedrock-converse\"\n\t| \"vertex-ai\"\n\t| \"scripted-replay\";\n\nexport interface OpenAICompatOverrides {\n\tsupportsStore?: boolean;\n\tsupportsDeveloperRole?: boolean;\n\tsupportsReasoningEffort?: boolean;\n\tsupportsResponsesApi?: boolean;\n\t/** Supports Anthropic-style cache_control (OpenRouter with Claude models) */\n\tsupportsCacheControl?: boolean;\n\tmaxTokensField?: \"max_tokens\" | \"max_completion_tokens\";\n\trequiresToolResultName?: boolean;\n\trequiresAssistantAfterToolResult?: boolean;\n\trequiresThinkingAsText?: boolean;\n\trequiresMistralToolIds?: boolean;\n}\n\n/**\n * Well-known LLM provider identifiers.\n *\n * These are the officially supported providers with built-in configurations:\n * - `anthropic` - Anthropic (Claude models)\n * - `bedrock` - AWS Bedrock\n * - `google` - Google AI (Gemini models)\n * - `openai` - OpenAI (GPT models)\n * - `azure-openai` - Azure OpenAI\n * - `writer` - Writer.com\n * - `xai` - xAI (Grok models)\n * - `groq` - Groq\n * - `cerebras` - Cerebras\n * - `openrouter` - OpenRouter (aggregator)\n * - `zai` - Z.ai (Zhipu GLM)\n * - `deepseek` - DeepSeek\n * - `moonshot` - Moonshot AI (Kimi)\n * - `dashscope` - Alibaba Qwen (DashScope)\n * - `minimax` - MiniMax\n */\nexport type KnownProvider =\n\t| \"anthropic\"\n\t| \"bedrock\"\n\t| \"google\"\n\t| \"openai\"\n\t| \"openai-codex\"\n\t| \"azure-openai\"\n\t| \"writer\"\n\t| \"xai\"\n\t| \"groq\"\n\t| \"cerebras\"\n\t| \"openrouter\"\n\t| \"zai\"\n\t| \"deepseek\"\n\t| \"moonshot\"\n\t| \"dashscope\"\n\t| \"minimax\";\n\n/**\n * Provider identifier - either a known provider or a custom string.\n * Custom providers can be used with OpenAI-compatible APIs.\n */\nexport type Provider = KnownProvider | string;\n\n/**\n * Reasoning effort level for models that support extended thinking.\n *\n * Higher levels produce more detailed reasoning at increased latency:\n * - `minimal` - Brief chain-of-thought hints\n * - `low` - Short reasoning steps\n * - `medium` - Moderate reasoning depth (recommended default)\n * - `high` - Thorough step-by-step reasoning\n * - `ultra` - Maximum reasoning depth (for complex problems)\n *\n * Note: Claude Code uses keywords \"think\", \"think hard\", \"think harder\", \"ultrathink\"\n * which map to low, medium, high, ultra respectively.\n */\nexport type ReasoningEffort = \"minimal\" | \"low\" | \"medium\" | \"high\" | \"ultra\";\n\n/**\n * Plain text content block within a message.\n *\n * @example\n * ```typescript\n * const content: TextContent = {\n *   type: \"text\",\n *   text: \"Hello, how can I help you today?\"\n * };\n * ```\n */\nexport interface TextContent {\n\t/** Discriminator for content block type */\n\ttype: \"text\";\n\t/** The text content */\n\ttext: string;\n\t/** Optional signature for content verification */\n\ttextSignature?: string;\n}\n\n/**\n * Extended thinking/reasoning content block.\n *\n * Contains the model's internal reasoning process when extended\n * thinking is enabled. This is typically hidden from end users\n * but useful for debugging and understanding model behavior.\n */\nexport interface ThinkingContent {\n\t/** Discriminator for content block type */\n\ttype: \"thinking\";\n\t/** The thinking/reasoning trace */\n\tthinking: string;\n\t/** Optional signature for content verification */\n\tthinkingSignature?: string;\n}\n\n/**\n * Base64-encoded image content block.\n *\n * Used for including images in user messages (vision input)\n * or tool results (screenshots, generated images).\n *\n * @example\n * ```typescript\n * const image: ImageContent = {\n *   type: \"image\",\n *   data: \"iVBORw0KGgo...\", // base64 encoded\n *   mimeType: \"image/png\"\n * };\n * ```\n */\nexport interface ImageContent {\n\t/** Discriminator for content block type */\n\ttype: \"image\";\n\t/** Base64-encoded image data */\n\tdata: string;\n\t/** MIME type (e.g., \"image/png\", \"image/jpeg\") */\n\tmimeType: string;\n}\n\n/**\n * Tool invocation request within an assistant message.\n *\n * When the model decides to use a tool, it emits a ToolCall\n * content block specifying which tool to call and with what arguments.\n *\n * @example\n * ```typescript\n * const toolCall: ToolCall = {\n *   type: \"toolCall\",\n *   id: \"call_abc123\",\n *   name: \"read\",\n *   arguments: { file_path: \"/src/index.ts\" }\n * };\n * ```\n */\nexport interface ToolCall {\n\t/** Discriminator for content block type */\n\ttype: \"toolCall\";\n\t/** Unique identifier for this tool call (used to match results) */\n\tid: string;\n\t/** Name of the tool to invoke */\n\tname: string;\n\t/** Arguments to pass to the tool */\n\targuments: Record<string, unknown>;\n\t/**\n\t * Provider-specific signature used by some APIs (notably Gemini 3) to\n\t * associate tool calls with preceding thoughts. If present, it must be\n\t * preserved across turns when replaying the message history back to the provider.\n\t */\n\tthoughtSignature?: string;\n}\n\nexport type ToolSchedulingDecisionKind =\n\t| \"scheduled\"\n\t| \"parallelized\"\n\t| \"delayed\"\n\t| \"serialized\"\n\t| \"cached\"\n\t| \"skipped\";\n\nexport interface ToolSchedulingDecision {\n\t/** Tool call identifier; duplicated here for standalone telemetry use. */\n\tcallId: string;\n\t/** Tool name, never arguments. */\n\ttoolName: string;\n\t/** Zero-based order from the model-emitted tool-call list. */\n\temittedIndex: number;\n\t/** Scheduler wave number when the call entered an execution wave. */\n\twaveIndex?: number;\n\t/** Scheduler outcome for this call. */\n\tdecision: ToolSchedulingDecisionKind;\n\t/** Stable reason code; intentionally avoids raw paths and arguments. */\n\treason: string;\n\t/** Time spent waiting inside the scheduler after model emission. */\n\tschedulerWaitMs?: number;\n\t/** True when an MCP server opt-in made the call parallel-safe. */\n\tmcpOptIn?: boolean;\n\t/** True when execution was served from reusable tool-result state. */\n\tcacheHit?: boolean;\n\t/** True when an in-flight mutation forced a wait or serialization. */\n\tblockedByMutation?: boolean;\n}\n\nexport type ToolPhaseDecisionOutcome =\n\t| \"parallelized\"\n\t| \"serialized\"\n\t| \"delayed\"\n\t| \"cached\"\n\t| \"skipped\";\n\nexport interface ToolPhaseDecision {\n\ttoolCallId: string;\n\ttoolName: string;\n\temittedIndex: number;\n\toutcome: ToolPhaseDecisionOutcome;\n\tdecision: ToolPhaseDecisionOutcome;\n\treason: string;\n\twaveIndex?: number;\n\twaitMs: number;\n\tschedulerWaitMs: number;\n\tmcpOptIn?: boolean;\n\tcacheHit?: boolean;\n\tblockedByMutation?: boolean;\n}\n\nexport interface ParallelismScopeMetadata {\n\tpathScope?: string[];\n\tpathScopeSource?: \"annotation\" | \"known_tool\";\n\tpathArgumentKeys?: string[];\n}\n\nexport interface ParallelismGatedEvent extends ParallelismScopeMetadata {\n\ttype: \"parallelism_gated\";\n\ttoolCallId: string;\n\ttoolName: string;\n\treason: \"mutation_scope_overlap\" | \"mutation_unknown_write_set\";\n\tqueueDepth: number;\n\tpendingMutations: number;\n\tpendingToolCallIds: string[];\n\tpendingToolNames: string[];\n}\n\nexport interface ParallelConflictDetectedEvent\n\textends ParallelismScopeMetadata {\n\ttype: \"parallel_conflict_detected\";\n\ttoolCallId: string;\n\ttoolName: string;\n\tconflictingToolCallId: string;\n\tconflictingToolName: string;\n\tconflictingPathScope?: string[];\n\tconflictingPathScopeSource?: \"annotation\" | \"known_tool\";\n}\n\nexport interface ToolPhaseBatchShapingFeedback {\n\tavoidableSingleton: boolean;\n\treason: string;\n\thint: string;\n}\n\nexport interface ToolPhaseSummary {\n\ttype: \"tool_phase_summary\";\n\tmodelToolCallCount: number;\n\tmodelEmittedToolCallCount: number;\n\tschedulableWaveCount: number;\n\tparallelizedCallCount: number;\n\tactuallyParallelizedCallCount: number;\n\tserializedCallCount: number;\n\tdelayedCallCount: number;\n\tblockedByMutationCount: number;\n\tmcpOptInCallCount: number;\n\tmcpOptInUseCount: number;\n\tcacheHitCount: number;\n\ttotalToolWaitMs: number;\n\ttoolWaitTimeMs: number;\n\tserializationReasons: Record<string, number>;\n\tdecisions: ToolPhaseDecision[];\n\tbatchShapingFeedback?: ToolPhaseBatchShapingFeedback;\n}\n\n/**\n * Token usage and cost information for a message or request.\n *\n * Tracks input/output tokens and cache utilization for cost monitoring\n * and context window management.\n */\nexport interface Usage {\n\t/** Number of input tokens consumed */\n\tinput: number;\n\t/** Number of output tokens generated */\n\toutput: number;\n\t/** Tokens served from prompt cache (reduces cost) */\n\tcacheRead: number;\n\t/** Tokens written to prompt cache */\n\tcacheWrite: number;\n\t/** Calculated cost breakdown in USD */\n\tcost: {\n\t\t/** Cost for input tokens */\n\t\tinput: number;\n\t\t/** Cost for output tokens */\n\t\toutput: number;\n\t\t/** Cost savings from cache reads */\n\t\tcacheRead: number;\n\t\t/** Cost for cache writes */\n\t\tcacheWrite: number;\n\t\t/** Total cost for this message/request */\n\t\ttotal: number;\n\t};\n}\n\n/**\n * Reason why the model stopped generating.\n *\n * - `stop` - Natural completion (end of response)\n * - `length` - Hit max_tokens limit\n * - `toolUse` - Model wants to use a tool (generation paused)\n * - `error` - An error occurred during generation\n * - `aborted` - Request was cancelled by the user\n */\nexport type StopReason = \"stop\" | \"length\" | \"toolUse\" | \"error\" | \"aborted\";\n\n/**\n * Message from the human user.\n *\n * User messages can contain plain text or an array of content blocks\n * (for multi-modal input with images).\n *\n * @example\n * ```typescript\n * // Simple text message\n * const msg: UserMessage = {\n *   role: \"user\",\n *   content: \"What is this code doing?\",\n *   timestamp: Date.now()\n * };\n *\n * // Message with image\n * const multiModal: UserMessage = {\n *   role: \"user\",\n *   content: [\n *     { type: \"text\", text: \"What's in this screenshot?\" },\n *     { type: \"image\", data: base64Data, mimeType: \"image/png\" }\n *   ],\n *   timestamp: Date.now()\n * };\n * ```\n */\nexport interface UserMessage {\n\t/** Message role discriminator */\n\trole: \"user\";\n\t/** Message content - string or array of content blocks */\n\tcontent: string | (TextContent | ImageContent)[];\n\t/** Optional non-LLM metadata for runtime bookkeeping */\n\tmetadata?: Record<string, unknown>;\n\t/** Unix timestamp in milliseconds when message was created */\n\ttimestamp: number;\n}\n\n/**\n * Response message from the AI assistant.\n *\n * Contains the model's response along with metadata about the generation\n * including token usage, stop reason, and provider information.\n *\n * The content array may contain:\n * - {@link TextContent} - The actual response text\n * - {@link ThinkingContent} - Extended reasoning (if enabled)\n * - {@link ToolCall} - Tool invocation requests\n */\nexport interface AssistantMessage {\n\t/** Message role discriminator */\n\trole: \"assistant\";\n\t/** Array of content blocks (text, thinking, tool calls) */\n\tcontent: (TextContent | ThinkingContent | ToolCall)[];\n\t/** API format used for this response */\n\tapi: Api;\n\t/** Provider that generated this response */\n\tprovider: Provider;\n\t/** Model ID that generated this response */\n\tmodel: string;\n\t/** Token usage and cost information */\n\tusage: Usage;\n\t/** Reason why generation stopped */\n\tstopReason: StopReason;\n\t/** Error message if stopReason is \"error\" */\n\terrorMessage?: string;\n\t/** Unix timestamp in milliseconds when message was created */\n\ttimestamp: number;\n}\n\n/**\n * Result message from a tool execution.\n *\n * After a tool is executed, the result is sent back to the model\n * as a ToolResultMessage so it can incorporate the information\n * into its response.\n *\n * @typeParam TDetails - Type of additional details attached to the result\n *\n * @example\n * ```typescript\n * const result: ToolResultMessage = {\n *   role: \"toolResult\",\n *   toolCallId: \"call_abc123\",\n *   toolName: \"read\",\n *   content: [{ type: \"text\", text: \"file contents...\" }],\n *   isError: false,\n *   timestamp: Date.now()\n * };\n * ```\n */\nexport interface ToolResultMessage<TDetails = unknown> {\n\t/** Message role discriminator */\n\trole: \"toolResult\";\n\t/** ID of the tool call this result corresponds to */\n\ttoolCallId: string;\n\t/** Name of the tool that was executed */\n\ttoolName: string;\n\t/** Result content (text or images) */\n\tcontent: (TextContent | ImageContent)[];\n\t/** Optional additional details about the execution */\n\tdetails?: TDetails;\n\t/** Whether the tool execution resulted in an error */\n\tisError: boolean;\n\t/** Unix timestamp in milliseconds when result was created */\n\ttimestamp: number;\n}\n\n/**\n * Message type for hook-injected messages.\n *\n * Hooks can inject these into the conversation. They are converted to user\n * messages for LLM context and can optionally be hidden from the UI.\n */\nexport interface HookMessage<T = unknown> {\n\t/** Message role discriminator */\n\trole: \"hookMessage\";\n\t/** Hook-defined message category */\n\tcustomType: string;\n\t/** Message content - string or array of content blocks */\n\tcontent: string | (TextContent | ImageContent)[];\n\t/** Whether to render this message in the UI */\n\tdisplay: boolean;\n\t/** Optional hook-specific metadata (not sent to the LLM) */\n\tdetails?: T;\n\t/** Unix timestamp in milliseconds when message was created */\n\ttimestamp: number;\n}\n\n/**\n * Message type for branch summaries when navigating session trees.\n */\nexport interface BranchSummaryMessage {\n\t/** Message role discriminator */\n\trole: \"branchSummary\";\n\t/** Summary text */\n\tsummary: string;\n\t/** ID of the branch point this summary came from */\n\tfromId: string;\n\t/** Unix timestamp in milliseconds when summary was created */\n\ttimestamp: number;\n}\n\n/**\n * Message type for compaction summaries.\n */\nexport interface CompactionSummaryMessage {\n\t/** Message role discriminator */\n\trole: \"compactionSummary\";\n\t/** Summary text */\n\tsummary: string;\n\t/** Token count before compaction (for diagnostics) */\n\ttokensBefore: number;\n\t/** Unix timestamp in milliseconds when summary was created */\n\ttimestamp: number;\n}\n\n/**\n * Union type representing LLM-native messages that can be sent to the model.\n *\n * A conversation with the LLM consists of user input, assistant responses,\n * and tool results.\n */\nexport type Message = UserMessage | AssistantMessage | ToolResultMessage;\n\n/**\n * Empty interface for declaration merging to add custom message types.\n *\n * Consumers can extend this interface to add their own message types:\n *\n * @example\n * ```typescript\n * declare module \"@evalops/maestro\" {\n *   interface CustomAgentMessages {\n *     notification: { role: \"notification\"; text: string; timestamp: number };\n *   }\n * }\n * ```\n */\n// biome-ignore lint/suspicious/noEmptyInterface: Required for declaration merging\nexport interface CustomAgentMessages {}\n\n/**\n * Union type representing all messages in the agent conversation history.\n *\n * Includes both LLM-native messages (user, assistant, toolResult) and\n * custom message types (hookMessage, branchSummary, compactionSummary,\n * plus any types added via declaration merging).\n *\n * Custom messages are preserved in session history but filtered out\n * before being sent to the LLM via {@link convertToLlm}.\n */\nexport type AgentMessage =\n\t| Message\n\t| HookMessage\n\t| BranchSummaryMessage\n\t| CompactionSummaryMessage\n\t| CustomAgentMessages[keyof CustomAgentMessages];\n\n/**\n * Tool definition schema for API serialization.\n *\n * This interface defines a tool's metadata and parameter schema\n * for transmission to the LLM. The actual execution logic is in\n * {@link AgentTool}.\n *\n * @typeParam TParameters - TypeBox schema for the tool's parameters\n *\n * @example\n * ```typescript\n * import { Type } from \"@sinclair/typebox\";\n *\n * const readTool: Tool = {\n *   name: \"read\",\n *   description: \"Read a file from the filesystem\",\n *   parameters: Type.Object({\n *     file_path: Type.String({ description: \"Path to the file\" })\n *   })\n * };\n * ```\n */\nexport interface Tool<TParameters extends TSchema = TSchema> {\n\t/** Unique tool identifier */\n\tname: string;\n\t/** Human-readable description of what the tool does */\n\tdescription: string;\n\t/** TypeBox schema defining the tool's parameters */\n\tparameters: TParameters;\n\t/** Optional categorization (e.g., \"file\", \"shell\", \"web\") */\n\ttoolType?: string;\n\t/** Example inputs for documentation/few-shot prompting */\n\tinputExamples?: unknown[];\n\t/** List of caller identifiers allowed to use this tool */\n\tallowedCallers?: string[];\n\t/** If true, don't send tool definition to API (used for internal tools) */\n\tdeferApiDefinition?: boolean;\n}\n\n/**\n * Behavioral hints for tools (from MCP annotations).\n *\n * These hints help the model and UI understand the tool's behavior\n * for better decision-making and user feedback.\n */\nexport interface ToolAnnotations {\n\t/** If true, the tool does not modify its environment (safe to retry) */\n\treadOnlyHint?: boolean;\n\t/** If true, the tool may perform destructive/irreversible updates */\n\tdestructiveHint?: boolean;\n\t/** If true, mutating calls are scoped to explicit path arguments */\n\tpathScopedMutationHint?: boolean;\n\t/** If true, calling repeatedly with same args has no additional effect */\n\tidempotentHint?: boolean;\n\t/** If true, the tool interacts with external systems (network, APIs) */\n\topenWorldHint?: boolean;\n}\n\nexport interface McpToolSourceMetadata {\n\ttype: \"mcp\";\n\tserver: string;\n\ttool: string;\n\tcapability?: ToolCapabilityMetadata;\n\tsupportsParallelToolCalls?: boolean;\n\tparallelSafetyProvenance?: \"static_config\" | \"server_capability\" | \"none\";\n\tparallelMaxConcurrency?: number;\n}\n\nexport type ToolSourceMetadata = McpToolSourceMetadata;\n\n/**\n * Complete tool definition with execute function.\n *\n * This is the runtime representation of a tool, including both\n * the schema (for the LLM) and the execute function (for the runtime).\n *\n * @typeParam TParameters - TypeBox schema for the tool's parameters\n * @typeParam TDetails - Type of additional details returned with results\n *\n * @example\n * ```typescript\n * import { Type } from \"@sinclair/typebox\";\n *\n * const readTool: AgentTool = {\n *   name: \"read\",\n *   description: \"Read a file from the filesystem\",\n *   parameters: Type.Object({\n *     file_path: Type.String()\n *   }),\n *   execute: async (toolCallId, params) => {\n *     const content = await fs.readFile(params.file_path, \"utf-8\");\n *     return { content: [{ type: \"text\", text: content }] };\n *   }\n * };\n * ```\n */\nexport interface AgentTool<\n\tTParameters extends TSchema = TSchema,\n\tTDetails = unknown,\n> {\n\t/** Unique tool identifier */\n\tname: string;\n\t/** Display label for UI (defaults to name) */\n\tlabel?: string;\n\t/** Human-readable description of what the tool does */\n\tdescription: string;\n\t/** TypeBox schema defining the tool's parameters */\n\tparameters: TParameters;\n\t/** Tool behavior hints from MCP annotations */\n\tannotations?: ToolAnnotations;\n\t/** Exact runtime provenance for bridged or remote tool sources */\n\tsource?: ToolSourceMetadata;\n\t/** Optional categorization (e.g., \"file\", \"shell\", \"web\") */\n\ttoolType?: string;\n\t/**\n\t * Where the tool should be executed.\n\t * - `\"server\"`: (default) Executed by the backend agent\n\t * - `\"client\"`: Executed by the client (VS Code, browser) via callback\n\t */\n\texecutionLocation?: \"server\" | \"client\";\n\t/** Example inputs for documentation/few-shot prompting */\n\tinputExamples?: unknown[];\n\t/** List of caller identifiers allowed to use this tool */\n\tallowedCallers?: string[];\n\t/** If true, don't send tool definition to API */\n\tdeferApiDefinition?: boolean;\n\t/** Optional max retries configured by the tool itself */\n\tmaxRetries?: number;\n\t/** Optional retry delay configured by the tool itself */\n\tretryDelayMs?: number;\n\t/** Optional tool-level retry predicate */\n\tshouldRetry?: (error: unknown) => boolean;\n\t/** Optional compact summary used after a tool finishes. */\n\tgetToolUseSummary?: (params: Record<string, unknown>) => string | null;\n\t/** Optional human-facing label used for live tool UI. */\n\tgetDisplayName?: (params: Record<string, unknown>) => string | null;\n\t/** Optional present-tense activity label used while a tool is running. */\n\tgetActivityDescription?: (params: Record<string, unknown>) => string | null;\n\t/**\n\t * Execute the tool with the given parameters.\n\t *\n\t * @param toolCallId - Unique identifier for this tool call\n\t * @param params - Parameters matching the tool's schema\n\t * @param signal - Optional AbortSignal for cancellation\n\t * @param context - Optional execution context (sandbox, etc.)\n\t * @param onUpdate - Optional callback for partial tool output streaming\n\t * @returns Tool result with content and optional details\n\t */\n\texecute: (\n\t\ttoolCallId: string,\n\t\tparams: Record<string, unknown>,\n\t\tsignal?: AbortSignal,\n\t\tcontext?: { sandbox?: import(\"../sandbox/types.js\").Sandbox },\n\t\tonUpdate?: AgentToolUpdateCallback<TDetails>,\n\t) => AgentToolResult<TDetails> | Promise<AgentToolResult<TDetails>>;\n}\n\nexport type AgentToolUpdateCallback<TDetails = unknown> = (\n\tpartial: AgentToolResult<TDetails>,\n) => void;\n\n/**\n * Result returned from tool execution.\n *\n * @typeParam TDetails - Type of additional details attached to the result\n */\nexport interface AgentToolResult<TDetails = unknown> {\n\t/** Result content (text or images) */\n\tcontent: (TextContent | ImageContent)[];\n\t/** Optional additional details about the execution */\n\tdetails?: TDetails;\n\t/** Whether the execution resulted in an error */\n\tisError?: boolean;\n\t/** Optional Platform ToolExecution identifier used for audit joins */\n\ttoolExecutionId?: string;\n\t/** Optional Platform approval request identifier correlated to ToolExecution */\n\tapprovalRequestId?: string;\n}\n\n/**\n * Conversation context for LLM requests.\n *\n * Contains the system prompt, conversation history, and available tools\n * for a single LLM request.\n */\nexport interface Context {\n\t/** System prompt providing instructions and context */\n\tsystemPrompt?: string;\n\t/** Conversation history */\n\tmessages: Message[];\n\t/** Tools available for the model to use */\n\ttools?: Tool[];\n}\n\n/**\n * Streaming events during assistant message construction.\n *\n * These events are emitted as the LLM generates its response, enabling\n * real-time UI updates and progress tracking.\n *\n * ## Event Types\n *\n * | Type | Description |\n * |------|-------------|\n * | `start` | Message generation started |\n * | `text_start` | New text content block started |\n * | `text_delta` | Incremental text content |\n * | `text_end` | Text content block completed |\n * | `thinking_start` | Extended thinking block started |\n * | `thinking_delta` | Incremental thinking content |\n * | `thinking_end` | Thinking block completed |\n * | `toolcall_start` | Tool call started |\n * | `toolcall_delta` | Incremental tool call args |\n * | `toolcall_end` | Tool call completed |\n * | `done` | Generation completed successfully |\n * | `error` | Generation failed or was aborted |\n */\nexport type AssistantMessageEvent =\n\t| {\n\t\t\t/** Message generation started */\n\t\t\ttype: \"start\";\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** New text content block started */\n\t\t\ttype: \"text_start\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental text content received */\n\t\t\ttype: \"text_delta\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** New text to append */\n\t\t\tdelta: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Text content block completed */\n\t\t\ttype: \"text_end\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Final text content */\n\t\t\tcontent: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Extended thinking block started */\n\t\t\ttype: \"thinking_start\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental thinking content received */\n\t\t\ttype: \"thinking_delta\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** New thinking text to append */\n\t\t\tdelta: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Thinking content block completed */\n\t\t\ttype: \"thinking_end\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Final thinking content */\n\t\t\tcontent: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Tool call started */\n\t\t\ttype: \"toolcall_start\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental tool call arguments received */\n\t\t\ttype: \"toolcall_delta\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** New JSON fragment to append to arguments */\n\t\t\tdelta: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Tool call completed */\n\t\t\ttype: \"toolcall_end\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Completed tool call */\n\t\t\ttoolCall: ToolCall;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Provider-owned tool execution started outside Maestro's local executor */\n\t\t\ttype: \"provider_tool_execution_start\";\n\t\t\t/** Provider tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Provider tool name */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Provider tool arguments */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Provider-owned tool execution produced an incremental update */\n\t\t\ttype: \"provider_tool_execution_update\";\n\t\t\t/** Provider tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Provider tool name */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Provider tool arguments */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Partial provider result */\n\t\t\tpartialResult: AgentToolResult;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Provider-owned tool execution completed outside Maestro's local executor */\n\t\t\ttype: \"provider_tool_execution_end\";\n\t\t\t/** Provider tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Provider tool name */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Provider tool result */\n\t\t\tresult: ToolResultMessage;\n\t\t\t/** Whether the provider tool returned an error */\n\t\t\tisError: boolean;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Optional Platform approval request identifier correlated to ToolExecution */\n\t\t\tapprovalRequestId?: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Generation completed successfully */\n\t\t\ttype: \"done\";\n\t\t\t/** Reason for completion */\n\t\t\treason: Extract<StopReason, \"stop\" | \"length\" | \"toolUse\">;\n\t\t\t/** Final assistant message */\n\t\t\tmessage: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Generation failed or was aborted */\n\t\t\ttype: \"error\";\n\t\t\t/** Reason for failure */\n\t\t\treason: Extract<StopReason, \"aborted\" | \"error\">;\n\t\t\t/** Error message details */\n\t\t\terror: AssistantMessage;\n\t  };\n\n/**\n * LLM model configuration.\n *\n * Contains all the information needed to use a model, including\n * API endpoints, capabilities, and pricing.\n *\n * @typeParam TApi - The API format this model uses\n *\n * @example\n * ```typescript\n * const claude: Model<\"anthropic-messages\"> = {\n *   id: \"claude-sonnet-4-5-20250929\",\n *   name: \"Claude Sonnet 4.5\",\n *   api: \"anthropic-messages\",\n *   provider: \"anthropic\",\n *   baseUrl: \"https://api.anthropic.com/v1\",\n *   reasoning: true,\n *   input: [\"text\", \"image\"],\n *   cost: { input: 3.00, output: 15.00, cacheRead: 0.30, cacheWrite: 3.75 },\n *   contextWindow: 200000,\n *   maxTokens: 8192\n * };\n * ```\n */\nexport interface Model<TApi extends Api> {\n\t/** Unique model identifier (e.g., \"claude-sonnet-4-5-20250929\") */\n\tid: string;\n\t/** Human-readable model name (e.g., \"Claude Sonnet 4.5\") */\n\tname: string;\n\t/** API format used for requests */\n\tapi: TApi;\n\t/** Provider serving this model */\n\tprovider: Provider;\n\t/** Base URL for API requests */\n\tbaseUrl: string;\n\t/** Optional custom headers to include in API requests */\n\theaders?: Record<string, string>;\n\t/** Optional OpenAI-compatibility overrides for vendor quirks */\n\tcompat?: OpenAICompatOverrides;\n\t/** Whether the model supports extended thinking */\n\treasoning: boolean;\n\t/** Whether the model supports tool use */\n\ttoolUse?: boolean;\n\t/** Supported input modalities */\n\tinput: (\"text\" | \"image\")[];\n\t/** Cost per million tokens in USD */\n\tcost: {\n\t\t/** Input token cost */\n\t\tinput: number;\n\t\t/** Output token cost */\n\t\toutput: number;\n\t\t/** Cache read cost (typically discounted) */\n\t\tcacheRead: number;\n\t\t/** Cache write cost */\n\t\tcacheWrite: number;\n\t};\n\t/** Maximum context window in tokens */\n\tcontextWindow: number;\n\t/** Maximum output tokens per response */\n\tmaxTokens: number;\n}\n\n/**\n * File attachment for messages.\n *\n * Represents an uploaded file (image or document) that can be\n * included in a user message.\n */\nexport interface Attachment {\n\t/** Unique identifier for this attachment */\n\tid: string;\n\t/** Type of attachment */\n\ttype: \"image\" | \"document\";\n\t/** Original filename */\n\tfileName: string;\n\t/** MIME type of the file */\n\tmimeType: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Base64-encoded file content */\n\tcontent: string;\n\t/** Extracted text content (for documents) */\n\textractedText?: string;\n\t/** Preview image (for documents) */\n\tpreview?: string;\n}\n\n/**\n * User-configurable thinking level for extended reasoning.\n *\n * Controls how much computational effort the model spends on\n * reasoning before generating a response.\n *\n * - `off` - No extended thinking\n * - `minimal` - Brief reasoning hints\n * - `low` - Short reasoning steps\n * - `medium` - Moderate reasoning (default)\n * - `high` - Thorough step-by-step reasoning\n * - `max` - Maximum reasoning depth\n */\nexport type ThinkingLevel =\n\t| \"off\"\n\t| \"minimal\"\n\t| \"low\"\n\t| \"medium\"\n\t| \"high\"\n\t| \"ultra\"\n\t| \"max\";\n\n/**\n * User message with optional file attachments.\n *\n * Extends the base UserMessage to support file attachments\n * for rich multi-modal interactions.\n */\nexport type UserMessageWithAttachments = UserMessage & {\n\t/** Optional file attachments */\n\tattachments?: Attachment[];\n};\n\n/**\n * Placeholder for custom message types.\n * Can be extended to add application-specific message types.\n */\nexport interface CustomMessages {\n\thookMessage: HookMessage;\n\tbranchSummary: BranchSummaryMessage;\n\tcompactionSummary: CompactionSummaryMessage;\n}\n\n/**\n * Application-level message type.\n *\n * Union of all message types that can appear in the UI,\n * including user messages with attachments.\n */\nexport type AppMessage =\n\t| AssistantMessage\n\t| UserMessageWithAttachments\n\t| Message\n\t| CustomMessages[keyof CustomMessages];\n\n/**\n * Information about a tool call currently being executed.\n */\nexport interface PendingToolCall {\n\t/** Name of the tool being executed */\n\ttoolName: string;\n\t/** Original arguments passed to the tool */\n\targs?: Record<string, unknown>;\n\t/** Tool metadata captured when execution started */\n\ttool?: Pick<\n\t\tAgentTool,\n\t\t\"label\" | \"getDisplayName\" | \"getToolUseSummary\" | \"getActivityDescription\"\n\t>;\n\t/** Stable display name for live UI */\n\tdisplayName?: string;\n\t/** Stable compact summary for live UI */\n\tsummaryLabel?: string;\n}\n\n/**\n * Current state of an agent instance.\n *\n * This is the central state object managed by the Agent class,\n * containing all information about the current conversation,\n * configuration, and execution status.\n */\nexport interface AgentState {\n\t/** System prompt providing instructions and context */\n\tsystemPrompt: string;\n\t/** Version/hash metadata for the base system prompt instructions */\n\tpromptMetadata?: PromptMetadata;\n\t/** Exact prompt source files layered into the current system prompt */\n\tsystemPromptSourcePaths?: string[];\n\t/** Manifest of project instruction files layered into the current system prompt */\n\tpromptContextManifest?: PromptProjectDocManifest;\n\t/** Full filesystem and MCP context provenance captured for this run */\n\tunifiedContextManifest?: UnifiedContextManifest;\n\t/** Current model configuration */\n\tmodel: Model<Api>;\n\t/** Current thinking level for extended reasoning */\n\tthinkingLevel: ThinkingLevel;\n\t/** Optional reasoning summary preference for Responses API */\n\treasoningSummary?: \"auto\" | \"detailed\" | \"concise\" | null;\n\t/** Available tools for this agent */\n\ttools: AgentTool[];\n\t/**\n\t * Controls how queued steering messages are sent between turns.\n\t * - `\"all\"` - Send all queued messages at once\n\t * - `\"one\"` - Send one message at a time\n\t */\n\tsteeringMode: \"all\" | \"one\";\n\t/**\n\t * Controls how queued follow-up messages are sent between turns.\n\t * - `\"all\"` - Send all queued messages at once\n\t * - `\"one\"` - Send one message at a time\n\t */\n\tfollowUpMode: \"all\" | \"one\";\n\t/**\n\t * @deprecated Use steeringMode/followUpMode instead.\n\t */\n\tqueueMode: \"all\" | \"one\";\n\t/** Conversation history */\n\tmessages: AppMessage[];\n\t/** Whether the agent is currently streaming a response */\n\tisStreaming: boolean;\n\t/** Current streaming message (partial response) */\n\tstreamMessage: Message | null;\n\t/** Tool calls currently being executed */\n\tpendingToolCalls: Map<string, PendingToolCall>;\n\t/** Current error message, if any */\n\terror?: string;\n\t/** Optional sandbox for isolated tool execution */\n\tsandbox?: import(\"../sandbox/types.js\").Sandbox;\n\t/** Current sandbox mode (e.g., \"docker\", \"local\") */\n\tsandboxMode?: string | null;\n\t/** Whether sandboxing is enabled */\n\tsandboxEnabled?: boolean;\n\t/** User identification for tracking */\n\tuser?: {\n\t\t/** User UUID */\n\t\tid: string;\n\t\t/** Organization UUID */\n\t\torgId: string;\n\t};\n\t/** Session information for persistence */\n\tsession?: {\n\t\t/** Session UUID */\n\t\tid: string;\n\t\t/** When the session started */\n\t\tstartedAt: Date;\n\t};\n\t/** Sampling temperature override (0.0-2.0, lower = more deterministic) */\n\ttemperature?: number;\n\t/** Top-p sampling override (0.0-1.0) */\n\ttopP?: number;\n}\n\n/**\n * Events emitted during agent execution.\n *\n * These events provide real-time updates about agent activity,\n * enabling UI updates, logging, and progress tracking.\n *\n * ## Lifecycle Events\n * - `agent_start` - Agent execution started\n * - `agent_end` - Agent execution completed\n * - `turn_start` - New conversation turn started\n * - `turn_end` - Conversation turn completed\n *\n * ## Message Events\n * - `message_start` - New message being constructed\n * - `message_update` - Incremental message update\n * - `message_end` - Message completed\n *\n * ## Tool Events\n * - `tool_execution_start` - Tool execution started\n * - `tool_execution_update` - Tool execution produced partial output\n * - `tool_execution_end` - Tool execution completed\n * - `parallelism_gated` - Scheduler delayed a tool because in-flight mutations made parallel execution unsafe\n * - `parallel_conflict_detected` - Scheduler detected overlapping write scopes while evaluating parallel execution\n * - `tool_batch_summary` - Tool batch completed with a transient summary label\n * - `client_tool_request` - Client-side tool invocation needed\n *\n * ## Approval Events\n * - `action_approval_required` - User approval needed\n * - `action_approval_resolved` - User made approval decision\n *\n * ## Tool Retry Events\n * - `tool_retry_required` - Tool failed and retry decision needed\n * - `tool_retry_resolved` - Tool retry decision resolved\n *\n * ## Status Events\n * - `status` - Status update\n * - `error` - Error occurred\n * - `compaction` - Context was compacted\n */\nexport interface ToolSchedulingMetadata {\n\tclassification:\n\t\t| \"read_only\"\n\t\t| \"path_scoped_mutation\"\n\t\t| \"parallel_safe_mutation\"\n\t\t| \"serialized_mutation\"\n\t\t| \"workflow_serialized\"\n\t\t| \"cache_reuse\"\n\t\t| \"unknown\";\n\treason:\n\t\t| \"read_only_tool\"\n\t\t| \"mcp_parallel_opt_in\"\n\t\t| \"path_scope_available\"\n\t\t| \"path_scope_disjoint\"\n\t\t| \"path_scope_overlap\"\n\t\t| \"pending_mutation\"\n\t\t| \"mutating_tool\"\n\t\t| \"workflow_state_tracker\"\n\t\t| \"cache_hit\"\n\t\t| \"cache_pending\"\n\t\t| \"unknown_tool\";\n\tconcurrencyLimit?: number;\n\tqueueDepth?: number;\n\tpendingMutations?: number;\n\tpathScope?: string[];\n\tpathScopeSource?: \"annotation\" | \"known_tool\";\n\tpathArgumentKeys?: string[];\n\tcache?: \"disabled\" | \"miss\" | \"candidate\" | \"pending_hit\" | \"hit\";\n}\n\nexport type AgentEvent =\n\t| {\n\t\t\t/** Agent execution started */\n\t\t\ttype: \"agent_start\";\n\t\t\t/** Whether this execution is an automatic continuation of the current turn */\n\t\t\tcontinuation?: boolean;\n\t  }\n\t| {\n\t\t\t/** Agent execution completed */\n\t\t\ttype: \"agent_end\";\n\t\t\t/** Final messages from this execution */\n\t\t\tmessages: AppMessage[];\n\t\t\t/** Whether execution was aborted */\n\t\t\taborted?: boolean;\n\t\t\t/** If aborted with partial acceptance, contains the saved partial message */\n\t\t\tpartialAccepted?: AppMessage;\n\t\t\t/** Final stop reason from the LLM - \"length\" indicates output hit the max token limit */\n\t\t\tstopReason?: StopReason;\n\t  }\n\t| {\n\t\t\t/** Status update during execution */\n\t\t\ttype: \"status\";\n\t\t\t/** Status message */\n\t\t\tstatus: string;\n\t\t\t/** Additional details */\n\t\t\tdetails: Record<string, unknown>;\n\t  }\n\t| {\n\t\t\t/** Error occurred during execution */\n\t\t\ttype: \"error\";\n\t\t\t/** Error message */\n\t\t\tmessage: string;\n\t  }\n\t| {\n\t\t\t/** New conversation turn started */\n\t\t\ttype: \"turn_start\";\n\t  }\n\t| {\n\t\t\t/** Conversation turn completed */\n\t\t\ttype: \"turn_end\";\n\t\t\t/** Assistant message from this turn */\n\t\t\tmessage: AppMessage;\n\t\t\t/** Tool results from this turn */\n\t\t\ttoolResults: AppMessage[];\n\t  }\n\t| {\n\t\t\t/** New message being constructed */\n\t\t\ttype: \"message_start\";\n\t\t\t/** The message being built */\n\t\t\tmessage: AppMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental update to current message */\n\t\t\ttype: \"message_update\";\n\t\t\t/** Updated message state */\n\t\t\tmessage: AppMessage;\n\t\t\t/** The streaming event that triggered this update */\n\t\t\tassistantMessageEvent: AssistantMessageEvent;\n\t  }\n\t| {\n\t\t\t/** Message completed */\n\t\t\ttype: \"message_end\";\n\t\t\t/** Final message */\n\t\t\tmessage: AppMessage;\n\t  }\n\t| {\n\t\t\t/** Tool execution started */\n\t\t\ttype: \"tool_execution_start\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Arguments passed to the tool */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Scheduler classification and serialization reason for this call */\n\t\t\tscheduling?: ToolSchedulingMetadata;\n\t  }\n\t| {\n\t\t\t/** Tool execution completed */\n\t\t\ttype: \"tool_execution_end\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Optional approval request identifier correlated to Platform ToolExecution */\n\t\t\tapprovalRequestId?: string;\n\t\t\t/** Optional stable error or outcome code for telemetry and clients */\n\t\t\terrorCode?: string;\n\t\t\t/** Optional governed outcome classification surfaced by the tool result */\n\t\t\tgovernedOutcome?:\n\t\t\t\t| \"approval_required\"\n\t\t\t\t| \"approval_pending\"\n\t\t\t\t| \"authentication_required\"\n\t\t\t\t| \"denied\"\n\t\t\t\t| \"rate_limited\";\n\t\t\t/** Optional selected skill artifact metadata surfaced by the tool result */\n\t\t\tskillMetadata?: SkillArtifactMetadata;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Result from the tool */\n\t\t\tresult: ToolResultMessage;\n\t\t\t/** Whether the tool returned an error */\n\t\t\tisError: boolean;\n\t\t\t/** Scheduler classification and final reuse/serialization reason */\n\t\t\tscheduling?: ToolSchedulingMetadata;\n\t  }\n\t| ParallelismGatedEvent\n\t| ParallelConflictDetectedEvent\n\t| {\n\t\t\t/** LSP diagnostic delta produced by an edit/write tool call */\n\t\t\ttype: \"diagnostic_delta\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** File affected by the diagnostic delta */\n\t\t\tfile: string;\n\t\t\t/** User-facing file path from the tool call */\n\t\t\tdisplayPath: string;\n\t\t\t/** Whether a pre-edit baseline was available */\n\t\t\tusedDelta: boolean;\n\t\t\t/** Newly introduced diagnostic count */\n\t\t\tintroducedCount: number;\n\t\t\t/** Diagnostics repaired by the tool call */\n\t\t\trepairedCount: number;\n\t\t\t/** Remaining diagnostics for the affected file */\n\t\t\tremainingCount: number;\n\t\t\t/** Stable fingerprint for introduced diagnostics */\n\t\t\tfingerprint: string;\n\t\t\t/** Repair attempt number for this fingerprint */\n\t\t\trepairAttempt?: number;\n\t\t\t/** Maximum automatic repair attempts for this fingerprint */\n\t\t\tmaxRepairAttempts?: number;\n\t\t\t/** Whether Agent queued a follow-up repair turn */\n\t\t\twillAutoFollowUp: boolean;\n\t\t\t/** Why a repair follow-up was or was not queued */\n\t\t\treason: string;\n\t  }\n\t| {\n\t\t\t/** Summary emitted after the final tool in a batch completes */\n\t\t\ttype: \"tool_batch_summary\";\n\t\t\t/** Stable one-line summary of what the completed tool batch did */\n\t\t\tsummary: string;\n\t\t\t/** Underlying per-tool summary labels used to build the summary */\n\t\t\tsummaryLabels: string[];\n\t\t\t/** Tool call identifiers included in this batch */\n\t\t\ttoolCallIds: string[];\n\t\t\t/** Tool names included in this batch */\n\t\t\ttoolNames: string[];\n\t\t\t/** Successful tool calls in the batch */\n\t\t\tcallsSucceeded: number;\n\t\t\t/** Failed tool calls in the batch */\n\t\t\tcallsFailed: number;\n\t  }\n\t| ToolPhaseSummary\n\t| {\n\t\t\t/** Tool execution produced partial output */\n\t\t\ttype: \"tool_execution_update\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Arguments passed to the tool */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Partial tool result */\n\t\t\tpartialResult: AgentToolResult;\n\t  }\n\t| {\n\t\t\t/** User approval required for an action */\n\t\t\ttype: \"action_approval_required\";\n\t\t\t/** Details of the approval request */\n\t\t\trequest: ActionApprovalRequest;\n\t  }\n\t| {\n\t\t\t/** User made approval decision */\n\t\t\ttype: \"action_approval_resolved\";\n\t\t\t/** The original request */\n\t\t\trequest: ActionApprovalRequest;\n\t\t\t/** User's decision */\n\t\t\tdecision: ActionApprovalDecision;\n\t  }\n\t| {\n\t\t\t/** Tool failed and requires a retry decision */\n\t\t\ttype: \"tool_retry_required\";\n\t\t\t/** Details of the retry request */\n\t\t\trequest: ToolRetryRequest;\n\t  }\n\t| {\n\t\t\t/** Tool retry decision resolved */\n\t\t\ttype: \"tool_retry_resolved\";\n\t\t\t/** The original request */\n\t\t\trequest: ToolRetryRequest;\n\t\t\t/** User or policy decision */\n\t\t\tdecision: ToolRetryDecision;\n\t  }\n\t| {\n\t\t\t/** Client-side tool invocation needed */\n\t\t\ttype: \"client_tool_request\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Arguments for the tool */\n\t\t\targs: unknown;\n\t  }\n\t| {\n\t\t\t/** Context was compacted (older messages summarized) */\n\t\t\ttype: \"compaction\";\n\t\t\t/** Generated summary of compacted messages */\n\t\t\tsummary: string;\n\t\t\t/** Index of first entry to keep (entries before were summarized) */\n\t\t\tfirstKeptEntryIndex: number;\n\t\t\t/** Token count before compaction */\n\t\t\ttokensBefore: number;\n\t\t\t/** Whether this was auto-triggered vs manual /compact */\n\t\t\tauto?: boolean;\n\t\t\t/** Custom instructions used for summarization */\n\t\t\tcustomInstructions?: string;\n\t\t\t/** Timestamp of compaction */\n\t\t\ttimestamp: string;\n\t  }\n\t| {\n\t\t\t/** Auto-retry started for transient error (rate limit, overload, 5xx) */\n\t\t\ttype: \"auto_retry_start\";\n\t\t\t/** Current retry attempt (1-based) */\n\t\t\tattempt: number;\n\t\t\t/** Maximum number of retry attempts */\n\t\t\tmaxAttempts: number;\n\t\t\t/** Delay in milliseconds before retry */\n\t\t\tdelayMs: number;\n\t\t\t/** The error message that triggered the retry */\n\t\t\terrorMessage: string;\n\t  }\n\t| {\n\t\t\t/** Auto-retry completed (success or final failure) */\n\t\t\ttype: \"auto_retry_end\";\n\t\t\t/** Whether the retry eventually succeeded */\n\t\t\tsuccess: boolean;\n\t\t\t/** Final attempt number */\n\t\t\tattempt: number;\n\t\t\t/** If failed, the final error message */\n\t\t\tfinalError?: string;\n\t  };\n\n/**\n * Events emitted over streaming transports (SSE/WebSocket).\n *\n * Includes core agent events plus transport-level signals.\n */\nexport type AgentStreamEvent =\n\t| AgentEvent\n\t| { type: \"session_update\"; sessionId: string }\n\t| { type: \"heartbeat\" }\n\t| { type: \"aborted\" }\n\t| { type: \"done\" };\n\n/**\n * Message queued for sending to the LLM.\n *\n * Wraps the original message with an optional LLM-formatted version,\n * allowing for message transformation before sending.\n *\n * @typeParam TOriginal - Type of the original message\n */\nexport interface QueuedMessage<TOriginal = AppMessage> {\n\t/** Stable identifier for queue operations */\n\tid: number;\n\t/** When the message was queued */\n\tcreatedAt: number;\n\t/** Original message as received */\n\toriginal: TOriginal;\n\t/** Optional LLM-formatted version of the message */\n\tllm?: Message;\n}\n\n/**\n * Runtime configuration for agent execution.\n *\n * Passed to the transport layer when starting a new agent run,\n * containing all the configuration needed to execute a conversation turn.\n */\nexport interface AgentRunConfig {\n\t/** System prompt providing instructions and context */\n\tsystemPrompt: string;\n\t/** Tools available for this run */\n\ttools: AgentTool[];\n\t/** Model to use for generation */\n\tmodel: Model<Api>;\n\t/** Optional reasoning effort level */\n\treasoning?: ReasoningEffort;\n\t/** Optional reasoning summary preference for Responses API */\n\treasoningSummary?: \"auto\" | \"detailed\" | \"concise\" | null;\n\t/** Emit message_end for the initial user message (defaults to true). */\n\temitUserMessageEnd?: boolean;\n\t/** Function to retrieve steering messages for batch sending */\n\tgetSteeringMessages?: <T>() => Promise<QueuedMessage<T>[]>;\n\t/** Function to retrieve follow-up messages for batch sending */\n\tgetFollowUpMessages?: <T>() => Promise<QueuedMessage<T>[]>;\n\t/** Function to retrieve prompt-only messages for the next turn. */\n\tgetPromptOnlyMessages?: () => Promise<Message[]>;\n\t/** @deprecated Use getSteeringMessages/getFollowUpMessages instead */\n\tgetQueuedMessages?: <T>() => Promise<QueuedMessage<T>[]>;\n\t/**\n\t * Optional message preprocessor applied immediately before calling the LLM provider.\n\t *\n\t * Use this to implement provider-specific compatibility transforms (e.g., image limits,\n\t * signature preservation, prompt caching markers) without polluting the core tools.\n\t *\n\t * Note: This is a pure preprocessing hook. It should not execute tools or perform I/O.\n\t */\n\tpreprocessMessages?: (\n\t\tmessages: Message[],\n\t\tcontext: {\n\t\t\tsystemPrompt: string;\n\t\t\ttools: AgentTool[];\n\t\t\tmodel: Model<Api>;\n\t\t\tuserMessage?: Message;\n\t\t},\n\t\tsignal?: AbortSignal,\n\t) => Message[] | Promise<Message[]>;\n\t/** User identification for tracking */\n\tuser?: {\n\t\t/** User UUID */\n\t\tid: string;\n\t\t/** Organization UUID */\n\t\torgId: string;\n\t};\n\t/** Session information for persistence */\n\tsession?: {\n\t\t/** Session UUID */\n\t\tid: string;\n\t\t/** When the session started */\n\t\tstartedAt: Date;\n\t};\n\t/** User/org guarded-files override policy for this run */\n\tguardedFiles?: GuardedFilesPolicySettings;\n\t/** Optional helper function for running LLM queries (e.g., for summarization) */\n\trunLLM?: (systemPrompt: string, userPrompt: string) => Promise<string>;\n\t/** Optional debug checkpoint profiler for local query latency diagnostics. */\n\tqueryProfiler?: CheckpointProfiler;\n\t/** Optional sandbox for isolated tool execution */\n\tsandbox?: import(\"../sandbox/types.js\").Sandbox;\n\t/** Sampling temperature override (0.0-2.0, lower = more deterministic) */\n\ttemperature?: number;\n\t/** Top-p sampling override (0.0-1.0) */\n\ttopP?: number;\n\t/** Optional Anthropic API-side task budget for the current turn */\n\ttaskBudget?: {\n\t\ttotal: number;\n\t\tremaining?: number;\n\t};\n}\n\n/**\n * Transport interface for LLM communication.\n *\n * Implementors of this interface handle the actual communication\n * with the LLM provider, including streaming and tool execution.\n */\nexport interface AgentTransport {\n\t/**\n\t * Execute a conversation turn with a new user message.\n\t *\n\t * @param messages - Conversation history\n\t * @param userMessage - New user message\n\t * @param config - Runtime configuration\n\t * @param signal - Optional abort signal for cancellation\n\t * @returns Async iterable of agent events\n\t */\n\trun(\n\t\tmessages: Message[],\n\t\tuserMessage: Message,\n\t\tconfig: AgentRunConfig,\n\t\tsignal?: AbortSignal,\n\t): AsyncIterable<AgentEvent>;\n\n\t/**\n\t * Continue from current context without a new user message.\n\t *\n\t * Used for:\n\t * - Retrying after transient errors (rate limits, overload)\n\t * - Continuing after context compaction\n\t * - Resuming interrupted tool execution\n\t *\n\t * @param messages - Current conversation history\n\t * @param config - Runtime configuration\n\t * @param signal - Optional abort signal for cancellation\n\t * @returns Async iterable of agent events\n\t */\n\tcontinue(\n\t\tmessages: Message[],\n\t\tconfig: AgentRunConfig,\n\t\tsignal?: AbortSignal,\n\t): AsyncIterable<AgentEvent>;\n\n\t/**\n\t * Optional lightweight connectivity probe for UI health checks.\n\t */\n\tping?: () => Promise<void>;\n}\n\n/**\n * Options for streaming LLM requests.\n *\n * These options are passed to the transport layer when making\n * streaming requests to the LLM provider.\n */\nexport interface StreamOptions {\n\t/** Sampling temperature (0.0-2.0, lower = more deterministic) */\n\ttemperature?: number;\n\t/** Maximum tokens to generate */\n\tmaxTokens?: number;\n\t/** Abort signal for cancellation */\n\tsignal?: AbortSignal;\n\t/** API key for authentication */\n\tapiKey?: string;\n\t/** Additional headers to include in requests */\n\theaders?: Record<string, string>;\n\t/** Additional request body fields for provider-specific extensions */\n\trequestBody?: Record<string, unknown>;\n\t/** Stable session id for provider-side request grouping/cache keys */\n\tsessionId?: string;\n\t/** Current working directory for local provider runtimes. */\n\tcwd?: string;\n\t/** Authentication type for the request */\n\tauthType?: \"api-key\" | \"bearer-token\";\n\t/** Optional Anthropic API-side task budget for the current turn */\n\ttaskBudget?: {\n\t\ttotal: number;\n\t\tremaining?: number;\n\t};\n\t/** Optional governed executor for provider-native dynamic tool callbacks. */\n\texecuteDynamicTool?: (toolCall: ToolCall) => Promise<AgentToolResult>;\n}\n\n/**\n * Cache control hint for prompt caching.\n *\n * Used to mark content that should be cached for faster\n * subsequent requests.\n */\nexport interface PromptCacheControl {\n\t/** Cache type - currently only \"ephemeral\" is supported */\n\ttype: \"ephemeral\";\n}\n"]}
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/agent/types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG","sourcesContent":["/**\n * @fileoverview Core Type Definitions for Maestro Agent\n *\n * This module defines the fundamental types used throughout the Maestro AI system,\n * including message formats, tool definitions, model configurations, and agent state.\n *\n * ## Type Categories\n *\n * ### Message Types\n * - {@link UserMessage} - Messages from the human user\n * - {@link AssistantMessage} - Responses from the AI assistant\n * - {@link ToolResultMessage} - Results from tool executions\n * - {@link Message} - Union of all message types\n *\n * ### Content Types\n * - {@link TextContent} - Plain text content blocks\n * - {@link ImageContent} - Base64-encoded images\n * - {@link ThinkingContent} - Extended reasoning traces\n * - {@link ToolCall} - Tool invocation requests\n *\n * ### Tool Types\n * - {@link Tool} - Tool definition schema (for API)\n * - {@link AgentTool} - Tool with execute function (for runtime)\n * - {@link AgentToolResult} - Return value from tool execution\n *\n * ### Configuration Types\n * - {@link Model} - LLM model configuration\n * - {@link AgentState} - Current state of an agent\n * - {@link AgentRunConfig} - Runtime configuration\n *\n * @module agent/types\n */\n\nimport type {\n\tGuardedFilesPolicySettings,\n\tRoutingReceipt,\n} from \"@evalops/contracts\";\nimport type { TSchema } from \"@sinclair/typebox\";\nimport type { PromptProjectDocManifest } from \"../config/index.js\";\nimport type { UnifiedContextManifest } from \"../context/manifest-types.js\";\nimport type { PromptMetadata } from \"../prompts/types.js\";\nimport type { CheckpointProfiler } from \"../utils/checkpoint-profiler.js\";\nimport type {\n\tActionApprovalDecision,\n\tActionApprovalRequest,\n} from \"./action-approval.js\";\nimport type { SkillArtifactMetadata } from \"./skill-artifact-metadata.js\";\nimport type { ToolCapabilityMetadata } from \"./tool-capability-types.js\";\nimport type { ToolRetryDecision, ToolRetryRequest } from \"./tool-retry.js\";\n\n/**\n * API format identifier for different LLM provider APIs.\n *\n * Each provider may support different API formats:\n * - `openai-completions` - OpenAI Chat Completions API\n * - `openai-responses` - OpenAI Responses API (newer format)\n * - `openai-codex-responses` - ChatGPT Codex Responses backend\n * - `openai-codex-app-server` - Local Codex app-server with ChatGPT sign-in\n * - `anthropic-messages` - Anthropic Messages API\n * - `google-generative-ai` - Google Generative AI (Gemini)\n * - `google-gemini-cli` - Google Cloud Code Assist (Gemini CLI)\n * - `bedrock-converse` - AWS Bedrock Converse API\n * - `scripted-replay` - Deterministic local scenario replay provider\n */\nexport type Api =\n\t| \"openai-completions\"\n\t| \"openai-responses\"\n\t| \"openai-codex-responses\"\n\t| \"openai-codex-app-server\"\n\t| \"anthropic-messages\"\n\t| \"google-generative-ai\"\n\t| \"google-gemini-cli\"\n\t| \"bedrock-converse\"\n\t| \"vertex-ai\"\n\t| \"scripted-replay\";\n\nexport interface OpenAICompatOverrides {\n\tsupportsStore?: boolean;\n\tsupportsDeveloperRole?: boolean;\n\tsupportsReasoningEffort?: boolean;\n\tsupportsResponsesApi?: boolean;\n\t/** Supports Anthropic-style cache_control (OpenRouter with Claude models) */\n\tsupportsCacheControl?: boolean;\n\tmaxTokensField?: \"max_tokens\" | \"max_completion_tokens\";\n\trequiresToolResultName?: boolean;\n\trequiresAssistantAfterToolResult?: boolean;\n\trequiresThinkingAsText?: boolean;\n\trequiresMistralToolIds?: boolean;\n}\n\n/**\n * Well-known LLM provider identifiers.\n *\n * These are the officially supported providers with built-in configurations:\n * - `anthropic` - Anthropic (Claude models)\n * - `bedrock` - AWS Bedrock\n * - `google` - Google AI (Gemini models)\n * - `openai` - OpenAI (GPT models)\n * - `azure-openai` - Azure OpenAI\n * - `writer` - Writer.com\n * - `xai` - xAI (Grok models)\n * - `groq` - Groq\n * - `cerebras` - Cerebras\n * - `openrouter` - OpenRouter (aggregator)\n * - `zai` - Z.ai (Zhipu GLM)\n * - `deepseek` - DeepSeek\n * - `moonshot` - Moonshot AI (Kimi)\n * - `dashscope` - Alibaba Qwen (DashScope)\n * - `minimax` - MiniMax\n */\nexport type KnownProvider =\n\t| \"anthropic\"\n\t| \"bedrock\"\n\t| \"google\"\n\t| \"openai\"\n\t| \"openai-codex\"\n\t| \"azure-openai\"\n\t| \"writer\"\n\t| \"xai\"\n\t| \"groq\"\n\t| \"cerebras\"\n\t| \"openrouter\"\n\t| \"zai\"\n\t| \"deepseek\"\n\t| \"moonshot\"\n\t| \"dashscope\"\n\t| \"minimax\";\n\n/**\n * Provider identifier - either a known provider or a custom string.\n * Custom providers can be used with OpenAI-compatible APIs.\n */\nexport type Provider = KnownProvider | string;\n\n/**\n * Reasoning effort level for models that support extended thinking.\n *\n * Higher levels produce more detailed reasoning at increased latency:\n * - `minimal` - Brief chain-of-thought hints\n * - `low` - Short reasoning steps\n * - `medium` - Moderate reasoning depth (recommended default)\n * - `high` - Thorough step-by-step reasoning\n * - `ultra` - Maximum reasoning depth (for complex problems)\n *\n * Note: Claude Code uses keywords \"think\", \"think hard\", \"think harder\", \"ultrathink\"\n * which map to low, medium, high, ultra respectively.\n */\nexport type ReasoningEffort = \"minimal\" | \"low\" | \"medium\" | \"high\" | \"ultra\";\n\n/**\n * Plain text content block within a message.\n *\n * @example\n * ```typescript\n * const content: TextContent = {\n *   type: \"text\",\n *   text: \"Hello, how can I help you today?\"\n * };\n * ```\n */\nexport interface TextContent {\n\t/** Discriminator for content block type */\n\ttype: \"text\";\n\t/** The text content */\n\ttext: string;\n\t/** Optional signature for content verification */\n\ttextSignature?: string;\n}\n\n/**\n * Extended thinking/reasoning content block.\n *\n * Contains the model's internal reasoning process when extended\n * thinking is enabled. This is typically hidden from end users\n * but useful for debugging and understanding model behavior.\n */\nexport interface ThinkingContent {\n\t/** Discriminator for content block type */\n\ttype: \"thinking\";\n\t/** The thinking/reasoning trace */\n\tthinking: string;\n\t/** Optional signature for content verification */\n\tthinkingSignature?: string;\n}\n\n/**\n * Base64-encoded image content block.\n *\n * Used for including images in user messages (vision input)\n * or tool results (screenshots, generated images).\n *\n * @example\n * ```typescript\n * const image: ImageContent = {\n *   type: \"image\",\n *   data: \"iVBORw0KGgo...\", // base64 encoded\n *   mimeType: \"image/png\"\n * };\n * ```\n */\nexport interface ImageContent {\n\t/** Discriminator for content block type */\n\ttype: \"image\";\n\t/** Base64-encoded image data */\n\tdata: string;\n\t/** MIME type (e.g., \"image/png\", \"image/jpeg\") */\n\tmimeType: string;\n}\n\n/**\n * Tool invocation request within an assistant message.\n *\n * When the model decides to use a tool, it emits a ToolCall\n * content block specifying which tool to call and with what arguments.\n *\n * @example\n * ```typescript\n * const toolCall: ToolCall = {\n *   type: \"toolCall\",\n *   id: \"call_abc123\",\n *   name: \"read\",\n *   arguments: { file_path: \"/src/index.ts\" }\n * };\n * ```\n */\nexport interface ToolCall {\n\t/** Discriminator for content block type */\n\ttype: \"toolCall\";\n\t/** Unique identifier for this tool call (used to match results) */\n\tid: string;\n\t/** Name of the tool to invoke */\n\tname: string;\n\t/** Arguments to pass to the tool */\n\targuments: Record<string, unknown>;\n\t/**\n\t * Provider-specific signature used by some APIs (notably Gemini 3) to\n\t * associate tool calls with preceding thoughts. If present, it must be\n\t * preserved across turns when replaying the message history back to the provider.\n\t */\n\tthoughtSignature?: string;\n}\n\nexport type ToolSchedulingDecisionKind =\n\t| \"scheduled\"\n\t| \"parallelized\"\n\t| \"delayed\"\n\t| \"serialized\"\n\t| \"cached\"\n\t| \"skipped\";\n\nexport interface ToolSchedulingDecision {\n\t/** Tool call identifier; duplicated here for standalone telemetry use. */\n\tcallId: string;\n\t/** Tool name, never arguments. */\n\ttoolName: string;\n\t/** Zero-based order from the model-emitted tool-call list. */\n\temittedIndex: number;\n\t/** Scheduler wave number when the call entered an execution wave. */\n\twaveIndex?: number;\n\t/** Scheduler outcome for this call. */\n\tdecision: ToolSchedulingDecisionKind;\n\t/** Stable reason code; intentionally avoids raw paths and arguments. */\n\treason: string;\n\t/** Time spent waiting inside the scheduler after model emission. */\n\tschedulerWaitMs?: number;\n\t/** True when an MCP server opt-in made the call parallel-safe. */\n\tmcpOptIn?: boolean;\n\t/** True when execution was served from reusable tool-result state. */\n\tcacheHit?: boolean;\n\t/** True when an in-flight mutation forced a wait or serialization. */\n\tblockedByMutation?: boolean;\n}\n\nexport type ToolPhaseDecisionOutcome =\n\t| \"parallelized\"\n\t| \"serialized\"\n\t| \"delayed\"\n\t| \"cached\"\n\t| \"skipped\";\n\nexport interface ToolPhaseDecision {\n\ttoolCallId: string;\n\ttoolName: string;\n\temittedIndex: number;\n\toutcome: ToolPhaseDecisionOutcome;\n\tdecision: ToolPhaseDecisionOutcome;\n\treason: string;\n\twaveIndex?: number;\n\twaitMs: number;\n\tschedulerWaitMs: number;\n\tmcpOptIn?: boolean;\n\tcacheHit?: boolean;\n\tblockedByMutation?: boolean;\n}\n\nexport interface ParallelismScopeMetadata {\n\tpathScope?: string[];\n\tpathScopeSource?: \"annotation\" | \"known_tool\";\n\tpathArgumentKeys?: string[];\n}\n\nexport interface ParallelismGatedEvent extends ParallelismScopeMetadata {\n\ttype: \"parallelism_gated\";\n\ttoolCallId: string;\n\ttoolName: string;\n\treason: \"mutation_scope_overlap\" | \"mutation_unknown_write_set\";\n\tqueueDepth: number;\n\tpendingMutations: number;\n\tpendingToolCallIds: string[];\n\tpendingToolNames: string[];\n}\n\nexport interface ParallelConflictDetectedEvent\n\textends ParallelismScopeMetadata {\n\ttype: \"parallel_conflict_detected\";\n\ttoolCallId: string;\n\ttoolName: string;\n\tconflictingToolCallId: string;\n\tconflictingToolName: string;\n\tconflictingPathScope?: string[];\n\tconflictingPathScopeSource?: \"annotation\" | \"known_tool\";\n}\n\nexport interface ToolPhaseBatchShapingFeedback {\n\tavoidableSingleton: boolean;\n\treason: string;\n\thint: string;\n}\n\nexport interface ToolPhaseSummary {\n\ttype: \"tool_phase_summary\";\n\tmodelToolCallCount: number;\n\tmodelEmittedToolCallCount: number;\n\tschedulableWaveCount: number;\n\tparallelizedCallCount: number;\n\tactuallyParallelizedCallCount: number;\n\tserializedCallCount: number;\n\tdelayedCallCount: number;\n\tblockedByMutationCount: number;\n\tmcpOptInCallCount: number;\n\tmcpOptInUseCount: number;\n\tcacheHitCount: number;\n\ttotalToolWaitMs: number;\n\ttoolWaitTimeMs: number;\n\tserializationReasons: Record<string, number>;\n\tdecisions: ToolPhaseDecision[];\n\tbatchShapingFeedback?: ToolPhaseBatchShapingFeedback;\n}\n\n/**\n * Token usage and cost information for a message or request.\n *\n * Tracks input/output tokens and cache utilization for cost monitoring\n * and context window management.\n */\nexport interface Usage {\n\t/** Number of input tokens consumed */\n\tinput: number;\n\t/** Number of output tokens generated */\n\toutput: number;\n\t/** Tokens served from prompt cache (reduces cost) */\n\tcacheRead: number;\n\t/** Tokens written to prompt cache */\n\tcacheWrite: number;\n\t/** Calculated cost breakdown in USD */\n\tcost: {\n\t\t/** Cost for input tokens */\n\t\tinput: number;\n\t\t/** Cost for output tokens */\n\t\toutput: number;\n\t\t/** Cost savings from cache reads */\n\t\tcacheRead: number;\n\t\t/** Cost for cache writes */\n\t\tcacheWrite: number;\n\t\t/** Total cost for this message/request */\n\t\ttotal: number;\n\t};\n}\n\n/**\n * Reason why the model stopped generating.\n *\n * - `stop` - Natural completion (end of response)\n * - `length` - Hit max_tokens limit\n * - `toolUse` - Model wants to use a tool (generation paused)\n * - `error` - An error occurred during generation\n * - `aborted` - Request was cancelled by the user\n */\nexport type StopReason = \"stop\" | \"length\" | \"toolUse\" | \"error\" | \"aborted\";\n\n/**\n * Message from the human user.\n *\n * User messages can contain plain text or an array of content blocks\n * (for multi-modal input with images).\n *\n * @example\n * ```typescript\n * // Simple text message\n * const msg: UserMessage = {\n *   role: \"user\",\n *   content: \"What is this code doing?\",\n *   timestamp: Date.now()\n * };\n *\n * // Message with image\n * const multiModal: UserMessage = {\n *   role: \"user\",\n *   content: [\n *     { type: \"text\", text: \"What's in this screenshot?\" },\n *     { type: \"image\", data: base64Data, mimeType: \"image/png\" }\n *   ],\n *   timestamp: Date.now()\n * };\n * ```\n */\nexport interface UserMessage {\n\t/** Message role discriminator */\n\trole: \"user\";\n\t/** Message content - string or array of content blocks */\n\tcontent: string | (TextContent | ImageContent)[];\n\t/** Optional non-LLM metadata for runtime bookkeeping */\n\tmetadata?: Record<string, unknown>;\n\t/** Unix timestamp in milliseconds when message was created */\n\ttimestamp: number;\n}\n\n/**\n * Response message from the AI assistant.\n *\n * Contains the model's response along with metadata about the generation\n * including token usage, stop reason, and provider information.\n *\n * The content array may contain:\n * - {@link TextContent} - The actual response text\n * - {@link ThinkingContent} - Extended reasoning (if enabled)\n * - {@link ToolCall} - Tool invocation requests\n */\nexport interface AssistantMessage {\n\t/** Message role discriminator */\n\trole: \"assistant\";\n\t/** Array of content blocks (text, thinking, tool calls) */\n\tcontent: (TextContent | ThinkingContent | ToolCall)[];\n\t/** API format used for this response */\n\tapi: Api;\n\t/** Provider that generated this response */\n\tprovider: Provider;\n\t/** Model ID that generated this response */\n\tmodel: string;\n\t/** Token usage and cost information */\n\tusage: Usage;\n\t/** Reason why generation stopped */\n\tstopReason: StopReason;\n\t/** Error message if stopReason is \"error\" */\n\terrorMessage?: string;\n\t/** Unix timestamp in milliseconds when message was created */\n\ttimestamp: number;\n\t/** Immutable model/profile routing decision for this turn. */\n\troutingReceipt?: RoutingReceipt;\n}\n\n/**\n * Result message from a tool execution.\n *\n * After a tool is executed, the result is sent back to the model\n * as a ToolResultMessage so it can incorporate the information\n * into its response.\n *\n * @typeParam TDetails - Type of additional details attached to the result\n *\n * @example\n * ```typescript\n * const result: ToolResultMessage = {\n *   role: \"toolResult\",\n *   toolCallId: \"call_abc123\",\n *   toolName: \"read\",\n *   content: [{ type: \"text\", text: \"file contents...\" }],\n *   isError: false,\n *   timestamp: Date.now()\n * };\n * ```\n */\nexport interface ToolResultMessage<TDetails = unknown> {\n\t/** Message role discriminator */\n\trole: \"toolResult\";\n\t/** ID of the tool call this result corresponds to */\n\ttoolCallId: string;\n\t/** Name of the tool that was executed */\n\ttoolName: string;\n\t/** Result content (text or images) */\n\tcontent: (TextContent | ImageContent)[];\n\t/** Optional additional details about the execution */\n\tdetails?: TDetails;\n\t/** Whether the tool execution resulted in an error */\n\tisError: boolean;\n\t/** Unix timestamp in milliseconds when result was created */\n\ttimestamp: number;\n}\n\n/**\n * Message type for hook-injected messages.\n *\n * Hooks can inject these into the conversation. They are converted to user\n * messages for LLM context and can optionally be hidden from the UI.\n */\nexport interface HookMessage<T = unknown> {\n\t/** Message role discriminator */\n\trole: \"hookMessage\";\n\t/** Hook-defined message category */\n\tcustomType: string;\n\t/** Message content - string or array of content blocks */\n\tcontent: string | (TextContent | ImageContent)[];\n\t/** Whether to render this message in the UI */\n\tdisplay: boolean;\n\t/** Optional hook-specific metadata (not sent to the LLM) */\n\tdetails?: T;\n\t/** Unix timestamp in milliseconds when message was created */\n\ttimestamp: number;\n}\n\n/**\n * Message type for branch summaries when navigating session trees.\n */\nexport interface BranchSummaryMessage {\n\t/** Message role discriminator */\n\trole: \"branchSummary\";\n\t/** Summary text */\n\tsummary: string;\n\t/** ID of the branch point this summary came from */\n\tfromId: string;\n\t/** Unix timestamp in milliseconds when summary was created */\n\ttimestamp: number;\n}\n\n/**\n * Message type for compaction summaries.\n */\nexport interface CompactionSummaryMessage {\n\t/** Message role discriminator */\n\trole: \"compactionSummary\";\n\t/** Summary text */\n\tsummary: string;\n\t/** Token count before compaction (for diagnostics) */\n\ttokensBefore: number;\n\t/** Unix timestamp in milliseconds when summary was created */\n\ttimestamp: number;\n}\n\n/**\n * Union type representing LLM-native messages that can be sent to the model.\n *\n * A conversation with the LLM consists of user input, assistant responses,\n * and tool results.\n */\nexport type Message = UserMessage | AssistantMessage | ToolResultMessage;\n\n/**\n * Empty interface for declaration merging to add custom message types.\n *\n * Consumers can extend this interface to add their own message types:\n *\n * @example\n * ```typescript\n * declare module \"@evalops/maestro\" {\n *   interface CustomAgentMessages {\n *     notification: { role: \"notification\"; text: string; timestamp: number };\n *   }\n * }\n * ```\n */\n// biome-ignore lint/suspicious/noEmptyInterface: Required for declaration merging\nexport interface CustomAgentMessages {}\n\n/**\n * Union type representing all messages in the agent conversation history.\n *\n * Includes both LLM-native messages (user, assistant, toolResult) and\n * custom message types (hookMessage, branchSummary, compactionSummary,\n * plus any types added via declaration merging).\n *\n * Custom messages are preserved in session history but filtered out\n * before being sent to the LLM via {@link convertToLlm}.\n */\nexport type AgentMessage =\n\t| Message\n\t| HookMessage\n\t| BranchSummaryMessage\n\t| CompactionSummaryMessage\n\t| CustomAgentMessages[keyof CustomAgentMessages];\n\n/**\n * Tool definition schema for API serialization.\n *\n * This interface defines a tool's metadata and parameter schema\n * for transmission to the LLM. The actual execution logic is in\n * {@link AgentTool}.\n *\n * @typeParam TParameters - TypeBox schema for the tool's parameters\n *\n * @example\n * ```typescript\n * import { Type } from \"@sinclair/typebox\";\n *\n * const readTool: Tool = {\n *   name: \"read\",\n *   description: \"Read a file from the filesystem\",\n *   parameters: Type.Object({\n *     file_path: Type.String({ description: \"Path to the file\" })\n *   })\n * };\n * ```\n */\nexport interface Tool<TParameters extends TSchema = TSchema> {\n\t/** Unique tool identifier */\n\tname: string;\n\t/** Human-readable description of what the tool does */\n\tdescription: string;\n\t/** TypeBox schema defining the tool's parameters */\n\tparameters: TParameters;\n\t/** Optional categorization (e.g., \"file\", \"shell\", \"web\") */\n\ttoolType?: string;\n\t/** Example inputs for documentation/few-shot prompting */\n\tinputExamples?: unknown[];\n\t/** List of caller identifiers allowed to use this tool */\n\tallowedCallers?: string[];\n\t/** If true, don't send tool definition to API (used for internal tools) */\n\tdeferApiDefinition?: boolean;\n}\n\n/**\n * Behavioral hints for tools (from MCP annotations).\n *\n * These hints help the model and UI understand the tool's behavior\n * for better decision-making and user feedback.\n */\nexport interface ToolAnnotations {\n\t/** If true, the tool does not modify its environment (safe to retry) */\n\treadOnlyHint?: boolean;\n\t/** If true, the tool may perform destructive/irreversible updates */\n\tdestructiveHint?: boolean;\n\t/** If true, mutating calls are scoped to explicit path arguments */\n\tpathScopedMutationHint?: boolean;\n\t/** If true, calling repeatedly with same args has no additional effect */\n\tidempotentHint?: boolean;\n\t/** If true, the tool interacts with external systems (network, APIs) */\n\topenWorldHint?: boolean;\n}\n\nexport interface McpToolSourceMetadata {\n\ttype: \"mcp\";\n\tserver: string;\n\ttool: string;\n\tcapability?: ToolCapabilityMetadata;\n\tsupportsParallelToolCalls?: boolean;\n\tparallelSafetyProvenance?: \"static_config\" | \"server_capability\" | \"none\";\n\tparallelMaxConcurrency?: number;\n}\n\nexport type ToolSourceMetadata = McpToolSourceMetadata;\n\n/**\n * Complete tool definition with execute function.\n *\n * This is the runtime representation of a tool, including both\n * the schema (for the LLM) and the execute function (for the runtime).\n *\n * @typeParam TParameters - TypeBox schema for the tool's parameters\n * @typeParam TDetails - Type of additional details returned with results\n *\n * @example\n * ```typescript\n * import { Type } from \"@sinclair/typebox\";\n *\n * const readTool: AgentTool = {\n *   name: \"read\",\n *   description: \"Read a file from the filesystem\",\n *   parameters: Type.Object({\n *     file_path: Type.String()\n *   }),\n *   execute: async (toolCallId, params) => {\n *     const content = await fs.readFile(params.file_path, \"utf-8\");\n *     return { content: [{ type: \"text\", text: content }] };\n *   }\n * };\n * ```\n */\nexport interface AgentTool<\n\tTParameters extends TSchema = TSchema,\n\tTDetails = unknown,\n> {\n\t/** Unique tool identifier */\n\tname: string;\n\t/** Display label for UI (defaults to name) */\n\tlabel?: string;\n\t/** Human-readable description of what the tool does */\n\tdescription: string;\n\t/** TypeBox schema defining the tool's parameters */\n\tparameters: TParameters;\n\t/** Tool behavior hints from MCP annotations */\n\tannotations?: ToolAnnotations;\n\t/** Exact runtime provenance for bridged or remote tool sources */\n\tsource?: ToolSourceMetadata;\n\t/** Optional categorization (e.g., \"file\", \"shell\", \"web\") */\n\ttoolType?: string;\n\t/**\n\t * Where the tool should be executed.\n\t * - `\"server\"`: (default) Executed by the backend agent\n\t * - `\"client\"`: Executed by the client (VS Code, browser) via callback\n\t */\n\texecutionLocation?: \"server\" | \"client\";\n\t/** Example inputs for documentation/few-shot prompting */\n\tinputExamples?: unknown[];\n\t/** List of caller identifiers allowed to use this tool */\n\tallowedCallers?: string[];\n\t/** If true, don't send tool definition to API */\n\tdeferApiDefinition?: boolean;\n\t/** Optional max retries configured by the tool itself */\n\tmaxRetries?: number;\n\t/** Optional retry delay configured by the tool itself */\n\tretryDelayMs?: number;\n\t/** Optional tool-level retry predicate */\n\tshouldRetry?: (error: unknown) => boolean;\n\t/** Optional compact summary used after a tool finishes. */\n\tgetToolUseSummary?: (params: Record<string, unknown>) => string | null;\n\t/** Optional human-facing label used for live tool UI. */\n\tgetDisplayName?: (params: Record<string, unknown>) => string | null;\n\t/** Optional present-tense activity label used while a tool is running. */\n\tgetActivityDescription?: (params: Record<string, unknown>) => string | null;\n\t/**\n\t * Execute the tool with the given parameters.\n\t *\n\t * @param toolCallId - Unique identifier for this tool call\n\t * @param params - Parameters matching the tool's schema\n\t * @param signal - Optional AbortSignal for cancellation\n\t * @param context - Optional execution context (sandbox, etc.)\n\t * @param onUpdate - Optional callback for partial tool output streaming\n\t * @returns Tool result with content and optional details\n\t */\n\texecute: (\n\t\ttoolCallId: string,\n\t\tparams: Record<string, unknown>,\n\t\tsignal?: AbortSignal,\n\t\tcontext?: { sandbox?: import(\"../sandbox/types.js\").Sandbox },\n\t\tonUpdate?: AgentToolUpdateCallback<TDetails>,\n\t) => AgentToolResult<TDetails> | Promise<AgentToolResult<TDetails>>;\n}\n\nexport type AgentToolUpdateCallback<TDetails = unknown> = (\n\tpartial: AgentToolResult<TDetails>,\n) => void;\n\n/**\n * Result returned from tool execution.\n *\n * @typeParam TDetails - Type of additional details attached to the result\n */\nexport interface AgentToolResult<TDetails = unknown> {\n\t/** Result content (text or images) */\n\tcontent: (TextContent | ImageContent)[];\n\t/** Optional additional details about the execution */\n\tdetails?: TDetails;\n\t/** Whether the execution resulted in an error */\n\tisError?: boolean;\n\t/** Optional Platform ToolExecution identifier used for audit joins */\n\ttoolExecutionId?: string;\n\t/** Optional Platform approval request identifier correlated to ToolExecution */\n\tapprovalRequestId?: string;\n}\n\n/**\n * Conversation context for LLM requests.\n *\n * Contains the system prompt, conversation history, and available tools\n * for a single LLM request.\n */\nexport interface Context {\n\t/** System prompt providing instructions and context */\n\tsystemPrompt?: string;\n\t/** Conversation history */\n\tmessages: Message[];\n\t/** Tools available for the model to use */\n\ttools?: Tool[];\n}\n\n/**\n * Streaming events during assistant message construction.\n *\n * These events are emitted as the LLM generates its response, enabling\n * real-time UI updates and progress tracking.\n *\n * ## Event Types\n *\n * | Type | Description |\n * |------|-------------|\n * | `start` | Message generation started |\n * | `text_start` | New text content block started |\n * | `text_delta` | Incremental text content |\n * | `text_end` | Text content block completed |\n * | `thinking_start` | Extended thinking block started |\n * | `thinking_delta` | Incremental thinking content |\n * | `thinking_end` | Thinking block completed |\n * | `toolcall_start` | Tool call started |\n * | `toolcall_delta` | Incremental tool call args |\n * | `toolcall_end` | Tool call completed |\n * | `done` | Generation completed successfully |\n * | `error` | Generation failed or was aborted |\n */\nexport type AssistantMessageEvent =\n\t| {\n\t\t\t/** Message generation started */\n\t\t\ttype: \"start\";\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** New text content block started */\n\t\t\ttype: \"text_start\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental text content received */\n\t\t\ttype: \"text_delta\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** New text to append */\n\t\t\tdelta: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Text content block completed */\n\t\t\ttype: \"text_end\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Final text content */\n\t\t\tcontent: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Extended thinking block started */\n\t\t\ttype: \"thinking_start\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental thinking content received */\n\t\t\ttype: \"thinking_delta\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** New thinking text to append */\n\t\t\tdelta: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Thinking content block completed */\n\t\t\ttype: \"thinking_end\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Final thinking content */\n\t\t\tcontent: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Tool call started */\n\t\t\ttype: \"toolcall_start\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental tool call arguments received */\n\t\t\ttype: \"toolcall_delta\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** New JSON fragment to append to arguments */\n\t\t\tdelta: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Tool call completed */\n\t\t\ttype: \"toolcall_end\";\n\t\t\t/** Index of the content block */\n\t\t\tcontentIndex: number;\n\t\t\t/** Completed tool call */\n\t\t\ttoolCall: ToolCall;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Provider-owned tool execution started outside Maestro's local executor */\n\t\t\ttype: \"provider_tool_execution_start\";\n\t\t\t/** Provider tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Provider tool name */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Provider tool arguments */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Provider-owned tool execution produced an incremental update */\n\t\t\ttype: \"provider_tool_execution_update\";\n\t\t\t/** Provider tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Provider tool name */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Provider tool arguments */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Partial provider result */\n\t\t\tpartialResult: AgentToolResult;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Provider-owned tool execution completed outside Maestro's local executor */\n\t\t\ttype: \"provider_tool_execution_end\";\n\t\t\t/** Provider tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Provider tool name */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Provider tool result */\n\t\t\tresult: ToolResultMessage;\n\t\t\t/** Whether the provider tool returned an error */\n\t\t\tisError: boolean;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Optional Platform approval request identifier correlated to ToolExecution */\n\t\t\tapprovalRequestId?: string;\n\t\t\t/** Partial message state */\n\t\t\tpartial: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Generation completed successfully */\n\t\t\ttype: \"done\";\n\t\t\t/** Reason for completion */\n\t\t\treason: Extract<StopReason, \"stop\" | \"length\" | \"toolUse\">;\n\t\t\t/** Final assistant message */\n\t\t\tmessage: AssistantMessage;\n\t  }\n\t| {\n\t\t\t/** Generation failed or was aborted */\n\t\t\ttype: \"error\";\n\t\t\t/** Reason for failure */\n\t\t\treason: Extract<StopReason, \"aborted\" | \"error\">;\n\t\t\t/** Error message details */\n\t\t\terror: AssistantMessage;\n\t  };\n\n/**\n * LLM model configuration.\n *\n * Contains all the information needed to use a model, including\n * API endpoints, capabilities, and pricing.\n *\n * @typeParam TApi - The API format this model uses\n *\n * @example\n * ```typescript\n * const claude: Model<\"anthropic-messages\"> = {\n *   id: \"claude-sonnet-4-5-20250929\",\n *   name: \"Claude Sonnet 4.5\",\n *   api: \"anthropic-messages\",\n *   provider: \"anthropic\",\n *   baseUrl: \"https://api.anthropic.com/v1\",\n *   reasoning: true,\n *   input: [\"text\", \"image\"],\n *   cost: { input: 3.00, output: 15.00, cacheRead: 0.30, cacheWrite: 3.75 },\n *   contextWindow: 200000,\n *   maxTokens: 8192\n * };\n * ```\n */\nexport interface Model<TApi extends Api> {\n\t/** Unique model identifier (e.g., \"claude-sonnet-4-5-20250929\") */\n\tid: string;\n\t/** Human-readable model name (e.g., \"Claude Sonnet 4.5\") */\n\tname: string;\n\t/** API format used for requests */\n\tapi: TApi;\n\t/** Provider serving this model */\n\tprovider: Provider;\n\t/** Base URL for API requests */\n\tbaseUrl: string;\n\t/** Optional custom headers to include in API requests */\n\theaders?: Record<string, string>;\n\t/** Optional OpenAI-compatibility overrides for vendor quirks */\n\tcompat?: OpenAICompatOverrides;\n\t/** Whether the model supports extended thinking */\n\treasoning: boolean;\n\t/** Whether the model supports tool use */\n\ttoolUse?: boolean;\n\t/** Supported input modalities */\n\tinput: (\"text\" | \"image\")[];\n\t/** Cost per million tokens in USD */\n\tcost: {\n\t\t/** Input token cost */\n\t\tinput: number;\n\t\t/** Output token cost */\n\t\toutput: number;\n\t\t/** Cache read cost (typically discounted) */\n\t\tcacheRead: number;\n\t\t/** Cache write cost */\n\t\tcacheWrite: number;\n\t};\n\t/** Maximum context window in tokens */\n\tcontextWindow: number;\n\t/** Maximum output tokens per response */\n\tmaxTokens: number;\n}\n\n/**\n * File attachment for messages.\n *\n * Represents an uploaded file (image or document) that can be\n * included in a user message.\n */\nexport interface Attachment {\n\t/** Unique identifier for this attachment */\n\tid: string;\n\t/** Type of attachment */\n\ttype: \"image\" | \"document\";\n\t/** Original filename */\n\tfileName: string;\n\t/** MIME type of the file */\n\tmimeType: string;\n\t/** File size in bytes */\n\tsize: number;\n\t/** Base64-encoded file content */\n\tcontent: string;\n\t/** Extracted text content (for documents) */\n\textractedText?: string;\n\t/** Preview image (for documents) */\n\tpreview?: string;\n}\n\n/**\n * User-configurable thinking level for extended reasoning.\n *\n * Controls how much computational effort the model spends on\n * reasoning before generating a response.\n *\n * - `off` - No extended thinking\n * - `minimal` - Brief reasoning hints\n * - `low` - Short reasoning steps\n * - `medium` - Moderate reasoning (default)\n * - `high` - Thorough step-by-step reasoning\n * - `max` - Maximum reasoning depth\n */\nexport type ThinkingLevel =\n\t| \"off\"\n\t| \"minimal\"\n\t| \"low\"\n\t| \"medium\"\n\t| \"high\"\n\t| \"ultra\"\n\t| \"max\";\n\n/**\n * User message with optional file attachments.\n *\n * Extends the base UserMessage to support file attachments\n * for rich multi-modal interactions.\n */\nexport type UserMessageWithAttachments = UserMessage & {\n\t/** Optional file attachments */\n\tattachments?: Attachment[];\n};\n\n/**\n * Placeholder for custom message types.\n * Can be extended to add application-specific message types.\n */\nexport interface CustomMessages {\n\thookMessage: HookMessage;\n\tbranchSummary: BranchSummaryMessage;\n\tcompactionSummary: CompactionSummaryMessage;\n}\n\n/**\n * Application-level message type.\n *\n * Union of all message types that can appear in the UI,\n * including user messages with attachments.\n */\nexport type AppMessage =\n\t| AssistantMessage\n\t| UserMessageWithAttachments\n\t| Message\n\t| CustomMessages[keyof CustomMessages];\n\n/**\n * Information about a tool call currently being executed.\n */\nexport interface PendingToolCall {\n\t/** Name of the tool being executed */\n\ttoolName: string;\n\t/** Original arguments passed to the tool */\n\targs?: Record<string, unknown>;\n\t/** Tool metadata captured when execution started */\n\ttool?: Pick<\n\t\tAgentTool,\n\t\t\"label\" | \"getDisplayName\" | \"getToolUseSummary\" | \"getActivityDescription\"\n\t>;\n\t/** Stable display name for live UI */\n\tdisplayName?: string;\n\t/** Stable compact summary for live UI */\n\tsummaryLabel?: string;\n}\n\n/**\n * Current state of an agent instance.\n *\n * This is the central state object managed by the Agent class,\n * containing all information about the current conversation,\n * configuration, and execution status.\n */\nexport interface AgentState {\n\t/** System prompt providing instructions and context */\n\tsystemPrompt: string;\n\t/** Version/hash metadata for the base system prompt instructions */\n\tpromptMetadata?: PromptMetadata;\n\t/** Exact prompt source files layered into the current system prompt */\n\tsystemPromptSourcePaths?: string[];\n\t/** Manifest of project instruction files layered into the current system prompt */\n\tpromptContextManifest?: PromptProjectDocManifest;\n\t/** Full filesystem and MCP context provenance captured for this run */\n\tunifiedContextManifest?: UnifiedContextManifest;\n\t/** Current model configuration */\n\tmodel: Model<Api>;\n\t/** Current thinking level for extended reasoning */\n\tthinkingLevel: ThinkingLevel;\n\t/** Optional reasoning summary preference for Responses API */\n\treasoningSummary?: \"auto\" | \"detailed\" | \"concise\" | null;\n\t/** Available tools for this agent */\n\ttools: AgentTool[];\n\t/**\n\t * Controls how queued steering messages are sent between turns.\n\t * - `\"all\"` - Send all queued messages at once\n\t * - `\"one\"` - Send one message at a time\n\t */\n\tsteeringMode: \"all\" | \"one\";\n\t/**\n\t * Controls how queued follow-up messages are sent between turns.\n\t * - `\"all\"` - Send all queued messages at once\n\t * - `\"one\"` - Send one message at a time\n\t */\n\tfollowUpMode: \"all\" | \"one\";\n\t/**\n\t * @deprecated Use steeringMode/followUpMode instead.\n\t */\n\tqueueMode: \"all\" | \"one\";\n\t/** Conversation history */\n\tmessages: AppMessage[];\n\t/** Whether the agent is currently streaming a response */\n\tisStreaming: boolean;\n\t/** Current streaming message (partial response) */\n\tstreamMessage: Message | null;\n\t/** Tool calls currently being executed */\n\tpendingToolCalls: Map<string, PendingToolCall>;\n\t/** Current error message, if any */\n\terror?: string;\n\t/** Optional sandbox for isolated tool execution */\n\tsandbox?: import(\"../sandbox/types.js\").Sandbox;\n\t/** Current sandbox mode (e.g., \"docker\", \"local\") */\n\tsandboxMode?: string | null;\n\t/** Whether sandboxing is enabled */\n\tsandboxEnabled?: boolean;\n\t/** User identification for tracking */\n\tuser?: {\n\t\t/** User UUID */\n\t\tid: string;\n\t\t/** Organization UUID */\n\t\torgId: string;\n\t};\n\t/** Session information for persistence */\n\tsession?: {\n\t\t/** Session UUID */\n\t\tid: string;\n\t\t/** When the session started */\n\t\tstartedAt: Date;\n\t};\n\t/** Sampling temperature override (0.0-2.0, lower = more deterministic) */\n\ttemperature?: number;\n\t/** Top-p sampling override (0.0-1.0) */\n\ttopP?: number;\n}\n\n/**\n * Events emitted during agent execution.\n *\n * These events provide real-time updates about agent activity,\n * enabling UI updates, logging, and progress tracking.\n *\n * ## Lifecycle Events\n * - `agent_start` - Agent execution started\n * - `agent_end` - Agent execution completed\n * - `turn_start` - New conversation turn started\n * - `turn_end` - Conversation turn completed\n *\n * ## Message Events\n * - `message_start` - New message being constructed\n * - `message_update` - Incremental message update\n * - `message_end` - Message completed\n *\n * ## Tool Events\n * - `tool_execution_start` - Tool execution started\n * - `tool_execution_update` - Tool execution produced partial output\n * - `tool_execution_end` - Tool execution completed\n * - `parallelism_gated` - Scheduler delayed a tool because in-flight mutations made parallel execution unsafe\n * - `parallel_conflict_detected` - Scheduler detected overlapping write scopes while evaluating parallel execution\n * - `tool_batch_summary` - Tool batch completed with a transient summary label\n * - `client_tool_request` - Client-side tool invocation needed\n *\n * ## Approval Events\n * - `action_approval_required` - User approval needed\n * - `action_approval_resolved` - User made approval decision\n *\n * ## Tool Retry Events\n * - `tool_retry_required` - Tool failed and retry decision needed\n * - `tool_retry_resolved` - Tool retry decision resolved\n *\n * ## Status Events\n * - `status` - Status update\n * - `error` - Error occurred\n * - `compaction` - Context was compacted\n */\nexport interface ToolSchedulingMetadata {\n\tclassification:\n\t\t| \"read_only\"\n\t\t| \"path_scoped_mutation\"\n\t\t| \"parallel_safe_mutation\"\n\t\t| \"serialized_mutation\"\n\t\t| \"workflow_serialized\"\n\t\t| \"cache_reuse\"\n\t\t| \"unknown\";\n\treason:\n\t\t| \"read_only_tool\"\n\t\t| \"mcp_parallel_opt_in\"\n\t\t| \"path_scope_available\"\n\t\t| \"path_scope_disjoint\"\n\t\t| \"path_scope_overlap\"\n\t\t| \"pending_mutation\"\n\t\t| \"mutating_tool\"\n\t\t| \"workflow_state_tracker\"\n\t\t| \"cache_hit\"\n\t\t| \"cache_pending\"\n\t\t| \"unknown_tool\";\n\tconcurrencyLimit?: number;\n\tqueueDepth?: number;\n\tpendingMutations?: number;\n\tpathScope?: string[];\n\tpathScopeSource?: \"annotation\" | \"known_tool\";\n\tpathArgumentKeys?: string[];\n\tcache?: \"disabled\" | \"miss\" | \"candidate\" | \"pending_hit\" | \"hit\";\n}\n\nexport type AgentEvent =\n\t| {\n\t\t\t/** Agent execution started */\n\t\t\ttype: \"agent_start\";\n\t\t\t/** Whether this execution is an automatic continuation of the current turn */\n\t\t\tcontinuation?: boolean;\n\t  }\n\t| {\n\t\t\t/** Agent execution completed */\n\t\t\ttype: \"agent_end\";\n\t\t\t/** Final messages from this execution */\n\t\t\tmessages: AppMessage[];\n\t\t\t/** Whether execution was aborted */\n\t\t\taborted?: boolean;\n\t\t\t/** If aborted with partial acceptance, contains the saved partial message */\n\t\t\tpartialAccepted?: AppMessage;\n\t\t\t/** Final stop reason from the LLM - \"length\" indicates output hit the max token limit */\n\t\t\tstopReason?: StopReason;\n\t  }\n\t| {\n\t\t\t/** Status update during execution */\n\t\t\ttype: \"status\";\n\t\t\t/** Status message */\n\t\t\tstatus: string;\n\t\t\t/** Additional details */\n\t\t\tdetails: Record<string, unknown>;\n\t  }\n\t| {\n\t\t\t/** Error occurred during execution */\n\t\t\ttype: \"error\";\n\t\t\t/** Error message */\n\t\t\tmessage: string;\n\t  }\n\t| {\n\t\t\t/** New conversation turn started */\n\t\t\ttype: \"turn_start\";\n\t  }\n\t| {\n\t\t\t/** Conversation turn completed */\n\t\t\ttype: \"turn_end\";\n\t\t\t/** Assistant message from this turn */\n\t\t\tmessage: AppMessage;\n\t\t\t/** Tool results from this turn */\n\t\t\ttoolResults: AppMessage[];\n\t  }\n\t| {\n\t\t\t/** New message being constructed */\n\t\t\ttype: \"message_start\";\n\t\t\t/** The message being built */\n\t\t\tmessage: AppMessage;\n\t  }\n\t| {\n\t\t\t/** Incremental update to current message */\n\t\t\ttype: \"message_update\";\n\t\t\t/** Updated message state */\n\t\t\tmessage: AppMessage;\n\t\t\t/** The streaming event that triggered this update */\n\t\t\tassistantMessageEvent: AssistantMessageEvent;\n\t  }\n\t| {\n\t\t\t/** Message completed */\n\t\t\ttype: \"message_end\";\n\t\t\t/** Final message */\n\t\t\tmessage: AppMessage;\n\t  }\n\t| {\n\t\t\t/** Tool execution started */\n\t\t\ttype: \"tool_execution_start\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Arguments passed to the tool */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Scheduler classification and serialization reason for this call */\n\t\t\tscheduling?: ToolSchedulingMetadata;\n\t  }\n\t| {\n\t\t\t/** Tool execution completed */\n\t\t\ttype: \"tool_execution_end\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Optional approval request identifier correlated to Platform ToolExecution */\n\t\t\tapprovalRequestId?: string;\n\t\t\t/** Optional stable error or outcome code for telemetry and clients */\n\t\t\terrorCode?: string;\n\t\t\t/** Optional governed outcome classification surfaced by the tool result */\n\t\t\tgovernedOutcome?:\n\t\t\t\t| \"approval_required\"\n\t\t\t\t| \"approval_pending\"\n\t\t\t\t| \"authentication_required\"\n\t\t\t\t| \"denied\"\n\t\t\t\t| \"rate_limited\";\n\t\t\t/** Optional selected skill artifact metadata surfaced by the tool result */\n\t\t\tskillMetadata?: SkillArtifactMetadata;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Result from the tool */\n\t\t\tresult: ToolResultMessage;\n\t\t\t/** Whether the tool returned an error */\n\t\t\tisError: boolean;\n\t\t\t/** Scheduler classification and final reuse/serialization reason */\n\t\t\tscheduling?: ToolSchedulingMetadata;\n\t  }\n\t| ParallelismGatedEvent\n\t| ParallelConflictDetectedEvent\n\t| {\n\t\t\t/** LSP diagnostic delta produced by an edit/write tool call */\n\t\t\ttype: \"diagnostic_delta\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** File affected by the diagnostic delta */\n\t\t\tfile: string;\n\t\t\t/** User-facing file path from the tool call */\n\t\t\tdisplayPath: string;\n\t\t\t/** Whether a pre-edit baseline was available */\n\t\t\tusedDelta: boolean;\n\t\t\t/** Newly introduced diagnostic count */\n\t\t\tintroducedCount: number;\n\t\t\t/** Diagnostics repaired by the tool call */\n\t\t\trepairedCount: number;\n\t\t\t/** Remaining diagnostics for the affected file */\n\t\t\tremainingCount: number;\n\t\t\t/** Stable fingerprint for introduced diagnostics */\n\t\t\tfingerprint: string;\n\t\t\t/** Repair attempt number for this fingerprint */\n\t\t\trepairAttempt?: number;\n\t\t\t/** Maximum automatic repair attempts for this fingerprint */\n\t\t\tmaxRepairAttempts?: number;\n\t\t\t/** Whether Agent queued a follow-up repair turn */\n\t\t\twillAutoFollowUp: boolean;\n\t\t\t/** Why a repair follow-up was or was not queued */\n\t\t\treason: string;\n\t  }\n\t| {\n\t\t\t/** Summary emitted after the final tool in a batch completes */\n\t\t\ttype: \"tool_batch_summary\";\n\t\t\t/** Stable one-line summary of what the completed tool batch did */\n\t\t\tsummary: string;\n\t\t\t/** Underlying per-tool summary labels used to build the summary */\n\t\t\tsummaryLabels: string[];\n\t\t\t/** Tool call identifiers included in this batch */\n\t\t\ttoolCallIds: string[];\n\t\t\t/** Tool names included in this batch */\n\t\t\ttoolNames: string[];\n\t\t\t/** Successful tool calls in the batch */\n\t\t\tcallsSucceeded: number;\n\t\t\t/** Failed tool calls in the batch */\n\t\t\tcallsFailed: number;\n\t  }\n\t| ToolPhaseSummary\n\t| {\n\t\t\t/** Tool execution produced partial output */\n\t\t\ttype: \"tool_execution_update\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Optional Platform ToolExecution identifier */\n\t\t\ttoolExecutionId?: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Optional human-facing label for live UI */\n\t\t\tdisplayName?: string;\n\t\t\t/** Optional compact summary for live UI */\n\t\t\tsummaryLabel?: string;\n\t\t\t/** Arguments passed to the tool */\n\t\t\targs: Record<string, unknown>;\n\t\t\t/** Partial tool result */\n\t\t\tpartialResult: AgentToolResult;\n\t  }\n\t| {\n\t\t\t/** User approval required for an action */\n\t\t\ttype: \"action_approval_required\";\n\t\t\t/** Details of the approval request */\n\t\t\trequest: ActionApprovalRequest;\n\t  }\n\t| {\n\t\t\t/** User made approval decision */\n\t\t\ttype: \"action_approval_resolved\";\n\t\t\t/** The original request */\n\t\t\trequest: ActionApprovalRequest;\n\t\t\t/** User's decision */\n\t\t\tdecision: ActionApprovalDecision;\n\t  }\n\t| {\n\t\t\t/** Tool failed and requires a retry decision */\n\t\t\ttype: \"tool_retry_required\";\n\t\t\t/** Details of the retry request */\n\t\t\trequest: ToolRetryRequest;\n\t  }\n\t| {\n\t\t\t/** Tool retry decision resolved */\n\t\t\ttype: \"tool_retry_resolved\";\n\t\t\t/** The original request */\n\t\t\trequest: ToolRetryRequest;\n\t\t\t/** User or policy decision */\n\t\t\tdecision: ToolRetryDecision;\n\t  }\n\t| {\n\t\t\t/** Client-side tool invocation needed */\n\t\t\ttype: \"client_tool_request\";\n\t\t\t/** Tool call identifier */\n\t\t\ttoolCallId: string;\n\t\t\t/** Name of the tool */\n\t\t\ttoolName: string;\n\t\t\t/** Arguments for the tool */\n\t\t\targs: unknown;\n\t  }\n\t| {\n\t\t\t/** Context was compacted (older messages summarized) */\n\t\t\ttype: \"compaction\";\n\t\t\t/** Generated summary of compacted messages */\n\t\t\tsummary: string;\n\t\t\t/** Index of first entry to keep (entries before were summarized) */\n\t\t\tfirstKeptEntryIndex: number;\n\t\t\t/** Token count before compaction */\n\t\t\ttokensBefore: number;\n\t\t\t/** Whether this was auto-triggered vs manual /compact */\n\t\t\tauto?: boolean;\n\t\t\t/** Custom instructions used for summarization */\n\t\t\tcustomInstructions?: string;\n\t\t\t/** Timestamp of compaction */\n\t\t\ttimestamp: string;\n\t  }\n\t| {\n\t\t\t/** Auto-retry started for transient error (rate limit, overload, 5xx) */\n\t\t\ttype: \"auto_retry_start\";\n\t\t\t/** Current retry attempt (1-based) */\n\t\t\tattempt: number;\n\t\t\t/** Maximum number of retry attempts */\n\t\t\tmaxAttempts: number;\n\t\t\t/** Delay in milliseconds before retry */\n\t\t\tdelayMs: number;\n\t\t\t/** The error message that triggered the retry */\n\t\t\terrorMessage: string;\n\t  }\n\t| {\n\t\t\t/** Auto-retry completed (success or final failure) */\n\t\t\ttype: \"auto_retry_end\";\n\t\t\t/** Whether the retry eventually succeeded */\n\t\t\tsuccess: boolean;\n\t\t\t/** Final attempt number */\n\t\t\tattempt: number;\n\t\t\t/** If failed, the final error message */\n\t\t\tfinalError?: string;\n\t  };\n\n/**\n * Events emitted over streaming transports (SSE/WebSocket).\n *\n * Includes core agent events plus transport-level signals.\n */\nexport type AgentStreamEvent =\n\t| AgentEvent\n\t| { type: \"session_update\"; sessionId: string }\n\t| { type: \"heartbeat\" }\n\t| { type: \"aborted\" }\n\t| { type: \"done\" };\n\n/**\n * Message queued for sending to the LLM.\n *\n * Wraps the original message with an optional LLM-formatted version,\n * allowing for message transformation before sending.\n *\n * @typeParam TOriginal - Type of the original message\n */\nexport interface QueuedMessage<TOriginal = AppMessage> {\n\t/** Stable identifier for queue operations */\n\tid: number;\n\t/** When the message was queued */\n\tcreatedAt: number;\n\t/** Original message as received */\n\toriginal: TOriginal;\n\t/** Optional LLM-formatted version of the message */\n\tllm?: Message;\n}\n\n/**\n * Runtime configuration for agent execution.\n *\n * Passed to the transport layer when starting a new agent run,\n * containing all the configuration needed to execute a conversation turn.\n */\nexport interface AgentRunConfig {\n\t/** System prompt providing instructions and context */\n\tsystemPrompt: string;\n\t/** Tools available for this run */\n\ttools: AgentTool[];\n\t/** Model to use for generation */\n\tmodel: Model<Api>;\n\t/** Optional reasoning effort level */\n\treasoning?: ReasoningEffort;\n\t/** Optional reasoning summary preference for Responses API */\n\treasoningSummary?: \"auto\" | \"detailed\" | \"concise\" | null;\n\t/** Emit message_end for the initial user message (defaults to true). */\n\temitUserMessageEnd?: boolean;\n\t/** Function to retrieve steering messages for batch sending */\n\tgetSteeringMessages?: <T>() => Promise<QueuedMessage<T>[]>;\n\t/** Function to retrieve follow-up messages for batch sending */\n\tgetFollowUpMessages?: <T>() => Promise<QueuedMessage<T>[]>;\n\t/** Function to retrieve prompt-only messages for the next turn. */\n\tgetPromptOnlyMessages?: () => Promise<Message[]>;\n\t/** @deprecated Use getSteeringMessages/getFollowUpMessages instead */\n\tgetQueuedMessages?: <T>() => Promise<QueuedMessage<T>[]>;\n\t/**\n\t * Optional message preprocessor applied immediately before calling the LLM provider.\n\t *\n\t * Use this to implement provider-specific compatibility transforms (e.g., image limits,\n\t * signature preservation, prompt caching markers) without polluting the core tools.\n\t *\n\t * Note: This is a pure preprocessing hook. It should not execute tools or perform I/O.\n\t */\n\tpreprocessMessages?: (\n\t\tmessages: Message[],\n\t\tcontext: {\n\t\t\tsystemPrompt: string;\n\t\t\ttools: AgentTool[];\n\t\t\tmodel: Model<Api>;\n\t\t\tuserMessage?: Message;\n\t\t},\n\t\tsignal?: AbortSignal,\n\t) => Message[] | Promise<Message[]>;\n\t/** User identification for tracking */\n\tuser?: {\n\t\t/** User UUID */\n\t\tid: string;\n\t\t/** Organization UUID */\n\t\torgId: string;\n\t};\n\t/** Session information for persistence */\n\tsession?: {\n\t\t/** Session UUID */\n\t\tid: string;\n\t\t/** When the session started */\n\t\tstartedAt: Date;\n\t};\n\t/** User/org guarded-files override policy for this run */\n\tguardedFiles?: GuardedFilesPolicySettings;\n\t/** Optional helper function for running LLM queries (e.g., for summarization) */\n\trunLLM?: (systemPrompt: string, userPrompt: string) => Promise<string>;\n\t/** Optional debug checkpoint profiler for local query latency diagnostics. */\n\tqueryProfiler?: CheckpointProfiler;\n\t/** Optional sandbox for isolated tool execution */\n\tsandbox?: import(\"../sandbox/types.js\").Sandbox;\n\t/** Sampling temperature override (0.0-2.0, lower = more deterministic) */\n\ttemperature?: number;\n\t/** Top-p sampling override (0.0-1.0) */\n\ttopP?: number;\n\t/** Optional Anthropic API-side task budget for the current turn */\n\ttaskBudget?: {\n\t\ttotal: number;\n\t\tremaining?: number;\n\t};\n}\n\n/**\n * Transport interface for LLM communication.\n *\n * Implementors of this interface handle the actual communication\n * with the LLM provider, including streaming and tool execution.\n */\nexport interface AgentTransport {\n\t/**\n\t * Execute a conversation turn with a new user message.\n\t *\n\t * @param messages - Conversation history\n\t * @param userMessage - New user message\n\t * @param config - Runtime configuration\n\t * @param signal - Optional abort signal for cancellation\n\t * @returns Async iterable of agent events\n\t */\n\trun(\n\t\tmessages: Message[],\n\t\tuserMessage: Message,\n\t\tconfig: AgentRunConfig,\n\t\tsignal?: AbortSignal,\n\t): AsyncIterable<AgentEvent>;\n\n\t/**\n\t * Continue from current context without a new user message.\n\t *\n\t * Used for:\n\t * - Retrying after transient errors (rate limits, overload)\n\t * - Continuing after context compaction\n\t * - Resuming interrupted tool execution\n\t *\n\t * @param messages - Current conversation history\n\t * @param config - Runtime configuration\n\t * @param signal - Optional abort signal for cancellation\n\t * @returns Async iterable of agent events\n\t */\n\tcontinue(\n\t\tmessages: Message[],\n\t\tconfig: AgentRunConfig,\n\t\tsignal?: AbortSignal,\n\t): AsyncIterable<AgentEvent>;\n\n\t/**\n\t * Optional lightweight connectivity probe for UI health checks.\n\t */\n\tping?: () => Promise<void>;\n}\n\n/**\n * Options for streaming LLM requests.\n *\n * These options are passed to the transport layer when making\n * streaming requests to the LLM provider.\n */\nexport interface StreamOptions {\n\t/** Sampling temperature (0.0-2.0, lower = more deterministic) */\n\ttemperature?: number;\n\t/** Maximum tokens to generate */\n\tmaxTokens?: number;\n\t/** Abort signal for cancellation */\n\tsignal?: AbortSignal;\n\t/** API key for authentication */\n\tapiKey?: string;\n\t/** Additional headers to include in requests */\n\theaders?: Record<string, string>;\n\t/** Additional request body fields for provider-specific extensions */\n\trequestBody?: Record<string, unknown>;\n\t/** Stable session id for provider-side request grouping/cache keys */\n\tsessionId?: string;\n\t/** Current working directory for local provider runtimes. */\n\tcwd?: string;\n\t/** Authentication type for the request */\n\tauthType?: \"api-key\" | \"bearer-token\";\n\t/** Optional Anthropic API-side task budget for the current turn */\n\ttaskBudget?: {\n\t\ttotal: number;\n\t\tremaining?: number;\n\t};\n\t/** Optional governed executor for provider-native dynamic tool callbacks. */\n\texecuteDynamicTool?: (toolCall: ToolCall) => Promise<AgentToolResult>;\n}\n\n/**\n * Cache control hint for prompt caching.\n *\n * Used to mark content that should be cached for faster\n * subsequent requests.\n */\nexport interface PromptCacheControl {\n\t/** Cache type - currently only \"ephemeral\" is supported */\n\ttype: \"ephemeral\";\n}\n"]}

package/dist/api/enterprise-routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-routes.d.ts","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAuBH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AA0TjD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAelE;AAMD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,EAAE,CA+I5E"}
+{"version":3,"file":"enterprise-routes.d.ts","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AA2BH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAyZjD,wBAAsB,4BAA4B,IAAI,OAAO,CAAC,IAAI,CAAC,CAelE;AAMD,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,KAAK,EAAE,CA2J5E"}

package/dist/api/enterprise-routes.js

@@ -2,21 +2,24 @@
  * Enterprise API Routes
  * Handles authentication, RBAC, organizations, and admin features
  */
-import { and, eq } from "drizzle-orm";
+import { and, eq, sql } from "drizzle-orm";
 import { AUDIT_ACTIONS, AuditLogger } from "../audit/logger.js";
 import { TokenTracker } from "../billing/token-tracker.js";
 import { getDb } from "../db/client.js";
-import { alerts, organizations, roles, } from "../db/schema.js";
-import { decryptOrgSettings, encryptOrgSettings, } from "../db/settings-encryption.js";
+import { alerts, organizations, roles, users, } from "../db/schema.js";
+import { decryptOrgSettings, decryptUserSettings, encryptOrgSettings, encryptUserSettings, } from "../db/settings-encryption.js";
 import { ACTIONS, PermissionChecker, RESOURCES, seedPermissions, } from "../rbac/permissions.js";
 import { readJsonBody, sendJson } from "../server/server-utils.js";
 import { resolveInternalTelemetryDisabledSetting } from "../telemetry/disablement.js";
+import { isPlainObject } from "../utils/json.js";
 import { createLogger } from "../utils/logger.js";
 import { handleLogin, handleMe, handleRegister, } from "./enterprise/auth-handlers.js";
 import { handleCreateDirectoryRule, handleDeleteDirectoryRule, handleGetDirectoryRules, } from "./enterprise/directory-rule-handlers.js";
 import { handleGetOrgMembers, handleInviteUser, handleRemoveMember, handleUpdateMemberQuota, handleUpdateMemberRole, } from "./enterprise/member-handlers.js";
 import { authenticateJWT } from "./enterprise/middleware.js";
 import { handleApproveModel, handleDenyModel, handleGetModelApprovals, } from "./enterprise/model-approval-handlers.js";
+import { mergeOrganizationSettings } from "./org-settings-merge.js";
+import { mergeUserSettings } from "./user-settings-merge.js";
 const logger = createLogger("enterprise-api");
 // ============================================================================
 // USAGE & QUOTA ENDPOINTS
@@ -158,13 +161,7 @@ async function handleUpdateOrgSettings(req, res, cors) {
         return;
     }
     const previousSettings = decryptOrgSettings(org.settings) || {};
-    const mergedSettings = {
-        ...previousSettings,
-        ...body,
-        internal: body.internal || previousSettings.internal
-            ? { ...previousSettings.internal, ...body.internal }
-            : undefined,
-    };
+    const mergedSettings = mergeOrganizationSettings(previousSettings, body);
     const previousTelemetryDisabled = resolveInternalTelemetryDisabledSetting(previousSettings);
     const nextTelemetryDisabled = resolveInternalTelemetryDisabledSetting(mergedSettings);
     // Encrypt sensitive fields (webhookSigningSecret) before storing
@@ -188,6 +185,75 @@ async function handleUpdateOrgSettings(req, res, cors) {
     }
     sendJson(res, 200, { success: true }, cors, req);
 }
+async function handleGetUserSettings(req, res, cors) {
+    const auth = await authenticateJWT(req);
+    if (!auth) {
+        sendJson(res, 401, { error: "Unauthorized" }, cors, req);
+        return;
+    }
+    const db = getDb();
+    const user = await db.query.users.findFirst({
+        where: eq(users.id, auth.userId),
+    });
+    if (!user) {
+        sendJson(res, 404, { error: "User not found" }, cors, req);
+        return;
+    }
+    // Decrypt sensitive fields (twoFactor secret) before returning.
+    const decryptedSettings = decryptUserSettings(user.settings) || {};
+    sendJson(res, 200, decryptedSettings, cors, req);
+}
+async function handleUpdateUserSettings(req, res, cors) {
+    const auth = await authenticateJWT(req);
+    if (!auth) {
+        sendJson(res, 401, { error: "Unauthorized" }, cors, req);
+        return;
+    }
+    const body = await readJsonBody(req);
+    if (!isPlainObject(body)) {
+        sendJson(res, 400, { error: "Settings body must be an object" }, cors, req);
+        return;
+    }
+    const requestedSettings = body;
+    const db = getDb();
+    for (let attempt = 0; attempt < 3; attempt++) {
+        const user = await db.query.users.findFirst({
+            where: eq(users.id, auth.userId),
+        });
+        if (!user) {
+            sendJson(res, 404, { error: "User not found" }, cors, req);
+            return;
+        }
+        // Self-scoped: the caller can only touch their own user settings. 2FA
+        // state is preserved from the latest committed row by retrying on
+        // concurrent settings writes, and the maestro runtime-knob namespace is
+        // validated against the MaestroSettings catalog.
+        const previousSettings = decryptUserSettings(user.settings) || {};
+        const mergedSettings = mergeUserSettings(previousSettings, requestedSettings);
+        const encryptedSettings = encryptUserSettings(mergedSettings);
+        const storedSettingsMatch = user.settings == null
+            ? sql `${users.settings} IS NULL`
+            : sql `${users.settings} IS NOT DISTINCT FROM ${JSON.stringify(user.settings)}::jsonb`;
+        const updatedRows = await db
+            .update(users)
+            .set({ settings: encryptedSettings })
+            .where(and(eq(users.id, auth.userId), storedSettingsMatch))
+            .returning({ id: users.id });
+        if (updatedRows.length > 0) {
+            await AuditLogger.log({
+                orgId: auth.orgId,
+                userId: auth.userId,
+                action: AUDIT_ACTIONS.CONFIG_WRITE,
+                resourceType: "user_settings",
+                status: "success",
+                metadata: {},
+            });
+            sendJson(res, 200, { success: true }, cors, req);
+            return;
+        }
+    }
+    sendJson(res, 409, { error: "Settings changed concurrently; please retry" }, cors, req);
+}
 // ============================================================================
 // ROLES
 // ============================================================================
@@ -309,6 +375,17 @@ export function createEnterpriseRoutes(cors) {
             path: "/api/org/settings",
             handler: (req, res) => handleUpdateOrgSettings(req, res, cors),
         },
+        // User Settings (self-scoped to the authenticated user)
+        {
+            method: "GET",
+            path: "/api/user/settings",
+            handler: (req, res) => handleGetUserSettings(req, res, cors),
+        },
+        {
+            method: "PUT",
+            path: "/api/user/settings",
+            handler: (req, res) => handleUpdateUserSettings(req, res, cors),
+        },
         // Roles
         {
             method: "GET",

package/dist/api/enterprise-routes.js.map

@@ -1 +1 @@
-{"version":3,"file":"enterprise-routes.js","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAEN,MAAM,EACN,aAAa,EACb,KAAK,GACL,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,kBAAkB,EAClB,kBAAkB,GAClB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACN,OAAO,EACP,iBAAiB,EACjB,SAAS,EACT,eAAe,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,cAAc,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACN,kBAAkB,EAClB,eAAe,EACf,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AAEjD,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,KAAK,UAAU,eAAe,CAC7B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG;KACV,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjD,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,KAAK,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,KAAK,UAAU,mBAAmB,CACjC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,oBAAoB,CAClC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAClD,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAC1C,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,KAAK,CACb,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAuB,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,cAAc,GAAyB;QAC5C,GAAG,gBAAgB;QACnB,GAAG,IAAI;QACP,QAAQ,EACP,IAAI,CAAC,QAAQ,IAAI,gBAAgB,CAAC,QAAQ;YACzC,CAAC,CAAC,EAAE,GAAG,gBAAgB,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,QAAQ,EAAE;YACpD,CAAC,CAAC,SAAS;KACb,CAAC;IACF,MAAM,yBAAyB,GAC9B,uCAAuC,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,qBAAqB,GAC1B,uCAAuC,CAAC,cAAc,CAAC,CAAC;IAEzD,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAE7D,MAAM,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;SACpC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1C,IAAI,yBAAyB,KAAK,qBAAqB,EAAE,CAAC;QACzD,MAAM,WAAW,CAAC,GAAG,CAAC;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,aAAa,CAAC,YAAY;YAClC,YAAY,EAAE,uBAAuB;YACrC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACT,aAAa,EAAE,MAAM,CAAC,yBAAyB,CAAC;gBAChD,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC;aACvC;SACD,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC/B,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,4BAA4B;IACjD,IAAI,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAEnD,qCAAqC;QACrC,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,0CAA0C,EAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;QACF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,UAAU,sBAAsB,CAAC,IAA4B;IAClE,OAAO;QACN,iBAAiB;QACjB;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAClD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC/C;QAED,iBAAiB;QACjB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,aAAa;QACb;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACtD;QAED,SAAS;QACT;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACnD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QAED,uBAAuB;QACvB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC7D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SACzD;QAED,wBAAwB;QACxB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QAED,QAAQ;QACR;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,kBAAkB;QAClB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SACvD;QAED,yBAAyB;QACzB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAChE;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAChE;KACD,CAAC;AACH,CAAC","sourcesContent":["/**\n * Enterprise API Routes\n * Handles authentication, RBAC, organizations, and admin features\n */\n\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { and, eq } from \"drizzle-orm\";\nimport { AUDIT_ACTIONS, AuditLogger } from \"../audit/logger.js\";\nimport { TokenTracker } from \"../billing/token-tracker.js\";\nimport { getDb } from \"../db/client.js\";\nimport {\n\ttype OrganizationSettings,\n\talerts,\n\torganizations,\n\troles,\n} from \"../db/schema.js\";\nimport {\n\tdecryptOrgSettings,\n\tencryptOrgSettings,\n} from \"../db/settings-encryption.js\";\nimport {\n\tACTIONS,\n\tPermissionChecker,\n\tRESOURCES,\n\tseedPermissions,\n} from \"../rbac/permissions.js\";\nimport type { Route } from \"../server/router.js\";\nimport { readJsonBody, sendJson } from \"../server/server-utils.js\";\nimport { resolveInternalTelemetryDisabledSetting } from \"../telemetry/disablement.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\thandleLogin,\n\thandleMe,\n\thandleRegister,\n} from \"./enterprise/auth-handlers.js\";\nimport {\n\thandleCreateDirectoryRule,\n\thandleDeleteDirectoryRule,\n\thandleGetDirectoryRules,\n} from \"./enterprise/directory-rule-handlers.js\";\nimport {\n\thandleGetOrgMembers,\n\thandleInviteUser,\n\thandleRemoveMember,\n\thandleUpdateMemberQuota,\n\thandleUpdateMemberRole,\n} from \"./enterprise/member-handlers.js\";\nimport { authenticateJWT } from \"./enterprise/middleware.js\";\nimport {\n\thandleApproveModel,\n\thandleDenyModel,\n\thandleGetModelApprovals,\n} from \"./enterprise/model-approval-handlers.js\";\n\nconst logger = createLogger(\"enterprise-api\");\n\n// ============================================================================\n// USAGE & QUOTA ENDPOINTS\n// ============================================================================\n\nasync function handleUsageQuota(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst quota = await TokenTracker.getQuota(auth.userId, auth.orgId);\n\tsendJson(res, 200, quota, cors, req);\n}\n\nasync function handleOrgUsage(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst summary = await TokenTracker.getOrgUsageSummary(auth.orgId);\n\tsendJson(res, 200, summary, cors, req);\n}\n\n// ============================================================================\n// AUDIT LOG ENDPOINTS\n// ============================================================================\n\nasync function handleAuditLogs(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst logs = await AuditLogger.query({\n\t\torgId: auth.orgId,\n\t\tlimit: 100,\n\t});\n\n\tsendJson(res, 200, { logs }, cors, req);\n}\n\n// ============================================================================\n// ALERT ENDPOINTS\n// ============================================================================\n\nasync function handleAlerts(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst userAlerts = await db.query.alerts.findMany({\n\t\twhere: and(eq(alerts.orgId, auth.orgId), eq(alerts.userId, auth.userId)),\n\t\torderBy: (alerts, { desc }) => [desc(alerts.createdAt)],\n\t\tlimit: 50,\n\t});\n\n\tsendJson(res, 200, { alerts: userAlerts }, cors, req);\n}\n\n// ============================================================================\n// ALERT ACTIONS\n// ============================================================================\n\nasync function handleMarkAlertRead(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ isRead: true })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\nasync function handleResolveAlert(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ resolvedAt: new Date() })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\n// ============================================================================\n// ORGANIZATION SETTINGS\n// ============================================================================\n\nasync function handleGetOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Decrypt sensitive fields (webhookSigningSecret) before returning\n\tconst decryptedSettings = decryptOrgSettings(org.settings) || {};\n\tsendJson(res, 200, decryptedSettings, cors, req);\n}\n\nasync function handleUpdateOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst hasPermission = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId },\n\t\tRESOURCES.ORGS,\n\t\tACTIONS.WRITE,\n\t);\n\tif (!hasPermission) {\n\t\tsendJson(res, 403, { error: \"Permission denied\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst body = await readJsonBody<OrganizationSettings>(req);\n\tif (!body) {\n\t\tsendJson(res, 400, { error: \"Settings body required\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst previousSettings = decryptOrgSettings(org.settings) || {};\n\tconst mergedSettings: OrganizationSettings = {\n\t\t...previousSettings,\n\t\t...body,\n\t\tinternal:\n\t\t\tbody.internal || previousSettings.internal\n\t\t\t\t? { ...previousSettings.internal, ...body.internal }\n\t\t\t\t: undefined,\n\t};\n\tconst previousTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(previousSettings);\n\tconst nextTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(mergedSettings);\n\n\t// Encrypt sensitive fields (webhookSigningSecret) before storing\n\tconst encryptedSettings = encryptOrgSettings(mergedSettings);\n\n\tawait db\n\t\t.update(organizations)\n\t\t.set({ settings: encryptedSettings })\n\t\t.where(eq(organizations.id, auth.orgId));\n\n\tif (previousTelemetryDisabled !== nextTelemetryDisabled) {\n\t\tawait AuditLogger.log({\n\t\t\torgId: auth.orgId,\n\t\t\tuserId: auth.userId,\n\t\t\taction: AUDIT_ACTIONS.CONFIG_WRITE,\n\t\t\tresourceType: \"organization_settings\",\n\t\t\tstatus: \"success\",\n\t\t\tmetadata: {\n\t\t\t\toriginalValue: String(previousTelemetryDisabled),\n\t\t\t\tnewValue: String(nextTelemetryDisabled),\n\t\t\t},\n\t\t});\n\t}\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\n// ============================================================================\n// ROLES\n// ============================================================================\n\nasync function handleGetRoles(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst orgRoles = await db.query.roles.findMany({\n\t\twhere: eq(roles.isSystem, true),\n\t});\n\n\tsendJson(res, 200, { roles: orgRoles }, cors, req);\n}\n\n// ============================================================================\n// INITIALIZE ENTERPRISE FEATURES\n// ============================================================================\n\nexport async function initializeEnterpriseFeatures(): Promise<void> {\n\ttry {\n\t\tlogger.info(\"Initializing enterprise features...\");\n\n\t\t// Seed default permissions and roles\n\t\tawait seedPermissions();\n\n\t\tlogger.info(\"Enterprise features initialized successfully\");\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Failed to initialize enterprise features\",\n\t\t\terror instanceof Error ? error : undefined,\n\t\t);\n\t\tthrow error;\n\t}\n}\n\n// ============================================================================\n// ROUTE EXPORTS\n// ============================================================================\n\nexport function createEnterpriseRoutes(cors: Record<string, string>): Route[] {\n\treturn [\n\t\t// Authentication\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/register\",\n\t\t\thandler: (req, res) => handleRegister(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/login\",\n\t\t\thandler: (req, res) => handleLogin(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/auth/me\",\n\t\t\thandler: (req, res) => handleMe(req, res, cors),\n\t\t},\n\n\t\t// Usage & Quotas\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/quota\",\n\t\t\thandler: (req, res) => handleUsageQuota(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/org\",\n\t\t\thandler: (req, res) => handleOrgUsage(req, res, cors),\n\t\t},\n\n\t\t// Audit Logs\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/audit/logs\",\n\t\t\thandler: (req, res) => handleAuditLogs(req, res, cors),\n\t\t},\n\n\t\t// Alerts\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/alerts\",\n\t\t\thandler: (req, res) => handleAlerts(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/read\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleMarkAlertRead(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/resolve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleResolveAlert(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\n\t\t// Organization Members\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/members\",\n\t\t\thandler: (req, res) => handleGetOrgMembers(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/org/members/invite\",\n\t\t\thandler: (req, res) => handleInviteUser(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/role\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberRole(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/quota\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberQuota(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/org/members/:userId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleRemoveMember(req, res, cors, params?.userId || \"\"),\n\t\t},\n\n\t\t// Organization Settings\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleGetOrgSettings(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleUpdateOrgSettings(req, res, cors),\n\t\t},\n\n\t\t// Roles\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/roles\",\n\t\t\thandler: (req, res) => handleGetRoles(req, res, cors),\n\t\t},\n\n\t\t// Model Approvals\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/models/approvals\",\n\t\t\thandler: (req, res) => handleGetModelApprovals(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/approve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleApproveModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/deny\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDenyModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\n\t\t// Directory Access Rules\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleGetDirectoryRules(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleCreateDirectoryRule(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/directory-rules/:ruleId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDeleteDirectoryRule(req, res, cors, params?.ruleId || \"\"),\n\t\t},\n\t];\n}\n"]}
+{"version":3,"file":"enterprise-routes.js","sourceRoot":"","sources":["../../src/api/enterprise-routes.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AACxC,OAAO,EAGN,MAAM,EACN,aAAa,EACb,KAAK,EACL,KAAK,GACL,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACN,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,mBAAmB,GACnB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACN,OAAO,EACP,iBAAiB,EACjB,SAAS,EACT,eAAe,GACf,MAAM,wBAAwB,CAAC;AAEhC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,EAAE,uCAAuC,EAAE,MAAM,6BAA6B,CAAC;AACtF,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACN,WAAW,EACX,QAAQ,EACR,cAAc,GACd,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACN,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EACN,mBAAmB,EACnB,gBAAgB,EAChB,kBAAkB,EAClB,uBAAuB,EACvB,sBAAsB,GACtB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,4BAA4B,CAAC;AAC7D,OAAO,EACN,kBAAkB,EAClB,eAAe,EACf,uBAAuB,GACvB,MAAM,yCAAyC,CAAC;AACjD,OAAO,EAAE,yBAAyB,EAAE,MAAM,yBAAyB,CAAC;AACpE,OAAO,EAAE,iBAAiB,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;AAE9C,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E,KAAK,UAAU,gBAAgB,CAC9B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACtC,CAAC;AAED,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACxC,CAAC;AAED,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E,KAAK,UAAU,eAAe,CAC7B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,mBAAmB;IACnB,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAC5C,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAC/D,SAAS,CAAC,KAAK,EACf,OAAO,CAAC,IAAI,CACZ,CAAC;IAEF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACtD,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,WAAW,CAAC,KAAK,CAAC;QACpC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,KAAK,EAAE,GAAG;KACV,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,KAAK,UAAU,YAAY,CAC1B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC;QACjD,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACxE,OAAO,EAAE,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACvD,KAAK,EAAE,EAAE;KACT,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACvD,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,KAAK,UAAU,mBAAmB,CACjC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;SACrB,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,GAAoB,EACpB,GAAmB,EACnB,IAA4B,EAC5B,OAAe;IAEf,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,EAAE;SACN,MAAM,CAAC,MAAM,CAAC;SACd,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,EAAE,CAAC;SAC/B,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,+EAA+E;AAC/E,wBAAwB;AACxB,+EAA+E;AAE/E,KAAK,UAAU,oBAAoB,CAClC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IAEH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,mEAAmE;IACnE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACjE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,aAAa,GAAG,MAAM,iBAAiB,CAAC,KAAK,CAClD,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,EAC1C,SAAS,CAAC,IAAI,EACd,OAAO,CAAC,KAAK,CACb,CAAC;IACF,IAAI,CAAC,aAAa,EAAE,CAAC;QACpB,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC9D,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAuB,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,aAAa,CAAC,SAAS,CAAC;QAClD,KAAK,EAAE,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC;KACvC,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,wBAAwB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,OAAO;IACR,CAAC;IAED,MAAM,gBAAgB,GAAG,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IAChE,MAAM,cAAc,GAAG,yBAAyB,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC;IACzE,MAAM,yBAAyB,GAC9B,uCAAuC,CAAC,gBAAgB,CAAC,CAAC;IAC3D,MAAM,qBAAqB,GAC1B,uCAAuC,CAAC,cAAc,CAAC,CAAC;IAEzD,iEAAiE;IACjE,MAAM,iBAAiB,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;IAE7D,MAAM,EAAE;SACN,MAAM,CAAC,aAAa,CAAC;SACrB,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;SACpC,KAAK,CAAC,EAAE,CAAC,aAAa,CAAC,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IAE1C,IAAI,yBAAyB,KAAK,qBAAqB,EAAE,CAAC;QACzD,MAAM,WAAW,CAAC,GAAG,CAAC;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,MAAM,EAAE,aAAa,CAAC,YAAY;YAClC,YAAY,EAAE,uBAAuB;YACrC,MAAM,EAAE,SAAS;YACjB,QAAQ,EAAE;gBACT,aAAa,EAAE,MAAM,CAAC,yBAAyB,CAAC;gBAChD,QAAQ,EAAE,MAAM,CAAC,qBAAqB,CAAC;aACvC;SACD,CAAC,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,qBAAqB,CACnC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QAC3C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC;KAChC,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC3D,OAAO;IACR,CAAC;IAED,gEAAgE;IAChE,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;IACnE,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,wBAAwB,CACtC,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,YAAY,CAAU,GAAG,CAAC,CAAC;IAC9C,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1B,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,iCAAiC,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QAC5E,OAAO;IACR,CAAC;IACD,MAAM,iBAAiB,GAAG,IAAoB,CAAC;IAE/C,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QAC9C,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;YAC3C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,EAAE,CAAC;YACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,gBAAgB,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YAC3D,OAAO;QACR,CAAC;QAED,sEAAsE;QACtE,kEAAkE;QAClE,wEAAwE;QACxE,iDAAiD;QACjD,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAClE,MAAM,cAAc,GAAG,iBAAiB,CACvC,gBAAgB,EAChB,iBAAiB,CACjB,CAAC;QACF,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,cAAc,CAAC,CAAC;QAC9D,MAAM,mBAAmB,GACxB,IAAI,CAAC,QAAQ,IAAI,IAAI;YACpB,CAAC,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,UAAU;YAChC,CAAC,CAAC,GAAG,CAAA,GAAG,KAAK,CAAC,QAAQ,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC;QAExF,MAAM,WAAW,GAAG,MAAM,EAAE;aAC1B,MAAM,CAAC,KAAK,CAAC;aACb,GAAG,CAAC,EAAE,QAAQ,EAAE,iBAAiB,EAAE,CAAC;aACpC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,mBAAmB,CAAC,CAAC;aAC1D,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC;QAE9B,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,MAAM,WAAW,CAAC,GAAG,CAAC;gBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,MAAM,EAAE,aAAa,CAAC,YAAY;gBAClC,YAAY,EAAE,eAAe;gBAC7B,MAAM,EAAE,SAAS;gBACjB,QAAQ,EAAE,EAAE;aACZ,CAAC,CAAC;YAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;YACjD,OAAO;QACR,CAAC;IACF,CAAC;IAED,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,6CAA6C,EAAE,EACxD,IAAI,EACJ,GAAG,CACH,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,QAAQ;AACR,+EAA+E;AAE/E,KAAK,UAAU,cAAc,CAC5B,GAAoB,EACpB,GAAmB,EACnB,IAA4B;IAE5B,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;QACzD,OAAO;IACR,CAAC;IAED,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,MAAM,QAAQ,GAAG,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC;QAC9C,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC;KAC/B,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED,+EAA+E;AAC/E,iCAAiC;AACjC,+EAA+E;AAE/E,MAAM,CAAC,KAAK,UAAU,4BAA4B;IACjD,IAAI,CAAC;QACJ,MAAM,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAEnD,qCAAqC;QACrC,MAAM,eAAe,EAAE,CAAC;QAExB,MAAM,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,KAAK,CACX,0CAA0C,EAC1C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAC1C,CAAC;QACF,MAAM,KAAK,CAAC;IACb,CAAC;AACF,CAAC;AAED,+EAA+E;AAC/E,gBAAgB;AAChB,+EAA+E;AAE/E,MAAM,UAAU,sBAAsB,CAAC,IAA4B;IAClE,OAAO;QACN,iBAAiB;QACjB;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAClD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,cAAc;YACpB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC/C;QAED,iBAAiB;QACjB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gBAAgB;YACtB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,aAAa;QACb;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,iBAAiB;YACvB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACtD;QAED,SAAS;QACT;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACnD;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,2BAA2B;YACjC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QAED,uBAAuB;QACvB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,yBAAyB;YAC/B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACvD;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,+BAA+B;YACrC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,sBAAsB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC7D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,gCAAgC;YACtC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,0BAA0B;YAChC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SACzD;QAED,wBAAwB;QACxB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,oBAAoB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC3D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QAED,wDAAwD;QACxD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC5D;QACD;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,oBAAoB;YAC1B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,wBAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC/D;QAED,QAAQ;QACR;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,YAAY;YAClB,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,cAAc,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SACrD;QAED,kBAAkB;QAClB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,uBAAuB;YAC7B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,wCAAwC;YAC9C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,kBAAkB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SAC1D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,qCAAqC;YAC3C,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,IAAI,EAAE,CAAC;SACvD;QAED,yBAAyB;QACzB;YACC,MAAM,EAAE,KAAK;YACb,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAC9D;QACD;YACC,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC;SAChE;QACD;YACC,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,8BAA8B;YACpC,OAAO,EAAE,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,EAAE,CAC7B,yBAAyB,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,CAAC;SAChE;KACD,CAAC;AACH,CAAC","sourcesContent":["/**\n * Enterprise API Routes\n * Handles authentication, RBAC, organizations, and admin features\n */\n\nimport type { IncomingMessage, ServerResponse } from \"node:http\";\nimport { and, eq, sql } from \"drizzle-orm\";\nimport { AUDIT_ACTIONS, AuditLogger } from \"../audit/logger.js\";\nimport { TokenTracker } from \"../billing/token-tracker.js\";\nimport { getDb } from \"../db/client.js\";\nimport {\n\ttype OrganizationSettings,\n\ttype UserSettings,\n\talerts,\n\torganizations,\n\troles,\n\tusers,\n} from \"../db/schema.js\";\nimport {\n\tdecryptOrgSettings,\n\tdecryptUserSettings,\n\tencryptOrgSettings,\n\tencryptUserSettings,\n} from \"../db/settings-encryption.js\";\nimport {\n\tACTIONS,\n\tPermissionChecker,\n\tRESOURCES,\n\tseedPermissions,\n} from \"../rbac/permissions.js\";\nimport type { Route } from \"../server/router.js\";\nimport { readJsonBody, sendJson } from \"../server/server-utils.js\";\nimport { resolveInternalTelemetryDisabledSetting } from \"../telemetry/disablement.js\";\nimport { isPlainObject } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\thandleLogin,\n\thandleMe,\n\thandleRegister,\n} from \"./enterprise/auth-handlers.js\";\nimport {\n\thandleCreateDirectoryRule,\n\thandleDeleteDirectoryRule,\n\thandleGetDirectoryRules,\n} from \"./enterprise/directory-rule-handlers.js\";\nimport {\n\thandleGetOrgMembers,\n\thandleInviteUser,\n\thandleRemoveMember,\n\thandleUpdateMemberQuota,\n\thandleUpdateMemberRole,\n} from \"./enterprise/member-handlers.js\";\nimport { authenticateJWT } from \"./enterprise/middleware.js\";\nimport {\n\thandleApproveModel,\n\thandleDenyModel,\n\thandleGetModelApprovals,\n} from \"./enterprise/model-approval-handlers.js\";\nimport { mergeOrganizationSettings } from \"./org-settings-merge.js\";\nimport { mergeUserSettings } from \"./user-settings-merge.js\";\n\nconst logger = createLogger(\"enterprise-api\");\n\n// ============================================================================\n// USAGE & QUOTA ENDPOINTS\n// ============================================================================\n\nasync function handleUsageQuota(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst quota = await TokenTracker.getQuota(auth.userId, auth.orgId);\n\tsendJson(res, 200, quota, cors, req);\n}\n\nasync function handleOrgUsage(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst summary = await TokenTracker.getOrgUsageSummary(auth.orgId);\n\tsendJson(res, 200, summary, cors, req);\n}\n\n// ============================================================================\n// AUDIT LOG ENDPOINTS\n// ============================================================================\n\nasync function handleAuditLogs(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Check permission\n\tconst allowed = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId, roleId: auth.roleId },\n\t\tRESOURCES.AUDIT,\n\t\tACTIONS.READ,\n\t);\n\n\tif (!allowed) {\n\t\tsendJson(res, 403, { error: \"Forbidden\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst logs = await AuditLogger.query({\n\t\torgId: auth.orgId,\n\t\tlimit: 100,\n\t});\n\n\tsendJson(res, 200, { logs }, cors, req);\n}\n\n// ============================================================================\n// ALERT ENDPOINTS\n// ============================================================================\n\nasync function handleAlerts(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n) {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst userAlerts = await db.query.alerts.findMany({\n\t\twhere: and(eq(alerts.orgId, auth.orgId), eq(alerts.userId, auth.userId)),\n\t\torderBy: (alerts, { desc }) => [desc(alerts.createdAt)],\n\t\tlimit: 50,\n\t});\n\n\tsendJson(res, 200, { alerts: userAlerts }, cors, req);\n}\n\n// ============================================================================\n// ALERT ACTIONS\n// ============================================================================\n\nasync function handleMarkAlertRead(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ isRead: true })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\nasync function handleResolveAlert(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n\talertId: string,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tawait db\n\t\t.update(alerts)\n\t\t.set({ resolvedAt: new Date() })\n\t\t.where(and(eq(alerts.id, alertId), eq(alerts.orgId, auth.orgId)));\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\n// ============================================================================\n// ORGANIZATION SETTINGS\n// ============================================================================\n\nasync function handleGetOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Decrypt sensitive fields (webhookSigningSecret) before returning\n\tconst decryptedSettings = decryptOrgSettings(org.settings) || {};\n\tsendJson(res, 200, decryptedSettings, cors, req);\n}\n\nasync function handleUpdateOrgSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst hasPermission = await PermissionChecker.check(\n\t\t{ userId: auth.userId, orgId: auth.orgId },\n\t\tRESOURCES.ORGS,\n\t\tACTIONS.WRITE,\n\t);\n\tif (!hasPermission) {\n\t\tsendJson(res, 403, { error: \"Permission denied\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst body = await readJsonBody<OrganizationSettings>(req);\n\tif (!body) {\n\t\tsendJson(res, 400, { error: \"Settings body required\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst org = await db.query.organizations.findFirst({\n\t\twhere: eq(organizations.id, auth.orgId),\n\t});\n\tif (!org) {\n\t\tsendJson(res, 404, { error: \"Organization not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst previousSettings = decryptOrgSettings(org.settings) || {};\n\tconst mergedSettings = mergeOrganizationSettings(previousSettings, body);\n\tconst previousTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(previousSettings);\n\tconst nextTelemetryDisabled =\n\t\tresolveInternalTelemetryDisabledSetting(mergedSettings);\n\n\t// Encrypt sensitive fields (webhookSigningSecret) before storing\n\tconst encryptedSettings = encryptOrgSettings(mergedSettings);\n\n\tawait db\n\t\t.update(organizations)\n\t\t.set({ settings: encryptedSettings })\n\t\t.where(eq(organizations.id, auth.orgId));\n\n\tif (previousTelemetryDisabled !== nextTelemetryDisabled) {\n\t\tawait AuditLogger.log({\n\t\t\torgId: auth.orgId,\n\t\t\tuserId: auth.userId,\n\t\t\taction: AUDIT_ACTIONS.CONFIG_WRITE,\n\t\t\tresourceType: \"organization_settings\",\n\t\t\tstatus: \"success\",\n\t\t\tmetadata: {\n\t\t\t\toriginalValue: String(previousTelemetryDisabled),\n\t\t\t\tnewValue: String(nextTelemetryDisabled),\n\t\t\t},\n\t\t});\n\t}\n\n\tsendJson(res, 200, { success: true }, cors, req);\n}\n\nasync function handleGetUserSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst user = await db.query.users.findFirst({\n\t\twhere: eq(users.id, auth.userId),\n\t});\n\n\tif (!user) {\n\t\tsendJson(res, 404, { error: \"User not found\" }, cors, req);\n\t\treturn;\n\t}\n\n\t// Decrypt sensitive fields (twoFactor secret) before returning.\n\tconst decryptedSettings = decryptUserSettings(user.settings) || {};\n\tsendJson(res, 200, decryptedSettings, cors, req);\n}\n\nasync function handleUpdateUserSettings(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst body = await readJsonBody<unknown>(req);\n\tif (!isPlainObject(body)) {\n\t\tsendJson(res, 400, { error: \"Settings body must be an object\" }, cors, req);\n\t\treturn;\n\t}\n\tconst requestedSettings = body as UserSettings;\n\n\tconst db = getDb();\n\tfor (let attempt = 0; attempt < 3; attempt++) {\n\t\tconst user = await db.query.users.findFirst({\n\t\t\twhere: eq(users.id, auth.userId),\n\t\t});\n\t\tif (!user) {\n\t\t\tsendJson(res, 404, { error: \"User not found\" }, cors, req);\n\t\t\treturn;\n\t\t}\n\n\t\t// Self-scoped: the caller can only touch their own user settings. 2FA\n\t\t// state is preserved from the latest committed row by retrying on\n\t\t// concurrent settings writes, and the maestro runtime-knob namespace is\n\t\t// validated against the MaestroSettings catalog.\n\t\tconst previousSettings = decryptUserSettings(user.settings) || {};\n\t\tconst mergedSettings = mergeUserSettings(\n\t\t\tpreviousSettings,\n\t\t\trequestedSettings,\n\t\t);\n\t\tconst encryptedSettings = encryptUserSettings(mergedSettings);\n\t\tconst storedSettingsMatch =\n\t\t\tuser.settings == null\n\t\t\t\t? sql`${users.settings} IS NULL`\n\t\t\t\t: sql`${users.settings} IS NOT DISTINCT FROM ${JSON.stringify(user.settings)}::jsonb`;\n\n\t\tconst updatedRows = await db\n\t\t\t.update(users)\n\t\t\t.set({ settings: encryptedSettings })\n\t\t\t.where(and(eq(users.id, auth.userId), storedSettingsMatch))\n\t\t\t.returning({ id: users.id });\n\n\t\tif (updatedRows.length > 0) {\n\t\t\tawait AuditLogger.log({\n\t\t\t\torgId: auth.orgId,\n\t\t\t\tuserId: auth.userId,\n\t\t\t\taction: AUDIT_ACTIONS.CONFIG_WRITE,\n\t\t\t\tresourceType: \"user_settings\",\n\t\t\t\tstatus: \"success\",\n\t\t\t\tmetadata: {},\n\t\t\t});\n\n\t\t\tsendJson(res, 200, { success: true }, cors, req);\n\t\t\treturn;\n\t\t}\n\t}\n\n\tsendJson(\n\t\tres,\n\t\t409,\n\t\t{ error: \"Settings changed concurrently; please retry\" },\n\t\tcors,\n\t\treq,\n\t);\n}\n\n// ============================================================================\n// ROLES\n// ============================================================================\n\nasync function handleGetRoles(\n\treq: IncomingMessage,\n\tres: ServerResponse,\n\tcors: Record<string, string>,\n): Promise<void> {\n\tconst auth = await authenticateJWT(req);\n\tif (!auth) {\n\t\tsendJson(res, 401, { error: \"Unauthorized\" }, cors, req);\n\t\treturn;\n\t}\n\n\tconst db = getDb();\n\tconst orgRoles = await db.query.roles.findMany({\n\t\twhere: eq(roles.isSystem, true),\n\t});\n\n\tsendJson(res, 200, { roles: orgRoles }, cors, req);\n}\n\n// ============================================================================\n// INITIALIZE ENTERPRISE FEATURES\n// ============================================================================\n\nexport async function initializeEnterpriseFeatures(): Promise<void> {\n\ttry {\n\t\tlogger.info(\"Initializing enterprise features...\");\n\n\t\t// Seed default permissions and roles\n\t\tawait seedPermissions();\n\n\t\tlogger.info(\"Enterprise features initialized successfully\");\n\t} catch (error) {\n\t\tlogger.error(\n\t\t\t\"Failed to initialize enterprise features\",\n\t\t\terror instanceof Error ? error : undefined,\n\t\t);\n\t\tthrow error;\n\t}\n}\n\n// ============================================================================\n// ROUTE EXPORTS\n// ============================================================================\n\nexport function createEnterpriseRoutes(cors: Record<string, string>): Route[] {\n\treturn [\n\t\t// Authentication\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/register\",\n\t\t\thandler: (req, res) => handleRegister(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/auth/login\",\n\t\t\thandler: (req, res) => handleLogin(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/auth/me\",\n\t\t\thandler: (req, res) => handleMe(req, res, cors),\n\t\t},\n\n\t\t// Usage & Quotas\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/quota\",\n\t\t\thandler: (req, res) => handleUsageQuota(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/usage/org\",\n\t\t\thandler: (req, res) => handleOrgUsage(req, res, cors),\n\t\t},\n\n\t\t// Audit Logs\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/audit/logs\",\n\t\t\thandler: (req, res) => handleAuditLogs(req, res, cors),\n\t\t},\n\n\t\t// Alerts\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/alerts\",\n\t\t\thandler: (req, res) => handleAlerts(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/read\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleMarkAlertRead(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/alerts/:alertId/resolve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleResolveAlert(req, res, cors, params?.alertId || \"\"),\n\t\t},\n\n\t\t// Organization Members\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/members\",\n\t\t\thandler: (req, res) => handleGetOrgMembers(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/org/members/invite\",\n\t\t\thandler: (req, res) => handleInviteUser(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/role\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberRole(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/members/:userId/quota\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleUpdateMemberQuota(req, res, cors, params?.userId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/org/members/:userId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleRemoveMember(req, res, cors, params?.userId || \"\"),\n\t\t},\n\n\t\t// Organization Settings\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleGetOrgSettings(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/org/settings\",\n\t\t\thandler: (req, res) => handleUpdateOrgSettings(req, res, cors),\n\t\t},\n\n\t\t// User Settings (self-scoped to the authenticated user)\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/user/settings\",\n\t\t\thandler: (req, res) => handleGetUserSettings(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"PUT\",\n\t\t\tpath: \"/api/user/settings\",\n\t\t\thandler: (req, res) => handleUpdateUserSettings(req, res, cors),\n\t\t},\n\n\t\t// Roles\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/roles\",\n\t\t\thandler: (req, res) => handleGetRoles(req, res, cors),\n\t\t},\n\n\t\t// Model Approvals\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/models/approvals\",\n\t\t\thandler: (req, res) => handleGetModelApprovals(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/approve\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleApproveModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/models/approvals/:modelId/deny\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDenyModel(req, res, cors, params?.modelId || \"\"),\n\t\t},\n\n\t\t// Directory Access Rules\n\t\t{\n\t\t\tmethod: \"GET\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleGetDirectoryRules(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\tpath: \"/api/directory-rules\",\n\t\t\thandler: (req, res) => handleCreateDirectoryRule(req, res, cors),\n\t\t},\n\t\t{\n\t\t\tmethod: \"DELETE\",\n\t\t\tpath: \"/api/directory-rules/:ruleId\",\n\t\t\thandler: (req, res, params) =>\n\t\t\t\thandleDeleteDirectoryRule(req, res, cors, params?.ruleId || \"\"),\n\t\t},\n\t];\n}\n"]}