@evalops/maestro 0.10.50 → 0.10.53

package/dist/node_modules/@evalops/contracts/dist/token-estimation.js

@@ -0,0 +1,86 @@
+/**
+ * @fileoverview Token estimation — single source of truth (TypeScript).
+ *
+ * Every TS surface that reasons about context-window usage (compaction gates,
+ * preflight overflow checks, context optimizers, repo maps, prompt-cache
+ * accounting, and every client renderer) MUST import from here instead of
+ * re-implementing the bytes/4 heuristic.
+ *
+ * ## Cross-language parity
+ *
+ * The constants and formulas mirror the Rust implementation in
+ * `packages/tui-rs/src/agent/token_estimation.rs` so that token budgets
+ * computed on the native side and the TS side agree. The design follows the
+ * same single-source-of-truth discipline as xai-org/grok-build's
+ * `xai-token-estimation` crate.
+ *
+ * @example
+ * ```typescript
+ * import { estimateTokens, usagePercentage } from "@evalops/contracts";
+ *
+ * const used = estimateTokens(prompt);
+ * const pct = usagePercentage(used, 200_000);
+ * ```
+ */
+/** Bytes per token under the rough character-based heuristic. */
+export const BYTES_PER_TOKEN = 4;
+/**
+ * Per-image approximate token cost when summing low-resolution image patches.
+ * Matches the Rust constant and the grok-build default.
+ */
+export const IMAGE_TOKEN_ESTIMATE = 765;
+/**
+ * Estimate the token count of a string using the shared bytes/4 heuristic.
+ *
+ * Empty input is `0`; any non-empty input is at least `1` token.
+ */
+export function estimateTokens(text) {
+    if (text.length === 0) {
+        return 0;
+    }
+    return Math.max(1, Math.ceil(text.length / BYTES_PER_TOKEN));
+}
+/**
+ * Estimate the token count of a value by serializing it to JSON first.
+ * Returns `0` if the value cannot be serialized.
+ */
+export function estimateTokensFromJson(value) {
+    let json;
+    try {
+        json = JSON.stringify(value);
+    }
+    catch {
+        return 0;
+    }
+    return estimateTokens(json);
+}
+/**
+ * Inverse of {@link estimateTokens}: convert a token budget into a character
+ * budget. Used by callers that size text passages against a model's context
+ * window.
+ */
+export function estimateChars(tokens) {
+    return Math.max(0, tokens * BYTES_PER_TOKEN);
+}
+/** Token estimate for `imageCount` images at {@link IMAGE_TOKEN_ESTIMATE} each. */
+export function estimateImageTokens(imageCount) {
+    return Math.max(0, imageCount) * IMAGE_TOKEN_ESTIMATE;
+}
+/**
+ * Usage percentage of a context window, clamped to `[0, 100]`.
+ * Returns `0` when capacity is non-positive.
+ */
+export function usagePercentage(used, capacity) {
+    if (capacity <= 0) {
+        return 0;
+    }
+    const pct = (used / capacity) * 100;
+    if (pct < 0) {
+        return 0;
+    }
+    if (pct > 100) {
+        return 100;
+    }
+    return pct;
+}
+//# sourceMappingURL=token-estimation.js.map

package/dist/node_modules/@evalops/contracts/dist/token-estimation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"token-estimation.js","sourceRoot":"","sources":["../src/token-estimation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,iEAAiE;AACjE,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,CAAC;AAEjC;;;GAGG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG,GAAG,CAAC;AAExC;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY;IAC1C,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc;IACpD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACJ,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACR,OAAO,CAAC,CAAC;IACV,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,MAAc;IAC3C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,GAAG,eAAe,CAAC,CAAC;AAC9C,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,mBAAmB,CAAC,UAAkB;IACrD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,UAAU,CAAC,GAAG,oBAAoB,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,QAAgB;IAC7D,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QACnB,OAAO,CAAC,CAAC;IACV,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC,GAAG,GAAG,CAAC;IACpC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;QACb,OAAO,CAAC,CAAC;IACV,CAAC;IACD,IAAI,GAAG,GAAG,GAAG,EAAE,CAAC;QACf,OAAO,GAAG,CAAC;IACZ,CAAC;IACD,OAAO,GAAG,CAAC;AACZ,CAAC","sourcesContent":["/**\n * @fileoverview Token estimation — single source of truth (TypeScript).\n *\n * Every TS surface that reasons about context-window usage (compaction gates,\n * preflight overflow checks, context optimizers, repo maps, prompt-cache\n * accounting, and every client renderer) MUST import from here instead of\n * re-implementing the bytes/4 heuristic.\n *\n * ## Cross-language parity\n *\n * The constants and formulas mirror the Rust implementation in\n * `packages/tui-rs/src/agent/token_estimation.rs` so that token budgets\n * computed on the native side and the TS side agree. The design follows the\n * same single-source-of-truth discipline as xai-org/grok-build's\n * `xai-token-estimation` crate.\n *\n * @example\n * ```typescript\n * import { estimateTokens, usagePercentage } from \"@evalops/contracts\";\n *\n * const used = estimateTokens(prompt);\n * const pct = usagePercentage(used, 200_000);\n * ```\n */\n\n/** Bytes per token under the rough character-based heuristic. */\nexport const BYTES_PER_TOKEN = 4;\n\n/**\n * Per-image approximate token cost when summing low-resolution image patches.\n * Matches the Rust constant and the grok-build default.\n */\nexport const IMAGE_TOKEN_ESTIMATE = 765;\n\n/**\n * Estimate the token count of a string using the shared bytes/4 heuristic.\n *\n * Empty input is `0`; any non-empty input is at least `1` token.\n */\nexport function estimateTokens(text: string): number {\n\tif (text.length === 0) {\n\t\treturn 0;\n\t}\n\treturn Math.max(1, Math.ceil(text.length / BYTES_PER_TOKEN));\n}\n\n/**\n * Estimate the token count of a value by serializing it to JSON first.\n * Returns `0` if the value cannot be serialized.\n */\nexport function estimateTokensFromJson(value: unknown): number {\n\tlet json: string;\n\ttry {\n\t\tjson = JSON.stringify(value);\n\t} catch {\n\t\treturn 0;\n\t}\n\treturn estimateTokens(json);\n}\n\n/**\n * Inverse of {@link estimateTokens}: convert a token budget into a character\n * budget. Used by callers that size text passages against a model's context\n * window.\n */\nexport function estimateChars(tokens: number): number {\n\treturn Math.max(0, tokens * BYTES_PER_TOKEN);\n}\n\n/** Token estimate for `imageCount` images at {@link IMAGE_TOKEN_ESTIMATE} each. */\nexport function estimateImageTokens(imageCount: number): number {\n\treturn Math.max(0, imageCount) * IMAGE_TOKEN_ESTIMATE;\n}\n\n/**\n * Usage percentage of a context window, clamped to `[0, 100]`.\n * Returns `0` when capacity is non-positive.\n */\nexport function usagePercentage(used: number, capacity: number): number {\n\tif (capacity <= 0) {\n\t\treturn 0;\n\t}\n\tconst pct = (used / capacity) * 100;\n\tif (pct < 0) {\n\t\treturn 0;\n\t}\n\tif (pct > 100) {\n\t\treturn 100;\n\t}\n\treturn pct;\n}\n"]}

package/dist/node_modules/@evalops/contracts/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "@evalops/contracts",
-	"version": "0.10.50",
+	"version": "0.10.53",
 	"description": "Shared Maestro contracts for frontend/backend integration",
 	"type": "module",
 	"main": "./dist/index.js",

package/dist/oauth/connectors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connectors.d.ts","sourceRoot":"","sources":["../../src/oauth/connectors.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EACN,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AAEtB,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;AAqBzE,eAAO,MAAM,+BAA+B,6DAMlC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACrC,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElD,MAAM,WAAW,8CAA8C;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0CAA0C;IAC1D,QAAQ,EAAE,sBAAsB,CAAC;IACjC,IAAI,EAAE,0BAA0B,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AA6BD,wBAAgB,mCAAmC,CAClD,IAAI,EAAE,MAAM,GACV,0BAA0B,GAAG,IAAI,CAgBnC;AAyID,wBAAsB,2BAA2B,CAChD,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,gBAAgB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAgC3B;AAED,wBAAsB,iCAAiC,CACtD,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,yCAAyC,CAC9D,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,8CAA8C,GACnD,OAAO,CAAC,0CAA0C,CAAC,CAwDrD;AAED,wBAAgB,qCAAqC,CACpD,QAAQ,EAAE,MAAM,GACd,OAAO,CAuBT;AAED,wBAAsB,6BAA6B,CAClD,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,gBAAgB,GAAG,IAAI,GAClC,OAAO,CAAC,IAAI,CAAC,CAYf"}
+{"version":3,"file":"connectors.d.ts","sourceRoot":"","sources":["../../src/oauth/connectors.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,MAAM,YAAY,CAAC;AAC9E,OAAO,EACN,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AAEtB,KAAK,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,EAAE,SAAS,CAAC,CAAC;AAqBzE,eAAO,MAAM,+BAA+B,6DAMlC,CAAC;AAEX,MAAM,MAAM,0BAA0B,GACrC,CAAC,OAAO,+BAA+B,CAAC,CAAC,MAAM,CAAC,CAAC;AAElD,MAAM,WAAW,8CAA8C;IAC9D,IAAI,EAAE,MAAM,CAAC;IACb,oBAAoB,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,0CAA0C;IAC1D,QAAQ,EAAE,sBAAsB,CAAC;IACjC,IAAI,EAAE,0BAA0B,CAAC;IACjC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,WAAW,CAAC,EAAE,MAAM,CAAC;CACrB;AA6BD,wBAAgB,mCAAmC,CAClD,IAAI,EAAE,MAAM,GACV,0BAA0B,GAAG,IAAI,CAgBnC;AAqID,wBAAsB,2BAA2B,CAChD,QAAQ,EAAE,sBAAsB,EAChC,WAAW,EAAE,gBAAgB,GAC3B,OAAO,CAAC,gBAAgB,CAAC,CAgC3B;AAED,wBAAsB,iCAAiC,CACtD,QAAQ,EAAE,sBAAsB,GAC9B,OAAO,CAAC,IAAI,CAAC,CAYf;AAED,wBAAsB,yCAAyC,CAC9D,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,8CAA8C,GACnD,OAAO,CAAC,0CAA0C,CAAC,CAwDrD;AAED,wBAAgB,qCAAqC,CACpD,QAAQ,EAAE,MAAM,GACd,OAAO,CAuBT;AAED,wBAAsB,6BAA6B,CAClD,QAAQ,EAAE,mBAAmB,EAC7B,WAAW,EAAE,gBAAgB,GAAG,IAAI,GAClC,OAAO,CAAC,IAAI,CAAC,CAYf"}

package/dist/oauth/connectors.js

@@ -1,4 +1,5 @@
 import { refreshRemoteConnection, registerRemoteConnection, revokeRemoteConnection, setRemoteSourceOfTruthPolicy, } from "../connectors/service-client.js";
+import { isRecord } from "../utils/json.js";
 import { loadOAuthCredentials, saveOAuthCredentials, } from "./storage.js";
 const CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER = {
     "github-copilot": "github",
@@ -54,9 +55,6 @@ export function normalizeConnectorSourceOfTruthArea(area) {
     }
     return null;
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function getMetadataString(metadata, key) {
     const value = metadata?.[key];
     return typeof value === "string" && value.trim().length > 0

package/dist/oauth/connectors.js.map

@@ -1 +1 @@
-{"version":3,"file":"connectors.js","sourceRoot":"","sources":["../../src/oauth/connectors.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,4BAA4B,GAC5B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAItB,MAAM,oCAAoC,GAGtC;IACH,gBAAgB,EAAE,QAAQ;IAC1B,oBAAoB,EAAE,QAAQ;IAC9B,mBAAmB,EAAE,QAAQ;IAC7B,MAAM,EAAE,kBAAkB;IAC1B,cAAc,EAAE,kBAAkB;CAClC,CAAC;AAEF,MAAM,8BAA8B,GAA2C;IAC9E,gBAAgB,EAAE,sBAAsB;IACxC,oBAAoB,EAAE,0BAA0B;IAChD,mBAAmB,EAAE,yBAAyB;IAC9C,MAAM,EAAE,cAAc;IACtB,cAAc,EAAE,oBAAoB;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC9C,WAAW;IACX,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;CACA,CAAC;AAmBX,MAAM,6BAA6B,GAAG;IACrC,4BAA4B;IAC5B,4CAA4C;IAC5C,2CAA2C;IAC3C,mCAAmC;IACnC,mBAAmB;IACnB,mCAAmC;CAC1B,CAAC;AAEX,SAAS,wBAAwB,CAChC,QAAgB;IAEhB,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAC1C,oCAAoC,EACpC,QAAQ,CACR,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAClD,IAAY;IAEZ,MAAM,UAAU,GAAG,IAAI;SACrB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;SACtC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;SACtC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,SAAS,IAAI,+BAA+B,EAAE,CAAC;QACzD,IACC,SAAS,KAAK,UAAU;YACxB,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,UAAU,EAC5C,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAC5B,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,GAAG,CACH,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B;QACC,QAAQ,CAAC,IAAI,EAAE;QACf,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KAC9C,CACX;SACA,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAS,uBAAuB,CAC/B,WAA6B,EAC7B,UAA4C,EAC5C,UAAkB;IAElB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,QAAQ,EAAE;YACT,GAAG,WAAW,CAAC,QAAQ;YACvB,qBAAqB,EAAE,UAAU,CAAC,EAAE;YACpC,qBAAqB,EAAE,UAAU,CAAC,YAAY;YAC9C,mBAAmB,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU;YACxD,kBAAkB,EAAE,UAAU,CAAC,SAAS;YACxC,oBAAoB,EAAE,UAAU,CAAC,WAAW;SAC5C;KACD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC5B,QAA6C;IAE7C,OAAO,CACN,iBAAiB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;QACzD,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAChD,CAAC;AACH,CAAC;AAED,SAAS,oCAAoC,CAC5C,QAA6C;IAE7C,OAAO,CACN,iBAAiB,CAAC,QAAQ,EAAE,4CAA4C,CAAC;QACzE,iBAAiB,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAChE,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACxC,WAA6B,EAC7B,MAAwC;IAExC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,QAAQ,EAAE;YACT,GAAG,WAAW,CAAC,QAAQ;YACvB,0BAA0B,EAAE,MAAM,CAAC,IAAI;YACvC,yCAAyC,EAAE,MAAM,CAAC,mBAAmB;YACrE,iCAAiC,EAAE,MAAM,CAAC,WAAW;YACrD,GAAG,CAAC,MAAM,CAAC,oBAAoB;gBAC9B,CAAC,CAAC;oBACA,0CAA0C,EACzC,MAAM,CAAC,oBAAoB;iBAC5B;gBACF,CAAC,CAAC,EAAE,CAAC;SACN;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,WAA6B,EAC7B,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QACjD,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,IAAI;QACJ,mBAAmB,EAAE,UAAU,CAAC,EAAE;QAClC,oBAAoB,EAAE,oCAAoC,CACzD,WAAW,CAAC,QAAQ,CACpB;KACD,CAAC,CAAC;IACH,OAAO,gCAAgC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,QAAgC,EAChC,WAA6B;IAE7B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GAAG,oCAAoC,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,iBAAiB,CACrC,WAAW,CAAC,QAAQ,EACpB,uBAAuB,CACvB,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAC/D,OAAO,uBAAuB,CAC7B,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,UAAU,CACV,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QACjD,UAAU;QACV,WAAW,EAAE,8BAA8B,CAAC,QAAQ,CAAC;QACrD,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,sBAAsB,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC9D,WAAW,EAAE,oBAAoB,CAChC,WAAW,CAAC,QAAQ,EACpB,yBAAyB,CACzB;KACD,CAAC,CAAC;IACH,OAAO,uBAAuB,CAC7B,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,UAAU,CACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,QAAgC;IAEhC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;IACR,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC5B,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC9D,QAAgB,EAChB,KAAqD;IAErD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,yCAAyC,QAAQ,0BAA0B,gCAAgC,EAAE,EAAE,CAC/G,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,mCAAmC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACd,qCAAqC,KAAK,CAAC,IAAI,kBAAkB,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACtE,QAAQ,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAC3C,OAAO,QAAQ,CAAC,iBAAiB,CAAC;IAClC,OAAO,QAAQ,CAAC,iCAAiC,CAAC;IAClD,OAAO,QAAQ,CAAC,yCAAyC,CAAC;IAC1D,OAAO,QAAQ,CAAC,iCAAiC,CAAC;IAElD,MAAM,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,oBAAoB,EAAE,CAAC;QAC1B,QAAQ,CAAC,0CAA0C,GAAG,oBAAoB,CAAC;IAC5E,CAAC;SAAM,CAAC;QACP,OAAO,QAAQ,CAAC,0CAA0C,CAAC;IAC5D,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,MAAM,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAElD,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC7C,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,cAAc,EACd,uBAAuB,CACvB,CAAC;IACF,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,cAAc,EACd,2CAA2C,CAC3C,CAAC;IACF,MAAM,WAAW,GAAG,iBAAiB,CACpC,cAAc,EACd,mCAAmC,CACnC,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACpD,QAAgB;IAEhB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,yCAAyC,QAAQ,0BAA0B,gCAAgC,EAAE,EAAE,CAC/G,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACtE,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,IAAI,CAC3D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CACxB,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,QAA6B,EAC7B,WAAoC;IAEpC,MAAM,YAAY,GAAG,iBAAiB,CACrC,WAAW,EAAE,QAAQ,EACrB,uBAAuB,CACvB,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO;IACR,CAAC;IACD,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import {\n\ttype RemoteConnectorConnection,\n\ttype RemoteSourceOfTruthPolicy,\n\trefreshRemoteConnection,\n\tregisterRemoteConnection,\n\trevokeRemoteConnection,\n\tsetRemoteSourceOfTruthPolicy,\n} from \"../connectors/service-client.js\";\nimport type { OAuthLogoutProvider, SupportedOAuthProvider } from \"./index.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\ntype ConnectorOAuthProvider = Exclude<SupportedOAuthProvider, \"evalops\">;\n\nconst CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER: Record<\n\tConnectorOAuthProvider,\n\tstring\n> = {\n\t\"github-copilot\": \"github\",\n\t\"google-antigravity\": \"google\",\n\t\"google-gemini-cli\": \"google\",\n\topenai: \"x-evalops:openai\",\n\t\"openai-codex\": \"x-evalops:openai\",\n};\n\nconst DISPLAY_NAME_BY_OAUTH_PROVIDER: Record<ConnectorOAuthProvider, string> = {\n\t\"github-copilot\": \"GitHub Copilot OAuth\",\n\t\"google-antigravity\": \"Google Antigravity OAuth\",\n\t\"google-gemini-cli\": \"Google Gemini CLI OAuth\",\n\topenai: \"OpenAI OAuth\",\n\t\"openai-codex\": \"OpenAI Codex OAuth\",\n};\n\nexport const CONNECTOR_SOURCE_OF_TRUTH_AREAS = [\n\t\"analytics\",\n\t\"billing\",\n\t\"crm\",\n\t\"hris\",\n\t\"support\",\n] as const;\n\nexport type ConnectorSourceOfTruthArea =\n\t(typeof CONNECTOR_SOURCE_OF_TRUTH_AREAS)[number];\n\nexport interface ConfigureOAuthProviderSourceOfTruthPolicyInput {\n\tarea: string;\n\tfallbackConnectionId?: string;\n}\n\nexport interface ConfiguredOAuthProviderSourceOfTruthPolicy {\n\tprovider: ConnectorOAuthProvider;\n\tarea: ConnectorSourceOfTruthArea;\n\tfallbackConnectionId?: string;\n\tconnectorConnectionId?: string;\n\tprimaryConnectionId?: string;\n\tworkspaceId?: string;\n}\n\nconst SOURCE_OF_TRUTH_METADATA_KEYS = [\n\t\"connectorSourceOfTruthArea\",\n\t\"connectorSourceOfTruthFallbackConnectionId\",\n\t\"connectorSourceOfTruthPrimaryConnectionId\",\n\t\"connectorSourceOfTruthWorkspaceId\",\n\t\"sourceOfTruthArea\",\n\t\"sourceOfTruthFallbackConnectionId\",\n] as const;\n\nfunction isConnectorOAuthProvider(\n\tprovider: string,\n): provider is ConnectorOAuthProvider {\n\treturn Object.prototype.hasOwnProperty.call(\n\t\tCONNECTOR_PROVIDER_BY_OAUTH_PROVIDER,\n\t\tprovider,\n\t);\n}\n\nfunction supportedConnectorOAuthProviders(): string {\n\treturn Object.keys(CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER).sort().join(\", \");\n}\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nexport function normalizeConnectorSourceOfTruthArea(\n\tarea: string,\n): ConnectorSourceOfTruthArea | null {\n\tconst normalized = area\n\t\t.trim()\n\t\t.toLowerCase()\n\t\t.replace(/^source_of_truth_area_/u, \"\")\n\t\t.replace(/^source-of-truth-area-/u, \"\")\n\t\t.replaceAll(\"_\", \"-\");\n\tfor (const candidate of CONNECTOR_SOURCE_OF_TRUTH_AREAS) {\n\t\tif (\n\t\t\tcandidate === normalized ||\n\t\t\tcandidate.replaceAll(\"_\", \"-\") === normalized\n\t\t) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction getMetadataStringArray(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string[] | undefined {\n\tconst value = metadata?.[key];\n\tif (!Array.isArray(value)) {\n\t\treturn undefined;\n\t}\n\tconst entries = value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n\treturn entries.length > 0 ? entries : undefined;\n}\n\nfunction getMetadataStringMap(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): Record<string, string> | undefined {\n\tconst value = metadata?.[key];\n\tif (!isRecord(value)) {\n\t\treturn undefined;\n\t}\n\tconst entries = Object.entries(value)\n\t\t.map(\n\t\t\t([entryKey, entryValue]) =>\n\t\t\t\t[\n\t\t\t\t\tentryKey.trim(),\n\t\t\t\t\ttypeof entryValue === \"string\" ? entryValue.trim() : \"\",\n\t\t\t\t] as const,\n\t\t)\n\t\t.filter(([entryKey, entryValue]) => entryKey && entryValue);\n\treturn entries.length > 0 ? Object.fromEntries(entries) : undefined;\n}\n\nfunction mergeConnectionMetadata(\n\tcredentials: OAuthCredentials,\n\tconnection: RemoteConnectorConnection | null,\n\tproviderId: string,\n): OAuthCredentials {\n\tif (!connection) {\n\t\treturn credentials;\n\t}\n\treturn {\n\t\t...credentials,\n\t\tmetadata: {\n\t\t\t...credentials.metadata,\n\t\t\tconnectorConnectionId: connection.id,\n\t\t\tconnectorHealthStatus: connection.healthStatus,\n\t\t\tconnectorProviderId: connection.providerId || providerId,\n\t\t\tconnectorUpdatedAt: connection.updatedAt,\n\t\t\tconnectorWorkspaceId: connection.workspaceId,\n\t\t},\n\t};\n}\n\nfunction getSourceOfTruthArea(\n\tmetadata: Record<string, unknown> | undefined,\n): string | undefined {\n\treturn (\n\t\tgetMetadataString(metadata, \"connectorSourceOfTruthArea\") ??\n\t\tgetMetadataString(metadata, \"sourceOfTruthArea\")\n\t);\n}\n\nfunction getSourceOfTruthFallbackConnectionId(\n\tmetadata: Record<string, unknown> | undefined,\n): string | undefined {\n\treturn (\n\t\tgetMetadataString(metadata, \"connectorSourceOfTruthFallbackConnectionId\") ??\n\t\tgetMetadataString(metadata, \"sourceOfTruthFallbackConnectionId\")\n\t);\n}\n\nfunction mergeSourceOfTruthPolicyMetadata(\n\tcredentials: OAuthCredentials,\n\tpolicy: RemoteSourceOfTruthPolicy | null,\n): OAuthCredentials {\n\tif (!policy) {\n\t\treturn credentials;\n\t}\n\treturn {\n\t\t...credentials,\n\t\tmetadata: {\n\t\t\t...credentials.metadata,\n\t\t\tconnectorSourceOfTruthArea: policy.area,\n\t\t\tconnectorSourceOfTruthPrimaryConnectionId: policy.primaryConnectionId,\n\t\t\tconnectorSourceOfTruthWorkspaceId: policy.workspaceId,\n\t\t\t...(policy.fallbackConnectionId\n\t\t\t\t? {\n\t\t\t\t\t\tconnectorSourceOfTruthFallbackConnectionId:\n\t\t\t\t\t\t\tpolicy.fallbackConnectionId,\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t},\n\t};\n}\n\nasync function syncSourceOfTruthPolicy(\n\tcredentials: OAuthCredentials,\n\tconnection: RemoteConnectorConnection | null,\n): Promise<OAuthCredentials> {\n\tif (!connection) {\n\t\treturn credentials;\n\t}\n\tconst area = getSourceOfTruthArea(credentials.metadata);\n\tif (!area) {\n\t\treturn credentials;\n\t}\n\n\tconst policy = await setRemoteSourceOfTruthPolicy({\n\t\tworkspaceId: connection.workspaceId,\n\t\tarea,\n\t\tprimaryConnectionId: connection.id,\n\t\tfallbackConnectionId: getSourceOfTruthFallbackConnectionId(\n\t\t\tcredentials.metadata,\n\t\t),\n\t});\n\treturn mergeSourceOfTruthPolicyMetadata(credentials, policy);\n}\n\nexport async function syncOAuthProviderConnection(\n\tprovider: SupportedOAuthProvider,\n\tcredentials: OAuthCredentials,\n): Promise<OAuthCredentials> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\treturn credentials;\n\t}\n\n\tconst providerId = CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER[provider];\n\tconst connectionId = getMetadataString(\n\t\tcredentials.metadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tif (connectionId) {\n\t\tconst connection = await refreshRemoteConnection(connectionId);\n\t\treturn syncSourceOfTruthPolicy(\n\t\t\tmergeConnectionMetadata(credentials, connection, providerId),\n\t\t\tconnection,\n\t\t);\n\t}\n\n\tconst connection = await registerRemoteConnection({\n\t\tproviderId,\n\t\tdisplayName: DISPLAY_NAME_BY_OAUTH_PROVIDER[provider],\n\t\tauthType: \"AUTH_TYPE_OAUTH2\",\n\t\tscopes: getMetadataStringArray(credentials.metadata, \"scopes\"),\n\t\tcredentials: getMetadataStringMap(\n\t\t\tcredentials.metadata,\n\t\t\t\"connectorCredentialRefs\",\n\t\t),\n\t});\n\treturn syncSourceOfTruthPolicy(\n\t\tmergeConnectionMetadata(credentials, connection, providerId),\n\t\tconnection,\n\t);\n}\n\nexport async function syncStoredOAuthProviderConnection(\n\tprovider: SupportedOAuthProvider,\n): Promise<void> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\treturn;\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\treturn;\n\t}\n\tconst synced = await syncOAuthProviderConnection(provider, credentials);\n\tif (synced !== credentials) {\n\t\tsaveOAuthCredentials(provider, synced);\n\t}\n}\n\nexport async function configureOAuthProviderSourceOfTruthPolicy(\n\tprovider: string,\n\tinput: ConfigureOAuthProviderSourceOfTruthPolicyInput,\n): Promise<ConfiguredOAuthProviderSourceOfTruthPolicy> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`,\n\t\t);\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\tconst area = normalizeConnectorSourceOfTruthArea(input.area);\n\tif (!area) {\n\t\tthrow new Error(\n\t\t\t`Unsupported source-of-truth area: ${input.area}. Valid areas: ${CONNECTOR_SOURCE_OF_TRUTH_AREAS.join(\", \")}`,\n\t\t);\n\t}\n\n\tconst metadata: Record<string, unknown> = { ...credentials.metadata };\n\tmetadata.connectorSourceOfTruthArea = area;\n\tdelete metadata.sourceOfTruthArea;\n\tdelete metadata.sourceOfTruthFallbackConnectionId;\n\tdelete metadata.connectorSourceOfTruthPrimaryConnectionId;\n\tdelete metadata.connectorSourceOfTruthWorkspaceId;\n\n\tconst fallbackConnectionId = trimString(input.fallbackConnectionId);\n\tif (fallbackConnectionId) {\n\t\tmetadata.connectorSourceOfTruthFallbackConnectionId = fallbackConnectionId;\n\t} else {\n\t\tdelete metadata.connectorSourceOfTruthFallbackConnectionId;\n\t}\n\n\tsaveOAuthCredentials(provider, { ...credentials, metadata });\n\tawait syncStoredOAuthProviderConnection(provider);\n\n\tconst synced = loadOAuthCredentials(provider) ?? { ...credentials, metadata };\n\tconst syncedMetadata = synced.metadata ?? {};\n\tconst connectorConnectionId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tconst primaryConnectionId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorSourceOfTruthPrimaryConnectionId\",\n\t);\n\tconst workspaceId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorSourceOfTruthWorkspaceId\",\n\t);\n\treturn {\n\t\tprovider,\n\t\tarea,\n\t\t...(fallbackConnectionId ? { fallbackConnectionId } : {}),\n\t\t...(connectorConnectionId ? { connectorConnectionId } : {}),\n\t\t...(primaryConnectionId ? { primaryConnectionId } : {}),\n\t\t...(workspaceId ? { workspaceId } : {}),\n\t};\n}\n\nexport function clearOAuthProviderSourceOfTruthPolicy(\n\tprovider: string,\n): boolean {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`,\n\t\t);\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\n\tconst metadata: Record<string, unknown> = { ...credentials.metadata };\n\tconst hadPolicyMetadata = SOURCE_OF_TRUTH_METADATA_KEYS.some(\n\t\t(key) => key in metadata,\n\t);\n\tif (!hadPolicyMetadata) {\n\t\treturn false;\n\t}\n\tfor (const key of SOURCE_OF_TRUTH_METADATA_KEYS) {\n\t\tdelete metadata[key];\n\t}\n\tsaveOAuthCredentials(provider, { ...credentials, metadata });\n\treturn hadPolicyMetadata;\n}\n\nexport async function revokeOAuthProviderConnection(\n\tprovider: OAuthLogoutProvider,\n\tcredentials: OAuthCredentials | null,\n): Promise<void> {\n\tconst connectionId = getMetadataString(\n\t\tcredentials?.metadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tif (!connectionId) {\n\t\treturn;\n\t}\n\tif (!isConnectorOAuthProvider(provider) && provider !== \"anthropic\") {\n\t\treturn;\n\t}\n\tawait revokeRemoteConnection(connectionId);\n}\n"]}
+{"version":3,"file":"connectors.js","sourceRoot":"","sources":["../../src/oauth/connectors.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,uBAAuB,EACvB,wBAAwB,EACxB,sBAAsB,EACtB,4BAA4B,GAC5B,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAItB,MAAM,oCAAoC,GAGtC;IACH,gBAAgB,EAAE,QAAQ;IAC1B,oBAAoB,EAAE,QAAQ;IAC9B,mBAAmB,EAAE,QAAQ;IAC7B,MAAM,EAAE,kBAAkB;IAC1B,cAAc,EAAE,kBAAkB;CAClC,CAAC;AAEF,MAAM,8BAA8B,GAA2C;IAC9E,gBAAgB,EAAE,sBAAsB;IACxC,oBAAoB,EAAE,0BAA0B;IAChD,mBAAmB,EAAE,yBAAyB;IAC9C,MAAM,EAAE,cAAc;IACtB,cAAc,EAAE,oBAAoB;CACpC,CAAC;AAEF,MAAM,CAAC,MAAM,+BAA+B,GAAG;IAC9C,WAAW;IACX,SAAS;IACT,KAAK;IACL,MAAM;IACN,SAAS;CACA,CAAC;AAmBX,MAAM,6BAA6B,GAAG;IACrC,4BAA4B;IAC5B,4CAA4C;IAC5C,2CAA2C;IAC3C,mCAAmC;IACnC,mBAAmB;IACnB,mCAAmC;CAC1B,CAAC;AAEX,SAAS,wBAAwB,CAChC,QAAgB;IAEhB,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAC1C,oCAAoC,EACpC,QAAQ,CACR,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC;IACxC,OAAO,MAAM,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5E,CAAC;AAED,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,mCAAmC,CAClD,IAAY;IAEZ,MAAM,UAAU,GAAG,IAAI;SACrB,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;SACtC,OAAO,CAAC,yBAAyB,EAAE,EAAE,CAAC;SACtC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACvB,KAAK,MAAM,SAAS,IAAI,+BAA+B,EAAE,CAAC;QACzD,IACC,SAAS,KAAK,UAAU;YACxB,SAAS,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,UAAU,EAC5C,CAAC;YACF,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE;QACd,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,sBAAsB,CAC9B,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,KAAK;SACnB,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACjD,CAAC;AAED,SAAS,oBAAoB,CAC5B,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC;SACnC,GAAG,CACH,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAC1B;QACC,QAAQ,CAAC,IAAI,EAAE;QACf,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE;KAC9C,CACX;SACA,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,UAAU,CAAC,CAAC;IAC7D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACrE,CAAC;AAED,SAAS,uBAAuB,CAC/B,WAA6B,EAC7B,UAA4C,EAC5C,UAAkB;IAElB,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,QAAQ,EAAE;YACT,GAAG,WAAW,CAAC,QAAQ;YACvB,qBAAqB,EAAE,UAAU,CAAC,EAAE;YACpC,qBAAqB,EAAE,UAAU,CAAC,YAAY;YAC9C,mBAAmB,EAAE,UAAU,CAAC,UAAU,IAAI,UAAU;YACxD,kBAAkB,EAAE,UAAU,CAAC,SAAS;YACxC,oBAAoB,EAAE,UAAU,CAAC,WAAW;SAC5C;KACD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC5B,QAA6C;IAE7C,OAAO,CACN,iBAAiB,CAAC,QAAQ,EAAE,4BAA4B,CAAC;QACzD,iBAAiB,CAAC,QAAQ,EAAE,mBAAmB,CAAC,CAChD,CAAC;AACH,CAAC;AAED,SAAS,oCAAoC,CAC5C,QAA6C;IAE7C,OAAO,CACN,iBAAiB,CAAC,QAAQ,EAAE,4CAA4C,CAAC;QACzE,iBAAiB,CAAC,QAAQ,EAAE,mCAAmC,CAAC,CAChE,CAAC;AACH,CAAC;AAED,SAAS,gCAAgC,CACxC,WAA6B,EAC7B,MAAwC;IAExC,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,OAAO;QACN,GAAG,WAAW;QACd,QAAQ,EAAE;YACT,GAAG,WAAW,CAAC,QAAQ;YACvB,0BAA0B,EAAE,MAAM,CAAC,IAAI;YACvC,yCAAyC,EAAE,MAAM,CAAC,mBAAmB;YACrE,iCAAiC,EAAE,MAAM,CAAC,WAAW;YACrD,GAAG,CAAC,MAAM,CAAC,oBAAoB;gBAC9B,CAAC,CAAC;oBACA,0CAA0C,EACzC,MAAM,CAAC,oBAAoB;iBAC5B;gBACF,CAAC,CAAC,EAAE,CAAC;SACN;KACD,CAAC;AACH,CAAC;AAED,KAAK,UAAU,uBAAuB,CACrC,WAA6B,EAC7B,UAA4C;IAE5C,IAAI,CAAC,UAAU,EAAE,CAAC;QACjB,OAAO,WAAW,CAAC;IACpB,CAAC;IACD,MAAM,IAAI,GAAG,oBAAoB,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IACxD,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC;QACjD,WAAW,EAAE,UAAU,CAAC,WAAW;QACnC,IAAI;QACJ,mBAAmB,EAAE,UAAU,CAAC,EAAE;QAClC,oBAAoB,EAAE,oCAAoC,CACzD,WAAW,CAAC,QAAQ,CACpB;KACD,CAAC,CAAC;IACH,OAAO,gCAAgC,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;AAC9D,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,QAAgC,EAChC,WAA6B;IAE7B,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO,WAAW,CAAC;IACpB,CAAC;IAED,MAAM,UAAU,GAAG,oCAAoC,CAAC,QAAQ,CAAC,CAAC;IAClE,MAAM,YAAY,GAAG,iBAAiB,CACrC,WAAW,CAAC,QAAQ,EACpB,uBAAuB,CACvB,CAAC;IACF,IAAI,YAAY,EAAE,CAAC;QAClB,MAAM,UAAU,GAAG,MAAM,uBAAuB,CAAC,YAAY,CAAC,CAAC;QAC/D,OAAO,uBAAuB,CAC7B,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,UAAU,CACV,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,wBAAwB,CAAC;QACjD,UAAU;QACV,WAAW,EAAE,8BAA8B,CAAC,QAAQ,CAAC;QACrD,QAAQ,EAAE,kBAAkB;QAC5B,MAAM,EAAE,sBAAsB,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC9D,WAAW,EAAE,oBAAoB,CAChC,WAAW,CAAC,QAAQ,EACpB,yBAAyB,CACzB;KACD,CAAC,CAAC;IACH,OAAO,uBAAuB,CAC7B,uBAAuB,CAAC,WAAW,EAAE,UAAU,EAAE,UAAU,CAAC,EAC5D,UAAU,CACV,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,iCAAiC,CACtD,QAAgC;IAEhC,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,OAAO;IACR,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO;IACR,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,2BAA2B,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACxE,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC5B,oBAAoB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,yCAAyC,CAC9D,QAAgB,EAChB,KAAqD;IAErD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,yCAAyC,QAAQ,0BAA0B,gCAAgC,EAAE,EAAE,CAC/G,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,MAAM,IAAI,GAAG,mCAAmC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,CAAC,IAAI,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACd,qCAAqC,KAAK,CAAC,IAAI,kBAAkB,+BAA+B,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC7G,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACtE,QAAQ,CAAC,0BAA0B,GAAG,IAAI,CAAC;IAC3C,OAAO,QAAQ,CAAC,iBAAiB,CAAC;IAClC,OAAO,QAAQ,CAAC,iCAAiC,CAAC;IAClD,OAAO,QAAQ,CAAC,yCAAyC,CAAC;IAC1D,OAAO,QAAQ,CAAC,iCAAiC,CAAC;IAElD,MAAM,oBAAoB,GAAG,UAAU,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;IACpE,IAAI,oBAAoB,EAAE,CAAC;QAC1B,QAAQ,CAAC,0CAA0C,GAAG,oBAAoB,CAAC;IAC5E,CAAC;SAAM,CAAC;QACP,OAAO,QAAQ,CAAC,0CAA0C,CAAC;IAC5D,CAAC;IAED,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,MAAM,iCAAiC,CAAC,QAAQ,CAAC,CAAC;IAElD,MAAM,MAAM,GAAG,oBAAoB,CAAC,QAAQ,CAAC,IAAI,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC;IAC9E,MAAM,cAAc,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IAC7C,MAAM,qBAAqB,GAAG,iBAAiB,CAC9C,cAAc,EACd,uBAAuB,CACvB,CAAC;IACF,MAAM,mBAAmB,GAAG,iBAAiB,CAC5C,cAAc,EACd,2CAA2C,CAC3C,CAAC;IACF,MAAM,WAAW,GAAG,iBAAiB,CACpC,cAAc,EACd,mCAAmC,CACnC,CAAC;IACF,OAAO;QACN,QAAQ;QACR,IAAI;QACJ,GAAG,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qCAAqC,CACpD,QAAgB;IAEhB,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,KAAK,CACd,yCAAyC,QAAQ,0BAA0B,gCAAgC,EAAE,EAAE,CAC/G,CAAC;IACH,CAAC;IACD,MAAM,WAAW,GAAG,oBAAoB,CAAC,QAAQ,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAC/D,CAAC;IAED,MAAM,QAAQ,GAA4B,EAAE,GAAG,WAAW,CAAC,QAAQ,EAAE,CAAC;IACtE,MAAM,iBAAiB,GAAG,6BAA6B,CAAC,IAAI,CAC3D,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,QAAQ,CACxB,CAAC;IACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACxB,OAAO,KAAK,CAAC;IACd,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,6BAA6B,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,oBAAoB,CAAC,QAAQ,EAAE,EAAE,GAAG,WAAW,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC7D,OAAO,iBAAiB,CAAC;AAC1B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,6BAA6B,CAClD,QAA6B,EAC7B,WAAoC;IAEpC,MAAM,YAAY,GAAG,iBAAiB,CACrC,WAAW,EAAE,QAAQ,EACrB,uBAAuB,CACvB,CAAC;IACF,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IACD,IAAI,CAAC,wBAAwB,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,WAAW,EAAE,CAAC;QACrE,OAAO;IACR,CAAC;IACD,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import {\n\ttype RemoteConnectorConnection,\n\ttype RemoteSourceOfTruthPolicy,\n\trefreshRemoteConnection,\n\tregisterRemoteConnection,\n\trevokeRemoteConnection,\n\tsetRemoteSourceOfTruthPolicy,\n} from \"../connectors/service-client.js\";\nimport { isRecord } from \"../utils/json.js\";\nimport type { OAuthLogoutProvider, SupportedOAuthProvider } from \"./index.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\ntype ConnectorOAuthProvider = Exclude<SupportedOAuthProvider, \"evalops\">;\n\nconst CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER: Record<\n\tConnectorOAuthProvider,\n\tstring\n> = {\n\t\"github-copilot\": \"github\",\n\t\"google-antigravity\": \"google\",\n\t\"google-gemini-cli\": \"google\",\n\topenai: \"x-evalops:openai\",\n\t\"openai-codex\": \"x-evalops:openai\",\n};\n\nconst DISPLAY_NAME_BY_OAUTH_PROVIDER: Record<ConnectorOAuthProvider, string> = {\n\t\"github-copilot\": \"GitHub Copilot OAuth\",\n\t\"google-antigravity\": \"Google Antigravity OAuth\",\n\t\"google-gemini-cli\": \"Google Gemini CLI OAuth\",\n\topenai: \"OpenAI OAuth\",\n\t\"openai-codex\": \"OpenAI Codex OAuth\",\n};\n\nexport const CONNECTOR_SOURCE_OF_TRUTH_AREAS = [\n\t\"analytics\",\n\t\"billing\",\n\t\"crm\",\n\t\"hris\",\n\t\"support\",\n] as const;\n\nexport type ConnectorSourceOfTruthArea =\n\t(typeof CONNECTOR_SOURCE_OF_TRUTH_AREAS)[number];\n\nexport interface ConfigureOAuthProviderSourceOfTruthPolicyInput {\n\tarea: string;\n\tfallbackConnectionId?: string;\n}\n\nexport interface ConfiguredOAuthProviderSourceOfTruthPolicy {\n\tprovider: ConnectorOAuthProvider;\n\tarea: ConnectorSourceOfTruthArea;\n\tfallbackConnectionId?: string;\n\tconnectorConnectionId?: string;\n\tprimaryConnectionId?: string;\n\tworkspaceId?: string;\n}\n\nconst SOURCE_OF_TRUTH_METADATA_KEYS = [\n\t\"connectorSourceOfTruthArea\",\n\t\"connectorSourceOfTruthFallbackConnectionId\",\n\t\"connectorSourceOfTruthPrimaryConnectionId\",\n\t\"connectorSourceOfTruthWorkspaceId\",\n\t\"sourceOfTruthArea\",\n\t\"sourceOfTruthFallbackConnectionId\",\n] as const;\n\nfunction isConnectorOAuthProvider(\n\tprovider: string,\n): provider is ConnectorOAuthProvider {\n\treturn Object.prototype.hasOwnProperty.call(\n\t\tCONNECTOR_PROVIDER_BY_OAUTH_PROVIDER,\n\t\tprovider,\n\t);\n}\n\nfunction supportedConnectorOAuthProviders(): string {\n\treturn Object.keys(CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER).sort().join(\", \");\n}\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nexport function normalizeConnectorSourceOfTruthArea(\n\tarea: string,\n): ConnectorSourceOfTruthArea | null {\n\tconst normalized = area\n\t\t.trim()\n\t\t.toLowerCase()\n\t\t.replace(/^source_of_truth_area_/u, \"\")\n\t\t.replace(/^source-of-truth-area-/u, \"\")\n\t\t.replaceAll(\"_\", \"-\");\n\tfor (const candidate of CONNECTOR_SOURCE_OF_TRUTH_AREAS) {\n\t\tif (\n\t\t\tcandidate === normalized ||\n\t\t\tcandidate.replaceAll(\"_\", \"-\") === normalized\n\t\t) {\n\t\t\treturn candidate;\n\t\t}\n\t}\n\treturn null;\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value.trim()\n\t\t: undefined;\n}\n\nfunction getMetadataStringArray(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string[] | undefined {\n\tconst value = metadata?.[key];\n\tif (!Array.isArray(value)) {\n\t\treturn undefined;\n\t}\n\tconst entries = value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n\treturn entries.length > 0 ? entries : undefined;\n}\n\nfunction getMetadataStringMap(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): Record<string, string> | undefined {\n\tconst value = metadata?.[key];\n\tif (!isRecord(value)) {\n\t\treturn undefined;\n\t}\n\tconst entries = Object.entries(value)\n\t\t.map(\n\t\t\t([entryKey, entryValue]) =>\n\t\t\t\t[\n\t\t\t\t\tentryKey.trim(),\n\t\t\t\t\ttypeof entryValue === \"string\" ? entryValue.trim() : \"\",\n\t\t\t\t] as const,\n\t\t)\n\t\t.filter(([entryKey, entryValue]) => entryKey && entryValue);\n\treturn entries.length > 0 ? Object.fromEntries(entries) : undefined;\n}\n\nfunction mergeConnectionMetadata(\n\tcredentials: OAuthCredentials,\n\tconnection: RemoteConnectorConnection | null,\n\tproviderId: string,\n): OAuthCredentials {\n\tif (!connection) {\n\t\treturn credentials;\n\t}\n\treturn {\n\t\t...credentials,\n\t\tmetadata: {\n\t\t\t...credentials.metadata,\n\t\t\tconnectorConnectionId: connection.id,\n\t\t\tconnectorHealthStatus: connection.healthStatus,\n\t\t\tconnectorProviderId: connection.providerId || providerId,\n\t\t\tconnectorUpdatedAt: connection.updatedAt,\n\t\t\tconnectorWorkspaceId: connection.workspaceId,\n\t\t},\n\t};\n}\n\nfunction getSourceOfTruthArea(\n\tmetadata: Record<string, unknown> | undefined,\n): string | undefined {\n\treturn (\n\t\tgetMetadataString(metadata, \"connectorSourceOfTruthArea\") ??\n\t\tgetMetadataString(metadata, \"sourceOfTruthArea\")\n\t);\n}\n\nfunction getSourceOfTruthFallbackConnectionId(\n\tmetadata: Record<string, unknown> | undefined,\n): string | undefined {\n\treturn (\n\t\tgetMetadataString(metadata, \"connectorSourceOfTruthFallbackConnectionId\") ??\n\t\tgetMetadataString(metadata, \"sourceOfTruthFallbackConnectionId\")\n\t);\n}\n\nfunction mergeSourceOfTruthPolicyMetadata(\n\tcredentials: OAuthCredentials,\n\tpolicy: RemoteSourceOfTruthPolicy | null,\n): OAuthCredentials {\n\tif (!policy) {\n\t\treturn credentials;\n\t}\n\treturn {\n\t\t...credentials,\n\t\tmetadata: {\n\t\t\t...credentials.metadata,\n\t\t\tconnectorSourceOfTruthArea: policy.area,\n\t\t\tconnectorSourceOfTruthPrimaryConnectionId: policy.primaryConnectionId,\n\t\t\tconnectorSourceOfTruthWorkspaceId: policy.workspaceId,\n\t\t\t...(policy.fallbackConnectionId\n\t\t\t\t? {\n\t\t\t\t\t\tconnectorSourceOfTruthFallbackConnectionId:\n\t\t\t\t\t\t\tpolicy.fallbackConnectionId,\n\t\t\t\t\t}\n\t\t\t\t: {}),\n\t\t},\n\t};\n}\n\nasync function syncSourceOfTruthPolicy(\n\tcredentials: OAuthCredentials,\n\tconnection: RemoteConnectorConnection | null,\n): Promise<OAuthCredentials> {\n\tif (!connection) {\n\t\treturn credentials;\n\t}\n\tconst area = getSourceOfTruthArea(credentials.metadata);\n\tif (!area) {\n\t\treturn credentials;\n\t}\n\n\tconst policy = await setRemoteSourceOfTruthPolicy({\n\t\tworkspaceId: connection.workspaceId,\n\t\tarea,\n\t\tprimaryConnectionId: connection.id,\n\t\tfallbackConnectionId: getSourceOfTruthFallbackConnectionId(\n\t\t\tcredentials.metadata,\n\t\t),\n\t});\n\treturn mergeSourceOfTruthPolicyMetadata(credentials, policy);\n}\n\nexport async function syncOAuthProviderConnection(\n\tprovider: SupportedOAuthProvider,\n\tcredentials: OAuthCredentials,\n): Promise<OAuthCredentials> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\treturn credentials;\n\t}\n\n\tconst providerId = CONNECTOR_PROVIDER_BY_OAUTH_PROVIDER[provider];\n\tconst connectionId = getMetadataString(\n\t\tcredentials.metadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tif (connectionId) {\n\t\tconst connection = await refreshRemoteConnection(connectionId);\n\t\treturn syncSourceOfTruthPolicy(\n\t\t\tmergeConnectionMetadata(credentials, connection, providerId),\n\t\t\tconnection,\n\t\t);\n\t}\n\n\tconst connection = await registerRemoteConnection({\n\t\tproviderId,\n\t\tdisplayName: DISPLAY_NAME_BY_OAUTH_PROVIDER[provider],\n\t\tauthType: \"AUTH_TYPE_OAUTH2\",\n\t\tscopes: getMetadataStringArray(credentials.metadata, \"scopes\"),\n\t\tcredentials: getMetadataStringMap(\n\t\t\tcredentials.metadata,\n\t\t\t\"connectorCredentialRefs\",\n\t\t),\n\t});\n\treturn syncSourceOfTruthPolicy(\n\t\tmergeConnectionMetadata(credentials, connection, providerId),\n\t\tconnection,\n\t);\n}\n\nexport async function syncStoredOAuthProviderConnection(\n\tprovider: SupportedOAuthProvider,\n): Promise<void> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\treturn;\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\treturn;\n\t}\n\tconst synced = await syncOAuthProviderConnection(provider, credentials);\n\tif (synced !== credentials) {\n\t\tsaveOAuthCredentials(provider, synced);\n\t}\n}\n\nexport async function configureOAuthProviderSourceOfTruthPolicy(\n\tprovider: string,\n\tinput: ConfigureOAuthProviderSourceOfTruthPolicyInput,\n): Promise<ConfiguredOAuthProviderSourceOfTruthPolicy> {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`,\n\t\t);\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\tconst area = normalizeConnectorSourceOfTruthArea(input.area);\n\tif (!area) {\n\t\tthrow new Error(\n\t\t\t`Unsupported source-of-truth area: ${input.area}. Valid areas: ${CONNECTOR_SOURCE_OF_TRUTH_AREAS.join(\", \")}`,\n\t\t);\n\t}\n\n\tconst metadata: Record<string, unknown> = { ...credentials.metadata };\n\tmetadata.connectorSourceOfTruthArea = area;\n\tdelete metadata.sourceOfTruthArea;\n\tdelete metadata.sourceOfTruthFallbackConnectionId;\n\tdelete metadata.connectorSourceOfTruthPrimaryConnectionId;\n\tdelete metadata.connectorSourceOfTruthWorkspaceId;\n\n\tconst fallbackConnectionId = trimString(input.fallbackConnectionId);\n\tif (fallbackConnectionId) {\n\t\tmetadata.connectorSourceOfTruthFallbackConnectionId = fallbackConnectionId;\n\t} else {\n\t\tdelete metadata.connectorSourceOfTruthFallbackConnectionId;\n\t}\n\n\tsaveOAuthCredentials(provider, { ...credentials, metadata });\n\tawait syncStoredOAuthProviderConnection(provider);\n\n\tconst synced = loadOAuthCredentials(provider) ?? { ...credentials, metadata };\n\tconst syncedMetadata = synced.metadata ?? {};\n\tconst connectorConnectionId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tconst primaryConnectionId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorSourceOfTruthPrimaryConnectionId\",\n\t);\n\tconst workspaceId = getMetadataString(\n\t\tsyncedMetadata,\n\t\t\"connectorSourceOfTruthWorkspaceId\",\n\t);\n\treturn {\n\t\tprovider,\n\t\tarea,\n\t\t...(fallbackConnectionId ? { fallbackConnectionId } : {}),\n\t\t...(connectorConnectionId ? { connectorConnectionId } : {}),\n\t\t...(primaryConnectionId ? { primaryConnectionId } : {}),\n\t\t...(workspaceId ? { workspaceId } : {}),\n\t};\n}\n\nexport function clearOAuthProviderSourceOfTruthPolicy(\n\tprovider: string,\n): boolean {\n\tif (!isConnectorOAuthProvider(provider)) {\n\t\tthrow new Error(\n\t\t\t`Unsupported OAuth connector provider: ${provider}. Supported providers: ${supportedConnectorOAuthProviders()}`,\n\t\t);\n\t}\n\tconst credentials = loadOAuthCredentials(provider);\n\tif (!credentials) {\n\t\tthrow new Error(`No OAuth credentials found for ${provider}`);\n\t}\n\n\tconst metadata: Record<string, unknown> = { ...credentials.metadata };\n\tconst hadPolicyMetadata = SOURCE_OF_TRUTH_METADATA_KEYS.some(\n\t\t(key) => key in metadata,\n\t);\n\tif (!hadPolicyMetadata) {\n\t\treturn false;\n\t}\n\tfor (const key of SOURCE_OF_TRUTH_METADATA_KEYS) {\n\t\tdelete metadata[key];\n\t}\n\tsaveOAuthCredentials(provider, { ...credentials, metadata });\n\treturn hadPolicyMetadata;\n}\n\nexport async function revokeOAuthProviderConnection(\n\tprovider: OAuthLogoutProvider,\n\tcredentials: OAuthCredentials | null,\n): Promise<void> {\n\tconst connectionId = getMetadataString(\n\t\tcredentials?.metadata,\n\t\t\"connectorConnectionId\",\n\t);\n\tif (!connectionId) {\n\t\treturn;\n\t}\n\tif (!isConnectorOAuthProvider(provider) && provider !== \"anthropic\") {\n\t\treturn;\n\t}\n\tawait revokeRemoteConnection(connectionId);\n}\n"]}

package/dist/oauth/evalops.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"evalops.d.ts","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAgBA,OAAO,EACN,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AAwDtB,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,6BAA6B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CAClB;AAqRD,wBAAgB,iCAAiC,CAChD,MAAM,EAAE,IAAI,CACX,4BAA4B,EAC5B,gBAAgB,GAAG,aAAa,GAAG,OAAO,CAC1C,GACA,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,GAC/D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AAED,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,6BAA6B,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAsFvC;AAyJD,wBAAsB,YAAY,CACjC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAgEf;AAED,wBAAsB,mBAAmB,CACxC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAsF3B;AAED,wBAAsB,kBAAkB,CACvC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CA2Bf"}
+{"version":3,"file":"evalops.d.ts","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAiBA,OAAO,EACN,KAAK,gBAAgB,EAGrB,MAAM,cAAc,CAAC;AAwDtB,MAAM,WAAW,kBAAkB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;CACjB;AAWD,MAAM,WAAW,6BAA6B;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,4BAA4B;IAC5C,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,WAAW,EAAE,kBAAkB,CAAC;IAChC,KAAK,EAAE,MAAM,CAAC;IACd,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CAClB;AAiRD,wBAAgB,iCAAiC,CAChD,MAAM,EAAE,IAAI,CACX,4BAA4B,EAC5B,gBAAgB,GAAG,aAAa,GAAG,OAAO,CAC1C,GACA,OAAO,CAAC,IAAI,CAAC,4BAA4B,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC,GAC/D,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAsBxB;AAED,wBAAsB,2BAA2B,CAChD,OAAO,EAAE,6BAA6B,GACpC,OAAO,CAAC,4BAA4B,CAAC,CAsFvC;AAyJD,wBAAsB,YAAY,CACjC,SAAS,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,EAChC,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,IAAI,GACjC,OAAO,CAAC,IAAI,CAAC,CAgEf;AAED,wBAAsB,mBAAmB,CACxC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,gBAAgB,CAAC,CAsF3B;AAED,wBAAsB,kBAAkB,CACvC,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAChC,OAAO,CAAC,IAAI,CAAC,CA2Bf"}

package/dist/oauth/evalops.js

@@ -2,6 +2,7 @@ import { createServer, } from "node:http";
 import { EVALOPS_ORGANIZATION_ID_ENV_VARS } from "../evalops/env-aliases.js";
 import { PLATFORM_HTTP_ROUTES } from "../platform/core-services.js";
 import { fetchDownstream } from "../utils/downstream-http.js";
+import { isRecord } from "../utils/json.js";
 import { createLogger } from "../utils/logger.js";
 import { rejectDisallowedLoopbackHost } from "../utils/loopback-http.js";
 import { buildEnrolledDesktopDeviceProof, enrollDesktopDeviceIdentity, } from "./device-identity.js";
@@ -131,9 +132,6 @@ function parseScopesPayload(value) {
         .map((entry) => entry.trim())
         .filter((entry) => entry.length > 0);
 }
-function isRecord(value) {
-    return typeof value === "object" && value !== null && !Array.isArray(value);
-}
 function getMetadataString(metadata, key) {
     const value = metadata?.[key];
     return typeof value === "string" && value.trim().length > 0

package/dist/oauth/evalops.js.map

@@ -1 +1 @@
-{"version":3,"file":"evalops.js","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAEN,+BAA+B,EAC/B,2BAA2B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,eAAe,GAAG,oBAAoB,aAAa,EAAE,CAAC;AAC5D,MAAM,YAAY,GAAG,GAAG,eAAe,GAAG,aAAa,EAAE,CAAC;AAC1D,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAC5D,MAAM,0BAA0B,GAAG;IAClC,sBAAsB;IACtB,sBAAsB;CACb,CAAC;AACX,MAAM,iCAAiC,GAAG;IACzC,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AACX,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAC/C,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAChD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AA2E5C,SAAS,WAAW,CAAC,KAAwB;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,wBAAwB,CAChC,OAAe,EACf,WAA8B,EAAE;IAEhC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,wBAAwB,CAC9B,WAAW,CAAC;QACX,GAAG,0BAA0B;QAC7B,GAAG,iCAAiC;KACpC,CAAC,IAAI,oBAAoB,EAC1B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC5B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,qCAAqC;QACrC,6BAA6B;KAC7B,CAAC,EACF,2BAA2B,CAC3B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC9B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,uCAAuC;QACvC,+BAA+B;KAC/B,CAAC,EACF,6BAA6B,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,eAAuB,EACvB,IAAY,EACZ,IAAiB;IAEjB,OAAO,eAAe,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE;QACzD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,oBAAoB,EAAE;QACjC,WAAW,EAAE,sBAAsB,EAAE;KACrC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IACnC,MAAM,cAAc,GAAG,WAAW,CAAC,gCAAgC,CAAC,CAAC;IACrE,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,qCAAqC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QAC1B,yBAAyB;QACzB,6BAA6B;KAC7B,CAAC,CAAC;IACH,OAAO;QACN,QAAQ,EACP,WAAW,CAAC;YACX,0BAA0B;YAC1B,8BAA8B;SAC9B,CAAC,IAAI,6BAA6B;QACpC,WAAW,EACV,WAAW,CAAC;YACX,6BAA6B;YAC7B,iCAAiC;SACjC,CAAC,IAAI,gCAAgC;QACvC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC3C,OAAO,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACtB,KAAgC,EAChC,SAAiB;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C;IAE7C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAA6C;IAE7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,QAAQ,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ;QACzE,WAAW,EACV,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,WAAW;QACtE,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpD,CAAC,CAAC;gBACA,eAAe,EAAE,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;aAClE;YACF,CAAC,CAAC,QAAQ,CAAC,eAAe;gBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC;YAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;KACP,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,+BAA+B,CACvC,QAA6C;IAE7C,MAAM,cAAc,GACnB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC7C,2BAA2B,EAAE,CAAC;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACd,+FAA+F,CAC/F,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,eAAuB,EACvB,WAAmB;IAEnB,IAAI,CAAC;QACJ,OAAO,CACN,CAAC,MAAM,2BAA2B,CACjC,eAAe,EACf,WAAW,EACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAC/B,CAAC,IAAI,SAAS,CACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACxD,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CACpC,eAAuB,EACvB,QAAgB;IAEhB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;IACR,CAAC;IACD,oBAAoB,CAAC,SAAS,EAAE;QAC/B,GAAG,MAAM;QACT,QAAQ,EAAE;YACT,GAAG,MAAM,CAAC,QAAQ;YAClB,eAAe;YACf,QAAQ;SACR;KACD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,QAAkC;IAElC,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAChC,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,MAIiE;IAEjE,OAAO;QACN,4BAA4B,EAAE,MAAM,CAAC,KAAK;QAC1C,sBAAsB,EAAE,MAAM,CAAC,cAAc;QAC7C,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACrD,2BAA2B,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW;QAC3D,GAAG,CAAC,MAAM,CAAC,OAAO;YACjB,CAAC,CAAC;gBACA,gBAAgB,EAAE,MAAM,CAAC,OAAO;gBAChC,wBAAwB,EAAE,MAAM,CAAC,OAAO;aACxC;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe;YACrC,CAAC,CAAC;gBACA,+BAA+B,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe;aACnE;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO;YAC7B,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAsC;IAEtC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GACvB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;QAClC,CAAC,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,IAAI,QAAQ,CAAC;QACzD,CAAC,CAAC,QAAQ,CAAC;IACb,IAAI,gBAAgB,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,WAAW,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,+BAA+B,CACrC,eAAe,EACf,YAAY,EACZ,gBAAgB,CAChB,CAAC;IACJ,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CACxD,eAAe,EACf,KAAK,CACL,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACtB,gBAAgB,GAAG,gBAAgB,CAAC;YACpC,4BAA4B,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;YAChE,WAAW,GAAG,MAAM,+BAA+B,CAClD,eAAe,EACf,YAAY,EACZ,gBAAgB,CAChB,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,gBAAgB,EAC9C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA+C,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,OAAO,EAAE,KAAK,IAAI,yCAAyC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;QAC5C,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,cAAc,EAAE,+BAA+B,CAAC,kBAAkB,CAAC;QACnE,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QACtC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACvD,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QACzD,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;KACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB;IAIjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,aAAqD,CAAC;QAC1D,IAAI,YAAoC,CAAC;QAEzC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrE,aAAa,GAAG,GAAG,CAAC;YACpB,YAAY,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACzE,IAAI,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC3D,OAAO;YACR,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,sDAAsD,KAAK,qDAAqD,CAChH,CAAC;gBACF,YAAY,CAAC,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACR,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qIAAqI,CACrI,CAAC;gBACF,YAAY,CACX,IAAI,KAAK,CACR,+DAA+D,CAC/D,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,cAAc,CAC/B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CACzC,CAAC;gBACF,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;gBACnE,MAAM,qBAAqB,GAC1B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,qBAAqB;oBAC7C,CAAC,CAAC,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;oBAC7D,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qHAAqH,CACrH,CAAC;gBACF,aAAa,CAAC;oBACb,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,gBAAgB;oBAChB,YAAY;oBACZ,MAAM;iBACN,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CACtJ,CAAC;gBACF,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CACL,IAAI,KAAK,CACR,QAAQ,aAAa,uEAAuE,CAC5F,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC;gBACP,MAAM;gBACN,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa;aAC9B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,eAAuB,EACvB,cAAkC,EAClC,QAAmC;IAEnC,QAAQ,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,eAAe,EAC7C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,CAAC,cAAc,CAAC;SACxB,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACjD,IAAI,OAAO,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,qBAAqB,YAAY,8DAA8D,CAC/F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,+BAA+B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,iBAAiB,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,SAAgC,EAChC,QAAmC;IAEnC,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,2BAA2B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAChD,eAAe,EACf,cAAc,EACd,QAAQ,CACR,CAAC;QACF,QAAQ,EAAE,CAAC,0CAA0C,CAAC,CAAC;QACvD,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,SAAS,EAAE;YACX,IAAI,OAAO,CAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChD,MAAM,OAAO,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAClE,CAAC,GAAG,EAAE,GAAG,IAAI,CACb,CAAC;gBACF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,CAAC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAqB;YACrC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACT,eAAe;gBACf,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW;gBACX,GAAG,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB;SACD,CAAC;QACF,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CACjD,eAAe,EACf,MAAM,CAAC,WAAW,EAClB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAC/B,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACd,oBAAoB,CAAC,SAAS,EAAE;gBAC/B,GAAG,WAAW;gBACd,QAAQ,EAAE;oBACT,GAAG,WAAW,CAAC,QAAQ;oBACvB,QAAQ;iBACR;aACD,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC/C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,+BAA+B,CACxD,eAAe,EACf,SAAS,EACT,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CACvC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAC1C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,gBAAgB,GACrB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,IAAI,IAAI;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,oBAAoB,GAAqB;QAC9C,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,OAAO,EAAE,gBAAgB;QACzB,OAAO;QACP,QAAQ,EAAE;YACT,GAAG,QAAQ;YACX,eAAe;YACf,cAAc,EACb,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC;SAChE;KACD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,oBAAoB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,gBAAgB,GAAG,WAAW;QACnC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,0BAA0B,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO,oBAAoB,CAAC;IAC7B,CAAC;IAED,MAAM,mBAAmB,GAAqB;QAC7C,GAAG,oBAAoB;QACvB,QAAQ,EAAE;YACT,GAAG,oBAAoB,CAAC,QAAQ;YAChC,QAAQ,EAAE,gBAAgB;SAC1B;KACD,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrD,OAAO,mBAAmB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,WAAW,EACzC;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CACD,CAAC;IAEF,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,6BAA6B,CAAC,CAAC;IAClE,CAAC;AACF,CAAC","sourcesContent":["import {\n\ttype IncomingMessage,\n\ttype Server,\n\ttype ServerResponse,\n\tcreateServer,\n} from \"node:http\";\nimport { EVALOPS_ORGANIZATION_ID_ENV_VARS } from \"../evalops/env-aliases.js\";\nimport { PLATFORM_HTTP_ROUTES } from \"../platform/core-services.js\";\nimport { fetchDownstream } from \"../utils/downstream-http.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { rejectDisallowedLoopbackHost } from \"../utils/loopback-http.js\";\nimport {\n\tbuildDesktopDeviceProof,\n\tbuildEnrolledDesktopDeviceProof,\n\tenrollDesktopDeviceIdentity,\n} from \"./device-identity.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth:evalops\");\n\nconst CALLBACK_PORT = 1460;\nconst CALLBACK_PATH = \"/auth/callback/evalops\";\nconst CALLBACK_ORIGIN = `http://127.0.0.1:${CALLBACK_PORT}`;\nconst CALLBACK_URI = `${CALLBACK_ORIGIN}${CALLBACK_PATH}`;\nconst DEFAULT_IDENTITY_URL = \"https://identity.evalops.dev\";\nconst IDENTITY_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_IDENTITY_URL\",\n\t\"EVALOPS_IDENTITY_URL\",\n] as const;\nconst SHARED_PLATFORM_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\nconst DEFAULT_PROVIDER_REF_PROVIDER = \"openai\";\nconst DEFAULT_PROVIDER_REF_ENVIRONMENT = \"prod\";\nconst DEFAULT_IDENTITY_TIMEOUT_MS = 10_000;\nconst DEFAULT_IDENTITY_MAX_ATTEMPTS = 2;\nconst REQUIRED_SCOPE = \"llm_gateway:invoke\";\n\ninterface IdentityStartResponse {\n\tauthorization_url?: string;\n\terror?: string;\n}\n\ninterface IdentityRefreshResponse {\n\taccess_token?: string;\n\terror?: string;\n\texpires_at?: string;\n\torganization_id?: string;\n\trefresh_expires_at?: string;\n\trefresh_token?: string;\n\tscopes?: unknown;\n}\n\ninterface IdentityRevokeResponse {\n\terror?: string;\n\trevoked?: boolean;\n}\n\ninterface IdentityDelegationResponse {\n\tagent_id?: string;\n\terror?: string;\n\texpires_at?: string;\n\trun_id?: string;\n\tscopes_denied?: unknown;\n\tscopes_granted?: unknown;\n\tscopes_requested?: unknown;\n\ttoken?: string;\n\ttoken_type?: string;\n}\n\nexport interface EvalOpsProviderRef {\n\tprovider: string;\n\tenvironment: string;\n\tcredential_name?: string;\n\tteam_id?: string;\n}\n\ninterface EvalOpsCallbackResult {\n\taccessToken: string;\n\texpiresAt: number;\n\torganizationId: string;\n\trefreshExpiresAt?: number;\n\trefreshToken?: string;\n\tscopes: string[];\n}\n\nexport interface EvalOpsDelegationTokenRequest {\n\tagentId: string;\n\tagentType: string;\n\tcapabilities?: string[];\n\tmetadata?: Record<string, unknown>;\n\trunId: string;\n\tscopes?: string[];\n\tsurface: string;\n\ttoken?: string;\n\tttlSeconds?: number;\n}\n\nexport interface EvalOpsDelegationTokenResult {\n\tagentId: string;\n\texpiresAt: number;\n\torganizationId: string;\n\tproviderRef: EvalOpsProviderRef;\n\trunId: string;\n\tscopesDenied: string[];\n\tscopesGranted: string[];\n\tscopesRequested: string[];\n\ttoken: string;\n\ttokenType: string;\n}\n\nfunction getEnvValue(names: readonly string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = process.env[name]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction normalizeIdentityBaseUrl(\n\tbaseUrl: string,\n\tsuffixes: readonly string[] = [],\n): string {\n\tlet normalized = baseUrl.trim().replace(/\\/+$/u, \"\");\n\tfor (const suffix of suffixes) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = normalized.slice(0, -suffix.length).replace(/\\/+$/u, \"\");\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction getIdentityBaseUrl(): string {\n\treturn normalizeIdentityBaseUrl(\n\t\tgetEnvValue([\n\t\t\t...IDENTITY_BASE_URL_ENV_VARS,\n\t\t\t...SHARED_PLATFORM_BASE_URL_ENV_VARS,\n\t\t]) ?? DEFAULT_IDENTITY_URL,\n\t\tObject.values(PLATFORM_HTTP_ROUTES.identity),\n\t);\n}\n\nfunction getIdentityTimeoutMs(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t\t\"EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_TIMEOUT_MS,\n\t);\n}\n\nfunction getIdentityMaxAttempts(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t\t\"EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_MAX_ATTEMPTS,\n\t);\n}\n\nfunction fetchIdentity(\n\tidentityBaseUrl: string,\n\tpath: string,\n\tinit: RequestInit,\n): Promise<Response> {\n\treturn fetchDownstream(`${identityBaseUrl}${path}`, init, {\n\t\tserviceName: \"EvalOps identity service\",\n\t\tfailureMode: \"required\",\n\t\ttimeoutMs: getIdentityTimeoutMs(),\n\t\tmaxAttempts: getIdentityMaxAttempts(),\n\t});\n}\n\nfunction getConfiguredOrganizationId(): string | undefined {\n\tconst organizationId = getEnvValue(EVALOPS_ORGANIZATION_ID_ENV_VARS);\n\treturn organizationId;\n}\n\nfunction getProviderRef(): EvalOpsProviderRef {\n\tconst credentialName = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_CREDENTIAL_NAME\",\n\t\t\"MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME\",\n\t]);\n\tconst teamID = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_TEAM_ID\",\n\t\t\"MAESTRO_LLM_GATEWAY_TEAM_ID\",\n\t]);\n\treturn {\n\t\tprovider:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_PROVIDER\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_PROVIDER\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_PROVIDER,\n\t\tenvironment:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_ENVIRONMENT\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_ENVIRONMENT\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_ENVIRONMENT,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamID ? { team_id: teamID } : {}),\n\t};\n}\n\nfunction parseExpiresAt(value: string | null): number {\n\treturn parseTimestamp(value, \"expires_at\");\n}\n\nfunction parseTimestamp(\n\tvalue: string | null | undefined,\n\tfieldName: string,\n): number {\n\tif (!value) {\n\t\tthrow new Error(`Missing ${fieldName} in EvalOps response`);\n\t}\n\tconst expiresAt = Date.parse(value);\n\tif (Number.isNaN(expiresAt)) {\n\t\tthrow new Error(`Invalid ${fieldName} in EvalOps response: ${value}`);\n\t}\n\treturn expiresAt;\n}\n\nfunction parseScopes(value: string | null): string[] {\n\tif (!value) {\n\t\treturn [REQUIRED_SCOPE];\n\t}\n\treturn value\n\t\t.split(\" \")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction parseScopesPayload(value: unknown): string[] {\n\tif (!Array.isArray(value)) {\n\t\treturn [];\n\t}\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataNumber(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): number | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"number\" && Number.isFinite(value)\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataScopes(\n\tmetadata: Record<string, unknown> | undefined,\n): string[] {\n\treturn parseScopesPayload(metadata?.scopes);\n}\n\nfunction resolveProviderRef(\n\tmetadata: Record<string, unknown> | undefined,\n): EvalOpsProviderRef {\n\tconst fallback = getProviderRef();\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: undefined;\n\treturn {\n\t\tprovider: getMetadataString(providerRef, \"provider\") ?? fallback.provider,\n\t\tenvironment:\n\t\t\tgetMetadataString(providerRef, \"environment\") ?? fallback.environment,\n\t\t...(getMetadataString(providerRef, \"credential_name\")\n\t\t\t? {\n\t\t\t\t\tcredential_name: getMetadataString(providerRef, \"credential_name\"),\n\t\t\t\t}\n\t\t\t: fallback.credential_name\n\t\t\t\t? { credential_name: fallback.credential_name }\n\t\t\t\t: {}),\n\t\t...(getMetadataString(providerRef, \"team_id\")\n\t\t\t? { team_id: getMetadataString(providerRef, \"team_id\") }\n\t\t\t: fallback.team_id\n\t\t\t\t? { team_id: fallback.team_id }\n\t\t\t\t: {}),\n\t};\n}\n\nfunction resolveStoredEvalOpsMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, unknown> | undefined {\n\tif (metadata) {\n\t\treturn metadata;\n\t}\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\treturn stored?.metadata;\n}\n\nfunction resolveDelegationOrganizationId(\n\tmetadata: Record<string, unknown> | undefined,\n): string {\n\tconst organizationId =\n\t\tgetMetadataString(metadata, \"organizationId\") ??\n\t\tgetConfiguredOrganizationId();\n\tif (!organizationId) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires an organization id from /login evalops or MAESTRO_EVALOPS_ORG_ID.\",\n\t\t);\n\t}\n\treturn organizationId;\n}\n\nasync function enrollCurrentDesktopDevice(\n\tidentityBaseUrl: string,\n\taccessToken: string,\n): Promise<string | undefined> {\n\ttry {\n\t\treturn (\n\t\t\t(await enrollDesktopDeviceIdentity(\n\t\t\t\tidentityBaseUrl,\n\t\t\t\taccessToken,\n\t\t\t\tprocess.env.npm_package_version,\n\t\t\t)) ?? undefined\n\t\t);\n\t} catch (error) {\n\t\tlogger.warn(\"EvalOps desktop device enrollment skipped\", {\n\t\t\terrorType: error instanceof Error ? error.name : \"unknown\",\n\t\t});\n\t\treturn undefined;\n\t}\n}\n\nfunction persistStoredEvalOpsDeviceId(\n\tidentityBaseUrl: string,\n\tdeviceId: string,\n): void {\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\tif (!stored) {\n\t\treturn;\n\t}\n\tsaveOAuthCredentials(\"evalops\", {\n\t\t...stored,\n\t\tmetadata: {\n\t\t\t...stored.metadata,\n\t\t\tidentityBaseUrl,\n\t\t\tdeviceId,\n\t\t},\n\t});\n}\n\nasync function getFreshEvalOpsAccessToken(\n\tmetadata?: Record<string, unknown>,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\tif (Date.now() < credentials.expires - 60_000) {\n\t\treturn credentials.access;\n\t}\n\tconst refreshed = await refreshEvalOpsToken(\n\t\tcredentials.refresh,\n\t\tmetadata ?? credentials.metadata,\n\t);\n\tsaveOAuthCredentials(\"evalops\", refreshed);\n\treturn refreshed.access;\n}\n\nexport function buildEvalOpsDelegationEnvironment(\n\tresult: Pick<\n\t\tEvalOpsDelegationTokenResult,\n\t\t\"organizationId\" | \"providerRef\" | \"token\"\n\t> &\n\t\tPartial<Pick<EvalOpsDelegationTokenResult, \"agentId\" | \"runId\">>,\n): Record<string, string> {\n\treturn {\n\t\tMAESTRO_EVALOPS_ACCESS_TOKEN: result.token,\n\t\tMAESTRO_EVALOPS_ORG_ID: result.organizationId,\n\t\tMAESTRO_EVALOPS_PROVIDER: result.providerRef.provider,\n\t\tMAESTRO_EVALOPS_ENVIRONMENT: result.providerRef.environment,\n\t\t...(result.agentId\n\t\t\t? {\n\t\t\t\t\tMAESTRO_AGENT_ID: result.agentId,\n\t\t\t\t\tMAESTRO_EVALOPS_AGENT_ID: result.agentId,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.runId ? { MAESTRO_EVALOPS_RUN_ID: result.runId } : {}),\n\t\t...(result.providerRef.credential_name\n\t\t\t? {\n\t\t\t\t\tMAESTRO_EVALOPS_CREDENTIAL_NAME: result.providerRef.credential_name,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.providerRef.team_id\n\t\t\t? { MAESTRO_EVALOPS_TEAM_ID: result.providerRef.team_id }\n\t\t\t: {}),\n\t};\n}\n\nexport async function issueEvalOpsDelegationToken(\n\trequest: EvalOpsDelegationTokenRequest,\n): Promise<EvalOpsDelegationTokenResult> {\n\tconst metadata = resolveStoredEvalOpsMetadata(request.metadata);\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst token = request.token ?? (await getFreshEvalOpsAccessToken(metadata));\n\tif (!token) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires a valid access token. Run /login evalops first.\",\n\t\t);\n\t}\n\tconst delegationMetadata =\n\t\t!request.token && !request.metadata\n\t\t\t? (loadOAuthCredentials(\"evalops\")?.metadata ?? metadata)\n\t\t\t: metadata;\n\tlet enrolledDeviceId = getMetadataString(delegationMetadata, \"deviceId\");\n\tlet deviceProof = request.token\n\t\t? undefined\n\t\t: await buildEnrolledDesktopDeviceProof(\n\t\t\t\tidentityBaseUrl,\n\t\t\t\t\"delegation\",\n\t\t\t\tenrolledDeviceId,\n\t\t\t);\n\tif (!deviceProof && !request.token) {\n\t\tconst migratedDeviceId = await enrollCurrentDesktopDevice(\n\t\t\tidentityBaseUrl,\n\t\t\ttoken,\n\t\t);\n\t\tif (migratedDeviceId) {\n\t\t\tenrolledDeviceId = migratedDeviceId;\n\t\t\tpersistStoredEvalOpsDeviceId(identityBaseUrl, migratedDeviceId);\n\t\t\tdeviceProof = await buildEnrolledDesktopDeviceProof(\n\t\t\t\tidentityBaseUrl,\n\t\t\t\t\"delegation\",\n\t\t\t\tenrolledDeviceId,\n\t\t\t);\n\t\t}\n\t}\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.delegationTokens,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify({\n\t\t\t\tagent_id: request.agentId,\n\t\t\t\tagent_type: request.agentType,\n\t\t\t\t...(request.capabilities?.length\n\t\t\t\t\t? { capabilities: request.capabilities }\n\t\t\t\t\t: {}),\n\t\t\t\trun_id: request.runId,\n\t\t\t\t...(request.scopes?.length ? { scopes: request.scopes } : {}),\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t\tsurface: request.surface,\n\t\t\t\t...(request.ttlSeconds ? { ttl_seconds: request.ttlSeconds } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityDelegationResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityDelegationResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.token || !payload.expires_at) {\n\t\tthrow new Error(\n\t\t\tpayload?.error ?? \"EvalOps delegation token request failed\",\n\t\t);\n\t}\n\n\treturn {\n\t\tagentId: payload.agent_id ?? request.agentId,\n\t\texpiresAt: parseTimestamp(payload.expires_at, \"expires_at\"),\n\t\torganizationId: resolveDelegationOrganizationId(delegationMetadata),\n\t\tproviderRef: resolveProviderRef(delegationMetadata),\n\t\trunId: payload.run_id ?? request.runId,\n\t\tscopesDenied: parseScopesPayload(payload.scopes_denied),\n\t\tscopesGranted: parseScopesPayload(payload.scopes_granted),\n\t\tscopesRequested: parseScopesPayload(payload.scopes_requested),\n\t\ttoken: payload.token,\n\t\ttokenType: payload.token_type ?? \"Bearer\",\n\t};\n}\n\nasync function startCallbackServer(): Promise<{\n\tserver: Server;\n\tgetResult: () => Promise<EvalOpsCallbackResult>;\n}> {\n\treturn new Promise((resolve, reject) => {\n\t\tlet resultResolve: (value: EvalOpsCallbackResult) => void;\n\t\tlet resultReject: (error: Error) => void;\n\n\t\tconst resultPromise = new Promise<EvalOpsCallbackResult>((res, rej) => {\n\t\t\tresultResolve = res;\n\t\t\tresultReject = rej;\n\t\t});\n\n\t\tconst server = createServer((req: IncomingMessage, res: ServerResponse) => {\n\t\t\tif (rejectDisallowedLoopbackHost(req, res, CALLBACK_PORT)) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst requestUrl = new URL(req.url ?? \"\", CALLBACK_ORIGIN);\n\t\t\tif (requestUrl.pathname !== CALLBACK_PATH) {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst error = requestUrl.searchParams.get(\"error\");\n\t\t\tif (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>EvalOps Login Failed</h1><p>Error: ${error}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(new Error(`EvalOps identity login failed: ${error}`));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst accessToken = requestUrl.searchParams.get(\"access_token\");\n\t\t\tconst organizationId = requestUrl.searchParams.get(\"organization_id\");\n\t\t\tif (!accessToken || !organizationId) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Invalid Callback</h1><p>Missing access_token or organization_id.</p><p>You can close this window.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultReject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\"EvalOps callback was missing access_token or organization_id.\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst expiresAt = parseExpiresAt(\n\t\t\t\t\trequestUrl.searchParams.get(\"expires_at\"),\n\t\t\t\t);\n\t\t\t\tconst refreshToken =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_token\")?.trim() || undefined;\n\t\t\t\tconst refreshExpiresAtValue =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_expires_at\");\n\t\t\t\tconst refreshExpiresAt = refreshExpiresAtValue\n\t\t\t\t\t? parseTimestamp(refreshExpiresAtValue, \"refresh_expires_at\")\n\t\t\t\t\t: undefined;\n\t\t\t\tconst scopes = parseScopes(requestUrl.searchParams.get(\"scope\"));\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Authentication Successful</h1><p>You can close this window and return to Maestro.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultResolve({\n\t\t\t\t\taccessToken,\n\t\t\t\t\texpiresAt,\n\t\t\t\t\torganizationId,\n\t\t\t\t\trefreshExpiresAt,\n\t\t\t\t\trefreshToken,\n\t\t\t\t\tscopes,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>Invalid Callback</h1><p>${error instanceof Error ? error.message : String(error)}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"EADDRINUSE\") {\n\t\t\t\treject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t`Port ${CALLBACK_PORT} is already in use. Close the other process and retry /login evalops.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treject(error);\n\t\t});\n\n\t\tserver.listen(CALLBACK_PORT, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tgetResult: () => resultPromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve) => {\n\t\tserver.close(() => resolve());\n\t});\n}\n\nasync function startIdentityLogin(\n\tidentityBaseUrl: string,\n\torganizationId: string | undefined,\n\tonStatus?: (status: string) => void,\n): Promise<string> {\n\tonStatus?.(\"Requesting EvalOps managed login URL...\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.authGoogleStart,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tredirect_uri: CALLBACK_URI,\n\t\t\t\tresponse_mode: \"query\",\n\t\t\t\t...(organizationId ? { organization_id: organizationId } : {}),\n\t\t\t\tprompt: \"select_account\",\n\t\t\t\tscopes: [REQUIRED_SCOPE],\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityStartResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityStartResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic message below.\n\t}\n\n\tif (!response.ok || !payload?.authorization_url) {\n\t\tif (payload?.error === \"redirect_uri_not_allowed\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Identity rejected ${CALLBACK_URI}. Add it to IDENTITY_GOOGLE_ALLOWED_REDIRECT_URIS and retry.`,\n\t\t\t);\n\t\t}\n\t\tthrow new Error(payload?.error ?? \"EvalOps identity start failed\");\n\t}\n\n\treturn payload.authorization_url;\n}\n\nexport async function loginEvalOps(\n\tonAuthUrl: (url: string) => void,\n\tonStatus?: (status: string) => void,\n): Promise<void> {\n\tconst identityBaseUrl = getIdentityBaseUrl();\n\tconst organizationId = getConfiguredOrganizationId();\n\tconst providerRef = getProviderRef();\n\tconst { server, getResult } = await startCallbackServer();\n\n\ttry {\n\t\tconst authorizationUrl = await startIdentityLogin(\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId,\n\t\t\tonStatus,\n\t\t);\n\t\tonStatus?.(\"Waiting for EvalOps identity callback...\");\n\t\tonAuthUrl(authorizationUrl);\n\n\t\tconst result = await Promise.race([\n\t\t\tgetResult(),\n\t\t\tnew Promise<EvalOpsCallbackResult>((_, reject) => {\n\t\t\t\tconst timeout = setTimeout(\n\t\t\t\t\t() => reject(new Error(\"EvalOps login timed out after 5 minutes\")),\n\t\t\t\t\t5 * 60 * 1000,\n\t\t\t\t);\n\t\t\t\ttimeout.unref?.();\n\t\t\t}),\n\t\t]);\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: result.accessToken,\n\t\t\trefresh: result.refreshToken ?? \"\",\n\t\t\texpires: result.expiresAt,\n\t\t\tmetadata: {\n\t\t\t\tidentityBaseUrl,\n\t\t\t\torganizationId: result.organizationId,\n\t\t\t\tproviderRef,\n\t\t\t\t...(result.refreshExpiresAt\n\t\t\t\t\t? { refreshExpiresAt: result.refreshExpiresAt }\n\t\t\t\t\t: {}),\n\t\t\t\tscopes: result.scopes,\n\t\t\t},\n\t\t};\n\t\tsaveOAuthCredentials(\"evalops\", credentials);\n\t\tconst deviceId = await enrollDesktopDeviceIdentity(\n\t\t\tidentityBaseUrl,\n\t\t\tresult.accessToken,\n\t\t\tprocess.env.npm_package_version,\n\t\t);\n\t\tif (deviceId) {\n\t\t\tsaveOAuthCredentials(\"evalops\", {\n\t\t\t\t...credentials,\n\t\t\t\tmetadata: {\n\t\t\t\t\t...credentials.metadata,\n\t\t\t\t\tdeviceId,\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\t\tlogger.info(\"EvalOps managed login successful\", {\n\t\t\torganizationId: result.organizationId,\n\t\t\tprovider: providerRef.provider,\n\t\t\tenvironment: providerRef.environment,\n\t\t});\n\t} finally {\n\t\tawait closeServer(server);\n\t}\n}\n\nexport async function refreshEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<OAuthCredentials> {\n\tif (!refreshToken) {\n\t\tthrow new Error(\"EvalOps refresh token missing. Run /login evalops again.\");\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildEnrolledDesktopDeviceProof(\n\t\tidentityBaseUrl,\n\t\t\"refresh\",\n\t\tgetMetadataString(metadata, \"deviceId\"),\n\t);\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRefresh,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\trefresh_token: refreshToken,\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityRefreshResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRefreshResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.access_token || !payload.expires_at) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token refresh failed\");\n\t}\n\n\tconst expires = parseTimestamp(payload.expires_at, \"expires_at\");\n\tconst nextRefreshToken =\n\t\ttypeof payload.refresh_token === \"string\" &&\n\t\tpayload.refresh_token.trim().length > 0\n\t\t\t? payload.refresh_token\n\t\t\t: refreshToken;\n\tconst scopes = parseScopesPayload(payload.scopes);\n\tconst refreshExpiresAt =\n\t\tpayload.refresh_expires_at != null\n\t\t\t? parseTimestamp(payload.refresh_expires_at, \"refresh_expires_at\")\n\t\t\t: getMetadataNumber(metadata, \"refreshExpiresAt\");\n\tconst existingDeviceId = getMetadataString(metadata, \"deviceId\");\n\tconst refreshedCredentials: OAuthCredentials = {\n\t\ttype: \"oauth\",\n\t\taccess: payload.access_token,\n\t\trefresh: nextRefreshToken,\n\t\texpires,\n\t\tmetadata: {\n\t\t\t...metadata,\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId:\n\t\t\t\ttypeof payload.organization_id === \"string\" &&\n\t\t\t\tpayload.organization_id.length > 0\n\t\t\t\t\t? payload.organization_id\n\t\t\t\t\t: getMetadataString(metadata, \"organizationId\"),\n\t\t\t...(refreshExpiresAt ? { refreshExpiresAt } : {}),\n\t\t\t...(existingDeviceId ? { deviceId: existingDeviceId } : {}),\n\t\t\tscopes: scopes.length > 0 ? scopes : getMetadataScopes(metadata),\n\t\t},\n\t};\n\tif (!deviceProof) {\n\t\tsaveOAuthCredentials(\"evalops\", refreshedCredentials);\n\t}\n\n\tconst migratedDeviceId = deviceProof\n\t\t? undefined\n\t\t: await enrollCurrentDesktopDevice(identityBaseUrl, payload.access_token);\n\tif (!migratedDeviceId) {\n\t\treturn refreshedCredentials;\n\t}\n\n\tconst migratedCredentials: OAuthCredentials = {\n\t\t...refreshedCredentials,\n\t\tmetadata: {\n\t\t\t...refreshedCredentials.metadata,\n\t\t\tdeviceId: migratedDeviceId,\n\t\t},\n\t};\n\tsaveOAuthCredentials(\"evalops\", migratedCredentials);\n\treturn migratedCredentials;\n}\n\nexport async function revokeEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<void> {\n\tif (!refreshToken) {\n\t\treturn;\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRevoke,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({ refresh_token: refreshToken }),\n\t\t},\n\t);\n\n\tlet payload: IdentityRevokeResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRevokeResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token revoke failed\");\n\t}\n}\n"]}
+{"version":3,"file":"evalops.js","sourceRoot":"","sources":["../../src/oauth/evalops.ts"],"names":[],"mappings":"AAAA,OAAO,EAIN,YAAY,GACZ,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,gCAAgC,EAAE,MAAM,2BAA2B,CAAC;AAC7E,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,4BAA4B,EAAE,MAAM,2BAA2B,CAAC;AACzE,OAAO,EAEN,+BAA+B,EAC/B,2BAA2B,GAC3B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAEN,oBAAoB,EACpB,oBAAoB,GACpB,MAAM,cAAc,CAAC;AAEtB,MAAM,MAAM,GAAG,YAAY,CAAC,eAAe,CAAC,CAAC;AAE7C,MAAM,aAAa,GAAG,IAAI,CAAC;AAC3B,MAAM,aAAa,GAAG,wBAAwB,CAAC;AAC/C,MAAM,eAAe,GAAG,oBAAoB,aAAa,EAAE,CAAC;AAC5D,MAAM,YAAY,GAAG,GAAG,eAAe,GAAG,aAAa,EAAE,CAAC;AAC1D,MAAM,oBAAoB,GAAG,8BAA8B,CAAC;AAC5D,MAAM,0BAA0B,GAAG;IAClC,sBAAsB;IACtB,sBAAsB;CACb,CAAC;AACX,MAAM,iCAAiC,GAAG;IACzC,2BAA2B;IAC3B,0BAA0B;IAC1B,kBAAkB;CACT,CAAC;AACX,MAAM,6BAA6B,GAAG,QAAQ,CAAC;AAC/C,MAAM,gCAAgC,GAAG,MAAM,CAAC;AAChD,MAAM,2BAA2B,GAAG,MAAM,CAAC;AAC3C,MAAM,6BAA6B,GAAG,CAAC,CAAC;AACxC,MAAM,cAAc,GAAG,oBAAoB,CAAC;AA2E5C,SAAS,WAAW,CAAC,KAAwB;IAC5C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,wBAAwB,CAChC,OAAe,EACf,WAA8B,EAAE;IAEhC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACrD,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;QACvE,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC;AACnB,CAAC;AAED,SAAS,kBAAkB;IAC1B,OAAO,wBAAwB,CAC9B,WAAW,CAAC;QACX,GAAG,0BAA0B;QAC7B,GAAG,iCAAiC;KACpC,CAAC,IAAI,oBAAoB,EAC1B,MAAM,CAAC,MAAM,CAAC,oBAAoB,CAAC,QAAQ,CAAC,CAC5C,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC5B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,qCAAqC;QACrC,6BAA6B;KAC7B,CAAC,EACF,2BAA2B,CAC3B,CAAC;AACH,CAAC;AAED,SAAS,sBAAsB;IAC9B,OAAO,gBAAgB,CACtB,WAAW,CAAC;QACX,uCAAuC;QACvC,+BAA+B;KAC/B,CAAC,EACF,6BAA6B,CAC7B,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CACrB,eAAuB,EACvB,IAAY,EACZ,IAAiB;IAEjB,OAAO,eAAe,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE;QACzD,WAAW,EAAE,0BAA0B;QACvC,WAAW,EAAE,UAAU;QACvB,SAAS,EAAE,oBAAoB,EAAE;QACjC,WAAW,EAAE,sBAAsB,EAAE;KACrC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B;IACnC,MAAM,cAAc,GAAG,WAAW,CAAC,gCAAgC,CAAC,CAAC;IACrE,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,SAAS,cAAc;IACtB,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,iCAAiC;QACjC,qCAAqC;KACrC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,WAAW,CAAC;QAC1B,yBAAyB;QACzB,6BAA6B;KAC7B,CAAC,CAAC;IACH,OAAO;QACN,QAAQ,EACP,WAAW,CAAC;YACX,0BAA0B;YAC1B,8BAA8B;SAC9B,CAAC,IAAI,6BAA6B;QACpC,WAAW,EACV,WAAW,CAAC;YACX,6BAA6B;YAC7B,iCAAiC;SACjC,CAAC,IAAI,gCAAgC;QACvC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACtC,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,KAAoB;IAC3C,OAAO,cAAc,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,cAAc,CACtB,KAAgC,EAChC,SAAiB;IAEjB,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,sBAAsB,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACpC,IAAI,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,WAAW,SAAS,yBAAyB,KAAK,EAAE,CAAC,CAAC;IACvE,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAC,KAAoB;IACxC,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,OAAO,CAAC,cAAc,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,KAAK;SACV,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,OAAO,EAAE,CAAC;IACX,CAAC;IACD,OAAO,KAAK;SACV,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;SAC7D,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C,EAC7C,GAAW;IAEX,MAAM,KAAK,GAAG,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC;QACzD,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CACzB,QAA6C;IAE7C,OAAO,kBAAkB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,kBAAkB,CAC1B,QAA6C;IAE7C,MAAM,QAAQ,GAAG,cAAc,EAAE,CAAC;IAClC,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC;QAClD,CAAC,CAAC,QAAQ,CAAC,WAAW;QACtB,CAAC,CAAC,SAAS,CAAC;IACb,OAAO;QACN,QAAQ,EAAE,iBAAiB,CAAC,WAAW,EAAE,UAAU,CAAC,IAAI,QAAQ,CAAC,QAAQ;QACzE,WAAW,EACV,iBAAiB,CAAC,WAAW,EAAE,aAAa,CAAC,IAAI,QAAQ,CAAC,WAAW;QACtE,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;YACpD,CAAC,CAAC;gBACA,eAAe,EAAE,iBAAiB,CAAC,WAAW,EAAE,iBAAiB,CAAC;aAClE;YACF,CAAC,CAAC,QAAQ,CAAC,eAAe;gBACzB,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,eAAe,EAAE;gBAC/C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC;YAC5C,CAAC,CAAC,EAAE,OAAO,EAAE,iBAAiB,CAAC,WAAW,EAAE,SAAS,CAAC,EAAE;YACxD,CAAC,CAAC,QAAQ,CAAC,OAAO;gBACjB,CAAC,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE;gBAC/B,CAAC,CAAC,EAAE,CAAC;KACP,CAAC;AACH,CAAC;AAED,SAAS,4BAA4B,CACpC,QAAkC;IAElC,IAAI,QAAQ,EAAE,CAAC;QACd,OAAO,QAAQ,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,OAAO,MAAM,EAAE,QAAQ,CAAC;AACzB,CAAC;AAED,SAAS,+BAA+B,CACvC,QAA6C;IAE7C,MAAM,cAAc,GACnB,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;QAC7C,2BAA2B,EAAE,CAAC;IAC/B,IAAI,CAAC,cAAc,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACd,+FAA+F,CAC/F,CAAC;IACH,CAAC;IACD,OAAO,cAAc,CAAC;AACvB,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,eAAuB,EACvB,WAAmB;IAEnB,IAAI,CAAC;QACJ,OAAO,CACN,CAAC,MAAM,2BAA2B,CACjC,eAAe,EACf,WAAW,EACX,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAC/B,CAAC,IAAI,SAAS,CACf,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,2CAA2C,EAAE;YACxD,SAAS,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC,CAAC;QACH,OAAO,SAAS,CAAC;IAClB,CAAC;AACF,CAAC;AAED,SAAS,4BAA4B,CACpC,eAAuB,EACvB,QAAgB;IAEhB,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,EAAE,CAAC;QACb,OAAO;IACR,CAAC;IACD,oBAAoB,CAAC,SAAS,EAAE;QAC/B,GAAG,MAAM;QACT,QAAQ,EAAE;YACT,GAAG,MAAM,CAAC,QAAQ;YAClB,eAAe;YACf,QAAQ;SACR;KACD,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,0BAA0B,CACxC,QAAkC;IAElC,MAAM,WAAW,GAAG,oBAAoB,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IACD,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,GAAG,MAAM,EAAE,CAAC;QAC/C,OAAO,WAAW,CAAC,MAAM,CAAC;IAC3B,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAC1C,WAAW,CAAC,OAAO,EACnB,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAChC,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC3C,OAAO,SAAS,CAAC,MAAM,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,iCAAiC,CAChD,MAIiE;IAEjE,OAAO;QACN,4BAA4B,EAAE,MAAM,CAAC,KAAK;QAC1C,sBAAsB,EAAE,MAAM,CAAC,cAAc;QAC7C,wBAAwB,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ;QACrD,2BAA2B,EAAE,MAAM,CAAC,WAAW,CAAC,WAAW;QAC3D,GAAG,CAAC,MAAM,CAAC,OAAO;YACjB,CAAC,CAAC;gBACA,gBAAgB,EAAE,MAAM,CAAC,OAAO;gBAChC,wBAAwB,EAAE,MAAM,CAAC,OAAO;aACxC;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,sBAAsB,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACjE,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,eAAe;YACrC,CAAC,CAAC;gBACA,+BAA+B,EAAE,MAAM,CAAC,WAAW,CAAC,eAAe;aACnE;YACF,CAAC,CAAC,EAAE,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO;YAC7B,CAAC,CAAC,EAAE,uBAAuB,EAAE,MAAM,CAAC,WAAW,CAAC,OAAO,EAAE;YACzD,CAAC,CAAC,EAAE,CAAC;KACN,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAChD,OAAsC;IAEtC,MAAM,QAAQ,GAAG,4BAA4B,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,MAAM,0BAA0B,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,CAAC,KAAK,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACd,6EAA6E,CAC7E,CAAC;IACH,CAAC;IACD,MAAM,kBAAkB,GACvB,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,QAAQ;QAClC,CAAC,CAAC,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,IAAI,QAAQ,CAAC;QACzD,CAAC,CAAC,QAAQ,CAAC;IACb,IAAI,gBAAgB,GAAG,iBAAiB,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;IACzE,IAAI,WAAW,GAAG,OAAO,CAAC,KAAK;QAC9B,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,+BAA+B,CACrC,eAAe,EACf,YAAY,EACZ,gBAAgB,CAChB,CAAC;IACJ,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACpC,MAAM,gBAAgB,GAAG,MAAM,0BAA0B,CACxD,eAAe,EACf,KAAK,CACL,CAAC;QACF,IAAI,gBAAgB,EAAE,CAAC;YACtB,gBAAgB,GAAG,gBAAgB,CAAC;YACpC,4BAA4B,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;YAChE,WAAW,GAAG,MAAM,+BAA+B,CAClD,eAAe,EACf,YAAY,EACZ,gBAAgB,CAChB,CAAC;QACH,CAAC;IACF,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,gBAAgB,EAC9C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACR,aAAa,EAAE,UAAU,KAAK,EAAE;YAChC,cAAc,EAAE,kBAAkB;SAClC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,QAAQ,EAAE,OAAO,CAAC,OAAO;YACzB,UAAU,EAAE,OAAO,CAAC,SAAS;YAC7B,GAAG,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM;gBAC/B,CAAC,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,YAAY,EAAE;gBACxC,CAAC,CAAC,EAAE,CAAC;YACN,MAAM,EAAE,OAAO,CAAC,KAAK;YACrB,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAClE,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA+C,CAAC;IACpD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA+B,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACR,oEAAoE;IACrE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACd,OAAO,EAAE,KAAK,IAAI,yCAAyC,CAC3D,CAAC;IACH,CAAC;IAED,OAAO;QACN,OAAO,EAAE,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO;QAC5C,SAAS,EAAE,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC;QAC3D,cAAc,EAAE,+BAA+B,CAAC,kBAAkB,CAAC;QACnE,WAAW,EAAE,kBAAkB,CAAC,kBAAkB,CAAC;QACnD,KAAK,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK;QACtC,YAAY,EAAE,kBAAkB,CAAC,OAAO,CAAC,aAAa,CAAC;QACvD,aAAa,EAAE,kBAAkB,CAAC,OAAO,CAAC,cAAc,CAAC;QACzD,eAAe,EAAE,kBAAkB,CAAC,OAAO,CAAC,gBAAgB,CAAC;QAC7D,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,SAAS,EAAE,OAAO,CAAC,UAAU,IAAI,QAAQ;KACzC,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB;IAIjC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtC,IAAI,aAAqD,CAAC;QAC1D,IAAI,YAAoC,CAAC;QAEzC,MAAM,aAAa,GAAG,IAAI,OAAO,CAAwB,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACrE,aAAa,GAAG,GAAG,CAAC;YACpB,YAAY,GAAG,GAAG,CAAC;QACpB,CAAC,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAoB,EAAE,GAAmB,EAAE,EAAE;YACzE,IAAI,4BAA4B,CAAC,GAAG,EAAE,GAAG,EAAE,aAAa,CAAC,EAAE,CAAC;gBAC3D,OAAO;YACR,CAAC;YACD,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,eAAe,CAAC,CAAC;YAC3D,IAAI,UAAU,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBAC3C,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBACrB,OAAO;YACR,CAAC;YAED,MAAM,KAAK,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACnD,IAAI,KAAK,EAAE,CAAC;gBACX,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,sDAAsD,KAAK,qDAAqD,CAChH,CAAC;gBACF,YAAY,CAAC,IAAI,KAAK,CAAC,kCAAkC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACnE,OAAO;YACR,CAAC;YAED,MAAM,WAAW,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;YAChE,MAAM,cAAc,GAAG,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;YACtE,IAAI,CAAC,WAAW,IAAI,CAAC,cAAc,EAAE,CAAC;gBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qIAAqI,CACrI,CAAC;gBACF,YAAY,CACX,IAAI,KAAK,CACR,+DAA+D,CAC/D,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YAED,IAAI,CAAC;gBACJ,MAAM,SAAS,GAAG,cAAc,CAC/B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,CACzC,CAAC;gBACF,MAAM,YAAY,GACjB,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,eAAe,CAAC,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;gBACnE,MAAM,qBAAqB,GAC1B,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;gBACnD,MAAM,gBAAgB,GAAG,qBAAqB;oBAC7C,CAAC,CAAC,cAAc,CAAC,qBAAqB,EAAE,oBAAoB,CAAC;oBAC7D,CAAC,CAAC,SAAS,CAAC;gBACb,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;gBAEjE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,qHAAqH,CACrH,CAAC;gBACF,aAAa,CAAC;oBACb,WAAW;oBACX,SAAS;oBACT,cAAc;oBACd,gBAAgB;oBAChB,YAAY;oBACZ,MAAM;iBACN,CAAC,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAChB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CACN,2CAA2C,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,qDAAqD,CACtJ,CAAC;gBACF,YAAY,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzE,CAAC;QACF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAA4B,EAAE,EAAE;YACnD,IAAI,KAAK,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;gBACjC,MAAM,CACL,IAAI,KAAK,CACR,QAAQ,aAAa,uEAAuE,CAC5F,CACD,CAAC;gBACF,OAAO;YACR,CAAC;YACD,MAAM,CAAC,KAAK,CAAC,CAAC;QACf,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,EAAE,GAAG,EAAE;YAC9C,OAAO,CAAC;gBACP,MAAM;gBACN,SAAS,EAAE,GAAG,EAAE,CAAC,aAAa;aAC9B,CAAC,CAAC;QACJ,CAAC,CAAC,CAAC;IACJ,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,MAAc;IAClC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC9B,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,kBAAkB,CAChC,eAAuB,EACvB,cAAkC,EAClC,QAAmC;IAEnC,QAAQ,EAAE,CAAC,yCAAyC,CAAC,CAAC;IACtD,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,eAAe,EAC7C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,YAAY,EAAE,YAAY;YAC1B,aAAa,EAAE,OAAO;YACtB,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,EAAE,gBAAgB;YACxB,MAAM,EAAE,CAAC,cAAc,CAAC;SACxB,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA0B,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACR,sEAAsE;IACvE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,CAAC;QACjD,IAAI,OAAO,EAAE,KAAK,KAAK,0BAA0B,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CACd,qBAAqB,YAAY,8DAA8D,CAC/F,CAAC;QACH,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,+BAA+B,CAAC,CAAC;IACpE,CAAC;IAED,OAAO,OAAO,CAAC,iBAAiB,CAAC;AAClC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CACjC,SAAgC,EAChC,QAAmC;IAEnC,MAAM,eAAe,GAAG,kBAAkB,EAAE,CAAC;IAC7C,MAAM,cAAc,GAAG,2BAA2B,EAAE,CAAC;IACrD,MAAM,WAAW,GAAG,cAAc,EAAE,CAAC;IACrC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAE1D,IAAI,CAAC;QACJ,MAAM,gBAAgB,GAAG,MAAM,kBAAkB,CAChD,eAAe,EACf,cAAc,EACd,QAAQ,CACR,CAAC;QACF,QAAQ,EAAE,CAAC,0CAA0C,CAAC,CAAC;QACvD,SAAS,CAAC,gBAAgB,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACjC,SAAS,EAAE;YACX,IAAI,OAAO,CAAwB,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;gBAChD,MAAM,OAAO,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC,EAClE,CAAC,GAAG,EAAE,GAAG,IAAI,CACb,CAAC;gBACF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,CAAC,CAAC;SACF,CAAC,CAAC;QAEH,MAAM,WAAW,GAAqB;YACrC,IAAI,EAAE,OAAO;YACb,MAAM,EAAE,MAAM,CAAC,WAAW;YAC1B,OAAO,EAAE,MAAM,CAAC,YAAY,IAAI,EAAE;YAClC,OAAO,EAAE,MAAM,CAAC,SAAS;YACzB,QAAQ,EAAE;gBACT,eAAe;gBACf,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,WAAW;gBACX,GAAG,CAAC,MAAM,CAAC,gBAAgB;oBAC1B,CAAC,CAAC,EAAE,gBAAgB,EAAE,MAAM,CAAC,gBAAgB,EAAE;oBAC/C,CAAC,CAAC,EAAE,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM;aACrB;SACD,CAAC;QACF,oBAAoB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAC7C,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CACjD,eAAe,EACf,MAAM,CAAC,WAAW,EAClB,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAC/B,CAAC;QACF,IAAI,QAAQ,EAAE,CAAC;YACd,oBAAoB,CAAC,SAAS,EAAE;gBAC/B,GAAG,WAAW;gBACd,QAAQ,EAAE;oBACT,GAAG,WAAW,CAAC,QAAQ;oBACvB,QAAQ;iBACR;aACD,CAAC,CAAC;QACJ,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,kCAAkC,EAAE;YAC/C,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,QAAQ,EAAE,WAAW,CAAC,QAAQ;YAC9B,WAAW,EAAE,WAAW,CAAC,WAAW;SACpC,CAAC,CAAC;IACJ,CAAC;YAAS,CAAC;QACV,MAAM,WAAW,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACxC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,WAAW,GAAG,MAAM,+BAA+B,CACxD,eAAe,EACf,SAAS,EACT,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CACvC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAC1C;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACpB,aAAa,EAAE,YAAY;YAC3B,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACrD,CAAC;KACF,CACD,CAAC;IAEF,IAAI,OAA4C,CAAC;IACjD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,CAAC;IAC9D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,YAAY,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACnE,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,8BAA8B,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IACjE,MAAM,gBAAgB,GACrB,OAAO,OAAO,CAAC,aAAa,KAAK,QAAQ;QACzC,OAAO,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,aAAa;QACvB,CAAC,CAAC,YAAY,CAAC;IACjB,MAAM,MAAM,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,MAAM,gBAAgB,GACrB,OAAO,CAAC,kBAAkB,IAAI,IAAI;QACjC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC,kBAAkB,EAAE,oBAAoB,CAAC;QAClE,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACpD,MAAM,gBAAgB,GAAG,iBAAiB,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACjE,MAAM,oBAAoB,GAAqB;QAC9C,IAAI,EAAE,OAAO;QACb,MAAM,EAAE,OAAO,CAAC,YAAY;QAC5B,OAAO,EAAE,gBAAgB;QACzB,OAAO;QACP,QAAQ,EAAE;YACT,GAAG,QAAQ;YACX,eAAe;YACf,cAAc,EACb,OAAO,OAAO,CAAC,eAAe,KAAK,QAAQ;gBAC3C,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBACjC,CAAC,CAAC,OAAO,CAAC,eAAe;gBACzB,CAAC,CAAC,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjD,GAAG,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,iBAAiB,CAAC,QAAQ,CAAC;SAChE;KACD,CAAC;IACF,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,oBAAoB,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,gBAAgB,GAAG,WAAW;QACnC,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,MAAM,0BAA0B,CAAC,eAAe,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IAC3E,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvB,OAAO,oBAAoB,CAAC;IAC7B,CAAC;IAED,MAAM,mBAAmB,GAAqB;QAC7C,GAAG,oBAAoB;QACvB,QAAQ,EAAE;YACT,GAAG,oBAAoB,CAAC,QAAQ;YAChC,QAAQ,EAAE,gBAAgB;SAC1B;KACD,CAAC;IACF,oBAAoB,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;IACrD,OAAO,mBAAmB,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACvC,YAAoB,EACpB,QAAkC;IAElC,IAAI,CAAC,YAAY,EAAE,CAAC;QACnB,OAAO;IACR,CAAC;IAED,MAAM,eAAe,GACpB,iBAAiB,CAAC,QAAQ,EAAE,iBAAiB,CAAC,IAAI,kBAAkB,EAAE,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,aAAa,CACnC,eAAe,EACf,oBAAoB,CAAC,QAAQ,CAAC,WAAW,EACzC;QACC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,YAAY,EAAE,CAAC;KACrD,CACD,CAAC;IAEF,IAAI,OAA2C,CAAC;IAChD,IAAI,CAAC;QACJ,OAAO,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2B,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACR,+DAA+D;IAChE,CAAC;IAED,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,OAAO,EAAE,KAAK,IAAI,6BAA6B,CAAC,CAAC;IAClE,CAAC;AACF,CAAC","sourcesContent":["import {\n\ttype IncomingMessage,\n\ttype Server,\n\ttype ServerResponse,\n\tcreateServer,\n} from \"node:http\";\nimport { EVALOPS_ORGANIZATION_ID_ENV_VARS } from \"../evalops/env-aliases.js\";\nimport { PLATFORM_HTTP_ROUTES } from \"../platform/core-services.js\";\nimport { fetchDownstream } from \"../utils/downstream-http.js\";\nimport { isRecord } from \"../utils/json.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport { rejectDisallowedLoopbackHost } from \"../utils/loopback-http.js\";\nimport {\n\tbuildDesktopDeviceProof,\n\tbuildEnrolledDesktopDeviceProof,\n\tenrollDesktopDeviceIdentity,\n} from \"./device-identity.js\";\nimport {\n\ttype OAuthCredentials,\n\tloadOAuthCredentials,\n\tsaveOAuthCredentials,\n} from \"./storage.js\";\n\nconst logger = createLogger(\"oauth:evalops\");\n\nconst CALLBACK_PORT = 1460;\nconst CALLBACK_PATH = \"/auth/callback/evalops\";\nconst CALLBACK_ORIGIN = `http://127.0.0.1:${CALLBACK_PORT}`;\nconst CALLBACK_URI = `${CALLBACK_ORIGIN}${CALLBACK_PATH}`;\nconst DEFAULT_IDENTITY_URL = \"https://identity.evalops.dev\";\nconst IDENTITY_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_IDENTITY_URL\",\n\t\"EVALOPS_IDENTITY_URL\",\n] as const;\nconst SHARED_PLATFORM_BASE_URL_ENV_VARS = [\n\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\"EVALOPS_BASE_URL\",\n] as const;\nconst DEFAULT_PROVIDER_REF_PROVIDER = \"openai\";\nconst DEFAULT_PROVIDER_REF_ENVIRONMENT = \"prod\";\nconst DEFAULT_IDENTITY_TIMEOUT_MS = 10_000;\nconst DEFAULT_IDENTITY_MAX_ATTEMPTS = 2;\nconst REQUIRED_SCOPE = \"llm_gateway:invoke\";\n\ninterface IdentityStartResponse {\n\tauthorization_url?: string;\n\terror?: string;\n}\n\ninterface IdentityRefreshResponse {\n\taccess_token?: string;\n\terror?: string;\n\texpires_at?: string;\n\torganization_id?: string;\n\trefresh_expires_at?: string;\n\trefresh_token?: string;\n\tscopes?: unknown;\n}\n\ninterface IdentityRevokeResponse {\n\terror?: string;\n\trevoked?: boolean;\n}\n\ninterface IdentityDelegationResponse {\n\tagent_id?: string;\n\terror?: string;\n\texpires_at?: string;\n\trun_id?: string;\n\tscopes_denied?: unknown;\n\tscopes_granted?: unknown;\n\tscopes_requested?: unknown;\n\ttoken?: string;\n\ttoken_type?: string;\n}\n\nexport interface EvalOpsProviderRef {\n\tprovider: string;\n\tenvironment: string;\n\tcredential_name?: string;\n\tteam_id?: string;\n}\n\ninterface EvalOpsCallbackResult {\n\taccessToken: string;\n\texpiresAt: number;\n\torganizationId: string;\n\trefreshExpiresAt?: number;\n\trefreshToken?: string;\n\tscopes: string[];\n}\n\nexport interface EvalOpsDelegationTokenRequest {\n\tagentId: string;\n\tagentType: string;\n\tcapabilities?: string[];\n\tmetadata?: Record<string, unknown>;\n\trunId: string;\n\tscopes?: string[];\n\tsurface: string;\n\ttoken?: string;\n\tttlSeconds?: number;\n}\n\nexport interface EvalOpsDelegationTokenResult {\n\tagentId: string;\n\texpiresAt: number;\n\torganizationId: string;\n\tproviderRef: EvalOpsProviderRef;\n\trunId: string;\n\tscopesDenied: string[];\n\tscopesGranted: string[];\n\tscopesRequested: string[];\n\ttoken: string;\n\ttokenType: string;\n}\n\nfunction getEnvValue(names: readonly string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = process.env[name]?.trim();\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction normalizeIdentityBaseUrl(\n\tbaseUrl: string,\n\tsuffixes: readonly string[] = [],\n): string {\n\tlet normalized = baseUrl.trim().replace(/\\/+$/u, \"\");\n\tfor (const suffix of suffixes) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = normalized.slice(0, -suffix.length).replace(/\\/+$/u, \"\");\n\t\t}\n\t}\n\treturn normalized;\n}\n\nfunction getIdentityBaseUrl(): string {\n\treturn normalizeIdentityBaseUrl(\n\t\tgetEnvValue([\n\t\t\t...IDENTITY_BASE_URL_ENV_VARS,\n\t\t\t...SHARED_PLATFORM_BASE_URL_ENV_VARS,\n\t\t]) ?? DEFAULT_IDENTITY_URL,\n\t\tObject.values(PLATFORM_HTTP_ROUTES.identity),\n\t);\n}\n\nfunction getIdentityTimeoutMs(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t\t\"EVALOPS_IDENTITY_TIMEOUT_MS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_TIMEOUT_MS,\n\t);\n}\n\nfunction getIdentityMaxAttempts(): number {\n\treturn parsePositiveInt(\n\t\tgetEnvValue([\n\t\t\t\"MAESTRO_EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t\t\"EVALOPS_IDENTITY_MAX_ATTEMPTS\",\n\t\t]),\n\t\tDEFAULT_IDENTITY_MAX_ATTEMPTS,\n\t);\n}\n\nfunction fetchIdentity(\n\tidentityBaseUrl: string,\n\tpath: string,\n\tinit: RequestInit,\n): Promise<Response> {\n\treturn fetchDownstream(`${identityBaseUrl}${path}`, init, {\n\t\tserviceName: \"EvalOps identity service\",\n\t\tfailureMode: \"required\",\n\t\ttimeoutMs: getIdentityTimeoutMs(),\n\t\tmaxAttempts: getIdentityMaxAttempts(),\n\t});\n}\n\nfunction getConfiguredOrganizationId(): string | undefined {\n\tconst organizationId = getEnvValue(EVALOPS_ORGANIZATION_ID_ENV_VARS);\n\treturn organizationId;\n}\n\nfunction getProviderRef(): EvalOpsProviderRef {\n\tconst credentialName = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_CREDENTIAL_NAME\",\n\t\t\"MAESTRO_LLM_GATEWAY_CREDENTIAL_NAME\",\n\t]);\n\tconst teamID = getEnvValue([\n\t\t\"MAESTRO_EVALOPS_TEAM_ID\",\n\t\t\"MAESTRO_LLM_GATEWAY_TEAM_ID\",\n\t]);\n\treturn {\n\t\tprovider:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_PROVIDER\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_PROVIDER\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_PROVIDER,\n\t\tenvironment:\n\t\t\tgetEnvValue([\n\t\t\t\t\"MAESTRO_EVALOPS_ENVIRONMENT\",\n\t\t\t\t\"MAESTRO_LLM_GATEWAY_ENVIRONMENT\",\n\t\t\t]) ?? DEFAULT_PROVIDER_REF_ENVIRONMENT,\n\t\t...(credentialName ? { credential_name: credentialName } : {}),\n\t\t...(teamID ? { team_id: teamID } : {}),\n\t};\n}\n\nfunction parseExpiresAt(value: string | null): number {\n\treturn parseTimestamp(value, \"expires_at\");\n}\n\nfunction parseTimestamp(\n\tvalue: string | null | undefined,\n\tfieldName: string,\n): number {\n\tif (!value) {\n\t\tthrow new Error(`Missing ${fieldName} in EvalOps response`);\n\t}\n\tconst expiresAt = Date.parse(value);\n\tif (Number.isNaN(expiresAt)) {\n\t\tthrow new Error(`Invalid ${fieldName} in EvalOps response: ${value}`);\n\t}\n\treturn expiresAt;\n}\n\nfunction parseScopes(value: string | null): string[] {\n\tif (!value) {\n\t\treturn [REQUIRED_SCOPE];\n\t}\n\treturn value\n\t\t.split(\" \")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction parseScopesPayload(value: unknown): string[] {\n\tif (!Array.isArray(value)) {\n\t\treturn [];\n\t}\n\treturn value\n\t\t.filter((entry): entry is string => typeof entry === \"string\")\n\t\t.map((entry) => entry.trim())\n\t\t.filter((entry) => entry.length > 0);\n}\n\nfunction getMetadataString(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): string | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"string\" && value.trim().length > 0\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataNumber(\n\tmetadata: Record<string, unknown> | undefined,\n\tkey: string,\n): number | undefined {\n\tconst value = metadata?.[key];\n\treturn typeof value === \"number\" && Number.isFinite(value)\n\t\t? value\n\t\t: undefined;\n}\n\nfunction getMetadataScopes(\n\tmetadata: Record<string, unknown> | undefined,\n): string[] {\n\treturn parseScopesPayload(metadata?.scopes);\n}\n\nfunction resolveProviderRef(\n\tmetadata: Record<string, unknown> | undefined,\n): EvalOpsProviderRef {\n\tconst fallback = getProviderRef();\n\tconst providerRef = isRecord(metadata?.providerRef)\n\t\t? metadata.providerRef\n\t\t: undefined;\n\treturn {\n\t\tprovider: getMetadataString(providerRef, \"provider\") ?? fallback.provider,\n\t\tenvironment:\n\t\t\tgetMetadataString(providerRef, \"environment\") ?? fallback.environment,\n\t\t...(getMetadataString(providerRef, \"credential_name\")\n\t\t\t? {\n\t\t\t\t\tcredential_name: getMetadataString(providerRef, \"credential_name\"),\n\t\t\t\t}\n\t\t\t: fallback.credential_name\n\t\t\t\t? { credential_name: fallback.credential_name }\n\t\t\t\t: {}),\n\t\t...(getMetadataString(providerRef, \"team_id\")\n\t\t\t? { team_id: getMetadataString(providerRef, \"team_id\") }\n\t\t\t: fallback.team_id\n\t\t\t\t? { team_id: fallback.team_id }\n\t\t\t\t: {}),\n\t};\n}\n\nfunction resolveStoredEvalOpsMetadata(\n\tmetadata?: Record<string, unknown>,\n): Record<string, unknown> | undefined {\n\tif (metadata) {\n\t\treturn metadata;\n\t}\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\treturn stored?.metadata;\n}\n\nfunction resolveDelegationOrganizationId(\n\tmetadata: Record<string, unknown> | undefined,\n): string {\n\tconst organizationId =\n\t\tgetMetadataString(metadata, \"organizationId\") ??\n\t\tgetConfiguredOrganizationId();\n\tif (!organizationId) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires an organization id from /login evalops or MAESTRO_EVALOPS_ORG_ID.\",\n\t\t);\n\t}\n\treturn organizationId;\n}\n\nasync function enrollCurrentDesktopDevice(\n\tidentityBaseUrl: string,\n\taccessToken: string,\n): Promise<string | undefined> {\n\ttry {\n\t\treturn (\n\t\t\t(await enrollDesktopDeviceIdentity(\n\t\t\t\tidentityBaseUrl,\n\t\t\t\taccessToken,\n\t\t\t\tprocess.env.npm_package_version,\n\t\t\t)) ?? undefined\n\t\t);\n\t} catch (error) {\n\t\tlogger.warn(\"EvalOps desktop device enrollment skipped\", {\n\t\t\terrorType: error instanceof Error ? error.name : \"unknown\",\n\t\t});\n\t\treturn undefined;\n\t}\n}\n\nfunction persistStoredEvalOpsDeviceId(\n\tidentityBaseUrl: string,\n\tdeviceId: string,\n): void {\n\tconst stored = loadOAuthCredentials(\"evalops\");\n\tif (!stored) {\n\t\treturn;\n\t}\n\tsaveOAuthCredentials(\"evalops\", {\n\t\t...stored,\n\t\tmetadata: {\n\t\t\t...stored.metadata,\n\t\t\tidentityBaseUrl,\n\t\t\tdeviceId,\n\t\t},\n\t});\n}\n\nasync function getFreshEvalOpsAccessToken(\n\tmetadata?: Record<string, unknown>,\n): Promise<string | null> {\n\tconst credentials = loadOAuthCredentials(\"evalops\");\n\tif (!credentials) {\n\t\treturn null;\n\t}\n\tif (Date.now() < credentials.expires - 60_000) {\n\t\treturn credentials.access;\n\t}\n\tconst refreshed = await refreshEvalOpsToken(\n\t\tcredentials.refresh,\n\t\tmetadata ?? credentials.metadata,\n\t);\n\tsaveOAuthCredentials(\"evalops\", refreshed);\n\treturn refreshed.access;\n}\n\nexport function buildEvalOpsDelegationEnvironment(\n\tresult: Pick<\n\t\tEvalOpsDelegationTokenResult,\n\t\t\"organizationId\" | \"providerRef\" | \"token\"\n\t> &\n\t\tPartial<Pick<EvalOpsDelegationTokenResult, \"agentId\" | \"runId\">>,\n): Record<string, string> {\n\treturn {\n\t\tMAESTRO_EVALOPS_ACCESS_TOKEN: result.token,\n\t\tMAESTRO_EVALOPS_ORG_ID: result.organizationId,\n\t\tMAESTRO_EVALOPS_PROVIDER: result.providerRef.provider,\n\t\tMAESTRO_EVALOPS_ENVIRONMENT: result.providerRef.environment,\n\t\t...(result.agentId\n\t\t\t? {\n\t\t\t\t\tMAESTRO_AGENT_ID: result.agentId,\n\t\t\t\t\tMAESTRO_EVALOPS_AGENT_ID: result.agentId,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.runId ? { MAESTRO_EVALOPS_RUN_ID: result.runId } : {}),\n\t\t...(result.providerRef.credential_name\n\t\t\t? {\n\t\t\t\t\tMAESTRO_EVALOPS_CREDENTIAL_NAME: result.providerRef.credential_name,\n\t\t\t\t}\n\t\t\t: {}),\n\t\t...(result.providerRef.team_id\n\t\t\t? { MAESTRO_EVALOPS_TEAM_ID: result.providerRef.team_id }\n\t\t\t: {}),\n\t};\n}\n\nexport async function issueEvalOpsDelegationToken(\n\trequest: EvalOpsDelegationTokenRequest,\n): Promise<EvalOpsDelegationTokenResult> {\n\tconst metadata = resolveStoredEvalOpsMetadata(request.metadata);\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst token = request.token ?? (await getFreshEvalOpsAccessToken(metadata));\n\tif (!token) {\n\t\tthrow new Error(\n\t\t\t\"EvalOps delegation requires a valid access token. Run /login evalops first.\",\n\t\t);\n\t}\n\tconst delegationMetadata =\n\t\t!request.token && !request.metadata\n\t\t\t? (loadOAuthCredentials(\"evalops\")?.metadata ?? metadata)\n\t\t\t: metadata;\n\tlet enrolledDeviceId = getMetadataString(delegationMetadata, \"deviceId\");\n\tlet deviceProof = request.token\n\t\t? undefined\n\t\t: await buildEnrolledDesktopDeviceProof(\n\t\t\t\tidentityBaseUrl,\n\t\t\t\t\"delegation\",\n\t\t\t\tenrolledDeviceId,\n\t\t\t);\n\tif (!deviceProof && !request.token) {\n\t\tconst migratedDeviceId = await enrollCurrentDesktopDevice(\n\t\t\tidentityBaseUrl,\n\t\t\ttoken,\n\t\t);\n\t\tif (migratedDeviceId) {\n\t\t\tenrolledDeviceId = migratedDeviceId;\n\t\t\tpersistStoredEvalOpsDeviceId(identityBaseUrl, migratedDeviceId);\n\t\t\tdeviceProof = await buildEnrolledDesktopDeviceProof(\n\t\t\t\tidentityBaseUrl,\n\t\t\t\t\"delegation\",\n\t\t\t\tenrolledDeviceId,\n\t\t\t);\n\t\t}\n\t}\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.delegationTokens,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: {\n\t\t\t\tAuthorization: `Bearer ${token}`,\n\t\t\t\t\"Content-Type\": \"application/json\",\n\t\t\t},\n\t\t\tbody: JSON.stringify({\n\t\t\t\tagent_id: request.agentId,\n\t\t\t\tagent_type: request.agentType,\n\t\t\t\t...(request.capabilities?.length\n\t\t\t\t\t? { capabilities: request.capabilities }\n\t\t\t\t\t: {}),\n\t\t\t\trun_id: request.runId,\n\t\t\t\t...(request.scopes?.length ? { scopes: request.scopes } : {}),\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t\tsurface: request.surface,\n\t\t\t\t...(request.ttlSeconds ? { ttl_seconds: request.ttlSeconds } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityDelegationResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityDelegationResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.token || !payload.expires_at) {\n\t\tthrow new Error(\n\t\t\tpayload?.error ?? \"EvalOps delegation token request failed\",\n\t\t);\n\t}\n\n\treturn {\n\t\tagentId: payload.agent_id ?? request.agentId,\n\t\texpiresAt: parseTimestamp(payload.expires_at, \"expires_at\"),\n\t\torganizationId: resolveDelegationOrganizationId(delegationMetadata),\n\t\tproviderRef: resolveProviderRef(delegationMetadata),\n\t\trunId: payload.run_id ?? request.runId,\n\t\tscopesDenied: parseScopesPayload(payload.scopes_denied),\n\t\tscopesGranted: parseScopesPayload(payload.scopes_granted),\n\t\tscopesRequested: parseScopesPayload(payload.scopes_requested),\n\t\ttoken: payload.token,\n\t\ttokenType: payload.token_type ?? \"Bearer\",\n\t};\n}\n\nasync function startCallbackServer(): Promise<{\n\tserver: Server;\n\tgetResult: () => Promise<EvalOpsCallbackResult>;\n}> {\n\treturn new Promise((resolve, reject) => {\n\t\tlet resultResolve: (value: EvalOpsCallbackResult) => void;\n\t\tlet resultReject: (error: Error) => void;\n\n\t\tconst resultPromise = new Promise<EvalOpsCallbackResult>((res, rej) => {\n\t\t\tresultResolve = res;\n\t\t\tresultReject = rej;\n\t\t});\n\n\t\tconst server = createServer((req: IncomingMessage, res: ServerResponse) => {\n\t\t\tif (rejectDisallowedLoopbackHost(req, res, CALLBACK_PORT)) {\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tconst requestUrl = new URL(req.url ?? \"\", CALLBACK_ORIGIN);\n\t\t\tif (requestUrl.pathname !== CALLBACK_PATH) {\n\t\t\t\tres.writeHead(404);\n\t\t\t\tres.end(\"Not found\");\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst error = requestUrl.searchParams.get(\"error\");\n\t\t\tif (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>EvalOps Login Failed</h1><p>Error: ${error}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(new Error(`EvalOps identity login failed: ${error}`));\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\tconst accessToken = requestUrl.searchParams.get(\"access_token\");\n\t\t\tconst organizationId = requestUrl.searchParams.get(\"organization_id\");\n\t\t\tif (!accessToken || !organizationId) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Invalid Callback</h1><p>Missing access_token or organization_id.</p><p>You can close this window.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultReject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t\"EvalOps callback was missing access_token or organization_id.\",\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\n\t\t\ttry {\n\t\t\t\tconst expiresAt = parseExpiresAt(\n\t\t\t\t\trequestUrl.searchParams.get(\"expires_at\"),\n\t\t\t\t);\n\t\t\t\tconst refreshToken =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_token\")?.trim() || undefined;\n\t\t\t\tconst refreshExpiresAtValue =\n\t\t\t\t\trequestUrl.searchParams.get(\"refresh_expires_at\");\n\t\t\t\tconst refreshExpiresAt = refreshExpiresAtValue\n\t\t\t\t\t? parseTimestamp(refreshExpiresAtValue, \"refresh_expires_at\")\n\t\t\t\t\t: undefined;\n\t\t\t\tconst scopes = parseScopes(requestUrl.searchParams.get(\"scope\"));\n\n\t\t\t\tres.writeHead(200, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t\"<html><body><h1>Authentication Successful</h1><p>You can close this window and return to Maestro.</p></body></html>\",\n\t\t\t\t);\n\t\t\t\tresultResolve({\n\t\t\t\t\taccessToken,\n\t\t\t\t\texpiresAt,\n\t\t\t\t\torganizationId,\n\t\t\t\t\trefreshExpiresAt,\n\t\t\t\t\trefreshToken,\n\t\t\t\t\tscopes,\n\t\t\t\t});\n\t\t\t} catch (error) {\n\t\t\t\tres.writeHead(400, { \"Content-Type\": \"text/html\" });\n\t\t\t\tres.end(\n\t\t\t\t\t`<html><body><h1>Invalid Callback</h1><p>${error instanceof Error ? error.message : String(error)}</p><p>You can close this window.</p></body></html>`,\n\t\t\t\t);\n\t\t\t\tresultReject(error instanceof Error ? error : new Error(String(error)));\n\t\t\t}\n\t\t});\n\n\t\tserver.on(\"error\", (error: NodeJS.ErrnoException) => {\n\t\t\tif (error.code === \"EADDRINUSE\") {\n\t\t\t\treject(\n\t\t\t\t\tnew Error(\n\t\t\t\t\t\t`Port ${CALLBACK_PORT} is already in use. Close the other process and retry /login evalops.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\treject(error);\n\t\t});\n\n\t\tserver.listen(CALLBACK_PORT, \"127.0.0.1\", () => {\n\t\t\tresolve({\n\t\t\t\tserver,\n\t\t\t\tgetResult: () => resultPromise,\n\t\t\t});\n\t\t});\n\t});\n}\n\nfunction closeServer(server: Server): Promise<void> {\n\treturn new Promise((resolve) => {\n\t\tserver.close(() => resolve());\n\t});\n}\n\nasync function startIdentityLogin(\n\tidentityBaseUrl: string,\n\torganizationId: string | undefined,\n\tonStatus?: (status: string) => void,\n): Promise<string> {\n\tonStatus?.(\"Requesting EvalOps managed login URL...\");\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.authGoogleStart,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\tredirect_uri: CALLBACK_URI,\n\t\t\t\tresponse_mode: \"query\",\n\t\t\t\t...(organizationId ? { organization_id: organizationId } : {}),\n\t\t\t\tprompt: \"select_account\",\n\t\t\t\tscopes: [REQUIRED_SCOPE],\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityStartResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityStartResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and fall back to a generic message below.\n\t}\n\n\tif (!response.ok || !payload?.authorization_url) {\n\t\tif (payload?.error === \"redirect_uri_not_allowed\") {\n\t\t\tthrow new Error(\n\t\t\t\t`Identity rejected ${CALLBACK_URI}. Add it to IDENTITY_GOOGLE_ALLOWED_REDIRECT_URIS and retry.`,\n\t\t\t);\n\t\t}\n\t\tthrow new Error(payload?.error ?? \"EvalOps identity start failed\");\n\t}\n\n\treturn payload.authorization_url;\n}\n\nexport async function loginEvalOps(\n\tonAuthUrl: (url: string) => void,\n\tonStatus?: (status: string) => void,\n): Promise<void> {\n\tconst identityBaseUrl = getIdentityBaseUrl();\n\tconst organizationId = getConfiguredOrganizationId();\n\tconst providerRef = getProviderRef();\n\tconst { server, getResult } = await startCallbackServer();\n\n\ttry {\n\t\tconst authorizationUrl = await startIdentityLogin(\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId,\n\t\t\tonStatus,\n\t\t);\n\t\tonStatus?.(\"Waiting for EvalOps identity callback...\");\n\t\tonAuthUrl(authorizationUrl);\n\n\t\tconst result = await Promise.race([\n\t\t\tgetResult(),\n\t\t\tnew Promise<EvalOpsCallbackResult>((_, reject) => {\n\t\t\t\tconst timeout = setTimeout(\n\t\t\t\t\t() => reject(new Error(\"EvalOps login timed out after 5 minutes\")),\n\t\t\t\t\t5 * 60 * 1000,\n\t\t\t\t);\n\t\t\t\ttimeout.unref?.();\n\t\t\t}),\n\t\t]);\n\n\t\tconst credentials: OAuthCredentials = {\n\t\t\ttype: \"oauth\",\n\t\t\taccess: result.accessToken,\n\t\t\trefresh: result.refreshToken ?? \"\",\n\t\t\texpires: result.expiresAt,\n\t\t\tmetadata: {\n\t\t\t\tidentityBaseUrl,\n\t\t\t\torganizationId: result.organizationId,\n\t\t\t\tproviderRef,\n\t\t\t\t...(result.refreshExpiresAt\n\t\t\t\t\t? { refreshExpiresAt: result.refreshExpiresAt }\n\t\t\t\t\t: {}),\n\t\t\t\tscopes: result.scopes,\n\t\t\t},\n\t\t};\n\t\tsaveOAuthCredentials(\"evalops\", credentials);\n\t\tconst deviceId = await enrollDesktopDeviceIdentity(\n\t\t\tidentityBaseUrl,\n\t\t\tresult.accessToken,\n\t\t\tprocess.env.npm_package_version,\n\t\t);\n\t\tif (deviceId) {\n\t\t\tsaveOAuthCredentials(\"evalops\", {\n\t\t\t\t...credentials,\n\t\t\t\tmetadata: {\n\t\t\t\t\t...credentials.metadata,\n\t\t\t\t\tdeviceId,\n\t\t\t\t},\n\t\t\t});\n\t\t}\n\t\tlogger.info(\"EvalOps managed login successful\", {\n\t\t\torganizationId: result.organizationId,\n\t\t\tprovider: providerRef.provider,\n\t\t\tenvironment: providerRef.environment,\n\t\t});\n\t} finally {\n\t\tawait closeServer(server);\n\t}\n}\n\nexport async function refreshEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<OAuthCredentials> {\n\tif (!refreshToken) {\n\t\tthrow new Error(\"EvalOps refresh token missing. Run /login evalops again.\");\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst deviceProof = await buildEnrolledDesktopDeviceProof(\n\t\tidentityBaseUrl,\n\t\t\"refresh\",\n\t\tgetMetadataString(metadata, \"deviceId\"),\n\t);\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRefresh,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({\n\t\t\t\trefresh_token: refreshToken,\n\t\t\t\t...(deviceProof ? { device_proof: deviceProof } : {}),\n\t\t\t}),\n\t\t},\n\t);\n\n\tlet payload: IdentityRefreshResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRefreshResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok || !payload?.access_token || !payload.expires_at) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token refresh failed\");\n\t}\n\n\tconst expires = parseTimestamp(payload.expires_at, \"expires_at\");\n\tconst nextRefreshToken =\n\t\ttypeof payload.refresh_token === \"string\" &&\n\t\tpayload.refresh_token.trim().length > 0\n\t\t\t? payload.refresh_token\n\t\t\t: refreshToken;\n\tconst scopes = parseScopesPayload(payload.scopes);\n\tconst refreshExpiresAt =\n\t\tpayload.refresh_expires_at != null\n\t\t\t? parseTimestamp(payload.refresh_expires_at, \"refresh_expires_at\")\n\t\t\t: getMetadataNumber(metadata, \"refreshExpiresAt\");\n\tconst existingDeviceId = getMetadataString(metadata, \"deviceId\");\n\tconst refreshedCredentials: OAuthCredentials = {\n\t\ttype: \"oauth\",\n\t\taccess: payload.access_token,\n\t\trefresh: nextRefreshToken,\n\t\texpires,\n\t\tmetadata: {\n\t\t\t...metadata,\n\t\t\tidentityBaseUrl,\n\t\t\torganizationId:\n\t\t\t\ttypeof payload.organization_id === \"string\" &&\n\t\t\t\tpayload.organization_id.length > 0\n\t\t\t\t\t? payload.organization_id\n\t\t\t\t\t: getMetadataString(metadata, \"organizationId\"),\n\t\t\t...(refreshExpiresAt ? { refreshExpiresAt } : {}),\n\t\t\t...(existingDeviceId ? { deviceId: existingDeviceId } : {}),\n\t\t\tscopes: scopes.length > 0 ? scopes : getMetadataScopes(metadata),\n\t\t},\n\t};\n\tif (!deviceProof) {\n\t\tsaveOAuthCredentials(\"evalops\", refreshedCredentials);\n\t}\n\n\tconst migratedDeviceId = deviceProof\n\t\t? undefined\n\t\t: await enrollCurrentDesktopDevice(identityBaseUrl, payload.access_token);\n\tif (!migratedDeviceId) {\n\t\treturn refreshedCredentials;\n\t}\n\n\tconst migratedCredentials: OAuthCredentials = {\n\t\t...refreshedCredentials,\n\t\tmetadata: {\n\t\t\t...refreshedCredentials.metadata,\n\t\t\tdeviceId: migratedDeviceId,\n\t\t},\n\t};\n\tsaveOAuthCredentials(\"evalops\", migratedCredentials);\n\treturn migratedCredentials;\n}\n\nexport async function revokeEvalOpsToken(\n\trefreshToken: string,\n\tmetadata?: Record<string, unknown>,\n): Promise<void> {\n\tif (!refreshToken) {\n\t\treturn;\n\t}\n\n\tconst identityBaseUrl =\n\t\tgetMetadataString(metadata, \"identityBaseUrl\") ?? getIdentityBaseUrl();\n\tconst response = await fetchIdentity(\n\t\tidentityBaseUrl,\n\t\tPLATFORM_HTTP_ROUTES.identity.tokenRevoke,\n\t\t{\n\t\t\tmethod: \"POST\",\n\t\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\t\tbody: JSON.stringify({ refresh_token: refreshToken }),\n\t\t},\n\t);\n\n\tlet payload: IdentityRevokeResponse | undefined;\n\ttry {\n\t\tpayload = (await response.json()) as IdentityRevokeResponse;\n\t} catch {\n\t\t// Ignore JSON parse failure and surface a generic error below.\n\t}\n\n\tif (!response.ok) {\n\t\tthrow new Error(payload?.error ?? \"EvalOps token revoke failed\");\n\t}\n}\n"]}

package/dist/packages/discovery.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/packages/discovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAe,MAAM,YAAY,CAAC;AAIjE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAgE7E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAMlE"}
+{"version":3,"file":"discovery.d.ts","sourceRoot":"","sources":["../../src/packages/discovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,iBAAiB,EAAe,MAAM,YAAY,CAAC;AAIjE;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAiE7E;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAMlE"}

package/dist/packages/discovery.js

@@ -39,6 +39,7 @@ export function discoverPackage(packagePath) {
             const manifest = packageJson.maestro;
             // Validate that resource paths are arrays
             for (const key of [
+                "agents",
                 "extensions",
                 "skills",
                 "prompts",

package/dist/packages/discovery.js.map

@@ -1 +1 @@
-{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/packages/discovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IAClD,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAE1D,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;QAEvD,2BAA2B;QAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,WAAW;gBACX,gBAAgB,EAAE,KAAK;gBACvB,MAAM,EAAE,CAAC,0BAA0B,CAAC;aACpC,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GACrB,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC;QAE5D,uCAAuC;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC;YAErC,0CAA0C;YAC1C,KAAK,MAAM,GAAG,IAAI;gBACjB,YAAY;gBACZ,QAAQ;gBACR,SAAS;gBACT,QAAQ;aACC,EAAE,CAAC;gBACZ,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,CAAC;gBAChD,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;YAClC,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,gBAAgB;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO;SAClC,CAAC,CAAC;QAEH,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,WAAW;YACX,gBAAgB;YAChB,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,IAAI,EAAE,eAAe;YACrB,KAAK;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO,CACN,CAAC,UAAU,EAAE,gBAAgB,IAAI,KAAK,CAAC;QACvC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CACvC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Package Discovery\n *\n * Discovers and validates maestro packages from the filesystem.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { DiscoveredPackage, PackageJson } from \"./types.js\";\n\nconst logger = createLogger(\"packages:discovery\");\n\n/**\n * Discover a maestro package at the given path\n *\n * @param packagePath - Path to package directory\n * @returns Discovered package info or null if invalid\n */\nexport function discoverPackage(packagePath: string): DiscoveredPackage | null {\n\tconst packageJsonPath = join(packagePath, \"package.json\");\n\n\tif (!existsSync(packageJsonPath)) {\n\t\tlogger.debug(\"No package.json found\", { path: packagePath });\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(packageJsonPath, \"utf-8\");\n\t\tconst packageJson = JSON.parse(content) as PackageJson;\n\n\t\t// Validate required fields\n\t\tif (!packageJson.name) {\n\t\t\treturn {\n\t\t\t\tpath: packagePath,\n\t\t\t\tpackageJson,\n\t\t\t\tisMaestroPackage: false,\n\t\t\t\terrors: [\"Package name is required\"],\n\t\t\t};\n\t\t}\n\n\t\t// Check for maestro-package keyword\n\t\tconst isMaestroPackage =\n\t\t\tpackageJson.keywords?.includes(\"maestro-package\") ?? false;\n\n\t\t// Validate maestro manifest if present\n\t\tconst errors: string[] = [];\n\t\tif (packageJson.maestro) {\n\t\t\tconst manifest = packageJson.maestro;\n\n\t\t\t// Validate that resource paths are arrays\n\t\t\tfor (const key of [\n\t\t\t\t\"extensions\",\n\t\t\t\t\"skills\",\n\t\t\t\t\"prompts\",\n\t\t\t\t\"themes\",\n\t\t\t] as const) {\n\t\t\t\tif (manifest[key] !== undefined && !Array.isArray(manifest[key])) {\n\t\t\t\t\terrors.push(`maestro.${key} must be an array`);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tlogger.debug(\"Discovered package\", {\n\t\t\tname: packageJson.name,\n\t\t\tversion: packageJson.version,\n\t\t\tisMaestroPackage,\n\t\t\thasManifest: !!packageJson.maestro,\n\t\t});\n\n\t\treturn {\n\t\t\tpath: packagePath,\n\t\t\tpackageJson,\n\t\t\tisMaestroPackage,\n\t\t\terrors: errors.length > 0 ? errors : undefined,\n\t\t};\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to parse package.json\", {\n\t\t\tpath: packageJsonPath,\n\t\t\terror,\n\t\t});\n\t\treturn null;\n\t}\n}\n\n/**\n * Check if a directory contains a valid maestro package\n *\n * @param packagePath - Path to check\n * @returns True if valid maestro package\n */\nexport function isValidMaestroPackage(packagePath: string): boolean {\n\tconst discovered = discoverPackage(packagePath);\n\treturn (\n\t\t(discovered?.isMaestroPackage ?? false) &&\n\t\t(discovered?.errors?.length ?? 0) === 0\n\t);\n}\n"]}
+{"version":3,"file":"discovery.js","sourceRoot":"","sources":["../../src/packages/discovery.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAGlD,MAAM,MAAM,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAC;AAElD;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,WAAmB;IAClD,MAAM,eAAe,GAAG,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IAE1D,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,uBAAuB,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC;IACb,CAAC;IAED,IAAI,CAAC;QACJ,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAgB,CAAC;QAEvD,2BAA2B;QAC3B,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YACvB,OAAO;gBACN,IAAI,EAAE,WAAW;gBACjB,WAAW;gBACX,gBAAgB,EAAE,KAAK;gBACvB,MAAM,EAAE,CAAC,0BAA0B,CAAC;aACpC,CAAC;QACH,CAAC;QAED,oCAAoC;QACpC,MAAM,gBAAgB,GACrB,WAAW,CAAC,QAAQ,EAAE,QAAQ,CAAC,iBAAiB,CAAC,IAAI,KAAK,CAAC;QAE5D,uCAAuC;QACvC,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,WAAW,CAAC,OAAO,EAAE,CAAC;YACzB,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC;YAErC,0CAA0C;YAC1C,KAAK,MAAM,GAAG,IAAI;gBACjB,QAAQ;gBACR,YAAY;gBACZ,QAAQ;gBACR,SAAS;gBACT,QAAQ;aACC,EAAE,CAAC;gBACZ,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;oBAClE,MAAM,CAAC,IAAI,CAAC,WAAW,GAAG,mBAAmB,CAAC,CAAC;gBAChD,CAAC;YACF,CAAC;QACF,CAAC;QAED,MAAM,CAAC,KAAK,CAAC,oBAAoB,EAAE;YAClC,IAAI,EAAE,WAAW,CAAC,IAAI;YACtB,OAAO,EAAE,WAAW,CAAC,OAAO;YAC5B,gBAAgB;YAChB,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,OAAO;SAClC,CAAC,CAAC;QAEH,OAAO;YACN,IAAI,EAAE,WAAW;YACjB,WAAW;YACX,gBAAgB;YAChB,MAAM,EAAE,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;SAC9C,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,8BAA8B,EAAE;YAC3C,IAAI,EAAE,eAAe;YACrB,KAAK;SACL,CAAC,CAAC;QACH,OAAO,IAAI,CAAC;IACb,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,WAAmB;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAChD,OAAO,CACN,CAAC,UAAU,EAAE,gBAAgB,IAAI,KAAK,CAAC;QACvC,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,CACvC,CAAC;AACH,CAAC","sourcesContent":["/**\n * Package Discovery\n *\n * Discovers and validates maestro packages from the filesystem.\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { createLogger } from \"../utils/logger.js\";\nimport type { DiscoveredPackage, PackageJson } from \"./types.js\";\n\nconst logger = createLogger(\"packages:discovery\");\n\n/**\n * Discover a maestro package at the given path\n *\n * @param packagePath - Path to package directory\n * @returns Discovered package info or null if invalid\n */\nexport function discoverPackage(packagePath: string): DiscoveredPackage | null {\n\tconst packageJsonPath = join(packagePath, \"package.json\");\n\n\tif (!existsSync(packageJsonPath)) {\n\t\tlogger.debug(\"No package.json found\", { path: packagePath });\n\t\treturn null;\n\t}\n\n\ttry {\n\t\tconst content = readFileSync(packageJsonPath, \"utf-8\");\n\t\tconst packageJson = JSON.parse(content) as PackageJson;\n\n\t\t// Validate required fields\n\t\tif (!packageJson.name) {\n\t\t\treturn {\n\t\t\t\tpath: packagePath,\n\t\t\t\tpackageJson,\n\t\t\t\tisMaestroPackage: false,\n\t\t\t\terrors: [\"Package name is required\"],\n\t\t\t};\n\t\t}\n\n\t\t// Check for maestro-package keyword\n\t\tconst isMaestroPackage =\n\t\t\tpackageJson.keywords?.includes(\"maestro-package\") ?? false;\n\n\t\t// Validate maestro manifest if present\n\t\tconst errors: string[] = [];\n\t\tif (packageJson.maestro) {\n\t\t\tconst manifest = packageJson.maestro;\n\n\t\t\t// Validate that resource paths are arrays\n\t\t\tfor (const key of [\n\t\t\t\t\"agents\",\n\t\t\t\t\"extensions\",\n\t\t\t\t\"skills\",\n\t\t\t\t\"prompts\",\n\t\t\t\t\"themes\",\n\t\t\t] as const) {\n\t\t\t\tif (manifest[key] !== undefined && !Array.isArray(manifest[key])) {\n\t\t\t\t\terrors.push(`maestro.${key} must be an array`);\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\n\t\tlogger.debug(\"Discovered package\", {\n\t\t\tname: packageJson.name,\n\t\t\tversion: packageJson.version,\n\t\t\tisMaestroPackage,\n\t\t\thasManifest: !!packageJson.maestro,\n\t\t});\n\n\t\treturn {\n\t\t\tpath: packagePath,\n\t\t\tpackageJson,\n\t\t\tisMaestroPackage,\n\t\t\terrors: errors.length > 0 ? errors : undefined,\n\t\t};\n\t} catch (error) {\n\t\tlogger.warn(\"Failed to parse package.json\", {\n\t\t\tpath: packageJsonPath,\n\t\t\terror,\n\t\t});\n\t\treturn null;\n\t}\n}\n\n/**\n * Check if a directory contains a valid maestro package\n *\n * @param packagePath - Path to check\n * @returns True if valid maestro package\n */\nexport function isValidMaestroPackage(packagePath: string): boolean {\n\tconst discovered = discoverPackage(packagePath);\n\treturn (\n\t\t(discovered?.isMaestroPackage ?? false) &&\n\t\t(discovered?.errors?.length ?? 0) === 0\n\t);\n}\n"]}

package/dist/packages/inspection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"inspection.d.ts","sourceRoot":"","sources":["../../src/packages/inspection.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAE1B,MAAM,0BAA0B,CAAC;AASlC,OAAO,KAAK,EACX,iBAAiB,EAEjB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,8BAA8B;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACvC;AAED,wBAAsB,oBAAoB,CACzC,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,gBAAgB,CAAC,CAqB3B;AAED,wBAAgB,8BAA8B,CAC7C,SAAS,EAAE,gBAAgB,GACzB,MAAM,EAAE,CAsBV;AA4BD,wBAAsB,4BAA4B,CACjD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,8BAAmC,GAC1C,OAAO,CAAC,uBAAuB,EAAE,CAAC,CA8BpC"}
+{"version":3,"file":"inspection.d.ts","sourceRoot":"","sources":["../../src/packages/inspection.ts"],"names":[],"mappings":"AAEA,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,qBAAqB,EAE1B,MAAM,0BAA0B,CAAC;AASlC,OAAO,KAAK,EACX,iBAAiB,EAEjB,gBAAgB,EAChB,aAAa,EACb,eAAe,EACf,MAAM,YAAY,CAAC;AAEpB,MAAM,WAAW,gBAAgB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,aAAa,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,iBAAiB,GAAG,IAAI,CAAC;IACrC,SAAS,CAAC,EAAE,gBAAgB,CAAC;CAC7B;AAED,MAAM,WAAW,uBAAuB;IACvC,KAAK,EAAE,qBAAqB,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,eAAe,CAAC;IAC1B,SAAS,CAAC,EAAE,gBAAgB,CAAC;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,8BAA8B;IAC9C,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACvC;AAED,wBAAsB,oBAAoB,CACzC,UAAU,EAAE,MAAM,EAClB,GAAG,EAAE,MAAM,GACT,OAAO,CAAC,gBAAgB,CAAC,CAqB3B;AAED,wBAAgB,8BAA8B,CAC7C,SAAS,EAAE,gBAAgB,GACzB,MAAM,EAAE,CAsBV;AAkCD,wBAAsB,4BAA4B,CACjD,YAAY,EAAE,MAAM,EACpB,OAAO,GAAE,8BAAmC,GAC1C,OAAO,CAAC,uBAAuB,EAAE,CAAC,CA8BpC"}

package/dist/packages/inspection.js

@@ -44,7 +44,13 @@ export function collectPackageValidationIssues(inspected) {
 }
 function collectManifestPathIssues(packagePath, manifest) {
     const issues = [];
-    for (const key of ["extensions", "skills", "prompts", "themes"]) {
+    for (const key of [
+        "agents",
+        "extensions",
+        "skills",
+        "prompts",
+        "themes",
+    ]) {
         const manifestPaths = manifest[key];
         if (!Array.isArray(manifestPaths)) {
             continue;

package/dist/packages/inspection.js.map

@@ -1 +1 @@
-{"version":3,"file":"inspection.js","sourceRoot":"","sources":["../../src/packages/inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAGN,0BAA0B,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACN,WAAW,EACX,oBAAoB,EACpB,gBAAgB,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AA8BxE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,UAAkB,EAClB,GAAW;IAEX,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,SAAS,GAAqB;QACnC,UAAU;QACV,MAAM;QACN,YAAY;QACZ,UAAU;KACV,CAAC;IAEF,IACC,UAAU,EAAE,gBAAgB;QAC5B,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QACtC,UAAU,CAAC,WAAW,CAAC,OAAO,EAC7B,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,SAAS,CAAC,SAAS,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC7C,SAA2B;IAE3B,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,kCAAkC,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CACjC,WAAmB,EACnB,QAAyB;IAEzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAU,EAAE,CAAC;QAC1E,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,SAAS;QACV,CAAC;QAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,yBAAyB,YAAY,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACV,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,6BAA6B,YAAY,EAAE,CAAC,CAAC;YAChE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,YAAoB,EACpB,UAA0C,EAAE;IAE5C,MAAM,UAAU,GAAG,0BAA0B,CAC5C,YAAY,EACZ,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC;gBACZ,KAAK;gBACL,UAAU;gBACV,OAAO;gBACP,SAAS,EAAE,MAAM,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC;aAC5D,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC;gBACZ,KAAK;gBACL,UAAU;gBACV,OAAO;gBACP,KAAK,EACJ,KAAK,YAAY,KAAK;oBACrB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,uCAAuC;aAC3C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC","sourcesContent":["import { existsSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport {\n\ttype ComposerConfig,\n\ttype ConfiguredPackageSpec,\n\tloadConfiguredPackageSpecs,\n} from \"../config/toml-config.js\";\nimport { MISSING_MAESTRO_PACKAGE_KEYWORD_MESSAGE } from \"./constants.js\";\nimport { discoverPackage } from \"./discovery.js\";\nimport {\n\tloadPackage,\n\tloadPackageResources,\n\tparsePackageSpec,\n} from \"./loader.js\";\nimport { parsePackageSource, resolvePackageSource } from \"./sources.js\";\nimport type {\n\tDiscoveredPackage,\n\tMaestroManifest,\n\tPackageResources,\n\tPackageSource,\n\tResourceFilters,\n} from \"./types.js\";\n\nexport interface InspectedPackage {\n\tsourceSpec: string;\n\tsource: PackageSource;\n\tresolvedPath: string;\n\tdiscovered: DiscoveredPackage | null;\n\tresources?: PackageResources;\n}\n\nexport interface ConfiguredPackageReport {\n\tentry: ConfiguredPackageSpec;\n\tsourceSpec: string;\n\tfilters?: ResourceFilters;\n\tinspected?: InspectedPackage;\n\terror?: string;\n}\n\nexport interface ConfiguredPackageReportOptions {\n\tprofileName?: string;\n\tcliOverrides?: Partial<ComposerConfig>;\n}\n\nexport async function inspectPackageSource(\n\tsourceSpec: string,\n\tcwd: string,\n): Promise<InspectedPackage> {\n\tconst source = parsePackageSource(sourceSpec, cwd);\n\tconst resolvedPath = await resolvePackageSource(source);\n\tconst discovered = discoverPackage(resolvedPath);\n\tconst inspected: InspectedPackage = {\n\t\tsourceSpec,\n\t\tsource,\n\t\tresolvedPath,\n\t\tdiscovered,\n\t};\n\n\tif (\n\t\tdiscovered?.isMaestroPackage &&\n\t\t(discovered.errors?.length ?? 0) === 0 &&\n\t\tdiscovered.packageJson.maestro\n\t) {\n\t\tconst loadedPackage = await loadPackage(sourceSpec, { cwd });\n\t\tinspected.resources = loadPackageResources(loadedPackage);\n\t}\n\n\treturn inspected;\n}\n\nexport function collectPackageValidationIssues(\n\tinspected: InspectedPackage,\n): string[] {\n\tif (!inspected.discovered) {\n\t\treturn [`No valid package.json found at ${inspected.resolvedPath}.`];\n\t}\n\n\tconst issues: string[] = [];\n\tif (!inspected.discovered.isMaestroPackage) {\n\t\tissues.push(MISSING_MAESTRO_PACKAGE_KEYWORD_MESSAGE);\n\t}\n\n\tfor (const error of inspected.discovered.errors ?? []) {\n\t\tissues.push(error);\n\t}\n\n\tconst manifest = inspected.discovered.packageJson.maestro;\n\tif (!manifest) {\n\t\tissues.push('Missing \"maestro\" section in package.json.');\n\t\treturn issues;\n\t}\n\n\tissues.push(...collectManifestPathIssues(inspected.resolvedPath, manifest));\n\treturn issues;\n}\n\nfunction collectManifestPathIssues(\n\tpackagePath: string,\n\tmanifest: MaestroManifest,\n): string[] {\n\tconst issues: string[] = [];\n\tfor (const key of [\"extensions\", \"skills\", \"prompts\", \"themes\"] as const) {\n\t\tconst manifestPaths = manifest[key];\n\t\tif (!Array.isArray(manifestPaths)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tfor (const manifestPath of manifestPaths) {\n\t\t\tconst absolutePath = join(packagePath, manifestPath);\n\t\t\tif (!existsSync(absolutePath)) {\n\t\t\t\tissues.push(`${key} path does not exist: ${manifestPath}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!statSync(absolutePath).isDirectory()) {\n\t\t\t\tissues.push(`${key} path is not a directory: ${manifestPath}`);\n\t\t\t}\n\t\t}\n\t}\n\treturn issues;\n}\n\nexport async function listConfiguredPackageReports(\n\tworkspaceDir: string,\n\toptions: ConfiguredPackageReportOptions = {},\n): Promise<ConfiguredPackageReport[]> {\n\tconst configured = loadConfiguredPackageSpecs(\n\t\tworkspaceDir,\n\t\toptions.profileName,\n\t\toptions.cliOverrides,\n\t);\n\tconst reports: ConfiguredPackageReport[] = [];\n\tfor (const entry of configured) {\n\t\tconst [sourceSpec, filters] = parsePackageSpec(entry.spec, entry.cwd);\n\t\ttry {\n\t\t\treports.push({\n\t\t\t\tentry,\n\t\t\t\tsourceSpec,\n\t\t\t\tfilters,\n\t\t\t\tinspected: await inspectPackageSource(sourceSpec, entry.cwd),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treports.push({\n\t\t\t\tentry,\n\t\t\t\tsourceSpec,\n\t\t\t\tfilters,\n\t\t\t\terror:\n\t\t\t\t\terror instanceof Error\n\t\t\t\t\t\t? error.message\n\t\t\t\t\t\t: \"Failed to inspect configured package.\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn reports;\n}\n"]}
+{"version":3,"file":"inspection.js","sourceRoot":"","sources":["../../src/packages/inspection.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC/C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAGN,0BAA0B,GAC1B,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,uCAAuC,EAAE,MAAM,gBAAgB,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EACN,WAAW,EACX,oBAAoB,EACpB,gBAAgB,GAChB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,kBAAkB,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AA8BxE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACzC,UAAkB,EAClB,GAAW;IAEX,MAAM,MAAM,GAAG,kBAAkB,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;IACnD,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACxD,MAAM,UAAU,GAAG,eAAe,CAAC,YAAY,CAAC,CAAC;IACjD,MAAM,SAAS,GAAqB;QACnC,UAAU;QACV,MAAM;QACN,YAAY;QACZ,UAAU;KACV,CAAC;IAEF,IACC,UAAU,EAAE,gBAAgB;QAC5B,CAAC,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC;QACtC,UAAU,CAAC,WAAW,CAAC,OAAO,EAC7B,CAAC;QACF,MAAM,aAAa,GAAG,MAAM,WAAW,CAAC,UAAU,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC7D,SAAS,CAAC,SAAS,GAAG,oBAAoB,CAAC,aAAa,CAAC,CAAC;IAC3D,CAAC;IAED,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,8BAA8B,CAC7C,SAA2B;IAE3B,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;QAC3B,OAAO,CAAC,kCAAkC,SAAS,CAAC,YAAY,GAAG,CAAC,CAAC;IACtE,CAAC;IAED,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,gBAAgB,EAAE,CAAC;QAC5C,MAAM,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC;IACtD,CAAC;IAED,KAAK,MAAM,KAAK,IAAI,SAAS,CAAC,UAAU,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACvD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,WAAW,CAAC,OAAO,CAAC;IAC1D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,MAAM,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QAC1D,OAAO,MAAM,CAAC;IACf,CAAC;IAED,MAAM,CAAC,IAAI,CAAC,GAAG,yBAAyB,CAAC,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,yBAAyB,CACjC,WAAmB,EACnB,QAAyB;IAEzB,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,GAAG,IAAI;QACjB,QAAQ;QACR,YAAY;QACZ,QAAQ;QACR,SAAS;QACT,QAAQ;KACC,EAAE,CAAC;QACZ,MAAM,aAAa,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;YACnC,SAAS;QACV,CAAC;QAED,KAAK,MAAM,YAAY,IAAI,aAAa,EAAE,CAAC;YAC1C,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YACrD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,yBAAyB,YAAY,EAAE,CAAC,CAAC;gBAC3D,SAAS;YACV,CAAC;YAED,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;gBAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,6BAA6B,YAAY,EAAE,CAAC,CAAC;YAChE,CAAC;QACF,CAAC;IACF,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CACjD,YAAoB,EACpB,UAA0C,EAAE;IAE5C,MAAM,UAAU,GAAG,0BAA0B,CAC5C,YAAY,EACZ,OAAO,CAAC,WAAW,EACnB,OAAO,CAAC,YAAY,CACpB,CAAC;IACF,MAAM,OAAO,GAA8B,EAAE,CAAC;IAC9C,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAChC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QACtE,IAAI,CAAC;YACJ,OAAO,CAAC,IAAI,CAAC;gBACZ,KAAK;gBACL,UAAU;gBACV,OAAO;gBACP,SAAS,EAAE,MAAM,oBAAoB,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC;aAC5D,CAAC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC;gBACZ,KAAK;gBACL,UAAU;gBACV,OAAO;gBACP,KAAK,EACJ,KAAK,YAAY,KAAK;oBACrB,CAAC,CAAC,KAAK,CAAC,OAAO;oBACf,CAAC,CAAC,uCAAuC;aAC3C,CAAC,CAAC;QACJ,CAAC;IACF,CAAC;IAED,OAAO,OAAO,CAAC;AAChB,CAAC","sourcesContent":["import { existsSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport {\n\ttype ComposerConfig,\n\ttype ConfiguredPackageSpec,\n\tloadConfiguredPackageSpecs,\n} from \"../config/toml-config.js\";\nimport { MISSING_MAESTRO_PACKAGE_KEYWORD_MESSAGE } from \"./constants.js\";\nimport { discoverPackage } from \"./discovery.js\";\nimport {\n\tloadPackage,\n\tloadPackageResources,\n\tparsePackageSpec,\n} from \"./loader.js\";\nimport { parsePackageSource, resolvePackageSource } from \"./sources.js\";\nimport type {\n\tDiscoveredPackage,\n\tMaestroManifest,\n\tPackageResources,\n\tPackageSource,\n\tResourceFilters,\n} from \"./types.js\";\n\nexport interface InspectedPackage {\n\tsourceSpec: string;\n\tsource: PackageSource;\n\tresolvedPath: string;\n\tdiscovered: DiscoveredPackage | null;\n\tresources?: PackageResources;\n}\n\nexport interface ConfiguredPackageReport {\n\tentry: ConfiguredPackageSpec;\n\tsourceSpec: string;\n\tfilters?: ResourceFilters;\n\tinspected?: InspectedPackage;\n\terror?: string;\n}\n\nexport interface ConfiguredPackageReportOptions {\n\tprofileName?: string;\n\tcliOverrides?: Partial<ComposerConfig>;\n}\n\nexport async function inspectPackageSource(\n\tsourceSpec: string,\n\tcwd: string,\n): Promise<InspectedPackage> {\n\tconst source = parsePackageSource(sourceSpec, cwd);\n\tconst resolvedPath = await resolvePackageSource(source);\n\tconst discovered = discoverPackage(resolvedPath);\n\tconst inspected: InspectedPackage = {\n\t\tsourceSpec,\n\t\tsource,\n\t\tresolvedPath,\n\t\tdiscovered,\n\t};\n\n\tif (\n\t\tdiscovered?.isMaestroPackage &&\n\t\t(discovered.errors?.length ?? 0) === 0 &&\n\t\tdiscovered.packageJson.maestro\n\t) {\n\t\tconst loadedPackage = await loadPackage(sourceSpec, { cwd });\n\t\tinspected.resources = loadPackageResources(loadedPackage);\n\t}\n\n\treturn inspected;\n}\n\nexport function collectPackageValidationIssues(\n\tinspected: InspectedPackage,\n): string[] {\n\tif (!inspected.discovered) {\n\t\treturn [`No valid package.json found at ${inspected.resolvedPath}.`];\n\t}\n\n\tconst issues: string[] = [];\n\tif (!inspected.discovered.isMaestroPackage) {\n\t\tissues.push(MISSING_MAESTRO_PACKAGE_KEYWORD_MESSAGE);\n\t}\n\n\tfor (const error of inspected.discovered.errors ?? []) {\n\t\tissues.push(error);\n\t}\n\n\tconst manifest = inspected.discovered.packageJson.maestro;\n\tif (!manifest) {\n\t\tissues.push('Missing \"maestro\" section in package.json.');\n\t\treturn issues;\n\t}\n\n\tissues.push(...collectManifestPathIssues(inspected.resolvedPath, manifest));\n\treturn issues;\n}\n\nfunction collectManifestPathIssues(\n\tpackagePath: string,\n\tmanifest: MaestroManifest,\n): string[] {\n\tconst issues: string[] = [];\n\tfor (const key of [\n\t\t\"agents\",\n\t\t\"extensions\",\n\t\t\"skills\",\n\t\t\"prompts\",\n\t\t\"themes\",\n\t] as const) {\n\t\tconst manifestPaths = manifest[key];\n\t\tif (!Array.isArray(manifestPaths)) {\n\t\t\tcontinue;\n\t\t}\n\n\t\tfor (const manifestPath of manifestPaths) {\n\t\t\tconst absolutePath = join(packagePath, manifestPath);\n\t\t\tif (!existsSync(absolutePath)) {\n\t\t\t\tissues.push(`${key} path does not exist: ${manifestPath}`);\n\t\t\t\tcontinue;\n\t\t\t}\n\n\t\t\tif (!statSync(absolutePath).isDirectory()) {\n\t\t\t\tissues.push(`${key} path is not a directory: ${manifestPath}`);\n\t\t\t}\n\t\t}\n\t}\n\treturn issues;\n}\n\nexport async function listConfiguredPackageReports(\n\tworkspaceDir: string,\n\toptions: ConfiguredPackageReportOptions = {},\n): Promise<ConfiguredPackageReport[]> {\n\tconst configured = loadConfiguredPackageSpecs(\n\t\tworkspaceDir,\n\t\toptions.profileName,\n\t\toptions.cliOverrides,\n\t);\n\tconst reports: ConfiguredPackageReport[] = [];\n\tfor (const entry of configured) {\n\t\tconst [sourceSpec, filters] = parsePackageSpec(entry.spec, entry.cwd);\n\t\ttry {\n\t\t\treports.push({\n\t\t\t\tentry,\n\t\t\t\tsourceSpec,\n\t\t\t\tfilters,\n\t\t\t\tinspected: await inspectPackageSource(sourceSpec, entry.cwd),\n\t\t\t});\n\t\t} catch (error) {\n\t\t\treports.push({\n\t\t\t\tentry,\n\t\t\t\tsourceSpec,\n\t\t\t\tfilters,\n\t\t\t\terror:\n\t\t\t\t\terror instanceof Error\n\t\t\t\t\t\t? error.message\n\t\t\t\t\t\t: \"Failed to inspect configured package.\",\n\t\t\t});\n\t\t}\n\t}\n\n\treturn reports;\n}\n"]}

package/dist/packages/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/packages/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EACX,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,MAAM,YAAY,CAAC;AAIpB;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,IAAI,EAAE,WAAW,EACjB,GAAG,CAAC,EAAE,MAAM,GACV,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC,CAevC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAChC,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CA8CxB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CAmDzE;AA8DD;;;;;;GAMG;AACH,wBAAsB,YAAY,CACjC,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkB7B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,WAAW,EAAE,EAC1B,YAAY,EAAE,WAAW,EAAE,GACzB,WAAW,EAAE,CA2Bf"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/packages/loader.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,KAAK,EACX,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,WAAW,EACX,eAAe,EACf,MAAM,YAAY,CAAC;AAIpB;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC/B,IAAI,EAAE,WAAW,EACjB,GAAG,CAAC,EAAE,MAAM,GACV,CAAC,MAAM,EAAE,eAAe,GAAG,SAAS,CAAC,CAgBvC;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAChC,IAAI,EAAE,WAAW,EACjB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,aAAa,CAAC,CA8CxB;AAED;;;;;GAKG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,aAAa,GAAG,gBAAgB,CA6DzE;AA8DD;;;;;;GAMG;AACH,wBAAsB,YAAY,CACjC,KAAK,EAAE,WAAW,EAAE,EACpB,OAAO,CAAC,EAAE,oBAAoB,GAC5B,OAAO,CAAC,gBAAgB,EAAE,CAAC,CAkB7B;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAClC,WAAW,EAAE,WAAW,EAAE,EAC1B,YAAY,EAAE,WAAW,EAAE,GACzB,WAAW,EAAE,CA2Bf"}