@evalops/maestro 0.10.8 → 0.10.10

package/dist/services/workspace-config/middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../../../src/services/workspace-config/middleware.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAC5E,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,8BAA8B,EAAE,MAAM,gBAAgB,CAAC;AAChE,OAAO,EACN,+BAA+B,EAC/B,yBAAyB,GACzB,MAAM,cAAc,CAAC;AAGtB,MAAM,MAAM,GAAG,YAAY,CAAC,6BAA6B,CAAC,CAAC;AAE3D,SAAS,WAAW,CACnB,GAAoB,EACpB,KAAe;IAEf,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QAC5C,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAChD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;QAC9B,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;IAC7B,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,OAAO,CAAC,GAAoB;IACpC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,UAAU,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,WAAW,EAAE,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,mCAAmC,CAC3C,QAAgB;IAEhB,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QAAE,OAAO,SAAS,CAAC;IAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpD,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAQ,EAAE,KAAe;IAClD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC;QACjD,IAAI,KAAK;YAAE,OAAO,KAAK,CAAC;IACzB,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,GAAoB;IAC5D,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACzB,OAAO,CACN,WAAW,CAAC,GAAG,EAAE;QAChB,wBAAwB;QACxB,yBAAyB;QACzB,qBAAqB;QACrB,sBAAsB;KACtB,CAAC;QACF,gBAAgB,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,aAAa,CAAC,CAAC;QACtD,mCAAmC,CAAC,GAAG,CAAC,QAAQ,CAAC;QACjD,OAAO,CAAC,GAAG,EAAE,CACb,CAAC;AACH,CAAC;AAED,MAAM,UAAU,+BAA+B,CAC9C,WAAmC;IAEnC,OAAO,KAAK,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE;QAC/B,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACtC,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACR,CAAC;QAED,MAAM,WAAW,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC;YAC7B,yBAAyB,CAAC;gBACzB,WAAW;gBACX,MAAM,EAAE,IAAI;gBACZ,MAAM,EAAE,cAAc;aACtB,CAAC,CAAC;YACH,MAAM,IAAI,EAAE,CAAC;YACb,OAAO;QACR,CAAC;QAED,IAAI,MAA8B,CAAC;QACnC,IAAI,CAAC;YACJ,MAAM,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QAC/C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,IAAI,KAAK,YAAY,+BAA+B,EAAE,CAAC;gBACtD,yBAAyB,CAAC;oBACzB,WAAW;oBACX,MAAM,EAAE,IAAI;oBACZ,MAAM,EAAE,cAAc;iBACtB,CAAC,CAAC;gBACH,MAAM,IAAI,EAAE,CAAC;gBACb,OAAO;YACR,CAAC;YACD,IAAI,KAAK,YAAY,8BAA8B,EAAE,CAAC;gBACrD,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,GAAG,CAAC,CAAC;gBAC/D,OAAO;YACR,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,iCAAiC,EAAE;gBAC9C,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,WAAW;aACX,CAAC,CAAC;YACH,QAAQ,CACP,GAAG,EACH,GAAG,EACH,EAAE,KAAK,EAAE,uCAAuC,EAAE,EAClD,WAAW,EACX,GAAG,CACH,CAAC;YACF,OAAO;QACR,CAAC;QAED,yBAAyB,CAAC;YACzB,WAAW;YACX,MAAM;YACN,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;SACvC,CAAC,CAAC;QACH,MAAM,IAAI,EAAE,CAAC;IACd,CAAC,CAAC;AACH,CAAC","sourcesContent":["import type { IncomingMessage } from \"node:http\";\nimport type { Middleware } from \"../../server/middleware.js\";\nimport { setWorkspaceConfigContext } from \"../../server/request-context.js\";\nimport { sendJson } from \"../../server/server-utils.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nimport { WorkspaceConfigValidationError } from \"./normalize.js\";\nimport {\n\tWorkspaceConfigUnavailableError,\n\tgetWorkspaceConfigService,\n} from \"./service.js\";\nimport type { WorkspaceConfig } from \"./types.js\";\n\nconst logger = createLogger(\"workspace-config:middleware\");\n\nfunction firstHeader(\n\treq: IncomingMessage,\n\tnames: string[],\n): string | undefined {\n\tfor (const name of names) {\n\t\tconst raw = req.headers[name.toLowerCase()];\n\t\tconst value = Array.isArray(raw) ? raw[0] : raw;\n\t\tconst trimmed = value?.trim();\n\t\tif (trimmed) return trimmed;\n\t}\n\treturn undefined;\n}\n\nfunction safeUrl(req: IncomingMessage): URL {\n\treturn new URL(req.url || \"/\", `http://${req.headers.host || \"localhost\"}`);\n}\n\nfunction workspaceIdFromWorkspaceConfigRoute(\n\tpathname: string,\n): string | undefined {\n\tconst match = pathname.match(/^\\/api\\/workspace-configs\\/([^/]+)$/);\n\tif (!match?.[1]) return undefined;\n\tconst decoded = decodeURIComponent(match[1]).trim();\n\treturn decoded ? decoded : undefined;\n}\n\nfunction firstSearchParam(url: URL, names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = url.searchParams.get(name)?.trim();\n\t\tif (value) return value;\n\t}\n\treturn undefined;\n}\n\nexport function resolveWorkspaceConfigId(req: IncomingMessage): string {\n\tconst url = safeUrl(req);\n\treturn (\n\t\tfirstHeader(req, [\n\t\t\t\"x-maestro-workspace-id\",\n\t\t\t\"x-composer-workspace-id\",\n\t\t\t\"x-maestro-workspace\",\n\t\t\t\"x-composer-workspace\",\n\t\t]) ??\n\t\tfirstSearchParam(url, [\"workspace_id\", \"workspaceId\"]) ??\n\t\tworkspaceIdFromWorkspaceConfigRoute(url.pathname) ??\n\t\tprocess.cwd()\n\t);\n}\n\nexport function createWorkspaceConfigMiddleware(\n\tcorsHeaders: Record<string, string>,\n): Middleware {\n\treturn async (req, res, next) => {\n\t\tconst url = safeUrl(req);\n\t\tif (!url.pathname.startsWith(\"/api\")) {\n\t\t\tawait next();\n\t\t\treturn;\n\t\t}\n\n\t\tconst workspaceId = resolveWorkspaceConfigId(req);\n\t\tconst service = getWorkspaceConfigService();\n\t\tif (!service.isConfigured()) {\n\t\t\tsetWorkspaceConfigContext({\n\t\t\t\tworkspaceId,\n\t\t\t\tconfig: null,\n\t\t\t\tsource: \"unconfigured\",\n\t\t\t});\n\t\t\tawait next();\n\t\t\treturn;\n\t\t}\n\n\t\tlet config: WorkspaceConfig | null;\n\t\ttry {\n\t\t\tconfig = await service.getConfig(workspaceId);\n\t\t} catch (error) {\n\t\t\tif (error instanceof WorkspaceConfigUnavailableError) {\n\t\t\t\tsetWorkspaceConfigContext({\n\t\t\t\t\tworkspaceId,\n\t\t\t\t\tconfig: null,\n\t\t\t\t\tsource: \"unconfigured\",\n\t\t\t\t});\n\t\t\t\tawait next();\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tif (error instanceof WorkspaceConfigValidationError) {\n\t\t\t\tsendJson(res, 400, { error: error.message }, corsHeaders, req);\n\t\t\t\treturn;\n\t\t\t}\n\t\t\tlogger.warn(\"Failed to load workspace config\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\tworkspaceId,\n\t\t\t});\n\t\t\tsendJson(\n\t\t\t\tres,\n\t\t\t\t503,\n\t\t\t\t{ error: \"Workspace config could not be loaded.\" },\n\t\t\t\tcorsHeaders,\n\t\t\t\treq,\n\t\t\t);\n\t\t\treturn;\n\t\t}\n\n\t\tsetWorkspaceConfigContext({\n\t\t\tworkspaceId,\n\t\t\tconfig,\n\t\t\tsource: config ? \"database\" : \"missing\",\n\t\t});\n\t\tawait next();\n\t};\n}\n"]}

package/dist/services/workspace-config/normalize.d.ts

@@ -0,0 +1,17 @@
+import type { WorkspaceConfig, WorkspaceConfigInput, WorkspaceConfigListQuery, WorkspaceConfigPatchInput, WorkspaceModelPreferences, WorkspaceRateLimits, WorkspaceSafetyRules } from "./types.js";
+export declare class WorkspaceConfigValidationError extends Error {
+    constructor(message: string);
+}
+export declare function normalizeWorkspaceConfigId(workspaceId: unknown, label?: string): string;
+export declare function normalizeModelPreferences(value: unknown): WorkspaceModelPreferences;
+export declare function normalizeSafetyRules(value: unknown): WorkspaceSafetyRules;
+export declare function normalizeRateLimits(value: unknown): WorkspaceRateLimits;
+export declare function normalizeWorkspaceConfigInput(input: WorkspaceConfigInput, now?: Date): WorkspaceConfig;
+export declare function normalizeWorkspaceConfigPatchInput(workspaceId: string, input: WorkspaceConfigPatchInput, existing: WorkspaceConfig | null, now?: Date): WorkspaceConfig;
+export declare function parseWorkspaceConfigLimit(value: string | null): number;
+export declare function parseWorkspaceConfigOffset(value: string | null): number;
+export declare function normalizeWorkspaceConfigListQuery(params: {
+    limit?: string | null;
+    offset?: string | null;
+}): WorkspaceConfigListQuery;
+//# sourceMappingURL=normalize.d.ts.map

package/dist/services/workspace-config/normalize.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.d.ts","sourceRoot":"","sources":["../../../src/services/workspace-config/normalize.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACX,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,MAAM,YAAY,CAAC;AAKpB,qBAAa,8BAA+B,SAAQ,KAAK;gBAC5C,OAAO,EAAE,MAAM;CAI3B;AAiBD,wBAAgB,0BAA0B,CACzC,WAAW,EAAE,OAAO,EACpB,KAAK,SAAgB,GACnB,MAAM,CAER;AAyCD,wBAAgB,yBAAyB,CACxC,KAAK,EAAE,OAAO,GACZ,yBAAyB,CAU3B;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,OAAO,GAAG,oBAAoB,CAezE;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,mBAAmB,CAwBvE;AAED,wBAAgB,6BAA6B,CAC5C,KAAK,EAAE,oBAAoB,EAC3B,GAAG,OAAa,GACd,eAAe,CAcjB;AAED,wBAAgB,kCAAkC,CACjD,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,yBAAyB,EAChC,QAAQ,EAAE,eAAe,GAAG,IAAI,EAChC,GAAG,OAAa,GACd,eAAe,CAuBjB;AAED,wBAAgB,yBAAyB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAStE;AAED,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CASvE;AAED,wBAAgB,iCAAiC,CAAC,MAAM,EAAE;IACzD,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,wBAAwB,CAK3B"}

package/dist/services/workspace-config/normalize.js

@@ -0,0 +1,148 @@
+const DEFAULT_LIST_LIMIT = 50;
+const MAX_LIST_LIMIT = 100;
+export class WorkspaceConfigValidationError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "WorkspaceConfigValidationError";
+    }
+}
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function cleanRequiredString(value, label) {
+    if (typeof value !== "string") {
+        throw new WorkspaceConfigValidationError(`${label} is required.`);
+    }
+    const trimmed = value.trim();
+    if (!trimmed) {
+        throw new WorkspaceConfigValidationError(`${label} is required.`);
+    }
+    return trimmed;
+}
+export function normalizeWorkspaceConfigId(workspaceId, label = "workspaceId") {
+    return cleanRequiredString(workspaceId, label);
+}
+function cleanOptionalString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function cleanStringList(value) {
+    if (!Array.isArray(value))
+        return [];
+    return Array.from(new Set(value
+        .map((entry) => cleanOptionalString(entry))
+        .filter((entry) => Boolean(entry))));
+}
+function cleanOptionalBoolean(value) {
+    return typeof value === "boolean" ? value : undefined;
+}
+function cleanOptionalPositiveInteger(value, label) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value !== "number" || !Number.isFinite(value)) {
+        throw new WorkspaceConfigValidationError(`${label} must be a finite number.`);
+    }
+    if (value < 1) {
+        throw new WorkspaceConfigValidationError(`${label} must be a positive integer.`);
+    }
+    return Math.floor(value);
+}
+export function normalizeModelPreferences(value) {
+    const input = isRecord(value) ? value : {};
+    const defaultModel = cleanOptionalString(input.defaultModel);
+    const preferredProvider = cleanOptionalString(input.preferredProvider);
+    return {
+        allowedModels: cleanStringList(input.allowedModels),
+        blockedModels: cleanStringList(input.blockedModels),
+        ...(defaultModel ? { defaultModel } : {}),
+        ...(preferredProvider ? { preferredProvider } : {}),
+    };
+}
+export function normalizeSafetyRules(value) {
+    const input = isRecord(value) ? value : {};
+    const requireApprovals = cleanOptionalBoolean(input.requireApprovals);
+    const maxTokensPerSession = cleanOptionalPositiveInteger(input.maxTokensPerSession, "safetyRules.maxTokensPerSession");
+    return {
+        allowedTools: cleanStringList(input.allowedTools),
+        blockedTools: cleanStringList(input.blockedTools),
+        requiredSkills: cleanStringList(input.requiredSkills),
+        fileBoundaries: cleanStringList(input.fileBoundaries),
+        ...(requireApprovals !== undefined ? { requireApprovals } : {}),
+        ...(maxTokensPerSession ? { maxTokensPerSession } : {}),
+    };
+}
+export function normalizeRateLimits(value) {
+    const input = isRecord(value) ? value : {};
+    const requestsPerMinute = cleanOptionalPositiveInteger(input.requestsPerMinute, "rateLimits.requestsPerMinute");
+    const tokensPerMinute = cleanOptionalPositiveInteger(input.tokensPerMinute, "rateLimits.tokensPerMinute");
+    const maxConcurrentSessions = cleanOptionalPositiveInteger(input.maxConcurrentSessions, "rateLimits.maxConcurrentSessions");
+    const maxTokensPerSession = cleanOptionalPositiveInteger(input.maxTokensPerSession, "rateLimits.maxTokensPerSession");
+    return {
+        ...(requestsPerMinute ? { requestsPerMinute } : {}),
+        ...(tokensPerMinute ? { tokensPerMinute } : {}),
+        ...(maxConcurrentSessions ? { maxConcurrentSessions } : {}),
+        ...(maxTokensPerSession ? { maxTokensPerSession } : {}),
+    };
+}
+export function normalizeWorkspaceConfigInput(input, now = new Date()) {
+    if (!isRecord(input)) {
+        throw new WorkspaceConfigValidationError("Workspace config must be an object.");
+    }
+    return {
+        workspaceId: cleanRequiredString(input.workspaceId, "workspaceId"),
+        modelPreferences: normalizeModelPreferences(input.modelPreferences),
+        safetyRules: normalizeSafetyRules(input.safetyRules),
+        rateLimits: normalizeRateLimits(input.rateLimits),
+        createdAt: now.toISOString(),
+        updatedAt: now.toISOString(),
+    };
+}
+export function normalizeWorkspaceConfigPatchInput(workspaceId, input, existing, now = new Date()) {
+    if (!isRecord(input)) {
+        throw new WorkspaceConfigValidationError("Workspace config must be an object.");
+    }
+    return {
+        workspaceId: cleanRequiredString(workspaceId, "workspaceId"),
+        modelPreferences: normalizeModelPreferences({
+            ...(existing?.modelPreferences ?? {}),
+            ...(isRecord(input.modelPreferences) ? input.modelPreferences : {}),
+        }),
+        safetyRules: normalizeSafetyRules({
+            ...(existing?.safetyRules ?? {}),
+            ...(isRecord(input.safetyRules) ? input.safetyRules : {}),
+        }),
+        rateLimits: normalizeRateLimits({
+            ...(existing?.rateLimits ?? {}),
+            ...(isRecord(input.rateLimits) ? input.rateLimits : {}),
+        }),
+        createdAt: existing?.createdAt ?? now.toISOString(),
+        updatedAt: now.toISOString(),
+    };
+}
+export function parseWorkspaceConfigLimit(value) {
+    if (!value)
+        return DEFAULT_LIST_LIMIT;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 1) {
+        throw new WorkspaceConfigValidationError("limit must be a positive integer.");
+    }
+    return Math.min(parsed, MAX_LIST_LIMIT);
+}
+export function parseWorkspaceConfigOffset(value) {
+    if (!value)
+        return 0;
+    const parsed = Number(value);
+    if (!Number.isInteger(parsed) || parsed < 0) {
+        throw new WorkspaceConfigValidationError("offset must be a non-negative integer.");
+    }
+    return parsed;
+}
+export function normalizeWorkspaceConfigListQuery(params) {
+    return {
+        limit: parseWorkspaceConfigLimit(params.limit ?? null),
+        offset: parseWorkspaceConfigOffset(params.offset ?? null),
+    };
+}
+//# sourceMappingURL=normalize.js.map

package/dist/services/workspace-config/normalize.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../src/services/workspace-config/normalize.ts"],"names":[],"mappings":"AAUA,MAAM,kBAAkB,GAAG,EAAE,CAAC;AAC9B,MAAM,cAAc,GAAG,GAAG,CAAC;AAE3B,MAAM,OAAO,8BAA+B,SAAQ,KAAK;IACxD,YAAY,OAAe;QAC1B,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gCAAgC,CAAC;IAC9C,CAAC;CACD;AAED,SAAS,QAAQ,CAAC,KAAc;IAC/B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC7E,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc,EAAE,KAAa;IACzD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC/B,MAAM,IAAI,8BAA8B,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IACnE,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,MAAM,IAAI,8BAA8B,CAAC,GAAG,KAAK,eAAe,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,OAAO,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,WAAoB,EACpB,KAAK,GAAG,aAAa;IAErB,OAAO,mBAAmB,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACrC,OAAO,KAAK,CAAC,IAAI,CAChB,IAAI,GAAG,CACN,KAAK;SACH,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CACpD,CACD,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,4BAA4B,CACpC,KAAc,EACd,KAAa;IAEb,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,8BAA8B,CACvC,GAAG,KAAK,2BAA2B,CACnC,CAAC;IACH,CAAC;IACD,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,8BAA8B,CACvC,GAAG,KAAK,8BAA8B,CACtC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,yBAAyB,CACxC,KAAc;IAEd,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,mBAAmB,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC7D,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACvE,OAAO;QACN,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QACnD,aAAa,EAAE,eAAe,CAAC,KAAK,CAAC,aAAa,CAAC;QACnD,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,oBAAoB,CAAC,KAAc;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACtE,MAAM,mBAAmB,GAAG,4BAA4B,CACvD,KAAK,CAAC,mBAAmB,EACzB,iCAAiC,CACjC,CAAC;IACF,OAAO;QACN,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,YAAY,EAAE,eAAe,CAAC,KAAK,CAAC,YAAY,CAAC;QACjD,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;QACrD,cAAc,EAAE,eAAe,CAAC,KAAK,CAAC,cAAc,CAAC;QACrD,GAAG,CAAC,gBAAgB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,KAAc;IACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3C,MAAM,iBAAiB,GAAG,4BAA4B,CACrD,KAAK,CAAC,iBAAiB,EACvB,8BAA8B,CAC9B,CAAC;IACF,MAAM,eAAe,GAAG,4BAA4B,CACnD,KAAK,CAAC,eAAe,EACrB,4BAA4B,CAC5B,CAAC;IACF,MAAM,qBAAqB,GAAG,4BAA4B,CACzD,KAAK,CAAC,qBAAqB,EAC3B,kCAAkC,CAClC,CAAC;IACF,MAAM,mBAAmB,GAAG,4BAA4B,CACvD,KAAK,CAAC,mBAAmB,EACzB,gCAAgC,CAChC,CAAC;IACF,OAAO;QACN,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,GAAG,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/C,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3D,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,KAA2B,EAC3B,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,8BAA8B,CACvC,qCAAqC,CACrC,CAAC;IACH,CAAC;IACD,OAAO;QACN,WAAW,EAAE,mBAAmB,CAAC,KAAK,CAAC,WAAW,EAAE,aAAa,CAAC;QAClE,gBAAgB,EAAE,yBAAyB,CAAC,KAAK,CAAC,gBAAgB,CAAC;QACnE,WAAW,EAAE,oBAAoB,CAAC,KAAK,CAAC,WAAW,CAAC;QACpD,UAAU,EAAE,mBAAmB,CAAC,KAAK,CAAC,UAAU,CAAC;QACjD,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;QAC5B,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,kCAAkC,CACjD,WAAmB,EACnB,KAAgC,EAChC,QAAgC,EAChC,GAAG,GAAG,IAAI,IAAI,EAAE;IAEhB,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,8BAA8B,CACvC,qCAAqC,CACrC,CAAC;IACH,CAAC;IACD,OAAO;QACN,WAAW,EAAE,mBAAmB,CAAC,WAAW,EAAE,aAAa,CAAC;QAC5D,gBAAgB,EAAE,yBAAyB,CAAC;YAC3C,GAAG,CAAC,QAAQ,EAAE,gBAAgB,IAAI,EAAE,CAAC;YACrC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC;SACnE,CAAC;QACF,WAAW,EAAE,oBAAoB,CAAC;YACjC,GAAG,CAAC,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC;YAChC,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;SACzD,CAAC;QACF,UAAU,EAAE,mBAAmB,CAAC;YAC/B,GAAG,CAAC,QAAQ,EAAE,UAAU,IAAI,EAAE,CAAC;YAC/B,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;SACvD,CAAC;QACF,SAAS,EAAE,QAAQ,EAAE,SAAS,IAAI,GAAG,CAAC,WAAW,EAAE;QACnD,SAAS,EAAE,GAAG,CAAC,WAAW,EAAE;KAC5B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,KAAoB;IAC7D,IAAI,CAAC,KAAK;QAAE,OAAO,kBAAkB,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,8BAA8B,CACvC,mCAAmC,CACnC,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,KAAoB;IAC9D,IAAI,CAAC,KAAK;QAAE,OAAO,CAAC,CAAC;IACrB,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,8BAA8B,CACvC,wCAAwC,CACxC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AACf,CAAC;AAED,MAAM,UAAU,iCAAiC,CAAC,MAGjD;IACA,OAAO;QACN,KAAK,EAAE,yBAAyB,CAAC,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC;QACtD,MAAM,EAAE,0BAA0B,CAAC,MAAM,CAAC,MAAM,IAAI,IAAI,CAAC;KACzD,CAAC;AACH,CAAC","sourcesContent":["import type {\n\tWorkspaceConfig,\n\tWorkspaceConfigInput,\n\tWorkspaceConfigListQuery,\n\tWorkspaceConfigPatchInput,\n\tWorkspaceModelPreferences,\n\tWorkspaceRateLimits,\n\tWorkspaceSafetyRules,\n} from \"./types.js\";\n\nconst DEFAULT_LIST_LIMIT = 50;\nconst MAX_LIST_LIMIT = 100;\n\nexport class WorkspaceConfigValidationError extends Error {\n\tconstructor(message: string) {\n\t\tsuper(message);\n\t\tthis.name = \"WorkspaceConfigValidationError\";\n\t}\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n\treturn typeof value === \"object\" && value !== null && !Array.isArray(value);\n}\n\nfunction cleanRequiredString(value: unknown, label: string): string {\n\tif (typeof value !== \"string\") {\n\t\tthrow new WorkspaceConfigValidationError(`${label} is required.`);\n\t}\n\tconst trimmed = value.trim();\n\tif (!trimmed) {\n\t\tthrow new WorkspaceConfigValidationError(`${label} is required.`);\n\t}\n\treturn trimmed;\n}\n\nexport function normalizeWorkspaceConfigId(\n\tworkspaceId: unknown,\n\tlabel = \"workspaceId\",\n): string {\n\treturn cleanRequiredString(workspaceId, label);\n}\n\nfunction cleanOptionalString(value: unknown): string | undefined {\n\tif (typeof value !== \"string\") return undefined;\n\tconst trimmed = value.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction cleanStringList(value: unknown): string[] {\n\tif (!Array.isArray(value)) return [];\n\treturn Array.from(\n\t\tnew Set(\n\t\t\tvalue\n\t\t\t\t.map((entry) => cleanOptionalString(entry))\n\t\t\t\t.filter((entry): entry is string => Boolean(entry)),\n\t\t),\n\t);\n}\n\nfunction cleanOptionalBoolean(value: unknown): boolean | undefined {\n\treturn typeof value === \"boolean\" ? value : undefined;\n}\n\nfunction cleanOptionalPositiveInteger(\n\tvalue: unknown,\n\tlabel: string,\n): number | undefined {\n\tif (value === undefined || value === null) return undefined;\n\tif (typeof value !== \"number\" || !Number.isFinite(value)) {\n\t\tthrow new WorkspaceConfigValidationError(\n\t\t\t`${label} must be a finite number.`,\n\t\t);\n\t}\n\tif (value < 1) {\n\t\tthrow new WorkspaceConfigValidationError(\n\t\t\t`${label} must be a positive integer.`,\n\t\t);\n\t}\n\treturn Math.floor(value);\n}\n\nexport function normalizeModelPreferences(\n\tvalue: unknown,\n): WorkspaceModelPreferences {\n\tconst input = isRecord(value) ? value : {};\n\tconst defaultModel = cleanOptionalString(input.defaultModel);\n\tconst preferredProvider = cleanOptionalString(input.preferredProvider);\n\treturn {\n\t\tallowedModels: cleanStringList(input.allowedModels),\n\t\tblockedModels: cleanStringList(input.blockedModels),\n\t\t...(defaultModel ? { defaultModel } : {}),\n\t\t...(preferredProvider ? { preferredProvider } : {}),\n\t};\n}\n\nexport function normalizeSafetyRules(value: unknown): WorkspaceSafetyRules {\n\tconst input = isRecord(value) ? value : {};\n\tconst requireApprovals = cleanOptionalBoolean(input.requireApprovals);\n\tconst maxTokensPerSession = cleanOptionalPositiveInteger(\n\t\tinput.maxTokensPerSession,\n\t\t\"safetyRules.maxTokensPerSession\",\n\t);\n\treturn {\n\t\tallowedTools: cleanStringList(input.allowedTools),\n\t\tblockedTools: cleanStringList(input.blockedTools),\n\t\trequiredSkills: cleanStringList(input.requiredSkills),\n\t\tfileBoundaries: cleanStringList(input.fileBoundaries),\n\t\t...(requireApprovals !== undefined ? { requireApprovals } : {}),\n\t\t...(maxTokensPerSession ? { maxTokensPerSession } : {}),\n\t};\n}\n\nexport function normalizeRateLimits(value: unknown): WorkspaceRateLimits {\n\tconst input = isRecord(value) ? value : {};\n\tconst requestsPerMinute = cleanOptionalPositiveInteger(\n\t\tinput.requestsPerMinute,\n\t\t\"rateLimits.requestsPerMinute\",\n\t);\n\tconst tokensPerMinute = cleanOptionalPositiveInteger(\n\t\tinput.tokensPerMinute,\n\t\t\"rateLimits.tokensPerMinute\",\n\t);\n\tconst maxConcurrentSessions = cleanOptionalPositiveInteger(\n\t\tinput.maxConcurrentSessions,\n\t\t\"rateLimits.maxConcurrentSessions\",\n\t);\n\tconst maxTokensPerSession = cleanOptionalPositiveInteger(\n\t\tinput.maxTokensPerSession,\n\t\t\"rateLimits.maxTokensPerSession\",\n\t);\n\treturn {\n\t\t...(requestsPerMinute ? { requestsPerMinute } : {}),\n\t\t...(tokensPerMinute ? { tokensPerMinute } : {}),\n\t\t...(maxConcurrentSessions ? { maxConcurrentSessions } : {}),\n\t\t...(maxTokensPerSession ? { maxTokensPerSession } : {}),\n\t};\n}\n\nexport function normalizeWorkspaceConfigInput(\n\tinput: WorkspaceConfigInput,\n\tnow = new Date(),\n): WorkspaceConfig {\n\tif (!isRecord(input)) {\n\t\tthrow new WorkspaceConfigValidationError(\n\t\t\t\"Workspace config must be an object.\",\n\t\t);\n\t}\n\treturn {\n\t\tworkspaceId: cleanRequiredString(input.workspaceId, \"workspaceId\"),\n\t\tmodelPreferences: normalizeModelPreferences(input.modelPreferences),\n\t\tsafetyRules: normalizeSafetyRules(input.safetyRules),\n\t\trateLimits: normalizeRateLimits(input.rateLimits),\n\t\tcreatedAt: now.toISOString(),\n\t\tupdatedAt: now.toISOString(),\n\t};\n}\n\nexport function normalizeWorkspaceConfigPatchInput(\n\tworkspaceId: string,\n\tinput: WorkspaceConfigPatchInput,\n\texisting: WorkspaceConfig | null,\n\tnow = new Date(),\n): WorkspaceConfig {\n\tif (!isRecord(input)) {\n\t\tthrow new WorkspaceConfigValidationError(\n\t\t\t\"Workspace config must be an object.\",\n\t\t);\n\t}\n\treturn {\n\t\tworkspaceId: cleanRequiredString(workspaceId, \"workspaceId\"),\n\t\tmodelPreferences: normalizeModelPreferences({\n\t\t\t...(existing?.modelPreferences ?? {}),\n\t\t\t...(isRecord(input.modelPreferences) ? input.modelPreferences : {}),\n\t\t}),\n\t\tsafetyRules: normalizeSafetyRules({\n\t\t\t...(existing?.safetyRules ?? {}),\n\t\t\t...(isRecord(input.safetyRules) ? input.safetyRules : {}),\n\t\t}),\n\t\trateLimits: normalizeRateLimits({\n\t\t\t...(existing?.rateLimits ?? {}),\n\t\t\t...(isRecord(input.rateLimits) ? input.rateLimits : {}),\n\t\t}),\n\t\tcreatedAt: existing?.createdAt ?? now.toISOString(),\n\t\tupdatedAt: now.toISOString(),\n\t};\n}\n\nexport function parseWorkspaceConfigLimit(value: string | null): number {\n\tif (!value) return DEFAULT_LIST_LIMIT;\n\tconst parsed = Number(value);\n\tif (!Number.isInteger(parsed) || parsed < 1) {\n\t\tthrow new WorkspaceConfigValidationError(\n\t\t\t\"limit must be a positive integer.\",\n\t\t);\n\t}\n\treturn Math.min(parsed, MAX_LIST_LIMIT);\n}\n\nexport function parseWorkspaceConfigOffset(value: string | null): number {\n\tif (!value) return 0;\n\tconst parsed = Number(value);\n\tif (!Number.isInteger(parsed) || parsed < 0) {\n\t\tthrow new WorkspaceConfigValidationError(\n\t\t\t\"offset must be a non-negative integer.\",\n\t\t);\n\t}\n\treturn parsed;\n}\n\nexport function normalizeWorkspaceConfigListQuery(params: {\n\tlimit?: string | null;\n\toffset?: string | null;\n}): WorkspaceConfigListQuery {\n\treturn {\n\t\tlimit: parseWorkspaceConfigLimit(params.limit ?? null),\n\t\toffset: parseWorkspaceConfigOffset(params.offset ?? null),\n\t};\n}\n"]}

package/dist/services/workspace-config/policy.d.ts

@@ -0,0 +1,16 @@
+import type { WorkspaceConfig, WorkspacePolicyViolation } from "./types.js";
+export declare class WorkspacePolicyViolationError extends Error {
+    readonly violation: WorkspacePolicyViolation;
+    constructor(violation: WorkspacePolicyViolation);
+}
+export declare function evaluateModelPolicy(config: WorkspaceConfig | null | undefined, params: {
+    provider: string;
+    modelId: string;
+}): WorkspacePolicyViolation | null;
+export declare function evaluateToolPolicy(config: WorkspaceConfig | null | undefined, toolName: string): WorkspacePolicyViolation | null;
+export declare function evaluateSessionTokenPolicy(config: WorkspaceConfig | null | undefined, tokens: number): WorkspacePolicyViolation | null;
+export declare function assertModelAllowedByWorkspacePolicy(params: {
+    provider: string;
+    modelId: string;
+}): void;
+//# sourceMappingURL=policy.d.ts.map

package/dist/services/workspace-config/policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../../src/services/workspace-config/policy.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,wBAAwB,EAAE,MAAM,YAAY,CAAC;AAE5E,qBAAa,6BAA8B,SAAQ,KAAK;aAC3B,SAAS,EAAE,wBAAwB;gBAAnC,SAAS,EAAE,wBAAwB;CAI/D;AAaD,wBAAgB,mBAAmB,CAClC,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE;IACP,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CAChB,GACC,wBAAwB,GAAG,IAAI,CAuBjC;AAED,wBAAgB,kBAAkB,CACjC,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC1C,QAAQ,EAAE,MAAM,GACd,wBAAwB,GAAG,IAAI,CAoBjC;AAED,wBAAgB,0BAA0B,CACzC,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,SAAS,EAC1C,MAAM,EAAE,MAAM,GACZ,wBAAwB,GAAG,IAAI,CAajC;AAED,wBAAgB,mCAAmC,CAAC,MAAM,EAAE;IAC3D,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;CAChB,GAAG,IAAI,CAMP"}

package/dist/services/workspace-config/policy.js

@@ -0,0 +1,77 @@
+import { getWorkspaceConfigContext } from "../../server/request-context.js";
+export class WorkspacePolicyViolationError extends Error {
+    constructor(violation) {
+        super(violation.message);
+        this.violation = violation;
+        this.name = "WorkspacePolicyViolationError";
+    }
+}
+function modelCandidates(provider, modelId) {
+    return new Set([modelId, `${provider}/${modelId}`]);
+}
+function listContainsCandidate(list, candidates) {
+    return list.some((entry) => candidates.has(entry));
+}
+export function evaluateModelPolicy(config, params) {
+    if (!config)
+        return null;
+    const candidates = modelCandidates(params.provider, params.modelId);
+    if (listContainsCandidate(config.modelPreferences.blockedModels, candidates)) {
+        return {
+            code: "model_blocked",
+            workspaceId: config.workspaceId,
+            message: `Model ${params.provider}/${params.modelId} is blocked by workspace policy.`,
+        };
+    }
+    if (config.modelPreferences.allowedModels.length > 0 &&
+        !listContainsCandidate(config.modelPreferences.allowedModels, candidates)) {
+        return {
+            code: "model_not_allowed",
+            workspaceId: config.workspaceId,
+            message: `Model ${params.provider}/${params.modelId} is not allowed by workspace policy.`,
+        };
+    }
+    return null;
+}
+export function evaluateToolPolicy(config, toolName) {
+    if (!config)
+        return null;
+    if (config.safetyRules.blockedTools.includes(toolName)) {
+        return {
+            code: "tool_blocked",
+            workspaceId: config.workspaceId,
+            message: `Tool ${toolName} is blocked by workspace policy.`,
+        };
+    }
+    if (config.safetyRules.allowedTools.length > 0 &&
+        !config.safetyRules.allowedTools.includes(toolName)) {
+        return {
+            code: "tool_not_allowed",
+            workspaceId: config.workspaceId,
+            message: `Tool ${toolName} is not allowed by workspace policy.`,
+        };
+    }
+    return null;
+}
+export function evaluateSessionTokenPolicy(config, tokens) {
+    if (!config)
+        return null;
+    const maxTokens = config.safetyRules.maxTokensPerSession ??
+        config.rateLimits.maxTokensPerSession;
+    if (maxTokens !== undefined && tokens > maxTokens) {
+        return {
+            code: "token_limit_exceeded",
+            workspaceId: config.workspaceId,
+            message: `Session token budget ${maxTokens} exceeded by requested ${tokens} tokens.`,
+        };
+    }
+    return null;
+}
+export function assertModelAllowedByWorkspacePolicy(params) {
+    const context = getWorkspaceConfigContext();
+    const violation = evaluateModelPolicy(context?.config, params);
+    if (violation) {
+        throw new WorkspacePolicyViolationError(violation);
+    }
+}
+//# sourceMappingURL=policy.js.map

package/dist/services/workspace-config/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../../src/services/workspace-config/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,yBAAyB,EAAE,MAAM,iCAAiC,CAAC;AAG5E,MAAM,OAAO,6BAA8B,SAAQ,KAAK;IACvD,YAA4B,SAAmC;QAC9D,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QADE,cAAS,GAAT,SAAS,CAA0B;QAE9D,IAAI,CAAC,IAAI,GAAG,+BAA+B,CAAC;IAC7C,CAAC;CACD;AAED,SAAS,eAAe,CAAC,QAAgB,EAAE,OAAe;IACzD,OAAO,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,GAAG,QAAQ,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,qBAAqB,CAC7B,IAAc,EACd,UAAuB;IAEvB,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,mBAAmB,CAClC,MAA0C,EAC1C,MAGC;IAED,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACpE,IACC,qBAAqB,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,EACvE,CAAC;QACF,OAAO;YACN,IAAI,EAAE,eAAe;YACrB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,SAAS,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,kCAAkC;SACrF,CAAC;IACH,CAAC;IACD,IACC,MAAM,CAAC,gBAAgB,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC;QAChD,CAAC,qBAAqB,CAAC,MAAM,CAAC,gBAAgB,CAAC,aAAa,EAAE,UAAU,CAAC,EACxE,CAAC;QACF,OAAO;YACN,IAAI,EAAE,mBAAmB;YACzB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,SAAS,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,OAAO,sCAAsC;SACzF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,kBAAkB,CACjC,MAA0C,EAC1C,QAAgB;IAEhB,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACxD,OAAO;YACN,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,QAAQ,QAAQ,kCAAkC;SAC3D,CAAC;IACH,CAAC;IACD,IACC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAC1C,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAClD,CAAC;QACF,OAAO;YACN,IAAI,EAAE,kBAAkB;YACxB,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,QAAQ,QAAQ,sCAAsC;SAC/D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,0BAA0B,CACzC,MAA0C,EAC1C,MAAc;IAEd,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,SAAS,GACd,MAAM,CAAC,WAAW,CAAC,mBAAmB;QACtC,MAAM,CAAC,UAAU,CAAC,mBAAmB,CAAC;IACvC,IAAI,SAAS,KAAK,SAAS,IAAI,MAAM,GAAG,SAAS,EAAE,CAAC;QACnD,OAAO;YACN,IAAI,EAAE,sBAAsB;YAC5B,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,OAAO,EAAE,wBAAwB,SAAS,0BAA0B,MAAM,UAAU;SACpF,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,MAAM,UAAU,mCAAmC,CAAC,MAGnD;IACA,MAAM,OAAO,GAAG,yBAAyB,EAAE,CAAC;IAC5C,MAAM,SAAS,GAAG,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/D,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,IAAI,6BAA6B,CAAC,SAAS,CAAC,CAAC;IACpD,CAAC;AACF,CAAC","sourcesContent":["import { getWorkspaceConfigContext } from \"../../server/request-context.js\";\nimport type { WorkspaceConfig, WorkspacePolicyViolation } from \"./types.js\";\n\nexport class WorkspacePolicyViolationError extends Error {\n\tconstructor(public readonly violation: WorkspacePolicyViolation) {\n\t\tsuper(violation.message);\n\t\tthis.name = \"WorkspacePolicyViolationError\";\n\t}\n}\n\nfunction modelCandidates(provider: string, modelId: string): Set<string> {\n\treturn new Set([modelId, `${provider}/${modelId}`]);\n}\n\nfunction listContainsCandidate(\n\tlist: string[],\n\tcandidates: Set<string>,\n): boolean {\n\treturn list.some((entry) => candidates.has(entry));\n}\n\nexport function evaluateModelPolicy(\n\tconfig: WorkspaceConfig | null | undefined,\n\tparams: {\n\t\tprovider: string;\n\t\tmodelId: string;\n\t},\n): WorkspacePolicyViolation | null {\n\tif (!config) return null;\n\tconst candidates = modelCandidates(params.provider, params.modelId);\n\tif (\n\t\tlistContainsCandidate(config.modelPreferences.blockedModels, candidates)\n\t) {\n\t\treturn {\n\t\t\tcode: \"model_blocked\",\n\t\t\tworkspaceId: config.workspaceId,\n\t\t\tmessage: `Model ${params.provider}/${params.modelId} is blocked by workspace policy.`,\n\t\t};\n\t}\n\tif (\n\t\tconfig.modelPreferences.allowedModels.length > 0 &&\n\t\t!listContainsCandidate(config.modelPreferences.allowedModels, candidates)\n\t) {\n\t\treturn {\n\t\t\tcode: \"model_not_allowed\",\n\t\t\tworkspaceId: config.workspaceId,\n\t\t\tmessage: `Model ${params.provider}/${params.modelId} is not allowed by workspace policy.`,\n\t\t};\n\t}\n\treturn null;\n}\n\nexport function evaluateToolPolicy(\n\tconfig: WorkspaceConfig | null | undefined,\n\ttoolName: string,\n): WorkspacePolicyViolation | null {\n\tif (!config) return null;\n\tif (config.safetyRules.blockedTools.includes(toolName)) {\n\t\treturn {\n\t\t\tcode: \"tool_blocked\",\n\t\t\tworkspaceId: config.workspaceId,\n\t\t\tmessage: `Tool ${toolName} is blocked by workspace policy.`,\n\t\t};\n\t}\n\tif (\n\t\tconfig.safetyRules.allowedTools.length > 0 &&\n\t\t!config.safetyRules.allowedTools.includes(toolName)\n\t) {\n\t\treturn {\n\t\t\tcode: \"tool_not_allowed\",\n\t\t\tworkspaceId: config.workspaceId,\n\t\t\tmessage: `Tool ${toolName} is not allowed by workspace policy.`,\n\t\t};\n\t}\n\treturn null;\n}\n\nexport function evaluateSessionTokenPolicy(\n\tconfig: WorkspaceConfig | null | undefined,\n\ttokens: number,\n): WorkspacePolicyViolation | null {\n\tif (!config) return null;\n\tconst maxTokens =\n\t\tconfig.safetyRules.maxTokensPerSession ??\n\t\tconfig.rateLimits.maxTokensPerSession;\n\tif (maxTokens !== undefined && tokens > maxTokens) {\n\t\treturn {\n\t\t\tcode: \"token_limit_exceeded\",\n\t\t\tworkspaceId: config.workspaceId,\n\t\t\tmessage: `Session token budget ${maxTokens} exceeded by requested ${tokens} tokens.`,\n\t\t};\n\t}\n\treturn null;\n}\n\nexport function assertModelAllowedByWorkspacePolicy(params: {\n\tprovider: string;\n\tmodelId: string;\n}): void {\n\tconst context = getWorkspaceConfigContext();\n\tconst violation = evaluateModelPolicy(context?.config, params);\n\tif (violation) {\n\t\tthrow new WorkspacePolicyViolationError(violation);\n\t}\n}\n"]}

package/dist/services/workspace-config/service.d.ts

@@ -0,0 +1,20 @@
+import { type DbClient } from "../../db/client.js";
+import type { WorkspaceConfig, WorkspaceConfigInput, WorkspaceConfigListQuery, WorkspaceConfigListResult, WorkspaceConfigPatchInput } from "./types.js";
+export declare class WorkspaceConfigUnavailableError extends Error {
+    constructor();
+}
+export declare class WorkspaceConfigService {
+    private readonly getDatabase;
+    private readonly databaseConfigured;
+    constructor(getDatabase?: () => DbClient, databaseConfigured?: () => boolean);
+    isConfigured(): boolean;
+    private requireDatabase;
+    upsertConfig(input: WorkspaceConfigInput): Promise<WorkspaceConfig>;
+    patchConfig(workspaceId: string, input: WorkspaceConfigPatchInput): Promise<WorkspaceConfig>;
+    getConfig(workspaceId: string): Promise<WorkspaceConfig | null>;
+    listConfigs(query: WorkspaceConfigListQuery): Promise<WorkspaceConfigListResult>;
+    deleteConfig(workspaceId: string): Promise<boolean>;
+}
+export declare function getWorkspaceConfigService(): WorkspaceConfigService;
+export declare function setWorkspaceConfigServiceForTest(service: WorkspaceConfigService | null): void;
+//# sourceMappingURL=service.d.ts.map

package/dist/services/workspace-config/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../../src/services/workspace-config/service.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,QAAQ,EAA+B,MAAM,oBAAoB,CAAC;AAWhF,OAAO,KAAK,EACX,eAAe,EACf,oBAAoB,EACpB,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EAEzB,MAAM,YAAY,CAAC;AAMpB,qBAAa,+BAAgC,SAAQ,KAAK;;CAKzD;AA8BD,qBAAa,sBAAsB;IAEjC,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;gBADlB,WAAW,GAAE,MAAM,QAAgB,EACnC,kBAAkB,GAAE,MAAM,OAA8B;IAG1E,YAAY,IAAI,OAAO;IAIvB,OAAO,CAAC,eAAe;IAOjB,YAAY,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,eAAe,CAAC;IAqCnE,WAAW,CAChB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,yBAAyB,GAC9B,OAAO,CAAC,eAAe,CAAC;IAkCrB,SAAS,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IAW/D,WAAW,CAChB,KAAK,EAAE,wBAAwB,GAC7B,OAAO,CAAC,yBAAyB,CAAC;IAqB/B,YAAY,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;CASzD;AAID,wBAAgB,yBAAyB,IAAI,sBAAsB,CAGlE;AAED,wBAAgB,gCAAgC,CAC/C,OAAO,EAAE,sBAAsB,GAAG,IAAI,GACpC,IAAI,CAEN"}

package/dist/services/workspace-config/service.js

@@ -0,0 +1,162 @@
+import { eq, sql } from "drizzle-orm";
+import { getDb, isDatabaseConfigured } from "../../db/client.js";
+import { workspaceConfig } from "../../db/schema.js";
+import { createLogger } from "../../utils/logger.js";
+import { normalizeModelPreferences, normalizeRateLimits, normalizeSafetyRules, normalizeWorkspaceConfigId, normalizeWorkspaceConfigInput, normalizeWorkspaceConfigPatchInput, } from "./normalize.js";
+const logger = createLogger("workspace-config");
+export class WorkspaceConfigUnavailableError extends Error {
+    constructor() {
+        super("Workspace config database is not configured.");
+        this.name = "WorkspaceConfigUnavailableError";
+    }
+}
+function toDateIso(value) {
+    return value instanceof Date
+        ? value.toISOString()
+        : new Date(value).toISOString();
+}
+function configFromRow(row) {
+    return {
+        workspaceId: row.workspaceId,
+        modelPreferences: normalizeModelPreferences(row.modelPreferences),
+        safetyRules: normalizeSafetyRules(row.safetyRules),
+        rateLimits: normalizeRateLimits(row.rateLimits),
+        createdAt: toDateIso(row.createdAt),
+        updatedAt: toDateIso(row.updatedAt),
+    };
+}
+function summaryFromConfig(config) {
+    return {
+        workspaceId: config.workspaceId,
+        modelPreferences: config.modelPreferences,
+        safetyRules: config.safetyRules,
+        rateLimits: config.rateLimits,
+        createdAt: config.createdAt,
+        updatedAt: config.updatedAt,
+    };
+}
+export class WorkspaceConfigService {
+    constructor(getDatabase = getDb, databaseConfigured = isDatabaseConfigured) {
+        this.getDatabase = getDatabase;
+        this.databaseConfigured = databaseConfigured;
+    }
+    isConfigured() {
+        return this.databaseConfigured();
+    }
+    requireDatabase() {
+        if (!this.databaseConfigured()) {
+            throw new WorkspaceConfigUnavailableError();
+        }
+        return this.getDatabase();
+    }
+    async upsertConfig(input) {
+        const config = normalizeWorkspaceConfigInput(input);
+        const db = this.requireDatabase();
+        const now = new Date(config.updatedAt);
+        try {
+            const [row] = await db
+                .insert(workspaceConfig)
+                .values({
+                workspaceId: config.workspaceId,
+                modelPreferences: config.modelPreferences,
+                safetyRules: config.safetyRules,
+                rateLimits: config.rateLimits,
+                createdAt: now,
+                updatedAt: now,
+            })
+                .onConflictDoUpdate({
+                target: workspaceConfig.workspaceId,
+                set: {
+                    modelPreferences: config.modelPreferences,
+                    safetyRules: config.safetyRules,
+                    rateLimits: config.rateLimits,
+                    updatedAt: now,
+                },
+            })
+                .returning();
+            return row ? configFromRow(row) : config;
+        }
+        catch (error) {
+            logger.warn("Failed to upsert workspace config", {
+                error: error instanceof Error ? error.message : String(error),
+                workspaceId: config.workspaceId,
+            });
+            throw error;
+        }
+    }
+    async patchConfig(workspaceId, input) {
+        const existing = await this.getConfig(workspaceId);
+        const config = normalizeWorkspaceConfigPatchInput(workspaceId, input, existing);
+        const db = this.requireDatabase();
+        const now = new Date(config.updatedAt);
+        const [row] = await db
+            .insert(workspaceConfig)
+            .values({
+            workspaceId: config.workspaceId,
+            modelPreferences: config.modelPreferences,
+            safetyRules: config.safetyRules,
+            rateLimits: config.rateLimits,
+            createdAt: new Date(config.createdAt),
+            updatedAt: now,
+        })
+            .onConflictDoUpdate({
+            target: workspaceConfig.workspaceId,
+            set: {
+                modelPreferences: config.modelPreferences,
+                safetyRules: config.safetyRules,
+                rateLimits: config.rateLimits,
+                updatedAt: now,
+            },
+        })
+            .returning();
+        return row ? configFromRow(row) : config;
+    }
+    async getConfig(workspaceId) {
+        const normalizedWorkspaceId = normalizeWorkspaceConfigId(workspaceId);
+        const db = this.requireDatabase();
+        const [row] = await db
+            .select()
+            .from(workspaceConfig)
+            .where(eq(workspaceConfig.workspaceId, normalizedWorkspaceId))
+            .limit(1);
+        return row ? configFromRow(row) : null;
+    }
+    async listConfigs(query) {
+        const db = this.requireDatabase();
+        const rows = await db
+            .select()
+            .from(workspaceConfig)
+            .orderBy(sql `${workspaceConfig.updatedAt} DESC`)
+            .limit(query.limit + 1)
+            .offset(query.offset);
+        const hasMore = rows.length > query.limit;
+        const visibleRows = hasMore ? rows.slice(0, query.limit) : rows;
+        return {
+            configs: visibleRows.map((row) => summaryFromConfig(configFromRow(row))),
+            pagination: {
+                limit: query.limit,
+                offset: query.offset,
+                hasMore,
+                ...(hasMore ? { nextOffset: query.offset + query.limit } : {}),
+            },
+        };
+    }
+    async deleteConfig(workspaceId) {
+        const normalizedWorkspaceId = normalizeWorkspaceConfigId(workspaceId);
+        const db = this.requireDatabase();
+        const deleted = await db
+            .delete(workspaceConfig)
+            .where(eq(workspaceConfig.workspaceId, normalizedWorkspaceId))
+            .returning({ workspaceId: workspaceConfig.workspaceId });
+        return deleted.length > 0;
+    }
+}
+let defaultWorkspaceConfigService = null;
+export function getWorkspaceConfigService() {
+    defaultWorkspaceConfigService ??= new WorkspaceConfigService();
+    return defaultWorkspaceConfigService;
+}
+export function setWorkspaceConfigServiceForTest(service) {
+    defaultWorkspaceConfigService = service;
+}
+//# sourceMappingURL=service.js.map

package/dist/services/workspace-config/service.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../../src/services/workspace-config/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AACtC,OAAO,EAAiB,KAAK,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAChF,OAAO,EAAE,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EACN,yBAAyB,EACzB,mBAAmB,EACnB,oBAAoB,EACpB,0BAA0B,EAC1B,6BAA6B,EAC7B,kCAAkC,GAClC,MAAM,gBAAgB,CAAC;AAUxB,MAAM,MAAM,GAAG,YAAY,CAAC,kBAAkB,CAAC,CAAC;AAIhD,MAAM,OAAO,+BAAgC,SAAQ,KAAK;IACzD;QACC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QACtD,IAAI,CAAC,IAAI,GAAG,iCAAiC,CAAC;IAC/C,CAAC;CACD;AAED,SAAS,SAAS,CAAC,KAAoB;IACtC,OAAO,KAAK,YAAY,IAAI;QAC3B,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE;QACrB,CAAC,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,GAAuB;IAC7C,OAAO;QACN,WAAW,EAAE,GAAG,CAAC,WAAW;QAC5B,gBAAgB,EAAE,yBAAyB,CAAC,GAAG,CAAC,gBAAgB,CAAC;QACjE,WAAW,EAAE,oBAAoB,CAAC,GAAG,CAAC,WAAW,CAAC;QAClD,UAAU,EAAE,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/C,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;QACnC,SAAS,EAAE,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;KACnC,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,MAAuB;IACjD,OAAO;QACN,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;QACzC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,SAAS,EAAE,MAAM,CAAC,SAAS;KAC3B,CAAC;AACH,CAAC;AAED,MAAM,OAAO,sBAAsB;IAClC,YACkB,cAA8B,KAAK,EACnC,qBAAoC,oBAAoB;QADxD,gBAAW,GAAX,WAAW,CAAwB;QACnC,uBAAkB,GAAlB,kBAAkB,CAAsC;IACvE,CAAC;IAEJ,YAAY;QACX,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;IAClC,CAAC;IAEO,eAAe;QACtB,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,EAAE,CAAC;YAChC,MAAM,IAAI,+BAA+B,EAAE,CAAC;QAC7C,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA2B;QAC7C,MAAM,MAAM,GAAG,6BAA6B,CAAC,KAAK,CAAC,CAAC;QACpD,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,IAAI,CAAC;YACJ,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;iBACpB,MAAM,CAAC,eAAe,CAAC;iBACvB,MAAM,CAAC;gBACP,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,GAAG;gBACd,SAAS,EAAE,GAAG;aACd,CAAC;iBACD,kBAAkB,CAAC;gBACnB,MAAM,EAAE,eAAe,CAAC,WAAW;gBACnC,GAAG,EAAE;oBACJ,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;oBACzC,WAAW,EAAE,MAAM,CAAC,WAAW;oBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,SAAS,EAAE,GAAG;iBACd;aACD,CAAC;iBACD,SAAS,EAAE,CAAC;YAEd,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,mCAAmC,EAAE;gBAChD,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;gBAC7D,WAAW,EAAE,MAAM,CAAC,WAAW;aAC/B,CAAC,CAAC;YACH,MAAM,KAAK,CAAC;QACb,CAAC;IACF,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,WAAmB,EACnB,KAAgC;QAEhC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,kCAAkC,CAChD,WAAW,EACX,KAAK,EACL,QAAQ,CACR,CAAC;QACF,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,GAAG,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAEvC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,CAAC,eAAe,CAAC;aACvB,MAAM,CAAC;YACP,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;YACzC,WAAW,EAAE,MAAM,CAAC,WAAW;YAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,SAAS,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC;YACrC,SAAS,EAAE,GAAG;SACd,CAAC;aACD,kBAAkB,CAAC;YACnB,MAAM,EAAE,eAAe,CAAC,WAAW;YACnC,GAAG,EAAE;gBACJ,gBAAgB,EAAE,MAAM,CAAC,gBAAgB;gBACzC,WAAW,EAAE,MAAM,CAAC,WAAW;gBAC/B,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,SAAS,EAAE,GAAG;aACd;SACD,CAAC;aACD,SAAS,EAAE,CAAC;QAEd,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1C,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,WAAmB;QAClC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE;aACpB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;aAC7D,KAAK,CAAC,CAAC,CAAC,CAAC;QACX,OAAO,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,WAAW,CAChB,KAA+B;QAE/B,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,IAAI,GAAG,MAAM,EAAE;aACnB,MAAM,EAAE;aACR,IAAI,CAAC,eAAe,CAAC;aACrB,OAAO,CAAC,GAAG,CAAA,GAAG,eAAe,CAAC,SAAS,OAAO,CAAC;aAC/C,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;aACtB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QAC1C,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAChE,OAAO;YACN,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,iBAAiB,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;YACxE,UAAU,EAAE;gBACX,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,OAAO;gBACP,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D;SACD,CAAC;IACH,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,WAAmB;QACrC,MAAM,qBAAqB,GAAG,0BAA0B,CAAC,WAAW,CAAC,CAAC;QACtE,MAAM,EAAE,GAAG,IAAI,CAAC,eAAe,EAAE,CAAC;QAClC,MAAM,OAAO,GAAG,MAAM,EAAE;aACtB,MAAM,CAAC,eAAe,CAAC;aACvB,KAAK,CAAC,EAAE,CAAC,eAAe,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;aAC7D,SAAS,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,WAAW,EAAE,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC3B,CAAC;CACD;AAED,IAAI,6BAA6B,GAAkC,IAAI,CAAC;AAExE,MAAM,UAAU,yBAAyB;IACxC,6BAA6B,KAAK,IAAI,sBAAsB,EAAE,CAAC;IAC/D,OAAO,6BAA6B,CAAC;AACtC,CAAC;AAED,MAAM,UAAU,gCAAgC,CAC/C,OAAsC;IAEtC,6BAA6B,GAAG,OAAO,CAAC;AACzC,CAAC","sourcesContent":["import { eq, sql } from \"drizzle-orm\";\nimport { type DbClient, getDb, isDatabaseConfigured } from \"../../db/client.js\";\nimport { workspaceConfig } from \"../../db/schema.js\";\nimport { createLogger } from \"../../utils/logger.js\";\nimport {\n\tnormalizeModelPreferences,\n\tnormalizeRateLimits,\n\tnormalizeSafetyRules,\n\tnormalizeWorkspaceConfigId,\n\tnormalizeWorkspaceConfigInput,\n\tnormalizeWorkspaceConfigPatchInput,\n} from \"./normalize.js\";\nimport type {\n\tWorkspaceConfig,\n\tWorkspaceConfigInput,\n\tWorkspaceConfigListQuery,\n\tWorkspaceConfigListResult,\n\tWorkspaceConfigPatchInput,\n\tWorkspaceConfigSummary,\n} from \"./types.js\";\n\nconst logger = createLogger(\"workspace-config\");\n\ntype WorkspaceConfigRow = typeof workspaceConfig.$inferSelect;\n\nexport class WorkspaceConfigUnavailableError extends Error {\n\tconstructor() {\n\t\tsuper(\"Workspace config database is not configured.\");\n\t\tthis.name = \"WorkspaceConfigUnavailableError\";\n\t}\n}\n\nfunction toDateIso(value: Date | string): string {\n\treturn value instanceof Date\n\t\t? value.toISOString()\n\t\t: new Date(value).toISOString();\n}\n\nfunction configFromRow(row: WorkspaceConfigRow): WorkspaceConfig {\n\treturn {\n\t\tworkspaceId: row.workspaceId,\n\t\tmodelPreferences: normalizeModelPreferences(row.modelPreferences),\n\t\tsafetyRules: normalizeSafetyRules(row.safetyRules),\n\t\trateLimits: normalizeRateLimits(row.rateLimits),\n\t\tcreatedAt: toDateIso(row.createdAt),\n\t\tupdatedAt: toDateIso(row.updatedAt),\n\t};\n}\n\nfunction summaryFromConfig(config: WorkspaceConfig): WorkspaceConfigSummary {\n\treturn {\n\t\tworkspaceId: config.workspaceId,\n\t\tmodelPreferences: config.modelPreferences,\n\t\tsafetyRules: config.safetyRules,\n\t\trateLimits: config.rateLimits,\n\t\tcreatedAt: config.createdAt,\n\t\tupdatedAt: config.updatedAt,\n\t};\n}\n\nexport class WorkspaceConfigService {\n\tconstructor(\n\t\tprivate readonly getDatabase: () => DbClient = getDb,\n\t\tprivate readonly databaseConfigured: () => boolean = isDatabaseConfigured,\n\t) {}\n\n\tisConfigured(): boolean {\n\t\treturn this.databaseConfigured();\n\t}\n\n\tprivate requireDatabase(): DbClient {\n\t\tif (!this.databaseConfigured()) {\n\t\t\tthrow new WorkspaceConfigUnavailableError();\n\t\t}\n\t\treturn this.getDatabase();\n\t}\n\n\tasync upsertConfig(input: WorkspaceConfigInput): Promise<WorkspaceConfig> {\n\t\tconst config = normalizeWorkspaceConfigInput(input);\n\t\tconst db = this.requireDatabase();\n\t\tconst now = new Date(config.updatedAt);\n\n\t\ttry {\n\t\t\tconst [row] = await db\n\t\t\t\t.insert(workspaceConfig)\n\t\t\t\t.values({\n\t\t\t\t\tworkspaceId: config.workspaceId,\n\t\t\t\t\tmodelPreferences: config.modelPreferences,\n\t\t\t\t\tsafetyRules: config.safetyRules,\n\t\t\t\t\trateLimits: config.rateLimits,\n\t\t\t\t\tcreatedAt: now,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t})\n\t\t\t\t.onConflictDoUpdate({\n\t\t\t\t\ttarget: workspaceConfig.workspaceId,\n\t\t\t\t\tset: {\n\t\t\t\t\t\tmodelPreferences: config.modelPreferences,\n\t\t\t\t\t\tsafetyRules: config.safetyRules,\n\t\t\t\t\t\trateLimits: config.rateLimits,\n\t\t\t\t\t\tupdatedAt: now,\n\t\t\t\t\t},\n\t\t\t\t})\n\t\t\t\t.returning();\n\n\t\t\treturn row ? configFromRow(row) : config;\n\t\t} catch (error) {\n\t\t\tlogger.warn(\"Failed to upsert workspace config\", {\n\t\t\t\terror: error instanceof Error ? error.message : String(error),\n\t\t\t\tworkspaceId: config.workspaceId,\n\t\t\t});\n\t\t\tthrow error;\n\t\t}\n\t}\n\n\tasync patchConfig(\n\t\tworkspaceId: string,\n\t\tinput: WorkspaceConfigPatchInput,\n\t): Promise<WorkspaceConfig> {\n\t\tconst existing = await this.getConfig(workspaceId);\n\t\tconst config = normalizeWorkspaceConfigPatchInput(\n\t\t\tworkspaceId,\n\t\t\tinput,\n\t\t\texisting,\n\t\t);\n\t\tconst db = this.requireDatabase();\n\t\tconst now = new Date(config.updatedAt);\n\n\t\tconst [row] = await db\n\t\t\t.insert(workspaceConfig)\n\t\t\t.values({\n\t\t\t\tworkspaceId: config.workspaceId,\n\t\t\t\tmodelPreferences: config.modelPreferences,\n\t\t\t\tsafetyRules: config.safetyRules,\n\t\t\t\trateLimits: config.rateLimits,\n\t\t\t\tcreatedAt: new Date(config.createdAt),\n\t\t\t\tupdatedAt: now,\n\t\t\t})\n\t\t\t.onConflictDoUpdate({\n\t\t\t\ttarget: workspaceConfig.workspaceId,\n\t\t\t\tset: {\n\t\t\t\t\tmodelPreferences: config.modelPreferences,\n\t\t\t\t\tsafetyRules: config.safetyRules,\n\t\t\t\t\trateLimits: config.rateLimits,\n\t\t\t\t\tupdatedAt: now,\n\t\t\t\t},\n\t\t\t})\n\t\t\t.returning();\n\n\t\treturn row ? configFromRow(row) : config;\n\t}\n\n\tasync getConfig(workspaceId: string): Promise<WorkspaceConfig | null> {\n\t\tconst normalizedWorkspaceId = normalizeWorkspaceConfigId(workspaceId);\n\t\tconst db = this.requireDatabase();\n\t\tconst [row] = await db\n\t\t\t.select()\n\t\t\t.from(workspaceConfig)\n\t\t\t.where(eq(workspaceConfig.workspaceId, normalizedWorkspaceId))\n\t\t\t.limit(1);\n\t\treturn row ? configFromRow(row) : null;\n\t}\n\n\tasync listConfigs(\n\t\tquery: WorkspaceConfigListQuery,\n\t): Promise<WorkspaceConfigListResult> {\n\t\tconst db = this.requireDatabase();\n\t\tconst rows = await db\n\t\t\t.select()\n\t\t\t.from(workspaceConfig)\n\t\t\t.orderBy(sql`${workspaceConfig.updatedAt} DESC`)\n\t\t\t.limit(query.limit + 1)\n\t\t\t.offset(query.offset);\n\t\tconst hasMore = rows.length > query.limit;\n\t\tconst visibleRows = hasMore ? rows.slice(0, query.limit) : rows;\n\t\treturn {\n\t\t\tconfigs: visibleRows.map((row) => summaryFromConfig(configFromRow(row))),\n\t\t\tpagination: {\n\t\t\t\tlimit: query.limit,\n\t\t\t\toffset: query.offset,\n\t\t\t\thasMore,\n\t\t\t\t...(hasMore ? { nextOffset: query.offset + query.limit } : {}),\n\t\t\t},\n\t\t};\n\t}\n\n\tasync deleteConfig(workspaceId: string): Promise<boolean> {\n\t\tconst normalizedWorkspaceId = normalizeWorkspaceConfigId(workspaceId);\n\t\tconst db = this.requireDatabase();\n\t\tconst deleted = await db\n\t\t\t.delete(workspaceConfig)\n\t\t\t.where(eq(workspaceConfig.workspaceId, normalizedWorkspaceId))\n\t\t\t.returning({ workspaceId: workspaceConfig.workspaceId });\n\t\treturn deleted.length > 0;\n\t}\n}\n\nlet defaultWorkspaceConfigService: WorkspaceConfigService | null = null;\n\nexport function getWorkspaceConfigService(): WorkspaceConfigService {\n\tdefaultWorkspaceConfigService ??= new WorkspaceConfigService();\n\treturn defaultWorkspaceConfigService;\n}\n\nexport function setWorkspaceConfigServiceForTest(\n\tservice: WorkspaceConfigService | null,\n): void {\n\tdefaultWorkspaceConfigService = service;\n}\n"]}

package/dist/services/workspace-config/types.d.ts

@@ -0,0 +1,71 @@
+export interface WorkspaceModelPreferences {
+    defaultModel?: string;
+    preferredProvider?: string;
+    allowedModels: string[];
+    blockedModels: string[];
+}
+export interface WorkspaceSafetyRules {
+    allowedTools: string[];
+    blockedTools: string[];
+    requiredSkills: string[];
+    fileBoundaries: string[];
+    requireApprovals?: boolean;
+    maxTokensPerSession?: number;
+}
+export interface WorkspaceRateLimits {
+    requestsPerMinute?: number;
+    tokensPerMinute?: number;
+    maxConcurrentSessions?: number;
+    maxTokensPerSession?: number;
+}
+export interface WorkspaceConfigInput {
+    workspaceId: string;
+    modelPreferences?: Partial<WorkspaceModelPreferences>;
+    safetyRules?: Partial<WorkspaceSafetyRules>;
+    rateLimits?: Partial<WorkspaceRateLimits>;
+}
+export interface WorkspaceConfigPatchInput {
+    modelPreferences?: Partial<WorkspaceModelPreferences>;
+    safetyRules?: Partial<WorkspaceSafetyRules>;
+    rateLimits?: Partial<WorkspaceRateLimits>;
+}
+export interface WorkspaceConfig {
+    workspaceId: string;
+    modelPreferences: WorkspaceModelPreferences;
+    safetyRules: WorkspaceSafetyRules;
+    rateLimits: WorkspaceRateLimits;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface WorkspaceConfigSummary {
+    workspaceId: string;
+    modelPreferences: WorkspaceModelPreferences;
+    safetyRules: WorkspaceSafetyRules;
+    rateLimits: WorkspaceRateLimits;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface WorkspaceConfigListQuery {
+    limit: number;
+    offset: number;
+}
+export interface WorkspaceConfigListResult {
+    configs: WorkspaceConfigSummary[];
+    pagination: {
+        limit: number;
+        offset: number;
+        nextOffset?: number;
+        hasMore: boolean;
+    };
+}
+export interface WorkspaceConfigRequestContext {
+    workspaceId: string;
+    config: WorkspaceConfig | null;
+    source: "database" | "missing" | "unconfigured";
+}
+export interface WorkspacePolicyViolation {
+    code: "model_blocked" | "model_not_allowed" | "tool_blocked" | "tool_not_allowed" | "token_limit_exceeded" | "file_boundary_violation";
+    message: string;
+    workspaceId: string;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/services/workspace-config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/services/workspace-config/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,yBAAyB;IACzC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACpC,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,mBAAmB;IACnC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5C,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,yBAAyB;IACzC,gBAAgB,CAAC,EAAE,OAAO,CAAC,yBAAyB,CAAC,CAAC;IACtD,WAAW,CAAC,EAAE,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5C,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,eAAe;IAC/B,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,EAAE,mBAAmB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,sBAAsB;IACtC,WAAW,EAAE,MAAM,CAAC;IACpB,gBAAgB,EAAE,yBAAyB,CAAC;IAC5C,WAAW,EAAE,oBAAoB,CAAC;IAClC,UAAU,EAAE,mBAAmB,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,wBAAwB;IACxC,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,yBAAyB;IACzC,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAClC,UAAU,EAAE;QACX,KAAK,EAAE,MAAM,CAAC;QACd,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,OAAO,CAAC;KACjB,CAAC;CACF;AAED,MAAM,WAAW,6BAA6B;IAC7C,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,eAAe,GAAG,IAAI,CAAC;IAC/B,MAAM,EAAE,UAAU,GAAG,SAAS,GAAG,cAAc,CAAC;CAChD;AAED,MAAM,WAAW,wBAAwB;IACxC,IAAI,EACD,eAAe,GACf,mBAAmB,GACnB,cAAc,GACd,kBAAkB,GAClB,sBAAsB,GACtB,yBAAyB,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACpB"}

package/dist/services/workspace-config/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/services/workspace-config/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/services/workspace-config/types.ts"],"names":[],"mappings":"","sourcesContent":["export interface WorkspaceModelPreferences {\n\tdefaultModel?: string;\n\tpreferredProvider?: string;\n\tallowedModels: string[];\n\tblockedModels: string[];\n}\n\nexport interface WorkspaceSafetyRules {\n\tallowedTools: string[];\n\tblockedTools: string[];\n\trequiredSkills: string[];\n\tfileBoundaries: string[];\n\trequireApprovals?: boolean;\n\tmaxTokensPerSession?: number;\n}\n\nexport interface WorkspaceRateLimits {\n\trequestsPerMinute?: number;\n\ttokensPerMinute?: number;\n\tmaxConcurrentSessions?: number;\n\tmaxTokensPerSession?: number;\n}\n\nexport interface WorkspaceConfigInput {\n\tworkspaceId: string;\n\tmodelPreferences?: Partial<WorkspaceModelPreferences>;\n\tsafetyRules?: Partial<WorkspaceSafetyRules>;\n\trateLimits?: Partial<WorkspaceRateLimits>;\n}\n\nexport interface WorkspaceConfigPatchInput {\n\tmodelPreferences?: Partial<WorkspaceModelPreferences>;\n\tsafetyRules?: Partial<WorkspaceSafetyRules>;\n\trateLimits?: Partial<WorkspaceRateLimits>;\n}\n\nexport interface WorkspaceConfig {\n\tworkspaceId: string;\n\tmodelPreferences: WorkspaceModelPreferences;\n\tsafetyRules: WorkspaceSafetyRules;\n\trateLimits: WorkspaceRateLimits;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface WorkspaceConfigSummary {\n\tworkspaceId: string;\n\tmodelPreferences: WorkspaceModelPreferences;\n\tsafetyRules: WorkspaceSafetyRules;\n\trateLimits: WorkspaceRateLimits;\n\tcreatedAt: string;\n\tupdatedAt: string;\n}\n\nexport interface WorkspaceConfigListQuery {\n\tlimit: number;\n\toffset: number;\n}\n\nexport interface WorkspaceConfigListResult {\n\tconfigs: WorkspaceConfigSummary[];\n\tpagination: {\n\t\tlimit: number;\n\t\toffset: number;\n\t\tnextOffset?: number;\n\t\thasMore: boolean;\n\t};\n}\n\nexport interface WorkspaceConfigRequestContext {\n\tworkspaceId: string;\n\tconfig: WorkspaceConfig | null;\n\tsource: \"database\" | \"missing\" | \"unconfigured\";\n}\n\nexport interface WorkspacePolicyViolation {\n\tcode:\n\t\t| \"model_blocked\"\n\t\t| \"model_not_allowed\"\n\t\t| \"tool_blocked\"\n\t\t| \"tool_not_allowed\"\n\t\t| \"token_limit_exceeded\"\n\t\t| \"file_boundary_violation\";\n\tmessage: string;\n\tworkspaceId: string;\n}\n"]}