@evalops/maestro 0.10.8 → 0.10.10

package/dist/approvals/platform-action-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platform-action-approval.js","sourceRoot":"","sources":["../../src/approvals/platform-action-approval.ts"],"names":[],"mappings":"AAAA,OAAO,EAGN,qBAAqB,GAErB,MAAM,6BAA6B,CAAC;AACrC,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAGN,mCAAmC,EACnC,mCAAmC,EACnC,6BAA6B,GAC7B,MAAM,qBAAqB,CAAC;AAuB7B,MAAM,MAAM,GAAG,YAAY,CAAC,oCAAoC,CAAC,CAAC;AAClE,MAAM,6CAA6C,GAAG,MAAM,CAAC;AAE7D,MAAM,OAAO,mCAAoC,SAAQ,qBAAqB;IAY7E,YACC,IAAmB,EACnB,UAA+C,EAAE;QAEjD,KAAK,CAAC,IAAI,CAAC,CAAC;QAbI,iCAA4B,GAAG,IAAI,GAAG,EAGpD,CAAC;QACa,uCAAkC,GAAG,IAAI,GAAG,EAG1D,CAAC;QAOH,IAAI,CAAC,iBAAiB,GAAG,OAAO,CAAC,iBAAiB,CAAC;QACnD,IAAI,CAAC,sBAAsB,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAC9D,CAAC;IAEQ,KAAK,CAAC,eAAe,CAC7B,OAA8B,EAC9B,MAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,CAAC;YACrC,OAAO,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QACtC,MAAM,kBAAkB,GAAG,IAAI,CAAC,4BAA4B,EAAE;YAC7D,CAAC,CAAC,MAAM,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC;YAC9D,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACpB,IAAI,UAAU,IAAI,kBAAkB,EAAE,CAAC;YACtC,IAAI,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1D,OAAO,kBAAkB,CAAC,QAAQ,CAAC;QACpC,CAAC;QAED,IAAI,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE,EAAE;YACnD,uBAAuB,EAAE,kBAAkB,CAAC,MAAM,EAAE,SAAS;SAC7D,CAAC,CAAC;QACH,IAAI,kBAAkB,CAAC,MAAM,EAAE,SAAS,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;YAC/D,OAAO,CAAC,QAAQ,GAAG;gBAClB,MAAM,EAAE,mBAAmB;gBAC3B,iBAAiB,EAAE,kBAAkB,CAAC,MAAM,CAAC,SAAS;aACtD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACrD,IAAI,CAAC;YACJ,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAC9D,IAAI,kBAAkB,CAAC,MAAM,EAAE,CAAC;gBAC/B,OAAO,MAAM,IAAI,CAAC,qBAAqB,CACtC,kBAAkB,CAAC,MAAM,EACzB,QAAQ,EACR,MAAM,CACN,CAAC;YACH,CAAC;YACD,OAAO,QAAQ,CAAC;QACjB,CAAC;gBAAS,CAAC;YACV,IAAI,CAAC,kCAAkC,CAAC,OAAO,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;YAC1D,IAAI,CAAC,wBAAwB,CAAC,OAAO,CAAC,CAAC;QACxC,CAAC;IACF,CAAC;IAED,8BAA8B,CAC7B,SAAiB;QAEjB,OAAO,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACzD,CAAC;IAED,kCAAkC,CACjC,SAAiB,EACjB,UAAwD,EAAE;QAE1D,MAAM,QAAQ,GAAG,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAClE,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;YAC7B,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC9B,CAAC;QAED,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC9B,MAAM,OAAO,GAAG,IAAI,CAAC;YACrB,IAAI,OAAO,GAAG,KAAK,CAAC;YACpB,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YACnC,MAAM,OAAO,GAAG,UAAU,CACzB,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,EAClB,OAAO,CAAC,SAAS,IAAI,6CAA6C,CAClE,CAAC;YACF,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;YAClB,MAAM,MAAM,GAAsC;gBACjD,OAAO,EAAE,MAAM;gBACf,OAAO;aACP,CAAC;YACF,SAAS,MAAM,CAAC,YAAgD;gBAC/D,IAAI,OAAO,EAAE,CAAC;oBACb,OAAO;gBACR,CAAC;gBACD,OAAO,GAAG,IAAI,CAAC;gBACf,YAAY,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBACtD,OAAO,CAAC,uCAAuC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;gBACnE,OAAO,CAAC,YAAY,CAAC,CAAC;YACvB,CAAC;YACD,MAAM,OAAO,GACZ,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC;YAC9D,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;YAChE,OAAO,CAAC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACJ,CAAC;IAES,2BAA2B,CACpC,UAA8B,EAC9B,QAA+B,IACvB,CAAC;IAEA,wBAAwB,CAAC,QAA+B,IAAS,CAAC;IAEpE,kCAAkC,CACzC,SAAiB,EACjB,YAAgD;QAEhD,IAAI,YAAY,EAAE,CAAC;YAClB,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;QAChE,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,4BAA4B,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACrD,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;QACR,CAAC;QACD,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC1D,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC9B,MAAM,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QAC9B,CAAC;IACF,CAAC;IAEO,uCAAuC,CAC9C,SAAiB,EACjB,MAAyC;QAEzC,MAAM,OAAO,GAAG,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACvE,IAAI,CAAC,OAAO,EAAE,CAAC;YACd,OAAO;QACR,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC;QACtE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,kCAAkC,CAAC,GAAG,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnE,CAAC;aAAM,CAAC;YACP,IAAI,CAAC,kCAAkC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC3D,CAAC;IACF,CAAC;IAEO,YAAY;QACnB,IAAI,OAAO,IAAI,CAAC,iBAAiB,KAAK,UAAU,EAAE,CAAC;YAClD,OAAO,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACjC,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC;IAC/B,CAAC;IAEO,4BAA4B;QACnC,IAAI,IAAI,CAAC,sBAAsB,KAAK,KAAK,EAAE,CAAC;YAC3C,OAAO,KAAK,CAAC;QACd,CAAC;QACD,IAAI,IAAI,CAAC,sBAAsB,EAAE,OAAO,EAAE,CAAC;YAC1C,OAAO,IAAI,CAAC;QACb,CAAC;QACD,OAAO,OAAO,CACb,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,IAAI,EAAE;YACxC,OAAO,CAAC,GAAG,CAAC,6BAA6B,EAAE,IAAI,EAAE;YACjD,OAAO,CAAC,GAAG,CAAC,yBAAyB,EAAE,IAAI,EAAE;YAC7C,OAAO,CAAC,GAAG,CAAC,wBAAwB,EAAE,IAAI,EAAE;YAC5C,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,IAAI,EAAE,CACrC,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAClC,OAA8B,EAC9B,SAA6B,EAC7B,MAAoB;QAKpB,IAAI,MAA6C,CAAC;QAClD,IAAI,CAAC;YACJ,MAAM,GAAG,6BAA6B,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;QACrE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,MAAM,CAAC,IAAI,CACV,kEAAkE,EAClE;gBACC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC1B,CACD,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACb,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAED,IAAI,CAAC;YACJ,MAAM,MAAM,GAAG,MAAM,mCAAmC,CACvD,MAAM,EACN,OAAO,EACP;gBACC,SAAS;gBACT,MAAM;aACN,CACD,CAAC;YACF,IAAI,CAAC,MAAM,EAAE,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;YACzB,CAAC;YACD,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;gBAC/B,OAAO;oBACN,QAAQ,EAAE;wBACT,QAAQ,EAAE,IAAI;wBACd,MAAM,EAAE,MAAM,CAAC,kBAAkB;wBACjC,UAAU,EAAE,QAAQ;qBACpB;iBACD,CAAC;YACH,CAAC;YACD,OAAO,EAAE,MAAM,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,EAAE,CAAC;QAC5D,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,WAAW,KAAK,UAAU,EAAE,CAAC;gBACvC,OAAO;oBACN,QAAQ,EAAE;wBACT,QAAQ,EAAE,KAAK;wBACf,MAAM,EAAE,kCAAkC,OAAO,EAAE;wBACnD,UAAU,EAAE,QAAQ;qBACpB;iBACD,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CACV,0EAA0E,EAC1E;gBACC,KAAK,EAAE,OAAO;gBACd,QAAQ,EAAE,OAAO,CAAC,QAAQ;aAC1B,CACD,CAAC;YACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;IACF,CAAC;IAEO,KAAK,CAAC,qBAAqB,CAClC,MAAkC,EAClC,QAAgC,EAChC,MAAoB;QAEpB,IAAI,CAAC;YACJ,MAAM,mCAAmC,CACxC,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,SAAS,EAChB,QAAQ,EACR,EAAE,MAAM,EAAE,CACV,CAAC;YACF,OAAO,QAAQ,CAAC;QACjB,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,IAAI,MAAM,CAAC,MAAM,CAAC,WAAW,KAAK,UAAU,IAAI,QAAQ,CAAC,QAAQ,EAAE,CAAC;gBACnE,OAAO;oBACN,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,2CAA2C,OAAO,EAAE;oBAC5D,UAAU,EAAE,QAAQ;iBACpB,CAAC;YACH,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,uDAAuD,EAAE;gBACpE,KAAK,EAAE,OAAO;gBACd,eAAe,EAAE,MAAM,CAAC,SAAS;aACjC,CAAC,CAAC;YACH,OAAO,QAAQ,CAAC;QACjB,CAAC;IACF,CAAC;CACD","sourcesContent":["import {\n\ttype ActionApprovalDecision,\n\ttype ActionApprovalRequest,\n\tActionApprovalService,\n\ttype ApprovalMode,\n} from \"../agent/action-approval.js\";\nimport { createLogger } from \"../utils/logger.js\";\nimport {\n\ttype ApprovalsServiceConfig,\n\ttype ResolvedApprovalsServiceConfig,\n\trequestApprovalWithApprovalsService,\n\tresolveApprovalWithApprovalsService,\n\tresolveApprovalsServiceConfig,\n} from \"./service-client.js\";\n\nexport type SessionIdProvider = string | (() => string | undefined);\n\ntype RemoteApprovalRegistration = {\n\tconfig: ResolvedApprovalsServiceConfig;\n\trequestId: string;\n};\n\nexport interface PendingApprovalRegistration {\n\tremoteApprovalRequestId?: string;\n}\n\ninterface PendingApprovalRegistrationWaiter {\n\tresolve: (registration: PendingApprovalRegistration | null) => void;\n\ttimeout: ReturnType<typeof setTimeout>;\n}\n\nexport interface PlatformBackedActionApprovalOptions {\n\tsessionIdProvider?: SessionIdProvider;\n\tapprovalsServiceConfig?: ApprovalsServiceConfig | false;\n}\n\nconst logger = createLogger(\"approvals:platform-action-approval\");\nconst PENDING_APPROVAL_REGISTRATION_WAIT_TIMEOUT_MS = 30_000;\n\nexport class PlatformBackedActionApprovalService extends ActionApprovalService {\n\tprivate readonly sessionIdProvider?: SessionIdProvider;\n\tprivate readonly approvalsServiceConfig?: ApprovalsServiceConfig | false;\n\tprivate readonly pendingApprovalRegistrations = new Map<\n\t\tstring,\n\t\tPendingApprovalRegistration\n\t>();\n\tprivate readonly pendingApprovalRegistrationWaiters = new Map<\n\t\tstring,\n\t\tPendingApprovalRegistrationWaiter[]\n\t>();\n\n\tconstructor(\n\t\tmode?: ApprovalMode,\n\t\toptions: PlatformBackedActionApprovalOptions = {},\n\t) {\n\t\tsuper(mode);\n\t\tthis.sessionIdProvider = options.sessionIdProvider;\n\t\tthis.approvalsServiceConfig = options.approvalsServiceConfig;\n\t}\n\n\toverride async requestApproval(\n\t\trequest: ActionApprovalRequest,\n\t\tsignal?: AbortSignal,\n\t): Promise<ActionApprovalDecision> {\n\t\tif (!this.requiresUserInteraction()) {\n\t\t\treturn await super.requestApproval(request, signal);\n\t\t}\n\n\t\tconst sessionId = this.getSessionId();\n\t\tconst remoteRegistration = this.hasApprovalsServiceCandidate()\n\t\t\t? await this.requestRemoteApproval(request, sessionId, signal)\n\t\t\t: { remote: null };\n\t\tif (\"decision\" in remoteRegistration) {\n\t\t\tthis.publishPendingApprovalRegistration(request.id, null);\n\t\t\treturn remoteRegistration.decision;\n\t\t}\n\n\t\tthis.publishPendingApprovalRegistration(request.id, {\n\t\t\tremoteApprovalRequestId: remoteRegistration.remote?.requestId,\n\t\t});\n\t\tif (remoteRegistration.remote?.requestId && !request.platform) {\n\t\t\trequest.platform = {\n\t\t\t\tsource: \"approvals_service\",\n\t\t\t\tapprovalRequestId: remoteRegistration.remote.requestId,\n\t\t\t};\n\t\t}\n\t\tthis.onPendingApprovalRegistered(sessionId, request);\n\t\ttry {\n\t\t\tconst decision = await super.requestApproval(request, signal);\n\t\t\tif (remoteRegistration.remote) {\n\t\t\t\treturn await this.resolveRemoteApproval(\n\t\t\t\t\tremoteRegistration.remote,\n\t\t\t\t\tdecision,\n\t\t\t\t\tsignal,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn decision;\n\t\t} finally {\n\t\t\tthis.publishPendingApprovalRegistration(request.id, null);\n\t\t\tthis.onPendingApprovalSettled(request);\n\t\t}\n\t}\n\n\tgetPendingApprovalRegistration(\n\t\trequestId: string,\n\t): PendingApprovalRegistration | undefined {\n\t\treturn this.pendingApprovalRegistrations.get(requestId);\n\t}\n\n\twaitForPendingApprovalRegistration(\n\t\trequestId: string,\n\t\toptions: { signal?: AbortSignal; timeoutMs?: number } = {},\n\t): Promise<PendingApprovalRegistration | null> {\n\t\tconst existing = this.pendingApprovalRegistrations.get(requestId);\n\t\tif (existing) {\n\t\t\treturn Promise.resolve(existing);\n\t\t}\n\t\tif (options.signal?.aborted) {\n\t\t\treturn Promise.resolve(null);\n\t\t}\n\n\t\treturn new Promise((resolve) => {\n\t\t\tconst service = this;\n\t\t\tlet settled = false;\n\t\t\tconst onAbort = () => finish(null);\n\t\t\tconst timeout = setTimeout(\n\t\t\t\t() => finish(null),\n\t\t\t\toptions.timeoutMs ?? PENDING_APPROVAL_REGISTRATION_WAIT_TIMEOUT_MS,\n\t\t\t);\n\t\t\ttimeout.unref?.();\n\t\t\tconst waiter: PendingApprovalRegistrationWaiter = {\n\t\t\t\tresolve: finish,\n\t\t\t\ttimeout,\n\t\t\t};\n\t\t\tfunction finish(registration: PendingApprovalRegistration | null) {\n\t\t\t\tif (settled) {\n\t\t\t\t\treturn;\n\t\t\t\t}\n\t\t\t\tsettled = true;\n\t\t\t\tclearTimeout(timeout);\n\t\t\t\toptions.signal?.removeEventListener(\"abort\", onAbort);\n\t\t\t\tservice.removePendingApprovalRegistrationWaiter(requestId, waiter);\n\t\t\t\tresolve(registration);\n\t\t\t}\n\t\t\tconst waiters =\n\t\t\t\tthis.pendingApprovalRegistrationWaiters.get(requestId) ?? [];\n\t\t\twaiters.push(waiter);\n\t\t\tthis.pendingApprovalRegistrationWaiters.set(requestId, waiters);\n\t\t\toptions.signal?.addEventListener(\"abort\", onAbort, { once: true });\n\t\t});\n\t}\n\n\tprotected onPendingApprovalRegistered(\n\t\t_sessionId: string | undefined,\n\t\t_request: ActionApprovalRequest,\n\t): void {}\n\n\tprotected onPendingApprovalSettled(_request: ActionApprovalRequest): void {}\n\n\tprivate publishPendingApprovalRegistration(\n\t\trequestId: string,\n\t\tregistration: PendingApprovalRegistration | null,\n\t): void {\n\t\tif (registration) {\n\t\t\tthis.pendingApprovalRegistrations.set(requestId, registration);\n\t\t} else {\n\t\t\tthis.pendingApprovalRegistrations.delete(requestId);\n\t\t}\n\n\t\tconst waiters = this.pendingApprovalRegistrationWaiters.get(requestId);\n\t\tif (!waiters) {\n\t\t\treturn;\n\t\t}\n\t\tthis.pendingApprovalRegistrationWaiters.delete(requestId);\n\t\tfor (const waiter of waiters) {\n\t\t\twaiter.resolve(registration);\n\t\t}\n\t}\n\n\tprivate removePendingApprovalRegistrationWaiter(\n\t\trequestId: string,\n\t\twaiter: PendingApprovalRegistrationWaiter,\n\t): void {\n\t\tconst waiters = this.pendingApprovalRegistrationWaiters.get(requestId);\n\t\tif (!waiters) {\n\t\t\treturn;\n\t\t}\n\t\tconst remaining = waiters.filter((candidate) => candidate !== waiter);\n\t\tif (remaining.length > 0) {\n\t\t\tthis.pendingApprovalRegistrationWaiters.set(requestId, remaining);\n\t\t} else {\n\t\t\tthis.pendingApprovalRegistrationWaiters.delete(requestId);\n\t\t}\n\t}\n\n\tprivate getSessionId(): string | undefined {\n\t\tif (typeof this.sessionIdProvider === \"function\") {\n\t\t\treturn this.sessionIdProvider();\n\t\t}\n\t\treturn this.sessionIdProvider;\n\t}\n\n\tprivate hasApprovalsServiceCandidate(): boolean {\n\t\tif (this.approvalsServiceConfig === false) {\n\t\t\treturn false;\n\t\t}\n\t\tif (this.approvalsServiceConfig?.baseUrl) {\n\t\t\treturn true;\n\t\t}\n\t\treturn Boolean(\n\t\t\tprocess.env.APPROVALS_SERVICE_URL?.trim() ||\n\t\t\t\tprocess.env.MAESTRO_APPROVALS_SERVICE_URL?.trim() ||\n\t\t\t\tprocess.env.MAESTRO_PLATFORM_BASE_URL?.trim() ||\n\t\t\t\tprocess.env.MAESTRO_EVALOPS_BASE_URL?.trim() ||\n\t\t\t\tprocess.env.EVALOPS_BASE_URL?.trim(),\n\t\t);\n\t}\n\n\tprivate async requestRemoteApproval(\n\t\trequest: ActionApprovalRequest,\n\t\tsessionId: string | undefined,\n\t\tsignal?: AbortSignal,\n\t): Promise<\n\t\t| { remote: RemoteApprovalRegistration | null }\n\t\t| { decision: ActionApprovalDecision }\n\t> {\n\t\tlet config: ResolvedApprovalsServiceConfig | null;\n\t\ttry {\n\t\t\tconfig = resolveApprovalsServiceConfig(this.approvalsServiceConfig);\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tlogger.warn(\n\t\t\t\t\"Failed to resolve approvals service config; using local approval\",\n\t\t\t\t{\n\t\t\t\t\terror: message,\n\t\t\t\t\ttoolName: request.toolName,\n\t\t\t\t},\n\t\t\t);\n\t\t\treturn { remote: null };\n\t\t}\n\t\tif (!config) {\n\t\t\treturn { remote: null };\n\t\t}\n\n\t\ttry {\n\t\t\tconst remote = await requestApprovalWithApprovalsService(\n\t\t\t\tconfig,\n\t\t\t\trequest,\n\t\t\t\t{\n\t\t\t\t\tsessionId,\n\t\t\t\t\tsignal,\n\t\t\t\t},\n\t\t\t);\n\t\t\tif (!remote) {\n\t\t\t\treturn { remote: null };\n\t\t\t}\n\t\t\tif (remote.autoApprovedReason) {\n\t\t\t\treturn {\n\t\t\t\t\tdecision: {\n\t\t\t\t\t\tapproved: true,\n\t\t\t\t\t\treason: remote.autoApprovedReason,\n\t\t\t\t\t\tresolvedBy: \"policy\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\treturn { remote: { config, requestId: remote.requestId } };\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tif (config.failureMode === \"required\") {\n\t\t\t\treturn {\n\t\t\t\t\tdecision: {\n\t\t\t\t\t\tapproved: false,\n\t\t\t\t\t\treason: `Approvals service unavailable: ${message}`,\n\t\t\t\t\t\tresolvedBy: \"policy\",\n\t\t\t\t\t},\n\t\t\t\t};\n\t\t\t}\n\t\t\tlogger.warn(\n\t\t\t\t\"Failed to register approval with approvals service; using local approval\",\n\t\t\t\t{\n\t\t\t\t\terror: message,\n\t\t\t\t\ttoolName: request.toolName,\n\t\t\t\t},\n\t\t\t);\n\t\t\treturn { remote: null };\n\t\t}\n\t}\n\n\tprivate async resolveRemoteApproval(\n\t\tremote: RemoteApprovalRegistration,\n\t\tdecision: ActionApprovalDecision,\n\t\tsignal?: AbortSignal,\n\t): Promise<ActionApprovalDecision> {\n\t\ttry {\n\t\t\tawait resolveApprovalWithApprovalsService(\n\t\t\t\tremote.config,\n\t\t\t\tremote.requestId,\n\t\t\t\tdecision,\n\t\t\t\t{ signal },\n\t\t\t);\n\t\t\treturn decision;\n\t\t} catch (error) {\n\t\t\tconst message = error instanceof Error ? error.message : String(error);\n\t\t\tif (remote.config.failureMode === \"required\" && decision.approved) {\n\t\t\t\treturn {\n\t\t\t\t\tapproved: false,\n\t\t\t\t\treason: `Approvals service decision sync failed: ${message}`,\n\t\t\t\t\tresolvedBy: \"policy\",\n\t\t\t\t};\n\t\t\t}\n\t\t\tlogger.warn(\"Failed to sync approval decision to approvals service\", {\n\t\t\t\terror: message,\n\t\t\t\tremoteRequestId: remote.requestId,\n\t\t\t});\n\t\t\treturn decision;\n\t\t}\n\t}\n}\n"]}

package/dist/approvals/service-client.d.ts

@@ -0,0 +1,56 @@
+import type { ActionApprovalDecision, ActionApprovalRequest } from "../agent/action-approval.js";
+import { type DownstreamFailureMode as DownstreamHttpFailureMode } from "../utils/downstream-http.js";
+export declare const APPROVALS_CALL_FAILURE_MODES: {
+    readonly requestApproval: {
+        readonly optional: "fail-open";
+        readonly required: "fail-closed";
+    };
+    readonly resolveApproval: {
+        readonly optional: "fail-open";
+        readonly required: "fail-closed";
+    };
+};
+export interface ApprovalsServiceConfig {
+    baseUrl?: string;
+    token?: string;
+    workspaceId?: string;
+    approverUserId?: string;
+    agentId?: string;
+    surface?: string;
+    riskLevel?: string;
+    timeoutMs?: number;
+    maxAttempts?: number;
+    circuitFailureThreshold?: number;
+    circuitResetTimeoutMs?: number;
+    circuitSuccessThreshold?: number;
+    required?: boolean;
+}
+export interface ResolvedApprovalsServiceConfig {
+    baseUrl: string;
+    token?: string;
+    workspaceId: string;
+    approverUserId?: string;
+    agentId: string;
+    surface: string;
+    riskLevel: string;
+    timeoutMs: number;
+    maxAttempts: number;
+    circuitFailureThreshold: number;
+    circuitResetTimeoutMs: number;
+    circuitSuccessThreshold: number;
+    failureMode: DownstreamHttpFailureMode;
+}
+export interface RemoteApprovalRequest {
+    requestId: string;
+    autoApprovedReason?: string;
+}
+export declare function resolveApprovalsServiceConfig(config: ApprovalsServiceConfig | false | undefined): ResolvedApprovalsServiceConfig | null;
+export declare function requestApprovalWithApprovalsService(config: ResolvedApprovalsServiceConfig, request: ActionApprovalRequest, options?: {
+    sessionId?: string;
+    signal?: AbortSignal;
+}): Promise<RemoteApprovalRequest | null>;
+export declare function resolveApprovalWithApprovalsService(config: ResolvedApprovalsServiceConfig, requestId: string, decision: ActionApprovalDecision, options?: {
+    signal?: AbortSignal;
+}): Promise<void>;
+export declare function resetApprovalsDownstreamForTests(): void;
+//# sourceMappingURL=service-client.d.ts.map

package/dist/approvals/service-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-client.d.ts","sourceRoot":"","sources":["../../src/approvals/service-client.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EACX,sBAAsB,EACtB,qBAAqB,EACrB,MAAM,6BAA6B,CAAC;AASrC,OAAO,EACN,KAAK,qBAAqB,IAAI,yBAAyB,EAEvD,MAAM,6BAA6B,CAAC;AAerC,eAAO,MAAM,4BAA4B;;;;;;;;;CAS/B,CAAC;AAIX,MAAM,WAAW,sBAAsB;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IAC/B,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,8BAA8B;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,EAAE,MAAM,CAAC;IAC9B,uBAAuB,EAAE,MAAM,CAAC;IAChC,WAAW,EAAE,yBAAyB,CAAC;CACvC;AAED,MAAM,WAAW,qBAAqB;IACrC,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AA4FD,wBAAgB,6BAA6B,CAC5C,MAAM,EAAE,sBAAsB,GAAG,KAAK,GAAG,SAAS,GAChD,8BAA8B,GAAG,IAAI,CA2HvC;AAuJD,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,OAAO,EAAE,qBAAqB,EAC9B,OAAO,CAAC,EAAE;IACT,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GACC,OAAO,CAAC,qBAAqB,GAAG,IAAI,CAAC,CAiCvC;AAED,wBAAsB,mCAAmC,CACxD,MAAM,EAAE,8BAA8B,EACtC,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,sBAAsB,EAChC,OAAO,CAAC,EAAE;IACT,MAAM,CAAC,EAAE,WAAW,CAAC;CACrB,GACC,OAAO,CAAC,IAAI,CAAC,CAgBf;AAED,wBAAgB,gCAAgC,IAAI,IAAI,CAEvD"}

package/dist/approvals/service-client.js

@@ -0,0 +1,316 @@
+import { Buffer } from "node:buffer";
+import { loadOAuthCredentials } from "../oauth/storage.js";
+import { CONNECT_PROTOCOL_VERSION } from "../platform/client.js";
+import { PLATFORM_CONNECT_METHODS, PLATFORM_CONNECT_SERVICES, platformConnectMethodPath, platformConnectServicePath, } from "../platform/core-services.js";
+import { fetchDownstream, } from "../utils/downstream-http.js";
+import * as downstream from "../utils/downstream.js";
+const DEFAULT_AGENT_ID = "maestro";
+const DEFAULT_MAX_ATTEMPTS = 2;
+const DEFAULT_SURFACE = "maestro";
+const DEFAULT_TIMEOUT_MS = 2_000;
+const DEFAULT_RISK_LEVEL = "RISK_LEVEL_MEDIUM";
+const REQUEST_APPROVAL_PATH = platformConnectMethodPath(PLATFORM_CONNECT_METHODS.approvals.requestApproval);
+const RESOLVE_APPROVAL_PATH = platformConnectMethodPath(PLATFORM_CONNECT_METHODS.approvals.resolveApproval);
+export const APPROVALS_CALL_FAILURE_MODES = {
+    requestApproval: {
+        optional: downstream.FailOpen,
+        required: downstream.FailClosed,
+    },
+    resolveApproval: {
+        optional: downstream.FailOpen,
+        required: downstream.FailClosed,
+    },
+};
+const downstreamClients = new Map();
+function trimString(value) {
+    const trimmed = value?.trim();
+    return trimmed ? trimmed : undefined;
+}
+function getEnvValue(names) {
+    for (const name of names) {
+        const value = trimString(process.env[name]);
+        if (value) {
+            return value;
+        }
+    }
+    return undefined;
+}
+function parsePositiveInt(value, fallback) {
+    const parsed = Number.parseInt(value ?? "", 10);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;
+}
+function normalizeBaseUrl(baseUrl) {
+    let normalized = baseUrl.trim();
+    for (const suffix of [
+        REQUEST_APPROVAL_PATH,
+        RESOLVE_APPROVAL_PATH,
+        platformConnectServicePath(PLATFORM_CONNECT_SERVICES.approvals),
+    ]) {
+        if (normalized.endsWith(suffix)) {
+            normalized = normalized.slice(0, -suffix.length);
+        }
+    }
+    return normalized.replace(/\/+$/, "");
+}
+function normalizeRiskLevel(value) {
+    const normalized = value?.trim().toLowerCase();
+    switch (normalized) {
+        case "low":
+        case "risk_level_low":
+            return "RISK_LEVEL_LOW";
+        case "medium":
+        case "risk_level_medium":
+            return "RISK_LEVEL_MEDIUM";
+        case "high":
+        case "risk_level_high":
+            return "RISK_LEVEL_HIGH";
+        case "critical":
+        case "risk_level_critical":
+            return "RISK_LEVEL_CRITICAL";
+        default:
+            return DEFAULT_RISK_LEVEL;
+    }
+}
+function resolveWorkspaceId(config) {
+    const configuredWorkspaceId = trimString(config?.workspaceId);
+    const envWorkspaceId = getEnvValue([
+        "APPROVALS_SERVICE_WORKSPACE_ID",
+        "MAESTRO_APPROVALS_WORKSPACE_ID",
+        "MAESTRO_EVALOPS_WORKSPACE_ID",
+        "MAESTRO_WORKSPACE_ID",
+        "MAESTRO_EVALOPS_ORG_ID",
+        "EVALOPS_ORGANIZATION_ID",
+        "MAESTRO_ENTERPRISE_ORG_ID",
+    ]);
+    if (configuredWorkspaceId ?? envWorkspaceId) {
+        return configuredWorkspaceId ?? envWorkspaceId;
+    }
+    const stored = loadOAuthCredentials("evalops")?.metadata?.organizationId;
+    return typeof stored === "string" && stored.trim().length > 0
+        ? stored.trim()
+        : undefined;
+}
+export function resolveApprovalsServiceConfig(config) {
+    if (config === false) {
+        return null;
+    }
+    const baseUrl = trimString(config?.baseUrl) ??
+        getEnvValue([
+            "APPROVALS_SERVICE_URL",
+            "MAESTRO_APPROVALS_SERVICE_URL",
+            "MAESTRO_PLATFORM_BASE_URL",
+            "MAESTRO_EVALOPS_BASE_URL",
+            "EVALOPS_BASE_URL",
+        ]);
+    if (!baseUrl) {
+        return null;
+    }
+    const workspaceId = resolveWorkspaceId(config);
+    if (!workspaceId) {
+        return null;
+    }
+    const storedToken = trimString(loadOAuthCredentials("evalops")?.access);
+    const token = trimString(config?.token) ??
+        getEnvValue([
+            "APPROVALS_SERVICE_TOKEN",
+            "MAESTRO_APPROVALS_SERVICE_TOKEN",
+            "MAESTRO_EVALOPS_ACCESS_TOKEN",
+            "EVALOPS_TOKEN",
+        ]) ??
+        storedToken;
+    const required = config?.required ??
+        getEnvValue([
+            "APPROVALS_SERVICE_REQUIRED",
+            "MAESTRO_APPROVALS_SERVICE_REQUIRED",
+        ]) === "1";
+    return {
+        agentId: trimString(config?.agentId) ??
+            getEnvValue([
+                "APPROVALS_SERVICE_AGENT_ID",
+                "MAESTRO_APPROVALS_AGENT_ID",
+                "MAESTRO_EVALOPS_AGENT_ID",
+                "MAESTRO_AGENT_ID",
+            ]) ??
+            DEFAULT_AGENT_ID,
+        approverUserId: trimString(config?.approverUserId) ??
+            getEnvValue([
+                "APPROVALS_SERVICE_APPROVER_USER_ID",
+                "MAESTRO_APPROVALS_APPROVER_USER_ID",
+            ]),
+        baseUrl: normalizeBaseUrl(baseUrl),
+        circuitFailureThreshold: config?.circuitFailureThreshold ??
+            parsePositiveInt(getEnvValue([
+                "APPROVALS_SERVICE_CIRCUIT_FAILURE_THRESHOLD",
+                "MAESTRO_APPROVALS_SERVICE_CIRCUIT_FAILURE_THRESHOLD",
+            ]), 5),
+        circuitResetTimeoutMs: config?.circuitResetTimeoutMs ??
+            parsePositiveInt(getEnvValue([
+                "APPROVALS_SERVICE_CIRCUIT_RESET_TIMEOUT_MS",
+                "MAESTRO_APPROVALS_SERVICE_CIRCUIT_RESET_TIMEOUT_MS",
+            ]), 30_000),
+        circuitSuccessThreshold: config?.circuitSuccessThreshold ??
+            parsePositiveInt(getEnvValue([
+                "APPROVALS_SERVICE_CIRCUIT_SUCCESS_THRESHOLD",
+                "MAESTRO_APPROVALS_SERVICE_CIRCUIT_SUCCESS_THRESHOLD",
+            ]), 2),
+        failureMode: required ? "required" : "optional",
+        maxAttempts: config?.maxAttempts ??
+            parsePositiveInt(getEnvValue([
+                "APPROVALS_SERVICE_MAX_ATTEMPTS",
+                "MAESTRO_APPROVALS_SERVICE_MAX_ATTEMPTS",
+            ]), DEFAULT_MAX_ATTEMPTS),
+        riskLevel: normalizeRiskLevel(config?.riskLevel ??
+            getEnvValue([
+                "APPROVALS_SERVICE_RISK_LEVEL",
+                "MAESTRO_APPROVALS_SERVICE_RISK_LEVEL",
+            ])),
+        surface: trimString(config?.surface) ??
+            getEnvValue([
+                "APPROVALS_SERVICE_SURFACE",
+                "MAESTRO_APPROVALS_SURFACE",
+                "MAESTRO_EVALOPS_SURFACE",
+                "MAESTRO_SURFACE",
+            ]) ??
+            DEFAULT_SURFACE,
+        timeoutMs: config?.timeoutMs ??
+            parsePositiveInt(getEnvValue([
+                "APPROVALS_SERVICE_TIMEOUT_MS",
+                "MAESTRO_APPROVALS_SERVICE_TIMEOUT_MS",
+            ]), DEFAULT_TIMEOUT_MS),
+        token,
+        workspaceId,
+    };
+}
+function getDownstreamClient(config, op) {
+    const failureMode = APPROVALS_CALL_FAILURE_MODES[op][config.failureMode];
+    const key = JSON.stringify({
+        baseUrl: config.baseUrl,
+        failureMode,
+        op,
+        reset: config.circuitResetTimeoutMs,
+        success: config.circuitSuccessThreshold,
+        threshold: config.circuitFailureThreshold,
+    });
+    const cached = downstreamClients.get(key);
+    if (cached) {
+        return cached;
+    }
+    const client = downstream.New(`approvals.${op}`, {
+        failureMode,
+        breaker: {
+            failureThreshold: config.circuitFailureThreshold,
+            resetTimeoutMs: config.circuitResetTimeoutMs,
+            successThreshold: config.circuitSuccessThreshold,
+            toolName: `approvals.${op}`,
+        },
+    });
+    downstreamClients.set(key, client);
+    return client;
+}
+function toHttpFailureMode(client) {
+    return client.failureMode === downstream.FailClosed ? "required" : "optional";
+}
+function buildHeaders(config) {
+    return {
+        ...(config.token ? { Authorization: `Bearer ${config.token}` } : {}),
+        "Connect-Protocol-Version": CONNECT_PROTOCOL_VERSION,
+        "Content-Type": "application/json",
+    };
+}
+function encodeActionPayload(request, sessionId) {
+    return Buffer.from(JSON.stringify({
+        localRequestId: request.id,
+        toolName: request.toolName,
+        displayName: request.displayName,
+        summaryLabel: request.summaryLabel,
+        actionDescription: request.actionDescription,
+        args: request.args,
+        reason: request.reason,
+        sessionId,
+    }), "utf8").toString("base64");
+}
+function buildContextJson(request, sessionId) {
+    return JSON.stringify({
+        localRequestId: request.id,
+        sessionId,
+        source: "maestro",
+    });
+}
+function normalizeAutoApprovedReason(evidence) {
+    if (!evidence) {
+        return undefined;
+    }
+    const details = [
+        trimString(evidence.pattern)
+            ? `pattern=${trimString(evidence.pattern)}`
+            : undefined,
+        typeof evidence.confidence === "number"
+            ? `confidence=${evidence.confidence.toFixed(2)}`
+            : undefined,
+        typeof evidence.observationCount === "number"
+            ? `observations=${Math.trunc(evidence.observationCount)}`
+            : undefined,
+    ].filter((item) => Boolean(item));
+    return details.length > 0
+        ? `Auto-approved by approvals service habit (${details.join(", ")})`
+        : "Auto-approved by approvals service habit";
+}
+function toServiceDecision(decision) {
+    return decision.approved ? "DECISION_TYPE_APPROVED" : "DECISION_TYPE_DENIED";
+}
+async function callApprovals(config, op, path, body, parse, failOpenValue, options) {
+    const client = getDownstreamClient(config, op);
+    return downstream.CallOp(client, op, async () => {
+        const response = await fetchDownstream(`${config.baseUrl}${path}`, {
+            method: "POST",
+            headers: buildHeaders(config),
+            signal: options?.signal,
+            body: JSON.stringify(body),
+        }, {
+            serviceName: "approvals service",
+            failureMode: toHttpFailureMode(client),
+            timeoutMs: config.timeoutMs,
+            maxAttempts: config.maxAttempts,
+        });
+        if (!response.ok) {
+            const text = await response.text();
+            throw new Error(`approvals service returned ${response.status}: ${text || response.statusText}`);
+        }
+        return await parse(response);
+    }, failOpenValue);
+}
+export async function requestApprovalWithApprovalsService(config, request, options) {
+    const payload = await callApprovals(config, "requestApproval", REQUEST_APPROVAL_PATH, {
+        workspaceId: config.workspaceId,
+        approverUserId: config.approverUserId,
+        agentId: config.agentId,
+        surface: config.surface,
+        actionType: request.toolName,
+        actionPayload: encodeActionPayload(request, options?.sessionId),
+        riskLevel: config.riskLevel,
+        contextJson: buildContextJson(request, options?.sessionId),
+    }, async (response) => (await response.json()), () => null, options);
+    if (!payload) {
+        return null;
+    }
+    const requestId = trimString(payload.approvalRequest?.id);
+    if (!requestId) {
+        throw new Error("approvals service response did not include request id");
+    }
+    return {
+        requestId,
+        autoApprovedReason: normalizeAutoApprovedReason(payload.autoApproveEvidence),
+    };
+}
+export async function resolveApprovalWithApprovalsService(config, requestId, decision, options) {
+    await callApprovals(config, "resolveApproval", RESOLVE_APPROVAL_PATH, {
+        approvalRequestId: requestId,
+        decision: toServiceDecision(decision),
+        decidedBy: decision.resolvedBy === "user" ? "maestro_user" : "maestro_policy",
+        reason: decision.reason,
+    }, async () => undefined, () => undefined, options);
+}
+export function resetApprovalsDownstreamForTests() {
+    downstreamClients.clear();
+}
+//# sourceMappingURL=service-client.js.map

package/dist/approvals/service-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"service-client.js","sourceRoot":"","sources":["../../src/approvals/service-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAKrC,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAE,wBAAwB,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EACN,wBAAwB,EACxB,yBAAyB,EACzB,yBAAyB,EACzB,0BAA0B,GAC1B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAEN,eAAe,GACf,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAErD,MAAM,gBAAgB,GAAG,SAAS,CAAC;AACnC,MAAM,oBAAoB,GAAG,CAAC,CAAC;AAC/B,MAAM,eAAe,GAAG,SAAS,CAAC;AAClC,MAAM,kBAAkB,GAAG,KAAK,CAAC;AACjC,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AAC/C,MAAM,qBAAqB,GAAG,yBAAyB,CACtD,wBAAwB,CAAC,SAAS,CAAC,eAAe,CAClD,CAAC;AACF,MAAM,qBAAqB,GAAG,yBAAyB,CACtD,wBAAwB,CAAC,SAAS,CAAC,eAAe,CAClD,CAAC;AAEF,MAAM,CAAC,MAAM,4BAA4B,GAAG;IAC3C,eAAe,EAAE;QAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,UAAU;KAC/B;IACD,eAAe,EAAE;QAChB,QAAQ,EAAE,UAAU,CAAC,QAAQ;QAC7B,QAAQ,EAAE,UAAU,CAAC,UAAU;KAC/B;CACQ,CAAC;AAqDX,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAuC,CAAC;AAEzE,SAAS,UAAU,CAAC,KAAyB;IAC5C,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AACtC,CAAC;AAED,SAAS,WAAW,CAAC,KAAe;IACnC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAC5C,IAAI,KAAK,EAAE,CAAC;YACX,OAAO,KAAK,CAAC;QACd,CAAC;IACF,CAAC;IACD,OAAO,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAyB,EAAE,QAAgB;IACpE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;IAChD,OAAO,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC;AAClE,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACxC,IAAI,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAChC,KAAK,MAAM,MAAM,IAAI;QACpB,qBAAqB;QACrB,qBAAqB;QACrB,0BAA0B,CAAC,yBAAyB,CAAC,SAAS,CAAC;KAC/D,EAAE,CAAC;QACH,IAAI,UAAU,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YACjC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,CAAC;IACF,CAAC;IACD,OAAO,UAAU,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAyB;IACpD,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,QAAQ,UAAU,EAAE,CAAC;QACpB,KAAK,KAAK,CAAC;QACX,KAAK,gBAAgB;YACpB,OAAO,gBAAgB,CAAC;QACzB,KAAK,QAAQ,CAAC;QACd,KAAK,mBAAmB;YACvB,OAAO,mBAAmB,CAAC;QAC5B,KAAK,MAAM,CAAC;QACZ,KAAK,iBAAiB;YACrB,OAAO,iBAAiB,CAAC;QAC1B,KAAK,UAAU,CAAC;QAChB,KAAK,qBAAqB;YACzB,OAAO,qBAAqB,CAAC;QAC9B;YACC,OAAO,kBAAkB,CAAC;IAC5B,CAAC;AACF,CAAC;AAED,SAAS,kBAAkB,CAC1B,MAA0C;IAE1C,MAAM,qBAAqB,GAAG,UAAU,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC9D,MAAM,cAAc,GAAG,WAAW,CAAC;QAClC,gCAAgC;QAChC,gCAAgC;QAChC,8BAA8B;QAC9B,sBAAsB;QACtB,wBAAwB;QACxB,yBAAyB;QACzB,2BAA2B;KAC3B,CAAC,CAAC;IACH,IAAI,qBAAqB,IAAI,cAAc,EAAE,CAAC;QAC7C,OAAO,qBAAqB,IAAI,cAAc,CAAC;IAChD,CAAC;IACD,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,cAAc,CAAC;IACzE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC5D,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;QACf,CAAC,CAAC,SAAS,CAAC;AACd,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC5C,MAAkD;IAElD,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,OAAO,GACZ,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;QAC3B,WAAW,CAAC;YACX,uBAAuB;YACvB,+BAA+B;YAC/B,2BAA2B;YAC3B,0BAA0B;YAC1B,kBAAkB;SAClB,CAAC,CAAC;IACJ,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,WAAW,GAAG,UAAU,CAAC,oBAAoB,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,CAAC;IACxE,MAAM,KAAK,GACV,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC;QACzB,WAAW,CAAC;YACX,yBAAyB;YACzB,iCAAiC;YACjC,8BAA8B;YAC9B,eAAe;SACf,CAAC;QACF,WAAW,CAAC;IAEb,MAAM,QAAQ,GACb,MAAM,EAAE,QAAQ;QAChB,WAAW,CAAC;YACX,4BAA4B;YAC5B,oCAAoC;SACpC,CAAC,KAAK,GAAG,CAAC;IAEZ,OAAO;QACN,OAAO,EACN,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3B,WAAW,CAAC;gBACX,4BAA4B;gBAC5B,4BAA4B;gBAC5B,0BAA0B;gBAC1B,kBAAkB;aAClB,CAAC;YACF,gBAAgB;QACjB,cAAc,EACb,UAAU,CAAC,MAAM,EAAE,cAAc,CAAC;YAClC,WAAW,CAAC;gBACX,oCAAoC;gBACpC,oCAAoC;aACpC,CAAC;QACH,OAAO,EAAE,gBAAgB,CAAC,OAAO,CAAC;QAClC,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,6CAA6C;gBAC7C,qDAAqD;aACrD,CAAC,EACF,CAAC,CACD;QACF,qBAAqB,EACpB,MAAM,EAAE,qBAAqB;YAC7B,gBAAgB,CACf,WAAW,CAAC;gBACX,4CAA4C;gBAC5C,oDAAoD;aACpD,CAAC,EACF,MAAM,CACN;QACF,uBAAuB,EACtB,MAAM,EAAE,uBAAuB;YAC/B,gBAAgB,CACf,WAAW,CAAC;gBACX,6CAA6C;gBAC7C,qDAAqD;aACrD,CAAC,EACF,CAAC,CACD;QACF,WAAW,EAAE,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU;QAC/C,WAAW,EACV,MAAM,EAAE,WAAW;YACnB,gBAAgB,CACf,WAAW,CAAC;gBACX,gCAAgC;gBAChC,wCAAwC;aACxC,CAAC,EACF,oBAAoB,CACpB;QACF,SAAS,EAAE,kBAAkB,CAC5B,MAAM,EAAE,SAAS;YAChB,WAAW,CAAC;gBACX,8BAA8B;gBAC9B,sCAAsC;aACtC,CAAC,CACH;QACD,OAAO,EACN,UAAU,CAAC,MAAM,EAAE,OAAO,CAAC;YAC3B,WAAW,CAAC;gBACX,2BAA2B;gBAC3B,2BAA2B;gBAC3B,yBAAyB;gBACzB,iBAAiB;aACjB,CAAC;YACF,eAAe;QAChB,SAAS,EACR,MAAM,EAAE,SAAS;YACjB,gBAAgB,CACf,WAAW,CAAC;gBACX,8BAA8B;gBAC9B,sCAAsC;aACtC,CAAC,EACF,kBAAkB,CAClB;QACF,KAAK;QACL,WAAW;KACX,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,MAAsC,EACtC,EAAiB;IAEjB,MAAM,WAAW,GAAG,4BAA4B,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IACzE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,WAAW;QACX,EAAE;QACF,KAAK,EAAE,MAAM,CAAC,qBAAqB;QACnC,OAAO,EAAE,MAAM,CAAC,uBAAuB;QACvC,SAAS,EAAE,MAAM,CAAC,uBAAuB;KACzC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,MAAM,EAAE,CAAC;QACZ,OAAO,MAAM,CAAC;IACf,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,aAAa,EAAE,EAAE,EAAE;QAChD,WAAW;QACX,OAAO,EAAE;YACR,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,cAAc,EAAE,MAAM,CAAC,qBAAqB;YAC5C,gBAAgB,EAAE,MAAM,CAAC,uBAAuB;YAChD,QAAQ,EAAE,aAAa,EAAE,EAAE;SAC3B;KACD,CAAC,CAAC;IACH,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACnC,OAAO,MAAM,CAAC;AACf,CAAC;AAED,SAAS,iBAAiB,CACzB,MAAmC;IAEnC,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CACpB,MAAsC;IAEtC,OAAO;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,0BAA0B,EAAE,wBAAwB;QACpD,cAAc,EAAE,kBAAkB;KAClC,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC3B,OAA8B,EAC9B,SAA6B;IAE7B,OAAO,MAAM,CAAC,IAAI,CACjB,IAAI,CAAC,SAAS,CAAC;QACd,cAAc,EAAE,OAAO,CAAC,EAAE;QAC1B,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,iBAAiB,EAAE,OAAO,CAAC,iBAAiB;QAC5C,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,SAAS;KACT,CAAC,EACF,MAAM,CACN,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AACtB,CAAC;AAED,SAAS,gBAAgB,CACxB,OAA8B,EAC9B,SAA6B;IAE7B,OAAO,IAAI,CAAC,SAAS,CAAC;QACrB,cAAc,EAAE,OAAO,CAAC,EAAE;QAC1B,SAAS;QACT,MAAM,EAAE,SAAS;KACjB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CACnC,QAAwD;IAExD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACf,OAAO,SAAS,CAAC;IAClB,CAAC;IACD,MAAM,OAAO,GAAG;QACf,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC;YAC3B,CAAC,CAAC,WAAW,UAAU,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE;YAC3C,CAAC,CAAC,SAAS;QACZ,OAAO,QAAQ,CAAC,UAAU,KAAK,QAAQ;YACtC,CAAC,CAAC,cAAc,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;YAChD,CAAC,CAAC,SAAS;QACZ,OAAO,QAAQ,CAAC,gBAAgB,KAAK,QAAQ;YAC5C,CAAC,CAAC,gBAAgB,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE;YACzD,CAAC,CAAC,SAAS;KACZ,CAAC,MAAM,CAAC,CAAC,IAAI,EAAkB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC;QACxB,CAAC,CAAC,6CAA6C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;QACpE,CAAC,CAAC,0CAA0C,CAAC;AAC/C,CAAC;AAED,SAAS,iBAAiB,CACzB,QAAgC;IAEhC,OAAO,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,sBAAsB,CAAC;AAC9E,CAAC;AAED,KAAK,UAAU,aAAa,CAC3B,MAAsC,EACtC,EAAiB,EACjB,IAAY,EACZ,IAA6B,EAC7B,KAAyC,EACzC,aAAsB,EACtB,OAEC;IAED,MAAM,MAAM,GAAG,mBAAmB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC/C,OAAO,UAAU,CAAC,MAAM,CACvB,MAAM,EACN,EAAE,EACF,KAAK,IAAI,EAAE;QACV,MAAM,QAAQ,GAAG,MAAM,eAAe,CACrC,GAAG,MAAM,CAAC,OAAO,GAAG,IAAI,EAAE,EAC1B;YACC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC;YAC7B,MAAM,EAAE,OAAO,EAAE,MAAM;YACvB,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;SAC1B,EACD;YACC,WAAW,EAAE,mBAAmB;YAChC,WAAW,EAAE,iBAAiB,CAAC,MAAM,CAAC;YACtC,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,WAAW,EAAE,MAAM,CAAC,WAAW;SAC/B,CACD,CAAC;QACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YAClB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CACd,8BAA8B,QAAQ,CAAC,MAAM,KAC5C,IAAI,IAAI,QAAQ,CAAC,UAClB,EAAE,CACF,CAAC;QACH,CAAC;QACD,OAAO,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9B,CAAC,EACD,aAAa,CACb,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACxD,MAAsC,EACtC,OAA8B,EAC9B,OAGC;IAED,MAAM,OAAO,GAAG,MAAM,aAAa,CAClC,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB;QACC,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,UAAU,EAAE,OAAO,CAAC,QAAQ;QAC5B,aAAa,EAAE,mBAAmB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;QAC/D,SAAS,EAAE,MAAM,CAAC,SAAS;QAC3B,WAAW,EAAE,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC;KAC1D,EACD,KAAK,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA4B,EACtE,GAAG,EAAE,CAAC,IAAI,EACV,OAAO,CACP,CAAC;IACF,IAAI,CAAC,OAAO,EAAE,CAAC;QACd,OAAO,IAAI,CAAC;IACb,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;IAC1D,IAAI,CAAC,SAAS,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO;QACN,SAAS;QACT,kBAAkB,EAAE,2BAA2B,CAC9C,OAAO,CAAC,mBAAmB,CAC3B;KACD,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mCAAmC,CACxD,MAAsC,EACtC,SAAiB,EACjB,QAAgC,EAChC,OAEC;IAED,MAAM,aAAa,CAClB,MAAM,EACN,iBAAiB,EACjB,qBAAqB,EACrB;QACC,iBAAiB,EAAE,SAAS;QAC5B,QAAQ,EAAE,iBAAiB,CAAC,QAAQ,CAAC;QACrC,SAAS,EACR,QAAQ,CAAC,UAAU,KAAK,MAAM,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,gBAAgB;QACnE,MAAM,EAAE,QAAQ,CAAC,MAAM;KACvB,EACD,KAAK,IAAI,EAAE,CAAC,SAAS,EACrB,GAAG,EAAE,CAAC,SAAS,EACf,OAAO,CACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gCAAgC;IAC/C,iBAAiB,CAAC,KAAK,EAAE,CAAC;AAC3B,CAAC","sourcesContent":["import { Buffer } from \"node:buffer\";\nimport type {\n\tActionApprovalDecision,\n\tActionApprovalRequest,\n} from \"../agent/action-approval.js\";\nimport { loadOAuthCredentials } from \"../oauth/storage.js\";\nimport { CONNECT_PROTOCOL_VERSION } from \"../platform/client.js\";\nimport {\n\tPLATFORM_CONNECT_METHODS,\n\tPLATFORM_CONNECT_SERVICES,\n\tplatformConnectMethodPath,\n\tplatformConnectServicePath,\n} from \"../platform/core-services.js\";\nimport {\n\ttype DownstreamFailureMode as DownstreamHttpFailureMode,\n\tfetchDownstream,\n} from \"../utils/downstream-http.js\";\nimport * as downstream from \"../utils/downstream.js\";\n\nconst DEFAULT_AGENT_ID = \"maestro\";\nconst DEFAULT_MAX_ATTEMPTS = 2;\nconst DEFAULT_SURFACE = \"maestro\";\nconst DEFAULT_TIMEOUT_MS = 2_000;\nconst DEFAULT_RISK_LEVEL = \"RISK_LEVEL_MEDIUM\";\nconst REQUEST_APPROVAL_PATH = platformConnectMethodPath(\n\tPLATFORM_CONNECT_METHODS.approvals.requestApproval,\n);\nconst RESOLVE_APPROVAL_PATH = platformConnectMethodPath(\n\tPLATFORM_CONNECT_METHODS.approvals.resolveApproval,\n);\n\nexport const APPROVALS_CALL_FAILURE_MODES = {\n\trequestApproval: {\n\t\toptional: downstream.FailOpen,\n\t\trequired: downstream.FailClosed,\n\t},\n\tresolveApproval: {\n\t\toptional: downstream.FailOpen,\n\t\trequired: downstream.FailClosed,\n\t},\n} as const;\n\ntype ApprovalsCall = keyof typeof APPROVALS_CALL_FAILURE_MODES;\n\nexport interface ApprovalsServiceConfig {\n\tbaseUrl?: string;\n\ttoken?: string;\n\tworkspaceId?: string;\n\tapproverUserId?: string;\n\tagentId?: string;\n\tsurface?: string;\n\triskLevel?: string;\n\ttimeoutMs?: number;\n\tmaxAttempts?: number;\n\tcircuitFailureThreshold?: number;\n\tcircuitResetTimeoutMs?: number;\n\tcircuitSuccessThreshold?: number;\n\trequired?: boolean;\n}\n\nexport interface ResolvedApprovalsServiceConfig {\n\tbaseUrl: string;\n\ttoken?: string;\n\tworkspaceId: string;\n\tapproverUserId?: string;\n\tagentId: string;\n\tsurface: string;\n\triskLevel: string;\n\ttimeoutMs: number;\n\tmaxAttempts: number;\n\tcircuitFailureThreshold: number;\n\tcircuitResetTimeoutMs: number;\n\tcircuitSuccessThreshold: number;\n\tfailureMode: DownstreamHttpFailureMode;\n}\n\nexport interface RemoteApprovalRequest {\n\trequestId: string;\n\tautoApprovedReason?: string;\n}\n\ninterface RequestApprovalResponse {\n\tapprovalRequest?: {\n\t\tid?: string;\n\t};\n\tautoApproveEvidence?: {\n\t\tpattern?: string;\n\t\tconfidence?: number;\n\t\tobservationCount?: number;\n\t\tthresholdApplied?: number;\n\t};\n}\n\nconst downstreamClients = new Map<string, downstream.DownstreamClient>();\n\nfunction trimString(value: string | undefined): string | undefined {\n\tconst trimmed = value?.trim();\n\treturn trimmed ? trimmed : undefined;\n}\n\nfunction getEnvValue(names: string[]): string | undefined {\n\tfor (const name of names) {\n\t\tconst value = trimString(process.env[name]);\n\t\tif (value) {\n\t\t\treturn value;\n\t\t}\n\t}\n\treturn undefined;\n}\n\nfunction parsePositiveInt(value: string | undefined, fallback: number): number {\n\tconst parsed = Number.parseInt(value ?? \"\", 10);\n\treturn Number.isFinite(parsed) && parsed > 0 ? parsed : fallback;\n}\n\nfunction normalizeBaseUrl(baseUrl: string): string {\n\tlet normalized = baseUrl.trim();\n\tfor (const suffix of [\n\t\tREQUEST_APPROVAL_PATH,\n\t\tRESOLVE_APPROVAL_PATH,\n\t\tplatformConnectServicePath(PLATFORM_CONNECT_SERVICES.approvals),\n\t]) {\n\t\tif (normalized.endsWith(suffix)) {\n\t\t\tnormalized = normalized.slice(0, -suffix.length);\n\t\t}\n\t}\n\treturn normalized.replace(/\\/+$/, \"\");\n}\n\nfunction normalizeRiskLevel(value: string | undefined): string {\n\tconst normalized = value?.trim().toLowerCase();\n\tswitch (normalized) {\n\t\tcase \"low\":\n\t\tcase \"risk_level_low\":\n\t\t\treturn \"RISK_LEVEL_LOW\";\n\t\tcase \"medium\":\n\t\tcase \"risk_level_medium\":\n\t\t\treturn \"RISK_LEVEL_MEDIUM\";\n\t\tcase \"high\":\n\t\tcase \"risk_level_high\":\n\t\t\treturn \"RISK_LEVEL_HIGH\";\n\t\tcase \"critical\":\n\t\tcase \"risk_level_critical\":\n\t\t\treturn \"RISK_LEVEL_CRITICAL\";\n\t\tdefault:\n\t\t\treturn DEFAULT_RISK_LEVEL;\n\t}\n}\n\nfunction resolveWorkspaceId(\n\tconfig: ApprovalsServiceConfig | undefined,\n): string | undefined {\n\tconst configuredWorkspaceId = trimString(config?.workspaceId);\n\tconst envWorkspaceId = getEnvValue([\n\t\t\"APPROVALS_SERVICE_WORKSPACE_ID\",\n\t\t\"MAESTRO_APPROVALS_WORKSPACE_ID\",\n\t\t\"MAESTRO_EVALOPS_WORKSPACE_ID\",\n\t\t\"MAESTRO_WORKSPACE_ID\",\n\t\t\"MAESTRO_EVALOPS_ORG_ID\",\n\t\t\"EVALOPS_ORGANIZATION_ID\",\n\t\t\"MAESTRO_ENTERPRISE_ORG_ID\",\n\t]);\n\tif (configuredWorkspaceId ?? envWorkspaceId) {\n\t\treturn configuredWorkspaceId ?? envWorkspaceId;\n\t}\n\tconst stored = loadOAuthCredentials(\"evalops\")?.metadata?.organizationId;\n\treturn typeof stored === \"string\" && stored.trim().length > 0\n\t\t? stored.trim()\n\t\t: undefined;\n}\n\nexport function resolveApprovalsServiceConfig(\n\tconfig: ApprovalsServiceConfig | false | undefined,\n): ResolvedApprovalsServiceConfig | null {\n\tif (config === false) {\n\t\treturn null;\n\t}\n\n\tconst baseUrl =\n\t\ttrimString(config?.baseUrl) ??\n\t\tgetEnvValue([\n\t\t\t\"APPROVALS_SERVICE_URL\",\n\t\t\t\"MAESTRO_APPROVALS_SERVICE_URL\",\n\t\t\t\"MAESTRO_PLATFORM_BASE_URL\",\n\t\t\t\"MAESTRO_EVALOPS_BASE_URL\",\n\t\t\t\"EVALOPS_BASE_URL\",\n\t\t]);\n\tif (!baseUrl) {\n\t\treturn null;\n\t}\n\n\tconst workspaceId = resolveWorkspaceId(config);\n\tif (!workspaceId) {\n\t\treturn null;\n\t}\n\n\tconst storedToken = trimString(loadOAuthCredentials(\"evalops\")?.access);\n\tconst token =\n\t\ttrimString(config?.token) ??\n\t\tgetEnvValue([\n\t\t\t\"APPROVALS_SERVICE_TOKEN\",\n\t\t\t\"MAESTRO_APPROVALS_SERVICE_TOKEN\",\n\t\t\t\"MAESTRO_EVALOPS_ACCESS_TOKEN\",\n\t\t\t\"EVALOPS_TOKEN\",\n\t\t]) ??\n\t\tstoredToken;\n\n\tconst required =\n\t\tconfig?.required ??\n\t\tgetEnvValue([\n\t\t\t\"APPROVALS_SERVICE_REQUIRED\",\n\t\t\t\"MAESTRO_APPROVALS_SERVICE_REQUIRED\",\n\t\t]) === \"1\";\n\n\treturn {\n\t\tagentId:\n\t\t\ttrimString(config?.agentId) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"APPROVALS_SERVICE_AGENT_ID\",\n\t\t\t\t\"MAESTRO_APPROVALS_AGENT_ID\",\n\t\t\t\t\"MAESTRO_EVALOPS_AGENT_ID\",\n\t\t\t\t\"MAESTRO_AGENT_ID\",\n\t\t\t]) ??\n\t\t\tDEFAULT_AGENT_ID,\n\t\tapproverUserId:\n\t\t\ttrimString(config?.approverUserId) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"APPROVALS_SERVICE_APPROVER_USER_ID\",\n\t\t\t\t\"MAESTRO_APPROVALS_APPROVER_USER_ID\",\n\t\t\t]),\n\t\tbaseUrl: normalizeBaseUrl(baseUrl),\n\t\tcircuitFailureThreshold:\n\t\t\tconfig?.circuitFailureThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"APPROVALS_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_APPROVALS_SERVICE_CIRCUIT_FAILURE_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t5,\n\t\t\t),\n\t\tcircuitResetTimeoutMs:\n\t\t\tconfig?.circuitResetTimeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"APPROVALS_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_APPROVALS_SERVICE_CIRCUIT_RESET_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\t30_000,\n\t\t\t),\n\t\tcircuitSuccessThreshold:\n\t\t\tconfig?.circuitSuccessThreshold ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"APPROVALS_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t\t\"MAESTRO_APPROVALS_SERVICE_CIRCUIT_SUCCESS_THRESHOLD\",\n\t\t\t\t]),\n\t\t\t\t2,\n\t\t\t),\n\t\tfailureMode: required ? \"required\" : \"optional\",\n\t\tmaxAttempts:\n\t\t\tconfig?.maxAttempts ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"APPROVALS_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t\t\"MAESTRO_APPROVALS_SERVICE_MAX_ATTEMPTS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_MAX_ATTEMPTS,\n\t\t\t),\n\t\triskLevel: normalizeRiskLevel(\n\t\t\tconfig?.riskLevel ??\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"APPROVALS_SERVICE_RISK_LEVEL\",\n\t\t\t\t\t\"MAESTRO_APPROVALS_SERVICE_RISK_LEVEL\",\n\t\t\t\t]),\n\t\t),\n\t\tsurface:\n\t\t\ttrimString(config?.surface) ??\n\t\t\tgetEnvValue([\n\t\t\t\t\"APPROVALS_SERVICE_SURFACE\",\n\t\t\t\t\"MAESTRO_APPROVALS_SURFACE\",\n\t\t\t\t\"MAESTRO_EVALOPS_SURFACE\",\n\t\t\t\t\"MAESTRO_SURFACE\",\n\t\t\t]) ??\n\t\t\tDEFAULT_SURFACE,\n\t\ttimeoutMs:\n\t\t\tconfig?.timeoutMs ??\n\t\t\tparsePositiveInt(\n\t\t\t\tgetEnvValue([\n\t\t\t\t\t\"APPROVALS_SERVICE_TIMEOUT_MS\",\n\t\t\t\t\t\"MAESTRO_APPROVALS_SERVICE_TIMEOUT_MS\",\n\t\t\t\t]),\n\t\t\t\tDEFAULT_TIMEOUT_MS,\n\t\t\t),\n\t\ttoken,\n\t\tworkspaceId,\n\t};\n}\n\nfunction getDownstreamClient(\n\tconfig: ResolvedApprovalsServiceConfig,\n\top: ApprovalsCall,\n): downstream.DownstreamClient {\n\tconst failureMode = APPROVALS_CALL_FAILURE_MODES[op][config.failureMode];\n\tconst key = JSON.stringify({\n\t\tbaseUrl: config.baseUrl,\n\t\tfailureMode,\n\t\top,\n\t\treset: config.circuitResetTimeoutMs,\n\t\tsuccess: config.circuitSuccessThreshold,\n\t\tthreshold: config.circuitFailureThreshold,\n\t});\n\tconst cached = downstreamClients.get(key);\n\tif (cached) {\n\t\treturn cached;\n\t}\n\tconst client = downstream.New(`approvals.${op}`, {\n\t\tfailureMode,\n\t\tbreaker: {\n\t\t\tfailureThreshold: config.circuitFailureThreshold,\n\t\t\tresetTimeoutMs: config.circuitResetTimeoutMs,\n\t\t\tsuccessThreshold: config.circuitSuccessThreshold,\n\t\t\ttoolName: `approvals.${op}`,\n\t\t},\n\t});\n\tdownstreamClients.set(key, client);\n\treturn client;\n}\n\nfunction toHttpFailureMode(\n\tclient: downstream.DownstreamClient,\n): DownstreamHttpFailureMode {\n\treturn client.failureMode === downstream.FailClosed ? \"required\" : \"optional\";\n}\n\nfunction buildHeaders(\n\tconfig: ResolvedApprovalsServiceConfig,\n): Record<string, string> {\n\treturn {\n\t\t...(config.token ? { Authorization: `Bearer ${config.token}` } : {}),\n\t\t\"Connect-Protocol-Version\": CONNECT_PROTOCOL_VERSION,\n\t\t\"Content-Type\": \"application/json\",\n\t};\n}\n\nfunction encodeActionPayload(\n\trequest: ActionApprovalRequest,\n\tsessionId: string | undefined,\n): string {\n\treturn Buffer.from(\n\t\tJSON.stringify({\n\t\t\tlocalRequestId: request.id,\n\t\t\ttoolName: request.toolName,\n\t\t\tdisplayName: request.displayName,\n\t\t\tsummaryLabel: request.summaryLabel,\n\t\t\tactionDescription: request.actionDescription,\n\t\t\targs: request.args,\n\t\t\treason: request.reason,\n\t\t\tsessionId,\n\t\t}),\n\t\t\"utf8\",\n\t).toString(\"base64\");\n}\n\nfunction buildContextJson(\n\trequest: ActionApprovalRequest,\n\tsessionId: string | undefined,\n): string {\n\treturn JSON.stringify({\n\t\tlocalRequestId: request.id,\n\t\tsessionId,\n\t\tsource: \"maestro\",\n\t});\n}\n\nfunction normalizeAutoApprovedReason(\n\tevidence: RequestApprovalResponse[\"autoApproveEvidence\"],\n): string | undefined {\n\tif (!evidence) {\n\t\treturn undefined;\n\t}\n\tconst details = [\n\t\ttrimString(evidence.pattern)\n\t\t\t? `pattern=${trimString(evidence.pattern)}`\n\t\t\t: undefined,\n\t\ttypeof evidence.confidence === \"number\"\n\t\t\t? `confidence=${evidence.confidence.toFixed(2)}`\n\t\t\t: undefined,\n\t\ttypeof evidence.observationCount === \"number\"\n\t\t\t? `observations=${Math.trunc(evidence.observationCount)}`\n\t\t\t: undefined,\n\t].filter((item): item is string => Boolean(item));\n\treturn details.length > 0\n\t\t? `Auto-approved by approvals service habit (${details.join(\", \")})`\n\t\t: \"Auto-approved by approvals service habit\";\n}\n\nfunction toServiceDecision(\n\tdecision: ActionApprovalDecision,\n): \"DECISION_TYPE_APPROVED\" | \"DECISION_TYPE_DENIED\" {\n\treturn decision.approved ? \"DECISION_TYPE_APPROVED\" : \"DECISION_TYPE_DENIED\";\n}\n\nasync function callApprovals<T>(\n\tconfig: ResolvedApprovalsServiceConfig,\n\top: ApprovalsCall,\n\tpath: string,\n\tbody: Record<string, unknown>,\n\tparse: (response: Response) => Promise<T>,\n\tfailOpenValue: () => T,\n\toptions?: {\n\t\tsignal?: AbortSignal;\n\t},\n): Promise<T> {\n\tconst client = getDownstreamClient(config, op);\n\treturn downstream.CallOp(\n\t\tclient,\n\t\top,\n\t\tasync () => {\n\t\t\tconst response = await fetchDownstream(\n\t\t\t\t`${config.baseUrl}${path}`,\n\t\t\t\t{\n\t\t\t\t\tmethod: \"POST\",\n\t\t\t\t\theaders: buildHeaders(config),\n\t\t\t\t\tsignal: options?.signal,\n\t\t\t\t\tbody: JSON.stringify(body),\n\t\t\t\t},\n\t\t\t\t{\n\t\t\t\t\tserviceName: \"approvals service\",\n\t\t\t\t\tfailureMode: toHttpFailureMode(client),\n\t\t\t\t\ttimeoutMs: config.timeoutMs,\n\t\t\t\t\tmaxAttempts: config.maxAttempts,\n\t\t\t\t},\n\t\t\t);\n\t\t\tif (!response.ok) {\n\t\t\t\tconst text = await response.text();\n\t\t\t\tthrow new Error(\n\t\t\t\t\t`approvals service returned ${response.status}: ${\n\t\t\t\t\t\ttext || response.statusText\n\t\t\t\t\t}`,\n\t\t\t\t);\n\t\t\t}\n\t\t\treturn await parse(response);\n\t\t},\n\t\tfailOpenValue,\n\t);\n}\n\nexport async function requestApprovalWithApprovalsService(\n\tconfig: ResolvedApprovalsServiceConfig,\n\trequest: ActionApprovalRequest,\n\toptions?: {\n\t\tsessionId?: string;\n\t\tsignal?: AbortSignal;\n\t},\n): Promise<RemoteApprovalRequest | null> {\n\tconst payload = await callApprovals<RequestApprovalResponse | null>(\n\t\tconfig,\n\t\t\"requestApproval\",\n\t\tREQUEST_APPROVAL_PATH,\n\t\t{\n\t\t\tworkspaceId: config.workspaceId,\n\t\t\tapproverUserId: config.approverUserId,\n\t\t\tagentId: config.agentId,\n\t\t\tsurface: config.surface,\n\t\t\tactionType: request.toolName,\n\t\t\tactionPayload: encodeActionPayload(request, options?.sessionId),\n\t\t\triskLevel: config.riskLevel,\n\t\t\tcontextJson: buildContextJson(request, options?.sessionId),\n\t\t},\n\t\tasync (response) => (await response.json()) as RequestApprovalResponse,\n\t\t() => null,\n\t\toptions,\n\t);\n\tif (!payload) {\n\t\treturn null;\n\t}\n\n\tconst requestId = trimString(payload.approvalRequest?.id);\n\tif (!requestId) {\n\t\tthrow new Error(\"approvals service response did not include request id\");\n\t}\n\treturn {\n\t\trequestId,\n\t\tautoApprovedReason: normalizeAutoApprovedReason(\n\t\t\tpayload.autoApproveEvidence,\n\t\t),\n\t};\n}\n\nexport async function resolveApprovalWithApprovalsService(\n\tconfig: ResolvedApprovalsServiceConfig,\n\trequestId: string,\n\tdecision: ActionApprovalDecision,\n\toptions?: {\n\t\tsignal?: AbortSignal;\n\t},\n): Promise<void> {\n\tawait callApprovals<void>(\n\t\tconfig,\n\t\t\"resolveApproval\",\n\t\tRESOLVE_APPROVAL_PATH,\n\t\t{\n\t\t\tapprovalRequestId: requestId,\n\t\t\tdecision: toServiceDecision(decision),\n\t\t\tdecidedBy:\n\t\t\t\tdecision.resolvedBy === \"user\" ? \"maestro_user\" : \"maestro_policy\",\n\t\t\treason: decision.reason,\n\t\t},\n\t\tasync () => undefined,\n\t\t() => undefined,\n\t\toptions,\n\t);\n}\n\nexport function resetApprovalsDownstreamForTests(): void {\n\tdownstreamClients.clear();\n}\n"]}

package/dist/audit/logger.d.ts

@@ -125,19 +125,19 @@ export declare function queryAuditLogs(filters: {
     limit?: number;
     offset?: number;
 }): Promise<{
-    action: string;
-    status: "error" | "success" | "failure" | "denied";
-    metadata: AuditMetadata | null;
+    status: "error" | "denied" | "success" | "failure";
     id: string;
+    metadata: AuditMetadata | null;
+    action: string;
     orgId: string;
     sessionId: string | null;
     durationMs: number | null;
     createdAt: Date;
     requestId: string | null;
+    resourceId: string | null;
     traceId: string | null;
     userId: string | null;
     resourceType: string | null;
-    resourceId: string | null;
     ipAddress: string | null;
     userAgent: string | null;
     integrityHash: string | null;

package/dist/bootstrap/auth-setup.d.ts

@@ -20,8 +20,8 @@ export interface AuthSetupResult {
     buildMissingAuthLines: (providerName: string) => AuthLine[];
 }
 /**
- * Validate that no unsupported Codex/ChatGPT flags are used, and warn
- * about CODEX_API_KEY if present. Throws with an error message on invalid flags.
+ * Validate that no unsupported legacy Codex/ChatGPT flags are used.
+ * Throws with an error message on invalid flags.
  */
 export declare function validateCodexFlags(args: string[], command?: string): void;
 /**

package/dist/bootstrap/auth-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-setup.d.ts","sourceRoot":"","sources":["../../src/bootstrap/auth-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEb,MAAM,sBAAsB,CAAC;AAO9B,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC/B,2EAA2E;IAC3E,iBAAiB,EAAE,CAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,OAAO,KACV,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;CAC5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAwBzE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACvC,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,eAAe,CA8ElB"}
+{"version":3,"file":"auth-setup.d.ts","sourceRoot":"","sources":["../../src/bootstrap/auth-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH,OAAO,EACN,KAAK,cAAc,EACnB,KAAK,QAAQ,EAEb,MAAM,sBAAsB,CAAC;AAO9B,yDAAyD;AACzD,MAAM,WAAW,QAAQ;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,eAAe;IAC/B,2EAA2E;IAC3E,iBAAiB,EAAE,CAClB,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,OAAO,KACV,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,oEAAoE;IACpE,qBAAqB,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,QAAQ,EAAE,CAAC;CAC5D;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAgBzE;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE;IACvC,QAAQ,EAAE,QAAQ,CAAC;IACnB,cAAc,CAAC,EAAE,MAAM,CAAC;CACxB,GAAG,eAAe,CA8ElB"}

package/dist/bootstrap/auth-setup.js

@@ -13,13 +13,10 @@ import { getEnvVarsForProvider } from "../providers/api-keys.js";
 import { createAuthResolver, } from "../providers/auth.js";
 import { isEvalOpsManagedGatewayEnabled, isEvalOpsManagedProvider, isKnownEvalOpsManagedProvider, } from "../providers/evalops-managed.js";
 /**
- * Validate that no unsupported Codex/ChatGPT flags are used, and warn
- * about CODEX_API_KEY if present. Throws with an error message on invalid flags.
+ * Validate that no unsupported legacy Codex/ChatGPT flags are used.
+ * Throws with an error message on invalid flags.
  */
 export function validateCodexFlags(args, command) {
-    if (process.env.CODEX_API_KEY) {
-        console.warn(chalk.yellow("CODEX_API_KEY detected but Codex subscriptions are not supported. The value will be ignored."));
-    }
     if (command !== "help" && command !== "config") {
         const codexFlagsUsed = args.some((arg, index) => {
             if (arg === "--codex-api-key" || arg.startsWith("--codex-api-key=")) {
@@ -32,7 +29,7 @@ export function validateCodexFlags(args, command) {
             return false;
         });
         if (codexFlagsUsed) {
-            throw new Error("Codex/ChatGPT auth mode is no longer supported. Use a standard OpenAI API key instead.");
+            throw new Error("Legacy Codex/ChatGPT auth flags are no longer supported. Use the openai-codex provider with `maestro codex login` or CODEX_API_KEY instead.");
         }
     }
 }
@@ -60,7 +57,7 @@ export function createAuthSetup(params) {
                         !isEvalOpsManagedGatewayEnabled()
                         ? "EvalOps managed gateway access is currently disabled by dynamic config."
                         : isEvalOpsManagedProvider(providerName)
-                            ? 'Run "/login evalops" after setting MAESTRO_EVALOPS_ORG_ID.'
+                            ? 'Run "maestro evalops login" or "/login evalops" to authenticate before retrying.'
                             : 'Run "/login" to authenticate before retrying.';
             push(`${loginHint} Or provide an API key for the selected provider.`, chalk.dim(`${loginHint} Or provide an API key for the selected provider.`));
         }

package/dist/bootstrap/auth-setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-setup.js","sourceRoot":"","sources":["../../src/bootstrap/auth-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAGN,kBAAkB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,iCAAiC,CAAC;AAkBzC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,OAAgB;IAClE,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,EAAE,CAAC;QAC/B,OAAO,CAAC,IAAI,CACX,KAAK,CAAC,MAAM,CACX,8FAA8F,CAC9F,CACD,CAAC;IACH,CAAC;IAED,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/C,IAAI,GAAG,KAAK,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnE,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClD,OAAO,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,wFAAwF,CACxF,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAG/B;IACA,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAE5C,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACvC,IAAI,EAAE,QAAQ;QACd,cAAc;KACd,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAc,EAAE;QAClE,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAgB,EAAE,EAAE;YAChD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC;QACF,IAAI,CACH,6CAA6C,YAAY,GAAG,EAC5D,KAAK,CAAC,GAAG,CAAC,6CAA6C,YAAY,GAAG,CAAC,CACvE,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GACd,YAAY,KAAK,WAAW;gBAC3B,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,YAAY,KAAK,QAAQ;oBAC1B,CAAC,CAAC,2EAA2E;oBAC7E,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC;wBAC3C,CAAC,8BAA8B,EAAE;wBAClC,CAAC,CAAC,yEAAyE;wBAC3E,CAAC,CAAC,wBAAwB,CAAC,YAAY,CAAC;4BACvC,CAAC,CAAC,4DAA4D;4BAC9D,CAAC,CAAC,+CAA+C,CAAC;YACvD,IAAI,CACH,GAAG,SAAS,mDAAmD,EAC/D,KAAK,CAAC,GAAG,CACR,GAAG,SAAS,mDAAmD,CAC/D,CACD,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CACH,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,YAAY,GAAG,EACvE,KAAK,CAAC,GAAG,CACR,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,YAAY,GAAG,CACvE,CACD,CAAC;QACH,CAAC;aAAM,CAAC;YACP,MAAM,UAAU,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;gBAC3B,IAAI,CACH,OAAO,UAAU,CAAC,SAAS,kDAAkD,YAAY,GAAG,EAC5F,KAAK,CAAC,GAAG,CACR,OAAO,UAAU,CAAC,SAAS,kDAAkD,YAAY,GAAG,CAC5F,CACD,CAAC;YACH,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAC9B,YAAoB,EACpB,KAAc,EACY,EAAE;QAC5B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;AACrD,CAAC","sourcesContent":["/**\n * Authentication Setup - Credential resolution and validation.\n *\n * Extracts auth-related initialization from main.ts Phase 4:\n * auth mode determination, Codex flag validation, credential resolution,\n * and missing-auth error message building.\n *\n * @module bootstrap/auth-setup\n */\n\nimport chalk from \"chalk\";\nimport { getCustomProviderMetadata } from \"../models/registry.js\";\nimport { getEnvVarsForProvider } from \"../providers/api-keys.js\";\nimport {\n\ttype AuthCredential,\n\ttype AuthMode,\n\tcreateAuthResolver,\n} from \"../providers/auth.js\";\nimport {\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"../providers/evalops-managed.js\";\n\n/** A plain + colored error line for terminal display. */\nexport interface AuthLine {\n\tplain: string;\n\tcolored: string;\n}\n\nexport interface AuthSetupResult {\n\t/** Resolve a credential for a provider, throwing or exiting on failure. */\n\trequireCredential: (\n\t\tproviderName: string,\n\t\tfatal: boolean,\n\t) => Promise<AuthCredential>;\n\t/** Build user-friendly error lines when credentials are missing. */\n\tbuildMissingAuthLines: (providerName: string) => AuthLine[];\n}\n\n/**\n * Validate that no unsupported Codex/ChatGPT flags are used, and warn\n * about CODEX_API_KEY if present. Throws with an error message on invalid flags.\n */\nexport function validateCodexFlags(args: string[], command?: string): void {\n\tif (process.env.CODEX_API_KEY) {\n\t\tconsole.warn(\n\t\t\tchalk.yellow(\n\t\t\t\t\"CODEX_API_KEY detected but Codex subscriptions are not supported. The value will be ignored.\",\n\t\t\t),\n\t\t);\n\t}\n\n\tif (command !== \"help\" && command !== \"config\") {\n\t\tconst codexFlagsUsed = args.some((arg, index) => {\n\t\t\tif (arg === \"--codex-api-key\" || arg.startsWith(\"--codex-api-key=\")) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (arg === \"--auth\" && args[index + 1] === \"chatgpt\") return true;\n\t\t\tif (arg.startsWith(\"--auth=chatgpt\")) return true;\n\t\t\treturn false;\n\t\t});\n\t\tif (codexFlagsUsed) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Codex/ChatGPT auth mode is no longer supported. Use a standard OpenAI API key instead.\",\n\t\t\t);\n\t\t}\n\t}\n}\n\n/**\n * Create the auth resolver and helper functions used throughout startup.\n */\nexport function createAuthSetup(params: {\n\tauthMode: AuthMode;\n\texplicitApiKey?: string;\n}): AuthSetupResult {\n\tconst { authMode, explicitApiKey } = params;\n\n\tconst authResolver = createAuthResolver({\n\t\tmode: authMode,\n\t\texplicitApiKey,\n\t});\n\n\tconst buildMissingAuthLines = (providerName: string): AuthLine[] => {\n\t\tconst lines: AuthLine[] = [];\n\t\tconst push = (plain: string, colored?: string) => {\n\t\t\tlines.push({ plain, colored: colored ?? plain });\n\t\t};\n\t\tpush(\n\t\t\t`Error: No credentials found for provider \"${providerName}\"`,\n\t\t\tchalk.red(`Error: No credentials found for provider \"${providerName}\"`),\n\t\t);\n\t\tif (authMode !== \"api-key\") {\n\t\t\tconst loginHint =\n\t\t\t\tproviderName === \"anthropic\"\n\t\t\t\t\t? 'Run \"maestro anthropic login\" (claude) or use /login to authenticate before retrying.'\n\t\t\t\t\t: providerName === \"openai\"\n\t\t\t\t\t\t? 'Run \"maestro openai login\" or use /login to authenticate before retrying.'\n\t\t\t\t\t\t: isKnownEvalOpsManagedProvider(providerName) &&\n\t\t\t\t\t\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t\t\t\t\t\t? \"EvalOps managed gateway access is currently disabled by dynamic config.\"\n\t\t\t\t\t\t\t: isEvalOpsManagedProvider(providerName)\n\t\t\t\t\t\t\t\t? 'Run \"/login evalops\" after setting MAESTRO_EVALOPS_ORG_ID.'\n\t\t\t\t\t\t\t\t: 'Run \"/login\" to authenticate before retrying.';\n\t\t\tpush(\n\t\t\t\t`${loginHint} Or provide an API key for the selected provider.`,\n\t\t\t\tchalk.dim(\n\t\t\t\t\t`${loginHint} Or provide an API key for the selected provider.`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst envVars = getEnvVarsForProvider(providerName);\n\t\tif (envVars.length) {\n\t\t\tpush(\n\t\t\t\t`Set ${envVars.join(\" or \")} or provide --api-key for ${providerName}.`,\n\t\t\t\tchalk.dim(\n\t\t\t\t\t`Set ${envVars.join(\" or \")} or provide --api-key for ${providerName}.`,\n\t\t\t\t),\n\t\t\t);\n\t\t} else {\n\t\t\tconst customMeta = getCustomProviderMetadata(providerName);\n\t\t\tif (customMeta?.apiKeyEnv) {\n\t\t\t\tpush(\n\t\t\t\t\t`Set ${customMeta.apiKeyEnv} environment variable or provide --api-key for ${providerName}.`,\n\t\t\t\t\tchalk.dim(\n\t\t\t\t\t\t`Set ${customMeta.apiKeyEnv} environment variable or provide --api-key for ${providerName}.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn lines;\n\t};\n\n\tconst requireCredential = async (\n\t\tproviderName: string,\n\t\tfatal: boolean,\n\t): Promise<AuthCredential> => {\n\t\tconst credential = await authResolver(providerName);\n\t\tif (credential) {\n\t\t\treturn credential;\n\t\t}\n\t\tconst lines = buildMissingAuthLines(providerName);\n\t\tif (fatal) {\n\t\t\tfor (const line of lines) {\n\t\t\t\tconsole.error(line.colored);\n\t\t\t}\n\t\t\tprocess.exit(1);\n\t\t}\n\t\tconst plain = lines.map((line) => line.plain).join(\"\\n\");\n\t\tthrow new Error(plain);\n\t};\n\n\treturn { requireCredential, buildMissingAuthLines };\n}\n"]}
+{"version":3,"file":"auth-setup.js","sourceRoot":"","sources":["../../src/bootstrap/auth-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,yBAAyB,EAAE,MAAM,uBAAuB,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAGN,kBAAkB,GAClB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACN,8BAA8B,EAC9B,wBAAwB,EACxB,6BAA6B,GAC7B,MAAM,iCAAiC,CAAC;AAkBzC;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAc,EAAE,OAAgB;IAClE,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChD,MAAM,cAAc,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,KAAK,EAAE,EAAE;YAC/C,IAAI,GAAG,KAAK,iBAAiB,IAAI,GAAG,CAAC,UAAU,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACrE,OAAO,IAAI,CAAC;YACb,CAAC;YACD,IAAI,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YACnE,IAAI,GAAG,CAAC,UAAU,CAAC,gBAAgB,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClD,OAAO,KAAK,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,cAAc,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACd,6IAA6I,CAC7I,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,MAG/B;IACA,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAAC;IAE5C,MAAM,YAAY,GAAG,kBAAkB,CAAC;QACvC,IAAI,EAAE,QAAQ;QACd,cAAc;KACd,CAAC,CAAC;IAEH,MAAM,qBAAqB,GAAG,CAAC,YAAoB,EAAc,EAAE;QAClE,MAAM,KAAK,GAAe,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,OAAgB,EAAE,EAAE;YAChD,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,KAAK,EAAE,CAAC,CAAC;QAClD,CAAC,CAAC;QACF,IAAI,CACH,6CAA6C,YAAY,GAAG,EAC5D,KAAK,CAAC,GAAG,CAAC,6CAA6C,YAAY,GAAG,CAAC,CACvE,CAAC;QACF,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC5B,MAAM,SAAS,GACd,YAAY,KAAK,WAAW;gBAC3B,CAAC,CAAC,uFAAuF;gBACzF,CAAC,CAAC,YAAY,KAAK,QAAQ;oBAC1B,CAAC,CAAC,2EAA2E;oBAC7E,CAAC,CAAC,6BAA6B,CAAC,YAAY,CAAC;wBAC3C,CAAC,8BAA8B,EAAE;wBAClC,CAAC,CAAC,yEAAyE;wBAC3E,CAAC,CAAC,wBAAwB,CAAC,YAAY,CAAC;4BACvC,CAAC,CAAC,kFAAkF;4BACpF,CAAC,CAAC,+CAA+C,CAAC;YACvD,IAAI,CACH,GAAG,SAAS,mDAAmD,EAC/D,KAAK,CAAC,GAAG,CACR,GAAG,SAAS,mDAAmD,CAC/D,CACD,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,IAAI,CACH,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,YAAY,GAAG,EACvE,KAAK,CAAC,GAAG,CACR,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,6BAA6B,YAAY,GAAG,CACvE,CACD,CAAC;QACH,CAAC;aAAM,CAAC;YACP,MAAM,UAAU,GAAG,yBAAyB,CAAC,YAAY,CAAC,CAAC;YAC3D,IAAI,UAAU,EAAE,SAAS,EAAE,CAAC;gBAC3B,IAAI,CACH,OAAO,UAAU,CAAC,SAAS,kDAAkD,YAAY,GAAG,EAC5F,KAAK,CAAC,GAAG,CACR,OAAO,UAAU,CAAC,SAAS,kDAAkD,YAAY,GAAG,CAC5F,CACD,CAAC;YACH,CAAC;QACF,CAAC;QACD,OAAO,KAAK,CAAC;IACd,CAAC,CAAC;IAEF,MAAM,iBAAiB,GAAG,KAAK,EAC9B,YAAoB,EACpB,KAAc,EACY,EAAE;QAC5B,MAAM,UAAU,GAAG,MAAM,YAAY,CAAC,YAAY,CAAC,CAAC;QACpD,IAAI,UAAU,EAAE,CAAC;YAChB,OAAO,UAAU,CAAC;QACnB,CAAC;QACD,MAAM,KAAK,GAAG,qBAAqB,CAAC,YAAY,CAAC,CAAC;QAClD,IAAI,KAAK,EAAE,CAAC;YACX,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBAC1B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC;QACD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,MAAM,IAAI,KAAK,CAAC,KAAK,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,CAAC;AACrD,CAAC","sourcesContent":["/**\n * Authentication Setup - Credential resolution and validation.\n *\n * Extracts auth-related initialization from main.ts Phase 4:\n * auth mode determination, Codex flag validation, credential resolution,\n * and missing-auth error message building.\n *\n * @module bootstrap/auth-setup\n */\n\nimport chalk from \"chalk\";\nimport { getCustomProviderMetadata } from \"../models/registry.js\";\nimport { getEnvVarsForProvider } from \"../providers/api-keys.js\";\nimport {\n\ttype AuthCredential,\n\ttype AuthMode,\n\tcreateAuthResolver,\n} from \"../providers/auth.js\";\nimport {\n\tisEvalOpsManagedGatewayEnabled,\n\tisEvalOpsManagedProvider,\n\tisKnownEvalOpsManagedProvider,\n} from \"../providers/evalops-managed.js\";\n\n/** A plain + colored error line for terminal display. */\nexport interface AuthLine {\n\tplain: string;\n\tcolored: string;\n}\n\nexport interface AuthSetupResult {\n\t/** Resolve a credential for a provider, throwing or exiting on failure. */\n\trequireCredential: (\n\t\tproviderName: string,\n\t\tfatal: boolean,\n\t) => Promise<AuthCredential>;\n\t/** Build user-friendly error lines when credentials are missing. */\n\tbuildMissingAuthLines: (providerName: string) => AuthLine[];\n}\n\n/**\n * Validate that no unsupported legacy Codex/ChatGPT flags are used.\n * Throws with an error message on invalid flags.\n */\nexport function validateCodexFlags(args: string[], command?: string): void {\n\tif (command !== \"help\" && command !== \"config\") {\n\t\tconst codexFlagsUsed = args.some((arg, index) => {\n\t\t\tif (arg === \"--codex-api-key\" || arg.startsWith(\"--codex-api-key=\")) {\n\t\t\t\treturn true;\n\t\t\t}\n\t\t\tif (arg === \"--auth\" && args[index + 1] === \"chatgpt\") return true;\n\t\t\tif (arg.startsWith(\"--auth=chatgpt\")) return true;\n\t\t\treturn false;\n\t\t});\n\t\tif (codexFlagsUsed) {\n\t\t\tthrow new Error(\n\t\t\t\t\"Legacy Codex/ChatGPT auth flags are no longer supported. Use the openai-codex provider with `maestro codex login` or CODEX_API_KEY instead.\",\n\t\t\t);\n\t\t}\n\t}\n}\n\n/**\n * Create the auth resolver and helper functions used throughout startup.\n */\nexport function createAuthSetup(params: {\n\tauthMode: AuthMode;\n\texplicitApiKey?: string;\n}): AuthSetupResult {\n\tconst { authMode, explicitApiKey } = params;\n\n\tconst authResolver = createAuthResolver({\n\t\tmode: authMode,\n\t\texplicitApiKey,\n\t});\n\n\tconst buildMissingAuthLines = (providerName: string): AuthLine[] => {\n\t\tconst lines: AuthLine[] = [];\n\t\tconst push = (plain: string, colored?: string) => {\n\t\t\tlines.push({ plain, colored: colored ?? plain });\n\t\t};\n\t\tpush(\n\t\t\t`Error: No credentials found for provider \"${providerName}\"`,\n\t\t\tchalk.red(`Error: No credentials found for provider \"${providerName}\"`),\n\t\t);\n\t\tif (authMode !== \"api-key\") {\n\t\t\tconst loginHint =\n\t\t\t\tproviderName === \"anthropic\"\n\t\t\t\t\t? 'Run \"maestro anthropic login\" (claude) or use /login to authenticate before retrying.'\n\t\t\t\t\t: providerName === \"openai\"\n\t\t\t\t\t\t? 'Run \"maestro openai login\" or use /login to authenticate before retrying.'\n\t\t\t\t\t\t: isKnownEvalOpsManagedProvider(providerName) &&\n\t\t\t\t\t\t\t\t!isEvalOpsManagedGatewayEnabled()\n\t\t\t\t\t\t\t? \"EvalOps managed gateway access is currently disabled by dynamic config.\"\n\t\t\t\t\t\t\t: isEvalOpsManagedProvider(providerName)\n\t\t\t\t\t\t\t\t? 'Run \"maestro evalops login\" or \"/login evalops\" to authenticate before retrying.'\n\t\t\t\t\t\t\t\t: 'Run \"/login\" to authenticate before retrying.';\n\t\t\tpush(\n\t\t\t\t`${loginHint} Or provide an API key for the selected provider.`,\n\t\t\t\tchalk.dim(\n\t\t\t\t\t`${loginHint} Or provide an API key for the selected provider.`,\n\t\t\t\t),\n\t\t\t);\n\t\t}\n\t\tconst envVars = getEnvVarsForProvider(providerName);\n\t\tif (envVars.length) {\n\t\t\tpush(\n\t\t\t\t`Set ${envVars.join(\" or \")} or provide --api-key for ${providerName}.`,\n\t\t\t\tchalk.dim(\n\t\t\t\t\t`Set ${envVars.join(\" or \")} or provide --api-key for ${providerName}.`,\n\t\t\t\t),\n\t\t\t);\n\t\t} else {\n\t\t\tconst customMeta = getCustomProviderMetadata(providerName);\n\t\t\tif (customMeta?.apiKeyEnv) {\n\t\t\t\tpush(\n\t\t\t\t\t`Set ${customMeta.apiKeyEnv} environment variable or provide --api-key for ${providerName}.`,\n\t\t\t\t\tchalk.dim(\n\t\t\t\t\t\t`Set ${customMeta.apiKeyEnv} environment variable or provide --api-key for ${providerName}.`,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t}\n\t\t}\n\t\treturn lines;\n\t};\n\n\tconst requireCredential = async (\n\t\tproviderName: string,\n\t\tfatal: boolean,\n\t): Promise<AuthCredential> => {\n\t\tconst credential = await authResolver(providerName);\n\t\tif (credential) {\n\t\t\treturn credential;\n\t\t}\n\t\tconst lines = buildMissingAuthLines(providerName);\n\t\tif (fatal) {\n\t\t\tfor (const line of lines) {\n\t\t\t\tconsole.error(line.colored);\n\t\t\t}\n\t\t\tprocess.exit(1);\n\t\t}\n\t\tconst plain = lines.map((line) => line.plain).join(\"\\n\");\n\t\tthrow new Error(plain);\n\t};\n\n\treturn { requireCredential, buildMissingAuthLines };\n}\n"]}

package/dist/cli/args.d.ts

@@ -22,6 +22,8 @@ export interface Args {
     safeMode?: boolean;
     command?: string;
     subcommand?: string;
+    /** Raw arguments owned by command-group handlers. */
+    commandArgs?: string[];
     approvalMode?: "auto" | "prompt" | "fail";
     authMode?: "auto" | "api-key" | "claude";
     force?: boolean;

package/dist/cli/args.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;AAExD,MAAM,WAAW,IAAI;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AA2BD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAgK9C"}
+{"version":3,"file":"args.d.ts","sourceRoot":"","sources":["../../src/cli/args.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,CAAC;AAExD,MAAM,WAAW,IAAI;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,4DAA4D;IAC5D,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,wDAAwD;IACxD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,GAAG,QAAQ,GAAG,MAAM,CAAC;IAC1C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,QAAQ,CAAC;IACzC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,2DAA2D;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,+CAA+C;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,2DAA2D;IAC3D,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8CAA8C;IAC9C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,aAAa,CAAC,EAAE,OAAO,CAAC;CACxB;AAoCD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,IAAI,CAoL9C"}