@matimo/core 0.1.0-alpha.9 → 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +341 -14
- package/dist/approval/approval-handler.d.ts +5 -1
- package/dist/approval/approval-handler.d.ts.map +1 -1
- package/dist/approval/approval-handler.js +6 -0
- package/dist/approval/approval-handler.js.map +1 -1
- package/dist/core/schema.d.ts +41 -10
- package/dist/core/schema.d.ts.map +1 -1
- package/dist/core/schema.js +40 -4
- package/dist/core/schema.js.map +1 -1
- package/dist/core/skill-content-parser.d.ts +91 -0
- package/dist/core/skill-content-parser.d.ts.map +1 -0
- package/dist/core/skill-content-parser.js +248 -0
- package/dist/core/skill-content-parser.js.map +1 -0
- package/dist/core/skill-loader.d.ts +46 -0
- package/dist/core/skill-loader.d.ts.map +1 -0
- package/dist/core/skill-loader.js +310 -0
- package/dist/core/skill-loader.js.map +1 -0
- package/dist/core/skill-registry.d.ts +131 -0
- package/dist/core/skill-registry.d.ts.map +1 -0
- package/dist/core/skill-registry.js +316 -0
- package/dist/core/skill-registry.js.map +1 -0
- package/dist/core/tfidf-embedding.d.ts +45 -0
- package/dist/core/tfidf-embedding.d.ts.map +1 -0
- package/dist/core/tfidf-embedding.js +199 -0
- package/dist/core/tfidf-embedding.js.map +1 -0
- package/dist/core/tool-loader.d.ts +3 -1
- package/dist/core/tool-loader.d.ts.map +1 -1
- package/dist/core/tool-loader.js +33 -10
- package/dist/core/tool-loader.js.map +1 -1
- package/dist/core/types.d.ts +203 -6
- package/dist/core/types.d.ts.map +1 -1
- package/dist/encodings/parameter-encoding.d.ts +1 -1
- package/dist/encodings/parameter-encoding.d.ts.map +1 -1
- package/dist/encodings/parameter-encoding.js +9 -4
- package/dist/encodings/parameter-encoding.js.map +1 -1
- package/dist/errors/matimo-error.d.ts +11 -2
- package/dist/errors/matimo-error.d.ts.map +1 -1
- package/dist/errors/matimo-error.js +25 -1
- package/dist/errors/matimo-error.js.map +1 -1
- package/dist/executors/command-executor.d.ts +9 -2
- package/dist/executors/command-executor.d.ts.map +1 -1
- package/dist/executors/command-executor.js +29 -5
- package/dist/executors/command-executor.js.map +1 -1
- package/dist/executors/function-executor.d.ts +10 -3
- package/dist/executors/function-executor.d.ts.map +1 -1
- package/dist/executors/function-executor.js +44 -24
- package/dist/executors/function-executor.js.map +1 -1
- package/dist/executors/http-executor.d.ts +79 -4
- package/dist/executors/http-executor.d.ts.map +1 -1
- package/dist/executors/http-executor.js +232 -28
- package/dist/executors/http-executor.js.map +1 -1
- package/dist/index.d.ts +25 -3
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +19 -1
- package/dist/index.js.map +1 -1
- package/dist/integrations/langchain.d.ts +55 -0
- package/dist/integrations/langchain.d.ts.map +1 -1
- package/dist/integrations/langchain.js +71 -4
- package/dist/integrations/langchain.js.map +1 -1
- package/dist/logging/winston-logger.d.ts.map +1 -1
- package/dist/logging/winston-logger.js +9 -1
- package/dist/logging/winston-logger.js.map +1 -1
- package/dist/matimo-instance.d.ts +230 -18
- package/dist/matimo-instance.d.ts.map +1 -1
- package/dist/matimo-instance.js +739 -40
- package/dist/matimo-instance.js.map +1 -1
- package/dist/mcp/index.d.ts +18 -0
- package/dist/mcp/index.d.ts.map +1 -0
- package/dist/mcp/index.js +24 -0
- package/dist/mcp/index.js.map +1 -0
- package/dist/mcp/mcp-server.d.ts +141 -0
- package/dist/mcp/mcp-server.d.ts.map +1 -0
- package/dist/mcp/mcp-server.js +754 -0
- package/dist/mcp/mcp-server.js.map +1 -0
- package/dist/mcp/secrets/aws-resolver.d.ts +41 -0
- package/dist/mcp/secrets/aws-resolver.d.ts.map +1 -0
- package/dist/mcp/secrets/aws-resolver.js +141 -0
- package/dist/mcp/secrets/aws-resolver.js.map +1 -0
- package/dist/mcp/secrets/dotenv-resolver.d.ts +23 -0
- package/dist/mcp/secrets/dotenv-resolver.d.ts.map +1 -0
- package/dist/mcp/secrets/dotenv-resolver.js +94 -0
- package/dist/mcp/secrets/dotenv-resolver.js.map +1 -0
- package/dist/mcp/secrets/env-resolver.d.ts +14 -0
- package/dist/mcp/secrets/env-resolver.d.ts.map +1 -0
- package/dist/mcp/secrets/env-resolver.js +27 -0
- package/dist/mcp/secrets/env-resolver.js.map +1 -0
- package/dist/mcp/secrets/index.d.ts +14 -0
- package/dist/mcp/secrets/index.d.ts.map +1 -0
- package/dist/mcp/secrets/index.js +13 -0
- package/dist/mcp/secrets/index.js.map +1 -0
- package/dist/mcp/secrets/resolver-chain.d.ts +34 -0
- package/dist/mcp/secrets/resolver-chain.d.ts.map +1 -0
- package/dist/mcp/secrets/resolver-chain.js +141 -0
- package/dist/mcp/secrets/resolver-chain.js.map +1 -0
- package/dist/mcp/secrets/types.d.ts +73 -0
- package/dist/mcp/secrets/types.d.ts.map +1 -0
- package/dist/mcp/secrets/types.js +8 -0
- package/dist/mcp/secrets/types.js.map +1 -0
- package/dist/mcp/secrets/vault-resolver.d.ts +43 -0
- package/dist/mcp/secrets/vault-resolver.d.ts.map +1 -0
- package/dist/mcp/secrets/vault-resolver.js +127 -0
- package/dist/mcp/secrets/vault-resolver.js.map +1 -0
- package/dist/mcp/tool-converter.d.ts +40 -0
- package/dist/mcp/tool-converter.d.ts.map +1 -0
- package/dist/mcp/tool-converter.js +185 -0
- package/dist/mcp/tool-converter.js.map +1 -0
- package/dist/policy/approval-manifest.d.ts +76 -0
- package/dist/policy/approval-manifest.d.ts.map +1 -0
- package/dist/policy/approval-manifest.js +197 -0
- package/dist/policy/approval-manifest.js.map +1 -0
- package/dist/policy/content-validator.d.ts +19 -0
- package/dist/policy/content-validator.d.ts.map +1 -0
- package/dist/policy/content-validator.js +196 -0
- package/dist/policy/content-validator.js.map +1 -0
- package/dist/policy/default-policy.d.ts +46 -0
- package/dist/policy/default-policy.d.ts.map +1 -0
- package/dist/policy/default-policy.js +241 -0
- package/dist/policy/default-policy.js.map +1 -0
- package/dist/policy/events.d.ts +71 -0
- package/dist/policy/events.d.ts.map +1 -0
- package/dist/policy/events.js +8 -0
- package/dist/policy/events.js.map +1 -0
- package/dist/policy/index.d.ts +13 -0
- package/dist/policy/index.d.ts.map +1 -0
- package/dist/policy/index.js +9 -0
- package/dist/policy/index.js.map +1 -0
- package/dist/policy/integrity-tracker.d.ts +62 -0
- package/dist/policy/integrity-tracker.d.ts.map +1 -0
- package/dist/policy/integrity-tracker.js +79 -0
- package/dist/policy/integrity-tracker.js.map +1 -0
- package/dist/policy/policy-loader.d.ts +58 -0
- package/dist/policy/policy-loader.d.ts.map +1 -0
- package/dist/policy/policy-loader.js +156 -0
- package/dist/policy/policy-loader.js.map +1 -0
- package/dist/policy/risk-classifier.d.ts +18 -0
- package/dist/policy/risk-classifier.d.ts.map +1 -0
- package/dist/policy/risk-classifier.js +47 -0
- package/dist/policy/risk-classifier.js.map +1 -0
- package/dist/policy/types.d.ts +131 -0
- package/dist/policy/types.d.ts.map +1 -0
- package/dist/policy/types.js +8 -0
- package/dist/policy/types.js.map +1 -0
- package/package.json +22 -6
- package/tools/matimo_approve_tool/definition.yaml +36 -0
- package/tools/matimo_approve_tool/matimo_approve_tool.ts +90 -0
- package/tools/matimo_create_skill/definition.yaml +46 -0
- package/tools/matimo_create_skill/matimo_create_skill.ts +75 -0
- package/tools/matimo_create_tool/definition.yaml +48 -0
- package/tools/matimo_create_tool/matimo_create_tool.ts +137 -0
- package/tools/matimo_get_skill/definition.yaml +60 -0
- package/tools/matimo_get_skill/matimo_get_skill.ts +182 -0
- package/tools/matimo_get_tool/definition.yaml +36 -0
- package/tools/matimo_get_tool/matimo_get_tool.ts +56 -0
- package/tools/matimo_get_tool_status/definition.yaml +42 -0
- package/tools/matimo_get_tool_status/matimo_get_tool_status.ts +101 -0
- package/tools/matimo_list_skills/definition.yaml +52 -0
- package/tools/matimo_list_skills/matimo_list_skills.ts +138 -0
- package/tools/matimo_list_user_tools/definition.yaml +32 -0
- package/tools/matimo_list_user_tools/matimo_list_user_tools.ts +74 -0
- package/tools/matimo_reload_tools/definition.yaml +35 -0
- package/tools/matimo_reload_tools/matimo_reload_tools.ts +29 -0
- package/tools/matimo_search_tools/definition.yaml +32 -0
- package/tools/matimo_search_tools/matimo_search_tools.ts +82 -0
- package/tools/matimo_validate_skill/definition.yaml +43 -0
- package/tools/matimo_validate_skill/matimo_validate_skill.ts +137 -0
- package/tools/matimo_validate_tool/definition.yaml +34 -0
- package/tools/matimo_validate_tool/matimo_validate_tool.ts +168 -0
- package/tools/shared/skill-validation.ts +335 -0
- package/LICENSE +0 -21
|
@@ -1,21 +1,80 @@
|
|
|
1
|
-
import {
|
|
1
|
+
import { ToolRegistry } from './core/tool-registry';
|
|
2
|
+
import type { SemanticSearchResult } from './core/skill-registry';
|
|
3
|
+
import { ToolDefinition, SkillDefinition, SkillSummary, SearchSkillsOptions, SkillContentOptions, EmbeddingProvider } from './core/types';
|
|
2
4
|
import { MatimoLogger, LoggerConfig } from './logging';
|
|
5
|
+
import type { ExecuteOptions } from './core/types';
|
|
6
|
+
import type { PolicyEngine, PolicyContext, PolicyConfig, HITLCallback } from './policy/types';
|
|
7
|
+
import { ToolIntegrityTracker } from './policy/integrity-tracker';
|
|
8
|
+
import { ApprovalManifest } from './policy/approval-manifest';
|
|
9
|
+
import type { MatimoEventHandler } from './policy/events';
|
|
10
|
+
/**
|
|
11
|
+
* Result of a hot-reload operation
|
|
12
|
+
*/
|
|
13
|
+
export interface ReloadResult {
|
|
14
|
+
loaded: number;
|
|
15
|
+
removed: number;
|
|
16
|
+
revalidated: number;
|
|
17
|
+
rejected: string[];
|
|
18
|
+
/** True if a mid-load failure caused the registry to be restored to its previous state. */
|
|
19
|
+
rolledBack?: boolean;
|
|
20
|
+
}
|
|
3
21
|
/**
|
|
4
22
|
* Options for MatimoInstance initialization
|
|
5
23
|
*/
|
|
6
24
|
export interface InitOptions extends LoggerConfig {
|
|
7
25
|
toolPaths?: string[];
|
|
26
|
+
/** Skill paths for discovering SKILL.md files (Level 1 discovery) */
|
|
27
|
+
skillPaths?: string[];
|
|
8
28
|
autoDiscover?: boolean;
|
|
9
29
|
includeCore?: boolean;
|
|
30
|
+
/** Custom PolicyEngine implementation. Mutually exclusive with policyConfig and policyFile. */
|
|
31
|
+
policy?: PolicyEngine;
|
|
32
|
+
/** Shorthand to create a DefaultPolicyEngine. Ignored if `policy` is provided. */
|
|
33
|
+
policyConfig?: PolicyConfig;
|
|
34
|
+
/** Path to a policy.yaml file. Loaded into a DefaultPolicyEngine. Ignored if `policy` is provided. */
|
|
35
|
+
policyFile?: string;
|
|
36
|
+
/** Paths containing trusted (developer-authored) tools. Defaults to auto-discovered @matimo/* paths. */
|
|
37
|
+
trustedPaths?: string[];
|
|
38
|
+
/** Paths containing untrusted (agent-created) tools. These tools undergo content validation. */
|
|
39
|
+
untrustedPaths?: string[];
|
|
40
|
+
/** HMAC secret for approval manifest. Overrides MATIMO_APPROVAL_SECRET env. */
|
|
41
|
+
approvalSecret?: string;
|
|
42
|
+
/** Directory for .matimo-approvals.json. Defaults to process.cwd(). */
|
|
43
|
+
approvalDir?: string;
|
|
44
|
+
/**
|
|
45
|
+
* Approval TTL in seconds. Approvals older than this are treated as expired
|
|
46
|
+
* and the tool must be re-approved. If not set, approvals never expire.
|
|
47
|
+
*/
|
|
48
|
+
approvalTtlSeconds?: number;
|
|
49
|
+
/** Event handler for audit events (tool creation, approval, execution, etc.) */
|
|
50
|
+
onEvent?: MatimoEventHandler;
|
|
51
|
+
/**
|
|
52
|
+
* Human-in-the-loop callback for quarantined tools.
|
|
53
|
+
* Called when a tool enters `pending_approval` state (medium-risk in prod with enableHITL).
|
|
54
|
+
* Return `true` to approve, `false` to reject.
|
|
55
|
+
* If not set, quarantined tools are rejected by default.
|
|
56
|
+
*/
|
|
57
|
+
onHITL?: HITLCallback;
|
|
58
|
+
/**
|
|
59
|
+
* Timeout in milliseconds for the HITL callback.
|
|
60
|
+
* If the callback does not resolve within this time, the tool is auto-rejected.
|
|
61
|
+
* Defaults to no timeout (waits indefinitely).
|
|
62
|
+
*/
|
|
63
|
+
hitlTimeoutMs?: number;
|
|
10
64
|
}
|
|
11
65
|
/**
|
|
12
66
|
* Matimo Instance - Single initialization point for tool execution
|
|
13
67
|
* Combines loader, registry, and executors into one interface
|
|
14
68
|
*/
|
|
15
69
|
export declare class MatimoInstance {
|
|
70
|
+
#private;
|
|
71
|
+
private static readonly HITL_TIMEOUT_SENTINEL;
|
|
16
72
|
private toolPaths;
|
|
73
|
+
private skillPaths;
|
|
17
74
|
private loader;
|
|
18
75
|
private registry;
|
|
76
|
+
private skillLoader;
|
|
77
|
+
private skillRegistry;
|
|
19
78
|
private commandExecutor;
|
|
20
79
|
private httpExecutor;
|
|
21
80
|
private functionExecutor;
|
|
@@ -59,12 +118,19 @@ export declare class MatimoInstance {
|
|
|
59
118
|
*/
|
|
60
119
|
getLogger(): MatimoLogger;
|
|
61
120
|
/**
|
|
62
|
-
* Execute a tool by name with parameters
|
|
121
|
+
* Execute a tool by name with parameters.
|
|
122
|
+
*
|
|
63
123
|
* @param toolName - Name of the tool to execute
|
|
64
124
|
* @param params - Tool parameters
|
|
125
|
+
* @param options - Optional execution options
|
|
126
|
+
* @param options.timeout - Execution timeout in milliseconds
|
|
127
|
+
* @param options.credentials - Per-call credential overrides (multi-tenant support).
|
|
128
|
+
* Keys must match the env-var names the tool references (e.g. `SLACK_BOT_TOKEN`).
|
|
129
|
+
* When provided, they take precedence over `process.env` for that single call.
|
|
130
|
+
* Values are never logged and held in memory only for the duration of the call.
|
|
65
131
|
* @returns Tool execution result
|
|
66
132
|
*/
|
|
67
|
-
execute(toolName: string, params: Record<string, unknown
|
|
133
|
+
execute(toolName: string, params: Record<string, unknown>, options?: ExecuteOptions): Promise<unknown>;
|
|
68
134
|
/**
|
|
69
135
|
* Get a tool definition by name
|
|
70
136
|
* @param toolName - Name of the tool
|
|
@@ -72,46 +138,148 @@ export declare class MatimoInstance {
|
|
|
72
138
|
*/
|
|
73
139
|
getTool(toolName: string): ToolDefinition | undefined;
|
|
74
140
|
/**
|
|
75
|
-
* List all available tools
|
|
141
|
+
* List all available tools, optionally filtered by policy.
|
|
142
|
+
* @param context - PolicyContext for filtering. If omitted and policy is active, returns all tools (backward compatible).
|
|
76
143
|
* @returns Array of tool definitions
|
|
77
144
|
*/
|
|
78
|
-
listTools(): ToolDefinition[];
|
|
145
|
+
listTools(context?: PolicyContext): ToolDefinition[];
|
|
79
146
|
/**
|
|
80
147
|
* Get all available tools (alias for listTools)
|
|
81
148
|
* @returns Array of tool definitions
|
|
82
149
|
*/
|
|
83
|
-
getAllTools(): ToolDefinition[];
|
|
150
|
+
getAllTools(context?: PolicyContext): ToolDefinition[];
|
|
151
|
+
/**
|
|
152
|
+
* Return only the tools this agent context is permitted to use.
|
|
153
|
+
* Mirrors: Matimo.get_tools_for_agent() in Python SDK.
|
|
154
|
+
*
|
|
155
|
+
* @param context - PolicyContext (agentId, roles, environment)
|
|
156
|
+
* @returns Tools permitted for this context, filtered through the policy engine
|
|
157
|
+
*/
|
|
158
|
+
getToolsForAgent(context: PolicyContext): ToolDefinition[];
|
|
84
159
|
/**
|
|
85
160
|
* Search tools by name or description
|
|
86
161
|
* @param query - Search query
|
|
87
162
|
* @returns Matching tools
|
|
88
163
|
*/
|
|
89
|
-
searchTools(query: string): ToolDefinition[];
|
|
164
|
+
searchTools(query: string, context?: PolicyContext): ToolDefinition[];
|
|
90
165
|
/**
|
|
91
166
|
* Get tools by tag
|
|
92
167
|
* @param tag - Tag to search for
|
|
93
168
|
* @returns Tools with the given tag
|
|
94
169
|
*/
|
|
95
|
-
getToolsByTag(tag: string): ToolDefinition[];
|
|
170
|
+
getToolsByTag(tag: string, context?: PolicyContext): ToolDefinition[];
|
|
171
|
+
/**
|
|
172
|
+
* Return the credential key names that a tool expects.
|
|
173
|
+
*
|
|
174
|
+
* This lets multi-tenant callers know exactly what to put in `options.credentials`
|
|
175
|
+
* without having to read the tool's YAML definition.
|
|
176
|
+
*
|
|
177
|
+
* The returned strings are the keys you pass to `execute()`:
|
|
178
|
+
* ```typescript
|
|
179
|
+
* const keys = matimo.getRequiredCredentials('slack-send-message');
|
|
180
|
+
* // → ['SLACK_BOT_TOKEN']
|
|
181
|
+
*
|
|
182
|
+
* // Then collect from your secrets store:
|
|
183
|
+
* const credentials = Object.fromEntries(
|
|
184
|
+
* keys.map(k => [k, tenant.secrets[k]])
|
|
185
|
+
* );
|
|
186
|
+
* await matimo.execute('slack-send-message', params, { credentials });
|
|
187
|
+
* ```
|
|
188
|
+
*
|
|
189
|
+
* @param toolName - Exact tool name
|
|
190
|
+
* @returns Array of credential key names (may be empty if the tool needs no auth)
|
|
191
|
+
* @throws `MatimoError(TOOL_NOT_FOUND)` if the tool doesn't exist
|
|
192
|
+
*/
|
|
193
|
+
getRequiredCredentials(toolName: string): string[];
|
|
194
|
+
/**
|
|
195
|
+
* List all available skills (Level 1 discovery - minimal context)
|
|
196
|
+
* @returns Array of skill summaries
|
|
197
|
+
*/
|
|
198
|
+
listSkills(): SkillSummary[];
|
|
199
|
+
/**
|
|
200
|
+
* Get a single skill by name (Level 2 activation - full content)
|
|
201
|
+
* @param name - Skill name
|
|
202
|
+
* @returns Skill definition or null
|
|
203
|
+
*/
|
|
204
|
+
getSkill(name: string): SkillDefinition | null;
|
|
205
|
+
/**
|
|
206
|
+
* Get selective skill content — only the sections an agent needs.
|
|
207
|
+
* Prevents dumping entire SKILL.md files into the LLM context window.
|
|
208
|
+
*
|
|
209
|
+
* @example
|
|
210
|
+
* // Get only error handling, max 500 tokens
|
|
211
|
+
* matimo.getSkillContent('postgres-query-operations', {
|
|
212
|
+
* sections: ['Error Handling'],
|
|
213
|
+
* maxTokens: 500,
|
|
214
|
+
* })
|
|
215
|
+
*/
|
|
216
|
+
getSkillContent(name: string, options?: SkillContentOptions): string | null;
|
|
217
|
+
/**
|
|
218
|
+
* List all sections of a skill with their token costs.
|
|
219
|
+
* Agents use this to decide which sections to load before activating.
|
|
220
|
+
*/
|
|
221
|
+
getSkillSections(name: string): Array<{
|
|
222
|
+
path: string;
|
|
223
|
+
level: number;
|
|
224
|
+
tokenEstimate: number;
|
|
225
|
+
}> | null;
|
|
226
|
+
/**
|
|
227
|
+
* Search skills by keyword, category, difficulty, etc.
|
|
228
|
+
* Set `options.semantic = true` for embedding-based similarity ranking.
|
|
229
|
+
* @param options - Search options
|
|
230
|
+
* @returns Matching skills
|
|
231
|
+
*/
|
|
232
|
+
searchSkills(options?: SearchSkillsOptions): SkillSummary[];
|
|
233
|
+
/**
|
|
234
|
+
* Semantic search with relevance scores.
|
|
235
|
+
* Uses embeddings to find skills by meaning, not just keywords.
|
|
236
|
+
*
|
|
237
|
+
* @example
|
|
238
|
+
* const results = await matimo.semanticSearchSkills('How do I handle Postgres locking?');
|
|
239
|
+
* // → [{ skill: { name: 'postgres-query-operations' }, score: 0.82 }]
|
|
240
|
+
*/
|
|
241
|
+
semanticSearchSkills(query: string, options?: {
|
|
242
|
+
limit?: number;
|
|
243
|
+
minScore?: number;
|
|
244
|
+
}): Promise<SemanticSearchResult[]>;
|
|
245
|
+
/**
|
|
246
|
+
* Set a custom embedding provider for semantic skill search.
|
|
247
|
+
* If not set, a built-in TF-IDF provider is used.
|
|
248
|
+
*/
|
|
249
|
+
setSkillEmbeddingProvider(provider: EmbeddingProvider): void;
|
|
250
|
+
/**
|
|
251
|
+
* Get a bundled resource from a skill (Level 3 resources)
|
|
252
|
+
* @param skillName - Skill name
|
|
253
|
+
* @param resourcePath - Relative path to resource (e.g., "scripts/extract.py")
|
|
254
|
+
* @returns Resource content
|
|
255
|
+
*/
|
|
256
|
+
getSkillResource(skillName: string, resourcePath: string): string;
|
|
257
|
+
/**
|
|
258
|
+
* Get all skill paths
|
|
259
|
+
* @returns Array of skill paths
|
|
260
|
+
*/
|
|
261
|
+
getSkillPaths(): string[];
|
|
96
262
|
/**
|
|
97
263
|
* Automatically inject parameters from environment variables
|
|
98
264
|
* Uses a YAML-native, scale-friendly approach:
|
|
99
265
|
*
|
|
100
266
|
* 1. Scans the execution config for all parameter placeholders
|
|
101
267
|
* 2. For each parameter not provided by user, checks if it looks like auth (TOKEN, KEY, SECRET, etc.)
|
|
102
|
-
* 3. If yes, attempts to load from
|
|
268
|
+
* 3. If yes, attempts to load from (in order of priority):
|
|
269
|
+
* a. `credentials[paramName]` — per-call override (multi-tenant)
|
|
270
|
+
* b. `credentials[MATIMO_${paramName}]` — prefixed per-call override
|
|
271
|
+
* c. `process.env[MATIMO_${paramName}]` — prefixed env var
|
|
272
|
+
* d. `process.env[paramName]` — direct env var
|
|
103
273
|
*
|
|
104
|
-
*
|
|
105
|
-
* Scales to unlimited tools - contributors just submit YAML.
|
|
106
|
-
*
|
|
107
|
-
* Examples:
|
|
108
|
-
* - GMAIL_ACCESS_TOKEN → looks in env vars
|
|
109
|
-
* - GITHUB_TOKEN → looks in env vars
|
|
110
|
-
* - SLACK_BOT_TOKEN → looks in env vars
|
|
111
|
-
* - MY_CUSTOM_API_KEY → looks in env vars
|
|
112
|
-
* - ANY_SECRET → looks in env vars
|
|
274
|
+
* Credential values are never logged.
|
|
113
275
|
*/
|
|
114
276
|
private injectAuthParameters;
|
|
277
|
+
/**
|
|
278
|
+
* After injectAuthParameters(), verify no auth-looking placeholders remain unfilled.
|
|
279
|
+
* Only checks HTTP headers (where auth credentials are injected) — not query params or body.
|
|
280
|
+
* Throws AUTH_FAILED with actionable guidance naming the missing env var(s).
|
|
281
|
+
*/
|
|
282
|
+
private assertAuthParamsFilled;
|
|
115
283
|
/**
|
|
116
284
|
* Extract all parameter placeholders from execution config
|
|
117
285
|
* Scans headers, body, URL, and query_params for {paramName} patterns
|
|
@@ -125,6 +293,50 @@ export declare class MatimoInstance {
|
|
|
125
293
|
* Get the appropriate executor for a tool
|
|
126
294
|
*/
|
|
127
295
|
private getExecutor;
|
|
296
|
+
/**
|
|
297
|
+
* Hot-reload tools from all configured paths.
|
|
298
|
+
* Re-validates untrusted tools via content validator and integrity tracker.
|
|
299
|
+
* Tools that fail validation are rejected and not loaded.
|
|
300
|
+
*
|
|
301
|
+
* Atomic: if loading fails mid-way (e.g. I/O error), the registry is restored
|
|
302
|
+
* to its previous state and `rolledBack: true` is included in the result.
|
|
303
|
+
*/
|
|
304
|
+
reloadTools(): Promise<ReloadResult>;
|
|
305
|
+
/**
|
|
306
|
+
* Check if a policy engine is active.
|
|
307
|
+
*/
|
|
308
|
+
hasPolicy(): boolean;
|
|
309
|
+
/**
|
|
310
|
+
* Get the approval manifest (if policy engine is active).
|
|
311
|
+
*/
|
|
312
|
+
getApprovalManifest(): ApprovalManifest | null;
|
|
313
|
+
/**
|
|
314
|
+
* Get the integrity tracker.
|
|
315
|
+
*/
|
|
316
|
+
getIntegrityTracker(): ToolIntegrityTracker;
|
|
317
|
+
/**
|
|
318
|
+
* Get the tool registry (for advanced use cases).
|
|
319
|
+
*/
|
|
320
|
+
getRegistry(): ToolRegistry;
|
|
321
|
+
/**
|
|
322
|
+
* Set a Human-in-the-Loop callback for quarantined tools.
|
|
323
|
+
* The callback is invoked when a tool with `pending_approval` status is executed.
|
|
324
|
+
* Return `true` to approve, `false` to reject.
|
|
325
|
+
*/
|
|
326
|
+
setHITLCallback(callback: HITLCallback | null): void;
|
|
327
|
+
/**
|
|
328
|
+
* Hot-reload the policy engine at runtime.
|
|
329
|
+
*
|
|
330
|
+
* - If `configOrFile` is a `PolicyConfig` object, creates a new `DefaultPolicyEngine`.
|
|
331
|
+
* - If `configOrFile` is a string, re-reads and parses the YAML file.
|
|
332
|
+
* - If omitted and the instance was initialized with `policyFile`, re-reads that file.
|
|
333
|
+
*
|
|
334
|
+
* The new policy is validated before swap — if validation fails, the old policy remains active.
|
|
335
|
+
* After swap, all tools are re-validated against the new policy via `reloadTools()`.
|
|
336
|
+
*
|
|
337
|
+
* @returns The ReloadResult from the subsequent tool re-validation.
|
|
338
|
+
*/
|
|
339
|
+
reloadPolicy(configOrFile?: PolicyConfig | string): Promise<ReloadResult>;
|
|
128
340
|
}
|
|
129
341
|
/**
|
|
130
342
|
* Matimo namespace - Entry point for the SDK
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"matimo-instance.d.ts","sourceRoot":"","sources":["../src/matimo-instance.ts"],"names":[],"mappings":"
|
|
1
|
+
{"version":3,"file":"matimo-instance.d.ts","sourceRoot":"","sources":["../src/matimo-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAIlE,OAAO,EACL,cAAc,EACd,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,YAAY,EAIb,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAe,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAqBvE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,kFAAkF;IAClF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,sGAAsG;IACtG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gGAAgG;IAChG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,cAAc;;IAEzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAA0B;IAEvE,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,UAAU,CAAW;IAC7B,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,eAAe,CAAkB;IAazC,OAAO;IA4DP;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;WACU,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAmI1E;;;OAGG;IACH,YAAY,IAAI,MAAM,EAAE;IAIxB;;;OAGG;IACH,SAAS,IAAI,YAAY;IAIzB;;;;;;;;;;;;OAYG;IACG,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,OAAO,CAAC;IAwKnB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIrD;;;;OAIG;IACH,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAQpD;;;OAGG;IACH,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAItD;;;;;;OAMG;IACH,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,EAAE;IAQ1D;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAQrE;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAQrE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IA8ClD;;;OAGG;IACH,UAAU,IAAI,YAAY,EAAE;IAI5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAI9C;;;;;;;;;;OAUG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI;IAI3E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,GACX,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAIvE;;;;;OAKG;IACH,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,EAAE;IAI/D;;;;;;;OAOG;IACG,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAIlC;;;OAGG;IACH,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAIjE;;;OAGG;IACH,aAAa,IAAI,MAAM,EAAE;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAyD5B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IA4D9B;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAkDpC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,WAAW;IA+BnB;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;IA8G1C;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,mBAAmB,IAAI,gBAAgB,GAAG,IAAI;IAI9C;;OAEG;IACH,mBAAmB,IAAI,oBAAoB;IAI3C;;OAEG;IACH,WAAW,IAAI,YAAY;IAI3B;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI;IAIpD;;;;;;;;;;;OAWG;IACG,YAAY,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CA+HhF;AAED;;GAEG;AACH,eAAO,MAAM,MAAM;IACjB;;;;OAIG;oBACmB,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAGvD,CAAC"}
|