@matimo/core 0.1.0-alpha.9 → 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (169) hide show
  1. package/README.md +341 -14
  2. package/dist/approval/approval-handler.d.ts +5 -1
  3. package/dist/approval/approval-handler.d.ts.map +1 -1
  4. package/dist/approval/approval-handler.js +6 -0
  5. package/dist/approval/approval-handler.js.map +1 -1
  6. package/dist/core/schema.d.ts +41 -10
  7. package/dist/core/schema.d.ts.map +1 -1
  8. package/dist/core/schema.js +40 -4
  9. package/dist/core/schema.js.map +1 -1
  10. package/dist/core/skill-content-parser.d.ts +91 -0
  11. package/dist/core/skill-content-parser.d.ts.map +1 -0
  12. package/dist/core/skill-content-parser.js +248 -0
  13. package/dist/core/skill-content-parser.js.map +1 -0
  14. package/dist/core/skill-loader.d.ts +46 -0
  15. package/dist/core/skill-loader.d.ts.map +1 -0
  16. package/dist/core/skill-loader.js +310 -0
  17. package/dist/core/skill-loader.js.map +1 -0
  18. package/dist/core/skill-registry.d.ts +131 -0
  19. package/dist/core/skill-registry.d.ts.map +1 -0
  20. package/dist/core/skill-registry.js +316 -0
  21. package/dist/core/skill-registry.js.map +1 -0
  22. package/dist/core/tfidf-embedding.d.ts +45 -0
  23. package/dist/core/tfidf-embedding.d.ts.map +1 -0
  24. package/dist/core/tfidf-embedding.js +199 -0
  25. package/dist/core/tfidf-embedding.js.map +1 -0
  26. package/dist/core/tool-loader.d.ts +3 -1
  27. package/dist/core/tool-loader.d.ts.map +1 -1
  28. package/dist/core/tool-loader.js +33 -10
  29. package/dist/core/tool-loader.js.map +1 -1
  30. package/dist/core/types.d.ts +203 -6
  31. package/dist/core/types.d.ts.map +1 -1
  32. package/dist/encodings/parameter-encoding.d.ts +1 -1
  33. package/dist/encodings/parameter-encoding.d.ts.map +1 -1
  34. package/dist/encodings/parameter-encoding.js +9 -4
  35. package/dist/encodings/parameter-encoding.js.map +1 -1
  36. package/dist/errors/matimo-error.d.ts +11 -2
  37. package/dist/errors/matimo-error.d.ts.map +1 -1
  38. package/dist/errors/matimo-error.js +25 -1
  39. package/dist/errors/matimo-error.js.map +1 -1
  40. package/dist/executors/command-executor.d.ts +9 -2
  41. package/dist/executors/command-executor.d.ts.map +1 -1
  42. package/dist/executors/command-executor.js +29 -5
  43. package/dist/executors/command-executor.js.map +1 -1
  44. package/dist/executors/function-executor.d.ts +10 -3
  45. package/dist/executors/function-executor.d.ts.map +1 -1
  46. package/dist/executors/function-executor.js +44 -24
  47. package/dist/executors/function-executor.js.map +1 -1
  48. package/dist/executors/http-executor.d.ts +79 -4
  49. package/dist/executors/http-executor.d.ts.map +1 -1
  50. package/dist/executors/http-executor.js +232 -28
  51. package/dist/executors/http-executor.js.map +1 -1
  52. package/dist/index.d.ts +25 -3
  53. package/dist/index.d.ts.map +1 -1
  54. package/dist/index.js +19 -1
  55. package/dist/index.js.map +1 -1
  56. package/dist/integrations/langchain.d.ts +55 -0
  57. package/dist/integrations/langchain.d.ts.map +1 -1
  58. package/dist/integrations/langchain.js +71 -4
  59. package/dist/integrations/langchain.js.map +1 -1
  60. package/dist/logging/winston-logger.d.ts.map +1 -1
  61. package/dist/logging/winston-logger.js +9 -1
  62. package/dist/logging/winston-logger.js.map +1 -1
  63. package/dist/matimo-instance.d.ts +230 -18
  64. package/dist/matimo-instance.d.ts.map +1 -1
  65. package/dist/matimo-instance.js +739 -40
  66. package/dist/matimo-instance.js.map +1 -1
  67. package/dist/mcp/index.d.ts +18 -0
  68. package/dist/mcp/index.d.ts.map +1 -0
  69. package/dist/mcp/index.js +24 -0
  70. package/dist/mcp/index.js.map +1 -0
  71. package/dist/mcp/mcp-server.d.ts +141 -0
  72. package/dist/mcp/mcp-server.d.ts.map +1 -0
  73. package/dist/mcp/mcp-server.js +754 -0
  74. package/dist/mcp/mcp-server.js.map +1 -0
  75. package/dist/mcp/secrets/aws-resolver.d.ts +41 -0
  76. package/dist/mcp/secrets/aws-resolver.d.ts.map +1 -0
  77. package/dist/mcp/secrets/aws-resolver.js +141 -0
  78. package/dist/mcp/secrets/aws-resolver.js.map +1 -0
  79. package/dist/mcp/secrets/dotenv-resolver.d.ts +23 -0
  80. package/dist/mcp/secrets/dotenv-resolver.d.ts.map +1 -0
  81. package/dist/mcp/secrets/dotenv-resolver.js +94 -0
  82. package/dist/mcp/secrets/dotenv-resolver.js.map +1 -0
  83. package/dist/mcp/secrets/env-resolver.d.ts +14 -0
  84. package/dist/mcp/secrets/env-resolver.d.ts.map +1 -0
  85. package/dist/mcp/secrets/env-resolver.js +27 -0
  86. package/dist/mcp/secrets/env-resolver.js.map +1 -0
  87. package/dist/mcp/secrets/index.d.ts +14 -0
  88. package/dist/mcp/secrets/index.d.ts.map +1 -0
  89. package/dist/mcp/secrets/index.js +13 -0
  90. package/dist/mcp/secrets/index.js.map +1 -0
  91. package/dist/mcp/secrets/resolver-chain.d.ts +34 -0
  92. package/dist/mcp/secrets/resolver-chain.d.ts.map +1 -0
  93. package/dist/mcp/secrets/resolver-chain.js +141 -0
  94. package/dist/mcp/secrets/resolver-chain.js.map +1 -0
  95. package/dist/mcp/secrets/types.d.ts +73 -0
  96. package/dist/mcp/secrets/types.d.ts.map +1 -0
  97. package/dist/mcp/secrets/types.js +8 -0
  98. package/dist/mcp/secrets/types.js.map +1 -0
  99. package/dist/mcp/secrets/vault-resolver.d.ts +43 -0
  100. package/dist/mcp/secrets/vault-resolver.d.ts.map +1 -0
  101. package/dist/mcp/secrets/vault-resolver.js +127 -0
  102. package/dist/mcp/secrets/vault-resolver.js.map +1 -0
  103. package/dist/mcp/tool-converter.d.ts +40 -0
  104. package/dist/mcp/tool-converter.d.ts.map +1 -0
  105. package/dist/mcp/tool-converter.js +185 -0
  106. package/dist/mcp/tool-converter.js.map +1 -0
  107. package/dist/policy/approval-manifest.d.ts +76 -0
  108. package/dist/policy/approval-manifest.d.ts.map +1 -0
  109. package/dist/policy/approval-manifest.js +197 -0
  110. package/dist/policy/approval-manifest.js.map +1 -0
  111. package/dist/policy/content-validator.d.ts +19 -0
  112. package/dist/policy/content-validator.d.ts.map +1 -0
  113. package/dist/policy/content-validator.js +196 -0
  114. package/dist/policy/content-validator.js.map +1 -0
  115. package/dist/policy/default-policy.d.ts +46 -0
  116. package/dist/policy/default-policy.d.ts.map +1 -0
  117. package/dist/policy/default-policy.js +241 -0
  118. package/dist/policy/default-policy.js.map +1 -0
  119. package/dist/policy/events.d.ts +71 -0
  120. package/dist/policy/events.d.ts.map +1 -0
  121. package/dist/policy/events.js +8 -0
  122. package/dist/policy/events.js.map +1 -0
  123. package/dist/policy/index.d.ts +13 -0
  124. package/dist/policy/index.d.ts.map +1 -0
  125. package/dist/policy/index.js +9 -0
  126. package/dist/policy/index.js.map +1 -0
  127. package/dist/policy/integrity-tracker.d.ts +62 -0
  128. package/dist/policy/integrity-tracker.d.ts.map +1 -0
  129. package/dist/policy/integrity-tracker.js +79 -0
  130. package/dist/policy/integrity-tracker.js.map +1 -0
  131. package/dist/policy/policy-loader.d.ts +58 -0
  132. package/dist/policy/policy-loader.d.ts.map +1 -0
  133. package/dist/policy/policy-loader.js +156 -0
  134. package/dist/policy/policy-loader.js.map +1 -0
  135. package/dist/policy/risk-classifier.d.ts +18 -0
  136. package/dist/policy/risk-classifier.d.ts.map +1 -0
  137. package/dist/policy/risk-classifier.js +47 -0
  138. package/dist/policy/risk-classifier.js.map +1 -0
  139. package/dist/policy/types.d.ts +131 -0
  140. package/dist/policy/types.d.ts.map +1 -0
  141. package/dist/policy/types.js +8 -0
  142. package/dist/policy/types.js.map +1 -0
  143. package/package.json +22 -6
  144. package/tools/matimo_approve_tool/definition.yaml +36 -0
  145. package/tools/matimo_approve_tool/matimo_approve_tool.ts +90 -0
  146. package/tools/matimo_create_skill/definition.yaml +46 -0
  147. package/tools/matimo_create_skill/matimo_create_skill.ts +75 -0
  148. package/tools/matimo_create_tool/definition.yaml +48 -0
  149. package/tools/matimo_create_tool/matimo_create_tool.ts +137 -0
  150. package/tools/matimo_get_skill/definition.yaml +60 -0
  151. package/tools/matimo_get_skill/matimo_get_skill.ts +182 -0
  152. package/tools/matimo_get_tool/definition.yaml +36 -0
  153. package/tools/matimo_get_tool/matimo_get_tool.ts +56 -0
  154. package/tools/matimo_get_tool_status/definition.yaml +42 -0
  155. package/tools/matimo_get_tool_status/matimo_get_tool_status.ts +101 -0
  156. package/tools/matimo_list_skills/definition.yaml +52 -0
  157. package/tools/matimo_list_skills/matimo_list_skills.ts +138 -0
  158. package/tools/matimo_list_user_tools/definition.yaml +32 -0
  159. package/tools/matimo_list_user_tools/matimo_list_user_tools.ts +74 -0
  160. package/tools/matimo_reload_tools/definition.yaml +35 -0
  161. package/tools/matimo_reload_tools/matimo_reload_tools.ts +29 -0
  162. package/tools/matimo_search_tools/definition.yaml +32 -0
  163. package/tools/matimo_search_tools/matimo_search_tools.ts +82 -0
  164. package/tools/matimo_validate_skill/definition.yaml +43 -0
  165. package/tools/matimo_validate_skill/matimo_validate_skill.ts +137 -0
  166. package/tools/matimo_validate_tool/definition.yaml +34 -0
  167. package/tools/matimo_validate_tool/matimo_validate_tool.ts +168 -0
  168. package/tools/shared/skill-validation.ts +335 -0
  169. package/LICENSE +0 -21
@@ -1,21 +1,80 @@
1
- import { ToolDefinition } from './core/schema';
1
+ import { ToolRegistry } from './core/tool-registry';
2
+ import type { SemanticSearchResult } from './core/skill-registry';
3
+ import { ToolDefinition, SkillDefinition, SkillSummary, SearchSkillsOptions, SkillContentOptions, EmbeddingProvider } from './core/types';
2
4
  import { MatimoLogger, LoggerConfig } from './logging';
5
+ import type { ExecuteOptions } from './core/types';
6
+ import type { PolicyEngine, PolicyContext, PolicyConfig, HITLCallback } from './policy/types';
7
+ import { ToolIntegrityTracker } from './policy/integrity-tracker';
8
+ import { ApprovalManifest } from './policy/approval-manifest';
9
+ import type { MatimoEventHandler } from './policy/events';
10
+ /**
11
+ * Result of a hot-reload operation
12
+ */
13
+ export interface ReloadResult {
14
+ loaded: number;
15
+ removed: number;
16
+ revalidated: number;
17
+ rejected: string[];
18
+ /** True if a mid-load failure caused the registry to be restored to its previous state. */
19
+ rolledBack?: boolean;
20
+ }
3
21
  /**
4
22
  * Options for MatimoInstance initialization
5
23
  */
6
24
  export interface InitOptions extends LoggerConfig {
7
25
  toolPaths?: string[];
26
+ /** Skill paths for discovering SKILL.md files (Level 1 discovery) */
27
+ skillPaths?: string[];
8
28
  autoDiscover?: boolean;
9
29
  includeCore?: boolean;
30
+ /** Custom PolicyEngine implementation. Mutually exclusive with policyConfig and policyFile. */
31
+ policy?: PolicyEngine;
32
+ /** Shorthand to create a DefaultPolicyEngine. Ignored if `policy` is provided. */
33
+ policyConfig?: PolicyConfig;
34
+ /** Path to a policy.yaml file. Loaded into a DefaultPolicyEngine. Ignored if `policy` is provided. */
35
+ policyFile?: string;
36
+ /** Paths containing trusted (developer-authored) tools. Defaults to auto-discovered @matimo/* paths. */
37
+ trustedPaths?: string[];
38
+ /** Paths containing untrusted (agent-created) tools. These tools undergo content validation. */
39
+ untrustedPaths?: string[];
40
+ /** HMAC secret for approval manifest. Overrides MATIMO_APPROVAL_SECRET env. */
41
+ approvalSecret?: string;
42
+ /** Directory for .matimo-approvals.json. Defaults to process.cwd(). */
43
+ approvalDir?: string;
44
+ /**
45
+ * Approval TTL in seconds. Approvals older than this are treated as expired
46
+ * and the tool must be re-approved. If not set, approvals never expire.
47
+ */
48
+ approvalTtlSeconds?: number;
49
+ /** Event handler for audit events (tool creation, approval, execution, etc.) */
50
+ onEvent?: MatimoEventHandler;
51
+ /**
52
+ * Human-in-the-loop callback for quarantined tools.
53
+ * Called when a tool enters `pending_approval` state (medium-risk in prod with enableHITL).
54
+ * Return `true` to approve, `false` to reject.
55
+ * If not set, quarantined tools are rejected by default.
56
+ */
57
+ onHITL?: HITLCallback;
58
+ /**
59
+ * Timeout in milliseconds for the HITL callback.
60
+ * If the callback does not resolve within this time, the tool is auto-rejected.
61
+ * Defaults to no timeout (waits indefinitely).
62
+ */
63
+ hitlTimeoutMs?: number;
10
64
  }
11
65
  /**
12
66
  * Matimo Instance - Single initialization point for tool execution
13
67
  * Combines loader, registry, and executors into one interface
14
68
  */
15
69
  export declare class MatimoInstance {
70
+ #private;
71
+ private static readonly HITL_TIMEOUT_SENTINEL;
16
72
  private toolPaths;
73
+ private skillPaths;
17
74
  private loader;
18
75
  private registry;
76
+ private skillLoader;
77
+ private skillRegistry;
19
78
  private commandExecutor;
20
79
  private httpExecutor;
21
80
  private functionExecutor;
@@ -59,12 +118,19 @@ export declare class MatimoInstance {
59
118
  */
60
119
  getLogger(): MatimoLogger;
61
120
  /**
62
- * Execute a tool by name with parameters
121
+ * Execute a tool by name with parameters.
122
+ *
63
123
  * @param toolName - Name of the tool to execute
64
124
  * @param params - Tool parameters
125
+ * @param options - Optional execution options
126
+ * @param options.timeout - Execution timeout in milliseconds
127
+ * @param options.credentials - Per-call credential overrides (multi-tenant support).
128
+ * Keys must match the env-var names the tool references (e.g. `SLACK_BOT_TOKEN`).
129
+ * When provided, they take precedence over `process.env` for that single call.
130
+ * Values are never logged and held in memory only for the duration of the call.
65
131
  * @returns Tool execution result
66
132
  */
67
- execute(toolName: string, params: Record<string, unknown>): Promise<unknown>;
133
+ execute(toolName: string, params: Record<string, unknown>, options?: ExecuteOptions): Promise<unknown>;
68
134
  /**
69
135
  * Get a tool definition by name
70
136
  * @param toolName - Name of the tool
@@ -72,46 +138,148 @@ export declare class MatimoInstance {
72
138
  */
73
139
  getTool(toolName: string): ToolDefinition | undefined;
74
140
  /**
75
- * List all available tools
141
+ * List all available tools, optionally filtered by policy.
142
+ * @param context - PolicyContext for filtering. If omitted and policy is active, returns all tools (backward compatible).
76
143
  * @returns Array of tool definitions
77
144
  */
78
- listTools(): ToolDefinition[];
145
+ listTools(context?: PolicyContext): ToolDefinition[];
79
146
  /**
80
147
  * Get all available tools (alias for listTools)
81
148
  * @returns Array of tool definitions
82
149
  */
83
- getAllTools(): ToolDefinition[];
150
+ getAllTools(context?: PolicyContext): ToolDefinition[];
151
+ /**
152
+ * Return only the tools this agent context is permitted to use.
153
+ * Mirrors: Matimo.get_tools_for_agent() in Python SDK.
154
+ *
155
+ * @param context - PolicyContext (agentId, roles, environment)
156
+ * @returns Tools permitted for this context, filtered through the policy engine
157
+ */
158
+ getToolsForAgent(context: PolicyContext): ToolDefinition[];
84
159
  /**
85
160
  * Search tools by name or description
86
161
  * @param query - Search query
87
162
  * @returns Matching tools
88
163
  */
89
- searchTools(query: string): ToolDefinition[];
164
+ searchTools(query: string, context?: PolicyContext): ToolDefinition[];
90
165
  /**
91
166
  * Get tools by tag
92
167
  * @param tag - Tag to search for
93
168
  * @returns Tools with the given tag
94
169
  */
95
- getToolsByTag(tag: string): ToolDefinition[];
170
+ getToolsByTag(tag: string, context?: PolicyContext): ToolDefinition[];
171
+ /**
172
+ * Return the credential key names that a tool expects.
173
+ *
174
+ * This lets multi-tenant callers know exactly what to put in `options.credentials`
175
+ * without having to read the tool's YAML definition.
176
+ *
177
+ * The returned strings are the keys you pass to `execute()`:
178
+ * ```typescript
179
+ * const keys = matimo.getRequiredCredentials('slack-send-message');
180
+ * // → ['SLACK_BOT_TOKEN']
181
+ *
182
+ * // Then collect from your secrets store:
183
+ * const credentials = Object.fromEntries(
184
+ * keys.map(k => [k, tenant.secrets[k]])
185
+ * );
186
+ * await matimo.execute('slack-send-message', params, { credentials });
187
+ * ```
188
+ *
189
+ * @param toolName - Exact tool name
190
+ * @returns Array of credential key names (may be empty if the tool needs no auth)
191
+ * @throws `MatimoError(TOOL_NOT_FOUND)` if the tool doesn't exist
192
+ */
193
+ getRequiredCredentials(toolName: string): string[];
194
+ /**
195
+ * List all available skills (Level 1 discovery - minimal context)
196
+ * @returns Array of skill summaries
197
+ */
198
+ listSkills(): SkillSummary[];
199
+ /**
200
+ * Get a single skill by name (Level 2 activation - full content)
201
+ * @param name - Skill name
202
+ * @returns Skill definition or null
203
+ */
204
+ getSkill(name: string): SkillDefinition | null;
205
+ /**
206
+ * Get selective skill content — only the sections an agent needs.
207
+ * Prevents dumping entire SKILL.md files into the LLM context window.
208
+ *
209
+ * @example
210
+ * // Get only error handling, max 500 tokens
211
+ * matimo.getSkillContent('postgres-query-operations', {
212
+ * sections: ['Error Handling'],
213
+ * maxTokens: 500,
214
+ * })
215
+ */
216
+ getSkillContent(name: string, options?: SkillContentOptions): string | null;
217
+ /**
218
+ * List all sections of a skill with their token costs.
219
+ * Agents use this to decide which sections to load before activating.
220
+ */
221
+ getSkillSections(name: string): Array<{
222
+ path: string;
223
+ level: number;
224
+ tokenEstimate: number;
225
+ }> | null;
226
+ /**
227
+ * Search skills by keyword, category, difficulty, etc.
228
+ * Set `options.semantic = true` for embedding-based similarity ranking.
229
+ * @param options - Search options
230
+ * @returns Matching skills
231
+ */
232
+ searchSkills(options?: SearchSkillsOptions): SkillSummary[];
233
+ /**
234
+ * Semantic search with relevance scores.
235
+ * Uses embeddings to find skills by meaning, not just keywords.
236
+ *
237
+ * @example
238
+ * const results = await matimo.semanticSearchSkills('How do I handle Postgres locking?');
239
+ * // → [{ skill: { name: 'postgres-query-operations' }, score: 0.82 }]
240
+ */
241
+ semanticSearchSkills(query: string, options?: {
242
+ limit?: number;
243
+ minScore?: number;
244
+ }): Promise<SemanticSearchResult[]>;
245
+ /**
246
+ * Set a custom embedding provider for semantic skill search.
247
+ * If not set, a built-in TF-IDF provider is used.
248
+ */
249
+ setSkillEmbeddingProvider(provider: EmbeddingProvider): void;
250
+ /**
251
+ * Get a bundled resource from a skill (Level 3 resources)
252
+ * @param skillName - Skill name
253
+ * @param resourcePath - Relative path to resource (e.g., "scripts/extract.py")
254
+ * @returns Resource content
255
+ */
256
+ getSkillResource(skillName: string, resourcePath: string): string;
257
+ /**
258
+ * Get all skill paths
259
+ * @returns Array of skill paths
260
+ */
261
+ getSkillPaths(): string[];
96
262
  /**
97
263
  * Automatically inject parameters from environment variables
98
264
  * Uses a YAML-native, scale-friendly approach:
99
265
  *
100
266
  * 1. Scans the execution config for all parameter placeholders
101
267
  * 2. For each parameter not provided by user, checks if it looks like auth (TOKEN, KEY, SECRET, etc.)
102
- * 3. If yes, attempts to load from environment: MATIMO_<PARAM_NAME> or <PARAM_NAME>
268
+ * 3. If yes, attempts to load from (in order of priority):
269
+ * a. `credentials[paramName]` — per-call override (multi-tenant)
270
+ * b. `credentials[MATIMO_${paramName}]` — prefixed per-call override
271
+ * c. `process.env[MATIMO_${paramName}]` — prefixed env var
272
+ * d. `process.env[paramName]` — direct env var
103
273
  *
104
- * This works for ANY tool with ANY auth parameter name - no hardcoding needed.
105
- * Scales to unlimited tools - contributors just submit YAML.
106
- *
107
- * Examples:
108
- * - GMAIL_ACCESS_TOKEN → looks in env vars
109
- * - GITHUB_TOKEN → looks in env vars
110
- * - SLACK_BOT_TOKEN → looks in env vars
111
- * - MY_CUSTOM_API_KEY → looks in env vars
112
- * - ANY_SECRET → looks in env vars
274
+ * Credential values are never logged.
113
275
  */
114
276
  private injectAuthParameters;
277
+ /**
278
+ * After injectAuthParameters(), verify no auth-looking placeholders remain unfilled.
279
+ * Only checks HTTP headers (where auth credentials are injected) — not query params or body.
280
+ * Throws AUTH_FAILED with actionable guidance naming the missing env var(s).
281
+ */
282
+ private assertAuthParamsFilled;
115
283
  /**
116
284
  * Extract all parameter placeholders from execution config
117
285
  * Scans headers, body, URL, and query_params for {paramName} patterns
@@ -125,6 +293,50 @@ export declare class MatimoInstance {
125
293
  * Get the appropriate executor for a tool
126
294
  */
127
295
  private getExecutor;
296
+ /**
297
+ * Hot-reload tools from all configured paths.
298
+ * Re-validates untrusted tools via content validator and integrity tracker.
299
+ * Tools that fail validation are rejected and not loaded.
300
+ *
301
+ * Atomic: if loading fails mid-way (e.g. I/O error), the registry is restored
302
+ * to its previous state and `rolledBack: true` is included in the result.
303
+ */
304
+ reloadTools(): Promise<ReloadResult>;
305
+ /**
306
+ * Check if a policy engine is active.
307
+ */
308
+ hasPolicy(): boolean;
309
+ /**
310
+ * Get the approval manifest (if policy engine is active).
311
+ */
312
+ getApprovalManifest(): ApprovalManifest | null;
313
+ /**
314
+ * Get the integrity tracker.
315
+ */
316
+ getIntegrityTracker(): ToolIntegrityTracker;
317
+ /**
318
+ * Get the tool registry (for advanced use cases).
319
+ */
320
+ getRegistry(): ToolRegistry;
321
+ /**
322
+ * Set a Human-in-the-Loop callback for quarantined tools.
323
+ * The callback is invoked when a tool with `pending_approval` status is executed.
324
+ * Return `true` to approve, `false` to reject.
325
+ */
326
+ setHITLCallback(callback: HITLCallback | null): void;
327
+ /**
328
+ * Hot-reload the policy engine at runtime.
329
+ *
330
+ * - If `configOrFile` is a `PolicyConfig` object, creates a new `DefaultPolicyEngine`.
331
+ * - If `configOrFile` is a string, re-reads and parses the YAML file.
332
+ * - If omitted and the instance was initialized with `policyFile`, re-reads that file.
333
+ *
334
+ * The new policy is validated before swap — if validation fails, the old policy remains active.
335
+ * After swap, all tools are re-validated against the new policy via `reloadTools()`.
336
+ *
337
+ * @returns The ReloadResult from the subsequent tool re-validation.
338
+ */
339
+ reloadPolicy(configOrFile?: PolicyConfig | string): Promise<ReloadResult>;
128
340
  }
129
341
  /**
130
342
  * Matimo namespace - Entry point for the SDK
@@ -1 +1 @@
1
- {"version":3,"file":"matimo-instance.d.ts","sourceRoot":"","sources":["../src/matimo-instance.ts"],"names":[],"mappings":"AAMA,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C,OAAO,EACL,YAAY,EACZ,YAAY,EAIb,MAAM,WAAW,CAAC;AAGnB;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,eAAe,CAAkB;IAEzC,OAAO;IAaP;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;WACU,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAqE1E;;;OAGG;IACH,YAAY,IAAI,MAAM,EAAE;IAIxB;;;OAGG;IACH,SAAS,IAAI,YAAY;IAIzB;;;;;OAKG;IACG,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC;IAiFlF;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIrD;;;OAGG;IACH,SAAS,IAAI,cAAc,EAAE;IAI7B;;;OAGG;IACH,WAAW,IAAI,cAAc,EAAE;IAI/B;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,EAAE;IAI5C;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,EAAE;IAI5C;;;;;;;;;;;;;;;;;OAiBG;IACH,OAAO,CAAC,oBAAoB;IAmD5B;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAkDpC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,WAAW;CAiBpB;AAED;;GAEG;AACH,eAAO,MAAM,MAAM;IACjB;;;;OAIG;oBACmB,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAGvD,CAAC"}
1
+ {"version":3,"file":"matimo-instance.d.ts","sourceRoot":"","sources":["../src/matimo-instance.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAGpD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAIlE,OAAO,EACL,cAAc,EACd,eAAe,EACf,YAAY,EACZ,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EAClB,MAAM,cAAc,CAAC;AAEtB,OAAO,EACL,YAAY,EACZ,YAAY,EAIb,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AACnD,OAAO,KAAK,EAAE,YAAY,EAAE,aAAa,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAG9F,OAAO,EAAE,oBAAoB,EAAE,MAAM,4BAA4B,CAAC;AAClE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAe,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAqBvE;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,2FAA2F;IAC3F,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,WAAY,SAAQ,YAAY;IAC/C,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,+FAA+F;IAC/F,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB,kFAAkF;IAClF,YAAY,CAAC,EAAE,YAAY,CAAC;IAC5B,sGAAsG;IACtG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,wGAAwG;IACxG,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,gGAAgG;IAChG,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,+EAA+E;IAC/E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,uEAAuE;IACvE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB;;;OAGG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,gFAAgF;IAChF,OAAO,CAAC,EAAE,kBAAkB,CAAC;IAC7B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,YAAY,CAAC;IACtB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,cAAc;;IAEzB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,qBAAqB,CAA0B;IAEvE,OAAO,CAAC,SAAS,CAAW;IAC5B,OAAO,CAAC,UAAU,CAAW;IAC7B,OAAO,CAAC,MAAM,CAAa;IAC3B,OAAO,CAAC,QAAQ,CAAe;IAC/B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,aAAa,CAAgB;IACrC,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,YAAY,CAAe;IACnC,OAAO,CAAC,gBAAgB,CAAmB;IAC3C,OAAO,CAAC,MAAM,CAAe;IAC7B,OAAO,CAAC,eAAe,CAAkB;IAazC,OAAO;IA4DP;;;;;;;;;;;;;;;;;;;;;;;;OAwBG;WACU,IAAI,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAmI1E;;;OAGG;IACH,YAAY,IAAI,MAAM,EAAE;IAIxB;;;OAGG;IACH,SAAS,IAAI,YAAY;IAIzB;;;;;;;;;;;;OAYG;IACG,OAAO,CACX,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC/B,OAAO,CAAC,EAAE,cAAc,GACvB,OAAO,CAAC,OAAO,CAAC;IAwKnB;;;;OAIG;IACH,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIrD;;;;OAIG;IACH,SAAS,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAQpD;;;OAGG;IACH,WAAW,CAAC,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAItD;;;;;;OAMG;IACH,gBAAgB,CAAC,OAAO,EAAE,aAAa,GAAG,cAAc,EAAE;IAQ1D;;;;OAIG;IACH,WAAW,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAQrE;;;;OAIG;IACH,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,aAAa,GAAG,cAAc,EAAE;IAQrE;;;;;;;;;;;;;;;;;;;;;OAqBG;IACH,sBAAsB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE;IA8ClD;;;OAGG;IACH,UAAU,IAAI,YAAY,EAAE;IAI5B;;;;OAIG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI;IAI9C;;;;;;;;;;OAUG;IACH,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI;IAI3E;;;OAGG;IACH,gBAAgB,CACd,IAAI,EAAE,MAAM,GACX,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC,GAAG,IAAI;IAIvE;;;;;OAKG;IACH,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,YAAY,EAAE;IAI/D;;;;;;;OAOG;IACG,oBAAoB,CACxB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,GAC9C,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAIlC;;;OAGG;IACH,yBAAyB,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI;IAI5D;;;;;OAKG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,MAAM;IAIjE;;;OAGG;IACH,aAAa,IAAI,MAAM,EAAE;IAIzB;;;;;;;;;;;;;OAaG;IACH,OAAO,CAAC,oBAAoB;IAyD5B;;;;OAIG;IACH,OAAO,CAAC,sBAAsB;IA4D9B;;;OAGG;IACH,OAAO,CAAC,4BAA4B;IAkDpC;;OAEG;IACH,OAAO,CAAC,mBAAmB;IA0C3B;;OAEG;IACH,OAAO,CAAC,WAAW;IA+BnB;;;;;;;OAOG;IACG,WAAW,IAAI,OAAO,CAAC,YAAY,CAAC;IA8G1C;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,mBAAmB,IAAI,gBAAgB,GAAG,IAAI;IAI9C;;OAEG;IACH,mBAAmB,IAAI,oBAAoB;IAI3C;;OAEG;IACH,WAAW,IAAI,YAAY;IAI3B;;;;OAIG;IACH,eAAe,CAAC,QAAQ,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI;IAIpD;;;;;;;;;;;OAWG;IACG,YAAY,CAAC,YAAY,CAAC,EAAE,YAAY,GAAG,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;CA+HhF;AAED;;GAEG;AACH,eAAO,MAAM,MAAM;IACjB;;;;OAIG;oBACmB,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAGvD,CAAC"}