"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.KmsKeyArnSchema = exports.KMS_KEY_ARN_PATTERN = exports.EvaluatorConfigSchema = exports.CodeBasedConfigSchema = exports.ExternalCodeBasedConfigSchema = exports.ManagedCodeBasedConfigSchema = exports.LlmAsAJudgeConfigSchema = exports.BedrockModelIdSchema = exports.RatingScaleSchema = exports.CategoricalRatingSchema = exports.NumericalRatingSchema = exports.EvaluatorNameSchema = exports.EvaluationLevelSchema = void 0;
exports.isValidBedrockModelId = isValidBedrockModelId;
exports.isValidKmsKeyArn = isValidKmsKeyArn;
const zod_1 = require("zod");
// ============================================================================
// Evaluator Types
// ============================================================================
exports.EvaluationLevelSchema = zod_1.z.enum(['SESSION', 'TRACE', 'TOOL_CALL']);
exports.EvaluatorNameSchema = zod_1.z
    .string()
    .min(1, 'Name is required')
    .max(48)
    .regex(/^[a-zA-Z][a-zA-Z0-9_]{0,47}$/, 'Must begin with a letter and contain only alphanumeric characters and underscores (max 48 chars)');
// ============================================================================
// Rating Scale
// ============================================================================
exports.NumericalRatingSchema = zod_1.z.object({
    value: zod_1.z.number().int(),
    label: zod_1.z.string().min(1),
    definition: zod_1.z.string().min(1),
});
exports.CategoricalRatingSchema = zod_1.z.object({
    label: zod_1.z.string().min(1),
    definition: zod_1.z.string().min(1),
});
exports.RatingScaleSchema = zod_1.z
    .object({
    numerical: zod_1.z.array(exports.NumericalRatingSchema).optional(),
    categorical: zod_1.z.array(exports.CategoricalRatingSchema).optional(),
})
    .refine(scale => {
    const hasNumerical = Boolean(scale.numerical);
    const hasCategorical = Boolean(scale.categorical);
    return hasNumerical !== hasCategorical;
}, { message: 'Rating scale must have either numerical or categorical, not both' });
// ============================================================================
// LLM-as-a-Judge Config
// ============================================================================
// eslint-disable-next-line security/detect-unsafe-regex -- anchored pattern, no backtracking risk
const BEDROCK_MODEL_ID_PATTERN = /^[a-z][a-z0-9-]*\.[a-zA-Z0-9._-]+(:[0-9]+)?$/;
const BEDROCK_ARN_PATTERN = /^arn:aws[a-z-]*:bedrock:[a-z0-9-]+:\d{12}:(inference-profile|foundation-model)\/.+$/;
function isValidBedrockModelId(value) {
    return BEDROCK_MODEL_ID_PATTERN.test(value) || BEDROCK_ARN_PATTERN.test(value);
}
exports.BedrockModelIdSchema = zod_1.z.string().min(1, 'Model ID is required');
exports.LlmAsAJudgeConfigSchema = zod_1.z.object({
    model: exports.BedrockModelIdSchema,
    instructions: zod_1.z.string().min(1, 'Evaluation instructions are required'),
    ratingScale: exports.RatingScaleSchema,
});
// ============================================================================
// Code-Based Evaluator Config
// ============================================================================
exports.ManagedCodeBasedConfigSchema = zod_1.z.object({
    codeLocation: zod_1.z.string().min(1),
    entrypoint: zod_1.z.string().min(1).default('lambda_function.handler'),
    timeoutSeconds: zod_1.z.number().int().min(1).max(300).default(60),
    additionalPolicies: zod_1.z.array(zod_1.z.string().min(1)).optional(),
});
const LAMBDA_ARN_PATTERN = /^arn:aws[a-z-]*:lambda:[a-z0-9-]+:\d{12}:function:.+$/;
exports.ExternalCodeBasedConfigSchema = zod_1.z.object({
    lambdaArn: zod_1.z.string().min(1).regex(LAMBDA_ARN_PATTERN, 'Must be a valid Lambda function ARN'),
});
exports.CodeBasedConfigSchema = zod_1.z
    .object({
    managed: exports.ManagedCodeBasedConfigSchema.optional(),
    external: exports.ExternalCodeBasedConfigSchema.optional(),
})
    .refine(config => Boolean(config.managed) !== Boolean(config.external), {
    message: 'Code-based config must have either managed or external, not both',
});
// ============================================================================
// Evaluator Config
// ============================================================================
exports.EvaluatorConfigSchema = zod_1.z
    .object({
    llmAsAJudge: exports.LlmAsAJudgeConfigSchema.optional(),
    codeBased: exports.CodeBasedConfigSchema.optional(),
})
    .refine(config => Boolean(config.llmAsAJudge) !== Boolean(config.codeBased), {
    message: 'Config must have either llmAsAJudge or codeBased, not both',
});
// ============================================================================
// KMS Key ARN Validation
// ============================================================================
/**
 * Pattern for KMS key ARNs accepted by the AgentCore Evaluation service.
 * Matches key ARNs across all AWS partitions with a 36-char UUID key ID.
 * Alias ARNs are not supported by the service for evaluator encryption.
 */
exports.KMS_KEY_ARN_PATTERN = /^arn:[^:]+:kms:[a-zA-Z0-9-]*:[0-9]{12}:key\/[a-zA-Z0-9-]{36}$/;
exports.KmsKeyArnSchema = zod_1.z
    .string()
    .regex(exports.KMS_KEY_ARN_PATTERN, 'Must be a valid KMS key ARN (e.g. arn:aws:kms:us-east-1:123456789012:key/12345678-1234-1234-1234-123456789012)');
function isValidKmsKeyArn(value) {
    return exports.KMS_KEY_ARN_PATTERN.test(value);
}
//# sourceMappingURL=evaluator.js.map