@agentronics/sdk 0.1.0

package/dist/init-only-DrZymcuA.d.ts

@@ -0,0 +1,508 @@
+import { AgentIdentity, IdentityClaim, TraceEvent, TraceEventType, VerificationResult, AgentClass, PolicyRule, PolicyEvaluation, MemoryScope, MemoryEntry, SiteMemory, SiteMemoryPageContext } from '@agentronics/protocol';
+import { D as DetectWebMcpOptions } from './webmcp-C4ikhM4g.js';
+
+interface SignalResult {
+    hit: boolean;
+    weight: number;
+    detail?: string;
+}
+declare const SIGNALS: {
+    readonly webdriver: () => SignalResult;
+    readonly chromedriver: () => SignalResult;
+    readonly headlessUa: () => SignalResult;
+    readonly languages: () => SignalResult;
+    readonly permissions: () => SignalResult;
+    readonly plugins: () => SignalResult;
+};
+type DomSignalName = keyof typeof SIGNALS;
+interface DetectDomOptions {
+    /** Floor below which we report no DOM agent. Defaults to 0.4. */
+    threshold?: number;
+}
+declare const detectDom: (options?: DetectDomOptions) => AgentIdentity | null;
+
+type DetectorStatus = 'stable' | 'beta' | 'research';
+interface Detector {
+    id: string;
+    status: DetectorStatus;
+    detect(): AgentIdentity | null | Promise<AgentIdentity | null>;
+}
+declare const bundledDetectors: () => Detector[];
+declare const createDetectorRegistry: (initial?: Detector[]) => {
+    register(detector: Detector): void;
+    list(status?: DetectorStatus): Detector[];
+    detectAll(includeResearch?: boolean): Promise<AgentIdentity | null>;
+};
+type DetectorRegistry = ReturnType<typeof createDetectorRegistry>;
+
+interface DetectAgentOptions {
+    webmcp?: DetectWebMcpOptions | false;
+    dom?: DetectDomOptions | false;
+    customDetectors?: Detector[];
+    experimental?: boolean;
+}
+/**
+ * Run the full detection pipeline. WebMCP wins if present (exact match), then DOM heuristics.
+ * Returns `null` if no agent class fires above its threshold — caller should treat as "human or
+ * undetectable agent."
+ */
+declare const detectAgent: (options?: DetectAgentOptions) => Promise<AgentIdentity | null>;
+
+interface PresentIdentityOptions extends IdentityClaim {
+    /**
+     * If false, accept the claim as `declared` (no remote verification).
+     * If true, the claim is staged for the gateway to verify; trust is `declared` until then.
+     */
+    verifyRemotely?: boolean;
+}
+interface PresentedIdentity {
+    identity: AgentIdentity;
+    claim: IdentityClaim;
+}
+declare const createIdentityStore: () => {
+    present(input: PresentIdentityOptions): PresentedIdentity;
+    clear(): void;
+    /** Return the presented identity if it outranks the supplied detection. */
+    preferOver(detected: AgentIdentity | null): AgentIdentity | null;
+    snapshot(): PresentedIdentity | null;
+};
+type IdentityStore = ReturnType<typeof createIdentityStore>;
+
+interface SamplerOptions {
+    traceRate?: number;
+    errorRate?: number;
+    random?: () => number;
+}
+
+interface TraceExporter {
+    name: string;
+    export(events: TraceEvent[]): Promise<void> | void;
+}
+interface TraceInput {
+    type: TraceEventType;
+    outcome?: TraceEvent['outcome'];
+    tool?: string;
+    agent?: TraceEvent['agent'];
+    policy?: TraceEvent['policy'];
+    durationMs?: number;
+    error?: string;
+    metadata?: Record<string, unknown>;
+}
+interface TracerOptions extends SamplerOptions {
+    siteId: string;
+    bufferSize?: number;
+    sessionId?: string;
+    scrubPaths?: string[];
+    exporters?: TraceExporter[];
+    onExporterError?: (error: unknown, exporter: TraceExporter, event: TraceEvent) => void;
+}
+interface Tracer {
+    readonly sessionId: string;
+    emit(input: TraceInput): Promise<TraceEvent | null>;
+    list(): TraceEvent[];
+    clear(): void;
+}
+declare const createTracer: ({ siteId, bufferSize, sessionId, scrubPaths, exporters, onExporterError, ...samplerOptions }: TracerOptions) => Tracer;
+
+type AuthMethodName = 'detection' | 'selfDeclaration' | 'bearer' | 'xAgentHeader' | 'extensionToken' | 'sessionLink' | 'oauth2';
+interface AuthInput {
+    detected?: AgentIdentity | null;
+    declaration?: IdentityClaim;
+    bearerToken?: string;
+    xAgentHeader?: string;
+    extensionToken?: string;
+    sessionLinkToken?: string;
+    linkedUserId?: string;
+    oauth2AccessToken?: string;
+    oauth2Subject?: string;
+    vendorHint?: string;
+    classHint?: AgentClass;
+}
+interface AuthContext {
+    verifyToken?: (method: Exclude<AuthMethodName, 'detection' | 'selfDeclaration' | 'xAgentHeader'>, token: string) => Promise<VerificationResult | null>;
+}
+interface AuthMethod {
+    name: AuthMethodName;
+    authenticate(input: AuthInput, context: AuthContext): Promise<AgentIdentity | null>;
+}
+interface AuthEngineOptions {
+    methods?: AuthMethod[];
+    context?: AuthContext;
+    onTrace?: (input: TraceInput) => void;
+}
+declare const createAuthEngine: ({ methods, context, onTrace, }?: AuthEngineOptions) => {
+    authenticate(input: AuthInput): Promise<AgentIdentity | null>;
+    methods(): AuthMethodName[];
+};
+type AuthEngine = ReturnType<typeof createAuthEngine>;
+
+interface AgentContextSnapshot {
+    identity: AgentIdentity | null;
+    source: 'detect' | 'declare' | 'authenticate' | 'cleared' | 'initial';
+    updatedAt: string | null;
+}
+type AgentContextListener = (snapshot: AgentContextSnapshot) => void;
+declare const createAgentContextStore: () => {
+    snapshot(): AgentContextSnapshot;
+    set(identity: AgentIdentity | null, source: AgentContextSnapshot["source"]): void;
+    subscribe(listener: AgentContextListener): () => void;
+};
+type AgentContextStore = ReturnType<typeof createAgentContextStore>;
+
+interface RateLimitRule {
+    max: number;
+    windowSeconds: number;
+}
+interface RateLimitResult {
+    allowed: boolean;
+    remaining: number;
+    resetAt: number;
+}
+interface RateLimiterStorage {
+    read(key: string): string | null;
+    write(key: string, value: string): void;
+}
+declare const createRateLimiter: (storage?: RateLimiterStorage) => {
+    consume(key: string, rule: RateLimitRule, now?: number): RateLimitResult;
+};
+type RateLimiter = ReturnType<typeof createRateLimiter>;
+
+interface EvaluateInput {
+    tool: string;
+    identity: AgentIdentity | null;
+}
+interface PolicyEngineOptions {
+    rateLimiter?: RateLimiter;
+}
+declare const createPolicyEngine: (initial?: PolicyRule[], options?: PolicyEngineOptions) => {
+    set(next: PolicyRule[]): void;
+    list(): PolicyRule[];
+    evaluate({ tool, identity }: EvaluateInput): PolicyEvaluation;
+};
+type PolicyEngine = ReturnType<typeof createPolicyEngine>;
+
+interface PolicyCacheOptions {
+    gatewayUrl: string;
+    siteId: string;
+    publishableKey: string;
+    fetcher?: typeof fetch;
+}
+interface PolicyCacheSnapshot {
+    policies: PolicyRule[];
+    etag: string | null;
+}
+declare const createPolicyCache: ({ gatewayUrl, siteId, publishableKey, fetcher, }: PolicyCacheOptions) => {
+    snapshot(): PolicyCacheSnapshot;
+    sync(): Promise<PolicyCacheSnapshot>;
+};
+type PolicyCache = ReturnType<typeof createPolicyCache>;
+
+interface MemoryGetOptions {
+    scope?: MemoryScope;
+}
+interface MemorySetOptions {
+    scope?: MemoryScope;
+    ttlSeconds?: number;
+}
+interface MemoryStoreOptions {
+    onTrace?: (input: TraceInput) => void;
+}
+declare const createMemoryStore: (options?: MemoryStoreOptions) => {
+    get: (key: string, options?: MemoryGetOptions) => unknown;
+    set: (key: string, value: unknown, options?: MemorySetOptions) => MemoryEntry;
+    remove: (key: string, options?: MemoryGetOptions) => void;
+    list: (options?: MemoryGetOptions) => MemoryEntry[];
+    clear: (options?: MemoryGetOptions) => void;
+};
+type MemoryStore = ReturnType<typeof createMemoryStore>;
+
+interface SiteMemoryStoreOptions {
+    initial?: Partial<SiteMemory>;
+    onTrace?: (input: TraceInput) => void;
+}
+interface ProvideForPageInput {
+    path: string;
+    payload: Record<string, unknown>;
+}
+type SiteMemoryListener = (snapshot: SiteMemory) => void;
+declare const createSiteMemoryStore: (options?: SiteMemoryStoreOptions) => {
+    provide: (next: Partial<SiteMemory>) => SiteMemory;
+    update: (path: string, value: unknown) => SiteMemory;
+    provideForPage: (input: ProvideForPageInput) => SiteMemoryPageContext;
+    snapshot: () => SiteMemory;
+    get: (path?: string) => unknown;
+    getForPage: (path: string) => SiteMemoryPageContext | null;
+    replace: (next: SiteMemory) => SiteMemory;
+    subscribe: (listener: SiteMemoryListener) => (() => void);
+};
+type SiteMemoryStore = ReturnType<typeof createSiteMemoryStore>;
+
+interface MemoryCacheOptions {
+    gatewayUrl: string;
+    siteId: string;
+    publishableKey: string;
+    fetcher?: typeof fetch;
+}
+interface MemoryCacheSnapshot {
+    memory: SiteMemory | null;
+    etag: string | null;
+}
+declare const createMemoryCache: ({ gatewayUrl, siteId, publishableKey, fetcher, }: MemoryCacheOptions) => {
+    snapshot(): MemoryCacheSnapshot;
+    sync(): Promise<MemoryCacheSnapshot>;
+};
+type MemoryCache = ReturnType<typeof createMemoryCache>;
+
+interface GovernedTool<Input = unknown, Output = unknown> {
+    name: string;
+    version?: string;
+    group?: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+    stage?: string;
+    authz?: Omit<PolicyRule, 'id' | 'tool'>;
+    rateLimit?: PolicyRule['rateLimit'];
+    execute: (input: Input, context: {
+        identity: AgentIdentity | null;
+    }) => Promise<Output> | Output;
+}
+interface ToolRegistryOptions {
+    evaluate: (tool: string, options?: {
+        identity?: AgentIdentity | null;
+    }) => Promise<PolicyEvaluation>;
+    setPolicies?: (rules: PolicyRule[]) => void;
+    listPolicies?: () => PolicyRule[];
+    onTrace?: (input: TraceInput) => void;
+}
+interface ToolRegistry {
+    register(tool: GovernedTool): () => void;
+    unregister(name: string): void;
+    enable(name: string): void;
+    disable(name: string): void;
+    isEnabled(name: string): boolean;
+    list(options?: {
+        includeDisabled?: boolean;
+    }): GovernedTool[];
+    get(name: string): GovernedTool | undefined;
+    execute<Input, Output>(name: string, input: Input, identity?: AgentIdentity | null): Promise<Output>;
+}
+declare const createToolRegistry: ({ evaluate, setPolicies, listPolicies, onTrace, }: ToolRegistryOptions) => ToolRegistry;
+
+interface ProgressionTransition {
+    on: string;
+    to: string;
+}
+interface ProgressionStage {
+    name: string;
+    enables?: string[];
+    transitions?: ProgressionTransition[];
+}
+interface ProgressionConfig {
+    initial: string;
+    stages: ProgressionStage[];
+}
+interface ProgressionStore {
+    current(): string;
+    enabledStages(): string[];
+    notify(toolName: string): {
+        changed: boolean;
+        from: string;
+        to: string;
+    };
+    set(stage: string): {
+        changed: boolean;
+        from: string;
+        to: string;
+    };
+    reset(): void;
+    snapshot(): {
+        current: string;
+        enabled: string[];
+    };
+}
+declare const createProgressionStore: (config: ProgressionConfig, options?: {
+    onTrace?: (input: TraceInput) => void;
+}) => ProgressionStore;
+
+interface SurfacingContext {
+    identity: AgentIdentity | null;
+    stage?: string | null;
+    enabledStages?: string[];
+}
+interface SurfacingDecision {
+    tool: GovernedTool;
+    visible: boolean;
+    reason: string;
+}
+declare const decideSurfacing: (tool: GovernedTool, context: SurfacingContext) => SurfacingDecision;
+declare const surfaceTools: (tools: GovernedTool[], context: SurfacingContext) => GovernedTool[];
+declare const explainSurfacing: (tools: GovernedTool[], context: SurfacingContext) => SurfacingDecision[];
+
+declare const DEFAULT_GROUP = "default";
+interface ToolGroupSummary {
+    name: string;
+    tools: GovernedTool[];
+}
+declare const groupTools: (tools: GovernedTool[]) => ToolGroupSummary[];
+declare const listGroupNames: (tools: GovernedTool[]) => string[];
+
+interface ToolTokenEstimate {
+    name: string;
+    characters: number;
+    tokens: number;
+}
+interface TokenBudgetReport {
+    total: number;
+    perTool: ToolTokenEstimate[];
+}
+declare const estimateToolTokens: (tool: GovernedTool) => ToolTokenEstimate;
+declare const estimateBudget: (tools: GovernedTool[]) => TokenBudgetReport;
+
+interface WebMcpToolDescriptor {
+    name: string;
+    description?: string;
+    inputSchema?: Record<string, unknown>;
+    invoke(input?: unknown): Promise<unknown>;
+}
+interface WebMcpProvider {
+    provideContext(payload: {
+        tools: WebMcpToolDescriptor[];
+    }): {
+        revoke: () => void;
+    };
+}
+interface WebMcpAdapterOptions {
+    provider?: WebMcpProvider;
+    doc?: {
+        defaultView?: WindowLike | null;
+    } | null;
+    invoke?: (tool: GovernedTool, input: unknown) => Promise<unknown>;
+}
+interface WindowLike {
+    navigator?: {
+        modelContext?: WebMcpProvider;
+    };
+}
+interface WebMcpAdapter {
+    publish(tools: GovernedTool[]): {
+        revoked: boolean;
+    };
+    revoke(): void;
+    available(): boolean;
+}
+declare const createWebMcpAdapter: (options?: WebMcpAdapterOptions) => WebMcpAdapter;
+
+interface InitOptions {
+    publishableKey: string;
+    siteId?: string;
+    /**
+     * Override the gateway URL the SDK calls. **Reserved for local development
+     * only** — the only accepted values are `localhost` / `127.0.0.1` URLs (so
+     * `pnpm dev` against a local gateway works). Any other value throws at
+     * `init()` time.
+     *
+     * Production deployments must omit this option. The SDK is hard-coded to
+     * call `https://gateway.agentronics.dev`. Custom backends are not
+     * supported, by design — see the project README + LICENSE NOTICE.
+     *
+     * @internal — kept on the public type only so dev tooling type-checks.
+     */
+    gatewayUrl?: string;
+    debug?: boolean;
+    policies?: PolicyRule[];
+    siteMemory?: Partial<SiteMemory>;
+    auth?: AuthContext;
+    progression?: ProgressionConfig;
+    tools?: GovernedTool[];
+    trace?: {
+        enabled?: boolean;
+        bufferSize?: number;
+        traceRate?: number;
+        errorRate?: number;
+        scrubPaths?: string[];
+        exporters?: TraceExporter[];
+        gateway?: boolean;
+        webhookUrl?: string;
+    };
+}
+interface AgentronicsClient {
+    readonly publishableKey: string;
+    readonly siteId: string;
+    readonly gatewayUrl: string;
+    readonly debug: boolean;
+    readonly memory: MemoryStore;
+    readonly siteMemory: SiteMemoryStore;
+    readonly memoryCache: MemoryCache;
+    readonly tracer: Tracer;
+    readonly auth: AuthEngine;
+    readonly agentContext: AgentContextStore;
+    readonly authz: PolicyEngine;
+    readonly policyCache: PolicyCache;
+    readonly tools: ToolRegistry;
+    readonly progression: ProgressionStore | null;
+    readonly webmcp: WebMcpAdapter;
+    detect(options?: DetectAgentOptions): Promise<AgentIdentity | null>;
+    authenticate(input: AuthInput): Promise<AgentIdentity | null>;
+    presentIdentity(input: PresentIdentityOptions): PresentedIdentity;
+    clearIdentity(): void;
+    presentedIdentity(): PresentedIdentity | null;
+    setPolicies(rules: PolicyRule[]): void;
+    listPolicies(): PolicyRule[];
+    evaluate(tool: string, options?: {
+        identity?: AgentIdentity | null;
+    }): Promise<PolicyEvaluation>;
+    syncPolicies(): Promise<PolicyRule[]>;
+    syncSiteMemory(): Promise<SiteMemory | null>;
+    provideSiteMemory(memory: Partial<SiteMemory>): SiteMemory;
+    provideForPage(input: ProvideForPageInput): void;
+    installMemoryDelivery(options?: {
+        metaTags?: boolean;
+        overlay?: boolean;
+    }): {
+        uninstall: () => void;
+    };
+    fetchWellKnown(origin?: string): Promise<SiteMemory | null>;
+    installDomEnforcer(): {
+        uninstall: () => void;
+    };
+    registerTool(tool: GovernedTool): () => void;
+    surfaceTools(options?: {
+        identity?: AgentIdentity | null;
+    }): GovernedTool[];
+    explainSurfacing(options?: {
+        identity?: AgentIdentity | null;
+    }): SurfacingDecision[];
+    groupedTools(options?: {
+        identity?: AgentIdentity | null;
+    }): ToolGroupSummary[];
+    estimateTokens(options?: {
+        identity?: AgentIdentity | null;
+    }): TokenBudgetReport;
+    publishToWebMcp(options?: {
+        identity?: AgentIdentity | null;
+    }): {
+        revoked: boolean;
+        surfaced: number;
+    };
+    notifyToolInvoked(toolName: string): void;
+    traces(): TraceEvent[];
+    clearTraces(): void;
+    /**
+     * Sanity-check the publishable key + gateway URL. Hits `GET /v1/health` and
+     * resolves to `{ ok: true, ... }` on 2xx, `{ ok: false, status, error }`
+     * otherwise. Doesn't throw — designed for "did my key wire up correctly?"
+     * UX without forcing the host page into a try/catch.
+     */
+    ping(): Promise<{
+        ok: true;
+        status: number;
+        body: unknown;
+    } | {
+        ok: false;
+        status: number;
+        error: string;
+    }>;
+}
+declare const init: (options: InitOptions) => AgentronicsClient;
+
+export { createProgressionStore as $, type AgentronicsClient as A, type ToolGroupSummary as B, type ToolRegistry as C, type DetectAgentOptions as D, type ToolTokenEstimate as E, type TraceInput as F, type GovernedTool as G, type Tracer as H, type InitOptions as I, type WebMcpAdapterOptions as J, type WebMcpProvider as K, type WebMcpToolDescriptor as L, type MemoryCache as M, bundledDetectors as N, createAgentContextStore as O, type PolicyEngine as P, createAuthEngine as Q, type RateLimiter as R, type SiteMemoryListener as S, type TraceExporter as T, createDetectorRegistry as U, createIdentityStore as V, type WebMcpAdapter as W, createMemoryCache as X, createMemoryStore as Y, createPolicyCache as Z, createPolicyEngine as _, type AgentContextListener as a, createRateLimiter as a0, createSiteMemoryStore as a1, createToolRegistry as a2, createTracer as a3, createWebMcpAdapter as a4, decideSurfacing as a5, detectAgent as a6, detectDom as a7, estimateBudget as a8, estimateToolTokens as a9, explainSurfacing as aa, groupTools as ab, init as ac, listGroupNames as ad, surfaceTools as ae, type AgentContextSnapshot as b, type AgentContextStore as c, type AuthEngine as d, type AuthInput as e, type AuthMethod as f, DEFAULT_GROUP as g, type DetectDomOptions as h, type Detector as i, type DetectorRegistry as j, type DetectorStatus as k, type DomSignalName as l, type IdentityStore as m, type MemoryStore as n, type PolicyCache as o, type PresentIdentityOptions as p, type PresentedIdentity as q, type ProgressionConfig as r, type ProgressionStage as s, type ProgressionStore as t, type ProgressionTransition as u, type ProvideForPageInput as v, type SiteMemoryStore as w, type SurfacingContext as x, type SurfacingDecision as y, type TokenBudgetReport as z };

package/dist/init-only.cjs

@@ -0,0 +1,17 @@
+'use strict';var protocol=require('@agentronics/protocol');var rt=()=>{if(typeof navigator>"u")return null;let e=navigator.modelContext;return e&&typeof e=="object"?e:null},C=async(e={})=>{let{pollMs:t=500}=e,n=Date.now();for(;;){let r=rt();if(r)return ot(r);if(Date.now()-n>=t)return null;await new Promise(o=>setTimeout(o,50));}},ot=e=>({class:"webmcp",trust:"detected",confidence:1,vendor:e.vendor??e.client??null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{webmcp:true,toolCount:Array.isArray(e.tools)?e.tools.length:0}});var it=[/HeadlessChrome/i,/Headless/i,/PhantomJS/i,/SlimerJS/i],st=()=>({hit:(typeof navigator<"u"&&navigator.webdriver)===true,weight:.6,detail:"navigator.webdriver === true"}),at=()=>{if(typeof window>"u")return {hit:false,weight:.5};let e=Object.keys(window).filter(t=>t.startsWith("cdc_"));return {hit:e.length>0,weight:.5,detail:`window.${e[0]??"cdc_*"}`}},ct=()=>{if(typeof navigator>"u"||!navigator.plugins)return {hit:false,weight:.2};let e=/Win|Mac|Linux/.test(navigator.userAgent??""),t=navigator.plugins.length===0;return {hit:e&&t,weight:.2,detail:"desktop UA with no plugins"}},lt=()=>{if(typeof navigator>"u")return {hit:false,weight:.7};let e=navigator.userAgent??"",t=it.some(n=>n.test(e));return t?{hit:t,weight:.7,detail:`headless UA: ${e}`}:{hit:t,weight:.7}},ut=()=>{if(typeof navigator>"u")return {hit:false,weight:.15};let e=navigator.languages;return {hit:!e||e.length===0,weight:.15,detail:"navigator.languages empty"}},pt=()=>{if(typeof navigator>"u")return {hit:false,weight:.1};let e="chrome"in window,t=navigator.userAgent??"";return {hit:/Chrome\//.test(t)&&!/Edg\//.test(t)&&!e,weight:.2,detail:"Chrome UA without window.chrome"}},dt={webdriver:st,chromedriver:at,headlessUa:lt,languages:ut,permissions:pt,plugins:ct},O=(e={})=>{let{threshold:t=.4}=e,n={},r=0,o=0;for(let[a,s]of Object.entries(dt)){let l=s();r+=l.weight,n[a]={hit:l.hit,weight:l.weight,detail:l.detail},l.hit&&(o+=l.weight);}let i=r===0?0:o/r;return i<t?null:{class:"dom",trust:"detected",confidence:i,vendor:null,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:n}};var ae=()=>[{id:"webmcp.model-context",status:"stable",detect:()=>C({pollMs:0})},{id:"dom.automation-heuristics",status:"beta",detect:()=>O()}],U=(e=ae())=>{let t=new Map(e.map(n=>[n.id,n]));return {register(n){t.set(n.id,n);},list(n){let r=[...t.values()];return n?r.filter(o=>o.status===n):r},async detectAll(n=false){for(let r of t.values()){if(r.status==="research"&&!n)continue;let o=await r.detect();if(o)return o}return null}}};var ce=async(e={})=>{if(e.customDetectors?.length){let t=await U(e.customDetectors).detectAll(!!e.experimental);if(t)return t}if(e.webmcp!==false){let t=await C(e.webmcp??{});if(t)return t}if(e.dom!==false){let t=O(e.dom??{});if(t)return t}return null};var ft=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),le=()=>{let e=null;return {present(t){let n=protocol.IdentityClaim.safeParse(t);if(!n.success)throw new protocol.AgentronicsError("invalid_api_key",`Invalid identity claim: ${n.error.issues[0]?.message??"unknown"}`);let r={claim:n.data,identity:ft(n.data)};return e=r,r},clear(){e=null;},preferOver(t){return e?t?protocol.isHigherTrust(e.identity.trust,t.trust)?e.identity:t:e.identity:t},snapshot(){return e}}};var pe=e=>{let t=null;for(let n of e)(!t||protocol.TRUST_RANK[n.trust]>protocol.TRUST_RANK[t.trust])&&(t=n);return t};var de=()=>({name:"bearer",async authenticate(e,t){if(!e.bearerToken)return null;let n=await t.verifyToken?.("bearer",e.bearerToken);return {class:e.classHint??"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"bearer",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{bearer:true,verifiedRemotely:!!n}}}});var ye=()=>({name:"detection",async authenticate(e){return e.detected??null}});var me=()=>({name:"extensionToken",async authenticate(e,t){if(!e.extensionToken)return null;let n=await t.verifyToken?.("extensionToken",e.extensionToken);return {class:"dom",trust:n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"browser-extension",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{extensionToken:true,verifiedRemotely:!!n}}}});var ge=()=>({name:"oauth2",async authenticate(e,t){if(!e.oauth2AccessToken)return null;let n=await t.verifyToken?.("oauth2",e.oauth2AccessToken);return {class:e.classHint??"webmcp",trust:e.oauth2Subject?"linked":n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"oauth2",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{oauth2:true,subject:e.oauth2Subject??null,verifiedRemotely:!!n}}}});var vt=e=>({class:e.class,trust:"declared",confidence:1,vendor:e.vendor,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{declared:true,hasToken:true,tokenExpiresAt:e.expiresAt??null}}),fe=()=>({name:"selfDeclaration",async authenticate(e){return e.declaration?vt(protocol.IdentityClaim.parse(e.declaration)):null}});var he=()=>({name:"sessionLink",async authenticate(e,t){if(!e.sessionLinkToken)return null;let n=await t.verifyToken?.("sessionLink",e.sessionLinkToken);return {class:e.classHint??"screenshot",trust:e.linkedUserId?"linked":n?.trust??"verified",confidence:1,vendor:n?.vendor??e.vendorHint??"session-link",userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{sessionLink:true,linkedUserId:e.linkedUserId??null,verifiedRemotely:!!n}}}});var ve=()=>({name:"xAgentHeader",async authenticate(e){if(!e.xAgentHeader)return null;let[t="x-agent",n="dom",r]=e.xAgentHeader.split(";"),o=protocol.AgentClass.safeParse(n);return {class:o.success?o.data:"dom",trust:r?"verified":"declared",confidence:r?1:.8,vendor:t,userAgent:typeof navigator>"u"?null:navigator.userAgent,detectionVersion:"2026.04",signals:{xAgentHeader:true,hasProof:!!r}}}});var wt=()=>[ye(),fe(),de(),ve(),me(),he(),ge()],xe=({methods:e=wt(),context:t={},onTrace:n}={})=>({async authenticate(r){let o=[],i={};for(let l of e){let u=await l.authenticate(r,t);i[l.name]=!!u,u&&o.push(u);}let a=pe(o),s={type:a?"auth.identity_presented":"sdk.error",agent:a,outcome:a?"success":"error",metadata:{methods:i}};return a||(s.error="No auth method produced an identity."),n?.(s),a},methods(){return e.map(r=>r.name)}});var St={identity:null,source:"initial",updatedAt:null},we=()=>{let e=St,t=new Set,n=()=>{t.size!==0&&t.forEach(r=>r(e));};return {snapshot(){return e},set(r,o){e={identity:r,source:o,updatedAt:new Date().toISOString()},n();},subscribe(r){return t.add(r),()=>{t.delete(r);}}}};var bt=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,n)=>{e.set(t,n);}}},Tt=()=>typeof window>"u"||!window.localStorage?bt():{read:e=>{try{return window.localStorage.getItem(e)}catch{return null}},write:(e,t)=>{try{window.localStorage.setItem(e,t);}catch{}}},At=e=>{if(!e)return null;try{let t=JSON.parse(e);if(typeof t=="object"&&t!==null&&Number.isFinite(t.count)&&Number.isFinite(t.resetAt))return t}catch{return null}return null},Se=(e=Tt())=>({consume(t,n,r=Date.now()){let o=`agtx:rate:${t}`,i=At(e.read(o)),a=i&&i.resetAt>r?i.resetAt:r+n.windowSeconds*1e3,s=i&&i.resetAt>r?i.count+1:1;return e.write(o,JSON.stringify({count:s,resetAt:a})),{allowed:s<=n.max,remaining:Math.max(0,n.max-s),resetAt:a}}});var kt=(e,t)=>e==="*"||e===t?true:e.includes("*")?new RegExp("^"+e.replace(/[.+?^${}()|[\]\\]/g,"\\$&").replace(/\*/g,".*")+"$").test(t):false,Mt=(e,t)=>{let n=e?protocol.TRUST_RANK[e.trust]:-1,r=protocol.TRUST_RANK[t.minTrust];return n>=r},It=(e,t)=>t.allowedClasses.length===0?true:e?t.allowedClasses.includes(e.class):false,Ae="review",Pt=(e,t)=>{let n=t?.class??"unknown",r=t?.vendor??"unknown",o=t?.trust??"none";return `${e}:${n}:${r}:${o}`},ke=(e=[],t={})=>{let n=e.map(o=>protocol.PolicyRule.parse(o)),r=t.rateLimiter??Se();return {set(o){n=o.map(i=>protocol.PolicyRule.parse(i));},list(){return [...n]},evaluate({tool:o,identity:i}){for(let a of n)if(kt(a.tool,o)){if(!Mt(i,a))return {decision:"deny",ruleId:a.id,reason:`Rule "${a.id}" requires trust >= ${a.minTrust}.`};if(!It(i,a))return {decision:"deny",ruleId:a.id,reason:`Rule "${a.id}" restricts to classes: ${a.allowedClasses.join(", ")}.`};if(a.rateLimit){let s=r.consume(Pt(o,i),a.rateLimit);if(!s.allowed)return {decision:"deny",ruleId:a.id,reason:`Rule "${a.id}" rate limit exceeded. Resets at ${new Date(s.resetAt).toISOString()}.`}}return {decision:a.decision,ruleId:a.id,reason:`Matched rule "${a.id}".`}}return {decision:Ae,ruleId:null,reason:`No rule matched tool "${o}". Falling back to "${Ae}".`}}}};var Me=({gatewayUrl:e,siteId:t,publishableKey:n,fetcher:r=fetch})=>{let o={policies:[],etag:null};return {snapshot(){return {policies:[...o.policies],etag:o.etag}},async sync(){let i=await r(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/policies`,{headers:{authorization:`Bearer ${n}`,...o.etag?{"if-none-match":o.etag}:{}}});if(i.status===304)return this.snapshot();if(!i.ok)throw new Error(`Policy sync failed with status ${i.status}.`);let a=await i.json();return o={policies:protocol.PolicyRule.array().parse(a.policies??[]),etag:i.headers.get("etag")},this.snapshot()}}};var Ie=({message:e="Agent action blocked by site policy.",durationMs:t=2400,documentRef:n=typeof document>"u"?void 0:document}={})=>{if(!n?.body)return null;let r=n.createElement("div");return r.setAttribute("role","status"),r.setAttribute("data-agentronics-deny-overlay","true"),r.textContent=e,Object.assign(r.style,{position:"fixed",zIndex:"2147483647",left:"50%",bottom:"24px",transform:"translateX(-50%)",maxWidth:"min(520px, calc(100vw - 32px))",padding:"12px 16px",borderRadius:"8px",background:"#07091A",color:"#F4F4F5",border:"1px solid #6366F1",boxShadow:"0 20px 48px -16px rgba(7,9,26,0.55)",font:"13px/1.45 'Space Mono', ui-monospace, SFMono-Regular, Menlo, monospace"}),n.body.appendChild(r),window.setTimeout(()=>r.remove(),t),r};var Pe=({policyEngine:e,getIdentity:t,documentRef:n=typeof document>"u"?void 0:document,selector:r="[data-agentronics-tool]"})=>{if(!n)return {uninstall:()=>{}};let o=i=>{let a=i.target instanceof Element?i.target.closest(r):null;if(!(a instanceof HTMLElement))return;let s=a.dataset.agentronicsTool;s&&Promise.resolve(t()).then(l=>{let u=e.evaluate({tool:s,identity:l});u.decision==="deny"&&(i.preventDefault(),i.stopPropagation(),Ie({message:u.reason,documentRef:n}));});};return n.addEventListener("click",o,true),{uninstall:()=>n.removeEventListener("click",o,true)}};var _=()=>{let e=new Map;return {read:t=>e.get(t)??null,write:(t,n)=>{e.set(t,n);},remove:t=>{e.delete(t);},keys:()=>[...e.keys()]}},Re=(e,t)=>({read:n=>{try{return e.getItem(t+n)}catch{return null}},write:(n,r)=>{try{e.setItem(t+n,r);}catch{}},remove:n=>{try{e.removeItem(t+n);}catch{}},keys:()=>{let n=[];try{for(let r=0;r<e.length;r++){let o=e.key(r);o&&o.startsWith(t)&&n.push(o.slice(t.length));}}catch{}return n}}),Ee="agtx:",Ce=()=>{let e=typeof window<"u",t=e&&typeof window.sessionStorage<"u"?Re(window.sessionStorage,Ee+"session:"):_(),n=e&&typeof window.localStorage<"u"?Re(window.localStorage,Ee+"user:"):_();return {session:t,user:n,org:_()}};var De=(e,t)=>e.expiresAt!==null&&e.expiresAt<=t,Le=e=>{if(!e)return null;try{let t=JSON.parse(e);return typeof t!="object"||t===null?null:t}catch{return null}},Et=e=>JSON.stringify(e),$e=(e={})=>{let t=Ce(),n=l=>{e.onTrace?.(l);};return {get:(l,u={})=>{let p=u.scope??"session",g=t[p],m=Le(g.read(l));if(!m){n({type:"memory.accessed",metadata:{operation:"get",key:l,scope:p,hit:false}});return}if(De(m,Date.now())){g.remove(l),n({type:"memory.accessed",metadata:{operation:"get",key:l,scope:p,hit:false,expired:true}});return}return n({type:"memory.accessed",metadata:{operation:"get",key:l,scope:p,hit:true}}),m.value},set:(l,u,p={})=>{let g=p.scope??"session",m=p.ttlSeconds??null,v=Date.now(),w={value:u,expiresAt:m===null?null:v+m*1e3,updatedAt:new Date(v).toISOString()};return t[g].write(l,Et(w)),n({type:"memory.updated",metadata:{operation:"set",key:l,scope:g,ttlSeconds:m}}),protocol.MemoryEntry.parse({key:l,value:u,scope:g,ttlSeconds:m,updatedAt:w.updatedAt})},remove:(l,u={})=>{let p=u.scope??"session";t[p].remove(l),n({type:"memory.updated",metadata:{operation:"remove",key:l,scope:p}});},list:(l={})=>{let u=l.scope??"session",p=t[u],g=Date.now(),m=[];for(let v of p.keys()){let w=Le(p.read(v));if(w){if(De(w,g)){p.remove(v);continue}m.push(protocol.MemoryEntry.parse({key:v,value:w.value,scope:u,ttlSeconds:w.expiresAt===null?null:Math.max(0,Math.round((w.expiresAt-g)/1e3)),updatedAt:w.updatedAt}));}}return n({type:"memory.accessed",metadata:{operation:"list",scope:u,count:m.length}}),m},clear:(l={})=>{let u=l.scope??"session",p=t[u],g=p.keys().length;for(let m of p.keys())p.remove(m);n({type:"memory.updated",metadata:{operation:"clear",scope:u,count:g}});}}};var N=e=>protocol.SiteMemory.parse(JSON.parse(JSON.stringify(e))),L=e=>({...e,updatedAt:new Date().toISOString()}),We=(e={})=>{let t=protocol.SiteMemory.parse({...protocol.SITE_MEMORY_DEFAULT,...e.initial??{}}),n=null,r=new Set,o=d=>{e.onTrace?.(d);},i=()=>{n=null;},a=()=>{if(r.size===0)return;let d=N(t);n=d,r.forEach(f=>f(d));},s=d=>{let f=protocol.SiteMemory.parse({...t,...d,workflows:{...t.workflows,...d.workflows??{}},policies:{...t.policies,...d.policies??{}},uiGuidance:{...t.uiGuidance,...d.uiGuidance??{}},pageContexts:{...t.pageContexts,...d.pageContexts??{}}});return t=L(f),i(),o({type:"memory.updated",metadata:{kind:"site",operation:"provide",keys:Object.keys(d)}}),a(),p()},l=(d,f)=>{let h=d.split(".").filter(Boolean);if(h.length===0)throw new Error("siteMemory.update() requires a non-empty dot-path.");let A=JSON.parse(JSON.stringify(t)),k=A;for(let M=0;M<h.length-1;M++){let b=h[M],I=k[b];(typeof I!="object"||I===null||Array.isArray(I))&&(k[b]={}),k=k[b];}return k[h[h.length-1]]=f,t=L(protocol.SiteMemory.parse(A)),i(),o({type:"memory.updated",metadata:{kind:"site",operation:"update",path:d}}),a(),p()},u=d=>{let f=protocol.SiteMemoryPageContext.parse({path:d.path,payload:d.payload,updatedAt:new Date().toISOString()});return t=L({...t,pageContexts:{...t.pageContexts,[d.path]:f}}),i(),o({type:"memory.updated",metadata:{kind:"site",operation:"provideForPage",path:d.path}}),a(),{...f,payload:{...f.payload}}},p=()=>(n||(n=N(t)),n);return {provide:s,update:l,provideForPage:u,snapshot:p,get:d=>{if(o({type:"memory.accessed",metadata:{kind:"site",operation:d?"get":"snapshot",path:d??null}}),!d)return N(t);let f=d.split(".").filter(Boolean),h=t;for(let A of f){if(typeof h!="object"||h===null)return;h=h[A];}return h},getForPage:d=>{o({type:"memory.accessed",metadata:{kind:"site",operation:"getForPage",path:d}});let f=t.pageContexts[d];return f?{...f,payload:{...f.payload}}:null},replace:d=>(t=L(protocol.SiteMemory.parse(d)),i(),a(),p()),subscribe:d=>(r.add(d),()=>{r.delete(d);})}};var Ge=({gatewayUrl:e,siteId:t,publishableKey:n,fetcher:r=fetch})=>{let o={memory:null,etag:null};return {snapshot(){return {memory:o.memory?protocol.SiteMemory.parse(o.memory):null,etag:o.etag}},async sync(){let i=await r(`${e.replace(/\/$/,"")}/v1/sites/${encodeURIComponent(t)}/memory`,{headers:{authorization:`Bearer ${n}`,...o.etag?{"if-none-match":o.etag}:{}}});if(i.status===304)return this.snapshot();if(!i.ok)throw new Error(`Memory sync failed with status ${i.status}.`);let a=await i.json();return o={memory:protocol.SiteMemory.parse(a.memory??{}),etag:i.headers.get("etag")},this.snapshot()}}};var T="agent-context-",K="agentronics-site-context",Dt=e=>{try{return JSON.stringify(e)}catch{return "{}"}},$=(e,t,n)=>{let r=e.querySelector(`meta[name="${t}"]`);r||(r=e.createElement("meta"),r.setAttribute("name",t),e.head.appendChild(r)),r.setAttribute("content",n);},W=(e,t)=>{e.querySelectorAll(`meta[name="${t}"]`).forEach(n=>n.remove());},F=({doc:e=typeof document>"u"?null:document,snapshot:t,schemaType:n="WebSite"})=>{if(!e)return {uninstall:()=>{}};$(e,`${T}version`,t.version),$(e,`${T}updated-at`,t.updatedAt??new Date().toISOString()),t.siteMap?.navigation?.flow&&$(e,`${T}flow`,t.siteMap.navigation.flow),$(e,`${T}workflows`,Object.keys(t.workflows).join(","));let r=e.getElementById(K);return r||(r=e.createElement("script"),r.type="application/ld+json",r.id=K,e.head.appendChild(r)),r.textContent=Dt({"@context":"https://schema.org","@type":n,name:"Agentronics Site Memory",agentronics:t}),{uninstall:()=>{W(e,`${T}version`),W(e,`${T}updated-at`),W(e,`${T}flow`),W(e,`${T}workflows`),e.getElementById(K)?.remove();}}};var Be="agentronics-memory-overlay",Lt=e=>`
+position: fixed;
+bottom: 16px;
+right: 16px;
+max-width: 320px;
+padding: 10px 12px;
+background: rgba(17, 24, 39, 0.92);
+color: #f9fafb;
+font: 12px/1.45 ui-monospace, SFMono-Regular, Menlo, monospace;
+border-radius: 8px;
+z-index: 2147483647;
+opacity: ${e?"0":"1"};
+pointer-events: ${e?"none":"auto"};
+box-shadow: 0 12px 32px rgba(15, 23, 42, 0.35);
+`,Ue=e=>{let t=e.siteMap?.pages?.length??0,n=Object.keys(e.workflows).length,r=Object.keys(e.uiGuidance).length;return `Agentronics site memory \xB7 pages:${t} \xB7 workflows:${n} \xB7 ui-hints:${r}`},H=({doc:e=typeof document>"u"?null:document,snapshot:t,hidden:n=false})=>{if(!e)return {uninstall:()=>{},refresh:()=>{}};let r=e.getElementById(Be);return r||(r=e.createElement("div"),r.id=Be,r.setAttribute("role","note"),r.setAttribute("aria-label","Agentronics site memory summary"),r.setAttribute("data-agent-context","overlay"),e.body.appendChild(r)),r.setAttribute("style",Lt(n)),r.textContent=Ue(t),{uninstall:()=>{r?.remove();},refresh:o=>{r&&(r.textContent=Ue(o));}}};var _e="/.well-known/agent-context.json",z=async({origin:e,fetcher:t=fetch,signal:n}={})=>{let r=(e?e.replace(/\/$/,""):typeof window<"u"?window.location.origin:"")+_e;if(!r.startsWith("http"))return null;let o={headers:{accept:"application/json"}};n!==void 0&&(o.signal=n);let i=await t(r,o);if(!i.ok){if(i.status===404)return null;throw new Error(`well-known agent-context fetch failed with status ${i.status}.`)}let a=await i.json();return protocol.SiteMemory.parse(a)};var Ne=({evaluate:e,setPolicies:t,listPolicies:n,onTrace:r})=>{let o=new Map,i=new Set,a=s=>{if(!s.authz||!t||!n)return;let l={id:`tool:${s.name}`,tool:s.name,...s.authz,rateLimit:s.rateLimit??s.authz.rateLimit};t([...n().filter(u=>u.id!==l.id),l]);};return {register(s){return o.set(s.name,s),i.delete(s.name),a(s),r?.({type:"tool.registered",tool:s.name,metadata:{version:s.version??null,group:s.group??null,stage:s.stage??null}}),()=>{o.delete(s.name),i.delete(s.name);}},unregister(s){o.delete(s),i.delete(s);},enable(s){!o.has(s)||!i.has(s)||(i.delete(s),r?.({type:"tool.surfaced",tool:s,metadata:{state:"enabled"}}));},disable(s){!o.has(s)||i.has(s)||(i.add(s),r?.({type:"tool.surfaced",tool:s,metadata:{state:"disabled"}}));},isEnabled:s=>o.has(s)&&!i.has(s),list({includeDisabled:s=false}={}){let l=[...o.values()];return s?l:l.filter(u=>!i.has(u.name))},get:s=>o.get(s),async execute(s,l,u=null){let p=o.get(s);if(!p)throw new Error(`Tool "${s}" is not registered.`);if(i.has(s)){let v={decision:"deny",ruleId:`tool:${s}`,reason:"Tool is disabled."};throw r?.({type:"tool.executed",tool:s,agent:u,policy:v,outcome:"blocked"}),new Error(v.reason)}let g=await e(s,{identity:u});if(g.decision==="deny")throw r?.({type:"tool.executed",tool:s,agent:u,policy:g,outcome:"blocked"}),new Error(g.reason);let m=await p.execute(l,{identity:u});return r?.({type:"tool.executed",tool:s,agent:u,policy:g,outcome:"success"}),m}}};var Ke=(e,t={})=>{let n=new Map;for(let a of e.stages)n.set(a.name,a);if(!n.has(e.initial))throw new Error(`Initial stage "${e.initial}" is not declared in progression stages.`);let r=e.initial,o=()=>{let a=n.get(r);return a?.enables?[r,...a.enables]:[r]},i=(a,s)=>{let l=r;if(!n.has(a))throw new Error(`Cannot transition to unknown stage "${a}".`);return a===r?{changed:false,from:l,to:a}:(r=a,t.onTrace?.({type:"tool.progressed",metadata:{from:l,to:a,trigger:s}}),{changed:true,from:l,to:a})};return {current:()=>r,enabledStages:()=>o(),notify(a){let l=n.get(r)?.transitions?.find(u=>u.on===a);return l?i(l.to,a):{changed:false,from:r,to:r}},set(a){return i(a,"manual")},reset(){let a=r;r=e.initial,a!==r&&t.onTrace?.({type:"tool.progressed",metadata:{from:a,to:r,trigger:"reset"}});},snapshot:()=>({current:r,enabled:o()})}};var Wt=(e,t)=>{let n=e.authz?.minTrust;return n?t?protocol.TRUST_RANK[t.trust]<protocol.TRUST_RANK[n]?{ok:false,reason:`trust-too-low:${t.trust}<${n}`}:{ok:true,reason:"trust-ok"}:{ok:false,reason:`requires-trust:${n}`}:{ok:true,reason:"no-trust-floor"}},jt=(e,t)=>{let n=e.authz?.allowedClasses??[];return n.length===0?{ok:true,reason:"no-class-restriction"}:t?n.includes(t.class)?{ok:true,reason:"class-ok"}:{ok:false,reason:`class-not-allowed:${t.class}`}:{ok:false,reason:`requires-class:${n.join("|")}`}},Gt=(e,t)=>e.stage?t.enabledStages&&t.enabledStages.includes(e.stage)?{ok:true,reason:`stage-enabled:${e.stage}`}:t.stage===e.stage?{ok:true,reason:`stage-active:${e.stage}`}:{ok:false,reason:`stage-locked:${e.stage}`}:{ok:true,reason:"no-stage"},He=(e,t)=>{let n=Wt(e,t.identity);if(!n.ok)return {tool:e,visible:false,reason:n.reason};let r=jt(e,t.identity);if(!r.ok)return {tool:e,visible:false,reason:r.reason};let o=Gt(e,t);return o.ok?e.authz?.decision==="deny"?{tool:e,visible:false,reason:"authz-deny"}:{tool:e,visible:true,reason:"visible"}:{tool:e,visible:false,reason:o.reason}},ze=(e,t)=>e.filter(n=>He(n,t).visible),Je=(e,t)=>e.map(n=>He(n,t));var Bt="default",Ve=e=>{let t=new Map;for(let n of e){let r=n.group??Bt,o=t.get(r)??[];o.push(n),t.set(r,o);}return [...t.entries()].sort(([n],[r])=>n.localeCompare(r)).map(([n,r])=>({name:n,tools:r}))};var J=e=>e===null||typeof e!="object"?JSON.stringify(e):Array.isArray(e)?`[${e.map(J).join(",")}]`:`{${Object.keys(e).sort().map(n=>`${JSON.stringify(n)}:${J(e[n])}`).join(",")}}`,Ut=e=>{let t={name:e.name,version:e.version??null,group:e.group??null,description:e.description??null,inputSchema:e.inputSchema??null,authz:e.authz??null,rateLimit:e.rateLimit??null},n=J(t).length;return {name:e.name,characters:n,tokens:Math.ceil(n/4)}},qe=e=>{let t=e.map(Ut);return {total:t.reduce((r,o)=>r+o.tokens,0),perTool:t}};var Xe=e=>e.provider?e.provider:(e.doc?.defaultView??(typeof globalThis<"u"?globalThis:null))?.navigator?.modelContext??null,_t=(e,t)=>{let n={name:e.name,invoke:r=>t(e,r)};return e.description!==void 0&&(n.description=e.description),e.inputSchema!==void 0&&(n.inputSchema=e.inputSchema),n},Ye=(e={})=>{let t=e.invoke??(async(r,o)=>r.execute(o,{identity:null})),n=null;return {publish(r){let o=Xe(e);return o?(n?.revoke(),n=o.provideContext({tools:r.map(i=>_t(i,t))}),{revoked:true}):{revoked:false}},revoke(){n?.revoke(),n=null;},available:()=>!!Xe(e)}};var V=(e=500)=>{let t=[];return {add(n){t.push(n),t.length>e&&t.splice(0,t.length-e);},list(){return [...t]},clear(){t.length=0;}}};var Qe=(e,t)=>e===void 0?t:Math.max(0,Math.min(1,e)),q=(e={})=>{let t=Qe(e.traceRate,1),n=Qe(e.errorRate,1),r=e.random??Math.random;return {shouldKeep(o){let i=o.outcome==="error"?n:t;return r()<i}}};var Nt="[REDACTED]",Kt=e=>{if(e!==void 0)return JSON.parse(JSON.stringify(e))},X=(e,t)=>{if(t.length===0||typeof e!="object"||e===null)return;let[n,...r]=t;if(!n)return;if(Array.isArray(e)){for(let i of e)X(i,t);return}let o=e;if(n in o){if(r.length===0){o[n]=Nt;return}X(o[n],r);}},Y=(e,t=[])=>{if(t.length===0)return e;let n=Kt(e);for(let r of t)X(n,r.split(".").filter(Boolean));return n},Q=["metadata.password","metadata.token","metadata.authorization","metadata.cookie"];var Ze=e=>{let t=globalThis.crypto;return t&&"randomUUID"in t?`${e}_${t.randomUUID()}`:`${e}_${Date.now().toString(36)}_${Math.random().toString(36).slice(2)}`},Z=({siteId:e,bufferSize:t,sessionId:n=Ze("ses"),scrubPaths:r=Q,exporters:o=[],onExporterError:i,...a})=>{let s=V(t),l=q(a);return {sessionId:n,async emit(u){let p=protocol.TraceEvent.parse(Y({id:Ze("trc"),siteId:e,sessionId:n,occurredAt:new Date().toISOString(),outcome:u.outcome??"success",metadata:{},...u},r));return l.shouldKeep(p)?(s.add(p),await Promise.all(o.map(async g=>{try{await g.export([p]);}catch(m){i?.(m,g,p);}})),p):null},list:()=>s.list(),clear:()=>s.clear()}};var ee=()=>({name:"console",export(e){for(let t of e)console.info("[agentronics:trace]",t.type,t);}});var te=({gatewayUrl:e,publishableKey:t,fetcher:n=fetch})=>({name:"gateway",async export(r){let o={publishableKey:t,events:r};await n(`${e.replace(/\/$/,"")}/v1/traces`,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${t}`},body:JSON.stringify(o)});}});var Ht=e=>new Promise(t=>setTimeout(t,e)),re=({url:e,fetcher:t=fetch,maxRetries:n=2,queueLimit:r=500})=>({name:"webhook",async export(o){let a=[...zt(e),...o].slice(-r),s=0;for(;;){let l=await t(e,{method:"POST",headers:{"content-type":"application/json"},body:JSON.stringify({events:a})});if(l.ok){et(e,[]);return}if(s>=n)throw et(e,a),new Error(`Webhook exporter failed with status ${l.status}.`);s+=1,await Ht(100*s);}}}),ne=e=>`agtx:webhook:${e}`,zt=e=>{if(typeof window>"u"||!window.localStorage)return [];try{let t=window.localStorage.getItem(ne(e));return t?JSON.parse(t):[]}catch{return []}},et=(e,t)=>{if(!(typeof window>"u"||!window.localStorage))try{if(t.length===0){window.localStorage.removeItem(ne(e));return}window.localStorage.setItem(ne(e),JSON.stringify(t));}catch{}};var nt="https://gateway.agentronics.dev",qt=e=>{if(e===void 0)return nt;if(e===nt)return e;let t;try{t=new URL(e);}catch{throw new Error(`Agentronics SDK: \`gatewayUrl\` is not a valid URL: ${e}`)}if(t.hostname==="localhost"||t.hostname==="127.0.0.1")return e;throw new Error(`Agentronics SDK does not support custom gateway URLs. Omit \`gatewayUrl\` to use the canonical https://gateway.agentronics.dev. The only accepted override is a localhost / 127.0.0.1 URL for local development. Got: ${e}`)},Xt=e=>{let{publishableKey:t,siteId:n="default",debug:r=false,policies:o=[],trace:i={}}=e,a=qt(e.gatewayUrl),s=protocol.classifyApiKey(t);if(s==="secret")throw new protocol.AgentronicsError("wrong_key_kind","A secret key was passed to Agentronics.init(). Browser code must use a publishable key (agtx_pk_*).");if(s!=="publishable")throw new protocol.AgentronicsError("invalid_api_key",`Agentronics.init() expected a key starting with "${protocol.PUBLISHABLE_KEY_PREFIX}".`);let l=i.enabled??true,u=[...r?[ee()]:[],...i.gateway?[te({gatewayUrl:a,publishableKey:t})]:[],...i.webhookUrl?[re({url:i.webhookUrl})]:[],...i.exporters??[]],p={siteId:n,exporters:l?u:[],onExporterError:(c,y)=>{r&&console.warn(`[agentronics] trace exporter "${y.name}" failed`,c);}};i.bufferSize!==void 0&&(p.bufferSize=i.bufferSize),i.traceRate!==void 0&&(p.traceRate=i.traceRate),i.errorRate!==void 0&&(p.errorRate=i.errorRate),i.scrubPaths!==void 0&&(p.scrubPaths=i.scrubPaths);let g=Z(p),m=c=>{l&&g.emit(c);},v=le(),w={onTrace:m};e.auth!==void 0&&(w.context=e.auth);let d=xe(w),f=we(),h=ke(o),A=Me({gatewayUrl:a,siteId:n,publishableKey:t}),k=$e({onTrace:m}),M={onTrace:m};e.siteMemory!==void 0&&(M.initial=e.siteMemory);let b=We(M),I=Ge({gatewayUrl:a,siteId:n,publishableKey:t}),j=async c=>{let y=Date.now(),x=await ce(c),S=v.preferOver(x);return l&&await g.emit({type:S?"agent.detected":"agent.missed",agent:S,durationMs:Date.now()-y,metadata:{detectedClass:x?.class??null,presented:v.snapshot()!==null}}),f.set(S,"detect"),S},oe=async(c,y={})=>{let x=Date.now(),S=y.identity!==void 0?y.identity:await j(),B=h.evaluate({tool:c,identity:S});return l&&await g.emit({type:"authz.evaluated",tool:c,agent:S,policy:B,outcome:B.decision==="deny"?"blocked":"success",durationMs:Date.now()-x}),B},P=Ne({evaluate:oe,setPolicies:c=>h.set(c),listPolicies:()=>h.list(),onTrace:m});for(let c of e.tools??[])P.register(c);let R=e.progression?Ke(e.progression,{onTrace:m}):null,ie=c=>{let y={identity:c};return R&&(y.stage=R.current(),y.enabledStages=R.enabledStages()),y},E=c=>ze(P.list(),ie(c)),se=c=>{if(!R)return;R.notify(c).changed&&G.publish(E(null));},G=Ye({invoke:async(c,y)=>{let x=await P.execute(c.name,y,null);return se(c.name),x}});return Object.freeze({publishableKey:t,siteId:n,gatewayUrl:a,debug:r,memory:k,siteMemory:b,memoryCache:I,tracer:g,auth:d,agentContext:f,authz:h,policyCache:A,tools:P,progression:R,webmcp:G,detect:j,authenticate:async c=>{let y=await d.authenticate(c);return f.set(y,"authenticate"),y},presentIdentity:c=>{let y=v.present(c);return m({type:"auth.identity_presented",agent:y.identity,metadata:{vendor:y.identity.vendor,class:y.identity.class}}),f.set(y.identity,"declare"),y},clearIdentity:()=>{v.clear(),m({type:"auth.identity_cleared"}),f.set(null,"cleared");},presentedIdentity:()=>v.snapshot(),setPolicies:c=>{h.set(c),m({type:"authz.policies_set",metadata:{count:c.length}});},listPolicies:()=>h.list(),syncPolicies:async()=>{let c=await A.sync();return h.set(c.policies),m({type:"authz.policies_set",metadata:{count:c.policies.length,synced:true}}),c.policies},syncSiteMemory:async()=>{let c=await I.sync();return c.memory&&(b.replace(c.memory),m({type:"memory.updated",metadata:{kind:"site",operation:"sync",etag:c.etag}})),c.memory},provideSiteMemory:c=>b.provide(c),provideForPage:c=>{b.provideForPage(c);},installMemoryDelivery:({metaTags:c=true,overlay:y=false}={})=>{let x=[];return c&&x.push(F({snapshot:b.snapshot()})),y&&x.push(H({snapshot:b.snapshot()})),{uninstall:()=>{x.forEach(S=>S.uninstall());}}},fetchWellKnown:async c=>{let y={};c!==void 0&&(y.origin=c);let x=await z(y);return x&&(b.replace(x),m({type:"memory.updated",metadata:{kind:"site",operation:"wellKnown",origin:c??null}})),x},installDomEnforcer:()=>Pe({policyEngine:h,getIdentity:()=>j({webmcp:{pollMs:0}})}),registerTool:c=>P.register(c),surfaceTools:({identity:c=null}={})=>E(c),explainSurfacing:({identity:c=null}={})=>Je(P.list(),ie(c)),groupedTools:({identity:c=null}={})=>Ve(E(c)),estimateTokens:({identity:c=null}={})=>qe(E(c)),publishToWebMcp:({identity:c=null}={})=>{let y=E(c),x=G.publish(y);return y.forEach(S=>{m({type:"tool.surfaced",tool:S.name,metadata:{state:"published",trust:c?.trust??null,group:S.group??null}});}),{revoked:x.revoked,surfaced:y.length}},notifyToolInvoked:c=>se(c),evaluate:oe,traces:()=>g.list(),clearTraces:()=>g.clear(),async ping(){try{let c=await fetch(`${a.replace(/\/$/,"")}/v1/health`,{method:"GET",headers:{authorization:`Bearer ${t}`}});if(!c.ok)return {ok:!1,status:c.status,error:`gateway returned ${c.status}`};let y=await c.json().catch(()=>null)??{};return {ok:!0,status:c.status,body:y}}catch(c){return {ok:false,status:0,error:c instanceof Error?c.message:String(c)}}}})};
+exports.init=Xt;//# sourceMappingURL=init-only.cjs.map
+//# sourceMappingURL=init-only.cjs.map