@axonflow/openclaw 1.3.1 → 2.0.0

package/dist/community-saas-bootstrap.js

@@ -0,0 +1,281 @@
+/**
+ * Community-SaaS first-run bootstrap (TypeScript).
+ *
+ * Mirrors the bash plugins' scripts/community-saas-bootstrap.sh contract:
+ * registers the plugin against try.getaxonflow.com on first run when the
+ * user has not provided explicit clientId/clientSecret, persists the
+ * resulting credential to a 0600 file under the user's config dir, and
+ * returns Basic-auth credentials the caller can hand to the AxonFlow client.
+ *
+ * Design rules (per feedback_telemetry_heartbeat_design_rules.md and
+ * feedback_pg_advisory_lock_pin_connection.md):
+ *   - Stamp-on-delivery: registration file is written ONLY after the
+ *     POST returns 201 with a valid response body. A network failure
+ *     leaves the previous (or absent) state untouched.
+ *   - Atomic writes: temp + rename so a crash mid-write never produces
+ *     a half-readable file.
+ *   - In-flight gate: a per-process Promise-based lock so concurrent
+ *     plugin loads don't both race to register.
+ *   - File permissions: 0700 directory, 0600 file. The file holds the
+ *     plain-text credential; world-readable would be a security bug.
+ *   - 429 (registration rate-limit) → write a short backoff stamp and
+ *     return null. Next call after backoff expires retries.
+ *   - Cross-platform cache dir resolution (Linux/macOS/Windows).
+ *   - Refuses to load a registration file with non-0600 permissions
+ *     (defends against silent credential leak via accidental chmod).
+ */
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { axonflowCacheDir, axonflowConfigDir } from "./cache-dir.js";
+const REGISTER_URL_DEFAULT = "https://try.getaxonflow.com/api/v1/register";
+const ENDPOINT_DEFAULT = "https://try.getaxonflow.com";
+const REGISTRATION_FILE_NAME = "try-registration.json";
+const BACKOFF_FILE_NAME = "openclaw-plugin-register-backoff";
+const BACKOFF_SECONDS = 3600;
+// Refresh registrations whose expires_at is within 30 days so we never let
+// a tenant lapse silently while users are actively using the plugin.
+const REFRESH_WINDOW_MS = 30 * 24 * 60 * 60 * 1000;
+/**
+ * Per-process in-flight gate. When two plugin loads happen concurrently
+ * (rare but possible in test harnesses or hot-reload scenarios), the second
+ * waits on the first's promise rather than firing a duplicate registration.
+ */
+let inFlight = null;
+/**
+ * Bootstrap a Community-SaaS registration. Returns null if bootstrap was
+ * skipped (registration file unreadable due to permissions, network error,
+ * 429 rate-limited, etc); the caller is responsible for surfacing a clear
+ * "governance degraded" notice in that case.
+ *
+ * Safe to call concurrently — the second concurrent call awaits the first
+ * rather than racing.
+ */
+export async function bootstrapCommunitySaas(opts) {
+    if (inFlight) {
+        return inFlight;
+    }
+    inFlight = bootstrapCommunitySaasInner(opts).finally(() => {
+        inFlight = null;
+    });
+    return inFlight;
+}
+async function bootstrapCommunitySaasInner(opts) {
+    // Test-harness overrides — only honoured when AXONFLOW_HARNESS=1 and
+    // exclusively used by tests/heartbeat-real-stack/. Production callers
+    // leave AXONFLOW_HARNESS unset and the URLs stay pinned to
+    // try.getaxonflow.com.
+    const harnessOn = process.env.AXONFLOW_HARNESS === "1";
+    const harnessRegister = harnessOn ? process.env.AXONFLOW_HARNESS_REGISTER_URL : "";
+    const harnessAgent = harnessOn ? process.env.AXONFLOW_HARNESS_AGENT_ENDPOINT : "";
+    const registerUrl = opts?.registerUrl ?? (harnessRegister || REGISTER_URL_DEFAULT);
+    const endpoint = opts?.endpoint ?? (harnessAgent || ENDPOINT_DEFAULT);
+    const fetchFn = opts?.fetchImpl ?? fetch;
+    const now = opts?.now ?? (() => new Date());
+    const configDir = axonflowConfigDir();
+    if (!configDir) {
+        return null;
+    }
+    const registrationFile = path.join(configDir, REGISTRATION_FILE_NAME);
+    const cacheDir = axonflowCacheDir();
+    const backoffFile = cacheDir
+        ? path.join(cacheDir, BACKOFF_FILE_NAME)
+        : "";
+    try {
+        fs.mkdirSync(configDir, { recursive: true, mode: 0o700 });
+        // mkdir's mode only applies to directories it creates. A user with
+        // ~/.config already at 0755 would otherwise hold our 0600 credential
+        // file inside a traversable directory; chmod restores the dir-mode
+        // contract on every invocation. Skip on Windows (mode bits don't map).
+        if (process.platform !== "win32") {
+            try {
+                fs.chmodSync(configDir, 0o700);
+            }
+            catch { /* best effort */ }
+        }
+    }
+    catch {
+        return null;
+    }
+    // Fast path: existing registration is fresh enough.
+    const cached = readRegistrationIfFreshAndSafe(registrationFile, now);
+    if (cached) {
+        return {
+            endpoint: cached.endpoint ?? endpoint,
+            clientId: cached.tenant_id,
+            clientSecret: cached.secret,
+            source: "cached-registration",
+        };
+    }
+    // Backoff path: 429 told us to slow down. Honour it.
+    if (backoffFile && isWithinBackoff(backoffFile, now)) {
+        return { endpoint, clientId: "", clientSecret: "", source: "rate-limited" };
+    }
+    // Issue the registration.
+    const label = buildLabel(opts?.pluginVersion);
+    let response;
+    try {
+        const ctl = new AbortController();
+        const timeoutHandle = setTimeout(() => ctl.abort(), 10_000);
+        try {
+            response = await fetchFn(registerUrl, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ label }),
+                signal: ctl.signal,
+            });
+        }
+        finally {
+            clearTimeout(timeoutHandle);
+        }
+    }
+    catch {
+        return { endpoint, clientId: "", clientSecret: "", source: "failed" };
+    }
+    if (response.status === 429) {
+        if (backoffFile && cacheDir) {
+            try {
+                fs.mkdirSync(cacheDir, { recursive: true, mode: 0o700 });
+                if (process.platform !== "win32") {
+                    try {
+                        fs.chmodSync(cacheDir, 0o700);
+                    }
+                    catch { /* best effort */ }
+                }
+                const backoffUntil = Math.floor(now().getTime() / 1000) + BACKOFF_SECONDS;
+                writeFileAtomicallyWithMode(backoffFile, String(backoffUntil), 0o600);
+            }
+            catch {
+                // Best effort; if we can't write the backoff stamp, the next call retries.
+            }
+        }
+        return { endpoint, clientId: "", clientSecret: "", source: "rate-limited" };
+    }
+    if (response.status !== 201) {
+        return { endpoint, clientId: "", clientSecret: "", source: "failed" };
+    }
+    let parsed;
+    try {
+        const body = (await response.json());
+        if (typeof body.tenant_id !== "string" || body.tenant_id.length === 0 ||
+            typeof body.secret !== "string" || body.secret.length === 0 ||
+            typeof body.expires_at !== "string") {
+            return { endpoint, clientId: "", clientSecret: "", source: "failed" };
+        }
+        parsed = {
+            tenant_id: body.tenant_id,
+            secret: body.secret,
+            expires_at: body.expires_at,
+            endpoint: typeof body.endpoint === "string" ? body.endpoint : endpoint,
+        };
+    }
+    catch {
+        return { endpoint, clientId: "", clientSecret: "", source: "failed" };
+    }
+    // Stamp-on-delivery: only write after a fully-validated response.
+    try {
+        writeFileAtomicallyWithMode(registrationFile, JSON.stringify(parsed), 0o600);
+        if (backoffFile) {
+            try {
+                fs.unlinkSync(backoffFile);
+            }
+            catch { /* fine */ }
+        }
+    }
+    catch {
+        // We received valid credentials but couldn't persist them. Return them
+        // anyway so the current process can still authenticate; on next run we
+        // re-register (cheap; rate-limited, but bounded).
+    }
+    return {
+        endpoint: parsed.endpoint ?? endpoint,
+        clientId: parsed.tenant_id,
+        clientSecret: parsed.secret,
+        source: "fresh-registration",
+    };
+}
+function readRegistrationIfFreshAndSafe(file, now) {
+    let stat;
+    try {
+        stat = fs.statSync(file);
+    }
+    catch {
+        return null;
+    }
+    // Refuse to read a registration file with non-0600 permissions. World-
+    // readable credential storage is a real bug; the caller surfaces the
+    // refusal so the user knows to delete + re-register.
+    if (process.platform !== "win32") {
+        const mode = stat.mode & 0o777;
+        if (mode !== 0o600) {
+            try {
+                process.stderr.write(`[AxonFlow] ${file} has unsafe permissions (${mode.toString(8).padStart(3, "0")}); refusing to use. ` +
+                    `Re-register: rm ${JSON.stringify(file)} and reload.\n`);
+            }
+            catch { /* stderr unavailable in some hosts */ }
+            return null;
+        }
+    }
+    let parsed;
+    try {
+        const raw = fs.readFileSync(file, "utf8");
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (typeof parsed.tenant_id !== "string" || parsed.tenant_id.length === 0 ||
+        typeof parsed.secret !== "string" || parsed.secret.length === 0 ||
+        typeof parsed.expires_at !== "string") {
+        return null;
+    }
+    const expiresMs = Date.parse(parsed.expires_at);
+    if (!Number.isFinite(expiresMs)) {
+        return null;
+    }
+    const remaining = expiresMs - now().getTime();
+    if (remaining < REFRESH_WINDOW_MS) {
+        return null;
+    }
+    return parsed;
+}
+function isWithinBackoff(backoffFile, now) {
+    try {
+        const raw = fs.readFileSync(backoffFile, "utf8").trim();
+        const until = Number(raw);
+        if (!Number.isFinite(until) || until <= 0)
+            return false;
+        return until > Math.floor(now().getTime() / 1000);
+    }
+    catch {
+        return false;
+    }
+}
+function buildLabel(pluginVersion) {
+    const version = pluginVersion ?? "unknown";
+    const platform = `${os.type()}-${os.arch()}`;
+    const label = `openclaw-plugin@${version} / ${platform}`;
+    return label.length > 255 ? label.slice(0, 255) : label;
+}
+function writeFileAtomicallyWithMode(file, content, mode) {
+    // tmp file in the same directory so rename is atomic on POSIX. On Windows,
+    // fs.renameSync replaces the destination atomically since Node 14+.
+    const dir = path.dirname(file);
+    const tmp = path.join(dir, `${path.basename(file)}.tmp.${process.pid}`);
+    fs.writeFileSync(tmp, content, { mode });
+    // chmod again because some filesystems / umask combinations ignore the
+    // mode passed to writeFileSync for already-existing temp files.
+    try {
+        fs.chmodSync(tmp, mode);
+    }
+    catch { /* best effort */ }
+    fs.renameSync(tmp, file);
+}
+/**
+ * Test-only: clear the in-flight gate so test cases can exercise concurrent
+ * bootstrap calls without sharing state across tests.
+ */
+export function _resetBootstrapInFlightForTests() {
+    inFlight = null;
+}
+//# sourceMappingURL=community-saas-bootstrap.js.map

package/dist/community-saas-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"community-saas-bootstrap.js","sourceRoot":"","sources":["../src/community-saas-bootstrap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,gBAAgB,CAAC;AAErE,MAAM,oBAAoB,GAAG,6CAA6C,CAAC;AAC3E,MAAM,gBAAgB,GAAG,6BAA6B,CAAC;AACvD,MAAM,sBAAsB,GAAG,uBAAuB,CAAC;AACvD,MAAM,iBAAiB,GAAG,kCAAkC,CAAC;AAC7D,MAAM,eAAe,GAAG,IAAI,CAAC;AAC7B,2EAA2E;AAC3E,qEAAqE;AACrE,MAAM,iBAAiB,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAoBnD;;;;GAIG;AACH,IAAI,QAAQ,GAA2C,IAAI,CAAC;AAE5D;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,IAM5C;IACC,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,QAAQ,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACxD,QAAQ,GAAG,IAAI,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,2BAA2B,CAAC,IAM1C;IACC,qEAAqE;IACrE,sEAAsE;IACtE,2DAA2D;IAC3D,uBAAuB;IACvB,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,KAAK,GAAG,CAAC;IACvD,MAAM,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IACnF,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC,CAAC,EAAE,CAAC;IAElF,MAAM,WAAW,GAAG,IAAI,EAAE,WAAW,IAAI,CAAC,eAAe,IAAI,oBAAoB,CAAC,CAAC;IACnF,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,CAAC,YAAY,IAAI,gBAAgB,CAAC,CAAC;IACtE,MAAM,OAAO,GAAG,IAAI,EAAE,SAAS,IAAI,KAAK,CAAC;IACzC,MAAM,GAAG,GAAG,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;IAE5C,MAAM,SAAS,GAAG,iBAAiB,EAAE,CAAC;IACtC,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;IAEtE,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IACpC,MAAM,WAAW,GAAG,QAAQ;QAC1B,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,iBAAiB,CAAC;QACxC,CAAC,CAAC,EAAE,CAAC;IAEP,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1D,mEAAmE;QACnE,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACjC,IAAI,CAAC;gBAAC,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,oDAAoD;IACpD,MAAM,MAAM,GAAG,8BAA8B,CAAC,gBAAgB,EAAE,GAAG,CAAC,CAAC;IACrE,IAAI,MAAM,EAAE,CAAC;QACX,OAAO;YACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;YACrC,QAAQ,EAAE,MAAM,CAAC,SAAS;YAC1B,YAAY,EAAE,MAAM,CAAC,MAAM;YAC3B,MAAM,EAAE,qBAAqB;SAC9B,CAAC;IACJ,CAAC;IAED,qDAAqD;IACrD,IAAI,WAAW,IAAI,eAAe,CAAC,WAAW,EAAE,GAAG,CAAC,EAAE,CAAC;QACrD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9E,CAAC;IAED,0BAA0B;IAC1B,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC9C,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,eAAe,EAAE,CAAC;QAClC,MAAM,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,OAAO,CAAC,WAAW,EAAE;gBACpC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC;gBAC/B,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,aAAa,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,IAAI,WAAW,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,CAAC;gBACH,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;gBACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;oBACjC,IAAI,CAAC;wBAAC,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;oBAAC,CAAC;oBAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,YAAY,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,eAAe,CAAC;gBAC1E,2BAA2B,CAAC,WAAW,EAAE,MAAM,CAAC,YAAY,CAAC,EAAE,KAAK,CAAC,CAAC;YACxE,CAAC;YAAC,MAAM,CAAC;gBACP,2EAA2E;YAC7E,CAAC;QACH,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC9E,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;QAC5B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAmC,CAAC;QACvE,IACE,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;YACjE,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAC3D,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,EACnC,CAAC;YACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;QACxE,CAAC;QACD,MAAM,GAAG;YACP,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,QAAQ,EAAE,OAAO,IAAI,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ;SACvE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC;IACxE,CAAC;IAED,kEAAkE;IAClE,IAAI,CAAC;QACH,2BAA2B,CAAC,gBAAgB,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC;QAC7E,IAAI,WAAW,EAAE,CAAC;YAChB,IAAI,CAAC;gBAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,uEAAuE;QACvE,kDAAkD;IACpD,CAAC;IAED,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,QAAQ;QACrC,QAAQ,EAAE,MAAM,CAAC,SAAS;QAC1B,YAAY,EAAE,MAAM,CAAC,MAAM;QAC3B,MAAM,EAAE,oBAAoB;KAC7B,CAAC;AACJ,CAAC;AAED,SAAS,8BAA8B,CACrC,IAAY,EACZ,GAAe;IAEf,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,uEAAuE;IACvE,qEAAqE;IACrE,qDAAqD;IACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,cAAc,IAAI,4BAA4B,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,sBAAsB;oBACrG,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,gBAAgB,CACxD,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC,CAAC,sCAAsC,CAAC,CAAC;YAClD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,IAAI,MAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA0B,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IACE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,KAAK,CAAC;QACrE,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;QAC/D,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EACrC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAG,SAAS,GAAG,GAAG,EAAE,CAAC,OAAO,EAAE,CAAC;IAC9C,IAAI,SAAS,GAAG,iBAAiB,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,WAAmB,EAAE,GAAe;IAC3D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QACxD,OAAO,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,CAAC;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,aAAiC;IACnD,MAAM,OAAO,GAAG,aAAa,IAAI,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,GAAG,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;IAC7C,MAAM,KAAK,GAAG,mBAAmB,OAAO,MAAM,QAAQ,EAAE,CAAC;IACzD,OAAO,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;AAC1D,CAAC;AAED,SAAS,2BAA2B,CAAC,IAAY,EAAE,OAAe,EAAE,IAAY;IAC9E,2EAA2E;IAC3E,oEAAoE;IACpE,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACxE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACzC,uEAAuE;IACvE,gEAAgE;IAChE,IAAI,CAAC;QAAC,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,iBAAiB,CAAC,CAAC;IAC5D,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,+BAA+B;IAC7C,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/config.d.ts

@@ -64,8 +64,33 @@ export interface AxonFlowPluginConfig {
      * Defaults to 8000ms.
      */
     requestTimeoutMs?: number;
+    /**
+     * Resolved deployment mode (set by `resolveConfig`):
+     *   - "community-saas": user provided no explicit endpoint/clientId/clientSecret;
+     *     plugin will register against try.getaxonflow.com on first run.
+     *   - "self-hosted": user provided at least one of endpoint/clientId/clientSecret;
+     *     plugin uses those values verbatim (no Community-SaaS bootstrap).
+     *
+     * Surfaced on the config so callers can emit the mode-clarity canary
+     * "[AxonFlow] Connected to AxonFlow at <URL> (mode=<X>)" and so the
+     * Gate 4 mode-clarity test can assert it.
+     */
+    mode: "community-saas" | "self-hosted";
 }
-/** Validate plugin config and return defaults. */
+/**
+ * Validate plugin config and return defaults.
+ *
+ * Resolution order (ADR-048):
+ *   1. If the user provided ANY of endpoint, clientId, clientSecret → mode is
+ *      "self-hosted". Defaults are filled in: endpoint defaults to localhost,
+ *      clientId defaults to "community", clientSecret stays empty (community
+ *      mode). The user's explicit values are honoured untouched.
+ *   2. If the user provided NONE → mode is "community-saas". Endpoint
+ *      defaults to https://try.getaxonflow.com. clientId/clientSecret stay
+ *      EMPTY here — the caller (registerAxonFlowGovernance) is expected to
+ *      bootstrap the registration via community-saas-bootstrap.ts and
+ *      override clientId/clientSecret on the resulting client.
+ */
 export declare function resolveConfig(raw: Record<string, unknown> | undefined): AxonFlowPluginConfig;
 /** Check if a tool should be governed based on config. */
 export declare function shouldGovernTool(toolName: string, config: AxonFlowPluginConfig): boolean;

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IAEjB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IAEjB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAE5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,kDAAkD;AAClD,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACvC,oBAAoB,CA0DtB;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAWT"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,oBAAoB;IACnC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IAEjB,sFAAsF;IACtF,QAAQ,EAAE,MAAM,CAAC;IAEjB,gFAAgF;IAChF,YAAY,EAAE,MAAM,CAAC;IAErB;;;;;;;;;;;;;;;;;OAiBG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IAEnB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;OAEG;IACH,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IAEzB;;;OAGG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;OAOG;IACH,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAE5B;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B;;;;;;;;;;OAUG;IACH,IAAI,EAAE,gBAAgB,GAAG,aAAa,CAAC;CACxC;AAID;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GACvC,oBAAoB,CAyEtB;AAED,0DAA0D;AAC1D,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,oBAAoB,GAC3B,OAAO,CAWT"}

package/dist/config.js

@@ -4,50 +4,80 @@
  * All configuration is read from the OpenClaw plugin config system
  * (openclaw.plugin.json or runtime config).
  */
-/** Validate plugin config and return defaults. */
+const COMMUNITY_SAAS_DEFAULT_ENDPOINT = "https://try.getaxonflow.com";
+/**
+ * Validate plugin config and return defaults.
+ *
+ * Resolution order (ADR-048):
+ *   1. If the user provided ANY of endpoint, clientId, clientSecret → mode is
+ *      "self-hosted". Defaults are filled in: endpoint defaults to localhost,
+ *      clientId defaults to "community", clientSecret stays empty (community
+ *      mode). The user's explicit values are honoured untouched.
+ *   2. If the user provided NONE → mode is "community-saas". Endpoint
+ *      defaults to https://try.getaxonflow.com. clientId/clientSecret stay
+ *      EMPTY here — the caller (registerAxonFlowGovernance) is expected to
+ *      bootstrap the registration via community-saas-bootstrap.ts and
+ *      override clientId/clientSecret on the resulting client.
+ */
 export function resolveConfig(raw) {
-    if (!raw) {
-        throw new Error("AxonFlow plugin requires configuration. Set endpoint, clientId, and clientSecret in your OpenClaw plugin config.");
-    }
-    const endpoint = raw["endpoint"];
-    if (typeof endpoint !== "string" || !endpoint) {
-        throw new Error("AxonFlow plugin: 'endpoint' is required (e.g., 'http://localhost:8080')");
-    }
-    // Defaults match SDK behavior: community mode works out of the box.
-    // Override with your evaluation/enterprise license credentials.
-    const rawClientId = typeof raw["clientId"] === "string" ? raw["clientId"] : "";
-    const rawClientSecret = typeof raw["clientSecret"] === "string" ? raw["clientSecret"] : "";
-    // Reject clientSecret without clientId — licensed mode must specify the tenant
+    const safe = raw ?? {};
+    const rawEndpoint = typeof safe["endpoint"] === "string" ? safe["endpoint"].trim() : "";
+    const rawClientId = typeof safe["clientId"] === "string" ? safe["clientId"].trim() : "";
+    const rawClientSecret = typeof safe["clientSecret"] === "string" ? safe["clientSecret"].trim() : "";
+    // Reject clientSecret without clientId regardless of mode — licensed
+    // setups must specify the tenant identity.
     if (!rawClientId && rawClientSecret) {
         throw new Error("AxonFlow plugin: 'clientId' is required when 'clientSecret' is set. " +
             "Set clientId to your tenant identity (e.g., your deployment's AXONFLOW_CLIENT_ID).");
     }
-    const clientId = rawClientId || "community";
-    const clientSecret = rawClientSecret;
+    const userProvidedAnything = rawEndpoint !== "" || rawClientId !== "" || rawClientSecret !== "";
+    let endpoint;
+    let clientId;
+    let clientSecret;
+    let mode;
+    if (userProvidedAnything) {
+        mode = "self-hosted";
+        // Endpoint default for self-hosted users who set credentials but not
+        // endpoint: assume the canonical local-agent URL. Matches the bash
+        // plugins' resolution rule.
+        endpoint = rawEndpoint || "http://localhost:8080";
+        clientId = rawClientId || "community";
+        clientSecret = rawClientSecret;
+    }
+    else {
+        mode = "community-saas";
+        endpoint = COMMUNITY_SAAS_DEFAULT_ENDPOINT;
+        // Bootstrap will fill these in. We deliberately leave them empty here
+        // so a misconfigured caller that skips the bootstrap step gets a clear
+        // 401 from the agent rather than a half-credentialled request.
+        clientId = "";
+        clientSecret = "";
+    }
     return {
         endpoint,
         clientId,
         clientSecret,
-        userEmail: typeof raw["userEmail"] === "string" && raw["userEmail"].trim()
-            ? raw["userEmail"].trim()
+        mode,
+        userEmail: typeof safe["userEmail"] === "string" && safe["userEmail"].trim()
+            ? safe["userEmail"].trim()
             : undefined,
-        highRiskTools: Array.isArray(raw["highRiskTools"])
-            ? raw["highRiskTools"]
+        highRiskTools: Array.isArray(safe["highRiskTools"])
+            ? safe["highRiskTools"]
             : [],
-        governedTools: Array.isArray(raw["governedTools"])
-            ? raw["governedTools"]
+        governedTools: Array.isArray(safe["governedTools"])
+            ? safe["governedTools"]
             : [],
-        excludedTools: Array.isArray(raw["excludedTools"])
-            ? raw["excludedTools"]
+        excludedTools: Array.isArray(safe["excludedTools"])
+            ? safe["excludedTools"]
             : [],
-        defaultOperation: typeof raw["defaultOperation"] === "string"
-            ? raw["defaultOperation"]
+        defaultOperation: typeof safe["defaultOperation"] === "string"
+            ? safe["defaultOperation"]
             : "execute",
-        onError: raw["onError"] === "allow" ? "allow" : "block",
-        requestTimeoutMs: typeof raw["requestTimeoutMs"] === "number" &&
-            Number.isFinite(raw["requestTimeoutMs"]) &&
-            raw["requestTimeoutMs"] > 0
-            ? raw["requestTimeoutMs"]
+        onError: safe["onError"] === "allow" ? "allow" : "block",
+        requestTimeoutMs: typeof safe["requestTimeoutMs"] === "number" &&
+            Number.isFinite(safe["requestTimeoutMs"]) &&
+            safe["requestTimeoutMs"] > 0
+            ? safe["requestTimeoutMs"]
             : 8000,
     };
 }

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAyEH,kDAAkD;AAClD,MAAM,UAAU,aAAa,CAC3B,GAAwC;IAExC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;IACjC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,QAAQ,EAAE,CAAC;QAC9C,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IAC7F,CAAC;IAED,oEAAoE;IACpE,gEAAgE;IAChE,MAAM,WAAW,GAAG,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/E,MAAM,eAAe,GAAG,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3F,+EAA+E;IAC/E,IAAI,CAAC,WAAW,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACtE,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,IAAI,WAAW,CAAC;IAC5C,MAAM,YAAY,GAAG,eAAe,CAAC;IAErC,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,YAAY;QACZ,SAAS,EACP,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE;YAC7D,CAAC,CAAE,GAAG,CAAC,WAAW,CAAY,CAAC,IAAI,EAAE;YACrC,CAAC,CAAC,SAAS;QACf,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChD,CAAC,CAAE,GAAG,CAAC,eAAe,CAAc;YACpC,CAAC,CAAC,EAAE;QACN,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChD,CAAC,CAAE,GAAG,CAAC,eAAe,CAAc;YACpC,CAAC,CAAC,EAAE;QACN,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC;YAChD,CAAC,CAAE,GAAG,CAAC,eAAe,CAAc;YACpC,CAAC,CAAC,EAAE;QACN,gBAAgB,EACd,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ;YACzC,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACzB,CAAC,CAAC,SAAS;QACf,OAAO,EACL,GAAG,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QAChD,gBAAgB,EACd,OAAO,GAAG,CAAC,kBAAkB,CAAC,KAAK,QAAQ;YAC3C,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;YACxC,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC;YACzB,CAAC,CAAC,GAAG,CAAC,kBAAkB,CAAC;YACzB,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAA4B;IAE5B,iCAAiC;IACjC,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,yDAAyD;IACzD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,4BAA4B;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAsFH,MAAM,+BAA+B,GAAG,6BAA6B,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAC3B,GAAwC;IAExC,MAAM,IAAI,GAAG,GAAG,IAAI,EAAE,CAAC;IAEvB,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,UAAU,CAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,WAAW,GAAG,OAAO,IAAI,CAAC,UAAU,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,UAAU,CAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACpG,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,IAAI,CAAC,cAAc,CAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IAEhH,qEAAqE;IACrE,2CAA2C;IAC3C,IAAI,CAAC,WAAW,IAAI,eAAe,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CACb,sEAAsE;YACtE,oFAAoF,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,oBAAoB,GACxB,WAAW,KAAK,EAAE,IAAI,WAAW,KAAK,EAAE,IAAI,eAAe,KAAK,EAAE,CAAC;IAErE,IAAI,QAAgB,CAAC;IACrB,IAAI,QAAgB,CAAC;IACrB,IAAI,YAAoB,CAAC;IACzB,IAAI,IAAsC,CAAC;IAE3C,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,GAAG,aAAa,CAAC;QACrB,qEAAqE;QACrE,mEAAmE;QACnE,4BAA4B;QAC5B,QAAQ,GAAG,WAAW,IAAI,uBAAuB,CAAC;QAClD,QAAQ,GAAG,WAAW,IAAI,WAAW,CAAC;QACtC,YAAY,GAAG,eAAe,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,IAAI,GAAG,gBAAgB,CAAC;QACxB,QAAQ,GAAG,+BAA+B,CAAC;QAC3C,sEAAsE;QACtE,uEAAuE;QACvE,+DAA+D;QAC/D,QAAQ,GAAG,EAAE,CAAC;QACd,YAAY,GAAG,EAAE,CAAC;IACpB,CAAC;IAED,OAAO;QACL,QAAQ;QACR,QAAQ;QACR,YAAY;QACZ,IAAI;QACJ,SAAS,EACP,OAAO,IAAI,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAK,IAAI,CAAC,WAAW,CAAY,CAAC,IAAI,EAAE;YAC3E,CAAC,CAAE,IAAI,CAAC,WAAW,CAAY,CAAC,IAAI,EAAE;YACtC,CAAC,CAAC,SAAS;QACf,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACjD,CAAC,CAAE,IAAI,CAAC,eAAe,CAAc;YACrC,CAAC,CAAC,EAAE;QACN,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACjD,CAAC,CAAE,IAAI,CAAC,eAAe,CAAc;YACrC,CAAC,CAAC,EAAE;QACN,aAAa,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;YACjD,CAAC,CAAE,IAAI,CAAC,eAAe,CAAc;YACrC,CAAC,CAAC,EAAE;QACN,gBAAgB,EACd,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,QAAQ;YAC1C,CAAC,CAAE,IAAI,CAAC,kBAAkB,CAAY;YACtC,CAAC,CAAC,SAAS;QACf,OAAO,EACL,IAAI,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO;QACjD,gBAAgB,EACd,OAAO,IAAI,CAAC,kBAAkB,CAAC,KAAK,QAAQ;YAC5C,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YACxC,IAAI,CAAC,kBAAkB,CAAY,GAAG,CAAC;YACtC,CAAC,CAAE,IAAI,CAAC,kBAAkB,CAAY;YACtC,CAAC,CAAC,IAAI;KACX,CAAC;AACJ,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAA4B;IAE5B,iCAAiC;IACjC,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,yDAAyD;IACzD,IAAI,MAAM,CAAC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,OAAO,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACjD,CAAC;IACD,4BAA4B;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/governance.d.ts

@@ -4,7 +4,8 @@
  * Evaluates tool arguments against AxonFlow policies before execution.
  * Can block the call, require human approval, or allow through.
  */
-import type { AxonFlowClient, MCPCheckInputResponse } from "./axonflow-client.js";
+import type { MCPCheckInputResponse } from "./axonflow-client.js";
+import type { ClientRef } from "./client-ref.js";
 import type { AxonFlowPluginConfig } from "./config.js";
 /** Result type matching OpenClaw's PluginHookBeforeToolCallResult. */
 export interface BeforeToolCallResult {
@@ -63,7 +64,7 @@ export declare function isAxonFlowAuthError(err: unknown): boolean;
  * 4. If tool is in highRiskTools AND allowed: return { requireApproval }
  * 5. Otherwise: allow through
  */
-export declare function createBeforeToolCallHandler(client: AxonFlowClient, config: AxonFlowPluginConfig): (event: {
+export declare function createBeforeToolCallHandler(clientRef: ClientRef, config: AxonFlowPluginConfig): (event: {
     toolName: string;
     params: Record<string, unknown>;
     runId?: string;

package/dist/governance.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,qBAAqB,EACtB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAUxD,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;QAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KACpC,CAAC;CACH;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAgBxE;AAoCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAazD;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,cAAc,EACtB,MAAM,EAAE,oBAAoB,IAEd,OAAO;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,KAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAoF9C"}
+{"version":3,"file":"governance.d.ts","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AAUxD,sEAAsE;AACtE,MAAM,WAAW,oBAAoB;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE;QAChB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,GAAG,UAAU,CAAC;QAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,eAAe,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;KACpC,CAAC;CACH;AAED,2EAA2E;AAC3E,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,qBAAqB,GAAG,MAAM,CAgBxE;AAoCD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,OAAO,CAazD;AAED;;;;;;;;;GASG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,SAAS,EACpB,MAAM,EAAE,oBAAoB,IAEd,OAAO;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAChC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,KAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAoF9C"}

package/dist/governance.js

@@ -113,7 +113,7 @@ export function isAxonFlowAuthError(err) {
  * 4. If tool is in highRiskTools AND allowed: return { requireApproval }
  * 5. Otherwise: allow through
  */
-export function createBeforeToolCallHandler(client, config) {
+export function createBeforeToolCallHandler(clientRef, config) {
     return async (event) => {
         if (!shouldGovernTool(event.toolName, config)) {
             return undefined;
@@ -123,7 +123,7 @@ export function createBeforeToolCallHandler(client, config) {
         const statement = JSON.stringify(event.params);
         let check;
         try {
-            check = await client.mcpCheckInput(connectorType, statement, config.defaultOperation ?? "execute");
+            check = await clientRef.current.mcpCheckInput(connectorType, statement, config.defaultOperation ?? "execute");
         }
         catch (err) {
             recordGovernanceError();

package/dist/governance.js.map

@@ -1 +1 @@
-{"version":3,"file":"governance.js","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAOH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAgBtB,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,YAAY,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA4B;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC;IACE,WAAW;IACX,WAAW;IACX,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,qCAAqC;IACrC,sCAAsC;IACtC,0BAA0B;CAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,EACX,GAAG,CACJ,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAElD,gDAAgD;IAChD,MAAM,WAAW,GACd,GAAgD,CAAC,MAAM;QACvD,GAAgD,CAAC,UAAU,CAAC;IAC/D,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE5D,8DAA8D;IAC9D,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,MAAsB,EACtB,MAA4B;IAE5B,OAAO,KAAK,EAAE,KAKb,EAA6C,EAAE;QAC9C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,uBAAuB,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,MAAM,CAAC,aAAa,CAChC,aAAa,EACb,SAAS,EACT,MAAM,CAAC,gBAAgB,IAAI,SAAS,CACrC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qBAAqB,EAAE,CAAC;YAExB,qEAAqE;YACrE,gEAAgE;YAChE,gEAAgE;YAChE,oEAAoE;YACpE,sEAAsE;YACtE,8DAA8D;YAC9D,+BAA+B;YAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,qBAAqB,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC,CAAC,qCAAqC;YACzD,CAAC;YAED,mEAAmE;YACnE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,qBAAqB,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,qBAAqB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,6CAA6C;aACvI,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,qBAAqB,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,IAAI,4BAA4B,CAAC;YACtE,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC;aACrD,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IACE,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7C,CAAC;YACD,8BAA8B,EAAE,CAAC;YACjC,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,QAAQ,GAAoC,SAAS,CAAC;YAC1D,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBACnE,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;gBACtC,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;YACD,OAAO;gBACL,eAAe,EAAE;oBACf,KAAK,EAAE,aAAa,KAAK,CAAC,QAAQ,oBAAoB;oBACtD,WAAW,EACT,mCAAmC,KAAK,CAAC,kBAAkB,sBAAsB;wBACjF,mBAAmB,CAAC,KAAK,CAAC;oBAC5B,QAAQ;oBACR,SAAS,EAAE,MAAM;oBACjB,eAAe,EAAE,MAAM;iBACxB;aACF,CAAC;QACJ,CAAC;QAED,qBAAqB,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}
+{"version":3,"file":"governance.js","sourceRoot":"","sources":["../src/governance.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EACL,uBAAuB,EACvB,qBAAqB,EACrB,8BAA8B,EAC9B,qBAAqB,EACrB,qBAAqB,GACtB,MAAM,cAAc,CAAC;AAgBtB,2EAA2E;AAC3E,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,YAAY,QAAQ,EAAE,CAAC;AAChC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAA4B;IAC9D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,WAAW;QAAE,KAAK,CAAC,IAAI,CAAC,aAAa,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACpE,IAAI,KAAK,CAAC,UAAU;QAAE,KAAK,CAAC,IAAI,CAAC,SAAS,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC9D,IAAI,KAAK,CAAC,cAAc,IAAI,KAAK,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5D,MAAM,KAAK,GAAG,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;QACtC,IAAI,KAAK,EAAE,WAAW;YAAE,KAAK,CAAC,IAAI,CAAC,WAAW,KAAK,CAAC,WAAW,EAAE,CAAC,CAAC;IACrE,CAAC;IACD,IAAI,KAAK,CAAC,kBAAkB,KAAK,IAAI,EAAE,CAAC;QACtC,IAAI,KAAK,CAAC,oBAAoB,EAAE,CAAC;YAC/B,KAAK,CAAC,IAAI,CAAC,oBAAoB,KAAK,CAAC,oBAAoB,EAAE,CAAC,CAAC;QAC/D,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,IAAI,CAAC,kDAAkD,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,kBAAkB,GAAG,IAAI,MAAM,CACnC;IACE,WAAW;IACX,WAAW;IACX,oBAAoB;IACpB,iBAAiB;IACjB,oBAAoB;IACpB,qCAAqC;IACrC,sCAAsC;IACtC,0BAA0B;CAC3B,CAAC,IAAI,CAAC,GAAG,CAAC,EACX,GAAG,CACJ,CAAC;AAEF;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAElD,gDAAgD;IAChD,MAAM,WAAW,GACd,GAAgD,CAAC,MAAM;QACvD,GAAgD,CAAC,UAAU,CAAC;IAC/D,IAAI,WAAW,KAAK,GAAG,IAAI,WAAW,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAE5D,8DAA8D;IAC9D,MAAM,OAAO,GACX,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACnD,OAAO,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAoB,EACpB,MAA4B;IAE5B,OAAO,KAAK,EAAE,KAKb,EAA6C,EAAE;QAC9C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC9C,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,uBAAuB,EAAE,CAAC;QAC1B,MAAM,aAAa,GAAG,mBAAmB,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAC1D,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC;QACV,IAAI,CAAC;YACH,KAAK,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,aAAa,CAC3C,aAAa,EACb,SAAS,EACT,MAAM,CAAC,gBAAgB,IAAI,SAAS,CACrC,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qBAAqB,EAAE,CAAC;YAExB,qEAAqE;YACrE,gEAAgE;YAChE,gEAAgE;YAChE,oEAAoE;YACpE,sEAAsE;YACtE,8DAA8D;YAC9D,+BAA+B;YAC/B,MAAM,WAAW,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YAC7C,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,qBAAqB,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC,CAAC,qCAAqC;YACzD,CAAC;YAED,mEAAmE;YACnE,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBAC/B,qBAAqB,EAAE,CAAC;gBACxB,OAAO,SAAS,CAAC;YACnB,CAAC;YACD,qBAAqB,EAAE,CAAC;YACxB,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,wBAAwB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,6CAA6C;aACvI,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YACnB,qBAAqB,EAAE,CAAC;YACxB,MAAM,UAAU,GAAG,KAAK,CAAC,YAAY,IAAI,4BAA4B,CAAC;YACtE,OAAO;gBACL,KAAK,EAAE,IAAI;gBACX,WAAW,EAAE,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC;aACrD,CAAC;QACJ,CAAC;QAED,uDAAuD;QACvD,IACE,MAAM,CAAC,aAAa;YACpB,MAAM,CAAC,aAAa,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,EAC7C,CAAC;YACD,8BAA8B,EAAE,CAAC;YACjC,mEAAmE;YACnE,uEAAuE;YACvE,wEAAwE;YACxE,IAAI,QAAQ,GAAoC,SAAS,CAAC;YAC1D,IAAI,KAAK,CAAC,UAAU,KAAK,UAAU,IAAI,KAAK,CAAC,UAAU,KAAK,MAAM,EAAE,CAAC;gBACnE,QAAQ,GAAG,UAAU,CAAC;YACxB,CAAC;iBAAM,IAAI,KAAK,CAAC,UAAU,KAAK,KAAK,EAAE,CAAC;gBACtC,QAAQ,GAAG,MAAM,CAAC;YACpB,CAAC;YACD,OAAO;gBACL,eAAe,EAAE;oBACf,KAAK,EAAE,aAAa,KAAK,CAAC,QAAQ,oBAAoB;oBACtD,WAAW,EACT,mCAAmC,KAAK,CAAC,kBAAkB,sBAAsB;wBACjF,mBAAmB,CAAC,KAAK,CAAC;oBAC5B,QAAQ;oBACR,SAAS,EAAE,MAAM;oBACjB,eAAe,EAAE,MAAM;iBACxB;aACF,CAAC;QACJ,CAAC;QAED,qBAAqB,EAAE,CAAC;QACxB,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -31,7 +31,7 @@
  * for async hook support.
  */
 /** Plugin version — update before each release. */
-export declare const VERSION = "1.3.1";
+export declare const VERSION = "2.0.0";
 export { AxonFlowClient } from "./axonflow-client.js";
 export type { AxonFlowPluginConfig } from "./config.js";
 export { resolveConfig, shouldGovernTool } from "./config.js";

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAWH,mDAAmD;AACnD,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACpG,EAAE,EAAE,CACF,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAChC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KACzB,IAAI,CAAC;CACX,GAAG,IAAI,CAwDP;AAED;;;;;;GAMG;;;;;;;AACH,wBAKE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAiBH,mDAAmD;AACnD,eAAO,MAAM,OAAO,UAAU,CAAC;AAG/B,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,YAAY,EAAE,oBAAoB,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AACtD,OAAO,EAAE,UAAU,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAElE;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE;IAC9C,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,MAAM,EAAE;QAAE,IAAI,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,KAAK,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;QAAC,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAE,CAAC;IACpG,EAAE,EAAE,CACF,QAAQ,EAAE,MAAM,EAChB,OAAO,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,EAChC,IAAI,CAAC,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,KACzB,IAAI,CAAC;CACX,GAAG,IAAI,CAyHP;AA4CD;;;;;;GAMG;;;;;;;AACH,wBAKE"}