@sekuire/sdk 0.1.10 → 0.1.11

package/dist/index.esm.js

@@ -78,6 +78,10 @@ function detectDeploymentUrl() {
  *
  * Automatically registers the agent with Sekuire and sends periodic heartbeats
  * to show online status in the Dashboard.
+ *
+ * Supports two authentication modes:
+ * 1. Install Token (recommended): Use an install token from the dashboard
+ * 2. API Key: Use an API key for SDK-initiated bootstrap (requires workspace)
  */
 // ============================================================================
 // Beacon Class
@@ -86,16 +90,21 @@ class Beacon {
     constructor(config) {
         this.intervalId = null;
         this.installationId = null;
+        this.runtimeToken = null;
+        this.refreshToken = null;
         this.lastHeartbeat = null;
         this.failedHeartbeats = 0;
         const resolvedApiKey = config.apiKey || this.getApiKey() || '';
+        const resolvedInstallToken = config.installToken || this.getInstallToken();
         this.config = {
             ...config,
-            heartbeatIntervalMs: config.heartbeatIntervalMs ?? 60000, // 60 seconds
+            heartbeatIntervalSeconds: config.heartbeatIntervalSeconds ?? 60,
             apiKey: resolvedApiKey,
+            installToken: resolvedInstallToken,
+            capabilities: config.capabilities ?? [],
         };
-        if (!this.config.apiKey) {
-            console.warn('[Beacon] No API key provided. Set SEKUIRE_API_KEY environment variable.');
+        if (!this.config.installToken && !this.config.apiKey) {
+            console.warn('[Beacon] No install token or API key provided. Set SEKUIRE_INSTALL_TOKEN or SEKUIRE_API_KEY.');
         }
     }
     /**
@@ -111,22 +120,27 @@ class Beacon {
         if (deploymentUrl) {
             console.log(`[Beacon] Deployment URL: ${deploymentUrl}`);
         }
-        // Bootstrap registration
+        // Bootstrap registration (exchanges install token for runtime credentials)
         try {
             await this.bootstrap(deploymentUrl);
+            console.log(`[Beacon] Bootstrap successful, installation ID: ${this.installationId}`);
         }
         catch (error) {
             console.error('[Beacon] Bootstrap failed:', error);
-            // Continue anyway - heartbeat will retry registration
+            this.notifyStatusChange();
+            // Cannot continue without bootstrap - runtime token required for heartbeats
+            throw error;
         }
         // Start heartbeat loop
+        const intervalMs = this.config.heartbeatIntervalSeconds * 1000;
         this.intervalId = setInterval(() => {
             this.heartbeat().catch((err) => {
                 console.error('[Beacon] Heartbeat failed:', err);
             });
-        }, this.config.heartbeatIntervalMs);
+        }, intervalMs);
         // Send first heartbeat immediately
         await this.heartbeat().catch(() => { });
+        this.notifyStatusChange();
     }
     /**
      * Stop the beacon
@@ -145,6 +159,7 @@ class Beacon {
         return {
             isRunning: this.intervalId !== null,
             installationId: this.installationId || undefined,
+            runtimeToken: this.runtimeToken ? '***' + this.runtimeToken.slice(-4) : undefined,
             deploymentUrl: this.config.deploymentUrl || detectDeploymentUrl(),
             lastHeartbeat: this.lastHeartbeat || undefined,
             failedHeartbeats: this.failedHeartbeats,
@@ -152,72 +167,116 @@ class Beacon {
     }
     /**
      * Bootstrap registration with Sekuire
+     *
+     * Exchanges an install token for runtime credentials (installation_id + runtime_token).
+     * The install token is obtained from the dashboard or CLI.
      */
     async bootstrap(deploymentUrl) {
-        if (!this.config.apiKey) {
-            throw new Error('API key required for beacon registration');
+        if (!this.config.installToken) {
+            throw new Error('Install token required for beacon registration. ' +
+                'Generate one from the dashboard or use: sekuire install token --workspace <id>');
         }
         const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/bootstrap`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
-                'X-API-Key': this.config.apiKey,
             },
             body: JSON.stringify({
-                agent_id: this.config.agentId,
+                install_token: this.config.installToken,
                 upstream_url: deploymentUrl,
+                capabilities: this.config.capabilities ?? [],
+                heartbeat_interval_seconds: this.config.heartbeatIntervalSeconds,
             }),
         });
         if (!response.ok) {
-            throw new Error(`Bootstrap failed: ${response.status} ${response.statusText}`);
+            const body = await response.text();
+            throw new Error(`Bootstrap failed: ${response.status} ${response.statusText} - ${body}`);
         }
         const data = await response.json();
         this.installationId = data.installation_id;
-        console.log(`[Beacon] Registered with installation ID: ${this.installationId}`);
+        this.runtimeToken = data.runtime_token;
+        this.refreshToken = data.refresh_token;
     }
     /**
-     * Send heartbeat to Sekuire
+     * Send heartbeat (lease renewal) to Sekuire
+     *
+     * Uses the installation-based lease endpoint with runtime token authentication.
      */
     async heartbeat() {
-        if (!this.config.apiKey) {
+        if (!this.installationId || !this.runtimeToken) {
+            console.warn('[Beacon] Cannot send heartbeat - not bootstrapped');
             return;
         }
         const deploymentUrl = this.config.deploymentUrl || detectDeploymentUrl();
         const prevFailed = this.failedHeartbeats;
         try {
-            const payload = this.config.onHeartbeat
-                ? await this.config.onHeartbeat(deploymentUrl)
-                : {
-                    agent_id: this.config.agentId,
-                    status: 'running',
-                    public_url: deploymentUrl,
-                    load: 0.0,
-                };
-            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/agents/heartbeat`, {
+            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/lease`, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
-                    'X-API-Key': this.config.apiKey,
+                    'Authorization': `Bearer ${this.runtimeToken}`,
                 },
-                body: JSON.stringify(payload),
+                body: JSON.stringify({
+                    status: 'running',
+                    heartbeat_interval_seconds: this.config.heartbeatIntervalSeconds,
+                    upstream_url: deploymentUrl,
+                }),
             });
+            if (response.status === 401) {
+                // Token expired - try to refresh
+                console.warn('[Beacon] Runtime token expired, attempting refresh...');
+                await this.refreshRuntimeToken();
+                // Retry heartbeat after refresh
+                return this.heartbeat();
+            }
             if (!response.ok) {
-                throw new Error(`Heartbeat failed: ${response.status}`);
+                const body = await response.text();
+                throw new Error(`Heartbeat failed: ${response.status} - ${body}`);
             }
             this.lastHeartbeat = new Date();
             this.failedHeartbeats = 0;
-            if (prevFailed > 0 && this.config.onStatusChange) {
-                this.config.onStatusChange(this.getStatus());
+            if (prevFailed > 0) {
+                this.notifyStatusChange();
             }
         }
         catch (error) {
             this.failedHeartbeats++;
-            if (this.config.onStatusChange) {
-                this.config.onStatusChange(this.getStatus());
-            }
+            this.notifyStatusChange();
             throw error;
         }
     }
+    /**
+     * Refresh the runtime token using the refresh token
+     */
+    async refreshRuntimeToken() {
+        if (!this.installationId || !this.refreshToken) {
+            throw new Error('Cannot refresh token - missing installation ID or refresh token');
+        }
+        const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/refresh`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({
+                refresh_token: this.refreshToken,
+            }),
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Token refresh failed: ${response.status} - ${body}`);
+        }
+        const data = await response.json();
+        this.runtimeToken = data.runtime_token;
+        console.log('[Beacon] Runtime token refreshed successfully');
+    }
+    /**
+     * Notify status change callback
+     */
+    notifyStatusChange() {
+        if (this.config.onStatusChange) {
+            this.config.onStatusChange(this.getStatus());
+        }
+    }
     /**
      * Get API key from environment
      */
@@ -227,6 +286,15 @@ class Beacon {
         }
         return undefined;
     }
+    /**
+     * Get install token from environment
+     */
+    getInstallToken() {
+        if (typeof process !== 'undefined' && process.env) {
+            return process.env.SEKUIRE_INSTALL_TOKEN;
+        }
+        return undefined;
+    }
 }
 // ============================================================================
 // Convenience Export
@@ -730,17 +798,20 @@ class SekuireSDK {
             throw new Error("agentId is required");
         }
         const apiKey = config.apiKey || process.env.SEKUIRE_API_KEY;
+        const installToken = config.installToken || process.env.SEKUIRE_INSTALL_TOKEN;
         this.config = {
             privateKey: config.privateKey,
             apiKey,
+            installToken,
             agentId: config.agentId,
             agentName: config.agentName ?? "Unknown",
             apiUrl: (config.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, ""),
             workspaceId: config.workspaceId ?? "",
             environment: config.environment ?? "production",
             autoHeartbeat: config.autoHeartbeat !== false,
-            heartbeatInterval: config.heartbeatInterval ?? 60000,
+            heartbeatIntervalSeconds: config.heartbeatIntervalSeconds ?? 60,
             loggingEnabled: config.loggingEnabled !== false,
+            capabilities: config.capabilities ?? [],
         };
         this.identity = new AgentIdentity(this.config.agentName, this.config.agentId, this.config.privateKey);
         const loggerConfig = {
@@ -759,22 +830,12 @@ class SekuireSDK {
         });
         this.beacon = new Beacon({
             apiBaseUrl: this.config.apiUrl,
+            installToken: this.config.installToken,
             apiKey: this.config.apiKey,
             agentId: this.config.agentId,
-            heartbeatIntervalMs: this.config.heartbeatInterval,
-            onHeartbeat: this.config.privateKey
-                ? async (deploymentUrl) => {
-                    const timestamp = Math.floor(Date.now() / 1000);
-                    const message = `${this.config.agentId}|${deploymentUrl ?? ""}|${timestamp}`;
-                    const signature = await this.identity.sign(message);
-                    return {
-                        sekuire_id: this.config.agentId,
-                        url: deploymentUrl ?? null,
-                        timestamp,
-                        signature,
-                    };
-                }
-                : undefined,
+            workspaceId: this.config.workspaceId || undefined,
+            heartbeatIntervalSeconds: this.config.heartbeatIntervalSeconds,
+            capabilities: this.config.capabilities,
         });
     }
     /**
@@ -782,10 +843,11 @@ class SekuireSDK {
      *
      * Required env vars:
      *   SEKUIRE_AGENT_ID - The agent's sekuire_id
+     *   SEKUIRE_INSTALL_TOKEN - Install token from dashboard (required for heartbeat)
      *
      * Optional env vars:
      *   SEKUIRE_API_KEY - API key for authentication (X-API-Key header)
-     *   SEKUIRE_PRIVATE_KEY - Private key for signing (required for heartbeat)
+     *   SEKUIRE_PRIVATE_KEY - Private key for signing
      *   SEKUIRE_AGENT_NAME - Human-readable agent name
      *   SEKUIRE_API_URL - API base URL (default: https://api.sekuire.ai)
      *   SEKUIRE_WORKSPACE_ID - Workspace ID for policy enforcement
@@ -799,6 +861,7 @@ class SekuireSDK {
         return new SekuireSDK({
             privateKey: process.env.SEKUIRE_PRIVATE_KEY,
             apiKey: process.env.SEKUIRE_API_KEY,
+            installToken: process.env.SEKUIRE_INSTALL_TOKEN,
             agentId,
             agentName: process.env.SEKUIRE_AGENT_NAME,
             apiUrl: process.env.SEKUIRE_API_URL ?? DEFAULT_API_URL,
@@ -811,46 +874,32 @@ class SekuireSDK {
     /**
      * Start the SDK.
      *
-     * - Sends initial heartbeat
+     * - Bootstraps with Sekuire using the install token
      * - Starts auto-heartbeat loop if enabled
+     *
+     * Requires SEKUIRE_INSTALL_TOKEN to be set (from dashboard or CLI).
      */
     async start() {
         if (this.isRunning) {
             return;
         }
         this.isRunning = true;
-        if (this.config.autoHeartbeat && (this.config.privateKey || this.config.apiKey)) {
+        if (this.config.autoHeartbeat && this.config.installToken) {
             await this.beacon.start();
         }
+        else if (this.config.autoHeartbeat && !this.config.installToken) {
+            console.warn("[SekuireSDK] Auto-heartbeat enabled but no install token provided. " +
+                "Set SEKUIRE_INSTALL_TOKEN or generate one from the dashboard.");
+        }
     }
     /**
-     * Send a signed heartbeat to the registry.
-     *
-     * The heartbeat proves the agent is running and has access to the private key.
+     * Check if the beacon is connected and sending heartbeats.
      *
-     * @param url Optional public URL where the agent can be reached
-     * @returns True if heartbeat was acknowledged, False otherwise
+     * @returns True if the beacon has successfully bootstrapped
      */
-    async heartbeat(url) {
-        if (!this.config.privateKey) {
-            return false;
-        }
-        const timestamp = Math.floor(Date.now() / 1000);
-        const message = `${this.config.agentId}|${url ?? ""}|${timestamp}`;
-        const signature = await this.identity.sign(message);
-        const payload = {
-            sekuire_id: this.config.agentId,
-            url: url ?? null,
-            timestamp,
-            signature,
-        };
-        try {
-            const response = await this.client.post("/api/v1/agents/heartbeat", payload);
-            return response.status === 200;
-        }
-        catch {
-            return false;
-        }
+    isConnected() {
+        const status = this.beacon.getStatus();
+        return status.isRunning && !!status.installationId;
     }
     /**
      * Log an event to Sekuire.
@@ -3070,12 +3119,25 @@ const llm = {
 };
 
 class BaseMemoryStorage {
+    constructor() {
+        this._connected = false;
+    }
+    async connect() {
+        this._connected = true;
+    }
+    async disconnect() {
+        this._connected = false;
+    }
+    isConnected() {
+        return this._connected;
+    }
 }
 
 class InMemoryStorage extends BaseMemoryStorage {
     constructor() {
-        super(...arguments);
+        super();
         this.storage = new Map();
+        this._connected = true;
     }
     async add(sessionId, message) {
         if (!this.storage.has(sessionId)) {
@@ -3104,32 +3166,49 @@ class InMemoryStorage extends BaseMemoryStorage {
 class PostgresStorage extends BaseMemoryStorage {
     constructor(config) {
         super();
-        this.initialized = false;
+        this.connectionPromise = null;
         this.tableName = config.tableName || 'sekuire_memory';
-        this.initPool(config);
+        this.config = config;
+        if (!config.lazyConnect) {
+            this.connectionPromise = this.connect();
+        }
+    }
+    async connect() {
+        if (this._connected)
+            return;
+        if (this.connectionPromise)
+            return this.connectionPromise;
+        this.connectionPromise = this.initPool();
+        return this.connectionPromise;
     }
-    async initPool(config) {
+    async initPool() {
         try {
             const { Pool } = await import('pg');
-            if (config.connectionString) {
-                this.pool = new Pool({ connectionString: config.connectionString });
+            if (this.config.connectionString) {
+                this.pool = new Pool({ connectionString: this.config.connectionString });
             }
             else {
                 this.pool = new Pool({
-                    host: config.host || 'localhost',
-                    port: config.port || 5432,
-                    database: config.database,
-                    user: config.user,
-                    password: config.password,
+                    host: this.config.host || 'localhost',
+                    port: this.config.port || 5432,
+                    database: this.config.database,
+                    user: this.config.user,
+                    password: this.config.password,
                 });
             }
             await this.createTableIfNotExists();
-            this.initialized = true;
+            this._connected = true;
         }
         catch (error) {
+            this.connectionPromise = null;
             throw new Error(`Failed to initialize Postgres: ${error}`);
         }
     }
+    async ensureConnected() {
+        if (!this._connected) {
+            await this.connect();
+        }
+    }
     async createTableIfNotExists() {
         const query = `
       CREATE TABLE IF NOT EXISTS ${this.tableName} (
@@ -3146,8 +3225,7 @@ class PostgresStorage extends BaseMemoryStorage {
         await this.pool.query(query);
     }
     async add(sessionId, message) {
-        if (!this.initialized)
-            throw new Error('Postgres not initialized');
+        await this.ensureConnected();
         const query = `
       INSERT INTO ${this.tableName} (session_id, role, content, timestamp, metadata)
       VALUES ($1, $2, $3, $4, $5)
@@ -3161,8 +3239,7 @@ class PostgresStorage extends BaseMemoryStorage {
         ]);
     }
     async get(sessionId, limit) {
-        if (!this.initialized)
-            throw new Error('Postgres not initialized');
+        await this.ensureConnected();
         let query = `
       SELECT role, content, timestamp, metadata
       FROM ${this.tableName}
@@ -3181,8 +3258,7 @@ class PostgresStorage extends BaseMemoryStorage {
         }));
     }
     async clear(sessionId) {
-        if (!this.initialized)
-            throw new Error('Postgres not initialized');
+        await this.ensureConnected();
         const query = `DELETE FROM ${this.tableName} WHERE session_id = $1`;
         await this.pool.query(query, [sessionId]);
     }
@@ -3190,16 +3266,16 @@ class PostgresStorage extends BaseMemoryStorage {
         await this.clear(sessionId);
     }
     async exists(sessionId) {
-        if (!this.initialized)
-            throw new Error('Postgres not initialized');
+        await this.ensureConnected();
         const query = `SELECT COUNT(*) FROM ${this.tableName} WHERE session_id = $1`;
         const result = await this.pool.query(query, [sessionId]);
         return parseInt(result.rows[0].count) > 0;
     }
     async disconnect() {
-        if (this.initialized) {
+        if (this._connected && this.pool) {
             await this.pool.end();
-            this.initialized = false;
+            this._connected = false;
+            this.connectionPromise = null;
         }
     }
 }
@@ -3208,56 +3284,70 @@ class RedisStorage extends BaseMemoryStorage {
     constructor(config) {
         super();
         this.client = null;
-        this.connected = false;
+        this.connectionPromise = null;
         this.keyPrefix = config.keyPrefix || 'sekuire:memory:';
-        this.initClient(config);
+        this.config = config;
+        if (!config.lazyConnect) {
+            this.connectionPromise = this.connect();
+        }
+    }
+    async connect() {
+        if (this._connected)
+            return;
+        if (this.connectionPromise)
+            return this.connectionPromise;
+        this.connectionPromise = this.initClient();
+        return this.connectionPromise;
     }
-    async initClient(config) {
+    async initClient() {
         try {
             const { createClient } = await import('redis');
-            if (config.url) {
-                this.client = createClient({ url: config.url });
+            if (this.config.url) {
+                this.client = createClient({ url: this.config.url });
             }
             else {
                 this.client = createClient({
                     socket: {
-                        host: config.host || 'localhost',
-                        port: config.port || 6379,
+                        host: this.config.host || 'localhost',
+                        port: this.config.port || 6379,
                     },
-                    password: config.password,
-                    database: config.db || 0,
+                    password: this.config.password,
+                    database: this.config.db || 0,
                 });
             }
             this.client.on('error', (err) => {
                 console.error('Redis client error:', err);
             });
             await this.client.connect();
-            this.connected = true;
+            this._connected = true;
         }
         catch (error) {
+            this.connectionPromise = null;
             throw new Error(`Failed to initialize Redis: ${error}`);
         }
     }
+    async ensureConnected() {
+        if (!this._connected) {
+            await this.connect();
+        }
+    }
     getKey(sessionId) {
         return `${this.keyPrefix}${sessionId}`;
     }
     async add(sessionId, message) {
-        if (!this.connected)
-            throw new Error('Redis not connected');
+        await this.ensureConnected();
         const key = this.getKey(sessionId);
         await this.client.rPush(key, JSON.stringify(message));
     }
     async get(sessionId, limit) {
-        if (!this.connected)
-            throw new Error('Redis not connected');
+        await this.ensureConnected();
         const key = this.getKey(sessionId);
         const start = limit ? -limit : 0;
         const messages = await this.client.lRange(key, start, -1);
         return messages.map((msg) => JSON.parse(msg));
     }
     async clear(sessionId) {
-        if (!this.connected)
-            throw new Error('Redis not connected');
+        await this.ensureConnected();
         const key = this.getKey(sessionId);
         await this.client.del(key);
     }
@@ -3265,190 +3355,1080 @@ class RedisStorage extends BaseMemoryStorage {
         await this.clear(sessionId);
     }
     async exists(sessionId) {
-        if (!this.connected)
-            throw new Error('Redis not connected');
+        await this.ensureConnected();
         const key = this.getKey(sessionId);
         return (await this.client.exists(key)) === 1;
     }
     async disconnect() {
-        if (this.connected) {
+        if (this._connected && this.client) {
             await this.client.quit();
-            this.connected = false;
+            this._connected = false;
+            this.connectionPromise = null;
         }
     }
 }
 
-function createMemoryStorage(config) {
-    // Normalize type (support "buffer" as alias for "in-memory")
-    const normalizedType = config.type === 'buffer' ? 'in-memory' : config.type;
-    switch (normalizedType) {
-        case 'in-memory':
-            return new InMemoryStorage();
-        case 'redis':
-            if (!config.redis) {
-                throw new Error('Redis config required for redis memory type');
-            }
-            return new RedisStorage(config.redis);
-        case 'postgres':
-            if (!config.postgres) {
-                throw new Error('Postgres config required for postgres memory type');
-            }
-            return new PostgresStorage(config.postgres);
-        default:
-            throw new Error(`Unknown memory type: ${config.type}`);
-    }
-}
-
-const DEFAULT_OVERRIDE_ENV = "SEKUIRE_POLICY_DEV_OVERRIDE";
-class PolicyEnforcer {
-    constructor(policy, override, onViolation) {
-        this.policy = policy;
-        this.onViolation = onViolation;
-        const envOverride = process.env[DEFAULT_OVERRIDE_ENV] === "true";
-        this.override = override ?? envOverride;
-        if (this.override) {
-            console.warn("[policy] override enabled; policy enforcement is running in warn-only mode");
-        }
+class SQLiteStorage extends BaseMemoryStorage {
+    constructor(config) {
+        super();
+        this.db = null;
+        this.connectionPromise = null;
+        this.config = config;
+        this.tableName = config.tableName || 'sekuire_memory';
+        this.connectionPromise = this.connect();
     }
-    enforceNetwork(domain, protocol) {
-        const perms = this.policy.content?.permissions?.network;
-        if (!perms) {
-            this.warnOnly("network.missing", "Network permissions not configured");
+    async connect() {
+        if (this._connected)
             return;
+        if (this.connectionPromise && !this._connected)
+            return this.connectionPromise;
+        try {
+            const Database = (await import('better-sqlite3')).default;
+            this.db = new Database(this.config.filename, {
+                readonly: this.config.readonly || false,
+            });
+            this.db.pragma('journal_mode = WAL');
+            this.ensureTableExists();
+            this._connected = true;
         }
-        if (!perms.enabled)
-            this.throw("network.disabled", "Network access is disabled");
-        if (perms.require_tls && protocol !== "https") {
-            this.throw("network.tls_required", "TLS is required for network requests");
-        }
-        if (perms.blocked_domains && this.matches(domain, perms.blocked_domains)) {
-            this.throw("network.blocked", `Domain ${domain} is blocked by policy`);
-        }
-        if (perms.allowed_domains && !this.matches(domain, perms.allowed_domains)) {
-            this.throw("network.not_allowed", `Domain ${domain} is not in the allowlist`);
+        catch (error) {
+            this.connectionPromise = null;
+            throw new Error(`Failed to initialize SQLite: ${error}`);
         }
     }
-    enforceFilesystem(path, operation) {
-        const perms = this.policy.content?.permissions?.filesystem;
-        if (!perms) {
-            this.warnOnly("fs.missing", "Filesystem permissions not configured");
-            return;
-        }
-        if (!perms.enabled)
-            this.throw("fs.disabled", "Filesystem access is disabled");
-        if (perms.blocked_paths && this.pathMatch(path, perms.blocked_paths)) {
-            this.throw("fs.blocked", `Path ${path} is blocked`);
-        }
-        if (perms.allowed_paths && !this.pathMatch(path, perms.allowed_paths)) {
-            this.throw("fs.not_allowed", `Path ${path} is not in the allowlist`);
-        }
-        if (perms.allowed_extensions) {
-            const ext = path.includes(".") ? `.${path.split(".").pop()}` : "";
-            if (ext && !perms.allowed_extensions.includes(ext)) {
-                this.throw("fs.ext", `Extension ${ext} is not allowed`);
-            }
-        }
+    ensureTableExists() {
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS ${this.tableName} (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        content TEXT NOT NULL,
+        timestamp INTEGER NOT NULL,
+        metadata TEXT,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+        this.db.exec(`
+      CREATE INDEX IF NOT EXISTS idx_${this.tableName}_session_id
+      ON ${this.tableName}(session_id)
+    `);
     }
-    enforceTool(toolName) {
-        const tools = this.policy.content?.tools;
-        // Check blocked tools
-        if (tools?.blocked_tools?.includes(toolName)) {
-            this.throw("tool.blocked", `Tool ${toolName} is blocked`);
-        }
-        // If no allowlist, allow all tools
-        if (!tools?.allowed_tools || tools.allowed_tools.length === 0) {
-            return;
-        }
-        // Check allowlist with pattern matching
-        const isAllowed = tools.allowed_tools.some((t) => {
-            const pattern = t.name;
-            // Exact match
-            if (pattern === toolName) {
-                return true;
-            }
-            // Category patterns: "files:*" => matches "file_read", "file_write", etc
-            // Check this BEFORE wildcard matching since it contains both : and *
-            if (pattern.includes(":")) {
-                const [category, ops] = pattern.split(":", 2);
-                const categoryPrefix = this.getCategoryPrefix(category);
-                if (ops === "*") {
-                    // Match all tools in category
-                    const matches = toolName.startsWith(categoryPrefix + "_");
-                    return matches;
-                }
-                if (ops.startsWith("[") && ops.endsWith("]")) {
-                    // Match specific operations: "files:[read,write]"
-                    const operations = ops.slice(1, -1).split(",").map(s => s.trim());
-                    const matches = operations.some(op => toolName === `${categoryPrefix}_${op}`);
-                    console.log(`[DEBUG]   ${matches ? '✓' : '✗'} Category ops: ${operations.join(",")}`);
-                    return matches;
-                }
-            }
-            // Pattern matching: "file_*", etc (simple wildcards without :)
-            if (pattern.includes("*")) {
-                const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
-                const matches = regex.test(toolName);
-                return matches;
-            }
-            return false;
-        });
-        if (!isAllowed) {
-            this.throw("tool.not_allowed", `Tool ${toolName} is not in the allowlist`);
+    async ensureConnected() {
+        if (!this._connected) {
+            await this.connect();
         }
     }
-    getCategoryPrefix(category) {
-        const prefixMap = {
-            files: "file",
-            directories: "dir",
-            network: "http",
-            data: "json",
-            system: "env",
-        };
-        return prefixMap[category] || category;
+    async add(sessionId, message) {
+        await this.ensureConnected();
+        const stmt = this.db.prepare(`
+      INSERT INTO ${this.tableName} (session_id, role, content, timestamp, metadata)
+      VALUES (?, ?, ?, ?, ?)
+    `);
+        stmt.run(sessionId, message.role, message.content, message.timestamp, message.metadata ? JSON.stringify(message.metadata) : null);
     }
-    enforceModel(model) {
-        const models = this.policy.content?.agent?.models;
-        if (models?.allowed_models && !models.allowed_models.includes(model)) {
-            this.throw("model.not_allowed", `Model ${model} is not allowed`);
-        }
-        if (models?.blocked_models && models.blocked_models.includes(model)) {
-            this.throw("model.blocked", `Model ${model} is blocked`);
+    async get(sessionId, limit) {
+        await this.ensureConnected();
+        let sql = `
+      SELECT role, content, timestamp, metadata
+      FROM ${this.tableName}
+      WHERE session_id = ?
+      ORDER BY timestamp ASC
+    `;
+        if (limit) {
+            sql += ` LIMIT ${limit}`;
         }
+        const stmt = this.db.prepare(sql);
+        const rows = stmt.all(sessionId);
+        return rows.map((row) => ({
+            role: row.role,
+            content: row.content,
+            timestamp: row.timestamp,
+            metadata: row.metadata ? JSON.parse(row.metadata) : undefined,
+        }));
     }
-    enforceApi(service) {
-        const perms = this.policy.content?.permissions?.api;
-        if (!perms) {
-            this.warnOnly("api.missing", "API permissions not configured");
-            return;
-        }
-        if (!perms.enabled)
-            this.throw("api.disabled", "API access is disabled");
-        if (perms.allowed_services &&
-            !perms.allowed_services.some((s) => s.service_name === service)) {
-            this.throw("api.not_allowed", `API service ${service} is not in the allowlist`);
+    async clear(sessionId) {
+        await this.ensureConnected();
+        const stmt = this.db.prepare(`DELETE FROM ${this.tableName} WHERE session_id = ?`);
+        stmt.run(sessionId);
+    }
+    async delete(sessionId) {
+        await this.clear(sessionId);
+    }
+    async exists(sessionId) {
+        await this.ensureConnected();
+        const stmt = this.db.prepare(`SELECT COUNT(*) as count FROM ${this.tableName} WHERE session_id = ?`);
+        const result = stmt.get(sessionId);
+        return result.count > 0;
+    }
+    async disconnect() {
+        if (this._connected && this.db) {
+            this.db.close();
+            this._connected = false;
+            this.connectionPromise = null;
         }
     }
-    enforceRateLimit(type, count = 1) {
-        const limits = this.policy.content?.rate_limits?.per_agent;
-        if (!limits)
-            return;
-        // Simple local enforcement (note: this does not sync across instances)
-        // TODO: Implement proper token bucket or sliding window
-        if (type === "request" && limits.requests_per_minute) ;
+}
+
+class UpstashStorage extends BaseMemoryStorage {
+    constructor(config) {
+        super();
+        this.client = null;
+        this.connectionPromise = null;
+        this.keyPrefix = config.keyPrefix || 'sekuire:memory:';
+        this.config = config;
+        this.connectionPromise = this.connect();
     }
-    throw(rule, reason) {
-        if (this.override) {
-            this.warnOnly(rule, reason);
+    async connect() {
+        if (this._connected)
             return;
+        if (this.connectionPromise && !this._connected)
+            return this.connectionPromise;
+        try {
+            const { Redis } = await import('@upstash/redis');
+            this.client = new Redis({
+                url: this.config.url,
+                token: this.config.token,
+            });
+            this._connected = true;
+        }
+        catch (error) {
+            this.connectionPromise = null;
+            throw new Error(`Failed to initialize Upstash Redis: ${error}`);
         }
-        if (this.onViolation)
-            this.onViolation(rule, reason);
-        throw new PolicyViolationError(reason, rule);
     }
-    warnOnly(rule, reason) {
-        if (this.onViolation)
-            this.onViolation(rule, reason);
-        console.warn(`[policy][${rule}] ${reason}`);
+    async ensureConnected() {
+        if (!this._connected) {
+            await this.connect();
+        }
+    }
+    getKey(sessionId) {
+        return `${this.keyPrefix}${sessionId}`;
+    }
+    async add(sessionId, message) {
+        await this.ensureConnected();
+        const key = this.getKey(sessionId);
+        await this.client.rpush(key, JSON.stringify(message));
+    }
+    async get(sessionId, limit) {
+        await this.ensureConnected();
+        const key = this.getKey(sessionId);
+        const start = limit ? -limit : 0;
+        const messages = await this.client.lrange(key, start, -1);
+        return messages.map((msg) => JSON.parse(msg));
+    }
+    async clear(sessionId) {
+        await this.ensureConnected();
+        const key = this.getKey(sessionId);
+        await this.client.del(key);
+    }
+    async delete(sessionId) {
+        await this.clear(sessionId);
+    }
+    async exists(sessionId) {
+        await this.ensureConnected();
+        const key = this.getKey(sessionId);
+        return (await this.client.exists(key)) === 1;
+    }
+    async disconnect() {
+        this._connected = false;
+        this.client = null;
+        this.connectionPromise = null;
+    }
+}
+
+class CloudflareKVStorage extends BaseMemoryStorage {
+    constructor(config) {
+        super();
+        this.binding = null;
+        this.config = config;
+        this.keyPrefix = config.keyPrefix || 'sekuire:memory:';
+        if (config.binding) {
+            this.binding = config.binding;
+            this.useRestApi = false;
+            this._connected = true;
+        }
+        else if (config.accountId && config.namespaceId && config.apiToken) {
+            this.useRestApi = true;
+            this._connected = true;
+        }
+        else {
+            throw new Error('CloudflareKVConfig requires either a binding (in Workers) or accountId, namespaceId, and apiToken (for REST API)');
+        }
+    }
+    getKey(sessionId) {
+        return `${this.keyPrefix}${sessionId}`;
+    }
+    async kvGet(key) {
+        if (!this.useRestApi) {
+            return this.binding.get(key);
+        }
+        const { accountId, namespaceId, apiToken } = this.config;
+        const url = `https://api.cloudflare.com/client/v4/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${encodeURIComponent(key)}`;
+        const response = await fetch(url, {
+            headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (response.status === 404)
+            return null;
+        if (!response.ok)
+            throw new Error(`KV GET failed: ${response.statusText}`);
+        return response.text();
+    }
+    async kvPut(key, value) {
+        if (!this.useRestApi) {
+            await this.binding.put(key, value);
+            return;
+        }
+        const { accountId, namespaceId, apiToken } = this.config;
+        const url = `https://api.cloudflare.com/client/v4/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${encodeURIComponent(key)}`;
+        const response = await fetch(url, {
+            method: 'PUT',
+            headers: {
+                Authorization: `Bearer ${apiToken}`,
+                'Content-Type': 'text/plain',
+            },
+            body: value,
+        });
+        if (!response.ok)
+            throw new Error(`KV PUT failed: ${response.statusText}`);
+    }
+    async kvDelete(key) {
+        if (!this.useRestApi) {
+            await this.binding.delete(key);
+            return;
+        }
+        const { accountId, namespaceId, apiToken } = this.config;
+        const url = `https://api.cloudflare.com/client/v4/accounts/${accountId}/storage/kv/namespaces/${namespaceId}/values/${encodeURIComponent(key)}`;
+        const response = await fetch(url, {
+            method: 'DELETE',
+            headers: { Authorization: `Bearer ${apiToken}` },
+        });
+        if (!response.ok && response.status !== 404) {
+            throw new Error(`KV DELETE failed: ${response.statusText}`);
+        }
+    }
+    async add(sessionId, message) {
+        const key = this.getKey(sessionId);
+        const existing = await this.kvGet(key);
+        const messages = existing ? JSON.parse(existing) : [];
+        messages.push(message);
+        await this.kvPut(key, JSON.stringify(messages));
+    }
+    async get(sessionId, limit) {
+        const key = this.getKey(sessionId);
+        const data = await this.kvGet(key);
+        if (!data)
+            return [];
+        const messages = JSON.parse(data);
+        if (limit) {
+            return messages.slice(-limit);
+        }
+        return messages;
+    }
+    async clear(sessionId) {
+        const key = this.getKey(sessionId);
+        await this.kvDelete(key);
+    }
+    async delete(sessionId) {
+        await this.clear(sessionId);
+    }
+    async exists(sessionId) {
+        const key = this.getKey(sessionId);
+        const data = await this.kvGet(key);
+        return data !== null;
+    }
+    async disconnect() {
+        this._connected = false;
+    }
+}
+
+class CloudflareD1Storage extends BaseMemoryStorage {
+    constructor(config) {
+        super();
+        this.binding = null;
+        this.tableInitialized = false;
+        this.config = config;
+        this.tableName = config.tableName || 'sekuire_memory';
+        if (config.binding) {
+            this.binding = config.binding;
+            this.useRestApi = false;
+            this._connected = true;
+        }
+        else if (config.accountId && config.databaseId && config.apiToken) {
+            this.useRestApi = true;
+            this._connected = true;
+        }
+        else {
+            throw new Error('CloudflareD1Config requires either a binding (in Workers) or accountId, databaseId, and apiToken (for REST API)');
+        }
+    }
+    async executeQuery(sql, params = []) {
+        if (!this.useRestApi) {
+            const stmt = this.binding.prepare(sql);
+            if (params.length > 0) {
+                return stmt.bind(...params).all();
+            }
+            return stmt.all();
+        }
+        const { accountId, databaseId, apiToken } = this.config;
+        const url = `https://api.cloudflare.com/client/v4/accounts/${accountId}/d1/database/${databaseId}/query`;
+        const response = await fetch(url, {
+            method: 'POST',
+            headers: {
+                Authorization: `Bearer ${apiToken}`,
+                'Content-Type': 'application/json',
+            },
+            body: JSON.stringify({ sql, params }),
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`D1 query failed: ${response.statusText} - ${errorText}`);
+        }
+        const result = await response.json();
+        if (!result.success) {
+            throw new Error(`D1 query failed: ${JSON.stringify(result.errors)}`);
+        }
+        return result.result?.[0] || { results: [] };
+    }
+    async ensureTableExists() {
+        if (this.tableInitialized)
+            return;
+        const createTableSQL = `
+      CREATE TABLE IF NOT EXISTS ${this.tableName} (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        content TEXT NOT NULL,
+        timestamp INTEGER NOT NULL,
+        metadata TEXT,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP
+      )
+    `;
+        const createIndexSQL = `
+      CREATE INDEX IF NOT EXISTS idx_${this.tableName}_session_id ON ${this.tableName}(session_id)
+    `;
+        await this.executeQuery(createTableSQL);
+        await this.executeQuery(createIndexSQL);
+        this.tableInitialized = true;
+    }
+    async add(sessionId, message) {
+        await this.ensureTableExists();
+        const sql = `
+      INSERT INTO ${this.tableName} (session_id, role, content, timestamp, metadata)
+      VALUES (?, ?, ?, ?, ?)
+    `;
+        await this.executeQuery(sql, [
+            sessionId,
+            message.role,
+            message.content,
+            message.timestamp,
+            message.metadata ? JSON.stringify(message.metadata) : null,
+        ]);
+    }
+    async get(sessionId, limit) {
+        await this.ensureTableExists();
+        let sql = `
+      SELECT role, content, timestamp, metadata
+      FROM ${this.tableName}
+      WHERE session_id = ?
+      ORDER BY timestamp ASC
+    `;
+        if (limit) {
+            sql += ` LIMIT ${limit}`;
+        }
+        const result = await this.executeQuery(sql, [sessionId]);
+        return (result.results || []).map((row) => ({
+            role: row.role,
+            content: row.content,
+            timestamp: row.timestamp,
+            metadata: row.metadata ? JSON.parse(row.metadata) : undefined,
+        }));
+    }
+    async clear(sessionId) {
+        await this.ensureTableExists();
+        const sql = `DELETE FROM ${this.tableName} WHERE session_id = ?`;
+        await this.executeQuery(sql, [sessionId]);
+    }
+    async delete(sessionId) {
+        await this.clear(sessionId);
+    }
+    async exists(sessionId) {
+        await this.ensureTableExists();
+        const sql = `SELECT COUNT(*) as count FROM ${this.tableName} WHERE session_id = ?`;
+        const result = await this.executeQuery(sql, [sessionId]);
+        return (result.results?.[0]?.count || 0) > 0;
+    }
+    async disconnect() {
+        this._connected = false;
+    }
+}
+
+class DynamoDBStorage extends BaseMemoryStorage {
+    constructor(config) {
+        super();
+        this.client = null;
+        this.docClient = null;
+        this.connectionPromise = null;
+        this.tableReady = false;
+        this.config = config;
+        this.connectionPromise = this.connect();
+    }
+    async connect() {
+        if (this._connected)
+            return;
+        if (this.connectionPromise && !this._connected)
+            return this.connectionPromise;
+        try {
+            const { DynamoDBClient, CreateTableCommand, DescribeTableCommand } = await import('@aws-sdk/client-dynamodb');
+            const { DynamoDBDocumentClient, PutCommand, QueryCommand, DeleteCommand } = await import('@aws-sdk/lib-dynamodb');
+            const clientConfig = {
+                region: this.config.region || process.env.AWS_REGION || 'us-east-1',
+            };
+            if (this.config.endpoint) {
+                clientConfig.endpoint = this.config.endpoint;
+            }
+            if (this.config.credentials) {
+                clientConfig.credentials = this.config.credentials;
+            }
+            this.client = new DynamoDBClient(clientConfig);
+            this.docClient = DynamoDBDocumentClient.from(this.client);
+            if (this.config.createTable) {
+                await this.ensureTableExists();
+            }
+            this._connected = true;
+        }
+        catch (error) {
+            this.connectionPromise = null;
+            throw new Error(`Failed to initialize DynamoDB: ${error}`);
+        }
+    }
+    async ensureTableExists() {
+        if (this.tableReady)
+            return;
+        try {
+            const { DescribeTableCommand } = await import('@aws-sdk/client-dynamodb');
+            await this.client.send(new DescribeTableCommand({ TableName: this.config.tableName }));
+            this.tableReady = true;
+            return;
+        }
+        catch (error) {
+            if (error.name !== 'ResourceNotFoundException') {
+                throw error;
+            }
+        }
+        const { CreateTableCommand } = await import('@aws-sdk/client-dynamodb');
+        await this.client.send(new CreateTableCommand({
+            TableName: this.config.tableName,
+            KeySchema: [
+                { AttributeName: 'sessionId', KeyType: 'HASH' },
+                { AttributeName: 'timestamp', KeyType: 'RANGE' },
+            ],
+            AttributeDefinitions: [
+                { AttributeName: 'sessionId', AttributeType: 'S' },
+                { AttributeName: 'timestamp', AttributeType: 'N' },
+            ],
+            BillingMode: 'PAY_PER_REQUEST',
+        }));
+        const { waitUntilTableExists } = await import('@aws-sdk/client-dynamodb');
+        await waitUntilTableExists({ client: this.client, maxWaitTime: 120 }, { TableName: this.config.tableName });
+        this.tableReady = true;
+    }
+    async ensureConnected() {
+        if (!this._connected) {
+            await this.connect();
+        }
+    }
+    async add(sessionId, message) {
+        await this.ensureConnected();
+        const { PutCommand } = await import('@aws-sdk/lib-dynamodb');
+        await this.docClient.send(new PutCommand({
+            TableName: this.config.tableName,
+            Item: {
+                sessionId,
+                timestamp: message.timestamp,
+                role: message.role,
+                content: message.content,
+                metadata: message.metadata || {},
+            },
+        }));
+    }
+    async get(sessionId, limit) {
+        await this.ensureConnected();
+        const { QueryCommand } = await import('@aws-sdk/lib-dynamodb');
+        const params = {
+            TableName: this.config.tableName,
+            KeyConditionExpression: 'sessionId = :sid',
+            ExpressionAttributeValues: {
+                ':sid': sessionId,
+            },
+            ScanIndexForward: true,
+        };
+        if (limit) {
+            params.Limit = limit;
+            params.ScanIndexForward = false;
+        }
+        const result = await this.docClient.send(new QueryCommand(params));
+        const items = result.Items || [];
+        const messages = items.map((item) => ({
+            role: item.role,
+            content: item.content,
+            timestamp: item.timestamp,
+            metadata: item.metadata && Object.keys(item.metadata).length > 0 ? item.metadata : undefined,
+        }));
+        if (limit) {
+            messages.reverse();
+        }
+        return messages;
+    }
+    async clear(sessionId) {
+        await this.ensureConnected();
+        const messages = await this.get(sessionId);
+        const { DeleteCommand } = await import('@aws-sdk/lib-dynamodb');
+        for (const message of messages) {
+            await this.docClient.send(new DeleteCommand({
+                TableName: this.config.tableName,
+                Key: {
+                    sessionId,
+                    timestamp: message.timestamp,
+                },
+            }));
+        }
+    }
+    async delete(sessionId) {
+        await this.clear(sessionId);
+    }
+    async exists(sessionId) {
+        await this.ensureConnected();
+        const { QueryCommand } = await import('@aws-sdk/lib-dynamodb');
+        const result = await this.docClient.send(new QueryCommand({
+            TableName: this.config.tableName,
+            KeyConditionExpression: 'sessionId = :sid',
+            ExpressionAttributeValues: {
+                ':sid': sessionId,
+            },
+            Limit: 1,
+            Select: 'COUNT',
+        }));
+        return (result.Count || 0) > 0;
+    }
+    async disconnect() {
+        if (this._connected && this.client) {
+            this.client.destroy();
+            this._connected = false;
+            this.connectionPromise = null;
+        }
+    }
+}
+
+class TursoStorage extends BaseMemoryStorage {
+    constructor(config) {
+        super();
+        this.client = null;
+        this.connectionPromise = null;
+        this.tableInitialized = false;
+        this.config = config;
+        this.tableName = config.tableName || 'sekuire_memory';
+        this.connectionPromise = this.connect();
+    }
+    async connect() {
+        if (this._connected)
+            return;
+        if (this.connectionPromise && !this._connected)
+            return this.connectionPromise;
+        try {
+            const { createClient } = await import('@libsql/client');
+            this.client = createClient({
+                url: this.config.url,
+                authToken: this.config.authToken,
+            });
+            await this.ensureTableExists();
+            this._connected = true;
+        }
+        catch (error) {
+            this.connectionPromise = null;
+            throw new Error(`Failed to initialize Turso: ${error}`);
+        }
+    }
+    async ensureTableExists() {
+        if (this.tableInitialized)
+            return;
+        await this.client.execute(`
+      CREATE TABLE IF NOT EXISTS ${this.tableName} (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        session_id TEXT NOT NULL,
+        role TEXT NOT NULL,
+        content TEXT NOT NULL,
+        timestamp INTEGER NOT NULL,
+        metadata TEXT,
+        created_at TEXT DEFAULT CURRENT_TIMESTAMP
+      )
+    `);
+        await this.client.execute(`
+      CREATE INDEX IF NOT EXISTS idx_${this.tableName}_session_id ON ${this.tableName}(session_id)
+    `);
+        this.tableInitialized = true;
+    }
+    async ensureConnected() {
+        if (!this._connected) {
+            await this.connect();
+        }
+    }
+    async add(sessionId, message) {
+        await this.ensureConnected();
+        await this.client.execute({
+            sql: `
+        INSERT INTO ${this.tableName} (session_id, role, content, timestamp, metadata)
+        VALUES (?, ?, ?, ?, ?)
+      `,
+            args: [
+                sessionId,
+                message.role,
+                message.content,
+                message.timestamp,
+                message.metadata ? JSON.stringify(message.metadata) : null,
+            ],
+        });
+    }
+    async get(sessionId, limit) {
+        await this.ensureConnected();
+        let sql = `
+      SELECT role, content, timestamp, metadata
+      FROM ${this.tableName}
+      WHERE session_id = ?
+      ORDER BY timestamp ASC
+    `;
+        if (limit) {
+            sql += ` LIMIT ${limit}`;
+        }
+        const result = await this.client.execute({
+            sql,
+            args: [sessionId],
+        });
+        return result.rows.map((row) => ({
+            role: row.role,
+            content: row.content,
+            timestamp: Number(row.timestamp),
+            metadata: row.metadata ? JSON.parse(row.metadata) : undefined,
+        }));
+    }
+    async clear(sessionId) {
+        await this.ensureConnected();
+        await this.client.execute({
+            sql: `DELETE FROM ${this.tableName} WHERE session_id = ?`,
+            args: [sessionId],
+        });
+    }
+    async delete(sessionId) {
+        await this.clear(sessionId);
+    }
+    async exists(sessionId) {
+        await this.ensureConnected();
+        const result = await this.client.execute({
+            sql: `SELECT COUNT(*) as count FROM ${this.tableName} WHERE session_id = ?`,
+            args: [sessionId],
+        });
+        return Number(result.rows[0]?.count || 0) > 0;
+    }
+    async disconnect() {
+        if (this._connected && this.client) {
+            this.client.close();
+            this._connected = false;
+            this.connectionPromise = null;
+        }
+    }
+}
+
+class ConvexStorage extends BaseMemoryStorage {
+    constructor(config) {
+        super();
+        this.client = null;
+        this.connectionPromise = null;
+        this.config = config;
+        this.connectionPromise = this.connect();
+    }
+    async connect() {
+        if (this._connected)
+            return;
+        if (this.connectionPromise && !this._connected)
+            return this.connectionPromise;
+        try {
+            const { ConvexHttpClient } = await import('convex/browser');
+            this.client = new ConvexHttpClient(this.config.url);
+            this._connected = true;
+        }
+        catch (error) {
+            this.connectionPromise = null;
+            throw new Error(`Failed to initialize Convex: ${error}`);
+        }
+    }
+    async ensureConnected() {
+        if (!this._connected) {
+            await this.connect();
+        }
+    }
+    async add(sessionId, message) {
+        await this.ensureConnected();
+        await this.client.mutation('sekuireMemory:add', {
+            sessionId,
+            role: message.role,
+            content: message.content,
+            timestamp: message.timestamp,
+            metadata: message.metadata || {},
+        });
+    }
+    async get(sessionId, limit) {
+        await this.ensureConnected();
+        const messages = await this.client.query('sekuireMemory:get', {
+            sessionId,
+            limit,
+        });
+        return messages.map((msg) => ({
+            role: msg.role,
+            content: msg.content,
+            timestamp: msg.timestamp,
+            metadata: msg.metadata && Object.keys(msg.metadata).length > 0 ? msg.metadata : undefined,
+        }));
+    }
+    async clear(sessionId) {
+        await this.ensureConnected();
+        await this.client.mutation('sekuireMemory:clear', { sessionId });
+    }
+    async delete(sessionId) {
+        await this.clear(sessionId);
+    }
+    async exists(sessionId) {
+        await this.ensureConnected();
+        return this.client.query('sekuireMemory:exists', { sessionId });
+    }
+    async disconnect() {
+        this._connected = false;
+        this.client = null;
+        this.connectionPromise = null;
+    }
+}
+const CONVEX_SCHEMA_TEMPLATE = `
+// convex/schema.ts
+import { defineSchema, defineTable } from "convex/server";
+import { v } from "convex/values";
+
+export default defineSchema({
+  sekuireMemory: defineTable({
+    sessionId: v.string(),
+    role: v.union(v.literal("user"), v.literal("assistant"), v.literal("system")),
+    content: v.string(),
+    timestamp: v.number(),
+    metadata: v.optional(v.any()),
+  }).index("by_session", ["sessionId", "timestamp"]),
+});
+`;
+const CONVEX_FUNCTIONS_TEMPLATE = `
+// convex/sekuireMemory.ts
+import { mutation, query } from "./_generated/server";
+import { v } from "convex/values";
+
+export const add = mutation({
+  args: {
+    sessionId: v.string(),
+    role: v.union(v.literal("user"), v.literal("assistant"), v.literal("system")),
+    content: v.string(),
+    timestamp: v.number(),
+    metadata: v.optional(v.any()),
+  },
+  handler: async (ctx, args) => {
+    await ctx.db.insert("sekuireMemory", args);
+  },
+});
+
+export const get = query({
+  args: {
+    sessionId: v.string(),
+    limit: v.optional(v.number()),
+  },
+  handler: async (ctx, args) => {
+    let query = ctx.db
+      .query("sekuireMemory")
+      .withIndex("by_session", (q) => q.eq("sessionId", args.sessionId))
+      .order("asc");
+
+    const messages = await query.collect();
+
+    if (args.limit) {
+      return messages.slice(-args.limit);
+    }
+    return messages;
+  },
+});
+
+export const clear = mutation({
+  args: {
+    sessionId: v.string(),
+  },
+  handler: async (ctx, args) => {
+    const messages = await ctx.db
+      .query("sekuireMemory")
+      .withIndex("by_session", (q) => q.eq("sessionId", args.sessionId))
+      .collect();
+
+    for (const message of messages) {
+      await ctx.db.delete(message._id);
+    }
+  },
+});
+
+export const exists = query({
+  args: {
+    sessionId: v.string(),
+  },
+  handler: async (ctx, args) => {
+    const message = await ctx.db
+      .query("sekuireMemory")
+      .withIndex("by_session", (q) => q.eq("sessionId", args.sessionId))
+      .first();
+    return message !== null;
+  },
+});
+`;
+
+const storageRegistry = new Map();
+function registerStorage(type, factory, description) {
+    if (storageRegistry.has(type)) {
+        console.warn(`Storage type '${type}' is already registered. Overwriting.`);
+    }
+    storageRegistry.set(type, { factory, description });
+}
+function getStorageFactory(type) {
+    const registration = storageRegistry.get(type);
+    return registration?.factory;
+}
+function hasStorage(type) {
+    return storageRegistry.has(type);
+}
+function listStorageTypes() {
+    return Array.from(storageRegistry.keys());
+}
+function getStorageInfo() {
+    return Array.from(storageRegistry.entries()).map(([type, reg]) => ({
+        type,
+        description: reg.description,
+    }));
+}
+
+registerStorage('in-memory', () => new InMemoryStorage(), 'Simple in-memory storage using Map');
+registerStorage('buffer', () => new InMemoryStorage(), 'Alias for in-memory storage');
+registerStorage('redis', (config) => {
+    if (!config.redis) {
+        throw new Error('Redis config required for redis memory type');
+    }
+    return new RedisStorage(config.redis);
+}, 'Self-hosted Redis for persistence and scaling');
+registerStorage('postgres', (config) => {
+    if (!config.postgres) {
+        throw new Error('Postgres config required for postgres memory type');
+    }
+    return new PostgresStorage(config.postgres);
+}, 'PostgreSQL with full SQL capabilities');
+registerStorage('sqlite', (config) => {
+    if (!config.sqlite) {
+        throw new Error('SQLite config required for sqlite memory type');
+    }
+    return new SQLiteStorage(config.sqlite);
+}, 'Local SQLite database for development and single-node deployments');
+registerStorage('upstash', (config) => {
+    if (!config.upstash) {
+        throw new Error('Upstash config required for upstash memory type');
+    }
+    return new UpstashStorage(config.upstash);
+}, 'Upstash Redis - serverless Redis with HTTP API');
+registerStorage('cloudflare-kv', (config) => {
+    if (!config.cloudflareKV) {
+        throw new Error('CloudflareKV config required for cloudflare-kv memory type');
+    }
+    return new CloudflareKVStorage(config.cloudflareKV);
+}, 'Cloudflare KV - edge key-value storage');
+registerStorage('cloudflare-d1', (config) => {
+    if (!config.cloudflareD1) {
+        throw new Error('CloudflareD1 config required for cloudflare-d1 memory type');
+    }
+    return new CloudflareD1Storage(config.cloudflareD1);
+}, 'Cloudflare D1 - edge SQLite database');
+registerStorage('dynamodb', (config) => {
+    if (!config.dynamodb) {
+        throw new Error('DynamoDB config required for dynamodb memory type');
+    }
+    return new DynamoDBStorage(config.dynamodb);
+}, 'AWS DynamoDB - serverless NoSQL database');
+registerStorage('turso', (config) => {
+    if (!config.turso) {
+        throw new Error('Turso config required for turso memory type');
+    }
+    return new TursoStorage(config.turso);
+}, 'Turso - edge SQLite with libSQL');
+registerStorage('convex', (config) => {
+    if (!config.convex) {
+        throw new Error('Convex config required for convex memory type');
+    }
+    return new ConvexStorage(config.convex);
+}, 'Convex - real-time backend platform');
+function createMemoryStorage(config) {
+    if (config.instance) {
+        return config.instance;
+    }
+    const factory = getStorageFactory(config.type);
+    if (factory) {
+        return factory(config);
+    }
+    throw new Error(`Unknown memory type: ${config.type}. Available types: ${listStorageTypes().join(', ')}`);
+}
+
+const DEFAULT_OVERRIDE_ENV = "SEKUIRE_POLICY_DEV_OVERRIDE";
+class PolicyEnforcer {
+    constructor(policy, override, onViolation) {
+        this.policy = policy;
+        this.onViolation = onViolation;
+        const envOverride = process.env[DEFAULT_OVERRIDE_ENV] === "true";
+        this.override = override ?? envOverride;
+        if (this.override) {
+            console.warn("[policy] override enabled; policy enforcement is running in warn-only mode");
+        }
+    }
+    enforceNetwork(domain, protocol) {
+        const perms = this.policy.content?.permissions?.network;
+        if (!perms) {
+            this.warnOnly("network.missing", "Network permissions not configured");
+            return;
+        }
+        if (!perms.enabled)
+            this.throw("network.disabled", "Network access is disabled");
+        if (perms.require_tls && protocol !== "https") {
+            this.throw("network.tls_required", "TLS is required for network requests");
+        }
+        if (perms.blocked_domains && this.matches(domain, perms.blocked_domains)) {
+            this.throw("network.blocked", `Domain ${domain} is blocked by policy`);
+        }
+        if (perms.allowed_domains && !this.matches(domain, perms.allowed_domains)) {
+            this.throw("network.not_allowed", `Domain ${domain} is not in the allowlist`);
+        }
+    }
+    enforceFilesystem(path, operation) {
+        const perms = this.policy.content?.permissions?.filesystem;
+        if (!perms) {
+            this.warnOnly("fs.missing", "Filesystem permissions not configured");
+            return;
+        }
+        if (!perms.enabled)
+            this.throw("fs.disabled", "Filesystem access is disabled");
+        if (perms.blocked_paths && this.pathMatch(path, perms.blocked_paths)) {
+            this.throw("fs.blocked", `Path ${path} is blocked`);
+        }
+        if (perms.allowed_paths && !this.pathMatch(path, perms.allowed_paths)) {
+            this.throw("fs.not_allowed", `Path ${path} is not in the allowlist`);
+        }
+        if (perms.allowed_extensions) {
+            const ext = path.includes(".") ? `.${path.split(".").pop()}` : "";
+            if (ext && !perms.allowed_extensions.includes(ext)) {
+                this.throw("fs.ext", `Extension ${ext} is not allowed`);
+            }
+        }
+    }
+    enforceTool(toolName) {
+        const tools = this.policy.content?.tools;
+        // Check blocked tools
+        if (tools?.blocked_tools?.includes(toolName)) {
+            this.throw("tool.blocked", `Tool ${toolName} is blocked`);
+        }
+        // If no allowlist, allow all tools
+        if (!tools?.allowed_tools || tools.allowed_tools.length === 0) {
+            return;
+        }
+        // Check allowlist with pattern matching
+        const isAllowed = tools.allowed_tools.some((t) => {
+            const pattern = t.name;
+            // Exact match
+            if (pattern === toolName) {
+                return true;
+            }
+            // Category patterns: "files:*" => matches "file_read", "file_write", etc
+            // Check this BEFORE wildcard matching since it contains both : and *
+            if (pattern.includes(":")) {
+                const [category, ops] = pattern.split(":", 2);
+                const categoryPrefix = this.getCategoryPrefix(category);
+                if (ops === "*") {
+                    // Match all tools in category
+                    const matches = toolName.startsWith(categoryPrefix + "_");
+                    return matches;
+                }
+                if (ops.startsWith("[") && ops.endsWith("]")) {
+                    // Match specific operations: "files:[read,write]"
+                    const operations = ops.slice(1, -1).split(",").map(s => s.trim());
+                    const matches = operations.some(op => toolName === `${categoryPrefix}_${op}`);
+                    console.log(`[DEBUG]   ${matches ? '✓' : '✗'} Category ops: ${operations.join(",")}`);
+                    return matches;
+                }
+            }
+            // Pattern matching: "file_*", etc (simple wildcards without :)
+            if (pattern.includes("*")) {
+                const regex = new RegExp("^" + pattern.replace(/\*/g, ".*") + "$");
+                const matches = regex.test(toolName);
+                return matches;
+            }
+            return false;
+        });
+        if (!isAllowed) {
+            this.throw("tool.not_allowed", `Tool ${toolName} is not in the allowlist`);
+        }
+    }
+    getCategoryPrefix(category) {
+        const prefixMap = {
+            files: "file",
+            directories: "dir",
+            network: "http",
+            data: "json",
+            system: "env",
+        };
+        return prefixMap[category] || category;
+    }
+    enforceModel(model) {
+        const models = this.policy.content?.agent?.models;
+        if (models?.allowed_models && !models.allowed_models.includes(model)) {
+            this.throw("model.not_allowed", `Model ${model} is not allowed`);
+        }
+        if (models?.blocked_models && models.blocked_models.includes(model)) {
+            this.throw("model.blocked", `Model ${model} is blocked`);
+        }
+    }
+    enforceApi(service) {
+        const perms = this.policy.content?.permissions?.api;
+        if (!perms) {
+            this.warnOnly("api.missing", "API permissions not configured");
+            return;
+        }
+        if (!perms.enabled)
+            this.throw("api.disabled", "API access is disabled");
+        if (perms.allowed_services &&
+            !perms.allowed_services.some((s) => s.service_name === service)) {
+            this.throw("api.not_allowed", `API service ${service} is not in the allowlist`);
+        }
+    }
+    enforceRateLimit(type, count = 1) {
+        const limits = this.policy.content?.rate_limits?.per_agent;
+        if (!limits)
+            return;
+        // Simple local enforcement (note: this does not sync across instances)
+        // TODO: Implement proper token bucket or sliding window
+        if (type === "request" && limits.requests_per_minute) ;
+    }
+    throw(rule, reason) {
+        if (this.override) {
+            this.warnOnly(rule, reason);
+            return;
+        }
+        if (this.onViolation)
+            this.onViolation(rule, reason);
+        throw new PolicyViolationError(reason, rule);
+    }
+    warnOnly(rule, reason) {
+        if (this.onViolation)
+            this.onViolation(rule, reason);
+        console.warn(`[policy][${rule}] ${reason}`);
     }
     matches(domain, patterns) {
         return patterns.some((pattern) => {
@@ -3907,7 +4887,7 @@ var __spreadArray$5 = (undefined && undefined.__spreadArray) || function (to, fr
     }
     return to.concat(ar || Array.prototype.slice.call(from));
 };
-var API_NAME$3 = 'diag';
+var API_NAME$4 = 'diag';
 /**
  * Singleton object which represents the entry point to the OpenTelemetry internal
  * diagnostic API
@@ -3962,7 +4942,7 @@ var DiagAPI = /** @class */ (function () {
         };
         self.setLogger = setLogger;
         self.disable = function () {
-            unregisterGlobal(API_NAME$3, self);
+            unregisterGlobal(API_NAME$4, self);
         };
         self.createComponentLogger = function (options) {
             return new DiagComponentLogger(options);
@@ -4196,6 +5176,171 @@ var BaseContext = /** @class */ (function () {
 /** The root context is used as the default parent context when there is no active context */
 var ROOT_CONTEXT = new BaseContext();
 
+/*
+ * Copyright The OpenTelemetry Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var __extends$3 = (undefined && undefined.__extends) || (function () {
+    var extendStatics = function (d, b) {
+        extendStatics = Object.setPrototypeOf ||
+            ({ __proto__: [] } instanceof Array && function (d, b) { d.__proto__ = b; }) ||
+            function (d, b) { for (var p in b) if (Object.prototype.hasOwnProperty.call(b, p)) d[p] = b[p]; };
+        return extendStatics(d, b);
+    };
+    return function (d, b) {
+        if (typeof b !== "function" && b !== null)
+            throw new TypeError("Class extends value " + String(b) + " is not a constructor or null");
+        extendStatics(d, b);
+        function __() { this.constructor = d; }
+        d.prototype = b === null ? Object.create(b) : (__.prototype = b.prototype, new __());
+    };
+})();
+/**
+ * NoopMeter is a noop implementation of the {@link Meter} interface. It reuses
+ * constant NoopMetrics for all of its methods.
+ */
+var NoopMeter = /** @class */ (function () {
+    function NoopMeter() {
+    }
+    /**
+     * @see {@link Meter.createGauge}
+     */
+    NoopMeter.prototype.createGauge = function (_name, _options) {
+        return NOOP_GAUGE_METRIC;
+    };
+    /**
+     * @see {@link Meter.createHistogram}
+     */
+    NoopMeter.prototype.createHistogram = function (_name, _options) {
+        return NOOP_HISTOGRAM_METRIC;
+    };
+    /**
+     * @see {@link Meter.createCounter}
+     */
+    NoopMeter.prototype.createCounter = function (_name, _options) {
+        return NOOP_COUNTER_METRIC;
+    };
+    /**
+     * @see {@link Meter.createUpDownCounter}
+     */
+    NoopMeter.prototype.createUpDownCounter = function (_name, _options) {
+        return NOOP_UP_DOWN_COUNTER_METRIC;
+    };
+    /**
+     * @see {@link Meter.createObservableGauge}
+     */
+    NoopMeter.prototype.createObservableGauge = function (_name, _options) {
+        return NOOP_OBSERVABLE_GAUGE_METRIC;
+    };
+    /**
+     * @see {@link Meter.createObservableCounter}
+     */
+    NoopMeter.prototype.createObservableCounter = function (_name, _options) {
+        return NOOP_OBSERVABLE_COUNTER_METRIC;
+    };
+    /**
+     * @see {@link Meter.createObservableUpDownCounter}
+     */
+    NoopMeter.prototype.createObservableUpDownCounter = function (_name, _options) {
+        return NOOP_OBSERVABLE_UP_DOWN_COUNTER_METRIC;
+    };
+    /**
+     * @see {@link Meter.addBatchObservableCallback}
+     */
+    NoopMeter.prototype.addBatchObservableCallback = function (_callback, _observables) { };
+    /**
+     * @see {@link Meter.removeBatchObservableCallback}
+     */
+    NoopMeter.prototype.removeBatchObservableCallback = function (_callback) { };
+    return NoopMeter;
+}());
+var NoopMetric = /** @class */ (function () {
+    function NoopMetric() {
+    }
+    return NoopMetric;
+}());
+var NoopCounterMetric = /** @class */ (function (_super) {
+    __extends$3(NoopCounterMetric, _super);
+    function NoopCounterMetric() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    NoopCounterMetric.prototype.add = function (_value, _attributes) { };
+    return NoopCounterMetric;
+}(NoopMetric));
+var NoopUpDownCounterMetric = /** @class */ (function (_super) {
+    __extends$3(NoopUpDownCounterMetric, _super);
+    function NoopUpDownCounterMetric() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    NoopUpDownCounterMetric.prototype.add = function (_value, _attributes) { };
+    return NoopUpDownCounterMetric;
+}(NoopMetric));
+var NoopGaugeMetric = /** @class */ (function (_super) {
+    __extends$3(NoopGaugeMetric, _super);
+    function NoopGaugeMetric() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    NoopGaugeMetric.prototype.record = function (_value, _attributes) { };
+    return NoopGaugeMetric;
+}(NoopMetric));
+var NoopHistogramMetric = /** @class */ (function (_super) {
+    __extends$3(NoopHistogramMetric, _super);
+    function NoopHistogramMetric() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    NoopHistogramMetric.prototype.record = function (_value, _attributes) { };
+    return NoopHistogramMetric;
+}(NoopMetric));
+var NoopObservableMetric = /** @class */ (function () {
+    function NoopObservableMetric() {
+    }
+    NoopObservableMetric.prototype.addCallback = function (_callback) { };
+    NoopObservableMetric.prototype.removeCallback = function (_callback) { };
+    return NoopObservableMetric;
+}());
+var NoopObservableCounterMetric = /** @class */ (function (_super) {
+    __extends$3(NoopObservableCounterMetric, _super);
+    function NoopObservableCounterMetric() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    return NoopObservableCounterMetric;
+}(NoopObservableMetric));
+var NoopObservableGaugeMetric = /** @class */ (function (_super) {
+    __extends$3(NoopObservableGaugeMetric, _super);
+    function NoopObservableGaugeMetric() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    return NoopObservableGaugeMetric;
+}(NoopObservableMetric));
+var NoopObservableUpDownCounterMetric = /** @class */ (function (_super) {
+    __extends$3(NoopObservableUpDownCounterMetric, _super);
+    function NoopObservableUpDownCounterMetric() {
+        return _super !== null && _super.apply(this, arguments) || this;
+    }
+    return NoopObservableUpDownCounterMetric;
+}(NoopObservableMetric));
+var NOOP_METER = new NoopMeter();
+// Synchronous instruments
+var NOOP_COUNTER_METRIC = new NoopCounterMetric();
+var NOOP_GAUGE_METRIC = new NoopGaugeMetric();
+var NOOP_HISTOGRAM_METRIC = new NoopHistogramMetric();
+var NOOP_UP_DOWN_COUNTER_METRIC = new NoopUpDownCounterMetric();
+// Asynchronous instruments
+var NOOP_OBSERVABLE_COUNTER_METRIC = new NoopObservableCounterMetric();
+var NOOP_OBSERVABLE_GAUGE_METRIC = new NoopObservableGaugeMetric();
+var NOOP_OBSERVABLE_UP_DOWN_COUNTER_METRIC = new NoopObservableUpDownCounterMetric();
+
 /*
  * Copyright The OpenTelemetry Authors
  *
@@ -4339,7 +5484,7 @@ var __spreadArray$3 = (undefined && undefined.__spreadArray) || function (to, fr
     }
     return to.concat(ar || Array.prototype.slice.call(from));
 };
-var API_NAME$2 = 'context';
+var API_NAME$3 = 'context';
 var NOOP_CONTEXT_MANAGER = new NoopContextManager();
 /**
  * Singleton object which represents the entry point to the OpenTelemetry Context API
@@ -4361,7 +5506,7 @@ var ContextAPI = /** @class */ (function () {
      * @returns true if the context manager was successfully registered, else false
      */
     ContextAPI.prototype.setGlobalContextManager = function (contextManager) {
-        return registerGlobal(API_NAME$2, contextManager, DiagAPI.instance());
+        return registerGlobal(API_NAME$3, contextManager, DiagAPI.instance());
     };
     /**
      * Get the currently active context
@@ -4395,12 +5540,12 @@ var ContextAPI = /** @class */ (function () {
         return this._getContextManager().bind(context, target);
     };
     ContextAPI.prototype._getContextManager = function () {
-        return getGlobal(API_NAME$2) || NOOP_CONTEXT_MANAGER;
+        return getGlobal(API_NAME$3) || NOOP_CONTEXT_MANAGER;
     };
     /** Disable and remove the global context manager */
     ContextAPI.prototype.disable = function () {
         this._getContextManager().disable();
-        unregisterGlobal(API_NAME$2, DiagAPI.instance());
+        unregisterGlobal(API_NAME$3, DiagAPI.instance());
     };
     return ContextAPI;
 }());
@@ -4977,6 +6122,111 @@ var context = ContextAPI.getInstance();
  */
 var diag = DiagAPI.instance();
 
+/*
+ * Copyright The OpenTelemetry Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * An implementation of the {@link MeterProvider} which returns an impotent Meter
+ * for all calls to `getMeter`
+ */
+var NoopMeterProvider = /** @class */ (function () {
+    function NoopMeterProvider() {
+    }
+    NoopMeterProvider.prototype.getMeter = function (_name, _version, _options) {
+        return NOOP_METER;
+    };
+    return NoopMeterProvider;
+}());
+var NOOP_METER_PROVIDER = new NoopMeterProvider();
+
+/*
+ * Copyright The OpenTelemetry Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+var API_NAME$2 = 'metrics';
+/**
+ * Singleton object which represents the entry point to the OpenTelemetry Metrics API
+ */
+var MetricsAPI = /** @class */ (function () {
+    /** Empty private constructor prevents end users from constructing a new instance of the API */
+    function MetricsAPI() {
+    }
+    /** Get the singleton instance of the Metrics API */
+    MetricsAPI.getInstance = function () {
+        if (!this._instance) {
+            this._instance = new MetricsAPI();
+        }
+        return this._instance;
+    };
+    /**
+     * Set the current global meter provider.
+     * Returns true if the meter provider was successfully registered, else false.
+     */
+    MetricsAPI.prototype.setGlobalMeterProvider = function (provider) {
+        return registerGlobal(API_NAME$2, provider, DiagAPI.instance());
+    };
+    /**
+     * Returns the global meter provider.
+     */
+    MetricsAPI.prototype.getMeterProvider = function () {
+        return getGlobal(API_NAME$2) || NOOP_METER_PROVIDER;
+    };
+    /**
+     * Returns a meter from the global meter provider.
+     */
+    MetricsAPI.prototype.getMeter = function (name, version, options) {
+        return this.getMeterProvider().getMeter(name, version, options);
+    };
+    /** Remove the global meter provider */
+    MetricsAPI.prototype.disable = function () {
+        unregisterGlobal(API_NAME$2, DiagAPI.instance());
+    };
+    return MetricsAPI;
+}());
+
+/*
+ * Copyright The OpenTelemetry Authors
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+// Split module-level variable definition into separate files to allow
+// tree-shaking on each api instance.
+/** Entrypoint for metrics API */
+MetricsAPI.getInstance();
+
 /*
  * Copyright The OpenTelemetry Authors
  *
@@ -15941,4 +17191,4 @@ function createDelegator(config) {
     return new A2ATaskDelegator(config);
 }
 
-export { A2AClient, A2AError, A2AServer, A2ATaskDelegator, SekuireAgent as Agent, AgentIdentity, AnthropicProvider, Beacon, ComplianceError, ComplianceMonitor, ContentPolicyError, CryptoError, DEFAULT_API_URL, FileAccessError, GoogleProvider, InMemoryStorage, NetworkComplianceError, NetworkError, OllamaProvider, OpenAIProvider, PolicyClient, PolicyEnforcer, PolicyViolationError, PostgresStorage, ProtocolError, RedisStorage, SekuireAgent$1 as SekuireAgent, SekuireAgentBuilder, SekuireClient, SekuireCrypto, SekuireError, SekuireLogger, SekuireRegistryClient, SekuireSDK, SekuireServer, SekuireSpanExporter, TaskWorker, ToolPatternParser, ToolRegistry, ToolUsageError, builtInTools, calculateSekuireId, createAgent, createBeacon, createDefaultToolRegistry, createDelegationTool, createDelegator, createDiscoveryTool, createLLMProvider, createMemoryStorage, createRegistryClient, createSekuireClient, createSekuireExpressMiddleware, createSekuireFastifyPlugin, createWorker, detectDeploymentUrl, generateKeyPair, getAgent, getAgentConfig, getAgents, getTools$1 as getLegacyTools, getSystemPrompt, getTools, getTracer, initTelemetry, llm, loadConfig, loadSystemPrompt, loadTools, shutdownTelemetry, tool, tools };
+export { A2AClient, A2AError, A2AServer, A2ATaskDelegator, SekuireAgent as Agent, AgentIdentity, AnthropicProvider, BaseMemoryStorage, Beacon, CONVEX_FUNCTIONS_TEMPLATE, CONVEX_SCHEMA_TEMPLATE, CloudflareD1Storage, CloudflareKVStorage, ComplianceError, ComplianceMonitor, ContentPolicyError, ConvexStorage, CryptoError, DEFAULT_API_URL, DynamoDBStorage, FileAccessError, GoogleProvider, InMemoryStorage, NetworkComplianceError, NetworkError, OllamaProvider, OpenAIProvider, PolicyClient, PolicyEnforcer, PolicyViolationError, PostgresStorage, ProtocolError, RedisStorage, SQLiteStorage, SekuireAgent$1 as SekuireAgent, SekuireAgentBuilder, SekuireClient, SekuireCrypto, SekuireError, SekuireLogger, SekuireRegistryClient, SekuireSDK, SekuireServer, SekuireSpanExporter, TaskWorker, ToolPatternParser, ToolRegistry, ToolUsageError, TursoStorage, UpstashStorage, builtInTools, calculateSekuireId, createAgent, createBeacon, createDefaultToolRegistry, createDelegationTool, createDelegator, createDiscoveryTool, createLLMProvider, createMemoryStorage, createRegistryClient, createSekuireClient, createSekuireExpressMiddleware, createSekuireFastifyPlugin, createWorker, detectDeploymentUrl, generateKeyPair, getAgent, getAgentConfig, getAgents, getTools$1 as getLegacyTools, getStorageInfo, getSystemPrompt, getTools, getTracer, hasStorage, initTelemetry, listStorageTypes, llm, loadConfig, loadSystemPrompt, loadTools, registerStorage, shutdownTelemetry, tool, tools };