@upx-us/shield 0.2.16-beta → 0.3.4

package/dist/src/redactor/vault.js

@@ -1,18 +1,4 @@
 "use strict";
-/**
- * src/redactor/vault.ts — Key management and encrypted mapping store.
- *
- * The vault owns all I/O. Key lifecycle, map persistence, reverse lookup —
- * everything involving files or crypto state lives here. No other module in
- * the redactor touches the filesystem.
- *
- * Security layers:
- *   - File permissions: 0o600 on key and vault files
- *   - Encryption at rest: AES-256-GCM with scrypt-derived key
- *   - Atomic writes: write to .tmp then rename (prevents mid-write corruption)
- *   - In-memory isolation: state fully encapsulated in this module
- *   - Test isolation: _initVaultForTesting() uses deterministic secret, no file I/O
- */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -57,23 +43,21 @@ const crypto = __importStar(require("crypto"));
 const fs = __importStar(require("fs"));
 const os = __importStar(require("os"));
 const path = __importStar(require("path"));
-// ─── Paths ────────────────────────────────────────────────────────────────────
 const SHIELD_DATA_DIR = path.join(os.homedir(), '.openclaw', 'shield', 'data');
 const KEY_FILE = path.join(SHIELD_DATA_DIR, 'redaction-key.secret');
 const VAULT_FILE = path.join(SHIELD_DATA_DIR, 'redaction-vault.json');
 const VAULT_TMP = `${VAULT_FILE}.tmp`;
-// Legacy plaintext map (pre-vault) — migrated on first init
 const LEGACY_MAP = path.join(SHIELD_DATA_DIR, 'redaction-map.json');
-// ─── State ────────────────────────────────────────────────────────────────────
 let _secret = null;
 let _map = {};
 let _mapDirty = false;
 let _testMode = false;
-// ─── Crypto Helpers ───────────────────────────────────────────────────────────
+let _derivedKey = null;
 function deriveVaultKey(secret) {
-    // Fixed salt is acceptable for v1: the HMAC secret is already random (32 hex bytes),
-    // so we're protecting against at-rest reads, not dictionary attacks on the key.
-    return crypto.scryptSync(secret, 'shield-vault-salt', 32);
+    if (_derivedKey)
+        return _derivedKey;
+    _derivedKey = crypto.scryptSync(secret, 'shield-vault-salt', 32);
+    return _derivedKey;
 }
 function encryptMap(data, key) {
     const iv = crypto.randomBytes(16);
@@ -90,7 +74,6 @@ function decryptMap(env, key) {
     decipher.setAuthTag(Buffer.from(env.tag, 'hex'));
     return decipher.update(env.ciphertext, 'hex', 'utf8') + decipher.final('utf8');
 }
-// ─── Key Management ───────────────────────────────────────────────────────────
 function getSecret() {
     if (_secret)
         return _secret;
@@ -105,11 +88,9 @@ function getSecret() {
     }
     return _secret;
 }
-// ─── Vault I/O ────────────────────────────────────────────────────────────────
 function loadVault() {
     if (_testMode)
         return;
-    // Try primary vault file, fall back to .tmp if primary is missing (crash recovery)
     let fileToLoad = null;
     if (fs.existsSync(VAULT_FILE))
         fileToLoad = VAULT_FILE;
@@ -131,9 +112,6 @@ function loadVault() {
         }
         return;
     }
-    // Migrate from legacy plaintext redaction-map.json if it exists.
-    // Check both locations: the new data dir AND the old project-root config/ directory
-    // (pre-v0.2 bridge stored it at config/redaction-map.json relative to the repo root).
     const OLD_PROJECT_MAP = path.join(__dirname, '..', '..', 'config', 'redaction-map.json');
     const legacyPath = [LEGACY_MAP, OLD_PROJECT_MAP].find(p => fs.existsSync(p));
     if (legacyPath) {
@@ -142,7 +120,7 @@ function loadVault() {
             const count = Object.keys(legacy).length;
             _map = legacy;
             _mapDirty = true;
-            flushVault(); // write encrypted vault immediately
+            flushVault();
             fs.unlinkSync(legacyPath);
             console.log(`[vault] Migrated ${count} mappings from legacy plaintext map (${legacyPath})`);
         }
@@ -160,7 +138,6 @@ function saveVault() {
         const key = deriveVaultKey(getSecret());
         const encrypted = encryptMap(JSON.stringify(_map), key);
         const content = JSON.stringify(encrypted);
-        // Atomic write: .tmp first, then rename
         fs.writeFileSync(VAULT_TMP, content, { mode: 0o600 });
         fs.renameSync(VAULT_TMP, VAULT_FILE);
         _mapDirty = false;
@@ -169,7 +146,6 @@ function saveVault() {
         console.error(`[vault] Failed to persist vault: ${e.message}`);
     }
 }
-// ─── Public API ───────────────────────────────────────────────────────────────
 function initVault() {
     getSecret();
     loadVault();
@@ -178,10 +154,6 @@ function initVault() {
 function flushVault() {
     saveVault();
 }
-/**
- * Produce a deterministic token for a (category, value) pair and record the
- * reverse mapping. This is the HmacFn injected into every strategy.
- */
 function hmacHash(category, value) {
     const hash = crypto.createHmac('sha256', getSecret())
         .update(`${category}:${value}`)
@@ -200,9 +172,9 @@ function reverseLookup(token) {
 function getAllMappings() {
     return { ..._map };
 }
-/** For testing only — deterministic secret, zero file I/O. */
 function _initVaultForTesting(secret) {
     _secret = secret;
+    _derivedKey = null;
     _map = {};
     _mapDirty = false;
     _testMode = true;

package/dist/src/sender.d.ts

@@ -1,34 +1,26 @@
-/**
- * sender.ts — Shield ingest API sender
- *
- * Posts events to the Shield ingest API via HMAC-SHA256 authentication.
- * Events are batched and sent to the configured Shield endpoint only —
- * no cloud provider details are exposed in this module.
- */
 import { EnvelopeEvent } from './transformer';
 import { Config, ShieldCredentials } from './config';
 export declare const REQUEST_TIMEOUT_MS = 30000;
-/** Exported for testing only — computes HMAC with an explicit secret */
+export declare const CIRCUIT_BREAKER_THRESHOLD = 2;
 export declare function _signRequestWithSecret(secret: string, instanceId: string, nonce: string): string;
 export interface SendResult {
     success: boolean;
     statusCode?: number;
     body?: string;
     eventCount: number;
-    /** True when Cloud Run returns 202 pending_namespace — hold cursors, backoff retry_after */
     pendingNamespace?: boolean;
     retryAfterMs?: number;
-    /** True when Cloud Run returns 403 needs_registration — plugin must self-halt */
     needsRegistration?: boolean;
 }
 export declare function sendEvents(events: EnvelopeEvent[], config: Config): Promise<SendResult[]>;
-/**
- * reportInstance — PUT /v1/instance
- *
- * Reports machine + software metadata to the Shield platform for score
- * calculation and dashboard display. This is NOT a security event and does
- * NOT go to Chronicle — it goes directly to the platform API via Cloud Run.
- *
- * Called periodically (default: every 5 minutes) by the bridge/plugin loop.
- */
-export declare function reportInstance(payload: Record<string, unknown>, credentials: ShieldCredentials): Promise<boolean>;
+export interface InstanceScore {
+    total: number;
+    grade: string;
+    badge: string;
+    recommendations: string[];
+}
+export interface ReportInstanceResult {
+    ok: boolean;
+    score?: InstanceScore;
+}
+export declare function reportInstance(payload: Record<string, unknown>, credentials: ShieldCredentials): Promise<ReportInstanceResult>;

package/dist/src/sender.js

@@ -1,11 +1,4 @@
 "use strict";
-/**
- * sender.ts — Shield ingest API sender
- *
- * Posts events to the Shield ingest API via HMAC-SHA256 authentication.
- * Events are batched and sent to the configured Shield endpoint only —
- * no cloud provider details are exposed in this module.
- */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -40,7 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.REQUEST_TIMEOUT_MS = void 0;
+exports.CIRCUIT_BREAKER_THRESHOLD = exports.REQUEST_TIMEOUT_MS = void 0;
 exports._signRequestWithSecret = _signRequestWithSecret;
 exports.sendEvents = sendEvents;
 exports.reportInstance = reportInstance;
@@ -49,9 +42,9 @@ const log = __importStar(require("./log"));
 const version_1 = require("./version");
 const BATCH_SIZE = 100;
 exports.REQUEST_TIMEOUT_MS = 30_000;
-/** Minimum delay between consecutive batch POSTs (ms). Prevents Cloud Armor rate-limit
- *  from triggering during backfill bursts. 200ms ≈ 5 req/s = 300 req/min (well under 600/min limit). */
+exports.CIRCUIT_BREAKER_THRESHOLD = 2;
 const INTER_BATCH_DELAY_MS = 200;
+const MAX_ERROR_BODY_LOG_CHARS = 200;
 function errMsg(err) {
     return err instanceof Error ? err.message : String(err);
 }
@@ -59,17 +52,22 @@ function envHeaders(shieldEnv) {
     return shieldEnv ? { 'X-Shield-Env': shieldEnv } : {};
 }
 function generateNonce() {
-    return `${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+    return `${Date.now()}-${(0, crypto_1.randomBytes)(8).toString('hex')}`;
 }
 function signRequest(instanceId, nonce, secret) {
     const message = `${instanceId}:${nonce}`;
     return (0, crypto_1.createHmac)('sha256', secret).update(message).digest('hex');
 }
-/** Exported for testing only — computes HMAC with an explicit secret */
 function _signRequestWithSecret(secret, instanceId, nonce) {
     const message = `${instanceId}:${nonce}`;
     return (0, crypto_1.createHmac)('sha256', secret).update(message).digest('hex');
 }
+function sanitizeResponseBodyForLog(body) {
+    const redacted = body.replace(/"((?:api_?key|token|secret|password|hmac_?secret))"\s*:\s*"[^"]*"/gi, '"$1":"[REDACTED]"');
+    if (redacted.length <= MAX_ERROR_BODY_LOG_CHARS)
+        return redacted;
+    return `${redacted.slice(0, MAX_ERROR_BODY_LOG_CHARS)}…`;
+}
 async function fetchWithTimeout(url, init, timeoutMs = exports.REQUEST_TIMEOUT_MS) {
     const controller = new AbortController();
     const timer = setTimeout(() => controller.abort(), timeoutMs);
@@ -99,8 +97,14 @@ async function sendEvents(events, config) {
         return [{ success: false, statusCode: 0, body: 'missing credentials', eventCount: events.length }];
     }
     const results = [];
+    let consecutiveBatchFailures = 0;
     for (let i = 0; i < events.length; i += BATCH_SIZE) {
-        // Throttle between batches to avoid Cloud Armor rate-limit during backfill
+        if (consecutiveBatchFailures >= exports.CIRCUIT_BREAKER_THRESHOLD) {
+            const remaining = events.slice(i);
+            log.warn('sender', `Circuit breaker: ${consecutiveBatchFailures} consecutive failures — skipping ${remaining.length} remaining events`);
+            results.push({ success: false, statusCode: 0, body: 'circuit breaker', eventCount: remaining.length });
+            break;
+        }
         if (i > 0)
             await new Promise(r => setTimeout(r, INTER_BATCH_DELAY_MS));
         const batch = events.slice(i, i + BATCH_SIZE);
@@ -115,8 +119,8 @@ async function sendEvents(events, config) {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json',
-                        'X-Shield-Instance-Id': instanceId, // legacy name
-                        'X-Shield-Fingerprint': instanceId, // canonical name
+                        'X-Shield-Instance-Id': instanceId,
+                        'X-Shield-Fingerprint': instanceId,
                         'X-Shield-Nonce': nonce,
                         'X-Shield-Signature': signature,
                         'X-Shield-Version': version_1.VERSION,
@@ -127,13 +131,12 @@ async function sendEvents(events, config) {
                 const data = await res.text();
                 log.info('sender', `Batch ${batchNum}: ${batch.length} events (HTTP ${res.status})`);
                 if (res.ok && res.status === 200) {
+                    consecutiveBatchFailures = 0;
                     results.push({ success: true, statusCode: res.status, body: data, eventCount: batch.length });
                     break;
                 }
-                // 202 pending_namespace — namespace not yet allocated by SIEM.
-                // Events must NOT be committed; plugin should hold and retry after retry_after.
                 if (res.status === 202) {
-                    let retryAfterMs = 300_000; // default 5 min
+                    let retryAfterMs = 300_000;
                     try {
                         retryAfterMs = (JSON.parse(data).retry_after ?? 300) * 1000;
                     }
@@ -143,7 +146,6 @@ async function sendEvents(events, config) {
                         pendingNamespace: true, retryAfterMs });
                     break;
                 }
-                // 403 needs_registration — instance unknown or inactive, plugin must self-halt.
                 if (res.status === 403) {
                     let needsReg = false;
                     try {
@@ -161,13 +163,16 @@ async function sendEvents(events, config) {
                     log.warn('sender', `Batch ${batchNum} attempt ${attempt + 1} — HTTP ${res.status}, retrying...`);
                     continue;
                 }
-                log.error('sender', `Batch ${batchNum} — HTTP ${res.status}: ${data}`);
+                const safeBody = sanitizeResponseBodyForLog(data);
+                log.error('sender', `Batch ${batchNum} — HTTP ${res.status}: ${safeBody}`);
+                consecutiveBatchFailures++;
                 results.push({ success: false, statusCode: res.status, body: data, eventCount: batch.length });
                 break;
             }
             catch (err) {
                 log.error('sender', `Batch ${batchNum} attempt ${attempt + 1} — ${errMsg(err)}`);
                 if (attempt === 1) {
+                    consecutiveBatchFailures++;
                     results.push({ success: false, statusCode: 0, body: errMsg(err), eventCount: batch.length });
                 }
             }
@@ -175,20 +180,11 @@ async function sendEvents(events, config) {
     }
     return results;
 }
-/**
- * reportInstance — PUT /v1/instance
- *
- * Reports machine + software metadata to the Shield platform for score
- * calculation and dashboard display. This is NOT a security event and does
- * NOT go to Chronicle — it goes directly to the platform API via Cloud Run.
- *
- * Called periodically (default: every 5 minutes) by the bridge/plugin loop.
- */
 async function reportInstance(payload, credentials) {
     const { apiUrl, instanceId, hmacSecret, shieldEnv } = credentials;
     if (!apiUrl || !instanceId || !hmacSecret) {
         log.warn('sender', 'reportInstance: missing credentials, skipping');
-        return false;
+        return { ok: false };
     }
     const nonce = generateNonce();
     const signature = signRequest(instanceId, nonce, hmacSecret);
@@ -198,8 +194,8 @@ async function reportInstance(payload, credentials) {
             method: 'PUT',
             headers: {
                 'Content-Type': 'application/json',
-                'X-Shield-Instance-Id': instanceId, // legacy
-                'X-Shield-Fingerprint': instanceId, // canonical
+                'X-Shield-Instance-Id': instanceId,
+                'X-Shield-Fingerprint': instanceId,
                 'X-Shield-Nonce': nonce,
                 'X-Shield-Signature': signature,
                 'X-Shield-Version': version_1.VERSION,
@@ -209,13 +205,21 @@ async function reportInstance(payload, credentials) {
         });
         if (!res.ok) {
             const body = await res.text();
-            log.warn('sender', `reportInstance HTTP ${res.status}: ${body.slice(0, 100)}`);
-            return false;
+            log.warn('sender', `reportInstance HTTP ${res.status}: ${sanitizeResponseBodyForLog(body)}`);
+            return { ok: false };
+        }
+        let score;
+        try {
+            const json = await res.json();
+            if (json.score)
+                score = json.score;
+        }
+        catch {
         }
-        return true;
+        return { ok: true, score };
     }
     catch (err) {
         log.warn('sender', `reportInstance error: ${errMsg(err)}`);
-        return false;
+        return { ok: false };
     }
 }

package/dist/src/setup.d.ts

@@ -1,10 +1,12 @@
 #!/usr/bin/env node
-/**
- * setup.ts — Interactive configuration wizard for Shield
- *
- * Two-stage credential flow:
- *   1. User provides a registration key from the Shield portal
- *   2. POST /v1/register exchanges it for an HMAC signing secret
- *   3. The returned HMAC secret + generated instance ID are saved to config.env
- */
-export {};
+interface SetupConfig {
+    apiUrl: string;
+    installationKey: string;
+    instanceName: string;
+    instanceId: string;
+    hmacSecret: string;
+}
+export declare function generateInstanceId(): string;
+export declare function registerInstance(config: SetupConfig): Promise<string | null>;
+export declare function saveConfig(config: SetupConfig, configPath?: string): void;
+export type { SetupConfig };

package/dist/src/setup.js

@@ -1,13 +1,5 @@
 #!/usr/bin/env node
 "use strict";
-/**
- * setup.ts — Interactive configuration wizard for Shield
- *
- * Two-stage credential flow:
- *   1. User provides a registration key from the Shield portal
- *   2. POST /v1/register exchanges it for an HMAC signing secret
- *   3. The returned HMAC secret + generated instance ID are saved to config.env
- */
 var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
     if (k2 === undefined) k2 = k;
     var desc = Object.getOwnPropertyDescriptor(m, k);
@@ -42,17 +34,23 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.generateInstanceId = generateInstanceId;
+exports.registerInstance = registerInstance;
+exports.saveConfig = saveConfig;
 const readline = __importStar(require("readline"));
 const fs_1 = require("fs");
 const path_1 = require("path");
 const os_1 = require("os");
 const config_1 = require("./config");
+const version_1 = require("./version");
 const crypto_1 = require("crypto");
-const rl = readline.createInterface({
-    input: process.stdin,
-    output: process.stdout
-});
-function prompt(question) {
+function createRl() {
+    return readline.createInterface({
+        input: process.stdin,
+        output: process.stdout
+    });
+}
+function prompt(rl, question) {
     return new Promise((resolve) => {
         rl.question(question, (answer) => resolve(answer.trim()));
     });
@@ -87,9 +85,8 @@ async function testConnection(apiUrl) {
 async function registerInstance(config) {
     try {
         process.stdout.write('Registering instance... ');
-        // Cloud Run /v1/register expects: installation_code + fingerprint
         const payload = {
-            installation_code: config.registrationKey,
+            installation_code: config.installationKey,
             fingerprint: config.instanceId,
             machine: {
                 hostname: (0, os_1.hostname)(),
@@ -99,7 +96,7 @@ async function registerInstance(config) {
                 node_version: process.version,
             },
             software: {
-                plugin_version: '0.2.8-beta',
+                plugin_version: version_1.VERSION,
                 instance_name: config.instanceName,
             },
         };
@@ -129,7 +126,7 @@ async function registerInstance(config) {
                 const parsed = JSON.parse(body);
                 msg = parsed.message || parsed.error || msg;
             }
-            catch { /* raw */ }
+            catch { }
             console.log(`failed — ${msg}`);
             return null;
         }
@@ -139,14 +136,14 @@ async function registerInstance(config) {
         return null;
     }
 }
-function saveConfig(config) {
-    const configDir = (0, path_1.join)(config_1.SHIELD_CONFIG_PATH, '..');
+function saveConfig(config, configPath = config_1.SHIELD_CONFIG_PATH) {
+    const configDir = (0, path_1.join)(configPath, '..');
     if (!(0, fs_1.existsSync)(configDir)) {
         (0, fs_1.mkdirSync)(configDir, { recursive: true });
     }
     const envContent = `# Shield API Configuration
 # Generated by shield-setup on ${new Date().toISOString()}
-# Location: ${config_1.SHIELD_CONFIG_PATH}
+# Location: ${configPath}
 
 SHIELD_API_URL=${config.apiUrl}
 SHIELD_INSTANCE_ID=${config.instanceId}
@@ -159,44 +156,53 @@ INSTANCE_NAME=${config.instanceName}
 # REDACTION_ENABLED=true
 # SESSION_DIR=/path/to/custom/sessions
 `;
-    (0, fs_1.writeFileSync)(config_1.SHIELD_CONFIG_PATH, envContent, { encoding: 'utf-8', mode: 0o600 });
-    console.log(`✅ Configuration saved to ${config_1.SHIELD_CONFIG_PATH}`);
+    (0, fs_1.writeFileSync)(configPath, envContent, { encoding: 'utf-8', mode: 0o600 });
+    console.log(`✅ Configuration saved to ${configPath}`);
 }
 const SHIELD_API_URL = 'https://openclaw-shield.upx.com';
 async function main() {
+    const rl = createRl();
     console.log('🛡️  OpenClaw Shield Setup');
     console.log('==========================\n');
+    process.on('SIGINT', () => {
+        console.log('\n\nSetup cancelled by user.');
+        rl.close();
+        process.exit(0);
+    });
     try {
-        const registrationKey = await prompt('Installation Key (from Shield portal): ');
-        if (!registrationKey) {
+        const installationKey = await prompt(rl, 'Installation Key (from Shield portal): ');
+        if (!installationKey) {
             console.log('❌ Installation key is required');
+            rl.close();
             process.exit(1);
         }
         const instanceName = `openclaw-${(0, os_1.hostname)()}`;
         const instanceId = generateInstanceId();
         const config = {
             apiUrl: SHIELD_API_URL,
-            registrationKey,
+            installationKey,
             instanceName,
             instanceId,
             hmacSecret: '',
         };
-        // Warn if credentials already exist
         if ((0, fs_1.existsSync)(config_1.SHIELD_CONFIG_PATH)) {
-            const overwrite = await prompt('⚠️  Shield is already configured. Overwrite? (y/N): ');
+            const overwrite = await prompt(rl, '⚠️  Shield is already configured. Overwrite? (y/N): ');
             if (overwrite.toLowerCase() !== 'y' && overwrite.toLowerCase() !== 'yes') {
                 console.log('Setup cancelled. Existing configuration preserved.');
+                rl.close();
                 process.exit(0);
             }
         }
         const connectionOk = await testConnection(SHIELD_API_URL);
         if (!connectionOk) {
             console.log('❌ Cannot reach the Shield API. Check your internet connection and try again.');
+            rl.close();
             process.exit(1);
         }
         const exchangedSecret = await registerInstance(config);
         if (!exchangedSecret) {
             console.log('❌ Registration failed. Please verify your installation key and try again.');
+            rl.close();
             process.exit(1);
         }
         config.hmacSecret = exchangedSecret;
@@ -212,11 +218,6 @@ async function main() {
         rl.close();
     }
 }
-process.on('SIGINT', () => {
-    console.log('\n\nSetup cancelled by user.');
-    rl.close();
-    process.exit(0);
-});
 if (require.main === module) {
     main();
 }

package/dist/src/transformer.d.ts

@@ -1,11 +1,3 @@
-/**
- * transformer.ts — Thin orchestration layer
- *
- * Iterates raw JSONL entries, routes each tool call to the matching schema,
- * and wraps the resulting ShieldEvent in an EnvelopeEvent for transmission.
- *
- * All enrichment logic lives in src/events/{type}/enrich.ts.
- */
 import { RawEntry } from './fetcher';
 import type { ShieldEvent, SourceInfo } from './events';
 export type { SourceInfo };
@@ -13,14 +5,11 @@ export interface EnvelopeEvent {
     source: SourceInfo;
     event: ShieldEvent;
 }
-/** Top-level request body for POST /v1/ingest — used for JSON Schema generation */
 export interface IngestPayload {
     entries: EnvelopeEvent[];
 }
-/** Resolve the installed OpenClaw version from known package.json paths. */
 export declare function resolveOpenClawVersion(): string;
-/** Resolve agent_label from IDENTITY.md in the configured workspace. */
 export declare function resolveAgentLabel(agentId: string): string;
+export declare function resolveOutboundIp(): Promise<string | null>;
 export declare function transformEntries(entries: RawEntry[]): EnvelopeEvent[];
-/** Generate a HOST_TELEMETRY envelope with version + config info for security rules */
 export declare function generateHostTelemetry(): EnvelopeEvent | null;