@visiq/claude-code-harness 0.1.12 → 0.1.13

package/dist/chunk-PH5GYJ6P.js

@@ -0,0 +1,3 @@
+import{A as m,B as K,C as G,D as Y,E as z,F as y,c as P,i as v,j as F,k as D,l as A,m as q,n as V,o as L,p as M,q as j,r as H,s as U,t as B,u as Q,w as W,x as g,y as $,z as J}from"./chunk-TG66JAN2.js";import{appendFile as re,mkdir as se}from"node:fs/promises";import{join as ae}from"node:path";function le(){return ae(P(),"fail-open.log")}async function l(e,t=!0){let n=`[VisIQ] FAIL-OPEN (${e.stage}): ${e.detail} \u2014 tool call proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`;try{process.stderr.write(`${n}
+`)}catch{}if(t)try{await se(P(),{recursive:!0}),await re(le(),`${JSON.stringify({at:new Date().toISOString(),...e})}
+`,{mode:384})}catch{}}async function w(e,t={}){e.failOpen===!0&&await l({stage:"runtime-fail-open",detail:e.reason,...t.toolName?{toolName:t.toolName}:{},...t.sessionId?{sessionId:t.sessionId}:{}})}var ce=new Set(["WebFetch","WebSearch","Read","Grep","Glob","LSP","NotebookRead","ListMcpResourcesTool","ReadMcpResourceTool"]),ue=/(^|_)(search|fetch|read|list|get|query|retrieve|lookup|find|describe|download|export|dump)(_|$)/i;function de(e){if(typeof e!="string"||!e.startsWith("mcp__"))return typeof e=="string"?e:"";let t=e.lastIndexOf("__");return t>=0?e.slice(t+2):e}function b(e){return typeof e!="string"?!1:ce.has(e)?!0:e.startsWith("mcp__")?ue.test(de(e)):!1}function X(e){return b(e)?["retrieval","action"]:["action"]}var pe=["query","q","url","prompt","pattern","file_path","path"];function k(e){if(!e||typeof e!="object")return;let t=e,n=[];for(let o of pe){let i=t[o];typeof i=="string"&&i.length>0&&n.push(i)}return n.length>0?n.join(" "):void 0}function c(e,t){let n=t?`VisIQ ${t}`:"VisIQ",o=e&&e.trim().length>0?e.trim():"blocked by policy";return`[${n}] ${o}`}function Z(e){let t={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow"}};return e&&(t.hookSpecificOutput.updatedInput=e),t}function _(e){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:e}}}function ee(e){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:e}}}function u(e,t){let n={hookSpecificOutput:{hookEventName:"PostToolUse",updatedToolOutput:e}};return t&&(n.hookSpecificOutput.additionalContext=t),n}function Se(e){try{let t=JSON.parse(e);return t&&typeof t=="object"&&typeof t.hook_event_name=="string"?t:null}catch{return null}}var fe="[VisIQ: retrieval withheld by policy]";function h(e){return T(e)}function T(e){if(e==null)return e;if(typeof e=="string")return e.length>0?fe:e;if(typeof e=="number")return 0;if(typeof e=="boolean")return!1;if(Array.isArray(e))return e.map(T);if(typeof e=="object"){let t=Object.create(null);for(let n of Object.keys(e))t[n]=T(e[n]);return t}return e}function te(e){return e.fields&&e.fields.length>0||e.patterns&&e.patterns.length>0?!0:!!e.directives?.some(t=>t.field&&t.field.length>0||t.pattern&&t.pattern.length>0)}function ne(e,t){if(!e.enforced)return null;let{action:n,retrieval:o}=e,i=c(e.reason,e.ruleCode);if(n.decision==="deny"||o.action==="deny")return _(i);if(n.decision==="approval_required"||o.action==="escalate")return ee(i);if(n.decision==="mask"&&n.argRedactionRules&&n.argRedactionRules.length>0){let r=U(n.argRedactionRules);if(te(r)){let s=v(t,r)??t;if(JSON.stringify(s)!==JSON.stringify(t))return Z(s)}return null}return null}function oe(e,t){if(!e.enforced)return null;let{retrieval:n}=e,o=c(e.reason,e.ruleCode);if(n.action==="redact"){let i=U(n.redactionRules??[]);if(!te(i))return u(h(t),o);let r=v(t,i);return JSON.stringify(r)===JSON.stringify(t)?null:u(r,o)}return n.action==="deny"?u(h(t),o):null}var me="cli_harness";function d(e){let t=new A(e.apiKey,e.baseUrl,e.agentId,me,void 0,B,F);return t.setFailMode(e.failMode),t}function I(e){let t={operations:e.operations,agentId:e.agentId,toolName:e.toolName,toolArgs:e.toolInput,resourceType:"tool_result",resourceMetadata:{toolName:e.toolName,...e.toolUseId?{toolCallId:e.toolUseId}:{},...e.sessionId?{sessionId:e.sessionId}:{},...e.cwd?{cwd:e.cwd}:{}}};return e.query&&(t.query=e.query),e.context&&(t.context=e.context),t}async function p(e,t,n=Q){let{agentId:o}=t,i=await K(o);if(i&&W(i,n,Date.now())&&x(e,i.body))return!0;let r=e.getEndpoint();if(r){let s=await Y(r,t.apiKey,o);if(s&&x(e,s.body))return await G(o,s.body,s.version),!0}if(i&&x(e,i.body))return!0;try{await e.awaitBundleReady(2500)}catch{}return e.isBundleLoaded()}function x(e,t){try{return e.applyBundle(t),!0}catch{return!1}}async function f(e){try{await e.flush()}catch{}let t=typeof e.droppedTelemetryCount=="function"?e.droppedTelemetryCount():0;try{e.dispose()}catch{}return t}async function ge(e){let{homedir:t}=await import("node:os"),{join:n}=await import("node:path");return[...e?[n(e,".claude","skills")]:[],n(t(),".claude","skills")]}async function R(e){let t=await H(await ge(e)),n={};for(let o of t){n[o.name]=o.fingerprint;let i=M(o.path);i&&(n[i]=o.fingerprint)}return{records:t,fingerprints:n}}async function Be(e,t){let n=d(t),o=e.tool_input??{};try{if(await z(e.session_id)||(n.registerHostEnvironment(),await y(e.session_id)),!await p(n,t)&&t.failMode!=="closed")return await l({stage:"no-bundle",detail:"no rule bundle available (cache empty + fetch failed)",toolName:e.tool_name,sessionId:e.session_id}),null;let r=q(e.tool_name,o),s=X(e.tool_name),S;r&&(D(n,{agentId:t.agentId,sessionId:e.session_id,framework:"claude-code"},r),s=Array.from(new Set([...s,"delegation"])),S=V(r,t.agentId));let a=j(e.tool_name,o),O=await J(e.session_id);a?(O=a.skill,await m(e.session_id,a.skill)):L(e.tool_name)&&await m(e.session_id,null);let E=a?await ye(e.session_id,e.cwd,a.skill):void 0,C=O?{skill:{name:O,activated:!!a,...a?{via:a.via,framework:a.framework}:{},...E?{fingerprint:E}:{}}}:void 0,ie=I({operations:s,agentId:t.agentId,toolName:e.tool_name,toolInput:o,sessionId:e.session_id,cwd:e.cwd,toolUseId:e.tool_use_id,query:k(o),...S||C?{context:{...S??{},...C??{}}}:{}}),N=await n.evaluate(ie);return await w(N,{toolName:e.tool_name,sessionId:e.session_id}),ne(N,o)}catch(i){return t.failMode==="closed"?_(c("evaluation error \u2014 blocked (VISIQ_FAIL_MODE=closed)",null)):(await l({stage:"pre-eval-error",detail:i instanceof Error?i.message:String(i),toolName:e.tool_name,sessionId:e.session_id}),null)}finally{await f(n)}}async function ye(e,t,n){try{let o=await $(e);if(o[n])return o[n];let{fingerprints:i}=await R(t);return i[n]?(await g(e,{...o,...i}),i[n]):void 0}catch{return}}async function Ye(e,t){if(!b(e.tool_name))return null;let n=d(t);try{if(!await p(n,t)&&t.failMode!=="closed")return await l({stage:"no-bundle",detail:"no rule bundle available (cache empty + fetch failed)",toolName:e.tool_name,sessionId:e.session_id}),null;let i=e.tool_input??{},r=I({operations:["retrieval"],agentId:t.agentId,toolName:e.tool_name,toolInput:i,sessionId:e.session_id,cwd:e.cwd,toolUseId:e.tool_use_id,query:k(i)}),s=await n.evaluate(r);return await w(s,{toolName:e.tool_name,sessionId:e.session_id}),oe(s,e.tool_response)}catch(o){return t.failMode==="closed"?u(h(e.tool_response),c("evaluation error \u2014 withheld (VISIQ_FAIL_MODE=closed)",null)):(await l({stage:"post-eval-error",detail:o instanceof Error?o.message:String(o),toolName:e.tool_name,sessionId:e.session_id}),null)}finally{await f(n)}}async function we(e,t,n){try{let{records:o,fingerprints:i}=await R(n);if(o.length===0)return;e.reportSkillInventory(o.map(r=>({name:r.name,path:r.path,...r.description?{description:r.description}:{},content_hash:r.contentHash,fingerprint:r.fingerprint,framework:"claude-code"}))),await g(t,i)}catch{}}async function tt(e,t){let n=d(t);try{n.registerHostEnvironment(),await p(n,t,0),await y(e.session_id),await we(n,e.session_id,e.cwd),await m(e.session_id,null)}finally{await f(n)}return null}export{le as a,l as b,de as c,b as d,X as e,k as f,c as g,Z as h,_ as i,ee as j,u as k,Se as l,fe as m,h as n,ne as o,oe as p,me as q,d as r,I as s,p as t,f as u,Be as v,Ye as w,tt as x};

package/dist/chunk-TG66JAN2.js

@@ -0,0 +1,5 @@
+import{readFile as un}from"node:fs/promises";import{homedir as ge}from"node:os";import{join as K,isAbsolute as dn,resolve as pn}from"node:path";var fn="https://api.visiqlabs.com",mn="@visiq/claude-code-harness",_e="open";function ye(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function w(){let e=process.env.VISIQ_HOME;return e&&e.trim().length>0?e:K(ge(),".visiq","claude-code")}function hn(){return K(w(),"config.json")}function gn(e){return e==="~"||e.startsWith("~/")?K(ge(),e.slice(1).replace(/^\//,"")):e}async function _n(e){try{let t=dn(e)?e:pn(e),n=await un(t,"utf-8");return JSON.parse(n)}catch{return null}}function M(e,...t){for(let n of t){let r=e[n];if(typeof r=="string"&&r.length>0)return r}}function me(e){if(!e||typeof e!="object")return{};let t=e,n={},r=M(t,"apiKey","api_key"),i=M(t,"agentId","agent_id"),a=M(t,"baseUrl","base_url"),o=ye(M(t,"failMode","fail_mode"));return r&&(n.apiKey=r),i&&(n.agentId=i),a&&(n.baseUrl=a),o&&(n.failMode=o),n}async function he(e){if(!e)return{};let t=await _n(gn(e));if(!t||typeof t!="object")return{};let n=t,r=n.plugins?.entries,i=r&&typeof r=="object"?r[mn]:void 0;return i&&typeof i=="object"&&i.config?me(i.config):me(n)}function yn(e=process.env){let t={};e.VISIQ_API_KEY&&(t.apiKey=e.VISIQ_API_KEY),e.VISIQ_AGENT_ID&&(t.agentId=e.VISIQ_AGENT_ID),e.VISIQ_BASE_URL?t.baseUrl=e.VISIQ_BASE_URL:e.VISIQ_ENDPOINT&&(t.baseUrl=e.VISIQ_ENDPOINT);let n=ye(e.VISIQ_FAIL_MODE);return n&&(t.failMode=n),t}function bn(e,t,n){let r={...e,...t,...n};if(!r.apiKey||!r.agentId)return null;let i={apiKey:r.apiKey,agentId:r.agentId,failMode:r.failMode??_e};return i.baseUrl=r.baseUrl||fn,i}async function vn(){let e=yn(),t=await he(process.env.VISIQ_CONFIG_PATH),n=await he(hn()),r={...n,...t,...e};return{config:bn(n,t,e),failMode:r.failMode??_e}}async function mo(){return(await vn()).config}import{mkdir as V,readFile as fe,writeFile as W,stat as ao}from"node:fs/promises";import{createHash as oo}from"node:crypto";import{join as I}from"node:path";import{z as p}from"zod";import*as A from"node:os";import{randomUUID as Dn}from"node:crypto";var Z=1,ve="X-VisIQ-SDK",we="X-VisIQ-Dialect",Ae="unknown";function T(e,t=1){return{[ve]:e&&e.length>0?e:Ae,[we]:String(t)}}var ke="interceptor_source",wn=p.enum(["enforce","audit","off"]),An=p.enum(["closed","open"]),Se=p.enum(["enforce","monitor","off"]),kn=p.object({apiKey:p.string().min(1,"apiKey is required"),agentId:p.string().min(1,"agentId is required"),endpoint:p.string().url().optional(),mode:wn.optional(),timeoutMs:p.number().int().positive().optional(),hitlTimeoutMs:p.number().int().positive().optional(),failBehavior:An.optional()}),_o=p.object({agent_id:p.string().min(1),target_app:p.string().min(1),action:p.string().min(1),context:p.record(p.unknown()).optional(),session_id:p.string().min(1).max(255).optional(),action_schema_id:p.string().min(1).max(128).optional(),telemetry:p.record(p.unknown()).optional()}),Sn=p.object({field:p.string().optional(),pattern:p.string().optional(),replacement:p.string().optional(),mode:p.enum(["full","partial","email"]).optional(),keepFirst:p.number().optional(),keepLast:p.number().optional(),maskChar:p.string().optional()}),In=p.object({decision_id:p.string().min(1),decision:p.enum(["permit","deny","approval_required","mask"]),reason:p.string().optional(),rule_code:p.string().nullable().optional(),enforced:p.boolean().optional(),agent_mode:Se.optional(),arg_redaction_rules:p.array(Sn).optional(),plane:p.string().nullable().optional(),operation:p.string().nullable().optional(),is_retrieval:p.boolean().optional(),metadata:p.record(p.unknown()).optional()}),En=p.object({field:p.string().min(1),operator:p.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:p.union([p.string(),p.number(),p.array(p.string())])}),Cn=p.object({id:p.string().min(1),rule_code:p.string().default(""),name:p.string().min(1),description:p.string().nullable().default(null),effect:p.enum(["allow","deny","hitl","mask"]),resource_type:p.string().min(1),rego_source:p.string().default(""),target_app:p.string().nullable().default(null),action_pattern:p.string().nullable().default(null),conditions:p.array(En).default([]),priority:p.number().int().default(0)}),Tn=p.object({version:p.string().min(1),agent_mode:Se.optional(),rules:p.array(Cn),no_coverage:p.object({no_coverage_defaults:p.record(p.string()),autopilot_enabled:p.boolean(),enduser_hitl_enabled:p.boolean(),hitl_timeout_seconds:p.number()}).optional()}),Nn=2e3,xn=e=>new RegExp("^\\p{White_Space}*$","u").test(e)||e.trim().length===0;function On(e){let t=e.rules.filter(n=>xn(n.rego_source)).map(n=>n.id);return t.length>0&&console.warn(`[VISIQ] ${t.length} bundle rule(s) carry an EMPTY rego body and will be evaluated as an UNCONDITIONAL PERMIT credited to their own rule id: ${t.join(", ")}. If any of these is meant to deny, it is not denying. Fix the rule body at the control plane; the SDK cannot tell an intentional stub from a dropped column.`),t}var Ie=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return T(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let i=await r.json();return In.parse(i)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json(),o=Tn.parse(a);return On(o),o}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let i=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});i.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${i.status}`)}catch(i){console.warn("[ALLOW] Execution result report failed:",i)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{system_prompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{tool_schemas:e.toolSchemas}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async reportSkillInventory(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/skills`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,skills:e})});n.ok||console.warn(`[ALLOW] Skill-inventory report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Skill-inventory report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json();if(typeof a!="object"||a===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let o=a,s=o.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof o.reason=="string"?o.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await Rn(Nn)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function Rn(e){return new Promise(t=>setTimeout(t,e))}function Y(){let e={};try{let t=`${A.platform()} ${A.release()}`.trim();t&&(e.os=t)}catch{}try{let t=A.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=A.userInfo();t&&(e.username=t)}catch{}try{let t=$n();t&&(e.ip=t)}catch{}return e}function $n(){let e=A.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}var be=new Map;function Mn(e){let t=(be.get(e)??0)+1;return be.set(e,t),t}function Pn(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:Dn(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:Mn(r),ts:Date.now(),kind:"spawn",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},spawn:{childAgentId:n.childAgentId,childName:n.childName,kind:n.kind,...n.model?{model:n.model}:{},...n.task?{prompt:n.task}:{}}})}import{z as f}from"zod";import{createHash as Ln}from"crypto";import{createHash as vr}from"crypto";var Ee=new Map;function Ce(e){return e.map(t=>t.trim()).filter(t=>t.length>0&&t!=="true")}function J(e){let t=Ln("sha256").update(e).digest("hex"),n=Ee.get(t);if(n)return n;let r=new Map,i=[],a=e.split(`
+`).map(l=>Fn(l)).filter(l=>l.trim().length>0),o=0;for(;o<a.length;){let l=a[o].trim();if(l.startsWith("package ")||l.startsWith("import ")){o++;continue}let c=l.match(/^default\s+(\w+)\s*:?=\s*(.+)$/);if(c){let m=c[1],h=c[2].trim();r.set(m,x(h)),o++;continue}let u=l.match(/^(\w+)\s*:?=\s*(.+?)(?:\s+if)?\s*\{(.*)$/);if(u){let m=u[1],h=u[2].trim(),g=u[3].trim(),_=[];if(g&&g!=="}"){let C=g.endsWith("}")?g.slice(0,-1).trim():g;C&&_.push(C),g.endsWith("}")||(o++,o=P(a,o,_))}else g==="}"||(o++,o=P(a,o,_));let b=Te(_);i.push({variable:m,value:x(h),conditions:b,rawConditions:Ce(_)}),o++;continue}let d=l.match(/^(\w+)(?:\s+if)?\s*\{(.*)$/);if(d){let m=d[1],h=d[2].trim(),g=[];if(h&&h!=="}"){let b=h.endsWith("}")?h.slice(0,-1).trim():h;b&&g.push(b),h.endsWith("}")||(o++,o=P(a,o,g))}else h==="}"||(o++,o=P(a,o,g));let _=Te(g);i.push({variable:m,value:"true",conditions:_,rawConditions:Ce(g)}),o++;continue}o++}let s={defaults:r,rules:i};return Ee.set(t,s),s}function Fn(e){let t=!1,n="";for(let r=0;r<e.length;r++){let i=e[r];if(t)i===n&&e[r-1]!=="\\"&&(t=!1);else if(i==='"'||i==="'")t=!0,n=i;else if(i==="#")return e.slice(0,r)}return e}function P(e,t,n){let r=1,i=t;for(;i<e.length&&r>0;){let a=e[i].trim();for(let o of a)o==="{"&&r++,o==="}"&&r--;if(r>0)n.push(a),i++;else{let o=a.slice(0,a.lastIndexOf("}")).trim();return o&&n.push(o),i}}return i}function x(e){return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function jn(e){return e.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}function Te(e){let t=[];for(let n of e){let r=n.split(";").map(i=>i.trim()).filter(i=>i.length>0);for(let i of r){let a=Vn(i);a&&t.push(a)}}return t}var Q=/"(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false/,Bn=new RegExp(`^(${Q.source})\\s+in\\s+((?:input|data)[^\\s]*)$`),Un=new RegExp(`^(${Q.source})\\s*==\\s*((?:input|data)\\S*)$`),zn=/^([^\s=!]+)\s*==\s*(.+)$/,qn=/^([^\s=!]+)\s*!=\s*(.+)$/,Ao=new RegExp(`^(?:${Q.source})$`);var Gn=/^regex\.match\(\s*("(?:[^"\\]|\\.)*")\s*,\s*((?:input|data)[^\s)]*)\s*\)$/;function Vn(e){let t=!1,n=e.trim();if(n.startsWith("not ")&&(t=!0,n=n.slice(4).trim()),n==="true"||n==="false")return{type:"literal_bool",negated:t,field:"",value:n==="true"};if(n.includes("[_]"))return{type:"truthy",negated:!1,field:F,value:e.trim()};let r=n.match(/^count\(([^)]+)\)\s*(>=|<=|>|<)\s*(\d+)$/);if(r)return{type:"count_gt",negated:t,field:r[1].trim(),operator:r[2],value:parseInt(r[3],10)};let i=n.match(/^startswith\(([^,]+),\s*"([^"]*)"\)$/);if(i)return{type:"startswith",negated:t,field:i[1].trim(),value:i[2]};let a=n.match(/^endswith\(([^,]+),\s*"([^"]*)"\)$/);if(a)return{type:"endswith",negated:t,field:a[1].trim(),value:a[2]};let o=n.match(/^contains\(([^,]+),\s*"([^"]*)"\)$/);if(o)return{type:"contains",negated:t,field:o[1].trim(),value:o[2]};let s=n.match(Gn);if(s)return{type:"regex_match",negated:t,field:s[2].trim(),value:jn(s[1])};let l=n.match(Bn);if(l)return{type:"array_includes",negated:t,field:l[2].trim(),value:Me(l[1])};let c=n.match(/^([^\s]+)\s+in\s+(\[.*\])$/);if(c){let _=Zn(c[2]);if(_!==null)return{type:"in_set",negated:t,field:c[1].trim(),values:_}}let u=n.match(/^([^\s=!<>]+)\s*(>=|<=|>|<)\s*(-?\d+(?:\.\d+)?)$/);if(u)return{type:"comparison",negated:t,field:u[1].trim(),operator:u[2],value:parseFloat(u[3])};let d=n.match(Un);if(d)return{type:"equality",negated:t,field:d[2].trim(),value:x(d[1].trim())};let m=n.match(zn);if(m)return{type:"equality",negated:t,field:m[1].trim(),value:x(m[2].trim())};let h=n.match(qn);if(h)return{type:"inequality",negated:t,field:h[1].trim(),value:x(h[2].trim())};let g=n.match(/^(input(?:\.[a-zA-Z0-9_]+|\["[^"]+"\]|\['[^']+'\])+)$/);return g?{type:"truthy",negated:t,field:g[1].trim()}:{type:"truthy",negated:!1,field:F,value:e.trim()}}var F="__unrecognized_condition_forces_deny__";var Wn=/[A-Za-z_][A-Za-z0-9_.]*\s*\(/;function De(e){let t=[];for(let n of e.rules)for(let r of n.conditions)typeof r.field=="string"&&r.field!==F&&Wn.test(r.field)&&t.push(r.field);return t}var Hn=["input.normalized.","input.normalized["];function Kn(e){let t=new Set;for(let n of e.rules)for(let r of n.conditions){let{field:i}=r;typeof i!="string"||i===F||Hn.some(a=>i.startsWith(a))&&t.add(i)}return[...t].sort()}function Me(e){let t=e.trim();return t==="true"?!0:t==="false"?!1:/^-?\d+(?:\.\d+)?$/.test(t)?parseFloat(t):t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'")?t.slice(1,-1):t}function Zn(e){let t=e.trim().replace(/^\[/,"").replace(/\]$/,"").trim();if(t.length===0)return[];let n=[],r="",i=!1,a="";for(let s=0;s<t.length;s++){let l=t[s];i?(r+=l,l===a&&t[s-1]!=="\\"&&(i=!1)):l==='"'||l==="'"?(r+=l,i=!0,a=l):l===","?(n.push(r.trim()),r=""):r+=l}if(i)return null;r.trim().length>0&&n.push(r.trim());let o=[];for(let s of n){let l=s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2,c=/^-?\d+(?:\.\d+)?$/.test(s);if(!l&&!c&&!(s==="true"||s==="false"))return null;o.push(Me(s))}return o}var ko=new RegExp("^\\p{White_Space}*$","u");var Yn=["tier1","tier2","tier3"];function Pe(e){return typeof e=="string"&&Yn.includes(e)}var Jn=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],Qn=["internal","customer_facing","experimental","third_party"],Le=[...Jn,...Qn];function Xn(e){return typeof e=="string"&&Le.includes(e)}function Fe(e){let t=new Set;for(let n of e)Xn(n)&&t.add(n);return Le.filter(n=>t.has(n))}var je=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"],er=["version_control","payments","crm","communication","cloud_infra","identity","data_warehouse","ticketing","hr","finance_erp","storage","database","other"],tr=["production","staging","development","test"],nr=["security","engineering","finance","legal","compliance","hr","sales","marketing","support","operations","executive"];function rr(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var Ne={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function ir(e){let t=rr(e);return t===null?"other":Ne[t]??Ne[t.replace(/_/g,"")]??"other"}function Be(e,t){let n={...e};if(t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=ir(t.targetApp)),n.context=r}return n}var xe=["pii","phi","pci","financial","biometric","genetic","location","communications","children","credentials","special_category_gdpr"],ar=["read","write","delete","share","export","decide","execute"],Oe=["none","low","medium","high","critical"],or=["public","internal","confidential","restricted","credentials","api_key","private_key","password","secret","token","pan","full_pan","card_number","track_data","cvv","cvc","ssn","tax_id","national_id","passport","drivers_license","identity_document","document_number","kyc_document","bank_account","account_number","routing_number","iban","account_balance","customer_financial","credit_score","net_worth","income","financial_profile","employee_pii","payroll","compensation","material_nonpublic","pre_release_earnings","mnpi","attorney_client","legal_hold","privileged","special_category_gdpr","gdpr_special_category","biometric","ethnicity","political_opinion","health_special","religion"],sr={action_class:je,operation:ar,"context/app_category":er,"context/environment":tr,"context/actor_function":nr,"read/classification":or,"read/data_categories":xe,"read/data_sensitivity":Oe,"write/data_categories":xe,"write/data_sensitivity":Oe};function Ue(e){if(e===null||typeof e!="object")return[];let t=e,n=new Set,r=(i,a,o)=>{let s=Array.isArray(a)?a:[a];for(let l of s)typeof l!="string"||l.length===0||o.includes(l)||n.add(`${i}=${l}`)};for(let[i,a]of Object.entries(sr)){Object.prototype.hasOwnProperty.call(t,i)&&r(i,t[i],a);let o=i.indexOf("/");if(o===-1)continue;let s=t[i.slice(0,o)];if(s!==null&&typeof s=="object"&&!Array.isArray(s)){let l=i.slice(o+1),c=s;Object.prototype.hasOwnProperty.call(c,l)&&r(i,c[l],a)}}return[...n].sort()}var Re=64,lr=64,O={retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function ze(){return{retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var cr=new Set(["deny","approval_required","escalate"]);function N(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let i of t)n.add(i);let r=[...n].sort();return r.length>Re?r.slice(0,Re):r}function $e(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function L(e){return typeof e=="string"&&e.length>0?e:null}function qe(e,t){let n=$e(t.data_categories),r=L(t.classification),i=$e(t.taint),a=L(t.action_class),o=a&&je.includes(a)?a:null,s=L(t.target_app),l=L(t.decision),c={...e.action_counts};if(o)if(o in c)c[o]=(c[o]??0)+1;else if(Object.keys(c).length<lr)c[o]=1;else{let u=Object.keys(c).sort(),d=u[u.length-1];d!==void 0&&o<d&&(delete c[d],c[o]=1)}return{retrieved_data_categories:N(e.retrieved_data_categories,n),retrieved_classifications:N(e.retrieved_classifications,r?[r]:[]),taint:N(e.taint,i),action_classes:N(e.action_classes,o?[o]:[]),action_counts:c,denied_count:e.denied_count+(l==="deny"?1:0),inhibited_count:e.inhibited_count+(l&&cr.has(l)?1:0),event_count:e.event_count+1,target_apps:N(e.target_apps,s?[s]:[])}}var Ge="generic",Ve=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:Ge,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],ur=Ve.map(e=>e.id),So=new Map(Ve.map(e=>[e.id,e])),Io=new Set(ur);function We(e){return Array.isArray(e)&&e.length>0?[...e]:[Ge]}var dr=/^[a-z][a-z0-9_]*$/;function He(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&dr.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var pr=["narrow","moderate","broad","unbounded","unknown"];function Ke(e){return typeof e=="string"&&pr.includes(e)}function fr(e){return e.toLowerCase().replace(/[^a-z0-9]+/g," ").trim().split(" ").filter(t=>t.length>0)}function mr(e){let t=2166136261,n=16777619;for(let r=0;r<e.length;r++){let i=e.charCodeAt(r);t=Math.imul(t^i,16777619)>>>0,n=Math.imul(n^(i<<1|1),2246822507)>>>0}return[t>>>0,n>>>0]}function hr(e,t=5){if(e.length===0)return[];if(e.length<t)return[e.join(" ")];let n=new Set;for(let r=0;r+t<=e.length;r++)n.add(e.slice(r,r+t).join(" "));return[...n]}function Ze(e){let t=hr(fr(e)),n=new Int32Array(64);for(let i of t){let[a,o]=mr(i);for(let s=0;s<32;s++)n[s]+=o>>>s&1?1:-1,n[s+32]+=a>>>s&1?1:-1}let r="";for(let i=1;i>=0;i--){let a=0;for(let o=31;o>=0;o--)a=(a<<1|(n[i*32+o]>0?1:0))>>>0;r+=a.toString(16).padStart(8,"0")}return r}function gr(e){let t=e-(e>>>1&1431655765);return t=(t&858993459)+(t>>>2&858993459),t=t+(t>>>4)&252645135,Math.imul(t,16843009)>>>24&255}function _r(e,t){if(typeof e!="string"||typeof t!="string"||e.length!==16||t.length!==16)return 64;let n=0;for(let r=0;r<16;r+=8){let i=parseInt(e.slice(r,r+8),16),a=parseInt(t.slice(r,r+8),16);if(!Number.isFinite(i)||!Number.isFinite(a))return 64;n+=gr((i^a)>>>0)}return n}var yr=["proposed","approved","revoked"];function br(e){if(e===null||typeof e!="object")return!1;let t=e;return typeof t.skill_id=="string"&&t.skill_id.length>0&&typeof t.skill_schema_hash=="string"&&t.skill_schema_hash.length>0&&typeof t.status=="string"&&yr.includes(t.status)}function Ye(e,t){let n=typeof e.action=="string"?e.action:"",r=typeof e.actionSchemaId=="string"&&e.actionSchemaId.length>0?e.actionSchemaId:null,i=typeof e.fingerprint=="string"&&e.fingerprint.length>0?e.fingerprint:null,a=typeof e.fingerprintRadius=="number"&&Number.isFinite(e.fingerprintRadius)?e.fingerprintRadius:15;if(n.length===0&&r===null&&i===null)return{blocked:!1,skillId:null};for(let o of t)if(br(o)&&o.status==="approved"){if(n.length>0&&o.skill_id===n)return{blocked:!0,skillId:o.skill_id,matchedBy:"action"};if(r!==null&&o.skill_schema_hash===r)return{blocked:!0,skillId:o.skill_id,matchedBy:"schema"};if(i!==null&&typeof o.skill_fingerprint=="string"){let s=_r(i,o.skill_fingerprint);if(s<=a&&s<64)return{blocked:!0,skillId:o.skill_id,matchedBy:"fingerprint",fingerprintDistance:s}}}return{blocked:!1,skillId:null}}function Je(e){return e==="open"||e==="closed"?e:null}var wr=["tool_name","function","name","action"];function j(e,t,n){if(Array.isArray(e)){if(e.length===0){n.push([`${t}[]`,void 0]);return}for(let r of e)j(r,`${t}[]`,n);return}if(e!==null&&typeof e=="object"){let r=Object.entries(e);if(r.length===0){t&&n.push([t,void 0]);return}for(let[i,a]of r)j(a,t?`${t}.${i}`:i,n);return}t&&n.push([t,e])}function Ar(e){let t=[];return j(e,"",t),[...new Set(t.map(([n])=>n))].sort()}function kr(e){let t=e.slice(e.lastIndexOf(".")+1);return t.endsWith("[]")?t.slice(0,-2):t}function Sr(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().toLowerCase();return t.length>0?t:null}function Ir(e,t={}){if(t.discriminatorField===null)return null;let n=[];j(e,"",n);let r=t.discriminatorField?[t.discriminatorField]:t.discriminatorFields??wr;for(let i of r){let a=null;for(let[o,s]of n){if(kr(o)!==i)continue;let l=Sr(s);l!==null&&(a===null||o<a.path)&&(a={path:o,value:l})}if(a)return a.value}return null}function Qe(e,t={}){let n=vr("sha256").update(Ar(e).join(",")).digest("hex").slice(0,16),r=Ir(e,t);return r!==null?`${n}:${r}`:n}var Er=["action","retrieval","delegation"];function Cr(e){return typeof e=="string"&&Er.includes(e)}var Tr=new Set(["rules"]);function Xe(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!Tr.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(Cr):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}function et(e){let t={retrieval:new Set,action:new Set,delegation:new Set};for(let n of e){if(!n.enabled||n.bypassActive)continue;let r=n.regoSource;if(typeof r!="string"||r.length===0)continue;let i;try{i=J(r)}catch{continue}let a=Kn(i);if(a.length!==0)for(let o of n.appliesTo){let s=t[o];if(s)for(let l of a)s.add(`${n.id}: ${l}`)}}return{retrieval:[...t.retrieval].sort(),action:[...t.action].sort(),delegation:[...t.delegation].sort()}}import{z as q}from"zod";var Nr=/[^\u0000-\u007F]/,yt=new RegExp("^\\p{Nd}$","u"),xr=new RegExp("^\\p{Pd}$","u"),Or=/^[\p{Zs}\p{Zl}\p{Zp}]$/u,Rr=/^[\p{Default_Ignorable_Code_Point}\p{Cf}]$/u,$r=new Map([[8722,"-"],[8259,"-"],[8231,"-"]]),bt="<invisible>",tt=new Map;function Dr(e){let t=String.fromCodePoint(e).normalize("NFKC");if(t.length===1&&t>="0"&&t<="9")return t;let n=e;for(let i=0;i<256&&n>0&&yt.test(String.fromCodePoint(n-1));i++)n--;let r=(e-n)%10;return String.fromCharCode(48+r)}function Mr(e){if(e<128)return null;let t=tt.get(e);if(t!==void 0)return t;let n=(()=>{if(e>=65281&&e<=65374)return String.fromCharCode(e-65248);let r=String.fromCodePoint(e);return yt.test(r)?Dr(e):xr.test(r)||$r.has(e)?"-":Or.test(r)?" ":Rr.test(r)?bt:null})();return tt.set(e,n),n}function re(e){if(typeof e!="string"||e.length===0||!Nr.test(e))return[];let t=nt(e,"as-separator");if(t===null)return[];let n=nt(e,"as-nothing");return n===null||n.text===t.text?[t]:[t,n]}function nt(e,t){let n=[],r=[],i=!1;for(let a=0;a<e.length;){let o=e.codePointAt(a),s=o>65535?2:1,l=Mr(o);if(l===null){for(let c=0;c<s;c++)n.push(e[a+c]),r.push(a+c);a+=s;continue}if(i=!0,l===bt){t==="as-separator"&&(n.push(" "),r.push(a)),a+=s;continue}n.push(l),r.push(a),a+=s}return i?(r.push(e.length),{label:t,text:n.join(""),offsets:Int32Array.from(r)}):null}function Pr(e,t){return{start:e.offsets[t.start],end:e.offsets[t.end]}}function Lr(e){if(e.length<=1)return[...e];let t=[...e].sort((i,a)=>i.start-a.start||i.end-a.end),n=[],r={start:t[0].start,end:t[0].end};for(let i=1;i<t.length;i++){let a=t[i];a.start<=r.end?a.end>r.end&&(r={start:r.start,end:a.end}):(n.push(r),r={start:a.start,end:a.end})}return n.push(r),n}function rt(e,t){let n=[];e.lastIndex=0;let r;for(;(r=e.exec(t))!==null;){if(r[0].length===0){e.lastIndex++;continue}n.push({start:r.index,end:r.index+r[0].length})}return n}var vt="[REDACTED]",ie=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"in_pan_tax",re:/\b[A-Z]{3}[ABCFGHJLPTE][A-Z]\d{4}[A-Z]\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"date_of_birth",re:/\b(?:\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])|(?:0[1-9]|[12]\d|3[01])[/.](?:0[1-9]|1[0-2])[/.]\d{4}|(?:0[1-9]|1[0-2])\/(?:0[1-9]|[12]\d|3[01])\/\d{4})\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}],To=ie.map(({name:e,re:t})=>({name:e,source:t.source})),Fr="(?:(?<![A-Za-z0-9])(?=[A-Za-z0-9])|(?<=[A-Za-z0-9])(?![A-Za-z0-9]))";function jr(e){return wt(e,Fr)}function wt(e,t){let n="",r=!1;for(let i=0;i<e.length;i++){let a=e[i];if(a==="\\"){if(!r&&e[i+1]==="b"){n+=t,i++;continue}n+=a+(e[i+1]??""),i++;continue}a==="["?r=!0:a==="]"&&(r=!1),n+=a}return n}function At(e){return new RegExp(jr(e.source),e.flags)}var Br="(?:\\b|_)";function ee(e){return wt(e,Br)}var Ur=/^\(\?<!\[((?:[^\]\\]|\\.)*)\]\)/;function zr(e){let t=Ur.exec(e);return t?`(?:^|[^${t[1]}])${e.slice(t[0].length)}`:e}function te(e){if(!/^\d+$/.test(e))return!1;let t=0,n=!1;for(let r=e.length-1;r>=0;r--){let i=e.charCodeAt(r)-48;n&&(i*=2,i>9&&(i-=9)),t+=i,n=!n}return t%10===0}function qr(e){let t=e.replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let i=0;i<n.length;i++){let a=n[i],o=a>="A"&&a<="Z"?String(a.charCodeAt(0)-55):a;for(let s=0;s<o.length;s++)r=(r*10+(o.charCodeAt(s)-48))%97}return r===1}function Gr(e){if(!/^\d{9}$/.test(e))return!1;let t=[3,7,1,3,7,1,3,7,1],n=0;for(let r=0;r<9;r++)n+=(e.charCodeAt(r)-48)*t[r];return n%10===0}var Vr=[[0,1,2,3,4,5,6,7,8,9],[1,2,3,4,0,6,7,8,9,5],[2,3,4,0,1,7,8,9,5,6],[3,4,0,1,2,8,9,5,6,7],[4,0,1,2,3,9,5,6,7,8],[5,9,8,7,6,0,4,3,2,1],[6,5,9,8,7,1,0,4,3,2],[7,6,5,9,8,2,1,0,4,3],[8,7,6,5,9,3,2,1,0,4],[9,8,7,6,5,4,3,2,1,0]],Wr=[[0,1,2,3,4,5,6,7,8,9],[1,5,7,6,2,8,3,0,9,4],[5,8,0,3,7,9,6,1,4,2],[8,9,1,6,0,4,3,5,2,7],[9,4,5,3,1,2,6,8,7,0],[4,2,8,6,5,7,3,9,0,1],[2,7,9,3,8,0,6,4,1,5],[7,0,4,6,9,1,3,2,5,8]];function Hr(e){if(!/^\d+$/.test(e))return!1;let t=0,n=e.split("").reverse();for(let r=0;r<n.length;r++)t=Vr[t][Wr[r%8][n[r].charCodeAt(0)-48]];return t===0}function Kr(e){if(!/^\d{11}$/.test(e)||/^(\d)\1{10}$/.test(e))return!1;let t=n=>{let r=0;for(let a=0;a<n;a++)r+=(e.charCodeAt(a)-48)*(n+1-a);let i=r*10%11;return i===10?0:i};return t(9)===e.charCodeAt(9)-48&&t(10)===e.charCodeAt(10)-48}function Zr(e){if(!/^\d{10}$/.test(e))return!1;let t=0;for(let i=0;i<9;i++)t+=(e.charCodeAt(i)-48)*(10-i);let n=11-t%11,r=n===11?0:n;return r!==10&&r===e.charCodeAt(9)-48}var Yr=[1,4,3,7,5,8,6,9,10];function Jr(e){if(!/^\d{8,9}$/.test(e))return!1;let t=0;for(let n=0;n<e.length;n++)t+=(e.charCodeAt(n)-48)*Yr[n];return t%11===0}var Qr="TRWAGMYFPDXBNJZSQVHLCKE";function Xr(e){let t=e.replace(/[\s.-]/g,"").toUpperCase(),n=/^([XYZ]?)(\d{7,8})([A-Z])$/.exec(t);if(!n)return!1;let[,r,i,a]=n;if(r===""&&i.length!==8||r!==""&&i.length!==7)return!1;let o=r===""?i:String("XYZ".indexOf(r))+i;return Qr[Number(o)%23]===a}var ei=new Set(["BG","GB","NK","KN","TN","NT","ZZ"]);function ti(e){let t=e.replace(/[\s-]/g,"").toUpperCase();return/^[ABCEGHJ-PRSTW-Z][ABCEGHJ-NPRSTW-Z]\d{6}[A-D]$/.test(t)?!ei.has(t.slice(0,2)):!1}var ae=[{name:"pan",re:/\d(?:[ -]?\d){12,18}/g,normalize:e=>e.replace(/[ -]/g,""),validate:e=>e.length>=13&&e.length<=19&&te(e)},{name:"iban",re:/\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){10,30}\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:qr},{name:"aba_routing",re:/\b\d{9}\b/g,normalize:e=>e,validate:Gr},{name:"uk_nino",re:/\b[A-Za-z]{2} ?\d{2} ?\d{2} ?\d{2} ?[A-Da-d]\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:(e,t)=>t!==void 0&&t===t.toLowerCase()?!1:ti(e)},{name:"in_aadhaar",re:/\b[2-9]\d{3}[ -]?\d{4}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===12&&Hr(e)},{name:"br_cpf",re:/\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,normalize:e=>e.replace(/[.-]/g,""),validate:Kr},{name:"es_dni_nie",re:/\b(?:[XYZxyz]-?)?(?:\d{7,8}|\d{1,2}[. ]\d{3}[. ]\d{3})[ -]?[A-Za-z]\b/g,normalize:e=>e.replace(/[\s.-]/g,"").toUpperCase(),validate:Xr},{name:"ca_sin",re:/\b\d{3}[ -]?\d{3}[ -]?\d{3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===9&&te(e)},{name:"uk_nhs_number",re:/\b\d{3}[ -]?\d{3}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Zr},{name:"au_tfn",re:/\b\d{3}[ -]?\d{3}[ -]?\d{2,3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Jr}],ni=Object.fromEntries([...ie,...ae].map(e=>[e.name,e.re.source])),y=ni,No=ae.map(e=>e.name),kt=ie.map(({name:e,re:t})=>({name:e,re:At(t)})),St=ae.map(e=>({...e,re:At(e.re)})),xo=[...kt,...St].map(({name:e,re:t})=>({name:String(e),source:t.source})),oe=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","uk_nino","in_aadhaar","in_pan_tax","br_cpf","es_dni_nie","ca_sin","uk_nhs_number","au_tfn","email","us_phone","date_of_birth","ipv4","mac_address"],ri={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
+MIIEv\u2026
+-----END PRIVATE KEY-----`,template:{pattern:y.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:y.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:y.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:y.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:y.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:y.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:y.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:y.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:y.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:y.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS). Collision rate: MEASURED 9.8% of benign 16-digit runs \u2014 Luhn leaves ~1 in 10. Default-ON because PCI-DSS makes masking mandatory; note in_aadhaar sits at the same rate and is often proposed for removal on that basis.",category:"financial",example:"4242 4242 4242 4242",template:{pattern:y.pan,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY 13-19 digit run (grouped or not) \u2014 the floor's regex without the checksum that makes it precise. ~9 in 10 of those are not card numbers.",examples:["4242 4242 4242 4243","4242424242424241"],measuredOverMaskRate:.531}},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible. Collision rate: MEASURED 1.0% \u2014 mod-97 leaves ~1 in 97, the most precise detector on this floor alongside br_cpf.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:y.iban,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run mod-97, so the rule masks EVERY IBAN-SHAPED token (2 letters, 2 digits, 10-30 alphanumerics) \u2014 and mod-97 is what makes this the most precise detector on the floor, so almost all of those are not IBANs.",examples:["DE89 3704 0044 0532 0130 01","GB00 NWBK 6016 1331 9268 19"],measuredOverMaskRate:.934}},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:y.aba_routing,mode:"full",templateOnly:{reason:"A rego rule cannot run the weighted 3-7-1 mod-10, so the rule masks EVERY bare 9-digit run \u2014 which is why this detector is default-OFF on the floor and why its rule form is broader still.",examples:["021000022","123456789"],measuredOverMaskRate:.899}},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX). Collision rate: MEASURED 100% \u2014 no checksum, so every 2-then-7 dashed digit run matches. Same trade as ssn: the punctuated shape is rare in benign traffic, not precise.",category:"financial",example:"12-3456789",template:{pattern:y.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:y.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789). Collision rate: MEASURED 100% \u2014 there is NO checksum, so every dashed 3-2-4 digit run matches. Default-ON regardless, because that punctuated shape is essentially absent from benign agent traffic; if your traffic carries 3-2-4 dashed reference codes, opt out.",category:"pii",example:"123-45-6789",template:{pattern:y.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},uk_nino:{id:"uk_nino",label:"UK National Insurance numbers",description:"UK NINOs (e.g. AB 12 34 56 C). DEFAULT-OFF \u2014 NO CHECKSUM. Precision comes only from the issued alphabet and the never-issued administrative prefixes (BG, GB, NK, KN, TN, NT, ZZ), so roughly half of tokens already shaped 2-letters/6-digits/[A-D] validate. All-lowercase candidates are rejected (git short SHAs), but that does NOT exclude uppercase business identifiers \u2014 serial, part, batch, PO, coupon and asset tags share the shape exactly and were measured being masked. Opt in when UK NINOs are expected in your traffic.",category:"pii",example:"AB 12 34 56 C",template:{pattern:"\\b(?:[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-D])\\b",mode:"full",templateOnly:{reason:"uk_nino has no checksum, but the floor still rejects the seven NEVER-ISSUED administrative prefixes (BG GB NK KN TN NT ZZ). A rego rule cannot express that exclusion without enumerating hundreds of letter pairs (RE2 has no lookahead), so the rule masks those too.",examples:["NK 12 34 56 A","ZZ 12 34 56 C"],measuredOverMaskRate:.019}},defaultEnabled:!1},in_aadhaar:{id:"in_aadhaar",label:"Aadhaar numbers (India)",description:"12-digit UIDAI Aadhaar numbers, Verhoeff-checksum validated and constrained to the issued 2-9 leading digit. Keeps the last 4 visible. Collision rate: MEASURED 10.0% of benign 12-digit ids starting 2-9 (order/transaction numbers) \u2014 Verhoeff leaves ~1 in 10. Comparable to the long-shipped pan (10.0%) and well behind iban (1.0%); it stays default-ON because the two US identifiers this floor has always shipped, ssn and us_ein, collide at 100%.",category:"pii",example:"2345 6789 0124",template:{pattern:"\\b[2-9]\\d{3}(?:[ -]\\d{4}[ -]?\\d{4}|\\d{4}[ -]\\d{4})\\b",mode:"partial",keepLast:4,floorOnly:{reason:"The floor accepts the entirely UNPUNCTUATED 12-digit form because Verhoeff gates it (~1 in 10 survive). A rego rule cannot run Verhoeff, so a bare \\d{12} in a rule would mask every 12-digit order id and E.164 Indian mobile number in the tenant. The rule requires at least one printed separator \u2014 every half-punctuated form is covered; only the bare digit run stays floor-only.",examples:["234567890124","id=234567890124"]},templateOnly:{reason:"A rego rule cannot run the Verhoeff checksum, so the rule masks EVERY 4-4-4 grouping that starts 2-9 \u2014 including the ~9 in 10 that are not Aadhaar numbers at all.",examples:["2345 6789 0125","2345-6789-0123"],measuredOverMaskRate:.903}},defaultEnabled:!0},in_pan_tax:{id:"in_pan_tax",label:"India PAN (tax ID)",description:"India Permanent Account Number \u2014 the income-tax id (ABCPE1234F), NOT a payment-card PAN. NO CHECKSUM: the only discriminator is the holder-type letter in position 4, which removes just 15 of 26 possibilities in one position, so roughly 4 in 10 uniform 5-letter/4-digit/1-letter tokens validate. DEFAULT-OFF for that reason \u2014 an uppercase SKU or part number of the same shape is masked, and nothing in the value distinguishes it.",category:"financial",example:"ABCPE1234F",template:{pattern:y.in_pan_tax,mode:"full"},defaultEnabled:!1},br_cpf:{id:"br_cpf",label:"CPF numbers (Brazil)",description:"Brazilian CPF, closed by TWO independent mod-11 check digits. Collision rate: MEASURED 1.0% of benign 11-digit runs (~1-in-100) \u2014 the most precise detector on this floor, alongside iban. Repdigits are rejected. Keeps the last 2 visible.",category:"pii",example:"123.456.789-09",template:{pattern:"\\b\\d{3}(?:\\.\\d{3}\\.?\\d{3}-?\\d{2}|\\d{3}(?:\\.\\d{3}-?\\d{2}|\\d{3}-\\d{2}))\\b",mode:"partial",keepLast:2,floorOnly:{reason:"The floor accepts the entirely bare 11-digit form because TWO mod-11 check digits gate it (~1 in 100 survive). A rego rule cannot run mod-11, so a bare \\d{11} in a rule would mask every 11-digit identifier in the tenant. The rule requires at least one printed separator; the bare form stays floor-only.",examples:["11144477735","ref 11144477735","12345678909"]},templateOnly:{reason:"A rego rule cannot run the two mod-11 check digits, so the rule masks EVERY punctuated 3-3-3-2 digit grouping \u2014 including the ~99 in 100 that are not CPFs.",examples:["123.456.789-10","111.444.777-34"],measuredOverMaskRate:.995}},defaultEnabled:!0},es_dni_nie:{id:"es_dni_nie",label:"DNI / NIE numbers (Spain)",description:"Spanish national ID (8 digits + letter) and foreigner ID (X/Y/Z + 7 digits + letter), validated by the mod-23 check letter. Collision rate: MEASURED 4.0% of benign 8-digit-plus-letter tokens (invoice/order numbers with a suffix letter) \u2014 mod-23 leaves ~1 in 23. More precise than in_aadhaar (10.0%) and pan (10.0%); behind br_cpf (1.0%) and iban (1.0%).",category:"pii",example:"12345678Z",template:{pattern:y.es_dni_nie,mode:"full",templateOnly:{reason:"A rego rule cannot run the mod-23 check letter, so the rule masks EVERY 7-8 digit run followed by a letter \u2014 invoice and order numbers with a suffix letter included. mod-23 admits ~1 in 23; the rule admits all of them. Re-measured 0.973 \u2192 0.981 when the floor learned the printed forms (dotted DNI, hyphenated NIE): the rule now also matches those written forms, and ~22 in 23 of them are not DNI/NIEs. The FLOOR's own rate is unchanged \u2014 mod-23, not punctuation, gates it.",examples:["12345678A","X1234567H"],measuredOverMaskRate:.976}},defaultEnabled:!0},ca_sin:{id:"ca_sin",label:"SIN numbers (Canada)",description:"Canadian Social Insurance Numbers (9-digit, Luhn-validated). DEFAULT-OFF \u2014 identical shape to an ABA routing number and to any 9-digit id, with only a mod-10 pass to separate them.",category:"pii",example:"046 454 286",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{3}|\\d{3}[- ]\\d{3})\\b",mode:"partial",keepLast:3,floorOnly:{reason:"The floor accepts the entirely bare 9-digit form because Luhn gates it. A rego rule cannot run Luhn, and a bare \\d{9} in a rule is also every ABA routing number and every 9-digit identifier, so the rule requires at least one printed separator in the 3-3-3 grouping.",examples:["046454286"]},templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY printed 3-3-3 digit grouping \u2014 including the ~9 in 10 that are not SINs.",examples:["046 454 287","123 456 789"],measuredOverMaskRate:.914}},defaultEnabled:!1},uk_nhs_number:{id:"uk_nhs_number",label:"NHS numbers (UK)",description:"UK NHS patient numbers (10-digit, weighted mod-11). DEFAULT-OFF \u2014 a 10-digit run is also every North American phone number.",category:"pii",example:"943 476 5919",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{4}|\\d{3}[- ]\\d{4})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 10-digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{10} in a rule is also every North American phone number, so the rule requires at least one printed separator in the 3-3-4 grouping.",examples:["9434765919"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-4 digit grouping \u2014 every North American phone number included \u2014 not just the ~1 in 10 that are NHS numbers.",examples:["943 476 5910","123 456 7890"],measuredOverMaskRate:.899}},defaultEnabled:!1},au_tfn:{id:"au_tfn",label:"Tax File Numbers (Australia)",description:"Australian TFNs (8-9 digit, weighted mod-11). DEFAULT-OFF \u2014 collides with essentially every 8-9 digit identifier.",category:"financial",example:"123 456 782",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{2,3}|\\d{3}[- ]\\d{2,3})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 8-9 digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{8,9} in a rule collides with essentially every identifier of that length, so the rule requires at least one printed separator. BOTH lengths are in the gap: a TFN may be 8 digits (`12345679`) or 9 (`123456782`), and the 8-digit branch went undeclared while the parity sweep derived its population from the 9-digit example alone.",examples:["12345679","123456782"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-2/3-3-3 digit grouping \u2014 including the ~9 in 10 that are not TFNs.",examples:["123 456 783","123 456 78"],measuredOverMaskRate:.912}},defaultEnabled:!1},date_of_birth:{id:"date_of_birth",label:"Dates of birth",description:"Dates in the common written formats. DEFAULT-OFF and heavily over-masking by nature \u2014 a DOB is indistinguishable from any other date (created_at, invoice, release). Offered because DOB is a GDPR/HIPAA identifier some regulated tenants must mask regardless.",category:"pii",example:"1985-04-12",template:{pattern:y.date_of_birth,mode:"full"},defaultEnabled:!1},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept). Collision rate: MEASURED 100% of well-formed addresses \u2014 that is BY DESIGN, not a defect: an email address is structurally unambiguous, so matching every one is correct rather than over-matching.",category:"pii",example:"alice@acme.com",template:{pattern:y.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:y.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:y.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:y.mac_address,mode:"full"},defaultEnabled:!1}},se=Object.freeze(Object.fromEntries(oe.map(e=>{let t=ri[e];return[e,{...t,template:{...t.template,pattern:zr(ee(t.template.pattern))}}]})));var Oo=new Set(oe.filter(e=>!se[e].defaultEnabled));function ii(e,t){let n=new Set;for(let r of oe)(se[r].defaultEnabled?!e?.has(r):t?.has(r))||n.add(r);return n}function B(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=le(t),a=e;for(let{name:o,re:s}of kt){let l=o;n.has(l)||(a=a.replace(s,c=>(r?.(l),i(c))))}for(let{name:o,re:s,normalize:l,validate:c}of St)n.has(o)||(a=hi(a,s,l,c,t,o,r));return a}function le(e){return typeof e=="function"?e:()=>e}var it=e=>"\0".repeat(e.length);function ai(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=re(e);if(i.length===0)return B(e,t,n,r);let a=new Set,o=m=>{a.add(m)},s=B(e,it,n,o),l=!0,c=new Array(e.length).fill(!1);for(let m=0;m<e.length;m++)c[m]=s[m]==="\0"&&e[m]!=="\0";for(let m of i){let h=B(m.text,it,n,o);for(let g=0;g<m.text.length;g++)if(!(h[g]!=="\0"||m.text[g]==="\0"))for(let _=m.offsets[g];_<m.offsets[g+1];_++)c[_]||(c[_]=!0,l=!1)}if(l)return B(e,t,n,r);for(let m of a)r?.(m);let u="",d=0;for(;d<e.length;){if(!c[d]){u+=e[d],d++;continue}let m=d;for(;d<e.length&&c[d];)d++;u+=le(t)(e.slice(m,d))}return u}function $(e){return e===void 0||!/[A-Za-z0-9]/.test(e)}var at=new Map;function oi(e){let t=at.get(e.source);return t===void 0&&(t=new RegExp(`^(?:${e.source})$`),at.set(e.source,t)),t}var si=4096,li=64,ot=null;function ci(e){return ot!==null?ot:si+e.length*li}var It=!1,v={spanCalls:0,spanMisses:0,cutCalls:0,cutMisses:0,budgetExhausted:0,maxMissesInAPass:0},Et={spanBudget:0,depthCap:0};function ui(e){return{stride:e.length+1,chosen:new Map,cuts:new Map,budget:ci(e),exhausted:!1}}function Ct(e,t,n,r,i,a,o){v.spanCalls++;let s=t*o.stride+n.length,l=It?void 0:o.chosen.get(s);if(l!==void 0)return l;if(o.budget<=0)return o.exhausted=!0,null;o.budget--,v.spanMisses++;let c=di(e,t,n,r,i,a,o);return o.chosen.set(s,c),c}function di(e,t,n,r,i,a,o){let s=oi(r),l=[];for(let u=n.length-1;u>=1;u--)if($(n[u])){let d=n.slice(0,u);s.test(d)&&l.push(d)}let c=$(e[t+n.length])?[n,...l]:[...l,n];for(let u of c)if(a(i(u),u)&&!fi(e,t,u,r,i,a,o))return u;return null}var st=new Map;function pi(e){let t=st.get(e.source);return t===void 0&&(t=new RegExp(e.source,"y"),st.set(e.source,t)),t}function fi(e,t,n,r,i,a,o){v.cutCalls++;let s=t*o.stride+n.length,l=It?void 0:o.cuts.get(s);if(l!==void 0)return l;if(o.budget<=0)return o.exhausted=!0,!0;o.budget--,v.cutMisses++;let c=mi(e,t,n,r,i,a,o);return o.cuts.set(s,c),c}function mi(e,t,n,r,i,a,o){let s=t+n.length,l=pi(r);for(let c=1;c<n.length;c++){if($(n[c])||!$(n[c-1]))continue;let u=t+c;l.lastIndex=u;let d=l.exec(e);if(d===null||d[0].length===0)continue;let m=Ct(e,u,d[0],r,i,a,o);if(m!==null&&u+m.length>s&&$(e[u+m.length]))return!0}return!1}function hi(e,t,n,r,i,a,o){let s=le(i);t.lastIndex=0;let l="",c=0,u=ui(e),d=v.spanMisses+v.cutMisses,m;for(;(m=t.exec(e))!==null;){let h=m[0],g=m.index;if(h.length===0){t.lastIndex=g+1;continue}let _;try{_=Ct(e,g,h,t,n,r,u)}catch(b){if(b instanceof RangeError&&/call stack/i.test(b.message))u.exhausted=!0,_=null;else throw b}if(u.exhausted)return v.budgetExhausted++,Et.spanBudget++,lt(d),l+e.slice(c,g)+s(e.slice(g));if(_!==null)o?.(a),l+=e.slice(c,g)+s(_),c=g+_.length,t.lastIndex=c;else{let b=h.slice(1).search(/[^A-Za-z0-9]/);t.lastIndex=b===-1?g+h.length:g+1+b+1}if(t.lastIndex>e.length)break}return lt(d),l+e.slice(c)}function lt(e){let t=v.spanMisses+v.cutMisses-e;t>v.maxMissesInAPass&&(v.maxMissesInAPass=t)}function Tt(e,t=vt,n,r){return _i(e,t,ii(n,r))}var gi=256;function _i(e,t,n){let r=new Set,i=!n.has("pan"),a=s=>{r.add(s)},o=(s,l)=>{if(l>gi)return Et.depthCap++,t;if(typeof s=="string")return ai(s,t,n,a);if(typeof s=="number"&&Number.isInteger(s)&&s>0){if(!i)return s;let c=String(s);return c.length>=13&&c.length<=19&&te(c)?(r.add("pan"),t):s}if(Array.isArray(s))return s.map(c=>o(c,l+1));if(s!==null&&typeof s=="object"){let c=s,u={};for(let d of Object.keys(c))u[d]=o(c[d],l+1);return u}return s};return{value:o(e,0),detectors:[...r].sort()}}function Nt(e,t=vt){return Tt(e,t).value}var yi=/[\u00AD\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFEFF]/g,xt=Object.freeze({\u0430:"a",\u0435:"e",\u043E:"o",\u0440:"p",\u0441:"c",\u0443:"y",\u0445:"x",\u0456:"i",\u0455:"s",\u043A:"k",\u043C:"m",\u0442:"t",\u043D:"h",\u0432:"b",\u0433:"r",\u03BF:"o",\u03B1:"a",\u03C1:"p",\u03B9:"i",\u03C4:"t",\u03B5:"e",\u03BA:"k",\u03BD:"v",\u03C5:"u",\u03B7:"n",\u0131:"i","\u04CF":"l",\u0578:"n"}),bi=new RegExp(`[${Object.keys(xt).join("")}]`,"gu"),vi=Object.freeze({4:"a","@":"a",3:"e",1:"i","!":"i",0:"o",5:"s",$:"s",7:"t",9:"g","(":"c",8:"b"}),Ot="\u2801\u2803\u2809\u2819\u2811\u280B\u281B\u2813\u280A\u281A\u2805\u2807\u280D\u281D\u2815\u280F\u281F\u2817\u280E\u281E\u2825\u2827\u283A\u282D\u283D\u2835",wi=Object.freeze(Object.fromEntries([...Ot].map((e,t)=>[e,String.fromCharCode(97+t)]))),Ai=new RegExp(`[${Ot}\u2800]`,"g"),Rt=/[⠀-⣿]/;function ki(e){let t="";for(let n of e){let r=n.codePointAt(0);r!==void 0&&(r>=917536&&r<=917630?t+=String.fromCodePoint(r-917504):r>=917504&&r<=917631||(t+=n))}return t}function Si(e){return e.replace(yi,"")}function $t(e){return e.replace(bi,t=>xt[t]??t)}function Ii(e){return e.replace(/[4@31!05$79(8]/g,t=>vi[t]??t)}function Ei(e){return e.replace(/[a-zA-Z]/g,t=>{let n=t<="Z"?65:97;return String.fromCharCode((t.charCodeAt(0)-n+13)%26+n)})}function Ci(e){return Rt.test(e)?e.replace(Ai,t=>t==="\u2800"?" ":wi[t]??t):e}function ct(e){let t;try{t=ki(e)}catch{t=e}try{t=t.normalize("NFKC")}catch{}return t=Si(t),t=$t(t),t}var Ti=/^[A-Za-z0-9+/]{16,}={0,2}$/,Ni=/^(?:[0-9a-fA-F]{2}\s*){8,}$/,ut=/[A-Za-z0-9+/]{20,}={0,2}/g;function ne(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);(r===9||r===10||r===13||r>=32&&r<=126||r>=160&&r!==65533)&&t++}return t/e.length}var Dt=new TextDecoder("utf-8",{fatal:!1});function Mt(e){let t;try{t=atob(e)}catch{return[]}let n=new Uint8Array(t.length);for(let i=0;i<t.length;i++)n[i]=t.charCodeAt(i)&255;let r=Dt.decode(n);return t===r?[t]:[r,t]}function xi(e){let t=e.replace(/\s+/g,"");if(t.length===0||t.length%2!==0)return[];let n=new Uint8Array(t.length/2);for(let a=0;a<n.length;a++){let o=Number.parseInt(t.slice(a*2,a*2+2),16);if(Number.isNaN(o))return[];n[a]=o}let r="";for(let a=0;a<n.length;a++)r+=String.fromCharCode(n[a]);let i=Dt.decode(n);return r===i?[r]:[i,r]}function dt(e){let t=e.trim(),n=[];if(Ni.test(t))for(let r of xi(t))n.push({decoded:r,textiness:ne(r)});if(Ti.test(t)&&t.length%4===0)for(let r of Mt(t))n.push({decoded:r,textiness:ne(r)});return n}function pt(e,t){let n=[],r;for(ut.lastIndex=0;(r=ut.exec(e))!==null&&n.length<t;){let i=r[0];if(i.length%4===0)for(let a of Mt(i))n.push({decoded:a,textiness:ne(a)})}return n}var Oi=Object.freeze({maxDepth:3,byteCap:262144,maxNodes:256,maxBlobsPerNode:8});function Pt(e,t=Oi){if(typeof e!="string"||e.length===0)return{views:[],anyDecoded:!1,truncated:!1,nodes:0,maxDepthSeen:0};let{maxDepth:n,byteCap:r,maxNodes:i,maxBlobsPerNode:a}=t,o=new Set,s=h=>{h.length>0&&h.length<=r&&o.add(h)},l=!1,c=!1,u=0,d=0,m=[{s:e,depth:0}];for(;m.length>0;){if(u>=i){c=!0;break}let h=m.pop();if(h===void 0)break;let{s:g,depth:_}=h;if(g.length>r){c=!0;continue}u++,_>d&&(d=_);let b=ct(g);s(b);let C=Ii(b);if(C!==b&&s(C),s(Ei(b)),Rt.test(g)&&s(Ci(b)),_>=n){let k=ct(g);(dt(k).length>0||pt(k,a).length>0)&&(c=!0);continue}let cn=[...dt(b),...pt(b,a)];for(let k of cn){if(l=!0,k.decoded.length>r){c=!0;continue}k.textiness>=.85&&k.decoded!==b?m.push({s:k.decoded,depth:_+1}):s(k.decoded)}}return{views:[...o],anyDecoded:l,truncated:c,nodes:u,maxDepthSeen:d}}var Lt=["hidden_text_carrier","injected_turn_boundary","mixed_script_token","nested_encoding_payload"],Ri=Object.freeze(["hidden_text_carrier","injected_turn_boundary","mixed_script_token"]),$i=8,Di=new Set([173,8203,8204,8205,8206,8207,8288,65279,8234,8235,8236,8237,8238,8294,8295,8296,8297]),ft=e=>e!==void 0&&(e>=65&&e<=90||e>=97&&e<=122);function Mi(e){let t=[...e].map(r=>r.codePointAt(0)),n=0;for(let r=0;r<t.length;r++){let i=t[r];if(i>=917504&&i<=917631||Di.has(i)&&ft(t[r-1])&&ft(t[r+1])&&(n++,n>=$i))return!0}return!1}var Pi=/^[ \t]*(?:system|assistant|developer|user)[ \t]*:/i;function Li(e){let t=e.split(/\r?\n/),n=!1;for(let r of t){if(Pi.test(r)){if(n)return!0;continue}r.trim().length>0&&(n=!0)}return!1}var Fi=[{name:"latin",lo:65,hi:591},{name:"greek",lo:880,hi:1023},{name:"cyrillic",lo:1024,hi:1279}];function ji(e){for(let t of Fi)if(e>=t.lo&&e<=t.hi)return t.name;return null}function Bi(e){for(let t of e.split(/\s+/)){if(t.length<4)continue;let n=0,r=0,i=!0;for(let a of t){let o=ji(a.codePointAt(0));if(o===null){i=!1;break}o==="latin"?n++:$t(a)!==a&&r++}if(i&&n>0&&r>0)return!0}return!1}var mt=Object.freeze({signals:[],contributes:!1});function Ui(e){if(typeof e!="string"||e.length===0)return{...mt,signals:[]};let t=new Set;try{Mi(e)&&t.add("hidden_text_carrier"),Li(e)&&t.add("injected_turn_boundary"),Bi(e)&&t.add("mixed_script_token");let{anyDecoded:n,maxDepthSeen:r,truncated:i}=Pt(e);n&&(r>=2||i)&&t.add("nested_encoding_payload")}catch{return{...mt,signals:[]}}return{signals:[...Lt.filter(n=>t.has(n))],contributes:Ri.some(n=>t.has(n))}}var z=[{name:"override_instructions",re:/\bignore (?:all |the )?(?:previous|above|prior) (?:instructions|prompts?)\b/i},{name:"disregard_instructions",re:/\bdisregard (?:the )?(?:above|previous|system)\b/i},{name:"role_tag",re:/<\/?(system|assistant|instructions|host_context)\b/i},{name:"privilege_override",re:/\b(grant|escalate|elevate) (admin|root|all|full) (access|privileges?)\b/i},{name:"tool_smuggle",re:/```[\s\S]*?(tool_call|function_call)/i}];function ht(e){return typeof e!="string"||e.length===0?[]:z.filter(({re:t})=>t.test(e)).map(({name:t})=>t)}function zi(e){if(typeof e!="string"||e.length===0)return[];let t=new Set(ht(e)),{views:n}=Pt(e);for(let r of n)for(let i of ht(r))t.add(i);return z.filter(r=>t.has(r.name)).map(r=>r.name)}function qi(e){let t=new Set,n=new Set,r=!1,i=a=>{if(a!=null){if(typeof a=="string"){for(let s of zi(a))t.add(s);let o=Ui(a);for(let s of o.signals)n.add(s);o.contributes&&(r=!0);return}if(Array.isArray(a)){for(let o of a)i(o);return}if(typeof a=="object")for(let o of Object.values(a))i(o)}};return i(e),{matched:t.size>0||r,signatures:z.filter(a=>t.has(a.name)).map(a=>a.name),structural:Lt.filter(a=>n.has(a))}}function Gi(e){return qi(e).matched}var Ro=z.map(e=>e.name);var Vi=new Set(["untrusted","external","public","public_internet","external_third_party","web"]);var Wi="i:injection";function Ft(e){let t=new Set;if(e.content!==void 0&&e.content!==null){let{detectors:i}=Tt(e.content);for(let a of i){let o=se[a]?.category;o&&t.add(`c:${o}`)}Gi(e.content)&&t.add(Wi)}let n=e.resourceMetadata??{},r=n.source_trust;return(n.untrusted_source===!0||typeof r=="string"&&Vi.has(r.toLowerCase()))&&t.add("i:untrusted"),[...t].sort()}var X="(?:system\\s+prompt|initial\\s+(?:instructions|prompt)|system\\s+(?:instructions|message)|hidden\\s+(?:instructions|prompt)|your\\s+(?:system\\s+prompt|initial\\s+instructions|instructions|prompt)|the\\s+prompt\\s+(?:above|you\\s+were\\s+given))",$o=[{name:"reveal_prompt",re:new RegExp(`\\b(?:reveal|show|print|repeat|output|echo|display|expose|dump|leak|reprint|divulge|disclose)\\b[\\s\\S]{0,40}?\\b${X}\\b`,"i")},{name:"what_is_prompt",re:new RegExp(`\\bwhat\\s+(?:is|are|were)\\b[\\s\\S]{0,20}?\\b${X}\\b`,"i")},{name:"tell_me_prompt",re:new RegExp(`\\b(?:tell|give|send|show)\\s+me\\b[\\s\\S]{0,30}?\\b${X}\\b`,"i")},{name:"repeat_above",re:/\b(?:repeat|print|output|echo|reproduce)\b[\s\S]{0,20}?\b(?:everything|all\s+(?:the\s+)?(?:text|words))\b[\s\S]{0,12}?\b(?:above|before|preceding|verbatim|word\s+for\s+word)\b/i}],gt="(?:instructions?|prompts?|rules?|directives?|guidelines?|constraints?|guardrails?)",Hi=`(?:(?:all\\s+|any\\s+|the\\s+|these\\s+|those\\s+)*(?:previous|prior|preceding|earlier|above|foregoing|initial|original|system|developer)\\s+${gt}|your\\s+(?:(?:system|initial|original|previous|prior|current)\\s+)?(?:${gt}|programming|training))`,Ki="(?:(?:all|any|every|the|of|and|now|please|completely|entirely|totally|immediately)\\s+){0,3}",_t="(?:\\b(?:unrestricted|unfiltered|uncensored|unbounded|unlimited|unchained|jailbroken|lawless|amoral)\\b|\\b(?:DAN|STAN|DUDE|AIM)\\b|\\bno\\s+(?:longer\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|boundaries|constraints?)\\b(?!\\s+(?:on|over|regarding|upon|for)\\b)|\\bwithout\\s+(?:any\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|constraints?|censorship)\\b|\\b(?:free|freed|released)\\s+from\\s+(?:your\\s+)?(?:restrictions?|limits?|rules?|guidelines?|guardrails?|programming|constraints?)\\b|\\b(?:can|will|are\\s+able\\s+to)\\s+(?:do|say)\\s+anything\\b|\\bignore\\s+(?:all\\s+)?(?:your\\s+)?(?:previous\\s+|prior\\s+|system\\s+)?(?:instructions?|rules?|guidelines?)\\b)",Zi="(?:ignore|disregard|forget|override|overrule|bypass|obey|comply\\s+with|follow\\s+(?:only|my|these))",Do=[{name:"override_instructions",re:new RegExp(`\\b(?:ignore|disregard|forget|discard|override|overrule|bypass|delete|erase)\\s+${Ki}${Hi}\\b`,"i")},{name:"forget_everything_prior",re:/\b(?:forget|ignore|disregard|erase|discard)\s+(?:about\s+|all\s+|any\s+)?(?:everything|anything)\b[\s\S]{0,24}?\b(?:above|before|previously|prior|earlier|you\s+(?:were|have\s+been)\s+(?:told|instructed|given|programmed))\b/i},{name:"persona_reassignment_jailbreak",re:new RegExp(`\\byou\\s+are\\s+now\\s+(?:(?:a|an|the)\\s+)?[\\s\\S]{0,48}?${_t}`,"i")},{name:"constraint_release",re:/\byou\s+are\s+no\s+longer\s+(?:bound|restricted|limited|constrained|obligated|governed|subject\s+to|required\s+to)\b/i},{name:"from_now_on_reassignment",re:new RegExp(`\\bfrom\\s+now\\s+on\\s*,?\\s+you\\s+(?:are|will|must|shall|have|can)\\s+(?:${Zi}\\b|[\\s\\S]{0,40}?${_t})`,"i")},{name:"new_instructions_header",re:/^\s*(?:[#*>-]+\s*)?(?:new|real|actual|true|secret|hidden|override)\s+(?:system\s+)?(?:instructions?|prompts?|directives?)\s*:/im}];var Mo=Object.freeze({"\u2019":"'",\u02BC:"'","\uFF07":"'","\u02B9":"'","\u2032":"'"});var S=e=>`[^.!?;\\n]{0,${e}}?`,Yi=["\\bi\\s+(?:can'?t|cannot|can\\s+not|won'?t|will\\s+not)\\b","\\bi(?:'m|\\s+am)\\s+(?:not\\s+able\\s+to|unable\\s+to|not\\s+going\\s+to|not\\s+permitted\\s+to|not\\s+allowed\\s+to)\\b"].join("|"),jt="(?:help|assist|provide|create|generate|produce|write|compose|draft|comply|fulfil|fulfill|share|disclose|reveal|perform|execute|run|send|transmit|publish|export|approve|grant|carry\\s+out|do\\s+that|do\\s+this|do\\s+so|go\\s+ahead)",Po=Object.freeze([{id:"capability_denial",class:"strong",re:new RegExp([`(?:${Yi})\\s${S(40)}\\b${jt}\\b`,"\\b(?:that|this|it)(?:'s|\\s+is)\\s+not\\s+something\\s+i\\s+(?:can|could|am\\s+able\\s+to|'m\\s+able\\s+to)\\b",`\\b(?:falls|sits|is)\\s+outside\\s+(?:of\\s+)?(?:what|the\\s+(?:scope|range|bounds))\\b${S(40)}\\bi\\s+(?:can|am|'m)\\b`,"\\bnot\\s+something\\s+i(?:'m|\\s+am)\\s+(?:able|willing|permitted|allowed)\\s+to\\b"].join("|"),"i")},{id:"explicit_decline",class:"strong",re:new RegExp(["\\bi\\s+(?:must|have\\s+to|need\\s+to|will\\s+have\\s+to|am\\s+going\\s+to|'m\\s+going\\s+to)\\s+(?:respectfully\\s+)?decline\\b","\\bi(?:'m|\\s+am)\\s+not\\s+(?:comfortable|willing|prepared)\\b","\\bi(?:'ll|\\s+will)\\s+(?:have\\s+to\\s+)?pass\\s+on\\b","\\bi\\s+(?:must|have\\s+to)\\s+refuse\\b"].join("|"),"i")},{id:"policy_citation",class:"strong",re:new RegExp([`\\b(?:against|contrary\\s+to|prohibited\\s+by|forbidden\\s+by|in\\s+violation\\s+of|violates)\\s${S(24)}\\b(?:polic(?:y|ies)|guidelines?|terms\\s+of\\s+(?:use|service)|rules\\s+of\\s+engagement|code\\s+of\\s+conduct)\\b`,`\\b(?:my|our|the|company|organi[sz]ation'?s?)\\s+(?:polic(?:y|ies)|guidelines?)\\s${S(24)}\\b(?:do(?:es)?\\s+not\\s+(?:allow|permit)|prohibit|forbid|prevent)\\b`,`\\bnot\\s+(?:permitted|allowed|authori[sz]ed)\\s+(?:under|by)\\s${S(24)}\\b(?:polic(?:y|ies)|guidelines?)\\b`].join("|"),"i")},{id:"guardrail_selfreference",class:"strong",re:new RegExp(["\\bi(?:'ve|\\s+have)\\s+been\\s+(?:instructed|configured|told|trained)\\s+not\\s+to\\b","\\bi(?:'m|\\s+am)\\s+(?:designed|configured|programmed|built|set\\s+up)\\s+not\\s+to\\b",`\\bmy\\s+(?:safety\\s+)?(?:instructions|configuration|guardrails?|constraints|training)\\s${S(24)}\\b(?:prevent|prohibit|forbid|do(?:es)?\\s+not\\s+(?:allow|permit)|preclude)\\b`,"\\b(?:outside|beyond)\\s+(?:my|the)\\s+(?:permitted|authori[sz]ed|configured|approved)\\s+(?:scope|remit|capabilities|actions|operations)\\b"].join("|"),"i")},{id:"ethical_objection",class:"strong",re:new RegExp(["\\b(?:that|this|doing\\s+(?:so|that)|what\\s+you(?:'re|\\s+are)\\s+asking|the\\s+request|such\\s+a\\s+request)\\s+(?:would\\s+be|is|are)\\s+(?:clearly\\s+|both\\s+|potentially\\s+)?(?:illegal|unethical|unlawful|harmful|fraudulent)\\b","\\bi\\s+(?:do\\s+not|don'?t)\\s+condone\\b","\\b(?:goes|would\\s+go|runs)\\s+against\\s+my\\s+(?:principles|values|ethics)\\b","\\bi\\s+(?:can'?t|cannot|won'?t)\\s+in\\s+good\\s+conscience\\b"].join("|"),"i")},{id:"apology_marker",class:"weak",re:new RegExp("\\b(?:i(?:'m|\\s+am)\\s+(?:really\\s+|very\\s+|terribly\\s+|so\\s+)?sorry|i\\s+apologi[sz]e|my\\s+apologies)\\b","i")}]),Lo=Object.freeze([/```/,/\b(?:here(?:'s|\s+is|\s+are)|below\s+(?:is|are|you(?:'ll|\s+will)\s+find)|the\s+following\s+(?:is|are))\b/i,new RegExp(`\\b(?:but|however|instead|although|that\\s+said)\\b${S(60)}\\b(?:i\\s+(?:can|could)(?!'t)\\s${S(30)}\\b${jt}\\b|i(?:'d|\\s+would)\\s+be\\s+happy\\s+to\\b|i(?:'m|\\s+am)\\s+able\\s+to\\b)`,"i"),/\bwhat\s+i\s+can\s+do\s+(?:instead|is|for\s+you)\b/i]);var R=e=>`[^.!?;\\n]{0,${e}}?`,Fo=Object.freeze([{id:"vulnerability_scanning",objectPatterns:[/\b(?:vulnerability|vuln|security)\s+(?:scan|scans|scanning|assessment|audit|test|testing)\b/i,/\bpen(?:etration)?[\s-]?test(?:ing)?\b/i,/\bport\s+scan(?:ning)?\b/i,/\b(?:exploit|nmap|metasploit|nessus|burp\s+suite)\b/i,/\bCVE-\d{4}-\d{4,7}\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|vulnerability|incident\s+respon\w{0,4}|threat|soc|red\s+team|phishing|malware)\b/i]},{id:"credential_access",objectPatterns:[/\b(?:credential|password|passphrase|api\s+key|access\s+key|secret|token|private\s+key|ssh\s+key)s?\b/i,/\b(?:vault|secrets?\s+manager|keychain|keystore)\b/i,/\bservice\s+account\s+key\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|identity|iam|credential|secrets?\s+manage\w{0,4}|vault|platform|devops)\b/i]},{id:"financial_transaction",objectPatterns:[/\b(?:wire\s+transfer|bank\s+transfer|payout|disbursement|chargeback)\b/i,new RegExp(`\\b(?:approve|issue|initiate|process|release)\\s${R(20)}\\b(?:payment|refund|invoice|transfer|purchase\\s+order)s?\\b`,"i"),new RegExp(`\\b(?:move|transfer)\\s${R(20)}\\b(?:funds|money)\\b`,"i")],purposeFunctions:["finance_accounting","procurement"],purposePatterns:[/\b(?:finance|financial|accounting|invoice|invoicing|payment|payments|billing|refund|refunds|treasury|procurement|spend|purchasing|fraud|kyc)\b/i]},{id:"personnel_data",objectPatterns:[/\b(?:employee|personnel|payroll|hr|staff)\s+(?:record|records|data|file|files|information|details)\b/i,/\b(?:salary|salaries|compensation|performance\s+review|termination\s+letter)s?\b/i,/\b(?:home\s+address|social\s+security\s+number|national\s+insurance\s+number)e?s?\b/i],purposeFunctions:["hr","privacy_compliance"],purposePatterns:[/\b(?:hr|human\s+resources|people\s+ops|payroll|benefits|recruit\w{0,4}|onboarding|privacy|dsar|consent)\b/i]},{id:"regulated_advice",objectPatterns:[/\b(?:legal|medical|tax|investment|financial)\s+advice\b/i,/\bpractis\w{0,3}\s+law\b/i,/\b(?:diagnose|diagnosis|prescribe|prescription)\b/i,/\b(?:binding|enforceable)\s+(?:opinion|interpretation)\b/i],purposeFunctions:["legal","privacy_compliance"],purposePatterns:[/\b(?:legal|compliance|counsel|contract|contracts|litigation|nda|privacy|regulator\w{0,2}|audit\w{0,3})\b/i]},{id:"data_export",objectPatterns:[new RegExp(`\\b(?:export|download|dump|extract|exfiltrat\\w{0,3}|bulk\\s+copy)\\b\\s${R(30)}\\b(?:data|database|dataset|records?|table|tables|customer\\s+list|contact\\s+list|report)\\b`,"i"),/\b(?:full|entire|whole)\s+(?:database|dataset|customer\s+table)\b/i],purposeFunctions:["operations","engineering","privacy_compliance"],purposePatterns:[/\b(?:data\s+(?:pipeline|engineering|platform)|etl|export|reporting|analytics|operations|document\s+extract\w{0,3}|forecast\w{0,3})\b/i]},{id:"code_execution",objectPatterns:[new RegExp(`\\b(?:run|execute|invoke)\\s${R(24)}\\b(?:script|scripts|command|commands|shell|code|binary|query|migration)\\b`,"i"),/\b(?:shell|root|sudo|admin)\s+(?:access|command|session)\b/i,/\bagainst\s+(?:the\s+)?production\s+(?:system|server|database|environment)s?\b/i],purposeFunctions:["engineering","it_security"],purposePatterns:[/\b(?:engineering|developer|devops|platform|release|deploy\w{0,4}|build|pipeline|sandbox|test\s+data|change\s+window)\b/i]},{id:"external_communication",objectPatterns:[new RegExp(`\\b(?:send|post|publish|email|tweet|message|broadcast)\\b\\s${R(30)}\\b(?:external|customer|customers|public|press|social\\s+media|third[\\s-]party|prospect|prospects)\\b`,"i"),/\b(?:cold\s+outreach|marketing\s+blast|phishing\s+email|press\s+release)\b/i],purposeFunctions:["marketing","sales","customer_support"],purposePatterns:[/\b(?:marketing|campaign|outreach|email\s+assistant|support|customer|sales|lead|leads|communication|communications)\b/i]}]);var ce="[REDACTED]",E="\u2022",U=e=>/[\p{L}\p{N}]/u.test(e);function Bt(e,t,n,r){let i=Array.from(e),a=i.length,o=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:E,c=o+s>=a;return i.map((u,d)=>!c&&(d<o||d>=a-s)?u:U(u)?l:u).join("")}function Ji(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return Bt(e,0,0,t);let r=e.slice(0,n),i=e.slice(n),a=t.length>0?t:E;return(r.length<=1?a:r[0]+Array.from(r.slice(1)).map(o=>U(o)?a:o).join(""))+i}function Qi(e,t,n){let r=n.length>0?n:E,i=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let c=new RegExp(t,"g"),u;for(;(u=c.exec(e))!==null;){if(u[0].length===0){c.lastIndex++;continue}for(let d=u.index;d<u.index+u[0].length;d++)i[d]=!0}}catch{}let a=!1,o=!0;for(let c=0;c<e.length;c++)if(U(e[c])&&(a=!0,!i[c])){o=!1;break}let s=a&&o,l="";for(let c=0;c<e.length;c++){let u=e[c];!s&&i[c]||!U(u)?l+=u:l+=r}return l}function Ut(e,t){let n=t.mode??"full";return n==="partial"?Bt(e,t.keepFirst??0,t.keepLast??0,t.maskChar??E):n==="email"?Ji(e,t.maskChar??E):n==="custom"?Qi(e,t.keepPattern,t.maskChar??E):t.replacement??ce}function Xi(e,t){return typeof e=="string"?Ut(e,t):t.replacement??ce}function zt(e){let t=[],n=e.replacement??ce;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:ee(r),replacer:()=>n});for(let r of e.directives??[]){let{pattern:i}=r;typeof i!="string"||i.length===0||t.push({source:ee(i),replacer:a=>Ut(a,r)})}return t}function qt(e){try{return new RegExp(e,"g")}catch(t){let n=t instanceof Error?t.message:String(t);throw new Error(`[visiq-redact] Invalid redaction pattern "${e}": ${n}`)}}function Gt(e,t){if(re(e).length===0){let n=e;for(let{source:r,replacer:i}of t)n=n.replace(qt(r),a=>i(a));return n}return ea(e,t)}function ea(e,t){let n=e;for(let{source:r,replacer:i}of t){let a=qt(r),o=[...rt(a,n)];for(let u of re(n))for(let d of rt(a,u.text))o.push(Pr(u,d));let s=Lr(o);if(s.length===0)continue;let l="",c=0;for(let{start:u,end:d}of s)l+=n.slice(c,u)+i(n.slice(u,d)),c=d;n=l+n.slice(c)}return n}function jo(e,t){return e==null?e:typeof e=="string"?ta(e,t):typeof e=="object"?na(e,t):e}function ta(e,t){if(typeof e!="string")return e;let n=zt(t);return n.length===0?e:Gt(e,n)}function na(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=zt(t),i=n.size>0,a=r.length>0,o=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>o(l));if(typeof s=="object"){let l=s,c=Object.create(Object.getPrototypeOf(l));for(let u of Object.keys(l)){let d=i?n.get(u):void 0;if(d){c[u]=Xi(l[u],d);continue}c[u]=o(l[u])}return c}return typeof s=="string"&&a?Gt(s,r):s};return o(e)}import{createHash as Za}from"node:crypto";var Vt=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function ra(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:Vt(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:Vt(t.spawn.prompt)}),t}function ia(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var aa=1440*60*1e3,oa="VISIQ_BUNDLE_GRACE_TTL_MS",sa="VISIQ_BUNDLE_CACHE_DISABLED",la="VISIQ_CACHE_DIR",ca=q.object({graceTtlMs:q.number().int().nonnegative().optional(),disabled:q.boolean().optional(),cacheDir:q.string().min(1).optional()}).strict();function ua(e){return e==null?{}:ca.parse(e)}function da(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[oa];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return aa}function pa(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[sa]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var Wt;function fa(){if(Wt!==void 0)return Wt;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function ma(e){return JSON.stringify(de(e))}function de(e){if(Array.isArray(e))return e.map(de);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=de(t[r]);return n}return e}function ha(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function ga(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function en(){if(!fa())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function tn(e,t){return e.createHash("sha256").update(ma(t)).digest("hex")}function _a(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[la]?.trim();if(r)return r;let i=process.env.XDG_CACHE_HOME?.trim();if(i)return e.path.join(i,"visiq");let a="";try{a=e.os.homedir()}catch{a=""}return a?e.path.join(a,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function ya(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function nn(e,t,n){return e.path.join(_a(e,n),"bundles",`${ya(e,t)}.json`)}async function ba(e,t,n,r={}){let i=await en();if(i)try{let a=nn(i,e,r),o=i.path.dirname(a);await i.fs.mkdir(o,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:tn(i.crypto,t),body:t},l=`${a}.tmp-${process.pid}-${i.crypto.randomBytes(6).toString("hex")}`;await i.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await i.fs.rename(l,a)}catch(c){throw await i.fs.rm(l,{force:!0}).catch(()=>{}),c}}catch{}}async function va(e,t={}){let n=await en();if(!n)return null;try{let r=await n.fs.readFile(nn(n,e,t),"utf-8"),i=ga(JSON.parse(r));return!i||tn(n.crypto,i.body)!==i.contentHash?null:i}catch{return null}}var D;async function wa(){if(D!==void 0)return D;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;D=typeof t=="function"?t:null}catch{D=null}return D}function Aa(e){let t=[];for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,i=r.rego_source;if(typeof i!="string"||i.length===0)continue;let a;try{a=J(i)}catch{continue}let o=typeof r.id=="string"?r.id:"<rule>";for(let s of De(a))t.push(`${o}: ${s}`)}return t}function ka(e){return et(e)}function Sa(e){return e==null||typeof e!="object"?!0:Object.keys(e).length===0}var Ia=5e3,Ea=600*1e3,Ca=1e4,Ta=25,Ht=1e3,Na=5e3,xa=100,Kt=2e3,Oa=10,Ra=512,$a=1800*1e3,Da=.7,Ma="monitor",Pa="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",Zt="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",La="open";function Yt(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function Fa(e,t){return Ft({content:e,resourceMetadata:t})}var ja=f.object({operations:f.array(f.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:f.string().min(1,"agentId is required"),sessionId:f.string().min(1).max(255).optional(),toolName:f.string().optional(),toolArgs:f.record(f.unknown()).optional(),targetResource:f.string().optional(),resourceType:f.string().optional(),resourceMetadata:f.record(f.unknown()).optional(),normalized:f.record(f.unknown()).optional(),query:f.string().optional(),contentPreview:f.string().optional(),telemetry:f.record(f.unknown()).optional(),context:f.record(f.unknown()).optional(),mcpServer:f.string().min(1).max(255).optional()}),Ba=f.object({version:f.string().min(1),dialect_version:f.number().int().optional(),min_dialect:f.number().int().optional(),shutdown:f.boolean().optional(),agent_mode:f.enum(["enforce","monitor","off"]).optional(),cognition_capture:f.boolean().optional(),agent_mode_by_operation:f.object({action:f.string().optional(),retrieval:f.string().optional(),delegation:f.string().optional()}).partial().optional(),agent_attributes:f.object({trust_tier:f.string().nullable().optional(),categories:f.array(f.string()).optional(),business_function:f.string().nullable().optional(),business_functions:f.array(f.string()).nullable().optional(),blast_radius_tier:f.string().nullable().optional(),no_coverage:f.string().nullable().optional(),fail_mode:f.string().nullable().optional()}).optional(),rules:f.array(f.record(f.unknown())),action_schemas:f.array(f.object({id:f.string(),plane:f.string().optional(),field_mappings:f.array(f.record(f.unknown())).optional(),derived_fields:f.array(f.record(f.unknown())).optional(),action_class:f.string().nullable().optional(),action_class_confidence:f.number().optional()})).optional(),no_coverage:f.object({no_coverage_defaults:f.record(f.string()),autopilot_enabled:f.boolean(),enduser_hitl_enabled:f.boolean(),hitl_timeout_seconds:f.number().optional()}).optional(),skill_blacklist:f.array(f.record(f.unknown())).optional()});function Ua(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=We(He(n));return{trust_tier:Pe(t)?t:null,categories:Fe(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&Ke(e.blast_radius_tier)?e.blast_radius_tier:null}}function za(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function qa(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var pe=new Set,Jt=!1;async function Qt(e){let t=[];for(let n of pe){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function Ga(){if(!Jt&&!(typeof process>"u"||typeof process.once!="function")){Jt=!0,process.once("beforeExit",()=>{Qt(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await Qt(!0)}finally{process.kill(process.pid,e)}})()})}}var Wo=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];skillBlacklist=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=Ma;agentModeByOperation=null;rawBundle=null;normalizedRefs={retrieval:[],action:[],delegation:[]};warnedNormalizedAbsent=!1;warnedNormalizedDrift=!1;lastNormalizedWarnRearmMs=0;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;failMode=Yt(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??La;governedFailMode=null;telemetryBuffer=[];droppedTelemetry=0;inFlightTelemetry=new Set;telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;lastSkillInventorySig=null;skillInventoryPromise=null;lastCloneCaptureSig=null;toolDescriptions=new Map;constructor(e,t,n,r,i,a,o,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,c=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,u=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=c,this.resolvedAgentId=u,this.harnessKind=r,this.sdkVersion=a,this.sdkDialect=o,this.originalFetch=globalThis.fetch.bind(globalThis);let d=ua(s);if(this.bundleCacheDisabled=pa(d.disabled),this.bundleGraceTtlMs=da(d.graceTtlMs),this.bundleCacheDirOverride=d.cacheDir,this.cacheIdentity=l&&c&&!this.bundleCacheDisabled?{endpoint:c,agentId:u,apiKey:l}:null,l&&c){let m={apiKey:l,agentId:u,endpoint:c,mode:"enforce",timeoutMs:ia(i),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...a!==void 0?{sdkVersion:a}:{},...o!==void 0?{sdkDialect:o}:{}};this.client=new Ie(m,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},Ia),ue(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},Ca),ue(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},Na),ue(this.cognitionTimer),pe.add(this),Ga()}else this.client=null}async evaluate(e){let t=ja.parse(e),n=Date.now();if(this.operatorShutdown){let h=this.denyAll(t,Pa);return this.applyAgentMode(h,"enforce",t,n)}if(this.dialectRefused){if(this.failMode==="open")return this.failOpen(t,Zt,n);let h=this.denyAll(t,Zt);return this.applyAgentMode(h,"enforce",t,n)}if(t.operations.every(h=>this.modeFor(h)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let h;if(this.agentModeConfirmed?h=this.agentMode:this.bundleApplyFailed?h="enforce":h="monitor",h==="enforce"&&this.failMode==="open")return this.failOpen(t,"no unified bundle loaded and no local rules",n);let g=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(g,h,t,n)}if(this.modeFor("action")!=="off"){let h=this.matchSkillQuarantine(t);if(h){let g=this.denyAll(t,h);return this.applyAgentMode(g,this.modeFor("action"),t,n)}}let r=this.readSession(t.sessionId),i=await wa();if(!i||!this.rawBundle){if(this.failMode==="open")return this.failOpen(t,"governance core (@visiq/core-wasm) unavailable",n);throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)")}let a=t.operations.includes("action")||t.operations.includes("delegation")?Be(t.normalized??{},{targetApp:t.targetResource??t.toolName??""}):t.normalized,o=this.buildActionSchemaEvent(t),s=t.mcpServer?{...a??{},mcp_server:t.mcpServer}:a,l={...t,normalized:s,session:r,at:Date.now(),action_schema_id:o.id,action_schema_raw:o.canonical},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},u;try{u=i(l,c)}catch(h){if(this.failMode==="open")return this.failOpen(t,`governance core evaluation threw: ${h instanceof Error?h.message:String(h)}`,n);throw h}let d=[...new Set(t.operations.flatMap(h=>this.normalizedRefs[h]??[]))].sort();d.length>0&&Sa(t.normalized)&&(u.normalizedColdStart=d,this.warnedNormalizedAbsent||(this.warnedNormalizedAbsent=!0,console.warn(`[UNIFIED] no normalized event supplied, but ${d.length} loaded rule condition(s) on this event's operation(s) read input.normalized.* \u2014 those conditions resolve to undefined here, so a deny carrying one does not fire. (Builtin-derived paths such as context/app_category ARE still populated in-core, so this is a dependency report, not a proof that every listed condition was the decider.) Cold start / no action-schema mapping yet. Affected: ${d.slice(0,5).join("; ")}${d.length>5?`; +${d.length-5} more`:""}`)));let m=Ue(t.normalized);return m.length>0&&(u.normalizedDrift=m,this.warnedNormalizedDrift||(this.warnedNormalizedDrift=!0,console.warn(`[UNIFIED] normalized event carries ${m.length} value(s) outside the canonical vocabulary \u2014 a builder-authored rule can only select in-vocab values, so these cannot match one, so a rule keyed on the canonical value does not fire here. Check the harness classifier's casing/spelling. Affected: ${m.slice(0,5).join("; ")}${m.length>5?`; +${m.length-5} more`:""}`))),this.foldSession(t,u.enforced?u.decision:"permit"),u.enforced&&u.action.decision==="approval_required"&&await this.registerHitl(t,u),this.bufferTelemetry(t,u,Date.now()-n,u.enforced),u}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}matchSkillQuarantine(e){if(this.skillBlacklist.length===0)return null;let t=e.context?.skill;if(!t||t.activated!==!0)return null;let n=typeof t.name=="string"?t.name:"",r=typeof t.fingerprint=="string"?t.fingerprint:null;if(n.length===0&&r===null)return null;let i=Ye({action:n,fingerprint:r},this.skillBlacklist);return i.blocked?i.matchedBy==="fingerprint"?"skill quarantined for the agent \u2014 its content signature matches a blacklisted skill (a renamed or edited re-skin); blocked ([D-27])":"skill quarantined for the agent \u2014 it is on the approved blacklist; blocked ([D-27])":null}readSession(e){if(!e)return O;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>$a?(this.sessions.delete(e),O):t.state:O}foldActionClass(e){let t=e.normalized?.action_class;if(typeof t=="string"&&t.length>0)return t;let n=this.rawBundle?.action_schemas;if(!Array.isArray(n))return;let{id:r}=this.buildActionSchemaEvent(e),i=n.find(s=>s?.id===r);if(!i)return;let a=i.action_class,o=typeof i.action_class_confidence=="number"?i.action_class_confidence:0;if(typeof a=="string"&&a.length>0&&o>=Da)return a}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),i=e.resourceMetadata??{},a=e.operations.includes("retrieval"),o=e.operations.includes("action")||e.operations.includes("delegation"),s=qe(r===O?ze():r,{data_categories:a&&Array.isArray(i.data_categories)?i.data_categories:void 0,classification:a?i.classification:void 0,taint:a?Fa(e.contentPreview,i):void 0,action_class:o?this.foldActionClass(e):void 0,target_app:o?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:s,touchedAt:Date.now()}),this.sessions.size>Ra){let l=this.sessions.keys().next().value;l!==void 0&&this.sessions.delete(l)}}applyAgentMode(e,t,n,r){let i=Date.now()-r;if(t==="enforce"){let o={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,o,i,!0),o}let a={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,a,i,!1),a}setFailMode(e){this.failMode=e}getFailMode(){return this.failMode}getGovernedFailMode(){return this.governedFailMode}failOpen(e,t,n){let r=`fail-open: ${t} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`;console.error(`[VisIQ] FAIL-OPEN: ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`);let i=e.operations.includes("action")||e.operations.includes("delegation"),a=e.operations.includes("retrieval"),o={decision:"permit",allowed:!0,reason:r,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:i?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:a?{action:"allow"}:{action:null},failOpen:!0};return this.bufferTelemetry(e,o,Date.now()-n,!1,!0),o}reportFailOpen(e,t){try{let n={operations:["action"],agentId:this.resolvedAgentId,...t?.toolName?{toolName:t.toolName}:{},...t?.sessionId?{sessionId:t.sessionId}:{}},r={decision:"permit",allowed:!0,reason:`fail-open: ${e} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:{decision:"permit",allowed:!0},retrieval:{action:null},failOpen:!0};this.bufferTelemetry(n,r,0,!1,!0)}catch{}}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},action_schema_id:this.buildActionSchemaEvent(e).id,...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=Ba.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}let r=Aa(t.rules);if(r.length>0){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle contains rego_source using a builtin the engine cannot evaluate (would silently never match \u2192 fail open): ${r.join("; ")}. Refusing the bundle and failing closed (G001). Recompile the rule without case-folding wrappers like upper()/lower().`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(i=>Xe(i)).filter(i=>i!==null),this.skillBlacklist=Array.isArray(t.skill_blacklist)?t.skill_blacklist:[],this.agentAttributes=t.agent_attributes?Ua(t.agent_attributes):null,this.agentNoCoverage=Je(t.agent_attributes?.no_coverage),this.governedFailMode=Yt(t.agent_attributes?.fail_mode)??null,this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=za(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.normalizedRefs=ka(this.rules),this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1,this.lastNormalizedWarnRearmMs=Date.now(),this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...T(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304){let o=Date.now();o-this.lastNormalizedWarnRearmMs>=Ea&&(this.lastNormalizedWarnRearmMs=o,this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1);return}if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),i=await n.json();this.applyBundle(i);let a=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&a?this.bundleEtag=r:a||(this.bundleEtag=null),a&&await this.persistBundleToDisk(i)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await va(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(ha(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await ba(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}isBundleLoaded(){return this.bundleLoaded}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e,t){this.registerEnvironment({...Y(),...e?{agent_type:e}:{},...t?.model?{model:t.model}:{},...t?.systemPrompt?{systemPrompt:t.systemPrompt}:{},...t?.toolSchemas&&t.toolSchemas.length>0?{toolSchemas:t.toolSchemas}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));for(let n of e)n.description&&this.toolDescriptions.set(n.name,n.description);t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}reportSkillInventory(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,h:n.content_hash})).sort((n,r)=>n.n===r.n?n.h.localeCompare(r.h):n.n.localeCompare(r.n)));t!==this.lastSkillInventorySig&&(this.lastSkillInventorySig=t,this.skillInventoryPromise=this.client.reportSkillInventory(e).catch(()=>{}))}captureCloneMetadata(e){if(!this.client||!this.resolvedAgentId||!(e.model||e.systemPrompt||(e.toolSchemas?.length??0)>0))return;let t=JSON.stringify({m:e.model??"",s:e.systemPrompt??"",t:e.toolSchemas??[]});t!==this.lastCloneCaptureSig&&(this.lastCloneCaptureSig=t,this.client.registerEnvironment({...Y(),...e.agentType?{agent_type:e.agentType}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{systemPrompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{toolSchemas:e.toolSchemas}:{}}))}buildActionSchemaEvent(e){let t=e.toolName?this.toolDescriptions.get(e.toolName):void 0,n={agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{},...e.toolArgs?{tool_args:e.toolArgs}:{},...t?{tool_description:t}:{}},r=Qe(n),i={...n};return e.toolArgs&&(i.tool_args=Nt(e.toolArgs)),{canonical:n,id:r,rawEventForWire:i}}bufferTelemetry(e,t,n,r,i=!1){let a=this.buildActionSchemaEvent(e);this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?qa(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:a.rawEventForWire,action_schema_id:a.id,...this.harnessKind||e.context||i||t.normalizedColdStart||t.normalizedDrift?{context:{...this.harnessKind?{[ke]:this.harnessKind}:{},...e.context??{},...i?{fail_open:!0}:{},...t.normalizedColdStart?{normalized_cold_start:!0,normalized_inert_conditions:t.normalizedColdStart.length}:{},...t.normalizedDrift?{normalized_drift:!0,normalized_drift_values:t.normalizedDrift.length,normalized_drift_fields:t.normalizedDrift.slice(0,Oa)}:{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=Ta&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0),{client:t}=this,n=(async()=>{try{await t.sendTelemetry(e)}catch(r){this.droppedTelemetry+=e.length,console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",r)}})();this.inFlightTelemetry.add(n);try{await n}finally{this.inFlightTelemetry.delete(n)}}async drainInFlightTelemetry(){for(let e=0;e<8&&this.inFlightTelemetry.size>0;e+=1)await Promise.allSettled([...this.inFlightTelemetry])}droppedTelemetryCount(){return this.droppedTelemetry}enforceTelemetryCap(){let e=this.telemetryBuffer.length-Ht;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${Ht})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(ra(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=xa&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-Kt;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${Kt})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}if(this.skillInventoryPromise)try{await this.skillInventoryPromise}catch{}await this.flushTelemetry(),await this.drainInFlightTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),pe.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function ue(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function G(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function Ho(e,t){if(e!=="Task"&&e!=="Agent")return null;let n=G(t.description),r=G(t.subagent_type),i=G(t.prompt),a=n??r??"sub-agent";return{childAgentId:a,childName:a,kind:"subagent",agentType:r,description:n,task:i,goal:i,model:G(t.model),source:"structural"}}function Ko(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}var Va={skill:"mastra",workspace_activate_skill:"voltagent",load_skill:"openai-agents",Skill:"claude-code"},Wa=new Set(["workspace_deactivate_skill"]),Ha=new Set(["read","read_file","readfile","view","cat"]);function Zo(e){return Wa.has((e??"").trim())}function Ka(e){let t=/(?:^|[/\\])([^/\\]+)[/\\]SKILL\.md$/i.exec(e.trim());return t?t[1]??null:null}function Xt(e,t){for(let n of t){let r=e[n];if(typeof r=="string"&&r.trim())return r.trim()}return null}function Yo(e,t){let n=(e??"").trim();if(!n)return null;let r=t??{},i=Va[n];if(i){let a=Xt(r,["name","skill_name","identifier","skill","path"]);return a?{skill:a,via:n,framework:i}:null}if(Ha.has(n.toLowerCase())){let a=Xt(r,["path","file_path","filePath","target","file"]),o=a?Ka(a):null;return o?{skill:o,via:n,framework:"unknown"}:null}return null}var Ya=/^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/,Ja=/^([A-Za-z0-9_.-]+):[ \t]*(.*)$/;function Qa(e){let t=e.trim();return t.length>=2&&(t[0]==='"'&&t.endsWith('"')||t[0]==="'"&&t.endsWith("'"))?t.slice(1,-1):t}function Xa(e,t){let n=t.startsWith("|");return(n?e.join(`
+`):e.join(" ")).replace(/[ \t]+/g,n?"$&":" ").trim()}function eo(e){let t=Ya.exec(e);if(!t)return{attrs:{},body:e};let[,n]=t,r=e.slice(t[0].length),i={},a=(n??"").split(/\r?\n/);for(let o=0;o<a.length;o+=1){let s=a[o]??"";if(!s.trim()||s.trimStart().startsWith("#")||/^[ \t]/.test(s))continue;let l=Ja.exec(s);if(!l)continue;let c=l[1],u=(l[2]??"").trim();if(/^[|>][+-]?\d*$/.test(u)){let d=[],m=o+1;for(;m<a.length;m+=1){let h=a[m]??"";if(h.trim()&&!/^[ \t]/.test(h))break;d.push(h.trim())}o=m-1,i[c]=Xa(d,u);continue}u&&(i[c]=Qa(u))}return{attrs:i,body:r}}function to(e){return Za("sha256").update(e,"utf8").digest("hex")}function no(e,t,n){let{attrs:r,body:i}=eo(e),{description:a}=r;return{name:r.name?.trim()||n,path:t,...a?{description:a}:{},contentHash:to(i),fingerprint:Ze(i)}}var ro=500,io=512*1024;async function Xo(e){let[t,n]=await Promise.all([import("node:fs/promises"),import("node:path")]),r=[],i=new Set;for(let a of e){let o;try{o=await t.readdir(a,{withFileTypes:!0})}catch{continue}for(let s of o){if(r.length>=ro)return r;if(!s.isDirectory())continue;let l=n.join(a,s.name,"SKILL.md");try{let c=await t.stat(l);if(!c.isFile()||c.size>io)continue;let u=await t.readFile(l,"utf8"),d=no(u,`${s.name}/SKILL.md`,s.name),m=`${d.name}@${d.contentHash}`;if(i.has(m))continue;i.add(m),r.push(d)}catch{continue}}}return r}function es(e){let t=[],n=[],r,i=[];for(let o of e){if(o.mode==="partial"||o.mode==="email"||o.mode==="custom"){let l={mode:o.mode};o.field&&(l.field=o.field),o.pattern&&(l.pattern=o.pattern),typeof o.keepFirst=="number"&&(l.keepFirst=o.keepFirst),typeof o.keepLast=="number"&&(l.keepLast=o.keepLast),o.maskChar&&(l.maskChar=o.maskChar),o.keepPattern&&(l.keepPattern=o.keepPattern),o.replacement!==void 0&&(l.replacement=o.replacement),i.push(l);continue}o.field&&t.push(o.field),o.pattern&&n.push(o.pattern);let{replacement:s}=o;s&&r===void 0&&(r=s)}let a={};return t.length>0&&(a.fields=t),n.length>0&&(a.patterns=n),r!==void 0&&(a.replacement=r),i.length>0&&(a.directives=i),a}var rn="0.1.13";var us=3e4,so=4e3;function lo(e){return e.replace(/[^a-zA-Z0-9._-]/g,"_").slice(0,200)||"default"}function H(e){let t=oo("sha1").update(e).digest("hex").slice(0,10);return`${lo(e)}-${t}`}function ds(e,t,n){return n-e.fetchedAt<t}function an(e){return I(w(),"bundles",`${H(e)}.json`)}function on(e){return I(w(),"sessions",`${H(e)}.registered`)}function sn(e){return I(w(),"sessions",`${H(e)}.skill`)}function ln(e){return I(w(),"sessions",`${H(e)}.skillfp.json`)}var co=/^[0-9a-f]{16}$/;async function ps(e,t){try{await V(I(w(),"sessions"),{recursive:!0}),await W(ln(e),JSON.stringify(t),{mode:384})}catch{}}async function fs(e){try{let t=await fe(ln(e),"utf8"),n=JSON.parse(t);if(n===null||typeof n!="object")return{};let r={};for(let[i,a]of Object.entries(n))typeof a=="string"&&co.test(a)&&(r[i]=a);return r}catch{return{}}}async function ms(e){try{let n=(await fe(sn(e),"utf8")).trim();return n.length>0?n:null}catch{return null}}async function hs(e,t){try{await V(I(w(),"sessions"),{recursive:!0}),await W(sn(e),t??"",{mode:384})}catch{}}async function gs(e){try{let t=await fe(an(e),"utf-8"),n=JSON.parse(t);return n&&typeof n.fetchedAt=="number"&&"body"in n?n:null}catch{return null}}async function _s(e,t,n){try{let r=an(e);await V(I(w(),"bundles"),{recursive:!0});let i={fetchedAt:Date.now(),version:n,body:t};await W(r,JSON.stringify(i),{mode:384})}catch{}}async function ys(e,t,n){try{let i=`${e.replace(/\/+$/,"")}/rules/bundle?agent_id=${encodeURIComponent(n)}`,a=await fetch(i,{method:"GET",headers:{Authorization:`Bearer ${t}`,Accept:"application/json",...T(rn,Z)},signal:AbortSignal.timeout(so)});if(!a.ok)return null;let o=a.headers.get("etag");return{body:await a.json(),version:o}}catch{return null}}async function bs(e){try{return await ao(on(e)),!0}catch{return!1}}async function vs(e){try{await V(I(w(),"sessions"),{recursive:!0}),await W(on(e),String(Date.now()),{mode:384})}catch{}}export{_e as a,ye as b,w as c,hn as d,yn as e,bn as f,vn as g,mo as h,jo as i,Z as j,Pn as k,Wo as l,Ho as m,Ko as n,Zo as o,Ka as p,Yo as q,Xo as r,es as s,rn as t,us as u,lo as v,ds as w,ps as x,fs as y,ms as z,hs as A,gs as B,_s as C,ys as D,bs as E,vs as F};

package/dist/cli/hook.js

@@ -1,4 +1,4 @@
 #!/usr/bin/env node
-import{b as a,i,l as p,v as f,w as m,x as I}from"../chunk-KIYOO6FJ.js";import{a as d,b as c,g as u}from"../chunk-KFHDW3CU.js";var g=process.env.VISIQ_DEBUG==="1",_=g?(...e)=>{process.stderr.write(`${e.map(String).join(" ")}
+import{b as a,i,l as p,v as f,w as m,x as I}from"../chunk-PH5GYJ6P.js";import{a as d,b as c,g as u}from"../chunk-TG66JAN2.js";var g=process.env.VISIQ_DEBUG==="1",_=g?(...e)=>{process.stderr.write(`${e.map(String).join(" ")}
 `)}:()=>{},S=console;for(let e of["log","info","debug","warn","error"])S[e]=_;var k={handlePre:(e,o)=>f(e,o),handlePost:(e,o)=>m(e,o),handleSession:(e,o)=>I(e,o),write:e=>{process.stdout.write(e)},reportFailOpen:e=>a(e)};async function h(e,o,s=k){let t=e.hook_event_name==="PreToolUse",r=n=>{t&&s.write(JSON.stringify(i(n)))};try{let n=null;switch(e.hook_event_name){case"PreToolUse":n=await s.handlePre(e,o);break;case"PostToolUse":n=await s.handlePost(e,o);break;case"SessionStart":n=await s.handleSession(e,o);break;default:n=null}n&&s.write(JSON.stringify(n))}catch(n){let l=n instanceof Error?n.message:String(n);o.failMode==="closed"?r(`[VisIQ] harness error \u2014 blocked (VISIQ_FAIL_MODE=closed): ${l}`):await s.reportFailOpen({stage:"handler-crash",detail:l,toolName:e.tool_name,sessionId:e.session_id})}}function v(e,o=process.env){return c(o.VISIQ_FAIL_MODE)??e}function w(e,o,s){let t=e instanceof Error?e.message:String(e),r=v(o,s.env??process.env);try{r==="closed"?s.writeOut(JSON.stringify(i("[VisIQ] harness crashed before evaluating the call \u2014 blocked (VISIQ_FAIL_MODE=closed)."))):s.writeErr(`[VisIQ] FAIL-OPEN (dispatch-crash): ${t} \u2014 tool call proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.
 `)}catch{}return r}var P=d;function E(){return new Promise(e=>{if(process.stdin.isTTY){e("");return}let o=[],s=!1,t=()=>{s||(s=!0,e(Buffer.concat(o).toString("utf-8")))};setTimeout(t,15e3).unref?.(),process.stdin.on("data",n=>o.push(n)),process.stdin.on("end",t),process.stdin.on("error",t)})}async function D(){let e=p(await E());if(!e)return;let o=e.hook_event_name==="PreToolUse",s=n=>{o&&process.stdout.write(JSON.stringify(i(n)))},{config:t,failMode:r}=await u();if(P=r,!t){r==="closed"?s("[VisIQ] Claude Code harness is loaded but NOT configured \u2014 set VISIQ_API_KEY + VISIQ_AGENT_ID (and optionally VISIQ_ENDPOINT), or run `visiq-claude-code configure`. Blocked because VISIQ_FAIL_MODE=closed."):o&&await a({stage:"unconfigured",detail:"no VisIQ credentials resolved (need VISIQ_API_KEY + VISIQ_AGENT_ID)",toolName:e.tool_name,sessionId:e.session_id},!1);return}await h(e,t)}D().then(()=>process.exit(0)).catch(e=>{w(e,P,{writeOut:o=>process.stdout.write(o),writeErr:o=>process.stderr.write(o)}),process.exit(0)});

package/dist/cli/main.js

@@ -1,13 +1,15 @@
 #!/usr/bin/env node
-import{a as f,e as m,f as w,g as d}from"../chunk-6DMSMBWM.js";import{c as l,d as u,e as g,h as p,y}from"../chunk-KFHDW3CU.js";import{mkdir as I,readFile as v,writeFile as h}from"node:fs/promises";import{existsSync as j}from"node:fs";import{homedir as k}from"node:os";import{dirname as $,isAbsolute as C,join as a,resolve as Q}from"node:path";import{parseArgs as V}from"node:util";function N(){let{positionals:e,values:n}=V({args:process.argv.slice(2),options:{user:{type:"boolean"},project:{type:"boolean"},settings:{type:"string"},command:{type:"string"},"api-key":{type:"string"},"agent-id":{type:"string"},"base-url":{type:"string"}},strict:!1,allowPositionals:!0});return{positionals:e,values:n}}function S(e){let n=e.settings;return typeof n=="string"&&n.length>0?C(n)?n:Q(n):e.project?a(process.cwd(),".claude","settings.json"):a(k(),".claude","settings.json")}async function c(e){if(!j(e))return{};try{let n=await v(e,"utf-8"),t=JSON.parse(n);return t&&typeof t=="object"?t:{}}catch{return{}}}async function P(e,n){await I($(e),{recursive:!0}),await h(e,`${JSON.stringify(n,null,2)}
-`,"utf-8")}async function U(e){let n=S(e),t=typeof e.command=="string"?e.command:f,s=await c(n);return await P(n,m(s,t)),process.stdout.write(`[VisIQ] Installed Claude Code governance hooks \u2192 ${n}
-        SessionStart + PreToolUse + PostToolUse \u2192 \`${t}\`
+import{a as m,e as w,f as y,g as l}from"../chunk-6DMSMBWM.js";import{B as h,c as u,d as g,e as p,h as f}from"../chunk-TG66JAN2.js";import{mkdir as I,readFile as j,writeFile as $}from"node:fs/promises";import{existsSync as C}from"node:fs";import{homedir as k}from"node:os";import{dirname as S,isAbsolute as N,join as c,resolve as A}from"node:path";import{parseArgs as O}from"node:util";function x(){let{positionals:e,values:n}=O({args:process.argv.slice(2),options:{user:{type:"boolean"},project:{type:"boolean"},settings:{type:"string"},command:{type:"string"},"api-key":{type:"string"},"agent-id":{type:"string"},"base-url":{type:"string"}},strict:!1,allowPositionals:!0});return{positionals:e,values:n}}function v(e){let n=e.settings;return typeof n=="string"&&n.length>0?N(n)?n:A(n):e.project?c(process.cwd(),".claude","settings.json"):c(k(),".claude","settings.json")}var a=class extends Error{constructor(s,t){super(`[visiq] refusing to write ${s}: it exists but could not be read as JSON (${t}).
+Writing would REPLACE it, discarding whatever it holds \u2014 permissions, model, MCP servers.
+Fix the JSON (a trailing comma is the usual cause) and re-run, or pass --settings <path> to install somewhere else.`);this.path=s;this.reason=t;this.name="UnreadableSettingsError"}path;reason};async function d(e){if(!C(e))return{};let n;try{n=await j(e,"utf-8")}catch(t){throw new a(e,t instanceof Error?t.message:String(t))}if(n.trim().length===0)return{};let s;try{s=JSON.parse(n)}catch(t){throw new a(e,t instanceof Error?t.message:String(t))}if(!s||typeof s!="object"||Array.isArray(s))throw new a(e,`expected a JSON object, got ${Array.isArray(s)?"an array":typeof s}`);return s}async function P(e,n){await I(S(e),{recursive:!0}),await $(e,`${JSON.stringify(n,null,2)}
+`,"utf-8")}async function Q(e){let n=v(e),s=typeof e.command=="string"?e.command:m,t=await d(n);return await P(n,w(t,s)),process.stdout.write(`[VisIQ] Installed Claude Code governance hooks \u2192 ${n}
+        SessionStart + PreToolUse + PostToolUse \u2192 \`${s}\`
         Next: set credentials (\`visiq-claude-code configure\`) then start Claude Code.
-`),0}async function O(e){let n=S(e),t=typeof e.command=="string"?e.command:void 0,s=await c(n);return await P(n,w(s,t)),process.stdout.write(`[VisIQ] Removed Claude Code governance hooks from ${n}
-`),0}async function R(e){let n=g(),t=typeof e["api-key"]=="string"&&e["api-key"]||n.apiKey,s=typeof e["agent-id"]=="string"&&e["agent-id"]||n.agentId,o=typeof e["base-url"]=="string"&&e["base-url"]||n.baseUrl;if(!t||!s)return process.stderr.write(`[VisIQ] configure needs --api-key and --agent-id (or VISIQ_API_KEY / VISIQ_AGENT_ID env).
-`),1;let i={apiKey:t,agentId:s};o&&(i.baseUrl=o);let r=u();return await I($(r),{recursive:!0}),await h(r,`${JSON.stringify(i,null,2)}
-`,{mode:384}),process.stdout.write(`[VisIQ] Wrote credentials \u2192 ${r} (agent ${s}${o?`, endpoint ${o}`:""})
-`),0}async function A(){let e=await p(),n=a(k(),".claude","settings.json"),t=a(process.cwd(),".claude","settings.json"),s=d(await c(n)),o=d(await c(t)),i=e?await y(e.agentId):null,r=["[VisIQ] Claude Code harness \u2014 doctor",`  credentials:   ${e?"resolved":"MISSING (run `visiq-claude-code configure`)"}`,`  agent id:      ${e?.agentId??"\u2014"}`,`  endpoint:      ${e?.baseUrl??process.env.VISIQ_ENDPOINT??"(default)"}`,`  state dir:     ${l()}`,`  hooks (user):  ${s?"installed":"not installed"} \u2014 ${n}`,`  hooks (proj):  ${o?"installed":"not installed"} \u2014 ${t}`,`  bundle cache:  ${i?`present (fetched ${new Date(i.fetchedAt).toISOString()})`:"none"}`];return process.stdout.write(`${r.join(`
+`),0}async function V(e){let n=v(e),s=typeof e.command=="string"?e.command:void 0,t=await d(n);return await P(n,y(t,s)),process.stdout.write(`[VisIQ] Removed Claude Code governance hooks from ${n}
+`),0}async function E(e){let n=p(),s=typeof e["api-key"]=="string"&&e["api-key"]||n.apiKey,t=typeof e["agent-id"]=="string"&&e["agent-id"]||n.agentId,r=typeof e["base-url"]=="string"&&e["base-url"]||n.baseUrl;if(!s||!t)return process.stderr.write(`[VisIQ] configure needs --api-key and --agent-id (or VISIQ_API_KEY / VISIQ_AGENT_ID env).
+`),1;let o={apiKey:s,agentId:t};r&&(o.baseUrl=r);let i=g();return await I(S(i),{recursive:!0}),await $(i,`${JSON.stringify(o,null,2)}
+`,{mode:384}),process.stdout.write(`[VisIQ] Wrote credentials \u2192 ${i} (agent ${t}${r?`, endpoint ${r}`:""})
+`),0}async function R(){let e=await f(),n=c(k(),".claude","settings.json"),s=c(process.cwd(),".claude","settings.json"),t=l(await d(n)),r=l(await d(s)),o=e?await h(e.agentId):null,i=["[VisIQ] Claude Code harness \u2014 doctor",`  credentials:   ${e?"resolved":"MISSING (run `visiq-claude-code configure`)"}`,`  agent id:      ${e?.agentId??"\u2014"}`,`  endpoint:      ${e?.baseUrl??process.env.VISIQ_ENDPOINT??"(default)"}`,`  state dir:     ${u()}`,`  hooks (user):  ${t?"installed":"not installed"} \u2014 ${n}`,`  hooks (proj):  ${r?"installed":"not installed"} \u2014 ${s}`,`  bundle cache:  ${o?`present (fetched ${new Date(o.fetchedAt).toISOString()})`:"none"}`];return process.stdout.write(`${i.join(`
 `)}
 `),e?0:1}function b(){process.stdout.write(`Usage: visiq-claude-code <install|uninstall|configure|doctor> [flags]
 
@@ -15,6 +17,6 @@ import{a as f,e as m,f as w,g as d}from"../chunk-6DMSMBWM.js";import{c as l,d as
   uninstall  [--user|--project|--settings <path>]
   configure  [--api-key <key>] [--agent-id <id>] [--base-url <url>]
   doctor
-`)}async function D(){let{positionals:e,values:n}=N(),t=e[0],s=0;switch(t){case"install":s=await U(n);break;case"uninstall":s=await O(n);break;case"configure":s=await R(n);break;case"doctor":s=await A();break;case"help":case void 0:b();break;default:process.stderr.write(`[VisIQ] Unknown command: ${t}
-`),b(),s=1}process.exit(s)}D().catch(e=>{process.stderr.write(`[VisIQ] ${e instanceof Error?e.message:String(e)}
-`),process.exit(1)});
+`)}async function U(){let{positionals:e,values:n}=x(),s=e[0],t=0;switch(s){case"install":t=await Q(n);break;case"uninstall":t=await V(n);break;case"configure":t=await E(n);break;case"doctor":t=await R();break;case"help":case void 0:b();break;default:process.stderr.write(`[VisIQ] Unknown command: ${s}
+`),b(),t=1}process.exit(t)}U().catch(e=>{process.stderr.write(`[VisIQ] ${e instanceof Error?e.message:String(e)}
+`),process.exit(1)});export{a as UnreadableSettingsError};

package/dist/index.d.ts

@@ -304,6 +304,14 @@ export interface ReportedSkill {
 	description?: string;
 	/** sha256 of the instruction body, hex. */
 	content_hash: string;
+	/**
+	 * The 64-bit SimHash (16 hex) of the body — the ROBUST-quarantine key. Unlike
+	 * content_hash it survives a rename / one-char edit, so a fleet sweep can match
+	 * a re-skinned copy of a blacklisted skill. Content-free (a lossy digest), so
+	 * it travels for the same reason content_hash does; the body stays put (G017).
+	 * Optional so an older harness that omits it still reports a valid inventory.
+	 */
+	fingerprint?: string;
 	/** Which surface reported it (`claude-code`, `mastra`, …). */
 	framework?: string;
 }
@@ -618,6 +626,12 @@ declare class UnifiedRuntime {
 	/** Wire-contract capability integer for the `X-VisIQ-Dialect` header (undefined → SDK_DIALECT). */
 	private readonly sdkDialect;
 	private rules;
+	/**
+	 * Surface D — the operator-approved skill blacklist carried in the bundle
+	 * (raw entries; the shared matcher validates each). The OFFLINE twin of the
+	 * server DETONATION_BLACKLIST_STOP. Empty until a bundle ships one.
+	 */
+	private skillBlacklist;
 	/** Server-authoritative agent attributes from the bundle (null until shipped). */
 	private agentAttributes;
 	/**
@@ -783,6 +797,18 @@ declare class UnifiedRuntime {
 	 * Resolve the effective mode for one operation: per-op override → agent mode.
 	 */
 	private modeFor;
+	/**
+	 * OFFLINE skill quarantine — does an operator-approved bundle blacklist entry
+	 * block THIS skill activation? Returns the deny reason, or null.
+	 *
+	 * Only a call that IS the activation (`context.skill.activated === true`) is
+	 * screened — the blacklist blocks the activation, not the follow-on actions it
+	 * precedes (attribution is by ordering, never causation). The identity handed to
+	 * the shared matcher is the skill NAME (its exact id) and its FINGERPRINT (the
+	 * robust leg). Total by construction: the matcher validates every entry and a
+	 * malformed one is ignored, so this never throws into the decision path.
+	 */
+	private matchSkillQuarantine;
 	/** Read the session's PRIOR-events state; fresh/absent/expired ⇒ empty. */
 	private readSession;
 	/** The action_class the SDK-local session fold accumulates (Phase 3). Source-3

package/dist/index.js

@@ -1 +1 @@
-import{a as h,b as x,c as O,d as S,e as C,f as H,g as _}from"./chunk-6DMSMBWM.js";import{a as s,b as p,c as m,d,e as f,f as E,g as K,h as V,i as w,j as z,k as G,l as Q,m as R,n as u,o as T,p as c,q as N,r as A,s as P,t as U,u as k,v as B,w as q,x as b}from"./chunk-KIYOO6FJ.js";import{A as v,B as I,C as M,a as e,b as o,c as t,d as r,e as i,f as a,g as n,h as l,t as g,u as D,v as F,y,z as L}from"./chunk-KFHDW3CU.js";export{g as DEFAULT_BUNDLE_TTL_MS,e as DEFAULT_FAIL_MODE,N as HARNESS_KIND,h as HOOK_COMMAND,x as HOOK_TIMEOUT_SECONDS,O as RETRIEVAL_MATCHER,R as WITHHELD_SENTINEL,m as bareToolName,u as blankContent,P as buildEvaluateEvent,G as buildPostRedact,V as buildPreAllow,z as buildPreAsk,w as buildPreDeny,r as configFilePath,A as createRuntime,i as envConfig,E as extractQuery,s as failOpenLogPath,v as fetchBundle,k as finishRuntime,K as formatReason,q as handlePostToolUse,B as handlePreToolUse,b as handleSessionStart,_ as hooksInstalled,C as installHooks,F as isFresh,d as isRetrievalTool,I as isSessionRegistered,S as isVisiqGroup,l as loadConfig,n as loadHarnessState,c as mapPostRedaction,T as mapPreDecision,M as markSessionRegistered,a as mergeConfig,o as normalizeFailMode,Q as parseHookInput,y as readBundleCache,p as reportFailOpen,D as sanitizeId,f as toolOperations,H as uninstallHooks,t as visiqHomeDir,U as warmFromCache,L as writeBundleCache};
+import{a as h,b as x,c as O,d as S,e as C,f as H,g as _}from"./chunk-6DMSMBWM.js";import{a as s,b as p,c as m,d,e as f,f as E,g as K,h as V,i as w,j as z,k as G,l as Q,m as R,n as u,o as T,p as c,q as N,r as A,s as P,t as U,u as k,v as B,w as q,x as b}from"./chunk-PH5GYJ6P.js";import{B as y,C as L,D as v,E as I,F as M,a as e,b as o,c as t,d as r,e as i,f as a,g as n,h as l,u as g,v as D,w as F}from"./chunk-TG66JAN2.js";export{g as DEFAULT_BUNDLE_TTL_MS,e as DEFAULT_FAIL_MODE,N as HARNESS_KIND,h as HOOK_COMMAND,x as HOOK_TIMEOUT_SECONDS,O as RETRIEVAL_MATCHER,R as WITHHELD_SENTINEL,m as bareToolName,u as blankContent,P as buildEvaluateEvent,G as buildPostRedact,V as buildPreAllow,z as buildPreAsk,w as buildPreDeny,r as configFilePath,A as createRuntime,i as envConfig,E as extractQuery,s as failOpenLogPath,v as fetchBundle,k as finishRuntime,K as formatReason,q as handlePostToolUse,B as handlePreToolUse,b as handleSessionStart,_ as hooksInstalled,C as installHooks,F as isFresh,d as isRetrievalTool,I as isSessionRegistered,S as isVisiqGroup,l as loadConfig,n as loadHarnessState,c as mapPostRedaction,T as mapPreDecision,M as markSessionRegistered,a as mergeConfig,o as normalizeFailMode,Q as parseHookInput,y as readBundleCache,p as reportFailOpen,D as sanitizeId,f as toolOperations,H as uninstallHooks,t as visiqHomeDir,U as warmFromCache,L as writeBundleCache};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visiq/claude-code-harness",
-  "version": "0.1.12",
+  "version": "0.1.13",
   "description": "VisIQ agent-governance harness for the Claude Code CLI — action governance on every tool call, retrieval governance on its built-in read tools and read-shaped MCP tools, and audit-trail reporting, installed as Claude Code hooks.",
   "type": "module",
   "main": "./dist/index.js",

package/dist/chunk-KFHDW3CU.js

@@ -1,5 +0,0 @@
-import{readFile as sn}from"node:fs/promises";import{homedir as he}from"node:os";import{join as G,isAbsolute as ln,resolve as cn}from"node:path";var un="https://api.visiqlabs.com",dn="@visiq/claude-code-harness",ge="open";function _e(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function k(){let e=process.env.VISIQ_HOME;return e&&e.trim().length>0?e:G(he(),".visiq","claude-code")}function pn(){return G(k(),"config.json")}function fn(e){return e==="~"||e.startsWith("~/")?G(he(),e.slice(1).replace(/^\//,"")):e}async function mn(e){try{let t=ln(e)?e:cn(e),n=await sn(t,"utf-8");return JSON.parse(n)}catch{return null}}function M(e,...t){for(let n of t){let r=e[n];if(typeof r=="string"&&r.length>0)return r}}function fe(e){if(!e||typeof e!="object")return{};let t=e,n={},r=M(t,"apiKey","api_key"),i=M(t,"agentId","agent_id"),a=M(t,"baseUrl","base_url"),o=_e(M(t,"failMode","fail_mode"));return r&&(n.apiKey=r),i&&(n.agentId=i),a&&(n.baseUrl=a),o&&(n.failMode=o),n}async function me(e){if(!e)return{};let t=await mn(fn(e));if(!t||typeof t!="object")return{};let n=t,r=n.plugins?.entries,i=r&&typeof r=="object"?r[dn]:void 0;return i&&typeof i=="object"&&i.config?fe(i.config):fe(n)}function hn(e=process.env){let t={};e.VISIQ_API_KEY&&(t.apiKey=e.VISIQ_API_KEY),e.VISIQ_AGENT_ID&&(t.agentId=e.VISIQ_AGENT_ID),e.VISIQ_BASE_URL?t.baseUrl=e.VISIQ_BASE_URL:e.VISIQ_ENDPOINT&&(t.baseUrl=e.VISIQ_ENDPOINT);let n=_e(e.VISIQ_FAIL_MODE);return n&&(t.failMode=n),t}function gn(e,t,n){let r={...e,...t,...n};if(!r.apiKey||!r.agentId)return null;let i={apiKey:r.apiKey,agentId:r.agentId,failMode:r.failMode??ge};return i.baseUrl=r.baseUrl||un,i}async function _n(){let e=hn(),t=await me(process.env.VISIQ_CONFIG_PATH),n=await me(pn()),r={...n,...t,...e};return{config:gn(n,t,e),failMode:r.failMode??ge}}async function no(){return(await _n()).config}import{mkdir as ue,readFile as tn,writeFile as de,stat as Za}from"node:fs/promises";import{createHash as Ya}from"node:crypto";import{join as E}from"node:path";import{z as p}from"zod";import*as w from"node:os";import{randomUUID as On}from"node:crypto";var W=1,be="X-VisIQ-SDK",ve="X-VisIQ-Dialect",we="unknown";function T(e,t=1){return{[be]:e&&e.length>0?e:we,[ve]:String(t)}}var Ae="interceptor_source",yn=p.enum(["enforce","audit","off"]),bn=p.enum(["closed","open"]),ke=p.enum(["enforce","monitor","off"]),vn=p.object({apiKey:p.string().min(1,"apiKey is required"),agentId:p.string().min(1,"agentId is required"),endpoint:p.string().url().optional(),mode:yn.optional(),timeoutMs:p.number().int().positive().optional(),hitlTimeoutMs:p.number().int().positive().optional(),failBehavior:bn.optional()}),ao=p.object({agent_id:p.string().min(1),target_app:p.string().min(1),action:p.string().min(1),context:p.record(p.unknown()).optional(),session_id:p.string().min(1).max(255).optional(),action_schema_id:p.string().min(1).max(128).optional(),telemetry:p.record(p.unknown()).optional()}),wn=p.object({field:p.string().optional(),pattern:p.string().optional(),replacement:p.string().optional(),mode:p.enum(["full","partial","email"]).optional(),keepFirst:p.number().optional(),keepLast:p.number().optional(),maskChar:p.string().optional()}),An=p.object({decision_id:p.string().min(1),decision:p.enum(["permit","deny","approval_required","mask"]),reason:p.string().optional(),rule_code:p.string().nullable().optional(),enforced:p.boolean().optional(),agent_mode:ke.optional(),arg_redaction_rules:p.array(wn).optional(),plane:p.string().nullable().optional(),operation:p.string().nullable().optional(),is_retrieval:p.boolean().optional(),metadata:p.record(p.unknown()).optional()}),kn=p.object({field:p.string().min(1),operator:p.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:p.union([p.string(),p.number(),p.array(p.string())])}),Sn=p.object({id:p.string().min(1),rule_code:p.string().default(""),name:p.string().min(1),description:p.string().nullable().default(null),effect:p.enum(["allow","deny","hitl","mask"]),resource_type:p.string().min(1),rego_source:p.string().default(""),target_app:p.string().nullable().default(null),action_pattern:p.string().nullable().default(null),conditions:p.array(kn).default([]),priority:p.number().int().default(0)}),In=p.object({version:p.string().min(1),agent_mode:ke.optional(),rules:p.array(Sn),no_coverage:p.object({no_coverage_defaults:p.record(p.string()),autopilot_enabled:p.boolean(),enduser_hitl_enabled:p.boolean(),hitl_timeout_seconds:p.number()}).optional()}),En=2e3,Cn=e=>new RegExp("^\\p{White_Space}*$","u").test(e)||e.trim().length===0;function Tn(e){let t=e.rules.filter(n=>Cn(n.rego_source)).map(n=>n.id);return t.length>0&&console.warn(`[VISIQ] ${t.length} bundle rule(s) carry an EMPTY rego body and will be evaluated as an UNCONDITIONAL PERMIT credited to their own rule id: ${t.join(", ")}. If any of these is meant to deny, it is not denying. Fix the rule body at the control plane; the SDK cannot tell an intentional stub from a dropped column.`),t}var Se=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return T(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let i=await r.json();return An.parse(i)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json(),o=In.parse(a);return Tn(o),o}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let i=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});i.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${i.status}`)}catch(i){console.warn("[ALLOW] Execution result report failed:",i)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{system_prompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{tool_schemas:e.toolSchemas}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async reportSkillInventory(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/skills`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,skills:e})});n.ok||console.warn(`[ALLOW] Skill-inventory report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Skill-inventory report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json();if(typeof a!="object"||a===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let o=a,s=o.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof o.reason=="string"?o.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await xn(En)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function xn(e){return new Promise(t=>setTimeout(t,e))}function H(){let e={};try{let t=`${w.platform()} ${w.release()}`.trim();t&&(e.os=t)}catch{}try{let t=w.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=w.userInfo();t&&(e.username=t)}catch{}try{let t=Nn();t&&(e.ip=t)}catch{}return e}function Nn(){let e=w.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}var ye=new Map;function Rn(e){let t=(ye.get(e)??0)+1;return ye.set(e,t),t}function $n(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:On(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:Rn(r),ts:Date.now(),kind:"spawn",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},spawn:{childAgentId:n.childAgentId,childName:n.childName,kind:n.kind,...n.model?{model:n.model}:{},...n.task?{prompt:n.task}:{}}})}import{z as f}from"zod";import{createHash as Dn}from"crypto";import{createHash as ur}from"crypto";var Ie=new Map;function Ee(e){return e.map(t=>t.trim()).filter(t=>t.length>0&&t!=="true")}function K(e){let t=Dn("sha256").update(e).digest("hex"),n=Ie.get(t);if(n)return n;let r=new Map,i=[],a=e.split(`
-`).map(l=>Mn(l)).filter(l=>l.trim().length>0),o=0;for(;o<a.length;){let l=a[o].trim();if(l.startsWith("package ")||l.startsWith("import ")){o++;continue}let c=l.match(/^default\s+(\w+)\s*:?=\s*(.+)$/);if(c){let m=c[1],h=c[2].trim();r.set(m,N(h)),o++;continue}let u=l.match(/^(\w+)\s*:?=\s*(.+?)(?:\s+if)?\s*\{(.*)$/);if(u){let m=u[1],h=u[2].trim(),g=u[3].trim(),_=[];if(g&&g!=="}"){let C=g.endsWith("}")?g.slice(0,-1).trim():g;C&&_.push(C),g.endsWith("}")||(o++,o=P(a,o,_))}else g==="}"||(o++,o=P(a,o,_));let b=Ce(_);i.push({variable:m,value:N(h),conditions:b,rawConditions:Ee(_)}),o++;continue}let d=l.match(/^(\w+)(?:\s+if)?\s*\{(.*)$/);if(d){let m=d[1],h=d[2].trim(),g=[];if(h&&h!=="}"){let b=h.endsWith("}")?h.slice(0,-1).trim():h;b&&g.push(b),h.endsWith("}")||(o++,o=P(a,o,g))}else h==="}"||(o++,o=P(a,o,g));let _=Ce(g);i.push({variable:m,value:"true",conditions:_,rawConditions:Ee(g)}),o++;continue}o++}let s={defaults:r,rules:i};return Ie.set(t,s),s}function Mn(e){let t=!1,n="";for(let r=0;r<e.length;r++){let i=e[r];if(t)i===n&&e[r-1]!=="\\"&&(t=!1);else if(i==='"'||i==="'")t=!0,n=i;else if(i==="#")return e.slice(0,r)}return e}function P(e,t,n){let r=1,i=t;for(;i<e.length&&r>0;){let a=e[i].trim();for(let o of a)o==="{"&&r++,o==="}"&&r--;if(r>0)n.push(a),i++;else{let o=a.slice(0,a.lastIndexOf("}")).trim();return o&&n.push(o),i}}return i}function N(e){return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function Pn(e){return e.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}function Ce(e){let t=[];for(let n of e){let r=n.split(";").map(i=>i.trim()).filter(i=>i.length>0);for(let i of r){let a=zn(i);a&&t.push(a)}}return t}var Z=/"(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false/,Ln=new RegExp(`^(${Z.source})\\s+in\\s+((?:input|data)[^\\s]*)$`),Fn=new RegExp(`^(${Z.source})\\s*==\\s*((?:input|data)\\S*)$`),jn=/^([^\s=!]+)\s*==\s*(.+)$/,Bn=/^([^\s=!]+)\s*!=\s*(.+)$/,uo=new RegExp(`^(?:${Z.source})$`);var Un=/^regex\.match\(\s*("(?:[^"\\]|\\.)*")\s*,\s*((?:input|data)[^\s)]*)\s*\)$/;function zn(e){let t=!1,n=e.trim();if(n.startsWith("not ")&&(t=!0,n=n.slice(4).trim()),n==="true"||n==="false")return{type:"literal_bool",negated:t,field:"",value:n==="true"};if(n.includes("[_]"))return{type:"truthy",negated:!1,field:F,value:e.trim()};let r=n.match(/^count\(([^)]+)\)\s*(>=|<=|>|<)\s*(\d+)$/);if(r)return{type:"count_gt",negated:t,field:r[1].trim(),operator:r[2],value:parseInt(r[3],10)};let i=n.match(/^startswith\(([^,]+),\s*"([^"]*)"\)$/);if(i)return{type:"startswith",negated:t,field:i[1].trim(),value:i[2]};let a=n.match(/^endswith\(([^,]+),\s*"([^"]*)"\)$/);if(a)return{type:"endswith",negated:t,field:a[1].trim(),value:a[2]};let o=n.match(/^contains\(([^,]+),\s*"([^"]*)"\)$/);if(o)return{type:"contains",negated:t,field:o[1].trim(),value:o[2]};let s=n.match(Un);if(s)return{type:"regex_match",negated:t,field:s[2].trim(),value:Pn(s[1])};let l=n.match(Ln);if(l)return{type:"array_includes",negated:t,field:l[2].trim(),value:De(l[1])};let c=n.match(/^([^\s]+)\s+in\s+(\[.*\])$/);if(c){let _=Wn(c[2]);if(_!==null)return{type:"in_set",negated:t,field:c[1].trim(),values:_}}let u=n.match(/^([^\s=!<>]+)\s*(>=|<=|>|<)\s*(-?\d+(?:\.\d+)?)$/);if(u)return{type:"comparison",negated:t,field:u[1].trim(),operator:u[2],value:parseFloat(u[3])};let d=n.match(Fn);if(d)return{type:"equality",negated:t,field:d[2].trim(),value:N(d[1].trim())};let m=n.match(jn);if(m)return{type:"equality",negated:t,field:m[1].trim(),value:N(m[2].trim())};let h=n.match(Bn);if(h)return{type:"inequality",negated:t,field:h[1].trim(),value:N(h[2].trim())};let g=n.match(/^(input(?:\.[a-zA-Z0-9_]+|\["[^"]+"\]|\['[^']+'\])+)$/);return g?{type:"truthy",negated:t,field:g[1].trim()}:{type:"truthy",negated:!1,field:F,value:e.trim()}}var F="__unrecognized_condition_forces_deny__";var qn=/[A-Za-z_][A-Za-z0-9_.]*\s*\(/;function $e(e){let t=[];for(let n of e.rules)for(let r of n.conditions)typeof r.field=="string"&&r.field!==F&&qn.test(r.field)&&t.push(r.field);return t}var Vn=["input.normalized.","input.normalized["];function Gn(e){let t=new Set;for(let n of e.rules)for(let r of n.conditions){let{field:i}=r;typeof i!="string"||i===F||Vn.some(a=>i.startsWith(a))&&t.add(i)}return[...t].sort()}function De(e){let t=e.trim();return t==="true"?!0:t==="false"?!1:/^-?\d+(?:\.\d+)?$/.test(t)?parseFloat(t):t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'")?t.slice(1,-1):t}function Wn(e){let t=e.trim().replace(/^\[/,"").replace(/\]$/,"").trim();if(t.length===0)return[];let n=[],r="",i=!1,a="";for(let s=0;s<t.length;s++){let l=t[s];i?(r+=l,l===a&&t[s-1]!=="\\"&&(i=!1)):l==='"'||l==="'"?(r+=l,i=!0,a=l):l===","?(n.push(r.trim()),r=""):r+=l}if(i)return null;r.trim().length>0&&n.push(r.trim());let o=[];for(let s of n){let l=s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2,c=/^-?\d+(?:\.\d+)?$/.test(s);if(!l&&!c&&!(s==="true"||s==="false"))return null;o.push(De(s))}return o}var po=new RegExp("^\\p{White_Space}*$","u");var Hn=["tier1","tier2","tier3"];function Me(e){return typeof e=="string"&&Hn.includes(e)}var Kn=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],Zn=["internal","customer_facing","experimental","third_party"],Pe=[...Kn,...Zn];function Yn(e){return typeof e=="string"&&Pe.includes(e)}function Le(e){let t=new Set;for(let n of e)Yn(n)&&t.add(n);return Pe.filter(n=>t.has(n))}var Fe=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"],Jn=["version_control","payments","crm","communication","cloud_infra","identity","data_warehouse","ticketing","hr","finance_erp","storage","database","other"],Qn=["production","staging","development","test"],Xn=["security","engineering","finance","legal","compliance","hr","sales","marketing","support","operations","executive"];function er(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var Te={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function tr(e){let t=er(e);return t===null?"other":Te[t]??Te[t.replace(/_/g,"")]??"other"}function je(e,t){let n={...e};if(t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=tr(t.targetApp)),n.context=r}return n}var xe=["pii","phi","pci","financial","biometric","genetic","location","communications","children","credentials","special_category_gdpr"],nr=["read","write","delete","share","export","decide","execute"],Ne=["none","low","medium","high","critical"],rr=["public","internal","confidential","restricted","credentials","api_key","private_key","password","secret","token","pan","full_pan","card_number","track_data","cvv","cvc","ssn","tax_id","national_id","passport","drivers_license","identity_document","document_number","kyc_document","bank_account","account_number","routing_number","iban","account_balance","customer_financial","credit_score","net_worth","income","financial_profile","employee_pii","payroll","compensation","material_nonpublic","pre_release_earnings","mnpi","attorney_client","legal_hold","privileged","special_category_gdpr","gdpr_special_category","biometric","ethnicity","political_opinion","health_special","religion"],ir={action_class:Fe,operation:nr,"context/app_category":Jn,"context/environment":Qn,"context/actor_function":Xn,"read/classification":rr,"read/data_categories":xe,"read/data_sensitivity":Ne,"write/data_categories":xe,"write/data_sensitivity":Ne};function Be(e){if(e===null||typeof e!="object")return[];let t=e,n=new Set,r=(i,a,o)=>{let s=Array.isArray(a)?a:[a];for(let l of s)typeof l!="string"||l.length===0||o.includes(l)||n.add(`${i}=${l}`)};for(let[i,a]of Object.entries(ir)){Object.prototype.hasOwnProperty.call(t,i)&&r(i,t[i],a);let o=i.indexOf("/");if(o===-1)continue;let s=t[i.slice(0,o)];if(s!==null&&typeof s=="object"&&!Array.isArray(s)){let l=i.slice(o+1),c=s;Object.prototype.hasOwnProperty.call(c,l)&&r(i,c[l],a)}}return[...n].sort()}var Oe=64,ar=64,O={retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function Ue(){return{retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var or=new Set(["deny","approval_required","escalate"]);function x(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let i of t)n.add(i);let r=[...n].sort();return r.length>Oe?r.slice(0,Oe):r}function Re(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function L(e){return typeof e=="string"&&e.length>0?e:null}function ze(e,t){let n=Re(t.data_categories),r=L(t.classification),i=Re(t.taint),a=L(t.action_class),o=a&&Fe.includes(a)?a:null,s=L(t.target_app),l=L(t.decision),c={...e.action_counts};if(o)if(o in c)c[o]=(c[o]??0)+1;else if(Object.keys(c).length<ar)c[o]=1;else{let u=Object.keys(c).sort(),d=u[u.length-1];d!==void 0&&o<d&&(delete c[d],c[o]=1)}return{retrieved_data_categories:x(e.retrieved_data_categories,n),retrieved_classifications:x(e.retrieved_classifications,r?[r]:[]),taint:x(e.taint,i),action_classes:x(e.action_classes,o?[o]:[]),action_counts:c,denied_count:e.denied_count+(l==="deny"?1:0),inhibited_count:e.inhibited_count+(l&&or.has(l)?1:0),event_count:e.event_count+1,target_apps:x(e.target_apps,s?[s]:[])}}var qe="generic",Ve=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:qe,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],sr=Ve.map(e=>e.id),fo=new Map(Ve.map(e=>[e.id,e])),mo=new Set(sr);function Ge(e){return Array.isArray(e)&&e.length>0?[...e]:[qe]}var lr=/^[a-z][a-z0-9_]*$/;function We(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&lr.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var cr=["narrow","moderate","broad","unbounded","unknown"];function He(e){return typeof e=="string"&&cr.includes(e)}function Ke(e){return e==="open"||e==="closed"?e:null}var dr=["tool_name","function","name","action"];function j(e,t,n){if(Array.isArray(e)){if(e.length===0){n.push([`${t}[]`,void 0]);return}for(let r of e)j(r,`${t}[]`,n);return}if(e!==null&&typeof e=="object"){let r=Object.entries(e);if(r.length===0){t&&n.push([t,void 0]);return}for(let[i,a]of r)j(a,t?`${t}.${i}`:i,n);return}t&&n.push([t,e])}function pr(e){let t=[];return j(e,"",t),[...new Set(t.map(([n])=>n))].sort()}function fr(e){let t=e.slice(e.lastIndexOf(".")+1);return t.endsWith("[]")?t.slice(0,-2):t}function mr(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().toLowerCase();return t.length>0?t:null}function hr(e,t={}){if(t.discriminatorField===null)return null;let n=[];j(e,"",n);let r=t.discriminatorField?[t.discriminatorField]:t.discriminatorFields??dr;for(let i of r){let a=null;for(let[o,s]of n){if(fr(o)!==i)continue;let l=mr(s);l!==null&&(a===null||o<a.path)&&(a={path:o,value:l})}if(a)return a.value}return null}function Ze(e,t={}){let n=ur("sha256").update(pr(e).join(",")).digest("hex").slice(0,16),r=hr(e,t);return r!==null?`${n}:${r}`:n}var gr=["action","retrieval","delegation"];function _r(e){return typeof e=="string"&&gr.includes(e)}var yr=new Set(["rules"]);function Ye(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!yr.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(_r):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}function Je(e){let t={retrieval:new Set,action:new Set,delegation:new Set};for(let n of e){if(!n.enabled||n.bypassActive)continue;let r=n.regoSource;if(typeof r!="string"||r.length===0)continue;let i;try{i=K(r)}catch{continue}let a=Gn(i);if(a.length!==0)for(let o of n.appliesTo){let s=t[o];if(s)for(let l of a)s.add(`${n.id}: ${l}`)}}return{retrieval:[...t.retrieval].sort(),action:[...t.action].sort(),delegation:[...t.delegation].sort()}}import{z as q}from"zod";var br=/[^\u0000-\u007F]/,ht=new RegExp("^\\p{Nd}$","u"),vr=new RegExp("^\\p{Pd}$","u"),wr=/^[\p{Zs}\p{Zl}\p{Zp}]$/u,Ar=/^[\p{Default_Ignorable_Code_Point}\p{Cf}]$/u,kr=new Map([[8722,"-"],[8259,"-"],[8231,"-"]]),gt="<invisible>",Qe=new Map;function Sr(e){let t=String.fromCodePoint(e).normalize("NFKC");if(t.length===1&&t>="0"&&t<="9")return t;let n=e;for(let i=0;i<256&&n>0&&ht.test(String.fromCodePoint(n-1));i++)n--;let r=(e-n)%10;return String.fromCharCode(48+r)}function Ir(e){if(e<128)return null;let t=Qe.get(e);if(t!==void 0)return t;let n=(()=>{if(e>=65281&&e<=65374)return String.fromCharCode(e-65248);let r=String.fromCodePoint(e);return ht.test(r)?Sr(e):vr.test(r)||kr.has(e)?"-":wr.test(r)?" ":Ar.test(r)?gt:null})();return Qe.set(e,n),n}function ee(e){if(typeof e!="string"||e.length===0||!br.test(e))return[];let t=Xe(e,"as-separator");if(t===null)return[];let n=Xe(e,"as-nothing");return n===null||n.text===t.text?[t]:[t,n]}function Xe(e,t){let n=[],r=[],i=!1;for(let a=0;a<e.length;){let o=e.codePointAt(a),s=o>65535?2:1,l=Ir(o);if(l===null){for(let c=0;c<s;c++)n.push(e[a+c]),r.push(a+c);a+=s;continue}if(i=!0,l===gt){t==="as-separator"&&(n.push(" "),r.push(a)),a+=s;continue}n.push(l),r.push(a),a+=s}return i?(r.push(e.length),{label:t,text:n.join(""),offsets:Int32Array.from(r)}):null}function Er(e,t){return{start:e.offsets[t.start],end:e.offsets[t.end]}}function Cr(e){if(e.length<=1)return[...e];let t=[...e].sort((i,a)=>i.start-a.start||i.end-a.end),n=[],r={start:t[0].start,end:t[0].end};for(let i=1;i<t.length;i++){let a=t[i];a.start<=r.end?a.end>r.end&&(r={start:r.start,end:a.end}):(n.push(r),r={start:a.start,end:a.end})}return n.push(r),n}function et(e,t){let n=[];e.lastIndex=0;let r;for(;(r=e.exec(t))!==null;){if(r[0].length===0){e.lastIndex++;continue}n.push({start:r.index,end:r.index+r[0].length})}return n}var _t="[REDACTED]",te=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"in_pan_tax",re:/\b[A-Z]{3}[ABCFGHJLPTE][A-Z]\d{4}[A-Z]\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"date_of_birth",re:/\b(?:\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])|(?:0[1-9]|[12]\d|3[01])[/.](?:0[1-9]|1[0-2])[/.]\d{4}|(?:0[1-9]|1[0-2])\/(?:0[1-9]|[12]\d|3[01])\/\d{4})\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}],_o=te.map(({name:e,re:t})=>({name:e,source:t.source})),Tr="(?:(?<![A-Za-z0-9])(?=[A-Za-z0-9])|(?<=[A-Za-z0-9])(?![A-Za-z0-9]))";function xr(e){return yt(e,Tr)}function yt(e,t){let n="",r=!1;for(let i=0;i<e.length;i++){let a=e[i];if(a==="\\"){if(!r&&e[i+1]==="b"){n+=t,i++;continue}n+=a+(e[i+1]??""),i++;continue}a==="["?r=!0:a==="]"&&(r=!1),n+=a}return n}function bt(e){return new RegExp(xr(e.source),e.flags)}var Nr="(?:\\b|_)";function J(e){return yt(e,Nr)}var Or=/^\(\?<!\[((?:[^\]\\]|\\.)*)\]\)/;function Rr(e){let t=Or.exec(e);return t?`(?:^|[^${t[1]}])${e.slice(t[0].length)}`:e}function Q(e){if(!/^\d+$/.test(e))return!1;let t=0,n=!1;for(let r=e.length-1;r>=0;r--){let i=e.charCodeAt(r)-48;n&&(i*=2,i>9&&(i-=9)),t+=i,n=!n}return t%10===0}function $r(e){let t=e.replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let i=0;i<n.length;i++){let a=n[i],o=a>="A"&&a<="Z"?String(a.charCodeAt(0)-55):a;for(let s=0;s<o.length;s++)r=(r*10+(o.charCodeAt(s)-48))%97}return r===1}function Dr(e){if(!/^\d{9}$/.test(e))return!1;let t=[3,7,1,3,7,1,3,7,1],n=0;for(let r=0;r<9;r++)n+=(e.charCodeAt(r)-48)*t[r];return n%10===0}var Mr=[[0,1,2,3,4,5,6,7,8,9],[1,2,3,4,0,6,7,8,9,5],[2,3,4,0,1,7,8,9,5,6],[3,4,0,1,2,8,9,5,6,7],[4,0,1,2,3,9,5,6,7,8],[5,9,8,7,6,0,4,3,2,1],[6,5,9,8,7,1,0,4,3,2],[7,6,5,9,8,2,1,0,4,3],[8,7,6,5,9,3,2,1,0,4],[9,8,7,6,5,4,3,2,1,0]],Pr=[[0,1,2,3,4,5,6,7,8,9],[1,5,7,6,2,8,3,0,9,4],[5,8,0,3,7,9,6,1,4,2],[8,9,1,6,0,4,3,5,2,7],[9,4,5,3,1,2,6,8,7,0],[4,2,8,6,5,7,3,9,0,1],[2,7,9,3,8,0,6,4,1,5],[7,0,4,6,9,1,3,2,5,8]];function Lr(e){if(!/^\d+$/.test(e))return!1;let t=0,n=e.split("").reverse();for(let r=0;r<n.length;r++)t=Mr[t][Pr[r%8][n[r].charCodeAt(0)-48]];return t===0}function Fr(e){if(!/^\d{11}$/.test(e)||/^(\d)\1{10}$/.test(e))return!1;let t=n=>{let r=0;for(let a=0;a<n;a++)r+=(e.charCodeAt(a)-48)*(n+1-a);let i=r*10%11;return i===10?0:i};return t(9)===e.charCodeAt(9)-48&&t(10)===e.charCodeAt(10)-48}function jr(e){if(!/^\d{10}$/.test(e))return!1;let t=0;for(let i=0;i<9;i++)t+=(e.charCodeAt(i)-48)*(10-i);let n=11-t%11,r=n===11?0:n;return r!==10&&r===e.charCodeAt(9)-48}var Br=[1,4,3,7,5,8,6,9,10];function Ur(e){if(!/^\d{8,9}$/.test(e))return!1;let t=0;for(let n=0;n<e.length;n++)t+=(e.charCodeAt(n)-48)*Br[n];return t%11===0}var zr="TRWAGMYFPDXBNJZSQVHLCKE";function qr(e){let t=e.replace(/[\s.-]/g,"").toUpperCase(),n=/^([XYZ]?)(\d{7,8})([A-Z])$/.exec(t);if(!n)return!1;let[,r,i,a]=n;if(r===""&&i.length!==8||r!==""&&i.length!==7)return!1;let o=r===""?i:String("XYZ".indexOf(r))+i;return zr[Number(o)%23]===a}var Vr=new Set(["BG","GB","NK","KN","TN","NT","ZZ"]);function Gr(e){let t=e.replace(/[\s-]/g,"").toUpperCase();return/^[ABCEGHJ-PRSTW-Z][ABCEGHJ-NPRSTW-Z]\d{6}[A-D]$/.test(t)?!Vr.has(t.slice(0,2)):!1}var ne=[{name:"pan",re:/\d(?:[ -]?\d){12,18}/g,normalize:e=>e.replace(/[ -]/g,""),validate:e=>e.length>=13&&e.length<=19&&Q(e)},{name:"iban",re:/\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){10,30}\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:$r},{name:"aba_routing",re:/\b\d{9}\b/g,normalize:e=>e,validate:Dr},{name:"uk_nino",re:/\b[A-Za-z]{2} ?\d{2} ?\d{2} ?\d{2} ?[A-Da-d]\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:(e,t)=>t!==void 0&&t===t.toLowerCase()?!1:Gr(e)},{name:"in_aadhaar",re:/\b[2-9]\d{3}[ -]?\d{4}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===12&&Lr(e)},{name:"br_cpf",re:/\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,normalize:e=>e.replace(/[.-]/g,""),validate:Fr},{name:"es_dni_nie",re:/\b(?:[XYZxyz]-?)?(?:\d{7,8}|\d{1,2}[. ]\d{3}[. ]\d{3})[ -]?[A-Za-z]\b/g,normalize:e=>e.replace(/[\s.-]/g,"").toUpperCase(),validate:qr},{name:"ca_sin",re:/\b\d{3}[ -]?\d{3}[ -]?\d{3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===9&&Q(e)},{name:"uk_nhs_number",re:/\b\d{3}[ -]?\d{3}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:jr},{name:"au_tfn",re:/\b\d{3}[ -]?\d{3}[ -]?\d{2,3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Ur}],Wr=Object.fromEntries([...te,...ne].map(e=>[e.name,e.re.source])),y=Wr,yo=ne.map(e=>e.name),vt=te.map(({name:e,re:t})=>({name:e,re:bt(t)})),wt=ne.map(e=>({...e,re:bt(e.re)})),bo=[...vt,...wt].map(({name:e,re:t})=>({name:String(e),source:t.source})),re=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","uk_nino","in_aadhaar","in_pan_tax","br_cpf","es_dni_nie","ca_sin","uk_nhs_number","au_tfn","email","us_phone","date_of_birth","ipv4","mac_address"],Hr={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
-MIIEv\u2026
------END PRIVATE KEY-----`,template:{pattern:y.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:y.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:y.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:y.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:y.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:y.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:y.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:y.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:y.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:y.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS). Collision rate: MEASURED 9.8% of benign 16-digit runs \u2014 Luhn leaves ~1 in 10. Default-ON because PCI-DSS makes masking mandatory; note in_aadhaar sits at the same rate and is often proposed for removal on that basis.",category:"financial",example:"4242 4242 4242 4242",template:{pattern:y.pan,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY 13-19 digit run (grouped or not) \u2014 the floor's regex without the checksum that makes it precise. ~9 in 10 of those are not card numbers.",examples:["4242 4242 4242 4243","4242424242424241"],measuredOverMaskRate:.531}},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible. Collision rate: MEASURED 1.0% \u2014 mod-97 leaves ~1 in 97, the most precise detector on this floor alongside br_cpf.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:y.iban,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run mod-97, so the rule masks EVERY IBAN-SHAPED token (2 letters, 2 digits, 10-30 alphanumerics) \u2014 and mod-97 is what makes this the most precise detector on the floor, so almost all of those are not IBANs.",examples:["DE89 3704 0044 0532 0130 01","GB00 NWBK 6016 1331 9268 19"],measuredOverMaskRate:.934}},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:y.aba_routing,mode:"full",templateOnly:{reason:"A rego rule cannot run the weighted 3-7-1 mod-10, so the rule masks EVERY bare 9-digit run \u2014 which is why this detector is default-OFF on the floor and why its rule form is broader still.",examples:["021000022","123456789"],measuredOverMaskRate:.899}},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX). Collision rate: MEASURED 100% \u2014 no checksum, so every 2-then-7 dashed digit run matches. Same trade as ssn: the punctuated shape is rare in benign traffic, not precise.",category:"financial",example:"12-3456789",template:{pattern:y.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:y.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789). Collision rate: MEASURED 100% \u2014 there is NO checksum, so every dashed 3-2-4 digit run matches. Default-ON regardless, because that punctuated shape is essentially absent from benign agent traffic; if your traffic carries 3-2-4 dashed reference codes, opt out.",category:"pii",example:"123-45-6789",template:{pattern:y.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},uk_nino:{id:"uk_nino",label:"UK National Insurance numbers",description:"UK NINOs (e.g. AB 12 34 56 C). DEFAULT-OFF \u2014 NO CHECKSUM. Precision comes only from the issued alphabet and the never-issued administrative prefixes (BG, GB, NK, KN, TN, NT, ZZ), so roughly half of tokens already shaped 2-letters/6-digits/[A-D] validate. All-lowercase candidates are rejected (git short SHAs), but that does NOT exclude uppercase business identifiers \u2014 serial, part, batch, PO, coupon and asset tags share the shape exactly and were measured being masked. Opt in when UK NINOs are expected in your traffic.",category:"pii",example:"AB 12 34 56 C",template:{pattern:"\\b(?:[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-D])\\b",mode:"full",templateOnly:{reason:"uk_nino has no checksum, but the floor still rejects the seven NEVER-ISSUED administrative prefixes (BG GB NK KN TN NT ZZ). A rego rule cannot express that exclusion without enumerating hundreds of letter pairs (RE2 has no lookahead), so the rule masks those too.",examples:["NK 12 34 56 A","ZZ 12 34 56 C"],measuredOverMaskRate:.019}},defaultEnabled:!1},in_aadhaar:{id:"in_aadhaar",label:"Aadhaar numbers (India)",description:"12-digit UIDAI Aadhaar numbers, Verhoeff-checksum validated and constrained to the issued 2-9 leading digit. Keeps the last 4 visible. Collision rate: MEASURED 10.0% of benign 12-digit ids starting 2-9 (order/transaction numbers) \u2014 Verhoeff leaves ~1 in 10. Comparable to the long-shipped pan (10.0%) and well behind iban (1.0%); it stays default-ON because the two US identifiers this floor has always shipped, ssn and us_ein, collide at 100%.",category:"pii",example:"2345 6789 0124",template:{pattern:"\\b[2-9]\\d{3}(?:[ -]\\d{4}[ -]?\\d{4}|\\d{4}[ -]\\d{4})\\b",mode:"partial",keepLast:4,floorOnly:{reason:"The floor accepts the entirely UNPUNCTUATED 12-digit form because Verhoeff gates it (~1 in 10 survive). A rego rule cannot run Verhoeff, so a bare \\d{12} in a rule would mask every 12-digit order id and E.164 Indian mobile number in the tenant. The rule requires at least one printed separator \u2014 every half-punctuated form is covered; only the bare digit run stays floor-only.",examples:["234567890124","id=234567890124"]},templateOnly:{reason:"A rego rule cannot run the Verhoeff checksum, so the rule masks EVERY 4-4-4 grouping that starts 2-9 \u2014 including the ~9 in 10 that are not Aadhaar numbers at all.",examples:["2345 6789 0125","2345-6789-0123"],measuredOverMaskRate:.903}},defaultEnabled:!0},in_pan_tax:{id:"in_pan_tax",label:"India PAN (tax ID)",description:"India Permanent Account Number \u2014 the income-tax id (ABCPE1234F), NOT a payment-card PAN. NO CHECKSUM: the only discriminator is the holder-type letter in position 4, which removes just 15 of 26 possibilities in one position, so roughly 4 in 10 uniform 5-letter/4-digit/1-letter tokens validate. DEFAULT-OFF for that reason \u2014 an uppercase SKU or part number of the same shape is masked, and nothing in the value distinguishes it.",category:"financial",example:"ABCPE1234F",template:{pattern:y.in_pan_tax,mode:"full"},defaultEnabled:!1},br_cpf:{id:"br_cpf",label:"CPF numbers (Brazil)",description:"Brazilian CPF, closed by TWO independent mod-11 check digits. Collision rate: MEASURED 1.0% of benign 11-digit runs (~1-in-100) \u2014 the most precise detector on this floor, alongside iban. Repdigits are rejected. Keeps the last 2 visible.",category:"pii",example:"123.456.789-09",template:{pattern:"\\b\\d{3}(?:\\.\\d{3}\\.?\\d{3}-?\\d{2}|\\d{3}(?:\\.\\d{3}-?\\d{2}|\\d{3}-\\d{2}))\\b",mode:"partial",keepLast:2,floorOnly:{reason:"The floor accepts the entirely bare 11-digit form because TWO mod-11 check digits gate it (~1 in 100 survive). A rego rule cannot run mod-11, so a bare \\d{11} in a rule would mask every 11-digit identifier in the tenant. The rule requires at least one printed separator; the bare form stays floor-only.",examples:["11144477735","ref 11144477735","12345678909"]},templateOnly:{reason:"A rego rule cannot run the two mod-11 check digits, so the rule masks EVERY punctuated 3-3-3-2 digit grouping \u2014 including the ~99 in 100 that are not CPFs.",examples:["123.456.789-10","111.444.777-34"],measuredOverMaskRate:.995}},defaultEnabled:!0},es_dni_nie:{id:"es_dni_nie",label:"DNI / NIE numbers (Spain)",description:"Spanish national ID (8 digits + letter) and foreigner ID (X/Y/Z + 7 digits + letter), validated by the mod-23 check letter. Collision rate: MEASURED 4.0% of benign 8-digit-plus-letter tokens (invoice/order numbers with a suffix letter) \u2014 mod-23 leaves ~1 in 23. More precise than in_aadhaar (10.0%) and pan (10.0%); behind br_cpf (1.0%) and iban (1.0%).",category:"pii",example:"12345678Z",template:{pattern:y.es_dni_nie,mode:"full",templateOnly:{reason:"A rego rule cannot run the mod-23 check letter, so the rule masks EVERY 7-8 digit run followed by a letter \u2014 invoice and order numbers with a suffix letter included. mod-23 admits ~1 in 23; the rule admits all of them. Re-measured 0.973 \u2192 0.981 when the floor learned the printed forms (dotted DNI, hyphenated NIE): the rule now also matches those written forms, and ~22 in 23 of them are not DNI/NIEs. The FLOOR's own rate is unchanged \u2014 mod-23, not punctuation, gates it.",examples:["12345678A","X1234567H"],measuredOverMaskRate:.976}},defaultEnabled:!0},ca_sin:{id:"ca_sin",label:"SIN numbers (Canada)",description:"Canadian Social Insurance Numbers (9-digit, Luhn-validated). DEFAULT-OFF \u2014 identical shape to an ABA routing number and to any 9-digit id, with only a mod-10 pass to separate them.",category:"pii",example:"046 454 286",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{3}|\\d{3}[- ]\\d{3})\\b",mode:"partial",keepLast:3,floorOnly:{reason:"The floor accepts the entirely bare 9-digit form because Luhn gates it. A rego rule cannot run Luhn, and a bare \\d{9} in a rule is also every ABA routing number and every 9-digit identifier, so the rule requires at least one printed separator in the 3-3-3 grouping.",examples:["046454286"]},templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY printed 3-3-3 digit grouping \u2014 including the ~9 in 10 that are not SINs.",examples:["046 454 287","123 456 789"],measuredOverMaskRate:.914}},defaultEnabled:!1},uk_nhs_number:{id:"uk_nhs_number",label:"NHS numbers (UK)",description:"UK NHS patient numbers (10-digit, weighted mod-11). DEFAULT-OFF \u2014 a 10-digit run is also every North American phone number.",category:"pii",example:"943 476 5919",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{4}|\\d{3}[- ]\\d{4})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 10-digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{10} in a rule is also every North American phone number, so the rule requires at least one printed separator in the 3-3-4 grouping.",examples:["9434765919"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-4 digit grouping \u2014 every North American phone number included \u2014 not just the ~1 in 10 that are NHS numbers.",examples:["943 476 5910","123 456 7890"],measuredOverMaskRate:.899}},defaultEnabled:!1},au_tfn:{id:"au_tfn",label:"Tax File Numbers (Australia)",description:"Australian TFNs (8-9 digit, weighted mod-11). DEFAULT-OFF \u2014 collides with essentially every 8-9 digit identifier.",category:"financial",example:"123 456 782",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{2,3}|\\d{3}[- ]\\d{2,3})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 8-9 digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{8,9} in a rule collides with essentially every identifier of that length, so the rule requires at least one printed separator. BOTH lengths are in the gap: a TFN may be 8 digits (`12345679`) or 9 (`123456782`), and the 8-digit branch went undeclared while the parity sweep derived its population from the 9-digit example alone.",examples:["12345679","123456782"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-2/3-3-3 digit grouping \u2014 including the ~9 in 10 that are not TFNs.",examples:["123 456 783","123 456 78"],measuredOverMaskRate:.912}},defaultEnabled:!1},date_of_birth:{id:"date_of_birth",label:"Dates of birth",description:"Dates in the common written formats. DEFAULT-OFF and heavily over-masking by nature \u2014 a DOB is indistinguishable from any other date (created_at, invoice, release). Offered because DOB is a GDPR/HIPAA identifier some regulated tenants must mask regardless.",category:"pii",example:"1985-04-12",template:{pattern:y.date_of_birth,mode:"full"},defaultEnabled:!1},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept). Collision rate: MEASURED 100% of well-formed addresses \u2014 that is BY DESIGN, not a defect: an email address is structurally unambiguous, so matching every one is correct rather than over-matching.",category:"pii",example:"alice@acme.com",template:{pattern:y.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:y.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:y.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:y.mac_address,mode:"full"},defaultEnabled:!1}},ie=Object.freeze(Object.fromEntries(re.map(e=>{let t=Hr[e];return[e,{...t,template:{...t.template,pattern:Rr(J(t.template.pattern))}}]})));var vo=new Set(re.filter(e=>!ie[e].defaultEnabled));function Kr(e,t){let n=new Set;for(let r of re)(ie[r].defaultEnabled?!e?.has(r):t?.has(r))||n.add(r);return n}function B(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=ae(t),a=e;for(let{name:o,re:s}of vt){let l=o;n.has(l)||(a=a.replace(s,c=>(r?.(l),i(c))))}for(let{name:o,re:s,normalize:l,validate:c}of wt)n.has(o)||(a=ai(a,s,l,c,t,o,r));return a}function ae(e){return typeof e=="function"?e:()=>e}var tt=e=>"\0".repeat(e.length);function Zr(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=ee(e);if(i.length===0)return B(e,t,n,r);let a=new Set,o=m=>{a.add(m)},s=B(e,tt,n,o),l=!0,c=new Array(e.length).fill(!1);for(let m=0;m<e.length;m++)c[m]=s[m]==="\0"&&e[m]!=="\0";for(let m of i){let h=B(m.text,tt,n,o);for(let g=0;g<m.text.length;g++)if(!(h[g]!=="\0"||m.text[g]==="\0"))for(let _=m.offsets[g];_<m.offsets[g+1];_++)c[_]||(c[_]=!0,l=!1)}if(l)return B(e,t,n,r);for(let m of a)r?.(m);let u="",d=0;for(;d<e.length;){if(!c[d]){u+=e[d],d++;continue}let m=d;for(;d<e.length&&c[d];)d++;u+=ae(t)(e.slice(m,d))}return u}function $(e){return e===void 0||!/[A-Za-z0-9]/.test(e)}var nt=new Map;function Yr(e){let t=nt.get(e.source);return t===void 0&&(t=new RegExp(`^(?:${e.source})$`),nt.set(e.source,t)),t}var Jr=4096,Qr=64,rt=null;function Xr(e){return rt!==null?rt:Jr+e.length*Qr}var At=!1,v={spanCalls:0,spanMisses:0,cutCalls:0,cutMisses:0,budgetExhausted:0,maxMissesInAPass:0},kt={spanBudget:0,depthCap:0};function ei(e){return{stride:e.length+1,chosen:new Map,cuts:new Map,budget:Xr(e),exhausted:!1}}function St(e,t,n,r,i,a,o){v.spanCalls++;let s=t*o.stride+n.length,l=At?void 0:o.chosen.get(s);if(l!==void 0)return l;if(o.budget<=0)return o.exhausted=!0,null;o.budget--,v.spanMisses++;let c=ti(e,t,n,r,i,a,o);return o.chosen.set(s,c),c}function ti(e,t,n,r,i,a,o){let s=Yr(r),l=[];for(let u=n.length-1;u>=1;u--)if($(n[u])){let d=n.slice(0,u);s.test(d)&&l.push(d)}let c=$(e[t+n.length])?[n,...l]:[...l,n];for(let u of c)if(a(i(u),u)&&!ri(e,t,u,r,i,a,o))return u;return null}var it=new Map;function ni(e){let t=it.get(e.source);return t===void 0&&(t=new RegExp(e.source,"y"),it.set(e.source,t)),t}function ri(e,t,n,r,i,a,o){v.cutCalls++;let s=t*o.stride+n.length,l=At?void 0:o.cuts.get(s);if(l!==void 0)return l;if(o.budget<=0)return o.exhausted=!0,!0;o.budget--,v.cutMisses++;let c=ii(e,t,n,r,i,a,o);return o.cuts.set(s,c),c}function ii(e,t,n,r,i,a,o){let s=t+n.length,l=ni(r);for(let c=1;c<n.length;c++){if($(n[c])||!$(n[c-1]))continue;let u=t+c;l.lastIndex=u;let d=l.exec(e);if(d===null||d[0].length===0)continue;let m=St(e,u,d[0],r,i,a,o);if(m!==null&&u+m.length>s&&$(e[u+m.length]))return!0}return!1}function ai(e,t,n,r,i,a,o){let s=ae(i);t.lastIndex=0;let l="",c=0,u=ei(e),d=v.spanMisses+v.cutMisses,m;for(;(m=t.exec(e))!==null;){let h=m[0],g=m.index;if(h.length===0){t.lastIndex=g+1;continue}let _;try{_=St(e,g,h,t,n,r,u)}catch(b){if(b instanceof RangeError&&/call stack/i.test(b.message))u.exhausted=!0,_=null;else throw b}if(u.exhausted)return v.budgetExhausted++,kt.spanBudget++,at(d),l+e.slice(c,g)+s(e.slice(g));if(_!==null)o?.(a),l+=e.slice(c,g)+s(_),c=g+_.length,t.lastIndex=c;else{let b=h.slice(1).search(/[^A-Za-z0-9]/);t.lastIndex=b===-1?g+h.length:g+1+b+1}if(t.lastIndex>e.length)break}return at(d),l+e.slice(c)}function at(e){let t=v.spanMisses+v.cutMisses-e;t>v.maxMissesInAPass&&(v.maxMissesInAPass=t)}function It(e,t=_t,n,r){return si(e,t,Kr(n,r))}var oi=256;function si(e,t,n){let r=new Set,i=!n.has("pan"),a=s=>{r.add(s)},o=(s,l)=>{if(l>oi)return kt.depthCap++,t;if(typeof s=="string")return Zr(s,t,n,a);if(typeof s=="number"&&Number.isInteger(s)&&s>0){if(!i)return s;let c=String(s);return c.length>=13&&c.length<=19&&Q(c)?(r.add("pan"),t):s}if(Array.isArray(s))return s.map(c=>o(c,l+1));if(s!==null&&typeof s=="object"){let c=s,u={};for(let d of Object.keys(c))u[d]=o(c[d],l+1);return u}return s};return{value:o(e,0),detectors:[...r].sort()}}function Et(e,t=_t){return It(e,t).value}var li=/[\u00AD\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFEFF]/g,Ct=Object.freeze({\u0430:"a",\u0435:"e",\u043E:"o",\u0440:"p",\u0441:"c",\u0443:"y",\u0445:"x",\u0456:"i",\u0455:"s",\u043A:"k",\u043C:"m",\u0442:"t",\u043D:"h",\u0432:"b",\u0433:"r",\u03BF:"o",\u03B1:"a",\u03C1:"p",\u03B9:"i",\u03C4:"t",\u03B5:"e",\u03BA:"k",\u03BD:"v",\u03C5:"u",\u03B7:"n",\u0131:"i","\u04CF":"l",\u0578:"n"}),ci=new RegExp(`[${Object.keys(Ct).join("")}]`,"gu"),ui=Object.freeze({4:"a","@":"a",3:"e",1:"i","!":"i",0:"o",5:"s",$:"s",7:"t",9:"g","(":"c",8:"b"}),Tt="\u2801\u2803\u2809\u2819\u2811\u280B\u281B\u2813\u280A\u281A\u2805\u2807\u280D\u281D\u2815\u280F\u281F\u2817\u280E\u281E\u2825\u2827\u283A\u282D\u283D\u2835",di=Object.freeze(Object.fromEntries([...Tt].map((e,t)=>[e,String.fromCharCode(97+t)]))),pi=new RegExp(`[${Tt}\u2800]`,"g"),xt=/[⠀-⣿]/;function fi(e){let t="";for(let n of e){let r=n.codePointAt(0);r!==void 0&&(r>=917536&&r<=917630?t+=String.fromCodePoint(r-917504):r>=917504&&r<=917631||(t+=n))}return t}function mi(e){return e.replace(li,"")}function Nt(e){return e.replace(ci,t=>Ct[t]??t)}function hi(e){return e.replace(/[4@31!05$79(8]/g,t=>ui[t]??t)}function gi(e){return e.replace(/[a-zA-Z]/g,t=>{let n=t<="Z"?65:97;return String.fromCharCode((t.charCodeAt(0)-n+13)%26+n)})}function _i(e){return xt.test(e)?e.replace(pi,t=>t==="\u2800"?" ":di[t]??t):e}function ot(e){let t;try{t=fi(e)}catch{t=e}try{t=t.normalize("NFKC")}catch{}return t=mi(t),t=Nt(t),t}var yi=/^[A-Za-z0-9+/]{16,}={0,2}$/,bi=/^(?:[0-9a-fA-F]{2}\s*){8,}$/,st=/[A-Za-z0-9+/]{20,}={0,2}/g;function X(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);(r===9||r===10||r===13||r>=32&&r<=126||r>=160&&r!==65533)&&t++}return t/e.length}var Ot=new TextDecoder("utf-8",{fatal:!1});function Rt(e){let t;try{t=atob(e)}catch{return[]}let n=new Uint8Array(t.length);for(let i=0;i<t.length;i++)n[i]=t.charCodeAt(i)&255;let r=Ot.decode(n);return t===r?[t]:[r,t]}function vi(e){let t=e.replace(/\s+/g,"");if(t.length===0||t.length%2!==0)return[];let n=new Uint8Array(t.length/2);for(let a=0;a<n.length;a++){let o=Number.parseInt(t.slice(a*2,a*2+2),16);if(Number.isNaN(o))return[];n[a]=o}let r="";for(let a=0;a<n.length;a++)r+=String.fromCharCode(n[a]);let i=Ot.decode(n);return r===i?[r]:[i,r]}function lt(e){let t=e.trim(),n=[];if(bi.test(t))for(let r of vi(t))n.push({decoded:r,textiness:X(r)});if(yi.test(t)&&t.length%4===0)for(let r of Rt(t))n.push({decoded:r,textiness:X(r)});return n}function ct(e,t){let n=[],r;for(st.lastIndex=0;(r=st.exec(e))!==null&&n.length<t;){let i=r[0];if(i.length%4===0)for(let a of Rt(i))n.push({decoded:a,textiness:X(a)})}return n}var wi=Object.freeze({maxDepth:3,byteCap:262144,maxNodes:256,maxBlobsPerNode:8});function $t(e,t=wi){if(typeof e!="string"||e.length===0)return{views:[],anyDecoded:!1,truncated:!1,nodes:0,maxDepthSeen:0};let{maxDepth:n,byteCap:r,maxNodes:i,maxBlobsPerNode:a}=t,o=new Set,s=h=>{h.length>0&&h.length<=r&&o.add(h)},l=!1,c=!1,u=0,d=0,m=[{s:e,depth:0}];for(;m.length>0;){if(u>=i){c=!0;break}let h=m.pop();if(h===void 0)break;let{s:g,depth:_}=h;if(g.length>r){c=!0;continue}u++,_>d&&(d=_);let b=ot(g);s(b);let C=hi(b);if(C!==b&&s(C),s(gi(b)),xt.test(g)&&s(_i(b)),_>=n){let A=ot(g);(lt(A).length>0||ct(A,a).length>0)&&(c=!0);continue}let on=[...lt(b),...ct(b,a)];for(let A of on){if(l=!0,A.decoded.length>r){c=!0;continue}A.textiness>=.85&&A.decoded!==b?m.push({s:A.decoded,depth:_+1}):s(A.decoded)}}return{views:[...o],anyDecoded:l,truncated:c,nodes:u,maxDepthSeen:d}}var Dt=["hidden_text_carrier","injected_turn_boundary","mixed_script_token","nested_encoding_payload"],Ai=Object.freeze(["hidden_text_carrier","injected_turn_boundary","mixed_script_token"]),ki=8,Si=new Set([173,8203,8204,8205,8206,8207,8288,65279,8234,8235,8236,8237,8238,8294,8295,8296,8297]),ut=e=>e!==void 0&&(e>=65&&e<=90||e>=97&&e<=122);function Ii(e){let t=[...e].map(r=>r.codePointAt(0)),n=0;for(let r=0;r<t.length;r++){let i=t[r];if(i>=917504&&i<=917631||Si.has(i)&&ut(t[r-1])&&ut(t[r+1])&&(n++,n>=ki))return!0}return!1}var Ei=/^[ \t]*(?:system|assistant|developer|user)[ \t]*:/i;function Ci(e){let t=e.split(/\r?\n/),n=!1;for(let r of t){if(Ei.test(r)){if(n)return!0;continue}r.trim().length>0&&(n=!0)}return!1}var Ti=[{name:"latin",lo:65,hi:591},{name:"greek",lo:880,hi:1023},{name:"cyrillic",lo:1024,hi:1279}];function xi(e){for(let t of Ti)if(e>=t.lo&&e<=t.hi)return t.name;return null}function Ni(e){for(let t of e.split(/\s+/)){if(t.length<4)continue;let n=0,r=0,i=!0;for(let a of t){let o=xi(a.codePointAt(0));if(o===null){i=!1;break}o==="latin"?n++:Nt(a)!==a&&r++}if(i&&n>0&&r>0)return!0}return!1}var dt=Object.freeze({signals:[],contributes:!1});function Oi(e){if(typeof e!="string"||e.length===0)return{...dt,signals:[]};let t=new Set;try{Ii(e)&&t.add("hidden_text_carrier"),Ci(e)&&t.add("injected_turn_boundary"),Ni(e)&&t.add("mixed_script_token");let{anyDecoded:n,maxDepthSeen:r,truncated:i}=$t(e);n&&(r>=2||i)&&t.add("nested_encoding_payload")}catch{return{...dt,signals:[]}}return{signals:[...Dt.filter(n=>t.has(n))],contributes:Ai.some(n=>t.has(n))}}var z=[{name:"override_instructions",re:/\bignore (?:all |the )?(?:previous|above|prior) (?:instructions|prompts?)\b/i},{name:"disregard_instructions",re:/\bdisregard (?:the )?(?:above|previous|system)\b/i},{name:"role_tag",re:/<\/?(system|assistant|instructions|host_context)\b/i},{name:"privilege_override",re:/\b(grant|escalate|elevate) (admin|root|all|full) (access|privileges?)\b/i},{name:"tool_smuggle",re:/```[\s\S]*?(tool_call|function_call)/i}];function pt(e){return typeof e!="string"||e.length===0?[]:z.filter(({re:t})=>t.test(e)).map(({name:t})=>t)}function Ri(e){if(typeof e!="string"||e.length===0)return[];let t=new Set(pt(e)),{views:n}=$t(e);for(let r of n)for(let i of pt(r))t.add(i);return z.filter(r=>t.has(r.name)).map(r=>r.name)}function $i(e){let t=new Set,n=new Set,r=!1,i=a=>{if(a!=null){if(typeof a=="string"){for(let s of Ri(a))t.add(s);let o=Oi(a);for(let s of o.signals)n.add(s);o.contributes&&(r=!0);return}if(Array.isArray(a)){for(let o of a)i(o);return}if(typeof a=="object")for(let o of Object.values(a))i(o)}};return i(e),{matched:t.size>0||r,signatures:z.filter(a=>t.has(a.name)).map(a=>a.name),structural:Dt.filter(a=>n.has(a))}}function Di(e){return $i(e).matched}var wo=z.map(e=>e.name);var Mi=new Set(["untrusted","external","public","public_internet","external_third_party","web"]);var Pi="i:injection";function Mt(e){let t=new Set;if(e.content!==void 0&&e.content!==null){let{detectors:i}=It(e.content);for(let a of i){let o=ie[a]?.category;o&&t.add(`c:${o}`)}Di(e.content)&&t.add(Pi)}let n=e.resourceMetadata??{},r=n.source_trust;return(n.untrusted_source===!0||typeof r=="string"&&Mi.has(r.toLowerCase()))&&t.add("i:untrusted"),[...t].sort()}var Y="(?:system\\s+prompt|initial\\s+(?:instructions|prompt)|system\\s+(?:instructions|message)|hidden\\s+(?:instructions|prompt)|your\\s+(?:system\\s+prompt|initial\\s+instructions|instructions|prompt)|the\\s+prompt\\s+(?:above|you\\s+were\\s+given))",Ao=[{name:"reveal_prompt",re:new RegExp(`\\b(?:reveal|show|print|repeat|output|echo|display|expose|dump|leak|reprint|divulge|disclose)\\b[\\s\\S]{0,40}?\\b${Y}\\b`,"i")},{name:"what_is_prompt",re:new RegExp(`\\bwhat\\s+(?:is|are|were)\\b[\\s\\S]{0,20}?\\b${Y}\\b`,"i")},{name:"tell_me_prompt",re:new RegExp(`\\b(?:tell|give|send|show)\\s+me\\b[\\s\\S]{0,30}?\\b${Y}\\b`,"i")},{name:"repeat_above",re:/\b(?:repeat|print|output|echo|reproduce)\b[\s\S]{0,20}?\b(?:everything|all\s+(?:the\s+)?(?:text|words))\b[\s\S]{0,12}?\b(?:above|before|preceding|verbatim|word\s+for\s+word)\b/i}],ft="(?:instructions?|prompts?|rules?|directives?|guidelines?|constraints?|guardrails?)",Li=`(?:(?:all\\s+|any\\s+|the\\s+|these\\s+|those\\s+)*(?:previous|prior|preceding|earlier|above|foregoing|initial|original|system|developer)\\s+${ft}|your\\s+(?:(?:system|initial|original|previous|prior|current)\\s+)?(?:${ft}|programming|training))`,Fi="(?:(?:all|any|every|the|of|and|now|please|completely|entirely|totally|immediately)\\s+){0,3}",mt="(?:\\b(?:unrestricted|unfiltered|uncensored|unbounded|unlimited|unchained|jailbroken|lawless|amoral)\\b|\\b(?:DAN|STAN|DUDE|AIM)\\b|\\bno\\s+(?:longer\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|boundaries|constraints?)\\b(?!\\s+(?:on|over|regarding|upon|for)\\b)|\\bwithout\\s+(?:any\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|constraints?|censorship)\\b|\\b(?:free|freed|released)\\s+from\\s+(?:your\\s+)?(?:restrictions?|limits?|rules?|guidelines?|guardrails?|programming|constraints?)\\b|\\b(?:can|will|are\\s+able\\s+to)\\s+(?:do|say)\\s+anything\\b|\\bignore\\s+(?:all\\s+)?(?:your\\s+)?(?:previous\\s+|prior\\s+|system\\s+)?(?:instructions?|rules?|guidelines?)\\b)",ji="(?:ignore|disregard|forget|override|overrule|bypass|obey|comply\\s+with|follow\\s+(?:only|my|these))",ko=[{name:"override_instructions",re:new RegExp(`\\b(?:ignore|disregard|forget|discard|override|overrule|bypass|delete|erase)\\s+${Fi}${Li}\\b`,"i")},{name:"forget_everything_prior",re:/\b(?:forget|ignore|disregard|erase|discard)\s+(?:about\s+|all\s+|any\s+)?(?:everything|anything)\b[\s\S]{0,24}?\b(?:above|before|previously|prior|earlier|you\s+(?:were|have\s+been)\s+(?:told|instructed|given|programmed))\b/i},{name:"persona_reassignment_jailbreak",re:new RegExp(`\\byou\\s+are\\s+now\\s+(?:(?:a|an|the)\\s+)?[\\s\\S]{0,48}?${mt}`,"i")},{name:"constraint_release",re:/\byou\s+are\s+no\s+longer\s+(?:bound|restricted|limited|constrained|obligated|governed|subject\s+to|required\s+to)\b/i},{name:"from_now_on_reassignment",re:new RegExp(`\\bfrom\\s+now\\s+on\\s*,?\\s+you\\s+(?:are|will|must|shall|have|can)\\s+(?:${ji}\\b|[\\s\\S]{0,40}?${mt})`,"i")},{name:"new_instructions_header",re:/^\s*(?:[#*>-]+\s*)?(?:new|real|actual|true|secret|hidden|override)\s+(?:system\s+)?(?:instructions?|prompts?|directives?)\s*:/im}];var So=Object.freeze({"\u2019":"'",\u02BC:"'","\uFF07":"'","\u02B9":"'","\u2032":"'"});var S=e=>`[^.!?;\\n]{0,${e}}?`,Bi=["\\bi\\s+(?:can'?t|cannot|can\\s+not|won'?t|will\\s+not)\\b","\\bi(?:'m|\\s+am)\\s+(?:not\\s+able\\s+to|unable\\s+to|not\\s+going\\s+to|not\\s+permitted\\s+to|not\\s+allowed\\s+to)\\b"].join("|"),Pt="(?:help|assist|provide|create|generate|produce|write|compose|draft|comply|fulfil|fulfill|share|disclose|reveal|perform|execute|run|send|transmit|publish|export|approve|grant|carry\\s+out|do\\s+that|do\\s+this|do\\s+so|go\\s+ahead)",Io=Object.freeze([{id:"capability_denial",class:"strong",re:new RegExp([`(?:${Bi})\\s${S(40)}\\b${Pt}\\b`,"\\b(?:that|this|it)(?:'s|\\s+is)\\s+not\\s+something\\s+i\\s+(?:can|could|am\\s+able\\s+to|'m\\s+able\\s+to)\\b",`\\b(?:falls|sits|is)\\s+outside\\s+(?:of\\s+)?(?:what|the\\s+(?:scope|range|bounds))\\b${S(40)}\\bi\\s+(?:can|am|'m)\\b`,"\\bnot\\s+something\\s+i(?:'m|\\s+am)\\s+(?:able|willing|permitted|allowed)\\s+to\\b"].join("|"),"i")},{id:"explicit_decline",class:"strong",re:new RegExp(["\\bi\\s+(?:must|have\\s+to|need\\s+to|will\\s+have\\s+to|am\\s+going\\s+to|'m\\s+going\\s+to)\\s+(?:respectfully\\s+)?decline\\b","\\bi(?:'m|\\s+am)\\s+not\\s+(?:comfortable|willing|prepared)\\b","\\bi(?:'ll|\\s+will)\\s+(?:have\\s+to\\s+)?pass\\s+on\\b","\\bi\\s+(?:must|have\\s+to)\\s+refuse\\b"].join("|"),"i")},{id:"policy_citation",class:"strong",re:new RegExp([`\\b(?:against|contrary\\s+to|prohibited\\s+by|forbidden\\s+by|in\\s+violation\\s+of|violates)\\s${S(24)}\\b(?:polic(?:y|ies)|guidelines?|terms\\s+of\\s+(?:use|service)|rules\\s+of\\s+engagement|code\\s+of\\s+conduct)\\b`,`\\b(?:my|our|the|company|organi[sz]ation'?s?)\\s+(?:polic(?:y|ies)|guidelines?)\\s${S(24)}\\b(?:do(?:es)?\\s+not\\s+(?:allow|permit)|prohibit|forbid|prevent)\\b`,`\\bnot\\s+(?:permitted|allowed|authori[sz]ed)\\s+(?:under|by)\\s${S(24)}\\b(?:polic(?:y|ies)|guidelines?)\\b`].join("|"),"i")},{id:"guardrail_selfreference",class:"strong",re:new RegExp(["\\bi(?:'ve|\\s+have)\\s+been\\s+(?:instructed|configured|told|trained)\\s+not\\s+to\\b","\\bi(?:'m|\\s+am)\\s+(?:designed|configured|programmed|built|set\\s+up)\\s+not\\s+to\\b",`\\bmy\\s+(?:safety\\s+)?(?:instructions|configuration|guardrails?|constraints|training)\\s${S(24)}\\b(?:prevent|prohibit|forbid|do(?:es)?\\s+not\\s+(?:allow|permit)|preclude)\\b`,"\\b(?:outside|beyond)\\s+(?:my|the)\\s+(?:permitted|authori[sz]ed|configured|approved)\\s+(?:scope|remit|capabilities|actions|operations)\\b"].join("|"),"i")},{id:"ethical_objection",class:"strong",re:new RegExp(["\\b(?:that|this|doing\\s+(?:so|that)|what\\s+you(?:'re|\\s+are)\\s+asking|the\\s+request|such\\s+a\\s+request)\\s+(?:would\\s+be|is|are)\\s+(?:clearly\\s+|both\\s+|potentially\\s+)?(?:illegal|unethical|unlawful|harmful|fraudulent)\\b","\\bi\\s+(?:do\\s+not|don'?t)\\s+condone\\b","\\b(?:goes|would\\s+go|runs)\\s+against\\s+my\\s+(?:principles|values|ethics)\\b","\\bi\\s+(?:can'?t|cannot|won'?t)\\s+in\\s+good\\s+conscience\\b"].join("|"),"i")},{id:"apology_marker",class:"weak",re:new RegExp("\\b(?:i(?:'m|\\s+am)\\s+(?:really\\s+|very\\s+|terribly\\s+|so\\s+)?sorry|i\\s+apologi[sz]e|my\\s+apologies)\\b","i")}]),Eo=Object.freeze([/```/,/\b(?:here(?:'s|\s+is|\s+are)|below\s+(?:is|are|you(?:'ll|\s+will)\s+find)|the\s+following\s+(?:is|are))\b/i,new RegExp(`\\b(?:but|however|instead|although|that\\s+said)\\b${S(60)}\\b(?:i\\s+(?:can|could)(?!'t)\\s${S(30)}\\b${Pt}\\b|i(?:'d|\\s+would)\\s+be\\s+happy\\s+to\\b|i(?:'m|\\s+am)\\s+able\\s+to\\b)`,"i"),/\bwhat\s+i\s+can\s+do\s+(?:instead|is|for\s+you)\b/i]);var R=e=>`[^.!?;\\n]{0,${e}}?`,Co=Object.freeze([{id:"vulnerability_scanning",objectPatterns:[/\b(?:vulnerability|vuln|security)\s+(?:scan|scans|scanning|assessment|audit|test|testing)\b/i,/\bpen(?:etration)?[\s-]?test(?:ing)?\b/i,/\bport\s+scan(?:ning)?\b/i,/\b(?:exploit|nmap|metasploit|nessus|burp\s+suite)\b/i,/\bCVE-\d{4}-\d{4,7}\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|vulnerability|incident\s+respon\w{0,4}|threat|soc|red\s+team|phishing|malware)\b/i]},{id:"credential_access",objectPatterns:[/\b(?:credential|password|passphrase|api\s+key|access\s+key|secret|token|private\s+key|ssh\s+key)s?\b/i,/\b(?:vault|secrets?\s+manager|keychain|keystore)\b/i,/\bservice\s+account\s+key\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|identity|iam|credential|secrets?\s+manage\w{0,4}|vault|platform|devops)\b/i]},{id:"financial_transaction",objectPatterns:[/\b(?:wire\s+transfer|bank\s+transfer|payout|disbursement|chargeback)\b/i,new RegExp(`\\b(?:approve|issue|initiate|process|release)\\s${R(20)}\\b(?:payment|refund|invoice|transfer|purchase\\s+order)s?\\b`,"i"),new RegExp(`\\b(?:move|transfer)\\s${R(20)}\\b(?:funds|money)\\b`,"i")],purposeFunctions:["finance_accounting","procurement"],purposePatterns:[/\b(?:finance|financial|accounting|invoice|invoicing|payment|payments|billing|refund|refunds|treasury|procurement|spend|purchasing|fraud|kyc)\b/i]},{id:"personnel_data",objectPatterns:[/\b(?:employee|personnel|payroll|hr|staff)\s+(?:record|records|data|file|files|information|details)\b/i,/\b(?:salary|salaries|compensation|performance\s+review|termination\s+letter)s?\b/i,/\b(?:home\s+address|social\s+security\s+number|national\s+insurance\s+number)e?s?\b/i],purposeFunctions:["hr","privacy_compliance"],purposePatterns:[/\b(?:hr|human\s+resources|people\s+ops|payroll|benefits|recruit\w{0,4}|onboarding|privacy|dsar|consent)\b/i]},{id:"regulated_advice",objectPatterns:[/\b(?:legal|medical|tax|investment|financial)\s+advice\b/i,/\bpractis\w{0,3}\s+law\b/i,/\b(?:diagnose|diagnosis|prescribe|prescription)\b/i,/\b(?:binding|enforceable)\s+(?:opinion|interpretation)\b/i],purposeFunctions:["legal","privacy_compliance"],purposePatterns:[/\b(?:legal|compliance|counsel|contract|contracts|litigation|nda|privacy|regulator\w{0,2}|audit\w{0,3})\b/i]},{id:"data_export",objectPatterns:[new RegExp(`\\b(?:export|download|dump|extract|exfiltrat\\w{0,3}|bulk\\s+copy)\\b\\s${R(30)}\\b(?:data|database|dataset|records?|table|tables|customer\\s+list|contact\\s+list|report)\\b`,"i"),/\b(?:full|entire|whole)\s+(?:database|dataset|customer\s+table)\b/i],purposeFunctions:["operations","engineering","privacy_compliance"],purposePatterns:[/\b(?:data\s+(?:pipeline|engineering|platform)|etl|export|reporting|analytics|operations|document\s+extract\w{0,3}|forecast\w{0,3})\b/i]},{id:"code_execution",objectPatterns:[new RegExp(`\\b(?:run|execute|invoke)\\s${R(24)}\\b(?:script|scripts|command|commands|shell|code|binary|query|migration)\\b`,"i"),/\b(?:shell|root|sudo|admin)\s+(?:access|command|session)\b/i,/\bagainst\s+(?:the\s+)?production\s+(?:system|server|database|environment)s?\b/i],purposeFunctions:["engineering","it_security"],purposePatterns:[/\b(?:engineering|developer|devops|platform|release|deploy\w{0,4}|build|pipeline|sandbox|test\s+data|change\s+window)\b/i]},{id:"external_communication",objectPatterns:[new RegExp(`\\b(?:send|post|publish|email|tweet|message|broadcast)\\b\\s${R(30)}\\b(?:external|customer|customers|public|press|social\\s+media|third[\\s-]party|prospect|prospects)\\b`,"i"),/\b(?:cold\s+outreach|marketing\s+blast|phishing\s+email|press\s+release)\b/i],purposeFunctions:["marketing","sales","customer_support"],purposePatterns:[/\b(?:marketing|campaign|outreach|email\s+assistant|support|customer|sales|lead|leads|communication|communications)\b/i]}]);var oe="[REDACTED]",I="\u2022",U=e=>/[\p{L}\p{N}]/u.test(e);function Lt(e,t,n,r){let i=Array.from(e),a=i.length,o=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:I,c=o+s>=a;return i.map((u,d)=>!c&&(d<o||d>=a-s)?u:U(u)?l:u).join("")}function Ui(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return Lt(e,0,0,t);let r=e.slice(0,n),i=e.slice(n),a=t.length>0?t:I;return(r.length<=1?a:r[0]+Array.from(r.slice(1)).map(o=>U(o)?a:o).join(""))+i}function zi(e,t,n){let r=n.length>0?n:I,i=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let c=new RegExp(t,"g"),u;for(;(u=c.exec(e))!==null;){if(u[0].length===0){c.lastIndex++;continue}for(let d=u.index;d<u.index+u[0].length;d++)i[d]=!0}}catch{}let a=!1,o=!0;for(let c=0;c<e.length;c++)if(U(e[c])&&(a=!0,!i[c])){o=!1;break}let s=a&&o,l="";for(let c=0;c<e.length;c++){let u=e[c];!s&&i[c]||!U(u)?l+=u:l+=r}return l}function Ft(e,t){let n=t.mode??"full";return n==="partial"?Lt(e,t.keepFirst??0,t.keepLast??0,t.maskChar??I):n==="email"?Ui(e,t.maskChar??I):n==="custom"?zi(e,t.keepPattern,t.maskChar??I):t.replacement??oe}function qi(e,t){return typeof e=="string"?Ft(e,t):t.replacement??oe}function jt(e){let t=[],n=e.replacement??oe;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:J(r),replacer:()=>n});for(let r of e.directives??[]){let{pattern:i}=r;typeof i!="string"||i.length===0||t.push({source:J(i),replacer:a=>Ft(a,r)})}return t}function Bt(e){try{return new RegExp(e,"g")}catch(t){let n=t instanceof Error?t.message:String(t);throw new Error(`[visiq-redact] Invalid redaction pattern "${e}": ${n}`)}}function Ut(e,t){if(ee(e).length===0){let n=e;for(let{source:r,replacer:i}of t)n=n.replace(Bt(r),a=>i(a));return n}return Vi(e,t)}function Vi(e,t){let n=e;for(let{source:r,replacer:i}of t){let a=Bt(r),o=[...et(a,n)];for(let u of ee(n))for(let d of et(a,u.text))o.push(Er(u,d));let s=Cr(o);if(s.length===0)continue;let l="",c=0;for(let{start:u,end:d}of s)l+=n.slice(c,u)+i(n.slice(u,d)),c=d;n=l+n.slice(c)}return n}function To(e,t){return e==null?e:typeof e=="string"?Gi(e,t):typeof e=="object"?Wi(e,t):e}function Gi(e,t){if(typeof e!="string")return e;let n=jt(t);return n.length===0?e:Ut(e,n)}function Wi(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=jt(t),i=n.size>0,a=r.length>0,o=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>o(l));if(typeof s=="object"){let l=s,c=Object.create(Object.getPrototypeOf(l));for(let u of Object.keys(l)){let d=i?n.get(u):void 0;if(d){c[u]=qi(l[u],d);continue}c[u]=o(l[u])}return c}return typeof s=="string"&&a?Ut(s,r):s};return o(e)}import{createHash as ja}from"node:crypto";var zt=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function Hi(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:zt(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:zt(t.spawn.prompt)}),t}function Ki(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var Zi=1440*60*1e3,Yi="VISIQ_BUNDLE_GRACE_TTL_MS",Ji="VISIQ_BUNDLE_CACHE_DISABLED",Qi="VISIQ_CACHE_DIR",Xi=q.object({graceTtlMs:q.number().int().nonnegative().optional(),disabled:q.boolean().optional(),cacheDir:q.string().min(1).optional()}).strict();function ea(e){return e==null?{}:Xi.parse(e)}function ta(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[Yi];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return Zi}function na(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[Ji]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var qt;function ra(){if(qt!==void 0)return qt;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function ia(e){return JSON.stringify(le(e))}function le(e){if(Array.isArray(e))return e.map(le);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=le(t[r]);return n}return e}function aa(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function oa(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function Jt(){if(!ra())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function Qt(e,t){return e.createHash("sha256").update(ia(t)).digest("hex")}function sa(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[Qi]?.trim();if(r)return r;let i=process.env.XDG_CACHE_HOME?.trim();if(i)return e.path.join(i,"visiq");let a="";try{a=e.os.homedir()}catch{a=""}return a?e.path.join(a,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function la(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function Xt(e,t,n){return e.path.join(sa(e,n),"bundles",`${la(e,t)}.json`)}async function ca(e,t,n,r={}){let i=await Jt();if(i)try{let a=Xt(i,e,r),o=i.path.dirname(a);await i.fs.mkdir(o,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:Qt(i.crypto,t),body:t},l=`${a}.tmp-${process.pid}-${i.crypto.randomBytes(6).toString("hex")}`;await i.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await i.fs.rename(l,a)}catch(c){throw await i.fs.rm(l,{force:!0}).catch(()=>{}),c}}catch{}}async function ua(e,t={}){let n=await Jt();if(!n)return null;try{let r=await n.fs.readFile(Xt(n,e,t),"utf-8"),i=oa(JSON.parse(r));return!i||Qt(n.crypto,i.body)!==i.contentHash?null:i}catch{return null}}var D;async function da(){if(D!==void 0)return D;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;D=typeof t=="function"?t:null}catch{D=null}return D}function pa(e){let t=[];for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,i=r.rego_source;if(typeof i!="string"||i.length===0)continue;let a;try{a=K(i)}catch{continue}let o=typeof r.id=="string"?r.id:"<rule>";for(let s of $e(a))t.push(`${o}: ${s}`)}return t}function fa(e){return Je(e)}function ma(e){return e==null||typeof e!="object"?!0:Object.keys(e).length===0}var ha=5e3,ga=600*1e3,_a=1e4,ya=25,Vt=1e3,ba=5e3,va=100,Gt=2e3,wa=10,Aa=512,ka=1800*1e3,Sa=.7,Ia="monitor",Ea="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",Wt="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",Ca="open";function Ht(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function Ta(e,t){return Mt({content:e,resourceMetadata:t})}var xa=f.object({operations:f.array(f.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:f.string().min(1,"agentId is required"),sessionId:f.string().min(1).max(255).optional(),toolName:f.string().optional(),toolArgs:f.record(f.unknown()).optional(),targetResource:f.string().optional(),resourceType:f.string().optional(),resourceMetadata:f.record(f.unknown()).optional(),normalized:f.record(f.unknown()).optional(),query:f.string().optional(),contentPreview:f.string().optional(),telemetry:f.record(f.unknown()).optional(),context:f.record(f.unknown()).optional(),mcpServer:f.string().min(1).max(255).optional()}),Na=f.object({version:f.string().min(1),dialect_version:f.number().int().optional(),min_dialect:f.number().int().optional(),shutdown:f.boolean().optional(),agent_mode:f.enum(["enforce","monitor","off"]).optional(),cognition_capture:f.boolean().optional(),agent_mode_by_operation:f.object({action:f.string().optional(),retrieval:f.string().optional(),delegation:f.string().optional()}).partial().optional(),agent_attributes:f.object({trust_tier:f.string().nullable().optional(),categories:f.array(f.string()).optional(),business_function:f.string().nullable().optional(),business_functions:f.array(f.string()).nullable().optional(),blast_radius_tier:f.string().nullable().optional(),no_coverage:f.string().nullable().optional(),fail_mode:f.string().nullable().optional()}).optional(),rules:f.array(f.record(f.unknown())),action_schemas:f.array(f.object({id:f.string(),plane:f.string().optional(),field_mappings:f.array(f.record(f.unknown())).optional(),derived_fields:f.array(f.record(f.unknown())).optional(),action_class:f.string().nullable().optional(),action_class_confidence:f.number().optional()})).optional(),no_coverage:f.object({no_coverage_defaults:f.record(f.string()),autopilot_enabled:f.boolean(),enduser_hitl_enabled:f.boolean(),hitl_timeout_seconds:f.number().optional()}).optional()});function Oa(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=Ge(We(n));return{trust_tier:Me(t)?t:null,categories:Le(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&He(e.blast_radius_tier)?e.blast_radius_tier:null}}function Ra(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function $a(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var ce=new Set,Kt=!1;async function Zt(e){let t=[];for(let n of ce){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function Da(){if(!Kt&&!(typeof process>"u"||typeof process.once!="function")){Kt=!0,process.once("beforeExit",()=>{Zt(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await Zt(!0)}finally{process.kill(process.pid,e)}})()})}}var Mo=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=Ia;agentModeByOperation=null;rawBundle=null;normalizedRefs={retrieval:[],action:[],delegation:[]};warnedNormalizedAbsent=!1;warnedNormalizedDrift=!1;lastNormalizedWarnRearmMs=0;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;failMode=Ht(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??Ca;governedFailMode=null;telemetryBuffer=[];droppedTelemetry=0;inFlightTelemetry=new Set;telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;lastSkillInventorySig=null;skillInventoryPromise=null;lastCloneCaptureSig=null;toolDescriptions=new Map;constructor(e,t,n,r,i,a,o,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,c=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,u=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=c,this.resolvedAgentId=u,this.harnessKind=r,this.sdkVersion=a,this.sdkDialect=o,this.originalFetch=globalThis.fetch.bind(globalThis);let d=ea(s);if(this.bundleCacheDisabled=na(d.disabled),this.bundleGraceTtlMs=ta(d.graceTtlMs),this.bundleCacheDirOverride=d.cacheDir,this.cacheIdentity=l&&c&&!this.bundleCacheDisabled?{endpoint:c,agentId:u,apiKey:l}:null,l&&c){let m={apiKey:l,agentId:u,endpoint:c,mode:"enforce",timeoutMs:Ki(i),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...a!==void 0?{sdkVersion:a}:{},...o!==void 0?{sdkDialect:o}:{}};this.client=new Se(m,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},ha),se(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},_a),se(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},ba),se(this.cognitionTimer),ce.add(this),Da()}else this.client=null}async evaluate(e){let t=xa.parse(e),n=Date.now();if(this.operatorShutdown){let h=this.denyAll(t,Ea);return this.applyAgentMode(h,"enforce",t,n)}if(this.dialectRefused){if(this.failMode==="open")return this.failOpen(t,Wt,n);let h=this.denyAll(t,Wt);return this.applyAgentMode(h,"enforce",t,n)}if(t.operations.every(h=>this.modeFor(h)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let h;if(this.agentModeConfirmed?h=this.agentMode:this.bundleApplyFailed?h="enforce":h="monitor",h==="enforce"&&this.failMode==="open")return this.failOpen(t,"no unified bundle loaded and no local rules",n);let g=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(g,h,t,n)}let r=this.readSession(t.sessionId),i=await da();if(!i||!this.rawBundle){if(this.failMode==="open")return this.failOpen(t,"governance core (@visiq/core-wasm) unavailable",n);throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)")}let a=t.operations.includes("action")||t.operations.includes("delegation")?je(t.normalized??{},{targetApp:t.targetResource??t.toolName??""}):t.normalized,o=this.buildActionSchemaEvent(t),s=t.mcpServer?{...a??{},mcp_server:t.mcpServer}:a,l={...t,normalized:s,session:r,at:Date.now(),action_schema_id:o.id,action_schema_raw:o.canonical},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},u;try{u=i(l,c)}catch(h){if(this.failMode==="open")return this.failOpen(t,`governance core evaluation threw: ${h instanceof Error?h.message:String(h)}`,n);throw h}let d=[...new Set(t.operations.flatMap(h=>this.normalizedRefs[h]??[]))].sort();d.length>0&&ma(t.normalized)&&(u.normalizedColdStart=d,this.warnedNormalizedAbsent||(this.warnedNormalizedAbsent=!0,console.warn(`[UNIFIED] no normalized event supplied, but ${d.length} loaded rule condition(s) on this event's operation(s) read input.normalized.* \u2014 those conditions resolve to undefined here, so a deny carrying one does not fire. (Builtin-derived paths such as context/app_category ARE still populated in-core, so this is a dependency report, not a proof that every listed condition was the decider.) Cold start / no action-schema mapping yet. Affected: ${d.slice(0,5).join("; ")}${d.length>5?`; +${d.length-5} more`:""}`)));let m=Be(t.normalized);return m.length>0&&(u.normalizedDrift=m,this.warnedNormalizedDrift||(this.warnedNormalizedDrift=!0,console.warn(`[UNIFIED] normalized event carries ${m.length} value(s) outside the canonical vocabulary \u2014 a builder-authored rule can only select in-vocab values, so these cannot match one, so a rule keyed on the canonical value does not fire here. Check the harness classifier's casing/spelling. Affected: ${m.slice(0,5).join("; ")}${m.length>5?`; +${m.length-5} more`:""}`))),this.foldSession(t,u.enforced?u.decision:"permit"),u.enforced&&u.action.decision==="approval_required"&&await this.registerHitl(t,u),this.bufferTelemetry(t,u,Date.now()-n,u.enforced),u}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}readSession(e){if(!e)return O;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>ka?(this.sessions.delete(e),O):t.state:O}foldActionClass(e){let t=e.normalized?.action_class;if(typeof t=="string"&&t.length>0)return t;let n=this.rawBundle?.action_schemas;if(!Array.isArray(n))return;let{id:r}=this.buildActionSchemaEvent(e),i=n.find(s=>s?.id===r);if(!i)return;let a=i.action_class,o=typeof i.action_class_confidence=="number"?i.action_class_confidence:0;if(typeof a=="string"&&a.length>0&&o>=Sa)return a}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),i=e.resourceMetadata??{},a=e.operations.includes("retrieval"),o=e.operations.includes("action")||e.operations.includes("delegation"),s=ze(r===O?Ue():r,{data_categories:a&&Array.isArray(i.data_categories)?i.data_categories:void 0,classification:a?i.classification:void 0,taint:a?Ta(e.contentPreview,i):void 0,action_class:o?this.foldActionClass(e):void 0,target_app:o?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:s,touchedAt:Date.now()}),this.sessions.size>Aa){let l=this.sessions.keys().next().value;l!==void 0&&this.sessions.delete(l)}}applyAgentMode(e,t,n,r){let i=Date.now()-r;if(t==="enforce"){let o={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,o,i,!0),o}let a={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,a,i,!1),a}setFailMode(e){this.failMode=e}getFailMode(){return this.failMode}getGovernedFailMode(){return this.governedFailMode}failOpen(e,t,n){let r=`fail-open: ${t} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`;console.error(`[VisIQ] FAIL-OPEN: ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`);let i=e.operations.includes("action")||e.operations.includes("delegation"),a=e.operations.includes("retrieval"),o={decision:"permit",allowed:!0,reason:r,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:i?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:a?{action:"allow"}:{action:null},failOpen:!0};return this.bufferTelemetry(e,o,Date.now()-n,!1,!0),o}reportFailOpen(e,t){try{let n={operations:["action"],agentId:this.resolvedAgentId,...t?.toolName?{toolName:t.toolName}:{},...t?.sessionId?{sessionId:t.sessionId}:{}},r={decision:"permit",allowed:!0,reason:`fail-open: ${e} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:{decision:"permit",allowed:!0},retrieval:{action:null},failOpen:!0};this.bufferTelemetry(n,r,0,!1,!0)}catch{}}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},action_schema_id:this.buildActionSchemaEvent(e).id,...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=Na.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}let r=pa(t.rules);if(r.length>0){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle contains rego_source using a builtin the engine cannot evaluate (would silently never match \u2192 fail open): ${r.join("; ")}. Refusing the bundle and failing closed (G001). Recompile the rule without case-folding wrappers like upper()/lower().`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(i=>Ye(i)).filter(i=>i!==null),this.agentAttributes=t.agent_attributes?Oa(t.agent_attributes):null,this.agentNoCoverage=Ke(t.agent_attributes?.no_coverage),this.governedFailMode=Ht(t.agent_attributes?.fail_mode)??null,this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=Ra(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.normalizedRefs=fa(this.rules),this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1,this.lastNormalizedWarnRearmMs=Date.now(),this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...T(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304){let o=Date.now();o-this.lastNormalizedWarnRearmMs>=ga&&(this.lastNormalizedWarnRearmMs=o,this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1);return}if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),i=await n.json();this.applyBundle(i);let a=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&a?this.bundleEtag=r:a||(this.bundleEtag=null),a&&await this.persistBundleToDisk(i)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await ua(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(aa(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await ca(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}isBundleLoaded(){return this.bundleLoaded}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e,t){this.registerEnvironment({...H(),...e?{agent_type:e}:{},...t?.model?{model:t.model}:{},...t?.systemPrompt?{systemPrompt:t.systemPrompt}:{},...t?.toolSchemas&&t.toolSchemas.length>0?{toolSchemas:t.toolSchemas}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));for(let n of e)n.description&&this.toolDescriptions.set(n.name,n.description);t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}reportSkillInventory(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,h:n.content_hash})).sort((n,r)=>n.n===r.n?n.h.localeCompare(r.h):n.n.localeCompare(r.n)));t!==this.lastSkillInventorySig&&(this.lastSkillInventorySig=t,this.skillInventoryPromise=this.client.reportSkillInventory(e).catch(()=>{}))}captureCloneMetadata(e){if(!this.client||!this.resolvedAgentId||!(e.model||e.systemPrompt||(e.toolSchemas?.length??0)>0))return;let t=JSON.stringify({m:e.model??"",s:e.systemPrompt??"",t:e.toolSchemas??[]});t!==this.lastCloneCaptureSig&&(this.lastCloneCaptureSig=t,this.client.registerEnvironment({...H(),...e.agentType?{agent_type:e.agentType}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{systemPrompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{toolSchemas:e.toolSchemas}:{}}))}buildActionSchemaEvent(e){let t=e.toolName?this.toolDescriptions.get(e.toolName):void 0,n={agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{},...e.toolArgs?{tool_args:e.toolArgs}:{},...t?{tool_description:t}:{}},r=Ze(n),i={...n};return e.toolArgs&&(i.tool_args=Et(e.toolArgs)),{canonical:n,id:r,rawEventForWire:i}}bufferTelemetry(e,t,n,r,i=!1){let a=this.buildActionSchemaEvent(e);this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?$a(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:a.rawEventForWire,action_schema_id:a.id,...this.harnessKind||e.context||i||t.normalizedColdStart||t.normalizedDrift?{context:{...this.harnessKind?{[Ae]:this.harnessKind}:{},...e.context??{},...i?{fail_open:!0}:{},...t.normalizedColdStart?{normalized_cold_start:!0,normalized_inert_conditions:t.normalizedColdStart.length}:{},...t.normalizedDrift?{normalized_drift:!0,normalized_drift_values:t.normalizedDrift.length,normalized_drift_fields:t.normalizedDrift.slice(0,wa)}:{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=ya&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0),{client:t}=this,n=(async()=>{try{await t.sendTelemetry(e)}catch(r){this.droppedTelemetry+=e.length,console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",r)}})();this.inFlightTelemetry.add(n);try{await n}finally{this.inFlightTelemetry.delete(n)}}async drainInFlightTelemetry(){for(let e=0;e<8&&this.inFlightTelemetry.size>0;e+=1)await Promise.allSettled([...this.inFlightTelemetry])}droppedTelemetryCount(){return this.droppedTelemetry}enforceTelemetryCap(){let e=this.telemetryBuffer.length-Vt;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${Vt})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(Hi(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=va&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-Gt;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${Gt})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}if(this.skillInventoryPromise)try{await this.skillInventoryPromise}catch{}await this.flushTelemetry(),await this.drainInFlightTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),ce.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function se(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function V(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function Po(e,t){if(e!=="Task"&&e!=="Agent")return null;let n=V(t.description),r=V(t.subagent_type),i=V(t.prompt),a=n??r??"sub-agent";return{childAgentId:a,childName:a,kind:"subagent",agentType:r,description:n,task:i,goal:i,model:V(t.model),source:"structural"}}function Lo(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}var Ma={skill:"mastra",workspace_activate_skill:"voltagent",load_skill:"openai-agents",Skill:"claude-code"},Pa=new Set(["workspace_deactivate_skill"]),La=new Set(["read","read_file","readfile","view","cat"]);function Fo(e){return Pa.has((e??"").trim())}function Fa(e){let t=/(?:^|[/\\])([^/\\]+)[/\\]SKILL\.md$/i.exec(e.trim());return t?t[1]??null:null}function Yt(e,t){for(let n of t){let r=e[n];if(typeof r=="string"&&r.trim())return r.trim()}return null}function jo(e,t){let n=(e??"").trim();if(!n)return null;let r=t??{},i=Ma[n];if(i){let a=Yt(r,["name","skill_name","identifier","skill","path"]);return a?{skill:a,via:n,framework:i}:null}if(La.has(n.toLowerCase())){let a=Yt(r,["path","file_path","filePath","target","file"]),o=a?Fa(a):null;return o?{skill:o,via:n,framework:"unknown"}:null}return null}var Ba=/^---[ \t]*\r?\n([\s\S]*?)\r?\n---[ \t]*(?:\r?\n|$)/,Ua=/^([A-Za-z0-9_.-]+):[ \t]*(.*)$/;function za(e){let t=e.trim();return t.length>=2&&(t[0]==='"'&&t.endsWith('"')||t[0]==="'"&&t.endsWith("'"))?t.slice(1,-1):t}function qa(e,t){let n=t.startsWith("|");return(n?e.join(`
-`):e.join(" ")).replace(/[ \t]+/g,n?"$&":" ").trim()}function Va(e){let t=Ba.exec(e);if(!t)return{attrs:{},body:e};let[,n]=t,r=e.slice(t[0].length),i={},a=(n??"").split(/\r?\n/);for(let o=0;o<a.length;o+=1){let s=a[o]??"";if(!s.trim()||s.trimStart().startsWith("#")||/^[ \t]/.test(s))continue;let l=Ua.exec(s);if(!l)continue;let c=l[1],u=(l[2]??"").trim();if(/^[|>][+-]?\d*$/.test(u)){let d=[],m=o+1;for(;m<a.length;m+=1){let h=a[m]??"";if(h.trim()&&!/^[ \t]/.test(h))break;d.push(h.trim())}o=m-1,i[c]=qa(d,u);continue}u&&(i[c]=za(u))}return{attrs:i,body:r}}function Ga(e){return ja("sha256").update(e,"utf8").digest("hex")}function Wa(e,t,n){let{attrs:r,body:i}=Va(e),{description:a}=r;return{name:r.name?.trim()||n,path:t,...a?{description:a}:{},contentHash:Ga(i)}}var Ha=500,Ka=512*1024;async function Uo(e){let[t,n]=await Promise.all([import("node:fs/promises"),import("node:path")]),r=[],i=new Set;for(let a of e){let o;try{o=await t.readdir(a,{withFileTypes:!0})}catch{continue}for(let s of o){if(r.length>=Ha)return r;if(!s.isDirectory())continue;let l=n.join(a,s.name,"SKILL.md");try{let c=await t.stat(l);if(!c.isFile()||c.size>Ka)continue;let u=await t.readFile(l,"utf8"),d=Wa(u,`${s.name}/SKILL.md`,s.name),m=`${d.name}@${d.contentHash}`;if(i.has(m))continue;i.add(m),r.push(d)}catch{continue}}}return r}function zo(e){let t=[],n=[],r,i=[];for(let o of e){if(o.mode==="partial"||o.mode==="email"||o.mode==="custom"){let l={mode:o.mode};o.field&&(l.field=o.field),o.pattern&&(l.pattern=o.pattern),typeof o.keepFirst=="number"&&(l.keepFirst=o.keepFirst),typeof o.keepLast=="number"&&(l.keepLast=o.keepLast),o.maskChar&&(l.maskChar=o.maskChar),o.keepPattern&&(l.keepPattern=o.keepPattern),o.replacement!==void 0&&(l.replacement=o.replacement),i.push(l);continue}o.field&&t.push(o.field),o.pattern&&n.push(o.pattern);let{replacement:s}=o;s&&r===void 0&&(r=s)}let a={};return t.length>0&&(a.fields=t),n.length>0&&(a.patterns=n),r!==void 0&&(a.replacement=r),i.length>0&&(a.directives=i),a}var en="0.1.12";var Qo=3e4,Ja=4e3;function Qa(e){return e.replace(/[^a-zA-Z0-9._-]/g,"_").slice(0,200)||"default"}function pe(e){let t=Ya("sha1").update(e).digest("hex").slice(0,10);return`${Qa(e)}-${t}`}function Xo(e,t,n){return n-e.fetchedAt<t}function nn(e){return E(k(),"bundles",`${pe(e)}.json`)}function rn(e){return E(k(),"sessions",`${pe(e)}.registered`)}function an(e){return E(k(),"sessions",`${pe(e)}.skill`)}async function es(e){try{let n=(await tn(an(e),"utf8")).trim();return n.length>0?n:null}catch{return null}}async function ts(e,t){try{await ue(E(k(),"sessions"),{recursive:!0}),await de(an(e),t??"",{mode:384})}catch{}}async function ns(e){try{let t=await tn(nn(e),"utf-8"),n=JSON.parse(t);return n&&typeof n.fetchedAt=="number"&&"body"in n?n:null}catch{return null}}async function rs(e,t,n){try{let r=nn(e);await ue(E(k(),"bundles"),{recursive:!0});let i={fetchedAt:Date.now(),version:n,body:t};await de(r,JSON.stringify(i),{mode:384})}catch{}}async function is(e,t,n){try{let i=`${e.replace(/\/+$/,"")}/rules/bundle?agent_id=${encodeURIComponent(n)}`,a=await fetch(i,{method:"GET",headers:{Authorization:`Bearer ${t}`,Accept:"application/json",...T(en,W)},signal:AbortSignal.timeout(Ja)});if(!a.ok)return null;let o=a.headers.get("etag");return{body:await a.json(),version:o}}catch{return null}}async function as(e){try{return await Za(rn(e)),!0}catch{return!1}}async function os(e){try{await ue(E(k(),"sessions"),{recursive:!0}),await de(rn(e),String(Date.now()),{mode:384})}catch{}}export{ge as a,_e as b,k as c,pn as d,hn as e,gn as f,_n as g,no as h,To as i,W as j,$n as k,Mo as l,Po as m,Lo as n,Fo as o,jo as p,Uo as q,zo as r,en as s,Qo as t,Qa as u,Xo as v,es as w,ts as x,ns as y,rs as z,is as A,as as B,os as C};

package/dist/chunk-KIYOO6FJ.js

@@ -1,3 +0,0 @@
-import{A as $,B as J,C as g,c as S,i as O,j as E,k as C,l as N,m as D,n as A,o as q,p as F,q as V,r as P,s as L,t as j,v as H,w as M,x as m,y as B,z as Q}from"./chunk-KFHDW3CU.js";import{appendFile as ee,mkdir as te}from"node:fs/promises";import{join as oe}from"node:path";function ne(){return oe(S(),"fail-open.log")}async function l(e,t=!0){let o=`[VisIQ] FAIL-OPEN (${e.stage}): ${e.detail} \u2014 tool call proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`;try{process.stderr.write(`${o}
-`)}catch{}if(t)try{await te(S(),{recursive:!0}),await ee(ne(),`${JSON.stringify({at:new Date().toISOString(),...e})}
-`,{mode:384})}catch{}}async function y(e,t={}){e.failOpen===!0&&await l({stage:"runtime-fail-open",detail:e.reason,...t.toolName?{toolName:t.toolName}:{},...t.sessionId?{sessionId:t.sessionId}:{}})}var ie=new Set(["WebFetch","WebSearch","Read","Grep","Glob","LSP","NotebookRead","ListMcpResourcesTool","ReadMcpResourceTool"]),re=/(^|_)(search|fetch|read|list|get|query|retrieve|lookup|find|describe|download|export|dump)(_|$)/i;function se(e){if(typeof e!="string"||!e.startsWith("mcp__"))return typeof e=="string"?e:"";let t=e.lastIndexOf("__");return t>=0?e.slice(t+2):e}function v(e){return typeof e!="string"?!1:ie.has(e)?!0:e.startsWith("mcp__")?re.test(se(e)):!1}function K(e){return v(e)?["retrieval","action"]:["action"]}var ae=["query","q","url","prompt","pattern","file_path","path"];function w(e){if(!e||typeof e!="object")return;let t=e,o=[];for(let n of ae){let i=t[n];typeof i=="string"&&i.length>0&&o.push(i)}return o.length>0?o.join(" "):void 0}function u(e,t){let o=t?`VisIQ ${t}`:"VisIQ",n=e&&e.trim().length>0?e.trim():"blocked by policy";return`[${o}] ${n}`}function W(e){let t={hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"allow"}};return e&&(t.hookSpecificOutput.updatedInput=e),t}function _(e){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:e}}}function G(e){return{hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"ask",permissionDecisionReason:e}}}function c(e,t){let o={hookSpecificOutput:{hookEventName:"PostToolUse",updatedToolOutput:e}};return t&&(o.hookSpecificOutput.additionalContext=t),o}function ye(e){try{let t=JSON.parse(e);return t&&typeof t=="object"&&typeof t.hook_event_name=="string"?t:null}catch{return null}}var le="[VisIQ: retrieval withheld by policy]";function k(e){return U(e)}function U(e){if(e==null)return e;if(typeof e=="string")return e.length>0?le:e;if(typeof e=="number")return 0;if(typeof e=="boolean")return!1;if(Array.isArray(e))return e.map(U);if(typeof e=="object"){let t=Object.create(null);for(let o of Object.keys(e))t[o]=U(e[o]);return t}return e}function Y(e){return e.fields&&e.fields.length>0||e.patterns&&e.patterns.length>0?!0:!!e.directives?.some(t=>t.field&&t.field.length>0||t.pattern&&t.pattern.length>0)}function z(e,t){if(!e.enforced)return null;let{action:o,retrieval:n}=e,i=u(e.reason,e.ruleCode);if(o.decision==="deny"||n.action==="deny")return _(i);if(o.decision==="approval_required"||n.action==="escalate")return G(i);if(o.decision==="mask"&&o.argRedactionRules&&o.argRedactionRules.length>0){let s=P(o.argRedactionRules);if(Y(s)){let r=O(t,s)??t;if(JSON.stringify(r)!==JSON.stringify(t))return W(r)}return null}return null}function X(e,t){if(!e.enforced)return null;let{retrieval:o}=e,n=u(e.reason,e.ruleCode);if(o.action==="redact"){let i=P(o.redactionRules??[]);if(!Y(i))return c(k(t),n);let s=O(t,i);return JSON.stringify(s)===JSON.stringify(t)?null:c(s,n)}return o.action==="deny"?c(k(t),n):null}var ue="cli_harness";function d(e){let t=new N(e.apiKey,e.baseUrl,e.agentId,ue,void 0,L,E);return t.setFailMode(e.failMode),t}function h(e){let t={operations:e.operations,agentId:e.agentId,toolName:e.toolName,toolArgs:e.toolInput,resourceType:"tool_result",resourceMetadata:{toolName:e.toolName,...e.toolUseId?{toolCallId:e.toolUseId}:{},...e.sessionId?{sessionId:e.sessionId}:{},...e.cwd?{cwd:e.cwd}:{}}};return e.query&&(t.query=e.query),e.context&&(t.context=e.context),t}async function p(e,t,o=j){let{agentId:n}=t,i=await B(n);if(i&&H(i,o,Date.now())&&b(e,i.body))return!0;let s=e.getEndpoint();if(s){let r=await $(s,t.apiKey,n);if(r&&b(e,r.body))return await Q(n,r.body,r.version),!0}if(i&&b(e,i.body))return!0;try{await e.awaitBundleReady(2500)}catch{}return e.isBundleLoaded()}function b(e,t){try{return e.applyBundle(t),!0}catch{return!1}}async function f(e){try{await e.flush()}catch{}let t=typeof e.droppedTelemetryCount=="function"?e.droppedTelemetryCount():0;try{e.dispose()}catch{}return t}async function Ne(e,t){let o=d(t),n=e.tool_input??{};try{if(await J(e.session_id)||(o.registerHostEnvironment(),await g(e.session_id)),!await p(o,t)&&t.failMode!=="closed")return await l({stage:"no-bundle",detail:"no rule bundle available (cache empty + fetch failed)",toolName:e.tool_name,sessionId:e.session_id}),null;let s=D(e.tool_name,n),r=K(e.tool_name),I;s&&(C(o,{agentId:t.agentId,sessionId:e.session_id,framework:"claude-code"},s),r=Array.from(new Set([...r,"delegation"])),I=A(s,t.agentId));let a=F(e.tool_name,n),R=await M(e.session_id);a?(R=a.skill,await m(e.session_id,a.skill)):q(e.tool_name)&&await m(e.session_id,null);let T=R?{skill:{name:R,activated:!!a,...a?{via:a.via,framework:a.framework}:{}}}:void 0,Z=h({operations:r,agentId:t.agentId,toolName:e.tool_name,toolInput:n,sessionId:e.session_id,cwd:e.cwd,toolUseId:e.tool_use_id,query:w(n),...I||T?{context:{...I??{},...T??{}}}:{}}),x=await o.evaluate(Z);return await y(x,{toolName:e.tool_name,sessionId:e.session_id}),z(x,n)}catch(i){return t.failMode==="closed"?_(u("evaluation error \u2014 blocked (VISIQ_FAIL_MODE=closed)",null)):(await l({stage:"pre-eval-error",detail:i instanceof Error?i.message:String(i),toolName:e.tool_name,sessionId:e.session_id}),null)}finally{await f(o)}}async function je(e,t){if(!v(e.tool_name))return null;let o=d(t);try{if(!await p(o,t)&&t.failMode!=="closed")return await l({stage:"no-bundle",detail:"no rule bundle available (cache empty + fetch failed)",toolName:e.tool_name,sessionId:e.session_id}),null;let i=e.tool_input??{},s=h({operations:["retrieval"],agentId:t.agentId,toolName:e.tool_name,toolInput:i,sessionId:e.session_id,cwd:e.cwd,toolUseId:e.tool_use_id,query:w(i)}),r=await o.evaluate(s);return await y(r,{toolName:e.tool_name,sessionId:e.session_id}),X(r,e.tool_response)}catch(n){return t.failMode==="closed"?c(k(e.tool_response),u("evaluation error \u2014 withheld (VISIQ_FAIL_MODE=closed)",null)):(await l({stage:"post-eval-error",detail:n instanceof Error?n.message:String(n),toolName:e.tool_name,sessionId:e.session_id}),null)}finally{await f(o)}}async function ce(e,t){try{let{homedir:o}=await import("node:os"),{join:n}=await import("node:path"),i=[...t?[n(t,".claude","skills")]:[],n(o(),".claude","skills")],s=await V(i);if(s.length===0)return;e.reportSkillInventory(s.map(r=>({name:r.name,path:r.path,...r.description?{description:r.description}:{},content_hash:r.contentHash,framework:"claude-code"})))}catch{}}async function $e(e,t){let o=d(t);try{o.registerHostEnvironment(),await p(o,t,0),await g(e.session_id),await ce(o,e.cwd),await m(e.session_id,null)}finally{await f(o)}return null}export{ne as a,l as b,se as c,v as d,K as e,w as f,u as g,W as h,_ as i,G as j,c as k,ye as l,le as m,k as n,z as o,X as p,ue as q,d as r,h as s,p as t,f as u,Ne as v,je as w,$e as x};