@visiq/harness 0.2.14 → 0.2.15
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/index.js +4 -4
- package/package.json +1 -1
package/dist/index.js
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
|
-
import{randomUUID as Il}from"node:crypto";import*as it from"node:fs";import*as ot from"node:path";import*as si from"node:os";import{AsyncLocalStorage as Sl}from"node:async_hooks";import{z as h}from"zod";import*as j from"node:os";import{randomUUID as fe}from"node:crypto";var st=1,Gt="X-VisIQ-SDK",Ht="X-VisIQ-Dialect",Wt="unknown";function W(e,t=1){return{[Gt]:e&&e.length>0?e:Wt,[Ht]:String(t)}}var Qt="interceptor_source",yi=h.enum(["enforce","audit","off"]),_i=h.enum(["closed","open"]),Yt=h.enum(["enforce","monitor","off"]),bi=h.object({apiKey:h.string().min(1,"apiKey is required"),agentId:h.string().min(1,"agentId is required"),endpoint:h.string().url().optional(),mode:yi.optional(),timeoutMs:h.number().int().positive().optional(),hitlTimeoutMs:h.number().int().positive().optional(),failBehavior:_i.optional()}),Hl=h.object({agent_id:h.string().min(1),target_app:h.string().min(1),action:h.string().min(1),context:h.record(h.unknown()).optional(),session_id:h.string().min(1).max(255).optional(),action_schema_id:h.string().min(1).max(128).optional(),telemetry:h.record(h.unknown()).optional()}),vi=h.object({field:h.string().optional(),pattern:h.string().optional(),replacement:h.string().optional(),mode:h.enum(["full","partial","email"]).optional(),keepFirst:h.number().optional(),keepLast:h.number().optional(),maskChar:h.string().optional()}),wi=h.object({decision_id:h.string().min(1),decision:h.enum(["permit","deny","approval_required","mask"]),reason:h.string().optional(),rule_code:h.string().nullable().optional(),enforced:h.boolean().optional(),agent_mode:Yt.optional(),arg_redaction_rules:h.array(vi).optional(),plane:h.string().nullable().optional(),operation:h.string().nullable().optional(),is_retrieval:h.boolean().optional(),metadata:h.record(h.unknown()).optional()}),ki=h.object({field:h.string().min(1),operator:h.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:h.union([h.string(),h.number(),h.array(h.string())])}),Ai=h.object({id:h.string().min(1),rule_code:h.string().default(""),name:h.string().min(1),description:h.string().nullable().default(null),effect:h.enum(["allow","deny","hitl","mask"]),resource_type:h.string().min(1),rego_source:h.string().default(""),target_app:h.string().nullable().default(null),action_pattern:h.string().nullable().default(null),conditions:h.array(ki).default([]),priority:h.number().int().default(0)}),Ii=h.object({version:h.string().min(1),agent_mode:Yt.optional(),rules:h.array(Ai),no_coverage:h.object({no_coverage_defaults:h.record(h.string()),autopilot_enabled:h.boolean(),enduser_hitl_enabled:h.boolean(),hitl_timeout_seconds:h.number()}).optional()}),Si=2e3,Ei=e=>new RegExp("^\\p{White_Space}*$","u").test(e)||e.trim().length===0;function Ti(e){let t=e.rules.filter(n=>Ei(n.rego_source)).map(n=>n.id);return t.length>0&&console.warn(`[VISIQ] ${t.length} bundle rule(s) carry an EMPTY rego body and will be evaluated as an UNCONDITIONAL PERMIT credited to their own rule id: ${t.join(", ")}. If any of these is meant to deny, it is not denying. Fix the rule body at the control plane; the SDK cannot tell an intentional stub from a dropped column.`),t}var lt=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return W(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let i=await r.json();return wi.parse(i)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${i.status} ${i.statusText}`);let o=await i.json(),a=Ii.parse(o);return Ti(a),a}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let i=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});i.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${i.status}`)}catch(i){console.warn("[ALLOW] Execution result report failed:",i)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{system_prompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{tool_schemas:e.toolSchemas}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${i.status} ${i.statusText}`);let o=await i.json();if(typeof o!="object"||o===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let a=o,s=a.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof a.reason=="string"?a.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await Ri(Si)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function Ri(e){return new Promise(t=>setTimeout(t,e))}function $e(){let e={};try{let t=`${j.platform()} ${j.release()}`.trim();t&&(e.os=t)}catch{}try{let t=j.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=j.userInfo();t&&(e.username=t)}catch{}try{let t=Ci();t&&(e.ip=t)}catch{}return e}function Ci(){let e=j.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}function xi(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function Le(e,...t){for(let n of t){let r=xi(e[n]);if(r)return r}}function Fe(e){if(Le(e,"run_id","runId","session_id","sessionId","thread_id","threadId"))return"session";if(Le(e,"user_id","userId"))return"user";if(Le(e,"agent_id","agentId"))return"agent";if(Le(e,"org_id","orgId","namespace"))return"org"}var Oi=[{framework:"mem0",matches:e=>/^(mem0[_-])?(add|search|get|retrieve|update|delete)[_-]memor(y|ies)$/i.test(e),extract:(e,t)=>{let n=/^(?:mem0[_-])?([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"||n==="update"?r="write":r="read";let i=Fe(t);return{op:r,store:"mem0",framework:"mem0",...i?{scope:i}:{}}}},{framework:"letta",matches:e=>/^(core_memory_(append|replace)|archival_memory_(insert|search)|conversation_search)$/i.test(e),extract:e=>{let t=e.toLowerCase();return t.startsWith("core_memory_")?{op:"write",store:"letta-core",scope:"agent",framework:"letta"}:t==="archival_memory_insert"?{op:"write",store:"letta-archival",scope:"agent",framework:"letta"}:t==="archival_memory_search"?{op:"search",store:"letta-archival",scope:"agent",framework:"letta"}:{op:"search",store:"letta-conversation",scope:"session",framework:"letta"}}},{framework:"langgraph",matches:e=>/^(upsert_memory|save_recall_memory|search_recall_memories)$/i.test(e),extract:(e,t)=>{let n=/^search_/i.test(e),r=Fe(t);return{op:n?"search":"write",store:"langgraph-store",framework:"langgraph",...r?{scope:r}:{}}}},{framework:"zep",matches:e=>/^zep[_-](add|search|get|delete)[_-]memory$/i.test(e),extract:(e,t)=>{let n=/^zep[_-]([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"?r="write":r="read";let i=Fe(t)??"session";return{op:r,store:"zep",scope:i,framework:"zep"}}},{framework:"mcp-memory",matches:e=>/^(create_entities|create_relations|add_observations|delete_entities|delete_relations|delete_observations|search_nodes|open_nodes|read_graph)$/i.test(e),extract:e=>{let t=e.toLowerCase(),n;return t.startsWith("delete_")?n="delete":t==="search_nodes"?n="search":t==="open_nodes"||t==="read_graph"?n="read":n="write",{op:n,store:"mcp-memory",scope:"agent",framework:"mcp-memory"}}},{framework:"generic",matches:e=>/(^|[_\-.])(memory|memories|mem0|recall)([_\-.]|$)/i.test(e),extract:(e,t)=>{let n=e.toLowerCase(),r;/(^|[_\-.])(search|query|find|lookup|retrieve)([_\-.]|$)/.test(n)?r="search":/(^|[_\-.])(delete|remove|forget|clear|purge)([_\-.]|$)/.test(n)?r="delete":/(^|[_\-.])(add|save|write|store|upsert|put|set|update|insert|append|remember)([_\-.]|$)/.test(n)?r="write":r="read";let i=Fe(t);return{op:r,store:"memory",framework:"generic",...i?{scope:i}:{}}}}];function pe(e,t){if(!e)return null;let n=t??{};for(let r of Oi)try{if(r.matches(e)){let i=r.extract(e,n);if(i)return i}}catch{}return null}function ct(e,t){let n=typeof t?.itemCount=="number"&&Number.isFinite(t.itemCount)&&t.itemCount>=0?Math.round(t.itemCount):void 0,r=typeof t?.bytes=="number"&&Number.isFinite(t.bytes)&&t.bytes>=0?Math.round(t.bytes):void 0,i=e.op==="read"||e.op==="search";return{op:e.op,store:e.store,...e.scope?{scope:e.scope}:{},...n!==void 0?{itemCount:n}:{},...r!==void 0?{bytes:r}:{},...i&&n!==void 0?{hit:n>0}:{}}}var Kt=new Map;function me(e){let t=(Kt.get(e)??0)+1;return Kt.set(e,t),t}function Zt(e){if(!e||typeof e!="object")return;let t={};for(let n of["tokensIn","tokensOut","cacheRead","cacheWrite"]){let r=e[n];typeof r=="number"&&Number.isFinite(r)&&r>=0&&(t[n]=Math.round(r))}return Object.keys(t).length>0?t:void 0}function ut(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,i=Array.isArray(n.texts)?n.texts.filter(a=>typeof a=="string"&&a.length>0).join(`
|
|
1
|
+
import{randomUUID as Cl}from"node:crypto";import*as ot from"node:fs";import*as at from"node:path";import*as ui from"node:os";import{AsyncLocalStorage as xl}from"node:async_hooks";import{z as h}from"zod";import*as j from"node:os";import{randomUUID as me}from"node:crypto";var lt=1,Qt="X-VisIQ-SDK",Yt="X-VisIQ-Dialect",Zt="unknown";function W(e,t=1){return{[Qt]:e&&e.length>0?e:Zt,[Yt]:String(t)}}var Jt="interceptor_source",vi=h.enum(["enforce","audit","off"]),wi=h.enum(["closed","open"]),Xt=h.enum(["enforce","monitor","off"]),ki=h.object({apiKey:h.string().min(1,"apiKey is required"),agentId:h.string().min(1,"agentId is required"),endpoint:h.string().url().optional(),mode:vi.optional(),timeoutMs:h.number().int().positive().optional(),hitlTimeoutMs:h.number().int().positive().optional(),failBehavior:wi.optional()}),Jl=h.object({agent_id:h.string().min(1),target_app:h.string().min(1),action:h.string().min(1),context:h.record(h.unknown()).optional(),session_id:h.string().min(1).max(255).optional(),action_schema_id:h.string().min(1).max(128).optional(),telemetry:h.record(h.unknown()).optional()}),Ai=h.object({field:h.string().optional(),pattern:h.string().optional(),replacement:h.string().optional(),mode:h.enum(["full","partial","email"]).optional(),keepFirst:h.number().optional(),keepLast:h.number().optional(),maskChar:h.string().optional()}),Ii=h.object({decision_id:h.string().min(1),decision:h.enum(["permit","deny","approval_required","mask"]),reason:h.string().optional(),rule_code:h.string().nullable().optional(),enforced:h.boolean().optional(),agent_mode:Xt.optional(),arg_redaction_rules:h.array(Ai).optional(),plane:h.string().nullable().optional(),operation:h.string().nullable().optional(),is_retrieval:h.boolean().optional(),metadata:h.record(h.unknown()).optional()}),Si=h.object({field:h.string().min(1),operator:h.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:h.union([h.string(),h.number(),h.array(h.string())])}),Ei=h.object({id:h.string().min(1),rule_code:h.string().default(""),name:h.string().min(1),description:h.string().nullable().default(null),effect:h.enum(["allow","deny","hitl","mask"]),resource_type:h.string().min(1),rego_source:h.string().default(""),target_app:h.string().nullable().default(null),action_pattern:h.string().nullable().default(null),conditions:h.array(Si).default([]),priority:h.number().int().default(0)}),Ti=h.object({version:h.string().min(1),agent_mode:Xt.optional(),rules:h.array(Ei),no_coverage:h.object({no_coverage_defaults:h.record(h.string()),autopilot_enabled:h.boolean(),enduser_hitl_enabled:h.boolean(),hitl_timeout_seconds:h.number()}).optional()}),Ri=2e3,Ci=e=>new RegExp("^\\p{White_Space}*$","u").test(e)||e.trim().length===0;function xi(e){let t=e.rules.filter(n=>Ci(n.rego_source)).map(n=>n.id);return t.length>0&&console.warn(`[VISIQ] ${t.length} bundle rule(s) carry an EMPTY rego body and will be evaluated as an UNCONDITIONAL PERMIT credited to their own rule id: ${t.join(", ")}. If any of these is meant to deny, it is not denying. Fix the rule body at the control plane; the SDK cannot tell an intentional stub from a dropped column.`),t}var ct=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return W(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let i=await r.json();return Ii.parse(i)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${i.status} ${i.statusText}`);let o=await i.json(),a=Ti.parse(o);return xi(a),a}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let i=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});i.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${i.status}`)}catch(i){console.warn("[ALLOW] Execution result report failed:",i)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{system_prompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{tool_schemas:e.toolSchemas}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${i.status} ${i.statusText}`);let o=await i.json();if(typeof o!="object"||o===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let a=o,s=a.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof a.reason=="string"?a.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await Oi(Ri)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function Oi(e){return new Promise(t=>setTimeout(t,e))}function $e(){let e={};try{let t=`${j.platform()} ${j.release()}`.trim();t&&(e.os=t)}catch{}try{let t=j.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=j.userInfo();t&&(e.username=t)}catch{}try{let t=Ni();t&&(e.ip=t)}catch{}return e}function Ni(){let e=j.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}function Mi(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function Le(e,...t){for(let n of t){let r=Mi(e[n]);if(r)return r}}function Fe(e){if(Le(e,"run_id","runId","session_id","sessionId","thread_id","threadId"))return"session";if(Le(e,"user_id","userId"))return"user";if(Le(e,"agent_id","agentId"))return"agent";if(Le(e,"org_id","orgId","namespace"))return"org"}var Di=[{framework:"mem0",matches:e=>/^(mem0[_-])?(add|search|get|retrieve|update|delete)[_-]memor(y|ies)$/i.test(e),extract:(e,t)=>{let n=/^(?:mem0[_-])?([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"||n==="update"?r="write":r="read";let i=Fe(t);return{op:r,store:"mem0",framework:"mem0",...i?{scope:i}:{}}}},{framework:"letta",matches:e=>/^(core_memory_(append|replace)|archival_memory_(insert|search)|conversation_search)$/i.test(e),extract:e=>{let t=e.toLowerCase();return t.startsWith("core_memory_")?{op:"write",store:"letta-core",scope:"agent",framework:"letta"}:t==="archival_memory_insert"?{op:"write",store:"letta-archival",scope:"agent",framework:"letta"}:t==="archival_memory_search"?{op:"search",store:"letta-archival",scope:"agent",framework:"letta"}:{op:"search",store:"letta-conversation",scope:"session",framework:"letta"}}},{framework:"langgraph",matches:e=>/^(upsert_memory|save_recall_memory|search_recall_memories)$/i.test(e),extract:(e,t)=>{let n=/^search_/i.test(e),r=Fe(t);return{op:n?"search":"write",store:"langgraph-store",framework:"langgraph",...r?{scope:r}:{}}}},{framework:"zep",matches:e=>/^zep[_-](add|search|get|delete)[_-]memory$/i.test(e),extract:(e,t)=>{let n=/^zep[_-]([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"?r="write":r="read";let i=Fe(t)??"session";return{op:r,store:"zep",scope:i,framework:"zep"}}},{framework:"mcp-memory",matches:e=>/^(create_entities|create_relations|add_observations|delete_entities|delete_relations|delete_observations|search_nodes|open_nodes|read_graph)$/i.test(e),extract:e=>{let t=e.toLowerCase(),n;return t.startsWith("delete_")?n="delete":t==="search_nodes"?n="search":t==="open_nodes"||t==="read_graph"?n="read":n="write",{op:n,store:"mcp-memory",scope:"agent",framework:"mcp-memory"}}},{framework:"generic",matches:e=>/(^|[_\-.])(memory|memories|mem0|recall)([_\-.]|$)/i.test(e),extract:(e,t)=>{let n=e.toLowerCase(),r;/(^|[_\-.])(search|query|find|lookup|retrieve)([_\-.]|$)/.test(n)?r="search":/(^|[_\-.])(delete|remove|forget|clear|purge)([_\-.]|$)/.test(n)?r="delete":/(^|[_\-.])(add|save|write|store|upsert|put|set|update|insert|append|remember)([_\-.]|$)/.test(n)?r="write":r="read";let i=Fe(t);return{op:r,store:"memory",framework:"generic",...i?{scope:i}:{}}}}];function fe(e,t){if(!e)return null;let n=t??{};for(let r of Di)try{if(r.matches(e)){let i=r.extract(e,n);if(i)return i}}catch{}return null}function ut(e,t){let n=typeof t?.itemCount=="number"&&Number.isFinite(t.itemCount)&&t.itemCount>=0?Math.round(t.itemCount):void 0,r=typeof t?.bytes=="number"&&Number.isFinite(t.bytes)&&t.bytes>=0?Math.round(t.bytes):void 0,i=e.op==="read"||e.op==="search";return{op:e.op,store:e.store,...e.scope?{scope:e.scope}:{},...n!==void 0?{itemCount:n}:{},...r!==void 0?{bytes:r}:{},...i&&n!==void 0?{hit:n>0}:{}}}var Wt=new Map;function ge(e){let t=(Wt.get(e)??0)+1;return Wt.set(e,t),t}function en(e){if(!e||typeof e!="object")return;let t={};for(let n of["tokensIn","tokensOut","cacheRead","cacheWrite"]){let r=e[n];typeof r=="number"&&Number.isFinite(r)&&r>=0&&(t[n]=Math.round(r))}return Object.keys(t).length>0?t:void 0}function dt(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,i=Array.isArray(n.texts)?n.texts.filter(a=>typeof a=="string"&&a.length>0).join(`
|
|
2
2
|
|
|
3
|
-
`):"",o=
|
|
4
|
-
`).map(l=>Mi(l)).filter(l=>l.trim().length>0),a=0;for(;a<o.length;){let l=o[a].trim();if(l.startsWith("package ")||l.startsWith("import ")){a++;continue}let c=l.match(/^default\s+(\w+)\s*:?=\s*(.+)$/);if(c){let f=c[1],g=c[2].trim();r.set(f,be(g)),a++;continue}let u=l.match(/^(\w+)\s*:?=\s*(.+?)(?:\s+if)?\s*\{(.*)$/);if(u){let f=u[1],g=u[2].trim(),m=u[3].trim(),p=[];if(m&&m!=="}"){let x=m.endsWith("}")?m.slice(0,-1).trim():m;x&&p.push(x),m.endsWith("}")||(a++,a=Pe(o,a,p))}else m==="}"||(a++,a=Pe(o,a,p));let _=en(p);i.push({variable:f,value:be(g),conditions:_,rawConditions:Xt(p)}),a++;continue}let d=l.match(/^(\w+)(?:\s+if)?\s*\{(.*)$/);if(d){let f=d[1],g=d[2].trim(),m=[];if(g&&g!=="}"){let _=g.endsWith("}")?g.slice(0,-1).trim():g;_&&m.push(_),g.endsWith("}")||(a++,a=Pe(o,a,m))}else g==="}"||(a++,a=Pe(o,a,m));let p=en(m);i.push({variable:f,value:"true",conditions:p,rawConditions:Xt(m)}),a++;continue}a++}let s={defaults:r,rules:i};return Jt.set(t,s),s}function Mi(e){let t=!1,n="";for(let r=0;r<e.length;r++){let i=e[r];if(t)i===n&&e[r-1]!=="\\"&&(t=!1);else if(i==='"'||i==="'")t=!0,n=i;else if(i==="#")return e.slice(0,r)}return e}function Pe(e,t,n){let r=1,i=t;for(;i<e.length&&r>0;){let o=e[i].trim();for(let a of o)a==="{"&&r++,a==="}"&&r--;if(r>0)n.push(o),i++;else{let a=o.slice(0,o.lastIndexOf("}")).trim();return a&&n.push(a),i}}return i}function be(e){return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function Di(e){return e.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}function en(e){let t=[];for(let n of e){let r=n.split(";").map(i=>i.trim()).filter(i=>i.length>0);for(let i of r){let o=Bi(i);o&&t.push(o)}}return t}var pt=/"(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false/,Li=new RegExp(`^(${pt.source})\\s+in\\s+((?:input|data)[^\\s]*)$`),Fi=new RegExp(`^(${pt.source})\\s*==\\s*((?:input|data)\\S*)$`),$i=/^([^\s=!]+)\s*==\s*(.+)$/,Pi=/^([^\s=!]+)\s*!=\s*(.+)$/,Jl=new RegExp(`^(?:${pt.source})$`);var ji=/^regex\.match\(\s*("(?:[^"\\]|\\.)*")\s*,\s*((?:input|data)[^\s)]*)\s*\)$/;function Bi(e){let t=!1,n=e.trim();if(n.startsWith("not ")&&(t=!0,n=n.slice(4).trim()),n==="true"||n==="false")return{type:"literal_bool",negated:t,field:"",value:n==="true"};if(n.includes("[_]"))return{type:"truthy",negated:!1,field:Be,value:e.trim()};let r=n.match(/^count\(([^)]+)\)\s*(>=|<=|>|<)\s*(\d+)$/);if(r)return{type:"count_gt",negated:t,field:r[1].trim(),operator:r[2],value:parseInt(r[3],10)};let i=n.match(/^startswith\(([^,]+),\s*"([^"]*)"\)$/);if(i)return{type:"startswith",negated:t,field:i[1].trim(),value:i[2]};let o=n.match(/^endswith\(([^,]+),\s*"([^"]*)"\)$/);if(o)return{type:"endswith",negated:t,field:o[1].trim(),value:o[2]};let a=n.match(/^contains\(([^,]+),\s*"([^"]*)"\)$/);if(a)return{type:"contains",negated:t,field:a[1].trim(),value:a[2]};let s=n.match(ji);if(s)return{type:"regex_match",negated:t,field:s[2].trim(),value:Di(s[1])};let l=n.match(Li);if(l)return{type:"array_includes",negated:t,field:l[2].trim(),value:ln(l[1])};let c=n.match(/^([^\s]+)\s+in\s+(\[.*\])$/);if(c){let p=Vi(c[2]);if(p!==null)return{type:"in_set",negated:t,field:c[1].trim(),values:p}}let u=n.match(/^([^\s=!<>]+)\s*(>=|<=|>|<)\s*(-?\d+(?:\.\d+)?)$/);if(u)return{type:"comparison",negated:t,field:u[1].trim(),operator:u[2],value:parseFloat(u[3])};let d=n.match(Fi);if(d)return{type:"equality",negated:t,field:d[2].trim(),value:be(d[1].trim())};let f=n.match($i);if(f)return{type:"equality",negated:t,field:f[1].trim(),value:be(f[2].trim())};let g=n.match(Pi);if(g)return{type:"inequality",negated:t,field:g[1].trim(),value:be(g[2].trim())};let m=n.match(/^(input(?:\.[a-zA-Z0-9_]+|\["[^"]+"\]|\['[^']+'\])+)$/);return m?{type:"truthy",negated:t,field:m[1].trim()}:{type:"truthy",negated:!1,field:Be,value:e.trim()}}var Be="__unrecognized_condition_forces_deny__";var Ui=/[A-Za-z_][A-Za-z0-9_.]*\s*\(/;function sn(e){let t=[];for(let n of e.rules)for(let r of n.conditions)typeof r.field=="string"&&r.field!==Be&&Ui.test(r.field)&&t.push(r.field);return t}var qi=["input.normalized.","input.normalized["];function zi(e){let t=new Set;for(let n of e.rules)for(let r of n.conditions){let{field:i}=r;typeof i!="string"||i===Be||qi.some(o=>i.startsWith(o))&&t.add(i)}return[...t].sort()}function ln(e){let t=e.trim();return t==="true"?!0:t==="false"?!1:/^-?\d+(?:\.\d+)?$/.test(t)?parseFloat(t):t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'")?t.slice(1,-1):t}function Vi(e){let t=e.trim().replace(/^\[/,"").replace(/\]$/,"").trim();if(t.length===0)return[];let n=[],r="",i=!1,o="";for(let s=0;s<t.length;s++){let l=t[s];i?(r+=l,l===o&&t[s-1]!=="\\"&&(i=!1)):l==='"'||l==="'"?(r+=l,i=!0,o=l):l===","?(n.push(r.trim()),r=""):r+=l}if(i)return null;r.trim().length>0&&n.push(r.trim());let a=[];for(let s of n){let l=s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2,c=/^-?\d+(?:\.\d+)?$/.test(s);if(!l&&!c&&!(s==="true"||s==="false"))return null;a.push(ln(s))}return a}var Xl=new RegExp("^\\p{White_Space}*$","u");var Ki=["tier1","tier2","tier3"];function cn(e){return typeof e=="string"&&Ki.includes(e)}var Gi=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],Hi=["internal","customer_facing","experimental","third_party"],un=[...Gi,...Hi];function Wi(e){return typeof e=="string"&&un.includes(e)}function dn(e){let t=new Set;for(let n of e)Wi(n)&&t.add(n);return un.filter(n=>t.has(n))}var pn=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"],Qi=["version_control","payments","crm","communication","cloud_infra","identity","data_warehouse","ticketing","hr","finance_erp","storage","database","other"],Yi=["production","staging","development","test"],Zi=["security","engineering","finance","legal","compliance","hr","sales","marketing","support","operations","executive"];function Ji(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var tn={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function Xi(e){let t=Ji(e);return t===null?"other":tn[t]??tn[t.replace(/_/g,"")]??"other"}function fn(e,t){let n={...e};if(t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=Xi(t.targetApp)),n.context=r}return n}var nn=["pii","phi","pci","financial","biometric","genetic","location","communications","children","credentials","special_category_gdpr"],eo=["read","write","delete","share","export","decide","execute"],rn=["none","low","medium","high","critical"],to=["public","internal","confidential","restricted","credentials","api_key","private_key","password","secret","token","pan","full_pan","card_number","track_data","cvv","cvc","ssn","tax_id","national_id","passport","drivers_license","identity_document","document_number","kyc_document","bank_account","account_number","routing_number","iban","account_balance","customer_financial","credit_score","net_worth","income","financial_profile","employee_pii","payroll","compensation","material_nonpublic","pre_release_earnings","mnpi","attorney_client","legal_hold","privileged","special_category_gdpr","gdpr_special_category","biometric","ethnicity","political_opinion","health_special","religion"],no={action_class:pn,operation:eo,"context/app_category":Qi,"context/environment":Yi,"context/actor_function":Zi,"read/classification":to,"read/data_categories":nn,"read/data_sensitivity":rn,"write/data_categories":nn,"write/data_sensitivity":rn};function mn(e){if(e===null||typeof e!="object")return[];let t=e,n=new Set,r=(i,o,a)=>{let s=Array.isArray(o)?o:[o];for(let l of s)typeof l!="string"||l.length===0||a.includes(l)||n.add(`${i}=${l}`)};for(let[i,o]of Object.entries(no)){Object.prototype.hasOwnProperty.call(t,i)&&r(i,t[i],o);let a=i.indexOf("/");if(a===-1)continue;let s=t[i.slice(0,a)];if(s!==null&&typeof s=="object"&&!Array.isArray(s)){let l=i.slice(a+1),c=s;Object.prototype.hasOwnProperty.call(c,l)&&r(i,c[l],o)}}return[...n].sort()}var on=64,ro=64,ve={retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function gn(){return{retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var io=new Set(["deny","approval_required","escalate"]);function _e(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let i of t)n.add(i);let r=[...n].sort();return r.length>on?r.slice(0,on):r}function an(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function je(e){return typeof e=="string"&&e.length>0?e:null}function hn(e,t){let n=an(t.data_categories),r=je(t.classification),i=an(t.taint),o=je(t.action_class),a=o&&pn.includes(o)?o:null,s=je(t.target_app),l=je(t.decision),c={...e.action_counts};if(a)if(a in c)c[a]=(c[a]??0)+1;else if(Object.keys(c).length<ro)c[a]=1;else{let u=Object.keys(c).sort(),d=u[u.length-1];d!==void 0&&a<d&&(delete c[d],c[a]=1)}return{retrieved_data_categories:_e(e.retrieved_data_categories,n),retrieved_classifications:_e(e.retrieved_classifications,r?[r]:[]),taint:_e(e.taint,i),action_classes:_e(e.action_classes,a?[a]:[]),action_counts:c,denied_count:e.denied_count+(l==="deny"?1:0),inhibited_count:e.inhibited_count+(l&&io.has(l)?1:0),event_count:e.event_count+1,target_apps:_e(e.target_apps,s?[s]:[])}}var yn="generic",_n=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:yn,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],oo=_n.map(e=>e.id),ec=new Map(_n.map(e=>[e.id,e])),tc=new Set(oo);function bn(e){return Array.isArray(e)&&e.length>0?[...e]:[yn]}var ao=/^[a-z][a-z0-9_]*$/;function vn(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&ao.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var so=["narrow","moderate","broad","unbounded","unknown"];function wn(e){return typeof e=="string"&&so.includes(e)}function kn(e){return e==="open"||e==="closed"?e:null}var co=["tool_name","function","name","action"];function Ue(e,t,n){if(Array.isArray(e)){if(e.length===0){n.push([`${t}[]`,void 0]);return}for(let r of e)Ue(r,`${t}[]`,n);return}if(e!==null&&typeof e=="object"){let r=Object.entries(e);if(r.length===0){t&&n.push([t,void 0]);return}for(let[i,o]of r)Ue(o,t?`${t}.${i}`:i,n);return}t&&n.push([t,e])}function uo(e){let t=[];return Ue(e,"",t),[...new Set(t.map(([n])=>n))].sort()}function po(e){let t=e.slice(e.lastIndexOf(".")+1);return t.endsWith("[]")?t.slice(0,-2):t}function fo(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().toLowerCase();return t.length>0?t:null}function mo(e,t={}){if(t.discriminatorField===null)return null;let n=[];Ue(e,"",n);let r=t.discriminatorField?[t.discriminatorField]:t.discriminatorFields??co;for(let i of r){let o=null;for(let[a,s]of n){if(po(a)!==i)continue;let l=fo(s);l!==null&&(o===null||a<o.path)&&(o={path:a,value:l})}if(o)return o.value}return null}function An(e,t={}){let n=lo("sha256").update(uo(e).join(",")).digest("hex").slice(0,16),r=mo(e,t);return r!==null?`${n}:${r}`:n}var go=["action","retrieval","delegation"];function ho(e){return typeof e=="string"&&go.includes(e)}var yo=new Set(["rules"]);function In(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!yo.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(ho):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}function Sn(e){let t={retrieval:new Set,action:new Set,delegation:new Set};for(let n of e){if(!n.enabled||n.bypassActive)continue;let r=n.regoSource;if(typeof r!="string"||r.length===0)continue;let i;try{i=dt(r)}catch{continue}let o=zi(i);if(o.length!==0)for(let a of n.appliesTo){let s=t[a];if(s)for(let l of o)s.add(`${n.id}: ${l}`)}}return{retrieval:[...t.retrieval].sort(),action:[...t.action].sort(),delegation:[...t.delegation].sort()}}import{z as Ge}from"zod";var _o=/[^\u0000-\u007F]/,zn=new RegExp("^\\p{Nd}$","u"),bo=new RegExp("^\\p{Pd}$","u"),vo=/^[\p{Zs}\p{Zl}\p{Zp}]$/u,wo=/^[\p{Default_Ignorable_Code_Point}\p{Cf}]$/u,ko=new Map([[8722,"-"],[8259,"-"],[8231,"-"]]),Vn="<invisible>",En=new Map;function Ao(e){let t=String.fromCodePoint(e).normalize("NFKC");if(t.length===1&&t>="0"&&t<="9")return t;let n=e;for(let i=0;i<256&&n>0&&zn.test(String.fromCodePoint(n-1));i++)n--;let r=(e-n)%10;return String.fromCharCode(48+r)}function Io(e){if(e<128)return null;let t=En.get(e);if(t!==void 0)return t;let n=(()=>{if(e>=65281&&e<=65374)return String.fromCharCode(e-65248);let r=String.fromCodePoint(e);return zn.test(r)?Ao(e):bo.test(r)||ko.has(e)?"-":vo.test(r)?" ":wo.test(r)?Vn:null})();return En.set(e,n),n}function yt(e){if(typeof e!="string"||e.length===0||!_o.test(e))return[];let t=Tn(e,"as-separator");if(t===null)return[];let n=Tn(e,"as-nothing");return n===null||n.text===t.text?[t]:[t,n]}function Tn(e,t){let n=[],r=[],i=!1;for(let o=0;o<e.length;){let a=e.codePointAt(o),s=a>65535?2:1,l=Io(a);if(l===null){for(let c=0;c<s;c++)n.push(e[o+c]),r.push(o+c);o+=s;continue}if(i=!0,l===Vn){t==="as-separator"&&(n.push(" "),r.push(o)),o+=s;continue}n.push(l),r.push(o),o+=s}return i?(r.push(e.length),{label:t,text:n.join(""),offsets:Int32Array.from(r)}):null}function So(e,t){return{start:e.offsets[t.start],end:e.offsets[t.end]}}function Eo(e){if(e.length<=1)return[...e];let t=[...e].sort((i,o)=>i.start-o.start||i.end-o.end),n=[],r={start:t[0].start,end:t[0].end};for(let i=1;i<t.length;i++){let o=t[i];o.start<=r.end?o.end>r.end&&(r={start:r.start,end:o.end}):(n.push(r),r={start:o.start,end:o.end})}return n.push(r),n}function Rn(e,t){let n=[];e.lastIndex=0;let r;for(;(r=e.exec(t))!==null;){if(r[0].length===0){e.lastIndex++;continue}n.push({start:r.index,end:r.index+r[0].length})}return n}var Kn="[REDACTED]",_t=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"in_pan_tax",re:/\b[A-Z]{3}[ABCFGHJLPTE][A-Z]\d{4}[A-Z]\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"date_of_birth",re:/\b(?:\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])|(?:0[1-9]|[12]\d|3[01])[/.](?:0[1-9]|1[0-2])[/.]\d{4}|(?:0[1-9]|1[0-2])\/(?:0[1-9]|[12]\d|3[01])\/\d{4})\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}],ic=_t.map(({name:e,re:t})=>({name:e,source:t.source})),To="(?:(?<![A-Za-z0-9])(?=[A-Za-z0-9])|(?<=[A-Za-z0-9])(?![A-Za-z0-9]))";function Ro(e){return Gn(e,To)}function Gn(e,t){let n="",r=!1;for(let i=0;i<e.length;i++){let o=e[i];if(o==="\\"){if(!r&&e[i+1]==="b"){n+=t,i++;continue}n+=o+(e[i+1]??""),i++;continue}o==="["?r=!0:o==="]"&&(r=!1),n+=o}return n}function Hn(e){return new RegExp(Ro(e.source),e.flags)}var Co="(?:\\b|_)";function mt(e){return Gn(e,Co)}var xo=/^\(\?<!\[((?:[^\]\\]|\\.)*)\]\)/;function Oo(e){let t=xo.exec(e);return t?`(?:^|[^${t[1]}])${e.slice(t[0].length)}`:e}function gt(e){if(!/^\d+$/.test(e))return!1;let t=0,n=!1;for(let r=e.length-1;r>=0;r--){let i=e.charCodeAt(r)-48;n&&(i*=2,i>9&&(i-=9)),t+=i,n=!n}return t%10===0}function No(e){let t=e.replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let i=0;i<n.length;i++){let o=n[i],a=o>="A"&&o<="Z"?String(o.charCodeAt(0)-55):o;for(let s=0;s<a.length;s++)r=(r*10+(a.charCodeAt(s)-48))%97}return r===1}function Mo(e){if(!/^\d{9}$/.test(e))return!1;let t=[3,7,1,3,7,1,3,7,1],n=0;for(let r=0;r<9;r++)n+=(e.charCodeAt(r)-48)*t[r];return n%10===0}var Do=[[0,1,2,3,4,5,6,7,8,9],[1,2,3,4,0,6,7,8,9,5],[2,3,4,0,1,7,8,9,5,6],[3,4,0,1,2,8,9,5,6,7],[4,0,1,2,3,9,5,6,7,8],[5,9,8,7,6,0,4,3,2,1],[6,5,9,8,7,1,0,4,3,2],[7,6,5,9,8,2,1,0,4,3],[8,7,6,5,9,3,2,1,0,4],[9,8,7,6,5,4,3,2,1,0]],Lo=[[0,1,2,3,4,5,6,7,8,9],[1,5,7,6,2,8,3,0,9,4],[5,8,0,3,7,9,6,1,4,2],[8,9,1,6,0,4,3,5,2,7],[9,4,5,3,1,2,6,8,7,0],[4,2,8,6,5,7,3,9,0,1],[2,7,9,3,8,0,6,4,1,5],[7,0,4,6,9,1,3,2,5,8]];function Fo(e){if(!/^\d+$/.test(e))return!1;let t=0,n=e.split("").reverse();for(let r=0;r<n.length;r++)t=Do[t][Lo[r%8][n[r].charCodeAt(0)-48]];return t===0}function $o(e){if(!/^\d{11}$/.test(e)||/^(\d)\1{10}$/.test(e))return!1;let t=n=>{let r=0;for(let o=0;o<n;o++)r+=(e.charCodeAt(o)-48)*(n+1-o);let i=r*10%11;return i===10?0:i};return t(9)===e.charCodeAt(9)-48&&t(10)===e.charCodeAt(10)-48}function Po(e){if(!/^\d{10}$/.test(e))return!1;let t=0;for(let i=0;i<9;i++)t+=(e.charCodeAt(i)-48)*(10-i);let n=11-t%11,r=n===11?0:n;return r!==10&&r===e.charCodeAt(9)-48}var jo=[1,4,3,7,5,8,6,9,10];function Bo(e){if(!/^\d{8,9}$/.test(e))return!1;let t=0;for(let n=0;n<e.length;n++)t+=(e.charCodeAt(n)-48)*jo[n];return t%11===0}var Uo="TRWAGMYFPDXBNJZSQVHLCKE";function qo(e){let t=e.replace(/[\s.-]/g,"").toUpperCase(),n=/^([XYZ]?)(\d{7,8})([A-Z])$/.exec(t);if(!n)return!1;let[,r,i,o]=n;if(r===""&&i.length!==8||r!==""&&i.length!==7)return!1;let a=r===""?i:String("XYZ".indexOf(r))+i;return Uo[Number(a)%23]===o}var zo=new Set(["BG","GB","NK","KN","TN","NT","ZZ"]);function Vo(e){let t=e.replace(/[\s-]/g,"").toUpperCase();return/^[ABCEGHJ-PRSTW-Z][ABCEGHJ-NPRSTW-Z]\d{6}[A-D]$/.test(t)?!zo.has(t.slice(0,2)):!1}var bt=[{name:"pan",re:/\d(?:[ -]?\d){12,18}/g,normalize:e=>e.replace(/[ -]/g,""),validate:e=>e.length>=13&&e.length<=19&>(e)},{name:"iban",re:/\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){10,30}\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:No},{name:"aba_routing",re:/\b\d{9}\b/g,normalize:e=>e,validate:Mo},{name:"uk_nino",re:/\b[A-Za-z]{2} ?\d{2} ?\d{2} ?\d{2} ?[A-Da-d]\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:(e,t)=>t!==void 0&&t===t.toLowerCase()?!1:Vo(e)},{name:"in_aadhaar",re:/\b[2-9]\d{3}[ -]?\d{4}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===12&&Fo(e)},{name:"br_cpf",re:/\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,normalize:e=>e.replace(/[.-]/g,""),validate:$o},{name:"es_dni_nie",re:/\b(?:[XYZxyz]-?)?(?:\d{7,8}|\d{1,2}[. ]\d{3}[. ]\d{3})[ -]?[A-Za-z]\b/g,normalize:e=>e.replace(/[\s.-]/g,"").toUpperCase(),validate:qo},{name:"ca_sin",re:/\b\d{3}[ -]?\d{3}[ -]?\d{3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===9&>(e)},{name:"uk_nhs_number",re:/\b\d{3}[ -]?\d{3}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Po},{name:"au_tfn",re:/\b\d{3}[ -]?\d{3}[ -]?\d{2,3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Bo}],Ko=Object.fromEntries([..._t,...bt].map(e=>[e.name,e.re.source])),I=Ko,oc=bt.map(e=>e.name),Wn=_t.map(({name:e,re:t})=>({name:e,re:Hn(t)})),Qn=bt.map(e=>({...e,re:Hn(e.re)})),ac=[...Wn,...Qn].map(({name:e,re:t})=>({name:String(e),source:t.source})),vt=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","uk_nino","in_aadhaar","in_pan_tax","br_cpf","es_dni_nie","ca_sin","uk_nhs_number","au_tfn","email","us_phone","date_of_birth","ipv4","mac_address"],Go={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
|
|
3
|
+
`):"",o=en(n.usage);e.emitCognition({clientEventId:me(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:ge(r),ts:Date.now(),kind:n.final?"speech":"thought",visibility:"shown",provenance:"narration",...i?{content:{text:i}}:{},...o?{cost:o}:{},...n.model?{model:n.model}:{},...typeof n.durationMs=="number"&&Number.isFinite(n.durationMs)?{durationMs:Math.max(0,Math.round(n.durationMs))}:{},...t.framework?{framework:t.framework}:{}})}function he(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:me(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:ge(r),ts:Date.now(),kind:"spawn",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},spawn:{childAgentId:n.childAgentId,childName:n.childName,kind:n.kind,...n.model?{model:n.model}:{},...n.task?{prompt:n.task}:{}}})}function ye(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,i=n.memory?ut(n.memory):void 0;e.emitCognition({clientEventId:me(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:ge(r),ts:Date.now(),kind:i?"memory":"action",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName,...n.verb?{verb:n.verb}:{},...n.argSummary?{argSummary:n.argSummary}:{}},...i?{memory:i}:{}})}function _e(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,i=c=>typeof c=="number"&&Number.isFinite(c)&&c>=0?Math.round(c):void 0,o=i(n.bytes),a=i(n.itemCount),s=i(n.durationMs),l;n.memory&&(l=ut(n.memory,{itemCount:a,bytes:o})),e.emitCognition({clientEventId:me(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:ge(r),ts:Date.now(),kind:"observation",visibility:"shown",provenance:"parsed",...s!==void 0?{durationMs:s}:{},...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},result:{ok:n.ok,...o!==void 0?{bytes:o}:{},...a!==void 0?{itemCount:a}:{}},...l?{memory:l}:{}})}function ne(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:me(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:ge(r),ts:Date.now(),kind:"intervention",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},governance:{decision:n.decision,enforced:n.enforced,...n.ruleCode?{ruleCode:n.ruleCode}:{},...n.ruleLabel?{ruleLabel:n.ruleLabel}:{},...n.harnessMessage?{harnessMessage:n.harnessMessage}:{}}})}function Q(e){try{let t=JSON.stringify(e);return typeof t=="string"?t.length:void 0}catch{return}}function Y(e){try{return Array.isArray(e)?e.length:void 0}catch{return}}import{z as y}from"zod";import{createHash as Li}from"crypto";import{createHash as po}from"crypto";var tn=new Map;function nn(e){return e.map(t=>t.trim()).filter(t=>t.length>0&&t!=="true")}function pt(e){let t=Li("sha256").update(e).digest("hex"),n=tn.get(t);if(n)return n;let r=new Map,i=[],o=e.split(`
|
|
4
|
+
`).map(l=>Fi(l)).filter(l=>l.trim().length>0),a=0;for(;a<o.length;){let l=o[a].trim();if(l.startsWith("package ")||l.startsWith("import ")){a++;continue}let c=l.match(/^default\s+(\w+)\s*:?=\s*(.+)$/);if(c){let f=c[1],g=c[2].trim();r.set(f,ve(g)),a++;continue}let u=l.match(/^(\w+)\s*:?=\s*(.+?)(?:\s+if)?\s*\{(.*)$/);if(u){let f=u[1],g=u[2].trim(),m=u[3].trim(),p=[];if(m&&m!=="}"){let O=m.endsWith("}")?m.slice(0,-1).trim():m;O&&p.push(O),m.endsWith("}")||(a++,a=Pe(o,a,p))}else m==="}"||(a++,a=Pe(o,a,p));let _=rn(p);i.push({variable:f,value:ve(g),conditions:_,rawConditions:nn(p)}),a++;continue}let d=l.match(/^(\w+)(?:\s+if)?\s*\{(.*)$/);if(d){let f=d[1],g=d[2].trim(),m=[];if(g&&g!=="}"){let _=g.endsWith("}")?g.slice(0,-1).trim():g;_&&m.push(_),g.endsWith("}")||(a++,a=Pe(o,a,m))}else g==="}"||(a++,a=Pe(o,a,m));let p=rn(m);i.push({variable:f,value:"true",conditions:p,rawConditions:nn(m)}),a++;continue}a++}let s={defaults:r,rules:i};return tn.set(t,s),s}function Fi(e){let t=!1,n="";for(let r=0;r<e.length;r++){let i=e[r];if(t)i===n&&e[r-1]!=="\\"&&(t=!1);else if(i==='"'||i==="'")t=!0,n=i;else if(i==="#")return e.slice(0,r)}return e}function Pe(e,t,n){let r=1,i=t;for(;i<e.length&&r>0;){let o=e[i].trim();for(let a of o)a==="{"&&r++,a==="}"&&r--;if(r>0)n.push(o),i++;else{let a=o.slice(0,o.lastIndexOf("}")).trim();return a&&n.push(a),i}}return i}function ve(e){return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function $i(e){return e.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}function rn(e){let t=[];for(let n of e){let r=n.split(";").map(i=>i.trim()).filter(i=>i.length>0);for(let i of r){let o=zi(i);o&&t.push(o)}}return t}var ft=/"(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false/,Pi=new RegExp(`^(${ft.source})\\s+in\\s+((?:input|data)[^\\s]*)$`),ji=new RegExp(`^(${ft.source})\\s*==\\s*((?:input|data)\\S*)$`),Bi=/^([^\s=!]+)\s*==\s*(.+)$/,Ui=/^([^\s=!]+)\s*!=\s*(.+)$/,rc=new RegExp(`^(?:${ft.source})$`);var qi=/^regex\.match\(\s*("(?:[^"\\]|\\.)*")\s*,\s*((?:input|data)[^\s)]*)\s*\)$/;function zi(e){let t=!1,n=e.trim();if(n.startsWith("not ")&&(t=!0,n=n.slice(4).trim()),n==="true"||n==="false")return{type:"literal_bool",negated:t,field:"",value:n==="true"};if(n.includes("[_]"))return{type:"truthy",negated:!1,field:Be,value:e.trim()};let r=n.match(/^count\(([^)]+)\)\s*(>=|<=|>|<)\s*(\d+)$/);if(r)return{type:"count_gt",negated:t,field:r[1].trim(),operator:r[2],value:parseInt(r[3],10)};let i=n.match(/^startswith\(([^,]+),\s*"([^"]*)"\)$/);if(i)return{type:"startswith",negated:t,field:i[1].trim(),value:i[2]};let o=n.match(/^endswith\(([^,]+),\s*"([^"]*)"\)$/);if(o)return{type:"endswith",negated:t,field:o[1].trim(),value:o[2]};let a=n.match(/^contains\(([^,]+),\s*"([^"]*)"\)$/);if(a)return{type:"contains",negated:t,field:a[1].trim(),value:a[2]};let s=n.match(qi);if(s)return{type:"regex_match",negated:t,field:s[2].trim(),value:$i(s[1])};let l=n.match(Pi);if(l)return{type:"array_includes",negated:t,field:l[2].trim(),value:dn(l[1])};let c=n.match(/^([^\s]+)\s+in\s+(\[.*\])$/);if(c){let p=Hi(c[2]);if(p!==null)return{type:"in_set",negated:t,field:c[1].trim(),values:p}}let u=n.match(/^([^\s=!<>]+)\s*(>=|<=|>|<)\s*(-?\d+(?:\.\d+)?)$/);if(u)return{type:"comparison",negated:t,field:u[1].trim(),operator:u[2],value:parseFloat(u[3])};let d=n.match(ji);if(d)return{type:"equality",negated:t,field:d[2].trim(),value:ve(d[1].trim())};let f=n.match(Bi);if(f)return{type:"equality",negated:t,field:f[1].trim(),value:ve(f[2].trim())};let g=n.match(Ui);if(g)return{type:"inequality",negated:t,field:g[1].trim(),value:ve(g[2].trim())};let m=n.match(/^(input(?:\.[a-zA-Z0-9_]+|\["[^"]+"\]|\['[^']+'\])+)$/);return m?{type:"truthy",negated:t,field:m[1].trim()}:{type:"truthy",negated:!1,field:Be,value:e.trim()}}var Be="__unrecognized_condition_forces_deny__";var Vi=/[A-Za-z_][A-Za-z0-9_.]*\s*\(/;function un(e){let t=[];for(let n of e.rules)for(let r of n.conditions)typeof r.field=="string"&&r.field!==Be&&Vi.test(r.field)&&t.push(r.field);return t}var Ki=["input.normalized.","input.normalized["];function Gi(e){let t=new Set;for(let n of e.rules)for(let r of n.conditions){let{field:i}=r;typeof i!="string"||i===Be||Ki.some(o=>i.startsWith(o))&&t.add(i)}return[...t].sort()}function dn(e){let t=e.trim();return t==="true"?!0:t==="false"?!1:/^-?\d+(?:\.\d+)?$/.test(t)?parseFloat(t):t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'")?t.slice(1,-1):t}function Hi(e){let t=e.trim().replace(/^\[/,"").replace(/\]$/,"").trim();if(t.length===0)return[];let n=[],r="",i=!1,o="";for(let s=0;s<t.length;s++){let l=t[s];i?(r+=l,l===o&&t[s-1]!=="\\"&&(i=!1)):l==='"'||l==="'"?(r+=l,i=!0,o=l):l===","?(n.push(r.trim()),r=""):r+=l}if(i)return null;r.trim().length>0&&n.push(r.trim());let a=[];for(let s of n){let l=s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2,c=/^-?\d+(?:\.\d+)?$/.test(s);if(!l&&!c&&!(s==="true"||s==="false"))return null;a.push(dn(s))}return a}var ic=new RegExp("^\\p{White_Space}*$","u");var Wi=["tier1","tier2","tier3"];function pn(e){return typeof e=="string"&&Wi.includes(e)}var Qi=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],Yi=["internal","customer_facing","experimental","third_party"],fn=[...Qi,...Yi];function Zi(e){return typeof e=="string"&&fn.includes(e)}function mn(e){let t=new Set;for(let n of e)Zi(n)&&t.add(n);return fn.filter(n=>t.has(n))}var gn=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"],Ji=["version_control","payments","crm","communication","cloud_infra","identity","data_warehouse","ticketing","hr","finance_erp","storage","database","other"],Xi=["production","staging","development","test"],eo=["security","engineering","finance","legal","compliance","hr","sales","marketing","support","operations","executive"];function to(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var on={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function no(e){let t=to(e);return t===null?"other":on[t]??on[t.replace(/_/g,"")]??"other"}function hn(e,t){let n={...e};if(t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=no(t.targetApp)),n.context=r}return n}var an=["pii","phi","pci","financial","biometric","genetic","location","communications","children","credentials","special_category_gdpr"],ro=["read","write","delete","share","export","decide","execute"],sn=["none","low","medium","high","critical"],io=["public","internal","confidential","restricted","credentials","api_key","private_key","password","secret","token","pan","full_pan","card_number","track_data","cvv","cvc","ssn","tax_id","national_id","passport","drivers_license","identity_document","document_number","kyc_document","bank_account","account_number","routing_number","iban","account_balance","customer_financial","credit_score","net_worth","income","financial_profile","employee_pii","payroll","compensation","material_nonpublic","pre_release_earnings","mnpi","attorney_client","legal_hold","privileged","special_category_gdpr","gdpr_special_category","biometric","ethnicity","political_opinion","health_special","religion"],oo={action_class:gn,operation:ro,"context/app_category":Ji,"context/environment":Xi,"context/actor_function":eo,"read/classification":io,"read/data_categories":an,"read/data_sensitivity":sn,"write/data_categories":an,"write/data_sensitivity":sn};function yn(e){if(e===null||typeof e!="object")return[];let t=e,n=new Set,r=(i,o,a)=>{let s=Array.isArray(o)?o:[o];for(let l of s)typeof l!="string"||l.length===0||a.includes(l)||n.add(`${i}=${l}`)};for(let[i,o]of Object.entries(oo)){Object.prototype.hasOwnProperty.call(t,i)&&r(i,t[i],o);let a=i.indexOf("/");if(a===-1)continue;let s=t[i.slice(0,a)];if(s!==null&&typeof s=="object"&&!Array.isArray(s)){let l=i.slice(a+1),c=s;Object.prototype.hasOwnProperty.call(c,l)&&r(i,c[l],o)}}return[...n].sort()}var ln=64,ao=64,we={retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function _n(){return{retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var so=new Set(["deny","approval_required","escalate"]);function be(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let i of t)n.add(i);let r=[...n].sort();return r.length>ln?r.slice(0,ln):r}function cn(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function je(e){return typeof e=="string"&&e.length>0?e:null}function bn(e,t){let n=cn(t.data_categories),r=je(t.classification),i=cn(t.taint),o=je(t.action_class),a=o&&gn.includes(o)?o:null,s=je(t.target_app),l=je(t.decision),c={...e.action_counts};if(a)if(a in c)c[a]=(c[a]??0)+1;else if(Object.keys(c).length<ao)c[a]=1;else{let u=Object.keys(c).sort(),d=u[u.length-1];d!==void 0&&a<d&&(delete c[d],c[a]=1)}return{retrieved_data_categories:be(e.retrieved_data_categories,n),retrieved_classifications:be(e.retrieved_classifications,r?[r]:[]),taint:be(e.taint,i),action_classes:be(e.action_classes,a?[a]:[]),action_counts:c,denied_count:e.denied_count+(l==="deny"?1:0),inhibited_count:e.inhibited_count+(l&&so.has(l)?1:0),event_count:e.event_count+1,target_apps:be(e.target_apps,s?[s]:[])}}var vn="generic",wn=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:vn,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],lo=wn.map(e=>e.id),oc=new Map(wn.map(e=>[e.id,e])),ac=new Set(lo);function kn(e){return Array.isArray(e)&&e.length>0?[...e]:[vn]}var co=/^[a-z][a-z0-9_]*$/;function An(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&co.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var uo=["narrow","moderate","broad","unbounded","unknown"];function In(e){return typeof e=="string"&&uo.includes(e)}function Sn(e){return e==="open"||e==="closed"?e:null}var fo=["tool_name","function","name","action"];function Ue(e,t,n){if(Array.isArray(e)){if(e.length===0){n.push([`${t}[]`,void 0]);return}for(let r of e)Ue(r,`${t}[]`,n);return}if(e!==null&&typeof e=="object"){let r=Object.entries(e);if(r.length===0){t&&n.push([t,void 0]);return}for(let[i,o]of r)Ue(o,t?`${t}.${i}`:i,n);return}t&&n.push([t,e])}function mo(e){let t=[];return Ue(e,"",t),[...new Set(t.map(([n])=>n))].sort()}function go(e){let t=e.slice(e.lastIndexOf(".")+1);return t.endsWith("[]")?t.slice(0,-2):t}function ho(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().toLowerCase();return t.length>0?t:null}function yo(e,t={}){if(t.discriminatorField===null)return null;let n=[];Ue(e,"",n);let r=t.discriminatorField?[t.discriminatorField]:t.discriminatorFields??fo;for(let i of r){let o=null;for(let[a,s]of n){if(go(a)!==i)continue;let l=ho(s);l!==null&&(o===null||a<o.path)&&(o={path:a,value:l})}if(o)return o.value}return null}function En(e,t={}){let n=po("sha256").update(mo(e).join(",")).digest("hex").slice(0,16),r=yo(e,t);return r!==null?`${n}:${r}`:n}var _o=["action","retrieval","delegation"];function bo(e){return typeof e=="string"&&_o.includes(e)}var vo=new Set(["rules"]);function Tn(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!vo.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(bo):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}function Rn(e){let t={retrieval:new Set,action:new Set,delegation:new Set};for(let n of e){if(!n.enabled||n.bypassActive)continue;let r=n.regoSource;if(typeof r!="string"||r.length===0)continue;let i;try{i=pt(r)}catch{continue}let o=Gi(i);if(o.length!==0)for(let a of n.appliesTo){let s=t[a];if(s)for(let l of o)s.add(`${n.id}: ${l}`)}}return{retrieval:[...t.retrieval].sort(),action:[...t.action].sort(),delegation:[...t.delegation].sort()}}import{z as Ge}from"zod";var wo=/[^\u0000-\u007F]/,Gn=new RegExp("^\\p{Nd}$","u"),ko=new RegExp("^\\p{Pd}$","u"),Ao=/^[\p{Zs}\p{Zl}\p{Zp}]$/u,Io=/^[\p{Default_Ignorable_Code_Point}\p{Cf}]$/u,So=new Map([[8722,"-"],[8259,"-"],[8231,"-"]]),Hn="<invisible>",Cn=new Map;function Eo(e){let t=String.fromCodePoint(e).normalize("NFKC");if(t.length===1&&t>="0"&&t<="9")return t;let n=e;for(let i=0;i<256&&n>0&&Gn.test(String.fromCodePoint(n-1));i++)n--;let r=(e-n)%10;return String.fromCharCode(48+r)}function To(e){if(e<128)return null;let t=Cn.get(e);if(t!==void 0)return t;let n=(()=>{if(e>=65281&&e<=65374)return String.fromCharCode(e-65248);let r=String.fromCodePoint(e);return Gn.test(r)?Eo(e):ko.test(r)||So.has(e)?"-":Ao.test(r)?" ":Io.test(r)?Hn:null})();return Cn.set(e,n),n}function _t(e){if(typeof e!="string"||e.length===0||!wo.test(e))return[];let t=xn(e,"as-separator");if(t===null)return[];let n=xn(e,"as-nothing");return n===null||n.text===t.text?[t]:[t,n]}function xn(e,t){let n=[],r=[],i=!1;for(let o=0;o<e.length;){let a=e.codePointAt(o),s=a>65535?2:1,l=To(a);if(l===null){for(let c=0;c<s;c++)n.push(e[o+c]),r.push(o+c);o+=s;continue}if(i=!0,l===Hn){t==="as-separator"&&(n.push(" "),r.push(o)),o+=s;continue}n.push(l),r.push(o),o+=s}return i?(r.push(e.length),{label:t,text:n.join(""),offsets:Int32Array.from(r)}):null}function Ro(e,t){return{start:e.offsets[t.start],end:e.offsets[t.end]}}function Co(e){if(e.length<=1)return[...e];let t=[...e].sort((i,o)=>i.start-o.start||i.end-o.end),n=[],r={start:t[0].start,end:t[0].end};for(let i=1;i<t.length;i++){let o=t[i];o.start<=r.end?o.end>r.end&&(r={start:r.start,end:o.end}):(n.push(r),r={start:o.start,end:o.end})}return n.push(r),n}function On(e,t){let n=[];e.lastIndex=0;let r;for(;(r=e.exec(t))!==null;){if(r[0].length===0){e.lastIndex++;continue}n.push({start:r.index,end:r.index+r[0].length})}return n}var Wn="[REDACTED]",bt=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/(?<![A-Za-z0-9._%+-])[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"in_pan_tax",re:/\b[A-Z]{3}[ABCFGHJLPTE][A-Z]\d{4}[A-Z]\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"date_of_birth",re:/\b(?:\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])|(?:0[1-9]|[12]\d|3[01])[/.](?:0[1-9]|1[0-2])[/.]\d{4}|(?:0[1-9]|1[0-2])\/(?:0[1-9]|[12]\d|3[01])\/\d{4})\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}],cc=bt.map(({name:e,re:t})=>({name:e,source:t.source})),xo="(?:(?<![A-Za-z0-9])(?=[A-Za-z0-9])|(?<=[A-Za-z0-9])(?![A-Za-z0-9]))";function Oo(e){return Qn(e,xo)}function Qn(e,t){let n="",r=!1;for(let i=0;i<e.length;i++){let o=e[i];if(o==="\\"){if(!r&&e[i+1]==="b"){n+=t,i++;continue}n+=o+(e[i+1]??""),i++;continue}o==="["?r=!0:o==="]"&&(r=!1),n+=o}return n}function Yn(e){return new RegExp(Oo(e.source),e.flags)}var No="(?:\\b|_)";function gt(e){return Qn(e,No)}var Mo=/^\(\?<!\[((?:[^\]\\]|\\.)*)\]\)/;function Do(e){let t=Mo.exec(e);return t?`(?:^|[^${t[1]}])${e.slice(t[0].length)}`:e}function ht(e){if(!/^\d+$/.test(e))return!1;let t=0,n=!1;for(let r=e.length-1;r>=0;r--){let i=e.charCodeAt(r)-48;n&&(i*=2,i>9&&(i-=9)),t+=i,n=!n}return t%10===0}function Lo(e){let t=e.replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let i=0;i<n.length;i++){let o=n[i],a=o>="A"&&o<="Z"?String(o.charCodeAt(0)-55):o;for(let s=0;s<a.length;s++)r=(r*10+(a.charCodeAt(s)-48))%97}return r===1}function Fo(e){if(!/^\d{9}$/.test(e))return!1;let t=[3,7,1,3,7,1,3,7,1],n=0;for(let r=0;r<9;r++)n+=(e.charCodeAt(r)-48)*t[r];return n%10===0}var $o=[[0,1,2,3,4,5,6,7,8,9],[1,2,3,4,0,6,7,8,9,5],[2,3,4,0,1,7,8,9,5,6],[3,4,0,1,2,8,9,5,6,7],[4,0,1,2,3,9,5,6,7,8],[5,9,8,7,6,0,4,3,2,1],[6,5,9,8,7,1,0,4,3,2],[7,6,5,9,8,2,1,0,4,3],[8,7,6,5,9,3,2,1,0,4],[9,8,7,6,5,4,3,2,1,0]],Po=[[0,1,2,3,4,5,6,7,8,9],[1,5,7,6,2,8,3,0,9,4],[5,8,0,3,7,9,6,1,4,2],[8,9,1,6,0,4,3,5,2,7],[9,4,5,3,1,2,6,8,7,0],[4,2,8,6,5,7,3,9,0,1],[2,7,9,3,8,0,6,4,1,5],[7,0,4,6,9,1,3,2,5,8]];function jo(e){if(!/^\d+$/.test(e))return!1;let t=0,n=e.split("").reverse();for(let r=0;r<n.length;r++)t=$o[t][Po[r%8][n[r].charCodeAt(0)-48]];return t===0}function Bo(e){if(!/^\d{11}$/.test(e)||/^(\d)\1{10}$/.test(e))return!1;let t=n=>{let r=0;for(let o=0;o<n;o++)r+=(e.charCodeAt(o)-48)*(n+1-o);let i=r*10%11;return i===10?0:i};return t(9)===e.charCodeAt(9)-48&&t(10)===e.charCodeAt(10)-48}function Uo(e){if(!/^\d{10}$/.test(e))return!1;let t=0;for(let i=0;i<9;i++)t+=(e.charCodeAt(i)-48)*(10-i);let n=11-t%11,r=n===11?0:n;return r!==10&&r===e.charCodeAt(9)-48}var qo=[1,4,3,7,5,8,6,9,10];function zo(e){if(!/^\d{8,9}$/.test(e))return!1;let t=0;for(let n=0;n<e.length;n++)t+=(e.charCodeAt(n)-48)*qo[n];return t%11===0}var Vo="TRWAGMYFPDXBNJZSQVHLCKE";function Ko(e){let t=e.replace(/[\s.-]/g,"").toUpperCase(),n=/^([XYZ]?)(\d{7,8})([A-Z])$/.exec(t);if(!n)return!1;let[,r,i,o]=n;if(r===""&&i.length!==8||r!==""&&i.length!==7)return!1;let a=r===""?i:String("XYZ".indexOf(r))+i;return Vo[Number(a)%23]===o}var Go=new Set(["BG","GB","NK","KN","TN","NT","ZZ"]);function Ho(e){let t=e.replace(/[\s-]/g,"").toUpperCase();return/^[ABCEGHJ-PRSTW-Z][ABCEGHJ-NPRSTW-Z]\d{6}[A-D]$/.test(t)?!Go.has(t.slice(0,2)):!1}var vt=[{name:"pan",re:/\d(?:[ -]?\d){12,18}/g,normalize:e=>e.replace(/[ -]/g,""),validate:e=>e.length>=13&&e.length<=19&&ht(e)},{name:"iban",re:/\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){10,30}\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:Lo},{name:"aba_routing",re:/\b\d{9}\b/g,normalize:e=>e,validate:Fo},{name:"uk_nino",re:/\b[A-Za-z]{2} ?\d{2} ?\d{2} ?\d{2} ?[A-Da-d]\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:(e,t)=>t!==void 0&&t===t.toLowerCase()?!1:Ho(e)},{name:"in_aadhaar",re:/\b[2-9]\d{3}[ -]?\d{4}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===12&&jo(e)},{name:"br_cpf",re:/\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,normalize:e=>e.replace(/[.-]/g,""),validate:Bo},{name:"es_dni_nie",re:/\b(?:[XYZxyz]-?)?(?:\d{7,8}|\d{1,2}[. ]\d{3}[. ]\d{3})[ -]?[A-Za-z]\b/g,normalize:e=>e.replace(/[\s.-]/g,"").toUpperCase(),validate:Ko},{name:"ca_sin",re:/\b\d{3}[ -]?\d{3}[ -]?\d{3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===9&&ht(e)},{name:"uk_nhs_number",re:/\b\d{3}[ -]?\d{3}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Uo},{name:"au_tfn",re:/\b\d{3}[ -]?\d{3}[ -]?\d{2,3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:zo}],Wo=Object.fromEntries([...bt,...vt].map(e=>[e.name,e.re.source])),I=Wo,uc=vt.map(e=>e.name),Zn=bt.map(({name:e,re:t})=>({name:e,re:Yn(t)})),Jn=vt.map(e=>({...e,re:Yn(e.re)})),dc=[...Zn,...Jn].map(({name:e,re:t})=>({name:String(e),source:t.source})),wt=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","uk_nino","in_aadhaar","in_pan_tax","br_cpf","es_dni_nie","ca_sin","uk_nhs_number","au_tfn","email","us_phone","date_of_birth","ipv4","mac_address"],Qo={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
|
|
5
5
|
MIIEv\u2026
|
|
6
|
-
-----END PRIVATE KEY-----`,template:{pattern:I.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:I.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:I.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:I.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:I.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:I.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:I.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:I.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:I.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:I.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS). Collision rate: MEASURED 9.8% of benign 16-digit runs \u2014 Luhn leaves ~1 in 10. Default-ON because PCI-DSS makes masking mandatory; note in_aadhaar sits at the same rate and is often proposed for removal on that basis.",category:"financial",example:"4242 4242 4242 4242",template:{pattern:I.pan,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY 13-19 digit run (grouped or not) \u2014 the floor's regex without the checksum that makes it precise. ~9 in 10 of those are not card numbers.",examples:["4242 4242 4242 4243","4242424242424241"],measuredOverMaskRate:.531}},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible. Collision rate: MEASURED 1.0% \u2014 mod-97 leaves ~1 in 97, the most precise detector on this floor alongside br_cpf.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:I.iban,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run mod-97, so the rule masks EVERY IBAN-SHAPED token (2 letters, 2 digits, 10-30 alphanumerics) \u2014 and mod-97 is what makes this the most precise detector on the floor, so almost all of those are not IBANs.",examples:["DE89 3704 0044 0532 0130 01","GB00 NWBK 6016 1331 9268 19"],measuredOverMaskRate:.934}},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:I.aba_routing,mode:"full",templateOnly:{reason:"A rego rule cannot run the weighted 3-7-1 mod-10, so the rule masks EVERY bare 9-digit run \u2014 which is why this detector is default-OFF on the floor and why its rule form is broader still.",examples:["021000022","123456789"],measuredOverMaskRate:.899}},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX). Collision rate: MEASURED 100% \u2014 no checksum, so every 2-then-7 dashed digit run matches. Same trade as ssn: the punctuated shape is rare in benign traffic, not precise.",category:"financial",example:"12-3456789",template:{pattern:I.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:I.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789). Collision rate: MEASURED 100% \u2014 there is NO checksum, so every dashed 3-2-4 digit run matches. Default-ON regardless, because that punctuated shape is essentially absent from benign agent traffic; if your traffic carries 3-2-4 dashed reference codes, opt out.",category:"pii",example:"123-45-6789",template:{pattern:I.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},uk_nino:{id:"uk_nino",label:"UK National Insurance numbers",description:"UK NINOs (e.g. AB 12 34 56 C). DEFAULT-OFF \u2014 NO CHECKSUM. Precision comes only from the issued alphabet and the never-issued administrative prefixes (BG, GB, NK, KN, TN, NT, ZZ), so roughly half of tokens already shaped 2-letters/6-digits/[A-D] validate. All-lowercase candidates are rejected (git short SHAs), but that does NOT exclude uppercase business identifiers \u2014 serial, part, batch, PO, coupon and asset tags share the shape exactly and were measured being masked. Opt in when UK NINOs are expected in your traffic.",category:"pii",example:"AB 12 34 56 C",template:{pattern:"\\b(?:[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-D])\\b",mode:"full",templateOnly:{reason:"uk_nino has no checksum, but the floor still rejects the seven NEVER-ISSUED administrative prefixes (BG GB NK KN TN NT ZZ). A rego rule cannot express that exclusion without enumerating hundreds of letter pairs (RE2 has no lookahead), so the rule masks those too.",examples:["NK 12 34 56 A","ZZ 12 34 56 C"],measuredOverMaskRate:.019}},defaultEnabled:!1},in_aadhaar:{id:"in_aadhaar",label:"Aadhaar numbers (India)",description:"12-digit UIDAI Aadhaar numbers, Verhoeff-checksum validated and constrained to the issued 2-9 leading digit. Keeps the last 4 visible. Collision rate: MEASURED 10.0% of benign 12-digit ids starting 2-9 (order/transaction numbers) \u2014 Verhoeff leaves ~1 in 10. Comparable to the long-shipped pan (10.0%) and well behind iban (1.0%); it stays default-ON because the two US identifiers this floor has always shipped, ssn and us_ein, collide at 100%.",category:"pii",example:"2345 6789 0124",template:{pattern:"\\b[2-9]\\d{3}(?:[ -]\\d{4}[ -]?\\d{4}|\\d{4}[ -]\\d{4})\\b",mode:"partial",keepLast:4,floorOnly:{reason:"The floor accepts the entirely UNPUNCTUATED 12-digit form because Verhoeff gates it (~1 in 10 survive). A rego rule cannot run Verhoeff, so a bare \\d{12} in a rule would mask every 12-digit order id and E.164 Indian mobile number in the tenant. The rule requires at least one printed separator \u2014 every half-punctuated form is covered; only the bare digit run stays floor-only.",examples:["234567890124","id=234567890124"]},templateOnly:{reason:"A rego rule cannot run the Verhoeff checksum, so the rule masks EVERY 4-4-4 grouping that starts 2-9 \u2014 including the ~9 in 10 that are not Aadhaar numbers at all.",examples:["2345 6789 0125","2345-6789-0123"],measuredOverMaskRate:.903}},defaultEnabled:!0},in_pan_tax:{id:"in_pan_tax",label:"India PAN (tax ID)",description:"India Permanent Account Number \u2014 the income-tax id (ABCPE1234F), NOT a payment-card PAN. NO CHECKSUM: the only discriminator is the holder-type letter in position 4, which removes just 15 of 26 possibilities in one position, so roughly 4 in 10 uniform 5-letter/4-digit/1-letter tokens validate. DEFAULT-OFF for that reason \u2014 an uppercase SKU or part number of the same shape is masked, and nothing in the value distinguishes it.",category:"financial",example:"ABCPE1234F",template:{pattern:I.in_pan_tax,mode:"full"},defaultEnabled:!1},br_cpf:{id:"br_cpf",label:"CPF numbers (Brazil)",description:"Brazilian CPF, closed by TWO independent mod-11 check digits. Collision rate: MEASURED 1.0% of benign 11-digit runs (~1-in-100) \u2014 the most precise detector on this floor, alongside iban. Repdigits are rejected. Keeps the last 2 visible.",category:"pii",example:"123.456.789-09",template:{pattern:"\\b\\d{3}(?:\\.\\d{3}\\.?\\d{3}-?\\d{2}|\\d{3}(?:\\.\\d{3}-?\\d{2}|\\d{3}-\\d{2}))\\b",mode:"partial",keepLast:2,floorOnly:{reason:"The floor accepts the entirely bare 11-digit form because TWO mod-11 check digits gate it (~1 in 100 survive). A rego rule cannot run mod-11, so a bare \\d{11} in a rule would mask every 11-digit identifier in the tenant. The rule requires at least one printed separator; the bare form stays floor-only.",examples:["11144477735","ref 11144477735","12345678909"]},templateOnly:{reason:"A rego rule cannot run the two mod-11 check digits, so the rule masks EVERY punctuated 3-3-3-2 digit grouping \u2014 including the ~99 in 100 that are not CPFs.",examples:["123.456.789-10","111.444.777-34"],measuredOverMaskRate:.995}},defaultEnabled:!0},es_dni_nie:{id:"es_dni_nie",label:"DNI / NIE numbers (Spain)",description:"Spanish national ID (8 digits + letter) and foreigner ID (X/Y/Z + 7 digits + letter), validated by the mod-23 check letter. Collision rate: MEASURED 4.0% of benign 8-digit-plus-letter tokens (invoice/order numbers with a suffix letter) \u2014 mod-23 leaves ~1 in 23. More precise than in_aadhaar (10.0%) and pan (10.0%); behind br_cpf (1.0%) and iban (1.0%).",category:"pii",example:"12345678Z",template:{pattern:I.es_dni_nie,mode:"full",templateOnly:{reason:"A rego rule cannot run the mod-23 check letter, so the rule masks EVERY 7-8 digit run followed by a letter \u2014 invoice and order numbers with a suffix letter included. mod-23 admits ~1 in 23; the rule admits all of them. Re-measured 0.973 \u2192 0.981 when the floor learned the printed forms (dotted DNI, hyphenated NIE): the rule now also matches those written forms, and ~22 in 23 of them are not DNI/NIEs. The FLOOR's own rate is unchanged \u2014 mod-23, not punctuation, gates it.",examples:["12345678A","X1234567H"],measuredOverMaskRate:.976}},defaultEnabled:!0},ca_sin:{id:"ca_sin",label:"SIN numbers (Canada)",description:"Canadian Social Insurance Numbers (9-digit, Luhn-validated). DEFAULT-OFF \u2014 identical shape to an ABA routing number and to any 9-digit id, with only a mod-10 pass to separate them.",category:"pii",example:"046 454 286",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{3}|\\d{3}[- ]\\d{3})\\b",mode:"partial",keepLast:3,floorOnly:{reason:"The floor accepts the entirely bare 9-digit form because Luhn gates it. A rego rule cannot run Luhn, and a bare \\d{9} in a rule is also every ABA routing number and every 9-digit identifier, so the rule requires at least one printed separator in the 3-3-3 grouping.",examples:["046454286"]},templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY printed 3-3-3 digit grouping \u2014 including the ~9 in 10 that are not SINs.",examples:["046 454 287","123 456 789"],measuredOverMaskRate:.914}},defaultEnabled:!1},uk_nhs_number:{id:"uk_nhs_number",label:"NHS numbers (UK)",description:"UK NHS patient numbers (10-digit, weighted mod-11). DEFAULT-OFF \u2014 a 10-digit run is also every North American phone number.",category:"pii",example:"943 476 5919",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{4}|\\d{3}[- ]\\d{4})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 10-digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{10} in a rule is also every North American phone number, so the rule requires at least one printed separator in the 3-3-4 grouping.",examples:["9434765919"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-4 digit grouping \u2014 every North American phone number included \u2014 not just the ~1 in 10 that are NHS numbers.",examples:["943 476 5910","123 456 7890"],measuredOverMaskRate:.899}},defaultEnabled:!1},au_tfn:{id:"au_tfn",label:"Tax File Numbers (Australia)",description:"Australian TFNs (8-9 digit, weighted mod-11). DEFAULT-OFF \u2014 collides with essentially every 8-9 digit identifier.",category:"financial",example:"123 456 782",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{2,3}|\\d{3}[- ]\\d{2,3})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 8-9 digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{8,9} in a rule collides with essentially every identifier of that length, so the rule requires at least one printed separator. BOTH lengths are in the gap: a TFN may be 8 digits (`12345679`) or 9 (`123456782`), and the 8-digit branch went undeclared while the parity sweep derived its population from the 9-digit example alone.",examples:["12345679","123456782"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-2/3-3-3 digit grouping \u2014 including the ~9 in 10 that are not TFNs.",examples:["123 456 783","123 456 78"],measuredOverMaskRate:.912}},defaultEnabled:!1},date_of_birth:{id:"date_of_birth",label:"Dates of birth",description:"Dates in the common written formats. DEFAULT-OFF and heavily over-masking by nature \u2014 a DOB is indistinguishable from any other date (created_at, invoice, release). Offered because DOB is a GDPR/HIPAA identifier some regulated tenants must mask regardless.",category:"pii",example:"1985-04-12",template:{pattern:I.date_of_birth,mode:"full"},defaultEnabled:!1},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept). Collision rate: MEASURED 100% of well-formed addresses \u2014 that is BY DESIGN, not a defect: an email address is structurally unambiguous, so matching every one is correct rather than over-matching.",category:"pii",example:"alice@acme.com",template:{pattern:I.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:I.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:I.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:I.mac_address,mode:"full"},defaultEnabled:!1}},Ve=Object.freeze(Object.fromEntries(vt.map(e=>{let t=Go[e];return[e,{...t,template:{...t.template,pattern:Oo(mt(t.template.pattern))}}]})));var sc=new Set(vt.filter(e=>!Ve[e].defaultEnabled));function Ho(e,t){let n=new Set;for(let r of vt)(Ve[r].defaultEnabled?!e?.has(r):t?.has(r))||n.add(r);return n}function qe(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=wt(t),o=e;for(let{name:a,re:s}of Wn){let l=a;n.has(l)||(o=o.replace(s,c=>(r?.(l),i(c))))}for(let{name:a,re:s,normalize:l,validate:c}of Qn)n.has(a)||(o=ia(o,s,l,c,t,a,r));return o}function wt(e){return typeof e=="function"?e:()=>e}var Cn=e=>"\0".repeat(e.length);function Wo(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=yt(e);if(i.length===0)return qe(e,t,n,r);let o=new Set,a=f=>{o.add(f)},s=qe(e,Cn,n,a),l=!0,c=new Array(e.length).fill(!1);for(let f=0;f<e.length;f++)c[f]=s[f]==="\0"&&e[f]!=="\0";for(let f of i){let g=qe(f.text,Cn,n,a);for(let m=0;m<f.text.length;m++)if(!(g[m]!=="\0"||f.text[m]==="\0"))for(let p=f.offsets[m];p<f.offsets[m+1];p++)c[p]||(c[p]=!0,l=!1)}if(l)return qe(e,t,n,r);for(let f of o)r?.(f);let u="",d=0;for(;d<e.length;){if(!c[d]){u+=e[d],d++;continue}let f=d;for(;d<e.length&&c[d];)d++;u+=wt(t)(e.slice(f,d))}return u}function ke(e){return e===void 0||!/[A-Za-z0-9]/.test(e)}var xn=new Map;function Qo(e){let t=xn.get(e.source);return t===void 0&&(t=new RegExp(`^(?:${e.source})$`),xn.set(e.source,t)),t}var Yo=4096,Zo=64,On=null;function Jo(e){return On!==null?On:Yo+e.length*Zo}var Yn=!1,F={spanCalls:0,spanMisses:0,cutCalls:0,cutMisses:0,budgetExhausted:0,maxMissesInAPass:0},Zn={spanBudget:0,depthCap:0};function Xo(e){return{stride:e.length+1,chosen:new Map,cuts:new Map,budget:Jo(e),exhausted:!1}}function Jn(e,t,n,r,i,o,a){F.spanCalls++;let s=t*a.stride+n.length,l=Yn?void 0:a.chosen.get(s);if(l!==void 0)return l;if(a.budget<=0)return a.exhausted=!0,null;a.budget--,F.spanMisses++;let c=ea(e,t,n,r,i,o,a);return a.chosen.set(s,c),c}function ea(e,t,n,r,i,o,a){let s=Qo(r),l=[];for(let u=n.length-1;u>=1;u--)if(ke(n[u])){let d=n.slice(0,u);s.test(d)&&l.push(d)}let c=ke(e[t+n.length])?[n,...l]:[...l,n];for(let u of c)if(o(i(u),u)&&!na(e,t,u,r,i,o,a))return u;return null}var Nn=new Map;function ta(e){let t=Nn.get(e.source);return t===void 0&&(t=new RegExp(e.source,"y"),Nn.set(e.source,t)),t}function na(e,t,n,r,i,o,a){F.cutCalls++;let s=t*a.stride+n.length,l=Yn?void 0:a.cuts.get(s);if(l!==void 0)return l;if(a.budget<=0)return a.exhausted=!0,!0;a.budget--,F.cutMisses++;let c=ra(e,t,n,r,i,o,a);return a.cuts.set(s,c),c}function ra(e,t,n,r,i,o,a){let s=t+n.length,l=ta(r);for(let c=1;c<n.length;c++){if(ke(n[c])||!ke(n[c-1]))continue;let u=t+c;l.lastIndex=u;let d=l.exec(e);if(d===null||d[0].length===0)continue;let f=Jn(e,u,d[0],r,i,o,a);if(f!==null&&u+f.length>s&&ke(e[u+f.length]))return!0}return!1}function ia(e,t,n,r,i,o,a){let s=wt(i);t.lastIndex=0;let l="",c=0,u=Xo(e),d=F.spanMisses+F.cutMisses,f;for(;(f=t.exec(e))!==null;){let g=f[0],m=f.index;if(g.length===0){t.lastIndex=m+1;continue}let p;try{p=Jn(e,m,g,t,n,r,u)}catch(_){if(_ instanceof RangeError&&/call stack/i.test(_.message))u.exhausted=!0,p=null;else throw _}if(u.exhausted)return F.budgetExhausted++,Zn.spanBudget++,Mn(d),l+e.slice(c,m)+s(e.slice(m));if(p!==null)a?.(o),l+=e.slice(c,m)+s(p),c=m+p.length,t.lastIndex=c;else{let _=g.slice(1).search(/[^A-Za-z0-9]/);t.lastIndex=_===-1?m+g.length:m+1+_+1}if(t.lastIndex>e.length)break}return Mn(d),l+e.slice(c)}function Mn(e){let t=F.spanMisses+F.cutMisses-e;t>F.maxMissesInAPass&&(F.maxMissesInAPass=t)}function kt(e,t=Kn,n,r){return aa(e,t,Ho(n,r))}var oa=256;function aa(e,t,n){let r=new Set,i=!n.has("pan"),o=s=>{r.add(s)},a=(s,l)=>{if(l>oa)return Zn.depthCap++,t;if(typeof s=="string")return Wo(s,t,n,o);if(typeof s=="number"&&Number.isInteger(s)&&s>0){if(!i)return s;let c=String(s);return c.length>=13&&c.length<=19&>(c)?(r.add("pan"),t):s}if(Array.isArray(s))return s.map(c=>a(c,l+1));if(s!==null&&typeof s=="object"){let c=s,u={};for(let d of Object.keys(c))u[d]=a(c[d],l+1);return u}return s};return{value:a(e,0),detectors:[...r].sort()}}function Xn(e,t=Kn){return kt(e,t).value}function sa(e){let{value:t,detectors:n}=kt(e),r=n.some(i=>Ve[i].category==="secret");return{detectors:n,blocked:r,redacted:t}}function la(e,t){let{blocked:n,redacted:r,detectors:i}=sa(e);return n?t.failMode==="closed"?{verdict:"block",redacted:r,detectors:i}:{verdict:"redact",redacted:r,detectors:i}:{verdict:"allow",redacted:r,detectors:i}}function ca(e){if(typeof e!="string"||e.length===0)return e;let t=e.lastIndexOf("__");return t<0?e:e.slice(t+2)}var ua=new Set(["send","send_email","send_message","email","email_send","message","post","post_message","http_post","upload","export","export_data","share","publish","webhook"]);function da(e){return ua.has(ca(e))}function re(e,t,n){return n.enforced&&da(e)?la(t,{failMode:n.failMode}):{verdict:"allow",redacted:t,detectors:[]}}var pa=/[\u00AD\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFEFF]/g,er=Object.freeze({\u0430:"a",\u0435:"e",\u043E:"o",\u0440:"p",\u0441:"c",\u0443:"y",\u0445:"x",\u0456:"i",\u0455:"s",\u043A:"k",\u043C:"m",\u0442:"t",\u043D:"h",\u0432:"b",\u0433:"r",\u03BF:"o",\u03B1:"a",\u03C1:"p",\u03B9:"i",\u03C4:"t",\u03B5:"e",\u03BA:"k",\u03BD:"v",\u03C5:"u",\u03B7:"n",\u0131:"i","\u04CF":"l",\u0578:"n"}),fa=new RegExp(`[${Object.keys(er).join("")}]`,"gu"),ma=Object.freeze({4:"a","@":"a",3:"e",1:"i","!":"i",0:"o",5:"s",$:"s",7:"t",9:"g","(":"c",8:"b"}),tr="\u2801\u2803\u2809\u2819\u2811\u280B\u281B\u2813\u280A\u281A\u2805\u2807\u280D\u281D\u2815\u280F\u281F\u2817\u280E\u281E\u2825\u2827\u283A\u282D\u283D\u2835",ga=Object.freeze(Object.fromEntries([...tr].map((e,t)=>[e,String.fromCharCode(97+t)]))),ha=new RegExp(`[${tr}\u2800]`,"g"),nr=/[⠀-⣿]/;function ya(e){let t="";for(let n of e){let r=n.codePointAt(0);r!==void 0&&(r>=917536&&r<=917630?t+=String.fromCodePoint(r-917504):r>=917504&&r<=917631||(t+=n))}return t}function _a(e){return e.replace(pa,"")}function rr(e){return e.replace(fa,t=>er[t]??t)}function ba(e){return e.replace(/[4@31!05$79(8]/g,t=>ma[t]??t)}function va(e){return e.replace(/[a-zA-Z]/g,t=>{let n=t<="Z"?65:97;return String.fromCharCode((t.charCodeAt(0)-n+13)%26+n)})}function wa(e){return nr.test(e)?e.replace(ha,t=>t==="\u2800"?" ":ga[t]??t):e}function Dn(e){let t;try{t=ya(e)}catch{t=e}try{t=t.normalize("NFKC")}catch{}return t=_a(t),t=rr(t),t}var ka=/^[A-Za-z0-9+/]{16,}={0,2}$/,Aa=/^(?:[0-9a-fA-F]{2}\s*){8,}$/,Ln=/[A-Za-z0-9+/]{20,}={0,2}/g;function ht(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);(r===9||r===10||r===13||r>=32&&r<=126||r>=160&&r!==65533)&&t++}return t/e.length}var ir=new TextDecoder("utf-8",{fatal:!1});function or(e){let t;try{t=atob(e)}catch{return[]}let n=new Uint8Array(t.length);for(let i=0;i<t.length;i++)n[i]=t.charCodeAt(i)&255;let r=ir.decode(n);return t===r?[t]:[r,t]}function Ia(e){let t=e.replace(/\s+/g,"");if(t.length===0||t.length%2!==0)return[];let n=new Uint8Array(t.length/2);for(let o=0;o<n.length;o++){let a=Number.parseInt(t.slice(o*2,o*2+2),16);if(Number.isNaN(a))return[];n[o]=a}let r="";for(let o=0;o<n.length;o++)r+=String.fromCharCode(n[o]);let i=ir.decode(n);return r===i?[r]:[i,r]}function Fn(e){let t=e.trim(),n=[];if(Aa.test(t))for(let r of Ia(t))n.push({decoded:r,textiness:ht(r)});if(ka.test(t)&&t.length%4===0)for(let r of or(t))n.push({decoded:r,textiness:ht(r)});return n}function $n(e,t){let n=[],r;for(Ln.lastIndex=0;(r=Ln.exec(e))!==null&&n.length<t;){let i=r[0];if(i.length%4===0)for(let o of or(i))n.push({decoded:o,textiness:ht(o)})}return n}var Sa=Object.freeze({maxDepth:3,byteCap:262144,maxNodes:256,maxBlobsPerNode:8});function ar(e,t=Sa){if(typeof e!="string"||e.length===0)return{views:[],anyDecoded:!1,truncated:!1,nodes:0,maxDepthSeen:0};let{maxDepth:n,byteCap:r,maxNodes:i,maxBlobsPerNode:o}=t,a=new Set,s=g=>{g.length>0&&g.length<=r&&a.add(g)},l=!1,c=!1,u=0,d=0,f=[{s:e,depth:0}];for(;f.length>0;){if(u>=i){c=!0;break}let g=f.pop();if(g===void 0)break;let{s:m,depth:p}=g;if(m.length>r){c=!0;continue}u++,p>d&&(d=p);let _=Dn(m);s(_);let x=ba(_);if(x!==_&&s(x),s(va(_)),nr.test(m)&&s(wa(_)),p>=n){let T=Dn(m);(Fn(T).length>0||$n(T,o).length>0)&&(c=!0);continue}let A=[...Fn(_),...$n(_,o)];for(let T of A){if(l=!0,T.decoded.length>r){c=!0;continue}T.textiness>=.85&&T.decoded!==_?f.push({s:T.decoded,depth:p+1}):s(T.decoded)}}return{views:[...a],anyDecoded:l,truncated:c,nodes:u,maxDepthSeen:d}}var sr=["hidden_text_carrier","injected_turn_boundary","mixed_script_token","nested_encoding_payload"],Ea=Object.freeze(["hidden_text_carrier","injected_turn_boundary","mixed_script_token"]),Ta=8,Ra=new Set([173,8203,8204,8205,8206,8207,8288,65279,8234,8235,8236,8237,8238,8294,8295,8296,8297]),Pn=e=>e!==void 0&&(e>=65&&e<=90||e>=97&&e<=122);function Ca(e){let t=[...e].map(r=>r.codePointAt(0)),n=0;for(let r=0;r<t.length;r++){let i=t[r];if(i>=917504&&i<=917631||Ra.has(i)&&Pn(t[r-1])&&Pn(t[r+1])&&(n++,n>=Ta))return!0}return!1}var xa=/^[ \t]*(?:system|assistant|developer|user)[ \t]*:/i;function Oa(e){let t=e.split(/\r?\n/),n=!1;for(let r of t){if(xa.test(r)){if(n)return!0;continue}r.trim().length>0&&(n=!0)}return!1}var Na=[{name:"latin",lo:65,hi:591},{name:"greek",lo:880,hi:1023},{name:"cyrillic",lo:1024,hi:1279}];function Ma(e){for(let t of Na)if(e>=t.lo&&e<=t.hi)return t.name;return null}function Da(e){for(let t of e.split(/\s+/)){if(t.length<4)continue;let n=0,r=0,i=!0;for(let o of t){let a=Ma(o.codePointAt(0));if(a===null){i=!1;break}a==="latin"?n++:rr(o)!==o&&r++}if(i&&n>0&&r>0)return!0}return!1}var jn=Object.freeze({signals:[],contributes:!1});function La(e){if(typeof e!="string"||e.length===0)return{...jn,signals:[]};let t=new Set;try{Ca(e)&&t.add("hidden_text_carrier"),Oa(e)&&t.add("injected_turn_boundary"),Da(e)&&t.add("mixed_script_token");let{anyDecoded:n,maxDepthSeen:r,truncated:i}=ar(e);n&&(r>=2||i)&&t.add("nested_encoding_payload")}catch{return{...jn,signals:[]}}return{signals:[...sr.filter(n=>t.has(n))],contributes:Ea.some(n=>t.has(n))}}var Ke=[{name:"override_instructions",re:/\bignore (?:all |the )?(?:previous|above|prior) (?:instructions|prompts?)\b/i},{name:"disregard_instructions",re:/\bdisregard (?:the )?(?:above|previous|system)\b/i},{name:"role_tag",re:/<\/?(system|assistant|instructions|host_context)\b/i},{name:"privilege_override",re:/\b(grant|escalate|elevate) (admin|root|all|full) (access|privileges?)\b/i},{name:"tool_smuggle",re:/```[\s\S]*?(tool_call|function_call)/i}];function Bn(e){return typeof e!="string"||e.length===0?[]:Ke.filter(({re:t})=>t.test(e)).map(({name:t})=>t)}function Fa(e){if(typeof e!="string"||e.length===0)return[];let t=new Set(Bn(e)),{views:n}=ar(e);for(let r of n)for(let i of Bn(r))t.add(i);return Ke.filter(r=>t.has(r.name)).map(r=>r.name)}function $a(e){let t=new Set,n=new Set,r=!1,i=o=>{if(o!=null){if(typeof o=="string"){for(let s of Fa(o))t.add(s);let a=La(o);for(let s of a.signals)n.add(s);a.contributes&&(r=!0);return}if(Array.isArray(o)){for(let a of o)i(a);return}if(typeof o=="object")for(let a of Object.values(o))i(a)}};return i(e),{matched:t.size>0||r,signatures:Ke.filter(o=>t.has(o.name)).map(o=>o.name),structural:sr.filter(o=>n.has(o))}}function Pa(e){return $a(e).matched}var lc=Ke.map(e=>e.name);var ja=new Set(["untrusted","external","public","public_internet","external_third_party","web"]);var Ba="i:injection";function lr(e){let t=new Set;if(e.content!==void 0&&e.content!==null){let{detectors:i}=kt(e.content);for(let o of i){let a=Ve[o]?.category;a&&t.add(`c:${a}`)}Pa(e.content)&&t.add(Ba)}let n=e.resourceMetadata??{},r=n.source_trust;return(n.untrusted_source===!0||typeof r=="string"&&ja.has(r.toLowerCase()))&&t.add("i:untrusted"),[...t].sort()}var ft="(?:system\\s+prompt|initial\\s+(?:instructions|prompt)|system\\s+(?:instructions|message)|hidden\\s+(?:instructions|prompt)|your\\s+(?:system\\s+prompt|initial\\s+instructions|instructions|prompt)|the\\s+prompt\\s+(?:above|you\\s+were\\s+given))",cc=[{name:"reveal_prompt",re:new RegExp(`\\b(?:reveal|show|print|repeat|output|echo|display|expose|dump|leak|reprint|divulge|disclose)\\b[\\s\\S]{0,40}?\\b${ft}\\b`,"i")},{name:"what_is_prompt",re:new RegExp(`\\bwhat\\s+(?:is|are|were)\\b[\\s\\S]{0,20}?\\b${ft}\\b`,"i")},{name:"tell_me_prompt",re:new RegExp(`\\b(?:tell|give|send|show)\\s+me\\b[\\s\\S]{0,30}?\\b${ft}\\b`,"i")},{name:"repeat_above",re:/\b(?:repeat|print|output|echo|reproduce)\b[\s\S]{0,20}?\b(?:everything|all\s+(?:the\s+)?(?:text|words))\b[\s\S]{0,12}?\b(?:above|before|preceding|verbatim|word\s+for\s+word)\b/i}],Un="(?:instructions?|prompts?|rules?|directives?|guidelines?|constraints?|guardrails?)",Ua=`(?:(?:all\\s+|any\\s+|the\\s+|these\\s+|those\\s+)*(?:previous|prior|preceding|earlier|above|foregoing|initial|original|system|developer)\\s+${Un}|your\\s+(?:(?:system|initial|original|previous|prior|current)\\s+)?(?:${Un}|programming|training))`,qa="(?:(?:all|any|every|the|of|and|now|please|completely|entirely|totally|immediately)\\s+){0,3}",qn="(?:\\b(?:unrestricted|unfiltered|uncensored|unbounded|unlimited|unchained|jailbroken|lawless|amoral)\\b|\\b(?:DAN|STAN|DUDE|AIM)\\b|\\bno\\s+(?:longer\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|boundaries|constraints?)\\b(?!\\s+(?:on|over|regarding|upon|for)\\b)|\\bwithout\\s+(?:any\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|constraints?|censorship)\\b|\\b(?:free|freed|released)\\s+from\\s+(?:your\\s+)?(?:restrictions?|limits?|rules?|guidelines?|guardrails?|programming|constraints?)\\b|\\b(?:can|will|are\\s+able\\s+to)\\s+(?:do|say)\\s+anything\\b|\\bignore\\s+(?:all\\s+)?(?:your\\s+)?(?:previous\\s+|prior\\s+|system\\s+)?(?:instructions?|rules?|guidelines?)\\b)",za="(?:ignore|disregard|forget|override|overrule|bypass|obey|comply\\s+with|follow\\s+(?:only|my|these))",uc=[{name:"override_instructions",re:new RegExp(`\\b(?:ignore|disregard|forget|discard|override|overrule|bypass|delete|erase)\\s+${qa}${Ua}\\b`,"i")},{name:"forget_everything_prior",re:/\b(?:forget|ignore|disregard|erase|discard)\s+(?:about\s+|all\s+|any\s+)?(?:everything|anything)\b[\s\S]{0,24}?\b(?:above|before|previously|prior|earlier|you\s+(?:were|have\s+been)\s+(?:told|instructed|given|programmed))\b/i},{name:"persona_reassignment_jailbreak",re:new RegExp(`\\byou\\s+are\\s+now\\s+(?:(?:a|an|the)\\s+)?[\\s\\S]{0,48}?${qn}`,"i")},{name:"constraint_release",re:/\byou\s+are\s+no\s+longer\s+(?:bound|restricted|limited|constrained|obligated|governed|subject\s+to|required\s+to)\b/i},{name:"from_now_on_reassignment",re:new RegExp(`\\bfrom\\s+now\\s+on\\s*,?\\s+you\\s+(?:are|will|must|shall|have|can)\\s+(?:${za}\\b|[\\s\\S]{0,40}?${qn})`,"i")},{name:"new_instructions_header",re:/^\s*(?:[#*>-]+\s*)?(?:new|real|actual|true|secret|hidden|override)\s+(?:system\s+)?(?:instructions?|prompts?|directives?)\s*:/im}];var dc=Object.freeze({"\u2019":"'",\u02BC:"'","\uFF07":"'","\u02B9":"'","\u2032":"'"});var z=e=>`[^.!?;\\n]{0,${e}}?`,Va=["\\bi\\s+(?:can'?t|cannot|can\\s+not|won'?t|will\\s+not)\\b","\\bi(?:'m|\\s+am)\\s+(?:not\\s+able\\s+to|unable\\s+to|not\\s+going\\s+to|not\\s+permitted\\s+to|not\\s+allowed\\s+to)\\b"].join("|"),cr="(?:help|assist|provide|create|generate|produce|write|compose|draft|comply|fulfil|fulfill|share|disclose|reveal|perform|execute|run|send|transmit|publish|export|approve|grant|carry\\s+out|do\\s+that|do\\s+this|do\\s+so|go\\s+ahead)",pc=Object.freeze([{id:"capability_denial",class:"strong",re:new RegExp([`(?:${Va})\\s${z(40)}\\b${cr}\\b`,"\\b(?:that|this|it)(?:'s|\\s+is)\\s+not\\s+something\\s+i\\s+(?:can|could|am\\s+able\\s+to|'m\\s+able\\s+to)\\b",`\\b(?:falls|sits|is)\\s+outside\\s+(?:of\\s+)?(?:what|the\\s+(?:scope|range|bounds))\\b${z(40)}\\bi\\s+(?:can|am|'m)\\b`,"\\bnot\\s+something\\s+i(?:'m|\\s+am)\\s+(?:able|willing|permitted|allowed)\\s+to\\b"].join("|"),"i")},{id:"explicit_decline",class:"strong",re:new RegExp(["\\bi\\s+(?:must|have\\s+to|need\\s+to|will\\s+have\\s+to|am\\s+going\\s+to|'m\\s+going\\s+to)\\s+(?:respectfully\\s+)?decline\\b","\\bi(?:'m|\\s+am)\\s+not\\s+(?:comfortable|willing|prepared)\\b","\\bi(?:'ll|\\s+will)\\s+(?:have\\s+to\\s+)?pass\\s+on\\b","\\bi\\s+(?:must|have\\s+to)\\s+refuse\\b"].join("|"),"i")},{id:"policy_citation",class:"strong",re:new RegExp([`\\b(?:against|contrary\\s+to|prohibited\\s+by|forbidden\\s+by|in\\s+violation\\s+of|violates)\\s${z(24)}\\b(?:polic(?:y|ies)|guidelines?|terms\\s+of\\s+(?:use|service)|rules\\s+of\\s+engagement|code\\s+of\\s+conduct)\\b`,`\\b(?:my|our|the|company|organi[sz]ation'?s?)\\s+(?:polic(?:y|ies)|guidelines?)\\s${z(24)}\\b(?:do(?:es)?\\s+not\\s+(?:allow|permit)|prohibit|forbid|prevent)\\b`,`\\bnot\\s+(?:permitted|allowed|authori[sz]ed)\\s+(?:under|by)\\s${z(24)}\\b(?:polic(?:y|ies)|guidelines?)\\b`].join("|"),"i")},{id:"guardrail_selfreference",class:"strong",re:new RegExp(["\\bi(?:'ve|\\s+have)\\s+been\\s+(?:instructed|configured|told|trained)\\s+not\\s+to\\b","\\bi(?:'m|\\s+am)\\s+(?:designed|configured|programmed|built|set\\s+up)\\s+not\\s+to\\b",`\\bmy\\s+(?:safety\\s+)?(?:instructions|configuration|guardrails?|constraints|training)\\s${z(24)}\\b(?:prevent|prohibit|forbid|do(?:es)?\\s+not\\s+(?:allow|permit)|preclude)\\b`,"\\b(?:outside|beyond)\\s+(?:my|the)\\s+(?:permitted|authori[sz]ed|configured|approved)\\s+(?:scope|remit|capabilities|actions|operations)\\b"].join("|"),"i")},{id:"ethical_objection",class:"strong",re:new RegExp(["\\b(?:that|this|doing\\s+(?:so|that)|what\\s+you(?:'re|\\s+are)\\s+asking|the\\s+request|such\\s+a\\s+request)\\s+(?:would\\s+be|is|are)\\s+(?:clearly\\s+|both\\s+|potentially\\s+)?(?:illegal|unethical|unlawful|harmful|fraudulent)\\b","\\bi\\s+(?:do\\s+not|don'?t)\\s+condone\\b","\\b(?:goes|would\\s+go|runs)\\s+against\\s+my\\s+(?:principles|values|ethics)\\b","\\bi\\s+(?:can'?t|cannot|won'?t)\\s+in\\s+good\\s+conscience\\b"].join("|"),"i")},{id:"apology_marker",class:"weak",re:new RegExp("\\b(?:i(?:'m|\\s+am)\\s+(?:really\\s+|very\\s+|terribly\\s+|so\\s+)?sorry|i\\s+apologi[sz]e|my\\s+apologies)\\b","i")}]),fc=Object.freeze([/```/,/\b(?:here(?:'s|\s+is|\s+are)|below\s+(?:is|are|you(?:'ll|\s+will)\s+find)|the\s+following\s+(?:is|are))\b/i,new RegExp(`\\b(?:but|however|instead|although|that\\s+said)\\b${z(60)}\\b(?:i\\s+(?:can|could)(?!'t)\\s${z(30)}\\b${cr}\\b|i(?:'d|\\s+would)\\s+be\\s+happy\\s+to\\b|i(?:'m|\\s+am)\\s+able\\s+to\\b)`,"i"),/\bwhat\s+i\s+can\s+do\s+(?:instead|is|for\s+you)\b/i]);var we=e=>`[^.!?;\\n]{0,${e}}?`,mc=Object.freeze([{id:"vulnerability_scanning",objectPatterns:[/\b(?:vulnerability|vuln|security)\s+(?:scan|scans|scanning|assessment|audit|test|testing)\b/i,/\bpen(?:etration)?[\s-]?test(?:ing)?\b/i,/\bport\s+scan(?:ning)?\b/i,/\b(?:exploit|nmap|metasploit|nessus|burp\s+suite)\b/i,/\bCVE-\d{4}-\d{4,7}\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|vulnerability|incident\s+respon\w{0,4}|threat|soc|red\s+team|phishing|malware)\b/i]},{id:"credential_access",objectPatterns:[/\b(?:credential|password|passphrase|api\s+key|access\s+key|secret|token|private\s+key|ssh\s+key)s?\b/i,/\b(?:vault|secrets?\s+manager|keychain|keystore)\b/i,/\bservice\s+account\s+key\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|identity|iam|credential|secrets?\s+manage\w{0,4}|vault|platform|devops)\b/i]},{id:"financial_transaction",objectPatterns:[/\b(?:wire\s+transfer|bank\s+transfer|payout|disbursement|chargeback)\b/i,new RegExp(`\\b(?:approve|issue|initiate|process|release)\\s${we(20)}\\b(?:payment|refund|invoice|transfer|purchase\\s+order)s?\\b`,"i"),new RegExp(`\\b(?:move|transfer)\\s${we(20)}\\b(?:funds|money)\\b`,"i")],purposeFunctions:["finance_accounting","procurement"],purposePatterns:[/\b(?:finance|financial|accounting|invoice|invoicing|payment|payments|billing|refund|refunds|treasury|procurement|spend|purchasing|fraud|kyc)\b/i]},{id:"personnel_data",objectPatterns:[/\b(?:employee|personnel|payroll|hr|staff)\s+(?:record|records|data|file|files|information|details)\b/i,/\b(?:salary|salaries|compensation|performance\s+review|termination\s+letter)s?\b/i,/\b(?:home\s+address|social\s+security\s+number|national\s+insurance\s+number)e?s?\b/i],purposeFunctions:["hr","privacy_compliance"],purposePatterns:[/\b(?:hr|human\s+resources|people\s+ops|payroll|benefits|recruit\w{0,4}|onboarding|privacy|dsar|consent)\b/i]},{id:"regulated_advice",objectPatterns:[/\b(?:legal|medical|tax|investment|financial)\s+advice\b/i,/\bpractis\w{0,3}\s+law\b/i,/\b(?:diagnose|diagnosis|prescribe|prescription)\b/i,/\b(?:binding|enforceable)\s+(?:opinion|interpretation)\b/i],purposeFunctions:["legal","privacy_compliance"],purposePatterns:[/\b(?:legal|compliance|counsel|contract|contracts|litigation|nda|privacy|regulator\w{0,2}|audit\w{0,3})\b/i]},{id:"data_export",objectPatterns:[new RegExp(`\\b(?:export|download|dump|extract|exfiltrat\\w{0,3}|bulk\\s+copy)\\b\\s${we(30)}\\b(?:data|database|dataset|records?|table|tables|customer\\s+list|contact\\s+list|report)\\b`,"i"),/\b(?:full|entire|whole)\s+(?:database|dataset|customer\s+table)\b/i],purposeFunctions:["operations","engineering","privacy_compliance"],purposePatterns:[/\b(?:data\s+(?:pipeline|engineering|platform)|etl|export|reporting|analytics|operations|document\s+extract\w{0,3}|forecast\w{0,3})\b/i]},{id:"code_execution",objectPatterns:[new RegExp(`\\b(?:run|execute|invoke)\\s${we(24)}\\b(?:script|scripts|command|commands|shell|code|binary|query|migration)\\b`,"i"),/\b(?:shell|root|sudo|admin)\s+(?:access|command|session)\b/i,/\bagainst\s+(?:the\s+)?production\s+(?:system|server|database|environment)s?\b/i],purposeFunctions:["engineering","it_security"],purposePatterns:[/\b(?:engineering|developer|devops|platform|release|deploy\w{0,4}|build|pipeline|sandbox|test\s+data|change\s+window)\b/i]},{id:"external_communication",objectPatterns:[new RegExp(`\\b(?:send|post|publish|email|tweet|message|broadcast)\\b\\s${we(30)}\\b(?:external|customer|customers|public|press|social\\s+media|third[\\s-]party|prospect|prospects)\\b`,"i"),/\b(?:cold\s+outreach|marketing\s+blast|phishing\s+email|press\s+release)\b/i],purposeFunctions:["marketing","sales","customer_support"],purposePatterns:[/\b(?:marketing|campaign|outreach|email\s+assistant|support|customer|sales|lead|leads|communication|communications)\b/i]}]);var At="[REDACTED]",ne="\u2022",ze=e=>/[\p{L}\p{N}]/u.test(e);function ur(e,t,n,r){let i=Array.from(e),o=i.length,a=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:ne,c=a+s>=o;return i.map((u,d)=>!c&&(d<a||d>=o-s)?u:ze(u)?l:u).join("")}function Ka(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return ur(e,0,0,t);let r=e.slice(0,n),i=e.slice(n),o=t.length>0?t:ne;return(r.length<=1?o:r[0]+Array.from(r.slice(1)).map(a=>ze(a)?o:a).join(""))+i}function Ga(e,t,n){let r=n.length>0?n:ne,i=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let c=new RegExp(t,"g"),u;for(;(u=c.exec(e))!==null;){if(u[0].length===0){c.lastIndex++;continue}for(let d=u.index;d<u.index+u[0].length;d++)i[d]=!0}}catch{}let o=!1,a=!0;for(let c=0;c<e.length;c++)if(ze(e[c])&&(o=!0,!i[c])){a=!1;break}let s=o&&a,l="";for(let c=0;c<e.length;c++){let u=e[c];!s&&i[c]||!ze(u)?l+=u:l+=r}return l}function dr(e,t){let n=t.mode??"full";return n==="partial"?ur(e,t.keepFirst??0,t.keepLast??0,t.maskChar??ne):n==="email"?Ka(e,t.maskChar??ne):n==="custom"?Ga(e,t.keepPattern,t.maskChar??ne):t.replacement??At}function Ha(e,t){return typeof e=="string"?dr(e,t):t.replacement??At}function pr(e){let t=[],n=e.replacement??At;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:mt(r),replacer:()=>n});for(let r of e.directives??[]){let{pattern:i}=r;typeof i!="string"||i.length===0||t.push({source:mt(i),replacer:o=>dr(o,r)})}return t}function fr(e){try{return new RegExp(e,"g")}catch(t){let n=t instanceof Error?t.message:String(t);throw new Error(`[visiq-redact] Invalid redaction pattern "${e}": ${n}`)}}function mr(e,t){if(yt(e).length===0){let n=e;for(let{source:r,replacer:i}of t)n=n.replace(fr(r),o=>i(o));return n}return Wa(e,t)}function Wa(e,t){let n=e;for(let{source:r,replacer:i}of t){let o=fr(r),a=[...Rn(o,n)];for(let u of yt(n))for(let d of Rn(o,u.text))a.push(So(u,d));let s=Eo(a);if(s.length===0)continue;let l="",c=0;for(let{start:u,end:d}of s)l+=n.slice(c,u)+i(n.slice(u,d)),c=d;n=l+n.slice(c)}return n}function M(e,t){return e==null?e:typeof e=="string"?Qa(e,t):typeof e=="object"?Ya(e,t):e}function Qa(e,t){if(typeof e!="string")return e;let n=pr(t);return n.length===0?e:mr(e,n)}function Ya(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=pr(t),i=n.size>0,o=r.length>0,a=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>a(l));if(typeof s=="object"){let l=s,c=Object.create(Object.getPrototypeOf(l));for(let u of Object.keys(l)){let d=i?n.get(u):void 0;if(d){c[u]=Ha(l[u],d);continue}c[u]=a(l[u])}return c}return typeof s=="string"&&o?mr(s,r):s};return a(e)}var gr=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function Za(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:gr(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:gr(t.spawn.prompt)}),t}function Ja(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var Xa=1440*60*1e3,es="VISIQ_BUNDLE_GRACE_TTL_MS",ts="VISIQ_BUNDLE_CACHE_DISABLED",ns="VISIQ_CACHE_DIR",rs=Ge.object({graceTtlMs:Ge.number().int().nonnegative().optional(),disabled:Ge.boolean().optional(),cacheDir:Ge.string().min(1).optional()}).strict();function is(e){return e==null?{}:rs.parse(e)}function os(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[es];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return Xa}function as(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[ts]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var hr;function ss(){if(hr!==void 0)return hr;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function ls(e){return JSON.stringify(St(e))}function St(e){if(Array.isArray(e))return e.map(St);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=St(t[r]);return n}return e}function cs(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function us(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function kr(){if(!ss())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function Ar(e,t){return e.createHash("sha256").update(ls(t)).digest("hex")}function ds(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[ns]?.trim();if(r)return r;let i=process.env.XDG_CACHE_HOME?.trim();if(i)return e.path.join(i,"visiq");let o="";try{o=e.os.homedir()}catch{o=""}return o?e.path.join(o,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function ps(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function Ir(e,t,n){return e.path.join(ds(e,n),"bundles",`${ps(e,t)}.json`)}async function fs(e,t,n,r={}){let i=await kr();if(i)try{let o=Ir(i,e,r),a=i.path.dirname(o);await i.fs.mkdir(a,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:Ar(i.crypto,t),body:t},l=`${o}.tmp-${process.pid}-${i.crypto.randomBytes(6).toString("hex")}`;await i.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await i.fs.rename(l,o)}catch(c){throw await i.fs.rm(l,{force:!0}).catch(()=>{}),c}}catch{}}async function ms(e,t={}){let n=await kr();if(!n)return null;try{let r=await n.fs.readFile(Ir(n,e,t),"utf-8"),i=us(JSON.parse(r));return!i||Ar(n.crypto,i.body)!==i.contentHash?null:i}catch{return null}}var Ae;async function gs(){if(Ae!==void 0)return Ae;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;Ae=typeof t=="function"?t:null}catch{Ae=null}return Ae}function hs(e){let t=[];for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,i=r.rego_source;if(typeof i!="string"||i.length===0)continue;let o;try{o=dt(i)}catch{continue}let a=typeof r.id=="string"?r.id:"<rule>";for(let s of sn(o))t.push(`${a}: ${s}`)}return t}function ys(e){return Sn(e)}function _s(e){return e==null||typeof e!="object"?!0:Object.keys(e).length===0}var bs=5e3,vs=600*1e3,ws=1e4,ks=25,yr=1e3,As=5e3,Is=100,_r=2e3,Ss=10,Es=512,Ts=1800*1e3,Rs=.7,Cs="monitor",xs="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",br="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",He="open";function Ie(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function Os(e,t){return lr({content:e,resourceMetadata:t})}var Ns=y.object({operations:y.array(y.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:y.string().min(1,"agentId is required"),sessionId:y.string().min(1).max(255).optional(),toolName:y.string().optional(),toolArgs:y.record(y.unknown()).optional(),targetResource:y.string().optional(),resourceType:y.string().optional(),resourceMetadata:y.record(y.unknown()).optional(),normalized:y.record(y.unknown()).optional(),query:y.string().optional(),contentPreview:y.string().optional(),telemetry:y.record(y.unknown()).optional(),context:y.record(y.unknown()).optional(),mcpServer:y.string().min(1).max(255).optional()}),Ms=y.object({version:y.string().min(1),dialect_version:y.number().int().optional(),min_dialect:y.number().int().optional(),shutdown:y.boolean().optional(),agent_mode:y.enum(["enforce","monitor","off"]).optional(),cognition_capture:y.boolean().optional(),agent_mode_by_operation:y.object({action:y.string().optional(),retrieval:y.string().optional(),delegation:y.string().optional()}).partial().optional(),agent_attributes:y.object({trust_tier:y.string().nullable().optional(),categories:y.array(y.string()).optional(),business_function:y.string().nullable().optional(),business_functions:y.array(y.string()).nullable().optional(),blast_radius_tier:y.string().nullable().optional(),no_coverage:y.string().nullable().optional(),fail_mode:y.string().nullable().optional()}).optional(),rules:y.array(y.record(y.unknown())),action_schemas:y.array(y.object({id:y.string(),plane:y.string().optional(),field_mappings:y.array(y.record(y.unknown())).optional(),derived_fields:y.array(y.record(y.unknown())).optional(),action_class:y.string().nullable().optional(),action_class_confidence:y.number().optional()})).optional(),no_coverage:y.object({no_coverage_defaults:y.record(y.string()),autopilot_enabled:y.boolean(),enduser_hitl_enabled:y.boolean(),hitl_timeout_seconds:y.number().optional()}).optional()});function Ds(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=bn(vn(n));return{trust_tier:cn(t)?t:null,categories:dn(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&wn(e.blast_radius_tier)?e.blast_radius_tier:null}}function Ls(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function Fs(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var Et=new Set,vr=!1;async function wr(e){let t=[];for(let n of Et){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function $s(){if(!vr&&!(typeof process>"u"||typeof process.once!="function")){vr=!0,process.once("beforeExit",()=>{wr(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await wr(!0)}finally{process.kill(process.pid,e)}})()})}}var Sr=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=Cs;agentModeByOperation=null;rawBundle=null;normalizedRefs={retrieval:[],action:[],delegation:[]};warnedNormalizedAbsent=!1;warnedNormalizedDrift=!1;lastNormalizedWarnRearmMs=0;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;failMode=Ie(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??He;governedFailMode=null;telemetryBuffer=[];telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;lastCloneCaptureSig=null;toolDescriptions=new Map;constructor(e,t,n,r,i,o,a,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,c=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,u=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=c,this.resolvedAgentId=u,this.harnessKind=r,this.sdkVersion=o,this.sdkDialect=a,this.originalFetch=globalThis.fetch.bind(globalThis);let d=is(s);if(this.bundleCacheDisabled=as(d.disabled),this.bundleGraceTtlMs=os(d.graceTtlMs),this.bundleCacheDirOverride=d.cacheDir,this.cacheIdentity=l&&c&&!this.bundleCacheDisabled?{endpoint:c,agentId:u,apiKey:l}:null,l&&c){let f={apiKey:l,agentId:u,endpoint:c,mode:"enforce",timeoutMs:Ja(i),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...o!==void 0?{sdkVersion:o}:{},...a!==void 0?{sdkDialect:a}:{}};this.client=new lt(f,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},bs),It(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},ws),It(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},As),It(this.cognitionTimer),Et.add(this),$s()}else this.client=null}async evaluate(e){let t=Ns.parse(e),n=Date.now();if(this.operatorShutdown){let g=this.denyAll(t,xs);return this.applyAgentMode(g,"enforce",t,n)}if(this.dialectRefused){if(this.failMode==="open")return this.failOpen(t,br,n);let g=this.denyAll(t,br);return this.applyAgentMode(g,"enforce",t,n)}if(t.operations.every(g=>this.modeFor(g)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let g;if(this.agentModeConfirmed?g=this.agentMode:this.bundleApplyFailed?g="enforce":g="monitor",g==="enforce"&&this.failMode==="open")return this.failOpen(t,"no unified bundle loaded and no local rules",n);let m=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(m,g,t,n)}let r=this.readSession(t.sessionId),i=await gs();if(!i||!this.rawBundle){if(this.failMode==="open")return this.failOpen(t,"governance core (@visiq/core-wasm) unavailable",n);throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)")}let o=t.operations.includes("action")||t.operations.includes("delegation")?fn(t.normalized??{},{targetApp:t.targetResource??t.toolName??""}):t.normalized,a=this.buildActionSchemaEvent(t),s=t.mcpServer?{...o??{},mcp_server:t.mcpServer}:o,l={...t,normalized:s,session:r,at:Date.now(),action_schema_id:a.id,action_schema_raw:a.canonical},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},u;try{u=i(l,c)}catch(g){if(this.failMode==="open")return this.failOpen(t,`governance core evaluation threw: ${g instanceof Error?g.message:String(g)}`,n);throw g}let d=[...new Set(t.operations.flatMap(g=>this.normalizedRefs[g]??[]))].sort();d.length>0&&_s(t.normalized)&&(u.normalizedColdStart=d,this.warnedNormalizedAbsent||(this.warnedNormalizedAbsent=!0,console.warn(`[UNIFIED] no normalized event supplied, but ${d.length} loaded rule condition(s) on this event's operation(s) read input.normalized.* \u2014 those conditions resolve to undefined here, so a deny carrying one does not fire. (Builtin-derived paths such as context/app_category ARE still populated in-core, so this is a dependency report, not a proof that every listed condition was the decider.) Cold start / no action-schema mapping yet. Affected: ${d.slice(0,5).join("; ")}${d.length>5?`; +${d.length-5} more`:""}`)));let f=mn(t.normalized);return f.length>0&&(u.normalizedDrift=f,this.warnedNormalizedDrift||(this.warnedNormalizedDrift=!0,console.warn(`[UNIFIED] normalized event carries ${f.length} value(s) outside the canonical vocabulary \u2014 a builder-authored rule can only select in-vocab values, so these cannot match one, so a rule keyed on the canonical value does not fire here. Check the harness classifier's casing/spelling. Affected: ${f.slice(0,5).join("; ")}${f.length>5?`; +${f.length-5} more`:""}`))),this.foldSession(t,u.enforced?u.decision:"permit"),u.enforced&&u.action.decision==="approval_required"&&await this.registerHitl(t,u),this.bufferTelemetry(t,u,Date.now()-n,u.enforced),u}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}readSession(e){if(!e)return ve;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>Ts?(this.sessions.delete(e),ve):t.state:ve}foldActionClass(e){let t=e.normalized?.action_class;if(typeof t=="string"&&t.length>0)return t;let n=this.rawBundle?.action_schemas;if(!Array.isArray(n))return;let{id:r}=this.buildActionSchemaEvent(e),i=n.find(s=>s?.id===r);if(!i)return;let o=i.action_class,a=typeof i.action_class_confidence=="number"?i.action_class_confidence:0;if(typeof o=="string"&&o.length>0&&a>=Rs)return o}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),i=e.resourceMetadata??{},o=e.operations.includes("retrieval"),a=e.operations.includes("action")||e.operations.includes("delegation"),s=hn(r===ve?gn():r,{data_categories:o&&Array.isArray(i.data_categories)?i.data_categories:void 0,classification:o?i.classification:void 0,taint:o?Os(e.contentPreview,i):void 0,action_class:a?this.foldActionClass(e):void 0,target_app:a?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:s,touchedAt:Date.now()}),this.sessions.size>Es){let l=this.sessions.keys().next().value;l!==void 0&&this.sessions.delete(l)}}applyAgentMode(e,t,n,r){let i=Date.now()-r;if(t==="enforce"){let a={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,a,i,!0),a}let o={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,o,i,!1),o}setFailMode(e){this.failMode=e}getFailMode(){return this.failMode}getGovernedFailMode(){return this.governedFailMode}failOpen(e,t,n){let r=`fail-open: ${t} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`;console.error(`[VisIQ] FAIL-OPEN: ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`);let i=e.operations.includes("action")||e.operations.includes("delegation"),o=e.operations.includes("retrieval"),a={decision:"permit",allowed:!0,reason:r,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:i?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:o?{action:"allow"}:{action:null},failOpen:!0};return this.bufferTelemetry(e,a,Date.now()-n,!1,!0),a}reportFailOpen(e,t){try{let n={operations:["action"],agentId:this.resolvedAgentId,...t?.toolName?{toolName:t.toolName}:{},...t?.sessionId?{sessionId:t.sessionId}:{}},r={decision:"permit",allowed:!0,reason:`fail-open: ${e} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:{decision:"permit",allowed:!0},retrieval:{action:null},failOpen:!0};this.bufferTelemetry(n,r,0,!1,!0)}catch{}}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},action_schema_id:this.buildActionSchemaEvent(e).id,...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=Ms.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}let r=hs(t.rules);if(r.length>0){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle contains rego_source using a builtin the engine cannot evaluate (would silently never match \u2192 fail open): ${r.join("; ")}. Refusing the bundle and failing closed (G001). Recompile the rule without case-folding wrappers like upper()/lower().`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(i=>In(i)).filter(i=>i!==null),this.agentAttributes=t.agent_attributes?Ds(t.agent_attributes):null,this.agentNoCoverage=kn(t.agent_attributes?.no_coverage),this.governedFailMode=Ie(t.agent_attributes?.fail_mode)??null,this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=Ls(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.normalizedRefs=ys(this.rules),this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1,this.lastNormalizedWarnRearmMs=Date.now(),this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...W(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304){let a=Date.now();a-this.lastNormalizedWarnRearmMs>=vs&&(this.lastNormalizedWarnRearmMs=a,this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1);return}if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),i=await n.json();this.applyBundle(i);let o=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&o?this.bundleEtag=r:o||(this.bundleEtag=null),o&&await this.persistBundleToDisk(i)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await ms(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(cs(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await fs(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}isBundleLoaded(){return this.bundleLoaded}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e,t){this.registerEnvironment({...$e(),...e?{agent_type:e}:{},...t?.model?{model:t.model}:{},...t?.systemPrompt?{systemPrompt:t.systemPrompt}:{},...t?.toolSchemas&&t.toolSchemas.length>0?{toolSchemas:t.toolSchemas}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));for(let n of e)n.description&&this.toolDescriptions.set(n.name,n.description);t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}captureCloneMetadata(e){if(!this.client||!this.resolvedAgentId||!(e.model||e.systemPrompt||(e.toolSchemas?.length??0)>0))return;let t=JSON.stringify({m:e.model??"",s:e.systemPrompt??"",t:e.toolSchemas??[]});t!==this.lastCloneCaptureSig&&(this.lastCloneCaptureSig=t,this.client.registerEnvironment({...$e(),...e.agentType?{agent_type:e.agentType}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{systemPrompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{toolSchemas:e.toolSchemas}:{}}))}buildActionSchemaEvent(e){let t=e.toolName?this.toolDescriptions.get(e.toolName):void 0,n={agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{},...e.toolArgs?{tool_args:e.toolArgs}:{},...t?{tool_description:t}:{}},r=An(n),i={...n};return e.toolArgs&&(i.tool_args=Xn(e.toolArgs)),{canonical:n,id:r,rawEventForWire:i}}bufferTelemetry(e,t,n,r,i=!1){let o=this.buildActionSchemaEvent(e);this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?Fs(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:o.rawEventForWire,action_schema_id:o.id,...this.harnessKind||e.context||i||t.normalizedColdStart||t.normalizedDrift?{context:{...this.harnessKind?{[Qt]:this.harnessKind}:{},...e.context??{},...i?{fail_open:!0}:{},...t.normalizedColdStart?{normalized_cold_start:!0,normalized_inert_conditions:t.normalizedColdStart.length}:{},...t.normalizedDrift?{normalized_drift:!0,normalized_drift_values:t.normalizedDrift.length,normalized_drift_fields:t.normalizedDrift.slice(0,Ss)}:{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=ks&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0);try{await this.client.sendTelemetry(e)}catch(t){console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",t)}}enforceTelemetryCap(){let e=this.telemetryBuffer.length-yr;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${yr})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(Za(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=Is&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-_r;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${_r})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}await this.flushTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),Et.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function It(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function Ps(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function $(e,...t){for(let n of t){let r=Ps(e[n]);if(r)return r}}var js=[{framework:"openai-agents",matches:e=>/^transfer_to_.+/.test(e),extract:(e,t)=>{let n=e.replace(/^transfer_to_/,"");return{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"teammate",task:$(t,"task","input","reason","message"),source:"structural"}}},{framework:"voltagent",matches:e=>e==="delegate_task",extract:(e,t)=>{let n=$(t,"targetAgent","agent","subAgent","agentName","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:$(t,"task","message","input"),description:$(t,"purpose"),source:"structural"}:null}},{framework:"crewai",matches:e=>/delegate work to (co-?worker|.+)/i.test(e),extract:(e,t)=>{let n=$(t,"coworker","agent","role");return n?{childAgentId:n,childName:n,kind:"teammate",agentType:n,task:$(t,"task","question"),description:$(t,"context"),source:"structural"}:null}},{framework:"llamaindex",matches:e=>e==="handoff"||/handoff/i.test(e),extract:(e,t)=>{let n=$(t,"to_agent","toAgent","agent_name","agentName","agent","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:$(t,"reason","task","message"),source:"structural"}:null}},{framework:"generic",matches:e=>/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)([_-].+)?$/i.test(e),extract:(e,t)=>{let n=$(t,"agent","agentName","agentId","target","targetAgent","to","to_agent","coworker","name")??(/[_-]/.test(e)?e.replace(/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)[_-]/i,""):void 0);return n?{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"subagent",task:$(t,"task","message","input","reason","prompt"),source:"heuristic"}:null}}];function We(e,t){if(!e)return null;let n=t??{};for(let r of js)try{if(r.matches(e)){let i=r.extract(e,n);if(i)return i}}catch{}return null}function Qe(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}function Tt(e){if(e===null||typeof e!="object"||Array.isArray(e))return{input:e===void 0?"":String(e)};let t=e,n=Object.keys(t);return n.length===1&&n[0]==="context"&&t.context!==null&&typeof t.context=="object"?t.context:t}function Er(e){if(typeof e=="string"){try{let t=JSON.parse(e);if(t!==null&&typeof t=="object"&&!Array.isArray(t))return t}catch{}return{input:e}}return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:{input:e===void 0?"":String(e)}}function D(e){let t=[],n=[],r,i=[];for(let a of e){if(a.mode==="partial"||a.mode==="email"||a.mode==="custom"){let l={mode:a.mode};a.field&&(l.field=a.field),a.pattern&&(l.pattern=a.pattern),typeof a.keepFirst=="number"&&(l.keepFirst=a.keepFirst),typeof a.keepLast=="number"&&(l.keepLast=a.keepLast),a.maskChar&&(l.maskChar=a.maskChar),a.keepPattern&&(l.keepPattern=a.keepPattern),a.replacement!==void 0&&(l.replacement=a.replacement),i.push(l);continue}a.field&&t.push(a.field),a.pattern&&n.push(a.pattern);let{replacement:s}=a;s&&r===void 0&&(r=s)}let o={};return t.length>0&&(o.fields=t),n.length>0&&(o.patterns=n),r!==void 0&&(o.replacement=r),i.length>0&&(o.directives=i),o}var V="0.2.14";import{AsyncLocalStorage as Bs}from"node:async_hooks";var C=new Bs,Us=5120,Tr=50;function qs(e,t){if(typeof e!="string")return"";let n=new TextEncoder,r=n.encode(e);if(r.length<=t)return e;let o=`\u2026[truncated ${Math.ceil(r.length/1024)}KB]`,a=n.encode(o).length,s=Math.max(0,t-a),l=r.subarray(0,s);return new TextDecoder("utf-8",{fatal:!1}).decode(l)+o}function K(e){if(!e)return;let t=r=>r.length<=Tr?r.slice():r.slice(r.length-Tr),n=r=>qs(r,Us);return{session_id:e.session_id,llm_prompts:t(e.llm_prompts).map(n),llm_responses:t(e.llm_responses).map(n),agent_reasoning:t(e.agent_reasoning).map(n)}}var Rt=12e4,Rr=2e3,Cr=3,zs=5e3;function Se(e,t){return e==="mask"&&(t?.length??0)>0}var Vs=new Set(["approved","resolved"]),Ks=new Set(["rejected","dismissed","expired","timeout","bypassed_disabled"]);function Gs(e){return new Promise(t=>setTimeout(t,e))}function Hs(e){if(typeof e!="object"||e===null)return null;let t=e,n=t.hitl_result;if(typeof n=="string"&&n.length>0)return n;let{hitl:r}=t;if(r&&typeof r=="object"){let{status:i}=r;if(typeof i=="string"&&i.length>0)return i==="pending"?null:i}return null}async function Ee(e){let{endpoint:t,apiKey:n,decisionId:r,timeoutMs:i=Rt,maskFallback:o=!1,sdkVersion:a,fetchImpl:s=globalThis.fetch,sleep:l=Gs,log:c=p=>console.warn(p)}=e,u=p=>o?{resolution:"mask",reason:p}:{resolution:"block",reason:p};if(!t)return u("HITL approval cannot be confirmed (no backend endpoint) \u2014 fail-closed (G001)");if(!r)return u("HITL approval cannot be confirmed (no decision id) \u2014 fail-closed (G001)");let d=`${t.replace(/\/$/,"")}/v1/allow/decisions/${encodeURIComponent(r)}`,f={Accept:"application/json",...W(a)};n&&(f.Authorization=`Bearer ${n}`);let g=Date.now()+Math.max(0,i),m=0;for(c(`[VisIQ HITL] Awaiting human approval for decision ${r} (timeout ${i}ms)`);;){if(Date.now()>=g)return c(`[VisIQ HITL] Decision ${r} timed out after ${i}ms \u2014 ${o?"masking":"blocking"} (G001)`),u("HITL approval timed out");let p=null;try{let _=new AbortController,x=setTimeout(()=>_.abort(),zs),A;try{A=await s(d,{method:"GET",headers:f,signal:_.signal})}finally{clearTimeout(x)}if(!A.ok)throw new Error(`HTTP ${A.status} ${A.statusText}`);let T=await A.json();p=Hs(T),m=0}catch(_){m+=1;let x=_ instanceof Error?_.message:String(_);if(c(`[VisIQ HITL] Poll failed for decision ${r} (${m}/${Cr}): ${x}`),m>=Cr)return u(`HITL approval poll failed repeatedly \u2014 fail-closed (G001): ${x}`);await l(Rr);continue}if(p!==null){let _=p.toLowerCase();return Vs.has(_)?(c(`[VisIQ HITL] Decision ${r} approved (${p}) \u2014 proceeding`),{resolution:"proceed",reason:`Approved by human reviewer (${p})`}):Ks.has(_)?(c(`[VisIQ HITL] Decision ${r} resolved as ${p} \u2014 ${o?"masking":"blocking"}`),u(`Not approved by human reviewer (${p})`)):(c(`[VisIQ HITL] Decision ${r} returned unknown status '${p}' \u2014 ${o?"masking":"blocking"} (G001)`),u(`HITL returned unknown status '${p}' \u2014 fail-closed (G001)`))}await l(Rr)}}function G(e){return e??Ie(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??He}function v(e,t){try{console.error(`[VisIQ] FAIL-OPEN (${e}): ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`)}catch{}}function U(e,t){try{console.error(`[VisIQ] TRACE-DEGRADED (${e}): ${t} \u2014 the governance decision was still made and enforced; only the execution-trace beat was lost.`)}catch{}}function ie(e){let t=e.getFailMode;return(typeof t=="function"?t.call(e):void 0)??G()}function Z(e){return e.enforced?{allowed:e.action.allowed,decision:e.action.decision,...e.action.decisionId!==void 0?{decisionId:e.action.decisionId}:{},...e.ruleCode!==null?{ruleCode:e.ruleCode}:{},reason:e.reason,argRedactionRules:e.action.argRedactionRules??[],...e.action.hitlFallback?{hitlFallback:e.action.hitlFallback}:{}}:{allowed:!0,decision:"permit",reason:e.reason,argRedactionRules:[]}}function Or(e){if(!e.enforced)return{action:"allow",reason:e.reason,redactionRules:[]};let t=e.retrieval.action??"deny",n=e.retrieval.redactionRules??[];return t==="escalate"&&Se(e.retrieval.hitlFallback,n)?{action:"redact",reason:e.reason,redactionRules:n}:{action:t,reason:e.reason,redactionRules:n}}var xr=new Set;function Nt(e){xr.has(e)||(xr.add(e),console.warn(`[VisIQ] unrecognized retrieval outcome "${e}" \u2014 failing closed (withholding content). Upgrade @visiq/harness if a newer control plane introduced this outcome.`))}async function Ze(e,t,n){let r=C.getStore(),i=K(r),o=await e.evaluate({operations:["retrieval"],agentId:t,...r?.session_id?{sessionId:r.session_id}:{},resourceType:n.resourceType??"document",resourceMetadata:n.resourceMetadata??{},...n.query!==void 0?{query:n.query}:{},...n.contentPreview!==void 0?{contentPreview:n.contentPreview}:{},...i?{telemetry:i}:{}});return Or(o)}async function Je(e,t,n){return await e.awaitBundleReady(),Ze(e,t,n)}function Nr(e,t,n=G()){switch(t.action){case"allow":case"escalate":return e;case"deny":return null;case"redact":{if(t.redactionRules.length===0)return e;try{return M(e,D(t.redactionRules))}catch{return n==="closed"?null:(v("redact-error","document redaction failed \u2014 document passed UNREDACTED"),e)}}default:return Nt(String(t.action)),n==="closed"?null:(v("unknown-retrieval-verb",`unrecognized outcome "${String(t.action)}" \u2014 document passed through`),e)}}async function Mr(e,t,n,r){if(!Array.isArray(e)||e.length===0)return e;await r.awaitBundleReady();let i=[];for(let o of e){let a=o,s=String(a.pageContent??a.text??a.content??""),l=a.metadata??{},c=await Ze(r,t,{resourceType:"document",resourceMetadata:l,query:n,contentPreview:s.slice(0,500)}),u=Nr(o,c,ie(r));u!==null&&i.push(u)}return i}async function Dr(e,t,n){if(typeof e!="string")return e;await n.awaitBundleReady();let r;try{r=await Ze(n,t,{resourceType:"document",resourceMetadata:{content_preview:e.slice(0,500)},contentPreview:e.slice(0,500)})}catch(i){return ie(n)==="closed"?"[RECALL] Retrieved context blocked \u2014 policy evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":(v("eval-error",`retrieval evaluation failed \u2014 text passed through: ${i instanceof Error?i.message:String(i)}`),e)}switch(r.action){case"allow":case"escalate":return e;case"deny":return"[RECALL] Retrieved context was blocked by policy.";case"redact":{if(r.redactionRules.length===0)return e;try{return M(e,D(r.redactionRules))}catch{return ie(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("redact-error","text redaction failed \u2014 text passed UNREDACTED"),e)}}default:return Nt(String(r.action)),ie(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 text passed through`),e)}}var Lr=4,Fr=1e3;function Ye(e){return e.length===0?!1:e.some(t=>t!==null&&typeof t=="object"&&(typeof t.pageContent=="string"||typeof t.text=="string"||typeof t.content=="string"))}async function $r(e,t,n){let r=[];for(let i of e){let o=i,a=String(o.pageContent??o.text??o.content??""),s={...o.metadata??{},content_preview:a.slice(0,500)},l;try{l=await Ze(n,t,{resourceType:"document",resourceMetadata:s,contentPreview:a.slice(0,500)})}catch(u){if(ie(n)==="closed")continue;v("eval-error",`document retrieval evaluation failed \u2014 document passed through: ${u instanceof Error?u.message:String(u)}`),r.push(i);continue}let c=Nr(i,l,ie(n));c!==null&&r.push(c)}return r}async function xt(e,t,n,r,i){if(r>Lr||i.nodes++>Fr)return e;if(Array.isArray(e)){if(Ye(e))return i.matched=!0,$r(e,t,n);let o=[];for(let a of e)o.push(await xt(a,t,n,r+1,i));return o}if(e!==null&&typeof e=="object"){let o=e,a={...o};for(let s of Object.keys(o))a[s]=await xt(o[s],t,n,r+1,i);return a}return e}async function Xe(e,t,n){if(await n.awaitBundleReady(),Array.isArray(e)&&Ye(e))return $r(e,t,n);if(e!==null&&typeof e=="object"){let r={nodes:0,matched:!1},i=await xt(e,t,n,0,r);if(r.matched)return i}return e}var Ws={blocked:!0,reason:"[RECALL] Retrieved context was blocked by policy."};function Ot(e,t,n){if(t>Lr||n.n++>Fr)return e;if(Array.isArray(e))return Ye(e)?[]:e.map(r=>Ot(r,t+1,n));if(e!==null&&typeof e=="object"){if(Ye([e]))return{...Ws};let r=e,i={};for(let o of Object.keys(r))i[o]=Ot(r[o],t+1,n);return i}return e}function Ct(e){return typeof e=="string"?"[RECALL] Retrieved context was blocked by policy.":Array.isArray(e)?[]:e!==null&&typeof e=="object"?Ot(e,0,{n:0}):e}function Pr(e,t,n=G()){let r=Or(t);switch(r.action){case"allow":case"escalate":return e;case"deny":return Ct(e);case"redact":{if(r.redactionRules.length===0)return e;try{return M(e,D(r.redactionRules))}catch{return n==="closed"?Ct(e):(v("redact-error","result redaction failed \u2014 result passed UNREDACTED"),e)}}default:return Nt(String(r.action)),n==="closed"?Ct(e):(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 result passed through`),e)}}function O(e){return typeof e=="object"&&e!==null?e:null}function jr(...e){for(let t of e)if(typeof t=="string"&&t.trim().length>0)return t}function Qs(e,t){let n=O(e.metadata),r=n&&typeof n.name=="string"?n.name:void 0;return jr(e.name,e.id,r,t)}function Ys(e){let t=O(e.metadata),n=t&&typeof t.description=="string"?t.description:void 0,r=jr(e.description,n);return r===void 0?void 0:r.slice(0,4e3)}function Zs(e){let t=O(e);return t!==null&&("type"in t||"properties"in t||"$schema"in t)}function Js(e){let t=O(e);if(t===null||!("_def"in t))return;let{shape:n}=t;if(typeof n=="function")try{n=n.call(t)}catch{n=void 0}let r=O(n);if(r===null)return{type:"object"};let i={};for(let o of Object.keys(r))i[o]={};return{type:"object",properties:i}}var Xs=new Set(["default","const","enum","examples","example"]);function Mt(e){if(Array.isArray(e))return e.map(Mt);let t=O(e);if(t===null)return e;let n={};for(let[r,i]of Object.entries(t))Xs.has(r)||(n[r]=Mt(i));return n}function el(e){let t;if(Zs(e))t=e;else{let n=Js(e);if(n===void 0)return;t=n}try{let n=JSON.stringify(t);if(n.length>2e4){let r=O(t),i=r&&O(r.properties);if(i){let o={};for(let a of Object.keys(i))o[a]={};return{type:"object",properties:o}}return{type:"object"}}return Mt(JSON.parse(n))}catch{return}}function tl(e){let t=O(e.metadata),n=e.input_schema??e.inputSchema??e.parameters??e.schema??e.args_schema??e.tool_call_schema??(t?t.parameters:void 0);return n===void 0?void 0:el(n)}function nl(e,t){let n=O(e);if(n===null)return null;let r=Qs(n,t);if(r===void 0)return null;let i={name:r.slice(0,255)},o=Ys(n);o!==void 0&&(i.description=o);let a=tl(n);return a!==void 0&&(i.input_schema=a),i}function Te(e){let t=[],n=new Set,r=(i,o)=>{try{let a=nl(i,o);a!==null&&!n.has(a.name)&&(n.add(a.name),t.push(a))}catch{}};if(Array.isArray(e)){for(let i of e)if(r(i),t.length>=200)break}else if(e instanceof Map){for(let[i,o]of e.entries())if(r(o,typeof i=="string"?i:void 0),t.length>=200)break}else{let i=O(e);if(i!==null){for(let o of Object.keys(i))if(r(i[o],o),t.length>=200)break}}return t}function Dt(e){try{let t=O(e);if(t===null)return[];let n=[],r=new Set,i=l=>{for(let c of l)!r.has(c.name)&&n.length<200&&(r.add(c.name),n.push(c))};t.tools!==void 0&&i(Te(t.tools));let o=O(t.settings);o&&o.tools!==void 0&&i(Te(o.tools));for(let l of["getTools","listTools"]){let c=t[l];if(typeof c=="function")try{i(Te(c.call(t)))}catch{}}let a=O(t.nodes);if(a)for(let l of Object.keys(a)){let c=O(a[l]);c&&c.tools!==void 0&&i(Te(c.tools))}let{agents:s}=t;if(s instanceof Map)for(let l of s.values()){let c=O(l);c&&c.tools!==void 0&&i(Te(c.tools))}return n}catch{return[]}}import{z as et}from"zod";var rl=et.object({decision:et.enum(["permit","deny"]),reason:et.string(),handoff_event_id:et.string().nullable()}),B=class extends Error{constructor(e,t,n){super(e),this.code=t,this.status=n,this.name="OrchestrateError"}code;status},J=class extends B{constructor(e,t){super(`Orchestrate grant denied: ${e}`,"GRANT_DENIED"),this.reason=e,this.handoffEventId=t,this.name="GrantDeniedError"}reason;handoffEventId},il="https://api.visiqlabs.com",ol=1e4,oe=class{config;fetch;constructor(e,t=globalThis.fetch){this.config={agentId:e.agentId,apiKey:e.apiKey??process.env.VISIQ_API_KEY??"",endpoint:e.endpoint??process.env.VISIQ_ENDPOINT??il,timeoutMs:e.timeoutMs??ol},this.fetch=t}get headers(){return{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,"X-Agent-ID":this.config.agentId}}async post(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.fetch(`${this.config.endpoint}${e}`,{method:"POST",headers:this.headers,body:JSON.stringify(t),signal:n.signal})}finally{clearTimeout(r)}let o=await i.json();if(!i.ok){let a=o?.error??`HTTP ${i.status}`;throw new B(a,"API_ERROR",i.status)}return o}async requestGrant(e){let t=await this.post("/orchestrate/grants",{parent_agent_id:e.parentAgentId,child_agent_id:e.childAgentId,tool_scope:e.toolScope??null,context_scope:e.contextScope??null,purpose:e.purpose,duration_seconds:e.durationSeconds,max_depth:e.maxDepth,parent_grant_token:e.parentGrantToken});return{grantId:t.grant_id,status:"pending",effectiveToolScope:t.effective_tool_scope,effectiveContextScope:t.effective_context_scope,acceptDeadline:t.accept_deadline}}async acceptGrant(e){let t=await this.post(`/orchestrate/grants/${e}/accept`,{});return{grantToken:t.grant_token,toolScope:t.tool_scope,contextScope:t.context_scope,expiresAt:t.expires_at}}async evaluate(e){let t=await this.post("/orchestrate/evaluate",{grant_token:e.grantToken,action:e.action,resource_type:e.resourceType,resource_metadata:e.resourceMetadata??{}}),n=rl.parse(t);return{decision:n.decision,reason:n.reason,handoffEventId:n.handoff_event_id}}async revokeGrant(e,t){return{revokedCount:(await this.post(`/orchestrate/grants/${e}/revoke`,{reason:t})).revoked_count}}};var Br=new Map;async function Ur(e,t){if(!e||e.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: agentId is required");if(!t||t.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: grantId is required");let n=Br.get(e);if(n)return n;let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[ORCHESTRATE] bootstrapGrant: VISIQ_API_KEY env var is required");let i=process.env.VISIQ_ENDPOINT,o=(await new oe({agentId:e,apiKey:r,...i?{endpoint:i}:{}}).acceptGrant(t)).grantToken;if(!o||o.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: backend returned empty grant token");return Br.set(e,o),o}var Re=Symbol.for("visiq.orchestrate.wrapped");function al(e){return e instanceof B&&typeof e.status=="number"&&e.status>=400&&e.status<500}function qr(e,t){if(!t.agentId||t.agentId.trim()==="")throw new B("agentId is required","CONFIG_ERROR");if(!t.grantToken||t.grantToken.trim()==="")throw new B("grantToken is required","CONFIG_ERROR");if(e[Re]===!0)return e;let n=new oe(t),r=t.failBehavior??(process.env.VISIQ_FAIL_MODE?.trim().toLowerCase()==="closed"?"deny":"permit"),i=async(o,a)=>{let s;try{s=await n.evaluate({grantToken:t.grantToken,action:o,resourceType:a})}catch(l){if(al(l))throw l;if(r==="permit"){console.warn('[VisIQ] FAIL-OPEN (orchestrate-eval-error): evaluate failed \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed (or failBehavior:"deny") to block instead.',l);return}throw new B(`ORCHESTRATE evaluate failed: ${l instanceof Error?l.message:String(l)}`,"EVALUATE_ERROR")}if(s.decision==="deny")throw new J(s.reason,s.handoffEventId)};return new Proxy(e,{get(o,a,s){let l=Reflect.get(o,a,s);return a===Re?!0:a==="_call"&&typeof l=="function"?async function(c,...u){let d=o.name;return await i(d??"_call"),l.call(this??o,c,...u)}:(a==="call"||a==="execute"||a==="run")&&typeof l=="function"?async function(c,...u){let d=o.name;return await i(d??String(a)),l.call(this??o,c,...u)}:l}})}import{randomUUID as Wr}from"node:crypto";var zr=Symbol.for("visiq.semantickernel.instrumented");function Gr(e){if(e===null||typeof e!="object")return!1;let t=e;return typeof t.useFunctionInvocation=="function"&&typeof t.usePromptRender=="function"&&typeof t.execute!="function"&&typeof t.generate!="function"&&typeof t.run!="function"}function Vr(e){let t=e.arguments;return t&&typeof t=="object"&&"arguments"in t&&t.arguments&&typeof t.arguments=="object"?t.arguments:t??{}}function Kr(e,t){let n=e.arguments;if(n&&typeof n=="object"&&"arguments"in n&&n.arguments&&typeof n.arguments=="object"){let r=n.arguments;for(let i of Object.keys(r))delete r[i];Object.assign(r,t);return}e.arguments=t}function q(e,t){e.result&&typeof e.result=="object"?e.result.value=t:e.result={value:t}}function sl(e){return e.result?.value}function ll(e){let{agentId:t,unified:n,failMode:r}=e;return async function(o,a){let s=o.function?.metadata?.name??"unknown",l=o.function?.metadata?.pluginName,c=Vr(o),u=l;try{let p=await n.evaluate({operations:["action"],agentId:t,toolName:s,toolArgs:c,...u!==void 0?{targetResource:u}:{}}),_=Z(p);if(!_.allowed){q(o,R({outcome:"deny",code:_.ruleCode??"DENY",reason:_.reason}));return}_.decision==="mask"&&_.argRedactionRules.length>0&&Kr(o,M(c,D(_.argRedactionRules)));let x=Vr(o),A=re(s,x,{failMode:r==="closed"?"closed":"open",enforced:p.enforced});if(A.verdict==="block"){q(o,R({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${A.detectors.join(",")})`}));return}A.verdict==="redact"&&(Kr(o,A.redacted),v("outbound-secret-redacted",`outbound secret screen redacted ${A.detectors.length} detector(s): ${A.detectors.join(",")}`))}catch(p){if(r==="closed"){q(o,R({outcome:"error",code:"EVAL-ERROR",mechanism:`evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}`}));return}v("eval-error",`SK action pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}try{let p=await Je(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l}});if(p.action==="deny"||p.action==="escalate"){q(o,`[RECALL: access denied \u2014 ${p.reason}]`);return}}catch(p){if(r==="closed"){q(o,`[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}.`);return}v("eval-error",`SK retrieval pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}await a(o);let d=sl(o),g=(typeof d=="string"?d:(()=>{try{return JSON.stringify(d)??String(d)}catch{return String(d)}})()).slice(0,500),m;try{m=await Je(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l,content_preview:g},contentPreview:g})}catch(p){r==="closed"?q(o,"[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("eval-error",`SK post-result retrieval eval failed for "${s}": ${p instanceof Error?p.message:String(p)}`);return}if(m.action==="deny"||m.action==="escalate"){q(o,`[RECALL: access denied \u2014 ${m.reason}]`);return}if(m.action==="redact"&&m.redactionRules&&m.redactionRules.length>0&&d!==null&&d!==void 0)try{q(o,M(d,D(m.redactionRules)))}catch(p){r==="closed"?q(o,"[RECALL] Result withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("redact-error",`SK result redaction failed for "${s}" \u2014 result passed UNREDACTED: ${p instanceof Error?p.message:String(p)}`)}}}function cl(e){return async function(n,r){await r(n);let i=n.renderedPrompt;if(typeof i!="string"||i.length===0)return;let o;try{o=await Je(e.unified,e.agentId,{resourceType:"prompt",resourceMetadata:{},contentPreview:i.slice(0,500)})}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("eval-error",`SK prompt-render eval failed: ${a instanceof Error?a.message:String(a)}`);return}if(o.action==="redact"&&o.redactionRules&&o.redactionRules.length>0){try{n.renderedPrompt=M(i,D(o.redactionRules))}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("redact-error",`SK prompt redaction failed \u2014 prompt passed UNREDACTED: ${a instanceof Error?a.message:String(a)}`)}return}(o.action==="deny"||o.action==="escalate")&&(n.renderedPrompt=`[RECALL: prompt suppressed \u2014 ${o.reason}]`)}}function Hr(e,t){let n=e;if(n[zr]===!0)return t.onWrap?.(),e;let r=ll(t),i=cl(t),o=!1;return Array.isArray(n._functionInvocationFilters)?(n._functionInvocationFilters.unshift(r),o=!0):typeof n.useFunctionInvocation=="function"&&(n.useFunctionInvocation(r),o=!0),typeof n.usePromptRender=="function"?n.usePromptRender(i):Array.isArray(n._promptRenderFilters)&&n._promptRenderFilters.push(i),o&&(n[zr]=!0,t.onWrap?.()),e}function R(e){let t=/^D-/.test(e.code),n;e.outcome==="approval_required"?n="requires human approval, which was not granted":e.outcome==="error"?n="was blocked (fail-closed) after a policy-evaluation error":n="was denied by policy";let r=e.reason?.trim(),i;r?i=r:t?i="no policy rule covers this action, so the organization default applied":e.outcome==="approval_required"?i="this action is routed to a human for approval":i="denied by policy";let o=e.mechanism?.trim()?` \u2014 ${e.mechanism.trim()}`:"";return`[VisIQ decision=${e.outcome} code=${e.code}] This tool call was NOT executed: it ${n} (${i})${o}. VisIQ is a security harness installed by your developer. Report this reason to the user verbatim; do not invent a different one.`}function tt(e){return e instanceof Error?e.message:String(e)}var ul=/https?:\/\/[^\s"'`,)}\]]+/;function Lt(e){let t=e.match(ul);if(t)try{let n=new URL(t[0]);return n.hostname+n.pathname}catch{return t[0]}}var ae=Symbol.for("visiq.toolexec.instrumented");function dl(e){return e!==null&&typeof e=="object"&&typeof e.execute=="function"}var Ft={vercel:"Vercel AI SDK agent",mastra:"Mastra Agent",openai:"OpenAI Agents SDK agent",llamaindex:"LlamaIndex.TS agent",voltagent:"VoltAgent agent","semantic-kernel":"Semantic Kernel"};function Qr(e){if(e===null||typeof e!="object")return null;let t=e;if(dl(t))return null;if(Gr(e))return"semantic-kernel";if(typeof t.generateText=="function"&&(typeof t.getTools=="function"||t.toolManager!==void 0))return"voltagent";if(typeof t.run=="function"&&typeof t.runStream=="function"&&t.agents!==void 0)return"llamaindex";if(Array.isArray(t.tools)&&t.handoffs!==void 0&&(typeof t.on=="function"||t.eventEmitter!==void 0))return"openai";if(typeof t.generate=="function"&&typeof t.getLLM=="function"&&(typeof t.listTools=="function"||typeof t.getTools=="function"))return"mastra";if(typeof t.generate=="function"){let n=t.settings;if(n&&typeof n=="object"&&n.tools!==void 0||t.tools!==void 0)return"vercel"}return null}async function pl(e,t,n,r,i,o){let{agentId:a,unified:s}=e,l=K(i),c,u=!1;try{await s.awaitBundleReady();let p=await s.evaluate({operations:o?["action","delegation"]:["action"],agentId:a,toolName:t,toolArgs:n,...o?{context:Qe(o,a)}:{},...i?.session_id?{sessionId:i.session_id}:{},...r!==void 0?{targetResource:r}:{},...l?{telemetry:l}:{}});({enforced:u}=p),c=Z(p)}catch(p){let _=p instanceof Error?p.message:String(p);return e.failMode==="closed"?{block:R({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${_} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})}:(v("eval-error",`policy evaluation failed for tool "${t}": ${_}`),{block:null})}if(c.decision==="approval_required"&&c.decisionId){let p=s.getApiKey()??e.apiKey,_=await Ee({endpoint:s.getEndpoint()??e.endpoint??"",...p?{apiKey:p}:{},decisionId:c.decisionId,timeoutMs:e.hitlTimeoutMs,sdkVersion:V});return _.resolution!=="proceed"?{block:R({outcome:"approval_required",code:c.ruleCode??"HITL-BLOCK",reason:c.reason,mechanism:_.reason}),decision:c}:{block:null}}if(!c.allowed)return{block:R({outcome:"deny",code:c.ruleCode??"DENY",reason:c.reason}),decision:c};let d=n,f=!1,g;if(c.decision==="mask"&&c.argRedactionRules&&c.argRedactionRules.length>0)try{let p=D(c.argRedactionRules);d=M(n,p),f=!0,g=c}catch(p){let _=p instanceof Error?p.message:String(p);if(e.failMode==="closed")return{block:R({outcome:"error",code:"MASK-ERROR",mechanism:`argument masking failed: ${_} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})};v("mask-error",`argument masking failed for tool "${t}" \u2014 running with UNMASKED args: ${_}`)}let m=re(t,d,{failMode:e.failMode==="closed"?"closed":"open",enforced:u});return m.verdict==="block"?{block:R({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${m.detectors.join(",")})`}),decision:{allowed:!1,decision:"deny",ruleCode:"OUTPUT-BLOCK",reason:"outbound content carried a live secret",argRedactionRules:[]}}:(m.verdict==="redact"&&(d=m.redacted,f=!0,v("outbound-secret-redacted",`outbound secret screen redacted ${m.detectors.length} detector(s): ${m.detectors.join(",")}`),g??={allowed:!0,decision:"mask",ruleCode:"OUTPUT-BLOCK",reason:"outbound secret redacted before egress",argRedactionRules:[]}),f?{block:null,maskedArgs:d,decision:g}:{block:null})}async function $t(e,t,n,r,i){let o=C.getStore()??e.telemetry,a=We(t,n);a&&ge(e.unified,{agentId:e.agentId,sessionId:o?.session_id,...e.framework?{framework:e.framework}:{}},a);let s={agentId:e.agentId,sessionId:o?.session_id,...e.framework?{framework:e.framework}:{}},l=pe(t,n);try{he(e.unified,s,{toolName:t,...l?{memory:l}:{},argSummary:r.slice(0,512)})}catch(m){U("step-beat",`emit failed for tool "${t}": ${tt(m)}`)}let c=Date.now(),u=await pl(e,t,n,Lt(r),o,a);if(u.block!==null){try{u.decision&&te(e.unified,s,{toolName:t,decision:u.decision.decision??"deny",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0,harnessMessage:u.block})}catch(m){U("intervention-beat",`emit failed for tool "${t}": ${tt(m)}`)}return u.block}if(u.maskedArgs!==void 0&&u.decision)try{te(e.unified,s,{toolName:t,decision:u.decision.decision??"mask",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0})}catch(m){U("intervention-beat",`emit failed for tool "${t}": ${tt(m)}`)}let d=u.maskedArgs??n,f=await i(d),g=await Xe(f,e.agentId,e.unified);try{ye(e.unified,s,{toolName:t,ok:!0,durationMs:Date.now()-c,...Q(g)!==void 0?{bytes:Q(g)}:{},...Y(g)!==void 0?{itemCount:Y(g)}:{},...l?{memory:l}:{}})}catch(m){U("observation-beat",`emit failed for tool "${t}": ${tt(m)}`)}return g}function nt(e,t,n){let r=e;if(r[ae]){n.onWrap?.();return}if(typeof r.execute!="function")return;let i=r.execute;jt(r,"execute",async function(...a){let s=Tt(a[0]);return $t(n,t,s,xe(s),l=>Promise.resolve(i.apply(this,[l,...a.slice(1)])))}),r[ae]=!0,n.onWrap?.()}function fl(e,t,n){let r=e;if(r[ae]){n.onWrap?.();return}if(typeof r.invoke!="function")return;let i=r.invoke;jt(r,"invoke",async function(...a){let s=a[1],l=Er(s),c=typeof s=="string"?s:xe(l);return $t(n,t,l,c,u=>{let d=typeof s=="string"?JSON.stringify(u):u;return Promise.resolve(i.apply(this,[a[0],d,...a.slice(2)]))})}),r[ae]=!0,n.onWrap?.()}function ml(e,t){let n=e;if(n[ae]){t.onWrap?.();return}if(typeof n.call!="function")return;let r=n.metadata,i=typeof r?.name=="string"?r.name:"unknown",o=n.call;jt(n,"call",async function(...s){let l=Tt(s[0]);return $t(t,i,l,xe(l),c=>Promise.resolve(o.apply(this,[c,...s.slice(1)])))}),n[ae]=!0,t.onWrap?.()}function Yr(e,t){for(let[n,r]of Object.entries(e))r!==null&&typeof r=="object"&&nt(r,n,t);return e}function Zr(e,t,n){let r={...t,framework:n};switch(n){case"vercel":return gl(e,r);case"mastra":return hl(e,r);case"openai":return bl(e,r);case"llamaindex":return _l(e,r);case"voltagent":return yl(e,r);case"semantic-kernel":return Hr(e,r);default:return e}}function gl(e,t){let n=e,r=n.settings&&typeof n.settings=="object"?n.settings:void 0,i=r?.tools??n.tools;return i&&typeof i=="object"&&Yr(i,t),r&&!r.__visiq_step&&(r.__visiq_step=!0,r.onStepFinish=Pt(r.onStepFinish)),rt(e,["generate","stream"],async(o,a)=>(Ce(a,o[0]),o)),e}function hl(e,t){let r=Al(e);return r&&Yr(r,t),rt(e,["generate","stream","generateVNext","streamVNext"],async(i,o)=>{Ce(o,i[0]);let a=i[1]&&typeof i[1]=="object"?{...i[1]}:{};a.onStepFinish=Pt(a.onStepFinish);let s=[...i];return s[1]=a,s}),e}function yl(e,t){let n=wl(e);if(n){for(let r of n)if(r!==null&&typeof r=="object"){let{name:i}=r;nt(r,typeof i=="string"?i:"unknown",t)}}return rt(e,["generateText","streamText","generateObject","streamObject"],async(r,i)=>{Ce(i,r[0]);let o=r[1]&&typeof r[1]=="object"?{...r[1]}:{};o.onStepFinish=Pt(o.onStepFinish);let a=[...r];return a[1]=o,a}),e}function _l(e,t){let n=e,r=o=>{let a=o?.tools;if(Array.isArray(a))for(let s of a)s!==null&&typeof s=="object"&&ml(s,t)},{agents:i}=n;if(i instanceof Map)for(let o of i.values())r(o);else Array.isArray(n.tools)&&r(n);return rt(e,["run"],async(o,a)=>(Ce(a,o[0]),o)),kl(e,"runStream",(o,a,s)=>{s||Ce(a,o[0])}),e}function bl(e,t){let n=e,{tools:r}=n;if(Array.isArray(r)){for(let i of r)if(i!==null&&typeof i=="object"){let{name:o}=i;fl(i,typeof o=="string"?o:"unknown",t)}}return vl(e,t),e}function vl(e,t){let n=e;if(n.__visiq_openai_hooks||typeof n.on!="function")return;let r=n.on,{telemetry:i}=t;r.call(e,"agent_start",(...o)=>{i.session_id=Wr(),i.llm_prompts=[],i.llm_responses=[],i.agent_reasoning=[],i.retrieverQueries=new Map;let a=o[2];a!=null&&i.llm_prompts.push(xe(a).slice(0,5120))}),r.call(e,"agent_end",(...o)=>{let a=o[1];typeof a=="string"&&a&&i.llm_responses.push(a.slice(0,5120))}),n.__visiq_openai_hooks=!0}function wl(e){let t=r=>Array.isArray(r)&&r.some(i=>i!==null&&typeof i.execute=="function");if(typeof e.getTools=="function")try{let r=e.getTools();if(t(r))return r}catch{}let n=e.toolManager;if(n&&typeof n.getAllBaseTools=="function")try{let r=n.getAllBaseTools();if(t(r))return r}catch{}return t(e.tools)?e.tools:null}function rt(e,t,n){let r=e;for(let i of t){if(typeof r[i]!="function")continue;let o=`__visiq_wrapped_${i}`;if(r[o])continue;let a=r[i];r[i]=function(...s){let l=Jr();return C.run(l,async()=>{let c=await n(s,l);return a.apply(e,c)})},r[o]=!0}}function kl(e,t,n){let r=e;if(typeof r[t]!="function")return;let i=`__visiq_wrapped_${t}`;if(r[i])return;let o=r[t];r[t]=function(...a){let s=C.getStore(),l=s??Jr();return n(a,l,s!==void 0),C.run(l,()=>o.apply(e,a))},r[i]=!0}function Pt(e){return t=>{let n=C.getStore(),r=t;if(n&&typeof r?.text=="string"&&r.text&&n.llm_responses.push(r.text.slice(0,5120)),typeof e=="function")return e(t)}}function Ce(e,t){if(t==null)return;let n=t;if(typeof t=="object"){let r=t;n=r.prompt??r.messages??t}e.llm_prompts.push(xe(n).slice(0,5120))}function Al(e){for(let t of["listTools","getTools"])if(typeof e[t]=="function")try{let n=e[t]();if(n&&typeof n=="object"&&typeof n.then!="function")return n}catch{}return null}function Jr(){return{session_id:Wr(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function jt(e,t,n){try{e[t]=n}catch{Object.defineProperty(e,t,{value:n,writable:!0,configurable:!0,enumerable:!0})}}function xe(e){try{return JSON.stringify(e)??String(e)}catch{return String(e)}}function li(e,t){let n=Cl(t);if(e[Re]===!0)return e;let r=Ml(e);if(r==="langchain-executor"||r==="langchain-graph")return le(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,ei(r,null),n.failMode,{model:ti(e)}),ri(e,n),Dl(e,n);let i=Qr(e);if(i){le(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,ei("unknown",i),n.failMode,{model:ti(e)}),ri(e,n);let o=0,a=fi(n);a.onWrap=()=>{o+=1};let s=Zr(e,a,i);if(o===0){let l=0;try{l=Dt(e).length}catch{l=0}if(l>0){let c=`[VisIQ] Detected a ${Ft[i]} that ADVERTISES ${String(l)} tool(s) but instrumented ZERO of them \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a tool bag that moved/renamed on a framework version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.`;if(n.onInstrumentFailure!==void 0?n.onInstrumentFailure==="throw":n.failMode==="closed")throw new Error(c);v("zero-instrument",`advertised ${String(l)} tool(s), instrumented none`),console.warn(c)}else{let c=`[VisIQ] Detected a ${Ft[i]} with no tools to instrument (the agent advertises none). If it is intentionally tool-less (LLM-only) this is safe to ignore; otherwise its tool bag is not where this SDK looks for it \u2014 upgrade @visiq/harness or pass the tools through visiq() (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw) to fail closed here.`;if(n.onInstrumentFailure==="throw")throw new Error(c);console.warn(c)}}return s}if(Ul(e)){let o=process.env.VISIQ_GRANT_ID;return o?zl(e,n,o):Vl(e,n)}throw new Error("[VisIQ] Cannot detect agentic framework. Pass a LangChain AgentExecutor, LangGraph CompiledGraph, or a tool with one of: _call, execute, call, run, invoke.")}var El="https://api.visiqlabs.com",Tl="\0",Xr=new Map;function ei(e,t){if(e==="langchain-executor"||e==="langchain-graph")return"langchain";switch(t){case"vercel":return"vercel_ai";case"mastra":return"mastra";case"openai":return"openai_agents";case"llamaindex":return"llamaindex";case"voltagent":return"voltagent";case"semantic-kernel":return"semantic_kernel";default:return}}function ti(e){try{if(typeof e!="object"||e===null)return;let t=e,n=se(t.model);if(n)return n;let{settings:r}=t;if(typeof r=="object"&&r!==null){let a=se(r.model);if(a)return a}let{llm:i}=t;if(typeof i=="object"&&i!==null){let a=ni(i);if(a)return a}let{agents:o}=t;if(o instanceof Map){for(let a of o.values())if(typeof a=="object"&&a!==null){let s=a,l=s.llm,c=se(s.model)??(typeof l=="object"&&l!==null?ni(l):void 0);if(c)return c}}return}catch{return}}function ni(e){return se(e.model)??se(e.modelId)??se(e.model_name)}function se(e){if(typeof e=="string"&&e.trim().length>0)return e.trim();if(typeof e=="object"&&e!==null){let t=e;for(let n of["modelId","model_id","id","model","modelName","model_name"]){let r=t[n];if(typeof r=="string"&&r.trim().length>0)return r.trim()}}}function le(e,t,n,r,i,o,a){let s=[e??"",t??"",n??"",r??"",o??""].join(Tl),l=Xr.get(s);return l||(l=new Sr(e,t,n,void 0,r,V,st),l.registerHostEnvironment(i,a),Xr.set(s,l)),o!==void 0&&l.setFailMode(o),l}function ri(e,t){try{let n=Dt(e);n.length>0&&le(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode).reportToolSurface(n)}catch{}}function Rl(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_TIMEOUT_MS;if(t!==void 0){let n=Number.parseInt(t,10);if(Number.isFinite(n)&&n>0)return n}}function Cl(e){let t=e?.agentId??process.env.VISIQ_AGENT_ID??Ol(),n=e?.apiKey??process.env.VISIQ_API_KEY,r=e?.endpoint??process.env.VISIQ_ENDPOINT??(n?El:void 0);return{agentId:t,apiKey:n,endpoint:r,hitlTimeoutMs:Nl(e?.hitlTimeoutMs),timeoutMs:Rl(e?.timeoutMs),onInstrumentFailure:e?.onInstrumentFailure??xl(),failMode:G(e?.failMode)}}function xl(){let e=process.env.VISIQ_ON_INSTRUMENT_FAILURE;if(e==="throw")return"throw";if(e==="warn")return"warn"}function Ol(){let e=t=>t.toLowerCase().replace(/^@[^/]+\//,"").replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,255);try{let t=process.cwd();for(let n=0;n<64;n++){let r=ot.join(t,"package.json");if(it.existsSync(r)){let o=JSON.parse(it.readFileSync(r,"utf8"));if(typeof o.name=="string"&&o.name.trim()){let a=e(o.name);if(a)return a}break}let i=ot.dirname(t);if(i===t)break;t=i}}catch{}try{let t=e(si.hostname());if(t)return t}catch{}return"agent"}function Nl(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_HITL_TIMEOUT_MS;if(t){let n=Number(t);if(Number.isFinite(n)&&n>0)return n}return Rt}function Ml(e){let t=e;return typeof t.invoke=="function"&&t.agent&&Array.isArray(t.tools)?"langchain-executor":typeof t.invoke=="function"&&t.nodes&&(t.edges||t.lg_is_pregel===!0||typeof t.builder=="object"&&t.builder!==null&&t.builder.edges)?"langchain-graph":"unknown"}function Dl(e,t){let n=e,r=le(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode),i=Ll(n);for(let l of i)qt(l,t.agentId,r),Pl(l,t.agentId,r,t),di(l,r,t);let{nodes:o}=n;if(!!o&&typeof o=="object"&&"tools"in o&&i.length===0){let l="[VisIQ] Detected a LangGraph agent whose compiled graph carries a ToolNode, but resolved ZERO tools from it \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a compiled-graph tool bag that moved on a @langchain/langgraph version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.";if(t.onInstrumentFailure!==void 0?t.onInstrumentFailure==="throw":t.failMode==="closed")throw new Error(l);v("zero-instrument","langgraph compiled-graph ToolNode present, resolved no tools"),console.warn(l)}let s=n.invoke;if(n.invoke=function(l,c){let u=Ut(),d=ai(t.agentId,r),f=c?.callbacks??[];return C.run(u,()=>s.call(this,l,{...c,callbacks:[...f,d]}))},typeof n.stream=="function"){let l=n.stream;n.stream=function(c,u){let d=Ut(),f=ai(t.agentId,r),g=u?.callbacks??[];return C.run(d,()=>l.call(this,c,{...u,callbacks:[...g,f]}))}}return e}function Ll(e){let t=[],n=new Set,r=o=>{if(Array.isArray(o))for(let a of o)a&&typeof a=="object"&&!n.has(a)&&(n.add(a),t.push(a))};r(e.tools);let{nodes:i}=e;if(i&&typeof i=="object"){for(let o of Object.values(i))if(o&&typeof o=="object"){let a=o;r(a.tools);let{bound:s}=a;s&&typeof s=="object"&&r(s.tools)}}return t}function Ut(){return{session_id:Il(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function qt(e,t,n){let r=e,i=Symbol.for("visiq.recall.instrumented");if(!r[i]){if(typeof r._getRelevantDocuments=="function"){let o=r._getRelevantDocuments;r._getRelevantDocuments=async function(a,s){let l=await o.call(this,a,s);return ii(l,t,a,n)},r[i]=!0}if(typeof r.retrieve=="function"&&!r._getRelevantDocuments){let o=r.retrieve;r.retrieve=async function(a){let s=await o.call(this,a);return ii(s,t,String(a),n)},r[i]=!0}r.retriever&&typeof r.retriever=="object"&&qt(r.retriever,t,n)}}var Fl=Symbol.for("visiq.operations"),$l=new Set(["action","retrieval","delegation"]);function ci(e){if(typeof e!="object"||e===null)return;let t=e[Fl]??e.visiqOperations;if(!Array.isArray(t))return;let n=t.filter(r=>typeof r=="string"&&$l.has(r));return n.length>0?Array.from(new Set(n)):void 0}function Pl(e,t,n,r){let i=e,o=Symbol.for("visiq.recall.tool-instrumented");if(i[o]||typeof i.func!="function")return;let a=typeof i.name=="string"?i.name:"",s=typeof i.retriever=="object"&&i.retriever!==null,l=a.split(/[^a-zA-Z0-9]+|(?<=[a-z])(?=[A-Z])/).map(S=>S.toLowerCase()),c=new Set(["update","delete","create","write","archive","insert","remove","patch"]),u=new Set(["send","post","put"]),d=l.some(S=>c.has(S)),f=u.has(l[0]??""),g=d||f,m=["update","delete","create","archive","insert","remove"],p=l.some(S=>m.some(b=>S.length>b.length&&S.endsWith(b))),x=/retriev/i.test(a)||/search.*doc|knowledge/i.test(a)&&!g&&!p,A=ci(i),T=A?.includes("retrieval")??!1;if(A!==void 0&&!T||!(s||x||T))return;let De=A?T&&A.includes("action"):d||p;if(!De)if(s)qt(i.retriever,t,n);else{let S=globalThis,b=Symbol.for("visiq.recall.closureRetrieverWarned"),P=S[b]??=new Set;P.has(a)||(P.add(a),console.warn(`[VisIQ] Retriever tool "${a||"(unnamed)"}" exposes no reachable retriever (e.g. LangChain createRetrieverTool returns a joined string). RECALL masks its output via value-shape + whole-result rules, but PER-DOCUMENT metadata/classification rules cannot apply to a metadata-less joined string. For full per-doc governance, pass the retriever to visiq() directly, or use a tool that returns a Document[].`))}let H=i.func;De?(i[ui]=!0,i.func=async function(...S){await n.awaitBundleReady();let b=S[0],P=typeof b=="object"&&b!==null?b:{input:b},ue=typeof P.query=="string"?P.query:void 0,w=C.getStore(),k=K(w),N;try{N=await n.evaluate({operations:["retrieval","action"],agentId:t,...w?.session_id?{sessionId:w.session_id}:{},toolName:a||"unknown",toolArgs:P,resourceType:"document",resourceMetadata:{},...ue!==void 0?{query:ue}:{},...k?{telemetry:k}:{}})}catch(L){let de=L instanceof Error?L.message:String(L);return G(r?.failMode)==="closed"?R({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${de} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for hybrid tool "${a||"unknown"}": ${de}`),H.apply(this,S))}let E=Z(N),at=Se(E.hitlFallback,E.argRedactionRules),zt=S,Vt=()=>{try{return zt=[M(P,D(E.argRedactionRules)),...S.slice(1)],null}catch{return G(r?.failMode)==="closed"?R({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a||"unknown"}" \u2014 running with UNMASKED args`),null)}};if(E.decision==="approval_required"&&E.decisionId&&r){let L=await Ee({endpoint:n.getEndpoint()??r.endpoint??"",apiKey:n.getApiKey()??r.apiKey,decisionId:E.decisionId,timeoutMs:r.hitlTimeoutMs,maskFallback:at,sdkVersion:V});if(L.resolution==="mask"){let de=Vt();if(de)return de}else if(L.resolution!=="proceed")return R({outcome:"approval_required",code:E.ruleCode??"HITL-BLOCK",reason:E.reason,mechanism:L.reason})}else if(!E.allowed)return R({outcome:"deny",code:E.ruleCode??"DENY",reason:E.reason});if(E.decision==="mask"&&E.argRedactionRules.length>0){let L=Vt();if(L)return L}let hi=await H.apply(this,zt);return Pr(hi,N,r?.failMode)}):i.func=async function(...S){let b=await H.apply(this,S);return typeof b=="string"?Dr(b,t,n):Xe(b,t,n)},i[o]=!0}var ui=Symbol.for("visiq.hybrid.instrumented");async function ii(e,t,n,r){return Mr(e,t,n,r)}var oi=["invoke","call","_call"],X=new Sl;function di(e,t,n){let r=e,i=Symbol.for("visiq.allow.instrumented");if(r[i]||typeof r._getRelevantDocuments=="function"||r[ui]||ci(r)?.every(c=>c==="retrieval")||!oi.some(c=>typeof r[c]=="function"))return;let{agentId:o}=n,a=typeof r.name=="string"?r.name:"unknown",s=Symbol("visiq.gate"),l=async(c,u,d,f,g)=>{let m=X.getStore();if(m!==void 0&&m.gateKey===s&&!m.entered.has(g))return m.entered.add(g),c.call(u,d,...f);let p;if(typeof d=="string")p=d;else{let w=d?.input;p=w!=null?String(w):JSON.stringify(d)??""}let _=C.getStore(),x=K(_),A=typeof d=="object"&&d!==null?d:{input:p},T=We(a,A);T&&ge(t,{agentId:o,sessionId:_?.session_id,framework:"langchain"},T);let Me={agentId:o,sessionId:_?.session_id,framework:"langchain"},ce=pe(a,A);try{he(t,Me,{toolName:a,...ce?{memory:ce}:{},argSummary:p.slice(0,512)})}catch(w){U("step-beat",`emit failed for tool "${a}": ${Bt(w)}`)}let De=Date.now(),H=async w=>{let k=await w();try{ye(t,Me,{toolName:a,ok:!0,durationMs:Date.now()-De,...Q(k)!==void 0?{bytes:Q(k)}:{},...Y(k)!==void 0?{itemCount:Y(k)}:{},...ce?{memory:ce}:{}})}catch(N){U("observation-beat",`emit failed for tool "${a}": ${Bt(N)}`)}return k},S=(w,k,N,E)=>{try{te(t,Me,{toolName:a,decision:w,...k?{ruleCode:k}:{},...N?{ruleLabel:N}:{},enforced:!0,...E?{harnessMessage:E}:{}})}catch(at){U("intervention-beat",`emit failed for tool "${a}": ${Bt(at)}`)}};await t.awaitBundleReady();let b,P=!1;try{let w=await t.evaluate({operations:T?["action","delegation"]:["action"],agentId:o,..._?.session_id?{sessionId:_.session_id}:{},toolName:a,toolArgs:A,targetResource:Lt(p),...x?{telemetry:x}:{},...T?{context:Qe(T,o)}:{}});({enforced:P}=w),b=Z(w)}catch(w){let k=w instanceof Error?w.message:String(w);return n.failMode==="closed"?R({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${k} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for tool "${a}": ${k}`),X.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)))}let ue=w=>{let k=re(a,w,{failMode:n.failMode==="closed"?"closed":"open",enforced:P});if(k.verdict==="block"){let E=R({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${k.detectors.join(",")})`});return S("deny","OUTPUT-BLOCK","outbound content carried a live secret",E),E}let N=w;return k.verdict==="redact"&&(N=k.redacted,v("outbound-secret-redacted",`outbound secret screen redacted ${k.detectors.length} detector(s): ${k.detectors.join(",")}`),S("mask","OUTPUT-BLOCK","outbound secret redacted before egress")),H(()=>X.run({gateKey:s,entered:new Set([g])},()=>c.call(u,N,...f)))};if(b.decision==="approval_required"&&b.decisionId){let w=Se(b.hitlFallback,b.argRedactionRules),k=await Ee({endpoint:t.getEndpoint()??n.endpoint??"",apiKey:t.getApiKey()??n.apiKey,decisionId:b.decisionId,timeoutMs:n.hitlTimeoutMs,maskFallback:w,sdkVersion:V});if(k.resolution==="proceed")return H(()=>X.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)));if(k.resolution==="mask")try{let E=M(d,D(b.argRedactionRules));return S("mask",b.ruleCode,b.reason),H(()=>X.run({gateKey:s,entered:new Set([g])},()=>c.call(u,E,...f)))}catch{return n.failMode==="closed"?R({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`HITL mask fallback failed for tool "${a}" \u2014 running with UNMASKED args`),X.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)))}let N=R({outcome:"approval_required",code:b.ruleCode??"HITL-BLOCK",reason:b.reason,mechanism:k.reason});return S("approval_required",b.ruleCode,b.reason,N),N}if(!b.allowed){let w=R({outcome:"deny",code:b.ruleCode??"DENY",reason:b.reason});return S("deny",b.ruleCode,b.reason,w),w}if(b.decision==="mask"&&b.argRedactionRules.length>0)try{let w=M(d,D(b.argRedactionRules));return S("mask",b.ruleCode,b.reason),ue(w)}catch{return n.failMode==="closed"?R({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a}" \u2014 running with UNMASKED args`),X.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)))}return ue(d)};for(let c of oi){if(typeof r[c]!="function")continue;let u=r[c];r[c]=function(d,...f){return l(u,this,d,f,c)}}r[i]=!0}function Bt(e){return e instanceof Error?e.message:String(e)}function jl(e,t,n){let r=(a,s)=>{if(!a||typeof a!="object")return;let l=a[s];return typeof l=="string"&&l.length>0?l:void 0},i=t?.invocation_params,o=e&&typeof e=="object"?e.kwargs:void 0;return r(i,"model")??r(i,"model_name")??r(n,"ls_model_name")??r(o,"model")??r(o,"model_name")}function Bl(e,t){let n=(g,m)=>{if(!g||typeof g!="object")return;let p=g[m];return typeof p=="number"&&Number.isFinite(p)?p:void 0},r=e?.tokenUsage,i=n(r,"promptTokens"),o=n(r,"completionTokens");if(i!==void 0||o!==void 0)return{...i!==void 0?{tokensIn:i}:{},...o!==void 0?{tokensOut:o}:{}};let a=t?.usage_metadata,s=n(a,"input_tokens"),l=n(a,"output_tokens");if(s===void 0&&l===void 0)return;let c=a&&typeof a=="object"?a.input_token_details:void 0,u=n(c,"cache_read"),d=n(c,"cache_creation"),f=s!==void 0?Math.max(0,s-(u??0)-(d??0)):void 0;return{...f!==void 0?{tokensIn:f}:{},...l!==void 0?{tokensOut:l}:{},...u!==void 0?{cacheRead:u}:{},...d!==void 0?{cacheWrite:d}:{}}}function ai(e,t){return{name:"VisiqHandler",handleLLMStart:async(n,r,i,o,a,s,l)=>{let c=C.getStore();if(!c)return;c.llm_prompts.push(...r);let u=jl(n,a,l);u&&(c.llm_model=u,t.captureCloneMetadata({model:u,agentType:"langchain"}))},handleLLMEnd:async n=>{let r=C.getStore();if(!r)return;let o=n?.generations?.[0]?.[0],a=typeof o?.text=="string"?o.text:"";a&&r.llm_responses.push(a);try{let s=n?.llmOutput,l=o?.message&&typeof o.message=="object"?o.message:void 0,c=Bl(s,l);if(!c&&!a)return;let u=l?.tool_calls,d=typeof s?.model=="string"?s.model:void 0,f=r.llm_model??d;await t.awaitBundleReady(),ut(t,{agentId:e,sessionId:r.session_id,framework:"langchain"},{...a?{texts:[a]}:{},...c?{usage:c}:{},...f?{model:f}:{},final:!(Array.isArray(u)&&u.length>0)})}catch{}},handleAgentAction:async n=>{let r=C.getStore();if(!r)return;let i=typeof n.log=="string"?n.log:"";i&&r.agent_reasoning.push(i)},handleRetrieverStart:async(n,r,i)=>{let o=C.getStore();o&&o.retrieverQueries.set(i,r??"")},handleRetrieverEnd:async(n,r)=>{let i=C.getStore();if(!i)return;let o=i.retrieverQueries.get(r)??"";if(i.retrieverQueries.delete(r),!Array.isArray(n))return;let a=K(i);for(let s of n){let l=s,c=String(l.pageContent??l.text??l.content??""),u=l.metadata??{};await t.evaluate({operations:["retrieval"],agentId:e,resourceType:"document",resourceMetadata:u,query:o,contentPreview:c.slice(0,500),...a?{telemetry:a}:{}})}},handleRetrieverError:async(n,r)=>{let i=C.getStore();i&&i.retrieverQueries.delete(r)}}}var pi=["_call","execute","call","run","invoke"];function Ul(e){let t=e;for(let n of pi)if(typeof t[n]=="function")return!0;return!1}function ql(e){return e instanceof J?!0:e instanceof B?typeof e.status=="number"&&e.status>=400&&e.status<500:!1}function zl(e,t,n){let r=null,i=null,o=!1,a=async()=>{if(r)return r;if(i)throw new J(`Failed to bootstrap grant ${n}: ${i.message}`,null);let s;try{s=await Ur(t.agentId,n)}catch(l){throw o=ql(l),o&&(i=l instanceof Error?l:new Error(String(l))),new J(`Failed to bootstrap grant ${n}: ${l instanceof Error?l.message:String(l)}`,null)}return r=qr(e,{agentId:t.agentId,grantToken:s,failBehavior:t.failMode==="closed"?"deny":"permit",...t.apiKey?{apiKey:t.apiKey}:{},...t.endpoint?{endpoint:t.endpoint}:{}}),r};return new Proxy(e,{get(s,l,c){if(l===Re)return!0;let u=Reflect.get(s,l,c);return typeof u!="function"||typeof l!="string"||!pi.includes(l)?u:async function(...d){let f;try{f=await a()}catch(m){if(o||t.failMode==="closed")throw m;return v("grant-bootstrap",`grant ${n} bootstrap failed: ${m instanceof Error?m.message:String(m)}`),u.call(this,...d)}return f[l].call(f,...d)}}})}function Vl(e,t){let n=le(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode);di(e,n,t);let r=e;if(typeof r.execute=="function"){let i=typeof r.name=="string"&&r.name||typeof r.id=="string"&&r.id||"unknown";nt(e,i,fi(t))}return e}function fi(e){return{agentId:e.agentId,unified:le(e.apiKey,e.endpoint,e.agentId,e.timeoutMs,void 0,e.failMode),hitlTimeoutMs:e.hitlTimeoutMs,failMode:e.failMode,...e.apiKey?{apiKey:e.apiKey}:{},...e.endpoint?{endpoint:e.endpoint}:{},telemetry:Ut()}}async function mi(e,t={}){if(!e||e.trim()==="")throw new Error("[VisIQ] visiq.delegate: childAgentId is required");let n=process.env.VISIQ_AGENT_ID;if(!n)throw new Error("[VisIQ] visiq.delegate: VISIQ_AGENT_ID env var is required. Set it to the parent agent ID before calling delegate.");let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[VisIQ] visiq.delegate: VISIQ_API_KEY env var is required");let i=process.env.VISIQ_ENDPOINT;return{VISIQ_GRANT_ID:(await new oe({agentId:n,apiKey:r,...i?{endpoint:i}:{}}).requestGrant({parentAgentId:n,childAgentId:e,toolScope:t.toolScope??null,contextScope:t.contextScope??null,durationSeconds:t.durationSeconds??3600,purpose:t.purpose??`Delegated to ${e}`,...t.maxDepth!==void 0?{maxDepth:t.maxDepth}:{},...t.parentGrantToken!==void 0?{parentGrantToken:t.parentGrantToken}:{}})).grantId}}var Oe=class{constructor(t){this.transport=t}transport;deploy(t={}){let n={include_mac:t.includeMac??!1};return t.autoInstallHarness!==void 0&&(n.auto_install_harness=t.autoInstallHarness),ee(this.transport,"POST","/api/discovery/fleet/deploy",n)}status(){return ee(this.transport,"GET","/api/discovery/fleet/status")}heartbeat(t){return ee(this.transport,"POST","/api/discovery/fleet/heartbeat",{instance_id:t.instanceId,vendor:t.vendor})}stop(){return ee(this.transport,"POST","/api/discovery/fleet/stop")}};var Ne=class{constructor(t){this.transport=t}transport;connectAws(t){return ee(this.transport,"POST","/api/discovery/integrations/aws",{aws_account_id:t.awsAccountId,aws_region:t.awsRegion})}};function Kl(e){if(!e.baseUrl||e.baseUrl.length===0)throw new Error("[VisIQ] createVisiqClient: baseUrl is required");if(!e.accessToken&&!e.cookieHeader)throw new Error("[VisIQ] createVisiqClient: one of accessToken or cookieHeader is required");let t=e.baseUrl.replace(/\/$/,""),n=e.fetchImpl??globalThis.fetch.bind(globalThis),r={baseUrl:t,accessToken:e.accessToken,cookieHeader:e.cookieHeader,fetchImpl:n};return{fleet:new Oe(r),integrations:new Ne(r)}}async function ee(e,t,n,r){let i=`${e.baseUrl}${n.startsWith("/")?n:`/${n}`}`,o={...W(V)};e.cookieHeader&&(o.Cookie=e.cookieHeader),e.accessToken&&(o.Authorization=`Bearer ${e.accessToken}`);let a;r!==void 0&&(o["Content-Type"]="application/json",a=JSON.stringify(r));let s=await e.fetchImpl(i,{method:t,headers:o,body:a});if(!s.ok){let l="";try{l=await s.text()}catch{}throw new Error(`[VisIQ] ${t} ${n} failed (${s.status}): ${l||s.statusText}`)}return await s.json()}var gi=li;gi.delegate=mi;var ju=gi;export{He as DEFAULT_FAIL_MODE,Oe as FleetClient,Ne as IntegrationsClient,Kl as createVisiqClient,mi as delegate,Ie as normalizeFailMode,ju as visiq};
|
|
6
|
+
-----END PRIVATE KEY-----`,template:{pattern:I.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:I.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:I.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:I.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:I.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:I.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:I.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:I.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:I.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:I.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS). Collision rate: MEASURED 9.8% of benign 16-digit runs \u2014 Luhn leaves ~1 in 10. Default-ON because PCI-DSS makes masking mandatory; note in_aadhaar sits at the same rate and is often proposed for removal on that basis.",category:"financial",example:"4242 4242 4242 4242",template:{pattern:I.pan,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY 13-19 digit run (grouped or not) \u2014 the floor's regex without the checksum that makes it precise. ~9 in 10 of those are not card numbers.",examples:["4242 4242 4242 4243","4242424242424241"],measuredOverMaskRate:.531}},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible. Collision rate: MEASURED 1.0% \u2014 mod-97 leaves ~1 in 97, the most precise detector on this floor alongside br_cpf.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:I.iban,mode:"partial",keepLast:4,templateOnly:{reason:"A rego rule cannot run mod-97, so the rule masks EVERY IBAN-SHAPED token (2 letters, 2 digits, 10-30 alphanumerics) \u2014 and mod-97 is what makes this the most precise detector on the floor, so almost all of those are not IBANs.",examples:["DE89 3704 0044 0532 0130 01","GB00 NWBK 6016 1331 9268 19"],measuredOverMaskRate:.934}},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:I.aba_routing,mode:"full",templateOnly:{reason:"A rego rule cannot run the weighted 3-7-1 mod-10, so the rule masks EVERY bare 9-digit run \u2014 which is why this detector is default-OFF on the floor and why its rule form is broader still.",examples:["021000022","123456789"],measuredOverMaskRate:.899}},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX). Collision rate: MEASURED 100% \u2014 no checksum, so every 2-then-7 dashed digit run matches. Same trade as ssn: the punctuated shape is rare in benign traffic, not precise.",category:"financial",example:"12-3456789",template:{pattern:I.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:I.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789). Collision rate: MEASURED 100% \u2014 there is NO checksum, so every dashed 3-2-4 digit run matches. Default-ON regardless, because that punctuated shape is essentially absent from benign agent traffic; if your traffic carries 3-2-4 dashed reference codes, opt out.",category:"pii",example:"123-45-6789",template:{pattern:I.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},uk_nino:{id:"uk_nino",label:"UK National Insurance numbers",description:"UK NINOs (e.g. AB 12 34 56 C). DEFAULT-OFF \u2014 NO CHECKSUM. Precision comes only from the issued alphabet and the never-issued administrative prefixes (BG, GB, NK, KN, TN, NT, ZZ), so roughly half of tokens already shaped 2-letters/6-digits/[A-D] validate. All-lowercase candidates are rejected (git short SHAs), but that does NOT exclude uppercase business identifiers \u2014 serial, part, batch, PO, coupon and asset tags share the shape exactly and were measured being masked. Opt in when UK NINOs are expected in your traffic.",category:"pii",example:"AB 12 34 56 C",template:{pattern:"\\b(?:[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-Da-d]|[A-CEGHJ-PR-TW-Za-ceghj-pr-tw-z][A-CEGHJ-NPR-TW-Za-ceghj-npr-tw-z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-D])\\b",mode:"full",templateOnly:{reason:"uk_nino has no checksum, but the floor still rejects the seven NEVER-ISSUED administrative prefixes (BG GB NK KN TN NT ZZ). A rego rule cannot express that exclusion without enumerating hundreds of letter pairs (RE2 has no lookahead), so the rule masks those too.",examples:["NK 12 34 56 A","ZZ 12 34 56 C"],measuredOverMaskRate:.019}},defaultEnabled:!1},in_aadhaar:{id:"in_aadhaar",label:"Aadhaar numbers (India)",description:"12-digit UIDAI Aadhaar numbers, Verhoeff-checksum validated and constrained to the issued 2-9 leading digit. Keeps the last 4 visible. Collision rate: MEASURED 10.0% of benign 12-digit ids starting 2-9 (order/transaction numbers) \u2014 Verhoeff leaves ~1 in 10. Comparable to the long-shipped pan (10.0%) and well behind iban (1.0%); it stays default-ON because the two US identifiers this floor has always shipped, ssn and us_ein, collide at 100%.",category:"pii",example:"2345 6789 0124",template:{pattern:"\\b[2-9]\\d{3}(?:[ -]\\d{4}[ -]?\\d{4}|\\d{4}[ -]\\d{4})\\b",mode:"partial",keepLast:4,floorOnly:{reason:"The floor accepts the entirely UNPUNCTUATED 12-digit form because Verhoeff gates it (~1 in 10 survive). A rego rule cannot run Verhoeff, so a bare \\d{12} in a rule would mask every 12-digit order id and E.164 Indian mobile number in the tenant. The rule requires at least one printed separator \u2014 every half-punctuated form is covered; only the bare digit run stays floor-only.",examples:["234567890124","id=234567890124"]},templateOnly:{reason:"A rego rule cannot run the Verhoeff checksum, so the rule masks EVERY 4-4-4 grouping that starts 2-9 \u2014 including the ~9 in 10 that are not Aadhaar numbers at all.",examples:["2345 6789 0125","2345-6789-0123"],measuredOverMaskRate:.903}},defaultEnabled:!0},in_pan_tax:{id:"in_pan_tax",label:"India PAN (tax ID)",description:"India Permanent Account Number \u2014 the income-tax id (ABCPE1234F), NOT a payment-card PAN. NO CHECKSUM: the only discriminator is the holder-type letter in position 4, which removes just 15 of 26 possibilities in one position, so roughly 4 in 10 uniform 5-letter/4-digit/1-letter tokens validate. DEFAULT-OFF for that reason \u2014 an uppercase SKU or part number of the same shape is masked, and nothing in the value distinguishes it.",category:"financial",example:"ABCPE1234F",template:{pattern:I.in_pan_tax,mode:"full"},defaultEnabled:!1},br_cpf:{id:"br_cpf",label:"CPF numbers (Brazil)",description:"Brazilian CPF, closed by TWO independent mod-11 check digits. Collision rate: MEASURED 1.0% of benign 11-digit runs (~1-in-100) \u2014 the most precise detector on this floor, alongside iban. Repdigits are rejected. Keeps the last 2 visible.",category:"pii",example:"123.456.789-09",template:{pattern:"\\b\\d{3}(?:\\.\\d{3}\\.?\\d{3}-?\\d{2}|\\d{3}(?:\\.\\d{3}-?\\d{2}|\\d{3}-\\d{2}))\\b",mode:"partial",keepLast:2,floorOnly:{reason:"The floor accepts the entirely bare 11-digit form because TWO mod-11 check digits gate it (~1 in 100 survive). A rego rule cannot run mod-11, so a bare \\d{11} in a rule would mask every 11-digit identifier in the tenant. The rule requires at least one printed separator; the bare form stays floor-only.",examples:["11144477735","ref 11144477735","12345678909"]},templateOnly:{reason:"A rego rule cannot run the two mod-11 check digits, so the rule masks EVERY punctuated 3-3-3-2 digit grouping \u2014 including the ~99 in 100 that are not CPFs.",examples:["123.456.789-10","111.444.777-34"],measuredOverMaskRate:.995}},defaultEnabled:!0},es_dni_nie:{id:"es_dni_nie",label:"DNI / NIE numbers (Spain)",description:"Spanish national ID (8 digits + letter) and foreigner ID (X/Y/Z + 7 digits + letter), validated by the mod-23 check letter. Collision rate: MEASURED 4.0% of benign 8-digit-plus-letter tokens (invoice/order numbers with a suffix letter) \u2014 mod-23 leaves ~1 in 23. More precise than in_aadhaar (10.0%) and pan (10.0%); behind br_cpf (1.0%) and iban (1.0%).",category:"pii",example:"12345678Z",template:{pattern:I.es_dni_nie,mode:"full",templateOnly:{reason:"A rego rule cannot run the mod-23 check letter, so the rule masks EVERY 7-8 digit run followed by a letter \u2014 invoice and order numbers with a suffix letter included. mod-23 admits ~1 in 23; the rule admits all of them. Re-measured 0.973 \u2192 0.981 when the floor learned the printed forms (dotted DNI, hyphenated NIE): the rule now also matches those written forms, and ~22 in 23 of them are not DNI/NIEs. The FLOOR's own rate is unchanged \u2014 mod-23, not punctuation, gates it.",examples:["12345678A","X1234567H"],measuredOverMaskRate:.976}},defaultEnabled:!0},ca_sin:{id:"ca_sin",label:"SIN numbers (Canada)",description:"Canadian Social Insurance Numbers (9-digit, Luhn-validated). DEFAULT-OFF \u2014 identical shape to an ABA routing number and to any 9-digit id, with only a mod-10 pass to separate them.",category:"pii",example:"046 454 286",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{3}|\\d{3}[- ]\\d{3})\\b",mode:"partial",keepLast:3,floorOnly:{reason:"The floor accepts the entirely bare 9-digit form because Luhn gates it. A rego rule cannot run Luhn, and a bare \\d{9} in a rule is also every ABA routing number and every 9-digit identifier, so the rule requires at least one printed separator in the 3-3-3 grouping.",examples:["046454286"]},templateOnly:{reason:"A rego rule cannot run Luhn, so the rule masks EVERY printed 3-3-3 digit grouping \u2014 including the ~9 in 10 that are not SINs.",examples:["046 454 287","123 456 789"],measuredOverMaskRate:.914}},defaultEnabled:!1},uk_nhs_number:{id:"uk_nhs_number",label:"NHS numbers (UK)",description:"UK NHS patient numbers (10-digit, weighted mod-11). DEFAULT-OFF \u2014 a 10-digit run is also every North American phone number.",category:"pii",example:"943 476 5919",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{4}|\\d{3}[- ]\\d{4})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 10-digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{10} in a rule is also every North American phone number, so the rule requires at least one printed separator in the 3-3-4 grouping.",examples:["9434765919"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-4 digit grouping \u2014 every North American phone number included \u2014 not just the ~1 in 10 that are NHS numbers.",examples:["943 476 5910","123 456 7890"],measuredOverMaskRate:.899}},defaultEnabled:!1},au_tfn:{id:"au_tfn",label:"Tax File Numbers (Australia)",description:"Australian TFNs (8-9 digit, weighted mod-11). DEFAULT-OFF \u2014 collides with essentially every 8-9 digit identifier.",category:"financial",example:"123 456 782",template:{pattern:"\\b\\d{3}(?:[- ]\\d{3}[- ]?\\d{2,3}|\\d{3}[- ]\\d{2,3})\\b",mode:"full",floorOnly:{reason:"The floor accepts the entirely bare 8-9 digit form because the weighted mod-11 gates it. A rego rule cannot run mod-11, and a bare \\d{8,9} in a rule collides with essentially every identifier of that length, so the rule requires at least one printed separator. BOTH lengths are in the gap: a TFN may be 8 digits (`12345679`) or 9 (`123456782`), and the 8-digit branch went undeclared while the parity sweep derived its population from the 9-digit example alone.",examples:["12345679","123456782"]},templateOnly:{reason:"A rego rule cannot run the weighted mod-11, so the rule masks EVERY printed 3-3-2/3-3-3 digit grouping \u2014 including the ~9 in 10 that are not TFNs.",examples:["123 456 783","123 456 78"],measuredOverMaskRate:.912}},defaultEnabled:!1},date_of_birth:{id:"date_of_birth",label:"Dates of birth",description:"Dates in the common written formats. DEFAULT-OFF and heavily over-masking by nature \u2014 a DOB is indistinguishable from any other date (created_at, invoice, release). Offered because DOB is a GDPR/HIPAA identifier some regulated tenants must mask regardless.",category:"pii",example:"1985-04-12",template:{pattern:I.date_of_birth,mode:"full"},defaultEnabled:!1},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept). Collision rate: MEASURED 100% of well-formed addresses \u2014 that is BY DESIGN, not a defect: an email address is structurally unambiguous, so matching every one is correct rather than over-matching.",category:"pii",example:"alice@acme.com",template:{pattern:I.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:I.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:I.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:I.mac_address,mode:"full"},defaultEnabled:!1}},Ve=Object.freeze(Object.fromEntries(wt.map(e=>{let t=Qo[e];return[e,{...t,template:{...t.template,pattern:Do(gt(t.template.pattern))}}]})));var pc=new Set(wt.filter(e=>!Ve[e].defaultEnabled));function Yo(e,t){let n=new Set;for(let r of wt)(Ve[r].defaultEnabled?!e?.has(r):t?.has(r))||n.add(r);return n}function qe(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=kt(t),o=e;for(let{name:a,re:s}of Zn){let l=a;n.has(l)||(o=o.replace(s,c=>(r?.(l),i(c))))}for(let{name:a,re:s,normalize:l,validate:c}of Jn)n.has(a)||(o=sa(o,s,l,c,t,a,r));return o}function kt(e){return typeof e=="function"?e:()=>e}var Nn=e=>"\0".repeat(e.length);function Zo(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=_t(e);if(i.length===0)return qe(e,t,n,r);let o=new Set,a=f=>{o.add(f)},s=qe(e,Nn,n,a),l=!0,c=new Array(e.length).fill(!1);for(let f=0;f<e.length;f++)c[f]=s[f]==="\0"&&e[f]!=="\0";for(let f of i){let g=qe(f.text,Nn,n,a);for(let m=0;m<f.text.length;m++)if(!(g[m]!=="\0"||f.text[m]==="\0"))for(let p=f.offsets[m];p<f.offsets[m+1];p++)c[p]||(c[p]=!0,l=!1)}if(l)return qe(e,t,n,r);for(let f of o)r?.(f);let u="",d=0;for(;d<e.length;){if(!c[d]){u+=e[d],d++;continue}let f=d;for(;d<e.length&&c[d];)d++;u+=kt(t)(e.slice(f,d))}return u}function Ae(e){return e===void 0||!/[A-Za-z0-9]/.test(e)}var Mn=new Map;function Jo(e){let t=Mn.get(e.source);return t===void 0&&(t=new RegExp(`^(?:${e.source})$`),Mn.set(e.source,t)),t}var Xo=4096,ea=64,Dn=null;function ta(e){return Dn!==null?Dn:Xo+e.length*ea}var Xn=!1,F={spanCalls:0,spanMisses:0,cutCalls:0,cutMisses:0,budgetExhausted:0,maxMissesInAPass:0},er={spanBudget:0,depthCap:0};function na(e){return{stride:e.length+1,chosen:new Map,cuts:new Map,budget:ta(e),exhausted:!1}}function tr(e,t,n,r,i,o,a){F.spanCalls++;let s=t*a.stride+n.length,l=Xn?void 0:a.chosen.get(s);if(l!==void 0)return l;if(a.budget<=0)return a.exhausted=!0,null;a.budget--,F.spanMisses++;let c=ra(e,t,n,r,i,o,a);return a.chosen.set(s,c),c}function ra(e,t,n,r,i,o,a){let s=Jo(r),l=[];for(let u=n.length-1;u>=1;u--)if(Ae(n[u])){let d=n.slice(0,u);s.test(d)&&l.push(d)}let c=Ae(e[t+n.length])?[n,...l]:[...l,n];for(let u of c)if(o(i(u),u)&&!oa(e,t,u,r,i,o,a))return u;return null}var Ln=new Map;function ia(e){let t=Ln.get(e.source);return t===void 0&&(t=new RegExp(e.source,"y"),Ln.set(e.source,t)),t}function oa(e,t,n,r,i,o,a){F.cutCalls++;let s=t*a.stride+n.length,l=Xn?void 0:a.cuts.get(s);if(l!==void 0)return l;if(a.budget<=0)return a.exhausted=!0,!0;a.budget--,F.cutMisses++;let c=aa(e,t,n,r,i,o,a);return a.cuts.set(s,c),c}function aa(e,t,n,r,i,o,a){let s=t+n.length,l=ia(r);for(let c=1;c<n.length;c++){if(Ae(n[c])||!Ae(n[c-1]))continue;let u=t+c;l.lastIndex=u;let d=l.exec(e);if(d===null||d[0].length===0)continue;let f=tr(e,u,d[0],r,i,o,a);if(f!==null&&u+f.length>s&&Ae(e[u+f.length]))return!0}return!1}function sa(e,t,n,r,i,o,a){let s=kt(i);t.lastIndex=0;let l="",c=0,u=na(e),d=F.spanMisses+F.cutMisses,f;for(;(f=t.exec(e))!==null;){let g=f[0],m=f.index;if(g.length===0){t.lastIndex=m+1;continue}let p;try{p=tr(e,m,g,t,n,r,u)}catch(_){if(_ instanceof RangeError&&/call stack/i.test(_.message))u.exhausted=!0,p=null;else throw _}if(u.exhausted)return F.budgetExhausted++,er.spanBudget++,Fn(d),l+e.slice(c,m)+s(e.slice(m));if(p!==null)a?.(o),l+=e.slice(c,m)+s(p),c=m+p.length,t.lastIndex=c;else{let _=g.slice(1).search(/[^A-Za-z0-9]/);t.lastIndex=_===-1?m+g.length:m+1+_+1}if(t.lastIndex>e.length)break}return Fn(d),l+e.slice(c)}function Fn(e){let t=F.spanMisses+F.cutMisses-e;t>F.maxMissesInAPass&&(F.maxMissesInAPass=t)}function At(e,t=Wn,n,r){return ca(e,t,Yo(n,r))}var la=256;function ca(e,t,n){let r=new Set,i=!n.has("pan"),o=s=>{r.add(s)},a=(s,l)=>{if(l>la)return er.depthCap++,t;if(typeof s=="string")return Zo(s,t,n,o);if(typeof s=="number"&&Number.isInteger(s)&&s>0){if(!i)return s;let c=String(s);return c.length>=13&&c.length<=19&&ht(c)?(r.add("pan"),t):s}if(Array.isArray(s))return s.map(c=>a(c,l+1));if(s!==null&&typeof s=="object"){let c=s,u={};for(let d of Object.keys(c))u[d]=a(c[d],l+1);return u}return s};return{value:a(e,0),detectors:[...r].sort()}}function nr(e,t=Wn){return At(e,t).value}function ua(e){let{value:t,detectors:n}=At(e),r=n.some(i=>Ve[i].category==="secret");return{detectors:n,blocked:r,redacted:t}}function da(e,t){let{blocked:n,redacted:r,detectors:i}=ua(e);return n?t.failMode==="closed"?{verdict:"block",redacted:r,detectors:i}:{verdict:"redact",redacted:r,detectors:i}:{verdict:"allow",redacted:r,detectors:i}}function pa(e){if(typeof e!="string"||e.length===0)return e;let t=e.lastIndexOf("__");return t<0?e:e.slice(t+2)}var fa=new Set(["send","send_email","send_message","email","email_send","message","post","post_message","http_post","upload","export","export_data","share","publish","webhook"]);function ma(e){return fa.has(pa(e))}function ie(e,t,n){return n.enforced&&ma(e)?da(t,{failMode:n.failMode}):{verdict:"allow",redacted:t,detectors:[]}}var ga=/[\u00AD\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFEFF]/g,rr=Object.freeze({\u0430:"a",\u0435:"e",\u043E:"o",\u0440:"p",\u0441:"c",\u0443:"y",\u0445:"x",\u0456:"i",\u0455:"s",\u043A:"k",\u043C:"m",\u0442:"t",\u043D:"h",\u0432:"b",\u0433:"r",\u03BF:"o",\u03B1:"a",\u03C1:"p",\u03B9:"i",\u03C4:"t",\u03B5:"e",\u03BA:"k",\u03BD:"v",\u03C5:"u",\u03B7:"n",\u0131:"i","\u04CF":"l",\u0578:"n"}),ha=new RegExp(`[${Object.keys(rr).join("")}]`,"gu"),ya=Object.freeze({4:"a","@":"a",3:"e",1:"i","!":"i",0:"o",5:"s",$:"s",7:"t",9:"g","(":"c",8:"b"}),ir="\u2801\u2803\u2809\u2819\u2811\u280B\u281B\u2813\u280A\u281A\u2805\u2807\u280D\u281D\u2815\u280F\u281F\u2817\u280E\u281E\u2825\u2827\u283A\u282D\u283D\u2835",_a=Object.freeze(Object.fromEntries([...ir].map((e,t)=>[e,String.fromCharCode(97+t)]))),ba=new RegExp(`[${ir}\u2800]`,"g"),or=/[⠀-⣿]/;function va(e){let t="";for(let n of e){let r=n.codePointAt(0);r!==void 0&&(r>=917536&&r<=917630?t+=String.fromCodePoint(r-917504):r>=917504&&r<=917631||(t+=n))}return t}function wa(e){return e.replace(ga,"")}function ar(e){return e.replace(ha,t=>rr[t]??t)}function ka(e){return e.replace(/[4@31!05$79(8]/g,t=>ya[t]??t)}function Aa(e){return e.replace(/[a-zA-Z]/g,t=>{let n=t<="Z"?65:97;return String.fromCharCode((t.charCodeAt(0)-n+13)%26+n)})}function Ia(e){return or.test(e)?e.replace(ba,t=>t==="\u2800"?" ":_a[t]??t):e}function $n(e){let t;try{t=va(e)}catch{t=e}try{t=t.normalize("NFKC")}catch{}return t=wa(t),t=ar(t),t}var Sa=/^[A-Za-z0-9+/]{16,}={0,2}$/,Ea=/^(?:[0-9a-fA-F]{2}\s*){8,}$/,Pn=/[A-Za-z0-9+/]{20,}={0,2}/g;function yt(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);(r===9||r===10||r===13||r>=32&&r<=126||r>=160&&r!==65533)&&t++}return t/e.length}var sr=new TextDecoder("utf-8",{fatal:!1});function lr(e){let t;try{t=atob(e)}catch{return[]}let n=new Uint8Array(t.length);for(let i=0;i<t.length;i++)n[i]=t.charCodeAt(i)&255;let r=sr.decode(n);return t===r?[t]:[r,t]}function Ta(e){let t=e.replace(/\s+/g,"");if(t.length===0||t.length%2!==0)return[];let n=new Uint8Array(t.length/2);for(let o=0;o<n.length;o++){let a=Number.parseInt(t.slice(o*2,o*2+2),16);if(Number.isNaN(a))return[];n[o]=a}let r="";for(let o=0;o<n.length;o++)r+=String.fromCharCode(n[o]);let i=sr.decode(n);return r===i?[r]:[i,r]}function jn(e){let t=e.trim(),n=[];if(Ea.test(t))for(let r of Ta(t))n.push({decoded:r,textiness:yt(r)});if(Sa.test(t)&&t.length%4===0)for(let r of lr(t))n.push({decoded:r,textiness:yt(r)});return n}function Bn(e,t){let n=[],r;for(Pn.lastIndex=0;(r=Pn.exec(e))!==null&&n.length<t;){let i=r[0];if(i.length%4===0)for(let o of lr(i))n.push({decoded:o,textiness:yt(o)})}return n}var Ra=Object.freeze({maxDepth:3,byteCap:262144,maxNodes:256,maxBlobsPerNode:8});function cr(e,t=Ra){if(typeof e!="string"||e.length===0)return{views:[],anyDecoded:!1,truncated:!1,nodes:0,maxDepthSeen:0};let{maxDepth:n,byteCap:r,maxNodes:i,maxBlobsPerNode:o}=t,a=new Set,s=g=>{g.length>0&&g.length<=r&&a.add(g)},l=!1,c=!1,u=0,d=0,f=[{s:e,depth:0}];for(;f.length>0;){if(u>=i){c=!0;break}let g=f.pop();if(g===void 0)break;let{s:m,depth:p}=g;if(m.length>r){c=!0;continue}u++,p>d&&(d=p);let _=$n(m);s(_);let O=ka(_);if(O!==_&&s(O),s(Aa(_)),or.test(m)&&s(Ia(_)),p>=n){let R=$n(m);(jn(R).length>0||Bn(R,o).length>0)&&(c=!0);continue}let A=[...jn(_),...Bn(_,o)];for(let R of A){if(l=!0,R.decoded.length>r){c=!0;continue}R.textiness>=.85&&R.decoded!==_?f.push({s:R.decoded,depth:p+1}):s(R.decoded)}}return{views:[...a],anyDecoded:l,truncated:c,nodes:u,maxDepthSeen:d}}var ur=["hidden_text_carrier","injected_turn_boundary","mixed_script_token","nested_encoding_payload"],Ca=Object.freeze(["hidden_text_carrier","injected_turn_boundary","mixed_script_token"]),xa=8,Oa=new Set([173,8203,8204,8205,8206,8207,8288,65279,8234,8235,8236,8237,8238,8294,8295,8296,8297]),Un=e=>e!==void 0&&(e>=65&&e<=90||e>=97&&e<=122);function Na(e){let t=[...e].map(r=>r.codePointAt(0)),n=0;for(let r=0;r<t.length;r++){let i=t[r];if(i>=917504&&i<=917631||Oa.has(i)&&Un(t[r-1])&&Un(t[r+1])&&(n++,n>=xa))return!0}return!1}var Ma=/^[ \t]*(?:system|assistant|developer|user)[ \t]*:/i;function Da(e){let t=e.split(/\r?\n/),n=!1;for(let r of t){if(Ma.test(r)){if(n)return!0;continue}r.trim().length>0&&(n=!0)}return!1}var La=[{name:"latin",lo:65,hi:591},{name:"greek",lo:880,hi:1023},{name:"cyrillic",lo:1024,hi:1279}];function Fa(e){for(let t of La)if(e>=t.lo&&e<=t.hi)return t.name;return null}function $a(e){for(let t of e.split(/\s+/)){if(t.length<4)continue;let n=0,r=0,i=!0;for(let o of t){let a=Fa(o.codePointAt(0));if(a===null){i=!1;break}a==="latin"?n++:ar(o)!==o&&r++}if(i&&n>0&&r>0)return!0}return!1}var qn=Object.freeze({signals:[],contributes:!1});function Pa(e){if(typeof e!="string"||e.length===0)return{...qn,signals:[]};let t=new Set;try{Na(e)&&t.add("hidden_text_carrier"),Da(e)&&t.add("injected_turn_boundary"),$a(e)&&t.add("mixed_script_token");let{anyDecoded:n,maxDepthSeen:r,truncated:i}=cr(e);n&&(r>=2||i)&&t.add("nested_encoding_payload")}catch{return{...qn,signals:[]}}return{signals:[...ur.filter(n=>t.has(n))],contributes:Ca.some(n=>t.has(n))}}var Ke=[{name:"override_instructions",re:/\bignore (?:all |the )?(?:previous|above|prior) (?:instructions|prompts?)\b/i},{name:"disregard_instructions",re:/\bdisregard (?:the )?(?:above|previous|system)\b/i},{name:"role_tag",re:/<\/?(system|assistant|instructions|host_context)\b/i},{name:"privilege_override",re:/\b(grant|escalate|elevate) (admin|root|all|full) (access|privileges?)\b/i},{name:"tool_smuggle",re:/```[\s\S]*?(tool_call|function_call)/i}];function zn(e){return typeof e!="string"||e.length===0?[]:Ke.filter(({re:t})=>t.test(e)).map(({name:t})=>t)}function ja(e){if(typeof e!="string"||e.length===0)return[];let t=new Set(zn(e)),{views:n}=cr(e);for(let r of n)for(let i of zn(r))t.add(i);return Ke.filter(r=>t.has(r.name)).map(r=>r.name)}function Ba(e){let t=new Set,n=new Set,r=!1,i=o=>{if(o!=null){if(typeof o=="string"){for(let s of ja(o))t.add(s);let a=Pa(o);for(let s of a.signals)n.add(s);a.contributes&&(r=!0);return}if(Array.isArray(o)){for(let a of o)i(a);return}if(typeof o=="object")for(let a of Object.values(o))i(a)}};return i(e),{matched:t.size>0||r,signatures:Ke.filter(o=>t.has(o.name)).map(o=>o.name),structural:ur.filter(o=>n.has(o))}}function Ua(e){return Ba(e).matched}var fc=Ke.map(e=>e.name);var qa=new Set(["untrusted","external","public","public_internet","external_third_party","web"]);var za="i:injection";function dr(e){let t=new Set;if(e.content!==void 0&&e.content!==null){let{detectors:i}=At(e.content);for(let o of i){let a=Ve[o]?.category;a&&t.add(`c:${a}`)}Ua(e.content)&&t.add(za)}let n=e.resourceMetadata??{},r=n.source_trust;return(n.untrusted_source===!0||typeof r=="string"&&qa.has(r.toLowerCase()))&&t.add("i:untrusted"),[...t].sort()}var mt="(?:system\\s+prompt|initial\\s+(?:instructions|prompt)|system\\s+(?:instructions|message)|hidden\\s+(?:instructions|prompt)|your\\s+(?:system\\s+prompt|initial\\s+instructions|instructions|prompt)|the\\s+prompt\\s+(?:above|you\\s+were\\s+given))",mc=[{name:"reveal_prompt",re:new RegExp(`\\b(?:reveal|show|print|repeat|output|echo|display|expose|dump|leak|reprint|divulge|disclose)\\b[\\s\\S]{0,40}?\\b${mt}\\b`,"i")},{name:"what_is_prompt",re:new RegExp(`\\bwhat\\s+(?:is|are|were)\\b[\\s\\S]{0,20}?\\b${mt}\\b`,"i")},{name:"tell_me_prompt",re:new RegExp(`\\b(?:tell|give|send|show)\\s+me\\b[\\s\\S]{0,30}?\\b${mt}\\b`,"i")},{name:"repeat_above",re:/\b(?:repeat|print|output|echo|reproduce)\b[\s\S]{0,20}?\b(?:everything|all\s+(?:the\s+)?(?:text|words))\b[\s\S]{0,12}?\b(?:above|before|preceding|verbatim|word\s+for\s+word)\b/i}],Vn="(?:instructions?|prompts?|rules?|directives?|guidelines?|constraints?|guardrails?)",Va=`(?:(?:all\\s+|any\\s+|the\\s+|these\\s+|those\\s+)*(?:previous|prior|preceding|earlier|above|foregoing|initial|original|system|developer)\\s+${Vn}|your\\s+(?:(?:system|initial|original|previous|prior|current)\\s+)?(?:${Vn}|programming|training))`,Ka="(?:(?:all|any|every|the|of|and|now|please|completely|entirely|totally|immediately)\\s+){0,3}",Kn="(?:\\b(?:unrestricted|unfiltered|uncensored|unbounded|unlimited|unchained|jailbroken|lawless|amoral)\\b|\\b(?:DAN|STAN|DUDE|AIM)\\b|\\bno\\s+(?:longer\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|boundaries|constraints?)\\b(?!\\s+(?:on|over|regarding|upon|for)\\b)|\\bwithout\\s+(?:any\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|constraints?|censorship)\\b|\\b(?:free|freed|released)\\s+from\\s+(?:your\\s+)?(?:restrictions?|limits?|rules?|guidelines?|guardrails?|programming|constraints?)\\b|\\b(?:can|will|are\\s+able\\s+to)\\s+(?:do|say)\\s+anything\\b|\\bignore\\s+(?:all\\s+)?(?:your\\s+)?(?:previous\\s+|prior\\s+|system\\s+)?(?:instructions?|rules?|guidelines?)\\b)",Ga="(?:ignore|disregard|forget|override|overrule|bypass|obey|comply\\s+with|follow\\s+(?:only|my|these))",gc=[{name:"override_instructions",re:new RegExp(`\\b(?:ignore|disregard|forget|discard|override|overrule|bypass|delete|erase)\\s+${Ka}${Va}\\b`,"i")},{name:"forget_everything_prior",re:/\b(?:forget|ignore|disregard|erase|discard)\s+(?:about\s+|all\s+|any\s+)?(?:everything|anything)\b[\s\S]{0,24}?\b(?:above|before|previously|prior|earlier|you\s+(?:were|have\s+been)\s+(?:told|instructed|given|programmed))\b/i},{name:"persona_reassignment_jailbreak",re:new RegExp(`\\byou\\s+are\\s+now\\s+(?:(?:a|an|the)\\s+)?[\\s\\S]{0,48}?${Kn}`,"i")},{name:"constraint_release",re:/\byou\s+are\s+no\s+longer\s+(?:bound|restricted|limited|constrained|obligated|governed|subject\s+to|required\s+to)\b/i},{name:"from_now_on_reassignment",re:new RegExp(`\\bfrom\\s+now\\s+on\\s*,?\\s+you\\s+(?:are|will|must|shall|have|can)\\s+(?:${Ga}\\b|[\\s\\S]{0,40}?${Kn})`,"i")},{name:"new_instructions_header",re:/^\s*(?:[#*>-]+\s*)?(?:new|real|actual|true|secret|hidden|override)\s+(?:system\s+)?(?:instructions?|prompts?|directives?)\s*:/im}];var hc=Object.freeze({"\u2019":"'",\u02BC:"'","\uFF07":"'","\u02B9":"'","\u2032":"'"});var z=e=>`[^.!?;\\n]{0,${e}}?`,Ha=["\\bi\\s+(?:can'?t|cannot|can\\s+not|won'?t|will\\s+not)\\b","\\bi(?:'m|\\s+am)\\s+(?:not\\s+able\\s+to|unable\\s+to|not\\s+going\\s+to|not\\s+permitted\\s+to|not\\s+allowed\\s+to)\\b"].join("|"),pr="(?:help|assist|provide|create|generate|produce|write|compose|draft|comply|fulfil|fulfill|share|disclose|reveal|perform|execute|run|send|transmit|publish|export|approve|grant|carry\\s+out|do\\s+that|do\\s+this|do\\s+so|go\\s+ahead)",yc=Object.freeze([{id:"capability_denial",class:"strong",re:new RegExp([`(?:${Ha})\\s${z(40)}\\b${pr}\\b`,"\\b(?:that|this|it)(?:'s|\\s+is)\\s+not\\s+something\\s+i\\s+(?:can|could|am\\s+able\\s+to|'m\\s+able\\s+to)\\b",`\\b(?:falls|sits|is)\\s+outside\\s+(?:of\\s+)?(?:what|the\\s+(?:scope|range|bounds))\\b${z(40)}\\bi\\s+(?:can|am|'m)\\b`,"\\bnot\\s+something\\s+i(?:'m|\\s+am)\\s+(?:able|willing|permitted|allowed)\\s+to\\b"].join("|"),"i")},{id:"explicit_decline",class:"strong",re:new RegExp(["\\bi\\s+(?:must|have\\s+to|need\\s+to|will\\s+have\\s+to|am\\s+going\\s+to|'m\\s+going\\s+to)\\s+(?:respectfully\\s+)?decline\\b","\\bi(?:'m|\\s+am)\\s+not\\s+(?:comfortable|willing|prepared)\\b","\\bi(?:'ll|\\s+will)\\s+(?:have\\s+to\\s+)?pass\\s+on\\b","\\bi\\s+(?:must|have\\s+to)\\s+refuse\\b"].join("|"),"i")},{id:"policy_citation",class:"strong",re:new RegExp([`\\b(?:against|contrary\\s+to|prohibited\\s+by|forbidden\\s+by|in\\s+violation\\s+of|violates)\\s${z(24)}\\b(?:polic(?:y|ies)|guidelines?|terms\\s+of\\s+(?:use|service)|rules\\s+of\\s+engagement|code\\s+of\\s+conduct)\\b`,`\\b(?:my|our|the|company|organi[sz]ation'?s?)\\s+(?:polic(?:y|ies)|guidelines?)\\s${z(24)}\\b(?:do(?:es)?\\s+not\\s+(?:allow|permit)|prohibit|forbid|prevent)\\b`,`\\bnot\\s+(?:permitted|allowed|authori[sz]ed)\\s+(?:under|by)\\s${z(24)}\\b(?:polic(?:y|ies)|guidelines?)\\b`].join("|"),"i")},{id:"guardrail_selfreference",class:"strong",re:new RegExp(["\\bi(?:'ve|\\s+have)\\s+been\\s+(?:instructed|configured|told|trained)\\s+not\\s+to\\b","\\bi(?:'m|\\s+am)\\s+(?:designed|configured|programmed|built|set\\s+up)\\s+not\\s+to\\b",`\\bmy\\s+(?:safety\\s+)?(?:instructions|configuration|guardrails?|constraints|training)\\s${z(24)}\\b(?:prevent|prohibit|forbid|do(?:es)?\\s+not\\s+(?:allow|permit)|preclude)\\b`,"\\b(?:outside|beyond)\\s+(?:my|the)\\s+(?:permitted|authori[sz]ed|configured|approved)\\s+(?:scope|remit|capabilities|actions|operations)\\b"].join("|"),"i")},{id:"ethical_objection",class:"strong",re:new RegExp(["\\b(?:that|this|doing\\s+(?:so|that)|what\\s+you(?:'re|\\s+are)\\s+asking|the\\s+request|such\\s+a\\s+request)\\s+(?:would\\s+be|is|are)\\s+(?:clearly\\s+|both\\s+|potentially\\s+)?(?:illegal|unethical|unlawful|harmful|fraudulent)\\b","\\bi\\s+(?:do\\s+not|don'?t)\\s+condone\\b","\\b(?:goes|would\\s+go|runs)\\s+against\\s+my\\s+(?:principles|values|ethics)\\b","\\bi\\s+(?:can'?t|cannot|won'?t)\\s+in\\s+good\\s+conscience\\b"].join("|"),"i")},{id:"apology_marker",class:"weak",re:new RegExp("\\b(?:i(?:'m|\\s+am)\\s+(?:really\\s+|very\\s+|terribly\\s+|so\\s+)?sorry|i\\s+apologi[sz]e|my\\s+apologies)\\b","i")}]),_c=Object.freeze([/```/,/\b(?:here(?:'s|\s+is|\s+are)|below\s+(?:is|are|you(?:'ll|\s+will)\s+find)|the\s+following\s+(?:is|are))\b/i,new RegExp(`\\b(?:but|however|instead|although|that\\s+said)\\b${z(60)}\\b(?:i\\s+(?:can|could)(?!'t)\\s${z(30)}\\b${pr}\\b|i(?:'d|\\s+would)\\s+be\\s+happy\\s+to\\b|i(?:'m|\\s+am)\\s+able\\s+to\\b)`,"i"),/\bwhat\s+i\s+can\s+do\s+(?:instead|is|for\s+you)\b/i]);var ke=e=>`[^.!?;\\n]{0,${e}}?`,bc=Object.freeze([{id:"vulnerability_scanning",objectPatterns:[/\b(?:vulnerability|vuln|security)\s+(?:scan|scans|scanning|assessment|audit|test|testing)\b/i,/\bpen(?:etration)?[\s-]?test(?:ing)?\b/i,/\bport\s+scan(?:ning)?\b/i,/\b(?:exploit|nmap|metasploit|nessus|burp\s+suite)\b/i,/\bCVE-\d{4}-\d{4,7}\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|vulnerability|incident\s+respon\w{0,4}|threat|soc|red\s+team|phishing|malware)\b/i]},{id:"credential_access",objectPatterns:[/\b(?:credential|password|passphrase|api\s+key|access\s+key|secret|token|private\s+key|ssh\s+key)s?\b/i,/\b(?:vault|secrets?\s+manager|keychain|keystore)\b/i,/\bservice\s+account\s+key\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|identity|iam|credential|secrets?\s+manage\w{0,4}|vault|platform|devops)\b/i]},{id:"financial_transaction",objectPatterns:[/\b(?:wire\s+transfer|bank\s+transfer|payout|disbursement|chargeback)\b/i,new RegExp(`\\b(?:approve|issue|initiate|process|release)\\s${ke(20)}\\b(?:payment|refund|invoice|transfer|purchase\\s+order)s?\\b`,"i"),new RegExp(`\\b(?:move|transfer)\\s${ke(20)}\\b(?:funds|money)\\b`,"i")],purposeFunctions:["finance_accounting","procurement"],purposePatterns:[/\b(?:finance|financial|accounting|invoice|invoicing|payment|payments|billing|refund|refunds|treasury|procurement|spend|purchasing|fraud|kyc)\b/i]},{id:"personnel_data",objectPatterns:[/\b(?:employee|personnel|payroll|hr|staff)\s+(?:record|records|data|file|files|information|details)\b/i,/\b(?:salary|salaries|compensation|performance\s+review|termination\s+letter)s?\b/i,/\b(?:home\s+address|social\s+security\s+number|national\s+insurance\s+number)e?s?\b/i],purposeFunctions:["hr","privacy_compliance"],purposePatterns:[/\b(?:hr|human\s+resources|people\s+ops|payroll|benefits|recruit\w{0,4}|onboarding|privacy|dsar|consent)\b/i]},{id:"regulated_advice",objectPatterns:[/\b(?:legal|medical|tax|investment|financial)\s+advice\b/i,/\bpractis\w{0,3}\s+law\b/i,/\b(?:diagnose|diagnosis|prescribe|prescription)\b/i,/\b(?:binding|enforceable)\s+(?:opinion|interpretation)\b/i],purposeFunctions:["legal","privacy_compliance"],purposePatterns:[/\b(?:legal|compliance|counsel|contract|contracts|litigation|nda|privacy|regulator\w{0,2}|audit\w{0,3})\b/i]},{id:"data_export",objectPatterns:[new RegExp(`\\b(?:export|download|dump|extract|exfiltrat\\w{0,3}|bulk\\s+copy)\\b\\s${ke(30)}\\b(?:data|database|dataset|records?|table|tables|customer\\s+list|contact\\s+list|report)\\b`,"i"),/\b(?:full|entire|whole)\s+(?:database|dataset|customer\s+table)\b/i],purposeFunctions:["operations","engineering","privacy_compliance"],purposePatterns:[/\b(?:data\s+(?:pipeline|engineering|platform)|etl|export|reporting|analytics|operations|document\s+extract\w{0,3}|forecast\w{0,3})\b/i]},{id:"code_execution",objectPatterns:[new RegExp(`\\b(?:run|execute|invoke)\\s${ke(24)}\\b(?:script|scripts|command|commands|shell|code|binary|query|migration)\\b`,"i"),/\b(?:shell|root|sudo|admin)\s+(?:access|command|session)\b/i,/\bagainst\s+(?:the\s+)?production\s+(?:system|server|database|environment)s?\b/i],purposeFunctions:["engineering","it_security"],purposePatterns:[/\b(?:engineering|developer|devops|platform|release|deploy\w{0,4}|build|pipeline|sandbox|test\s+data|change\s+window)\b/i]},{id:"external_communication",objectPatterns:[new RegExp(`\\b(?:send|post|publish|email|tweet|message|broadcast)\\b\\s${ke(30)}\\b(?:external|customer|customers|public|press|social\\s+media|third[\\s-]party|prospect|prospects)\\b`,"i"),/\b(?:cold\s+outreach|marketing\s+blast|phishing\s+email|press\s+release)\b/i],purposeFunctions:["marketing","sales","customer_support"],purposePatterns:[/\b(?:marketing|campaign|outreach|email\s+assistant|support|customer|sales|lead|leads|communication|communications)\b/i]}]);var It="[REDACTED]",re="\u2022",ze=e=>/[\p{L}\p{N}]/u.test(e);function fr(e,t,n,r){let i=Array.from(e),o=i.length,a=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:re,c=a+s>=o;return i.map((u,d)=>!c&&(d<a||d>=o-s)?u:ze(u)?l:u).join("")}function Wa(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return fr(e,0,0,t);let r=e.slice(0,n),i=e.slice(n),o=t.length>0?t:re;return(r.length<=1?o:r[0]+Array.from(r.slice(1)).map(a=>ze(a)?o:a).join(""))+i}function Qa(e,t,n){let r=n.length>0?n:re,i=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let c=new RegExp(t,"g"),u;for(;(u=c.exec(e))!==null;){if(u[0].length===0){c.lastIndex++;continue}for(let d=u.index;d<u.index+u[0].length;d++)i[d]=!0}}catch{}let o=!1,a=!0;for(let c=0;c<e.length;c++)if(ze(e[c])&&(o=!0,!i[c])){a=!1;break}let s=o&&a,l="";for(let c=0;c<e.length;c++){let u=e[c];!s&&i[c]||!ze(u)?l+=u:l+=r}return l}function mr(e,t){let n=t.mode??"full";return n==="partial"?fr(e,t.keepFirst??0,t.keepLast??0,t.maskChar??re):n==="email"?Wa(e,t.maskChar??re):n==="custom"?Qa(e,t.keepPattern,t.maskChar??re):t.replacement??It}function Ya(e,t){return typeof e=="string"?mr(e,t):t.replacement??It}function gr(e){let t=[],n=e.replacement??It;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:gt(r),replacer:()=>n});for(let r of e.directives??[]){let{pattern:i}=r;typeof i!="string"||i.length===0||t.push({source:gt(i),replacer:o=>mr(o,r)})}return t}function hr(e){try{return new RegExp(e,"g")}catch(t){let n=t instanceof Error?t.message:String(t);throw new Error(`[visiq-redact] Invalid redaction pattern "${e}": ${n}`)}}function yr(e,t){if(_t(e).length===0){let n=e;for(let{source:r,replacer:i}of t)n=n.replace(hr(r),o=>i(o));return n}return Za(e,t)}function Za(e,t){let n=e;for(let{source:r,replacer:i}of t){let o=hr(r),a=[...On(o,n)];for(let u of _t(n))for(let d of On(o,u.text))a.push(Ro(u,d));let s=Co(a);if(s.length===0)continue;let l="",c=0;for(let{start:u,end:d}of s)l+=n.slice(c,u)+i(n.slice(u,d)),c=d;n=l+n.slice(c)}return n}function M(e,t){return e==null?e:typeof e=="string"?Ja(e,t):typeof e=="object"?Xa(e,t):e}function Ja(e,t){if(typeof e!="string")return e;let n=gr(t);return n.length===0?e:yr(e,n)}function Xa(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=gr(t),i=n.size>0,o=r.length>0,a=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>a(l));if(typeof s=="object"){let l=s,c=Object.create(Object.getPrototypeOf(l));for(let u of Object.keys(l)){let d=i?n.get(u):void 0;if(d){c[u]=Ya(l[u],d);continue}c[u]=a(l[u])}return c}return typeof s=="string"&&o?yr(s,r):s};return a(e)}var _r=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function es(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:_r(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:_r(t.spawn.prompt)}),t}function ts(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var ns=1440*60*1e3,rs="VISIQ_BUNDLE_GRACE_TTL_MS",is="VISIQ_BUNDLE_CACHE_DISABLED",os="VISIQ_CACHE_DIR",as=Ge.object({graceTtlMs:Ge.number().int().nonnegative().optional(),disabled:Ge.boolean().optional(),cacheDir:Ge.string().min(1).optional()}).strict();function ss(e){return e==null?{}:as.parse(e)}function ls(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[rs];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return ns}function cs(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[is]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var br;function us(){if(br!==void 0)return br;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function ds(e){return JSON.stringify(Et(e))}function Et(e){if(Array.isArray(e))return e.map(Et);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=Et(t[r]);return n}return e}function ps(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function fs(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function Sr(){if(!us())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function Er(e,t){return e.createHash("sha256").update(ds(t)).digest("hex")}function ms(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[os]?.trim();if(r)return r;let i=process.env.XDG_CACHE_HOME?.trim();if(i)return e.path.join(i,"visiq");let o="";try{o=e.os.homedir()}catch{o=""}return o?e.path.join(o,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function gs(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function Tr(e,t,n){return e.path.join(ms(e,n),"bundles",`${gs(e,t)}.json`)}async function hs(e,t,n,r={}){let i=await Sr();if(i)try{let o=Tr(i,e,r),a=i.path.dirname(o);await i.fs.mkdir(a,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:Er(i.crypto,t),body:t},l=`${o}.tmp-${process.pid}-${i.crypto.randomBytes(6).toString("hex")}`;await i.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await i.fs.rename(l,o)}catch(c){throw await i.fs.rm(l,{force:!0}).catch(()=>{}),c}}catch{}}async function ys(e,t={}){let n=await Sr();if(!n)return null;try{let r=await n.fs.readFile(Tr(n,e,t),"utf-8"),i=fs(JSON.parse(r));return!i||Er(n.crypto,i.body)!==i.contentHash?null:i}catch{return null}}var Ie;async function _s(){if(Ie!==void 0)return Ie;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;Ie=typeof t=="function"?t:null}catch{Ie=null}return Ie}function bs(e){let t=[];for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,i=r.rego_source;if(typeof i!="string"||i.length===0)continue;let o;try{o=pt(i)}catch{continue}let a=typeof r.id=="string"?r.id:"<rule>";for(let s of un(o))t.push(`${a}: ${s}`)}return t}function vs(e){return Rn(e)}function ws(e){return e==null||typeof e!="object"?!0:Object.keys(e).length===0}var ks=5e3,As=600*1e3,Is=1e4,Ss=25,vr=1e3,Es=5e3,Ts=100,wr=2e3,Rs=10,Cs=512,xs=1800*1e3,Os=.7,Ns="monitor",Ms="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",kr="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",He="open";function Se(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function Ds(e,t){return dr({content:e,resourceMetadata:t})}var Ls=y.object({operations:y.array(y.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:y.string().min(1,"agentId is required"),sessionId:y.string().min(1).max(255).optional(),toolName:y.string().optional(),toolArgs:y.record(y.unknown()).optional(),targetResource:y.string().optional(),resourceType:y.string().optional(),resourceMetadata:y.record(y.unknown()).optional(),normalized:y.record(y.unknown()).optional(),query:y.string().optional(),contentPreview:y.string().optional(),telemetry:y.record(y.unknown()).optional(),context:y.record(y.unknown()).optional(),mcpServer:y.string().min(1).max(255).optional()}),Fs=y.object({version:y.string().min(1),dialect_version:y.number().int().optional(),min_dialect:y.number().int().optional(),shutdown:y.boolean().optional(),agent_mode:y.enum(["enforce","monitor","off"]).optional(),cognition_capture:y.boolean().optional(),agent_mode_by_operation:y.object({action:y.string().optional(),retrieval:y.string().optional(),delegation:y.string().optional()}).partial().optional(),agent_attributes:y.object({trust_tier:y.string().nullable().optional(),categories:y.array(y.string()).optional(),business_function:y.string().nullable().optional(),business_functions:y.array(y.string()).nullable().optional(),blast_radius_tier:y.string().nullable().optional(),no_coverage:y.string().nullable().optional(),fail_mode:y.string().nullable().optional()}).optional(),rules:y.array(y.record(y.unknown())),action_schemas:y.array(y.object({id:y.string(),plane:y.string().optional(),field_mappings:y.array(y.record(y.unknown())).optional(),derived_fields:y.array(y.record(y.unknown())).optional(),action_class:y.string().nullable().optional(),action_class_confidence:y.number().optional()})).optional(),no_coverage:y.object({no_coverage_defaults:y.record(y.string()),autopilot_enabled:y.boolean(),enduser_hitl_enabled:y.boolean(),hitl_timeout_seconds:y.number().optional()}).optional()});function $s(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=kn(An(n));return{trust_tier:pn(t)?t:null,categories:mn(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&In(e.blast_radius_tier)?e.blast_radius_tier:null}}function Ps(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function js(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var Tt=new Set,Ar=!1;async function Ir(e){let t=[];for(let n of Tt){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function Bs(){if(!Ar&&!(typeof process>"u"||typeof process.once!="function")){Ar=!0,process.once("beforeExit",()=>{Ir(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await Ir(!0)}finally{process.kill(process.pid,e)}})()})}}var Rr=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=Ns;agentModeByOperation=null;rawBundle=null;normalizedRefs={retrieval:[],action:[],delegation:[]};warnedNormalizedAbsent=!1;warnedNormalizedDrift=!1;lastNormalizedWarnRearmMs=0;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;failMode=Se(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??He;governedFailMode=null;telemetryBuffer=[];telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;lastCloneCaptureSig=null;toolDescriptions=new Map;constructor(e,t,n,r,i,o,a,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,c=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,u=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=c,this.resolvedAgentId=u,this.harnessKind=r,this.sdkVersion=o,this.sdkDialect=a,this.originalFetch=globalThis.fetch.bind(globalThis);let d=ss(s);if(this.bundleCacheDisabled=cs(d.disabled),this.bundleGraceTtlMs=ls(d.graceTtlMs),this.bundleCacheDirOverride=d.cacheDir,this.cacheIdentity=l&&c&&!this.bundleCacheDisabled?{endpoint:c,agentId:u,apiKey:l}:null,l&&c){let f={apiKey:l,agentId:u,endpoint:c,mode:"enforce",timeoutMs:ts(i),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...o!==void 0?{sdkVersion:o}:{},...a!==void 0?{sdkDialect:a}:{}};this.client=new ct(f,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},ks),St(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},Is),St(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},Es),St(this.cognitionTimer),Tt.add(this),Bs()}else this.client=null}async evaluate(e){let t=Ls.parse(e),n=Date.now();if(this.operatorShutdown){let g=this.denyAll(t,Ms);return this.applyAgentMode(g,"enforce",t,n)}if(this.dialectRefused){if(this.failMode==="open")return this.failOpen(t,kr,n);let g=this.denyAll(t,kr);return this.applyAgentMode(g,"enforce",t,n)}if(t.operations.every(g=>this.modeFor(g)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let g;if(this.agentModeConfirmed?g=this.agentMode:this.bundleApplyFailed?g="enforce":g="monitor",g==="enforce"&&this.failMode==="open")return this.failOpen(t,"no unified bundle loaded and no local rules",n);let m=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(m,g,t,n)}let r=this.readSession(t.sessionId),i=await _s();if(!i||!this.rawBundle){if(this.failMode==="open")return this.failOpen(t,"governance core (@visiq/core-wasm) unavailable",n);throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)")}let o=t.operations.includes("action")||t.operations.includes("delegation")?hn(t.normalized??{},{targetApp:t.targetResource??t.toolName??""}):t.normalized,a=this.buildActionSchemaEvent(t),s=t.mcpServer?{...o??{},mcp_server:t.mcpServer}:o,l={...t,normalized:s,session:r,at:Date.now(),action_schema_id:a.id,action_schema_raw:a.canonical},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},u;try{u=i(l,c)}catch(g){if(this.failMode==="open")return this.failOpen(t,`governance core evaluation threw: ${g instanceof Error?g.message:String(g)}`,n);throw g}let d=[...new Set(t.operations.flatMap(g=>this.normalizedRefs[g]??[]))].sort();d.length>0&&ws(t.normalized)&&(u.normalizedColdStart=d,this.warnedNormalizedAbsent||(this.warnedNormalizedAbsent=!0,console.warn(`[UNIFIED] no normalized event supplied, but ${d.length} loaded rule condition(s) on this event's operation(s) read input.normalized.* \u2014 those conditions resolve to undefined here, so a deny carrying one does not fire. (Builtin-derived paths such as context/app_category ARE still populated in-core, so this is a dependency report, not a proof that every listed condition was the decider.) Cold start / no action-schema mapping yet. Affected: ${d.slice(0,5).join("; ")}${d.length>5?`; +${d.length-5} more`:""}`)));let f=yn(t.normalized);return f.length>0&&(u.normalizedDrift=f,this.warnedNormalizedDrift||(this.warnedNormalizedDrift=!0,console.warn(`[UNIFIED] normalized event carries ${f.length} value(s) outside the canonical vocabulary \u2014 a builder-authored rule can only select in-vocab values, so these cannot match one, so a rule keyed on the canonical value does not fire here. Check the harness classifier's casing/spelling. Affected: ${f.slice(0,5).join("; ")}${f.length>5?`; +${f.length-5} more`:""}`))),this.foldSession(t,u.enforced?u.decision:"permit"),u.enforced&&u.action.decision==="approval_required"&&await this.registerHitl(t,u),this.bufferTelemetry(t,u,Date.now()-n,u.enforced),u}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}readSession(e){if(!e)return we;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>xs?(this.sessions.delete(e),we):t.state:we}foldActionClass(e){let t=e.normalized?.action_class;if(typeof t=="string"&&t.length>0)return t;let n=this.rawBundle?.action_schemas;if(!Array.isArray(n))return;let{id:r}=this.buildActionSchemaEvent(e),i=n.find(s=>s?.id===r);if(!i)return;let o=i.action_class,a=typeof i.action_class_confidence=="number"?i.action_class_confidence:0;if(typeof o=="string"&&o.length>0&&a>=Os)return o}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),i=e.resourceMetadata??{},o=e.operations.includes("retrieval"),a=e.operations.includes("action")||e.operations.includes("delegation"),s=bn(r===we?_n():r,{data_categories:o&&Array.isArray(i.data_categories)?i.data_categories:void 0,classification:o?i.classification:void 0,taint:o?Ds(e.contentPreview,i):void 0,action_class:a?this.foldActionClass(e):void 0,target_app:a?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:s,touchedAt:Date.now()}),this.sessions.size>Cs){let l=this.sessions.keys().next().value;l!==void 0&&this.sessions.delete(l)}}applyAgentMode(e,t,n,r){let i=Date.now()-r;if(t==="enforce"){let a={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,a,i,!0),a}let o={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,o,i,!1),o}setFailMode(e){this.failMode=e}getFailMode(){return this.failMode}getGovernedFailMode(){return this.governedFailMode}failOpen(e,t,n){let r=`fail-open: ${t} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`;console.error(`[VisIQ] FAIL-OPEN: ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`);let i=e.operations.includes("action")||e.operations.includes("delegation"),o=e.operations.includes("retrieval"),a={decision:"permit",allowed:!0,reason:r,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:i?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:o?{action:"allow"}:{action:null},failOpen:!0};return this.bufferTelemetry(e,a,Date.now()-n,!1,!0),a}reportFailOpen(e,t){try{let n={operations:["action"],agentId:this.resolvedAgentId,...t?.toolName?{toolName:t.toolName}:{},...t?.sessionId?{sessionId:t.sessionId}:{}},r={decision:"permit",allowed:!0,reason:`fail-open: ${e} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:{decision:"permit",allowed:!0},retrieval:{action:null},failOpen:!0};this.bufferTelemetry(n,r,0,!1,!0)}catch{}}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},action_schema_id:this.buildActionSchemaEvent(e).id,...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=Fs.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}let r=bs(t.rules);if(r.length>0){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle contains rego_source using a builtin the engine cannot evaluate (would silently never match \u2192 fail open): ${r.join("; ")}. Refusing the bundle and failing closed (G001). Recompile the rule without case-folding wrappers like upper()/lower().`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(i=>Tn(i)).filter(i=>i!==null),this.agentAttributes=t.agent_attributes?$s(t.agent_attributes):null,this.agentNoCoverage=Sn(t.agent_attributes?.no_coverage),this.governedFailMode=Se(t.agent_attributes?.fail_mode)??null,this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=Ps(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.normalizedRefs=vs(this.rules),this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1,this.lastNormalizedWarnRearmMs=Date.now(),this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...W(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304){let a=Date.now();a-this.lastNormalizedWarnRearmMs>=As&&(this.lastNormalizedWarnRearmMs=a,this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1);return}if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),i=await n.json();this.applyBundle(i);let o=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&o?this.bundleEtag=r:o||(this.bundleEtag=null),o&&await this.persistBundleToDisk(i)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await ys(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(ps(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await hs(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}isBundleLoaded(){return this.bundleLoaded}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e,t){this.registerEnvironment({...$e(),...e?{agent_type:e}:{},...t?.model?{model:t.model}:{},...t?.systemPrompt?{systemPrompt:t.systemPrompt}:{},...t?.toolSchemas&&t.toolSchemas.length>0?{toolSchemas:t.toolSchemas}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));for(let n of e)n.description&&this.toolDescriptions.set(n.name,n.description);t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}captureCloneMetadata(e){if(!this.client||!this.resolvedAgentId||!(e.model||e.systemPrompt||(e.toolSchemas?.length??0)>0))return;let t=JSON.stringify({m:e.model??"",s:e.systemPrompt??"",t:e.toolSchemas??[]});t!==this.lastCloneCaptureSig&&(this.lastCloneCaptureSig=t,this.client.registerEnvironment({...$e(),...e.agentType?{agent_type:e.agentType}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{systemPrompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{toolSchemas:e.toolSchemas}:{}}))}buildActionSchemaEvent(e){let t=e.toolName?this.toolDescriptions.get(e.toolName):void 0,n={agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{},...e.toolArgs?{tool_args:e.toolArgs}:{},...t?{tool_description:t}:{}},r=En(n),i={...n};return e.toolArgs&&(i.tool_args=nr(e.toolArgs)),{canonical:n,id:r,rawEventForWire:i}}bufferTelemetry(e,t,n,r,i=!1){let o=this.buildActionSchemaEvent(e);this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?js(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:o.rawEventForWire,action_schema_id:o.id,...this.harnessKind||e.context||i||t.normalizedColdStart||t.normalizedDrift?{context:{...this.harnessKind?{[Jt]:this.harnessKind}:{},...e.context??{},...i?{fail_open:!0}:{},...t.normalizedColdStart?{normalized_cold_start:!0,normalized_inert_conditions:t.normalizedColdStart.length}:{},...t.normalizedDrift?{normalized_drift:!0,normalized_drift_values:t.normalizedDrift.length,normalized_drift_fields:t.normalizedDrift.slice(0,Rs)}:{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=Ss&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0);try{await this.client.sendTelemetry(e)}catch(t){console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",t)}}enforceTelemetryCap(){let e=this.telemetryBuffer.length-vr;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${vr})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(es(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=Ts&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-wr;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${wr})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}await this.flushTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),Tt.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function St(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function Us(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function $(e,...t){for(let n of t){let r=Us(e[n]);if(r)return r}}var qs=[{framework:"openai-agents",matches:e=>/^transfer_to_.+/.test(e),extract:(e,t)=>{let n=e.replace(/^transfer_to_/,"");return{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"teammate",task:$(t,"task","input","reason","message"),source:"structural"}}},{framework:"voltagent",matches:e=>e==="delegate_task",extract:(e,t)=>{let n=$(t,"targetAgent","agent","subAgent","agentName","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:$(t,"task","message","input"),description:$(t,"purpose"),source:"structural"}:null}},{framework:"crewai",matches:e=>/delegate work to (co-?worker|.+)/i.test(e),extract:(e,t)=>{let n=$(t,"coworker","agent","role");return n?{childAgentId:n,childName:n,kind:"teammate",agentType:n,task:$(t,"task","question"),description:$(t,"context"),source:"structural"}:null}},{framework:"llamaindex",matches:e=>e==="handoff"||/handoff/i.test(e),extract:(e,t)=>{let n=$(t,"to_agent","toAgent","agent_name","agentName","agent","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:$(t,"reason","task","message"),source:"structural"}:null}},{framework:"generic",matches:e=>/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)([_-].+)?$/i.test(e),extract:(e,t)=>{let n=$(t,"agent","agentName","agentId","target","targetAgent","to","to_agent","coworker","name")??(/[_-]/.test(e)?e.replace(/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)[_-]/i,""):void 0);return n?{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"subagent",task:$(t,"task","message","input","reason","prompt"),source:"heuristic"}:null}}];function We(e,t){if(!e)return null;let n=t??{};for(let r of qs)try{if(r.matches(e)){let i=r.extract(e,n);if(i)return i}}catch{}return null}function Qe(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}function Rt(e){if(e===null||typeof e!="object"||Array.isArray(e))return{input:e===void 0?"":String(e)};let t=e,n=Object.keys(t);return n.length===1&&n[0]==="context"&&t.context!==null&&typeof t.context=="object"?t.context:t}function Cr(e){if(typeof e=="string"){try{let t=JSON.parse(e);if(t!==null&&typeof t=="object"&&!Array.isArray(t))return t}catch{}return{input:e}}return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:{input:e===void 0?"":String(e)}}function D(e){let t=[],n=[],r,i=[];for(let a of e){if(a.mode==="partial"||a.mode==="email"||a.mode==="custom"){let l={mode:a.mode};a.field&&(l.field=a.field),a.pattern&&(l.pattern=a.pattern),typeof a.keepFirst=="number"&&(l.keepFirst=a.keepFirst),typeof a.keepLast=="number"&&(l.keepLast=a.keepLast),a.maskChar&&(l.maskChar=a.maskChar),a.keepPattern&&(l.keepPattern=a.keepPattern),a.replacement!==void 0&&(l.replacement=a.replacement),i.push(l);continue}a.field&&t.push(a.field),a.pattern&&n.push(a.pattern);let{replacement:s}=a;s&&r===void 0&&(r=s)}let o={};return t.length>0&&(o.fields=t),n.length>0&&(o.patterns=n),r!==void 0&&(o.replacement=r),i.length>0&&(o.directives=i),o}var V="0.2.15";import{AsyncLocalStorage as zs}from"node:async_hooks";var x=new zs,Vs=5120,xr=50;function Ks(e,t){if(typeof e!="string")return"";let n=new TextEncoder,r=n.encode(e);if(r.length<=t)return e;let o=`\u2026[truncated ${Math.ceil(r.length/1024)}KB]`,a=n.encode(o).length,s=Math.max(0,t-a),l=r.subarray(0,s);return new TextDecoder("utf-8",{fatal:!1}).decode(l)+o}function K(e){if(!e)return;let t=r=>r.length<=xr?r.slice():r.slice(r.length-xr),n=r=>Ks(r,Vs);return{session_id:e.session_id,llm_prompts:t(e.llm_prompts).map(n),llm_responses:t(e.llm_responses).map(n),agent_reasoning:t(e.agent_reasoning).map(n)}}var Ct=12e4,Or=2e3,Nr=3,Gs=5e3;function Ee(e,t){return e==="mask"&&(t?.length??0)>0}var Hs=new Set(["approved","resolved"]),Ws=new Set(["rejected","dismissed","expired","timeout","bypassed_disabled"]);function Qs(e){return new Promise(t=>setTimeout(t,e))}function Ys(e){if(typeof e!="object"||e===null)return null;let t=e,n=t.hitl_result;if(typeof n=="string"&&n.length>0)return n;let{hitl:r}=t;if(r&&typeof r=="object"){let{status:i}=r;if(typeof i=="string"&&i.length>0)return i==="pending"?null:i}return null}async function Te(e){let{endpoint:t,apiKey:n,decisionId:r,timeoutMs:i=Ct,maskFallback:o=!1,sdkVersion:a,fetchImpl:s=globalThis.fetch,sleep:l=Qs,log:c=p=>console.warn(p)}=e,u=p=>o?{resolution:"mask",reason:p}:{resolution:"block",reason:p};if(!t)return u("HITL approval cannot be confirmed (no backend endpoint) \u2014 fail-closed (G001)");if(!r)return u("HITL approval cannot be confirmed (no decision id) \u2014 fail-closed (G001)");let d=`${t.replace(/\/$/,"")}/v1/allow/decisions/${encodeURIComponent(r)}`,f={Accept:"application/json",...W(a)};n&&(f.Authorization=`Bearer ${n}`);let g=Date.now()+Math.max(0,i),m=0;for(c(`[VisIQ HITL] Awaiting human approval for decision ${r} (timeout ${i}ms)`);;){if(Date.now()>=g)return c(`[VisIQ HITL] Decision ${r} timed out after ${i}ms \u2014 ${o?"masking":"blocking"} (G001)`),u("HITL approval timed out");let p=null;try{let _=new AbortController,O=setTimeout(()=>_.abort(),Gs),A;try{A=await s(d,{method:"GET",headers:f,signal:_.signal})}finally{clearTimeout(O)}if(!A.ok)throw new Error(`HTTP ${A.status} ${A.statusText}`);let R=await A.json();p=Ys(R),m=0}catch(_){m+=1;let O=_ instanceof Error?_.message:String(_);if(c(`[VisIQ HITL] Poll failed for decision ${r} (${m}/${Nr}): ${O}`),m>=Nr)return u(`HITL approval poll failed repeatedly \u2014 fail-closed (G001): ${O}`);await l(Or);continue}if(p!==null){let _=p.toLowerCase();return Hs.has(_)?(c(`[VisIQ HITL] Decision ${r} approved (${p}) \u2014 proceeding`),{resolution:"proceed",reason:`Approved by human reviewer (${p})`}):Ws.has(_)?(c(`[VisIQ HITL] Decision ${r} resolved as ${p} \u2014 ${o?"masking":"blocking"}`),u(`Not approved by human reviewer (${p})`)):(c(`[VisIQ HITL] Decision ${r} returned unknown status '${p}' \u2014 ${o?"masking":"blocking"} (G001)`),u(`HITL returned unknown status '${p}' \u2014 fail-closed (G001)`))}await l(Or)}}function G(e){return e??Se(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??He}function v(e,t){try{console.error(`[VisIQ] FAIL-OPEN (${e}): ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`)}catch{}}function U(e,t){try{console.error(`[VisIQ] TRACE-DEGRADED (${e}): ${t} \u2014 the governance decision was still made and enforced; only the execution-trace beat was lost.`)}catch{}}function oe(e){let t=e.getFailMode;return(typeof t=="function"?t.call(e):void 0)??G()}function Z(e){return e.enforced?{allowed:e.action.allowed,decision:e.action.decision,...e.action.decisionId!==void 0?{decisionId:e.action.decisionId}:{},...e.ruleCode!==null?{ruleCode:e.ruleCode}:{},reason:e.reason,argRedactionRules:e.action.argRedactionRules??[],...e.action.hitlFallback?{hitlFallback:e.action.hitlFallback}:{}}:{allowed:!0,decision:"permit",reason:e.reason,argRedactionRules:[]}}function Dr(e){if(!e.enforced)return{action:"allow",reason:e.reason,redactionRules:[]};let t=e.retrieval.action??"deny",n=e.retrieval.redactionRules??[];return t==="escalate"&&Ee(e.retrieval.hitlFallback,n)?{action:"redact",reason:e.reason,redactionRules:n}:{action:t,reason:e.reason,redactionRules:n}}var Mr=new Set;function Mt(e){Mr.has(e)||(Mr.add(e),console.warn(`[VisIQ] unrecognized retrieval outcome "${e}" \u2014 failing closed (withholding content). Upgrade @visiq/harness if a newer control plane introduced this outcome.`))}async function Ze(e,t,n){let r=x.getStore(),i=K(r),o=await e.evaluate({operations:["retrieval"],agentId:t,...r?.session_id?{sessionId:r.session_id}:{},resourceType:n.resourceType??"document",resourceMetadata:n.resourceMetadata??{},...n.query!==void 0?{query:n.query}:{},...n.contentPreview!==void 0?{contentPreview:n.contentPreview}:{},...i?{telemetry:i}:{}});return Dr(o)}async function Je(e,t,n){return await e.awaitBundleReady(),Ze(e,t,n)}function Lr(e,t,n=G()){switch(t.action){case"allow":case"escalate":return e;case"deny":return null;case"redact":{if(t.redactionRules.length===0)return e;try{return M(e,D(t.redactionRules))}catch{return n==="closed"?null:(v("redact-error","document redaction failed \u2014 document passed UNREDACTED"),e)}}default:return Mt(String(t.action)),n==="closed"?null:(v("unknown-retrieval-verb",`unrecognized outcome "${String(t.action)}" \u2014 document passed through`),e)}}async function Fr(e,t,n,r){if(!Array.isArray(e)||e.length===0)return e;await r.awaitBundleReady();let i=[];for(let o of e){let a=o,s=String(a.pageContent??a.text??a.content??""),l=a.metadata??{},c=await Ze(r,t,{resourceType:"document",resourceMetadata:l,query:n,contentPreview:s.slice(0,500)}),u=Lr(o,c,oe(r));u!==null&&i.push(u)}return i}async function $r(e,t,n){if(typeof e!="string")return e;await n.awaitBundleReady();let r;try{r=await Ze(n,t,{resourceType:"document",resourceMetadata:{content_preview:e.slice(0,500)},contentPreview:e.slice(0,500)})}catch(i){return oe(n)==="closed"?"[RECALL] Retrieved context blocked \u2014 policy evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":(v("eval-error",`retrieval evaluation failed \u2014 text passed through: ${i instanceof Error?i.message:String(i)}`),e)}switch(r.action){case"allow":case"escalate":return e;case"deny":return"[RECALL] Retrieved context was blocked by policy.";case"redact":{if(r.redactionRules.length===0)return e;try{return M(e,D(r.redactionRules))}catch{return oe(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("redact-error","text redaction failed \u2014 text passed UNREDACTED"),e)}}default:return Mt(String(r.action)),oe(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 text passed through`),e)}}var Pr=4,jr=1e3;function Ye(e){return e.length===0?!1:e.some(t=>t!==null&&typeof t=="object"&&(typeof t.pageContent=="string"||typeof t.text=="string"||typeof t.content=="string"))}async function Br(e,t,n){let r=[];for(let i of e){let o=i,a=String(o.pageContent??o.text??o.content??""),s={...o.metadata??{},content_preview:a.slice(0,500)},l;try{l=await Ze(n,t,{resourceType:"document",resourceMetadata:s,contentPreview:a.slice(0,500)})}catch(u){if(oe(n)==="closed")continue;v("eval-error",`document retrieval evaluation failed \u2014 document passed through: ${u instanceof Error?u.message:String(u)}`),r.push(i);continue}let c=Lr(i,l,oe(n));c!==null&&r.push(c)}return r}async function Ot(e,t,n,r,i){if(r>Pr||i.nodes++>jr)return e;if(Array.isArray(e)){if(Ye(e))return i.matched=!0,Br(e,t,n);let o=[];for(let a of e)o.push(await Ot(a,t,n,r+1,i));return o}if(e!==null&&typeof e=="object"){let o=e,a={...o};for(let s of Object.keys(o))a[s]=await Ot(o[s],t,n,r+1,i);return a}return e}async function Xe(e,t,n){if(await n.awaitBundleReady(),Array.isArray(e)&&Ye(e))return Br(e,t,n);if(e!==null&&typeof e=="object"){let r={nodes:0,matched:!1},i=await Ot(e,t,n,0,r);if(r.matched)return i}return e}var Zs={blocked:!0,reason:"[RECALL] Retrieved context was blocked by policy."};function Nt(e,t,n){if(t>Pr||n.n++>jr)return e;if(Array.isArray(e))return Ye(e)?[]:e.map(r=>Nt(r,t+1,n));if(e!==null&&typeof e=="object"){if(Ye([e]))return{...Zs};let r=e,i={};for(let o of Object.keys(r))i[o]=Nt(r[o],t+1,n);return i}return e}function xt(e){return typeof e=="string"?"[RECALL] Retrieved context was blocked by policy.":Array.isArray(e)?[]:e!==null&&typeof e=="object"?Nt(e,0,{n:0}):e}function Ur(e,t,n=G()){let r=Dr(t);switch(r.action){case"allow":case"escalate":return e;case"deny":return xt(e);case"redact":{if(r.redactionRules.length===0)return e;try{return M(e,D(r.redactionRules))}catch{return n==="closed"?xt(e):(v("redact-error","result redaction failed \u2014 result passed UNREDACTED"),e)}}default:return Mt(String(r.action)),n==="closed"?xt(e):(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 result passed through`),e)}}function T(e){return typeof e=="object"&&e!==null?e:null}function qr(...e){for(let t of e)if(typeof t=="string"&&t.trim().length>0)return t}function Js(e,t){let n=T(e.metadata),r=n&&typeof n.name=="string"?n.name:void 0;return qr(e.name,e.id,r,t)}function Xs(e){let t=T(e.metadata),n=t&&typeof t.description=="string"?t.description:void 0,r=qr(e.description,n);return r===void 0?void 0:r.slice(0,4e3)}function el(e){let t=T(e);return t!==null&&("type"in t||"properties"in t||"$schema"in t)}function tl(e){let t=T(e);if(t===null||!("_def"in t))return;let{shape:n}=t;if(typeof n=="function")try{n=n.call(t)}catch{n=void 0}let r=T(n);if(r===null)return{type:"object"};let i={};for(let o of Object.keys(r))i[o]={};return{type:"object",properties:i}}var nl=new Set(["default","const","enum","examples","example"]);function Dt(e){if(Array.isArray(e))return e.map(Dt);let t=T(e);if(t===null)return e;let n={};for(let[r,i]of Object.entries(t))nl.has(r)||(n[r]=Dt(i));return n}function rl(e){let t;if(el(e))t=e;else{let n=tl(e);if(n===void 0)return;t=n}try{let n=JSON.stringify(t);if(n.length>2e4){let r=T(t),i=r&&T(r.properties);if(i){let o={};for(let a of Object.keys(i))o[a]={};return{type:"object",properties:o}}return{type:"object"}}return Dt(JSON.parse(n))}catch{return}}function il(e){let t=T(e.metadata),n=e.input_schema??e.inputSchema??e.parameters??e.schema??e.args_schema??e.tool_call_schema??(t?t.parameters:void 0);return n===void 0?void 0:rl(n)}function ol(e,t){let n=T(e);if(n===null)return null;let r=Js(n,t);if(r===void 0)return null;let i={name:r.slice(0,255)},o=Xs(n);o!==void 0&&(i.description=o);let a=il(n);return a!==void 0&&(i.input_schema=a),i}function J(e){let t=[],n=new Set,r=(i,o)=>{try{let a=ol(i,o);a!==null&&!n.has(a.name)&&(n.add(a.name),t.push(a))}catch{}};if(Array.isArray(e)){for(let i of e)if(r(i),t.length>=200)break}else if(e instanceof Map){for(let[i,o]of e.entries())if(r(o,typeof i=="string"?i:void 0),t.length>=200)break}else{let i=T(e);if(i!==null){for(let o of Object.keys(i))if(r(i[o],o),t.length>=200)break}}return t}function Lt(e){try{let t=T(e);if(t===null)return[];let n=[],r=new Set,i=c=>{for(let u of c)!r.has(u.name)&&n.length<200&&(r.add(u.name),n.push(u))};t.tools!==void 0&&i(J(t.tools));let o=T(t.settings);o&&o.tools!==void 0&&i(J(o.tools));for(let c of["getTools","listTools"]){let u=t[c];if(typeof u=="function")try{let d=u.call(t);if(d&&typeof d.then=="function")continue;i(J(d))}catch{}}let a=T(t.nodes)?t:T(t.graph)??T(t.builder)??t,s=T(a.nodes);if(s)for(let c of Object.keys(s)){let u=T(s[c]);if(!u)continue;u.tools!==void 0&&i(J(u.tools));let d=T(u.bound);d&&d.tools!==void 0&&i(J(d.tools))}let{agents:l}=t;if(l instanceof Map)for(let c of l.values()){let u=T(c);u&&u.tools!==void 0&&i(J(u.tools))}return n}catch{return[]}}async function zr(e){let t=T(e);if(!t)return[];let n=[],r=new Set;for(let i of["getTools","listTools"]){let o=t[i];if(typeof o=="function")try{let a=o.call(t);if(!a||typeof a.then!="function")continue;for(let s of J(await a))r.has(s.name)||(r.add(s.name),n.push(s))}catch{}}return n}import{z as et}from"zod";var al=et.object({decision:et.enum(["permit","deny"]),reason:et.string(),handoff_event_id:et.string().nullable()}),B=class extends Error{constructor(e,t,n){super(e),this.code=t,this.status=n,this.name="OrchestrateError"}code;status},X=class extends B{constructor(e,t){super(`Orchestrate grant denied: ${e}`,"GRANT_DENIED"),this.reason=e,this.handoffEventId=t,this.name="GrantDeniedError"}reason;handoffEventId},sl="https://api.visiqlabs.com",ll=1e4,ae=class{config;fetch;constructor(e,t=globalThis.fetch){this.config={agentId:e.agentId,apiKey:e.apiKey??process.env.VISIQ_API_KEY??"",endpoint:e.endpoint??process.env.VISIQ_ENDPOINT??sl,timeoutMs:e.timeoutMs??ll},this.fetch=t}get headers(){return{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,"X-Agent-ID":this.config.agentId}}async post(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.fetch(`${this.config.endpoint}${e}`,{method:"POST",headers:this.headers,body:JSON.stringify(t),signal:n.signal})}finally{clearTimeout(r)}let o=await i.json();if(!i.ok){let a=o?.error??`HTTP ${i.status}`;throw new B(a,"API_ERROR",i.status)}return o}async requestGrant(e){let t=await this.post("/orchestrate/grants",{parent_agent_id:e.parentAgentId,child_agent_id:e.childAgentId,tool_scope:e.toolScope??null,context_scope:e.contextScope??null,purpose:e.purpose,duration_seconds:e.durationSeconds,max_depth:e.maxDepth,parent_grant_token:e.parentGrantToken});return{grantId:t.grant_id,status:"pending",effectiveToolScope:t.effective_tool_scope,effectiveContextScope:t.effective_context_scope,acceptDeadline:t.accept_deadline}}async acceptGrant(e){let t=await this.post(`/orchestrate/grants/${e}/accept`,{});return{grantToken:t.grant_token,toolScope:t.tool_scope,contextScope:t.context_scope,expiresAt:t.expires_at}}async evaluate(e){let t=await this.post("/orchestrate/evaluate",{grant_token:e.grantToken,action:e.action,resource_type:e.resourceType,resource_metadata:e.resourceMetadata??{}}),n=al.parse(t);return{decision:n.decision,reason:n.reason,handoffEventId:n.handoff_event_id}}async revokeGrant(e,t){return{revokedCount:(await this.post(`/orchestrate/grants/${e}/revoke`,{reason:t})).revoked_count}}};var Vr=new Map;async function Kr(e,t){if(!e||e.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: agentId is required");if(!t||t.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: grantId is required");let n=Vr.get(e);if(n)return n;let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[ORCHESTRATE] bootstrapGrant: VISIQ_API_KEY env var is required");let i=process.env.VISIQ_ENDPOINT,o=(await new ae({agentId:e,apiKey:r,...i?{endpoint:i}:{}}).acceptGrant(t)).grantToken;if(!o||o.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: backend returned empty grant token");return Vr.set(e,o),o}var Re=Symbol.for("visiq.orchestrate.wrapped");function cl(e){return e instanceof B&&typeof e.status=="number"&&e.status>=400&&e.status<500}function Gr(e,t){if(!t.agentId||t.agentId.trim()==="")throw new B("agentId is required","CONFIG_ERROR");if(!t.grantToken||t.grantToken.trim()==="")throw new B("grantToken is required","CONFIG_ERROR");if(e[Re]===!0)return e;let n=new ae(t),r=t.failBehavior??(process.env.VISIQ_FAIL_MODE?.trim().toLowerCase()==="closed"?"deny":"permit"),i=async(o,a)=>{let s;try{s=await n.evaluate({grantToken:t.grantToken,action:o,resourceType:a})}catch(l){if(cl(l))throw l;if(r==="permit"){console.warn('[VisIQ] FAIL-OPEN (orchestrate-eval-error): evaluate failed \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed (or failBehavior:"deny") to block instead.',l);return}throw new B(`ORCHESTRATE evaluate failed: ${l instanceof Error?l.message:String(l)}`,"EVALUATE_ERROR")}if(s.decision==="deny")throw new X(s.reason,s.handoffEventId)};return new Proxy(e,{get(o,a,s){let l=Reflect.get(o,a,s);return a===Re?!0:a==="_call"&&typeof l=="function"?async function(c,...u){let d=o.name;return await i(d??"_call"),l.call(this??o,c,...u)}:(a==="call"||a==="execute"||a==="run")&&typeof l=="function"?async function(c,...u){let d=o.name;return await i(d??String(a)),l.call(this??o,c,...u)}:l}})}import{randomUUID as Jr}from"node:crypto";var Hr=Symbol.for("visiq.semantickernel.instrumented");function Yr(e){if(e===null||typeof e!="object")return!1;let t=e;return typeof t.useFunctionInvocation=="function"&&typeof t.usePromptRender=="function"&&typeof t.execute!="function"&&typeof t.generate!="function"&&typeof t.run!="function"}function Wr(e){let t=e.arguments;return t&&typeof t=="object"&&"arguments"in t&&t.arguments&&typeof t.arguments=="object"?t.arguments:t??{}}function Qr(e,t){let n=e.arguments;if(n&&typeof n=="object"&&"arguments"in n&&n.arguments&&typeof n.arguments=="object"){let r=n.arguments;for(let i of Object.keys(r))delete r[i];Object.assign(r,t);return}e.arguments=t}function q(e,t){e.result&&typeof e.result=="object"?e.result.value=t:e.result={value:t}}function ul(e){return e.result?.value}function dl(e){let{agentId:t,unified:n,failMode:r}=e;return async function(o,a){let s=o.function?.metadata?.name??"unknown",l=o.function?.metadata?.pluginName,c=Wr(o),u=l;try{let p=await n.evaluate({operations:["action"],agentId:t,toolName:s,toolArgs:c,...u!==void 0?{targetResource:u}:{}}),_=Z(p);if(!_.allowed){q(o,C({outcome:"deny",code:_.ruleCode??"DENY",reason:_.reason}));return}_.decision==="mask"&&_.argRedactionRules.length>0&&Qr(o,M(c,D(_.argRedactionRules)));let O=Wr(o),A=ie(s,O,{failMode:r==="closed"?"closed":"open",enforced:p.enforced});if(A.verdict==="block"){q(o,C({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${A.detectors.join(",")})`}));return}A.verdict==="redact"&&(Qr(o,A.redacted),v("outbound-secret-redacted",`outbound secret screen redacted ${A.detectors.length} detector(s): ${A.detectors.join(",")}`))}catch(p){if(r==="closed"){q(o,C({outcome:"error",code:"EVAL-ERROR",mechanism:`evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}`}));return}v("eval-error",`SK action pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}try{let p=await Je(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l}});if(p.action==="deny"||p.action==="escalate"){q(o,`[RECALL: access denied \u2014 ${p.reason}]`);return}}catch(p){if(r==="closed"){q(o,`[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}.`);return}v("eval-error",`SK retrieval pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}await a(o);let d=ul(o),g=(typeof d=="string"?d:(()=>{try{return JSON.stringify(d)??String(d)}catch{return String(d)}})()).slice(0,500),m;try{m=await Je(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l,content_preview:g},contentPreview:g})}catch(p){r==="closed"?q(o,"[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("eval-error",`SK post-result retrieval eval failed for "${s}": ${p instanceof Error?p.message:String(p)}`);return}if(m.action==="deny"||m.action==="escalate"){q(o,`[RECALL: access denied \u2014 ${m.reason}]`);return}if(m.action==="redact"&&m.redactionRules&&m.redactionRules.length>0&&d!==null&&d!==void 0)try{q(o,M(d,D(m.redactionRules)))}catch(p){r==="closed"?q(o,"[RECALL] Result withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("redact-error",`SK result redaction failed for "${s}" \u2014 result passed UNREDACTED: ${p instanceof Error?p.message:String(p)}`)}}}function pl(e){return async function(n,r){await r(n);let i=n.renderedPrompt;if(typeof i!="string"||i.length===0)return;let o;try{o=await Je(e.unified,e.agentId,{resourceType:"prompt",resourceMetadata:{},contentPreview:i.slice(0,500)})}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("eval-error",`SK prompt-render eval failed: ${a instanceof Error?a.message:String(a)}`);return}if(o.action==="redact"&&o.redactionRules&&o.redactionRules.length>0){try{n.renderedPrompt=M(i,D(o.redactionRules))}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("redact-error",`SK prompt redaction failed \u2014 prompt passed UNREDACTED: ${a instanceof Error?a.message:String(a)}`)}return}(o.action==="deny"||o.action==="escalate")&&(n.renderedPrompt=`[RECALL: prompt suppressed \u2014 ${o.reason}]`)}}function Zr(e,t){let n=e;if(n[Hr]===!0)return t.onWrap?.(),e;let r=dl(t),i=pl(t),o=!1;return Array.isArray(n._functionInvocationFilters)?(n._functionInvocationFilters.unshift(r),o=!0):typeof n.useFunctionInvocation=="function"&&(n.useFunctionInvocation(r),o=!0),typeof n.usePromptRender=="function"?n.usePromptRender(i):Array.isArray(n._promptRenderFilters)&&n._promptRenderFilters.push(i),o&&(n[Hr]=!0,t.onWrap?.()),e}function C(e){let t=/^D-/.test(e.code),n;e.outcome==="approval_required"?n="requires human approval, which was not granted":e.outcome==="error"?n="was blocked (fail-closed) after a policy-evaluation error":n="was denied by policy";let r=e.reason?.trim(),i;r?i=r:t?i="no policy rule covers this action, so the organization default applied":e.outcome==="approval_required"?i="this action is routed to a human for approval":i="denied by policy";let o=e.mechanism?.trim()?` \u2014 ${e.mechanism.trim()}`:"";return`[VisIQ decision=${e.outcome} code=${e.code}] This tool call was NOT executed: it ${n} (${i})${o}. VisIQ is a security harness installed by your developer. Report this reason to the user verbatim; do not invent a different one.`}function tt(e){return e instanceof Error?e.message:String(e)}var fl=/https?:\/\/[^\s"'`,)}\]]+/;function Ft(e){let t=e.match(fl);if(t)try{let n=new URL(t[0]);return n.hostname+n.pathname}catch{return t[0]}}var se=Symbol.for("visiq.toolexec.instrumented"),$t=Symbol.for("visiq.instrument.deferred");function ml(e){return e!==null&&typeof e=="object"&&typeof e.execute=="function"}var Pt={vercel:"Vercel AI SDK agent",mastra:"Mastra Agent",openai:"OpenAI Agents SDK agent",llamaindex:"LlamaIndex.TS agent",voltagent:"VoltAgent agent","semantic-kernel":"Semantic Kernel"};function Xr(e){if(e===null||typeof e!="object")return null;let t=e;if(ml(t))return null;if(Yr(e))return"semantic-kernel";if(typeof t.generateText=="function"&&(typeof t.getTools=="function"||t.toolManager!==void 0))return"voltagent";if(typeof t.run=="function"&&typeof t.runStream=="function"&&t.agents!==void 0)return"llamaindex";if(Array.isArray(t.tools)&&t.handoffs!==void 0&&(typeof t.on=="function"||t.eventEmitter!==void 0))return"openai";if(typeof t.generate=="function"&&typeof t.getLLM=="function"&&(typeof t.listTools=="function"||typeof t.getTools=="function"))return"mastra";if(typeof t.generate=="function"){let n=t.settings;if(n&&typeof n=="object"&&n.tools!==void 0||t.tools!==void 0)return"vercel"}return null}async function gl(e,t,n,r,i,o){let{agentId:a,unified:s}=e,l=K(i),c,u=!1;try{await s.awaitBundleReady();let p=await s.evaluate({operations:o?["action","delegation"]:["action"],agentId:a,toolName:t,toolArgs:n,...o?{context:Qe(o,a)}:{},...i?.session_id?{sessionId:i.session_id}:{},...r!==void 0?{targetResource:r}:{},...l?{telemetry:l}:{}});({enforced:u}=p),c=Z(p)}catch(p){let _=p instanceof Error?p.message:String(p);return e.failMode==="closed"?{block:C({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${_} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})}:(v("eval-error",`policy evaluation failed for tool "${t}": ${_}`),{block:null})}if(c.decision==="approval_required"&&c.decisionId){let p=s.getApiKey()??e.apiKey,_=await Te({endpoint:s.getEndpoint()??e.endpoint??"",...p?{apiKey:p}:{},decisionId:c.decisionId,timeoutMs:e.hitlTimeoutMs,sdkVersion:V});return _.resolution!=="proceed"?{block:C({outcome:"approval_required",code:c.ruleCode??"HITL-BLOCK",reason:c.reason,mechanism:_.reason}),decision:c}:{block:null}}if(!c.allowed)return{block:C({outcome:"deny",code:c.ruleCode??"DENY",reason:c.reason}),decision:c};let d=n,f=!1,g;if(c.decision==="mask"&&c.argRedactionRules&&c.argRedactionRules.length>0)try{let p=D(c.argRedactionRules);d=M(n,p),f=!0,g=c}catch(p){let _=p instanceof Error?p.message:String(p);if(e.failMode==="closed")return{block:C({outcome:"error",code:"MASK-ERROR",mechanism:`argument masking failed: ${_} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})};v("mask-error",`argument masking failed for tool "${t}" \u2014 running with UNMASKED args: ${_}`)}let m=ie(t,d,{failMode:e.failMode==="closed"?"closed":"open",enforced:u});return m.verdict==="block"?{block:C({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${m.detectors.join(",")})`}),decision:{allowed:!1,decision:"deny",ruleCode:"OUTPUT-BLOCK",reason:"outbound content carried a live secret",argRedactionRules:[]}}:(m.verdict==="redact"&&(d=m.redacted,f=!0,v("outbound-secret-redacted",`outbound secret screen redacted ${m.detectors.length} detector(s): ${m.detectors.join(",")}`),g??={allowed:!0,decision:"mask",ruleCode:"OUTPUT-BLOCK",reason:"outbound secret redacted before egress",argRedactionRules:[]}),f?{block:null,maskedArgs:d,decision:g}:{block:null})}async function jt(e,t,n,r,i){let o=x.getStore()??e.telemetry,a=We(t,n);a&&he(e.unified,{agentId:e.agentId,sessionId:o?.session_id,...e.framework?{framework:e.framework}:{}},a);let s={agentId:e.agentId,sessionId:o?.session_id,...e.framework?{framework:e.framework}:{}},l=fe(t,n);try{ye(e.unified,s,{toolName:t,...l?{memory:l}:{},argSummary:r.slice(0,512)})}catch(m){U("step-beat",`emit failed for tool "${t}": ${tt(m)}`)}let c=Date.now(),u=await gl(e,t,n,Ft(r),o,a);if(u.block!==null){try{u.decision&&ne(e.unified,s,{toolName:t,decision:u.decision.decision??"deny",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0,harnessMessage:u.block})}catch(m){U("intervention-beat",`emit failed for tool "${t}": ${tt(m)}`)}return u.block}if(u.maskedArgs!==void 0&&u.decision)try{ne(e.unified,s,{toolName:t,decision:u.decision.decision??"mask",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0})}catch(m){U("intervention-beat",`emit failed for tool "${t}": ${tt(m)}`)}let d=u.maskedArgs??n,f=await i(d),g=await Xe(f,e.agentId,e.unified);try{_e(e.unified,s,{toolName:t,ok:!0,durationMs:Date.now()-c,...Q(g)!==void 0?{bytes:Q(g)}:{},...Y(g)!==void 0?{itemCount:Y(g)}:{},...l?{memory:l}:{}})}catch(m){U("observation-beat",`emit failed for tool "${t}": ${tt(m)}`)}return g}function nt(e,t,n){let r=e;if(r[se]){n.onWrap?.();return}if(typeof r.execute!="function")return;let i=r.execute;it(r,"execute",async function(...a){let s=Rt(a[0]);return jt(n,t,s,xe(s),l=>Promise.resolve(i.apply(this,[l,...a.slice(1)])))}),r[se]=!0,n.onWrap?.()}function hl(e,t,n){let r=e;if(r[se]){n.onWrap?.();return}if(typeof r.invoke!="function")return;let i=r.invoke;it(r,"invoke",async function(...a){let s=a[1],l=Cr(s),c=typeof s=="string"?s:xe(l);return jt(n,t,l,c,u=>{let d=typeof s=="string"?JSON.stringify(u):u;return Promise.resolve(i.apply(this,[a[0],d,...a.slice(2)]))})}),r[se]=!0,n.onWrap?.()}function yl(e,t){let n=e;if(n[se]){t.onWrap?.();return}if(typeof n.call!="function")return;let r=n.metadata,i=typeof r?.name=="string"?r.name:"unknown",o=n.call;it(n,"call",async function(...s){let l=Rt(s[0]);return jt(t,i,l,xe(l),c=>Promise.resolve(o.apply(this,[c,...s.slice(1)])))}),n[se]=!0,t.onWrap?.()}function Bt(e,t){for(let[n,r]of Object.entries(e))r!==null&&typeof r=="object"&&nt(r,n,t);return e}function ei(e,t,n){let r={...t,framework:n};switch(n){case"vercel":return _l(e,r);case"mastra":return bl(e,r);case"openai":return kl(e,r);case"llamaindex":return wl(e,r);case"voltagent":return vl(e,r);case"semantic-kernel":return Zr(e,r);default:return e}}function _l(e,t){let n=e,r=n.settings&&typeof n.settings=="object"?n.settings:void 0,i=r?.tools??n.tools;return i&&typeof i=="object"&&Bt(i,t),r&&!r.__visiq_step&&(r.__visiq_step=!0,r.onStepFinish=Ut(r.onStepFinish)),rt(e,["generate","stream"],async(o,a)=>(Ce(a,o[0]),o)),e}function bl(e,t){let n=e;return Tl(n,t)==="deferred"&&(n[$t]=!0),rt(e,["generate","stream","generateVNext","streamVNext"],async(r,i)=>{Ce(i,r[0]);let o=r[1]&&typeof r[1]=="object"?{...r[1]}:{};o.onStepFinish=Ut(o.onStepFinish);let a=[...r];return a[1]=o,a}),e}function vl(e,t){let n=Il(e);if(n){for(let r of n)if(r!==null&&typeof r=="object"){let{name:i}=r;nt(r,typeof i=="string"?i:"unknown",t)}}return rt(e,["generateText","streamText","generateObject","streamObject"],async(r,i)=>{Ce(i,r[0]);let o=r[1]&&typeof r[1]=="object"?{...r[1]}:{};o.onStepFinish=Ut(o.onStepFinish);let a=[...r];return a[1]=o,a}),e}function wl(e,t){let n=e,r=o=>{let a=o?.tools;if(Array.isArray(a))for(let s of a)s!==null&&typeof s=="object"&&yl(s,t)},{agents:i}=n;if(i instanceof Map)for(let o of i.values())r(o);else Array.isArray(n.tools)&&r(n);return rt(e,["run"],async(o,a)=>(Ce(a,o[0]),o)),Sl(e,"runStream",(o,a,s)=>{s||Ce(a,o[0])}),e}function kl(e,t){let n=e,{tools:r}=n;if(Array.isArray(r)){for(let i of r)if(i!==null&&typeof i=="object"){let{name:o}=i;hl(i,typeof o=="string"?o:"unknown",t)}}return Al(e,t),e}function Al(e,t){let n=e;if(n.__visiq_openai_hooks||typeof n.on!="function")return;let r=n.on,{telemetry:i}=t;r.call(e,"agent_start",(...o)=>{i.session_id=Jr(),i.llm_prompts=[],i.llm_responses=[],i.agent_reasoning=[],i.retrieverQueries=new Map;let a=o[2];a!=null&&i.llm_prompts.push(xe(a).slice(0,5120))}),r.call(e,"agent_end",(...o)=>{let a=o[1];typeof a=="string"&&a&&i.llm_responses.push(a.slice(0,5120))}),n.__visiq_openai_hooks=!0}function Il(e){let t=r=>Array.isArray(r)&&r.some(i=>i!==null&&typeof i.execute=="function");if(typeof e.getTools=="function")try{let r=e.getTools();if(t(r))return r}catch{}let n=e.toolManager;if(n&&typeof n.getAllBaseTools=="function")try{let r=n.getAllBaseTools();if(t(r))return r}catch{}return t(e.tools)?e.tools:null}function rt(e,t,n){let r=e;for(let i of t){if(typeof r[i]!="function")continue;let o=`__visiq_wrapped_${i}`;if(r[o])continue;let a=r[i];r[i]=function(...s){let l=ti();return x.run(l,async()=>{let c=await n(s,l);return a.apply(e,c)})},r[o]=!0}}function Sl(e,t,n){let r=e;if(typeof r[t]!="function")return;let i=`__visiq_wrapped_${t}`;if(r[i])return;let o=r[t];r[t]=function(...a){let s=x.getStore(),l=s??ti();return n(a,l,s!==void 0),x.run(l,()=>o.apply(e,a))},r[i]=!0}function Ut(e){return t=>{let n=x.getStore(),r=t;if(n&&typeof r?.text=="string"&&r.text&&n.llm_responses.push(r.text.slice(0,5120)),typeof e=="function")return e(t)}}function Ce(e,t){if(t==null)return;let n=t;if(typeof t=="object"){let r=t;n=r.prompt??r.messages??t}e.llm_prompts.push(xe(n).slice(0,5120))}var El=["listTools","getTools"];function Tl(e,t){for(let n of El){let r=e[n];if(typeof r!="function")continue;let i;try{i=r.call(e)}catch{continue}if(i&&typeof i=="object")return typeof i.then!="function"?(Bt(i,t),"sync"):(i.then(()=>{},()=>{}),Rl(e,n,r,t),"deferred")}return"none"}function Rl(e,t,n,r){let i=o=>(o&&typeof o=="object"&&Bt(o,r),o);it(e,t,function(...o){let a=n.apply(this??e,o);return a&&typeof a.then=="function"?a.then(i):i(a)})}function ti(){return{session_id:Jr(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function it(e,t,n){try{e[t]=n}catch{Object.defineProperty(e,t,{value:n,writable:!0,configurable:!0,enumerable:!0})}}function xe(e){try{return JSON.stringify(e)??String(e)}catch{return String(e)}}function di(e,t){let n=Dl(t);if(e[Re]===!0)return e;let r=Pl(e);if(r==="langchain-executor"||r==="langchain-graph")return ce(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,ri(r,null),n.failMode,{model:ii(e)}),ai(e,n),jl(e,n);let i=Xr(e);if(i){ce(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,ri("unknown",i),n.failMode,{model:ii(e)}),ai(e,n);let o=0,a=hi(n);a.onWrap=()=>{o+=1};let s=ei(e,a,i),l=s[$t]===!0;if(o===0&&!l){let c=0;try{c=Lt(e).length}catch{c=0}if(c>0){let u=`[VisIQ] Detected a ${Pt[i]} that ADVERTISES ${String(c)} tool(s) but instrumented ZERO of them \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a tool bag that moved/renamed on a framework version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.`;if(n.onInstrumentFailure!==void 0?n.onInstrumentFailure==="throw":n.failMode==="closed")throw new Error(u);v("zero-instrument",`advertised ${String(c)} tool(s), instrumented none`),console.warn(u)}else{let u=`[VisIQ] Detected a ${Pt[i]} with no tools to instrument (the agent advertises none). If it is intentionally tool-less (LLM-only) this is safe to ignore; otherwise its tool bag is not where this SDK looks for it \u2014 upgrade @visiq/harness or pass the tools through visiq() (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw) to fail closed here.`;if(n.onInstrumentFailure==="throw")throw new Error(u);console.warn(u)}}return s}if(Gl(e)){let o=process.env.VISIQ_GRANT_ID;return o?Wl(e,n,o):Ql(e,n)}throw new Error("[VisIQ] Cannot detect agentic framework. Pass a LangChain AgentExecutor, LangGraph CompiledGraph, or a tool with one of: _call, execute, call, run, invoke.")}var Ol="https://api.visiqlabs.com",Nl="\0",ni=new Map;function ri(e,t){if(e==="langchain-executor"||e==="langchain-graph")return"langchain";switch(t){case"vercel":return"vercel_ai";case"mastra":return"mastra";case"openai":return"openai_agents";case"llamaindex":return"llamaindex";case"voltagent":return"voltagent";case"semantic-kernel":return"semantic_kernel";default:return}}function ii(e){try{if(typeof e!="object"||e===null)return;let t=e,n=le(t.model);if(n)return n;let{settings:r}=t;if(typeof r=="object"&&r!==null){let a=le(r.model);if(a)return a}let{llm:i}=t;if(typeof i=="object"&&i!==null){let a=oi(i);if(a)return a}let{agents:o}=t;if(o instanceof Map){for(let a of o.values())if(typeof a=="object"&&a!==null){let s=a,l=s.llm,c=le(s.model)??(typeof l=="object"&&l!==null?oi(l):void 0);if(c)return c}}return}catch{return}}function oi(e){return le(e.model)??le(e.modelId)??le(e.model_name)}function le(e){if(typeof e=="string"&&e.trim().length>0)return e.trim();if(typeof e=="object"&&e!==null){let t=e;for(let n of["modelId","model_id","id","model","modelName","model_name"]){let r=t[n];if(typeof r=="string"&&r.trim().length>0)return r.trim()}}}function ce(e,t,n,r,i,o,a){let s=[e??"",t??"",n??"",r??"",o??""].join(Nl),l=ni.get(s);return l||(l=new Rr(e,t,n,void 0,r,V,lt),l.registerHostEnvironment(i,a),ni.set(s,l)),o!==void 0&&l.setFailMode(o),l}function ai(e,t){try{let n=ce(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode),r=Lt(e);r.length>0&&n.reportToolSurface(r),zr(e).then(i=>{let o=i.filter(a=>!r.some(s=>s.name===a.name));o.length>0&&n.reportToolSurface(o)}).catch(()=>{})}catch{}}function Ml(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_TIMEOUT_MS;if(t!==void 0){let n=Number.parseInt(t,10);if(Number.isFinite(n)&&n>0)return n}}function Dl(e){let t=e?.agentId??process.env.VISIQ_AGENT_ID??Fl(),n=e?.apiKey??process.env.VISIQ_API_KEY,r=e?.endpoint??process.env.VISIQ_ENDPOINT??(n?Ol:void 0);return{agentId:t,apiKey:n,endpoint:r,hitlTimeoutMs:$l(e?.hitlTimeoutMs),timeoutMs:Ml(e?.timeoutMs),onInstrumentFailure:e?.onInstrumentFailure??Ll(),failMode:G(e?.failMode)}}function Ll(){let e=process.env.VISIQ_ON_INSTRUMENT_FAILURE;if(e==="throw")return"throw";if(e==="warn")return"warn"}function Fl(){let e=t=>t.toLowerCase().replace(/^@[^/]+\//,"").replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,255);try{let t=process.cwd();for(let n=0;n<64;n++){let r=at.join(t,"package.json");if(ot.existsSync(r)){let o=JSON.parse(ot.readFileSync(r,"utf8"));if(typeof o.name=="string"&&o.name.trim()){let a=e(o.name);if(a)return a}break}let i=at.dirname(t);if(i===t)break;t=i}}catch{}try{let t=e(ui.hostname());if(t)return t}catch{}return"agent"}function $l(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_HITL_TIMEOUT_MS;if(t){let n=Number(t);if(Number.isFinite(n)&&n>0)return n}return Ct}function Pl(e){let t=e;if(typeof t.invoke=="function"&&t.agent&&Array.isArray(t.tools))return"langchain-executor";if(typeof t.invoke=="function"&&t.nodes&&(t.edges||t.lg_is_pregel===!0||typeof t.builder=="object"&&t.builder!==null&&t.builder.edges))return"langchain-graph";if(typeof t.invoke=="function"){let n=Vt(t);if(n!==t&&n.nodes&&(n.lg_is_pregel===!0||n.channels))return"langchain-graph"}return"unknown"}function jl(e,t){let n=e,r=ce(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode),i=Bl(n);for(let l of i)Kt(l,t.agentId,r),zl(l,t.agentId,r,t),mi(l,r,t);let{nodes:o}=Vt(n);if(!!o&&typeof o=="object"&&"tools"in o&&i.length===0){let l="[VisIQ] Detected a LangGraph agent whose compiled graph carries a ToolNode, but resolved ZERO tools from it \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a compiled-graph tool bag that moved on a @langchain/langgraph version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.";if(t.onInstrumentFailure!==void 0?t.onInstrumentFailure==="throw":t.failMode==="closed")throw new Error(l);v("zero-instrument","langgraph compiled-graph ToolNode present, resolved no tools"),console.warn(l)}let s=n.invoke;if(n.invoke=function(l,c){let u=zt(),d=ci(t.agentId,r),f=c?.callbacks??[];return x.run(u,()=>s.call(this,l,{...c,callbacks:[...f,d]}))},typeof n.stream=="function"){let l=n.stream;n.stream=function(c,u){let d=zt(),f=ci(t.agentId,r),g=u?.callbacks??[];return x.run(d,()=>l.call(this,c,{...u,callbacks:[...g,f]}))}}return e}function Vt(e){if(e.nodes&&typeof e.nodes=="object")return e;for(let t of["graph","builder"]){let n=e[t];if(n&&typeof n=="object"&&n.nodes)return n}return e}function Bl(e){let t=[],n=new Set,r=o=>{if(Array.isArray(o))for(let a of o)a&&typeof a=="object"&&!n.has(a)&&(n.add(a),t.push(a))};r(e.tools);let{nodes:i}=Vt(e);if(i&&typeof i=="object"){for(let o of Object.values(i))if(o&&typeof o=="object"){let a=o;r(a.tools);let{bound:s}=a;s&&typeof s=="object"&&r(s.tools)}}return t}function zt(){return{session_id:Cl(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function Kt(e,t,n){let r=e,i=Symbol.for("visiq.recall.instrumented");if(!r[i]){if(typeof r._getRelevantDocuments=="function"){let o=r._getRelevantDocuments;r._getRelevantDocuments=async function(a,s){let l=await o.call(this,a,s);return si(l,t,a,n)},r[i]=!0}if(typeof r.retrieve=="function"&&!r._getRelevantDocuments){let o=r.retrieve;r.retrieve=async function(a){let s=await o.call(this,a);return si(s,t,String(a),n)},r[i]=!0}r.retriever&&typeof r.retriever=="object"&&Kt(r.retriever,t,n)}}var Ul=Symbol.for("visiq.operations"),ql=new Set(["action","retrieval","delegation"]);function pi(e){if(typeof e!="object"||e===null)return;let t=e[Ul]??e.visiqOperations;if(!Array.isArray(t))return;let n=t.filter(r=>typeof r=="string"&&ql.has(r));return n.length>0?Array.from(new Set(n)):void 0}function zl(e,t,n,r){let i=e,o=Symbol.for("visiq.recall.tool-instrumented");if(i[o]||typeof i.func!="function")return;let a=typeof i.name=="string"?i.name:"",s=typeof i.retriever=="object"&&i.retriever!==null,l=a.split(/[^a-zA-Z0-9]+|(?<=[a-z])(?=[A-Z])/).map(S=>S.toLowerCase()),c=new Set(["update","delete","create","write","archive","insert","remove","patch"]),u=new Set(["send","post","put"]),d=l.some(S=>c.has(S)),f=u.has(l[0]??""),g=d||f,m=["update","delete","create","archive","insert","remove"],p=l.some(S=>m.some(b=>S.length>b.length&&S.endsWith(b))),O=/retriev/i.test(a)||/search.*doc|knowledge/i.test(a)&&!g&&!p,A=pi(i),R=A?.includes("retrieval")??!1;if(A!==void 0&&!R||!(s||O||R))return;let De=A?R&&A.includes("action"):d||p;if(!De)if(s)Kt(i.retriever,t,n);else{let S=globalThis,b=Symbol.for("visiq.recall.closureRetrieverWarned"),P=S[b]??=new Set;P.has(a)||(P.add(a),console.warn(`[VisIQ] Retriever tool "${a||"(unnamed)"}" exposes no reachable retriever (e.g. LangChain createRetrieverTool returns a joined string). RECALL masks its output via value-shape + whole-result rules, but PER-DOCUMENT metadata/classification rules cannot apply to a metadata-less joined string. For full per-doc governance, pass the retriever to visiq() directly, or use a tool that returns a Document[].`))}let H=i.func;De?(i[fi]=!0,i.func=async function(...S){await n.awaitBundleReady();let b=S[0],P=typeof b=="object"&&b!==null?b:{input:b},de=typeof P.query=="string"?P.query:void 0,w=x.getStore(),k=K(w),N;try{N=await n.evaluate({operations:["retrieval","action"],agentId:t,...w?.session_id?{sessionId:w.session_id}:{},toolName:a||"unknown",toolArgs:P,resourceType:"document",resourceMetadata:{},...de!==void 0?{query:de}:{},...k?{telemetry:k}:{}})}catch(L){let pe=L instanceof Error?L.message:String(L);return G(r?.failMode)==="closed"?C({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${pe} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for hybrid tool "${a||"unknown"}": ${pe}`),H.apply(this,S))}let E=Z(N),st=Ee(E.hitlFallback,E.argRedactionRules),Gt=S,Ht=()=>{try{return Gt=[M(P,D(E.argRedactionRules)),...S.slice(1)],null}catch{return G(r?.failMode)==="closed"?C({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a||"unknown"}" \u2014 running with UNMASKED args`),null)}};if(E.decision==="approval_required"&&E.decisionId&&r){let L=await Te({endpoint:n.getEndpoint()??r.endpoint??"",apiKey:n.getApiKey()??r.apiKey,decisionId:E.decisionId,timeoutMs:r.hitlTimeoutMs,maskFallback:st,sdkVersion:V});if(L.resolution==="mask"){let pe=Ht();if(pe)return pe}else if(L.resolution!=="proceed")return C({outcome:"approval_required",code:E.ruleCode??"HITL-BLOCK",reason:E.reason,mechanism:L.reason})}else if(!E.allowed)return C({outcome:"deny",code:E.ruleCode??"DENY",reason:E.reason});if(E.decision==="mask"&&E.argRedactionRules.length>0){let L=Ht();if(L)return L}let bi=await H.apply(this,Gt);return Ur(bi,N,r?.failMode)}):i.func=async function(...S){let b=await H.apply(this,S);return typeof b=="string"?$r(b,t,n):Xe(b,t,n)},i[o]=!0}var fi=Symbol.for("visiq.hybrid.instrumented");async function si(e,t,n,r){return Fr(e,t,n,r)}var li=["invoke","call","_call"],ee=new xl;function mi(e,t,n){let r=e,i=Symbol.for("visiq.allow.instrumented");if(r[i]||typeof r._getRelevantDocuments=="function"||r[fi]||pi(r)?.every(c=>c==="retrieval")||!li.some(c=>typeof r[c]=="function"))return;let{agentId:o}=n,a=typeof r.name=="string"?r.name:"unknown",s=Symbol("visiq.gate"),l=async(c,u,d,f,g)=>{let m=ee.getStore();if(m!==void 0&&m.gateKey===s&&!m.entered.has(g))return m.entered.add(g),c.call(u,d,...f);let p;if(typeof d=="string")p=d;else{let w=d?.input;p=w!=null?String(w):JSON.stringify(d)??""}let _=x.getStore(),O=K(_),A=typeof d=="object"&&d!==null?d:{input:p},R=We(a,A);R&&he(t,{agentId:o,sessionId:_?.session_id,framework:"langchain"},R);let Me={agentId:o,sessionId:_?.session_id,framework:"langchain"},ue=fe(a,A);try{ye(t,Me,{toolName:a,...ue?{memory:ue}:{},argSummary:p.slice(0,512)})}catch(w){U("step-beat",`emit failed for tool "${a}": ${qt(w)}`)}let De=Date.now(),H=async w=>{let k=await w();try{_e(t,Me,{toolName:a,ok:!0,durationMs:Date.now()-De,...Q(k)!==void 0?{bytes:Q(k)}:{},...Y(k)!==void 0?{itemCount:Y(k)}:{},...ue?{memory:ue}:{}})}catch(N){U("observation-beat",`emit failed for tool "${a}": ${qt(N)}`)}return k},S=(w,k,N,E)=>{try{ne(t,Me,{toolName:a,decision:w,...k?{ruleCode:k}:{},...N?{ruleLabel:N}:{},enforced:!0,...E?{harnessMessage:E}:{}})}catch(st){U("intervention-beat",`emit failed for tool "${a}": ${qt(st)}`)}};await t.awaitBundleReady();let b,P=!1;try{let w=await t.evaluate({operations:R?["action","delegation"]:["action"],agentId:o,..._?.session_id?{sessionId:_.session_id}:{},toolName:a,toolArgs:A,targetResource:Ft(p),...O?{telemetry:O}:{},...R?{context:Qe(R,o)}:{}});({enforced:P}=w),b=Z(w)}catch(w){let k=w instanceof Error?w.message:String(w);return n.failMode==="closed"?C({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${k} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for tool "${a}": ${k}`),ee.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)))}let de=w=>{let k=ie(a,w,{failMode:n.failMode==="closed"?"closed":"open",enforced:P});if(k.verdict==="block"){let E=C({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${k.detectors.join(",")})`});return S("deny","OUTPUT-BLOCK","outbound content carried a live secret",E),E}let N=w;return k.verdict==="redact"&&(N=k.redacted,v("outbound-secret-redacted",`outbound secret screen redacted ${k.detectors.length} detector(s): ${k.detectors.join(",")}`),S("mask","OUTPUT-BLOCK","outbound secret redacted before egress")),H(()=>ee.run({gateKey:s,entered:new Set([g])},()=>c.call(u,N,...f)))};if(b.decision==="approval_required"&&b.decisionId){let w=Ee(b.hitlFallback,b.argRedactionRules),k=await Te({endpoint:t.getEndpoint()??n.endpoint??"",apiKey:t.getApiKey()??n.apiKey,decisionId:b.decisionId,timeoutMs:n.hitlTimeoutMs,maskFallback:w,sdkVersion:V});if(k.resolution==="proceed")return H(()=>ee.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)));if(k.resolution==="mask")try{let E=M(d,D(b.argRedactionRules));return S("mask",b.ruleCode,b.reason),H(()=>ee.run({gateKey:s,entered:new Set([g])},()=>c.call(u,E,...f)))}catch{return n.failMode==="closed"?C({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`HITL mask fallback failed for tool "${a}" \u2014 running with UNMASKED args`),ee.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)))}let N=C({outcome:"approval_required",code:b.ruleCode??"HITL-BLOCK",reason:b.reason,mechanism:k.reason});return S("approval_required",b.ruleCode,b.reason,N),N}if(!b.allowed){let w=C({outcome:"deny",code:b.ruleCode??"DENY",reason:b.reason});return S("deny",b.ruleCode,b.reason,w),w}if(b.decision==="mask"&&b.argRedactionRules.length>0)try{let w=M(d,D(b.argRedactionRules));return S("mask",b.ruleCode,b.reason),de(w)}catch{return n.failMode==="closed"?C({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a}" \u2014 running with UNMASKED args`),ee.run({gateKey:s,entered:new Set([g])},()=>c.call(u,d,...f)))}return de(d)};for(let c of li){if(typeof r[c]!="function")continue;let u=r[c];r[c]=function(d,...f){return l(u,this,d,f,c)}}r[i]=!0}function qt(e){return e instanceof Error?e.message:String(e)}function Vl(e,t,n){let r=(a,s)=>{if(!a||typeof a!="object")return;let l=a[s];return typeof l=="string"&&l.length>0?l:void 0},i=t?.invocation_params,o=e&&typeof e=="object"?e.kwargs:void 0;return r(i,"model")??r(i,"model_name")??r(n,"ls_model_name")??r(o,"model")??r(o,"model_name")}function Kl(e,t){let n=(g,m)=>{if(!g||typeof g!="object")return;let p=g[m];return typeof p=="number"&&Number.isFinite(p)?p:void 0},r=e?.tokenUsage,i=n(r,"promptTokens"),o=n(r,"completionTokens");if(i!==void 0||o!==void 0)return{...i!==void 0?{tokensIn:i}:{},...o!==void 0?{tokensOut:o}:{}};let a=t?.usage_metadata,s=n(a,"input_tokens"),l=n(a,"output_tokens");if(s===void 0&&l===void 0)return;let c=a&&typeof a=="object"?a.input_token_details:void 0,u=n(c,"cache_read"),d=n(c,"cache_creation"),f=s!==void 0?Math.max(0,s-(u??0)-(d??0)):void 0;return{...f!==void 0?{tokensIn:f}:{},...l!==void 0?{tokensOut:l}:{},...u!==void 0?{cacheRead:u}:{},...d!==void 0?{cacheWrite:d}:{}}}function ci(e,t){return{name:"VisiqHandler",handleLLMStart:async(n,r,i,o,a,s,l)=>{let c=x.getStore();if(!c)return;c.llm_prompts.push(...r);let u=Vl(n,a,l);u&&(c.llm_model=u,t.captureCloneMetadata({model:u,agentType:"langchain"}))},handleLLMEnd:async n=>{let r=x.getStore();if(!r)return;let o=n?.generations?.[0]?.[0],a=typeof o?.text=="string"?o.text:"";a&&r.llm_responses.push(a);try{let s=n?.llmOutput,l=o?.message&&typeof o.message=="object"?o.message:void 0,c=Kl(s,l);if(!c&&!a)return;let u=l?.tool_calls,d=typeof s?.model=="string"?s.model:void 0,f=r.llm_model??d;await t.awaitBundleReady(),dt(t,{agentId:e,sessionId:r.session_id,framework:"langchain"},{...a?{texts:[a]}:{},...c?{usage:c}:{},...f?{model:f}:{},final:!(Array.isArray(u)&&u.length>0)})}catch{}},handleAgentAction:async n=>{let r=x.getStore();if(!r)return;let i=typeof n.log=="string"?n.log:"";i&&r.agent_reasoning.push(i)},handleRetrieverStart:async(n,r,i)=>{let o=x.getStore();o&&o.retrieverQueries.set(i,r??"")},handleRetrieverEnd:async(n,r)=>{let i=x.getStore();if(!i)return;let o=i.retrieverQueries.get(r)??"";if(i.retrieverQueries.delete(r),!Array.isArray(n))return;let a=K(i);for(let s of n){let l=s,c=String(l.pageContent??l.text??l.content??""),u=l.metadata??{};await t.evaluate({operations:["retrieval"],agentId:e,resourceType:"document",resourceMetadata:u,query:o,contentPreview:c.slice(0,500),...a?{telemetry:a}:{}})}},handleRetrieverError:async(n,r)=>{let i=x.getStore();i&&i.retrieverQueries.delete(r)}}}var gi=["_call","execute","call","run","invoke"];function Gl(e){let t=e;for(let n of gi)if(typeof t[n]=="function")return!0;return!1}function Hl(e){return e instanceof X?!0:e instanceof B?typeof e.status=="number"&&e.status>=400&&e.status<500:!1}function Wl(e,t,n){let r=null,i=null,o=!1,a=async()=>{if(r)return r;if(i)throw new X(`Failed to bootstrap grant ${n}: ${i.message}`,null);let s;try{s=await Kr(t.agentId,n)}catch(l){throw o=Hl(l),o&&(i=l instanceof Error?l:new Error(String(l))),new X(`Failed to bootstrap grant ${n}: ${l instanceof Error?l.message:String(l)}`,null)}return r=Gr(e,{agentId:t.agentId,grantToken:s,failBehavior:t.failMode==="closed"?"deny":"permit",...t.apiKey?{apiKey:t.apiKey}:{},...t.endpoint?{endpoint:t.endpoint}:{}}),r};return new Proxy(e,{get(s,l,c){if(l===Re)return!0;let u=Reflect.get(s,l,c);return typeof u!="function"||typeof l!="string"||!gi.includes(l)?u:async function(...d){let f;try{f=await a()}catch(m){if(o||t.failMode==="closed")throw m;return v("grant-bootstrap",`grant ${n} bootstrap failed: ${m instanceof Error?m.message:String(m)}`),u.call(this,...d)}return f[l].call(f,...d)}}})}function Ql(e,t){let n=ce(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode);mi(e,n,t);let r=e;if(typeof r.execute=="function"){let i=typeof r.name=="string"&&r.name||typeof r.id=="string"&&r.id||"unknown";nt(e,i,hi(t))}return e}function hi(e){return{agentId:e.agentId,unified:ce(e.apiKey,e.endpoint,e.agentId,e.timeoutMs,void 0,e.failMode),hitlTimeoutMs:e.hitlTimeoutMs,failMode:e.failMode,...e.apiKey?{apiKey:e.apiKey}:{},...e.endpoint?{endpoint:e.endpoint}:{},telemetry:zt()}}async function yi(e,t={}){if(!e||e.trim()==="")throw new Error("[VisIQ] visiq.delegate: childAgentId is required");let n=process.env.VISIQ_AGENT_ID;if(!n)throw new Error("[VisIQ] visiq.delegate: VISIQ_AGENT_ID env var is required. Set it to the parent agent ID before calling delegate.");let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[VisIQ] visiq.delegate: VISIQ_API_KEY env var is required");let i=process.env.VISIQ_ENDPOINT;return{VISIQ_GRANT_ID:(await new ae({agentId:n,apiKey:r,...i?{endpoint:i}:{}}).requestGrant({parentAgentId:n,childAgentId:e,toolScope:t.toolScope??null,contextScope:t.contextScope??null,durationSeconds:t.durationSeconds??3600,purpose:t.purpose??`Delegated to ${e}`,...t.maxDepth!==void 0?{maxDepth:t.maxDepth}:{},...t.parentGrantToken!==void 0?{parentGrantToken:t.parentGrantToken}:{}})).grantId}}var Oe=class{constructor(t){this.transport=t}transport;deploy(t={}){let n={include_mac:t.includeMac??!1};return t.autoInstallHarness!==void 0&&(n.auto_install_harness=t.autoInstallHarness),te(this.transport,"POST","/api/discovery/fleet/deploy",n)}status(){return te(this.transport,"GET","/api/discovery/fleet/status")}heartbeat(t){return te(this.transport,"POST","/api/discovery/fleet/heartbeat",{instance_id:t.instanceId,vendor:t.vendor})}stop(){return te(this.transport,"POST","/api/discovery/fleet/stop")}};var Ne=class{constructor(t){this.transport=t}transport;connectAws(t){return te(this.transport,"POST","/api/discovery/integrations/aws",{aws_account_id:t.awsAccountId,aws_region:t.awsRegion})}};function Yl(e){if(!e.baseUrl||e.baseUrl.length===0)throw new Error("[VisIQ] createVisiqClient: baseUrl is required");if(!e.accessToken&&!e.cookieHeader)throw new Error("[VisIQ] createVisiqClient: one of accessToken or cookieHeader is required");let t=e.baseUrl.replace(/\/$/,""),n=e.fetchImpl??globalThis.fetch.bind(globalThis),r={baseUrl:t,accessToken:e.accessToken,cookieHeader:e.cookieHeader,fetchImpl:n};return{fleet:new Oe(r),integrations:new Ne(r)}}async function te(e,t,n,r){let i=`${e.baseUrl}${n.startsWith("/")?n:`/${n}`}`,o={...W(V)};e.cookieHeader&&(o.Cookie=e.cookieHeader),e.accessToken&&(o.Authorization=`Bearer ${e.accessToken}`);let a;r!==void 0&&(o["Content-Type"]="application/json",a=JSON.stringify(r));let s=await e.fetchImpl(i,{method:t,headers:o,body:a});if(!s.ok){let l="";try{l=await s.text()}catch{}throw new Error(`[VisIQ] ${t} ${n} failed (${s.status}): ${l||s.statusText}`)}return await s.json()}var _i=di;_i.delegate=yi;var Vu=_i;export{He as DEFAULT_FAIL_MODE,Oe as FleetClient,Ne as IntegrationsClient,Yl as createVisiqClient,yi as delegate,Se as normalizeFailMode,Vu as visiq};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@visiq/harness",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.15",
|
|
4
4
|
"description": "VisIQ agent-governance harness for Node.js — action governance, retrieval governance, and audit-trail reporting, added to your existing agent framework by one visiq() call.",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|