@visiq/harness 0.2.9 → 0.2.10

package/README.md

@@ -65,7 +65,7 @@ variables (option takes precedence, then the env var):
 
 ## Multi-agent delegation
 
-For multi-agent (ORCHESTRATE) flows, mint the env a child process needs so its
+For multi-agent delegation flows, mint the env a child process needs so its
 authority is a scoped delegation of the parent's:
 
 ```ts

package/dist/index.d.ts

@@ -28,14 +28,14 @@ export interface VisiqOptions {
 	/** Backend endpoint URL. Falls back to VISIQ_ENDPOINT env var. */
 	endpoint?: string;
 	/**
-	 * Max time (ms) to wait for a human to resolve an ALLOW `approval_required`
+	 * Max time (ms) to wait for a human to resolve an `approval_required`
 	 * (HITL) decision before failing closed and blocking the tool call. Falls
 	 * back to the VISIQ_HITL_TIMEOUT_MS env var, then to 120_000ms (2 min) —
 	 * matching the backend's 120s `hitl_timeout_seconds` ceiling.
 	 */
 	hitlTimeoutMs?: number;
 	/**
-	 * Per-evaluate network timeout (ms) before the ALLOW pre-gate fails CLOSED
+	 * Per-evaluate network timeout (ms) before the action-governance pre-gate fails CLOSED
 	 * (G001) on a stuck/slow backend. Falls back to the VISIQ_TIMEOUT_MS env var,
 	 * then to the SDK runtime default (5s). Raise it for high-latency paths
 	 * (cross-region CI → deployed backend, or the approval_required path that
@@ -228,13 +228,14 @@ export interface Transport {
 /**
  * Callable + namespaced `visiq` entry point.
  *
- * The function form is the ALLOW/RECALL/ORCHESTRATE tool & framework wrap
- * (`visiq(target, { agentId })`). `visiq.delegate(child, opts)` mints a
- * delegation grant and returns the env vars the child process needs.
+ * The function form applies action, retrieval and delegation governance to a
+ * tool or framework object (`visiq(target, { agentId })`).
+ * `visiq.delegate(child, opts)` mints a delegation grant and returns the env
+ * vars the child process needs.
  */
 export interface VisiqFunction {
 	<T extends object>(target: T, options?: VisiqOptions): T;
-	/** Mint an ORCHESTRATE delegation grant for a child agent. */
+	/** Mint a delegation grant for a child agent. */
 	delegate: typeof delegate;
 }
 export declare const visiq: VisiqFunction;

package/dist/index.js

@@ -1,6 +1,6 @@
-import{randomUUID as rs}from"node:crypto";import*as tt from"node:fs";import*as nt from"node:path";import*as Dr from"node:os";import{AsyncLocalStorage as os}from"node:async_hooks";import{z as m}from"zod";import*as P from"node:os";import{randomUUID as pe}from"node:crypto";var ot=1,Dt="X-VisIQ-SDK",$t="X-VisIQ-Dialect",Ft="unknown";function H(e,t=1){return{[Dt]:e&&e.length>0?e:Ft,[$t]:String(t)}}var Pt="interceptor_source",Kr=m.enum(["enforce","audit","off"]),Gr=m.enum(["closed","open"]),jt=m.enum(["enforce","monitor","off"]),Hr=m.object({apiKey:m.string().min(1,"apiKey is required"),agentId:m.string().min(1,"agentId is required"),endpoint:m.string().url().optional(),mode:Kr.optional(),timeoutMs:m.number().int().positive().optional(),hitlTimeoutMs:m.number().int().positive().optional(),failBehavior:Gr.optional()}),Ts=m.object({agent_id:m.string().min(1),target_app:m.string().min(1),action:m.string().min(1),context:m.record(m.unknown()).optional(),session_id:m.string().min(1).max(255).optional(),action_schema_id:m.string().min(1).max(128).optional(),telemetry:m.record(m.unknown()).optional()}),Wr=m.object({field:m.string().optional(),pattern:m.string().optional(),replacement:m.string().optional(),mode:m.enum(["full","partial","email"]).optional(),keepFirst:m.number().optional(),keepLast:m.number().optional(),maskChar:m.string().optional()}),Qr=m.object({decision_id:m.string().min(1),decision:m.enum(["permit","deny","approval_required","mask"]),reason:m.string().optional(),rule_code:m.string().nullable().optional(),enforced:m.boolean().optional(),agent_mode:jt.optional(),arg_redaction_rules:m.array(Wr).optional(),plane:m.string().nullable().optional(),operation:m.string().nullable().optional(),is_retrieval:m.boolean().optional(),metadata:m.record(m.unknown()).optional()}),Yr=m.object({field:m.string().min(1),operator:m.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:m.union([m.string(),m.number(),m.array(m.string())])}),Jr=m.object({id:m.string().min(1),rule_code:m.string().default(""),name:m.string().min(1),description:m.string().nullable().default(null),effect:m.enum(["allow","deny","hitl","mask"]),resource_type:m.string().min(1),rego_source:m.string().default(""),target_app:m.string().nullable().default(null),action_pattern:m.string().nullable().default(null),conditions:m.array(Yr).default([]),priority:m.number().int().default(0)}),Zr=m.object({version:m.string().min(1),agent_mode:jt.optional(),rules:m.array(Jr),no_coverage:m.object({no_coverage_defaults:m.record(m.string()),autopilot_enabled:m.boolean(),enduser_hitl_enabled:m.boolean(),hitl_timeout_seconds:m.number()}).optional()}),Xr=2e3,it=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return H(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let o=await r.json();return Qr.parse(o)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),o;try{o=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!o.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${o.status} ${o.statusText}`);let i=await o.json();return Zr.parse(i)}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let o=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});o.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${o.status}`)}catch(o){console.warn("[ALLOW] Execution result report failed:",o)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{system_prompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{tool_schemas:e.toolSchemas}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),o;try{o=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!o.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${o.status} ${o.statusText}`);let i=await o.json();if(typeof i!="object"||i===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let a=i,s=a.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof a.reason=="string"?a.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await eo(Xr)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function eo(e){return new Promise(t=>setTimeout(t,e))}function De(){let e={};try{let t=`${P.platform()} ${P.release()}`.trim();t&&(e.os=t)}catch{}try{let t=P.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=P.userInfo();t&&(e.username=t)}catch{}try{let t=to();t&&(e.ip=t)}catch{}return e}function to(){let e=P.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}function no(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function Me(e,...t){for(let n of t){let r=no(e[n]);if(r)return r}}function Le(e){if(Me(e,"run_id","runId","session_id","sessionId","thread_id","threadId"))return"session";if(Me(e,"user_id","userId"))return"user";if(Me(e,"agent_id","agentId"))return"agent";if(Me(e,"org_id","orgId","namespace"))return"org"}var ro=[{framework:"mem0",matches:e=>/^(mem0[_-])?(add|search|get|retrieve|update|delete)[_-]memor(y|ies)$/i.test(e),extract:(e,t)=>{let n=/^(?:mem0[_-])?([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"||n==="update"?r="write":r="read";let o=Le(t);return{op:r,store:"mem0",framework:"mem0",...o?{scope:o}:{}}}},{framework:"letta",matches:e=>/^(core_memory_(append|replace)|archival_memory_(insert|search)|conversation_search)$/i.test(e),extract:e=>{let t=e.toLowerCase();return t.startsWith("core_memory_")?{op:"write",store:"letta-core",scope:"agent",framework:"letta"}:t==="archival_memory_insert"?{op:"write",store:"letta-archival",scope:"agent",framework:"letta"}:t==="archival_memory_search"?{op:"search",store:"letta-archival",scope:"agent",framework:"letta"}:{op:"search",store:"letta-conversation",scope:"session",framework:"letta"}}},{framework:"langgraph",matches:e=>/^(upsert_memory|save_recall_memory|search_recall_memories)$/i.test(e),extract:(e,t)=>{let n=/^search_/i.test(e),r=Le(t);return{op:n?"search":"write",store:"langgraph-store",framework:"langgraph",...r?{scope:r}:{}}}},{framework:"zep",matches:e=>/^zep[_-](add|search|get|delete)[_-]memory$/i.test(e),extract:(e,t)=>{let n=/^zep[_-]([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"?r="write":r="read";let o=Le(t)??"session";return{op:r,store:"zep",scope:o,framework:"zep"}}},{framework:"mcp-memory",matches:e=>/^(create_entities|create_relations|add_observations|delete_entities|delete_relations|delete_observations|search_nodes|open_nodes|read_graph)$/i.test(e),extract:e=>{let t=e.toLowerCase(),n;return t.startsWith("delete_")?n="delete":t==="search_nodes"?n="search":t==="open_nodes"||t==="read_graph"?n="read":n="write",{op:n,store:"mcp-memory",scope:"agent",framework:"mcp-memory"}}},{framework:"generic",matches:e=>/(^|[_\-.])(memory|memories|mem0|recall)([_\-.]|$)/i.test(e),extract:(e,t)=>{let n=e.toLowerCase(),r;/(^|[_\-.])(search|query|find|lookup|retrieve)([_\-.]|$)/.test(n)?r="search":/(^|[_\-.])(delete|remove|forget|clear|purge)([_\-.]|$)/.test(n)?r="delete":/(^|[_\-.])(add|save|write|store|upsert|put|set|update|insert|append|remember)([_\-.]|$)/.test(n)?r="write":r="read";let o=Le(t);return{op:r,store:"memory",framework:"generic",...o?{scope:o}:{}}}}];function de(e,t){if(!e)return null;let n=t??{};for(let r of ro)try{if(r.matches(e)){let o=r.extract(e,n);if(o)return o}}catch{}return null}function at(e,t){let n=typeof t?.itemCount=="number"&&Number.isFinite(t.itemCount)&&t.itemCount>=0?Math.round(t.itemCount):void 0,r=typeof t?.bytes=="number"&&Number.isFinite(t.bytes)&&t.bytes>=0?Math.round(t.bytes):void 0,o=e.op==="read"||e.op==="search";return{op:e.op,store:e.store,...e.scope?{scope:e.scope}:{},...n!==void 0?{itemCount:n}:{},...r!==void 0?{bytes:r}:{},...o&&n!==void 0?{hit:n>0}:{}}}var Lt=new Map;function fe(e){let t=(Lt.get(e)??0)+1;return Lt.set(e,t),t}function Ut(e){if(!e||typeof e!="object")return;let t={};for(let n of["tokensIn","tokensOut","cacheRead","cacheWrite"]){let r=e[n];typeof r=="number"&&Number.isFinite(r)&&r>=0&&(t[n]=Math.round(r))}return Object.keys(t).length>0?t:void 0}function st(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,o=Array.isArray(n.texts)?n.texts.filter(a=>typeof a=="string"&&a.length>0).join(`
+import{randomUUID as hs}from"node:crypto";import*as tt from"node:fs";import*as nt from"node:path";import*as Dr from"node:os";import{AsyncLocalStorage as _s}from"node:async_hooks";import{z as m}from"zod";import*as P from"node:os";import{randomUUID as pe}from"node:crypto";var ot=1,Ft="X-VisIQ-SDK",$t="X-VisIQ-Dialect",Pt="unknown";function H(e,t=1){return{[Ft]:e&&e.length>0?e:Pt,[$t]:String(t)}}var jt="interceptor_source",Kr=m.enum(["enforce","audit","off"]),Gr=m.enum(["closed","open"]),Ut=m.enum(["enforce","monitor","off"]),Hr=m.object({apiKey:m.string().min(1,"apiKey is required"),agentId:m.string().min(1,"agentId is required"),endpoint:m.string().url().optional(),mode:Kr.optional(),timeoutMs:m.number().int().positive().optional(),hitlTimeoutMs:m.number().int().positive().optional(),failBehavior:Gr.optional()}),js=m.object({agent_id:m.string().min(1),target_app:m.string().min(1),action:m.string().min(1),context:m.record(m.unknown()).optional(),session_id:m.string().min(1).max(255).optional(),action_schema_id:m.string().min(1).max(128).optional(),telemetry:m.record(m.unknown()).optional()}),Wr=m.object({field:m.string().optional(),pattern:m.string().optional(),replacement:m.string().optional(),mode:m.enum(["full","partial","email"]).optional(),keepFirst:m.number().optional(),keepLast:m.number().optional(),maskChar:m.string().optional()}),Qr=m.object({decision_id:m.string().min(1),decision:m.enum(["permit","deny","approval_required","mask"]),reason:m.string().optional(),rule_code:m.string().nullable().optional(),enforced:m.boolean().optional(),agent_mode:Ut.optional(),arg_redaction_rules:m.array(Wr).optional(),plane:m.string().nullable().optional(),operation:m.string().nullable().optional(),is_retrieval:m.boolean().optional(),metadata:m.record(m.unknown()).optional()}),Yr=m.object({field:m.string().min(1),operator:m.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:m.union([m.string(),m.number(),m.array(m.string())])}),Zr=m.object({id:m.string().min(1),rule_code:m.string().default(""),name:m.string().min(1),description:m.string().nullable().default(null),effect:m.enum(["allow","deny","hitl","mask"]),resource_type:m.string().min(1),rego_source:m.string().default(""),target_app:m.string().nullable().default(null),action_pattern:m.string().nullable().default(null),conditions:m.array(Yr).default([]),priority:m.number().int().default(0)}),Jr=m.object({version:m.string().min(1),agent_mode:Ut.optional(),rules:m.array(Zr),no_coverage:m.object({no_coverage_defaults:m.record(m.string()),autopilot_enabled:m.boolean(),enduser_hitl_enabled:m.boolean(),hitl_timeout_seconds:m.number()}).optional()}),Xr=2e3,it=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return H(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let o=await r.json();return Qr.parse(o)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),o;try{o=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!o.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${o.status} ${o.statusText}`);let i=await o.json();return Jr.parse(i)}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let o=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});o.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${o.status}`)}catch(o){console.warn("[ALLOW] Execution result report failed:",o)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{system_prompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{tool_schemas:e.toolSchemas}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),o;try{o=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!o.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${o.status} ${o.statusText}`);let i=await o.json();if(typeof i!="object"||i===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let a=i,s=a.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof a.reason=="string"?a.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await eo(Xr)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function eo(e){return new Promise(t=>setTimeout(t,e))}function De(){let e={};try{let t=`${P.platform()} ${P.release()}`.trim();t&&(e.os=t)}catch{}try{let t=P.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=P.userInfo();t&&(e.username=t)}catch{}try{let t=to();t&&(e.ip=t)}catch{}return e}function to(){let e=P.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}function no(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function Le(e,...t){for(let n of t){let r=no(e[n]);if(r)return r}}function Me(e){if(Le(e,"run_id","runId","session_id","sessionId","thread_id","threadId"))return"session";if(Le(e,"user_id","userId"))return"user";if(Le(e,"agent_id","agentId"))return"agent";if(Le(e,"org_id","orgId","namespace"))return"org"}var ro=[{framework:"mem0",matches:e=>/^(mem0[_-])?(add|search|get|retrieve|update|delete)[_-]memor(y|ies)$/i.test(e),extract:(e,t)=>{let n=/^(?:mem0[_-])?([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"||n==="update"?r="write":r="read";let o=Me(t);return{op:r,store:"mem0",framework:"mem0",...o?{scope:o}:{}}}},{framework:"letta",matches:e=>/^(core_memory_(append|replace)|archival_memory_(insert|search)|conversation_search)$/i.test(e),extract:e=>{let t=e.toLowerCase();return t.startsWith("core_memory_")?{op:"write",store:"letta-core",scope:"agent",framework:"letta"}:t==="archival_memory_insert"?{op:"write",store:"letta-archival",scope:"agent",framework:"letta"}:t==="archival_memory_search"?{op:"search",store:"letta-archival",scope:"agent",framework:"letta"}:{op:"search",store:"letta-conversation",scope:"session",framework:"letta"}}},{framework:"langgraph",matches:e=>/^(upsert_memory|save_recall_memory|search_recall_memories)$/i.test(e),extract:(e,t)=>{let n=/^search_/i.test(e),r=Me(t);return{op:n?"search":"write",store:"langgraph-store",framework:"langgraph",...r?{scope:r}:{}}}},{framework:"zep",matches:e=>/^zep[_-](add|search|get|delete)[_-]memory$/i.test(e),extract:(e,t)=>{let n=/^zep[_-]([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"?r="write":r="read";let o=Me(t)??"session";return{op:r,store:"zep",scope:o,framework:"zep"}}},{framework:"mcp-memory",matches:e=>/^(create_entities|create_relations|add_observations|delete_entities|delete_relations|delete_observations|search_nodes|open_nodes|read_graph)$/i.test(e),extract:e=>{let t=e.toLowerCase(),n;return t.startsWith("delete_")?n="delete":t==="search_nodes"?n="search":t==="open_nodes"||t==="read_graph"?n="read":n="write",{op:n,store:"mcp-memory",scope:"agent",framework:"mcp-memory"}}},{framework:"generic",matches:e=>/(^|[_\-.])(memory|memories|mem0|recall)([_\-.]|$)/i.test(e),extract:(e,t)=>{let n=e.toLowerCase(),r;/(^|[_\-.])(search|query|find|lookup|retrieve)([_\-.]|$)/.test(n)?r="search":/(^|[_\-.])(delete|remove|forget|clear|purge)([_\-.]|$)/.test(n)?r="delete":/(^|[_\-.])(add|save|write|store|upsert|put|set|update|insert|append|remember)([_\-.]|$)/.test(n)?r="write":r="read";let o=Me(t);return{op:r,store:"memory",framework:"generic",...o?{scope:o}:{}}}}];function de(e,t){if(!e)return null;let n=t??{};for(let r of ro)try{if(r.matches(e)){let o=r.extract(e,n);if(o)return o}}catch{}return null}function at(e,t){let n=typeof t?.itemCount=="number"&&Number.isFinite(t.itemCount)&&t.itemCount>=0?Math.round(t.itemCount):void 0,r=typeof t?.bytes=="number"&&Number.isFinite(t.bytes)&&t.bytes>=0?Math.round(t.bytes):void 0,o=e.op==="read"||e.op==="search";return{op:e.op,store:e.store,...e.scope?{scope:e.scope}:{},...n!==void 0?{itemCount:n}:{},...r!==void 0?{bytes:r}:{},...o&&n!==void 0?{hit:n>0}:{}}}var Dt=new Map;function fe(e){let t=(Dt.get(e)??0)+1;return Dt.set(e,t),t}function Bt(e){if(!e||typeof e!="object")return;let t={};for(let n of["tokensIn","tokensOut","cacheRead","cacheWrite"]){let r=e[n];typeof r=="number"&&Number.isFinite(r)&&r>=0&&(t[n]=Math.round(r))}return Object.keys(t).length>0?t:void 0}function st(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,o=Array.isArray(n.texts)?n.texts.filter(a=>typeof a=="string"&&a.length>0).join(`
 
-`):"",i=Ut(n.usage);e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:n.final?"speech":"thought",visibility:"shown",provenance:"narration",...o?{content:{text:o}}:{},...i?{cost:i}:{},...n.model?{model:n.model}:{},...typeof n.durationMs=="number"&&Number.isFinite(n.durationMs)?{durationMs:Math.max(0,Math.round(n.durationMs))}:{},...t.framework?{framework:t.framework}:{}})}function me(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:"spawn",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},spawn:{childAgentId:n.childAgentId,childName:n.childName,kind:n.kind,...n.model?{model:n.model}:{},...n.task?{prompt:n.task}:{}}})}function ge(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,o=n.memory?at(n.memory):void 0;e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:o?"memory":"action",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName,...n.verb?{verb:n.verb}:{},...n.argSummary?{argSummary:n.argSummary}:{}},...o?{memory:o}:{}})}function he(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,o=c=>typeof c=="number"&&Number.isFinite(c)&&c>=0?Math.round(c):void 0,i=o(n.bytes),a=o(n.itemCount),s=o(n.durationMs),l;n.memory&&(l=at(n.memory,{itemCount:a,bytes:i})),e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:"observation",visibility:"shown",provenance:"parsed",...s!==void 0?{durationMs:s}:{},...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},result:{ok:n.ok,...i!==void 0?{bytes:i}:{},...a!==void 0?{itemCount:a}:{}},...l?{memory:l}:{}})}function ee(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:"intervention",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},governance:{decision:n.decision,enforced:n.enforced,...n.ruleCode?{ruleCode:n.ruleCode}:{},...n.ruleLabel?{ruleLabel:n.ruleLabel}:{},...n.harnessMessage?{harnessMessage:n.harnessMessage}:{}}})}function W(e){try{let t=JSON.stringify(e);return typeof t=="string"?t.length:void 0}catch{return}}function Q(e){try{return Array.isArray(e)?e.length:void 0}catch{return}}import{z as h}from"zod";import{createHash as oo}from"crypto";import{createHash as Ro}from"crypto";var Bt=new Map;function qt(e){return e.map(t=>t.trim()).filter(t=>t.length>0&&t!=="true")}function lt(e){let t=oo("sha256").update(e).digest("hex"),n=Bt.get(t);if(n)return n;let r=new Map,o=[],i=e.split(`
-`).map(l=>io(l)).filter(l=>l.trim().length>0),a=0;for(;a<i.length;){let l=i[a].trim();if(l.startsWith("package ")||l.startsWith("import ")){a++;continue}let c=l.match(/^default\s+(\w+)\s*:?=\s*(.+)$/);if(c){let f=c[1],_=c[2].trim();r.set(f,ye(_)),a++;continue}let u=l.match(/^(\w+)\s*:?=\s*(.+?)(?:\s+if)?\s*\{(.*)$/);if(u){let f=u[1],_=u[2].trim(),g=u[3].trim(),p=[];if(g&&g!=="}"){let C=g.endsWith("}")?g.slice(0,-1).trim():g;C&&p.push(C),g.endsWith("}")||(a++,a=$e(i,a,p))}else g==="}"||(a++,a=$e(i,a,p));let y=Vt(p);o.push({variable:f,value:ye(_),conditions:y,rawConditions:qt(p)}),a++;continue}let d=l.match(/^(\w+)(?:\s+if)?\s*\{(.*)$/);if(d){let f=d[1],_=d[2].trim(),g=[];if(_&&_!=="}"){let y=_.endsWith("}")?_.slice(0,-1).trim():_;y&&g.push(y),_.endsWith("}")||(a++,a=$e(i,a,g))}else _==="}"||(a++,a=$e(i,a,g));let p=Vt(g);o.push({variable:f,value:"true",conditions:p,rawConditions:qt(g)}),a++;continue}a++}let s={defaults:r,rules:o};return Bt.set(t,s),s}function io(e){let t=!1,n="";for(let r=0;r<e.length;r++){let o=e[r];if(t)o===n&&e[r-1]!=="\\"&&(t=!1);else if(o==='"'||o==="'")t=!0,n=o;else if(o==="#")return e.slice(0,r)}return e}function $e(e,t,n){let r=1,o=t;for(;o<e.length&&r>0;){let i=e[o].trim();for(let a of i)a==="{"&&r++,a==="}"&&r--;if(r>0)n.push(i),o++;else{let a=i.slice(0,i.lastIndexOf("}")).trim();return a&&n.push(a),o}}return o}function ye(e){return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function ao(e){return e.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}function Vt(e){let t=[];for(let n of e){let r=n.split(";").map(o=>o.trim()).filter(o=>o.length>0);for(let o of r){let i=so(o);i&&t.push(i)}}return t}function so(e){let t=!1,n=e.trim();if(n.startsWith("not ")&&(t=!0,n=n.slice(4).trim()),n==="true"||n==="false")return{type:"literal_bool",negated:t,field:"",value:n==="true"};if(n.includes("[_]"))return{type:"truthy",negated:!1,field:Pe,value:e.trim()};let r=n.match(/^count\(([^)]+)\)\s*(>=|<=|>|<)\s*(\d+)$/);if(r)return{type:"count_gt",negated:t,field:r[1].trim(),operator:r[2],value:parseInt(r[3],10)};let o=n.match(/^startswith\(([^,]+),\s*"([^"]*)"\)$/);if(o)return{type:"startswith",negated:t,field:o[1].trim(),value:o[2]};let i=n.match(/^endswith\(([^,]+),\s*"([^"]*)"\)$/);if(i)return{type:"endswith",negated:t,field:i[1].trim(),value:i[2]};let a=n.match(/^contains\(([^,]+),\s*"([^"]*)"\)$/);if(a)return{type:"contains",negated:t,field:a[1].trim(),value:a[2]};let s=n.match(/^regex\.match\(\s*("(?:[^"\\]|\\.)*")\s*,\s*((?:input|data)[^\s)]*)\s*\)$/);if(s)return{type:"regex_match",negated:t,field:s[2].trim(),value:ao(s[1])};let l=n.match(/^("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false)\s+in\s+((?:input|data)[^\s]*)$/);if(l)return{type:"array_includes",negated:t,field:l[2].trim(),value:Jt(l[1])};let c=n.match(/^([^\s]+)\s+in\s+(\[.*\])$/);if(c){let p=uo(c[2]);if(p!==null)return{type:"in_set",negated:t,field:c[1].trim(),values:p}}let u=n.match(/^([^\s=!<>]+)\s*(>=|<=|>|<)\s*(-?\d+(?:\.\d+)?)$/);if(u)return{type:"comparison",negated:t,field:u[1].trim(),operator:u[2],value:parseFloat(u[3])};let d=n.match(/^("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false)\s*==\s*((?:input|data)\S*)$/);if(d)return{type:"equality",negated:t,field:d[2].trim(),value:ye(d[1].trim())};let f=n.match(/^([^\s=!]+)\s*==\s*(.+)$/);if(f)return{type:"equality",negated:t,field:f[1].trim(),value:ye(f[2].trim())};let _=n.match(/^([^\s=!]+)\s*!=\s*(.+)$/);if(_)return{type:"inequality",negated:t,field:_[1].trim(),value:ye(_[2].trim())};let g=n.match(/^(input(?:\.[a-zA-Z0-9_]+|\["[^"]+"\]|\['[^']+'\])+)$/);return g?{type:"truthy",negated:t,field:g[1].trim()}:{type:"truthy",negated:!1,field:Pe,value:e.trim()}}var Pe="__unrecognized_condition_forces_deny__";var lo=/[A-Za-z_][A-Za-z0-9_.]*\s*\(/;function Qt(e){let t=[];for(let n of e.rules)for(let r of n.conditions)typeof r.field=="string"&&r.field!==Pe&&lo.test(r.field)&&t.push(r.field);return t}var co=["input.normalized.","input.normalized["];function Yt(e){let t=new Set;for(let n of e.rules)for(let r of n.conditions){let{field:o}=r;typeof o!="string"||o===Pe||co.some(i=>o.startsWith(i))&&t.add(o)}return[...t].sort()}function Jt(e){let t=e.trim();return t==="true"?!0:t==="false"?!1:/^-?\d+(?:\.\d+)?$/.test(t)?parseFloat(t):t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'")?t.slice(1,-1):t}function uo(e){let t=e.trim().replace(/^\[/,"").replace(/\]$/,"").trim();if(t.length===0)return[];let n=[],r="",o=!1,i="";for(let s=0;s<t.length;s++){let l=t[s];o?(r+=l,l===i&&t[s-1]!=="\\"&&(o=!1)):l==='"'||l==="'"?(r+=l,o=!0,i=l):l===","?(n.push(r.trim()),r=""):r+=l}if(o)return null;r.trim().length>0&&n.push(r.trim());let a=[];for(let s of n){let l=s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2,c=/^-?\d+(?:\.\d+)?$/.test(s);if(!l&&!c&&!(s==="true"||s==="false"))return null;a.push(Jt(s))}return a}var po=["tier1","tier2","tier3"];function Zt(e){return typeof e=="string"&&po.includes(e)}var fo=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],mo=["internal","customer_facing","experimental","third_party"],Xt=[...fo,...mo];function go(e){return typeof e=="string"&&Xt.includes(e)}function en(e){let t=new Set;for(let n of e)go(n)&&t.add(n);return Xt.filter(n=>t.has(n))}var tn=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"],ho=["version_control","payments","crm","communication","cloud_infra","identity","data_warehouse","ticketing","hr","finance_erp","storage","database","other"],_o=["production","staging","development","test"],yo=["security","engineering","finance","legal","compliance","hr","sales","marketing","support","operations","executive"];function bo(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var zt={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function vo(e){let t=bo(e);return t===null?"other":zt[t]??zt[t.replace(/_/g,"")]??"other"}function nn(e,t){let n={...e};if(t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=vo(t.targetApp)),n.context=r}return n}var Kt=["pii","phi","pci","financial","biometric","genetic","location","communications","children","credentials","special_category_gdpr"],Gt=["none","low","medium","high","critical"],wo=["public","internal","confidential","restricted","credentials","api_key","private_key","password","secret","token","pan","full_pan","card_number","track_data","cvv","cvc","ssn","tax_id","national_id","passport","drivers_license","identity_document","document_number","kyc_document","bank_account","account_number","routing_number","iban","account_balance","customer_financial","credit_score","net_worth","income","financial_profile","employee_pii","payroll","compensation","material_nonpublic","pre_release_earnings","mnpi","attorney_client","legal_hold","privileged","special_category_gdpr","gdpr_special_category","biometric","ethnicity","political_opinion","health_special","religion"],ko={action_class:tn,"context/app_category":ho,"context/environment":_o,"context/actor_function":yo,"read/classification":wo,"read/data_categories":Kt,"read/data_sensitivity":Gt,"write/data_categories":Kt,"write/data_sensitivity":Gt};function rn(e){if(e===null||typeof e!="object")return[];let t=e,n=new Set,r=(o,i,a)=>{let s=Array.isArray(i)?i:[i];for(let l of s)typeof l!="string"||l.length===0||a.includes(l)||n.add(`${o}=${l}`)};for(let[o,i]of Object.entries(ko)){Object.prototype.hasOwnProperty.call(t,o)&&r(o,t[o],i);let a=o.indexOf("/");if(a===-1)continue;let s=t[o.slice(0,a)];if(s!==null&&typeof s=="object"&&!Array.isArray(s)){let l=o.slice(a+1),c=s;Object.prototype.hasOwnProperty.call(c,l)&&r(o,c[l],i)}}return[...n].sort()}var Ht=64,Ao=64,be={retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function on(){return{retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var Io=new Set(["deny","approval_required","escalate"]);function _e(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let o of t)n.add(o);let r=[...n].sort();return r.length>Ht?r.slice(0,Ht):r}function Wt(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function Fe(e){return typeof e=="string"&&e.length>0?e:null}function an(e,t){let n=Wt(t.data_categories),r=Fe(t.classification),o=Wt(t.taint),i=Fe(t.action_class),a=i&&tn.includes(i)?i:null,s=Fe(t.target_app),l=Fe(t.decision),c={...e.action_counts};if(a)if(a in c)c[a]=(c[a]??0)+1;else if(Object.keys(c).length<Ao)c[a]=1;else{let u=Object.keys(c).sort(),d=u[u.length-1];d!==void 0&&a<d&&(delete c[d],c[a]=1)}return{retrieved_data_categories:_e(e.retrieved_data_categories,n),retrieved_classifications:_e(e.retrieved_classifications,r?[r]:[]),taint:_e(e.taint,o),action_classes:_e(e.action_classes,a?[a]:[]),action_counts:c,denied_count:e.denied_count+(l==="deny"?1:0),inhibited_count:e.inhibited_count+(l&&Io.has(l)?1:0),event_count:e.event_count+1,target_apps:_e(e.target_apps,s?[s]:[])}}var sn="generic",ln=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:sn,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],So=ln.map(e=>e.id),Os=new Map(ln.map(e=>[e.id,e])),Ns=new Set(So);function cn(e){return Array.isArray(e)&&e.length>0?[...e]:[sn]}var To=/^[a-z][a-z0-9_]*$/;function un(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&To.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var Eo=["narrow","moderate","broad","unbounded","unknown"];function dn(e){return typeof e=="string"&&Eo.includes(e)}function pn(e){return e==="open"||e==="closed"?e:null}var Co=["tool_name","function","name","action"];function je(e,t,n){if(Array.isArray(e)){if(e.length===0){n.push([`${t}[]`,void 0]);return}for(let r of e)je(r,`${t}[]`,n);return}if(e!==null&&typeof e=="object"){let r=Object.entries(e);if(r.length===0){t&&n.push([t,void 0]);return}for(let[o,i]of r)je(i,t?`${t}.${o}`:o,n);return}t&&n.push([t,e])}function xo(e){let t=[];return je(e,"",t),[...new Set(t.map(([n])=>n))].sort()}function Oo(e){let t=e.slice(e.lastIndexOf(".")+1);return t.endsWith("[]")?t.slice(0,-2):t}function No(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().toLowerCase();return t.length>0?t:null}function Mo(e,t={}){if(t.discriminatorField===null)return null;let n=[];je(e,"",n);let r=t.discriminatorField?[t.discriminatorField]:t.discriminatorFields??Co;for(let o of r){let i=null;for(let[a,s]of n){if(Oo(a)!==o)continue;let l=No(s);l!==null&&(i===null||a<i.path)&&(i={path:a,value:l})}if(i)return i.value}return null}function fn(e,t={}){let n=Ro("sha256").update(xo(e).join(",")).digest("hex").slice(0,16),r=Mo(e,t);return r!==null?`${n}:${r}`:n}var Lo=["action","retrieval","delegation"];function Do(e){return typeof e=="string"&&Lo.includes(e)}var $o=new Set(["rules"]);function mn(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!$o.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(Do):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}import{z as Ve}from"zod";var In="[REDACTED]",Sn=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}];function Tn(e){if(!/^\d+$/.test(e))return!1;let t=0,n=!1;for(let r=e.length-1;r>=0;r--){let o=e.charCodeAt(r)-48;n&&(o*=2,o>9&&(o-=9)),t+=o,n=!n}return t%10===0}function Fo(e){let t=e.replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let o=0;o<n.length;o++){let i=n[o],a=i>="A"&&i<="Z"?String(i.charCodeAt(0)-55):i;for(let s=0;s<a.length;s++)r=(r*10+(a.charCodeAt(s)-48))%97}return r===1}function Po(e){if(!/^\d{9}$/.test(e))return!1;let t=[3,7,1,3,7,1,3,7,1],n=0;for(let r=0;r<9;r++)n+=(e.charCodeAt(r)-48)*t[r];return n%10===0}var jo=[{name:"pan",re:/\d(?:[ -]?\d){12,18}/g,normalize:e=>e.replace(/[ -]/g,""),validate:e=>e.length>=13&&e.length<=19&&Tn(e)},{name:"iban",re:/\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){10,30}\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:Fo},{name:"aba_routing",re:/\b\d{9}\b/g,normalize:e=>e,validate:Po}],x=Object.fromEntries(Sn.map(e=>[e.name,e.re.source])),En=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","email","us_phone","ipv4","mac_address"],Be={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
+`):"",i=Bt(n.usage);e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:n.final?"speech":"thought",visibility:"shown",provenance:"narration",...o?{content:{text:o}}:{},...i?{cost:i}:{},...n.model?{model:n.model}:{},...typeof n.durationMs=="number"&&Number.isFinite(n.durationMs)?{durationMs:Math.max(0,Math.round(n.durationMs))}:{},...t.framework?{framework:t.framework}:{}})}function me(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:"spawn",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},spawn:{childAgentId:n.childAgentId,childName:n.childName,kind:n.kind,...n.model?{model:n.model}:{},...n.task?{prompt:n.task}:{}}})}function ge(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,o=n.memory?at(n.memory):void 0;e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:o?"memory":"action",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName,...n.verb?{verb:n.verb}:{},...n.argSummary?{argSummary:n.argSummary}:{}},...o?{memory:o}:{}})}function he(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,o=c=>typeof c=="number"&&Number.isFinite(c)&&c>=0?Math.round(c):void 0,i=o(n.bytes),a=o(n.itemCount),s=o(n.durationMs),l;n.memory&&(l=at(n.memory,{itemCount:a,bytes:i})),e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:"observation",visibility:"shown",provenance:"parsed",...s!==void 0?{durationMs:s}:{},...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},result:{ok:n.ok,...i!==void 0?{bytes:i}:{},...a!==void 0?{itemCount:a}:{}},...l?{memory:l}:{}})}function ee(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:pe(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:fe(r),ts:Date.now(),kind:"intervention",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},governance:{decision:n.decision,enforced:n.enforced,...n.ruleCode?{ruleCode:n.ruleCode}:{},...n.ruleLabel?{ruleLabel:n.ruleLabel}:{},...n.harnessMessage?{harnessMessage:n.harnessMessage}:{}}})}function W(e){try{let t=JSON.stringify(e);return typeof t=="string"?t.length:void 0}catch{return}}function Q(e){try{return Array.isArray(e)?e.length:void 0}catch{return}}import{z as h}from"zod";import{createHash as oo}from"crypto";import{createHash as Ro}from"crypto";var qt=new Map;function Vt(e){return e.map(t=>t.trim()).filter(t=>t.length>0&&t!=="true")}function lt(e){let t=oo("sha256").update(e).digest("hex"),n=qt.get(t);if(n)return n;let r=new Map,o=[],i=e.split(`
+`).map(l=>io(l)).filter(l=>l.trim().length>0),a=0;for(;a<i.length;){let l=i[a].trim();if(l.startsWith("package ")||l.startsWith("import ")){a++;continue}let c=l.match(/^default\s+(\w+)\s*:?=\s*(.+)$/);if(c){let _=c[1],f=c[2].trim();r.set(_,ye(f)),a++;continue}let u=l.match(/^(\w+)\s*:?=\s*(.+?)(?:\s+if)?\s*\{(.*)$/);if(u){let _=u[1],f=u[2].trim(),g=u[3].trim(),p=[];if(g&&g!=="}"){let x=g.endsWith("}")?g.slice(0,-1).trim():g;x&&p.push(x),g.endsWith("}")||(a++,a=Fe(i,a,p))}else g==="}"||(a++,a=Fe(i,a,p));let y=zt(p);o.push({variable:_,value:ye(f),conditions:y,rawConditions:Vt(p)}),a++;continue}let d=l.match(/^(\w+)(?:\s+if)?\s*\{(.*)$/);if(d){let _=d[1],f=d[2].trim(),g=[];if(f&&f!=="}"){let y=f.endsWith("}")?f.slice(0,-1).trim():f;y&&g.push(y),f.endsWith("}")||(a++,a=Fe(i,a,g))}else f==="}"||(a++,a=Fe(i,a,g));let p=zt(g);o.push({variable:_,value:"true",conditions:p,rawConditions:Vt(g)}),a++;continue}a++}let s={defaults:r,rules:o};return qt.set(t,s),s}function io(e){let t=!1,n="";for(let r=0;r<e.length;r++){let o=e[r];if(t)o===n&&e[r-1]!=="\\"&&(t=!1);else if(o==='"'||o==="'")t=!0,n=o;else if(o==="#")return e.slice(0,r)}return e}function Fe(e,t,n){let r=1,o=t;for(;o<e.length&&r>0;){let i=e[o].trim();for(let a of i)a==="{"&&r++,a==="}"&&r--;if(r>0)n.push(i),o++;else{let a=i.slice(0,i.lastIndexOf("}")).trim();return a&&n.push(a),o}}return o}function ye(e){return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function ao(e){return e.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}function zt(e){let t=[];for(let n of e){let r=n.split(";").map(o=>o.trim()).filter(o=>o.length>0);for(let o of r){let i=so(o);i&&t.push(i)}}return t}function so(e){let t=!1,n=e.trim();if(n.startsWith("not ")&&(t=!0,n=n.slice(4).trim()),n==="true"||n==="false")return{type:"literal_bool",negated:t,field:"",value:n==="true"};if(n.includes("[_]"))return{type:"truthy",negated:!1,field:Pe,value:e.trim()};let r=n.match(/^count\(([^)]+)\)\s*(>=|<=|>|<)\s*(\d+)$/);if(r)return{type:"count_gt",negated:t,field:r[1].trim(),operator:r[2],value:parseInt(r[3],10)};let o=n.match(/^startswith\(([^,]+),\s*"([^"]*)"\)$/);if(o)return{type:"startswith",negated:t,field:o[1].trim(),value:o[2]};let i=n.match(/^endswith\(([^,]+),\s*"([^"]*)"\)$/);if(i)return{type:"endswith",negated:t,field:i[1].trim(),value:i[2]};let a=n.match(/^contains\(([^,]+),\s*"([^"]*)"\)$/);if(a)return{type:"contains",negated:t,field:a[1].trim(),value:a[2]};let s=n.match(/^regex\.match\(\s*("(?:[^"\\]|\\.)*")\s*,\s*((?:input|data)[^\s)]*)\s*\)$/);if(s)return{type:"regex_match",negated:t,field:s[2].trim(),value:ao(s[1])};let l=n.match(/^("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false)\s+in\s+((?:input|data)[^\s]*)$/);if(l)return{type:"array_includes",negated:t,field:l[2].trim(),value:Jt(l[1])};let c=n.match(/^([^\s]+)\s+in\s+(\[.*\])$/);if(c){let p=uo(c[2]);if(p!==null)return{type:"in_set",negated:t,field:c[1].trim(),values:p}}let u=n.match(/^([^\s=!<>]+)\s*(>=|<=|>|<)\s*(-?\d+(?:\.\d+)?)$/);if(u)return{type:"comparison",negated:t,field:u[1].trim(),operator:u[2],value:parseFloat(u[3])};let d=n.match(/^("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false)\s*==\s*((?:input|data)\S*)$/);if(d)return{type:"equality",negated:t,field:d[2].trim(),value:ye(d[1].trim())};let _=n.match(/^([^\s=!]+)\s*==\s*(.+)$/);if(_)return{type:"equality",negated:t,field:_[1].trim(),value:ye(_[2].trim())};let f=n.match(/^([^\s=!]+)\s*!=\s*(.+)$/);if(f)return{type:"inequality",negated:t,field:f[1].trim(),value:ye(f[2].trim())};let g=n.match(/^(input(?:\.[a-zA-Z0-9_]+|\["[^"]+"\]|\['[^']+'\])+)$/);return g?{type:"truthy",negated:t,field:g[1].trim()}:{type:"truthy",negated:!1,field:Pe,value:e.trim()}}var Pe="__unrecognized_condition_forces_deny__";var lo=/[A-Za-z_][A-Za-z0-9_.]*\s*\(/;function Yt(e){let t=[];for(let n of e.rules)for(let r of n.conditions)typeof r.field=="string"&&r.field!==Pe&&lo.test(r.field)&&t.push(r.field);return t}var co=["input.normalized.","input.normalized["];function Zt(e){let t=new Set;for(let n of e.rules)for(let r of n.conditions){let{field:o}=r;typeof o!="string"||o===Pe||co.some(i=>o.startsWith(i))&&t.add(o)}return[...t].sort()}function Jt(e){let t=e.trim();return t==="true"?!0:t==="false"?!1:/^-?\d+(?:\.\d+)?$/.test(t)?parseFloat(t):t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'")?t.slice(1,-1):t}function uo(e){let t=e.trim().replace(/^\[/,"").replace(/\]$/,"").trim();if(t.length===0)return[];let n=[],r="",o=!1,i="";for(let s=0;s<t.length;s++){let l=t[s];o?(r+=l,l===i&&t[s-1]!=="\\"&&(o=!1)):l==='"'||l==="'"?(r+=l,o=!0,i=l):l===","?(n.push(r.trim()),r=""):r+=l}if(o)return null;r.trim().length>0&&n.push(r.trim());let a=[];for(let s of n){let l=s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2,c=/^-?\d+(?:\.\d+)?$/.test(s);if(!l&&!c&&!(s==="true"||s==="false"))return null;a.push(Jt(s))}return a}var po=["tier1","tier2","tier3"];function Xt(e){return typeof e=="string"&&po.includes(e)}var fo=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],mo=["internal","customer_facing","experimental","third_party"],en=[...fo,...mo];function go(e){return typeof e=="string"&&en.includes(e)}function tn(e){let t=new Set;for(let n of e)go(n)&&t.add(n);return en.filter(n=>t.has(n))}var nn=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"],ho=["version_control","payments","crm","communication","cloud_infra","identity","data_warehouse","ticketing","hr","finance_erp","storage","database","other"],_o=["production","staging","development","test"],yo=["security","engineering","finance","legal","compliance","hr","sales","marketing","support","operations","executive"];function bo(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var Kt={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function vo(e){let t=bo(e);return t===null?"other":Kt[t]??Kt[t.replace(/_/g,"")]??"other"}function rn(e,t){let n={...e};if(t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=vo(t.targetApp)),n.context=r}return n}var Gt=["pii","phi","pci","financial","biometric","genetic","location","communications","children","credentials","special_category_gdpr"],Ht=["none","low","medium","high","critical"],wo=["public","internal","confidential","restricted","credentials","api_key","private_key","password","secret","token","pan","full_pan","card_number","track_data","cvv","cvc","ssn","tax_id","national_id","passport","drivers_license","identity_document","document_number","kyc_document","bank_account","account_number","routing_number","iban","account_balance","customer_financial","credit_score","net_worth","income","financial_profile","employee_pii","payroll","compensation","material_nonpublic","pre_release_earnings","mnpi","attorney_client","legal_hold","privileged","special_category_gdpr","gdpr_special_category","biometric","ethnicity","political_opinion","health_special","religion"],ko={action_class:nn,"context/app_category":ho,"context/environment":_o,"context/actor_function":yo,"read/classification":wo,"read/data_categories":Gt,"read/data_sensitivity":Ht,"write/data_categories":Gt,"write/data_sensitivity":Ht};function on(e){if(e===null||typeof e!="object")return[];let t=e,n=new Set,r=(o,i,a)=>{let s=Array.isArray(i)?i:[i];for(let l of s)typeof l!="string"||l.length===0||a.includes(l)||n.add(`${o}=${l}`)};for(let[o,i]of Object.entries(ko)){Object.prototype.hasOwnProperty.call(t,o)&&r(o,t[o],i);let a=o.indexOf("/");if(a===-1)continue;let s=t[o.slice(0,a)];if(s!==null&&typeof s=="object"&&!Array.isArray(s)){let l=o.slice(a+1),c=s;Object.prototype.hasOwnProperty.call(c,l)&&r(o,c[l],i)}}return[...n].sort()}var Wt=64,Ao=64,be={retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function an(){return{retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var Io=new Set(["deny","approval_required","escalate"]);function _e(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let o of t)n.add(o);let r=[...n].sort();return r.length>Wt?r.slice(0,Wt):r}function Qt(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function $e(e){return typeof e=="string"&&e.length>0?e:null}function sn(e,t){let n=Qt(t.data_categories),r=$e(t.classification),o=Qt(t.taint),i=$e(t.action_class),a=i&&nn.includes(i)?i:null,s=$e(t.target_app),l=$e(t.decision),c={...e.action_counts};if(a)if(a in c)c[a]=(c[a]??0)+1;else if(Object.keys(c).length<Ao)c[a]=1;else{let u=Object.keys(c).sort(),d=u[u.length-1];d!==void 0&&a<d&&(delete c[d],c[a]=1)}return{retrieved_data_categories:_e(e.retrieved_data_categories,n),retrieved_classifications:_e(e.retrieved_classifications,r?[r]:[]),taint:_e(e.taint,o),action_classes:_e(e.action_classes,a?[a]:[]),action_counts:c,denied_count:e.denied_count+(l==="deny"?1:0),inhibited_count:e.inhibited_count+(l&&Io.has(l)?1:0),event_count:e.event_count+1,target_apps:_e(e.target_apps,s?[s]:[])}}var ln="generic",cn=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:ln,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],So=cn.map(e=>e.id),zs=new Map(cn.map(e=>[e.id,e])),Ks=new Set(So);function un(e){return Array.isArray(e)&&e.length>0?[...e]:[ln]}var To=/^[a-z][a-z0-9_]*$/;function dn(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&To.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var Eo=["narrow","moderate","broad","unbounded","unknown"];function pn(e){return typeof e=="string"&&Eo.includes(e)}function fn(e){return e==="open"||e==="closed"?e:null}var Co=["tool_name","function","name","action"];function je(e,t,n){if(Array.isArray(e)){if(e.length===0){n.push([`${t}[]`,void 0]);return}for(let r of e)je(r,`${t}[]`,n);return}if(e!==null&&typeof e=="object"){let r=Object.entries(e);if(r.length===0){t&&n.push([t,void 0]);return}for(let[o,i]of r)je(i,t?`${t}.${o}`:o,n);return}t&&n.push([t,e])}function xo(e){let t=[];return je(e,"",t),[...new Set(t.map(([n])=>n))].sort()}function Oo(e){let t=e.slice(e.lastIndexOf(".")+1);return t.endsWith("[]")?t.slice(0,-2):t}function No(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().toLowerCase();return t.length>0?t:null}function Lo(e,t={}){if(t.discriminatorField===null)return null;let n=[];je(e,"",n);let r=t.discriminatorField?[t.discriminatorField]:t.discriminatorFields??Co;for(let o of r){let i=null;for(let[a,s]of n){if(Oo(a)!==o)continue;let l=No(s);l!==null&&(i===null||a<i.path)&&(i={path:a,value:l})}if(i)return i.value}return null}function mn(e,t={}){let n=Ro("sha256").update(xo(e).join(",")).digest("hex").slice(0,16),r=Lo(e,t);return r!==null?`${n}:${r}`:n}var Mo=["action","retrieval","delegation"];function Do(e){return typeof e=="string"&&Mo.includes(e)}var Fo=new Set(["rules"]);function gn(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!Fo.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(Do):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}import{z as Ve}from"zod";var Sn="[REDACTED]",Tn=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"in_pan_tax",re:/\b[A-Z]{3}[ABCFGHJLPTE][A-Z]\d{4}[A-Z]\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"date_of_birth",re:/\b(?:\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])|(?:0[1-9]|[12]\d|3[01])[/.](?:0[1-9]|1[0-2])[/.]\d{4}|(?:0[1-9]|1[0-2])\/(?:0[1-9]|[12]\d|3[01])\/\d{4})\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}];function ut(e){if(!/^\d+$/.test(e))return!1;let t=0,n=!1;for(let r=e.length-1;r>=0;r--){let o=e.charCodeAt(r)-48;n&&(o*=2,o>9&&(o-=9)),t+=o,n=!n}return t%10===0}function $o(e){let t=e.replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let o=0;o<n.length;o++){let i=n[o],a=i>="A"&&i<="Z"?String(i.charCodeAt(0)-55):i;for(let s=0;s<a.length;s++)r=(r*10+(a.charCodeAt(s)-48))%97}return r===1}function Po(e){if(!/^\d{9}$/.test(e))return!1;let t=[3,7,1,3,7,1,3,7,1],n=0;for(let r=0;r<9;r++)n+=(e.charCodeAt(r)-48)*t[r];return n%10===0}var jo=[[0,1,2,3,4,5,6,7,8,9],[1,2,3,4,0,6,7,8,9,5],[2,3,4,0,1,7,8,9,5,6],[3,4,0,1,2,8,9,5,6,7],[4,0,1,2,3,9,5,6,7,8],[5,9,8,7,6,0,4,3,2,1],[6,5,9,8,7,1,0,4,3,2],[7,6,5,9,8,2,1,0,4,3],[8,7,6,5,9,3,2,1,0,4],[9,8,7,6,5,4,3,2,1,0]],Uo=[[0,1,2,3,4,5,6,7,8,9],[1,5,7,6,2,8,3,0,9,4],[5,8,0,3,7,9,6,1,4,2],[8,9,1,6,0,4,3,5,2,7],[9,4,5,3,1,2,6,8,7,0],[4,2,8,6,5,7,3,9,0,1],[2,7,9,3,8,0,6,4,1,5],[7,0,4,6,9,1,3,2,5,8]];function Bo(e){if(!/^\d+$/.test(e))return!1;let t=0,n=e.split("").reverse();for(let r=0;r<n.length;r++)t=jo[t][Uo[r%8][n[r].charCodeAt(0)-48]];return t===0}function qo(e){if(!/^\d{11}$/.test(e)||/^(\d)\1{10}$/.test(e))return!1;let t=n=>{let r=0;for(let i=0;i<n;i++)r+=(e.charCodeAt(i)-48)*(n+1-i);let o=r*10%11;return o===10?0:o};return t(9)===e.charCodeAt(9)-48&&t(10)===e.charCodeAt(10)-48}function Vo(e){if(!/^\d{10}$/.test(e))return!1;let t=0;for(let o=0;o<9;o++)t+=(e.charCodeAt(o)-48)*(10-o);let n=11-t%11,r=n===11?0:n;return r!==10&&r===e.charCodeAt(9)-48}var zo=[1,4,3,7,5,8,6,9,10];function Ko(e){if(!/^\d{8,9}$/.test(e))return!1;let t=0;for(let n=0;n<e.length;n++)t+=(e.charCodeAt(n)-48)*zo[n];return t%11===0}var Go="TRWAGMYFPDXBNJZSQVHLCKE";function Ho(e){let t=e.replace(/[\s-]/g,"").toUpperCase(),n=/^([XYZ]?)(\d{7,8})([A-Z])$/.exec(t);if(!n)return!1;let[,r,o,i]=n;if(r===""&&o.length!==8||r!==""&&o.length!==7)return!1;let a=r===""?o:String("XYZ".indexOf(r))+o;return Go[Number(a)%23]===i}var Wo=new Set(["BG","GB","NK","KN","TN","NT","ZZ"]);function Qo(e){let t=e.replace(/[\s-]/g,"").toUpperCase();return/^[ABCEGHJ-PRSTW-Z][ABCEGHJ-NPRSTW-Z]\d{6}[A-D]$/.test(t)?!Wo.has(t.slice(0,2)):!1}var Yo=[{name:"pan",re:/\d(?:[ -]?\d){12,18}/g,normalize:e=>e.replace(/[ -]/g,""),validate:e=>e.length>=13&&e.length<=19&&ut(e)},{name:"iban",re:/\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){10,30}\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:$o},{name:"aba_routing",re:/\b\d{9}\b/g,normalize:e=>e,validate:Po},{name:"uk_nino",re:/\b[A-Za-z]{2} ?\d{2} ?\d{2} ?\d{2} ?[A-Da-d]\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:(e,t)=>t!==void 0&&t===t.toLowerCase()?!1:Qo(e)},{name:"in_aadhaar",re:/\b[2-9]\d{3}[ -]?\d{4}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===12&&Bo(e)},{name:"br_cpf",re:/\b\d{3}\.?\d{3}\.?\d{3}-?\d{2}\b/g,normalize:e=>e.replace(/[.-]/g,""),validate:qo},{name:"es_dni_nie",re:/\b[XYZxyz]?\d{7,8}[ -]?[A-Za-z]\b/g,normalize:e=>e.replace(/[\s-]/g,"").toUpperCase(),validate:Ho},{name:"ca_sin",re:/\b\d{3}[ -]?\d{3}[ -]?\d{3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:e=>e.length===9&&ut(e)},{name:"uk_nhs_number",re:/\b\d{3}[ -]?\d{3}[ -]?\d{4}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Vo},{name:"au_tfn",re:/\b\d{3}[ -]?\d{3}[ -]?\d{2,3}\b/g,normalize:e=>e.replace(/[\s-]/g,""),validate:Ko}],R=Object.fromEntries(Tn.map(e=>[e.name,e.re.source])),En=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","uk_nino","in_aadhaar","in_pan_tax","br_cpf","es_dni_nie","ca_sin","uk_nhs_number","au_tfn","email","us_phone","date_of_birth","ipv4","mac_address"],Be={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
 MIIEv\u2026
------END PRIVATE KEY-----`,template:{pattern:x.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:x.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:x.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:x.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:x.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:x.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:x.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:x.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:x.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:x.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS).",category:"financial",example:"4242 4242 4242 4242",template:{pattern:"\\b\\d{13,19}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:"\\b[A-Z]{2}\\d{2}(?:[ ]?[A-Z0-9]){10,30}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:"\\b\\d{9}\\b",mode:"full"},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX).",category:"financial",example:"12-3456789",template:{pattern:x.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:x.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789).",category:"pii",example:"123-45-6789",template:{pattern:x.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept).",category:"pii",example:"alice@acme.com",template:{pattern:x.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:x.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:x.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:x.mac_address,mode:"full"},defaultEnabled:!1}},Ds=new Set(En.filter(e=>!Be[e].defaultEnabled));function Uo(e,t){let n=new Set;for(let r of En)(Be[r].defaultEnabled?!e?.has(r):t?.has(r))||n.add(r);return n}function Bo(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let o=e;for(let{name:i,re:a}of Sn){let s=i;n.has(s)||(o=o.replace(a,()=>(r?.(s),t)))}for(let{name:i,re:a,normalize:s,validate:l}of jo)n.has(i)||(o=o.replace(a,c=>l(s(c))?(r?.(i),t):c));return o}function dt(e,t=In,n,r){return qo(e,t,Uo(n,r))}function qo(e,t,n){let r=new Set,o=!n.has("pan"),i=s=>{r.add(s)},a=s=>{if(typeof s=="string")return Bo(s,t,n,i);if(typeof s=="number"&&Number.isInteger(s)&&s>0){if(!o)return s;let l=String(s);return l.length>=13&&l.length<=19&&Tn(l)?(r.add("pan"),t):s}if(Array.isArray(s))return s.map(l=>a(l));if(s!==null&&typeof s=="object"){let l=s,c={};for(let u of Object.keys(l))c[u]=a(l[u]);return c}return s};return{value:a(e),detectors:[...r].sort()}}function Rn(e,t=In){return dt(e,t).value}function Vo(e){let{value:t,detectors:n}=dt(e),r=n.some(o=>Be[o].category==="secret");return{detectors:n,blocked:r,redacted:t}}function zo(e,t){let{blocked:n,redacted:r,detectors:o}=Vo(e);return n?t.failMode==="closed"?{verdict:"block",redacted:r,detectors:o}:{verdict:"redact",redacted:r,detectors:o}:{verdict:"allow",redacted:r,detectors:o}}function Ko(e){if(typeof e!="string"||e.length===0)return e;let t=e.lastIndexOf("__");return t<0?e:e.slice(t+2)}var Go=new Set(["send","send_email","send_message","email","email_send","message","post","post_message","http_post","upload","export","export_data","share","publish","webhook"]);function Ho(e){return Go.has(Ko(e))}function ne(e,t,n){return n.enforced&&Ho(e)?zo(t,{failMode:n.failMode}):{verdict:"allow",redacted:t,detectors:[]}}var Wo=/[\u00AD\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFEFF]/g,Cn=Object.freeze({\u0430:"a",\u0435:"e",\u043E:"o",\u0440:"p",\u0441:"c",\u0443:"y",\u0445:"x",\u0456:"i",\u0455:"s",\u043A:"k",\u043C:"m",\u0442:"t",\u043D:"h",\u0432:"b",\u0433:"r",\u03BF:"o",\u03B1:"a",\u03C1:"p",\u03B9:"i",\u03C4:"t",\u03B5:"e",\u03BA:"k",\u03BD:"v",\u03C5:"u",\u03B7:"n",\u0131:"i","\u04CF":"l",\u0578:"n"}),Qo=new RegExp(`[${Object.keys(Cn).join("")}]`,"gu"),Yo=Object.freeze({4:"a","@":"a",3:"e",1:"i","!":"i",0:"o",5:"s",$:"s",7:"t",9:"g","(":"c",8:"b"}),xn="\u2801\u2803\u2809\u2819\u2811\u280B\u281B\u2813\u280A\u281A\u2805\u2807\u280D\u281D\u2815\u280F\u281F\u2817\u280E\u281E\u2825\u2827\u283A\u282D\u283D\u2835",Jo=Object.freeze(Object.fromEntries([...xn].map((e,t)=>[e,String.fromCharCode(97+t)]))),Zo=new RegExp(`[${xn}\u2800]`,"g"),On=/[⠀-⣿]/;function Xo(e){let t="";for(let n of e){let r=n.codePointAt(0);r!==void 0&&(r>=917536&&r<=917630?t+=String.fromCodePoint(r-917504):r>=917504&&r<=917631||(t+=n))}return t}function ei(e){return e.replace(Wo,"")}function Nn(e){return e.replace(Qo,t=>Cn[t]??t)}function ti(e){return e.replace(/[4@31!05$79(8]/g,t=>Yo[t]??t)}function ni(e){return e.replace(/[a-zA-Z]/g,t=>{let n=t<="Z"?65:97;return String.fromCharCode((t.charCodeAt(0)-n+13)%26+n)})}function ri(e){return On.test(e)?e.replace(Zo,t=>t==="\u2800"?" ":Jo[t]??t):e}function gn(e){let t;try{t=Xo(e)}catch{t=e}try{t=t.normalize("NFKC")}catch{}return t=ei(t),t=Nn(t),t}var oi=/^[A-Za-z0-9+/]{16,}={0,2}$/,ii=/^(?:[0-9a-fA-F]{2}\s*){8,}$/,hn=/[A-Za-z0-9+/]{20,}={0,2}/g;function ut(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);(r===9||r===10||r===13||r>=32&&r<=126||r>=160&&r!==65533)&&t++}return t/e.length}var Mn=new TextDecoder("utf-8",{fatal:!1});function Ln(e){let t;try{t=atob(e)}catch{return[]}let n=new Uint8Array(t.length);for(let o=0;o<t.length;o++)n[o]=t.charCodeAt(o)&255;let r=Mn.decode(n);return t===r?[t]:[r,t]}function ai(e){let t=e.replace(/\s+/g,"");if(t.length===0||t.length%2!==0)return[];let n=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++){let a=Number.parseInt(t.slice(i*2,i*2+2),16);if(Number.isNaN(a))return[];n[i]=a}let r="";for(let i=0;i<n.length;i++)r+=String.fromCharCode(n[i]);let o=Mn.decode(n);return r===o?[r]:[o,r]}function _n(e){let t=e.trim(),n=[];if(ii.test(t))for(let r of ai(t))n.push({decoded:r,textiness:ut(r)});if(oi.test(t)&&t.length%4===0)for(let r of Ln(t))n.push({decoded:r,textiness:ut(r)});return n}function yn(e,t){let n=[],r;for(hn.lastIndex=0;(r=hn.exec(e))!==null&&n.length<t;){let o=r[0];if(o.length%4===0)for(let i of Ln(o))n.push({decoded:i,textiness:ut(i)})}return n}var si=Object.freeze({maxDepth:3,byteCap:262144,maxNodes:256,maxBlobsPerNode:8});function Dn(e,t=si){if(typeof e!="string"||e.length===0)return{views:[],anyDecoded:!1,truncated:!1,nodes:0,maxDepthSeen:0};let{maxDepth:n,byteCap:r,maxNodes:o,maxBlobsPerNode:i}=t,a=new Set,s=_=>{_.length>0&&_.length<=r&&a.add(_)},l=!1,c=!1,u=0,d=0,f=[{s:e,depth:0}];for(;f.length>0;){if(u>=o){c=!0;break}let _=f.pop();if(_===void 0)break;let{s:g,depth:p}=_;if(g.length>r){c=!0;continue}u++,p>d&&(d=p);let y=gn(g);s(y);let C=ti(y);if(C!==y&&s(C),s(ni(y)),On.test(g)&&s(ri(y)),p>=n){let T=gn(g);(_n(T).length>0||yn(T,i).length>0)&&(c=!0);continue}let A=[..._n(y),...yn(y,i)];for(let T of A){if(l=!0,T.decoded.length>r){c=!0;continue}T.textiness>=.85&&T.decoded!==y?f.push({s:T.decoded,depth:p+1}):s(T.decoded)}}return{views:[...a],anyDecoded:l,truncated:c,nodes:u,maxDepthSeen:d}}var $n=["hidden_text_carrier","injected_turn_boundary","mixed_script_token","nested_encoding_payload"],li=Object.freeze(["hidden_text_carrier","injected_turn_boundary","mixed_script_token"]),ci=8,ui=new Set([173,8203,8204,8205,8206,8207,8288,65279,8234,8235,8236,8237,8238,8294,8295,8296,8297]),bn=e=>e!==void 0&&(e>=65&&e<=90||e>=97&&e<=122);function di(e){let t=[...e].map(r=>r.codePointAt(0)),n=0;for(let r=0;r<t.length;r++){let o=t[r];if(o>=917504&&o<=917631||ui.has(o)&&bn(t[r-1])&&bn(t[r+1])&&(n++,n>=ci))return!0}return!1}var pi=/^[ \t]*(?:system|assistant|developer|user)[ \t]*:/i;function fi(e){let t=e.split(/\r?\n/),n=!1;for(let r of t){if(pi.test(r)){if(n)return!0;continue}r.trim().length>0&&(n=!0)}return!1}var mi=[{name:"latin",lo:65,hi:591},{name:"greek",lo:880,hi:1023},{name:"cyrillic",lo:1024,hi:1279}];function gi(e){for(let t of mi)if(e>=t.lo&&e<=t.hi)return t.name;return null}function hi(e){for(let t of e.split(/\s+/)){if(t.length<4)continue;let n=0,r=0,o=!0;for(let i of t){let a=gi(i.codePointAt(0));if(a===null){o=!1;break}a==="latin"?n++:Nn(i)!==i&&r++}if(o&&n>0&&r>0)return!0}return!1}var vn=Object.freeze({signals:[],contributes:!1});function _i(e){if(typeof e!="string"||e.length===0)return{...vn,signals:[]};let t=new Set;try{di(e)&&t.add("hidden_text_carrier"),fi(e)&&t.add("injected_turn_boundary"),hi(e)&&t.add("mixed_script_token");let{anyDecoded:n,maxDepthSeen:r,truncated:o}=Dn(e);n&&(r>=2||o)&&t.add("nested_encoding_payload")}catch{return{...vn,signals:[]}}return{signals:[...$n.filter(n=>t.has(n))],contributes:li.some(n=>t.has(n))}}var qe=[{name:"override_instructions",re:/\bignore (?:all |the )?(?:previous|above|prior) (?:instructions|prompts?)\b/i},{name:"disregard_instructions",re:/\bdisregard (?:the )?(?:above|previous|system)\b/i},{name:"role_tag",re:/<\/?(system|assistant|instructions|host_context)\b/i},{name:"privilege_override",re:/\b(grant|escalate|elevate) (admin|root|all|full) (access|privileges?)\b/i},{name:"tool_smuggle",re:/```[\s\S]*?(tool_call|function_call)/i}];function wn(e){return typeof e!="string"||e.length===0?[]:qe.filter(({re:t})=>t.test(e)).map(({name:t})=>t)}function yi(e){if(typeof e!="string"||e.length===0)return[];let t=new Set(wn(e)),{views:n}=Dn(e);for(let r of n)for(let o of wn(r))t.add(o);return qe.filter(r=>t.has(r.name)).map(r=>r.name)}function bi(e){let t=new Set,n=new Set,r=!1,o=i=>{if(i!=null){if(typeof i=="string"){for(let s of yi(i))t.add(s);let a=_i(i);for(let s of a.signals)n.add(s);a.contributes&&(r=!0);return}if(Array.isArray(i)){for(let a of i)o(a);return}if(typeof i=="object")for(let a of Object.values(i))o(a)}};return o(e),{matched:t.size>0||r,signatures:qe.filter(i=>t.has(i.name)).map(i=>i.name),structural:$n.filter(i=>n.has(i))}}function vi(e){return bi(e).matched}var $s=qe.map(e=>e.name);var wi=new Set(["untrusted","external","public","public_internet","external_third_party","web"]);var ki="i:injection";function Fn(e){let t=new Set;if(e.content!==void 0&&e.content!==null){let{detectors:o}=dt(e.content);for(let i of o){let a=Be[i]?.category;a&&t.add(`c:${a}`)}vi(e.content)&&t.add(ki)}let n=e.resourceMetadata??{},r=n.source_trust;return(n.untrusted_source===!0||typeof r=="string"&&wi.has(r.toLowerCase()))&&t.add("i:untrusted"),[...t].sort()}var ct="(?:system\\s+prompt|initial\\s+(?:instructions|prompt)|system\\s+(?:instructions|message)|hidden\\s+(?:instructions|prompt)|your\\s+(?:system\\s+prompt|initial\\s+instructions|instructions|prompt)|the\\s+prompt\\s+(?:above|you\\s+were\\s+given))",Fs=[{name:"reveal_prompt",re:new RegExp(`\\b(?:reveal|show|print|repeat|output|echo|display|expose|dump|leak|reprint|divulge|disclose)\\b[\\s\\S]{0,40}?\\b${ct}\\b`,"i")},{name:"what_is_prompt",re:new RegExp(`\\bwhat\\s+(?:is|are|were)\\b[\\s\\S]{0,20}?\\b${ct}\\b`,"i")},{name:"tell_me_prompt",re:new RegExp(`\\b(?:tell|give|send|show)\\s+me\\b[\\s\\S]{0,30}?\\b${ct}\\b`,"i")},{name:"repeat_above",re:/\b(?:repeat|print|output|echo|reproduce)\b[\s\S]{0,20}?\b(?:everything|all\s+(?:the\s+)?(?:text|words))\b[\s\S]{0,12}?\b(?:above|before|preceding|verbatim|word\s+for\s+word)\b/i}],kn="(?:instructions?|prompts?|rules?|directives?|guidelines?|constraints?|guardrails?)",Ai=`(?:(?:all\\s+|any\\s+|the\\s+|these\\s+|those\\s+)*(?:previous|prior|preceding|earlier|above|foregoing|initial|original|system|developer)\\s+${kn}|your\\s+(?:(?:system|initial|original|previous|prior|current)\\s+)?(?:${kn}|programming|training))`,Ii="(?:(?:all|any|every|the|of|and|now|please|completely|entirely|totally|immediately)\\s+){0,3}",An="(?:\\b(?:unrestricted|unfiltered|uncensored|unbounded|unlimited|unchained|jailbroken|lawless|amoral)\\b|\\b(?:DAN|STAN|DUDE|AIM)\\b|\\bno\\s+(?:longer\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|boundaries|constraints?)\\b(?!\\s+(?:on|over|regarding|upon|for)\\b)|\\bwithout\\s+(?:any\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|constraints?|censorship)\\b|\\b(?:free|freed|released)\\s+from\\s+(?:your\\s+)?(?:restrictions?|limits?|rules?|guidelines?|guardrails?|programming|constraints?)\\b|\\b(?:can|will|are\\s+able\\s+to)\\s+(?:do|say)\\s+anything\\b|\\bignore\\s+(?:all\\s+)?(?:your\\s+)?(?:previous\\s+|prior\\s+|system\\s+)?(?:instructions?|rules?|guidelines?)\\b)",Si="(?:ignore|disregard|forget|override|overrule|bypass|obey|comply\\s+with|follow\\s+(?:only|my|these))",Ps=[{name:"override_instructions",re:new RegExp(`\\b(?:ignore|disregard|forget|discard|override|overrule|bypass|delete|erase)\\s+${Ii}${Ai}\\b`,"i")},{name:"forget_everything_prior",re:/\b(?:forget|ignore|disregard|erase|discard)\s+(?:about\s+|all\s+|any\s+)?(?:everything|anything)\b[\s\S]{0,24}?\b(?:above|before|previously|prior|earlier|you\s+(?:were|have\s+been)\s+(?:told|instructed|given|programmed))\b/i},{name:"persona_reassignment_jailbreak",re:new RegExp(`\\byou\\s+are\\s+now\\s+(?:(?:a|an|the)\\s+)?[\\s\\S]{0,48}?${An}`,"i")},{name:"constraint_release",re:/\byou\s+are\s+no\s+longer\s+(?:bound|restricted|limited|constrained|obligated|governed|subject\s+to|required\s+to)\b/i},{name:"from_now_on_reassignment",re:new RegExp(`\\bfrom\\s+now\\s+on\\s*,?\\s+you\\s+(?:are|will|must|shall|have|can)\\s+(?:${Si}\\b|[\\s\\S]{0,40}?${An})`,"i")},{name:"new_instructions_header",re:/^\s*(?:[#*>-]+\s*)?(?:new|real|actual|true|secret|hidden|override)\s+(?:system\s+)?(?:instructions?|prompts?|directives?)\s*:/im}];var js=Object.freeze({"\u2019":"'",\u02BC:"'","\uFF07":"'","\u02B9":"'","\u2032":"'"});var q=e=>`[^.!?;\\n]{0,${e}}?`,Ti=["\\bi\\s+(?:can'?t|cannot|can\\s+not|won'?t|will\\s+not)\\b","\\bi(?:'m|\\s+am)\\s+(?:not\\s+able\\s+to|unable\\s+to|not\\s+going\\s+to|not\\s+permitted\\s+to|not\\s+allowed\\s+to)\\b"].join("|"),Pn="(?:help|assist|provide|create|generate|produce|write|compose|draft|comply|fulfil|fulfill|share|disclose|reveal|perform|execute|run|send|transmit|publish|export|approve|grant|carry\\s+out|do\\s+that|do\\s+this|do\\s+so|go\\s+ahead)",Us=Object.freeze([{id:"capability_denial",class:"strong",re:new RegExp([`(?:${Ti})\\s${q(40)}\\b${Pn}\\b`,"\\b(?:that|this|it)(?:'s|\\s+is)\\s+not\\s+something\\s+i\\s+(?:can|could|am\\s+able\\s+to|'m\\s+able\\s+to)\\b",`\\b(?:falls|sits|is)\\s+outside\\s+(?:of\\s+)?(?:what|the\\s+(?:scope|range|bounds))\\b${q(40)}\\bi\\s+(?:can|am|'m)\\b`,"\\bnot\\s+something\\s+i(?:'m|\\s+am)\\s+(?:able|willing|permitted|allowed)\\s+to\\b"].join("|"),"i")},{id:"explicit_decline",class:"strong",re:new RegExp(["\\bi\\s+(?:must|have\\s+to|need\\s+to|will\\s+have\\s+to|am\\s+going\\s+to|'m\\s+going\\s+to)\\s+(?:respectfully\\s+)?decline\\b","\\bi(?:'m|\\s+am)\\s+not\\s+(?:comfortable|willing|prepared)\\b","\\bi(?:'ll|\\s+will)\\s+(?:have\\s+to\\s+)?pass\\s+on\\b","\\bi\\s+(?:must|have\\s+to)\\s+refuse\\b"].join("|"),"i")},{id:"policy_citation",class:"strong",re:new RegExp([`\\b(?:against|contrary\\s+to|prohibited\\s+by|forbidden\\s+by|in\\s+violation\\s+of|violates)\\s${q(24)}\\b(?:polic(?:y|ies)|guidelines?|terms\\s+of\\s+(?:use|service)|rules\\s+of\\s+engagement|code\\s+of\\s+conduct)\\b`,`\\b(?:my|our|the|company|organi[sz]ation'?s?)\\s+(?:polic(?:y|ies)|guidelines?)\\s${q(24)}\\b(?:do(?:es)?\\s+not\\s+(?:allow|permit)|prohibit|forbid|prevent)\\b`,`\\bnot\\s+(?:permitted|allowed|authori[sz]ed)\\s+(?:under|by)\\s${q(24)}\\b(?:polic(?:y|ies)|guidelines?)\\b`].join("|"),"i")},{id:"guardrail_selfreference",class:"strong",re:new RegExp(["\\bi(?:'ve|\\s+have)\\s+been\\s+(?:instructed|configured|told|trained)\\s+not\\s+to\\b","\\bi(?:'m|\\s+am)\\s+(?:designed|configured|programmed|built|set\\s+up)\\s+not\\s+to\\b",`\\bmy\\s+(?:safety\\s+)?(?:instructions|configuration|guardrails?|constraints|training)\\s${q(24)}\\b(?:prevent|prohibit|forbid|do(?:es)?\\s+not\\s+(?:allow|permit)|preclude)\\b`,"\\b(?:outside|beyond)\\s+(?:my|the)\\s+(?:permitted|authori[sz]ed|configured|approved)\\s+(?:scope|remit|capabilities|actions|operations)\\b"].join("|"),"i")},{id:"ethical_objection",class:"strong",re:new RegExp(["\\b(?:that|this|doing\\s+(?:so|that)|what\\s+you(?:'re|\\s+are)\\s+asking|the\\s+request|such\\s+a\\s+request)\\s+(?:would\\s+be|is|are)\\s+(?:clearly\\s+|both\\s+|potentially\\s+)?(?:illegal|unethical|unlawful|harmful|fraudulent)\\b","\\bi\\s+(?:do\\s+not|don'?t)\\s+condone\\b","\\b(?:goes|would\\s+go|runs)\\s+against\\s+my\\s+(?:principles|values|ethics)\\b","\\bi\\s+(?:can'?t|cannot|won'?t)\\s+in\\s+good\\s+conscience\\b"].join("|"),"i")},{id:"apology_marker",class:"weak",re:new RegExp("\\b(?:i(?:'m|\\s+am)\\s+(?:really\\s+|very\\s+|terribly\\s+|so\\s+)?sorry|i\\s+apologi[sz]e|my\\s+apologies)\\b","i")}]),Bs=Object.freeze([/```/,/\b(?:here(?:'s|\s+is|\s+are)|below\s+(?:is|are|you(?:'ll|\s+will)\s+find)|the\s+following\s+(?:is|are))\b/i,new RegExp(`\\b(?:but|however|instead|although|that\\s+said)\\b${q(60)}\\b(?:i\\s+(?:can|could)(?!'t)\\s${q(30)}\\b${Pn}\\b|i(?:'d|\\s+would)\\s+be\\s+happy\\s+to\\b|i(?:'m|\\s+am)\\s+able\\s+to\\b)`,"i"),/\bwhat\s+i\s+can\s+do\s+(?:instead|is|for\s+you)\b/i]);var ve=e=>`[^.!?;\\n]{0,${e}}?`,qs=Object.freeze([{id:"vulnerability_scanning",objectPatterns:[/\b(?:vulnerability|vuln|security)\s+(?:scan|scans|scanning|assessment|audit|test|testing)\b/i,/\bpen(?:etration)?[\s-]?test(?:ing)?\b/i,/\bport\s+scan(?:ning)?\b/i,/\b(?:exploit|nmap|metasploit|nessus|burp\s+suite)\b/i,/\bCVE-\d{4}-\d{4,7}\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|vulnerability|incident\s+respon\w{0,4}|threat|soc|red\s+team|phishing|malware)\b/i]},{id:"credential_access",objectPatterns:[/\b(?:credential|password|passphrase|api\s+key|access\s+key|secret|token|private\s+key|ssh\s+key)s?\b/i,/\b(?:vault|secrets?\s+manager|keychain|keystore)\b/i,/\bservice\s+account\s+key\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|identity|iam|credential|secrets?\s+manage\w{0,4}|vault|platform|devops)\b/i]},{id:"financial_transaction",objectPatterns:[/\b(?:wire\s+transfer|bank\s+transfer|payout|disbursement|chargeback)\b/i,new RegExp(`\\b(?:approve|issue|initiate|process|release)\\s${ve(20)}\\b(?:payment|refund|invoice|transfer|purchase\\s+order)s?\\b`,"i"),new RegExp(`\\b(?:move|transfer)\\s${ve(20)}\\b(?:funds|money)\\b`,"i")],purposeFunctions:["finance_accounting","procurement"],purposePatterns:[/\b(?:finance|financial|accounting|invoice|invoicing|payment|payments|billing|refund|refunds|treasury|procurement|spend|purchasing|fraud|kyc)\b/i]},{id:"personnel_data",objectPatterns:[/\b(?:employee|personnel|payroll|hr|staff)\s+(?:record|records|data|file|files|information|details)\b/i,/\b(?:salary|salaries|compensation|performance\s+review|termination\s+letter)s?\b/i,/\b(?:home\s+address|social\s+security\s+number|national\s+insurance\s+number)e?s?\b/i],purposeFunctions:["hr","privacy_compliance"],purposePatterns:[/\b(?:hr|human\s+resources|people\s+ops|payroll|benefits|recruit\w{0,4}|onboarding|privacy|dsar|consent)\b/i]},{id:"regulated_advice",objectPatterns:[/\b(?:legal|medical|tax|investment|financial)\s+advice\b/i,/\bpractis\w{0,3}\s+law\b/i,/\b(?:diagnose|diagnosis|prescribe|prescription)\b/i,/\b(?:binding|enforceable)\s+(?:opinion|interpretation)\b/i],purposeFunctions:["legal","privacy_compliance"],purposePatterns:[/\b(?:legal|compliance|counsel|contract|contracts|litigation|nda|privacy|regulator\w{0,2}|audit\w{0,3})\b/i]},{id:"data_export",objectPatterns:[new RegExp(`\\b(?:export|download|dump|extract|exfiltrat\\w{0,3}|bulk\\s+copy)\\b\\s${ve(30)}\\b(?:data|database|dataset|records?|table|tables|customer\\s+list|contact\\s+list|report)\\b`,"i"),/\b(?:full|entire|whole)\s+(?:database|dataset|customer\s+table)\b/i],purposeFunctions:["operations","engineering","privacy_compliance"],purposePatterns:[/\b(?:data\s+(?:pipeline|engineering|platform)|etl|export|reporting|analytics|operations|document\s+extract\w{0,3}|forecast\w{0,3})\b/i]},{id:"code_execution",objectPatterns:[new RegExp(`\\b(?:run|execute|invoke)\\s${ve(24)}\\b(?:script|scripts|command|commands|shell|code|binary|query|migration)\\b`,"i"),/\b(?:shell|root|sudo|admin)\s+(?:access|command|session)\b/i,/\bagainst\s+(?:the\s+)?production\s+(?:system|server|database|environment)s?\b/i],purposeFunctions:["engineering","it_security"],purposePatterns:[/\b(?:engineering|developer|devops|platform|release|deploy\w{0,4}|build|pipeline|sandbox|test\s+data|change\s+window)\b/i]},{id:"external_communication",objectPatterns:[new RegExp(`\\b(?:send|post|publish|email|tweet|message|broadcast)\\b\\s${ve(30)}\\b(?:external|customer|customers|public|press|social\\s+media|third[\\s-]party|prospect|prospects)\\b`,"i"),/\b(?:cold\s+outreach|marketing\s+blast|phishing\s+email|press\s+release)\b/i],purposeFunctions:["marketing","sales","customer_support"],purposePatterns:[/\b(?:marketing|campaign|outreach|email\s+assistant|support|customer|sales|lead|leads|communication|communications)\b/i]}]);var pt="[REDACTED]",te="\u2022",Ue=e=>/[A-Za-z0-9]/.test(e);function jn(e,t,n,r){let o=Array.from(e),i=o.length,a=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:te,c=a+s>=i;return o.map((u,d)=>!c&&(d<a||d>=i-s)?u:Ue(u)?l:u).join("")}function Ei(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return jn(e,0,0,t);let r=e.slice(0,n),o=e.slice(n),i=t.length>0?t:te;return(r.length<=1?i:r[0]+Array.from(r.slice(1)).map(a=>Ue(a)?i:a).join(""))+o}function Ri(e,t,n){let r=n.length>0?n:te,o=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let c=new RegExp(t,"g"),u;for(;(u=c.exec(e))!==null;){if(u[0].length===0){c.lastIndex++;continue}for(let d=u.index;d<u.index+u[0].length;d++)o[d]=!0}}catch{}let i=!1,a=!0;for(let c=0;c<e.length;c++)if(Ue(e[c])&&(i=!0,!o[c])){a=!1;break}let s=i&&a,l="";for(let c=0;c<e.length;c++){let u=e[c];!s&&o[c]||!Ue(u)?l+=u:l+=r}return l}function Un(e,t){let n=t.mode??"full";return n==="partial"?jn(e,t.keepFirst??0,t.keepLast??0,t.maskChar??te):n==="email"?Ei(e,t.maskChar??te):n==="custom"?Ri(e,t.keepPattern,t.maskChar??te):t.replacement??pt}function Ci(e,t){return typeof e=="string"?Un(e,t):t.replacement??pt}function Bn(e){let t=[],n=e.replacement??pt;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:r,replacer:()=>n});for(let r of e.directives??[]){let{pattern:o}=r;typeof o!="string"||o.length===0||t.push({source:o,replacer:i=>Un(i,r)})}return t}function qn(e,t){let n=e;for(let{source:r,replacer:o}of t){let i;try{i=new RegExp(r,"g")}catch(a){let s=a instanceof Error?a.message:String(a);throw new Error(`[visiq-redact] Invalid redaction pattern "${r}": ${s}`)}n=n.replace(i,a=>o(a))}return n}function M(e,t){return e==null?e:typeof e=="string"?xi(e,t):typeof e=="object"?Oi(e,t):e}function xi(e,t){if(typeof e!="string")return e;let n=Bn(t);return n.length===0?e:qn(e,n)}function Oi(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=Bn(t),o=n.size>0,i=r.length>0,a=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>a(l));if(typeof s=="object"){let l=s,c=Object.create(Object.getPrototypeOf(l));for(let u of Object.keys(l)){let d=o?n.get(u):void 0;if(d){c[u]=Ci(l[u],d);continue}c[u]=a(l[u])}return c}return typeof s=="string"&&i?qn(s,r):s};return a(e)}var Vn=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function Ni(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:Vn(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:Vn(t.spawn.prompt)}),t}function Mi(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var Li=1440*60*1e3,Di="VISIQ_BUNDLE_GRACE_TTL_MS",$i="VISIQ_BUNDLE_CACHE_DISABLED",Fi="VISIQ_CACHE_DIR",Pi=Ve.object({graceTtlMs:Ve.number().int().nonnegative().optional(),disabled:Ve.boolean().optional(),cacheDir:Ve.string().min(1).optional()}).strict();function ji(e){return e==null?{}:Pi.parse(e)}function Ui(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[Di];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return Li}function Bi(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[$i]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var zn;function qi(){if(zn!==void 0)return zn;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function Vi(e){return JSON.stringify(mt(e))}function mt(e){if(Array.isArray(e))return e.map(mt);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=mt(t[r]);return n}return e}function zi(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function Ki(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function Yn(){if(!qi())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function Jn(e,t){return e.createHash("sha256").update(Vi(t)).digest("hex")}function Gi(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[Fi]?.trim();if(r)return r;let o=process.env.XDG_CACHE_HOME?.trim();if(o)return e.path.join(o,"visiq");let i="";try{i=e.os.homedir()}catch{i=""}return i?e.path.join(i,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function Hi(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function Zn(e,t,n){return e.path.join(Gi(e,n),"bundles",`${Hi(e,t)}.json`)}async function Wi(e,t,n,r={}){let o=await Yn();if(o)try{let i=Zn(o,e,r),a=o.path.dirname(i);await o.fs.mkdir(a,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:Jn(o.crypto,t),body:t},l=`${i}.tmp-${process.pid}-${o.crypto.randomBytes(6).toString("hex")}`;await o.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await o.fs.rename(l,i)}catch(c){throw await o.fs.rm(l,{force:!0}).catch(()=>{}),c}}catch{}}async function Qi(e,t={}){let n=await Yn();if(!n)return null;try{let r=await n.fs.readFile(Zn(n,e,t),"utf-8"),o=Ki(JSON.parse(r));return!o||Jn(n.crypto,o.body)!==o.contentHash?null:o}catch{return null}}var we;async function Yi(){if(we!==void 0)return we;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;we=typeof t=="function"?t:null}catch{we=null}return we}function Ji(e){let t=[];for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,o=r.rego_source;if(typeof o!="string"||o.length===0)continue;let i;try{i=lt(o)}catch{continue}let a=typeof r.id=="string"?r.id:"<rule>";for(let s of Qt(i))t.push(`${a}: ${s}`)}return t}function Zi(e){let t=new Set;for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,o=r.rego_source;if(typeof o!="string"||o.length===0)continue;let i;try{i=lt(o)}catch{continue}let a=typeof r.id=="string"?r.id:"<rule>";for(let s of Yt(i))t.add(`${a}: ${s}`)}return[...t].sort()}function Xi(e){return e==null||typeof e!="object"?!0:Object.keys(e).length===0}var ea=5e3,ta=1e4,na=25,Kn=1e3,ra=5e3,oa=100,Gn=2e3,ia=512,aa=1800*1e3,sa=.7,la="monitor",ca="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",Hn="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",ze="open";function ke(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function ua(e,t){return Fn({content:e,resourceMetadata:t})}var da=h.object({operations:h.array(h.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:h.string().min(1,"agentId is required"),sessionId:h.string().min(1).max(255).optional(),toolName:h.string().optional(),toolArgs:h.record(h.unknown()).optional(),targetResource:h.string().optional(),resourceType:h.string().optional(),resourceMetadata:h.record(h.unknown()).optional(),normalized:h.record(h.unknown()).optional(),query:h.string().optional(),contentPreview:h.string().optional(),telemetry:h.record(h.unknown()).optional(),context:h.record(h.unknown()).optional(),mcpServer:h.string().min(1).max(255).optional()}),pa=h.object({version:h.string().min(1),dialect_version:h.number().int().optional(),min_dialect:h.number().int().optional(),shutdown:h.boolean().optional(),agent_mode:h.enum(["enforce","monitor","off"]).optional(),cognition_capture:h.boolean().optional(),agent_mode_by_operation:h.object({action:h.string().optional(),retrieval:h.string().optional(),delegation:h.string().optional()}).partial().optional(),agent_attributes:h.object({trust_tier:h.string().nullable().optional(),categories:h.array(h.string()).optional(),business_function:h.string().nullable().optional(),business_functions:h.array(h.string()).nullable().optional(),blast_radius_tier:h.string().nullable().optional(),no_coverage:h.string().nullable().optional(),fail_mode:h.string().nullable().optional()}).optional(),rules:h.array(h.record(h.unknown())),action_schemas:h.array(h.object({id:h.string(),plane:h.string().optional(),field_mappings:h.array(h.record(h.unknown())).optional(),derived_fields:h.array(h.record(h.unknown())).optional(),action_class:h.string().nullable().optional(),action_class_confidence:h.number().optional()})).optional(),no_coverage:h.object({no_coverage_defaults:h.record(h.string()),autopilot_enabled:h.boolean(),enduser_hitl_enabled:h.boolean(),hitl_timeout_seconds:h.number().optional()}).optional()});function fa(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=cn(un(n));return{trust_tier:Zt(t)?t:null,categories:en(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&dn(e.blast_radius_tier)?e.blast_radius_tier:null}}function ma(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function ga(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var gt=new Set,Wn=!1;async function Qn(e){let t=[];for(let n of gt){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function ha(){if(!Wn&&!(typeof process>"u"||typeof process.once!="function")){Wn=!0,process.once("beforeExit",()=>{Qn(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await Qn(!0)}finally{process.kill(process.pid,e)}})()})}}var Xn=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=la;agentModeByOperation=null;rawBundle=null;normalizedRefs=[];warnedNormalizedAbsent=!1;warnedNormalizedDrift=!1;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;failMode=ke(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??ze;governedFailMode=null;telemetryBuffer=[];telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;lastCloneCaptureSig=null;toolDescriptions=new Map;constructor(e,t,n,r,o,i,a,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,c=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,u=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=c,this.resolvedAgentId=u,this.harnessKind=r,this.sdkVersion=i,this.sdkDialect=a,this.originalFetch=globalThis.fetch.bind(globalThis);let d=ji(s);if(this.bundleCacheDisabled=Bi(d.disabled),this.bundleGraceTtlMs=Ui(d.graceTtlMs),this.bundleCacheDirOverride=d.cacheDir,this.cacheIdentity=l&&c&&!this.bundleCacheDisabled?{endpoint:c,agentId:u,apiKey:l}:null,l&&c){let f={apiKey:l,agentId:u,endpoint:c,mode:"enforce",timeoutMs:Mi(o),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...i!==void 0?{sdkVersion:i}:{},...a!==void 0?{sdkDialect:a}:{}};this.client=new it(f,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},ea),ft(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},ta),ft(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},ra),ft(this.cognitionTimer),gt.add(this),ha()}else this.client=null}async evaluate(e){let t=da.parse(e),n=Date.now();if(this.operatorShutdown){let f=this.denyAll(t,ca);return this.applyAgentMode(f,"enforce",t,n)}if(this.dialectRefused){if(this.failMode==="open")return this.failOpen(t,Hn,n);let f=this.denyAll(t,Hn);return this.applyAgentMode(f,"enforce",t,n)}if(t.operations.every(f=>this.modeFor(f)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let f;if(this.agentModeConfirmed?f=this.agentMode:this.bundleApplyFailed?f="enforce":f="monitor",f==="enforce"&&this.failMode==="open")return this.failOpen(t,"no unified bundle loaded and no local rules",n);let _=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(_,f,t,n)}let r=this.readSession(t.sessionId),o=await Yi();if(!o||!this.rawBundle){if(this.failMode==="open")return this.failOpen(t,"governance core (@visiq/core-wasm) unavailable",n);throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)")}let i=t.operations.includes("action")||t.operations.includes("delegation")?nn(t.normalized??{},{targetApp:t.targetResource??t.toolName??""}):t.normalized,a=this.buildActionSchemaEvent(t),s=t.mcpServer?{...i??{},mcp_server:t.mcpServer}:i,l={...t,normalized:s,session:r,at:Date.now(),action_schema_id:a.id,action_schema_raw:a.canonical},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},u;try{u=o(l,c)}catch(f){if(this.failMode==="open")return this.failOpen(t,`governance core evaluation threw: ${f instanceof Error?f.message:String(f)}`,n);throw f}this.normalizedRefs.length>0&&Xi(t.normalized)&&(u.normalizedColdStart=[...this.normalizedRefs],this.warnedNormalizedAbsent||(this.warnedNormalizedAbsent=!0,console.warn(`[UNIFIED] no normalized event supplied, but ${this.normalizedRefs.length} loaded rule condition(s) read input.normalized.* \u2014 those conditions CANNOT match, so a deny carrying one silently permits. Cold start / no action-schema mapping yet. Affected: ${this.normalizedRefs.slice(0,5).join("; ")}${this.normalizedRefs.length>5?`; +${this.normalizedRefs.length-5} more`:""}`)));let d=rn(t.normalized);return d.length>0&&(u.normalizedDrift=d,this.warnedNormalizedDrift||(this.warnedNormalizedDrift=!0,console.warn(`[UNIFIED] normalized event carries ${d.length} value(s) outside the canonical vocabulary \u2014 a builder-authored rule can only select in-vocab values, so these CANNOT match one (silent non-match). Check the harness classifier's casing/spelling. Affected: ${d.slice(0,5).join("; ")}${d.length>5?`; +${d.length-5} more`:""}`))),this.foldSession(t,u.enforced?u.decision:"permit"),u.enforced&&u.action.decision==="approval_required"&&await this.registerHitl(t,u),this.bufferTelemetry(t,u,Date.now()-n,u.enforced),u}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}readSession(e){if(!e)return be;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>aa?(this.sessions.delete(e),be):t.state:be}foldActionClass(e){let t=e.normalized?.action_class;if(typeof t=="string"&&t.length>0)return t;let n=this.rawBundle?.action_schemas;if(!Array.isArray(n))return;let{id:r}=this.buildActionSchemaEvent(e),o=n.find(s=>s?.id===r);if(!o)return;let i=o.action_class,a=typeof o.action_class_confidence=="number"?o.action_class_confidence:0;if(typeof i=="string"&&i.length>0&&a>=sa)return i}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),o=e.resourceMetadata??{},i=e.operations.includes("retrieval"),a=e.operations.includes("action")||e.operations.includes("delegation"),s=an(r===be?on():r,{data_categories:i&&Array.isArray(o.data_categories)?o.data_categories:void 0,classification:i?o.classification:void 0,taint:i?ua(e.contentPreview,o):void 0,action_class:a?this.foldActionClass(e):void 0,target_app:a?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:s,touchedAt:Date.now()}),this.sessions.size>ia){let l=this.sessions.keys().next().value;l!==void 0&&this.sessions.delete(l)}}applyAgentMode(e,t,n,r){let o=Date.now()-r;if(t==="enforce"){let a={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,a,o,!0),a}let i={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,i,o,!1),i}setFailMode(e){this.failMode=e}getFailMode(){return this.failMode}getGovernedFailMode(){return this.governedFailMode}failOpen(e,t,n){let r=`fail-open: ${t} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`;console.error(`[VisIQ] FAIL-OPEN: ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`);let o=e.operations.includes("action")||e.operations.includes("delegation"),i=e.operations.includes("retrieval"),a={decision:"permit",allowed:!0,reason:r,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:o?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:i?{action:"allow"}:{action:null},failOpen:!0};return this.bufferTelemetry(e,a,Date.now()-n,!1,!0),a}reportFailOpen(e,t){try{let n={operations:["action"],agentId:this.resolvedAgentId,...t?.toolName?{toolName:t.toolName}:{},...t?.sessionId?{sessionId:t.sessionId}:{}},r={decision:"permit",allowed:!0,reason:`fail-open: ${e} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:{decision:"permit",allowed:!0},retrieval:{action:null},failOpen:!0};this.bufferTelemetry(n,r,0,!1,!0)}catch{}}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},action_schema_id:this.buildActionSchemaEvent(e).id,...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=pa.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}let r=Ji(t.rules);if(r.length>0){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle contains rego_source using a builtin the engine cannot evaluate (would silently never match \u2192 fail open): ${r.join("; ")}. Refusing the bundle and failing closed (G001). Recompile the rule without case-folding wrappers like upper()/lower().`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(o=>mn(o)).filter(o=>o!==null),this.agentAttributes=t.agent_attributes?fa(t.agent_attributes):null,this.agentNoCoverage=pn(t.agent_attributes?.no_coverage),this.governedFailMode=ke(t.agent_attributes?.fail_mode)??null,this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=ma(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.normalizedRefs=Zi(t.rules),this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1,this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...H(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304)return;if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),o=await n.json();this.applyBundle(o);let i=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&i?this.bundleEtag=r:i||(this.bundleEtag=null),i&&await this.persistBundleToDisk(o)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await Qi(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(zi(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await Wi(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}isBundleLoaded(){return this.bundleLoaded}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e,t){this.registerEnvironment({...De(),...e?{agent_type:e}:{},...t?.model?{model:t.model}:{},...t?.systemPrompt?{systemPrompt:t.systemPrompt}:{},...t?.toolSchemas&&t.toolSchemas.length>0?{toolSchemas:t.toolSchemas}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));for(let n of e)n.description&&this.toolDescriptions.set(n.name,n.description);t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}captureCloneMetadata(e){if(!this.client||!this.resolvedAgentId||!(e.model||e.systemPrompt||(e.toolSchemas?.length??0)>0))return;let t=JSON.stringify({m:e.model??"",s:e.systemPrompt??"",t:e.toolSchemas??[]});t!==this.lastCloneCaptureSig&&(this.lastCloneCaptureSig=t,this.client.registerEnvironment({...De(),...e.agentType?{agent_type:e.agentType}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{systemPrompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{toolSchemas:e.toolSchemas}:{}}))}buildActionSchemaEvent(e){let t=e.toolName?this.toolDescriptions.get(e.toolName):void 0,n={agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{},...e.toolArgs?{tool_args:e.toolArgs}:{},...t?{tool_description:t}:{}},r=fn(n),o={...n};return e.toolArgs&&(o.tool_args=Rn(e.toolArgs)),{canonical:n,id:r,rawEventForWire:o}}bufferTelemetry(e,t,n,r,o=!1){let i=this.buildActionSchemaEvent(e);this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?ga(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:i.rawEventForWire,action_schema_id:i.id,...this.harnessKind||e.context||o||t.normalizedColdStart||t.normalizedDrift?{context:{...this.harnessKind?{[Pt]:this.harnessKind}:{},...e.context??{},...o?{fail_open:!0}:{},...t.normalizedColdStart?{normalized_cold_start:!0,normalized_inert_conditions:t.normalizedColdStart.length}:{},...t.normalizedDrift?{normalized_drift:!0,normalized_drift_values:t.normalizedDrift.length}:{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=na&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0);try{await this.client.sendTelemetry(e)}catch(t){console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",t)}}enforceTelemetryCap(){let e=this.telemetryBuffer.length-Kn;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${Kn})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(Ni(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=oa&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-Gn;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${Gn})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}await this.flushTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),gt.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function ft(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function _a(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function $(e,...t){for(let n of t){let r=_a(e[n]);if(r)return r}}var ya=[{framework:"openai-agents",matches:e=>/^transfer_to_.+/.test(e),extract:(e,t)=>{let n=e.replace(/^transfer_to_/,"");return{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"teammate",task:$(t,"task","input","reason","message"),source:"structural"}}},{framework:"voltagent",matches:e=>e==="delegate_task",extract:(e,t)=>{let n=$(t,"targetAgent","agent","subAgent","agentName","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:$(t,"task","message","input"),description:$(t,"purpose"),source:"structural"}:null}},{framework:"crewai",matches:e=>/delegate work to (co-?worker|.+)/i.test(e),extract:(e,t)=>{let n=$(t,"coworker","agent","role");return n?{childAgentId:n,childName:n,kind:"teammate",agentType:n,task:$(t,"task","question"),description:$(t,"context"),source:"structural"}:null}},{framework:"llamaindex",matches:e=>e==="handoff"||/handoff/i.test(e),extract:(e,t)=>{let n=$(t,"to_agent","toAgent","agent_name","agentName","agent","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:$(t,"reason","task","message"),source:"structural"}:null}},{framework:"generic",matches:e=>/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)([_-].+)?$/i.test(e),extract:(e,t)=>{let n=$(t,"agent","agentName","agentId","target","targetAgent","to","to_agent","coworker","name")??(/[_-]/.test(e)?e.replace(/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)[_-]/i,""):void 0);return n?{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"subagent",task:$(t,"task","message","input","reason","prompt"),source:"heuristic"}:null}}];function Ke(e,t){if(!e)return null;let n=t??{};for(let r of ya)try{if(r.matches(e)){let o=r.extract(e,n);if(o)return o}}catch{}return null}function Ge(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}function ht(e){if(e===null||typeof e!="object"||Array.isArray(e))return{input:e===void 0?"":String(e)};let t=e,n=Object.keys(t);return n.length===1&&n[0]==="context"&&t.context!==null&&typeof t.context=="object"?t.context:t}function er(e){if(typeof e=="string"){try{let t=JSON.parse(e);if(t!==null&&typeof t=="object"&&!Array.isArray(t))return t}catch{}return{input:e}}return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:{input:e===void 0?"":String(e)}}function L(e){let t=[],n=[],r,o=[];for(let a of e){if(a.mode==="partial"||a.mode==="email"||a.mode==="custom"){let l={mode:a.mode};a.field&&(l.field=a.field),a.pattern&&(l.pattern=a.pattern),typeof a.keepFirst=="number"&&(l.keepFirst=a.keepFirst),typeof a.keepLast=="number"&&(l.keepLast=a.keepLast),a.maskChar&&(l.maskChar=a.maskChar),a.keepPattern&&(l.keepPattern=a.keepPattern),a.replacement!==void 0&&(l.replacement=a.replacement),o.push(l);continue}a.field&&t.push(a.field),a.pattern&&n.push(a.pattern);let{replacement:s}=a;s&&r===void 0&&(r=s)}let i={};return t.length>0&&(i.fields=t),n.length>0&&(i.patterns=n),r!==void 0&&(i.replacement=r),o.length>0&&(i.directives=o),i}var V="0.2.9";import{AsyncLocalStorage as ba}from"node:async_hooks";var R=new ba,va=5120,tr=50;function wa(e,t){if(typeof e!="string")return"";let n=new TextEncoder,r=n.encode(e);if(r.length<=t)return e;let i=`\u2026[truncated ${Math.ceil(r.length/1024)}KB]`,a=n.encode(i).length,s=Math.max(0,t-a),l=r.subarray(0,s);return new TextDecoder("utf-8",{fatal:!1}).decode(l)+i}function z(e){if(!e)return;let t=r=>r.length<=tr?r.slice():r.slice(r.length-tr),n=r=>wa(r,va);return{session_id:e.session_id,llm_prompts:t(e.llm_prompts).map(n),llm_responses:t(e.llm_responses).map(n),agent_reasoning:t(e.agent_reasoning).map(n)}}var _t=12e4,nr=2e3,rr=3,ka=5e3;function Ae(e,t){return e==="mask"&&(t?.length??0)>0}var Aa=new Set(["approved","resolved"]),Ia=new Set(["rejected","dismissed","expired","timeout","bypassed_disabled"]);function Sa(e){return new Promise(t=>setTimeout(t,e))}function Ta(e){if(typeof e!="object"||e===null)return null;let t=e,n=t.hitl_result;if(typeof n=="string"&&n.length>0)return n;let{hitl:r}=t;if(r&&typeof r=="object"){let{status:o}=r;if(typeof o=="string"&&o.length>0)return o==="pending"?null:o}return null}async function Ie(e){let{endpoint:t,apiKey:n,decisionId:r,timeoutMs:o=_t,maskFallback:i=!1,sdkVersion:a,fetchImpl:s=globalThis.fetch,sleep:l=Sa,log:c=p=>console.warn(p)}=e,u=p=>i?{resolution:"mask",reason:p}:{resolution:"block",reason:p};if(!t)return u("HITL approval cannot be confirmed (no backend endpoint) \u2014 fail-closed (G001)");if(!r)return u("HITL approval cannot be confirmed (no decision id) \u2014 fail-closed (G001)");let d=`${t.replace(/\/$/,"")}/v1/allow/decisions/${encodeURIComponent(r)}`,f={Accept:"application/json",...H(a)};n&&(f.Authorization=`Bearer ${n}`);let _=Date.now()+Math.max(0,o),g=0;for(c(`[VisIQ HITL] Awaiting human approval for decision ${r} (timeout ${o}ms)`);;){if(Date.now()>=_)return c(`[VisIQ HITL] Decision ${r} timed out after ${o}ms \u2014 ${i?"masking":"blocking"} (G001)`),u("HITL approval timed out");let p=null;try{let y=new AbortController,C=setTimeout(()=>y.abort(),ka),A;try{A=await s(d,{method:"GET",headers:f,signal:y.signal})}finally{clearTimeout(C)}if(!A.ok)throw new Error(`HTTP ${A.status} ${A.statusText}`);let T=await A.json();p=Ta(T),g=0}catch(y){g+=1;let C=y instanceof Error?y.message:String(y);if(c(`[VisIQ HITL] Poll failed for decision ${r} (${g}/${rr}): ${C}`),g>=rr)return u(`HITL approval poll failed repeatedly \u2014 fail-closed (G001): ${C}`);await l(nr);continue}if(p!==null){let y=p.toLowerCase();return Aa.has(y)?(c(`[VisIQ HITL] Decision ${r} approved (${p}) \u2014 proceeding`),{resolution:"proceed",reason:`Approved by human reviewer (${p})`}):Ia.has(y)?(c(`[VisIQ HITL] Decision ${r} resolved as ${p} \u2014 ${i?"masking":"blocking"}`),u(`Not approved by human reviewer (${p})`)):(c(`[VisIQ HITL] Decision ${r} returned unknown status '${p}' \u2014 ${i?"masking":"blocking"} (G001)`),u(`HITL returned unknown status '${p}' \u2014 fail-closed (G001)`))}await l(nr)}}function K(e){return e??ke(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??ze}function v(e,t){try{console.error(`[VisIQ] FAIL-OPEN (${e}): ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`)}catch{}}function U(e,t){try{console.error(`[VisIQ] TRACE-DEGRADED (${e}): ${t} \u2014 the governance decision was still made and enforced; only the execution-trace beat was lost.`)}catch{}}function re(e){let t=e.getFailMode;return(typeof t=="function"?t.call(e):void 0)??K()}function Y(e){return e.enforced?{allowed:e.action.allowed,decision:e.action.decision,...e.action.decisionId!==void 0?{decisionId:e.action.decisionId}:{},...e.ruleCode!==null?{ruleCode:e.ruleCode}:{},reason:e.reason,argRedactionRules:e.action.argRedactionRules??[],...e.action.hitlFallback?{hitlFallback:e.action.hitlFallback}:{}}:{allowed:!0,decision:"permit",reason:e.reason,argRedactionRules:[]}}function ir(e){if(!e.enforced)return{action:"allow",reason:e.reason,redactionRules:[]};let t=e.retrieval.action??"deny",n=e.retrieval.redactionRules??[];return t==="escalate"&&Ae(e.retrieval.hitlFallback,n)?{action:"redact",reason:e.reason,redactionRules:n}:{action:t,reason:e.reason,redactionRules:n}}var or=new Set;function wt(e){or.has(e)||(or.add(e),console.warn(`[VisIQ] unrecognized retrieval outcome "${e}" \u2014 failing closed (withholding content). Upgrade @visiq/harness if a newer control plane introduced this outcome.`))}async function We(e,t,n){let r=R.getStore(),o=z(r),i=await e.evaluate({operations:["retrieval"],agentId:t,...r?.session_id?{sessionId:r.session_id}:{},resourceType:n.resourceType??"document",resourceMetadata:n.resourceMetadata??{},...n.query!==void 0?{query:n.query}:{},...n.contentPreview!==void 0?{contentPreview:n.contentPreview}:{},...o?{telemetry:o}:{}});return ir(i)}async function Qe(e,t,n){return await e.awaitBundleReady(),We(e,t,n)}function ar(e,t,n=K()){switch(t.action){case"allow":case"escalate":return e;case"deny":return null;case"redact":{if(t.redactionRules.length===0)return e;try{return M(e,L(t.redactionRules))}catch{return n==="closed"?null:(v("redact-error","document redaction failed \u2014 document passed UNREDACTED"),e)}}default:return wt(String(t.action)),n==="closed"?null:(v("unknown-retrieval-verb",`unrecognized outcome "${String(t.action)}" \u2014 document passed through`),e)}}async function sr(e,t,n,r){if(!Array.isArray(e)||e.length===0)return e;await r.awaitBundleReady();let o=[];for(let i of e){let a=i,s=String(a.pageContent??a.text??a.content??""),l=a.metadata??{},c=await We(r,t,{resourceType:"document",resourceMetadata:l,query:n,contentPreview:s.slice(0,500)}),u=ar(i,c,re(r));u!==null&&o.push(u)}return o}async function lr(e,t,n){if(typeof e!="string")return e;await n.awaitBundleReady();let r;try{r=await We(n,t,{resourceType:"document",resourceMetadata:{content_preview:e.slice(0,500)},contentPreview:e.slice(0,500)})}catch(o){return re(n)==="closed"?"[RECALL] Retrieved context blocked \u2014 policy evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":(v("eval-error",`retrieval evaluation failed \u2014 text passed through: ${o instanceof Error?o.message:String(o)}`),e)}switch(r.action){case"allow":case"escalate":return e;case"deny":return"[RECALL] Retrieved context was blocked by policy.";case"redact":{if(r.redactionRules.length===0)return e;try{return M(e,L(r.redactionRules))}catch{return re(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("redact-error","text redaction failed \u2014 text passed UNREDACTED"),e)}}default:return wt(String(r.action)),re(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 text passed through`),e)}}var cr=4,ur=1e3;function He(e){return e.length===0?!1:e.some(t=>t!==null&&typeof t=="object"&&(typeof t.pageContent=="string"||typeof t.text=="string"||typeof t.content=="string"))}async function dr(e,t,n){let r=[];for(let o of e){let i=o,a=String(i.pageContent??i.text??i.content??""),s={...i.metadata??{},content_preview:a.slice(0,500)},l;try{l=await We(n,t,{resourceType:"document",resourceMetadata:s,contentPreview:a.slice(0,500)})}catch(u){if(re(n)==="closed")continue;v("eval-error",`document retrieval evaluation failed \u2014 document passed through: ${u instanceof Error?u.message:String(u)}`),r.push(o);continue}let c=ar(o,l,re(n));c!==null&&r.push(c)}return r}async function bt(e,t,n,r,o){if(r>cr||o.nodes++>ur)return e;if(Array.isArray(e)){if(He(e))return o.matched=!0,dr(e,t,n);let i=[];for(let a of e)i.push(await bt(a,t,n,r+1,o));return i}if(e!==null&&typeof e=="object"){let i=e,a={...i};for(let s of Object.keys(i))a[s]=await bt(i[s],t,n,r+1,o);return a}return e}async function Ye(e,t,n){if(await n.awaitBundleReady(),Array.isArray(e)&&He(e))return dr(e,t,n);if(e!==null&&typeof e=="object"){let r={nodes:0,matched:!1},o=await bt(e,t,n,0,r);if(r.matched)return o}return e}var Ea={blocked:!0,reason:"[RECALL] Retrieved context was blocked by policy."};function vt(e,t,n){if(t>cr||n.n++>ur)return e;if(Array.isArray(e))return He(e)?[]:e.map(r=>vt(r,t+1,n));if(e!==null&&typeof e=="object"){if(He([e]))return{...Ea};let r=e,o={};for(let i of Object.keys(r))o[i]=vt(r[i],t+1,n);return o}return e}function yt(e){return typeof e=="string"?"[RECALL] Retrieved context was blocked by policy.":Array.isArray(e)?[]:e!==null&&typeof e=="object"?vt(e,0,{n:0}):e}function pr(e,t,n=K()){let r=ir(t);switch(r.action){case"allow":case"escalate":return e;case"deny":return yt(e);case"redact":{if(r.redactionRules.length===0)return e;try{return M(e,L(r.redactionRules))}catch{return n==="closed"?yt(e):(v("redact-error","result redaction failed \u2014 result passed UNREDACTED"),e)}}default:return wt(String(r.action)),n==="closed"?yt(e):(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 result passed through`),e)}}function O(e){return typeof e=="object"&&e!==null?e:null}function fr(...e){for(let t of e)if(typeof t=="string"&&t.trim().length>0)return t}function Ra(e,t){let n=O(e.metadata),r=n&&typeof n.name=="string"?n.name:void 0;return fr(e.name,e.id,r,t)}function Ca(e){let t=O(e.metadata),n=t&&typeof t.description=="string"?t.description:void 0,r=fr(e.description,n);return r===void 0?void 0:r.slice(0,4e3)}function xa(e){let t=O(e);return t!==null&&("type"in t||"properties"in t||"$schema"in t)}function Oa(e){let t=O(e);if(t===null||!("_def"in t))return;let{shape:n}=t;if(typeof n=="function")try{n=n.call(t)}catch{n=void 0}let r=O(n);if(r===null)return{type:"object"};let o={};for(let i of Object.keys(r))o[i]={};return{type:"object",properties:o}}var Na=new Set(["default","const","enum","examples","example"]);function kt(e){if(Array.isArray(e))return e.map(kt);let t=O(e);if(t===null)return e;let n={};for(let[r,o]of Object.entries(t))Na.has(r)||(n[r]=kt(o));return n}function Ma(e){let t;if(xa(e))t=e;else{let n=Oa(e);if(n===void 0)return;t=n}try{let n=JSON.stringify(t);if(n.length>2e4){let r=O(t),o=r&&O(r.properties);if(o){let i={};for(let a of Object.keys(o))i[a]={};return{type:"object",properties:i}}return{type:"object"}}return kt(JSON.parse(n))}catch{return}}function La(e){let t=O(e.metadata),n=e.input_schema??e.inputSchema??e.parameters??e.schema??e.args_schema??e.tool_call_schema??(t?t.parameters:void 0);return n===void 0?void 0:Ma(n)}function Da(e,t){let n=O(e);if(n===null)return null;let r=Ra(n,t);if(r===void 0)return null;let o={name:r.slice(0,255)},i=Ca(n);i!==void 0&&(o.description=i);let a=La(n);return a!==void 0&&(o.input_schema=a),o}function Se(e){let t=[],n=new Set,r=(o,i)=>{try{let a=Da(o,i);a!==null&&!n.has(a.name)&&(n.add(a.name),t.push(a))}catch{}};if(Array.isArray(e)){for(let o of e)if(r(o),t.length>=200)break}else if(e instanceof Map){for(let[o,i]of e.entries())if(r(i,typeof o=="string"?o:void 0),t.length>=200)break}else{let o=O(e);if(o!==null){for(let i of Object.keys(o))if(r(o[i],i),t.length>=200)break}}return t}function At(e){try{let t=O(e);if(t===null)return[];let n=[],r=new Set,o=l=>{for(let c of l)!r.has(c.name)&&n.length<200&&(r.add(c.name),n.push(c))};t.tools!==void 0&&o(Se(t.tools));let i=O(t.settings);i&&i.tools!==void 0&&o(Se(i.tools));for(let l of["getTools","listTools"]){let c=t[l];if(typeof c=="function")try{o(Se(c.call(t)))}catch{}}let a=O(t.nodes);if(a)for(let l of Object.keys(a)){let c=O(a[l]);c&&c.tools!==void 0&&o(Se(c.tools))}let{agents:s}=t;if(s instanceof Map)for(let l of s.values()){let c=O(l);c&&c.tools!==void 0&&o(Se(c.tools))}return n}catch{return[]}}import{z as Je}from"zod";var $a=Je.object({decision:Je.enum(["permit","deny"]),reason:Je.string(),handoff_event_id:Je.string().nullable()}),j=class extends Error{constructor(e,t,n){super(e),this.code=t,this.status=n,this.name="OrchestrateError"}code;status},J=class extends j{constructor(e,t){super(`Orchestrate grant denied: ${e}`,"GRANT_DENIED"),this.reason=e,this.handoffEventId=t,this.name="GrantDeniedError"}reason;handoffEventId},Fa="https://api.visiqlabs.com",Pa=1e4,oe=class{config;fetch;constructor(e,t=globalThis.fetch){this.config={agentId:e.agentId,apiKey:e.apiKey??process.env.VISIQ_API_KEY??"",endpoint:e.endpoint??process.env.VISIQ_ENDPOINT??Fa,timeoutMs:e.timeoutMs??Pa},this.fetch=t}get headers(){return{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,"X-Agent-ID":this.config.agentId}}async post(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),o;try{o=await this.fetch(`${this.config.endpoint}${e}`,{method:"POST",headers:this.headers,body:JSON.stringify(t),signal:n.signal})}finally{clearTimeout(r)}let i=await o.json();if(!o.ok){let a=i?.error??`HTTP ${o.status}`;throw new j(a,"API_ERROR",o.status)}return i}async requestGrant(e){let t=await this.post("/orchestrate/grants",{parent_agent_id:e.parentAgentId,child_agent_id:e.childAgentId,tool_scope:e.toolScope??null,context_scope:e.contextScope??null,purpose:e.purpose,duration_seconds:e.durationSeconds,max_depth:e.maxDepth,parent_grant_token:e.parentGrantToken});return{grantId:t.grant_id,status:"pending",effectiveToolScope:t.effective_tool_scope,effectiveContextScope:t.effective_context_scope,acceptDeadline:t.accept_deadline}}async acceptGrant(e){let t=await this.post(`/orchestrate/grants/${e}/accept`,{});return{grantToken:t.grant_token,toolScope:t.tool_scope,contextScope:t.context_scope,expiresAt:t.expires_at}}async evaluate(e){let t=await this.post("/orchestrate/evaluate",{grant_token:e.grantToken,action:e.action,resource_type:e.resourceType,resource_metadata:e.resourceMetadata??{}}),n=$a.parse(t);return{decision:n.decision,reason:n.reason,handoffEventId:n.handoff_event_id}}async revokeGrant(e,t){return{revokedCount:(await this.post(`/orchestrate/grants/${e}/revoke`,{reason:t})).revoked_count}}};var mr=new Map;async function gr(e,t){if(!e||e.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: agentId is required");if(!t||t.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: grantId is required");let n=mr.get(e);if(n)return n;let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[ORCHESTRATE] bootstrapGrant: VISIQ_API_KEY env var is required");let o=process.env.VISIQ_ENDPOINT,i=(await new oe({agentId:e,apiKey:r,...o?{endpoint:o}:{}}).acceptGrant(t)).grantToken;if(!i||i.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: backend returned empty grant token");return mr.set(e,i),i}var Te=Symbol.for("visiq.orchestrate.wrapped");function ja(e){return e instanceof j&&typeof e.status=="number"&&e.status>=400&&e.status<500}function hr(e,t){if(!t.agentId||t.agentId.trim()==="")throw new j("agentId is required","CONFIG_ERROR");if(!t.grantToken||t.grantToken.trim()==="")throw new j("grantToken is required","CONFIG_ERROR");if(e[Te]===!0)return e;let n=new oe(t),r=t.failBehavior??(process.env.VISIQ_FAIL_MODE?.trim().toLowerCase()==="closed"?"deny":"permit"),o=async(i,a)=>{let s;try{s=await n.evaluate({grantToken:t.grantToken,action:i,resourceType:a})}catch(l){if(ja(l))throw l;if(r==="permit"){console.warn('[VisIQ] FAIL-OPEN (orchestrate-eval-error): evaluate failed \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed (or failBehavior:"deny") to block instead.',l);return}throw new j(`ORCHESTRATE evaluate failed: ${l instanceof Error?l.message:String(l)}`,"EVALUATE_ERROR")}if(s.decision==="deny")throw new J(s.reason,s.handoffEventId)};return new Proxy(e,{get(i,a,s){let l=Reflect.get(i,a,s);return a===Te?!0:a==="_call"&&typeof l=="function"?async function(c,...u){let d=i.name;return await o(d??"_call"),l.call(this??i,c,...u)}:(a==="call"||a==="execute"||a==="run")&&typeof l=="function"?async function(c,...u){let d=i.name;return await o(d??String(a)),l.call(this??i,c,...u)}:l}})}import{randomUUID as kr}from"node:crypto";var _r=Symbol.for("visiq.semantickernel.instrumented");function vr(e){if(e===null||typeof e!="object")return!1;let t=e;return typeof t.useFunctionInvocation=="function"&&typeof t.usePromptRender=="function"&&typeof t.execute!="function"&&typeof t.generate!="function"&&typeof t.run!="function"}function yr(e){let t=e.arguments;return t&&typeof t=="object"&&"arguments"in t&&t.arguments&&typeof t.arguments=="object"?t.arguments:t??{}}function br(e,t){let n=e.arguments;if(n&&typeof n=="object"&&"arguments"in n&&n.arguments&&typeof n.arguments=="object"){let r=n.arguments;for(let o of Object.keys(r))delete r[o];Object.assign(r,t);return}e.arguments=t}function B(e,t){e.result&&typeof e.result=="object"?e.result.value=t:e.result={value:t}}function Ua(e){return e.result?.value}function Ba(e){let{agentId:t,unified:n,failMode:r}=e;return async function(i,a){let s=i.function?.metadata?.name??"unknown",l=i.function?.metadata?.pluginName,c=yr(i),u=l;try{let p=await n.evaluate({operations:["action"],agentId:t,toolName:s,toolArgs:c,...u!==void 0?{targetResource:u}:{}}),y=Y(p);if(!y.allowed){B(i,E({outcome:"deny",code:y.ruleCode??"DENY",reason:y.reason}));return}y.decision==="mask"&&y.argRedactionRules.length>0&&br(i,M(c,L(y.argRedactionRules)));let C=yr(i),A=ne(s,C,{failMode:r==="closed"?"closed":"open",enforced:p.enforced});if(A.verdict==="block"){B(i,E({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${A.detectors.join(",")})`}));return}A.verdict==="redact"&&(br(i,A.redacted),v("outbound-secret-redacted",`outbound secret screen redacted ${A.detectors.length} detector(s): ${A.detectors.join(",")}`))}catch(p){if(r==="closed"){B(i,E({outcome:"error",code:"EVAL-ERROR",mechanism:`evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}`}));return}v("eval-error",`SK action pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}try{let p=await Qe(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l}});if(p.action==="deny"||p.action==="escalate"){B(i,`[RECALL: access denied \u2014 ${p.reason}]`);return}}catch(p){if(r==="closed"){B(i,`[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}.`);return}v("eval-error",`SK retrieval pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}await a(i);let d=Ua(i),_=(typeof d=="string"?d:(()=>{try{return JSON.stringify(d)??String(d)}catch{return String(d)}})()).slice(0,500),g;try{g=await Qe(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l,content_preview:_},contentPreview:_})}catch(p){r==="closed"?B(i,"[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("eval-error",`SK post-result retrieval eval failed for "${s}": ${p instanceof Error?p.message:String(p)}`);return}if(g.action==="deny"||g.action==="escalate"){B(i,`[RECALL: access denied \u2014 ${g.reason}]`);return}if(g.action==="redact"&&g.redactionRules&&g.redactionRules.length>0&&d!==null&&d!==void 0)try{B(i,M(d,L(g.redactionRules)))}catch(p){r==="closed"?B(i,"[RECALL] Result withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("redact-error",`SK result redaction failed for "${s}" \u2014 result passed UNREDACTED: ${p instanceof Error?p.message:String(p)}`)}}}function qa(e){return async function(n,r){await r(n);let o=n.renderedPrompt;if(typeof o!="string"||o.length===0)return;let i;try{i=await Qe(e.unified,e.agentId,{resourceType:"prompt",resourceMetadata:{},contentPreview:o.slice(0,500)})}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("eval-error",`SK prompt-render eval failed: ${a instanceof Error?a.message:String(a)}`);return}if(i.action==="redact"&&i.redactionRules&&i.redactionRules.length>0){try{n.renderedPrompt=M(o,L(i.redactionRules))}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("redact-error",`SK prompt redaction failed \u2014 prompt passed UNREDACTED: ${a instanceof Error?a.message:String(a)}`)}return}(i.action==="deny"||i.action==="escalate")&&(n.renderedPrompt=`[RECALL: prompt suppressed \u2014 ${i.reason}]`)}}function wr(e,t){let n=e;if(n[_r]===!0)return t.onWrap?.(),e;let r=Ba(t),o=qa(t),i=!1;return Array.isArray(n._functionInvocationFilters)?(n._functionInvocationFilters.unshift(r),i=!0):typeof n.useFunctionInvocation=="function"&&(n.useFunctionInvocation(r),i=!0),typeof n.usePromptRender=="function"?n.usePromptRender(o):Array.isArray(n._promptRenderFilters)&&n._promptRenderFilters.push(o),i&&(n[_r]=!0,t.onWrap?.()),e}function E(e){let t=/^D-/.test(e.code),n;e.outcome==="approval_required"?n="requires human approval, which was not granted":e.outcome==="error"?n="was blocked (fail-closed) after a policy-evaluation error":n="was denied by policy";let r=e.reason?.trim(),o;r?o=r:t?o="no policy rule covers this action, so the organization default applied":e.outcome==="approval_required"?o="this action is routed to a human for approval":o="denied by policy";let i=e.mechanism?.trim()?` \u2014 ${e.mechanism.trim()}`:"";return`[VisIQ decision=${e.outcome} code=${e.code}] This tool call was NOT executed: it ${n} (${o})${i}. VisIQ is a security harness installed by your developer. Report this reason to the user verbatim; do not invent a different one.`}function Ze(e){return e instanceof Error?e.message:String(e)}var Va=/https?:\/\/[^\s"'`,)}\]]+/;function It(e){let t=e.match(Va);if(t)try{let n=new URL(t[0]);return n.hostname+n.pathname}catch{return t[0]}}var ie=Symbol.for("visiq.toolexec.instrumented");function za(e){return e!==null&&typeof e=="object"&&typeof e.execute=="function"}var St={vercel:"Vercel AI SDK agent",mastra:"Mastra Agent",openai:"OpenAI Agents SDK agent",llamaindex:"LlamaIndex.TS agent",voltagent:"VoltAgent agent","semantic-kernel":"Semantic Kernel"};function Ar(e){if(e===null||typeof e!="object")return null;let t=e;if(za(t))return null;if(vr(e))return"semantic-kernel";if(typeof t.generateText=="function"&&(typeof t.getTools=="function"||t.toolManager!==void 0))return"voltagent";if(typeof t.run=="function"&&typeof t.runStream=="function"&&t.agents!==void 0)return"llamaindex";if(Array.isArray(t.tools)&&t.handoffs!==void 0&&(typeof t.on=="function"||t.eventEmitter!==void 0))return"openai";if(typeof t.generate=="function"&&typeof t.getLLM=="function"&&(typeof t.listTools=="function"||typeof t.getTools=="function"))return"mastra";if(typeof t.generate=="function"){let n=t.settings;if(n&&typeof n=="object"&&n.tools!==void 0||t.tools!==void 0)return"vercel"}return null}async function Ka(e,t,n,r,o,i){let{agentId:a,unified:s}=e,l=z(o),c,u=!1;try{await s.awaitBundleReady();let p=await s.evaluate({operations:i?["action","delegation"]:["action"],agentId:a,toolName:t,toolArgs:n,...i?{context:Ge(i,a)}:{},...o?.session_id?{sessionId:o.session_id}:{},...r!==void 0?{targetResource:r}:{},...l?{telemetry:l}:{}});({enforced:u}=p),c=Y(p)}catch(p){let y=p instanceof Error?p.message:String(p);return e.failMode==="closed"?{block:E({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${y} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})}:(v("eval-error",`policy evaluation failed for tool "${t}": ${y}`),{block:null})}if(c.decision==="approval_required"&&c.decisionId){let p=s.getApiKey()??e.apiKey,y=await Ie({endpoint:s.getEndpoint()??e.endpoint??"",...p?{apiKey:p}:{},decisionId:c.decisionId,timeoutMs:e.hitlTimeoutMs,sdkVersion:V});return y.resolution!=="proceed"?{block:E({outcome:"approval_required",code:c.ruleCode??"HITL-BLOCK",reason:c.reason,mechanism:y.reason}),decision:c}:{block:null}}if(!c.allowed)return{block:E({outcome:"deny",code:c.ruleCode??"DENY",reason:c.reason}),decision:c};let d=n,f=!1,_;if(c.decision==="mask"&&c.argRedactionRules&&c.argRedactionRules.length>0)try{let p=L(c.argRedactionRules);d=M(n,p),f=!0,_=c}catch(p){let y=p instanceof Error?p.message:String(p);if(e.failMode==="closed")return{block:E({outcome:"error",code:"MASK-ERROR",mechanism:`argument masking failed: ${y} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})};v("mask-error",`argument masking failed for tool "${t}" \u2014 running with UNMASKED args: ${y}`)}let g=ne(t,d,{failMode:e.failMode==="closed"?"closed":"open",enforced:u});return g.verdict==="block"?{block:E({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${g.detectors.join(",")})`}),decision:{allowed:!1,decision:"deny",ruleCode:"OUTPUT-BLOCK",reason:"outbound content carried a live secret",argRedactionRules:[]}}:(g.verdict==="redact"&&(d=g.redacted,f=!0,v("outbound-secret-redacted",`outbound secret screen redacted ${g.detectors.length} detector(s): ${g.detectors.join(",")}`),_??={allowed:!0,decision:"mask",ruleCode:"OUTPUT-BLOCK",reason:"outbound secret redacted before egress",argRedactionRules:[]}),f?{block:null,maskedArgs:d,decision:_}:{block:null})}async function Tt(e,t,n,r,o){let i=R.getStore()??e.telemetry,a=Ke(t,n);a&&me(e.unified,{agentId:e.agentId,sessionId:i?.session_id,...e.framework?{framework:e.framework}:{}},a);let s={agentId:e.agentId,sessionId:i?.session_id,...e.framework?{framework:e.framework}:{}},l=de(t,n);try{ge(e.unified,s,{toolName:t,...l?{memory:l}:{},argSummary:r.slice(0,512)})}catch(g){U("step-beat",`emit failed for tool "${t}": ${Ze(g)}`)}let c=Date.now(),u=await Ka(e,t,n,It(r),i,a);if(u.block!==null){try{u.decision&&ee(e.unified,s,{toolName:t,decision:u.decision.decision??"deny",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0,harnessMessage:u.block})}catch(g){U("intervention-beat",`emit failed for tool "${t}": ${Ze(g)}`)}return u.block}if(u.maskedArgs!==void 0&&u.decision)try{ee(e.unified,s,{toolName:t,decision:u.decision.decision??"mask",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0})}catch(g){U("intervention-beat",`emit failed for tool "${t}": ${Ze(g)}`)}let d=u.maskedArgs??n,f=await o(d),_=await Ye(f,e.agentId,e.unified);try{he(e.unified,s,{toolName:t,ok:!0,durationMs:Date.now()-c,...W(_)!==void 0?{bytes:W(_)}:{},...Q(_)!==void 0?{itemCount:Q(_)}:{},...l?{memory:l}:{}})}catch(g){U("observation-beat",`emit failed for tool "${t}": ${Ze(g)}`)}return _}function Xe(e,t,n){let r=e;if(r[ie]){n.onWrap?.();return}if(typeof r.execute!="function")return;let o=r.execute;Rt(r,"execute",async function(...a){let s=ht(a[0]);return Tt(n,t,s,Re(s),l=>Promise.resolve(o.apply(this,[l,...a.slice(1)])))}),r[ie]=!0,n.onWrap?.()}function Ga(e,t,n){let r=e;if(r[ie]){n.onWrap?.();return}if(typeof r.invoke!="function")return;let o=r.invoke;Rt(r,"invoke",async function(...a){let s=a[1],l=er(s),c=typeof s=="string"?s:Re(l);return Tt(n,t,l,c,u=>{let d=typeof s=="string"?JSON.stringify(u):u;return Promise.resolve(o.apply(this,[a[0],d,...a.slice(2)]))})}),r[ie]=!0,n.onWrap?.()}function Ha(e,t){let n=e;if(n[ie]){t.onWrap?.();return}if(typeof n.call!="function")return;let r=n.metadata,o=typeof r?.name=="string"?r.name:"unknown",i=n.call;Rt(n,"call",async function(...s){let l=ht(s[0]);return Tt(t,o,l,Re(l),c=>Promise.resolve(i.apply(this,[c,...s.slice(1)])))}),n[ie]=!0,t.onWrap?.()}function Ir(e,t){for(let[n,r]of Object.entries(e))r!==null&&typeof r=="object"&&Xe(r,n,t);return e}function Sr(e,t,n){let r={...t,framework:n};switch(n){case"vercel":return Wa(e,r);case"mastra":return Qa(e,r);case"openai":return Za(e,r);case"llamaindex":return Ja(e,r);case"voltagent":return Ya(e,r);case"semantic-kernel":return wr(e,r);default:return e}}function Wa(e,t){let n=e,r=n.settings&&typeof n.settings=="object"?n.settings:void 0,o=r?.tools??n.tools;return o&&typeof o=="object"&&Ir(o,t),r&&!r.__visiq_step&&(r.__visiq_step=!0,r.onStepFinish=Et(r.onStepFinish)),et(e,["generate","stream"],async(i,a)=>(Ee(a,i[0]),i)),e}function Qa(e,t){let r=ns(e);return r&&Ir(r,t),et(e,["generate","stream","generateVNext","streamVNext"],async(o,i)=>{Ee(i,o[0]);let a=o[1]&&typeof o[1]=="object"?{...o[1]}:{};a.onStepFinish=Et(a.onStepFinish);let s=[...o];return s[1]=a,s}),e}function Ya(e,t){let n=es(e);if(n){for(let r of n)if(r!==null&&typeof r=="object"){let{name:o}=r;Xe(r,typeof o=="string"?o:"unknown",t)}}return et(e,["generateText","streamText","generateObject","streamObject"],async(r,o)=>{Ee(o,r[0]);let i=r[1]&&typeof r[1]=="object"?{...r[1]}:{};i.onStepFinish=Et(i.onStepFinish);let a=[...r];return a[1]=i,a}),e}function Ja(e,t){let n=e,r=i=>{let a=i?.tools;if(Array.isArray(a))for(let s of a)s!==null&&typeof s=="object"&&Ha(s,t)},{agents:o}=n;if(o instanceof Map)for(let i of o.values())r(i);else Array.isArray(n.tools)&&r(n);return et(e,["run"],async(i,a)=>(Ee(a,i[0]),i)),ts(e,"runStream",(i,a,s)=>{s||Ee(a,i[0])}),e}function Za(e,t){let n=e,{tools:r}=n;if(Array.isArray(r)){for(let o of r)if(o!==null&&typeof o=="object"){let{name:i}=o;Ga(o,typeof i=="string"?i:"unknown",t)}}return Xa(e,t),e}function Xa(e,t){let n=e;if(n.__visiq_openai_hooks||typeof n.on!="function")return;let r=n.on,{telemetry:o}=t;r.call(e,"agent_start",(...i)=>{o.session_id=kr(),o.llm_prompts=[],o.llm_responses=[],o.agent_reasoning=[],o.retrieverQueries=new Map;let a=i[2];a!=null&&o.llm_prompts.push(Re(a).slice(0,5120))}),r.call(e,"agent_end",(...i)=>{let a=i[1];typeof a=="string"&&a&&o.llm_responses.push(a.slice(0,5120))}),n.__visiq_openai_hooks=!0}function es(e){let t=r=>Array.isArray(r)&&r.some(o=>o!==null&&typeof o.execute=="function");if(typeof e.getTools=="function")try{let r=e.getTools();if(t(r))return r}catch{}let n=e.toolManager;if(n&&typeof n.getAllBaseTools=="function")try{let r=n.getAllBaseTools();if(t(r))return r}catch{}return t(e.tools)?e.tools:null}function et(e,t,n){let r=e;for(let o of t){if(typeof r[o]!="function")continue;let i=`__visiq_wrapped_${o}`;if(r[i])continue;let a=r[o];r[o]=function(...s){let l=Tr();return R.run(l,async()=>{let c=await n(s,l);return a.apply(e,c)})},r[i]=!0}}function ts(e,t,n){let r=e;if(typeof r[t]!="function")return;let o=`__visiq_wrapped_${t}`;if(r[o])return;let i=r[t];r[t]=function(...a){let s=R.getStore(),l=s??Tr();return n(a,l,s!==void 0),R.run(l,()=>i.apply(e,a))},r[o]=!0}function Et(e){return t=>{let n=R.getStore(),r=t;if(n&&typeof r?.text=="string"&&r.text&&n.llm_responses.push(r.text.slice(0,5120)),typeof e=="function")return e(t)}}function Ee(e,t){if(t==null)return;let n=t;if(typeof t=="object"){let r=t;n=r.prompt??r.messages??t}e.llm_prompts.push(Re(n).slice(0,5120))}function ns(e){for(let t of["listTools","getTools"])if(typeof e[t]=="function")try{let n=e[t]();if(n&&typeof n=="object"&&typeof n.then!="function")return n}catch{}return null}function Tr(){return{session_id:kr(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function Rt(e,t,n){try{e[t]=n}catch{Object.defineProperty(e,t,{value:n,writable:!0,configurable:!0,enumerable:!0})}}function Re(e){try{return JSON.stringify(e)??String(e)}catch{return String(e)}}function $r(e,t){let n=ls(t);if(e[Te]===!0)return e;let r=ps(e);if(r==="langchain-executor"||r==="langchain-graph")return se(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,Rr(r,null),n.failMode,{model:Cr(e)}),Or(e,n),fs(e,n);let o=Ar(e);if(o){se(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,Rr("unknown",o),n.failMode,{model:Cr(e)}),Or(e,n);let i=0,a=Br(n);a.onWrap=()=>{i+=1};let s=Sr(e,a,o);if(i===0){let l=0;try{l=At(e).length}catch{l=0}if(l>0){let c=`[VisIQ] Detected a ${St[o]} that ADVERTISES ${String(l)} tool(s) but instrumented ZERO of them \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a tool bag that moved/renamed on a framework version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.`;if(n.onInstrumentFailure!==void 0?n.onInstrumentFailure==="throw":n.failMode==="closed")throw new Error(c);v("zero-instrument",`advertised ${String(l)} tool(s), instrumented none`),console.warn(c)}else{let c=`[VisIQ] Detected a ${St[o]} with no tools to instrument (the agent advertises none). If it is intentionally tool-less (LLM-only) this is safe to ignore; otherwise its tool bag is not where this SDK looks for it \u2014 upgrade @visiq/harness or pass the tools through visiq() (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw) to fail closed here.`;if(n.onInstrumentFailure==="throw")throw new Error(c);console.warn(c)}}return s}if(vs(e)){let i=process.env.VISIQ_GRANT_ID;return i?ks(e,n,i):As(e,n)}throw new Error("[VisIQ] Cannot detect agentic framework. Pass a LangChain AgentExecutor, LangGraph CompiledGraph, or a tool with one of: _call, execute, call, run, invoke.")}var is="https://api.visiqlabs.com",as="\0",Er=new Map;function Rr(e,t){if(e==="langchain-executor"||e==="langchain-graph")return"langchain";switch(t){case"vercel":return"vercel_ai";case"mastra":return"mastra";case"openai":return"openai_agents";case"llamaindex":return"llamaindex";case"voltagent":return"voltagent";case"semantic-kernel":return"semantic_kernel";default:return}}function Cr(e){try{if(typeof e!="object"||e===null)return;let t=e,n=ae(t.model);if(n)return n;let{settings:r}=t;if(typeof r=="object"&&r!==null){let a=ae(r.model);if(a)return a}let{llm:o}=t;if(typeof o=="object"&&o!==null){let a=xr(o);if(a)return a}let{agents:i}=t;if(i instanceof Map){for(let a of i.values())if(typeof a=="object"&&a!==null){let s=a,l=s.llm,c=ae(s.model)??(typeof l=="object"&&l!==null?xr(l):void 0);if(c)return c}}return}catch{return}}function xr(e){return ae(e.model)??ae(e.modelId)??ae(e.model_name)}function ae(e){if(typeof e=="string"&&e.trim().length>0)return e.trim();if(typeof e=="object"&&e!==null){let t=e;for(let n of["modelId","model_id","id","model","modelName","model_name"]){let r=t[n];if(typeof r=="string"&&r.trim().length>0)return r.trim()}}}function se(e,t,n,r,o,i,a){let s=[e??"",t??"",n??"",r??"",i??""].join(as),l=Er.get(s);return l||(l=new Xn(e,t,n,void 0,r,V,ot),l.registerHostEnvironment(o,a),Er.set(s,l)),i!==void 0&&l.setFailMode(i),l}function Or(e,t){try{let n=At(e);n.length>0&&se(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode).reportToolSurface(n)}catch{}}function ss(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_TIMEOUT_MS;if(t!==void 0){let n=Number.parseInt(t,10);if(Number.isFinite(n)&&n>0)return n}}function ls(e){let t=e?.agentId??process.env.VISIQ_AGENT_ID??us(),n=e?.apiKey??process.env.VISIQ_API_KEY,r=e?.endpoint??process.env.VISIQ_ENDPOINT??(n?is:void 0);return{agentId:t,apiKey:n,endpoint:r,hitlTimeoutMs:ds(e?.hitlTimeoutMs),timeoutMs:ss(e?.timeoutMs),onInstrumentFailure:e?.onInstrumentFailure??cs(),failMode:K(e?.failMode)}}function cs(){let e=process.env.VISIQ_ON_INSTRUMENT_FAILURE;if(e==="throw")return"throw";if(e==="warn")return"warn"}function us(){let e=t=>t.toLowerCase().replace(/^@[^/]+\//,"").replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,255);try{let t=process.cwd();for(let n=0;n<64;n++){let r=nt.join(t,"package.json");if(tt.existsSync(r)){let i=JSON.parse(tt.readFileSync(r,"utf8"));if(typeof i.name=="string"&&i.name.trim()){let a=e(i.name);if(a)return a}break}let o=nt.dirname(t);if(o===t)break;t=o}}catch{}try{let t=e(Dr.hostname());if(t)return t}catch{}return"agent"}function ds(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_HITL_TIMEOUT_MS;if(t){let n=Number(t);if(Number.isFinite(n)&&n>0)return n}return _t}function ps(e){let t=e;return typeof t.invoke=="function"&&t.agent&&Array.isArray(t.tools)?"langchain-executor":typeof t.invoke=="function"&&t.nodes&&(t.edges||t.lg_is_pregel===!0||typeof t.builder=="object"&&t.builder!==null&&t.builder.edges)?"langchain-graph":"unknown"}function fs(e,t){let n=e,r=se(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode),o=ms(n);for(let l of o)Ot(l,t.agentId,r),_s(l,t.agentId,r,t),jr(l,r,t);let{nodes:i}=n;if(!!i&&typeof i=="object"&&"tools"in i&&o.length===0){let l="[VisIQ] Detected a LangGraph agent whose compiled graph carries a ToolNode, but resolved ZERO tools from it \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a compiled-graph tool bag that moved on a @langchain/langgraph version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.";if(t.onInstrumentFailure!==void 0?t.onInstrumentFailure==="throw":t.failMode==="closed")throw new Error(l);v("zero-instrument","langgraph compiled-graph ToolNode present, resolved no tools"),console.warn(l)}let s=n.invoke;if(n.invoke=function(l,c){let u=xt(),d=Lr(t.agentId,r),f=c?.callbacks??[];return R.run(u,()=>s.call(this,l,{...c,callbacks:[...f,d]}))},typeof n.stream=="function"){let l=n.stream;n.stream=function(c,u){let d=xt(),f=Lr(t.agentId,r),_=u?.callbacks??[];return R.run(d,()=>l.call(this,c,{...u,callbacks:[..._,f]}))}}return e}function ms(e){let t=[],n=new Set,r=i=>{if(Array.isArray(i))for(let a of i)a&&typeof a=="object"&&!n.has(a)&&(n.add(a),t.push(a))};r(e.tools);let{nodes:o}=e;if(o&&typeof o=="object"){for(let i of Object.values(o))if(i&&typeof i=="object"){let a=i;r(a.tools);let{bound:s}=a;s&&typeof s=="object"&&r(s.tools)}}return t}function xt(){return{session_id:rs(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function Ot(e,t,n){let r=e,o=Symbol.for("visiq.recall.instrumented");if(!r[o]){if(typeof r._getRelevantDocuments=="function"){let i=r._getRelevantDocuments;r._getRelevantDocuments=async function(a,s){let l=await i.call(this,a,s);return Nr(l,t,a,n)},r[o]=!0}if(typeof r.retrieve=="function"&&!r._getRelevantDocuments){let i=r.retrieve;r.retrieve=async function(a){let s=await i.call(this,a);return Nr(s,t,String(a),n)},r[o]=!0}r.retriever&&typeof r.retriever=="object"&&Ot(r.retriever,t,n)}}var gs=Symbol.for("visiq.operations"),hs=new Set(["action","retrieval","delegation"]);function Fr(e){if(typeof e!="object"||e===null)return;let t=e[gs]??e.visiqOperations;if(!Array.isArray(t))return;let n=t.filter(r=>typeof r=="string"&&hs.has(r));return n.length>0?Array.from(new Set(n)):void 0}function _s(e,t,n,r){let o=e,i=Symbol.for("visiq.recall.tool-instrumented");if(o[i]||typeof o.func!="function")return;let a=typeof o.name=="string"?o.name:"",s=typeof o.retriever=="object"&&o.retriever!==null,l=a.split(/[^a-zA-Z0-9]+|(?<=[a-z])(?=[A-Z])/).map(I=>I.toLowerCase()),c=new Set(["update","delete","create","write","archive","insert","remove","patch"]),u=new Set(["send","post","put"]),d=l.some(I=>c.has(I)),f=u.has(l[0]??""),_=d||f,g=["update","delete","create","archive","insert","remove"],p=l.some(I=>g.some(b=>I.length>b.length&&I.endsWith(b))),C=/retriev/i.test(a)||/search.*doc|knowledge/i.test(a)&&!_&&!p,A=Fr(o),T=A?.includes("retrieval")??!1;if(A!==void 0&&!T||!(s||C||T))return;let Ne=A?T&&A.includes("action"):d||p;if(!Ne)if(s)Ot(o.retriever,t,n);else{let I=globalThis,b=Symbol.for("visiq.recall.closureRetrieverWarned"),F=I[b]??=new Set;F.has(a)||(F.add(a),console.warn(`[VisIQ] Retriever tool "${a||"(unnamed)"}" exposes no reachable retriever (e.g. LangChain createRetrieverTool returns a joined string). RECALL masks its output via value-shape + whole-result rules, but PER-DOCUMENT metadata/classification rules cannot apply to a metadata-less joined string. For full per-doc governance, pass the retriever to visiq() directly, or use a tool that returns a Document[].`))}let G=o.func;Ne?(o[Pr]=!0,o.func=async function(...I){await n.awaitBundleReady();let b=I[0],F=typeof b=="object"&&b!==null?b:{input:b},ce=typeof F.query=="string"?F.query:void 0,w=R.getStore(),k=z(w),N;try{N=await n.evaluate({operations:["retrieval","action"],agentId:t,...w?.session_id?{sessionId:w.session_id}:{},toolName:a||"unknown",toolArgs:F,resourceType:"document",resourceMetadata:{},...ce!==void 0?{query:ce}:{},...k?{telemetry:k}:{}})}catch(D){let ue=D instanceof Error?D.message:String(D);return K(r?.failMode)==="closed"?E({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${ue} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for hybrid tool "${a||"unknown"}": ${ue}`),G.apply(this,I))}let S=Y(N),rt=Ae(S.hitlFallback,S.argRedactionRules),Nt=I,Mt=()=>{try{return Nt=[M(F,L(S.argRedactionRules)),...I.slice(1)],null}catch{return K(r?.failMode)==="closed"?E({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a||"unknown"}" \u2014 running with UNMASKED args`),null)}};if(S.decision==="approval_required"&&S.decisionId&&r){let D=await Ie({endpoint:n.getEndpoint()??r.endpoint??"",apiKey:n.getApiKey()??r.apiKey,decisionId:S.decisionId,timeoutMs:r.hitlTimeoutMs,maskFallback:rt,sdkVersion:V});if(D.resolution==="mask"){let ue=Mt();if(ue)return ue}else if(D.resolution!=="proceed")return E({outcome:"approval_required",code:S.ruleCode??"HITL-BLOCK",reason:S.reason,mechanism:D.reason})}else if(!S.allowed)return E({outcome:"deny",code:S.ruleCode??"DENY",reason:S.reason});if(S.decision==="mask"&&S.argRedactionRules.length>0){let D=Mt();if(D)return D}let zr=await G.apply(this,Nt);return pr(zr,N,r?.failMode)}):o.func=async function(...I){let b=await G.apply(this,I);return typeof b=="string"?lr(b,t,n):Ye(b,t,n)},o[i]=!0}var Pr=Symbol.for("visiq.hybrid.instrumented");async function Nr(e,t,n,r){return sr(e,t,n,r)}var Mr=["invoke","call","_call"],Z=new os;function jr(e,t,n){let r=e,o=Symbol.for("visiq.allow.instrumented");if(r[o]||typeof r._getRelevantDocuments=="function"||r[Pr]||Fr(r)?.every(c=>c==="retrieval")||!Mr.some(c=>typeof r[c]=="function"))return;let{agentId:i}=n,a=typeof r.name=="string"?r.name:"unknown",s=Symbol("visiq.gate"),l=async(c,u,d,f,_)=>{let g=Z.getStore();if(g!==void 0&&g.gateKey===s&&!g.entered.has(_))return g.entered.add(_),c.call(u,d,...f);let p;if(typeof d=="string")p=d;else{let w=d?.input;p=w!=null?String(w):JSON.stringify(d)??""}let y=R.getStore(),C=z(y),A=typeof d=="object"&&d!==null?d:{input:p},T=Ke(a,A);T&&me(t,{agentId:i,sessionId:y?.session_id,framework:"langchain"},T);let Oe={agentId:i,sessionId:y?.session_id,framework:"langchain"},le=de(a,A);try{ge(t,Oe,{toolName:a,...le?{memory:le}:{},argSummary:p.slice(0,512)})}catch(w){U("step-beat",`emit failed for tool "${a}": ${Ct(w)}`)}let Ne=Date.now(),G=async w=>{let k=await w();try{he(t,Oe,{toolName:a,ok:!0,durationMs:Date.now()-Ne,...W(k)!==void 0?{bytes:W(k)}:{},...Q(k)!==void 0?{itemCount:Q(k)}:{},...le?{memory:le}:{}})}catch(N){U("observation-beat",`emit failed for tool "${a}": ${Ct(N)}`)}return k},I=(w,k,N,S)=>{try{ee(t,Oe,{toolName:a,decision:w,...k?{ruleCode:k}:{},...N?{ruleLabel:N}:{},enforced:!0,...S?{harnessMessage:S}:{}})}catch(rt){U("intervention-beat",`emit failed for tool "${a}": ${Ct(rt)}`)}};await t.awaitBundleReady();let b,F=!1;try{let w=await t.evaluate({operations:T?["action","delegation"]:["action"],agentId:i,...y?.session_id?{sessionId:y.session_id}:{},toolName:a,toolArgs:A,targetResource:It(p),...C?{telemetry:C}:{},...T?{context:Ge(T,i)}:{}});({enforced:F}=w),b=Y(w)}catch(w){let k=w instanceof Error?w.message:String(w);return n.failMode==="closed"?E({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${k} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for tool "${a}": ${k}`),Z.run({gateKey:s,entered:new Set([_])},()=>c.call(u,d,...f)))}let ce=w=>{let k=ne(a,w,{failMode:n.failMode==="closed"?"closed":"open",enforced:F});if(k.verdict==="block"){let S=E({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${k.detectors.join(",")})`});return I("deny","OUTPUT-BLOCK","outbound content carried a live secret",S),S}let N=w;return k.verdict==="redact"&&(N=k.redacted,v("outbound-secret-redacted",`outbound secret screen redacted ${k.detectors.length} detector(s): ${k.detectors.join(",")}`),I("mask","OUTPUT-BLOCK","outbound secret redacted before egress")),G(()=>Z.run({gateKey:s,entered:new Set([_])},()=>c.call(u,N,...f)))};if(b.decision==="approval_required"&&b.decisionId){let w=Ae(b.hitlFallback,b.argRedactionRules),k=await Ie({endpoint:t.getEndpoint()??n.endpoint??"",apiKey:t.getApiKey()??n.apiKey,decisionId:b.decisionId,timeoutMs:n.hitlTimeoutMs,maskFallback:w,sdkVersion:V});if(k.resolution==="proceed")return G(()=>Z.run({gateKey:s,entered:new Set([_])},()=>c.call(u,d,...f)));if(k.resolution==="mask")try{let S=M(d,L(b.argRedactionRules));return I("mask",b.ruleCode,b.reason),G(()=>Z.run({gateKey:s,entered:new Set([_])},()=>c.call(u,S,...f)))}catch{return n.failMode==="closed"?E({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`HITL mask fallback failed for tool "${a}" \u2014 running with UNMASKED args`),Z.run({gateKey:s,entered:new Set([_])},()=>c.call(u,d,...f)))}let N=E({outcome:"approval_required",code:b.ruleCode??"HITL-BLOCK",reason:b.reason,mechanism:k.reason});return I("approval_required",b.ruleCode,b.reason,N),N}if(!b.allowed){let w=E({outcome:"deny",code:b.ruleCode??"DENY",reason:b.reason});return I("deny",b.ruleCode,b.reason,w),w}if(b.decision==="mask"&&b.argRedactionRules.length>0)try{let w=M(d,L(b.argRedactionRules));return I("mask",b.ruleCode,b.reason),ce(w)}catch{return n.failMode==="closed"?E({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a}" \u2014 running with UNMASKED args`),Z.run({gateKey:s,entered:new Set([_])},()=>c.call(u,d,...f)))}return ce(d)};for(let c of Mr){if(typeof r[c]!="function")continue;let u=r[c];r[c]=function(d,...f){return l(u,this,d,f,c)}}r[o]=!0}function Ct(e){return e instanceof Error?e.message:String(e)}function ys(e,t,n){let r=(a,s)=>{if(!a||typeof a!="object")return;let l=a[s];return typeof l=="string"&&l.length>0?l:void 0},o=t?.invocation_params,i=e&&typeof e=="object"?e.kwargs:void 0;return r(o,"model")??r(o,"model_name")??r(n,"ls_model_name")??r(i,"model")??r(i,"model_name")}function bs(e,t){let n=(_,g)=>{if(!_||typeof _!="object")return;let p=_[g];return typeof p=="number"&&Number.isFinite(p)?p:void 0},r=e?.tokenUsage,o=n(r,"promptTokens"),i=n(r,"completionTokens");if(o!==void 0||i!==void 0)return{...o!==void 0?{tokensIn:o}:{},...i!==void 0?{tokensOut:i}:{}};let a=t?.usage_metadata,s=n(a,"input_tokens"),l=n(a,"output_tokens");if(s===void 0&&l===void 0)return;let c=a&&typeof a=="object"?a.input_token_details:void 0,u=n(c,"cache_read"),d=n(c,"cache_creation"),f=s!==void 0?Math.max(0,s-(u??0)-(d??0)):void 0;return{...f!==void 0?{tokensIn:f}:{},...l!==void 0?{tokensOut:l}:{},...u!==void 0?{cacheRead:u}:{},...d!==void 0?{cacheWrite:d}:{}}}function Lr(e,t){return{name:"VisiqHandler",handleLLMStart:async(n,r,o,i,a,s,l)=>{let c=R.getStore();if(!c)return;c.llm_prompts.push(...r);let u=ys(n,a,l);u&&(c.llm_model=u,t.captureCloneMetadata({model:u,agentType:"langchain"}))},handleLLMEnd:async n=>{let r=R.getStore();if(!r)return;let i=n?.generations?.[0]?.[0],a=typeof i?.text=="string"?i.text:"";a&&r.llm_responses.push(a);try{let s=n?.llmOutput,l=i?.message&&typeof i.message=="object"?i.message:void 0,c=bs(s,l);if(!c&&!a)return;let u=l?.tool_calls,d=typeof s?.model=="string"?s.model:void 0,f=r.llm_model??d;await t.awaitBundleReady(),st(t,{agentId:e,sessionId:r.session_id,framework:"langchain"},{...a?{texts:[a]}:{},...c?{usage:c}:{},...f?{model:f}:{},final:!(Array.isArray(u)&&u.length>0)})}catch{}},handleAgentAction:async n=>{let r=R.getStore();if(!r)return;let o=typeof n.log=="string"?n.log:"";o&&r.agent_reasoning.push(o)},handleRetrieverStart:async(n,r,o)=>{let i=R.getStore();i&&i.retrieverQueries.set(o,r??"")},handleRetrieverEnd:async(n,r)=>{let o=R.getStore();if(!o)return;let i=o.retrieverQueries.get(r)??"";if(o.retrieverQueries.delete(r),!Array.isArray(n))return;let a=z(o);for(let s of n){let l=s,c=String(l.pageContent??l.text??l.content??""),u=l.metadata??{};await t.evaluate({operations:["retrieval"],agentId:e,resourceType:"document",resourceMetadata:u,query:i,contentPreview:c.slice(0,500),...a?{telemetry:a}:{}})}},handleRetrieverError:async(n,r)=>{let o=R.getStore();o&&o.retrieverQueries.delete(r)}}}var Ur=["_call","execute","call","run","invoke"];function vs(e){let t=e;for(let n of Ur)if(typeof t[n]=="function")return!0;return!1}function ws(e){return e instanceof J?!0:e instanceof j?typeof e.status=="number"&&e.status>=400&&e.status<500:!1}function ks(e,t,n){let r=null,o=null,i=!1,a=async()=>{if(r)return r;if(o)throw new J(`Failed to bootstrap grant ${n}: ${o.message}`,null);let s;try{s=await gr(t.agentId,n)}catch(l){throw i=ws(l),i&&(o=l instanceof Error?l:new Error(String(l))),new J(`Failed to bootstrap grant ${n}: ${l instanceof Error?l.message:String(l)}`,null)}return r=hr(e,{agentId:t.agentId,grantToken:s,failBehavior:t.failMode==="closed"?"deny":"permit",...t.apiKey?{apiKey:t.apiKey}:{},...t.endpoint?{endpoint:t.endpoint}:{}}),r};return new Proxy(e,{get(s,l,c){if(l===Te)return!0;let u=Reflect.get(s,l,c);return typeof u!="function"||typeof l!="string"||!Ur.includes(l)?u:async function(...d){let f;try{f=await a()}catch(g){if(i||t.failMode==="closed")throw g;return v("grant-bootstrap",`grant ${n} bootstrap failed: ${g instanceof Error?g.message:String(g)}`),u.call(this,...d)}return f[l].call(f,...d)}}})}function As(e,t){let n=se(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode);jr(e,n,t);let r=e;if(typeof r.execute=="function"){let o=typeof r.name=="string"&&r.name||typeof r.id=="string"&&r.id||"unknown";Xe(e,o,Br(t))}return e}function Br(e){return{agentId:e.agentId,unified:se(e.apiKey,e.endpoint,e.agentId,e.timeoutMs,void 0,e.failMode),hitlTimeoutMs:e.hitlTimeoutMs,failMode:e.failMode,...e.apiKey?{apiKey:e.apiKey}:{},...e.endpoint?{endpoint:e.endpoint}:{},telemetry:xt()}}async function qr(e,t={}){if(!e||e.trim()==="")throw new Error("[VisIQ] visiq.delegate: childAgentId is required");let n=process.env.VISIQ_AGENT_ID;if(!n)throw new Error("[VisIQ] visiq.delegate: VISIQ_AGENT_ID env var is required. Set it to the parent agent ID before calling delegate.");let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[VisIQ] visiq.delegate: VISIQ_API_KEY env var is required");let o=process.env.VISIQ_ENDPOINT;return{VISIQ_GRANT_ID:(await new oe({agentId:n,apiKey:r,...o?{endpoint:o}:{}}).requestGrant({parentAgentId:n,childAgentId:e,toolScope:t.toolScope??null,contextScope:t.contextScope??null,durationSeconds:t.durationSeconds??3600,purpose:t.purpose??`Delegated to ${e}`,...t.maxDepth!==void 0?{maxDepth:t.maxDepth}:{},...t.parentGrantToken!==void 0?{parentGrantToken:t.parentGrantToken}:{}})).grantId}}var Ce=class{constructor(t){this.transport=t}transport;deploy(t={}){let n={include_mac:t.includeMac??!1};return t.autoInstallHarness!==void 0&&(n.auto_install_harness=t.autoInstallHarness),X(this.transport,"POST","/api/discovery/fleet/deploy",n)}status(){return X(this.transport,"GET","/api/discovery/fleet/status")}heartbeat(t){return X(this.transport,"POST","/api/discovery/fleet/heartbeat",{instance_id:t.instanceId,vendor:t.vendor})}stop(){return X(this.transport,"POST","/api/discovery/fleet/stop")}};var xe=class{constructor(t){this.transport=t}transport;connectAws(t){return X(this.transport,"POST","/api/discovery/integrations/aws",{aws_account_id:t.awsAccountId,aws_region:t.awsRegion})}};function Is(e){if(!e.baseUrl||e.baseUrl.length===0)throw new Error("[VisIQ] createVisiqClient: baseUrl is required");if(!e.accessToken&&!e.cookieHeader)throw new Error("[VisIQ] createVisiqClient: one of accessToken or cookieHeader is required");let t=e.baseUrl.replace(/\/$/,""),n=e.fetchImpl??globalThis.fetch.bind(globalThis),r={baseUrl:t,accessToken:e.accessToken,cookieHeader:e.cookieHeader,fetchImpl:n};return{fleet:new Ce(r),integrations:new xe(r)}}async function X(e,t,n,r){let o=`${e.baseUrl}${n.startsWith("/")?n:`/${n}`}`,i={...H(V)};e.cookieHeader&&(i.Cookie=e.cookieHeader),e.accessToken&&(i.Authorization=`Bearer ${e.accessToken}`);let a;r!==void 0&&(i["Content-Type"]="application/json",a=JSON.stringify(r));let s=await e.fetchImpl(o,{method:t,headers:i,body:a});if(!s.ok){let l="";try{l=await s.text()}catch{}throw new Error(`[VisIQ] ${t} ${n} failed (${s.status}): ${l||s.statusText}`)}return await s.json()}var Vr=$r;Vr.delegate=qr;var fc=Vr;export{ze as DEFAULT_FAIL_MODE,Ce as FleetClient,xe as IntegrationsClient,Is as createVisiqClient,qr as delegate,ke as normalizeFailMode,fc as visiq};
+-----END PRIVATE KEY-----`,template:{pattern:R.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:R.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:R.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:R.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:R.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:R.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:R.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:R.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:R.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:R.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS).",category:"financial",example:"4242 4242 4242 4242",template:{pattern:"\\b\\d{13,19}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:"\\b[A-Z]{2}\\d{2}(?:[ ]?[A-Z0-9]){10,30}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:"\\b\\d{9}\\b",mode:"full"},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX).",category:"financial",example:"12-3456789",template:{pattern:R.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:R.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789).",category:"pii",example:"123-45-6789",template:{pattern:R.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},uk_nino:{id:"uk_nino",label:"UK National Insurance numbers",description:"UK NINOs (e.g. AB 12 34 56 C). DEFAULT-OFF \u2014 NO CHECKSUM. Precision comes only from the issued alphabet and the never-issued administrative prefixes (BG, GB, NK, KN, TN, NT, ZZ), so roughly half of tokens already shaped 2-letters/6-digits/[A-D] validate. All-lowercase candidates are rejected (git short SHAs), but that does NOT exclude uppercase business identifiers \u2014 serial, part, batch, PO, coupon and asset tags share the shape exactly and were measured being masked. Opt in when UK NINOs are expected in your traffic.",category:"pii",example:"AB 12 34 56 C",template:{pattern:"\\b[A-CEGHJ-PR-TW-Z][A-CEGHJ-NPR-TW-Z]\\s?\\d{2}\\s?\\d{2}\\s?\\d{2}\\s?[A-D]\\b",mode:"full"},defaultEnabled:!1},in_aadhaar:{id:"in_aadhaar",label:"Aadhaar numbers (India)",description:"12-digit UIDAI Aadhaar numbers, Verhoeff-checksum validated and constrained to the issued 2-9 leading digit. Keeps the last 4 visible.",category:"pii",example:"2345 6789 0124",template:{pattern:"\\b[2-9]\\d{3}\\s\\d{4}\\s\\d{4}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},in_pan_tax:{id:"in_pan_tax",label:"India PAN (tax ID)",description:"India Permanent Account Number \u2014 the income-tax id (ABCPE1234F), NOT a payment-card PAN. NO CHECKSUM: the only discriminator is the holder-type letter in position 4, which removes just 15 of 26 possibilities in one position, so roughly 4 in 10 uniform 5-letter/4-digit/1-letter tokens validate. DEFAULT-OFF for that reason \u2014 an uppercase SKU or part number of the same shape is masked, and nothing in the value distinguishes it.",category:"financial",example:"ABCPE1234F",template:{pattern:R.in_pan_tax,mode:"full"},defaultEnabled:!1},br_cpf:{id:"br_cpf",label:"CPF numbers (Brazil)",description:"Brazilian CPF, closed by TWO independent mod-11 check digits (~1-in-100 false-positive rate). Repdigits are rejected. Keeps the last 2 visible.",category:"pii",example:"123.456.789-09",template:{pattern:"\\b\\d{3}\\.\\d{3}\\.\\d{3}-\\d{2}\\b",mode:"partial",keepLast:2},defaultEnabled:!0},es_dni_nie:{id:"es_dni_nie",label:"DNI / NIE numbers (Spain)",description:"Spanish national ID (8 digits + letter) and foreigner ID (X/Y/Z + 7 digits + letter), validated by the mod-23 check letter.",category:"pii",example:"12345678Z",template:{pattern:"\\b[XYZ]?\\d{7,8}[A-Z]\\b",mode:"full"},defaultEnabled:!0},ca_sin:{id:"ca_sin",label:"SIN numbers (Canada)",description:"Canadian Social Insurance Numbers (9-digit, Luhn-validated). DEFAULT-OFF \u2014 identical shape to an ABA routing number and to any 9-digit id, with only a mod-10 pass to separate them.",category:"pii",example:"046 454 286",template:{pattern:"\\b\\d{3}[- ]\\d{3}[- ]\\d{3}\\b",mode:"partial",keepLast:3},defaultEnabled:!1},uk_nhs_number:{id:"uk_nhs_number",label:"NHS numbers (UK)",description:"UK NHS patient numbers (10-digit, weighted mod-11). DEFAULT-OFF \u2014 a 10-digit run is also every North American phone number.",category:"pii",example:"943 476 5919",template:{pattern:"\\b\\d{3}[- ]\\d{3}[- ]\\d{4}\\b",mode:"full"},defaultEnabled:!1},au_tfn:{id:"au_tfn",label:"Tax File Numbers (Australia)",description:"Australian TFNs (8-9 digit, weighted mod-11). DEFAULT-OFF \u2014 collides with essentially every 8-9 digit identifier.",category:"financial",example:"123 456 782",template:{pattern:"\\b\\d{3}[- ]\\d{3}[- ]\\d{2,3}\\b",mode:"full"},defaultEnabled:!1},date_of_birth:{id:"date_of_birth",label:"Dates of birth",description:"Dates in the common written formats. DEFAULT-OFF and heavily over-masking by nature \u2014 a DOB is indistinguishable from any other date (created_at, invoice, release). Offered because DOB is a GDPR/HIPAA identifier some regulated tenants must mask regardless.",category:"pii",example:"1985-04-12",template:{pattern:R.date_of_birth,mode:"full"},defaultEnabled:!1},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept).",category:"pii",example:"alice@acme.com",template:{pattern:R.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:R.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:R.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:R.mac_address,mode:"full"},defaultEnabled:!1}};var Ws=new Set(En.filter(e=>!Be[e].defaultEnabled));function Zo(e,t){let n=new Set;for(let r of En)(Be[r].defaultEnabled?!e?.has(r):t?.has(r))||n.add(r);return n}function Jo(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let o=e;for(let{name:i,re:a}of Tn){let s=i;n.has(s)||(o=o.replace(a,()=>(r?.(s),t)))}for(let{name:i,re:a,normalize:s,validate:l}of Yo)n.has(i)||(o=o.replace(a,c=>l(s(c),c)?(r?.(i),t):c));return o}function pt(e,t=Sn,n,r){return Xo(e,t,Zo(n,r))}function Xo(e,t,n){let r=new Set,o=!n.has("pan"),i=s=>{r.add(s)},a=s=>{if(typeof s=="string")return Jo(s,t,n,i);if(typeof s=="number"&&Number.isInteger(s)&&s>0){if(!o)return s;let l=String(s);return l.length>=13&&l.length<=19&&ut(l)?(r.add("pan"),t):s}if(Array.isArray(s))return s.map(l=>a(l));if(s!==null&&typeof s=="object"){let l=s,c={};for(let u of Object.keys(l))c[u]=a(l[u]);return c}return s};return{value:a(e),detectors:[...r].sort()}}function Rn(e,t=Sn){return pt(e,t).value}function ei(e){let{value:t,detectors:n}=pt(e),r=n.some(o=>Be[o].category==="secret");return{detectors:n,blocked:r,redacted:t}}function ti(e,t){let{blocked:n,redacted:r,detectors:o}=ei(e);return n?t.failMode==="closed"?{verdict:"block",redacted:r,detectors:o}:{verdict:"redact",redacted:r,detectors:o}:{verdict:"allow",redacted:r,detectors:o}}function ni(e){if(typeof e!="string"||e.length===0)return e;let t=e.lastIndexOf("__");return t<0?e:e.slice(t+2)}var ri=new Set(["send","send_email","send_message","email","email_send","message","post","post_message","http_post","upload","export","export_data","share","publish","webhook"]);function oi(e){return ri.has(ni(e))}function ne(e,t,n){return n.enforced&&oi(e)?ti(t,{failMode:n.failMode}):{verdict:"allow",redacted:t,detectors:[]}}var ii=/[\u00AD\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFEFF]/g,Cn=Object.freeze({\u0430:"a",\u0435:"e",\u043E:"o",\u0440:"p",\u0441:"c",\u0443:"y",\u0445:"x",\u0456:"i",\u0455:"s",\u043A:"k",\u043C:"m",\u0442:"t",\u043D:"h",\u0432:"b",\u0433:"r",\u03BF:"o",\u03B1:"a",\u03C1:"p",\u03B9:"i",\u03C4:"t",\u03B5:"e",\u03BA:"k",\u03BD:"v",\u03C5:"u",\u03B7:"n",\u0131:"i","\u04CF":"l",\u0578:"n"}),ai=new RegExp(`[${Object.keys(Cn).join("")}]`,"gu"),si=Object.freeze({4:"a","@":"a",3:"e",1:"i","!":"i",0:"o",5:"s",$:"s",7:"t",9:"g","(":"c",8:"b"}),xn="\u2801\u2803\u2809\u2819\u2811\u280B\u281B\u2813\u280A\u281A\u2805\u2807\u280D\u281D\u2815\u280F\u281F\u2817\u280E\u281E\u2825\u2827\u283A\u282D\u283D\u2835",li=Object.freeze(Object.fromEntries([...xn].map((e,t)=>[e,String.fromCharCode(97+t)]))),ci=new RegExp(`[${xn}\u2800]`,"g"),On=/[⠀-⣿]/;function ui(e){let t="";for(let n of e){let r=n.codePointAt(0);r!==void 0&&(r>=917536&&r<=917630?t+=String.fromCodePoint(r-917504):r>=917504&&r<=917631||(t+=n))}return t}function di(e){return e.replace(ii,"")}function Nn(e){return e.replace(ai,t=>Cn[t]??t)}function pi(e){return e.replace(/[4@31!05$79(8]/g,t=>si[t]??t)}function fi(e){return e.replace(/[a-zA-Z]/g,t=>{let n=t<="Z"?65:97;return String.fromCharCode((t.charCodeAt(0)-n+13)%26+n)})}function mi(e){return On.test(e)?e.replace(ci,t=>t==="\u2800"?" ":li[t]??t):e}function hn(e){let t;try{t=ui(e)}catch{t=e}try{t=t.normalize("NFKC")}catch{}return t=di(t),t=Nn(t),t}var gi=/^[A-Za-z0-9+/]{16,}={0,2}$/,hi=/^(?:[0-9a-fA-F]{2}\s*){8,}$/,_n=/[A-Za-z0-9+/]{20,}={0,2}/g;function dt(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);(r===9||r===10||r===13||r>=32&&r<=126||r>=160&&r!==65533)&&t++}return t/e.length}var Ln=new TextDecoder("utf-8",{fatal:!1});function Mn(e){let t;try{t=atob(e)}catch{return[]}let n=new Uint8Array(t.length);for(let o=0;o<t.length;o++)n[o]=t.charCodeAt(o)&255;let r=Ln.decode(n);return t===r?[t]:[r,t]}function _i(e){let t=e.replace(/\s+/g,"");if(t.length===0||t.length%2!==0)return[];let n=new Uint8Array(t.length/2);for(let i=0;i<n.length;i++){let a=Number.parseInt(t.slice(i*2,i*2+2),16);if(Number.isNaN(a))return[];n[i]=a}let r="";for(let i=0;i<n.length;i++)r+=String.fromCharCode(n[i]);let o=Ln.decode(n);return r===o?[r]:[o,r]}function yn(e){let t=e.trim(),n=[];if(hi.test(t))for(let r of _i(t))n.push({decoded:r,textiness:dt(r)});if(gi.test(t)&&t.length%4===0)for(let r of Mn(t))n.push({decoded:r,textiness:dt(r)});return n}function bn(e,t){let n=[],r;for(_n.lastIndex=0;(r=_n.exec(e))!==null&&n.length<t;){let o=r[0];if(o.length%4===0)for(let i of Mn(o))n.push({decoded:i,textiness:dt(i)})}return n}var yi=Object.freeze({maxDepth:3,byteCap:262144,maxNodes:256,maxBlobsPerNode:8});function Dn(e,t=yi){if(typeof e!="string"||e.length===0)return{views:[],anyDecoded:!1,truncated:!1,nodes:0,maxDepthSeen:0};let{maxDepth:n,byteCap:r,maxNodes:o,maxBlobsPerNode:i}=t,a=new Set,s=f=>{f.length>0&&f.length<=r&&a.add(f)},l=!1,c=!1,u=0,d=0,_=[{s:e,depth:0}];for(;_.length>0;){if(u>=o){c=!0;break}let f=_.pop();if(f===void 0)break;let{s:g,depth:p}=f;if(g.length>r){c=!0;continue}u++,p>d&&(d=p);let y=hn(g);s(y);let x=pi(y);if(x!==y&&s(x),s(fi(y)),On.test(g)&&s(mi(y)),p>=n){let T=hn(g);(yn(T).length>0||bn(T,i).length>0)&&(c=!0);continue}let A=[...yn(y),...bn(y,i)];for(let T of A){if(l=!0,T.decoded.length>r){c=!0;continue}T.textiness>=.85&&T.decoded!==y?_.push({s:T.decoded,depth:p+1}):s(T.decoded)}}return{views:[...a],anyDecoded:l,truncated:c,nodes:u,maxDepthSeen:d}}var Fn=["hidden_text_carrier","injected_turn_boundary","mixed_script_token","nested_encoding_payload"],bi=Object.freeze(["hidden_text_carrier","injected_turn_boundary","mixed_script_token"]),vi=8,wi=new Set([173,8203,8204,8205,8206,8207,8288,65279,8234,8235,8236,8237,8238,8294,8295,8296,8297]),vn=e=>e!==void 0&&(e>=65&&e<=90||e>=97&&e<=122);function ki(e){let t=[...e].map(r=>r.codePointAt(0)),n=0;for(let r=0;r<t.length;r++){let o=t[r];if(o>=917504&&o<=917631||wi.has(o)&&vn(t[r-1])&&vn(t[r+1])&&(n++,n>=vi))return!0}return!1}var Ai=/^[ \t]*(?:system|assistant|developer|user)[ \t]*:/i;function Ii(e){let t=e.split(/\r?\n/),n=!1;for(let r of t){if(Ai.test(r)){if(n)return!0;continue}r.trim().length>0&&(n=!0)}return!1}var Si=[{name:"latin",lo:65,hi:591},{name:"greek",lo:880,hi:1023},{name:"cyrillic",lo:1024,hi:1279}];function Ti(e){for(let t of Si)if(e>=t.lo&&e<=t.hi)return t.name;return null}function Ei(e){for(let t of e.split(/\s+/)){if(t.length<4)continue;let n=0,r=0,o=!0;for(let i of t){let a=Ti(i.codePointAt(0));if(a===null){o=!1;break}a==="latin"?n++:Nn(i)!==i&&r++}if(o&&n>0&&r>0)return!0}return!1}var wn=Object.freeze({signals:[],contributes:!1});function Ri(e){if(typeof e!="string"||e.length===0)return{...wn,signals:[]};let t=new Set;try{ki(e)&&t.add("hidden_text_carrier"),Ii(e)&&t.add("injected_turn_boundary"),Ei(e)&&t.add("mixed_script_token");let{anyDecoded:n,maxDepthSeen:r,truncated:o}=Dn(e);n&&(r>=2||o)&&t.add("nested_encoding_payload")}catch{return{...wn,signals:[]}}return{signals:[...Fn.filter(n=>t.has(n))],contributes:bi.some(n=>t.has(n))}}var qe=[{name:"override_instructions",re:/\bignore (?:all |the )?(?:previous|above|prior) (?:instructions|prompts?)\b/i},{name:"disregard_instructions",re:/\bdisregard (?:the )?(?:above|previous|system)\b/i},{name:"role_tag",re:/<\/?(system|assistant|instructions|host_context)\b/i},{name:"privilege_override",re:/\b(grant|escalate|elevate) (admin|root|all|full) (access|privileges?)\b/i},{name:"tool_smuggle",re:/```[\s\S]*?(tool_call|function_call)/i}];function kn(e){return typeof e!="string"||e.length===0?[]:qe.filter(({re:t})=>t.test(e)).map(({name:t})=>t)}function Ci(e){if(typeof e!="string"||e.length===0)return[];let t=new Set(kn(e)),{views:n}=Dn(e);for(let r of n)for(let o of kn(r))t.add(o);return qe.filter(r=>t.has(r.name)).map(r=>r.name)}function xi(e){let t=new Set,n=new Set,r=!1,o=i=>{if(i!=null){if(typeof i=="string"){for(let s of Ci(i))t.add(s);let a=Ri(i);for(let s of a.signals)n.add(s);a.contributes&&(r=!0);return}if(Array.isArray(i)){for(let a of i)o(a);return}if(typeof i=="object")for(let a of Object.values(i))o(a)}};return o(e),{matched:t.size>0||r,signatures:qe.filter(i=>t.has(i.name)).map(i=>i.name),structural:Fn.filter(i=>n.has(i))}}function Oi(e){return xi(e).matched}var Qs=qe.map(e=>e.name);var Ni=new Set(["untrusted","external","public","public_internet","external_third_party","web"]);var Li="i:injection";function $n(e){let t=new Set;if(e.content!==void 0&&e.content!==null){let{detectors:o}=pt(e.content);for(let i of o){let a=Be[i]?.category;a&&t.add(`c:${a}`)}Oi(e.content)&&t.add(Li)}let n=e.resourceMetadata??{},r=n.source_trust;return(n.untrusted_source===!0||typeof r=="string"&&Ni.has(r.toLowerCase()))&&t.add("i:untrusted"),[...t].sort()}var ct="(?:system\\s+prompt|initial\\s+(?:instructions|prompt)|system\\s+(?:instructions|message)|hidden\\s+(?:instructions|prompt)|your\\s+(?:system\\s+prompt|initial\\s+instructions|instructions|prompt)|the\\s+prompt\\s+(?:above|you\\s+were\\s+given))",Ys=[{name:"reveal_prompt",re:new RegExp(`\\b(?:reveal|show|print|repeat|output|echo|display|expose|dump|leak|reprint|divulge|disclose)\\b[\\s\\S]{0,40}?\\b${ct}\\b`,"i")},{name:"what_is_prompt",re:new RegExp(`\\bwhat\\s+(?:is|are|were)\\b[\\s\\S]{0,20}?\\b${ct}\\b`,"i")},{name:"tell_me_prompt",re:new RegExp(`\\b(?:tell|give|send|show)\\s+me\\b[\\s\\S]{0,30}?\\b${ct}\\b`,"i")},{name:"repeat_above",re:/\b(?:repeat|print|output|echo|reproduce)\b[\s\S]{0,20}?\b(?:everything|all\s+(?:the\s+)?(?:text|words))\b[\s\S]{0,12}?\b(?:above|before|preceding|verbatim|word\s+for\s+word)\b/i}],An="(?:instructions?|prompts?|rules?|directives?|guidelines?|constraints?|guardrails?)",Mi=`(?:(?:all\\s+|any\\s+|the\\s+|these\\s+|those\\s+)*(?:previous|prior|preceding|earlier|above|foregoing|initial|original|system|developer)\\s+${An}|your\\s+(?:(?:system|initial|original|previous|prior|current)\\s+)?(?:${An}|programming|training))`,Di="(?:(?:all|any|every|the|of|and|now|please|completely|entirely|totally|immediately)\\s+){0,3}",In="(?:\\b(?:unrestricted|unfiltered|uncensored|unbounded|unlimited|unchained|jailbroken|lawless|amoral)\\b|\\b(?:DAN|STAN|DUDE|AIM)\\b|\\bno\\s+(?:longer\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|boundaries|constraints?)\\b(?!\\s+(?:on|over|regarding|upon|for)\\b)|\\bwithout\\s+(?:any\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|constraints?|censorship)\\b|\\b(?:free|freed|released)\\s+from\\s+(?:your\\s+)?(?:restrictions?|limits?|rules?|guidelines?|guardrails?|programming|constraints?)\\b|\\b(?:can|will|are\\s+able\\s+to)\\s+(?:do|say)\\s+anything\\b|\\bignore\\s+(?:all\\s+)?(?:your\\s+)?(?:previous\\s+|prior\\s+|system\\s+)?(?:instructions?|rules?|guidelines?)\\b)",Fi="(?:ignore|disregard|forget|override|overrule|bypass|obey|comply\\s+with|follow\\s+(?:only|my|these))",Zs=[{name:"override_instructions",re:new RegExp(`\\b(?:ignore|disregard|forget|discard|override|overrule|bypass|delete|erase)\\s+${Di}${Mi}\\b`,"i")},{name:"forget_everything_prior",re:/\b(?:forget|ignore|disregard|erase|discard)\s+(?:about\s+|all\s+|any\s+)?(?:everything|anything)\b[\s\S]{0,24}?\b(?:above|before|previously|prior|earlier|you\s+(?:were|have\s+been)\s+(?:told|instructed|given|programmed))\b/i},{name:"persona_reassignment_jailbreak",re:new RegExp(`\\byou\\s+are\\s+now\\s+(?:(?:a|an|the)\\s+)?[\\s\\S]{0,48}?${In}`,"i")},{name:"constraint_release",re:/\byou\s+are\s+no\s+longer\s+(?:bound|restricted|limited|constrained|obligated|governed|subject\s+to|required\s+to)\b/i},{name:"from_now_on_reassignment",re:new RegExp(`\\bfrom\\s+now\\s+on\\s*,?\\s+you\\s+(?:are|will|must|shall|have|can)\\s+(?:${Fi}\\b|[\\s\\S]{0,40}?${In})`,"i")},{name:"new_instructions_header",re:/^\s*(?:[#*>-]+\s*)?(?:new|real|actual|true|secret|hidden|override)\s+(?:system\s+)?(?:instructions?|prompts?|directives?)\s*:/im}];var Js=Object.freeze({"\u2019":"'",\u02BC:"'","\uFF07":"'","\u02B9":"'","\u2032":"'"});var q=e=>`[^.!?;\\n]{0,${e}}?`,$i=["\\bi\\s+(?:can'?t|cannot|can\\s+not|won'?t|will\\s+not)\\b","\\bi(?:'m|\\s+am)\\s+(?:not\\s+able\\s+to|unable\\s+to|not\\s+going\\s+to|not\\s+permitted\\s+to|not\\s+allowed\\s+to)\\b"].join("|"),Pn="(?:help|assist|provide|create|generate|produce|write|compose|draft|comply|fulfil|fulfill|share|disclose|reveal|perform|execute|run|send|transmit|publish|export|approve|grant|carry\\s+out|do\\s+that|do\\s+this|do\\s+so|go\\s+ahead)",Xs=Object.freeze([{id:"capability_denial",class:"strong",re:new RegExp([`(?:${$i})\\s${q(40)}\\b${Pn}\\b`,"\\b(?:that|this|it)(?:'s|\\s+is)\\s+not\\s+something\\s+i\\s+(?:can|could|am\\s+able\\s+to|'m\\s+able\\s+to)\\b",`\\b(?:falls|sits|is)\\s+outside\\s+(?:of\\s+)?(?:what|the\\s+(?:scope|range|bounds))\\b${q(40)}\\bi\\s+(?:can|am|'m)\\b`,"\\bnot\\s+something\\s+i(?:'m|\\s+am)\\s+(?:able|willing|permitted|allowed)\\s+to\\b"].join("|"),"i")},{id:"explicit_decline",class:"strong",re:new RegExp(["\\bi\\s+(?:must|have\\s+to|need\\s+to|will\\s+have\\s+to|am\\s+going\\s+to|'m\\s+going\\s+to)\\s+(?:respectfully\\s+)?decline\\b","\\bi(?:'m|\\s+am)\\s+not\\s+(?:comfortable|willing|prepared)\\b","\\bi(?:'ll|\\s+will)\\s+(?:have\\s+to\\s+)?pass\\s+on\\b","\\bi\\s+(?:must|have\\s+to)\\s+refuse\\b"].join("|"),"i")},{id:"policy_citation",class:"strong",re:new RegExp([`\\b(?:against|contrary\\s+to|prohibited\\s+by|forbidden\\s+by|in\\s+violation\\s+of|violates)\\s${q(24)}\\b(?:polic(?:y|ies)|guidelines?|terms\\s+of\\s+(?:use|service)|rules\\s+of\\s+engagement|code\\s+of\\s+conduct)\\b`,`\\b(?:my|our|the|company|organi[sz]ation'?s?)\\s+(?:polic(?:y|ies)|guidelines?)\\s${q(24)}\\b(?:do(?:es)?\\s+not\\s+(?:allow|permit)|prohibit|forbid|prevent)\\b`,`\\bnot\\s+(?:permitted|allowed|authori[sz]ed)\\s+(?:under|by)\\s${q(24)}\\b(?:polic(?:y|ies)|guidelines?)\\b`].join("|"),"i")},{id:"guardrail_selfreference",class:"strong",re:new RegExp(["\\bi(?:'ve|\\s+have)\\s+been\\s+(?:instructed|configured|told|trained)\\s+not\\s+to\\b","\\bi(?:'m|\\s+am)\\s+(?:designed|configured|programmed|built|set\\s+up)\\s+not\\s+to\\b",`\\bmy\\s+(?:safety\\s+)?(?:instructions|configuration|guardrails?|constraints|training)\\s${q(24)}\\b(?:prevent|prohibit|forbid|do(?:es)?\\s+not\\s+(?:allow|permit)|preclude)\\b`,"\\b(?:outside|beyond)\\s+(?:my|the)\\s+(?:permitted|authori[sz]ed|configured|approved)\\s+(?:scope|remit|capabilities|actions|operations)\\b"].join("|"),"i")},{id:"ethical_objection",class:"strong",re:new RegExp(["\\b(?:that|this|doing\\s+(?:so|that)|what\\s+you(?:'re|\\s+are)\\s+asking|the\\s+request|such\\s+a\\s+request)\\s+(?:would\\s+be|is|are)\\s+(?:clearly\\s+|both\\s+|potentially\\s+)?(?:illegal|unethical|unlawful|harmful|fraudulent)\\b","\\bi\\s+(?:do\\s+not|don'?t)\\s+condone\\b","\\b(?:goes|would\\s+go|runs)\\s+against\\s+my\\s+(?:principles|values|ethics)\\b","\\bi\\s+(?:can'?t|cannot|won'?t)\\s+in\\s+good\\s+conscience\\b"].join("|"),"i")},{id:"apology_marker",class:"weak",re:new RegExp("\\b(?:i(?:'m|\\s+am)\\s+(?:really\\s+|very\\s+|terribly\\s+|so\\s+)?sorry|i\\s+apologi[sz]e|my\\s+apologies)\\b","i")}]),el=Object.freeze([/```/,/\b(?:here(?:'s|\s+is|\s+are)|below\s+(?:is|are|you(?:'ll|\s+will)\s+find)|the\s+following\s+(?:is|are))\b/i,new RegExp(`\\b(?:but|however|instead|although|that\\s+said)\\b${q(60)}\\b(?:i\\s+(?:can|could)(?!'t)\\s${q(30)}\\b${Pn}\\b|i(?:'d|\\s+would)\\s+be\\s+happy\\s+to\\b|i(?:'m|\\s+am)\\s+able\\s+to\\b)`,"i"),/\bwhat\s+i\s+can\s+do\s+(?:instead|is|for\s+you)\b/i]);var ve=e=>`[^.!?;\\n]{0,${e}}?`,tl=Object.freeze([{id:"vulnerability_scanning",objectPatterns:[/\b(?:vulnerability|vuln|security)\s+(?:scan|scans|scanning|assessment|audit|test|testing)\b/i,/\bpen(?:etration)?[\s-]?test(?:ing)?\b/i,/\bport\s+scan(?:ning)?\b/i,/\b(?:exploit|nmap|metasploit|nessus|burp\s+suite)\b/i,/\bCVE-\d{4}-\d{4,7}\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|vulnerability|incident\s+respon\w{0,4}|threat|soc|red\s+team|phishing|malware)\b/i]},{id:"credential_access",objectPatterns:[/\b(?:credential|password|passphrase|api\s+key|access\s+key|secret|token|private\s+key|ssh\s+key)s?\b/i,/\b(?:vault|secrets?\s+manager|keychain|keystore)\b/i,/\bservice\s+account\s+key\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|identity|iam|credential|secrets?\s+manage\w{0,4}|vault|platform|devops)\b/i]},{id:"financial_transaction",objectPatterns:[/\b(?:wire\s+transfer|bank\s+transfer|payout|disbursement|chargeback)\b/i,new RegExp(`\\b(?:approve|issue|initiate|process|release)\\s${ve(20)}\\b(?:payment|refund|invoice|transfer|purchase\\s+order)s?\\b`,"i"),new RegExp(`\\b(?:move|transfer)\\s${ve(20)}\\b(?:funds|money)\\b`,"i")],purposeFunctions:["finance_accounting","procurement"],purposePatterns:[/\b(?:finance|financial|accounting|invoice|invoicing|payment|payments|billing|refund|refunds|treasury|procurement|spend|purchasing|fraud|kyc)\b/i]},{id:"personnel_data",objectPatterns:[/\b(?:employee|personnel|payroll|hr|staff)\s+(?:record|records|data|file|files|information|details)\b/i,/\b(?:salary|salaries|compensation|performance\s+review|termination\s+letter)s?\b/i,/\b(?:home\s+address|social\s+security\s+number|national\s+insurance\s+number)e?s?\b/i],purposeFunctions:["hr","privacy_compliance"],purposePatterns:[/\b(?:hr|human\s+resources|people\s+ops|payroll|benefits|recruit\w{0,4}|onboarding|privacy|dsar|consent)\b/i]},{id:"regulated_advice",objectPatterns:[/\b(?:legal|medical|tax|investment|financial)\s+advice\b/i,/\bpractis\w{0,3}\s+law\b/i,/\b(?:diagnose|diagnosis|prescribe|prescription)\b/i,/\b(?:binding|enforceable)\s+(?:opinion|interpretation)\b/i],purposeFunctions:["legal","privacy_compliance"],purposePatterns:[/\b(?:legal|compliance|counsel|contract|contracts|litigation|nda|privacy|regulator\w{0,2}|audit\w{0,3})\b/i]},{id:"data_export",objectPatterns:[new RegExp(`\\b(?:export|download|dump|extract|exfiltrat\\w{0,3}|bulk\\s+copy)\\b\\s${ve(30)}\\b(?:data|database|dataset|records?|table|tables|customer\\s+list|contact\\s+list|report)\\b`,"i"),/\b(?:full|entire|whole)\s+(?:database|dataset|customer\s+table)\b/i],purposeFunctions:["operations","engineering","privacy_compliance"],purposePatterns:[/\b(?:data\s+(?:pipeline|engineering|platform)|etl|export|reporting|analytics|operations|document\s+extract\w{0,3}|forecast\w{0,3})\b/i]},{id:"code_execution",objectPatterns:[new RegExp(`\\b(?:run|execute|invoke)\\s${ve(24)}\\b(?:script|scripts|command|commands|shell|code|binary|query|migration)\\b`,"i"),/\b(?:shell|root|sudo|admin)\s+(?:access|command|session)\b/i,/\bagainst\s+(?:the\s+)?production\s+(?:system|server|database|environment)s?\b/i],purposeFunctions:["engineering","it_security"],purposePatterns:[/\b(?:engineering|developer|devops|platform|release|deploy\w{0,4}|build|pipeline|sandbox|test\s+data|change\s+window)\b/i]},{id:"external_communication",objectPatterns:[new RegExp(`\\b(?:send|post|publish|email|tweet|message|broadcast)\\b\\s${ve(30)}\\b(?:external|customer|customers|public|press|social\\s+media|third[\\s-]party|prospect|prospects)\\b`,"i"),/\b(?:cold\s+outreach|marketing\s+blast|phishing\s+email|press\s+release)\b/i],purposeFunctions:["marketing","sales","customer_support"],purposePatterns:[/\b(?:marketing|campaign|outreach|email\s+assistant|support|customer|sales|lead|leads|communication|communications)\b/i]}]);var ft="[REDACTED]",te="\u2022",Ue=e=>/[A-Za-z0-9]/.test(e);function jn(e,t,n,r){let o=Array.from(e),i=o.length,a=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:te,c=a+s>=i;return o.map((u,d)=>!c&&(d<a||d>=i-s)?u:Ue(u)?l:u).join("")}function Pi(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return jn(e,0,0,t);let r=e.slice(0,n),o=e.slice(n),i=t.length>0?t:te;return(r.length<=1?i:r[0]+Array.from(r.slice(1)).map(a=>Ue(a)?i:a).join(""))+o}function ji(e,t,n){let r=n.length>0?n:te,o=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let c=new RegExp(t,"g"),u;for(;(u=c.exec(e))!==null;){if(u[0].length===0){c.lastIndex++;continue}for(let d=u.index;d<u.index+u[0].length;d++)o[d]=!0}}catch{}let i=!1,a=!0;for(let c=0;c<e.length;c++)if(Ue(e[c])&&(i=!0,!o[c])){a=!1;break}let s=i&&a,l="";for(let c=0;c<e.length;c++){let u=e[c];!s&&o[c]||!Ue(u)?l+=u:l+=r}return l}function Un(e,t){let n=t.mode??"full";return n==="partial"?jn(e,t.keepFirst??0,t.keepLast??0,t.maskChar??te):n==="email"?Pi(e,t.maskChar??te):n==="custom"?ji(e,t.keepPattern,t.maskChar??te):t.replacement??ft}function Ui(e,t){return typeof e=="string"?Un(e,t):t.replacement??ft}function Bn(e){let t=[],n=e.replacement??ft;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:r,replacer:()=>n});for(let r of e.directives??[]){let{pattern:o}=r;typeof o!="string"||o.length===0||t.push({source:o,replacer:i=>Un(i,r)})}return t}function qn(e,t){let n=e;for(let{source:r,replacer:o}of t){let i;try{i=new RegExp(r,"g")}catch(a){let s=a instanceof Error?a.message:String(a);throw new Error(`[visiq-redact] Invalid redaction pattern "${r}": ${s}`)}n=n.replace(i,a=>o(a))}return n}function L(e,t){return e==null?e:typeof e=="string"?Bi(e,t):typeof e=="object"?qi(e,t):e}function Bi(e,t){if(typeof e!="string")return e;let n=Bn(t);return n.length===0?e:qn(e,n)}function qi(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=Bn(t),o=n.size>0,i=r.length>0,a=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>a(l));if(typeof s=="object"){let l=s,c=Object.create(Object.getPrototypeOf(l));for(let u of Object.keys(l)){let d=o?n.get(u):void 0;if(d){c[u]=Ui(l[u],d);continue}c[u]=a(l[u])}return c}return typeof s=="string"&&i?qn(s,r):s};return a(e)}var Vn=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function Vi(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:Vn(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:Vn(t.spawn.prompt)}),t}function zi(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var Ki=1440*60*1e3,Gi="VISIQ_BUNDLE_GRACE_TTL_MS",Hi="VISIQ_BUNDLE_CACHE_DISABLED",Wi="VISIQ_CACHE_DIR",Qi=Ve.object({graceTtlMs:Ve.number().int().nonnegative().optional(),disabled:Ve.boolean().optional(),cacheDir:Ve.string().min(1).optional()}).strict();function Yi(e){return e==null?{}:Qi.parse(e)}function Zi(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[Gi];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return Ki}function Ji(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[Hi]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var zn;function Xi(){if(zn!==void 0)return zn;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function ea(e){return JSON.stringify(gt(e))}function gt(e){if(Array.isArray(e))return e.map(gt);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=gt(t[r]);return n}return e}function ta(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function na(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function Yn(){if(!Xi())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function Zn(e,t){return e.createHash("sha256").update(ea(t)).digest("hex")}function ra(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[Wi]?.trim();if(r)return r;let o=process.env.XDG_CACHE_HOME?.trim();if(o)return e.path.join(o,"visiq");let i="";try{i=e.os.homedir()}catch{i=""}return i?e.path.join(i,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function oa(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function Jn(e,t,n){return e.path.join(ra(e,n),"bundles",`${oa(e,t)}.json`)}async function ia(e,t,n,r={}){let o=await Yn();if(o)try{let i=Jn(o,e,r),a=o.path.dirname(i);await o.fs.mkdir(a,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:Zn(o.crypto,t),body:t},l=`${i}.tmp-${process.pid}-${o.crypto.randomBytes(6).toString("hex")}`;await o.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await o.fs.rename(l,i)}catch(c){throw await o.fs.rm(l,{force:!0}).catch(()=>{}),c}}catch{}}async function aa(e,t={}){let n=await Yn();if(!n)return null;try{let r=await n.fs.readFile(Jn(n,e,t),"utf-8"),o=na(JSON.parse(r));return!o||Zn(n.crypto,o.body)!==o.contentHash?null:o}catch{return null}}var we;async function sa(){if(we!==void 0)return we;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;we=typeof t=="function"?t:null}catch{we=null}return we}function la(e){let t=[];for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,o=r.rego_source;if(typeof o!="string"||o.length===0)continue;let i;try{i=lt(o)}catch{continue}let a=typeof r.id=="string"?r.id:"<rule>";for(let s of Yt(i))t.push(`${a}: ${s}`)}return t}function ca(e){let t={retrieval:new Set,action:new Set,delegation:new Set};for(let n of e){if(!n.enabled||n.bypassActive)continue;let r=n.regoSource;if(typeof r!="string"||r.length===0)continue;let o;try{o=lt(r)}catch{continue}let i=Zt(o);if(i.length!==0)for(let a of n.appliesTo){let s=t[a];if(s)for(let l of i)s.add(`${n.id}: ${l}`)}}return{retrieval:[...t.retrieval].sort(),action:[...t.action].sort(),delegation:[...t.delegation].sort()}}function ua(e){return e==null||typeof e!="object"?!0:Object.keys(e).length===0}var da=5e3,pa=600*1e3,fa=1e4,ma=25,Kn=1e3,ga=5e3,ha=100,Gn=2e3,_a=10,ya=512,ba=1800*1e3,va=.7,wa="monitor",ka="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",Hn="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",ze="open";function ke(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function Aa(e,t){return $n({content:e,resourceMetadata:t})}var Ia=h.object({operations:h.array(h.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:h.string().min(1,"agentId is required"),sessionId:h.string().min(1).max(255).optional(),toolName:h.string().optional(),toolArgs:h.record(h.unknown()).optional(),targetResource:h.string().optional(),resourceType:h.string().optional(),resourceMetadata:h.record(h.unknown()).optional(),normalized:h.record(h.unknown()).optional(),query:h.string().optional(),contentPreview:h.string().optional(),telemetry:h.record(h.unknown()).optional(),context:h.record(h.unknown()).optional(),mcpServer:h.string().min(1).max(255).optional()}),Sa=h.object({version:h.string().min(1),dialect_version:h.number().int().optional(),min_dialect:h.number().int().optional(),shutdown:h.boolean().optional(),agent_mode:h.enum(["enforce","monitor","off"]).optional(),cognition_capture:h.boolean().optional(),agent_mode_by_operation:h.object({action:h.string().optional(),retrieval:h.string().optional(),delegation:h.string().optional()}).partial().optional(),agent_attributes:h.object({trust_tier:h.string().nullable().optional(),categories:h.array(h.string()).optional(),business_function:h.string().nullable().optional(),business_functions:h.array(h.string()).nullable().optional(),blast_radius_tier:h.string().nullable().optional(),no_coverage:h.string().nullable().optional(),fail_mode:h.string().nullable().optional()}).optional(),rules:h.array(h.record(h.unknown())),action_schemas:h.array(h.object({id:h.string(),plane:h.string().optional(),field_mappings:h.array(h.record(h.unknown())).optional(),derived_fields:h.array(h.record(h.unknown())).optional(),action_class:h.string().nullable().optional(),action_class_confidence:h.number().optional()})).optional(),no_coverage:h.object({no_coverage_defaults:h.record(h.string()),autopilot_enabled:h.boolean(),enduser_hitl_enabled:h.boolean(),hitl_timeout_seconds:h.number().optional()}).optional()});function Ta(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=un(dn(n));return{trust_tier:Xt(t)?t:null,categories:tn(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&pn(e.blast_radius_tier)?e.blast_radius_tier:null}}function Ea(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function Ra(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var ht=new Set,Wn=!1;async function Qn(e){let t=[];for(let n of ht){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function Ca(){if(!Wn&&!(typeof process>"u"||typeof process.once!="function")){Wn=!0,process.once("beforeExit",()=>{Qn(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await Qn(!0)}finally{process.kill(process.pid,e)}})()})}}var Xn=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=wa;agentModeByOperation=null;rawBundle=null;normalizedRefs={retrieval:[],action:[],delegation:[]};warnedNormalizedAbsent=!1;warnedNormalizedDrift=!1;lastNormalizedWarnRearmMs=0;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;failMode=ke(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??ze;governedFailMode=null;telemetryBuffer=[];telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;lastCloneCaptureSig=null;toolDescriptions=new Map;constructor(e,t,n,r,o,i,a,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,c=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,u=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=c,this.resolvedAgentId=u,this.harnessKind=r,this.sdkVersion=i,this.sdkDialect=a,this.originalFetch=globalThis.fetch.bind(globalThis);let d=Yi(s);if(this.bundleCacheDisabled=Ji(d.disabled),this.bundleGraceTtlMs=Zi(d.graceTtlMs),this.bundleCacheDirOverride=d.cacheDir,this.cacheIdentity=l&&c&&!this.bundleCacheDisabled?{endpoint:c,agentId:u,apiKey:l}:null,l&&c){let _={apiKey:l,agentId:u,endpoint:c,mode:"enforce",timeoutMs:zi(o),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...i!==void 0?{sdkVersion:i}:{},...a!==void 0?{sdkDialect:a}:{}};this.client=new it(_,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},da),mt(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},fa),mt(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},ga),mt(this.cognitionTimer),ht.add(this),Ca()}else this.client=null}async evaluate(e){let t=Ia.parse(e),n=Date.now();if(this.operatorShutdown){let f=this.denyAll(t,ka);return this.applyAgentMode(f,"enforce",t,n)}if(this.dialectRefused){if(this.failMode==="open")return this.failOpen(t,Hn,n);let f=this.denyAll(t,Hn);return this.applyAgentMode(f,"enforce",t,n)}if(t.operations.every(f=>this.modeFor(f)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let f;if(this.agentModeConfirmed?f=this.agentMode:this.bundleApplyFailed?f="enforce":f="monitor",f==="enforce"&&this.failMode==="open")return this.failOpen(t,"no unified bundle loaded and no local rules",n);let g=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(g,f,t,n)}let r=this.readSession(t.sessionId),o=await sa();if(!o||!this.rawBundle){if(this.failMode==="open")return this.failOpen(t,"governance core (@visiq/core-wasm) unavailable",n);throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)")}let i=t.operations.includes("action")||t.operations.includes("delegation")?rn(t.normalized??{},{targetApp:t.targetResource??t.toolName??""}):t.normalized,a=this.buildActionSchemaEvent(t),s=t.mcpServer?{...i??{},mcp_server:t.mcpServer}:i,l={...t,normalized:s,session:r,at:Date.now(),action_schema_id:a.id,action_schema_raw:a.canonical},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},u;try{u=o(l,c)}catch(f){if(this.failMode==="open")return this.failOpen(t,`governance core evaluation threw: ${f instanceof Error?f.message:String(f)}`,n);throw f}let d=[...new Set(t.operations.flatMap(f=>this.normalizedRefs[f]??[]))].sort();d.length>0&&ua(t.normalized)&&(u.normalizedColdStart=d,this.warnedNormalizedAbsent||(this.warnedNormalizedAbsent=!0,console.warn(`[UNIFIED] no normalized event supplied, but ${d.length} loaded rule condition(s) on this event's operation(s) read input.normalized.* \u2014 those conditions resolve to undefined here, so a deny carrying one does not fire. (Builtin-derived paths such as context/app_category ARE still populated in-core, so this is a dependency report, not a proof that every listed condition was the decider.) Cold start / no action-schema mapping yet. Affected: ${d.slice(0,5).join("; ")}${d.length>5?`; +${d.length-5} more`:""}`)));let _=on(t.normalized);return _.length>0&&(u.normalizedDrift=_,this.warnedNormalizedDrift||(this.warnedNormalizedDrift=!0,console.warn(`[UNIFIED] normalized event carries ${_.length} value(s) outside the canonical vocabulary \u2014 a builder-authored rule can only select in-vocab values, so these cannot match one, so a rule keyed on the canonical value does not fire here. Check the harness classifier's casing/spelling. Affected: ${_.slice(0,5).join("; ")}${_.length>5?`; +${_.length-5} more`:""}`))),this.foldSession(t,u.enforced?u.decision:"permit"),u.enforced&&u.action.decision==="approval_required"&&await this.registerHitl(t,u),this.bufferTelemetry(t,u,Date.now()-n,u.enforced),u}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}readSession(e){if(!e)return be;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>ba?(this.sessions.delete(e),be):t.state:be}foldActionClass(e){let t=e.normalized?.action_class;if(typeof t=="string"&&t.length>0)return t;let n=this.rawBundle?.action_schemas;if(!Array.isArray(n))return;let{id:r}=this.buildActionSchemaEvent(e),o=n.find(s=>s?.id===r);if(!o)return;let i=o.action_class,a=typeof o.action_class_confidence=="number"?o.action_class_confidence:0;if(typeof i=="string"&&i.length>0&&a>=va)return i}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),o=e.resourceMetadata??{},i=e.operations.includes("retrieval"),a=e.operations.includes("action")||e.operations.includes("delegation"),s=sn(r===be?an():r,{data_categories:i&&Array.isArray(o.data_categories)?o.data_categories:void 0,classification:i?o.classification:void 0,taint:i?Aa(e.contentPreview,o):void 0,action_class:a?this.foldActionClass(e):void 0,target_app:a?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:s,touchedAt:Date.now()}),this.sessions.size>ya){let l=this.sessions.keys().next().value;l!==void 0&&this.sessions.delete(l)}}applyAgentMode(e,t,n,r){let o=Date.now()-r;if(t==="enforce"){let a={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,a,o,!0),a}let i={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,i,o,!1),i}setFailMode(e){this.failMode=e}getFailMode(){return this.failMode}getGovernedFailMode(){return this.governedFailMode}failOpen(e,t,n){let r=`fail-open: ${t} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`;console.error(`[VisIQ] FAIL-OPEN: ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`);let o=e.operations.includes("action")||e.operations.includes("delegation"),i=e.operations.includes("retrieval"),a={decision:"permit",allowed:!0,reason:r,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:o?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:i?{action:"allow"}:{action:null},failOpen:!0};return this.bufferTelemetry(e,a,Date.now()-n,!1,!0),a}reportFailOpen(e,t){try{let n={operations:["action"],agentId:this.resolvedAgentId,...t?.toolName?{toolName:t.toolName}:{},...t?.sessionId?{sessionId:t.sessionId}:{}},r={decision:"permit",allowed:!0,reason:`fail-open: ${e} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:{decision:"permit",allowed:!0},retrieval:{action:null},failOpen:!0};this.bufferTelemetry(n,r,0,!1,!0)}catch{}}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},action_schema_id:this.buildActionSchemaEvent(e).id,...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=Sa.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}let r=la(t.rules);if(r.length>0){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle contains rego_source using a builtin the engine cannot evaluate (would silently never match \u2192 fail open): ${r.join("; ")}. Refusing the bundle and failing closed (G001). Recompile the rule without case-folding wrappers like upper()/lower().`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(o=>gn(o)).filter(o=>o!==null),this.agentAttributes=t.agent_attributes?Ta(t.agent_attributes):null,this.agentNoCoverage=fn(t.agent_attributes?.no_coverage),this.governedFailMode=ke(t.agent_attributes?.fail_mode)??null,this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=Ea(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.normalizedRefs=ca(this.rules),this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1,this.lastNormalizedWarnRearmMs=Date.now(),this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...H(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304){let a=Date.now();a-this.lastNormalizedWarnRearmMs>=pa&&(this.lastNormalizedWarnRearmMs=a,this.warnedNormalizedAbsent=!1,this.warnedNormalizedDrift=!1);return}if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),o=await n.json();this.applyBundle(o);let i=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&i?this.bundleEtag=r:i||(this.bundleEtag=null),i&&await this.persistBundleToDisk(o)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await aa(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(ta(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await ia(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}isBundleLoaded(){return this.bundleLoaded}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e,t){this.registerEnvironment({...De(),...e?{agent_type:e}:{},...t?.model?{model:t.model}:{},...t?.systemPrompt?{systemPrompt:t.systemPrompt}:{},...t?.toolSchemas&&t.toolSchemas.length>0?{toolSchemas:t.toolSchemas}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));for(let n of e)n.description&&this.toolDescriptions.set(n.name,n.description);t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}captureCloneMetadata(e){if(!this.client||!this.resolvedAgentId||!(e.model||e.systemPrompt||(e.toolSchemas?.length??0)>0))return;let t=JSON.stringify({m:e.model??"",s:e.systemPrompt??"",t:e.toolSchemas??[]});t!==this.lastCloneCaptureSig&&(this.lastCloneCaptureSig=t,this.client.registerEnvironment({...De(),...e.agentType?{agent_type:e.agentType}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{systemPrompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{toolSchemas:e.toolSchemas}:{}}))}buildActionSchemaEvent(e){let t=e.toolName?this.toolDescriptions.get(e.toolName):void 0,n={agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{},...e.toolArgs?{tool_args:e.toolArgs}:{},...t?{tool_description:t}:{}},r=mn(n),o={...n};return e.toolArgs&&(o.tool_args=Rn(e.toolArgs)),{canonical:n,id:r,rawEventForWire:o}}bufferTelemetry(e,t,n,r,o=!1){let i=this.buildActionSchemaEvent(e);this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?Ra(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:i.rawEventForWire,action_schema_id:i.id,...this.harnessKind||e.context||o||t.normalizedColdStart||t.normalizedDrift?{context:{...this.harnessKind?{[jt]:this.harnessKind}:{},...e.context??{},...o?{fail_open:!0}:{},...t.normalizedColdStart?{normalized_cold_start:!0,normalized_inert_conditions:t.normalizedColdStart.length}:{},...t.normalizedDrift?{normalized_drift:!0,normalized_drift_values:t.normalizedDrift.length,normalized_drift_fields:t.normalizedDrift.slice(0,_a)}:{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=ma&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0);try{await this.client.sendTelemetry(e)}catch(t){console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",t)}}enforceTelemetryCap(){let e=this.telemetryBuffer.length-Kn;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${Kn})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(Vi(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=ha&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-Gn;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${Gn})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}await this.flushTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),ht.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function mt(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function xa(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function F(e,...t){for(let n of t){let r=xa(e[n]);if(r)return r}}var Oa=[{framework:"openai-agents",matches:e=>/^transfer_to_.+/.test(e),extract:(e,t)=>{let n=e.replace(/^transfer_to_/,"");return{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"teammate",task:F(t,"task","input","reason","message"),source:"structural"}}},{framework:"voltagent",matches:e=>e==="delegate_task",extract:(e,t)=>{let n=F(t,"targetAgent","agent","subAgent","agentName","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:F(t,"task","message","input"),description:F(t,"purpose"),source:"structural"}:null}},{framework:"crewai",matches:e=>/delegate work to (co-?worker|.+)/i.test(e),extract:(e,t)=>{let n=F(t,"coworker","agent","role");return n?{childAgentId:n,childName:n,kind:"teammate",agentType:n,task:F(t,"task","question"),description:F(t,"context"),source:"structural"}:null}},{framework:"llamaindex",matches:e=>e==="handoff"||/handoff/i.test(e),extract:(e,t)=>{let n=F(t,"to_agent","toAgent","agent_name","agentName","agent","name");return n?{childAgentId:n,childName:n,kind:"subagent",task:F(t,"reason","task","message"),source:"structural"}:null}},{framework:"generic",matches:e=>/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)([_-].+)?$/i.test(e),extract:(e,t)=>{let n=F(t,"agent","agentName","agentId","target","targetAgent","to","to_agent","coworker","name")??(/[_-]/.test(e)?e.replace(/^(delegate|hand[_-]?off|route[_-]?to|call[_-]?agent)[_-]/i,""):void 0);return n?{childAgentId:n,childName:n.replace(/[_-]+/g," ").trim(),kind:"subagent",task:F(t,"task","message","input","reason","prompt"),source:"heuristic"}:null}}];function Ke(e,t){if(!e)return null;let n=t??{};for(let r of Oa)try{if(r.matches(e)){let o=r.extract(e,n);if(o)return o}}catch{}return null}function Ge(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}function _t(e){if(e===null||typeof e!="object"||Array.isArray(e))return{input:e===void 0?"":String(e)};let t=e,n=Object.keys(t);return n.length===1&&n[0]==="context"&&t.context!==null&&typeof t.context=="object"?t.context:t}function er(e){if(typeof e=="string"){try{let t=JSON.parse(e);if(t!==null&&typeof t=="object"&&!Array.isArray(t))return t}catch{}return{input:e}}return e!==null&&typeof e=="object"&&!Array.isArray(e)?e:{input:e===void 0?"":String(e)}}function M(e){let t=[],n=[],r,o=[];for(let a of e){if(a.mode==="partial"||a.mode==="email"||a.mode==="custom"){let l={mode:a.mode};a.field&&(l.field=a.field),a.pattern&&(l.pattern=a.pattern),typeof a.keepFirst=="number"&&(l.keepFirst=a.keepFirst),typeof a.keepLast=="number"&&(l.keepLast=a.keepLast),a.maskChar&&(l.maskChar=a.maskChar),a.keepPattern&&(l.keepPattern=a.keepPattern),a.replacement!==void 0&&(l.replacement=a.replacement),o.push(l);continue}a.field&&t.push(a.field),a.pattern&&n.push(a.pattern);let{replacement:s}=a;s&&r===void 0&&(r=s)}let i={};return t.length>0&&(i.fields=t),n.length>0&&(i.patterns=n),r!==void 0&&(i.replacement=r),o.length>0&&(i.directives=o),i}var V="0.2.10";import{AsyncLocalStorage as Na}from"node:async_hooks";var C=new Na,La=5120,tr=50;function Ma(e,t){if(typeof e!="string")return"";let n=new TextEncoder,r=n.encode(e);if(r.length<=t)return e;let i=`\u2026[truncated ${Math.ceil(r.length/1024)}KB]`,a=n.encode(i).length,s=Math.max(0,t-a),l=r.subarray(0,s);return new TextDecoder("utf-8",{fatal:!1}).decode(l)+i}function z(e){if(!e)return;let t=r=>r.length<=tr?r.slice():r.slice(r.length-tr),n=r=>Ma(r,La);return{session_id:e.session_id,llm_prompts:t(e.llm_prompts).map(n),llm_responses:t(e.llm_responses).map(n),agent_reasoning:t(e.agent_reasoning).map(n)}}var yt=12e4,nr=2e3,rr=3,Da=5e3;function Ae(e,t){return e==="mask"&&(t?.length??0)>0}var Fa=new Set(["approved","resolved"]),$a=new Set(["rejected","dismissed","expired","timeout","bypassed_disabled"]);function Pa(e){return new Promise(t=>setTimeout(t,e))}function ja(e){if(typeof e!="object"||e===null)return null;let t=e,n=t.hitl_result;if(typeof n=="string"&&n.length>0)return n;let{hitl:r}=t;if(r&&typeof r=="object"){let{status:o}=r;if(typeof o=="string"&&o.length>0)return o==="pending"?null:o}return null}async function Ie(e){let{endpoint:t,apiKey:n,decisionId:r,timeoutMs:o=yt,maskFallback:i=!1,sdkVersion:a,fetchImpl:s=globalThis.fetch,sleep:l=Pa,log:c=p=>console.warn(p)}=e,u=p=>i?{resolution:"mask",reason:p}:{resolution:"block",reason:p};if(!t)return u("HITL approval cannot be confirmed (no backend endpoint) \u2014 fail-closed (G001)");if(!r)return u("HITL approval cannot be confirmed (no decision id) \u2014 fail-closed (G001)");let d=`${t.replace(/\/$/,"")}/v1/allow/decisions/${encodeURIComponent(r)}`,_={Accept:"application/json",...H(a)};n&&(_.Authorization=`Bearer ${n}`);let f=Date.now()+Math.max(0,o),g=0;for(c(`[VisIQ HITL] Awaiting human approval for decision ${r} (timeout ${o}ms)`);;){if(Date.now()>=f)return c(`[VisIQ HITL] Decision ${r} timed out after ${o}ms \u2014 ${i?"masking":"blocking"} (G001)`),u("HITL approval timed out");let p=null;try{let y=new AbortController,x=setTimeout(()=>y.abort(),Da),A;try{A=await s(d,{method:"GET",headers:_,signal:y.signal})}finally{clearTimeout(x)}if(!A.ok)throw new Error(`HTTP ${A.status} ${A.statusText}`);let T=await A.json();p=ja(T),g=0}catch(y){g+=1;let x=y instanceof Error?y.message:String(y);if(c(`[VisIQ HITL] Poll failed for decision ${r} (${g}/${rr}): ${x}`),g>=rr)return u(`HITL approval poll failed repeatedly \u2014 fail-closed (G001): ${x}`);await l(nr);continue}if(p!==null){let y=p.toLowerCase();return Fa.has(y)?(c(`[VisIQ HITL] Decision ${r} approved (${p}) \u2014 proceeding`),{resolution:"proceed",reason:`Approved by human reviewer (${p})`}):$a.has(y)?(c(`[VisIQ HITL] Decision ${r} resolved as ${p} \u2014 ${i?"masking":"blocking"}`),u(`Not approved by human reviewer (${p})`)):(c(`[VisIQ HITL] Decision ${r} returned unknown status '${p}' \u2014 ${i?"masking":"blocking"} (G001)`),u(`HITL returned unknown status '${p}' \u2014 fail-closed (G001)`))}await l(nr)}}function K(e){return e??ke(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??ze}function v(e,t){try{console.error(`[VisIQ] FAIL-OPEN (${e}): ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`)}catch{}}function U(e,t){try{console.error(`[VisIQ] TRACE-DEGRADED (${e}): ${t} \u2014 the governance decision was still made and enforced; only the execution-trace beat was lost.`)}catch{}}function re(e){let t=e.getFailMode;return(typeof t=="function"?t.call(e):void 0)??K()}function Y(e){return e.enforced?{allowed:e.action.allowed,decision:e.action.decision,...e.action.decisionId!==void 0?{decisionId:e.action.decisionId}:{},...e.ruleCode!==null?{ruleCode:e.ruleCode}:{},reason:e.reason,argRedactionRules:e.action.argRedactionRules??[],...e.action.hitlFallback?{hitlFallback:e.action.hitlFallback}:{}}:{allowed:!0,decision:"permit",reason:e.reason,argRedactionRules:[]}}function ir(e){if(!e.enforced)return{action:"allow",reason:e.reason,redactionRules:[]};let t=e.retrieval.action??"deny",n=e.retrieval.redactionRules??[];return t==="escalate"&&Ae(e.retrieval.hitlFallback,n)?{action:"redact",reason:e.reason,redactionRules:n}:{action:t,reason:e.reason,redactionRules:n}}var or=new Set;function kt(e){or.has(e)||(or.add(e),console.warn(`[VisIQ] unrecognized retrieval outcome "${e}" \u2014 failing closed (withholding content). Upgrade @visiq/harness if a newer control plane introduced this outcome.`))}async function We(e,t,n){let r=C.getStore(),o=z(r),i=await e.evaluate({operations:["retrieval"],agentId:t,...r?.session_id?{sessionId:r.session_id}:{},resourceType:n.resourceType??"document",resourceMetadata:n.resourceMetadata??{},...n.query!==void 0?{query:n.query}:{},...n.contentPreview!==void 0?{contentPreview:n.contentPreview}:{},...o?{telemetry:o}:{}});return ir(i)}async function Qe(e,t,n){return await e.awaitBundleReady(),We(e,t,n)}function ar(e,t,n=K()){switch(t.action){case"allow":case"escalate":return e;case"deny":return null;case"redact":{if(t.redactionRules.length===0)return e;try{return L(e,M(t.redactionRules))}catch{return n==="closed"?null:(v("redact-error","document redaction failed \u2014 document passed UNREDACTED"),e)}}default:return kt(String(t.action)),n==="closed"?null:(v("unknown-retrieval-verb",`unrecognized outcome "${String(t.action)}" \u2014 document passed through`),e)}}async function sr(e,t,n,r){if(!Array.isArray(e)||e.length===0)return e;await r.awaitBundleReady();let o=[];for(let i of e){let a=i,s=String(a.pageContent??a.text??a.content??""),l=a.metadata??{},c=await We(r,t,{resourceType:"document",resourceMetadata:l,query:n,contentPreview:s.slice(0,500)}),u=ar(i,c,re(r));u!==null&&o.push(u)}return o}async function lr(e,t,n){if(typeof e!="string")return e;await n.awaitBundleReady();let r;try{r=await We(n,t,{resourceType:"document",resourceMetadata:{content_preview:e.slice(0,500)},contentPreview:e.slice(0,500)})}catch(o){return re(n)==="closed"?"[RECALL] Retrieved context blocked \u2014 policy evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":(v("eval-error",`retrieval evaluation failed \u2014 text passed through: ${o instanceof Error?o.message:String(o)}`),e)}switch(r.action){case"allow":case"escalate":return e;case"deny":return"[RECALL] Retrieved context was blocked by policy.";case"redact":{if(r.redactionRules.length===0)return e;try{return L(e,M(r.redactionRules))}catch{return re(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("redact-error","text redaction failed \u2014 text passed UNREDACTED"),e)}}default:return kt(String(r.action)),re(n)==="closed"?"[RECALL] Retrieved context was blocked by policy.":(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 text passed through`),e)}}var cr=4,ur=1e3;function He(e){return e.length===0?!1:e.some(t=>t!==null&&typeof t=="object"&&(typeof t.pageContent=="string"||typeof t.text=="string"||typeof t.content=="string"))}async function dr(e,t,n){let r=[];for(let o of e){let i=o,a=String(i.pageContent??i.text??i.content??""),s={...i.metadata??{},content_preview:a.slice(0,500)},l;try{l=await We(n,t,{resourceType:"document",resourceMetadata:s,contentPreview:a.slice(0,500)})}catch(u){if(re(n)==="closed")continue;v("eval-error",`document retrieval evaluation failed \u2014 document passed through: ${u instanceof Error?u.message:String(u)}`),r.push(o);continue}let c=ar(o,l,re(n));c!==null&&r.push(c)}return r}async function vt(e,t,n,r,o){if(r>cr||o.nodes++>ur)return e;if(Array.isArray(e)){if(He(e))return o.matched=!0,dr(e,t,n);let i=[];for(let a of e)i.push(await vt(a,t,n,r+1,o));return i}if(e!==null&&typeof e=="object"){let i=e,a={...i};for(let s of Object.keys(i))a[s]=await vt(i[s],t,n,r+1,o);return a}return e}async function Ye(e,t,n){if(await n.awaitBundleReady(),Array.isArray(e)&&He(e))return dr(e,t,n);if(e!==null&&typeof e=="object"){let r={nodes:0,matched:!1},o=await vt(e,t,n,0,r);if(r.matched)return o}return e}var Ua={blocked:!0,reason:"[RECALL] Retrieved context was blocked by policy."};function wt(e,t,n){if(t>cr||n.n++>ur)return e;if(Array.isArray(e))return He(e)?[]:e.map(r=>wt(r,t+1,n));if(e!==null&&typeof e=="object"){if(He([e]))return{...Ua};let r=e,o={};for(let i of Object.keys(r))o[i]=wt(r[i],t+1,n);return o}return e}function bt(e){return typeof e=="string"?"[RECALL] Retrieved context was blocked by policy.":Array.isArray(e)?[]:e!==null&&typeof e=="object"?wt(e,0,{n:0}):e}function pr(e,t,n=K()){let r=ir(t);switch(r.action){case"allow":case"escalate":return e;case"deny":return bt(e);case"redact":{if(r.redactionRules.length===0)return e;try{return L(e,M(r.redactionRules))}catch{return n==="closed"?bt(e):(v("redact-error","result redaction failed \u2014 result passed UNREDACTED"),e)}}default:return kt(String(r.action)),n==="closed"?bt(e):(v("unknown-retrieval-verb",`unrecognized outcome "${String(r.action)}" \u2014 result passed through`),e)}}function O(e){return typeof e=="object"&&e!==null?e:null}function fr(...e){for(let t of e)if(typeof t=="string"&&t.trim().length>0)return t}function Ba(e,t){let n=O(e.metadata),r=n&&typeof n.name=="string"?n.name:void 0;return fr(e.name,e.id,r,t)}function qa(e){let t=O(e.metadata),n=t&&typeof t.description=="string"?t.description:void 0,r=fr(e.description,n);return r===void 0?void 0:r.slice(0,4e3)}function Va(e){let t=O(e);return t!==null&&("type"in t||"properties"in t||"$schema"in t)}function za(e){let t=O(e);if(t===null||!("_def"in t))return;let{shape:n}=t;if(typeof n=="function")try{n=n.call(t)}catch{n=void 0}let r=O(n);if(r===null)return{type:"object"};let o={};for(let i of Object.keys(r))o[i]={};return{type:"object",properties:o}}var Ka=new Set(["default","const","enum","examples","example"]);function At(e){if(Array.isArray(e))return e.map(At);let t=O(e);if(t===null)return e;let n={};for(let[r,o]of Object.entries(t))Ka.has(r)||(n[r]=At(o));return n}function Ga(e){let t;if(Va(e))t=e;else{let n=za(e);if(n===void 0)return;t=n}try{let n=JSON.stringify(t);if(n.length>2e4){let r=O(t),o=r&&O(r.properties);if(o){let i={};for(let a of Object.keys(o))i[a]={};return{type:"object",properties:i}}return{type:"object"}}return At(JSON.parse(n))}catch{return}}function Ha(e){let t=O(e.metadata),n=e.input_schema??e.inputSchema??e.parameters??e.schema??e.args_schema??e.tool_call_schema??(t?t.parameters:void 0);return n===void 0?void 0:Ga(n)}function Wa(e,t){let n=O(e);if(n===null)return null;let r=Ba(n,t);if(r===void 0)return null;let o={name:r.slice(0,255)},i=qa(n);i!==void 0&&(o.description=i);let a=Ha(n);return a!==void 0&&(o.input_schema=a),o}function Se(e){let t=[],n=new Set,r=(o,i)=>{try{let a=Wa(o,i);a!==null&&!n.has(a.name)&&(n.add(a.name),t.push(a))}catch{}};if(Array.isArray(e)){for(let o of e)if(r(o),t.length>=200)break}else if(e instanceof Map){for(let[o,i]of e.entries())if(r(i,typeof o=="string"?o:void 0),t.length>=200)break}else{let o=O(e);if(o!==null){for(let i of Object.keys(o))if(r(o[i],i),t.length>=200)break}}return t}function It(e){try{let t=O(e);if(t===null)return[];let n=[],r=new Set,o=l=>{for(let c of l)!r.has(c.name)&&n.length<200&&(r.add(c.name),n.push(c))};t.tools!==void 0&&o(Se(t.tools));let i=O(t.settings);i&&i.tools!==void 0&&o(Se(i.tools));for(let l of["getTools","listTools"]){let c=t[l];if(typeof c=="function")try{o(Se(c.call(t)))}catch{}}let a=O(t.nodes);if(a)for(let l of Object.keys(a)){let c=O(a[l]);c&&c.tools!==void 0&&o(Se(c.tools))}let{agents:s}=t;if(s instanceof Map)for(let l of s.values()){let c=O(l);c&&c.tools!==void 0&&o(Se(c.tools))}return n}catch{return[]}}import{z as Ze}from"zod";var Qa=Ze.object({decision:Ze.enum(["permit","deny"]),reason:Ze.string(),handoff_event_id:Ze.string().nullable()}),j=class extends Error{constructor(e,t,n){super(e),this.code=t,this.status=n,this.name="OrchestrateError"}code;status},Z=class extends j{constructor(e,t){super(`Orchestrate grant denied: ${e}`,"GRANT_DENIED"),this.reason=e,this.handoffEventId=t,this.name="GrantDeniedError"}reason;handoffEventId},Ya="https://api.visiqlabs.com",Za=1e4,oe=class{config;fetch;constructor(e,t=globalThis.fetch){this.config={agentId:e.agentId,apiKey:e.apiKey??process.env.VISIQ_API_KEY??"",endpoint:e.endpoint??process.env.VISIQ_ENDPOINT??Ya,timeoutMs:e.timeoutMs??Za},this.fetch=t}get headers(){return{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,"X-Agent-ID":this.config.agentId}}async post(e,t){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),o;try{o=await this.fetch(`${this.config.endpoint}${e}`,{method:"POST",headers:this.headers,body:JSON.stringify(t),signal:n.signal})}finally{clearTimeout(r)}let i=await o.json();if(!o.ok){let a=i?.error??`HTTP ${o.status}`;throw new j(a,"API_ERROR",o.status)}return i}async requestGrant(e){let t=await this.post("/orchestrate/grants",{parent_agent_id:e.parentAgentId,child_agent_id:e.childAgentId,tool_scope:e.toolScope??null,context_scope:e.contextScope??null,purpose:e.purpose,duration_seconds:e.durationSeconds,max_depth:e.maxDepth,parent_grant_token:e.parentGrantToken});return{grantId:t.grant_id,status:"pending",effectiveToolScope:t.effective_tool_scope,effectiveContextScope:t.effective_context_scope,acceptDeadline:t.accept_deadline}}async acceptGrant(e){let t=await this.post(`/orchestrate/grants/${e}/accept`,{});return{grantToken:t.grant_token,toolScope:t.tool_scope,contextScope:t.context_scope,expiresAt:t.expires_at}}async evaluate(e){let t=await this.post("/orchestrate/evaluate",{grant_token:e.grantToken,action:e.action,resource_type:e.resourceType,resource_metadata:e.resourceMetadata??{}}),n=Qa.parse(t);return{decision:n.decision,reason:n.reason,handoffEventId:n.handoff_event_id}}async revokeGrant(e,t){return{revokedCount:(await this.post(`/orchestrate/grants/${e}/revoke`,{reason:t})).revoked_count}}};var mr=new Map;async function gr(e,t){if(!e||e.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: agentId is required");if(!t||t.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: grantId is required");let n=mr.get(e);if(n)return n;let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[ORCHESTRATE] bootstrapGrant: VISIQ_API_KEY env var is required");let o=process.env.VISIQ_ENDPOINT,i=(await new oe({agentId:e,apiKey:r,...o?{endpoint:o}:{}}).acceptGrant(t)).grantToken;if(!i||i.trim()==="")throw new Error("[ORCHESTRATE] bootstrapGrant: backend returned empty grant token");return mr.set(e,i),i}var Te=Symbol.for("visiq.orchestrate.wrapped");function Ja(e){return e instanceof j&&typeof e.status=="number"&&e.status>=400&&e.status<500}function hr(e,t){if(!t.agentId||t.agentId.trim()==="")throw new j("agentId is required","CONFIG_ERROR");if(!t.grantToken||t.grantToken.trim()==="")throw new j("grantToken is required","CONFIG_ERROR");if(e[Te]===!0)return e;let n=new oe(t),r=t.failBehavior??(process.env.VISIQ_FAIL_MODE?.trim().toLowerCase()==="closed"?"deny":"permit"),o=async(i,a)=>{let s;try{s=await n.evaluate({grantToken:t.grantToken,action:i,resourceType:a})}catch(l){if(Ja(l))throw l;if(r==="permit"){console.warn('[VisIQ] FAIL-OPEN (orchestrate-eval-error): evaluate failed \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed (or failBehavior:"deny") to block instead.',l);return}throw new j(`ORCHESTRATE evaluate failed: ${l instanceof Error?l.message:String(l)}`,"EVALUATE_ERROR")}if(s.decision==="deny")throw new Z(s.reason,s.handoffEventId)};return new Proxy(e,{get(i,a,s){let l=Reflect.get(i,a,s);return a===Te?!0:a==="_call"&&typeof l=="function"?async function(c,...u){let d=i.name;return await o(d??"_call"),l.call(this??i,c,...u)}:(a==="call"||a==="execute"||a==="run")&&typeof l=="function"?async function(c,...u){let d=i.name;return await o(d??String(a)),l.call(this??i,c,...u)}:l}})}import{randomUUID as kr}from"node:crypto";var _r=Symbol.for("visiq.semantickernel.instrumented");function vr(e){if(e===null||typeof e!="object")return!1;let t=e;return typeof t.useFunctionInvocation=="function"&&typeof t.usePromptRender=="function"&&typeof t.execute!="function"&&typeof t.generate!="function"&&typeof t.run!="function"}function yr(e){let t=e.arguments;return t&&typeof t=="object"&&"arguments"in t&&t.arguments&&typeof t.arguments=="object"?t.arguments:t??{}}function br(e,t){let n=e.arguments;if(n&&typeof n=="object"&&"arguments"in n&&n.arguments&&typeof n.arguments=="object"){let r=n.arguments;for(let o of Object.keys(r))delete r[o];Object.assign(r,t);return}e.arguments=t}function B(e,t){e.result&&typeof e.result=="object"?e.result.value=t:e.result={value:t}}function Xa(e){return e.result?.value}function es(e){let{agentId:t,unified:n,failMode:r}=e;return async function(i,a){let s=i.function?.metadata?.name??"unknown",l=i.function?.metadata?.pluginName,c=yr(i),u=l;try{let p=await n.evaluate({operations:["action"],agentId:t,toolName:s,toolArgs:c,...u!==void 0?{targetResource:u}:{}}),y=Y(p);if(!y.allowed){B(i,E({outcome:"deny",code:y.ruleCode??"DENY",reason:y.reason}));return}y.decision==="mask"&&y.argRedactionRules.length>0&&br(i,L(c,M(y.argRedactionRules)));let x=yr(i),A=ne(s,x,{failMode:r==="closed"?"closed":"open",enforced:p.enforced});if(A.verdict==="block"){B(i,E({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${A.detectors.join(",")})`}));return}A.verdict==="redact"&&(br(i,A.redacted),v("outbound-secret-redacted",`outbound secret screen redacted ${A.detectors.length} detector(s): ${A.detectors.join(",")}`))}catch(p){if(r==="closed"){B(i,E({outcome:"error",code:"EVAL-ERROR",mechanism:`evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}`}));return}v("eval-error",`SK action pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}try{let p=await Qe(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l}});if(p.action==="deny"||p.action==="escalate"){B(i,`[RECALL: access denied \u2014 ${p.reason}]`);return}}catch(p){if(r==="closed"){B(i,`[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed): ${p instanceof Error?p.message:String(p)}.`);return}v("eval-error",`SK retrieval pre-gate failed for "${s}": ${p instanceof Error?p.message:String(p)}`)}await a(i);let d=Xa(i),f=(typeof d=="string"?d:(()=>{try{return JSON.stringify(d)??String(d)}catch{return String(d)}})()).slice(0,500),g;try{g=await Qe(n,t,{resourceType:"tool_result",resourceMetadata:{function_name:s,plugin_name:l,content_preview:f},contentPreview:f})}catch(p){r==="closed"?B(i,"[RECALL] Result withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("eval-error",`SK post-result retrieval eval failed for "${s}": ${p instanceof Error?p.message:String(p)}`);return}if(g.action==="deny"||g.action==="escalate"){B(i,`[RECALL: access denied \u2014 ${g.reason}]`);return}if(g.action==="redact"&&g.redactionRules&&g.redactionRules.length>0&&d!==null&&d!==void 0)try{B(i,L(d,M(g.redactionRules)))}catch(p){r==="closed"?B(i,"[RECALL] Result withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed)."):v("redact-error",`SK result redaction failed for "${s}" \u2014 result passed UNREDACTED: ${p instanceof Error?p.message:String(p)}`)}}}function ts(e){return async function(n,r){await r(n);let o=n.renderedPrompt;if(typeof o!="string"||o.length===0)return;let i;try{i=await Qe(e.unified,e.agentId,{resourceType:"prompt",resourceMetadata:{},contentPreview:o.slice(0,500)})}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 evaluation error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("eval-error",`SK prompt-render eval failed: ${a instanceof Error?a.message:String(a)}`);return}if(i.action==="redact"&&i.redactionRules&&i.redactionRules.length>0){try{n.renderedPrompt=L(o,M(i.redactionRules))}catch(a){e.failMode==="closed"?n.renderedPrompt="[RECALL] Prompt withheld \u2014 redaction error (blocked \u2014 VISIQ_FAIL_MODE=closed).":v("redact-error",`SK prompt redaction failed \u2014 prompt passed UNREDACTED: ${a instanceof Error?a.message:String(a)}`)}return}(i.action==="deny"||i.action==="escalate")&&(n.renderedPrompt=`[RECALL: prompt suppressed \u2014 ${i.reason}]`)}}function wr(e,t){let n=e;if(n[_r]===!0)return t.onWrap?.(),e;let r=es(t),o=ts(t),i=!1;return Array.isArray(n._functionInvocationFilters)?(n._functionInvocationFilters.unshift(r),i=!0):typeof n.useFunctionInvocation=="function"&&(n.useFunctionInvocation(r),i=!0),typeof n.usePromptRender=="function"?n.usePromptRender(o):Array.isArray(n._promptRenderFilters)&&n._promptRenderFilters.push(o),i&&(n[_r]=!0,t.onWrap?.()),e}function E(e){let t=/^D-/.test(e.code),n;e.outcome==="approval_required"?n="requires human approval, which was not granted":e.outcome==="error"?n="was blocked (fail-closed) after a policy-evaluation error":n="was denied by policy";let r=e.reason?.trim(),o;r?o=r:t?o="no policy rule covers this action, so the organization default applied":e.outcome==="approval_required"?o="this action is routed to a human for approval":o="denied by policy";let i=e.mechanism?.trim()?` \u2014 ${e.mechanism.trim()}`:"";return`[VisIQ decision=${e.outcome} code=${e.code}] This tool call was NOT executed: it ${n} (${o})${i}. VisIQ is a security harness installed by your developer. Report this reason to the user verbatim; do not invent a different one.`}function Je(e){return e instanceof Error?e.message:String(e)}var ns=/https?:\/\/[^\s"'`,)}\]]+/;function St(e){let t=e.match(ns);if(t)try{let n=new URL(t[0]);return n.hostname+n.pathname}catch{return t[0]}}var ie=Symbol.for("visiq.toolexec.instrumented");function rs(e){return e!==null&&typeof e=="object"&&typeof e.execute=="function"}var Tt={vercel:"Vercel AI SDK agent",mastra:"Mastra Agent",openai:"OpenAI Agents SDK agent",llamaindex:"LlamaIndex.TS agent",voltagent:"VoltAgent agent","semantic-kernel":"Semantic Kernel"};function Ar(e){if(e===null||typeof e!="object")return null;let t=e;if(rs(t))return null;if(vr(e))return"semantic-kernel";if(typeof t.generateText=="function"&&(typeof t.getTools=="function"||t.toolManager!==void 0))return"voltagent";if(typeof t.run=="function"&&typeof t.runStream=="function"&&t.agents!==void 0)return"llamaindex";if(Array.isArray(t.tools)&&t.handoffs!==void 0&&(typeof t.on=="function"||t.eventEmitter!==void 0))return"openai";if(typeof t.generate=="function"&&typeof t.getLLM=="function"&&(typeof t.listTools=="function"||typeof t.getTools=="function"))return"mastra";if(typeof t.generate=="function"){let n=t.settings;if(n&&typeof n=="object"&&n.tools!==void 0||t.tools!==void 0)return"vercel"}return null}async function os(e,t,n,r,o,i){let{agentId:a,unified:s}=e,l=z(o),c,u=!1;try{await s.awaitBundleReady();let p=await s.evaluate({operations:i?["action","delegation"]:["action"],agentId:a,toolName:t,toolArgs:n,...i?{context:Ge(i,a)}:{},...o?.session_id?{sessionId:o.session_id}:{},...r!==void 0?{targetResource:r}:{},...l?{telemetry:l}:{}});({enforced:u}=p),c=Y(p)}catch(p){let y=p instanceof Error?p.message:String(p);return e.failMode==="closed"?{block:E({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${y} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})}:(v("eval-error",`policy evaluation failed for tool "${t}": ${y}`),{block:null})}if(c.decision==="approval_required"&&c.decisionId){let p=s.getApiKey()??e.apiKey,y=await Ie({endpoint:s.getEndpoint()??e.endpoint??"",...p?{apiKey:p}:{},decisionId:c.decisionId,timeoutMs:e.hitlTimeoutMs,sdkVersion:V});return y.resolution!=="proceed"?{block:E({outcome:"approval_required",code:c.ruleCode??"HITL-BLOCK",reason:c.reason,mechanism:y.reason}),decision:c}:{block:null}}if(!c.allowed)return{block:E({outcome:"deny",code:c.ruleCode??"DENY",reason:c.reason}),decision:c};let d=n,_=!1,f;if(c.decision==="mask"&&c.argRedactionRules&&c.argRedactionRules.length>0)try{let p=M(c.argRedactionRules);d=L(n,p),_=!0,f=c}catch(p){let y=p instanceof Error?p.message:String(p);if(e.failMode==="closed")return{block:E({outcome:"error",code:"MASK-ERROR",mechanism:`argument masking failed: ${y} (blocked \u2014 VISIQ_FAIL_MODE=closed)`})};v("mask-error",`argument masking failed for tool "${t}" \u2014 running with UNMASKED args: ${y}`)}let g=ne(t,d,{failMode:e.failMode==="closed"?"closed":"open",enforced:u});return g.verdict==="block"?{block:E({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${g.detectors.join(",")})`}),decision:{allowed:!1,decision:"deny",ruleCode:"OUTPUT-BLOCK",reason:"outbound content carried a live secret",argRedactionRules:[]}}:(g.verdict==="redact"&&(d=g.redacted,_=!0,v("outbound-secret-redacted",`outbound secret screen redacted ${g.detectors.length} detector(s): ${g.detectors.join(",")}`),f??={allowed:!0,decision:"mask",ruleCode:"OUTPUT-BLOCK",reason:"outbound secret redacted before egress",argRedactionRules:[]}),_?{block:null,maskedArgs:d,decision:f}:{block:null})}async function Et(e,t,n,r,o){let i=C.getStore()??e.telemetry,a=Ke(t,n);a&&me(e.unified,{agentId:e.agentId,sessionId:i?.session_id,...e.framework?{framework:e.framework}:{}},a);let s={agentId:e.agentId,sessionId:i?.session_id,...e.framework?{framework:e.framework}:{}},l=de(t,n);try{ge(e.unified,s,{toolName:t,...l?{memory:l}:{},argSummary:r.slice(0,512)})}catch(g){U("step-beat",`emit failed for tool "${t}": ${Je(g)}`)}let c=Date.now(),u=await os(e,t,n,St(r),i,a);if(u.block!==null){try{u.decision&&ee(e.unified,s,{toolName:t,decision:u.decision.decision??"deny",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0,harnessMessage:u.block})}catch(g){U("intervention-beat",`emit failed for tool "${t}": ${Je(g)}`)}return u.block}if(u.maskedArgs!==void 0&&u.decision)try{ee(e.unified,s,{toolName:t,decision:u.decision.decision??"mask",...u.decision.ruleCode?{ruleCode:u.decision.ruleCode}:{},...u.decision.reason?{ruleLabel:u.decision.reason}:{},enforced:!0})}catch(g){U("intervention-beat",`emit failed for tool "${t}": ${Je(g)}`)}let d=u.maskedArgs??n,_=await o(d),f=await Ye(_,e.agentId,e.unified);try{he(e.unified,s,{toolName:t,ok:!0,durationMs:Date.now()-c,...W(f)!==void 0?{bytes:W(f)}:{},...Q(f)!==void 0?{itemCount:Q(f)}:{},...l?{memory:l}:{}})}catch(g){U("observation-beat",`emit failed for tool "${t}": ${Je(g)}`)}return f}function Xe(e,t,n){let r=e;if(r[ie]){n.onWrap?.();return}if(typeof r.execute!="function")return;let o=r.execute;Ct(r,"execute",async function(...a){let s=_t(a[0]);return Et(n,t,s,Re(s),l=>Promise.resolve(o.apply(this,[l,...a.slice(1)])))}),r[ie]=!0,n.onWrap?.()}function is(e,t,n){let r=e;if(r[ie]){n.onWrap?.();return}if(typeof r.invoke!="function")return;let o=r.invoke;Ct(r,"invoke",async function(...a){let s=a[1],l=er(s),c=typeof s=="string"?s:Re(l);return Et(n,t,l,c,u=>{let d=typeof s=="string"?JSON.stringify(u):u;return Promise.resolve(o.apply(this,[a[0],d,...a.slice(2)]))})}),r[ie]=!0,n.onWrap?.()}function as(e,t){let n=e;if(n[ie]){t.onWrap?.();return}if(typeof n.call!="function")return;let r=n.metadata,o=typeof r?.name=="string"?r.name:"unknown",i=n.call;Ct(n,"call",async function(...s){let l=_t(s[0]);return Et(t,o,l,Re(l),c=>Promise.resolve(i.apply(this,[c,...s.slice(1)])))}),n[ie]=!0,t.onWrap?.()}function Ir(e,t){for(let[n,r]of Object.entries(e))r!==null&&typeof r=="object"&&Xe(r,n,t);return e}function Sr(e,t,n){let r={...t,framework:n};switch(n){case"vercel":return ss(e,r);case"mastra":return ls(e,r);case"openai":return ds(e,r);case"llamaindex":return us(e,r);case"voltagent":return cs(e,r);case"semantic-kernel":return wr(e,r);default:return e}}function ss(e,t){let n=e,r=n.settings&&typeof n.settings=="object"?n.settings:void 0,o=r?.tools??n.tools;return o&&typeof o=="object"&&Ir(o,t),r&&!r.__visiq_step&&(r.__visiq_step=!0,r.onStepFinish=Rt(r.onStepFinish)),et(e,["generate","stream"],async(i,a)=>(Ee(a,i[0]),i)),e}function ls(e,t){let r=gs(e);return r&&Ir(r,t),et(e,["generate","stream","generateVNext","streamVNext"],async(o,i)=>{Ee(i,o[0]);let a=o[1]&&typeof o[1]=="object"?{...o[1]}:{};a.onStepFinish=Rt(a.onStepFinish);let s=[...o];return s[1]=a,s}),e}function cs(e,t){let n=fs(e);if(n){for(let r of n)if(r!==null&&typeof r=="object"){let{name:o}=r;Xe(r,typeof o=="string"?o:"unknown",t)}}return et(e,["generateText","streamText","generateObject","streamObject"],async(r,o)=>{Ee(o,r[0]);let i=r[1]&&typeof r[1]=="object"?{...r[1]}:{};i.onStepFinish=Rt(i.onStepFinish);let a=[...r];return a[1]=i,a}),e}function us(e,t){let n=e,r=i=>{let a=i?.tools;if(Array.isArray(a))for(let s of a)s!==null&&typeof s=="object"&&as(s,t)},{agents:o}=n;if(o instanceof Map)for(let i of o.values())r(i);else Array.isArray(n.tools)&&r(n);return et(e,["run"],async(i,a)=>(Ee(a,i[0]),i)),ms(e,"runStream",(i,a,s)=>{s||Ee(a,i[0])}),e}function ds(e,t){let n=e,{tools:r}=n;if(Array.isArray(r)){for(let o of r)if(o!==null&&typeof o=="object"){let{name:i}=o;is(o,typeof i=="string"?i:"unknown",t)}}return ps(e,t),e}function ps(e,t){let n=e;if(n.__visiq_openai_hooks||typeof n.on!="function")return;let r=n.on,{telemetry:o}=t;r.call(e,"agent_start",(...i)=>{o.session_id=kr(),o.llm_prompts=[],o.llm_responses=[],o.agent_reasoning=[],o.retrieverQueries=new Map;let a=i[2];a!=null&&o.llm_prompts.push(Re(a).slice(0,5120))}),r.call(e,"agent_end",(...i)=>{let a=i[1];typeof a=="string"&&a&&o.llm_responses.push(a.slice(0,5120))}),n.__visiq_openai_hooks=!0}function fs(e){let t=r=>Array.isArray(r)&&r.some(o=>o!==null&&typeof o.execute=="function");if(typeof e.getTools=="function")try{let r=e.getTools();if(t(r))return r}catch{}let n=e.toolManager;if(n&&typeof n.getAllBaseTools=="function")try{let r=n.getAllBaseTools();if(t(r))return r}catch{}return t(e.tools)?e.tools:null}function et(e,t,n){let r=e;for(let o of t){if(typeof r[o]!="function")continue;let i=`__visiq_wrapped_${o}`;if(r[i])continue;let a=r[o];r[o]=function(...s){let l=Tr();return C.run(l,async()=>{let c=await n(s,l);return a.apply(e,c)})},r[i]=!0}}function ms(e,t,n){let r=e;if(typeof r[t]!="function")return;let o=`__visiq_wrapped_${t}`;if(r[o])return;let i=r[t];r[t]=function(...a){let s=C.getStore(),l=s??Tr();return n(a,l,s!==void 0),C.run(l,()=>i.apply(e,a))},r[o]=!0}function Rt(e){return t=>{let n=C.getStore(),r=t;if(n&&typeof r?.text=="string"&&r.text&&n.llm_responses.push(r.text.slice(0,5120)),typeof e=="function")return e(t)}}function Ee(e,t){if(t==null)return;let n=t;if(typeof t=="object"){let r=t;n=r.prompt??r.messages??t}e.llm_prompts.push(Re(n).slice(0,5120))}function gs(e){for(let t of["listTools","getTools"])if(typeof e[t]=="function")try{let n=e[t]();if(n&&typeof n=="object"&&typeof n.then!="function")return n}catch{}return null}function Tr(){return{session_id:kr(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function Ct(e,t,n){try{e[t]=n}catch{Object.defineProperty(e,t,{value:n,writable:!0,configurable:!0,enumerable:!0})}}function Re(e){try{return JSON.stringify(e)??String(e)}catch{return String(e)}}function Fr(e,t){let n=ws(t);if(e[Te]===!0)return e;let r=Ss(e);if(r==="langchain-executor"||r==="langchain-graph")return se(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,Rr(r,null),n.failMode,{model:Cr(e)}),Or(e,n),Ts(e,n);let o=Ar(e);if(o){se(n.apiKey,n.endpoint,n.agentId,n.timeoutMs,Rr("unknown",o),n.failMode,{model:Cr(e)}),Or(e,n);let i=0,a=Br(n);a.onWrap=()=>{i+=1};let s=Sr(e,a,o);if(i===0){let l=0;try{l=It(e).length}catch{l=0}if(l>0){let c=`[VisIQ] Detected a ${Tt[o]} that ADVERTISES ${String(l)} tool(s) but instrumented ZERO of them \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a tool bag that moved/renamed on a framework version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.`;if(n.onInstrumentFailure!==void 0?n.onInstrumentFailure==="throw":n.failMode==="closed")throw new Error(c);v("zero-instrument",`advertised ${String(l)} tool(s), instrumented none`),console.warn(c)}else{let c=`[VisIQ] Detected a ${Tt[o]} with no tools to instrument (the agent advertises none). If it is intentionally tool-less (LLM-only) this is safe to ignore; otherwise its tool bag is not where this SDK looks for it \u2014 upgrade @visiq/harness or pass the tools through visiq() (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw) to fail closed here.`;if(n.onInstrumentFailure==="throw")throw new Error(c);console.warn(c)}}return s}if(Ls(e)){let i=process.env.VISIQ_GRANT_ID;return i?Ds(e,n,i):Fs(e,n)}throw new Error("[VisIQ] Cannot detect agentic framework. Pass a LangChain AgentExecutor, LangGraph CompiledGraph, or a tool with one of: _call, execute, call, run, invoke.")}var ys="https://api.visiqlabs.com",bs="\0",Er=new Map;function Rr(e,t){if(e==="langchain-executor"||e==="langchain-graph")return"langchain";switch(t){case"vercel":return"vercel_ai";case"mastra":return"mastra";case"openai":return"openai_agents";case"llamaindex":return"llamaindex";case"voltagent":return"voltagent";case"semantic-kernel":return"semantic_kernel";default:return}}function Cr(e){try{if(typeof e!="object"||e===null)return;let t=e,n=ae(t.model);if(n)return n;let{settings:r}=t;if(typeof r=="object"&&r!==null){let a=ae(r.model);if(a)return a}let{llm:o}=t;if(typeof o=="object"&&o!==null){let a=xr(o);if(a)return a}let{agents:i}=t;if(i instanceof Map){for(let a of i.values())if(typeof a=="object"&&a!==null){let s=a,l=s.llm,c=ae(s.model)??(typeof l=="object"&&l!==null?xr(l):void 0);if(c)return c}}return}catch{return}}function xr(e){return ae(e.model)??ae(e.modelId)??ae(e.model_name)}function ae(e){if(typeof e=="string"&&e.trim().length>0)return e.trim();if(typeof e=="object"&&e!==null){let t=e;for(let n of["modelId","model_id","id","model","modelName","model_name"]){let r=t[n];if(typeof r=="string"&&r.trim().length>0)return r.trim()}}}function se(e,t,n,r,o,i,a){let s=[e??"",t??"",n??"",r??"",i??""].join(bs),l=Er.get(s);return l||(l=new Xn(e,t,n,void 0,r,V,ot),l.registerHostEnvironment(o,a),Er.set(s,l)),i!==void 0&&l.setFailMode(i),l}function Or(e,t){try{let n=It(e);n.length>0&&se(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode).reportToolSurface(n)}catch{}}function vs(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_TIMEOUT_MS;if(t!==void 0){let n=Number.parseInt(t,10);if(Number.isFinite(n)&&n>0)return n}}function ws(e){let t=e?.agentId??process.env.VISIQ_AGENT_ID??As(),n=e?.apiKey??process.env.VISIQ_API_KEY,r=e?.endpoint??process.env.VISIQ_ENDPOINT??(n?ys:void 0);return{agentId:t,apiKey:n,endpoint:r,hitlTimeoutMs:Is(e?.hitlTimeoutMs),timeoutMs:vs(e?.timeoutMs),onInstrumentFailure:e?.onInstrumentFailure??ks(),failMode:K(e?.failMode)}}function ks(){let e=process.env.VISIQ_ON_INSTRUMENT_FAILURE;if(e==="throw")return"throw";if(e==="warn")return"warn"}function As(){let e=t=>t.toLowerCase().replace(/^@[^/]+\//,"").replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"").slice(0,255);try{let t=process.cwd();for(let n=0;n<64;n++){let r=nt.join(t,"package.json");if(tt.existsSync(r)){let i=JSON.parse(tt.readFileSync(r,"utf8"));if(typeof i.name=="string"&&i.name.trim()){let a=e(i.name);if(a)return a}break}let o=nt.dirname(t);if(o===t)break;t=o}}catch{}try{let t=e(Dr.hostname());if(t)return t}catch{}return"agent"}function Is(e){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let t=process.env.VISIQ_HITL_TIMEOUT_MS;if(t){let n=Number(t);if(Number.isFinite(n)&&n>0)return n}return yt}function Ss(e){let t=e;return typeof t.invoke=="function"&&t.agent&&Array.isArray(t.tools)?"langchain-executor":typeof t.invoke=="function"&&t.nodes&&(t.edges||t.lg_is_pregel===!0||typeof t.builder=="object"&&t.builder!==null&&t.builder.edges)?"langchain-graph":"unknown"}function Ts(e,t){let n=e,r=se(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode),o=Es(n);for(let l of o)Nt(l,t.agentId,r),xs(l,t.agentId,r,t),jr(l,r,t);let{nodes:i}=n;if(!!i&&typeof i=="object"&&"tools"in i&&o.length===0){let l="[VisIQ] Detected a LangGraph agent whose compiled graph carries a ToolNode, but resolved ZERO tools from it \u2014 its tool calls run UN-GOVERNED while this SDK appears correctly wired. This is almost always a compiled-graph tool bag that moved on a @langchain/langgraph version bump. Upgrade @visiq/harness, or pass the tools through visiq() directly (visiq(tools, \u2026)). Set onInstrumentFailure:'throw' (or VISIQ_ON_INSTRUMENT_FAILURE=throw / VISIQ_FAIL_MODE=closed) to refuse to run ungoverned.";if(t.onInstrumentFailure!==void 0?t.onInstrumentFailure==="throw":t.failMode==="closed")throw new Error(l);v("zero-instrument","langgraph compiled-graph ToolNode present, resolved no tools"),console.warn(l)}let s=n.invoke;if(n.invoke=function(l,c){let u=Ot(),d=Mr(t.agentId,r),_=c?.callbacks??[];return C.run(u,()=>s.call(this,l,{...c,callbacks:[..._,d]}))},typeof n.stream=="function"){let l=n.stream;n.stream=function(c,u){let d=Ot(),_=Mr(t.agentId,r),f=u?.callbacks??[];return C.run(d,()=>l.call(this,c,{...u,callbacks:[...f,_]}))}}return e}function Es(e){let t=[],n=new Set,r=i=>{if(Array.isArray(i))for(let a of i)a&&typeof a=="object"&&!n.has(a)&&(n.add(a),t.push(a))};r(e.tools);let{nodes:o}=e;if(o&&typeof o=="object"){for(let i of Object.values(o))if(i&&typeof i=="object"){let a=i;r(a.tools);let{bound:s}=a;s&&typeof s=="object"&&r(s.tools)}}return t}function Ot(){return{session_id:hs(),llm_prompts:[],llm_responses:[],agent_reasoning:[],retrieverQueries:new Map}}function Nt(e,t,n){let r=e,o=Symbol.for("visiq.recall.instrumented");if(!r[o]){if(typeof r._getRelevantDocuments=="function"){let i=r._getRelevantDocuments;r._getRelevantDocuments=async function(a,s){let l=await i.call(this,a,s);return Nr(l,t,a,n)},r[o]=!0}if(typeof r.retrieve=="function"&&!r._getRelevantDocuments){let i=r.retrieve;r.retrieve=async function(a){let s=await i.call(this,a);return Nr(s,t,String(a),n)},r[o]=!0}r.retriever&&typeof r.retriever=="object"&&Nt(r.retriever,t,n)}}var Rs=Symbol.for("visiq.operations"),Cs=new Set(["action","retrieval","delegation"]);function $r(e){if(typeof e!="object"||e===null)return;let t=e[Rs]??e.visiqOperations;if(!Array.isArray(t))return;let n=t.filter(r=>typeof r=="string"&&Cs.has(r));return n.length>0?Array.from(new Set(n)):void 0}function xs(e,t,n,r){let o=e,i=Symbol.for("visiq.recall.tool-instrumented");if(o[i]||typeof o.func!="function")return;let a=typeof o.name=="string"?o.name:"",s=typeof o.retriever=="object"&&o.retriever!==null,l=a.split(/[^a-zA-Z0-9]+|(?<=[a-z])(?=[A-Z])/).map(I=>I.toLowerCase()),c=new Set(["update","delete","create","write","archive","insert","remove","patch"]),u=new Set(["send","post","put"]),d=l.some(I=>c.has(I)),_=u.has(l[0]??""),f=d||_,g=["update","delete","create","archive","insert","remove"],p=l.some(I=>g.some(b=>I.length>b.length&&I.endsWith(b))),x=/retriev/i.test(a)||/search.*doc|knowledge/i.test(a)&&!f&&!p,A=$r(o),T=A?.includes("retrieval")??!1;if(A!==void 0&&!T||!(s||x||T))return;let Ne=A?T&&A.includes("action"):d||p;if(!Ne)if(s)Nt(o.retriever,t,n);else{let I=globalThis,b=Symbol.for("visiq.recall.closureRetrieverWarned"),$=I[b]??=new Set;$.has(a)||($.add(a),console.warn(`[VisIQ] Retriever tool "${a||"(unnamed)"}" exposes no reachable retriever (e.g. LangChain createRetrieverTool returns a joined string). RECALL masks its output via value-shape + whole-result rules, but PER-DOCUMENT metadata/classification rules cannot apply to a metadata-less joined string. For full per-doc governance, pass the retriever to visiq() directly, or use a tool that returns a Document[].`))}let G=o.func;Ne?(o[Pr]=!0,o.func=async function(...I){await n.awaitBundleReady();let b=I[0],$=typeof b=="object"&&b!==null?b:{input:b},ce=typeof $.query=="string"?$.query:void 0,w=C.getStore(),k=z(w),N;try{N=await n.evaluate({operations:["retrieval","action"],agentId:t,...w?.session_id?{sessionId:w.session_id}:{},toolName:a||"unknown",toolArgs:$,resourceType:"document",resourceMetadata:{},...ce!==void 0?{query:ce}:{},...k?{telemetry:k}:{}})}catch(D){let ue=D instanceof Error?D.message:String(D);return K(r?.failMode)==="closed"?E({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${ue} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for hybrid tool "${a||"unknown"}": ${ue}`),G.apply(this,I))}let S=Y(N),rt=Ae(S.hitlFallback,S.argRedactionRules),Lt=I,Mt=()=>{try{return Lt=[L($,M(S.argRedactionRules)),...I.slice(1)],null}catch{return K(r?.failMode)==="closed"?E({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a||"unknown"}" \u2014 running with UNMASKED args`),null)}};if(S.decision==="approval_required"&&S.decisionId&&r){let D=await Ie({endpoint:n.getEndpoint()??r.endpoint??"",apiKey:n.getApiKey()??r.apiKey,decisionId:S.decisionId,timeoutMs:r.hitlTimeoutMs,maskFallback:rt,sdkVersion:V});if(D.resolution==="mask"){let ue=Mt();if(ue)return ue}else if(D.resolution!=="proceed")return E({outcome:"approval_required",code:S.ruleCode??"HITL-BLOCK",reason:S.reason,mechanism:D.reason})}else if(!S.allowed)return E({outcome:"deny",code:S.ruleCode??"DENY",reason:S.reason});if(S.decision==="mask"&&S.argRedactionRules.length>0){let D=Mt();if(D)return D}let zr=await G.apply(this,Lt);return pr(zr,N,r?.failMode)}):o.func=async function(...I){let b=await G.apply(this,I);return typeof b=="string"?lr(b,t,n):Ye(b,t,n)},o[i]=!0}var Pr=Symbol.for("visiq.hybrid.instrumented");async function Nr(e,t,n,r){return sr(e,t,n,r)}var Lr=["invoke","call","_call"],J=new _s;function jr(e,t,n){let r=e,o=Symbol.for("visiq.allow.instrumented");if(r[o]||typeof r._getRelevantDocuments=="function"||r[Pr]||$r(r)?.every(c=>c==="retrieval")||!Lr.some(c=>typeof r[c]=="function"))return;let{agentId:i}=n,a=typeof r.name=="string"?r.name:"unknown",s=Symbol("visiq.gate"),l=async(c,u,d,_,f)=>{let g=J.getStore();if(g!==void 0&&g.gateKey===s&&!g.entered.has(f))return g.entered.add(f),c.call(u,d,..._);let p;if(typeof d=="string")p=d;else{let w=d?.input;p=w!=null?String(w):JSON.stringify(d)??""}let y=C.getStore(),x=z(y),A=typeof d=="object"&&d!==null?d:{input:p},T=Ke(a,A);T&&me(t,{agentId:i,sessionId:y?.session_id,framework:"langchain"},T);let Oe={agentId:i,sessionId:y?.session_id,framework:"langchain"},le=de(a,A);try{ge(t,Oe,{toolName:a,...le?{memory:le}:{},argSummary:p.slice(0,512)})}catch(w){U("step-beat",`emit failed for tool "${a}": ${xt(w)}`)}let Ne=Date.now(),G=async w=>{let k=await w();try{he(t,Oe,{toolName:a,ok:!0,durationMs:Date.now()-Ne,...W(k)!==void 0?{bytes:W(k)}:{},...Q(k)!==void 0?{itemCount:Q(k)}:{},...le?{memory:le}:{}})}catch(N){U("observation-beat",`emit failed for tool "${a}": ${xt(N)}`)}return k},I=(w,k,N,S)=>{try{ee(t,Oe,{toolName:a,decision:w,...k?{ruleCode:k}:{},...N?{ruleLabel:N}:{},enforced:!0,...S?{harnessMessage:S}:{}})}catch(rt){U("intervention-beat",`emit failed for tool "${a}": ${xt(rt)}`)}};await t.awaitBundleReady();let b,$=!1;try{let w=await t.evaluate({operations:T?["action","delegation"]:["action"],agentId:i,...y?.session_id?{sessionId:y.session_id}:{},toolName:a,toolArgs:A,targetResource:St(p),...x?{telemetry:x}:{},...T?{context:Ge(T,i)}:{}});({enforced:$}=w),b=Y(w)}catch(w){let k=w instanceof Error?w.message:String(w);return n.failMode==="closed"?E({outcome:"error",code:"EVAL-ERROR",mechanism:`policy evaluation failed: ${k} (blocked \u2014 VISIQ_FAIL_MODE=closed)`}):(v("eval-error",`policy evaluation failed for tool "${a}": ${k}`),J.run({gateKey:s,entered:new Set([f])},()=>c.call(u,d,..._)))}let ce=w=>{let k=ne(a,w,{failMode:n.failMode==="closed"?"closed":"open",enforced:$});if(k.verdict==="block"){let S=E({outcome:"deny",code:"OUTPUT-BLOCK",reason:`outbound content carried a live secret (${k.detectors.join(",")})`});return I("deny","OUTPUT-BLOCK","outbound content carried a live secret",S),S}let N=w;return k.verdict==="redact"&&(N=k.redacted,v("outbound-secret-redacted",`outbound secret screen redacted ${k.detectors.length} detector(s): ${k.detectors.join(",")}`),I("mask","OUTPUT-BLOCK","outbound secret redacted before egress")),G(()=>J.run({gateKey:s,entered:new Set([f])},()=>c.call(u,N,..._)))};if(b.decision==="approval_required"&&b.decisionId){let w=Ae(b.hitlFallback,b.argRedactionRules),k=await Ie({endpoint:t.getEndpoint()??n.endpoint??"",apiKey:t.getApiKey()??n.apiKey,decisionId:b.decisionId,timeoutMs:n.hitlTimeoutMs,maskFallback:w,sdkVersion:V});if(k.resolution==="proceed")return G(()=>J.run({gateKey:s,entered:new Set([f])},()=>c.call(u,d,..._)));if(k.resolution==="mask")try{let S=L(d,M(b.argRedactionRules));return I("mask",b.ruleCode,b.reason),G(()=>J.run({gateKey:s,entered:new Set([f])},()=>c.call(u,S,..._)))}catch{return n.failMode==="closed"?E({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`HITL mask fallback failed for tool "${a}" \u2014 running with UNMASKED args`),J.run({gateKey:s,entered:new Set([f])},()=>c.call(u,d,..._)))}let N=E({outcome:"approval_required",code:b.ruleCode??"HITL-BLOCK",reason:b.reason,mechanism:k.reason});return I("approval_required",b.ruleCode,b.reason,N),N}if(!b.allowed){let w=E({outcome:"deny",code:b.ruleCode??"DENY",reason:b.reason});return I("deny",b.ruleCode,b.reason,w),w}if(b.decision==="mask"&&b.argRedactionRules.length>0)try{let w=L(d,M(b.argRedactionRules));return I("mask",b.ruleCode,b.reason),ce(w)}catch{return n.failMode==="closed"?E({outcome:"error",code:"MASK-ERROR",mechanism:"argument masking failed (blocked \u2014 VISIQ_FAIL_MODE=closed)"}):(v("mask-error",`argument masking failed for tool "${a}" \u2014 running with UNMASKED args`),J.run({gateKey:s,entered:new Set([f])},()=>c.call(u,d,..._)))}return ce(d)};for(let c of Lr){if(typeof r[c]!="function")continue;let u=r[c];r[c]=function(d,..._){return l(u,this,d,_,c)}}r[o]=!0}function xt(e){return e instanceof Error?e.message:String(e)}function Os(e,t,n){let r=(a,s)=>{if(!a||typeof a!="object")return;let l=a[s];return typeof l=="string"&&l.length>0?l:void 0},o=t?.invocation_params,i=e&&typeof e=="object"?e.kwargs:void 0;return r(o,"model")??r(o,"model_name")??r(n,"ls_model_name")??r(i,"model")??r(i,"model_name")}function Ns(e,t){let n=(f,g)=>{if(!f||typeof f!="object")return;let p=f[g];return typeof p=="number"&&Number.isFinite(p)?p:void 0},r=e?.tokenUsage,o=n(r,"promptTokens"),i=n(r,"completionTokens");if(o!==void 0||i!==void 0)return{...o!==void 0?{tokensIn:o}:{},...i!==void 0?{tokensOut:i}:{}};let a=t?.usage_metadata,s=n(a,"input_tokens"),l=n(a,"output_tokens");if(s===void 0&&l===void 0)return;let c=a&&typeof a=="object"?a.input_token_details:void 0,u=n(c,"cache_read"),d=n(c,"cache_creation"),_=s!==void 0?Math.max(0,s-(u??0)-(d??0)):void 0;return{..._!==void 0?{tokensIn:_}:{},...l!==void 0?{tokensOut:l}:{},...u!==void 0?{cacheRead:u}:{},...d!==void 0?{cacheWrite:d}:{}}}function Mr(e,t){return{name:"VisiqHandler",handleLLMStart:async(n,r,o,i,a,s,l)=>{let c=C.getStore();if(!c)return;c.llm_prompts.push(...r);let u=Os(n,a,l);u&&(c.llm_model=u,t.captureCloneMetadata({model:u,agentType:"langchain"}))},handleLLMEnd:async n=>{let r=C.getStore();if(!r)return;let i=n?.generations?.[0]?.[0],a=typeof i?.text=="string"?i.text:"";a&&r.llm_responses.push(a);try{let s=n?.llmOutput,l=i?.message&&typeof i.message=="object"?i.message:void 0,c=Ns(s,l);if(!c&&!a)return;let u=l?.tool_calls,d=typeof s?.model=="string"?s.model:void 0,_=r.llm_model??d;await t.awaitBundleReady(),st(t,{agentId:e,sessionId:r.session_id,framework:"langchain"},{...a?{texts:[a]}:{},...c?{usage:c}:{},..._?{model:_}:{},final:!(Array.isArray(u)&&u.length>0)})}catch{}},handleAgentAction:async n=>{let r=C.getStore();if(!r)return;let o=typeof n.log=="string"?n.log:"";o&&r.agent_reasoning.push(o)},handleRetrieverStart:async(n,r,o)=>{let i=C.getStore();i&&i.retrieverQueries.set(o,r??"")},handleRetrieverEnd:async(n,r)=>{let o=C.getStore();if(!o)return;let i=o.retrieverQueries.get(r)??"";if(o.retrieverQueries.delete(r),!Array.isArray(n))return;let a=z(o);for(let s of n){let l=s,c=String(l.pageContent??l.text??l.content??""),u=l.metadata??{};await t.evaluate({operations:["retrieval"],agentId:e,resourceType:"document",resourceMetadata:u,query:i,contentPreview:c.slice(0,500),...a?{telemetry:a}:{}})}},handleRetrieverError:async(n,r)=>{let o=C.getStore();o&&o.retrieverQueries.delete(r)}}}var Ur=["_call","execute","call","run","invoke"];function Ls(e){let t=e;for(let n of Ur)if(typeof t[n]=="function")return!0;return!1}function Ms(e){return e instanceof Z?!0:e instanceof j?typeof e.status=="number"&&e.status>=400&&e.status<500:!1}function Ds(e,t,n){let r=null,o=null,i=!1,a=async()=>{if(r)return r;if(o)throw new Z(`Failed to bootstrap grant ${n}: ${o.message}`,null);let s;try{s=await gr(t.agentId,n)}catch(l){throw i=Ms(l),i&&(o=l instanceof Error?l:new Error(String(l))),new Z(`Failed to bootstrap grant ${n}: ${l instanceof Error?l.message:String(l)}`,null)}return r=hr(e,{agentId:t.agentId,grantToken:s,failBehavior:t.failMode==="closed"?"deny":"permit",...t.apiKey?{apiKey:t.apiKey}:{},...t.endpoint?{endpoint:t.endpoint}:{}}),r};return new Proxy(e,{get(s,l,c){if(l===Te)return!0;let u=Reflect.get(s,l,c);return typeof u!="function"||typeof l!="string"||!Ur.includes(l)?u:async function(...d){let _;try{_=await a()}catch(g){if(i||t.failMode==="closed")throw g;return v("grant-bootstrap",`grant ${n} bootstrap failed: ${g instanceof Error?g.message:String(g)}`),u.call(this,...d)}return _[l].call(_,...d)}}})}function Fs(e,t){let n=se(t.apiKey,t.endpoint,t.agentId,t.timeoutMs,void 0,t.failMode);jr(e,n,t);let r=e;if(typeof r.execute=="function"){let o=typeof r.name=="string"&&r.name||typeof r.id=="string"&&r.id||"unknown";Xe(e,o,Br(t))}return e}function Br(e){return{agentId:e.agentId,unified:se(e.apiKey,e.endpoint,e.agentId,e.timeoutMs,void 0,e.failMode),hitlTimeoutMs:e.hitlTimeoutMs,failMode:e.failMode,...e.apiKey?{apiKey:e.apiKey}:{},...e.endpoint?{endpoint:e.endpoint}:{},telemetry:Ot()}}async function qr(e,t={}){if(!e||e.trim()==="")throw new Error("[VisIQ] visiq.delegate: childAgentId is required");let n=process.env.VISIQ_AGENT_ID;if(!n)throw new Error("[VisIQ] visiq.delegate: VISIQ_AGENT_ID env var is required. Set it to the parent agent ID before calling delegate.");let r=process.env.VISIQ_API_KEY;if(!r)throw new Error("[VisIQ] visiq.delegate: VISIQ_API_KEY env var is required");let o=process.env.VISIQ_ENDPOINT;return{VISIQ_GRANT_ID:(await new oe({agentId:n,apiKey:r,...o?{endpoint:o}:{}}).requestGrant({parentAgentId:n,childAgentId:e,toolScope:t.toolScope??null,contextScope:t.contextScope??null,durationSeconds:t.durationSeconds??3600,purpose:t.purpose??`Delegated to ${e}`,...t.maxDepth!==void 0?{maxDepth:t.maxDepth}:{},...t.parentGrantToken!==void 0?{parentGrantToken:t.parentGrantToken}:{}})).grantId}}var Ce=class{constructor(t){this.transport=t}transport;deploy(t={}){let n={include_mac:t.includeMac??!1};return t.autoInstallHarness!==void 0&&(n.auto_install_harness=t.autoInstallHarness),X(this.transport,"POST","/api/discovery/fleet/deploy",n)}status(){return X(this.transport,"GET","/api/discovery/fleet/status")}heartbeat(t){return X(this.transport,"POST","/api/discovery/fleet/heartbeat",{instance_id:t.instanceId,vendor:t.vendor})}stop(){return X(this.transport,"POST","/api/discovery/fleet/stop")}};var xe=class{constructor(t){this.transport=t}transport;connectAws(t){return X(this.transport,"POST","/api/discovery/integrations/aws",{aws_account_id:t.awsAccountId,aws_region:t.awsRegion})}};function $s(e){if(!e.baseUrl||e.baseUrl.length===0)throw new Error("[VisIQ] createVisiqClient: baseUrl is required");if(!e.accessToken&&!e.cookieHeader)throw new Error("[VisIQ] createVisiqClient: one of accessToken or cookieHeader is required");let t=e.baseUrl.replace(/\/$/,""),n=e.fetchImpl??globalThis.fetch.bind(globalThis),r={baseUrl:t,accessToken:e.accessToken,cookieHeader:e.cookieHeader,fetchImpl:n};return{fleet:new Ce(r),integrations:new xe(r)}}async function X(e,t,n,r){let o=`${e.baseUrl}${n.startsWith("/")?n:`/${n}`}`,i={...H(V)};e.cookieHeader&&(i.Cookie=e.cookieHeader),e.accessToken&&(i.Authorization=`Bearer ${e.accessToken}`);let a;r!==void 0&&(i["Content-Type"]="application/json",a=JSON.stringify(r));let s=await e.fetchImpl(o,{method:t,headers:i,body:a});if(!s.ok){let l="";try{l=await s.text()}catch{}throw new Error(`[VisIQ] ${t} ${n} failed (${s.status}): ${l||s.statusText}`)}return await s.json()}var Vr=Fr;Vr.delegate=qr;var Tc=Vr;export{ze as DEFAULT_FAIL_MODE,Ce as FleetClient,xe as IntegrationsClient,$s as createVisiqClient,qr as delegate,ke as normalizeFailMode,Tc as visiq};

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@visiq/harness",
-  "version": "0.2.9",
-  "description": "VisIQ SDK — AI agent governance harness",
+  "version": "0.2.10",
+  "description": "VisIQ agent-governance harness for Node.js — action governance, retrieval governance, and audit-trail reporting, added to your existing agent framework by one visiq() call.",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",