@visiq/openclaw-plugin 0.1.7 → 0.1.9

package/dist/chunk-INF55VX4.js

@@ -0,0 +1,10 @@
+var ot="[REDACTED]",st=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}];function lt(e){if(!/^\d+$/.test(e))return!1;let t=0,n=!1;for(let r=e.length-1;r>=0;r--){let i=e.charCodeAt(r)-48;n&&(i*=2,i>9&&(i-=9)),t+=i,n=!n}return t%10===0}function Rn(e){let t=e.replace(/\s/g,"").toUpperCase();if(!/^[A-Z]{2}\d{2}[A-Z0-9]{10,30}$/.test(t))return!1;let n=t.slice(4)+t.slice(0,4),r=0;for(let i=0;i<n.length;i++){let a=n[i],o=a>="A"&&a<="Z"?String(a.charCodeAt(0)-55):a;for(let s=0;s<o.length;s++)r=(r*10+(o.charCodeAt(s)-48))%97}return r===1}function xn(e){if(!/^\d{9}$/.test(e))return!1;let t=[3,7,1,3,7,1,3,7,1],n=0;for(let r=0;r<9;r++)n+=(e.charCodeAt(r)-48)*t[r];return n%10===0}var Mn=[{name:"pan",re:/\d(?:[ -]?\d){12,18}/g,normalize:e=>e.replace(/[ -]/g,""),validate:e=>e.length>=13&&e.length<=19&&lt(e)},{name:"iban",re:/\b[A-Z]{2}\d{2}(?:[ ]?[A-Z0-9]){10,30}\b/g,normalize:e=>e.replace(/\s/g,"").toUpperCase(),validate:Rn},{name:"aba_routing",re:/\b\d{9}\b/g,normalize:e=>e,validate:xn}],w=Object.fromEntries(st.map(e=>[e.name,e.re.source])),ct=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","email","us_phone","ipv4","mac_address"],H={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
+MIIEv\u2026
+-----END PRIVATE KEY-----`,template:{pattern:w.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:w.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:w.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:w.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:w.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:w.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:w.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:w.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:w.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:w.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS).",category:"financial",example:"4242 4242 4242 4242",template:{pattern:"\\b\\d{13,19}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:"\\b[A-Z]{2}\\d{2}(?:[ ]?[A-Z0-9]){10,30}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:"\\b\\d{9}\\b",mode:"full"},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX).",category:"financial",example:"12-3456789",template:{pattern:w.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:w.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789).",category:"pii",example:"123-45-6789",template:{pattern:w.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept).",category:"pii",example:"alice@acme.com",template:{pattern:w.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:w.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:w.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:w.mac_address,mode:"full"},defaultEnabled:!1}},Ia=new Set(ct.filter(e=>!H[e].defaultEnabled));function Ln(e,t){let n=new Set;for(let r of ct)(H[r].defaultEnabled?!e?.has(r):t?.has(r))||n.add(r);return n}function $n(e,t,n,r){if(typeof e!="string"||e.length===0)return e;let i=e;for(let{name:a,re:o}of st){let s=a;n.has(s)||(i=i.replace(o,()=>(r?.(s),t)))}for(let{name:a,re:o,normalize:s,validate:l}of Mn)n.has(a)||(i=i.replace(o,c=>l(s(c))?(r?.(a),t):c));return i}function we(e,t=ot,n,r){return Pn(e,t,Ln(n,r))}function Pn(e,t,n){let r=new Set,i=!n.has("pan"),a=s=>{r.add(s)},o=s=>{if(typeof s=="string")return $n(s,t,n,a);if(typeof s=="number"&&Number.isInteger(s)&&s>0){if(!i)return s;let l=String(s);return l.length>=13&&l.length<=19&&lt(l)?(r.add("pan"),t):s}if(Array.isArray(s))return s.map(l=>o(l));if(s!==null&&typeof s=="object"){let l=s,c={};for(let d of Object.keys(l))c[d]=o(l[d]);return c}return s};return{value:o(e),detectors:[...r].sort()}}function dt(e,t=ot){return we(e,t).value}function Dn(e){let{value:t,detectors:n}=we(e),r=n.some(i=>H[i].category==="secret");return{detectors:n,blocked:r,redacted:t}}function Q(e,t){let{blocked:n,redacted:r,detectors:i}=Dn(e);return n?t.failMode==="closed"?{verdict:"block",redacted:r,detectors:i}:{verdict:"redact",redacted:r,detectors:i}:{verdict:"allow",redacted:r,detectors:i}}function Ae(e){if(typeof e!="string"||e.length===0)return e;let t=e.lastIndexOf("__");return t<0?e:e.slice(t+2)}var Fn=new Set(["send","send_email","send_message","email","email_send","message","post","post_message","http_post","upload","export","export_data","share","publish","webhook"]);function Ie(e){return Fn.has(Ae(e))}var jn=/[\u00AD\u200B-\u200F\u202A-\u202E\u2060\u2066-\u2069\uFEFF]/g,ut=Object.freeze({\u0430:"a",\u0435:"e",\u043E:"o",\u0440:"p",\u0441:"c",\u0443:"y",\u0445:"x",\u0456:"i",\u0455:"s",\u043A:"k",\u043C:"m",\u0442:"t",\u043D:"h",\u0432:"b",\u0433:"r",\u03BF:"o",\u03B1:"a",\u03C1:"p",\u03B9:"i",\u03C4:"t",\u03B5:"e",\u03BA:"k",\u03BD:"v",\u03C5:"u",\u03B7:"n",\u0131:"i","\u04CF":"l",\u0578:"n"}),qn=new RegExp(`[${Object.keys(ut).join("")}]`,"gu"),Bn=Object.freeze({4:"a","@":"a",3:"e",1:"i","!":"i",0:"o",5:"s",$:"s",7:"t",9:"g","(":"c",8:"b"}),pt="\u2801\u2803\u2809\u2819\u2811\u280B\u281B\u2813\u280A\u281A\u2805\u2807\u280D\u281D\u2815\u280F\u281F\u2817\u280E\u281E\u2825\u2827\u283A\u282D\u283D\u2835",Un=Object.freeze(Object.fromEntries([...pt].map((e,t)=>[e,String.fromCharCode(97+t)]))),Vn=new RegExp(`[${pt}\u2800]`,"g"),ft=/[⠀-⣿]/;function zn(e){let t="";for(let n of e){let r=n.codePointAt(0);r!==void 0&&(r>=917536&&r<=917630?t+=String.fromCodePoint(r-917504):r>=917504&&r<=917631||(t+=n))}return t}function Kn(e){return e.replace(jn,"")}function mt(e){return e.replace(qn,t=>ut[t]??t)}function Gn(e){return e.replace(/[4@31!05$79(8]/g,t=>Bn[t]??t)}function Wn(e){return e.replace(/[a-zA-Z]/g,t=>{let n=t<="Z"?65:97;return String.fromCharCode((t.charCodeAt(0)-n+13)%26+n)})}function Hn(e){return ft.test(e)?e.replace(Vn,t=>t==="\u2800"?" ":Un[t]??t):e}function Ze(e){let t;try{t=zn(e)}catch{t=e}try{t=t.normalize("NFKC")}catch{}return t=Kn(t),t=mt(t),t}var Qn=/^[A-Za-z0-9+/]{16,}={0,2}$/,Yn=/^(?:[0-9a-fA-F]{2}\s*){8,}$/,Je=/[A-Za-z0-9+/]{20,}={0,2}/g;function _e(e){if(e.length===0)return 0;let t=0;for(let n=0;n<e.length;n++){let r=e.charCodeAt(n);(r===9||r===10||r===13||r>=32&&r<=126||r>=160&&r!==65533)&&t++}return t/e.length}var gt=new TextDecoder("utf-8",{fatal:!1});function ht(e){let t;try{t=atob(e)}catch{return[]}let n=new Uint8Array(t.length);for(let i=0;i<t.length;i++)n[i]=t.charCodeAt(i)&255;let r=gt.decode(n);return t===r?[t]:[r,t]}function Zn(e){let t=e.replace(/\s+/g,"");if(t.length===0||t.length%2!==0)return[];let n=new Uint8Array(t.length/2);for(let a=0;a<n.length;a++){let o=Number.parseInt(t.slice(a*2,a*2+2),16);if(Number.isNaN(o))return[];n[a]=o}let r="";for(let a=0;a<n.length;a++)r+=String.fromCharCode(n[a]);let i=gt.decode(n);return r===i?[r]:[i,r]}function Xe(e){let t=e.trim(),n=[];if(Yn.test(t))for(let r of Zn(t))n.push({decoded:r,textiness:_e(r)});if(Qn.test(t)&&t.length%4===0)for(let r of ht(t))n.push({decoded:r,textiness:_e(r)});return n}function et(e,t){let n=[],r;for(Je.lastIndex=0;(r=Je.exec(e))!==null&&n.length<t;){let i=r[0];if(i.length%4===0)for(let a of ht(i))n.push({decoded:a,textiness:_e(a)})}return n}var Jn=Object.freeze({maxDepth:3,byteCap:262144,maxNodes:256,maxBlobsPerNode:8});function _t(e,t=Jn){if(typeof e!="string"||e.length===0)return{views:[],anyDecoded:!1,truncated:!1,nodes:0,maxDepthSeen:0};let{maxDepth:n,byteCap:r,maxNodes:i,maxBlobsPerNode:a}=t,o=new Set,s=g=>{g.length>0&&g.length<=r&&o.add(g)},l=!1,c=!1,d=0,u=0,m=[{s:e,depth:0}];for(;m.length>0;){if(d>=i){c=!0;break}let g=m.pop();if(g===void 0)break;let{s:_,depth:v}=g;if(_.length>r){c=!0;continue}d++,v>u&&(u=v);let h=Ze(_);s(h);let A=Gn(h);if(A!==h&&s(A),s(Wn(h)),ft.test(_)&&s(Hn(h)),v>=n){let S=Ze(_);(Xe(S).length>0||et(S,a).length>0)&&(c=!0);continue}let k=[...Xe(h),...et(h,a)];for(let S of k){if(l=!0,S.decoded.length>r){c=!0;continue}S.textiness>=.85&&S.decoded!==h?m.push({s:S.decoded,depth:v+1}):s(S.decoded)}}return{views:[...o],anyDecoded:l,truncated:c,nodes:d,maxDepthSeen:u}}var yt=["hidden_text_carrier","injected_turn_boundary","mixed_script_token","nested_encoding_payload"],Xn=Object.freeze(["hidden_text_carrier","injected_turn_boundary","mixed_script_token"]),er=8,tr=new Set([173,8203,8204,8205,8206,8207,8288,65279,8234,8235,8236,8237,8238,8294,8295,8296,8297]),tt=e=>e!==void 0&&(e>=65&&e<=90||e>=97&&e<=122);function nr(e){let t=[...e].map(r=>r.codePointAt(0)),n=0;for(let r=0;r<t.length;r++){let i=t[r];if(i>=917504&&i<=917631||tr.has(i)&&tt(t[r-1])&&tt(t[r+1])&&(n++,n>=er))return!0}return!1}var rr=/^[ \t]*(?:system|assistant|developer|user)[ \t]*:/i;function ir(e){let t=e.split(/\r?\n/),n=!1;for(let r of t){if(rr.test(r)){if(n)return!0;continue}r.trim().length>0&&(n=!0)}return!1}var ar=[{name:"latin",lo:65,hi:591},{name:"greek",lo:880,hi:1023},{name:"cyrillic",lo:1024,hi:1279}];function or(e){for(let t of ar)if(e>=t.lo&&e<=t.hi)return t.name;return null}function sr(e){for(let t of e.split(/\s+/)){if(t.length<4)continue;let n=0,r=0,i=!0;for(let a of t){let o=or(a.codePointAt(0));if(o===null){i=!1;break}o==="latin"?n++:mt(a)!==a&&r++}if(i&&n>0&&r>0)return!0}return!1}var nt=Object.freeze({signals:[],contributes:!1});function lr(e){if(typeof e!="string"||e.length===0)return{...nt,signals:[]};let t=new Set;try{nr(e)&&t.add("hidden_text_carrier"),ir(e)&&t.add("injected_turn_boundary"),sr(e)&&t.add("mixed_script_token");let{anyDecoded:n,maxDepthSeen:r,truncated:i}=_t(e);n&&(r>=2||i)&&t.add("nested_encoding_payload")}catch{return{...nt,signals:[]}}return{signals:[...yt.filter(n=>t.has(n))],contributes:Xn.some(n=>t.has(n))}}var Y=[{name:"override_instructions",re:/\bignore (?:all |the )?(?:previous|above|prior) (?:instructions|prompts?)\b/i},{name:"disregard_instructions",re:/\bdisregard (?:the )?(?:above|previous|system)\b/i},{name:"role_tag",re:/<\/?(system|assistant|instructions|host_context)\b/i},{name:"privilege_override",re:/\b(grant|escalate|elevate) (admin|root|all|full) (access|privileges?)\b/i},{name:"tool_smuggle",re:/```[\s\S]*?(tool_call|function_call)/i}];function rt(e){return typeof e!="string"||e.length===0?[]:Y.filter(({re:t})=>t.test(e)).map(({name:t})=>t)}function cr(e){if(typeof e!="string"||e.length===0)return[];let t=new Set(rt(e)),{views:n}=_t(e);for(let r of n)for(let i of rt(r))t.add(i);return Y.filter(r=>t.has(r.name)).map(r=>r.name)}function dr(e){let t=new Set,n=new Set,r=!1,i=a=>{if(a!=null){if(typeof a=="string"){for(let s of cr(a))t.add(s);let o=lr(a);for(let s of o.signals)n.add(s);o.contributes&&(r=!0);return}if(Array.isArray(a)){for(let o of a)i(o);return}if(typeof a=="object")for(let o of Object.values(a))i(o)}};return i(e),{matched:t.size>0||r,signatures:Y.filter(a=>t.has(a.name)).map(a=>a.name),structural:yt.filter(a=>n.has(a))}}function ur(e){return dr(e).matched}var ka=Y.map(e=>e.name);var pr=new Set(["untrusted","external","public","public_internet","external_third_party","web"]);var fr="i:injection";function bt(e){let t=new Set;if(e.content!==void 0&&e.content!==null){let{detectors:i}=we(e.content);for(let a of i){let o=H[a]?.category;o&&t.add(`c:${o}`)}ur(e.content)&&t.add(fr)}let n=e.resourceMetadata??{},r=n.source_trust;return(n.untrusted_source===!0||typeof r=="string"&&pr.has(r.toLowerCase()))&&t.add("i:untrusted"),[...t].sort()}var he="(?:system\\s+prompt|initial\\s+(?:instructions|prompt)|system\\s+(?:instructions|message)|hidden\\s+(?:instructions|prompt)|your\\s+(?:system\\s+prompt|initial\\s+instructions|instructions|prompt)|the\\s+prompt\\s+(?:above|you\\s+were\\s+given))",Sa=[{name:"reveal_prompt",re:new RegExp(`\\b(?:reveal|show|print|repeat|output|echo|display|expose|dump|leak|reprint|divulge|disclose)\\b[\\s\\S]{0,40}?\\b${he}\\b`,"i")},{name:"what_is_prompt",re:new RegExp(`\\bwhat\\s+(?:is|are|were)\\b[\\s\\S]{0,20}?\\b${he}\\b`,"i")},{name:"tell_me_prompt",re:new RegExp(`\\b(?:tell|give|send|show)\\s+me\\b[\\s\\S]{0,30}?\\b${he}\\b`,"i")},{name:"repeat_above",re:/\b(?:repeat|print|output|echo|reproduce)\b[\s\S]{0,20}?\b(?:everything|all\s+(?:the\s+)?(?:text|words))\b[\s\S]{0,12}?\b(?:above|before|preceding|verbatim|word\s+for\s+word)\b/i}],it="(?:instructions?|prompts?|rules?|directives?|guidelines?|constraints?|guardrails?)",mr=`(?:(?:all\\s+|any\\s+|the\\s+|these\\s+|those\\s+)*(?:previous|prior|preceding|earlier|above|foregoing|initial|original|system|developer)\\s+${it}|your\\s+(?:(?:system|initial|original|previous|prior|current)\\s+)?(?:${it}|programming|training))`,gr="(?:(?:all|any|every|the|of|and|now|please|completely|entirely|totally|immediately)\\s+){0,3}",at="(?:\\b(?:unrestricted|unfiltered|uncensored|unbounded|unlimited|unchained|jailbroken|lawless|amoral)\\b|\\b(?:DAN|STAN|DUDE|AIM)\\b|\\bno\\s+(?:longer\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|boundaries|constraints?)\\b(?!\\s+(?:on|over|regarding|upon|for)\\b)|\\bwithout\\s+(?:any\\s+)?(?:restrictions?|limits?|rules?|guidelines?|filters?|constraints?|censorship)\\b|\\b(?:free|freed|released)\\s+from\\s+(?:your\\s+)?(?:restrictions?|limits?|rules?|guidelines?|guardrails?|programming|constraints?)\\b|\\b(?:can|will|are\\s+able\\s+to)\\s+(?:do|say)\\s+anything\\b|\\bignore\\s+(?:all\\s+)?(?:your\\s+)?(?:previous\\s+|prior\\s+|system\\s+)?(?:instructions?|rules?|guidelines?)\\b)",hr="(?:ignore|disregard|forget|override|overrule|bypass|obey|comply\\s+with|follow\\s+(?:only|my|these))",Ea=[{name:"override_instructions",re:new RegExp(`\\b(?:ignore|disregard|forget|discard|override|overrule|bypass|delete|erase)\\s+${gr}${mr}\\b`,"i")},{name:"forget_everything_prior",re:/\b(?:forget|ignore|disregard|erase|discard)\s+(?:about\s+|all\s+|any\s+)?(?:everything|anything)\b[\s\S]{0,24}?\b(?:above|before|previously|prior|earlier|you\s+(?:were|have\s+been)\s+(?:told|instructed|given|programmed))\b/i},{name:"persona_reassignment_jailbreak",re:new RegExp(`\\byou\\s+are\\s+now\\s+(?:(?:a|an|the)\\s+)?[\\s\\S]{0,48}?${at}`,"i")},{name:"constraint_release",re:/\byou\s+are\s+no\s+longer\s+(?:bound|restricted|limited|constrained|obligated|governed|subject\s+to|required\s+to)\b/i},{name:"from_now_on_reassignment",re:new RegExp(`\\bfrom\\s+now\\s+on\\s*,?\\s+you\\s+(?:are|will|must|shall|have|can)\\s+(?:${hr}\\b|[\\s\\S]{0,40}?${at})`,"i")},{name:"new_instructions_header",re:/^\s*(?:[#*>-]+\s*)?(?:new|real|actual|true|secret|hidden|override)\s+(?:system\s+)?(?:instructions?|prompts?|directives?)\s*:/im}];var _r="[SYSTEM-PROMPT-REDACTED]";function ye(e){return e.toLowerCase().replace(/\s+/g," ").trim().split(" ").filter(t=>t.length>0)}function yr(e){return e.replace(/[.*+?^${}()|[\]\\]/g,"\\$&")}function vt(e,t){if(typeof e!="string"||typeof t!="string"||e.length===0||t.length===0)return[];let n=ye(e),r=ye(t),i=8;if(n.length<i||r.length<i)return[];let a=new Set;for(let l=0;l+i<=r.length;l++)a.add(r.slice(l,l+i).join(" "));let o=[],s=new Set;for(let l=0;l+i<=n.length;l++){let c=n.slice(l,l+i).join(" ");a.has(c)&&!s.has(c)&&(s.add(c),o.push(c))}return o}function br(e,t){if(typeof e!="string"||e.length===0)return e;let n=e,r=Math.max(1,ye(e).length);for(let i=0;i<r;i++){let a=vt(t,n);if(a.length===0)return n;for(let o of a){let s=o.split(" ").filter(d=>d.length>0);if(s.length===0)continue;let l=s.map(yr).join("\\s+"),c;try{c=new RegExp(l,"gi")}catch{continue}n=n.replace(c,_r)}}return n}function be(e,t,n){if(e==null)return e;if(typeof e=="string"){for(let r of vt(t,e))n.add(r);return br(e,t)}if(Array.isArray(e))return e.map(r=>be(r,t,n));if(typeof e=="object"){let r=e,i=Object.create(Object.getPrototypeOf(r));for(let a of Object.keys(r))i[a]=be(r[a],t,n);return i}return e}function vr(e,t){if(typeof t!="string"||t.length===0)return{leaked:!1,matchedSpans:[],redacted:e};let n=new Set,r=be(e,t,n),i=[...n].sort();return{leaked:i.length>0,matchedSpans:i,redacted:r}}function wt(e,t,n){let{leaked:r,redacted:i,matchedSpans:a}=vr(e,t);return r?n.failMode==="closed"?{verdict:"block",redacted:i,matchedSpans:a}:{verdict:"redact",redacted:i,matchedSpans:a}:{verdict:"allow",redacted:i,matchedSpans:a}}var Ca=Object.freeze({"\u2019":"'",\u02BC:"'","\uFF07":"'","\u02B9":"'","\u2032":"'"});var R=e=>`[^.!?;\\n]{0,${e}}?`,wr=["\\bi\\s+(?:can'?t|cannot|can\\s+not|won'?t|will\\s+not)\\b","\\bi(?:'m|\\s+am)\\s+(?:not\\s+able\\s+to|unable\\s+to|not\\s+going\\s+to|not\\s+permitted\\s+to|not\\s+allowed\\s+to)\\b"].join("|"),At="(?:help|assist|provide|create|generate|produce|write|compose|draft|comply|fulfil|fulfill|share|disclose|reveal|perform|execute|run|send|transmit|publish|export|approve|grant|carry\\s+out|do\\s+that|do\\s+this|do\\s+so|go\\s+ahead)",Ta=Object.freeze([{id:"capability_denial",class:"strong",re:new RegExp([`(?:${wr})\\s${R(40)}\\b${At}\\b`,"\\b(?:that|this|it)(?:'s|\\s+is)\\s+not\\s+something\\s+i\\s+(?:can|could|am\\s+able\\s+to|'m\\s+able\\s+to)\\b",`\\b(?:falls|sits|is)\\s+outside\\s+(?:of\\s+)?(?:what|the\\s+(?:scope|range|bounds))\\b${R(40)}\\bi\\s+(?:can|am|'m)\\b`,"\\bnot\\s+something\\s+i(?:'m|\\s+am)\\s+(?:able|willing|permitted|allowed)\\s+to\\b"].join("|"),"i")},{id:"explicit_decline",class:"strong",re:new RegExp(["\\bi\\s+(?:must|have\\s+to|need\\s+to|will\\s+have\\s+to|am\\s+going\\s+to|'m\\s+going\\s+to)\\s+(?:respectfully\\s+)?decline\\b","\\bi(?:'m|\\s+am)\\s+not\\s+(?:comfortable|willing|prepared)\\b","\\bi(?:'ll|\\s+will)\\s+(?:have\\s+to\\s+)?pass\\s+on\\b","\\bi\\s+(?:must|have\\s+to)\\s+refuse\\b"].join("|"),"i")},{id:"policy_citation",class:"strong",re:new RegExp([`\\b(?:against|contrary\\s+to|prohibited\\s+by|forbidden\\s+by|in\\s+violation\\s+of|violates)\\s${R(24)}\\b(?:polic(?:y|ies)|guidelines?|terms\\s+of\\s+(?:use|service)|rules\\s+of\\s+engagement|code\\s+of\\s+conduct)\\b`,`\\b(?:my|our|the|company|organi[sz]ation'?s?)\\s+(?:polic(?:y|ies)|guidelines?)\\s${R(24)}\\b(?:do(?:es)?\\s+not\\s+(?:allow|permit)|prohibit|forbid|prevent)\\b`,`\\bnot\\s+(?:permitted|allowed|authori[sz]ed)\\s+(?:under|by)\\s${R(24)}\\b(?:polic(?:y|ies)|guidelines?)\\b`].join("|"),"i")},{id:"guardrail_selfreference",class:"strong",re:new RegExp(["\\bi(?:'ve|\\s+have)\\s+been\\s+(?:instructed|configured|told|trained)\\s+not\\s+to\\b","\\bi(?:'m|\\s+am)\\s+(?:designed|configured|programmed|built|set\\s+up)\\s+not\\s+to\\b",`\\bmy\\s+(?:safety\\s+)?(?:instructions|configuration|guardrails?|constraints|training)\\s${R(24)}\\b(?:prevent|prohibit|forbid|do(?:es)?\\s+not\\s+(?:allow|permit)|preclude)\\b`,"\\b(?:outside|beyond)\\s+(?:my|the)\\s+(?:permitted|authori[sz]ed|configured|approved)\\s+(?:scope|remit|capabilities|actions|operations)\\b"].join("|"),"i")},{id:"ethical_objection",class:"strong",re:new RegExp(["\\b(?:that|this|doing\\s+(?:so|that)|what\\s+you(?:'re|\\s+are)\\s+asking|the\\s+request|such\\s+a\\s+request)\\s+(?:would\\s+be|is|are)\\s+(?:clearly\\s+|both\\s+|potentially\\s+)?(?:illegal|unethical|unlawful|harmful|fraudulent)\\b","\\bi\\s+(?:do\\s+not|don'?t)\\s+condone\\b","\\b(?:goes|would\\s+go|runs)\\s+against\\s+my\\s+(?:principles|values|ethics)\\b","\\bi\\s+(?:can'?t|cannot|won'?t)\\s+in\\s+good\\s+conscience\\b"].join("|"),"i")},{id:"apology_marker",class:"weak",re:new RegExp("\\b(?:i(?:'m|\\s+am)\\s+(?:really\\s+|very\\s+|terribly\\s+|so\\s+)?sorry|i\\s+apologi[sz]e|my\\s+apologies)\\b","i")}]),Na=Object.freeze([/```/,/\b(?:here(?:'s|\s+is|\s+are)|below\s+(?:is|are|you(?:'ll|\s+will)\s+find)|the\s+following\s+(?:is|are))\b/i,new RegExp(`\\b(?:but|however|instead|although|that\\s+said)\\b${R(60)}\\b(?:i\\s+(?:can|could)(?!'t)\\s${R(30)}\\b${At}\\b|i(?:'d|\\s+would)\\s+be\\s+happy\\s+to\\b|i(?:'m|\\s+am)\\s+able\\s+to\\b)`,"i"),/\bwhat\s+i\s+can\s+do\s+(?:instead|is|for\s+you)\b/i]);var D=e=>`[^.!?;\\n]{0,${e}}?`,Oa=Object.freeze([{id:"vulnerability_scanning",objectPatterns:[/\b(?:vulnerability|vuln|security)\s+(?:scan|scans|scanning|assessment|audit|test|testing)\b/i,/\bpen(?:etration)?[\s-]?test(?:ing)?\b/i,/\bport\s+scan(?:ning)?\b/i,/\b(?:exploit|nmap|metasploit|nessus|burp\s+suite)\b/i,/\bCVE-\d{4}-\d{4,7}\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|vulnerability|incident\s+respon\w{0,4}|threat|soc|red\s+team|phishing|malware)\b/i]},{id:"credential_access",objectPatterns:[/\b(?:credential|password|passphrase|api\s+key|access\s+key|secret|token|private\s+key|ssh\s+key)s?\b/i,/\b(?:vault|secrets?\s+manager|keychain|keystore)\b/i,/\bservice\s+account\s+key\b/i],purposeFunctions:["it_security","engineering"],purposePatterns:[/\b(?:security|identity|iam|credential|secrets?\s+manage\w{0,4}|vault|platform|devops)\b/i]},{id:"financial_transaction",objectPatterns:[/\b(?:wire\s+transfer|bank\s+transfer|payout|disbursement|chargeback)\b/i,new RegExp(`\\b(?:approve|issue|initiate|process|release)\\s${D(20)}\\b(?:payment|refund|invoice|transfer|purchase\\s+order)s?\\b`,"i"),new RegExp(`\\b(?:move|transfer)\\s${D(20)}\\b(?:funds|money)\\b`,"i")],purposeFunctions:["finance_accounting","procurement"],purposePatterns:[/\b(?:finance|financial|accounting|invoice|invoicing|payment|payments|billing|refund|refunds|treasury|procurement|spend|purchasing|fraud|kyc)\b/i]},{id:"personnel_data",objectPatterns:[/\b(?:employee|personnel|payroll|hr|staff)\s+(?:record|records|data|file|files|information|details)\b/i,/\b(?:salary|salaries|compensation|performance\s+review|termination\s+letter)s?\b/i,/\b(?:home\s+address|social\s+security\s+number|national\s+insurance\s+number)e?s?\b/i],purposeFunctions:["hr","privacy_compliance"],purposePatterns:[/\b(?:hr|human\s+resources|people\s+ops|payroll|benefits|recruit\w{0,4}|onboarding|privacy|dsar|consent)\b/i]},{id:"regulated_advice",objectPatterns:[/\b(?:legal|medical|tax|investment|financial)\s+advice\b/i,/\bpractis\w{0,3}\s+law\b/i,/\b(?:diagnose|diagnosis|prescribe|prescription)\b/i,/\b(?:binding|enforceable)\s+(?:opinion|interpretation)\b/i],purposeFunctions:["legal","privacy_compliance"],purposePatterns:[/\b(?:legal|compliance|counsel|contract|contracts|litigation|nda|privacy|regulator\w{0,2}|audit\w{0,3})\b/i]},{id:"data_export",objectPatterns:[new RegExp(`\\b(?:export|download|dump|extract|exfiltrat\\w{0,3}|bulk\\s+copy)\\b\\s${D(30)}\\b(?:data|database|dataset|records?|table|tables|customer\\s+list|contact\\s+list|report)\\b`,"i"),/\b(?:full|entire|whole)\s+(?:database|dataset|customer\s+table)\b/i],purposeFunctions:["operations","engineering","privacy_compliance"],purposePatterns:[/\b(?:data\s+(?:pipeline|engineering|platform)|etl|export|reporting|analytics|operations|document\s+extract\w{0,3}|forecast\w{0,3})\b/i]},{id:"code_execution",objectPatterns:[new RegExp(`\\b(?:run|execute|invoke)\\s${D(24)}\\b(?:script|scripts|command|commands|shell|code|binary|query|migration)\\b`,"i"),/\b(?:shell|root|sudo|admin)\s+(?:access|command|session)\b/i,/\bagainst\s+(?:the\s+)?production\s+(?:system|server|database|environment)s?\b/i],purposeFunctions:["engineering","it_security"],purposePatterns:[/\b(?:engineering|developer|devops|platform|release|deploy\w{0,4}|build|pipeline|sandbox|test\s+data|change\s+window)\b/i]},{id:"external_communication",objectPatterns:[new RegExp(`\\b(?:send|post|publish|email|tweet|message|broadcast)\\b\\s${D(30)}\\b(?:external|customer|customers|public|press|social\\s+media|third[\\s-]party|prospect|prospects)\\b`,"i"),/\b(?:cold\s+outreach|marketing\s+blast|phishing\s+email|press\s+release)\b/i],purposeFunctions:["marketing","sales","customer_support"],purposePatterns:[/\b(?:marketing|campaign|outreach|email\s+assistant|support|customer|sales|lead|leads|communication|communications)\b/i]}]);var Ar=["competitor_mention","disallowed_topic","off_brand_claim","restricted_advice"];var Ir=[{id:"competitor_mention",re:/\b(acmecorp|northwind\s+rival|zenithsoft|globex\s+analytics)\b/gi},{id:"disallowed_topic",re:/\b(political\s+endorsement|religious\s+affiliation|layoff\s+rumou?rs?|pending\s+litigation)\b/gi},{id:"off_brand_claim",re:/\b(100%\s+(secure|guaranteed)|zero\s+risk|unhackable|never\s+fails)\b/gi},{id:"restricted_advice",re:/\b(investment\s+advice|medical\s+diagnosis|legal\s+advice|tax\s+advice)\b/gi}];var kr={competitor_mention:"redact",off_brand_claim:"redact",disallowed_topic:"escalate",restricted_advice:"escalate"};function Sr(e){return e.length===0?null:e.some(t=>kr[t]==="escalate")?"escalate":"redact"}var Er="[BRAND-TOPIC-REDACTED]";function ve(e,t){if(e==null)return e;if(typeof e=="string"){let n=e;for(let{id:r,re:i}of Ir){i.lastIndex=0;let a=n.replace(i,()=>Er);a!==n&&(t.add(r),n=a)}return n}if(Array.isArray(e))return e.map(n=>ve(n,t));if(typeof e=="object"){let n=e,r=Object.create(Object.getPrototypeOf(n));for(let i of Object.keys(n))r[i]=ve(n[i],t);return r}return e}function Cr(e){let t=new Set,n=ve(e,t);return{matched:Ar.filter(r=>t.has(r)),redacted:n}}function Z(e,t){let{matched:n,redacted:r}=Cr(e),i=Sr(n);return n.length===0?{verdict:"allow",redacted:r,matched:n,recommendedOutcome:i}:t.failMode==="closed"?{verdict:"block",redacted:r,matched:n,recommendedOutcome:i}:{verdict:"redact",redacted:r,matched:n,recommendedOutcome:i}}var ke="[REDACTED]",L="\u2022",W=e=>/[A-Za-z0-9]/.test(e);function It(e,t,n,r){let i=Array.from(e),a=i.length,o=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:L,c=o+s>=a;return i.map((d,u)=>!c&&(u<o||u>=a-s)?d:W(d)?l:d).join("")}function Tr(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return It(e,0,0,t);let r=e.slice(0,n),i=e.slice(n),a=t.length>0?t:L;return(r.length<=1?a:r[0]+Array.from(r.slice(1)).map(o=>W(o)?a:o).join(""))+i}function Nr(e,t,n){let r=n.length>0?n:L,i=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let c=new RegExp(t,"g"),d;for(;(d=c.exec(e))!==null;){if(d[0].length===0){c.lastIndex++;continue}for(let u=d.index;u<d.index+d[0].length;u++)i[u]=!0}}catch{}let a=!1,o=!0;for(let c=0;c<e.length;c++)if(W(e[c])&&(a=!0,!i[c])){o=!1;break}let s=a&&o,l="";for(let c=0;c<e.length;c++){let d=e[c];!s&&i[c]||!W(d)?l+=d:l+=r}return l}function kt(e,t){let n=t.mode??"full";return n==="partial"?It(e,t.keepFirst??0,t.keepLast??0,t.maskChar??L):n==="email"?Tr(e,t.maskChar??L):n==="custom"?Nr(e,t.keepPattern,t.maskChar??L):t.replacement??ke}function Or(e,t){return typeof e=="string"?kt(e,t):t.replacement??ke}function St(e){let t=[],n=e.replacement??ke;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:r,replacer:()=>n});for(let r of e.directives??[]){let{pattern:i}=r;typeof i!="string"||i.length===0||t.push({source:i,replacer:a=>kt(a,r)})}return t}function Et(e,t){let n=e;for(let{source:r,replacer:i}of t){let a;try{a=new RegExp(r,"g")}catch(o){let s=o instanceof Error?o.message:String(o);throw new Error(`[visiq-redact] Invalid redaction pattern "${r}": ${s}`)}n=n.replace(a,o=>i(o))}return n}function J(e,t){return e==null?e:typeof e=="string"?Rr(e,t):typeof e=="object"?xr(e,t):e}function Rr(e,t){if(typeof e!="string")return e;let n=St(t);return n.length===0?e:Et(e,n)}function xr(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=St(t),i=n.size>0,a=r.length>0,o=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>o(l));if(typeof s=="object"){let l=s,c=Object.create(Object.getPrototypeOf(l));for(let d of Object.keys(l)){let u=i?n.get(d):void 0;if(u){c[d]=Or(l[d],u);continue}c[d]=o(l[d])}return c}return typeof s=="string"&&a?Et(s,r):s};return o(e)}import{readFile as Mr}from"node:fs/promises";import{homedir as Ee}from"node:os";import{join as Ce,isAbsolute as Lr,resolve as $r}from"node:path";import{createInterface as Pr}from"node:readline";import{parseArgs as Dr}from"node:util";var Fr="https://api.visiqlabs.com",Ct="@visiq/openclaw-plugin",te="open";function Te(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}var jr={enabled:!0,thresholds:{}},ne=[{key:"minEvents",env:"VISIQ_SEQUENCE_ANOMALY_MIN_EVENTS",cli:"sequence-anomaly-min-events",json:"min_events"},{key:"minClasses",env:"VISIQ_SEQUENCE_ANOMALY_MIN_CLASSES",cli:"sequence-anomaly-min-classes",json:"min_classes"},{key:"concentrationSigma",env:"VISIQ_SEQUENCE_ANOMALY_SIGMA",cli:"sequence-anomaly-sigma",json:"concentration_sigma"},{key:"dominanceRatio",env:"VISIQ_SEQUENCE_ANOMALY_DOMINANCE_RATIO",cli:"sequence-anomaly-dominance-ratio",json:"dominance_ratio"},{key:"dominanceShare",env:"VISIQ_SEQUENCE_ANOMALY_DOMINANCE_SHARE",cli:"sequence-anomaly-dominance-share",json:"dominance_share"},{key:"frictionRatio",env:"VISIQ_SEQUENCE_ANOMALY_FRICTION_RATIO",cli:"sequence-anomaly-friction-ratio",json:"friction_ratio"},{key:"minFrictionEvents",env:"VISIQ_SEQUENCE_ANOMALY_MIN_FRICTION_EVENTS",cli:"sequence-anomaly-min-friction-events",json:"min_friction_events"}],qr=["sequence-anomaly",...ne.map(e=>e.cli)];function ee(e){if(typeof e=="boolean")return e;if(typeof e!="string")return;let t=e.trim().toLowerCase();if(t==="0"||t==="off"||t==="false"||t==="no"||t==="disabled")return!1;if(t==="1"||t==="on"||t==="true"||t==="yes"||t==="enabled")return!0}function Ne(e){if(typeof e=="number")return Number.isFinite(e)&&e>=0?e:void 0;if(typeof e!="string"||e.trim()==="")return;let t=Number(e);return Number.isFinite(t)&&t>=0?t:void 0}function Br(...e){let t={};for(let n of e)for(let[r,i]of Object.entries(n??{}))typeof i=="number"&&(t[r]=i);return t}var Ur='[VisIQ] OpenClaw plugin is installed but missing credentials. Provide them with one of (highest precedence first): (1) environment variables VISIQ_API_KEY=<key> VISIQ_AGENT_ID=<id> (set before `openclaw gateway run` / `openclaw start`) ; (2) a JSON file at the path in VISIQ_CONFIG_PATH ; (3) ~/.openclaw/openclaw.json -> plugins.entries["@visiq/openclaw-plugin"].config = { "apiKey": "<key>", "agentId": "<id>" } . Until credentials are provided the plugin is a NO-OP \u2014 tool calls run UNGOVERNED (fail-open default; set VISIQ_FAIL_MODE=closed to block instead).';function Vr(e){return e==="~"||e.startsWith("~/")?Ce(Ee(),e.slice(1).replace(/^\//,"")):e}async function Tt(e){try{let t=Lr(e)?e:$r(e),n=await Mr(t,"utf-8");return JSON.parse(n)}catch{return null}}function X(e,...t){for(let n of t){let r=e[n];if(typeof r=="string")return r}}function Se(e){if(!e||typeof e!="object")return{};let t=e,n=X(t,"apiKey","api_key"),r=X(t,"agentId","agent_id"),i=X(t,"baseUrl","base_url"),a=Te(X(t,"failMode","fail_mode")),o={};n&&(o.apiKey=n),r&&(o.agentId=r),i&&(o.baseUrl=i),a&&(o.failMode=a);let s=t.sequenceAnomaly??t.sequence_anomaly;if(s!=null){let l=ee(s);if(l!==void 0)o.sequenceAnomalyEnabled=l;else if(typeof s=="object"&&!Array.isArray(s)){let c=s,d=ee(c.enabled);d!==void 0&&(o.sequenceAnomalyEnabled=d);let u={};for(let m of ne){let g=Ne(c[m.key]??c[m.json]);g!==void 0&&(u[m.key]=g)}Object.keys(u).length>0&&(o.sequenceAnomalyThresholds=u)}}return o}async function zr(e){if(!e)return{};let t=Vr(e),n=await Tt(t);if(!n||typeof n!="object")return{};let r=n,i=r.plugins?.entries,a=i&&typeof i=="object"?i[Ct]:void 0;return a&&typeof a=="object"&&a.config?Se(a.config):Se(r)}async function Nt(e){if(!e)return{};let t=await Tt(e);if(!t||typeof t!="object")return{};let a=t.plugins?.entries?.[Ct];return!a||typeof a!="object"?{}:Se(a.config)}function Kr(){return Nt(Ce(Ee(),".openclaw","openclaw.json"))}function Gr(){let e=process.env.OPENCLAW_CONFIG_PATH;return!e||e===Ce(Ee(),".openclaw","openclaw.json")?Promise.resolve({}):Nt(e)}async function Wr(e){if(!process.stdout.isTTY)return{};let t=Pr({input:process.stdin,output:process.stdout}),n=r=>new Promise(i=>t.question(r,a=>i(a)));try{let r={...e};if(!r.apiKey){let i=(await n("VisIQ API key: ")).trim();i&&(r.apiKey=i)}if(!r.agentId){let i=(await n("VisIQ agent ID: ")).trim();i&&(r.agentId=i)}if(!r.baseUrl){let i=(await n("VisIQ base URL (optional, press Enter for default): ")).trim();i&&(r.baseUrl=i)}return r}finally{t.close()}}function Hr(){try{let e={"api-key":{type:"string"},"agent-id":{type:"string"},"base-url":{type:"string"},"fail-mode":{type:"string"}};for(let c of qr)e[c]={type:"string"};let{values:t}=Dr({args:process.argv.slice(2),options:e,strict:!1,allowPositionals:!0}),n={},r=t["api-key"],i=t["agent-id"],a=t["base-url"],o=Te(t["fail-mode"]);typeof r=="string"&&r&&(n.apiKey=r),typeof i=="string"&&i&&(n.agentId=i),typeof a=="string"&&a&&(n.baseUrl=a),o&&(n.failMode=o);let s=ee(t["sequence-anomaly"]);s!==void 0&&(n.sequenceAnomalyEnabled=s);let l={};for(let c of ne){let d=Ne(t[c.cli]);d!==void 0&&(l[c.key]=d)}return Object.keys(l).length>0&&(n.sequenceAnomalyThresholds=l),n}catch{return{}}}async function Da(){return(await Oe()).config}async function Oe(){let e=Hr(),t={};process.env.VISIQ_API_KEY&&(t.apiKey=process.env.VISIQ_API_KEY),process.env.VISIQ_AGENT_ID&&(t.agentId=process.env.VISIQ_AGENT_ID),process.env.VISIQ_BASE_URL?t.baseUrl=process.env.VISIQ_BASE_URL:process.env.VISIQ_ENDPOINT&&(t.baseUrl=process.env.VISIQ_ENDPOINT);let n=Te(process.env.VISIQ_FAIL_MODE);n&&(t.failMode=n);let r=ee(process.env.VISIQ_SEQUENCE_ANOMALY);r!==void 0&&(t.sequenceAnomalyEnabled=r);let i={};for(let u of ne){let m=Ne(process.env[u.env]);m!==void 0&&(i[u.key]=m)}Object.keys(i).length>0&&(t.sequenceAnomalyThresholds=i);let a=await zr(process.env.VISIQ_CONFIG_PATH),o=await Kr(),s=await Gr(),l={...o,...s,...a,...t,...e,sequenceAnomalyThresholds:Br(o.sequenceAnomalyThresholds,s.sequenceAnomalyThresholds,a.sequenceAnomalyThresholds,t.sequenceAnomalyThresholds,e.sequenceAnomalyThresholds)};(!l.apiKey||!l.agentId)&&process.stdout.isTTY&&process.stdin.isTTY&&(l=await Wr(l));let c=l.failMode??te;if(!l.apiKey||!l.agentId)return process.stderr.write(`${Ur}
+`),{config:null,failMode:c};let d={apiKey:l.apiKey,agentId:l.agentId,failMode:c,sequenceAnomaly:{enabled:l.sequenceAnomalyEnabled??jr.enabled,thresholds:l.sequenceAnomalyThresholds??{}}};return d.baseUrl=l.baseUrl||Fr,{config:d,failMode:c}}var Re=null,Ot={ready:!1,config:null,failMode:te};function xe(){return Re||(Re=Oe().catch(e=>(process.stderr.write(`[VisIQ] Config resolution failed (treating as unconfigured): ${e instanceof Error?e.message:String(e)}
+`),{config:null,failMode:te})).then(e=>(Ot={ready:!0,config:e.config,failMode:e.failMode},e))),Re}function re(){return xe().then(e=>e.config)}function ie(){return xe()}function ae(){return Ot}function qa(){xe()}import{z as p}from"zod";import*as C from"node:os";import{randomUUID as j}from"node:crypto";var xt="X-VisIQ-SDK",Mt="X-VisIQ-Dialect",Lt="unknown";function Me(e,t=1){return{[xt]:e&&e.length>0?e:Lt,[Mt]:String(t)}}var $t="interceptor_source",Qr=p.enum(["enforce","audit","off"]),Yr=p.enum(["closed","open"]),Pt=p.enum(["enforce","monitor","off"]),Zr=p.object({apiKey:p.string().min(1,"apiKey is required"),agentId:p.string().min(1,"agentId is required"),endpoint:p.string().url().optional(),mode:Qr.optional(),timeoutMs:p.number().int().positive().optional(),hitlTimeoutMs:p.number().int().positive().optional(),failBehavior:Yr.optional()}),Va=p.object({agent_id:p.string().min(1),target_app:p.string().min(1),action:p.string().min(1),context:p.record(p.unknown()).optional(),session_id:p.string().min(1).max(255).optional(),action_schema_id:p.string().min(1).max(128).optional(),telemetry:p.record(p.unknown()).optional()}),Jr=p.object({field:p.string().optional(),pattern:p.string().optional(),replacement:p.string().optional(),mode:p.enum(["full","partial","email"]).optional(),keepFirst:p.number().optional(),keepLast:p.number().optional(),maskChar:p.string().optional()}),Xr=p.object({decision_id:p.string().min(1),decision:p.enum(["permit","deny","approval_required","mask"]),reason:p.string().optional(),rule_code:p.string().nullable().optional(),enforced:p.boolean().optional(),agent_mode:Pt.optional(),arg_redaction_rules:p.array(Jr).optional(),plane:p.string().nullable().optional(),operation:p.string().nullable().optional(),is_retrieval:p.boolean().optional(),metadata:p.record(p.unknown()).optional()}),ei=p.object({field:p.string().min(1),operator:p.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:p.union([p.string(),p.number(),p.array(p.string())])}),ti=p.object({id:p.string().min(1),rule_code:p.string().default(""),name:p.string().min(1),description:p.string().nullable().default(null),effect:p.enum(["allow","deny","hitl","mask"]),resource_type:p.string().min(1),rego_source:p.string().default(""),target_app:p.string().nullable().default(null),action_pattern:p.string().nullable().default(null),conditions:p.array(ei).default([]),priority:p.number().int().default(0)}),ni=p.object({version:p.string().min(1),agent_mode:Pt.optional(),rules:p.array(ti),no_coverage:p.object({no_coverage_defaults:p.record(p.string()),autopilot_enabled:p.boolean(),enduser_hitl_enabled:p.boolean(),hitl_timeout_seconds:p.number()}).optional()}),ri=2e3,Le=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return Me(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let i=await r.json();return Xr.parse(i)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json();return ni.parse(a)}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let i=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});i.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${i.status}`)}catch(i){console.warn("[ALLOW] Execution result report failed:",i)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{system_prompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{tool_schemas:e.toolSchemas}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json();if(typeof a!="object"||a===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let o=a,s=o.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof o.reason=="string"?o.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await ii(ri)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function ii(e){return new Promise(t=>setTimeout(t,e))}function le(){let e={};try{let t=`${C.platform()} ${C.release()}`.trim();t&&(e.os=t)}catch{}try{let t=C.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=C.userInfo();t&&(e.username=t)}catch{}try{let t=ai();t&&(e.ip=t)}catch{}return e}function ai(){let e=C.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}function oi(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function oe(e,...t){for(let n of t){let r=oi(e[n]);if(r)return r}}function se(e){if(oe(e,"run_id","runId","session_id","sessionId","thread_id","threadId"))return"session";if(oe(e,"user_id","userId"))return"user";if(oe(e,"agent_id","agentId"))return"agent";if(oe(e,"org_id","orgId","namespace"))return"org"}var si=[{framework:"mem0",matches:e=>/^(mem0[_-])?(add|search|get|retrieve|update|delete)[_-]memor(y|ies)$/i.test(e),extract:(e,t)=>{let n=/^(?:mem0[_-])?([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"||n==="update"?r="write":r="read";let i=se(t);return{op:r,store:"mem0",framework:"mem0",...i?{scope:i}:{}}}},{framework:"letta",matches:e=>/^(core_memory_(append|replace)|archival_memory_(insert|search)|conversation_search)$/i.test(e),extract:e=>{let t=e.toLowerCase();return t.startsWith("core_memory_")?{op:"write",store:"letta-core",scope:"agent",framework:"letta"}:t==="archival_memory_insert"?{op:"write",store:"letta-archival",scope:"agent",framework:"letta"}:t==="archival_memory_search"?{op:"search",store:"letta-archival",scope:"agent",framework:"letta"}:{op:"search",store:"letta-conversation",scope:"session",framework:"letta"}}},{framework:"langgraph",matches:e=>/^(upsert_memory|save_recall_memory|search_recall_memories)$/i.test(e),extract:(e,t)=>{let n=/^search_/i.test(e),r=se(t);return{op:n?"search":"write",store:"langgraph-store",framework:"langgraph",...r?{scope:r}:{}}}},{framework:"zep",matches:e=>/^zep[_-](add|search|get|delete)[_-]memory$/i.test(e),extract:(e,t)=>{let n=/^zep[_-]([a-z]+)/i.exec(e)?.[1]?.toLowerCase(),r;n==="search"?r="search":n==="delete"?r="delete":n==="add"?r="write":r="read";let i=se(t)??"session";return{op:r,store:"zep",scope:i,framework:"zep"}}},{framework:"mcp-memory",matches:e=>/^(create_entities|create_relations|add_observations|delete_entities|delete_relations|delete_observations|search_nodes|open_nodes|read_graph)$/i.test(e),extract:e=>{let t=e.toLowerCase(),n;return t.startsWith("delete_")?n="delete":t==="search_nodes"?n="search":t==="open_nodes"||t==="read_graph"?n="read":n="write",{op:n,store:"mcp-memory",scope:"agent",framework:"mcp-memory"}}},{framework:"generic",matches:e=>/(^|[_\-.])(memory|memories|mem0|recall)([_\-.]|$)/i.test(e),extract:(e,t)=>{let n=e.toLowerCase(),r;/(^|[_\-.])(search|query|find|lookup|retrieve)([_\-.]|$)/.test(n)?r="search":/(^|[_\-.])(delete|remove|forget|clear|purge)([_\-.]|$)/.test(n)?r="delete":/(^|[_\-.])(add|save|write|store|upsert|put|set|update|insert|append|remember)([_\-.]|$)/.test(n)?r="write":r="read";let i=se(t);return{op:r,store:"memory",framework:"generic",...i?{scope:i}:{}}}}];function F(e,t){if(!e)return null;let n=t??{};for(let r of si)try{if(r.matches(e)){let i=r.extract(e,n);if(i)return i}}catch{}return null}function $e(e,t){let n=typeof t?.itemCount=="number"&&Number.isFinite(t.itemCount)&&t.itemCount>=0?Math.round(t.itemCount):void 0,r=typeof t?.bytes=="number"&&Number.isFinite(t.bytes)&&t.bytes>=0?Math.round(t.bytes):void 0,i=e.op==="read"||e.op==="search";return{op:e.op,store:e.store,...e.scope?{scope:e.scope}:{},...n!==void 0?{itemCount:n}:{},...r!==void 0?{bytes:r}:{},...i&&n!==void 0?{hit:n>0}:{}}}var Rt=new Map;function q(e){let t=(Rt.get(e)??0)+1;return Rt.set(e,t),t}function Dt(e){if(!e||typeof e!="object")return;let t={};for(let n of["tokensIn","tokensOut","cacheRead","cacheWrite"]){let r=e[n];typeof r=="number"&&Number.isFinite(r)&&r>=0&&(t[n]=Math.round(r))}return Object.keys(t).length>0?t:void 0}function Pe(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,i=Array.isArray(n.texts)?n.texts.filter(o=>typeof o=="string"&&o.length>0).join(`
+
+`):"",a=Dt(n.usage);e.emitCognition({clientEventId:j(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:q(r),ts:Date.now(),kind:n.final?"speech":"thought",visibility:"shown",provenance:"narration",...i?{content:{text:i}}:{},...a?{cost:a}:{},...n.model?{model:n.model}:{},...typeof n.durationMs=="number"&&Number.isFinite(n.durationMs)?{durationMs:Math.max(0,Math.round(n.durationMs))}:{},...t.framework?{framework:t.framework}:{}})}function De(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:j(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:q(r),ts:Date.now(),kind:"spawn",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},spawn:{childAgentId:n.childAgentId,childName:n.childName,kind:n.kind,...n.model?{model:n.model}:{},...n.task?{prompt:n.task}:{}}})}function Fe(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,i=n.memory?$e(n.memory):void 0;e.emitCognition({clientEventId:j(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:q(r),ts:Date.now(),kind:i?"memory":"action",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName,...n.verb?{verb:n.verb}:{},...n.argSummary?{argSummary:n.argSummary}:{}},...i?{memory:i}:{}})}function je(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId,i=c=>typeof c=="number"&&Number.isFinite(c)&&c>=0?Math.round(c):void 0,a=i(n.bytes),o=i(n.itemCount),s=i(n.durationMs),l;n.memory&&(l=$e(n.memory,{itemCount:o,bytes:a})),e.emitCognition({clientEventId:j(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:q(r),ts:Date.now(),kind:"observation",visibility:"shown",provenance:"parsed",...s!==void 0?{durationMs:s}:{},...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},result:{ok:n.ok,...a!==void 0?{bytes:a}:{},...o!==void 0?{itemCount:o}:{}},...l?{memory:l}:{}})}function qe(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:j(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:q(r),ts:Date.now(),kind:"intervention",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},tool:{name:n.toolName},governance:{decision:n.decision,enforced:n.enforced,...n.ruleCode?{ruleCode:n.ruleCode}:{},...n.ruleLabel?{ruleLabel:n.ruleLabel}:{},...n.harnessMessage?{harnessMessage:n.harnessMessage}:{}}})}function ce(e){try{let t=JSON.stringify(e);return typeof t=="string"?t.length:void 0}catch{return}}function de(e){try{return Array.isArray(e)?e.length:void 0}catch{return}}import{z as f}from"zod";import{createHash as li}from"crypto";import{createHash as Ni}from"crypto";var Ft=new Map;function jt(e){return e.map(t=>t.trim()).filter(t=>t.length>0&&t!=="true")}function zt(e){let t=li("sha256").update(e).digest("hex"),n=Ft.get(t);if(n)return n;let r=new Map,i=[],a=e.split(`
+`).map(l=>ci(l)).filter(l=>l.trim().length>0),o=0;for(;o<a.length;){let l=a[o].trim();if(l.startsWith("package ")||l.startsWith("import ")){o++;continue}let c=l.match(/^default\s+(\w+)\s*:?=\s*(.+)$/);if(c){let m=c[1],g=c[2].trim();r.set(m,U(g)),o++;continue}let d=l.match(/^(\w+)\s*:?=\s*(.+?)(?:\s+if)?\s*\{(.*)$/);if(d){let m=d[1],g=d[2].trim(),_=d[3].trim(),v=[];if(_&&_!=="}"){let A=_.endsWith("}")?_.slice(0,-1).trim():_;A&&v.push(A),_.endsWith("}")||(o++,o=ue(a,o,v))}else _==="}"||(o++,o=ue(a,o,v));let h=qt(v);i.push({variable:m,value:U(g),conditions:h,rawConditions:jt(v)}),o++;continue}let u=l.match(/^(\w+)(?:\s+if)?\s*\{(.*)$/);if(u){let m=u[1],g=u[2].trim(),_=[];if(g&&g!=="}"){let h=g.endsWith("}")?g.slice(0,-1).trim():g;h&&_.push(h),g.endsWith("}")||(o++,o=ue(a,o,_))}else g==="}"||(o++,o=ue(a,o,_));let v=qt(_);i.push({variable:m,value:"true",conditions:v,rawConditions:jt(_)}),o++;continue}o++}let s={defaults:r,rules:i};return Ft.set(t,s),s}function ci(e){let t=!1,n="";for(let r=0;r<e.length;r++){let i=e[r];if(t)i===n&&e[r-1]!=="\\"&&(t=!1);else if(i==='"'||i==="'")t=!0,n=i;else if(i==="#")return e.slice(0,r)}return e}function ue(e,t,n){let r=1,i=t;for(;i<e.length&&r>0;){let a=e[i].trim();for(let o of a)o==="{"&&r++,o==="}"&&r--;if(r>0)n.push(a),i++;else{let o=a.slice(0,a.lastIndexOf("}")).trim();return o&&n.push(o),i}}return i}function U(e){return e.startsWith('"')&&e.endsWith('"')||e.startsWith("'")&&e.endsWith("'")?e.slice(1,-1):e}function di(e){return e.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\")}function qt(e){let t=[];for(let n of e){let r=n.split(";").map(i=>i.trim()).filter(i=>i.length>0);for(let i of r){let a=ui(i);a&&t.push(a)}}return t}function ui(e){let t=!1,n=e.trim();if(n.startsWith("not ")&&(t=!0,n=n.slice(4).trim()),n==="true"||n==="false")return{type:"literal_bool",negated:t,field:"",value:n==="true"};if(n.includes("[_]"))return{type:"truthy",negated:!1,field:Be,value:e.trim()};let r=n.match(/^count\(([^)]+)\)\s*(>=|<=|>|<)\s*(\d+)$/);if(r)return{type:"count_gt",negated:t,field:r[1].trim(),operator:r[2],value:parseInt(r[3],10)};let i=n.match(/^startswith\(([^,]+),\s*"([^"]*)"\)$/);if(i)return{type:"startswith",negated:t,field:i[1].trim(),value:i[2]};let a=n.match(/^endswith\(([^,]+),\s*"([^"]*)"\)$/);if(a)return{type:"endswith",negated:t,field:a[1].trim(),value:a[2]};let o=n.match(/^contains\(([^,]+),\s*"([^"]*)"\)$/);if(o)return{type:"contains",negated:t,field:o[1].trim(),value:o[2]};let s=n.match(/^regex\.match\(\s*("(?:[^"\\]|\\.)*")\s*,\s*((?:input|data)[^\s)]*)\s*\)$/);if(s)return{type:"regex_match",negated:t,field:s[2].trim(),value:di(s[1])};let l=n.match(/^("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false)\s+in\s+((?:input|data)[^\s]*)$/);if(l)return{type:"array_includes",negated:t,field:l[2].trim(),value:Gt(l[1])};let c=n.match(/^([^\s]+)\s+in\s+(\[.*\])$/);if(c){let v=fi(c[2]);if(v!==null)return{type:"in_set",negated:t,field:c[1].trim(),values:v}}let d=n.match(/^([^\s=!<>]+)\s*(>=|<=|>|<)\s*(-?\d+(?:\.\d+)?)$/);if(d)return{type:"comparison",negated:t,field:d[1].trim(),operator:d[2],value:parseFloat(d[3])};let u=n.match(/^("(?:[^"\\]|\\.)*"|-?\d+(?:\.\d+)?|true|false)\s*==\s*((?:input|data)\S*)$/);if(u)return{type:"equality",negated:t,field:u[2].trim(),value:U(u[1].trim())};let m=n.match(/^([^\s=!]+)\s*==\s*(.+)$/);if(m)return{type:"equality",negated:t,field:m[1].trim(),value:U(m[2].trim())};let g=n.match(/^([^\s=!]+)\s*!=\s*(.+)$/);if(g)return{type:"inequality",negated:t,field:g[1].trim(),value:U(g[2].trim())};let _=n.match(/^(input(?:\.[a-zA-Z0-9_]+|\["[^"]+"\]|\['[^']+'\])+)$/);return _?{type:"truthy",negated:t,field:_[1].trim()}:{type:"truthy",negated:!1,field:Be,value:e.trim()}}var Be="__unrecognized_condition_forces_deny__";var pi=/[A-Za-z_][A-Za-z0-9_.]*\s*\(/;function Kt(e){let t=[];for(let n of e.rules)for(let r of n.conditions)typeof r.field=="string"&&r.field!==Be&&pi.test(r.field)&&t.push(r.field);return t}function Gt(e){let t=e.trim();return t==="true"?!0:t==="false"?!1:/^-?\d+(?:\.\d+)?$/.test(t)?parseFloat(t):t.startsWith('"')&&t.endsWith('"')||t.startsWith("'")&&t.endsWith("'")?t.slice(1,-1):t}function fi(e){let t=e.trim().replace(/^\[/,"").replace(/\]$/,"").trim();if(t.length===0)return[];let n=[],r="",i=!1,a="";for(let s=0;s<t.length;s++){let l=t[s];i?(r+=l,l===a&&t[s-1]!=="\\"&&(i=!1)):l==='"'||l==="'"?(r+=l,i=!0,a=l):l===","?(n.push(r.trim()),r=""):r+=l}if(i)return null;r.trim().length>0&&n.push(r.trim());let o=[];for(let s of n){let l=s.startsWith('"')&&s.endsWith('"')&&s.length>=2||s.startsWith("'")&&s.endsWith("'")&&s.length>=2,c=/^-?\d+(?:\.\d+)?$/.test(s);if(!l&&!c&&!(s==="true"||s==="false"))return null;o.push(Gt(s))}return o}var mi=["tier1","tier2","tier3"];function Wt(e){return typeof e=="string"&&mi.includes(e)}var gi=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],hi=["internal","customer_facing","experimental","third_party"],Ht=[...gi,...hi];function _i(e){return typeof e=="string"&&Ht.includes(e)}function Qt(e){let t=new Set;for(let n of e)_i(n)&&t.add(n);return Ht.filter(n=>t.has(n))}var yi=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"];function bi(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var Bt={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function vi(e){let t=bi(e);return t===null?"other":Bt[t]??Bt[t.replace(/_/g,"")]??"other"}function Yt(e,t){let n={...e};if(t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=vi(t.targetApp)),n.context=r}return n}var Ut=64,wi=64,V={retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function Zt(){return{retrieved_data_categories:[],retrieved_classifications:[],taint:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var Ai=new Set(["deny","approval_required","escalate"]);function B(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let i of t)n.add(i);let r=[...n].sort();return r.length>Ut?r.slice(0,Ut):r}function Vt(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function pe(e){return typeof e=="string"&&e.length>0?e:null}function Jt(e,t){let n=Vt(t.data_categories),r=pe(t.classification),i=Vt(t.taint),a=pe(t.action_class),o=a&&yi.includes(a)?a:null,s=pe(t.target_app),l=pe(t.decision),c={...e.action_counts};if(o)if(o in c)c[o]=(c[o]??0)+1;else if(Object.keys(c).length<wi)c[o]=1;else{let d=Object.keys(c).sort(),u=d[d.length-1];u!==void 0&&o<u&&(delete c[u],c[o]=1)}return{retrieved_data_categories:B(e.retrieved_data_categories,n),retrieved_classifications:B(e.retrieved_classifications,r?[r]:[]),taint:B(e.taint,i),action_classes:B(e.action_classes,o?[o]:[]),action_counts:c,denied_count:e.denied_count+(l==="deny"?1:0),inhibited_count:e.inhibited_count+(l&&Ai.has(l)?1:0),event_count:e.event_count+1,target_apps:B(e.target_apps,s?[s]:[])}}var Xt={minEvents:12,minClasses:3,concentrationSigma:2,dominanceRatio:4,dominanceShare:.5,frictionRatio:.75,minFrictionEvents:6};function Ii(e){let t=null,n=0;for(let r of Object.keys(e).sort()){let i=Math.max(0,e[r]??0);i>n&&(n=i,t=r)}return{label:t,count:n}}function Ue(e){let t=e.length;if(t===0)return 0;let n=t>>1;return t%2===1?e[n]:(e[n-1]+e[n])/2}function fe(e){return Number.isFinite(e)?Math.round(e*1e3)/1e3:0}var ki=.5;function Si(e){let t=e.length;if(t===0)return 0;let n=[...e].sort((s,l)=>s-l),r=Ue(n),i=n[t-1],a=n.map(s=>Math.abs(s-r)).sort((s,l)=>s-l),o=Ue(a);return o>0?.6745*(i-r)/o:i===r?0:.6745*(i-r)/ki}function Ve(e,t){let n={...Xt,...t.config},r=e.action_counts??{},i=Math.max(0,e.event_count??0),a=Math.max(0,e.denied_count??0),o=Math.max(0,e.inhibited_count??0),s=Ii(r),l={};for(let y of Object.keys(r).sort()){let b=Math.max(0,r[y]??0);b>0&&(l[y]=b)}let c=Object.values(l),d=c.reduce((y,b)=>y+b,0),u=[...c].sort((y,b)=>y-b),m=Ue(u),g=Si(c),_=m>0?s.count/m:0,v=d>0?s.count/d:0,h=i>0?(a+o)/i:0,A={action_class:null,repeats:s.count,event_count:i,denied_count:a,inhibited_count:o,class_count:c.length,class_counts:l,concentration_score:fe(g),dominance_ratio:fe(_),dominance_share:fe(v),friction_score:fe(h),signals:[]};if(i<n.minEvents)return{verdict:"allow",signals:[],evidence:A};let k=[],S=null;return c.length>=n.minClasses&&g>=n.concentrationSigma&&_>=n.dominanceRatio&&v>=n.dominanceShare&&(k.push("concentration"),S=s.label),h>=n.frictionRatio&&a+o>=n.minFrictionEvents&&k.push("friction"),k.length===0?{verdict:"allow",signals:[],evidence:A}:{verdict:t.failMode==="closed"?"deny":"hold",signals:[...k],evidence:{...A,action_class:S,signals:[...k]}}}var en="generic",tn=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:en,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],Ei=tn.map(e=>e.id),Ha=new Map(tn.map(e=>[e.id,e])),Qa=new Set(Ei);function nn(e){return Array.isArray(e)&&e.length>0?[...e]:[en]}var Ci=/^[a-z][a-z0-9_]*$/;function rn(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&Ci.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var Ti=["narrow","moderate","broad","unbounded","unknown"];function an(e){return typeof e=="string"&&Ti.includes(e)}function on(e){return e==="open"||e==="closed"?e:null}var Oi=["tool_name","function","name","action"];function me(e,t,n){if(Array.isArray(e)){if(e.length===0){n.push([`${t}[]`,void 0]);return}for(let r of e)me(r,`${t}[]`,n);return}if(e!==null&&typeof e=="object"){let r=Object.entries(e);if(r.length===0){t&&n.push([t,void 0]);return}for(let[i,a]of r)me(a,t?`${t}.${i}`:i,n);return}t&&n.push([t,e])}function Ri(e){let t=[];return me(e,"",t),[...new Set(t.map(([n])=>n))].sort()}function xi(e){let t=e.slice(e.lastIndexOf(".")+1);return t.endsWith("[]")?t.slice(0,-2):t}function Mi(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().toLowerCase();return t.length>0?t:null}function Li(e,t={}){if(t.discriminatorField===null)return null;let n=[];me(e,"",n);let r=t.discriminatorField?[t.discriminatorField]:t.discriminatorFields??Oi;for(let i of r){let a=null;for(let[o,s]of n){if(xi(o)!==i)continue;let l=Mi(s);l!==null&&(a===null||o<a.path)&&(a={path:o,value:l})}if(a)return a.value}return null}function sn(e,t={}){let n=Ni("sha256").update(Ri(e).join(",")).digest("hex").slice(0,16),r=Li(e,t);return r!==null?`${n}:${r}`:n}var $i=["action","retrieval","delegation"];function Pi(e){return typeof e=="string"&&$i.includes(e)}var Di=new Set(["rules"]);function ln(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!Di.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(Pi):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}import{z as ge}from"zod";var cn=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function Fi(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:cn(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:cn(t.spawn.prompt)}),t}function ji(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var qi=1440*60*1e3,Bi="VISIQ_BUNDLE_GRACE_TTL_MS",Ui="VISIQ_BUNDLE_CACHE_DISABLED",Vi="VISIQ_CACHE_DIR",zi=ge.object({graceTtlMs:ge.number().int().nonnegative().optional(),disabled:ge.boolean().optional(),cacheDir:ge.string().min(1).optional()}).strict();function Ki(e){return e==null?{}:zi.parse(e)}function Gi(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[Bi];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return qi}function Wi(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[Ui]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var dn;function Hi(){if(dn!==void 0)return dn;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function Qi(e){return JSON.stringify(Ke(e))}function Ke(e){if(Array.isArray(e))return e.map(Ke);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=Ke(t[r]);return n}return e}function Yi(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function Zi(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function _n(){if(!Hi())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function yn(e,t){return e.createHash("sha256").update(Qi(t)).digest("hex")}function Ji(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[Vi]?.trim();if(r)return r;let i=process.env.XDG_CACHE_HOME?.trim();if(i)return e.path.join(i,"visiq");let a="";try{a=e.os.homedir()}catch{a=""}return a?e.path.join(a,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function Xi(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function bn(e,t,n){return e.path.join(Ji(e,n),"bundles",`${Xi(e,t)}.json`)}async function ea(e,t,n,r={}){let i=await _n();if(i)try{let a=bn(i,e,r),o=i.path.dirname(a);await i.fs.mkdir(o,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:yn(i.crypto,t),body:t},l=`${a}.tmp-${process.pid}-${i.crypto.randomBytes(6).toString("hex")}`;await i.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await i.fs.rename(l,a)}catch(c){throw await i.fs.rm(l,{force:!0}).catch(()=>{}),c}}catch{}}async function ta(e,t={}){let n=await _n();if(!n)return null;try{let r=await n.fs.readFile(bn(n,e,t),"utf-8"),i=Zi(JSON.parse(r));return!i||yn(n.crypto,i.body)!==i.contentHash?null:i}catch{return null}}var z;async function na(){if(z!==void 0)return z;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;z=typeof t=="function"?t:null}catch{z=null}return z}function ra(e){let t=[];for(let n of e){if(typeof n!="object"||n===null)continue;let r=n,i=r.rego_source;if(typeof i!="string"||i.length===0)continue;let a;try{a=zt(i)}catch{continue}let o=typeof r.id=="string"?r.id:"<rule>";for(let s of Kt(a))t.push(`${o}: ${s}`)}return t}var ia=5e3,aa=1e4,oa=25,un=1e3,sa=5e3,la=100,pn=2e3,ca=512,da=1800*1e3,ua=.7,pa="monitor",fa="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",fn="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",ma="open";function mn(e){if(typeof e!="string")return;let t=e.trim().toLowerCase();return t==="open"||t==="closed"?t:void 0}function ga(e,t){return bt({content:e,resourceMetadata:t})}var ha=f.object({operations:f.array(f.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:f.string().min(1,"agentId is required"),sessionId:f.string().min(1).max(255).optional(),toolName:f.string().optional(),toolArgs:f.record(f.unknown()).optional(),targetResource:f.string().optional(),resourceType:f.string().optional(),resourceMetadata:f.record(f.unknown()).optional(),normalized:f.record(f.unknown()).optional(),query:f.string().optional(),contentPreview:f.string().optional(),telemetry:f.record(f.unknown()).optional(),context:f.record(f.unknown()).optional(),mcpServer:f.string().min(1).max(255).optional()}),_a=f.object({version:f.string().min(1),dialect_version:f.number().int().optional(),min_dialect:f.number().int().optional(),shutdown:f.boolean().optional(),agent_mode:f.enum(["enforce","monitor","off"]).optional(),cognition_capture:f.boolean().optional(),agent_mode_by_operation:f.object({action:f.string().optional(),retrieval:f.string().optional(),delegation:f.string().optional()}).partial().optional(),agent_attributes:f.object({trust_tier:f.string().nullable().optional(),categories:f.array(f.string()).optional(),business_function:f.string().nullable().optional(),business_functions:f.array(f.string()).nullable().optional(),blast_radius_tier:f.string().nullable().optional(),no_coverage:f.string().nullable().optional(),fail_mode:f.string().nullable().optional()}).optional(),rules:f.array(f.record(f.unknown())),action_schemas:f.array(f.object({id:f.string(),plane:f.string().optional(),field_mappings:f.array(f.record(f.unknown())).optional(),derived_fields:f.array(f.record(f.unknown())).optional(),action_class:f.string().nullable().optional(),action_class_confidence:f.number().optional()})).optional(),no_coverage:f.object({no_coverage_defaults:f.record(f.string()),autopilot_enabled:f.boolean(),enduser_hitl_enabled:f.boolean(),hitl_timeout_seconds:f.number().optional()}).optional()});function ya(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=nn(rn(n));return{trust_tier:Wt(t)?t:null,categories:Qt(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&an(e.blast_radius_tier)?e.blast_radius_tier:null}}function ba(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function va(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var Ge=new Set,gn=!1;async function hn(e){let t=[];for(let n of Ge){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function wa(){if(!gn&&!(typeof process>"u"||typeof process.once!="function")){gn=!0,process.once("beforeExit",()=>{hn(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await hn(!0)}finally{process.kill(process.pid,e)}})()})}}var vn=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=pa;agentModeByOperation=null;rawBundle=null;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;failMode=mn(typeof process<"u"?process.env?.VISIQ_FAIL_MODE:void 0)??ma;governedFailMode=null;telemetryBuffer=[];telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;lastCloneCaptureSig=null;toolDescriptions=new Map;constructor(e,t,n,r,i,a,o,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,c=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,d=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=c,this.resolvedAgentId=d,this.harnessKind=r,this.sdkVersion=a,this.sdkDialect=o,this.originalFetch=globalThis.fetch.bind(globalThis);let u=Ki(s);if(this.bundleCacheDisabled=Wi(u.disabled),this.bundleGraceTtlMs=Gi(u.graceTtlMs),this.bundleCacheDirOverride=u.cacheDir,this.cacheIdentity=l&&c&&!this.bundleCacheDisabled?{endpoint:c,agentId:d,apiKey:l}:null,l&&c){let m={apiKey:l,agentId:d,endpoint:c,mode:"enforce",timeoutMs:ji(i),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...a!==void 0?{sdkVersion:a}:{},...o!==void 0?{sdkDialect:o}:{}};this.client=new Le(m,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},ia),ze(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},aa),ze(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},sa),ze(this.cognitionTimer),Ge.add(this),wa()}else this.client=null}async evaluate(e){let t=ha.parse(e),n=Date.now();if(this.operatorShutdown){let u=this.denyAll(t,fa);return this.applyAgentMode(u,"enforce",t,n)}if(this.dialectRefused){if(this.failMode==="open")return this.failOpen(t,fn,n);let u=this.denyAll(t,fn);return this.applyAgentMode(u,"enforce",t,n)}if(t.operations.every(u=>this.modeFor(u)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let u;if(this.agentModeConfirmed?u=this.agentMode:this.bundleApplyFailed?u="enforce":u="monitor",u==="enforce"&&this.failMode==="open")return this.failOpen(t,"no unified bundle loaded and no local rules",n);let m=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(m,u,t,n)}let r=this.readSession(t.sessionId),i=await na();if(!i||!this.rawBundle){if(this.failMode==="open")return this.failOpen(t,"governance core (@visiq/core-wasm) unavailable",n);throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)")}let a=t.operations.includes("action")||t.operations.includes("delegation")?Yt(t.normalized??{},{targetApp:t.targetResource??t.toolName??""}):t.normalized,o=this.buildActionSchemaEvent(t),s=t.mcpServer?{...a??{},mcp_server:t.mcpServer}:a,l={...t,normalized:s,session:r,at:Date.now(),action_schema_id:o.id,action_schema_raw:o.canonical},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},d;try{d=i(l,c)}catch(u){if(this.failMode==="open")return this.failOpen(t,`governance core evaluation threw: ${u instanceof Error?u.message:String(u)}`,n);throw u}return this.foldSession(t,d.enforced?d.decision:"permit"),d.enforced&&d.action.decision==="approval_required"&&await this.registerHitl(t,d),this.bufferTelemetry(t,d,Date.now()-n,d.enforced),d}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}readSession(e){if(!e)return V;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>da?(this.sessions.delete(e),V):t.state:V}foldActionClass(e){let t=e.normalized?.action_class;if(typeof t=="string"&&t.length>0)return t;let n=this.rawBundle?.action_schemas;if(!Array.isArray(n))return;let{id:r}=this.buildActionSchemaEvent(e),i=n.find(s=>s?.id===r);if(!i)return;let a=i.action_class,o=typeof i.action_class_confidence=="number"?i.action_class_confidence:0;if(typeof a=="string"&&a.length>0&&o>=ua)return a}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),i=e.resourceMetadata??{},a=e.operations.includes("retrieval"),o=e.operations.includes("action")||e.operations.includes("delegation"),s=Jt(r===V?Zt():r,{data_categories:a&&Array.isArray(i.data_categories)?i.data_categories:void 0,classification:a?i.classification:void 0,taint:a?ga(e.contentPreview,i):void 0,action_class:o?this.foldActionClass(e):void 0,target_app:o?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:s,touchedAt:Date.now()}),this.sessions.size>ca){let l=this.sessions.keys().next().value;l!==void 0&&this.sessions.delete(l)}}applyAgentMode(e,t,n,r){let i=Date.now()-r;if(t==="enforce"){let o={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,o,i,!0),o}let a={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,a,i,!1),a}setFailMode(e){this.failMode=e}getFailMode(){return this.failMode}getGovernedFailMode(){return this.governedFailMode}failOpen(e,t,n){let r=`fail-open: ${t} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`;console.error(`[VisIQ] FAIL-OPEN: ${t} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.`);let i=e.operations.includes("action")||e.operations.includes("delegation"),a=e.operations.includes("retrieval"),o={decision:"permit",allowed:!0,reason:r,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:i?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:a?{action:"allow"}:{action:null},failOpen:!0};return this.bufferTelemetry(e,o,Date.now()-n,!1,!0),o}reportFailOpen(e,t){try{let n={operations:["action"],agentId:this.resolvedAgentId,...t?.toolName?{toolName:t.toolName}:{},...t?.sessionId?{sessionId:t.sessionId}:{}},r={decision:"permit",allowed:!0,reason:`fail-open: ${e} \u2014 proceeding UNGOVERNED (set VISIQ_FAIL_MODE=closed to block instead)`,ruleId:null,ruleCode:null,enforced:!1,agentMode:this.agentMode,action:{decision:"permit",allowed:!0},retrieval:{action:null},failOpen:!0};this.bufferTelemetry(n,r,0,!1,!0)}catch{}}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},action_schema_id:this.buildActionSchemaEvent(e).id,...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=_a.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}let r=ra(t.rules);if(r.length>0){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle contains rego_source using a builtin the engine cannot evaluate (would silently never match \u2192 fail open): ${r.join("; ")}. Refusing the bundle and failing closed (G001). Recompile the rule without case-folding wrappers like upper()/lower().`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(i=>ln(i)).filter(i=>i!==null),this.agentAttributes=t.agent_attributes?ya(t.agent_attributes):null,this.agentNoCoverage=on(t.agent_attributes?.no_coverage),this.governedFailMode=mn(t.agent_attributes?.fail_mode)??null,this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=ba(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...Me(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304)return;if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),i=await n.json();this.applyBundle(i);let a=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&a?this.bundleEtag=r:a||(this.bundleEtag=null),a&&await this.persistBundleToDisk(i)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await ta(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(Yi(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await ea(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}isBundleLoaded(){return this.bundleLoaded}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e,t){this.registerEnvironment({...le(),...e?{agent_type:e}:{},...t?.model?{model:t.model}:{},...t?.systemPrompt?{systemPrompt:t.systemPrompt}:{},...t?.toolSchemas&&t.toolSchemas.length>0?{toolSchemas:t.toolSchemas}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));for(let n of e)n.description&&this.toolDescriptions.set(n.name,n.description);t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}captureCloneMetadata(e){if(!this.client||!this.resolvedAgentId||!(e.model||e.systemPrompt||(e.toolSchemas?.length??0)>0))return;let t=JSON.stringify({m:e.model??"",s:e.systemPrompt??"",t:e.toolSchemas??[]});t!==this.lastCloneCaptureSig&&(this.lastCloneCaptureSig=t,this.client.registerEnvironment({...le(),...e.agentType?{agent_type:e.agentType}:{},...e.model?{model:e.model}:{},...e.systemPrompt?{systemPrompt:e.systemPrompt}:{},...e.toolSchemas&&e.toolSchemas.length>0?{toolSchemas:e.toolSchemas}:{}}))}buildActionSchemaEvent(e){let t=e.toolName?this.toolDescriptions.get(e.toolName):void 0,n={agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{},...e.toolArgs?{tool_args:e.toolArgs}:{},...t?{tool_description:t}:{}},r=sn(n),i={...n};return e.toolArgs&&(i.tool_args=dt(e.toolArgs)),{canonical:n,id:r,rawEventForWire:i}}bufferTelemetry(e,t,n,r,i=!1){let a=this.buildActionSchemaEvent(e);this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?va(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:a.rawEventForWire,action_schema_id:a.id,...this.harnessKind||e.context||i?{context:{...this.harnessKind?{[$t]:this.harnessKind}:{},...e.context??{},...i?{fail_open:!0}:{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=oa&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0);try{await this.client.sendTelemetry(e)}catch(t){console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",t)}}enforceTelemetryCap(){let e=this.telemetryBuffer.length-un;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${un})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(Fi(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=la&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-pn;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${pn})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}await this.flushTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),Ge.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function ze(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function K(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function wn(e,t){if(e!=="sessions_spawn")return null;let n=K(t.agentId);return n?{childAgentId:n,childName:K(t.taskName)??K(t.label)??n,kind:"subagent",task:K(t.task),model:K(t.model),source:"structural"}:null}function An(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}var x=null;function E(e){let t=`${e.apiKey}::${e.agentId}::${e.baseUrl??""}`;if(x&&x.key===t)return x.runtimes;let n=new vn(e.apiKey,e.baseUrl,e.agentId,"cli_harness");return n.setFailMode(e.failMode),n.registerHostEnvironment(),x={key:t,runtimes:{unified:n}},x.runtimes}async function co(){if(x)try{await x.runtimes.unified.flush()}catch{}}async function uo(e){try{let t=await re();if(!t)return;let{unified:n}=E(t);await n.awaitBundleReady(e)}catch{}}function In(){return x?.runtimes.unified.getAgentMode()}function I(e){try{process.stderr.write(`[VisIQ] FAIL-OPEN (${e.stage}): ${e.detail} \u2014 proceeding UNGOVERNED. Set VISIQ_FAIL_MODE=closed to block instead.
+`)}catch{}if(e.config)try{E(e.config).unified.reportFailOpen(`${e.stage}: ${e.detail}`,{...e.toolName?{toolName:e.toolName}:{},...e.sessionId?{sessionId:e.sessionId}:{}})}catch{}}function G(e,t,n){try{let r=n instanceof Error?n.message:String(n);process.stderr.write(`[VisIQ] TRACE-DEGRADED (${e}) for tool "${t}": ${r} \u2014 the governance decision was still made and enforced; only the execution-trace beat was lost.
+`)}catch{}}function O(e,t){return e?.sessionKey??t?.sessionKey??t?.sessionId??"default"}var We=class{entries=new Map;set(t,n){this.entries.set(t,n)}get(t){return this.entries.get(t)}delete(t){this.entries.delete(t)}clear(){this.entries.clear()}size(){return this.entries.size}},He=new Map;function $(e){let t=He.get(e);return t||(t=new We,He.set(e,t)),t}function kn(e){He.delete(e)}var Sn=new Set(["web_search","x_search","web_fetch","tool_search","tool_describe","get_account","get_transactions","get_devices","check_watchlist","search_knowledge"]);function En(e){return Sn.has(Ae(e))}function _o(){return Sn}var Qe="@visiq/openclaw-plugin";function Cn(e){let t=[],n=[],r;for(let a of e){let{field:o,pattern:s,replacement:l}=a;o&&t.push(o),s&&n.push(s),l&&r===void 0&&(r=l)}let i={};return t.length>0&&(i.fields=t),n.length>0&&(i.patterns=n),r!==void 0&&(i.replacement=r),i}async function Mo(e,t){let{config:n,failMode:r}=await ie();if(!n){if(r==="closed")return{block:!0,blockReason:"[VisIQ] Plugin is loaded but NOT configured \u2014 VisIQ cannot govern this tool call. Set VISIQ_API_KEY + VISIQ_AGENT_ID (and optionally VISIQ_ENDPOINT), or the plugin config, then retry. Blocked because VISIQ_FAIL_MODE=closed."};I({stage:"unconfigured",detail:"no VisIQ credentials resolved (need VISIQ_API_KEY + VISIQ_AGENT_ID)",toolName:e.toolName,sessionId:O(e,t)});return}let i=E(n),a=n.agentId??t.agentId,o=O(e,t),s=t.toolCallId??e.toolCallId,c=En(e.toolName)?["retrieval","action"]:["action"],d=Aa(e.params),u=wn(e.toolName,e.params??{}),m;u&&a&&(De(i.unified,{agentId:a,sessionId:o,framework:"openclaw"},u),c.push("delegation"),m=An(u,a));let g=a?{agentId:a,sessionId:o,framework:"openclaw"}:null,_=F(e.toolName,e.params??{});if(g)try{Fe(i.unified,g,{toolName:e.toolName,..._?{memory:_}:{}})}catch(y){G("step-beat",e.toolName,y)}let v=(y,b,M,T)=>{if(g)try{qe(i.unified,g,{toolName:e.toolName,decision:y,...b?{ruleCode:b}:{},...M?{ruleLabel:M}:{},enforced:!0,...T?{harnessMessage:T}:{}})}catch(N){G("intervention-beat",e.toolName,N)}},h;try{if(await i.unified.awaitBundleReady(),!i.unified.isBundleLoaded()&&n.failMode!=="closed"){I({stage:"no-bundle",detail:"no rule bundle available after warm-up",toolName:e.toolName,sessionId:o,config:n});return}h=await i.unified.evaluate({operations:c,agentId:a,sessionId:o,toolName:e.toolName,toolArgs:e.params??{},resourceType:"tool_result",resourceMetadata:{toolName:e.toolName,runId:e.runId??t.runId},...d!==void 0?{query:d}:{},...m?{context:m}:{}})}catch(y){let b=y instanceof Error?y.message:String(y);if(n.failMode==="closed")return{block:!0,blockReason:`[VisIQ] Evaluation error \u2014 blocked (VISIQ_FAIL_MODE=closed): ${b}`};I({stage:"eval-error",detail:b,toolName:e.toolName,sessionId:o,config:n});return}if(!h.enforced)return;let{action:A}=h;if(A.decision==="approval_required")return v("approval_required",h.ruleCode??void 0,h.reason),{requireApproval:{title:`VisIQ approval required: ${e.toolName}`,description:h.reason,severity:"critical",allowedDecisions:["allow-once","allow-always","deny"],pluginId:Qe}};if(!A.allowed){let b=`[VisIQ ${h.ruleCode??"DENY"}] ${h.reason}`;return v("deny",h.ruleCode??void 0,h.reason,b),{block:!0,blockReason:b}}let k;if(A.decision==="mask"&&A.argRedactionRules&&A.argRedactionRules.length>0)try{k=J(e.params??{},Cn(A.argRedactionRules)),v("mask",h.ruleCode??void 0,h.reason)}catch(y){let b=y instanceof Error?y.message:String(y);if(n.failMode==="closed")return{block:!0,blockReason:`[VisIQ] Argument masking failed \u2014 blocked (VISIQ_FAIL_MODE=closed): ${b}`};I({stage:"mask-error",detail:`argument masking failed \u2014 running with UNMASKED params: ${b}`,toolName:e.toolName,sessionId:o,config:n}),k=void 0}if(c.includes("retrieval"))switch(h.retrieval.action){case"allow":case null:break;case"deny":{let y=`[VisIQ RECALL] ${h.reason}`;return v("deny",h.ruleCode??void 0,h.reason,y),{block:!0,blockReason:y}}case"redact":{if(!s){if(n.failMode==="closed")return{block:!0,blockReason:"[VisIQ RECALL] Redact decision but no toolCallId \u2014 blocked (VISIQ_FAIL_MODE=closed)"};I({stage:"redact-no-toolcallid",detail:"redact decision could not be applied (no toolCallId to correlate the result)",toolName:e.toolName,sessionId:o,config:n});break}let y=h.retrieval.redactionRules??[];y.length>0&&$(o).set(s,Cn(y));break}case"escalate":return{requireApproval:{title:`VisIQ approval required: ${e.toolName}`,description:h.reason,severity:"warning",allowedDecisions:["allow-once","allow-always","deny"],pluginId:Qe}};default:{let y=h.retrieval.action;if(n.failMode==="closed")return{block:!0,blockReason:`[VisIQ RECALL] Unknown action "${String(y)}" \u2014 blocked (VISIQ_FAIL_MODE=closed)`};I({stage:"unknown-retrieval-verb",detail:`unknown retrieval action "${String(y)}" (harness/backend version skew)`,toolName:e.toolName,sessionId:o,config:n});break}}if(Ie(e.toolName)){let y=n.failMode==="closed"?"closed":"open",b=k??e.params??{},M=!1,T=Q(b,{failMode:y});if(T.verdict==="block")return{block:!0,blockReason:`[VisIQ OUTPUT-BLOCK] outbound content carried a live secret (${T.detectors.join(",")}) \u2014 blocked (VISIQ_FAIL_MODE=closed)`};T.verdict==="redact"&&(b=T.redacted,M=!0,I({stage:"outbound-secret-redacted",detail:`outbound secret screen redacted ${T.detectors.length} detector(s): ${T.detectors.join(",")}`,toolName:e.toolName,sessionId:o,config:n}));let N=Z(b,{failMode:y});if(N.verdict==="block")return{block:!0,blockReason:`[VisIQ OUTPUT-BLOCK] outbound content matched a brand/topic rule (${N.matched.join(",")}) \u2014 blocked (VISIQ_FAIL_MODE=closed)`};if(N.verdict==="redact"&&(b=N.redacted,M=!0,I({stage:"outbound-brand-topic-redacted",detail:`outbound brand/topic screen redacted ${N.matched.length} rule(s): ${N.matched.join(",")} (recommended: ${N.recommendedOutcome??"none"})`,toolName:e.toolName,sessionId:o,config:n})),M)return{params:b}}if((n.sequenceAnomaly?.enabled??!0)&&typeof i.unified.getSessionState=="function"&&o){let y=i.unified.getSessionState(o),b=Ve(y,{failMode:n.failMode==="closed"?"closed":"open",config:n.sequenceAnomaly?.thresholds});if(b.verdict==="deny")return{block:!0,blockReason:`[VisIQ ANOMALY] session-sequence anomaly (${b.signals.join(",")}) over ${b.evidence.event_count} events \u2014 blocked (VISIQ_FAIL_MODE=closed)`};if(b.verdict==="hold")return I({stage:"sequence-anomaly-hold",detail:`session-sequence anomaly held for approval (${b.signals.join(",")}) over ${b.evidence.event_count} events`,toolName:e.toolName,sessionId:o,config:n}),{requireApproval:{title:`VisIQ approval required: ${e.toolName}`,description:`A behavioral sequence anomaly was detected in this session (${b.signals.join(",")}). Approve to proceed, or deny to stop the run.`,severity:"warning",allowedDecisions:["allow-once","allow-always","deny"],pluginId:Qe}}}if(k)return{params:k}}function Aa(e){if(e)for(let t of["query","q","url","prompt"]){let n=e[t];if(typeof n=="string"&&n.length>0)return n}}function Bo(e,t){let{ready:n,config:r}=ae();if(!n||!r)return;let i=O(e,t),a=e.toolName??t.toolName,o=r.agentId??t.agentId;if(a&&o)try{let u=e.message?.content,m=F(a);je(E(r).unified,{agentId:o,sessionId:i,framework:"openclaw"},{toolName:a,ok:!0,...ce(u)!==void 0?{bytes:ce(u)}:{},...de(u)!==void 0?{itemCount:de(u)}:{},...m?{memory:m}:{}})}catch(u){G("observation-beat",a,u)}let s=e.toolCallId??t.toolCallId;if(!s)return;let l=$(i),c=l.get(s);if(!c)return;let d={...e.message};return d.content!==void 0&&(d.content=J(d.content,c)),l.delete(s),{message:d}}function P(e,t){return e?.sessionKey||e?.sessionId||t?.sessionKey||t?.sessionId||void 0}var Ye=new Map;function Tn(e,t){e&&Ye.set(e,t)}function Nn(e){return e?Ye.get(e):void 0}function On(e){e&&Ye.delete(e)}function Yo(e,t){let{ready:n,config:r,failMode:i}=ae();if(n&&!r)return;let a=O(e,t),o=$(a);if(o.size()>0){if(o.clear(),i==="closed")return{block:!0};I({stage:"unconsumed-redaction",detail:"queued redaction was never applied to a tool result before message write",sessionId:a,config:r})}if(r&&In()==="enforce"){let s=i==="closed"?"closed":"open",l=Q(e.message,{failMode:s});if(l.verdict==="block")return{block:!0};let c=e.message,d=!1;l.verdict==="redact"&&(c=l.redacted,d=!0);let u=!1,m=Nn(P(e,t));if(m){let v=wt(c,m,{failMode:s});if(v.verdict==="block")return{block:!0};v.verdict==="redact"&&(c=v.redacted,u=!0,I({stage:"final-message-prompt-leak-redacted",detail:`final assistant message leaked the system prompt \u2014 masked ${v.matchedSpans.length} verbatim span(s)`,sessionId:a,config:r}))}let g=!1,_=Z(c,{failMode:s});if(_.verdict==="block")return{block:!0};if(_.verdict==="redact"&&(c=_.redacted,g=!0,I({stage:"final-message-brand-topic-redacted",detail:`final assistant message matched a brand/topic rule \u2014 redacted ${_.matched.length} rule(s): ${_.matched.join(",")} (recommended: ${_.recommendedOutcome??"none"})`,sessionId:a,config:r})),d&&I({stage:"final-message-secret-redacted",detail:`final assistant message carried a live secret \u2014 redacted ${l.detectors.length} detector(s): ${l.detectors.join(",")}`,sessionId:a,config:r}),d||u||g)return{message:c}}}async function ts(e,t){try{let{config:n}=await ie();if(!n)return;typeof e.systemPrompt=="string"&&e.systemPrompt.trim().length>0&&Tn(P(e,t),e.systemPrompt);let{unified:r}=E(n);r.captureCloneMetadata({model:typeof e.model=="string"&&e.model.trim().length>0?e.model:void 0,systemPrompt:typeof e.systemPrompt=="string"&&e.systemPrompt.trim().length>0?e.systemPrompt:void 0,toolSchemas:Array.isArray(e.tools)&&e.tools.length>0?e.tools:void 0,agentType:"openclaw"})}catch{}}async function os(e,t){try{let n=await re();if(!n)return;let r=n.agentId??t.agentId;if(!r)return;let i=e.sessionId??t.sessionId??t.sessionKey,{unified:a}=E(n);await a.awaitBundleReady(),Pe(a,{agentId:r,...i?{sessionId:i}:{},framework:"openclaw"},{texts:e.assistantTexts,usage:e.usage?{tokensIn:e.usage.input,tokensOut:e.usage.output,cacheRead:e.usage.cacheRead,cacheWrite:e.usage.cacheWrite}:void 0,model:e.model||e.resolvedRef,final:!0})}catch{}}function ds(e,t){kn(O(e,t)),On(P(e,t))}export{Ae as a,te as b,Te as c,Da as d,Oe as e,qa as f,co as g,uo as h,I as i,We as j,$ as k,kn as l,En as m,_o as n,Mo as o,Bo as p,Yo as q,ts as r,os as s,ds as t};

package/dist/index.d.ts

@@ -6,26 +6,92 @@
  *   1. Environment variables: VISIQ_API_KEY / VISIQ_AGENT_ID / VISIQ_BASE_URL
  *   2. JSON config file at VISIQ_CONFIG_PATH
  *   3. ~/.openclaw/openclaw.json plugin config
+ *   3b. $OPENCLAW_CONFIG_PATH openclaw.json (the gateway's own config; Sigma)
  *   4. Interactive TTY prompt (only when stdout is a TTY)
  *
+ * The same chain also resolves the Surface E sequence-anomaly interlock's
+ * OPERATOR CONTROL (see SequenceAnomalySettings below):
+ *   kill switch  --sequence-anomaly <on|off> · VISIQ_SEQUENCE_ANOMALY=off ·
+ *                `sequenceAnomaly: false` / `{ "enabled": false }` in JSON
+ *   thresholds   --sequence-anomaly-{min-events,min-classes,sigma,
+ *                dominance-ratio,dominance-share,friction-ratio,
+ *                min-friction-events} · the matching VISIQ_SEQUENCE_ANOMALY_*
+ *                env vars · the same keys (camelCase or snake_case) inside the
+ *                JSON `sequenceAnomaly` object
+ * Both DEFAULT to the shipped posture (enabled, detector defaults).
+ *
  * Behavior on missing credentials:
  *   - Non-TTY context  -> log a structured warning to stderr and return null
  *   - TTY context      -> print a single-paragraph hint with the three setup
  *                         options and return null
  *
  * This function NEVER throws. The plugin must remain installable / loadable
- * even when unconfigured; but downstream enforcement hooks FAIL-CLOSED (BLOCK)
- * when this function returns null (reform Phase 3, owner decision #2) — a
- * security harness that cannot reach its policy engine must never silently let
- * tool calls through. loadConfig itself just returns null + warns; the block
- * happens in the hooks (see before-tool-call.ts).
+ * even when unconfigured. Downstream enforcement hooks route a null config by
+ * failMode (owner decision 2026-07-15, supersedes reform-Phase-3 "owner
+ * decision #2"): DEFAULT `open` → no-op with loud fail-open telemetry (an
+ * unconfigured harness must never disrupt the agent); `closed` → BLOCK until
+ * configured. loadConfig itself just returns null + warns; the routing happens
+ * in the hooks (see before-tool-call.ts).
  *
  * G004: never logs the resolved apiKey value, only its presence/absence.
  */
+/**
+ * What the plugin does when IT (not policy) fails — missing config, endpoint
+ * unreachable, no bundle, evaluator crash, redaction bookkeeping failure.
+ * `open` (DEFAULT, owner decision 2026-07-15): let the call/message proceed +
+ * loud fail-open telemetry — a VisIQ bug must never disrupt the agent.
+ * `closed`: strict blocking (opt-in via VISIQ_FAIL_MODE=closed, `--fail-mode
+ * closed`, or `failMode` in the plugin config).
+ */
+export type FailMode = "open" | "closed";
+export declare const DEFAULT_FAIL_MODE: FailMode;
+/**
+ * Normalize a raw failMode value. Only (case-insensitive) `open`/`closed`
+ * count; anything else → undefined so the default applies. A typo'd value must
+ * degrade to the DEFAULT, never invent strictness.
+ */
+export declare function normalizeFailMode(raw: unknown): FailMode | undefined;
+/**
+ * OPERATOR CONTROL for the sequence-anomaly DETECTION interlock (Surface E).
+ *
+ * The interlock reads the LIVE per-session fold, and that fold is MONOTONE — so
+ * once a session trips the hold it re-fires on EVERY subsequent call in that
+ * session. Without a switch, the only way to stop that is to disable enforcement
+ * entirely, which also drops real policy denies. So the interlock gets its own
+ * kill switch and its own threshold overrides, resolved through the SAME
+ * precedence chain as the credentials (CLI > env > VISIQ_CONFIG_PATH >
+ * $OPENCLAW_CONFIG_PATH > ~/.openclaw/openclaw.json).
+ *
+ * DEFAULT POSTURE IS UNCHANGED: `enabled` defaults to true and `thresholds` to
+ * empty (i.e. DEFAULT_SEQUENCE_ANOMALY_CONFIG), so an operator who sets nothing
+ * gets exactly the shipped behaviour. Per G001's agent-side rule the switch is
+ * fail-OPEN in the sense that an unparseable value degrades to the DEFAULT — a
+ * typo can never silently invent strictness, nor silently disable detection.
+ */
+export interface SequenceAnomalySettings {
+	/** Master kill switch. false ⇒ the interlock leg is skipped entirely. */
+	enabled: boolean;
+	/**
+	 * Threshold overrides MERGED over the detector's defaults. Structurally typed
+	 * (a plain numeric bag) so config.ts needs no value-import of the detector.
+	 */
+	thresholds: {
+		minEvents?: number;
+		minClasses?: number;
+		concentrationSigma?: number;
+		dominanceRatio?: number;
+		dominanceShare?: number;
+		frictionRatio?: number;
+		minFrictionEvents?: number;
+	};
+}
 export interface VisiqConfig {
 	apiKey: string;
 	agentId: string;
 	baseUrl?: string;
+	failMode: FailMode;
+	/** Surface E operator control (kill switch + threshold overrides). */
+	sequenceAnomaly: SequenceAnomalySettings;
 }
 /**
  * Resolve plugin credentials following the documented precedence chain.
@@ -35,12 +101,41 @@ export interface VisiqConfig {
  *   1. Environment variables: VISIQ_API_KEY / VISIQ_AGENT_ID / VISIQ_BASE_URL
  *   2. JSON config file at VISIQ_CONFIG_PATH
  *   3. ~/.openclaw/openclaw.json plugin config
+ *   3b. $OPENCLAW_CONFIG_PATH openclaw.json (the gateway's own config; Sigma)
  *   4. Interactive TTY prompt (only when stdout is a TTY)
  *
  * Returns `null` when credentials cannot be resolved. Downstream hooks
  * MUST treat null as "plugin unconfigured, no-op" and MUST NOT crash.
  */
 export declare function loadConfig(): Promise<VisiqConfig | null>;
+/** Credentials (null when unresolvable) + the failMode that applies either way. */
+export interface PluginState {
+	config: VisiqConfig | null;
+	failMode: FailMode;
+}
+/**
+ * Resolve credentials AND failMode in one pass. failMode must be resolvable
+ * even when credentials are absent (the unconfigured no-op/deny guard consults
+ * it), so it is surfaced separately from the nullable config. Never throws.
+ */
+export declare function loadPluginState(): Promise<PluginState>;
+export interface FailOpenReport {
+	/** Which guard failed open (e.g. `unconfigured`, `no-bundle`, `eval-error`). */
+	stage: string;
+	detail: string;
+	toolName?: string;
+	sessionId?: string;
+	/** When present, the event is also buffered to the runtime's audit telemetry. */
+	config?: VisiqConfig | null;
+}
+export declare function reportFailOpen(report: FailOpenReport): void;
+/**
+ * Return the bare tool name (the segment after the last `__`). Tools without a
+ * `__` separator are returned unchanged. Copied verbatim from the OpenClaw
+ * plugin's `retrieval-tools.ts` behavior so the two never drift (it now re-exports
+ * this one).
+ */
+export declare function bareToolName(toolName: string): string;
 /**
  * @visiq/redact — shared redaction primitives for VisIQ SDKs.
  *
@@ -203,20 +298,6 @@ export declare function getLedger(sessionId: string): RedactionLedger;
  * long-running OpenClaw daemon does not accumulate ledgers indefinitely.
  */
 export declare function clearLedger(sessionId: string): void;
-/**
- * Classifier for "retrieval" tools — the tool names where ALLOW + RECALL
- * must run before the tool executes.
- *
- * OpenClaw exposes some tools under bare names (`web_fetch`) and some under
- * namespaced names (`mcp__brave__web_search`, `serverName__toolName`). For
- * classification we look at the trailing segment after the last `__` and
- * compare against a set of bare names so both forms route consistently.
- */
-/**
- * Return the bare tool name (the segment after the last `__`). Tools without
- * a `__` separator are returned unchanged.
- */
-export declare function bareToolName(toolName: string): string;
 /**
  * True if the tool participates in retrieval semantics and therefore must be
  * routed through ALLOW + RECALL evaluation in `before_tool_call`.

package/dist/index.js

@@ -1 +1 @@
-import{a as w,c as g,d as _,e as d,f as k,g as f,h as e,i as t,j as h,k as i,l as s,m as l,n as a,o as u,p}from"./chunk-PS2DVYPN.js";var c=new Set(["place_hold","block_card","wire_transfer","create_case","send_notification","bank_account_lookup_tool","exec","write_file","http_post","http_put","http_delete"]),N=new Set(["sessions_list","sessions_history","sessions_send","sessions_get","sessions_create","sessions_delete","memory_search","memory_read","memory_write"]),T=["sessions_","memory_"];function I(o){let r=e(o);return N.has(r)?!0:T.some(m=>r.startsWith(m))}function x(o){return!(t(o)||I(o))}function R(o){return c.has(e(o))}function O(){return c}var n="@visiq/openclaw-plugin";function b(){return{id:n,name:"VisIQ OpenClaw Plugin",version:"0.1.7",hooks:[{pluginId:n,hookName:"before_tool_call",handler:i,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"tool_result_persist",handler:s,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"before_message_write",handler:l,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"llm_input",handler:a,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"llm_output",handler:u,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"session_end",handler:p,source:"visiq-openclaw-plugin"}]}}var S=b;export{d as RedactionLedger,_ as awaitRuntimesReady,e as bareToolName,f as clearLedger,b as createPlugin,S as default,O as getActionToolNames,k as getLedger,h as getRetrievalToolNames,x as isActionTool,R as isKnownActionTool,t as isRetrievalTool,w as loadConfig,g as shutdownRuntimes};
+import{a as o,b as g,c as w,d as _,e as d,g as f,h as k,i as h,j as N,k as T,l as I,m as t,n as O,o as i,p as s,q as l,r as a,s as u,t as p}from"./chunk-INF55VX4.js";var c=new Set(["place_hold","block_card","wire_transfer","create_case","send_notification","bank_account_lookup_tool","exec","write_file","http_post","http_put","http_delete"]),x=new Set(["sessions_list","sessions_history","sessions_send","sessions_get","sessions_create","sessions_delete","memory_search","memory_read","memory_write"]),R=["sessions_","memory_"];function y(e){let r=o(e);return x.has(r)?!0:R.some(m=>r.startsWith(m))}function A(e){return!(t(e)||y(e))}function b(e){return c.has(o(e))}function v(){return c}var n="@visiq/openclaw-plugin";function L(){return{id:n,name:"VisIQ OpenClaw Plugin",version:"0.1.8",hooks:[{pluginId:n,hookName:"before_tool_call",handler:i,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"tool_result_persist",handler:s,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"before_message_write",handler:l,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"llm_input",handler:a,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"llm_output",handler:u,source:"visiq-openclaw-plugin"},{pluginId:n,hookName:"session_end",handler:p,source:"visiq-openclaw-plugin"}]}}var D=L;export{g as DEFAULT_FAIL_MODE,N as RedactionLedger,k as awaitRuntimesReady,o as bareToolName,I as clearLedger,L as createPlugin,D as default,v as getActionToolNames,T as getLedger,O as getRetrievalToolNames,A as isActionTool,b as isKnownActionTool,t as isRetrievalTool,_ as loadConfig,d as loadPluginState,w as normalizeFailMode,h as reportFailOpen,f as shutdownRuntimes};

package/dist/openclaw-entry.js

@@ -1,5 +1,5 @@
-import{b as w,k as b,l as S,m as k,n as L,o as v,p as O}from"./chunk-PS2DVYPN.js";import{Type as e}from"typebox";import{definePluginEntry as D}from"openclaw/plugin-sdk/plugin-entry";import{readFileSync as x,readdirSync as A,statSync as C,existsSync as R}from"node:fs";import{join as p,dirname as $}from"node:path";import{fileURLToPath as P}from"node:url";var U="@visiq/openclaw-plugin",h=process.env.BANK_API_URL??"http://localhost:4000/api",I=$(P(import.meta.url));function c(n,i={}){return{content:[{type:"text",text:n}],details:i}}async function m(n){let i=await fetch(`${h}${n}`);return i.ok?await i.text():`[Error ${i.status}]`}async function d(n,i){let t=await fetch(`${h}${n}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});return t.ok?await t.text():`[Error ${t.status}]`}function j(){let n=[p(I,"..","..","..","examples","langchain-agent","docs"),p(I,"..","..","examples","langchain-agent","docs"),process.env.VISIQ_KNOWLEDGE_DIR??""].filter(i=>i.length>0);for(let i of n)if(R(i))return i;return null}function N(){let n=j();if(!n)return[];let i=[];function t(o){for(let s of A(o)){let r=p(o,s);if(C(r).isDirectory())t(r);else if(s.endsWith(".txt")){let l=x(r,"utf-8").match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);if(l){let a={};for(let _ of l[1].split(`
-`)){let[g,...y]=_.split(":");g&&y.length&&(a[g.trim()]=y.join(":").trim())}i.push({path:r,title:a.title?.replace(/"/g,"")??s,classification:a.classification??"public",source:a.source??"unknown",content:l[2].trim()})}}}}return t(n),i}var f=null;function B(){return f===null&&(f=N()),f}function T(n,i=5){let t=B(),o=n.toLowerCase().split(/\s+/).filter(r=>r.length>=3);return t.map(r=>{let u=`${r.title} ${r.content}`.toLowerCase(),l=0;for(let a of o)u.includes(a)&&(l+=a.length,r.title.toLowerCase().includes(a)&&(l+=a.length*2));return{doc:r,score:l}}).filter(r=>r.score>0).sort((r,u)=>u.score-r.score).slice(0,i).map(r=>r.doc)}function K(n){w(),n.on("before_tool_call",b,{priority:50}),n.on("tool_result_persist",S),n.on("before_message_write",k),n.on("llm_input",L),n.on("llm_output",v),n.on("session_end",O),n.registerTool({name:"get_account",label:"Get account",description:"Get account holder profile from core banking system. Input: account ID (e.g. '4821-7734'). Returns: holder name, balance, risk score, KYC status, linked cards, address.",parameters:e.Object({account_id:e.String({description:"Account ID (e.g. '4821-7734')."})}),async execute(i,t){return c(await m(`/accounts/${t.account_id}`))}}),n.registerTool({name:"get_devices",label:"Get devices",description:"Get device fingerprints and login sessions from BioCatch. Input: account ID. Returns: registered devices, recent sessions with IP/geolocation, anomaly alerts.",parameters:e.Object({account_id:e.String({description:"Account ID to fetch devices for."})}),async execute(i,t){return c(await m(`/accounts/${t.account_id}/devices`))}}),n.registerTool({name:"get_transactions",label:"Get transactions",description:"Get recent transactions from the card processor with filtering. Returns: transaction list with amounts, merchants, locations, and risk flags.",parameters:e.Object({account_id:e.String({description:"Account ID (e.g. '4821-7734')."}),lookback_hours:e.Optional(e.Integer({minimum:1,maximum:720,description:"How far back to look (1\u2013720h, default 72)."})),min_amount:e.Optional(e.Number({minimum:0,description:"Filter out transactions below this dollar amount."}))}),async execute(i,t){let o=new URLSearchParams;t.lookback_hours!==void 0&&o.set("lookback_hours",String(t.lookback_hours)),t.min_amount!==void 0&&o.set("min_amount",String(t.min_amount));let s=o.toString()?`?${o.toString()}`:"";return c(await m(`/accounts/${t.account_id}/transactions${s}`))}}),n.registerTool({name:"check_watchlist",label:"Check watchlist",description:"Screen a name or entity against OFAC SDN, EU, and UN sanctions lists. Returns: match scores and recommendation.",parameters:e.Object({name:e.String({description:"Name or entity to screen."}),country_code:e.Optional(e.String({description:"ISO 3166-1 alpha-2 country code to scope the screening (e.g. 'US')."}))}),async execute(i,t){return c(await d("/watchlists/check",{name:t.name,country_code:t.country_code}))}}),n.registerTool({name:"search_knowledge",label:"Search knowledge base",description:"Search the bank's internal knowledge base for compliance policies, prior fraud case files, triage procedures, and customer information. Input is a free-text search query.",parameters:e.Object({query:e.String({description:"Free-text knowledge base search query."})}),async execute(i,t){let o=T(t.query,5);if(o.length===0)return c("No matching knowledge base documents found.",{hitCount:0});let s=o.map(r=>`--- ${r.title} (classification=${r.classification}, source=${r.source}) ---
-${r.content}`).join(`
+import{f as w,o as b,p as S,q as k,r as L,s as v,t as O}from"./chunk-INF55VX4.js";import{Type as e}from"typebox";import{emptyPluginConfigSchema as D}from"openclaw/plugin-sdk/core";import{readFileSync as x,readdirSync as A,statSync as C,existsSync as R}from"node:fs";import{join as p,dirname as $}from"node:path";import{fileURLToPath as P}from"node:url";var U="@visiq/openclaw-plugin",h=process.env.BANK_API_URL??"http://localhost:4000/api",I=$(P(import.meta.url));function c(n,i={}){return{content:[{type:"text",text:n}],details:i}}async function m(n){let i=await fetch(`${h}${n}`);return i.ok?await i.text():`[Error ${i.status}]`}async function d(n,i){let t=await fetch(`${h}${n}`,{method:"POST",headers:{"Content-Type":"application/json"},body:JSON.stringify(i)});return t.ok?await t.text():`[Error ${t.status}]`}function j(){let n=[p(I,"..","..","..","examples","langchain-agent","docs"),p(I,"..","..","examples","langchain-agent","docs"),process.env.VISIQ_KNOWLEDGE_DIR??""].filter(i=>i.length>0);for(let i of n)if(R(i))return i;return null}function N(){let n=j();if(!n)return[];let i=[];function t(r){for(let s of A(r)){let o=p(r,s);if(C(o).isDirectory())t(o);else if(s.endsWith(".txt")){let l=x(o,"utf-8").match(/^---\n([\s\S]*?)\n---\n([\s\S]*)$/);if(l){let a={};for(let _ of l[1].split(`
+`)){let[g,...y]=_.split(":");g&&y.length&&(a[g.trim()]=y.join(":").trim())}i.push({path:o,title:a.title?.replace(/"/g,"")??s,classification:a.classification??"public",source:a.source??"unknown",content:l[2].trim()})}}}}return t(n),i}var f=null;function B(){return f===null&&(f=N()),f}function T(n,i=5){let t=B(),r=n.toLowerCase().split(/\s+/).filter(o=>o.length>=3);return t.map(o=>{let u=`${o.title} ${o.content}`.toLowerCase(),l=0;for(let a of r)u.includes(a)&&(l+=a.length,o.title.toLowerCase().includes(a)&&(l+=a.length*2));return{doc:o,score:l}}).filter(o=>o.score>0).sort((o,u)=>u.score-o.score).slice(0,i).map(o=>o.doc)}function K(n){w(),n.on("before_tool_call",b,{priority:50}),n.on("tool_result_persist",S),n.on("before_message_write",k),n.on("llm_input",L),n.on("llm_output",v),n.on("session_end",O),n.registerTool({name:"get_account",label:"Get account",description:"Get account holder profile from core banking system. Input: account ID (e.g. '4821-7734'). Returns: holder name, balance, risk score, KYC status, linked cards, address.",parameters:e.Object({account_id:e.String({description:"Account ID (e.g. '4821-7734')."})}),async execute(i,t){return c(await m(`/accounts/${t.account_id}`))}}),n.registerTool({name:"get_devices",label:"Get devices",description:"Get device fingerprints and login sessions from BioCatch. Input: account ID. Returns: registered devices, recent sessions with IP/geolocation, anomaly alerts.",parameters:e.Object({account_id:e.String({description:"Account ID to fetch devices for."})}),async execute(i,t){return c(await m(`/accounts/${t.account_id}/devices`))}}),n.registerTool({name:"get_transactions",label:"Get transactions",description:"Get recent transactions from the card processor with filtering. Returns: transaction list with amounts, merchants, locations, and risk flags.",parameters:e.Object({account_id:e.String({description:"Account ID (e.g. '4821-7734')."}),lookback_hours:e.Optional(e.Integer({minimum:1,maximum:720,description:"How far back to look (1\u2013720h, default 72)."})),min_amount:e.Optional(e.Number({minimum:0,description:"Filter out transactions below this dollar amount."}))}),async execute(i,t){let r=new URLSearchParams;t.lookback_hours!==void 0&&r.set("lookback_hours",String(t.lookback_hours)),t.min_amount!==void 0&&r.set("min_amount",String(t.min_amount));let s=r.toString()?`?${r.toString()}`:"";return c(await m(`/accounts/${t.account_id}/transactions${s}`))}}),n.registerTool({name:"check_watchlist",label:"Check watchlist",description:"Screen a name or entity against OFAC SDN, EU, and UN sanctions lists. Returns: match scores and recommendation.",parameters:e.Object({name:e.String({description:"Name or entity to screen."}),country_code:e.Optional(e.String({description:"ISO 3166-1 alpha-2 country code to scope the screening (e.g. 'US')."}))}),async execute(i,t){return c(await d("/watchlists/check",{name:t.name,country_code:t.country_code}))}}),n.registerTool({name:"search_knowledge",label:"Search knowledge base",description:"Search the bank's internal knowledge base for compliance policies, prior fraud case files, triage procedures, and customer information. Input is a free-text search query.",parameters:e.Object({query:e.String({description:"Free-text knowledge base search query."})}),async execute(i,t){let r=T(t.query,5);if(r.length===0)return c("No matching knowledge base documents found.",{hitCount:0});let s=r.map(o=>`--- ${o.title} (classification=${o.classification}, source=${o.source}) ---
+${o.content}`).join(`
 
-`);return c(s,{hitCount:o.length,classifications:o.map(r=>r.classification)})}}),n.registerTool({name:"place_hold",label:"Place hold",description:"Place a temporary fraud hold on an account. Blocks outbound transactions while allowing inbound credits.",parameters:e.Object({account_id:e.String({description:"Account to place the hold on."}),amount:e.Number({minimum:0,description:"Dollar amount to hold (0 = full account freeze)."}),currency:e.Union([e.Literal("USD"),e.Literal("EUR"),e.Literal("GBP"),e.Literal("CAD")],{description:"ISO currency code for the hold amount."}),duration_hours:e.Integer({minimum:1,maximum:168,description:"How long the hold stays (1\u2013168h)."}),reason:e.Union([e.Literal("fraud_investigation"),e.Literal("suspicious_pattern"),e.Literal("sanctions_review"),e.Literal("manual_review")],{description:"Reason classification for the hold."}),notify_holder:e.String({description:"Whether to notify the holder. Accepts: yes, no, true, false, 1, 0."})}),async execute(i,t){let{account_id:o,...s}=t;return c(await d(`/accounts/${o}/hold`,s))}}),n.registerTool({name:"block_card",label:"Block card",description:"Block a debit or credit card immediately. A replacement card will be mailed.",parameters:e.Object({account_id:e.String({description:"Account ID owning the card."}),reason:e.Union([e.Literal("fraud_investigation"),e.Literal("lost"),e.Literal("stolen"),e.Literal("compromised_pin"),e.Literal("customer_request")],{description:"Reason for blocking \u2014 drives the customer notification."}),notify_holder:e.Optional(e.String({description:"Whether to notify the holder. Accepts: yes, no, true, false."}))}),async execute(i,t){return c(await d(`/accounts/${t.account_id}/card/block`,{reason:t.reason,notify_holder:t.notify_holder}))}}),n.registerTool({name:"wire_transfer",label:"Wire transfer",description:"Initiate an outbound wire transfer from an account. HIGH RISK \u2014 large or sanctioned-destination wires are blocked or escalated by VisIQ ALLOW policy.",parameters:e.Object({account_id:e.String({description:"Source account ID."}),amount:e.Number({minimum:0,description:"Dollar amount to wire."}),currency:e.Union([e.Literal("USD"),e.Literal("EUR"),e.Literal("GBP"),e.Literal("CAD")],{description:"ISO currency code."}),destination:e.String({description:"Destination account / IBAN / beneficiary identifier."}),destination_country:e.Optional(e.String({description:"ISO 3166-1 alpha-2 destination country (e.g. 'US')."})),memo:e.Optional(e.String({description:"Free-text wire memo."}))}),async execute(i,t){let{account_id:o,...s}=t;return c(await d(`/accounts/${o}/wire`,s))}}),n.registerTool({name:"create_case",label:"Create case",description:"Create a fraud investigation case. Routes to the right queue based on severity / category.",parameters:e.Object({account_id:e.String({description:"Affected account ID."}),severity:e.Union([e.Literal("low"),e.Literal("medium"),e.Literal("high"),e.Literal("critical")],{description:"Case severity \u2014 drives SLA and routing."}),category:e.Union([e.Literal("account_takeover"),e.Literal("card_fraud"),e.Literal("wire_fraud"),e.Literal("synthetic_identity"),e.Literal("sanctions_hit"),e.Literal("structuring")],{description:"Fraud category \u2014 routes to specialist queue."}),summary:e.String({description:"Free-text case summary for the analyst."}),assignee:e.Optional(e.String({description:"Specialist email to assign directly."})),sla_hours:e.Optional(e.Integer({minimum:1,maximum:168,description:"Override the default SLA (1\u2013168h)."}))}),async execute(i,t){return c(await d("/cases",t))}}),n.registerTool({name:"send_notification",label:"Send notification",description:"Send a fraud alert notification to the customer. Channel + priority drive delivery latency.",parameters:e.Object({account_id:e.String({description:"Account ID \u2014 used to look up contact methods."}),channel:e.Union([e.Literal("sms"),e.Literal("email"),e.Literal("push"),e.Literal("voice"),e.Literal("in_app")],{description:"Delivery channel."}),priority:e.Union([e.Literal("low"),e.Literal("normal"),e.Literal("high"),e.Literal("critical")],{description:"Delivery priority \u2014 critical bypasses customer quiet hours."}),subject:e.String({maxLength:120,description:"Short subject line (used for email / push title)."}),message:e.String({description:"Body text of the notification."}),locale:e.Optional(e.String({description:"BCP-47 locale (e.g. 'en-US', 'es-MX')."}))}),async execute(i,t){return c(await d("/notifications/send",t))}}),n.registerTool({name:"bank_account_lookup_tool",label:"Bank account lookup (sensitive)",description:"Look up sensitive account data for fraud investigation. account_id is the account number (e.g. '4821-7734'). include_ssn controls whether PII fields (SSN, DOB, full legal name) come back \u2014 accepts 'yes' / 'no' / 'true' / 'false' / '1' / '0'.",parameters:e.Object({account_id:e.String({description:"Account number to look up (e.g. 4821-7734)."}),include_ssn:e.String({description:"Whether to include PII fields (SSN, DOB, full legal name). Accepts: yes, no, true, false, 1, 0."})}),async execute(i,t){let s=new Set(["yes","y","true","1"]).has(String(t.include_ssn).toLowerCase().trim()),r=await fetch(`${h}/accounts/${t.account_id}`);if(!r.ok)return c(JSON.stringify({error:`Account ${t.account_id} not found`}),{status:r.status});let u=await r.json();if(!s){let{ssn:l,dob:a,full_legal_name:_,...g}=u;return c(JSON.stringify({account:g,pii_included:!1}),{pii_included:!1})}return c(JSON.stringify({account:u,pii_included:!0}),{pii_included:!0})}})}var Y=D({id:U,name:"VisIQ OpenClaw Plugin",description:"Routes tool calls and LLM I/O through VisIQ ALLOW + RECALL + RECORD",register:K});export{Y as default};
+`);return c(s,{hitCount:r.length,classifications:r.map(o=>o.classification)})}}),n.registerTool({name:"place_hold",label:"Place hold",description:"Place a temporary fraud hold on an account. Blocks outbound transactions while allowing inbound credits.",parameters:e.Object({account_id:e.String({description:"Account to place the hold on."}),amount:e.Number({minimum:0,description:"Dollar amount to hold (0 = full account freeze)."}),currency:e.Union([e.Literal("USD"),e.Literal("EUR"),e.Literal("GBP"),e.Literal("CAD")],{description:"ISO currency code for the hold amount."}),duration_hours:e.Integer({minimum:1,maximum:168,description:"How long the hold stays (1\u2013168h)."}),reason:e.Union([e.Literal("fraud_investigation"),e.Literal("suspicious_pattern"),e.Literal("sanctions_review"),e.Literal("manual_review")],{description:"Reason classification for the hold."}),notify_holder:e.String({description:"Whether to notify the holder. Accepts: yes, no, true, false, 1, 0."})}),async execute(i,t){let{account_id:r,...s}=t;return c(await d(`/accounts/${r}/hold`,s))}}),n.registerTool({name:"block_card",label:"Block card",description:"Block a debit or credit card immediately. A replacement card will be mailed.",parameters:e.Object({account_id:e.String({description:"Account ID owning the card."}),reason:e.Union([e.Literal("fraud_investigation"),e.Literal("lost"),e.Literal("stolen"),e.Literal("compromised_pin"),e.Literal("customer_request")],{description:"Reason for blocking \u2014 drives the customer notification."}),notify_holder:e.Optional(e.String({description:"Whether to notify the holder. Accepts: yes, no, true, false."}))}),async execute(i,t){return c(await d(`/accounts/${t.account_id}/card/block`,{reason:t.reason,notify_holder:t.notify_holder}))}}),n.registerTool({name:"wire_transfer",label:"Wire transfer",description:"Initiate an outbound wire transfer from an account. HIGH RISK \u2014 large or sanctioned-destination wires are blocked or escalated by VisIQ ALLOW policy.",parameters:e.Object({account_id:e.String({description:"Source account ID."}),amount:e.Number({minimum:0,description:"Dollar amount to wire."}),currency:e.Union([e.Literal("USD"),e.Literal("EUR"),e.Literal("GBP"),e.Literal("CAD")],{description:"ISO currency code."}),destination:e.String({description:"Destination account / IBAN / beneficiary identifier."}),destination_country:e.Optional(e.String({description:"ISO 3166-1 alpha-2 destination country (e.g. 'US')."})),memo:e.Optional(e.String({description:"Free-text wire memo."}))}),async execute(i,t){let{account_id:r,...s}=t;return c(await d(`/accounts/${r}/wire`,s))}}),n.registerTool({name:"create_case",label:"Create case",description:"Create a fraud investigation case. Routes to the right queue based on severity / category.",parameters:e.Object({account_id:e.String({description:"Affected account ID."}),severity:e.Union([e.Literal("low"),e.Literal("medium"),e.Literal("high"),e.Literal("critical")],{description:"Case severity \u2014 drives SLA and routing."}),category:e.Union([e.Literal("account_takeover"),e.Literal("card_fraud"),e.Literal("wire_fraud"),e.Literal("synthetic_identity"),e.Literal("sanctions_hit"),e.Literal("structuring")],{description:"Fraud category \u2014 routes to specialist queue."}),summary:e.String({description:"Free-text case summary for the analyst."}),assignee:e.Optional(e.String({description:"Specialist email to assign directly."})),sla_hours:e.Optional(e.Integer({minimum:1,maximum:168,description:"Override the default SLA (1\u2013168h)."}))}),async execute(i,t){return c(await d("/cases",t))}}),n.registerTool({name:"send_notification",label:"Send notification",description:"Send a fraud alert notification to the customer. Channel + priority drive delivery latency.",parameters:e.Object({account_id:e.String({description:"Account ID \u2014 used to look up contact methods."}),channel:e.Union([e.Literal("sms"),e.Literal("email"),e.Literal("push"),e.Literal("voice"),e.Literal("in_app")],{description:"Delivery channel."}),priority:e.Union([e.Literal("low"),e.Literal("normal"),e.Literal("high"),e.Literal("critical")],{description:"Delivery priority \u2014 critical bypasses customer quiet hours."}),subject:e.String({maxLength:120,description:"Short subject line (used for email / push title)."}),message:e.String({description:"Body text of the notification."}),locale:e.Optional(e.String({description:"BCP-47 locale (e.g. 'en-US', 'es-MX')."}))}),async execute(i,t){return c(await d("/notifications/send",t))}}),n.registerTool({name:"bank_account_lookup_tool",label:"Bank account lookup (sensitive)",description:"Look up sensitive account data for fraud investigation. account_id is the account number (e.g. '4821-7734'). include_ssn controls whether PII fields (SSN, DOB, full legal name) come back \u2014 accepts 'yes' / 'no' / 'true' / 'false' / '1' / '0'.",parameters:e.Object({account_id:e.String({description:"Account number to look up (e.g. 4821-7734)."}),include_ssn:e.String({description:"Whether to include PII fields (SSN, DOB, full legal name). Accepts: yes, no, true, false, 1, 0."})}),async execute(i,t){let s=new Set(["yes","y","true","1"]).has(String(t.include_ssn).toLowerCase().trim()),o=await fetch(`${h}/accounts/${t.account_id}`);if(!o.ok)return c(JSON.stringify({error:`Account ${t.account_id} not found`}),{status:o.status});let u=await o.json();if(!s){let{ssn:l,dob:a,full_legal_name:_,...g}=u;return c(JSON.stringify({account:g,pii_included:!1}),{pii_included:!1})}return c(JSON.stringify({account:u,pii_included:!0}),{pii_included:!0})}})}var G={id:U,name:"VisIQ OpenClaw Plugin",description:"Routes tool calls and LLM I/O through VisIQ ALLOW + RECALL + RECORD",configSchema:D(),register:K},Z=G;export{Z as default};

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "@visiq/openclaw-plugin",
   "name": "VisIQ OpenClaw Plugin",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "Routes tool calls and LLM I/O through VisIQ ALLOW+RECALL+RECORD",
   "main": "dist/index.js",
   "activation": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@visiq/openclaw-plugin",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "OpenClaw plugin for VisIQ ALLOW + RECALL + RECORD",
   "type": "module",
   "main": "./dist/index.js",
@@ -10,8 +10,8 @@
       "./dist/openclaw-entry.js"
     ],
     "compat": {
-      "pluginApi": ">=2026.5.18",
-      "minGatewayVersion": "2026.5.18"
+      "pluginApi": ">=2026.3.13",
+      "minGatewayVersion": "2026.3.13"
     },
     "build": {
       "openclawVersion": "2026.5.18",
@@ -35,7 +35,7 @@
   "peerDependencies": {
     "@langchain/core": ">=0.3.0",
     "llamaindex": ">=0.11.0",
-    "openclaw": ">=2026.5.18"
+    "openclaw": ">=2026.3.13 || >=2026.7.1-0"
   },
   "peerDependenciesMeta": {
     "@langchain/core": {

package/dist/chunk-PS2DVYPN.js

@@ -1,8 +0,0 @@
-import{readFile as Ue}from"node:fs/promises";import{homedir as W}from"node:os";import{join as G,isAbsolute as Ve,resolve as Ke}from"node:path";import{createInterface as ze}from"node:readline";import{parseArgs as We}from"node:util";var H="@visiq/openclaw-plugin",Ge='[VisIQ] OpenClaw plugin is installed but missing credentials. Provide them with one of (highest precedence first): (1) environment variables VISIQ_API_KEY=<key> VISIQ_AGENT_ID=<id> (set before `openclaw gateway run` / `openclaw start`) ; (2) a JSON file at the path in VISIQ_CONFIG_PATH ; (3) ~/.openclaw/openclaw.json -> plugins.entries["@visiq/openclaw-plugin"].config = { "apiKey": "<key>", "agentId": "<id>" } . Until credentials are provided the plugin loads but every tool call is BLOCKED (fail-closed, G001) \u2014 configure it to govern.';function He(e){return e==="~"||e.startsWith("~/")?G(W(),e.slice(1).replace(/^\//,"")):e}async function Q(e){try{let t=Ve(e)?e:Ke(e),n=await Ue(t,"utf-8");return JSON.parse(n)}catch{return null}}function D(e,...t){for(let n of t){let r=e[n];if(typeof r=="string")return r}}function F(e){if(!e||typeof e!="object")return{};let t=e,n=D(t,"apiKey","api_key"),r=D(t,"agentId","agent_id"),i=D(t,"baseUrl","base_url"),a={};return n&&(a.apiKey=n),r&&(a.agentId=r),i&&(a.baseUrl=i),a}async function Qe(e){if(!e)return{};let t=He(e),n=await Q(t);if(!n||typeof n!="object")return{};let r=n,i=r.plugins?.entries,a=i&&typeof i=="object"?i[H]:void 0;return a&&typeof a=="object"&&a.config?F(a.config):F(r)}async function Ye(){let e=G(W(),".openclaw","openclaw.json"),t=await Q(e);if(!t||typeof t!="object")return{};let a=t.plugins?.entries?.[H];return!a||typeof a!="object"?{}:F(a.config)}async function Ze(e){if(!process.stdout.isTTY)return{};let t=ze({input:process.stdin,output:process.stdout}),n=r=>new Promise(i=>t.question(r,a=>i(a)));try{let r={...e};if(!r.apiKey){let i=(await n("VisIQ API key: ")).trim();i&&(r.apiKey=i)}if(!r.agentId){let i=(await n("VisIQ agent ID: ")).trim();i&&(r.agentId=i)}if(!r.baseUrl){let i=(await n("VisIQ base URL (optional, press Enter for default): ")).trim();i&&(r.baseUrl=i)}return r}finally{t.close()}}function Je(){try{let{values:e}=We({args:process.argv.slice(2),options:{"api-key":{type:"string"},"agent-id":{type:"string"},"base-url":{type:"string"}},strict:!1,allowPositionals:!0}),t={},n=e["api-key"],r=e["agent-id"],i=e["base-url"];return typeof n=="string"&&n&&(t.apiKey=n),typeof r=="string"&&r&&(t.agentId=r),typeof i=="string"&&i&&(t.baseUrl=i),t}catch{return{}}}async function Y(){let e=Je(),t={};process.env.VISIQ_API_KEY&&(t.apiKey=process.env.VISIQ_API_KEY),process.env.VISIQ_AGENT_ID&&(t.agentId=process.env.VISIQ_AGENT_ID),process.env.VISIQ_BASE_URL?t.baseUrl=process.env.VISIQ_BASE_URL:process.env.VISIQ_ENDPOINT&&(t.baseUrl=process.env.VISIQ_ENDPOINT);let n=await Qe(process.env.VISIQ_CONFIG_PATH),i={...await Ye(),...n,...t,...e};if((!i.apiKey||!i.agentId)&&process.stdout.isTTY&&process.stdin.isTTY&&(i=await Ze(i)),!i.apiKey||!i.agentId)return process.stderr.write(`${Ge}
-`),null;let a={apiKey:i.apiKey,agentId:i.agentId};return i.baseUrl&&(a.baseUrl=i.baseUrl),a}var M=null,Z={ready:!1,config:null};function y(){return M||(M=Y().catch(e=>(process.stderr.write(`[VisIQ] Config resolution failed (treating as unconfigured): ${e instanceof Error?e.message:String(e)}
-`),null)).then(e=>(Z={ready:!0,config:e},e))),M}function E(){return Z}function xn(){y()}import{z as o}from"zod";import*as h from"node:os";var J="X-VisIQ-SDK",X="X-VisIQ-Dialect",ee="unknown";function B(e,t=1){return{[J]:e&&e.length>0?e:ee,[X]:String(t)}}var te="interceptor_source",Xe=o.enum(["enforce","audit","off"]),et=o.enum(["closed","open"]),ne=o.enum(["enforce","monitor","off"]),tt=o.object({apiKey:o.string().min(1,"apiKey is required"),agentId:o.string().min(1,"agentId is required"),endpoint:o.string().url().optional(),mode:Xe.optional(),timeoutMs:o.number().int().positive().optional(),hitlTimeoutMs:o.number().int().positive().optional(),failBehavior:et.optional()}),Ln=o.object({agent_id:o.string().min(1),target_app:o.string().min(1),action:o.string().min(1),context:o.record(o.unknown()).optional(),session_id:o.string().min(1).max(255).optional(),telemetry:o.record(o.unknown()).optional()}),nt=o.object({field:o.string().optional(),pattern:o.string().optional(),replacement:o.string().optional(),mode:o.enum(["full","partial","email"]).optional(),keepFirst:o.number().optional(),keepLast:o.number().optional(),maskChar:o.string().optional()}),rt=o.object({decision_id:o.string().min(1),decision:o.enum(["permit","deny","approval_required","mask"]),reason:o.string().optional(),rule_code:o.string().nullable().optional(),enforced:o.boolean().optional(),agent_mode:ne.optional(),arg_redaction_rules:o.array(nt).optional(),plane:o.string().nullable().optional(),operation:o.string().nullable().optional(),is_retrieval:o.boolean().optional(),metadata:o.record(o.unknown()).optional()}),it=o.object({field:o.string().min(1),operator:o.enum(["equals","in","not_equals","not_in","glob","gt","lt","gte","lte","contains","not_contains"]),value:o.union([o.string(),o.number(),o.array(o.string())])}),at=o.object({id:o.string().min(1),rule_code:o.string().default(""),name:o.string().min(1),description:o.string().nullable().default(null),effect:o.enum(["allow","deny","hitl","mask"]),resource_type:o.string().min(1),rego_source:o.string().default(""),target_app:o.string().nullable().default(null),action_pattern:o.string().nullable().default(null),conditions:o.array(it).default([]),priority:o.number().int().default(0)}),ot=o.object({version:o.string().min(1),agent_mode:ne.optional(),rules:o.array(at),no_coverage:o.object({no_coverage_defaults:o.record(o.string()),autopilot_enabled:o.boolean(),enduser_hitl_enabled:o.boolean(),hitl_timeout_seconds:o.number()}).optional()}),st=2e3,re=class{config;originalFetch;constructor(e,t){this.config=e,this.originalFetch=t}versionHeaders(){return B(this.config.sdkVersion,this.config.sdkDialect)}async evaluate(e){let t=new AbortController,n=setTimeout(()=>t.abort(),this.config.timeoutMs),r;try{r=await this.originalFetch(`${this.config.endpoint}/allow/evaluate`,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify(e),signal:t.signal})}finally{clearTimeout(n)}if(!r.ok)throw new Error(`ALLOW evaluate request failed: HTTP ${r.status} ${r.statusText}`);let i=await r.json();return rt.parse(i)}async fetchBundle(){let e=this.config.agentId?`?agent_id=${encodeURIComponent(this.config.agentId)}`:"",t=`${this.config.endpoint}/allow/rules/bundle${e}`,n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(t,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,Accept:"application/json",...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW rules/bundle fetch failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json();return ot.parse(a)}async sendTelemetry(e){if(e.length===0)return;let t=`${this.config.endpoint}/allow/telemetry`,n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decisions:e})});if(!n.ok)throw new Error(`ALLOW telemetry delivery failed: HTTP ${n.status} ${n.statusText}`)}async sendCognition(e,t){if(t.length===0)return;let n=`${this.config.endpoint}/allow/cognition`,r=await this.originalFetch(n,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({...e?{session:e}:{},beats:t})});if(!r.ok)throw new Error(`ALLOW cognition delivery failed: HTTP ${r.status} ${r.statusText}`)}async reportExecutionResult(e,t,n){let r=`${this.config.endpoint}/allow/execution-events`;try{let i=await this.originalFetch(r,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({decision_id:e,result:t,details:n})});i.ok||console.warn(`[ALLOW] Execution result report failed: HTTP ${i.status}`)}catch(i){console.warn("[ALLOW] Execution result report failed:",i)}}async registerEnvironment(e){if(!this.config.agentId)return;let t=`${this.config.endpoint}/allow/agents/register`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,os:e.os,hostname:e.hostname,ip:e.ip,username:e.username,...this.config.harnessKind?{kind:this.config.harnessKind}:{},...e.agent_type?{agent_type:e.agent_type}:{}})});n.ok||console.warn(`[ALLOW] Agent registration failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Agent registration failed:",n)}}async reportToolSurface(e){if(!this.config.agentId||e.length===0)return;let t=`${this.config.endpoint}/allow/agents/tools`;try{let n=await this.originalFetch(t,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},body:JSON.stringify({agent_id:this.config.agentId,tools:e})});n.ok||console.warn(`[ALLOW] Tool-surface report failed: HTTP ${n.status} ${n.statusText}`)}catch(n){console.warn("[ALLOW] Tool-surface report failed:",n)}}async waitForApproval(e){if(!e)throw new Error("waitForApproval: decisionId must be a non-empty string");let t=Date.now()+this.config.hitlTimeoutMs;for(;Date.now()<t;){let n=new AbortController,r=setTimeout(()=>n.abort(),this.config.timeoutMs),i;try{i=await this.originalFetch(`${this.config.endpoint}/v1/allow/decisions/${encodeURIComponent(e)}`,{method:"GET",headers:{Authorization:`Bearer ${this.config.apiKey}`,...this.versionHeaders()},signal:n.signal})}finally{clearTimeout(r)}if(!i.ok)throw new Error(`ALLOW decisions poll failed: HTTP ${i.status} ${i.statusText}`);let a=await i.json();if(typeof a!="object"||a===null)throw new Error("ALLOW decisions poll returned unexpected non-object response");let c=a,s=c.hitl_result;if(s==="approved")return{decision_id:e,decision:"permit",reason:"Approved by human reviewer"};if(s==="rejected")return{decision_id:e,decision:"deny",reason:typeof c.reason=="string"?c.reason:"Rejected by human reviewer"};if(s==="timeout"||s==="expired")return{decision_id:e,decision:"deny",reason:"HITL approval timed out"};await lt(st)}return{decision_id:e,decision:"deny",reason:"HITL approval timed out"}}};function lt(e){return new Promise(t=>setTimeout(t,e))}function ie(){let e={};try{let t=`${h.platform()} ${h.release()}`.trim();t&&(e.os=t)}catch{}try{let t=h.hostname();t&&(e.hostname=t)}catch{}try{let{username:t}=h.userInfo();t&&(e.username=t)}catch{}try{let t=ct();t&&(e.ip=t)}catch{}return e}function ct(){let e=h.networkInterfaces();for(let t of Object.keys(e))for(let n of e[t]??[])if((n.family==="IPv4"||n.family===4)&&!n.internal&&n.address)return n.address}import{z as u}from"zod";import{createHash as Mn}from"crypto";import{createHash as qn}from"crypto";var ut=["tier1","tier2","tier3"];function se(e){return typeof e=="string"&&ut.includes(e)}var dt=["read_only","transactional","data_processor","external_comms","code_exec","privileged"],pt=["internal","customer_facing","experimental","third_party"],le=[...dt,...pt];function ft(e){return typeof e=="string"&&le.includes(e)}function ce(e){let t=new Set;for(let n of e)ft(n)&&t.add(n);return le.filter(n=>t.has(n))}var gt=["read_only","record_create","record_update","record_delete","data_export","data_share","data_subject_request","consent_change","funds_transfer","funds_disbursement","payroll_run","trade_execution","ledger_mutation","credit_decision","decision_adverse","account_restriction","account_closure","card_management","purchase_commitment","vendor_management","deal_management","pricing_change","contract_execution","legal_hold","regulatory_filing","personnel_action","employment_termination","compensation_change","campaign_send","content_publish","inventory_adjustment","order_fulfillment","account_servicing","credential_reset","access_grant","permission_change","credential_management","auth_policy_change","security_config_change","logging_change","alert_management","code_change","infrastructure_provision","deployment_change","communication_send","other"];function ue(e){if(typeof e!="string"&&typeof e!="number")return null;let t=String(e).trim().replace(/([a-z0-9])([A-Z])/g,"$1_$2").toLowerCase().replace(/[^a-z0-9]+/g,"_").replace(/^_+|_+$/g,"");return t.length>0?t:null}var mt={wire_transfer:"funds_transfer",international_transfer:"funds_transfer",cross_border_payment:"funds_transfer",send_swift:"funds_transfer",send_wire:"funds_transfer",transfer_funds:"funds_transfer",update_wire_instructions:"funds_transfer",add_beneficiary:"funds_transfer",modify_payee:"funds_transfer",disburse_funds:"funds_disbursement",initiate_ach:"funds_disbursement",issue_refund:"funds_disbursement",execute_trade:"trade_execution",place_order:"trade_execution",post_journal_entry:"ledger_mutation",adjust_ledger:"ledger_mutation",modify_general_ledger:"ledger_mutation",raise_limit:"credit_decision",increase_credit_limit:"credit_decision",extend_credit:"credit_decision",decline_credit:"decision_adverse",deny_application:"decision_adverse",adverse_action:"decision_adverse",block_card:"card_management",cancel_card:"card_management",place_hold:"account_restriction",freeze_account:"account_restriction",restrict_account:"account_restriction",close_account:"account_closure",export_data:"data_export",export_customer_list:"data_export",download_report:"data_export",download_customer_list:"data_export",bulk_export:"data_export",share_data:"data_share",send_to_partner:"data_share",delete_records:"record_delete",delete_user:"record_delete",drop_table:"record_delete",grant_role:"access_grant",change_permissions:"permission_change",modify_access:"permission_change",rotate_keys:"credential_management",disable_mfa:"auth_policy_change",modify_security_config:"security_config_change",disable_logging:"logging_change",purge_logs:"logging_change",suppress_alert:"alert_management",dismiss_alert:"alert_management",rollback:"deployment_change",modify_billing:"record_update",close_sar:"record_update",send_email:"communication_send",send_sms:"communication_send",fulfill_dsar:"data_subject_request",process_dsar:"data_subject_request",fulfill_data_request:"data_subject_request",process_erasure_request:"data_subject_request",honor_deletion_request:"data_subject_request",export_subject_data:"data_subject_request",erase_subject_data:"data_subject_request",delete_subject_data:"data_subject_request",record_consent:"consent_change",capture_consent:"consent_change",update_consent:"consent_change",withdraw_consent:"consent_change",revoke_consent:"consent_change",opt_out:"consent_change",opt_in:"consent_change",run_payroll:"payroll_run",process_payroll:"payroll_run",submit_payroll:"payroll_run",approve_payroll:"payroll_run",create_purchase_order:"purchase_commitment",issue_purchase_order:"purchase_commitment",approve_purchase_order:"purchase_commitment",submit_purchase_order:"purchase_commitment",approve_purchase:"purchase_commitment",approve_requisition:"purchase_commitment",commit_spend:"purchase_commitment",onboard_vendor:"vendor_management",add_vendor:"vendor_management",create_supplier:"vendor_management",approve_vendor:"vendor_management",update_vendor_bank:"vendor_management",update_supplier_bank:"vendor_management",modify_supplier:"vendor_management",create_opportunity:"deal_management",update_opportunity:"deal_management",advance_deal_stage:"deal_management",update_deal_stage:"deal_management",close_deal:"deal_management",mark_closed_won:"deal_management",mark_closed_lost:"deal_management",issue_quote:"pricing_change",send_quote:"pricing_change",approve_discount:"pricing_change",apply_discount:"pricing_change",override_price:"pricing_change",update_pricing:"pricing_change",approve_special_pricing:"pricing_change",execute_contract:"contract_execution",sign_contract:"contract_execution",countersign_contract:"contract_execution",sign_agreement:"contract_execution",execute_agreement:"contract_execution",sign_nda:"contract_execution",execute_nda:"contract_execution",sign_document:"contract_execution",esign_document:"contract_execution",place_legal_hold:"legal_hold",place_litigation_hold:"legal_hold",apply_legal_hold:"legal_hold",release_legal_hold:"legal_hold",file_regulatory_report:"regulatory_filing",file_sar:"regulatory_filing",submit_regulatory_filing:"regulatory_filing",file_compliance_report:"regulatory_filing",file_disclosure:"regulatory_filing",onboard_employee:"personnel_action",hire_employee:"personnel_action",change_employee_role:"personnel_action",promote_employee:"personnel_action",transfer_employee:"personnel_action",update_job_title:"personnel_action",terminate_employee:"employment_termination",offboard_employee:"employment_termination",deactivate_employee:"employment_termination",separate_employee:"employment_termination",adjust_salary:"compensation_change",change_compensation:"compensation_change",approve_raise:"compensation_change",grant_equity:"compensation_change",grant_stock:"compensation_change",issue_bonus:"compensation_change",update_pay_rate:"compensation_change",send_campaign:"campaign_send",launch_campaign:"campaign_send",schedule_campaign:"campaign_send",send_bulk_email:"campaign_send",send_marketing_email:"campaign_send",send_newsletter:"campaign_send",blast_email:"campaign_send",publish_post:"content_publish",publish_content:"content_publish",publish_blog:"content_publish",post_to_social:"content_publish",schedule_post:"content_publish",adjust_inventory:"inventory_adjustment",write_off_inventory:"inventory_adjustment",update_stock_level:"inventory_adjustment",reconcile_inventory:"inventory_adjustment",fulfill_order:"order_fulfillment",ship_order:"order_fulfillment",dispatch_order:"order_fulfillment",mark_order_shipped:"order_fulfillment",update_customer_account:"account_servicing",modify_customer_account:"account_servicing",update_customer_contact:"account_servicing",change_customer_settings:"account_servicing",reset_customer_password:"credential_reset",reset_password:"credential_reset",force_password_reset:"credential_reset",reset_mfa:"credential_reset",unlock_account:"credential_reset",reset_customer_credentials:"credential_reset",merge_pull_request:"code_change",merge_pr:"code_change",merge_branch:"code_change",push_to_branch:"code_change",push_to_main:"code_change",push_code:"code_change",commit_code:"code_change",force_push:"code_change",provision_infrastructure:"infrastructure_provision",provision_resource:"infrastructure_provision",create_instance:"infrastructure_provision",terminate_instance:"infrastructure_provision",spin_up_server:"infrastructure_provision",tear_down_server:"infrastructure_provision",destroy_resource:"infrastructure_provision",create_cluster:"infrastructure_provision"};function ht(e){let t=ue(e);return t===null?"other":mt[t]||(/^(delete|remove|purge|drop|destroy|wipe)_/.test(t)?"record_delete":/^(export|download|extract|dump)_/.test(t)?"data_export":/^(create|add|insert)_/.test(t)?"record_create":/^(update|edit|modify|patch|set)_/.test(t)?"record_update":t==="send_email"||t==="send_sms"||/^(notify|email|sms)_/.test(t)?"communication_send":/^(read|get|list|search|fetch|view|query)_/.test(t)||t==="read"||t==="get"?"read_only":"other")}var ae={github:"version_control",gitlab:"version_control",bitbucket:"version_control",stripe:"payments",adyen:"payments",braintree:"payments",paypal:"payments",square:"payments",salesforce:"crm",hubspot:"crm",pipedrive:"crm",slack:"communication",teams:"communication",twilio:"communication",sendgrid:"communication",mailgun:"communication",gmail:"communication",outlook:"communication",zoom:"communication",aws:"cloud_infra",gcp:"cloud_infra",azure:"cloud_infra",okta:"identity",auth0:"identity",entra:"identity",onelogin:"identity",duo:"identity",snowflake:"data_warehouse",bigquery:"data_warehouse",databricks:"data_warehouse",redshift:"data_warehouse",jira:"ticketing",zendesk:"ticketing",servicenow:"ticketing",freshdesk:"ticketing",linear:"ticketing",workday:"hr",bamboohr:"hr",gusto:"hr",netsuite:"finance_erp",quickbooks:"finance_erp",sap:"finance_erp",xero:"finance_erp",s3:"storage",gcs:"storage",dropbox:"storage",box:"storage",postgres:"database",postgresql:"database",mysql:"database",mongodb:"database",redis:"database"};function _t(e){let t=ue(e);return t===null?"other":ae[t]??ae[t.replace(/_/g,"")]??"other"}function de(e,t){let n={...e};if(t.action!==void 0&&t.action!==null&&n.action_class===void 0&&(n.action_class=ht(t.action)),t.targetApp!==void 0&&t.targetApp!==null){let r=n.context&&typeof n.context=="object"&&!Array.isArray(n.context)?{...n.context}:{};r.app_category===void 0&&(r.app_category=_t(t.targetApp)),n.context=r}return n}var oe=64,yt=64,k={retrieved_data_categories:[],retrieved_classifications:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]};function pe(){return{retrieved_data_categories:[],retrieved_classifications:[],action_classes:[],action_counts:{},denied_count:0,inhibited_count:0,event_count:0,target_apps:[]}}var bt=new Set(["deny","approval_required","escalate"]);function T(e,t){if(t.length===0)return[...e];let n=new Set(e);for(let i of t)n.add(i);let r=[...n].sort();return r.length>oe?r.slice(0,oe):r}function vt(e){return e?e.filter(t=>typeof t=="string"&&t.length>0):[]}function R(e){return typeof e=="string"&&e.length>0?e:null}function fe(e,t){let n=vt(t.data_categories),r=R(t.classification),i=R(t.action_class),a=i&&gt.includes(i)?i:null,c=R(t.target_app),s=R(t.decision),l={...e.action_counts};if(a)if(a in l)l[a]=(l[a]??0)+1;else if(Object.keys(l).length<yt)l[a]=1;else{let d=Object.keys(l).sort(),p=d[d.length-1];p!==void 0&&a<p&&(delete l[p],l[a]=1)}return{retrieved_data_categories:T(e.retrieved_data_categories,n),retrieved_classifications:T(e.retrieved_classifications,r?[r]:[]),action_classes:T(e.action_classes,a?[a]:[]),action_counts:l,denied_count:e.denied_count+(s==="deny"?1:0),inhibited_count:e.inhibited_count+(s&&bt.has(s)?1:0),event_count:e.event_count+1,target_apps:T(e.target_apps,c?[c]:[])}}var wt="generic",ge=[{id:"finance_accounting",name:"Finance & Accounting",icon:"Landmark",description:"Payments, invoicing, ledgers, transactions, refunds, financial reporting, SOX/AML/KYC controls."},{id:"hr",name:"Human Resources",icon:"Users",description:"Employee records, payroll, hiring/recruiting, benefits, personnel actions and PII of staff."},{id:"engineering",name:"Engineering",icon:"Code",description:"Source code, build/deploy pipelines, infrastructure changes, production systems and developer tooling."},{id:"it_security",name:"IT & Security",icon:"ShieldCheck",description:"Credentials, secrets, access control, configuration, threat/exfiltration prevention and security operations."},{id:"legal",name:"Legal",icon:"Scale",description:"Contracts, NDAs, litigation, counsel communications and legal-hold material."},{id:"privacy_compliance",name:"Privacy & Compliance",icon:"BadgeCheck",description:"GDPR/CCPA/HIPAA, consent, data-subject rights, special-category data and regulatory data handling."},{id:"sales",name:"Sales",icon:"TrendingUp",description:"CRM, leads, deals, quotes, pipeline and customer commercial relationships."},{id:"marketing",name:"Marketing",icon:"Megaphone",description:"Campaigns, content, brand, social channels and prospect/audience data."},{id:"operations",name:"Operations",icon:"Cog",description:"Business operations, logistics, internal workflows, vendor/ops tooling and process automation."},{id:"customer_support",name:"Customer Support",icon:"LifeBuoy",description:"Support tickets, customer communications, account servicing and help-desk actions."},{id:"procurement",name:"Procurement",icon:"ShoppingCart",description:"Purchasing, supplier management, purchase orders, sourcing and spend approvals."},{id:wt,name:"Generic",icon:"Shapes",description:"Catch-all for cross-cutting rules or rules that do not fit a specific function. Assign when no specific function clearly applies."}],At=ge.map(e=>e.id),Bn=new Map(ge.map(e=>[e.id,e])),$n=new Set(At);var It=/^[a-z][a-z0-9_]*$/;function me(e){if(!Array.isArray(e))return[];let t=[],n=new Set;for(let r of e)typeof r=="string"&&It.test(r)&&!n.has(r)&&(n.add(r),t.push(r));return t}var kt=["narrow","moderate","broad","unbounded","unknown"];function he(e){return typeof e=="string"&&kt.includes(e)}function _e(e){return e==="open"||e==="closed"?e:null}var St=["action","retrieval","delegation"];function Ct(e){return typeof e=="string"&&St.includes(e)}var Et=new Set(["rules"]);function ye(e){if(typeof e.id!="string"||typeof e.vendor_id!="string")return null;let t=typeof e.origin_table=="string"?e.origin_table:"";if(!Et.has(t))return null;let n=Array.isArray(e.applies_to)?e.applies_to.filter(Ct):[];return n.length===0?null:{id:e.id,originTable:t,vendorId:e.vendor_id,name:typeof e.name=="string"?e.name:"",description:typeof e.description=="string"?e.description:null,regoSource:typeof e.rego_source=="string"?e.rego_source:null,priority:typeof e.priority=="number"?e.priority:0,enabled:e.enabled===!0,appliesTo:n,targetApp:typeof e.target_app=="string"?e.target_app:null,actionPattern:typeof e.action_pattern=="string"?e.action_pattern:null,trustTier:typeof e.trust_tier=="string"?e.trust_tier:null,surface:typeof e.surface=="string"?e.surface:null,principalExclusions:Array.isArray(e.principal_exclusions)?e.principal_exclusions.filter(r=>typeof r=="string"):null,bypassActive:e.bypass_active===!0,bypassReason:typeof e.bypass_reason=="string"?e.bypass_reason:null,bypassExpiresAt:typeof e.bypass_expires_at=="string"?e.bypass_expires_at:null,redactionSpec:e.redaction_spec??null,failClosedOnEmptySpec:e.fail_closed_on_empty_spec===!0,hitlFallback:e.hitl_fallback==="mask"?"mask":"deny",ruleCode:typeof e.rule_code=="string"?e.rule_code:null}}import{z as x}from"zod";import{randomUUID as un}from"node:crypto";var be=e=>e!==void 0&&e.length>5120?e.slice(0,5120):e;function Tt(e){let t={...e};return t.content?.text!==void 0&&(t.content={...t.content,text:be(t.content.text)}),t.spawn?.prompt!==void 0&&(t.spawn={...t.spawn,prompt:be(t.spawn.prompt)}),t}function Rt(e,t=process.env){if(typeof e=="number"&&Number.isFinite(e)&&e>0)return e;let n=t.ALLOW_TIMEOUT_MS;if(n!==void 0){let r=Number.parseInt(n,10);if(Number.isFinite(r)&&r>0)return r}return 5e3}var xt=1440*60*1e3,Nt="VISIQ_BUNDLE_GRACE_TTL_MS",Ot="VISIQ_BUNDLE_CACHE_DISABLED",Lt="VISIQ_CACHE_DIR",Pt=x.object({graceTtlMs:x.number().int().nonnegative().optional(),disabled:x.boolean().optional(),cacheDir:x.string().min(1).optional()}).strict();function Dt(e){return e==null?{}:Pt.parse(e)}function Ft(e,t=process.env){if(typeof e=="number"&&Number.isInteger(e)&&e>=0)return e;let n=t[Nt];if(n!==void 0){let r=Number(n);if(Number.isInteger(r)&&r>=0)return r}return xt}function Mt(e,t=process.env){if(typeof e=="boolean")return e;let n=(t[Ot]??"").trim().toLowerCase();return n==="1"||n==="true"||n==="yes"}var ve;function Bt(){if(ve!==void 0)return ve;try{return typeof process<"u"&&!!process.versions&&!!process.versions.node}catch{return!1}}function $t(e){return JSON.stringify(j(e))}function j(e){if(Array.isArray(e))return e.map(j);if(e!==null&&typeof e=="object"){let t=e,n={};for(let r of Object.keys(t).sort())n[r]=j(t[r]);return n}return e}function jt(e,t,n){let r=n-e.fetchedAt;return r<0?!1:r<=t}function qt(e){if(e!==null&&typeof e=="object"&&typeof e.fetchedAt=="number"&&typeof e.contentHash=="string"&&"body"in e){let t=e;return{fetchedAt:t.fetchedAt,version:typeof t.version=="string"?t.version:null,contentHash:t.contentHash,body:t.body}}return null}async function Ce(){if(!Bt())return null;try{let[e,t,n,r]=await Promise.all([import("node:fs/promises"),import("node:path"),import("node:os"),import("node:crypto")]);return{fs:e,path:t,os:n,crypto:r}}catch{return null}}function Ee(e,t){return e.createHash("sha256").update($t(t)).digest("hex")}function Ut(e,t){let n=t.cacheDir?.trim();if(n)return n;let r=process.env[Lt]?.trim();if(r)return r;let i=process.env.XDG_CACHE_HOME?.trim();if(i)return e.path.join(i,"visiq");let a="";try{a=e.os.homedir()}catch{a=""}return a?e.path.join(a,".cache","visiq"):e.path.join(e.os.tmpdir(),"visiq-cache")}function Vt(e,t){return e.crypto.createHash("sha256").update(`${t.endpoint}\0${t.agentId}\0${t.apiKey}`).digest("hex")}function Te(e,t,n){return e.path.join(Ut(e,n),"bundles",`${Vt(e,t)}.json`)}async function Kt(e,t,n,r={}){let i=await Ce();if(i)try{let a=Te(i,e,r),c=i.path.dirname(a);await i.fs.mkdir(c,{recursive:!0,mode:448});let s={fetchedAt:r.now??Date.now(),version:n,contentHash:Ee(i.crypto,t),body:t},l=`${a}.tmp-${process.pid}-${i.crypto.randomBytes(6).toString("hex")}`;await i.fs.writeFile(l,JSON.stringify(s),{mode:384});try{await i.fs.rename(l,a)}catch(d){throw await i.fs.rm(l,{force:!0}).catch(()=>{}),d}}catch{}}async function zt(e,t={}){let n=await Ce();if(!n)return null;try{let r=await n.fs.readFile(Te(n,e,t),"utf-8"),i=qt(JSON.parse(r));return!i||Ee(n.crypto,i.body)!==i.contentHash?null:i}catch{return null}}var S;async function Wt(){if(S!==void 0)return S;try{let e=await import("@visiq/core-wasm"),t=e.evaluate??e.default?.evaluate;S=typeof t=="function"?t:null}catch{S=null}return S}var Gt=5e3,Ht=1e4,Qt=25,we=1e3,Yt=5e3,Zt=100,Ae=2e3,Jt=512,Xt=1800*1e3,en="monitor",tn="Agent has been shut down by an operator \u2014 all actions are blocked (G001)",nn="Rules bundle requires a newer SDK wire-contract dialect than this SDK supports \u2014 refusing the bundle and blocking all actions (fail-closed, G001). Upgrade the VisIQ SDK.",rn=u.object({operations:u.array(u.enum(["retrieval","action","delegation"])).min(1,"at least one operation is required"),agentId:u.string().min(1,"agentId is required"),sessionId:u.string().min(1).max(255).optional(),toolName:u.string().optional(),toolArgs:u.record(u.unknown()).optional(),targetResource:u.string().optional(),resourceType:u.string().optional(),resourceMetadata:u.record(u.unknown()).optional(),normalized:u.record(u.unknown()).optional(),query:u.string().optional(),contentPreview:u.string().optional(),telemetry:u.record(u.unknown()).optional(),context:u.record(u.unknown()).optional()}),an=u.object({version:u.string().min(1),dialect_version:u.number().int().optional(),min_dialect:u.number().int().optional(),shutdown:u.boolean().optional(),agent_mode:u.enum(["enforce","monitor","off"]).optional(),cognition_capture:u.boolean().optional(),agent_mode_by_operation:u.object({action:u.string().optional(),retrieval:u.string().optional(),delegation:u.string().optional()}).partial().optional(),agent_attributes:u.object({trust_tier:u.string().nullable().optional(),categories:u.array(u.string()).optional(),business_function:u.string().nullable().optional(),business_functions:u.array(u.string()).nullable().optional(),blast_radius_tier:u.string().nullable().optional(),no_coverage:u.string().nullable().optional()}).optional(),rules:u.array(u.record(u.unknown())),no_coverage:u.object({no_coverage_defaults:u.record(u.string()),autopilot_enabled:u.boolean(),enduser_hitl_enabled:u.boolean(),hitl_timeout_seconds:u.number().optional()}).optional()});function on(e){let t=e.trust_tier??null,n=[];Array.isArray(e.business_functions)&&e.business_functions.length>0?n=e.business_functions:typeof e.business_function=="string"&&e.business_function!==""&&(n=[e.business_function]);let r=me(n);return{trust_tier:se(t)?t:null,categories:ce(e.categories??[]),business_functions:r,business_function:r[0]??null,blast_radius_tier:typeof e.blast_radius_tier=="string"&&he(e.blast_radius_tier)?e.blast_radius_tier:null}}function sn(e){if(!e)return null;let t={};for(let n of["action","retrieval","delegation"]){let r=e[n];(r==="enforce"||r==="monitor"||r==="off")&&(t[n]=r)}return Object.keys(t).length>0?t:null}function ln(e){return e==="permit"?"permit":e==="mask"||e==="redact"?"mask":e==="approval_required"||e==="escalate"?"approval_required":"deny"}var q=new Set,Ie=!1;async function ke(e){let t=[];for(let n of q){if(n.pendingTelemetryCount()>0&&!n.hasBackend()){console.warn(`[UnifiedRuntime] exiting with ${n.pendingTelemetryCount()} un-sent decision(s) and no backend \u2014 telemetry lost.`);continue}let r=n.flush();e&&t.push(r)}t.length>0&&await Promise.allSettled(t)}function cn(){if(!Ie&&!(typeof process>"u"||typeof process.once!="function")){Ie=!0,process.once("beforeExit",()=>{ke(!1)});for(let e of["SIGINT","SIGTERM"])process.once(e,()=>{(async()=>{try{await ke(!0)}finally{process.kill(process.pid,e)}})()})}}var Re=class{client;originalFetch;resolvedApiKey;resolvedEndpoint;resolvedAgentId;harnessKind;sdkVersion;sdkDialect;rules=[];agentAttributes=null;agentNoCoverage=null;sessions=new Map;noCoverage=null;bundleVersion=null;bundleEtag=null;bundleLoaded=!1;bundleFetchInProgress=!1;initialBundlePromise=null;refreshTimer=null;cacheIdentity;bundleCacheDisabled;bundleGraceTtlMs;bundleCacheDirOverride;diskFallbackServed=!1;agentMode=en;agentModeByOperation=null;rawBundle=null;agentModeConfirmed=!1;operatorShutdown=!1;bundleApplyFailed=!1;dialectRefused=!1;telemetryBuffer=[];telemetryTimer=null;cognitionBuffer=[];cognitionTimer=null;cognitionEnabled=process.env.VISIQ_COGNITION_CAPTURE==="1";envRegistered=!1;registerPromise=null;lastToolSurfaceSig=null;constructor(e,t,n,r,i,a,c,s){let l=e??process.env.VISIQ_API_KEY??process.env.ALLOW_API_KEY??process.env.VISIQ_ALLOW_API_KEY,d=t??process.env.VISIQ_ENDPOINT??process.env.ALLOW_ENDPOINT,p=n??process.env.VISIQ_AGENT_ID??process.env.ALLOW_AGENT_ID??"";this.resolvedApiKey=l,this.resolvedEndpoint=d,this.resolvedAgentId=p,this.harnessKind=r,this.sdkVersion=a,this.sdkDialect=c,this.originalFetch=globalThis.fetch.bind(globalThis);let f=Dt(s);if(this.bundleCacheDisabled=Mt(f.disabled),this.bundleGraceTtlMs=Ft(f.graceTtlMs),this.bundleCacheDirOverride=f.cacheDir,this.cacheIdentity=l&&d&&!this.bundleCacheDisabled?{endpoint:d,agentId:p,apiKey:l}:null,l&&d){let m={apiKey:l,agentId:p,endpoint:d,mode:"enforce",timeoutMs:Rt(i),hitlTimeoutMs:12e4,failBehavior:"closed",...r?{harnessKind:r}:{},...a!==void 0?{sdkVersion:a}:{},...c!==void 0?{sdkDialect:c}:{}};this.client=new re(m,this.originalFetch),this.initialBundlePromise=this.initialBundleLoad(),this.refreshTimer=setInterval(()=>{this.fetchBundleBackground()},Gt),$(this.refreshTimer),this.telemetryTimer=setInterval(()=>{this.flushTelemetry()},Ht),$(this.telemetryTimer),this.cognitionTimer=setInterval(()=>{this.flushCognition()},Yt),$(this.cognitionTimer),q.add(this),cn()}else this.client=null}async evaluate(e){let t=rn.parse(e),n=Date.now();if(this.operatorShutdown){let l=this.denyAll(t,tn);return this.applyAgentMode(l,"enforce",t,n)}if(this.dialectRefused){let l=this.denyAll(t,nn);return this.applyAgentMode(l,"enforce",t,n)}if(t.operations.every(l=>this.modeFor(l)==="off"))return this.offDecision(t);if(!this.bundleLoaded){let l;this.agentModeConfirmed?l=this.agentMode:this.bundleApplyFailed?l="enforce":l="monitor";let d=this.denyAll(t,"No unified bundle loaded and no local rules \u2014 fail-closed (G001)");return this.applyAgentMode(d,l,t,n)}let r=this.readSession(t.sessionId),i=await Wt();if(!i||!this.rawBundle)throw new Error("governance core (@visiq/core-wasm) unavailable \u2014 failing closed (G001)");let a={...t,session:r,at:Date.now()},c={...this.rawBundle,agent_mode:this.agentMode,...this.agentModeByOperation?{agent_mode_by_operation:this.agentModeByOperation}:{}},s=i(a,c);return this.foldSession(t,s.enforced?s.decision:"permit"),s.enforced&&s.action.decision==="approval_required"&&await this.registerHitl(t,s),this.bufferTelemetry(t,s,Date.now()-n,s.enforced),s}modeFor(e){return this.agentModeByOperation?.[e]??this.agentMode}readSession(e){if(!e)return k;let t=this.sessions.get(e);return t?Date.now()-t.touchedAt>Xt?(this.sessions.delete(e),k):t.state:k}foldSession(e,t){let{sessionId:n}=e;if(!n)return;let r=this.readSession(n),i=e.resourceMetadata??{},a=e.operations.includes("retrieval"),c=e.operations.includes("action")||e.operations.includes("delegation"),s=c?de(e.normalized??{},{action:e.toolName??"",targetApp:e.targetResource??e.toolName??""}):e.normalized??{},l=fe(r===k?pe():r,{data_categories:a&&Array.isArray(i.data_categories)?i.data_categories:void 0,classification:a?i.classification:void 0,action_class:c?s.action_class:void 0,target_app:c?e.targetResource??e.toolName:void 0,decision:t});if(this.sessions.delete(n),this.sessions.set(n,{state:l,touchedAt:Date.now()}),this.sessions.size>Jt){let d=this.sessions.keys().next().value;d!==void 0&&this.sessions.delete(d)}}applyAgentMode(e,t,n,r){let i=Date.now()-r;if(t==="enforce"){let c={...e,enforced:!0,agentMode:"enforce"};return this.bufferTelemetry(n,c,i,!0),c}let a={...e,allowed:!0,enforced:!1,agentMode:"monitor"};return this.bufferTelemetry(n,a,i,!1),a}offDecision(e){let t=e.operations.includes("action")||e.operations.includes("delegation"),n=e.operations.includes("retrieval");return{decision:"permit",allowed:!0,reason:"agent_mode=off \u2014 evaluation bypassed",ruleId:null,ruleCode:null,enforced:!1,agentMode:"off",action:t?{decision:"permit",allowed:!0}:{decision:null,allowed:!0},retrieval:n?{action:"allow"}:{action:null}}}denyAll(e,t){let n=e.operations.includes("action")||e.operations.includes("delegation"),r=e.operations.includes("retrieval");return{decision:"deny",allowed:!1,reason:t,ruleId:null,ruleCode:null,enforced:!0,agentMode:"enforce",action:n?{decision:"deny",allowed:!1}:{decision:null,allowed:!0},retrieval:r?{action:"deny"}:{action:null}}}async registerHitl(e,t){if(this.client)try{let n={agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??"",context:e.toolName?{[e.toolName]:e.toolArgs??{}}:{},...e.sessionId?{session_id:e.sessionId}:{},...e.telemetry?{telemetry:e.telemetry}:{}},r=await this.client.evaluate(n);r.decision_id&&(t.action.decisionId=r.decision_id)}catch(n){console.warn("[UNIFIED] HITL registration failed \u2014 staying fail-closed (G001):",n)}}applyBundle(e){this.bundleApplyFailed=!0;let t=an.parse(e);this.bundleApplyFailed=!1;let n=this.sdkDialect??1;if(t.min_dialect!==void 0&&t.min_dialect>n){this.dialectRefused=!0,this.bundleApplyFailed=!0,console.warn(`[UNIFIED] rules bundle requires dialect ${t.min_dialect} but this SDK speaks ${n} \u2014 refusing the bundle and failing closed (deny-all, G001). Upgrade the VisIQ SDK.`);return}this.dialectRefused=!1,!(this.bundleLoaded&&t.version===this.bundleVersion)&&(this.rules=t.rules.map(r=>ye(r)).filter(r=>r!==null),this.agentAttributes=t.agent_attributes?on(t.agent_attributes):null,this.agentNoCoverage=_e(t.agent_attributes?.no_coverage),this.bundleVersion=t.version,this.bundleLoaded=!0,this.noCoverage=t.no_coverage?{no_coverage_defaults:t.no_coverage.no_coverage_defaults,autopilot_enabled:t.no_coverage.autopilot_enabled,enduser_hitl_enabled:t.no_coverage.enduser_hitl_enabled}:null,t.agent_mode!==void 0&&(this.agentMode=t.agent_mode,this.agentModeConfirmed=!0),this.agentModeByOperation=sn(t.agent_mode_by_operation),process.env.VISIQ_COGNITION_CAPTURE==="1"?this.cognitionEnabled=!0:typeof t.cognition_capture=="boolean"&&(this.cognitionEnabled=t.cognition_capture),this.operatorShutdown=t.shutdown===!0,this.rawBundle=e)}async awaitBundleReady(e=5e3){if(!this.initialBundlePromise||this.bundleLoaded)return;let t,n=new Promise(r=>{t=setTimeout(r,e)});try{await Promise.race([this.initialBundlePromise,n])}catch{}finally{t&&clearTimeout(t)}}async fetchBundleBackground(){if(!(this.bundleFetchInProgress||!this.resolvedEndpoint||!this.resolvedApiKey)){this.bundleFetchInProgress=!0;try{let e=this.resolvedAgentId?`?agent_id=${encodeURIComponent(this.resolvedAgentId)}`:"",t={Authorization:`Bearer ${this.resolvedApiKey}`,Accept:"application/json",...B(this.sdkVersion,this.sdkDialect)};this.bundleEtag&&(t["If-None-Match"]=this.bundleEtag);let n=await this.originalFetch(`${this.resolvedEndpoint}/rules/bundle${e}`,{method:"GET",headers:t});if(n.status===304)return;if(!n.ok)throw new Error(`unified bundle fetch failed: HTTP ${n.status}`);let r=n.headers.get("ETag"),i=await n.json();this.applyBundle(i);let a=this.bundleLoaded&&!this.dialectRefused&&!this.bundleApplyFailed;r&&a?this.bundleEtag=r:a||(this.bundleEtag=null),a&&await this.persistBundleToDisk(i)}catch(e){this.bundleLoaded?console.warn("[UNIFIED] Bundle refresh failed (using cached rules):",e):console.warn("[UNIFIED] Initial bundle fetch failed (fail-closed until loaded):",e)}finally{this.bundleFetchInProgress=!1}}}async initialBundleLoad(){await this.fetchBundleBackground(),this.bundleLoaded||await this.tryLoadFromDiskCache()}async tryLoadFromDiskCache(){if(this.bundleLoaded||this.bundleCacheDisabled||!this.cacheIdentity||this.dialectRefused)return;let e;try{e=await zt(this.cacheIdentity,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}catch{return}if(!e)return;let t=Date.now();if(jt(e,this.bundleGraceTtlMs,t)){try{this.applyBundle(e.body)}catch{return}if(this.bundleLoaded&&!this.dialectRefused&&!this.diskFallbackServed){this.diskFallbackServed=!0;let n=Math.max(0,Math.round((t-e.fetchedAt)/1e3)),r=Math.round(this.bundleGraceTtlMs/1e3);console.warn(`[UnifiedRuntime] serving cached rules bundle (age ${n}s) \u2014 control plane unreachable on cold start; will keep retrying and fail closed once the cache exceeds the ${r}s grace window.`)}}}async persistBundleToDisk(e){this.bundleCacheDisabled||!this.cacheIdentity||await Kt(this.cacheIdentity,e,this.bundleVersion,{...this.bundleCacheDirOverride?{cacheDir:this.bundleCacheDirOverride}:{}})}hasRules(){return this.bundleLoaded&&this.rules.length>0}hasClient(){return this.client!==null}getEndpoint(){return this.resolvedEndpoint}getApiKey(){return this.resolvedApiKey}getBundleVersion(){return this.bundleVersion}getAgentMode(){return this.agentMode}getAgentAttributes(){return this.agentAttributes}getSessionState(e){return this.readSession(e)}registerEnvironment(e){!this.client||this.envRegistered||!this.resolvedAgentId||(this.envRegistered=!0,this.registerPromise=this.client.registerEnvironment(e))}registerHostEnvironment(e){this.registerEnvironment({...ie(),...e?{agent_type:e}:{}})}reportToolSurface(e){if(!this.client||!this.resolvedAgentId||e.length===0)return;let t=JSON.stringify([...e].map(n=>({n:n.name,d:n.description??"",s:n.input_schema??null})).sort((n,r)=>n.n.localeCompare(r.n)));t!==this.lastToolSurfaceSig&&(this.lastToolSurfaceSig=t,this.client.reportToolSurface(e))}bufferTelemetry(e,t,n,r){this.telemetryBuffer.push({decision_id:crypto.randomUUID(),agent_id:e.agentId,target_app:e.targetResource??e.toolName??"",action:e.toolName??e.operations.join("+"),...e.sessionId?{session_id:e.sessionId}:{},decision:r?ln(t.decision):"permit",reason:t.reason,evaluated_at:new Date().toISOString(),rule_id:t.ruleId,rule_code:t.ruleCode,enforced:r,agent_mode:this.agentMode,latency_ms:n,evaluation_mode:"local",raw_event:{agent_id:e.agentId,operations:e.operations,...e.toolName?{tool_name:e.toolName}:{},...e.targetResource?{target_resource:e.targetResource}:{},...e.resourceType?{resource_type:e.resourceType}:{}},...this.harnessKind||e.context?{context:{...this.harnessKind?{[te]:this.harnessKind}:{},...e.context??{}}}:{}}),this.enforceTelemetryCap(),this.telemetryBuffer.length>=Qt&&this.flushTelemetry()}pendingTelemetryCount(){return this.telemetryBuffer.length}hasBackend(){return this.client!==null}async flushTelemetry(){if(this.telemetryBuffer.length===0||!this.client)return;let e=this.telemetryBuffer.splice(0);try{await this.client.sendTelemetry(e)}catch(t){console.error("[UnifiedRuntime] telemetry flush failed (non-fatal):",t)}}enforceTelemetryCap(){let e=this.telemetryBuffer.length-we;e>0&&(this.telemetryBuffer.splice(0,e),console.warn(`[UnifiedRuntime] telemetry buffer full \u2014 dropped ${e} oldest entries (cap ${we})`))}isCognitionEnabled(){return this.cognitionEnabled}emitCognition(e){!this.cognitionEnabled||!this.client||(this.cognitionBuffer.push(Tt(e)),this.enforceCognitionCap(),this.cognitionBuffer.length>=Zt&&this.flushCognition())}async flushCognition(){if(this.cognitionBuffer.length===0||!this.client)return;let e=this.cognitionBuffer.splice(0);try{await this.client.sendCognition(void 0,e)}catch(t){console.error("[UnifiedRuntime] cognition flush failed (non-fatal):",t)}}enforceCognitionCap(){let e=this.cognitionBuffer.length-Ae;e>0&&(this.cognitionBuffer.splice(0,e),console.warn(`[UnifiedRuntime] cognition buffer full \u2014 dropped ${e} oldest beats (cap ${Ae})`))}async flush(){if(this.registerPromise)try{await this.registerPromise}catch{}await this.flushTelemetry(),await this.flushCognition()}async shutdown(){await this.flush(),this.dispose(),q.delete(this)}dispose(){this.refreshTimer&&(clearInterval(this.refreshTimer),this.refreshTimer=null),this.telemetryTimer&&(clearInterval(this.telemetryTimer),this.telemetryTimer=null),this.cognitionTimer&&(clearInterval(this.cognitionTimer),this.cognitionTimer=null),this.flushTelemetry(),this.flushCognition()}};function $(e){e&&typeof e=="object"&&"unref"in e&&e.unref()}function C(e){return typeof e=="string"&&e.trim().length>0?e:void 0}function xe(e,t){if(e!=="sessions_spawn")return null;let n=C(t.agentId);return n?{childAgentId:n,childName:C(t.taskName)??C(t.label)??n,kind:"subagent",task:C(t.task),model:C(t.model),source:"structural"}:null}function Ne(e,t){return{delegation:{is_delegated:!0,role:"parent",parent_agent_id:t,target_agent:e.childAgentId,source:e.source,spawn:{childAgentId:e.childAgentId,childName:e.childName,kind:e.kind,...e.model?{model:e.model}:{},...e.task?{prompt:e.task}:{},...e.description?{description:e.description}:{},...e.goal?{goal:e.goal}:{},...e.agentType?{agentType:e.agentType}:{}}}}}var Se=new Map;function dn(e){let t=(Se.get(e)??0)+1;return Se.set(e,t),t}function Oe(e,t,n){if(!e||typeof e.isCognitionEnabled!="function"||!e.isCognitionEnabled())return;let r=t.sessionId&&t.sessionId.length>0?t.sessionId:t.agentId;e.emitCognition({clientEventId:un(),agentId:t.agentId,sessionId:r,threadId:t.agentId,parentId:t.agentId,seq:dn(r),ts:Date.now(),kind:"spawn",visibility:"shown",provenance:"parsed",...t.framework?{framework:t.framework}:{},spawn:{childAgentId:n.childAgentId,childName:n.childName,kind:n.kind,...n.model?{model:n.model}:{},...n.task?{prompt:n.task}:{}}})}var v=null;function U(e){let t=`${e.apiKey}::${e.agentId}::${e.baseUrl??""}`;if(v&&v.key===t)return v.runtimes;let n=new Re(e.apiKey,e.baseUrl,e.agentId,"cli_harness");return n.registerHostEnvironment(),v={key:t,runtimes:{unified:n}},v.runtimes}async function Xn(){if(v)try{await v.runtimes.unified.flush()}catch{}}async function er(e){try{let t=await y();if(!t)return;let{unified:n}=U(t);await n.awaitBundleReady(e)}catch{}}function b(e,t){return e?.sessionKey??t?.sessionKey??t?.sessionId??"default"}var V=class{entries=new Map;set(t,n){this.entries.set(t,n)}get(t){return this.entries.get(t)}delete(t){this.entries.delete(t)}clear(){this.entries.clear()}size(){return this.entries.size}},K=new Map;function A(e){let t=K.get(e);return t||(t=new V,K.set(e,t)),t}function Le(e){K.delete(e)}var Pe=new Set(["web_search","x_search","web_fetch","tool_search","tool_describe","get_account","get_transactions","get_devices","check_watchlist","search_knowledge"]);function pn(e){if(typeof e!="string"||e.length===0)return e;let t=e.lastIndexOf("__");return t<0?e:e.slice(t+2)}function De(e){return Pe.has(pn(e))}function rr(){return Pe}var fn=[{name:"private_key",re:/-----BEGIN (?:[A-Z]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z]+ )?PRIVATE KEY-----/g},{name:"jwt",re:/\beyJ[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\.[A-Za-z0-9_-]{6,}\b/g},{name:"aws_access_key",re:/\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA|ANVA|AIPA)[0-9A-Z]{16}\b/g},{name:"github_token",re:/\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g},{name:"slack_token",re:/\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g},{name:"stripe_secret",re:/\b(?:sk|rk)_live_[A-Za-z0-9]{16,}\b/g},{name:"google_api_key",re:/\bAIza[0-9A-Za-z_-]{35}\b/g},{name:"llm_api_key",re:/\bsk-(?:ant-|proj-)?[A-Za-z0-9_-]{20,}\b/g},{name:"bearer_token",re:/\bBearer\s+[A-Za-z0-9._~+/=-]{20,}/g},{name:"connection_string",re:/\b(?:postgres(?:ql)?|mysql|mongodb(?:\+srv)?|redis|amqps?):\/\/[^\s/@:]+:[^\s/@:]+@[^\s'"]+/g},{name:"us_ein",re:/\b\d{2}-\d{7}\b/g},{name:"ssn",re:/\b\d{3}[- ]\d{2}[- ]\d{4}\b/g},{name:"email",re:/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g},{name:"swift_bic",re:/\b[A-Z]{6}[A-Z0-9]{2}(?:[A-Z0-9]{3})?\b/g},{name:"us_phone",re:/\b(?:\+?1[ .-]?)?\(?\d{3}\)?[ .-]?\d{3}[ .-]?\d{4}\b/g},{name:"ipv4",re:/\b(?:(?:25[0-5]|2[0-4]\d|1?\d?\d)\.){3}(?:25[0-5]|2[0-4]\d|1?\d?\d)\b/g},{name:"mac_address",re:/\b(?:[0-9A-Fa-f]{2}[:-]){5}[0-9A-Fa-f]{2}\b/g}];var g=Object.fromEntries(fn.map(e=>[e.name,e.re.source])),gn=["private_key","jwt","aws_access_key","github_token","slack_token","stripe_secret","google_api_key","llm_api_key","bearer_token","connection_string","pan","iban","aba_routing","us_ein","swift_bic","ssn","email","us_phone","ipv4","mac_address"],mn={private_key:{id:"private_key",label:"Private keys (PEM)",description:"PEM-encoded private keys (RSA / EC / EdDSA / OpenSSH).",category:"secret",example:`-----BEGIN PRIVATE KEY-----
-MIIEv\u2026
------END PRIVATE KEY-----`,template:{pattern:g.private_key,mode:"full"},defaultEnabled:!0},jwt:{id:"jwt",label:"JWT / bearer tokens",description:"JSON Web Tokens (base64url header.payload.signature).",category:"secret",example:"eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.dBjftJeZ4CVP",template:{pattern:g.jwt,mode:"full"},defaultEnabled:!0},aws_access_key:{id:"aws_access_key",label:"AWS access key IDs",description:"AWS access / identity key ids (AKIA / ASIA / AROA \u2026).",category:"secret",example:"AKIAIOSFODNN7EXAMPLE",template:{pattern:g.aws_access_key,mode:"full"},defaultEnabled:!0},github_token:{id:"github_token",label:"GitHub tokens",description:"GitHub personal / OAuth tokens (classic ghp_\u2026 + fine-grained).",category:"secret",example:"ghp_0123456789abcdef0123456789abcdef0123",template:{pattern:g.github_token,mode:"full"},defaultEnabled:!0},slack_token:{id:"slack_token",label:"Slack tokens",description:"Slack bot / user / app tokens (xoxb- / xoxp- \u2026).",category:"secret",example:"xoxb-1234567890-abcdefghijkl",template:{pattern:g.slack_token,mode:"full"},defaultEnabled:!0},stripe_secret:{id:"stripe_secret",label:"Stripe secret keys",description:"Stripe live secret / restricted keys (sk_live_ / rk_live_).",category:"secret",example:"sk_live_0123456789abcdefABCDEF",template:{pattern:g.stripe_secret,mode:"full"},defaultEnabled:!0},google_api_key:{id:"google_api_key",label:"Google API keys",description:"Google API keys (AIza\u2026).",category:"secret",example:"AIzaSyA1234567890abcdefghijklmnopqrstuv",template:{pattern:g.google_api_key,mode:"full"},defaultEnabled:!0},llm_api_key:{id:"llm_api_key",label:"LLM provider API keys",description:"OpenAI / Anthropic secret keys (sk-\u2026, sk-proj-\u2026, sk-ant-\u2026).",category:"secret",example:"sk-ant-api03-AbCdEf0123456789AbCdEf01",template:{pattern:g.llm_api_key,mode:"full"},defaultEnabled:!0},bearer_token:{id:"bearer_token",label:"Authorization bearer tokens",description:"Credentials following an HTTP `Authorization: Bearer \u2026` header.",category:"secret",example:"Bearer abcdef0123456789abcdef0123456789",template:{pattern:g.bearer_token,mode:"full"},defaultEnabled:!0},connection_string:{id:"connection_string",label:"Connection strings (with password)",description:"Database / broker DSNs carrying an inline password (scheme://user:pass@host).",category:"secret",example:"postgres://app:s3cr3t@db.internal:5432/main",template:{pattern:g.connection_string,mode:"full"},defaultEnabled:!0},pan:{id:"pan",label:"Payment card numbers (PAN)",description:"Luhn-valid 13\u201319 digit primary account numbers (PCI-DSS).",category:"financial",example:"4242 4242 4242 4242",template:{pattern:"\\b\\d{13,19}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},iban:{id:"iban",label:"IBAN bank account numbers",description:"ISO 13616 IBANs (mod-97 validated); keeps the last 4 visible.",category:"financial",example:"DE89 3704 0044 0532 0130 00",template:{pattern:"\\b[A-Z]{2}\\d{2}(?:[ ]?[A-Z0-9]){10,30}\\b",mode:"partial",keepLast:4},defaultEnabled:!0},aba_routing:{id:"aba_routing",label:"ABA routing numbers",description:"US bank routing-transit numbers (9-digit, checksum-validated). DEFAULT-OFF (9-digit false-positive surface).",category:"financial",example:"021000021",template:{pattern:"\\b\\d{9}\\b",mode:"full"},defaultEnabled:!1},us_ein:{id:"us_ein",label:"US Employer ID (EIN)",description:"US tax Employer Identification Numbers (XX-XXXXXXX).",category:"financial",example:"12-3456789",template:{pattern:g.us_ein,mode:"full"},defaultEnabled:!0},swift_bic:{id:"swift_bic",label:"SWIFT / BIC codes",description:"Bank SWIFT/BIC codes (8 or 11 chars). DEFAULT-OFF (matches uppercase tokens).",category:"financial",example:"DEUTDEFF500",template:{pattern:g.swift_bic,mode:"full"},defaultEnabled:!1},ssn:{id:"ssn",label:"US Social Security numbers",description:"Dashed / spaced US SSNs (e.g. 123-45-6789).",category:"pii",example:"123-45-6789",template:{pattern:g.ssn,mode:"partial",keepLast:4},defaultEnabled:!0},email:{id:"email",label:"Email addresses",description:"Email addresses (the mailbox is masked, the domain kept).",category:"pii",example:"alice@acme.com",template:{pattern:g.email,mode:"email"},defaultEnabled:!0},us_phone:{id:"us_phone",label:"US phone numbers",description:"US phone numbers in common formats. DEFAULT-OFF (10-digit false-positive surface).",category:"pii",example:"(415) 555-0132",template:{pattern:g.us_phone,mode:"partial",keepLast:4},defaultEnabled:!1},ipv4:{id:"ipv4",label:"IPv4 addresses",description:"Dotted-quad IPv4 addresses. DEFAULT-OFF (common + usually benign).",category:"identifier",example:"203.0.113.42",template:{pattern:g.ipv4,mode:"full"},defaultEnabled:!1},mac_address:{id:"mac_address",label:"MAC addresses",description:"Hardware MAC addresses. DEFAULT-OFF.",category:"identifier",example:"3c:22:fb:1a:2b:3c",template:{pattern:g.mac_address,mode:"full"},defaultEnabled:!1}},ar=new Set(gn.filter(e=>!mn[e].defaultEnabled));var z="[REDACTED]",I="\u2022",N=e=>/[A-Za-z0-9]/.test(e);function Fe(e,t,n,r){let i=Array.from(e),a=i.length,c=Math.max(0,Math.floor(t)||0),s=Math.max(0,Math.floor(n)||0),l=r.length>0?r:I,d=c+s>=a;return i.map((p,f)=>!d&&(f<c||f>=a-s)?p:N(p)?l:p).join("")}function hn(e,t){let n=e.indexOf("@");if(n<=0||n>=e.length-1)return Fe(e,0,0,t);let r=e.slice(0,n),i=e.slice(n),a=t.length>0?t:I;return(r.length<=1?a:r[0]+Array.from(r.slice(1)).map(c=>N(c)?a:c).join(""))+i}function _n(e,t,n){let r=n.length>0?n:I,i=new Array(e.length).fill(!1);if(typeof t=="string"&&t.length>0)try{let d=new RegExp(t,"g"),p;for(;(p=d.exec(e))!==null;){if(p[0].length===0){d.lastIndex++;continue}for(let f=p.index;f<p.index+p[0].length;f++)i[f]=!0}}catch{}let a=!1,c=!0;for(let d=0;d<e.length;d++)if(N(e[d])&&(a=!0,!i[d])){c=!1;break}let s=a&&c,l="";for(let d=0;d<e.length;d++){let p=e[d];!s&&i[d]||!N(p)?l+=p:l+=r}return l}function Me(e,t){let n=t.mode??"full";return n==="partial"?Fe(e,t.keepFirst??0,t.keepLast??0,t.maskChar??I):n==="email"?hn(e,t.maskChar??I):n==="custom"?_n(e,t.keepPattern,t.maskChar??I):t.replacement??z}function yn(e,t){return typeof e=="string"?Me(e,t):t.replacement??z}function Be(e){let t=[],n=e.replacement??z;for(let r of e.patterns??[])typeof r!="string"||r.length===0||t.push({source:r,replacer:()=>n});for(let r of e.directives??[]){let{pattern:i}=r;typeof i!="string"||i.length===0||t.push({source:i,replacer:a=>Me(a,r)})}return t}function $e(e,t){let n=e;for(let{source:r,replacer:i}of t){let a;try{a=new RegExp(r,"g")}catch(c){let s=c instanceof Error?c.message:String(c);throw new Error(`[visiq-redact] Invalid redaction pattern "${r}": ${s}`)}n=n.replace(a,c=>i(c))}return n}function O(e,t){return e==null?e:typeof e=="string"?bn(e,t):typeof e=="object"?vn(e,t):e}function bn(e,t){if(typeof e!="string")return e;let n=Be(t);return n.length===0?e:$e(e,n)}function vn(e,t){let n=new Map;for(let s of t.fields??[])typeof s=="string"&&s.length>0&&n.set(s,{field:s,mode:"full",replacement:t.replacement});for(let s of t.directives??[])typeof s.field=="string"&&s.field.length>0&&n.set(s.field,s);let r=Be(t),i=n.size>0,a=r.length>0,c=s=>{if(s==null)return s;if(Array.isArray(s))return s.map(l=>c(l));if(typeof s=="object"){let l=s,d=Object.create(Object.getPrototypeOf(l));for(let p of Object.keys(l)){let f=i?n.get(p):void 0;if(f){d[p]=yn(l[p],f);continue}d[p]=c(l[p])}return d}return typeof s=="string"&&a?$e(s,r):s};return c(e)}var je="@visiq/openclaw-plugin";function qe(e){let t=[],n=[],r;for(let a of e){let{field:c,pattern:s,replacement:l}=a;c&&t.push(c),s&&n.push(s),l&&r===void 0&&(r=l)}let i={};return t.length>0&&(i.fields=t),n.length>0&&(i.patterns=n),r!==void 0&&(i.replacement=r),i}async function fr(e,t){let n=await y();if(!n)return{block:!0,blockReason:"[VisIQ] Plugin is loaded but NOT configured \u2014 VisIQ cannot govern this tool call, so it is blocked (fail-closed). Set VISIQ_API_KEY + VISIQ_ENDPOINT (or the plugin config) so VisIQ can evaluate the call, then retry."};let r=U(n),i=n.agentId??t.agentId,a=b(e,t),c=t.toolCallId??e.toolCallId,l=De(e.toolName)?["retrieval","action"]:["action"],d=wn(e.params),p=xe(e.toolName,e.params??{}),f;p&&i&&(Oe(r.unified,{agentId:i,sessionId:a,framework:"openclaw"},p),l.push("delegation"),f=Ne(p,i));let m;try{await r.unified.awaitBundleReady(),m=await r.unified.evaluate({operations:l,agentId:i,sessionId:a,toolName:e.toolName,toolArgs:e.params??{},resourceType:"tool_result",resourceMetadata:{toolName:e.toolName,runId:e.runId??t.runId},...d!==void 0?{query:d}:{},...f?{context:f}:{}})}catch(_){return{block:!0,blockReason:`[VisIQ] Evaluation error (fail-closed): ${_ instanceof Error?_.message:String(_)}`}}if(!m.enforced)return;let{action:w}=m;if(w.decision==="approval_required")return{requireApproval:{title:`VisIQ approval required: ${e.toolName}`,description:m.reason,severity:"critical",allowedDecisions:["allow-once","allow-always","deny"],pluginId:je}};if(!w.allowed)return{block:!0,blockReason:`[VisIQ ${m.ruleCode??"DENY"}] ${m.reason}`};let P;if(w.decision==="mask"&&w.argRedactionRules&&w.argRedactionRules.length>0&&(P=O(e.params??{},qe(w.argRedactionRules))),l.includes("retrieval"))switch(m.retrieval.action){case"allow":case null:break;case"deny":return{block:!0,blockReason:`[VisIQ RECALL] ${m.reason}`};case"redact":{if(!c)return{block:!0,blockReason:"[VisIQ RECALL] Redact decision but no toolCallId \u2014 fail-closed"};let _=m.retrieval.redactionRules??[];_.length>0&&A(a).set(c,qe(_));break}case"escalate":return{requireApproval:{title:`VisIQ approval required: ${e.toolName}`,description:m.reason,severity:"warning",allowedDecisions:["allow-once","allow-always","deny"],pluginId:je}};default:{let _=m.retrieval.action;return{block:!0,blockReason:`[VisIQ RECALL] Unknown action "${String(_)}" \u2014 fail-closed`}}}if(P)return{params:P}}function wn(e){if(e)for(let t of["query","q","url","prompt"]){let n=e[t];if(typeof n=="string"&&n.length>0)return n}}function yr(e,t){let{ready:n,config:r}=E();if(!n||!r)return;let i=e.toolCallId??t.toolCallId;if(!i)return;let a=b(e,t),c=A(a),s=c.get(i);if(!s)return;let l={...e.message};return l.content!==void 0&&(l.content=O(l.content,s)),c.delete(i),{message:l}}function Ar(e,t){let{ready:n,config:r}=E();if(n&&!r)return;let i=b(e,t),a=A(i);if(a.size()>0)return a.clear(),{block:!0}}async function L(e,t){let r=`${(e.baseUrl??"https://api.visiqlabs.com").replace(/\/$/,"")}/v1/events`;try{let i=new AbortController,a=setTimeout(()=>i.abort(),5e3);try{let c=await fetch(r,{method:"POST",headers:{"content-type":"application/json",authorization:`Bearer ${e.apiKey}`},body:JSON.stringify(t),signal:i.signal});c.ok||process.stderr.write(`[VisIQ] /v1/events POST failed: ${c.status} ${c.statusText}
-`);try{await c.text()}catch{}}finally{clearTimeout(a)}}catch(i){if(i instanceof Error&&i.name==="AbortError"){process.stderr.write(`[VisIQ] /v1/events POST timed out (5s)
-`);return}process.stderr.write(`[VisIQ] /v1/events POST error: ${i instanceof Error?i.message:String(i)}
-`)}}async function Er(e,t){let n=await y();if(!n)return;let r=n.agentId??t.agentId;L(n,{type:"llm_input",agentId:r,sessionId:e.sessionId??t.sessionId??t.sessionKey,runId:e.runId??t.runId,timestamp:new Date().toISOString(),payload:{provider:e.provider,model:e.model,hasSystemPrompt:typeof e.systemPrompt=="string"&&e.systemPrompt.length>0,promptLength:typeof e.prompt=="string"?e.prompt.length:0,historyMessageCount:Array.isArray(e.historyMessages)?e.historyMessages.length:0,imagesCount:e.imagesCount??0,toolCount:Array.isArray(e.tools)?e.tools.length:0}})}function An(e){if(!Array.isArray(e))return 0;let t=0;for(let n of e)typeof n=="string"&&(t+=n.length);return t}async function Nr(e,t){let n=await y();if(!n)return;let r=n.agentId??t.agentId;L(n,{type:"llm_output",agentId:r,sessionId:e.sessionId??t.sessionId??t.sessionKey,runId:e.runId??t.runId,timestamp:new Date().toISOString(),payload:{provider:e.provider,model:e.model,resolvedRef:e.resolvedRef,harnessId:e.harnessId,assistantSegmentCount:Array.isArray(e.assistantTexts)?e.assistantTexts.length:0,assistantTotalChars:An(e.assistantTexts),usage:e.usage??null}})}function Pr(e,t){Le(b(e,t))}export{Y as a,xn as b,Xn as c,er as d,V as e,A as f,Le as g,pn as h,De as i,rr as j,fr as k,yr as l,Ar as m,Er as n,Nr as o,Pr as p};