agentid-sdk 0.1.36 → 0.1.38

package/dist/langchain.js

@@ -27,7 +27,7 @@ var import_base = require("@langchain/core/callbacks/base");
 
 // src/sdk-version.ts
 var FALLBACK_SDK_VERSION = "js-0.0.0-dev";
-var AGENTID_SDK_VERSION_HEADER = "js-0.1.36".trim().length > 0 ? "js-0.1.36" : FALLBACK_SDK_VERSION;
+var AGENTID_SDK_VERSION_HEADER = "js-0.1.38".trim().length > 0 ? "js-0.1.38" : FALLBACK_SDK_VERSION;
 
 // src/pii-national-identifiers.ts
 var MAX_CANDIDATES_PER_RULE = 256;
@@ -891,8 +891,173 @@ function detectNationalIdentifiers(text, options = {}) {
   return results;
 }
 
+// src/secret-patterns.ts
+var SDK_SECRET_PATTERN_DEFINITIONS = [
+  {
+    id: "openai_api_key",
+    placeholderType: "OPENAI_API_KEY",
+    patternSource: "\\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\\b",
+    flags: "iu",
+    prefilterTerms: ["sk-", "proj-", "openai"]
+  },
+  {
+    id: "aws_access_key",
+    placeholderType: "AWS_ACCESS_KEY",
+    patternSource: "\\b(?:AKIA|ASIA)[A-Z0-9]{16}\\b",
+    flags: "iu",
+    prefilterTerms: ["akia", "asia", "aws"]
+  },
+  {
+    id: "github_token",
+    placeholderType: "GITHUB_TOKEN",
+    patternSource: "\\b(?:gh[pousr]_[A-Za-z0-9]{24,255}|github_pat_[A-Za-z0-9_]{20,255})\\b",
+    flags: "iu",
+    prefilterTerms: ["ghp_", "gho_", "ghu_", "ghs_", "ghr_", "github_pat_"]
+  },
+  {
+    id: "slack_token",
+    placeholderType: "SLACK_TOKEN",
+    patternSource: "\\bxox(?:a|b|p|r|s)-[A-Za-z0-9-]{10,200}\\b",
+    flags: "iu",
+    prefilterTerms: ["xoxa-", "xoxb-", "xoxp-", "xoxr-", "xoxs-", "slack"]
+  },
+  {
+    id: "slack_webhook_url",
+    placeholderType: "SLACK_WEBHOOK_URL",
+    patternSource: "https:\\/\\/hooks\\.slack\\.com\\/services\\/[A-Za-z0-9/_-]{20,}",
+    flags: "iu",
+    prefilterTerms: ["hooks.slack.com/services", "slack"]
+  },
+  {
+    id: "discord_webhook_url",
+    placeholderType: "DISCORD_WEBHOOK_URL",
+    patternSource: "https:\\/\\/discord(?:app)?\\.com\\/api\\/webhooks\\/\\d+\\/[A-Za-z0-9_-]{16,}",
+    flags: "iu",
+    prefilterTerms: ["discord.com/api/webhooks", "discordapp.com/api/webhooks", "discord"]
+  },
+  {
+    id: "stripe_secret_key",
+    placeholderType: "STRIPE_SECRET_KEY",
+    patternSource: "\\b(?:sk|pk|ak|rk)_(?:live|test)_[A-Za-z0-9]+\\b",
+    flags: "iu",
+    prefilterTerms: [
+      "sk_live_",
+      "pk_live_",
+      "sk_test_",
+      "pk_test_",
+      "ak_live_",
+      "ak_test_",
+      "rk_live_",
+      "rk_test_",
+      "stripe"
+    ]
+  },
+  {
+    id: "google_api_key",
+    placeholderType: "GOOGLE_API_KEY",
+    patternSource: "\\bAIza[0-9A-Za-z_-]{35}\\b",
+    flags: "iu",
+    prefilterTerms: ["aiza", "google"]
+  },
+  {
+    id: "anthropic_api_key",
+    placeholderType: "ANTHROPIC_API_KEY",
+    patternSource: "\\bsk-ant-(?:api\\d{2}-)?[A-Za-z0-9_-]{20,}\\b",
+    flags: "iu",
+    prefilterTerms: ["sk-ant-", "anthropic"]
+  },
+  {
+    id: "evm_private_key",
+    placeholderType: "EVM_PRIVATE_KEY",
+    patternSource: "\\b0x[a-fA-F0-9]{64}\\b",
+    flags: "iu",
+    prefilterTerms: ["0x", "ethereum", "evm", "private key"]
+  },
+  {
+    id: "jwt_token",
+    placeholderType: "JWT_TOKEN",
+    patternSource: "\\beyJ[A-Za-z0-9_-]{6,}\\.[A-Za-z0-9_-]{8,}\\.[A-Za-z0-9_-]{8,}\\b",
+    flags: "iu",
+    prefilterTerms: ["eyj", "jwt", "bearer"]
+  },
+  {
+    id: "bearer_token",
+    placeholderType: "BEARER_TOKEN",
+    patternSource: "\\bauthorization\\b\\s*[:=]\\s*bearer\\s+[A-Za-z0-9._~+\\/-]{16,}|\\bbearer\\s+[A-Za-z0-9._~+\\/-]{24,}",
+    flags: "iu",
+    prefilterTerms: ["authorization", "bearer"]
+  },
+  {
+    id: "api_key_header",
+    placeholderType: "API_KEY_HEADER",
+    patternSource: "\\bx[-_]?api[-_]?key\\b\\s*[:=]\\s*[A-Za-z0-9._~+\\/-]{16,}",
+    flags: "iu",
+    prefilterTerms: ["x-api-key", "api-key", "x_api_key", "api_key"]
+  },
+  {
+    id: "credential_assignment",
+    placeholderType: "CREDENTIAL_ASSIGNMENT",
+    patternSource: `(?:\\b|["'])(?:api(?:[_-]?|\\s+)key|access(?:[_-]?|\\s+)token|auth(?:[_-]?|\\s+)token|client(?:[_-]?|\\s+)secret|private(?:[_-]?|\\s+)key)(?:\\b|["'])\\s*(?::|=|=>)\\s*(?:"[A-Za-z0-9._~+\\/=:-]{16,}"|'[A-Za-z0-9._~+\\/=:-]{16,}'|[A-Za-z0-9._~+\\/=:-]{16,})`,
+    flags: "iu",
+    prefilterTerms: [
+      "api key",
+      "apikey",
+      "api_key",
+      "access token",
+      "access_token",
+      "auth token",
+      "client secret",
+      "private key"
+    ]
+  },
+  {
+    id: "password_assignment",
+    placeholderType: "PASSWORD_ASSIGNMENT",
+    patternSource: `(?:\\b|["'])(?:password|passwd|pwd)(?:\\b|["'])\\s*(?:(?::|=|=>)|(?:is|are|was|were)\\b)\\s*(?:"[A-Za-z0-9._~!@#$%^&*+=\\/-]{8,}"|'[A-Za-z0-9._~!@#$%^&*+=\\/-]{8,}'|[A-Za-z0-9._~!@#$%^&*+=\\/-]{8,})`,
+    flags: "iu",
+    prefilterTerms: ["password", "passwd", "pwd"]
+  },
+  {
+    id: "private_key_material",
+    placeholderType: "PRIVATE_KEY_MATERIAL",
+    patternSource: "-----BEGIN (?:(?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY|PGP PRIVATE KEY BLOCK|CERTIFICATE)-----[\\s\\S]{20,12000}(?:-----END (?:(?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY|PGP PRIVATE KEY BLOCK|CERTIFICATE)-----|$)",
+    flags: "iu",
+    prefilterTerms: ["begin private key", "begin pgp private key block", "private key"]
+  },
+  {
+    id: "azure_connection_string",
+    placeholderType: "AZURE_CONNECTION_STRING",
+    patternSource: "\\bDefaultEndpointsProtocol=https;AccountName=[A-Za-z0-9.-]{3,};AccountKey=[A-Za-z0-9+/=]{20,}(?:;EndpointSuffix=[A-Za-z0-9.-]+)?\\b",
+    flags: "iu",
+    prefilterTerms: ["defaultendpointsprotocol", "accountname", "accountkey", "azure"]
+  },
+  {
+    id: "azure_sas_token",
+    placeholderType: "AZURE_SAS_TOKEN",
+    patternSource: "\\bsv=[^\\s&]{2,}&[^\\s]{0,200}\\bsig=[A-Za-z0-9%/+_-]{16,}",
+    flags: "iu",
+    prefilterTerms: ["sv=", "sig=", "accountkey", "azure"]
+  }
+];
+function ensureGlobalFlag(flags) {
+  const normalized = new Set(flags.split(""));
+  normalized.add("g");
+  return [...normalized].join("");
+}
+var COMPILED_SDK_SECRET_PATTERNS = SDK_SECRET_PATTERN_DEFINITIONS.map((definition) => ({
+  ...definition,
+  scanRegex: new RegExp(definition.patternSource, ensureGlobalFlag(definition.flags)),
+  prefilterTermsLower: definition.prefilterTerms.map((term) => term.toLowerCase())
+}));
+function getSdkSecretDetectionMatchers() {
+  return COMPILED_SDK_SECRET_PATTERNS;
+}
+
 // src/pii.ts
 var defaultScanDeadlineMs = 100;
+var sdkSecretMatchers = getSdkSecretDetectionMatchers();
+var DISCORD_WEBHOOK_TOKEN_RE = /https:\/\/discord(?:app)?\.com\/api\/webhooks\/\d+\/([A-Za-z0-9_-]{16,})/giu;
+var BASIC_AUTH_PASSWORD_RE = /\/\/[^:\s/?#@]+:([^@\s/?#]+)@/giu;
 function countDigits2(value) {
   let count = 0;
   for (const ch of value) {
@@ -917,15 +1082,32 @@ function luhnCheck(value) {
   return sum % 10 === 0;
 }
 function normalizeDetections(text, detections) {
-  const sorted = detections.filter((d) => d.start >= 0 && d.end > d.start && d.end <= text.length).sort((a, b) => a.start - b.start || b.end - b.start - (a.end - a.start));
+  const sorted = detections.filter((d) => d.start >= 0 && d.end > d.start && d.end <= text.length).sort(
+    (a, b) => detectionPriority(b.type) - detectionPriority(a.type) || a.start - b.start || b.end - b.start - (a.end - a.start)
+  );
   const kept = [];
-  let cursor = 0;
   for (const d of sorted) {
-    if (d.start < cursor) continue;
+    if (kept.some((candidate) => rangesOverlap(candidate, d))) continue;
     kept.push(d);
-    cursor = d.end;
   }
-  return kept;
+  return kept.sort((a, b) => a.start - b.start || a.end - b.end);
+}
+function rangesOverlap(left, right) {
+  return left.start < right.end && right.start < left.end;
+}
+function detectionPriority(type) {
+  if (/^(?:OPENAI_API_KEY|AWS_ACCESS_KEY|GITHUB_TOKEN|SLACK_TOKEN|SLACK_WEBHOOK_URL|DISCORD_WEBHOOK_URL|STRIPE_SECRET_KEY|GOOGLE_API_KEY|ANTHROPIC_API_KEY|EVM_PRIVATE_KEY|JWT_TOKEN|BEARER_TOKEN|API_KEY_HEADER|AZURE_CONNECTION_STRING|AZURE_SAS_TOKEN)$/u.test(
+    type
+  )) {
+    return 100;
+  }
+  if (/^(?:CREDENTIAL_ASSIGNMENT|PASSWORD_ASSIGNMENT|PRIVATE_KEY_MATERIAL|ENV_SECRET_ASSIGNMENT)$/u.test(type)) {
+    return 80;
+  }
+  if (type === "PERSON_NAME" || type === "PERSON") {
+    return 10;
+  }
+  return 50;
 }
 var PHONE_CONTEXT_KEYWORDS = [
   "tel",
@@ -960,6 +1142,59 @@ var PHONE_CONTEXT_RE = new RegExp(
   "iu"
 );
 var PERSON_NAME_STOPWORDS = /* @__PURE__ */ new Set([
+  "name",
+  "names",
+  "namen",
+  "firstname",
+  "lastname",
+  "first",
+  "last",
+  "forename",
+  "surname",
+  "family",
+  "given",
+  "jmeno",
+  "jake",
+  "jaky",
+  "jaka",
+  "jsem",
+  "jsme",
+  "napsal",
+  "napsali",
+  "napsala",
+  "napsane",
+  "pouzil",
+  "pouzili",
+  "prijmeni",
+  "vorname",
+  "nachname",
+  "familienname",
+  "what",
+  "which",
+  "whose",
+  "did",
+  "we",
+  "write",
+  "wrote",
+  "written",
+  "type",
+  "typed",
+  "use",
+  "used",
+  "wie",
+  "welchen",
+  "welche",
+  "welches",
+  "haben",
+  "wir",
+  "geschrieben",
+  "getippt",
+  "quel",
+  "quelle",
+  "nom",
+  "que",
+  "cual",
+  "nombre",
   "write",
   "code",
   "script",
@@ -986,6 +1221,52 @@ var PERSON_NAME_STOPWORDS = /* @__PURE__ */ new Set([
   "security",
   "instructions",
   "instruction",
+  "google",
+  "form",
+  "forms",
+  "engineering",
+  "leadership",
+  "weekly",
+  "daily",
+  "monthly",
+  "quarterly",
+  "sync",
+  "office",
+  "updates",
+  "update",
+  "meeting",
+  "meetings",
+  "agenda",
+  "minutes",
+  "subject",
+  "calendar",
+  "roadmap",
+  "platform",
+  "product",
+  "design",
+  "operations",
+  "business",
+  "newsletter",
+  "report",
+  "reports",
+  "amazon",
+  "web",
+  "services",
+  "aws",
+  "velka",
+  "transformace",
+  "project",
+  "projekt",
+  "program",
+  "initiative",
+  "iniciativa",
+  "migration",
+  "migrace",
+  "test",
+  "uuid",
+  "fixture",
+  "data",
+  "firma",
   "rules",
   "rule",
   "json",
@@ -998,10 +1279,22 @@ var PERSON_NAME_STOPWORDS = /* @__PURE__ */ new Set([
   "agentid",
   "risk",
   "score",
-  "summary"
+  "summary",
+  "hi",
+  "hello",
+  "hey",
+  "dear",
+  "team",
+  "ahoj",
+  "dobry",
+  "dobryden",
+  "zdravim"
 ]);
 var TECHNICAL_CONTEXT_WORD_REGEX = /\b(?:curl|http|https|import|python|javascript|typescript|sql|nosql|mongo|database|query|script|code|os\.system|eval|exec|node|npm|api|endpoint|regex|json|xml|yaml|bash|powershell)\b/i;
 var TECHNICAL_CONTEXT_SYMBOL_REGEX = /:\/\/|`|\{|\}|\[|\]|\(|\)|;|\$|=>|::|\/\//;
+var NAME_LABEL_QUESTION_CONTEXT_REGEX = /\b(?:jak(?:e|y|a|ou)|kter(?:e|y|a|ou)|co|what|which|whose|wie|welch(?:e|er|es|en|em)?|quel(?:le|s|les)?|que|cual(?:es)?|wat|welke|jaki|jakie|jaka)\b[\s\S]{0,80}\b(?:jmeno|prijmeni|name|names|namen|nom|nombre|nome|naam|imie|nazwisko|meno)\b[\s\S]{0,96}\b(?:napsal\p{L}*|napsan\p{L}*|psal\p{L}*|pouzil\p{L}*|pouzili\p{L}*|write|wrote|written|type|typed|enter(?:ed)?|use(?:d)?|say|said|geschrieben|getippt|eingetragen|ecrit|escrib\p{L}*|scritt\p{L}*)\b/iu;
+var NAME_VALUE_ASSIGNMENT_BEFORE_CANDIDATE_REGEX = /(?:[:=]|=>|-|\b(?:is|was|je|jsou|jmenuje|called|named|ist|sind|lautet|est|es)\b)\s*$/iu;
+var BIRTH_NUMBER_CONTEXT_RE = /\b(?:rodn[eé]\s*(?:č[ií]slo|cislo)|r\.?\s*c\.?|birth\s+number)\b[^0-9]{0,80}(\d{6}(?:\/?\d{3,4})?)\b/giu;
 function hasPhoneContext(text, matchStartIndex, windowSize = 50) {
   const start = Math.max(0, matchStartIndex - windowSize);
   const windowLower = text.slice(start, matchStartIndex).toLowerCase();
@@ -1018,6 +1311,16 @@ function buildContextWindow(source, index, length) {
 function isTechnicalContext(contextWindow) {
   return TECHNICAL_CONTEXT_WORD_REGEX.test(contextWindow) || TECHNICAL_CONTEXT_SYMBOL_REGEX.test(contextWindow);
 }
+function isNameLabelQuestionContext(contextWindow) {
+  const normalized = normalizePersonWord(contextWindow);
+  if (!normalized.trim()) {
+    return false;
+  }
+  if (!NAME_LABEL_QUESTION_CONTEXT_REGEX.test(normalized)) {
+    return false;
+  }
+  return !NAME_VALUE_ASSIGNMENT_BEFORE_CANDIDATE_REGEX.test(normalized.slice(-32));
+}
 function isLikelyPersonNameCandidate(candidate, contextWindow) {
   const words = candidate.trim().split(/\s+/);
   if (words.length !== 2) {
@@ -1026,6 +1329,9 @@ function isLikelyPersonNameCandidate(candidate, contextWindow) {
   if (isTechnicalContext(contextWindow)) {
     return false;
   }
+  if (isNameLabelQuestionContext(contextWindow)) {
+    return false;
+  }
   for (const rawWord of words) {
     const normalized = normalizePersonWord(rawWord);
     if (normalized.length < 2) {
@@ -1046,63 +1352,135 @@ var PIIManager = class {
    *
    * Zero-dependency fallback with strict checksum validation for CEE national IDs.
    */
-  anonymize(text) {
+  anonymize(text, options) {
     if (!text) return { maskedText: text, mapping: {} };
     try {
       const detections = [];
-      const emailRe = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
-      for (const m of text.matchAll(emailRe)) {
-        if (m.index == null) continue;
-        detections.push({ start: m.index, end: m.index + m[0].length, type: "EMAIL", text: m[0] });
+      const loweredText = text.toLowerCase();
+      const resolvedOptions = {
+        pii: options?.pii !== false,
+        secrets: options?.secrets !== false
+      };
+      if (!resolvedOptions.pii && !resolvedOptions.secrets) {
+        return { maskedText: text, mapping: {} };
       }
-      const ibanRe = /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/gi;
-      for (const m of text.matchAll(ibanRe)) {
-        if (m.index == null) continue;
-        detections.push({ start: m.index, end: m.index + m[0].length, type: "IBAN", text: m[0] });
-      }
-      const ccRe = /(?:\b\d[\d -]{10,22}\d\b)/g;
-      for (const m of text.matchAll(ccRe)) {
-        if (m.index == null) continue;
-        const digits = countDigits2(m[0]);
-        if (digits < 12 || digits > 19) continue;
-        if (!luhnCheck(m[0])) continue;
-        detections.push({ start: m.index, end: m.index + m[0].length, type: "CREDIT_CARD", text: m[0] });
-      }
-      const phoneRe = /(?<!\d)(?:\+?\d[\d\s().-]{7,}\d)(?!\d)/g;
-      for (const m of text.matchAll(phoneRe)) {
-        if (m.index == null) continue;
-        const candidate = m[0];
-        const digits = countDigits2(candidate);
-        if (digits < 9 || digits > 15) continue;
-        const isStrongInternational = candidate.startsWith("+") || candidate.startsWith("00");
-        if (!isStrongInternational) {
-          const hasContext = hasPhoneContext(text, m.index);
-          if (!hasContext) continue;
+      if (resolvedOptions.pii) {
+        const emailRe = /\b[A-Z0-9._%+-]+@[A-Z0-9.-]+\.[A-Z]{2,}\b/gi;
+        for (const m of text.matchAll(emailRe)) {
+          if (m.index == null) continue;
+          detections.push({ start: m.index, end: m.index + m[0].length, type: "EMAIL", text: m[0] });
         }
-        detections.push({ start: m.index, end: m.index + m[0].length, type: "PHONE", text: m[0] });
-      }
-      const personRe = /(?<!\p{L})\p{Lu}\p{Ll}{2,}\s+\p{Lu}\p{Ll}{2,}(?!\p{L})/gu;
-      for (const m of text.matchAll(personRe)) {
-        if (m.index == null) continue;
-        const candidate = m[0];
-        const contextWindow = buildContextWindow(text, m.index, candidate.length);
-        if (!isLikelyPersonNameCandidate(candidate, contextWindow)) {
-          continue;
+        const ibanRe = /\b[A-Z]{2}\d{2}[A-Z0-9]{11,30}\b/gi;
+        for (const m of text.matchAll(ibanRe)) {
+          if (m.index == null) continue;
+          detections.push({ start: m.index, end: m.index + m[0].length, type: "IBAN", text: m[0] });
         }
-        detections.push({ start: m.index, end: m.index + candidate.length, type: "PERSON", text: candidate });
-      }
-      const nationalIdMatches = detectNationalIdentifiers(text, {
-        deadlineMs: defaultScanDeadlineMs,
-        allowContextBirthNumberFallback: false
-      });
-      for (const match of nationalIdMatches) {
-        if (match.start < 0 || match.end <= match.start) continue;
-        detections.push({
-          start: match.start,
-          end: match.end,
-          type: "NATIONAL_ID",
-          text: text.slice(match.start, match.end)
+        const ccRe = /(?:\b\d[\d -]{10,22}\d\b)/g;
+        for (const m of text.matchAll(ccRe)) {
+          if (m.index == null) continue;
+          const digits = countDigits2(m[0]);
+          if (digits < 12 || digits > 19) continue;
+          if (!luhnCheck(m[0])) continue;
+          detections.push({ start: m.index, end: m.index + m[0].length, type: "CREDIT_CARD", text: m[0] });
+        }
+        const phoneRe = /(?<!\d)(?:\+?\d[\d\s().-]{7,}\d)(?!\d)/g;
+        for (const m of text.matchAll(phoneRe)) {
+          if (m.index == null) continue;
+          const candidate = m[0];
+          const digits = countDigits2(candidate);
+          if (digits < 9 || digits > 15) continue;
+          const isStrongInternational = candidate.startsWith("+") || candidate.startsWith("00");
+          if (!isStrongInternational) {
+            const hasContext = hasPhoneContext(text, m.index);
+            if (!hasContext) continue;
+          }
+          detections.push({ start: m.index, end: m.index + m[0].length, type: "PHONE", text: m[0] });
+        }
+        const personRe = /(?<!\p{L})\p{Lu}\p{Ll}{2,}\s+\p{Lu}\p{Ll}{2,}(?!\p{L})/gu;
+        for (const m of text.matchAll(personRe)) {
+          if (m.index == null) continue;
+          const candidate = m[0];
+          const contextWindow = buildContextWindow(text, m.index, candidate.length);
+          if (!isLikelyPersonNameCandidate(candidate, contextWindow)) {
+            continue;
+          }
+          detections.push({ start: m.index, end: m.index + candidate.length, type: "PERSON", text: candidate });
+        }
+        BIRTH_NUMBER_CONTEXT_RE.lastIndex = 0;
+        for (const match of text.matchAll(BIRTH_NUMBER_CONTEXT_RE)) {
+          if (match.index == null) continue;
+          const value = match[1] ?? "";
+          if (!/^\d{6}(?:\/?\d{3,4})?$/.test(value)) continue;
+          const localIndex = match[0].lastIndexOf(value);
+          const start = match.index + Math.max(0, localIndex);
+          detections.push({
+            start,
+            end: start + value.length,
+            type: "BIRTH_NUMBER",
+            text: value
+          });
+        }
+        const nationalIdMatches = detectNationalIdentifiers(text, {
+          deadlineMs: defaultScanDeadlineMs,
+          allowContextBirthNumberFallback: false
         });
+        for (const match of nationalIdMatches) {
+          if (match.start < 0 || match.end <= match.start) continue;
+          detections.push({
+            start: match.start,
+            end: match.end,
+            type: "NATIONAL_ID",
+            text: text.slice(match.start, match.end)
+          });
+        }
+      }
+      if (resolvedOptions.secrets) {
+        BASIC_AUTH_PASSWORD_RE.lastIndex = 0;
+        for (const match of text.matchAll(BASIC_AUTH_PASSWORD_RE)) {
+          if (match.index == null) continue;
+          const password = match[1] ?? "";
+          if (!password) continue;
+          const localIndex = match[0].lastIndexOf(password);
+          const start = match.index + Math.max(0, localIndex);
+          detections.push({
+            start,
+            end: start + password.length,
+            type: "BASIC_AUTH_PASSWORD",
+            text: password
+          });
+        }
+        DISCORD_WEBHOOK_TOKEN_RE.lastIndex = 0;
+        for (const match of text.matchAll(DISCORD_WEBHOOK_TOKEN_RE)) {
+          if (match.index == null) continue;
+          const token = match[1] ?? "";
+          if (!token) continue;
+          const localIndex = match[0].lastIndexOf(token);
+          const start = match.index + Math.max(0, localIndex);
+          detections.push({
+            start,
+            end: start + token.length,
+            type: "DISCORD_WEBHOOK_TOKEN",
+            text: token
+          });
+        }
+        for (const matcher of sdkSecretMatchers) {
+          if (matcher.id === "discord_webhook_url") {
+            continue;
+          }
+          if (matcher.prefilterTermsLower.length > 0 && !matcher.prefilterTermsLower.some((term) => loweredText.includes(term))) {
+            continue;
+          }
+          matcher.scanRegex.lastIndex = 0;
+          for (const match of text.matchAll(matcher.scanRegex)) {
+            if (match.index == null) continue;
+            detections.push({
+              start: match.index,
+              end: match.index + match[0].length,
+              type: matcher.placeholderType,
+              text: match[0]
+            });
+          }
+        }
       }
       const kept = normalizeDetections(text, detections);
       if (!kept.length) return { maskedText: text, mapping: {} };
@@ -1143,6 +1521,109 @@ var CONFIG_TTL_MS = 15 * 1e3;
 var CONFIG_FAILURE_FALLBACK_TTL_MS = 2 * 1e3;
 
 // src/agentid.ts
+function getObjectString(value, ...keys) {
+  for (const key of keys) {
+    const candidate = value?.[key];
+    if (typeof candidate === "string" && candidate.trim().length > 0) {
+      return candidate.trim();
+    }
+  }
+  return void 0;
+}
+function getObjectNumber(value, ...keys) {
+  for (const key of keys) {
+    const candidate = value?.[key];
+    if (typeof candidate === "number" && Number.isFinite(candidate)) {
+      return candidate;
+    }
+    if (typeof candidate === "string" && candidate.trim().length > 0) {
+      const parsed = Number(candidate);
+      if (Number.isFinite(parsed)) {
+        return parsed;
+      }
+    }
+  }
+  return void 0;
+}
+function createAgentIdTelemetryContext(value) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    return void 0;
+  }
+  const raw = { ...value };
+  const normalized = {};
+  const assignString = (key, ...aliases) => {
+    const next = getObjectString(raw, key, ...aliases);
+    if (next) {
+      normalized[key] = next;
+    }
+  };
+  const assignNumber = (key, ...aliases) => {
+    const next = getObjectNumber(raw, key, ...aliases);
+    if (typeof next === "number") {
+      normalized[key] = next;
+    }
+  };
+  assignString("workflow_id", "workflowId");
+  assignString("workflow_run_id", "workflowRunId");
+  assignString("workflow_step_id", "workflowStepId");
+  assignString("workflow_name", "workflowName");
+  assignString("workflow_step_name", "workflowStepName");
+  assignNumber("workflow_step_index", "workflowStepIndex");
+  assignString("parent_event_id", "parentEventId");
+  assignString("tool_name", "toolName");
+  assignString("tool_target", "toolTarget");
+  assignString("tool_target_type", "toolTargetType");
+  assignString("event_title", "eventTitle");
+  assignString("event_status", "eventStatus");
+  assignString("event_category", "eventCategory");
+  assignString("event_subtype", "eventSubtype");
+  const consumedKeys = /* @__PURE__ */ new Set([
+    "workflow_id",
+    "workflowId",
+    "workflow_run_id",
+    "workflowRunId",
+    "workflow_step_id",
+    "workflowStepId",
+    "workflow_name",
+    "workflowName",
+    "workflow_step_name",
+    "workflowStepName",
+    "workflow_step_index",
+    "workflowStepIndex",
+    "parent_event_id",
+    "parentEventId",
+    "tool_name",
+    "toolName",
+    "tool_target",
+    "toolTarget",
+    "tool_target_type",
+    "toolTargetType",
+    "event_title",
+    "eventTitle",
+    "event_status",
+    "eventStatus",
+    "event_category",
+    "eventCategory",
+    "event_subtype",
+    "eventSubtype"
+  ]);
+  for (const [key, entry] of Object.entries(raw)) {
+    if (consumedKeys.has(key) || entry === void 0) {
+      continue;
+    }
+    if (typeof entry === "string") {
+      if (entry.trim().length > 0) {
+        normalized[key] = entry.trim();
+      }
+      continue;
+    }
+    normalized[key] = entry;
+  }
+  if (typeof normalized.workflow_id !== "string" && typeof normalized.workflow_run_id === "string") {
+    normalized.workflow_id = normalized.workflow_run_id;
+  }
+  return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
 var SecurityBlockError = class extends Error {
   constructor(reason = "guard_denied") {
     super(`AgentID: Security Blocked (${reason})`);
@@ -1153,9 +1634,18 @@ var SecurityBlockError = class extends Error {
 
 // src/langchain.ts
 var piiManager = new PIIManager();
+var LANGCHAIN_TELEMETRY_FIELD = "agentid_telemetry";
 function safeString(val) {
   return typeof val === "string" ? val : "";
 }
+function firstNonEmptyString(...values) {
+  for (const value of values) {
+    if (typeof value === "string" && value.trim().length > 0) {
+      return value.trim();
+    }
+  }
+  return void 0;
+}
 function normalizeExpectedLanguages(value) {
   if (!Array.isArray(value)) {
     return void 0;
@@ -1165,6 +1655,121 @@ function normalizeExpectedLanguages(value) {
   )];
   return normalized.length > 0 ? normalized : void 0;
 }
+function isPlainRecord(value) {
+  return Boolean(value && typeof value === "object" && !Array.isArray(value));
+}
+function hasKnownTelemetryField(record) {
+  const knownKeys = [
+    "workflow_id",
+    "workflowId",
+    "workflow_run_id",
+    "workflowRunId",
+    "workflow_step_id",
+    "workflowStepId",
+    "workflow_name",
+    "workflowName",
+    "workflow_step_name",
+    "workflowStepName",
+    "workflow_step_index",
+    "workflowStepIndex",
+    "parent_event_id",
+    "parentEventId",
+    "tool_name",
+    "toolName",
+    "tool_target",
+    "toolTarget",
+    "tool_target_type",
+    "toolTargetType",
+    "event_title",
+    "eventTitle",
+    "event_status",
+    "eventStatus",
+    "event_category",
+    "eventCategory",
+    "event_subtype",
+    "eventSubtype"
+  ];
+  return knownKeys.some((key) => Object.prototype.hasOwnProperty.call(record, key));
+}
+function asTelemetryContext(value) {
+  if (!isPlainRecord(value)) {
+    return void 0;
+  }
+  return createAgentIdTelemetryContext(value);
+}
+function mergeTelemetryContexts(...contexts) {
+  const merged = {};
+  let hasValues = false;
+  for (const context of contexts) {
+    const normalized = createAgentIdTelemetryContext(context);
+    if (!normalized) {
+      continue;
+    }
+    Object.assign(merged, normalized);
+    hasValues = true;
+  }
+  return hasValues ? createAgentIdTelemetryContext(merged) : void 0;
+}
+function extractTelemetryFromRecord(record) {
+  const candidates = [];
+  const add = (value) => {
+    const telemetry = asTelemetryContext(value);
+    if (telemetry) {
+      candidates.push(telemetry);
+    }
+  };
+  add(record[LANGCHAIN_TELEMETRY_FIELD]);
+  add(record.agentidTelemetry);
+  const agentid = record.agentid;
+  if (isPlainRecord(agentid)) {
+    add(agentid.telemetry);
+    add(agentid.telemetryMetadata);
+  }
+  if (hasKnownTelemetryField(record)) {
+    add(record);
+  }
+  return mergeTelemetryContexts(...candidates);
+}
+function extractLangChainTelemetryContext(extraParams) {
+  if (!isPlainRecord(extraParams)) {
+    return void 0;
+  }
+  const contexts = [];
+  const addFromRecord = (record) => {
+    if (!isPlainRecord(record)) {
+      return;
+    }
+    const telemetry = extractTelemetryFromRecord(record);
+    if (telemetry) {
+      contexts.push(telemetry);
+    }
+  };
+  addFromRecord(extraParams);
+  addFromRecord(extraParams.metadata);
+  addFromRecord(extraParams.options);
+  if (isPlainRecord(extraParams.options)) {
+    addFromRecord(extraParams.options.metadata);
+  }
+  addFromRecord(extraParams.invocation_params);
+  if (isPlainRecord(extraParams.invocation_params)) {
+    addFromRecord(extraParams.invocation_params.metadata);
+  }
+  addFromRecord(extraParams.kwargs);
+  if (isPlainRecord(extraParams.kwargs)) {
+    addFromRecord(extraParams.kwargs.metadata);
+  }
+  return mergeTelemetryContexts(...contexts);
+}
+function extractTelemetryFromValues(...values) {
+  const contexts = [];
+  for (const value of values) {
+    const telemetry = extractLangChainTelemetryContext(value);
+    if (telemetry) {
+      contexts.push(telemetry);
+    }
+  }
+  return mergeTelemetryContexts(...contexts);
+}
 function coerceTransparencyMetadata(value) {
   if (!value || typeof value !== "object" || Array.isArray(value)) {
     return void 0;
@@ -1335,6 +1940,40 @@ function extractModel(serialized, kwargs) {
   if (typeof name === "string" && name) return name;
   return void 0;
 }
+function extractToolName(serialized, extras, telemetry) {
+  const serializedRecord = serialized && typeof serialized === "object" ? serialized : void 0;
+  const extraName = extras.find(
+    (value) => typeof value === "string" && value.trim().length > 0
+  );
+  return firstNonEmptyString(
+    telemetry?.tool_name,
+    telemetry?.toolName,
+    serializedRecord?.name,
+    serializedRecord?.id,
+    serializedRecord?.tool_name,
+    serializedRecord?.toolName,
+    extraName
+  );
+}
+function extractWorkflowName(serialized, extras, telemetry) {
+  const serializedRecord = serialized && typeof serialized === "object" ? serialized : void 0;
+  const extraName = extras.find(
+    (value) => typeof value === "string" && value.trim().length > 0
+  );
+  return firstNonEmptyString(
+    telemetry?.workflow_step_name,
+    telemetry?.workflowStepName,
+    telemetry?.workflow_name,
+    telemetry?.workflowName,
+    telemetry?.event_title,
+    telemetry?.eventTitle,
+    serializedRecord?.name,
+    serializedRecord?.id,
+    serializedRecord?.chain_name,
+    serializedRecord?.chainName,
+    extraName
+  );
+}
 function extractModelFromOutput(output) {
   const llmOutput = output?.llmOutput ?? output?.llm_output;
   const llmModel = llmOutput?.model ?? llmOutput?.model_name ?? llmOutput?.modelName;
@@ -1485,22 +2124,28 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
     super();
     this.name = "agentid_callback_handler";
     this.runs = /* @__PURE__ */ new Map();
+    this.toolRuns = /* @__PURE__ */ new Map();
+    this.chainRuns = /* @__PURE__ */ new Map();
     this.agent = agent;
     this.systemId = options.system_id;
     this.expectedLanguages = normalizeExpectedLanguages(
       options.expected_languages ?? options.expectedLanguages
     );
     this.apiKeyOverride = options.apiKey?.trim() || options.api_key?.trim() || void 0;
+    this.telemetry = createAgentIdTelemetryContext(options.telemetry);
   }
   get requestOptions() {
     return this.apiKeyOverride ? { apiKey: this.apiKeyOverride } : void 0;
   }
-  getLangchainCapabilities(piiMaskingEnabled) {
+  getLangchainCapabilities(piiMaskingEnabled, secretMaskingEnabled) {
     const resolvedPiiMaskingEnabled = typeof piiMaskingEnabled === "boolean" ? piiMaskingEnabled : this.agent.getEffectivePiiMasking(this.requestOptions);
+    const agentWithResolvedSecret = this.agent;
+    const resolvedSecretMaskingEnabled = typeof secretMaskingEnabled === "boolean" ? secretMaskingEnabled : typeof agentWithResolvedSecret.getEffectiveSecretMaskingForConfig === "function" ? agentWithResolvedSecret.getEffectiveSecretMaskingForConfig() : false;
     return {
       capabilities: {
         has_feedback_handler: true,
         pii_masking_enabled: resolvedPiiMaskingEnabled,
+        secret_masking_enabled: resolvedSecretMaskingEnabled,
         framework: "langchain"
       }
     };
@@ -1512,15 +2157,76 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
     }
     return this.agent.getEffectivePiiMasking(this.requestOptions);
   }
-  async preflight(input, stream, clientEventId) {
+  resolvePreparedSecretMaskingEnabled(prepared) {
+    const agentWithResolvedConfig = this.agent;
+    if (typeof agentWithResolvedConfig.getEffectiveSecretMaskingForConfig === "function") {
+      return agentWithResolvedConfig.getEffectiveSecretMaskingForConfig(
+        prepared.capabilityConfig
+      );
+    }
+    return false;
+  }
+  async preflight(input, stream, clientEventId, telemetryMetadata) {
     const prepared = await this.agent.prepareInputForDispatch({
       input,
       systemId: this.systemId,
       stream,
-      clientEventId
+      clientEventId,
+      telemetryMetadata
     }, this.requestOptions);
     return prepared;
   }
+  resolveTelemetry(extraParams) {
+    return mergeTelemetryContexts(
+      this.telemetry,
+      extractLangChainTelemetryContext(extraParams)
+    );
+  }
+  resolveParentEventContext(parentRunId) {
+    const parentId = String(parentRunId ?? "");
+    const llmRun = this.runs.get(parentId);
+    if (llmRun) {
+      return {
+        parentEventId: llmRun.clientEventId,
+        piiMaskingEnabled: llmRun.piiMaskingEnabled,
+        secretMaskingEnabled: llmRun.secretMaskingEnabled
+      };
+    }
+    const toolRun = this.toolRuns.get(parentId);
+    if (toolRun) {
+      return {
+        parentEventId: toolRun.startEventId,
+        piiMaskingEnabled: toolRun.piiMaskingEnabled,
+        secretMaskingEnabled: toolRun.secretMaskingEnabled
+      };
+    }
+    const chainRun = this.chainRuns.get(parentId);
+    if (chainRun) {
+      return {
+        parentEventId: chainRun.startEventId,
+        piiMaskingEnabled: chainRun.piiMaskingEnabled,
+        secretMaskingEnabled: chainRun.secretMaskingEnabled
+      };
+    }
+    return {};
+  }
+  async logWorkflowOperation(params, capabilityHints) {
+    const payload = this.agent.buildOperationLogParams({
+      system_id: this.systemId,
+      telemetry: params.telemetry,
+      metadata: params.metadata,
+      event_type: params.event_type,
+      event_status: params.event_status,
+      severity: params.severity,
+      latency: params.latency,
+      client_capabilities: this.getLangchainCapabilities(
+        capabilityHints?.piiMaskingEnabled,
+        capabilityHints?.secretMaskingEnabled
+      )
+    });
+    await this.agent.log(payload, this.requestOptions);
+    return payload;
+  }
   async handleLLMStart(serialized, prompts, runId, _parentRunId, extraParams) {
     const input = extractPromptFromPrompts(prompts);
     const id = String(runId ?? "");
@@ -1530,9 +2236,16 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
     }
     const requestedClientEventId = isUuidLike(id) ? id.trim() : createClientEventId();
     const stream = extractStreamFlag(serialized, extraParams);
-    const prepared = await this.preflight(input, stream, requestedClientEventId);
+    const telemetryMetadata = this.resolveTelemetry(extraParams);
+    const prepared = await this.preflight(
+      input,
+      stream,
+      requestedClientEventId,
+      telemetryMetadata
+    );
     const sanitizedInput = prepared.sanitizedInput;
     const piiMaskingEnabled = this.resolvePreparedPiiMaskingEnabled(prepared);
+    const secretMaskingEnabled = this.resolvePreparedSecretMaskingEnabled(prepared);
     if (sanitizedInput !== input) {
       const mutated = setPromptInPrompts(prompts, sanitizedInput);
       if (!mutated) {
@@ -1549,7 +2262,11 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       model: modelName,
       client_event_id: requestedClientEventId,
       expected_languages: this.expectedLanguages,
-      client_capabilities: this.getLangchainCapabilities(piiMaskingEnabled)
+      metadata: telemetryMetadata,
+      client_capabilities: this.getLangchainCapabilities(
+        piiMaskingEnabled,
+        secretMaskingEnabled
+      )
     }, this.requestOptions);
     let transformedForRun = sanitizedInput;
     let sdkLocalScanMs = prepared.sdkLocalScanMs;
@@ -1564,7 +2281,8 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
           stream,
           clientEventId: requestedClientEventId,
           capabilityConfig: prepared.capabilityConfig,
-          sdkConfigFetchMs: prepared.sdkConfigFetchMs
+          sdkConfigFetchMs: prepared.sdkConfigFetchMs,
+          telemetryMetadata
         }, this.requestOptions);
         transformedForRun = fallback.sanitizedInput;
         sdkLocalScanMs = fallback.sdkLocalScanMs;
@@ -1603,12 +2321,14 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       model: modelName,
       clientEventId: canonicalClientEventId,
       guardEventId,
+      telemetryMetadata,
       transparency,
       piiMapping: normalizePiiMapping(prepared.piiMapping),
       shouldDeanonymize: prepared.shouldDeanonymize === true,
       responseStreamed: stream,
       sdkConfigVersion: prepared.capabilityConfig?.version ?? null,
-      piiMaskingEnabled
+      piiMaskingEnabled,
+      secretMaskingEnabled
     });
     logCallbackDebug("handleLLMStart state_set", {
       runId: id,
@@ -1625,9 +2345,16 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
     }
     const requestedClientEventId = isUuidLike(id) ? id.trim() : createClientEventId();
     const stream = extractStreamFlag(serialized, extraParams);
-    const prepared = await this.preflight(input, stream, requestedClientEventId);
+    const telemetryMetadata = this.resolveTelemetry(extraParams);
+    const prepared = await this.preflight(
+      input,
+      stream,
+      requestedClientEventId,
+      telemetryMetadata
+    );
     const sanitizedInput = prepared.sanitizedInput;
     const piiMaskingEnabled = this.resolvePreparedPiiMaskingEnabled(prepared);
+    const secretMaskingEnabled = this.resolvePreparedSecretMaskingEnabled(prepared);
     if (sanitizedInput !== input) {
       const mutated = setPromptInMessages(messages, sanitizedInput);
       if (!mutated) {
@@ -1644,7 +2371,11 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       model: modelName,
       client_event_id: requestedClientEventId,
       expected_languages: this.expectedLanguages,
-      client_capabilities: this.getLangchainCapabilities(piiMaskingEnabled)
+      metadata: telemetryMetadata,
+      client_capabilities: this.getLangchainCapabilities(
+        piiMaskingEnabled,
+        secretMaskingEnabled
+      )
     }, this.requestOptions);
     let transformedForRun = sanitizedInput;
     let sdkLocalScanMs = prepared.sdkLocalScanMs;
@@ -1659,7 +2390,8 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
           stream,
           clientEventId: requestedClientEventId,
           capabilityConfig: prepared.capabilityConfig,
-          sdkConfigFetchMs: prepared.sdkConfigFetchMs
+          sdkConfigFetchMs: prepared.sdkConfigFetchMs,
+          telemetryMetadata
         }, this.requestOptions);
         transformedForRun = fallback.sanitizedInput;
         sdkLocalScanMs = fallback.sdkLocalScanMs;
@@ -1698,12 +2430,14 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       model: modelName,
       clientEventId: canonicalClientEventId,
       guardEventId,
+      telemetryMetadata,
       transparency,
       piiMapping: normalizePiiMapping(prepared.piiMapping),
       shouldDeanonymize: prepared.shouldDeanonymize === true,
       responseStreamed: stream,
       sdkConfigVersion: prepared.capabilityConfig?.version ?? null,
-      piiMaskingEnabled
+      piiMaskingEnabled,
+      secretMaskingEnabled
     });
     logCallbackDebug("handleChatModelStart state_set", {
       runId: id,
@@ -1731,7 +2465,9 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
     }
     const clientOutputText = extractOutputText(output);
     const usage = extractTokenUsage(output);
-    const metadata = {};
+    const metadata = {
+      ...state.telemetryMetadata ?? {}
+    };
     if (state.clientEventId) {
       metadata.client_event_id = state.clientEventId;
     }
@@ -1767,7 +2503,10 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       usage,
       latency: modelLatencyMs,
       metadata: Object.keys(metadata).length > 0 ? metadata : void 0,
-      client_capabilities: this.getLangchainCapabilities(state.piiMaskingEnabled)
+      client_capabilities: this.getLangchainCapabilities(
+        state.piiMaskingEnabled,
+        state.secretMaskingEnabled
+      )
     }, this.requestOptions);
     logCallbackDebug("handleLLMEnd logged", {
       runId: id,
@@ -1781,6 +2520,7 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
     if (state) this.runs.delete(id);
     const message = err && typeof err === "object" && "message" in err ? String(err.message) : String(err ?? "");
     const metadata = {
+      ...state?.telemetryMetadata ?? {},
       error_message: message
     };
     if (state?.clientEventId) {
@@ -1809,9 +2549,184 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       event_type: "error",
       severity: "error",
       metadata,
-      client_capabilities: this.getLangchainCapabilities(state?.piiMaskingEnabled)
+      client_capabilities: this.getLangchainCapabilities(
+        state?.piiMaskingEnabled,
+        state?.secretMaskingEnabled
+      )
     }, this.requestOptions);
   }
+  async handleToolStart(serialized, _input, runId, parentRunId, ...rest) {
+    const id = String(runId ?? "");
+    const parentContext = this.resolveParentEventContext(parentRunId);
+    const baseTelemetry = extractTelemetryFromValues(...rest);
+    const toolName = extractToolName(serialized, rest, baseTelemetry);
+    const workflowStepId = firstNonEmptyString(baseTelemetry?.workflow_step_id, baseTelemetry?.workflowStepId) ?? createClientEventId();
+    const telemetry = mergeTelemetryContexts(
+      this.telemetry,
+      baseTelemetry,
+      createAgentIdTelemetryContext({
+        workflow_step_id: workflowStepId,
+        parent_event_id: parentContext.parentEventId,
+        tool_name: toolName
+      })
+    );
+    const startedAtMs = Date.now();
+    const payload = await this.logWorkflowOperation(
+      {
+        telemetry,
+        event_type: "start",
+        event_status: "started"
+      },
+      parentContext
+    );
+    this.toolRuns.set(id, {
+      startedAtMs,
+      workflowStepId,
+      startEventId: payload.event_id ?? createClientEventId(),
+      telemetryMetadata: telemetry,
+      piiMaskingEnabled: parentContext.piiMaskingEnabled,
+      secretMaskingEnabled: parentContext.secretMaskingEnabled
+    });
+  }
+  async handleToolEnd(_output, runId) {
+    const id = String(runId ?? "");
+    const state = this.toolRuns.get(id);
+    if (!state) {
+      return;
+    }
+    this.toolRuns.delete(id);
+    await this.logWorkflowOperation(
+      {
+        telemetry: mergeTelemetryContexts(
+          state.telemetryMetadata,
+          createAgentIdTelemetryContext({
+            workflow_step_id: state.workflowStepId,
+            parent_event_id: state.startEventId
+          })
+        ),
+        event_type: "complete",
+        event_status: "completed",
+        latency: Math.max(0, Date.now() - state.startedAtMs)
+      },
+      state
+    );
+  }
+  async handleToolError(err, runId) {
+    const id = String(runId ?? "");
+    const state = this.toolRuns.get(id);
+    if (!state) {
+      return;
+    }
+    this.toolRuns.delete(id);
+    const errorMessage = err instanceof Error ? err.message : typeof err === "undefined" ? "" : String(err);
+    await this.logWorkflowOperation(
+      {
+        telemetry: mergeTelemetryContexts(
+          state?.telemetryMetadata,
+          createAgentIdTelemetryContext({
+            workflow_step_id: state?.workflowStepId,
+            parent_event_id: state?.startEventId
+          })
+        ),
+        metadata: errorMessage.trim().length > 0 ? {
+          error_message: errorMessage.trim(),
+          ...err instanceof Error && err.name ? { error_name: err.name } : {}
+        } : void 0,
+        event_type: "error",
+        event_status: "failed",
+        severity: "error",
+        latency: typeof state?.startedAtMs === "number" ? Math.max(0, Date.now() - state.startedAtMs) : void 0
+      },
+      state
+    );
+  }
+  async handleChainStart(serialized, _inputs, runId, parentRunId, ...rest) {
+    const id = String(runId ?? "");
+    const parentContext = this.resolveParentEventContext(parentRunId);
+    const baseTelemetry = extractTelemetryFromValues(...rest);
+    const workflowName = extractWorkflowName(serialized, rest, baseTelemetry);
+    const workflowStepId = firstNonEmptyString(baseTelemetry?.workflow_step_id, baseTelemetry?.workflowStepId) ?? createClientEventId();
+    const resolvedCategory = firstNonEmptyString(baseTelemetry?.event_category, baseTelemetry?.eventCategory) ?? "workflow";
+    const telemetry = mergeTelemetryContexts(
+      this.telemetry,
+      baseTelemetry,
+      createAgentIdTelemetryContext({
+        workflow_step_id: workflowStepId,
+        workflow_step_name: workflowName,
+        parent_event_id: parentContext.parentEventId,
+        event_category: resolvedCategory
+      })
+    );
+    const startedAtMs = Date.now();
+    const payload = await this.logWorkflowOperation(
+      {
+        telemetry,
+        event_type: "start",
+        event_status: "started"
+      },
+      parentContext
+    );
+    this.chainRuns.set(id, {
+      startedAtMs,
+      workflowStepId,
+      startEventId: payload.event_id ?? createClientEventId(),
+      telemetryMetadata: telemetry,
+      piiMaskingEnabled: parentContext.piiMaskingEnabled,
+      secretMaskingEnabled: parentContext.secretMaskingEnabled
+    });
+  }
+  async handleChainEnd(_outputs, runId) {
+    const id = String(runId ?? "");
+    const state = this.chainRuns.get(id);
+    if (!state) {
+      return;
+    }
+    this.chainRuns.delete(id);
+    await this.logWorkflowOperation(
+      {
+        telemetry: mergeTelemetryContexts(
+          state.telemetryMetadata,
+          createAgentIdTelemetryContext({
+            workflow_step_id: state.workflowStepId,
+            parent_event_id: state.startEventId
+          })
+        ),
+        event_type: "complete",
+        event_status: "completed",
+        latency: Math.max(0, Date.now() - state.startedAtMs)
+      },
+      state
+    );
+  }
+  async handleChainError(err, runId) {
+    const id = String(runId ?? "");
+    const state = this.chainRuns.get(id);
+    if (!state) {
+      return;
+    }
+    this.chainRuns.delete(id);
+    const errorMessage = err instanceof Error ? err.message : typeof err === "undefined" ? "" : String(err);
+    await this.logWorkflowOperation(
+      {
+        telemetry: mergeTelemetryContexts(
+          state.telemetryMetadata,
+          createAgentIdTelemetryContext({
+            workflow_step_id: state.workflowStepId,
+            parent_event_id: state.startEventId
+          })
+        ),
+        metadata: errorMessage.trim().length > 0 ? {
+          error_message: errorMessage.trim(),
+          ...err instanceof Error && err.name ? { error_name: err.name } : {}
+        } : void 0,
+        event_type: "error",
+        event_status: "failed",
+        severity: "error",
+        latency: Math.max(0, Date.now() - state.startedAtMs)
+      },
+      state
+    );
+  }
 };
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {