nduka 1.0.0

package/dist/conversation/secure-tool-natural-language-controller.js

@@ -0,0 +1,634 @@
+import { AIResponseEngine } from '../llm/engine.js';
+import { loadSecureToolManifest } from '../tool-runtime/manifest-loader.js';
+import { SecureToolOrchestrator } from '../tool-runtime/orchestrator.js';
+import { ToolCallPlanner } from '../tool-runtime/planner.js';
+import { SecureToolIdentityService } from '../tool-runtime/identity.js';
+import { evaluateSecureToolAccess } from '../tool-runtime/access-policy.js';
+import { enabledNaturalLanguageTools, hasConfiguredRoutingCue } from './secure-tool-routing.js';
+import { compact, envNumber, maskJid } from './secure-tool-runtime-utils.js';
+const DEFAULT_PENDING_TTL_MS = 10 * 60 * 1000;
+const DEFAULT_COLLECTION_TTL_MS = 10 * 60 * 1000;
+const DEFAULT_FIELD_ATTEMPTS = 3;
+const DEFAULT_UNLINKED_ATTEMPTS = 3;
+const DEFAULT_UNLINKED_WINDOW_MS = 10 * 60 * 1000;
+const DEFAULT_UNLINKED_LOCKOUT_MS = 15 * 60 * 1000;
+const PLANNER_ROUTING_TEXT = 'secure_tool_planner_json_only_no_direct_web_lookup';
+const APPROVAL_RE = /^(yes|y|approve|approved|i approve|confirm|confirmed|ok|okay|go ahead|yes please)$/i;
+const DENIAL_RE = /^(no|n|cancel|stop|never mind|nevermind|do not|don't)$/i;
+function isCandidateMessage(text, quotedText, manifest) {
+    if (!text || text.startsWith('/'))
+        return false;
+    if (enabledNaturalLanguageTools(manifest).length === 0)
+        return false;
+    return hasConfiguredRoutingCue([text, quotedText || ''].join(' '), manifest);
+}
+function filterManifestForNaturalLanguage(manifest) {
+    return { ...manifest, tools: enabledNaturalLanguageTools(manifest) };
+}
+function isSecretKey(key) {
+    return /token|secret|password|passwd|passcode|pin|otp|credential|authorization|apikey|api_key|bearer|private_key|session_key|access_key|refresh_key|client_secret/i.test(key);
+}
+function safeVariables(variables) {
+    if (!variables)
+        return {};
+    const out = {};
+    for (const [key, value] of Object.entries(variables))
+        out[key] = isSecretKey(key) ? '[REDACTED]' : value;
+    return out;
+}
+function profileForPrompt(identity) {
+    if (!identity.profile)
+        return { tenantId: identity.tenantId, linked: false };
+    return {
+        tenantId: identity.tenantId,
+        linked: true,
+        displayName: identity.profile.displayName,
+        variables: safeVariables(identity.profile.variables),
+        allowedTools: identity.profile.allowedTools,
+    };
+}
+function enrichPlannerText(text, quotedText, identity) {
+    const parts = [
+        text,
+        '',
+        'Known customer profile for tool planning only. Secret-looking values are redacted:',
+        JSON.stringify(profileForPrompt(identity)),
+    ];
+    if (quotedText) {
+        parts.push('', 'WhatsApp reply context. The user replied to this previous message:', quotedText);
+    }
+    parts.push('', 'Use tool descriptions and naturalLanguage metadata only.', 'If required details are missing, return clarify with the selected toolName and any non-secret arguments you already know.', 'Never ask for or invent secrets. Secret collection is handled by the host runtime, not the planner.');
+    return parts.join('\n');
+}
+function makePlanner(engine) {
+    return new ToolCallPlanner(async (prompt) => {
+        if (!engine.hasValidKeys())
+            return '{"action":"none","arguments":{},"confidence":0,"reason":"No model keys configured"}';
+        const response = await engine.generateResponse(prompt, [], { suppressThinking: true, routingText: PLANNER_ROUTING_TEXT });
+        return response.text || '';
+    });
+}
+function createOrchestrator(manifest, planner) {
+    return SecureToolOrchestrator.fromManifest(filterManifestForNaturalLanguage(manifest), planner);
+}
+function approvalPromptFor(plan, manifest) {
+    const tool = manifest.tools.find((item) => item.name === plan.toolName);
+    const label = tool?.naturalLanguage?.customerFacingName || plan.toolName || 'this tool';
+    const custom = tool?.naturalLanguage?.approvalPrompt;
+    if (custom)
+        return custom;
+    return `I can check that using ${label}, but I need your approval first.`;
+}
+function isFieldRequired(field, args) {
+    if (field.presence === 'required' || field.presence === 'managed')
+        return true;
+    if (field.presence === 'optional')
+        return false;
+    if (field.presence === 'conditional' && field.requiredWhen) {
+        const value = args[field.requiredWhen.field];
+        if (typeof field.requiredWhen.exists === 'boolean') {
+            const exists = value !== undefined && value !== null && value !== '';
+            if (exists !== field.requiredWhen.exists)
+                return false;
+        }
+        if ('equals' in field.requiredWhen && value !== field.requiredWhen.equals)
+            return false;
+        if ('notEquals' in field.requiredWhen && value === field.requiredWhen.notEquals)
+            return false;
+        return true;
+    }
+    return field.required === true;
+}
+function fieldLabel(fieldName, field) {
+    return field.label || fieldName;
+}
+function fieldPrompt(fieldName, field) {
+    if (field.prompt)
+        return field.prompt;
+    if (field.secret || field.source === 'customer_secret')
+        return `Please send the ${fieldLabel(fieldName, field)} required to continue.`;
+    return `Please send your ${fieldLabel(fieldName, field)} so I can continue.`;
+}
+function fieldMaxAttempts(field) {
+    return typeof field.maxAttempts === 'number' && field.maxAttempts > 0 ? Math.round(field.maxAttempts) : DEFAULT_FIELD_ATTEMPTS;
+}
+function isMissing(value) {
+    return value === undefined || value === null || value === '';
+}
+function fieldCanBeAsked(field) {
+    return field.askIfMissing === true || field.source === 'customer' || field.source === 'customer_secret' || field.source === 'profile_or_customer';
+}
+function matchesFieldType(value, field) {
+    if (field.type === 'string')
+        return true;
+    if (field.type === 'number')
+        return Number.isFinite(Number(value));
+    if (field.type === 'boolean')
+        return /^(true|false|yes|no)$/i.test(value);
+    return true;
+}
+function coerceFieldValue(value, field) {
+    const trimmed = value.trim();
+    if (field.type === 'number')
+        return Number(trimmed);
+    if (field.type === 'boolean')
+        return /^(true|yes)$/i.test(trimmed);
+    return trimmed;
+}
+function validateCollectedField(value, field) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return field.validationMessage || 'That value cannot be empty.';
+    if (!matchesFieldType(trimmed, field))
+        return field.validationMessage || `That value must be a ${field.type}.`;
+    if (typeof field.minLength === 'number' && trimmed.length < field.minLength)
+        return field.validationMessage || 'That value is too short.';
+    if (typeof field.maxLength === 'number' && trimmed.length > field.maxLength)
+        return field.validationMessage || 'That value is too long.';
+    if (field.enum && field.enum.length > 0 && !field.enum.includes(coerceFieldValue(trimmed, field))) {
+        return field.validationMessage || 'That value is not one of the allowed options.';
+    }
+    if (field.validationRegex) {
+        try {
+            const re = new RegExp(field.validationRegex);
+            if (!re.test(trimmed))
+                return field.validationMessage || 'That value does not match the required format.';
+        }
+        catch {
+            return 'This field has an invalid validation rule in the tool config.';
+        }
+    }
+    return null;
+}
+function getPath(value, path) {
+    const normalized = path.replace(/^response\./, '');
+    if (!normalized)
+        return value;
+    let current = value;
+    for (const part of normalized.split('.')) {
+        if (typeof current !== 'object' || current === null || Array.isArray(current))
+            return undefined;
+        current = current[part];
+    }
+    return current;
+}
+export class SecureToolNaturalLanguageController {
+    manifest;
+    identityService;
+    orchestrator;
+    pending = new Map();
+    collections = new Map();
+    dynamicVariables = new Map();
+    unlinkedAttempts = new Map();
+    now;
+    pendingTtlMs;
+    collectionTtlMs;
+    maxUnlinkedAttempts;
+    unlinkedAttemptWindowMs;
+    unlinkedLockoutMs;
+    constructor(options = {}) {
+        const engine = options.engine || new AIResponseEngine();
+        const planner = options.planner || makePlanner(engine);
+        this.manifest = options.manifest || loadSecureToolManifest();
+        this.identityService = options.identityService || new SecureToolIdentityService();
+        this.orchestrator = createOrchestrator(this.manifest, planner);
+        this.now = options.now || (() => Date.now());
+        this.pendingTtlMs = options.pendingTtlMs || DEFAULT_PENDING_TTL_MS;
+        this.collectionTtlMs = options.collectionTtlMs || DEFAULT_COLLECTION_TTL_MS;
+        this.maxUnlinkedAttempts = options.maxUnlinkedAttempts || envNumber('SECURE_TOOL_MAX_UNLINKED_ATTEMPTS', DEFAULT_UNLINKED_ATTEMPTS);
+        this.unlinkedAttemptWindowMs = options.unlinkedAttemptWindowMs || envNumber('SECURE_TOOL_UNLINKED_ATTEMPT_WINDOW_MS', DEFAULT_UNLINKED_WINDOW_MS);
+        this.unlinkedLockoutMs = options.unlinkedLockoutMs || envNumber('SECURE_TOOL_UNLINKED_LOCKOUT_MS', DEFAULT_UNLINKED_LOCKOUT_MS);
+    }
+    async handle(input) {
+        const text = compact(input.text);
+        const quotedText = input.quotedText ? compact(input.quotedText) : undefined;
+        if (!text || input.isOwnerSelfChat || text.startsWith('/'))
+            return null;
+        if (input.isGroup && !enabledNaturalLanguageTools(this.manifest).some((tool) => tool.access?.allowGroups === true))
+            return null;
+        if (enabledNaturalLanguageTools(this.manifest).length === 0)
+            return null;
+        const collection = this.collections.get(input.chatJid);
+        if (collection)
+            return this.handleCollectionReply(input.chatJid, text, collection);
+        const identity = this.identityService.resolve(input.chatJid, input.senderJid);
+        const pending = this.pending.get(input.chatJid);
+        if (pending && pending.expiresAt <= this.now()) {
+            this.pending.delete(input.chatJid);
+            if (APPROVAL_RE.test(text) || DENIAL_RE.test(text)) {
+                return { reply: 'That approval request has expired. Please ask again if you still want me to check it.', shouldStoreInMemory: false };
+            }
+        }
+        if (pending && DENIAL_RE.test(text)) {
+            this.pending.delete(input.chatJid);
+            return { reply: 'Okay, I will not check that.', shouldStoreInMemory: false };
+        }
+        if (pending && APPROVAL_RE.test(text)) {
+            this.grantIdentityTools(identity);
+            if (pending.plan.toolName)
+                this.orchestrator.grantPermission(pending.tenantId, pending.plan.toolName);
+            const executed = await this.orchestrator.executePlan({
+                text: pending.enrichedText,
+                tenantId: pending.tenantId,
+                userId: pending.userId,
+                chatId: pending.chatId,
+                actorRole: 'customer',
+                approved: true,
+            }, pending.plan);
+            this.pending.delete(input.chatJid);
+            if (!executed)
+                return null;
+            return { reply: executed.reply, shouldStoreInMemory: false };
+        }
+        if (pending) {
+            this.pending.delete(input.chatJid);
+        }
+        if (!isCandidateMessage(text, quotedText, this.manifest))
+            return null;
+        const enrichedText = enrichPlannerText(text, quotedText, identity);
+        this.grantIdentityTools(identity);
+        const plan = await this.orchestrator.plan(enrichedText);
+        if (plan.action === 'none')
+            return null;
+        return this.prepareAndRunPlan({
+            chatJid: input.chatJid,
+            senderJid: input.senderJid,
+            userId: input.senderJid || input.chatJid,
+            tenantId: identity.tenantId,
+            enrichedText,
+            plan,
+            identity,
+            isGroup: input.isGroup,
+        });
+    }
+    async handleCollectionReply(chatJid, text, collection) {
+        if (collection.expiresAt <= this.now()) {
+            this.collections.delete(chatJid);
+            return { reply: 'That verification request has expired. Please ask again if you still want me to check it.', shouldStoreInMemory: false };
+        }
+        if (DENIAL_RE.test(text)) {
+            this.collections.delete(chatJid);
+            return { reply: 'Okay, I will not continue that lookup.', shouldStoreInMemory: false };
+        }
+        const tool = this.toolDefinition(collection.toolName);
+        if (!tool) {
+            this.collections.delete(chatJid);
+            return { reply: 'I could not continue because the configured tool is no longer available.', shouldStoreInMemory: false };
+        }
+        const fieldName = collection.missingFields[0];
+        const field = tool.inputSchema[fieldName];
+        const validationError = validateCollectedField(text, field);
+        if (validationError) {
+            collection.attempts[fieldName] = (collection.attempts[fieldName] || 0) + 1;
+            if (collection.attempts[fieldName] >= fieldMaxAttempts(field)) {
+                this.collections.delete(chatJid);
+                return {
+                    reply: [
+                        'I cannot continue this verification right now.',
+                        'Too many invalid attempts were received for the required information.',
+                        'Please contact the business owner if you need help linking or verifying your account.',
+                    ].join('\n'),
+                    shouldStoreInMemory: false,
+                };
+            }
+            return {
+                reply: [
+                    validationError,
+                    fieldPrompt(fieldName, field),
+                    `Attempts remaining: ${fieldMaxAttempts(field) - collection.attempts[fieldName]}`,
+                ].join('\n'),
+                shouldStoreInMemory: false,
+            };
+        }
+        collection.args[fieldName] = coerceFieldValue(text, field);
+        collection.missingFields.shift();
+        if (collection.missingFields.length > 0) {
+            const nextFieldName = collection.missingFields[0];
+            return { reply: fieldPrompt(nextFieldName, tool.inputSchema[nextFieldName]), shouldStoreInMemory: false };
+        }
+        this.collections.delete(chatJid);
+        return this.executePreparedPlan({
+            chatJid: collection.chatId,
+            userId: collection.userId,
+            tenantId: collection.tenantId,
+            enrichedText: collection.enrichedText,
+            plan: {
+                action: 'tool_call',
+                toolName: collection.toolName,
+                arguments: collection.args,
+                confidence: 1,
+                reason: 'Collected required fields from configured slot prompts.',
+            },
+        });
+    }
+    async prepareAndRunPlan(args) {
+        if (!args.plan.toolName) {
+            if (args.plan.action === 'clarify')
+                return { reply: args.plan.reason || 'I need one more detail before I can check that.', shouldStoreInMemory: false };
+            return null;
+        }
+        const tool = this.toolDefinition(args.plan.toolName);
+        if (!tool)
+            return null;
+        const confidenceReply = this.confidenceGate(args.plan, tool);
+        if (confidenceReply === null)
+            return null;
+        if (confidenceReply)
+            return { reply: confidenceReply, shouldStoreInMemory: false };
+        const accessReply = this.accessPolicyReply(args.plan.toolName, args.identity, args.chatJid, args.senderJid, args.isGroup);
+        if (accessReply)
+            return { reply: accessReply, shouldStoreInMemory: false };
+        const verificationReply = this.preSlotVerificationReply(tool, args.identity, args.chatJid);
+        if (verificationReply)
+            return { reply: verificationReply, shouldStoreInMemory: false };
+        const preparedArgs = { ...(args.plan.arguments || {}) };
+        const missingFields = [];
+        for (const [fieldName, field] of Object.entries(tool.inputSchema)) {
+            const resolved = this.resolveConfiguredField({
+                fieldName,
+                field,
+                inputArgs: preparedArgs,
+                identity: args.identity,
+                chatJid: args.chatJid,
+                senderJid: args.senderJid,
+                userId: args.userId,
+                tenantId: args.tenantId,
+            });
+            if (resolved.kind === 'value') {
+                if (isMissing(resolved.value)) {
+                    delete preparedArgs[fieldName];
+                }
+                else {
+                    preparedArgs[fieldName] = resolved.value;
+                }
+                continue;
+            }
+            if (resolved.kind === 'missing_ask') {
+                missingFields.push(fieldName);
+                continue;
+            }
+            if (resolved.kind === 'missing_link') {
+                return { reply: this.unlinkedProfileReply(args.chatJid), shouldStoreInMemory: false };
+            }
+            if (resolved.kind === 'missing_config') {
+                return { reply: resolved.reply, shouldStoreInMemory: false };
+            }
+        }
+        if (missingFields.length > 0) {
+            this.collections.set(args.chatJid, {
+                toolName: tool.name,
+                args: preparedArgs,
+                enrichedText: args.enrichedText,
+                tenantId: args.tenantId,
+                userId: args.userId,
+                chatId: args.chatJid,
+                senderJid: args.senderJid,
+                missingFields,
+                attempts: {},
+                expiresAt: this.now() + this.collectionTtlMs,
+            });
+            const first = missingFields[0];
+            return { reply: fieldPrompt(first, tool.inputSchema[first]), shouldStoreInMemory: false };
+        }
+        return this.executePreparedPlan({
+            chatJid: args.chatJid,
+            userId: args.userId,
+            tenantId: args.tenantId,
+            enrichedText: args.enrichedText,
+            plan: {
+                action: 'tool_call',
+                toolName: tool.name,
+                arguments: preparedArgs,
+                confidence: args.plan.confidence,
+                reason: args.plan.reason,
+            },
+        });
+    }
+    accessPolicyReply(toolName, identity, chatJid, senderJid, isGroup) {
+        if (!toolName)
+            return null;
+        const manifestTool = this.manifest.tools.find((tool) => tool.name === toolName);
+        if (!manifestTool)
+            return null;
+        const decision = evaluateSecureToolAccess({
+            tool: manifestTool,
+            chatJid,
+            senderJid,
+            isGroup,
+            isOwner: false,
+            hasProfile: Boolean(identity.profile),
+        });
+        return decision.allowed ? null : decision.reply || 'This tool is not available for this WhatsApp chat.';
+    }
+    confidenceGate(plan, tool) {
+        const routing = tool.routing || {};
+        const ignoreBelow = routing.ignoreBelow ?? 0.35;
+        const minConfidence = routing.minConfidence ?? routing.clarifyBelow ?? 0.75;
+        if (plan.confidence < ignoreBelow)
+            return null;
+        if (plan.confidence < minConfidence) {
+            return routing.clarificationPrompt || plan.reason || `Do you want me to use ${tool.naturalLanguage?.customerFacingName || tool.name} for this?`;
+        }
+        return undefined;
+    }
+    preSlotVerificationReply(tool, identity, chatJid) {
+        const mode = tool.verification?.mode || 'none';
+        if (mode === 'chat_link' && !identity.profile)
+            return this.unlinkedProfileReply(chatJid);
+        if (mode === 'owner_approval')
+            return 'This request requires business owner approval before I can continue.';
+        return null;
+    }
+    resolveConfiguredField(args) {
+        const { fieldName, field } = args;
+        const required = isFieldRequired(field, args.inputArgs);
+        if (!required && isMissing(args.inputArgs[fieldName]))
+            return { kind: 'value', value: undefined };
+        const source = field.source || 'profile_or_customer';
+        const profileValue = args.identity.profile?.variables?.[fieldName];
+        if (source === 'constant') {
+            if (!isMissing(field.value))
+                return { kind: 'value', value: field.value };
+            return { kind: 'missing_config', reply: `The tool is missing a configured constant for ${fieldName}.` };
+        }
+        if (source === 'env_secret') {
+            if (!field.envName)
+                return { kind: 'missing_config', reply: `The tool is missing envName for ${fieldName}.` };
+            const value = process.env[field.envName];
+            if (!isMissing(value))
+                return { kind: 'value', value };
+            return { kind: 'missing_config', reply: `The tool is missing required environment secret ${field.envName}.` };
+        }
+        if (source === 'system') {
+            const key = field.systemKey || fieldName;
+            const values = {
+                chatJid: args.chatJid,
+                senderJid: args.senderJid,
+                tenantId: args.tenantId,
+                userId: args.userId,
+                timestamp: this.now(),
+            };
+            if (!isMissing(values[key]))
+                return { kind: 'value', value: values[key] };
+            return { kind: 'missing_config', reply: `The tool is missing system value ${String(key)}.` };
+        }
+        if (source === 'dynamic_variable' || source === 'tool_response') {
+            const vars = this.dynamicVariables.get(args.chatJid) || {};
+            const key = field.dynamicVariableName || fieldName;
+            if (!isMissing(vars[key]))
+                return { kind: 'value', value: vars[key] };
+            if (fieldCanBeAsked(field))
+                return { kind: 'missing_ask' };
+            return { kind: 'missing_config', reply: `I need ${fieldName} before I can continue.` };
+        }
+        if (source === 'profile' || source === 'owner_provided') {
+            if (!isMissing(profileValue))
+                return { kind: 'value', value: profileValue };
+            return { kind: 'missing_link' };
+        }
+        if (source === 'customer_secret') {
+            if (fieldCanBeAsked(field))
+                return { kind: 'missing_ask' };
+            return { kind: 'missing_config', reply: `The tool requires ${fieldName}, but it is not configured to ask for it.` };
+        }
+        if (source === 'customer') {
+            if (!field.secret && !isMissing(args.inputArgs[fieldName]))
+                return { kind: 'value', value: args.inputArgs[fieldName] };
+            if (fieldCanBeAsked(field))
+                return { kind: 'missing_ask' };
+            return { kind: 'missing_config', reply: `I need ${fieldName} before I can continue.` };
+        }
+        if (source === 'profile_or_customer') {
+            if (!isMissing(profileValue))
+                return { kind: 'value', value: profileValue };
+            if (!field.secret && !isMissing(args.inputArgs[fieldName]))
+                return { kind: 'value', value: args.inputArgs[fieldName] };
+            if (fieldCanBeAsked(field))
+                return { kind: 'missing_ask' };
+            return { kind: 'missing_link' };
+        }
+        return { kind: 'missing_config', reply: `Unsupported source for ${fieldName}.` };
+    }
+    async executePreparedPlan(args) {
+        if (!args.plan.toolName)
+            return null;
+        const tool = this.toolDefinition(args.plan.toolName);
+        if (tool) {
+            const verification = await this.runVerificationIfNeeded(args, tool.verification);
+            if (verification)
+                return verification;
+        }
+        this.orchestrator.grantPermission(args.tenantId, args.plan.toolName);
+        const result = await this.orchestrator.executePlan({
+            text: args.enrichedText,
+            tenantId: args.tenantId,
+            userId: args.userId,
+            chatId: args.chatJid,
+            actorRole: 'customer',
+            approved: false,
+        }, args.plan);
+        if (!result)
+            return null;
+        if (result.result?.policyDecision === 'confirmation_required' && result.plan?.action === 'tool_call') {
+            this.pending.set(args.chatJid, {
+                plan: result.plan,
+                enrichedText: args.enrichedText,
+                tenantId: args.tenantId,
+                userId: args.userId,
+                chatId: args.chatJid,
+                expiresAt: this.now() + this.pendingTtlMs,
+            });
+            return {
+                reply: [
+                    approvalPromptFor(result.plan, this.manifest),
+                    'Reply yes to approve this lookup, or no to cancel.',
+                ].join('\n'),
+                shouldStoreInMemory: false,
+            };
+        }
+        return { reply: result.reply, shouldStoreInMemory: false };
+    }
+    async runVerificationIfNeeded(args, verification) {
+        const mode = verification?.mode || 'none';
+        if (mode !== 'collect_and_verify' && mode !== 'otp')
+            return null;
+        if (!verification?.verifyWithTool)
+            return { reply: 'This tool requires verification, but no verification tool is configured.', shouldStoreInMemory: false };
+        const sourceArgs = args.plan.arguments || {};
+        const allowedFields = new Set([...(verification.identityFields || []), ...(verification.secretFields || [])]);
+        const verifyArgs = allowedFields.size > 0
+            ? Object.fromEntries(Object.entries(sourceArgs).filter(([key]) => allowedFields.has(key)))
+            : sourceArgs;
+        this.orchestrator.grantPermission(args.tenantId, verification.verifyWithTool);
+        const verificationResult = await this.orchestrator.executePlan({
+            text: args.enrichedText,
+            tenantId: args.tenantId,
+            userId: args.userId,
+            chatId: args.chatJid,
+            actorRole: 'customer',
+            approved: true,
+        }, {
+            action: 'tool_call',
+            toolName: verification.verifyWithTool,
+            arguments: verifyArgs,
+            confidence: 1,
+            reason: 'Configured verification tool.',
+        });
+        if (!verificationResult?.result?.success) {
+            return { reply: 'I could not verify those details. Please check them and try again later.', shouldStoreInMemory: false };
+        }
+        if (verification.onSuccessAssign) {
+            const vars = this.dynamicVariables.get(args.chatJid) || {};
+            for (const [target, source] of Object.entries(verification.onSuccessAssign)) {
+                const value = getPath(verificationResult.result.data, source);
+                if (!isMissing(value))
+                    vars[target.replace(/^(session|dynamic|profile)\./, '')] = value;
+            }
+            this.dynamicVariables.set(args.chatJid, vars);
+        }
+        return null;
+    }
+    toolDefinition(name) {
+        return this.orchestrator.getToolDefinitions().find((tool) => tool.name === name);
+    }
+    unlinkedProfileReply(chatJid) {
+        const now = this.now();
+        const existing = this.unlinkedAttempts.get(chatJid);
+        let state = existing;
+        if (!state || now - state.firstAt > this.unlinkedAttemptWindowMs) {
+            state = { count: 0, firstAt: now };
+        }
+        if (state.lockedUntil && state.lockedUntil > now) {
+            return [
+                'I cannot continue account verification in this chat right now.',
+                `WhatsApp chat clue: ${maskJid(chatJid)}`,
+                'Please contact the business owner to link this chat or verify your account.',
+            ].join('\n');
+        }
+        state.count += 1;
+        if (state.count >= this.maxUnlinkedAttempts)
+            state.lockedUntil = now + this.unlinkedLockoutMs;
+        this.unlinkedAttempts.set(chatJid, state);
+        const remaining = Math.max(0, this.maxUnlinkedAttempts - state.count);
+        if (state.lockedUntil && state.lockedUntil > now) {
+            return [
+                'I cannot verify this account from messages in this chat.',
+                `WhatsApp chat clue: ${maskJid(chatJid)}`,
+                'Verification attempts are now paused. Please contact the business owner to link this chat or verify your account.',
+            ].join('\n');
+        }
+        return [
+            'I can help with that after this WhatsApp chat is linked to a customer profile or the tool is configured to collect verification details.',
+            `WhatsApp chat clue: ${maskJid(chatJid)}`,
+            `Attempts remaining before verification pauses: ${remaining}`,
+            'Please contact the business owner if you need help. For security, do not send account IDs as proof unless this tool is configured to request them.',
+        ].join('\n');
+    }
+    grantIdentityTools(identity) {
+        if (!identity.profile)
+            return;
+        for (const toolName of identity.profile.allowedTools)
+            this.orchestrator.grantPermission(identity.tenantId, toolName);
+    }
+}
+//# sourceMappingURL=secure-tool-natural-language-controller.js.map