@chatpanel/gateway 0.6.5 → 0.6.8

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chatpanel/gateway",
-  "version": "0.6.5",
+  "version": "0.6.8",
   "description": "Local privacy gateway — redacts PII out of OpenAI/Anthropic API traffic before it reaches a model, then restores it in the reply. Point opencode, codex, aider, Claude Code, etc. at it.",
   "type": "module",
   "bin": {
@@ -27,7 +27,7 @@
     "node": ">=18"
   },
   "dependencies": {
-    "@chatpanel/pii": "^0.2.6",
+    "@chatpanel/pii": "^0.2.10",
     "@huggingface/transformers": "^4.2.0",
     "onnxruntime-web": "1.26.0-dev.20260416-b7804b056c"
   },

package/src/config.js

@@ -34,14 +34,16 @@ const DEFAULTS = {
   allowedOrigins: [],
   maxBodyBytes: 26214400,
 
-  // Monetization: the gateway is free to try, paid to rely on. Free = deterministic
-  // redaction (basic tier) + a daily request cap. Paste a ChatPanel Pro entitlement
-  // token (the same offline-signed token the extension/bridge use) to unlock
-  // full-tier redaction (NER names/orgs + full dictionary) and unlimited usage.
+  // Monetization: the gateway is free to try, paid to rely on. Free = full-tier
+  // redaction (the real thing — NER names/orgs + dictionary) for a FIXED LIFETIME
+  // allowance (freegate.FREE_TOTAL_CAP redactions), then it stops. Paste a
+  // ChatPanel Pro entitlement token (the same offline-signed token the extension/
+  // bridge use) to unlock unlimited usage. `free.used` is the running lifetime
+  // count (server-authoritative; persisted here so it survives restarts).
   pro: {
     entitlementToken: '',
     free: {
-      maxRequestsPerDay: 25,
+      used: 0,
     },
   },
 

package/src/configstore.js

@@ -5,6 +5,7 @@
 import { writeFileSync, mkdirSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import os from 'node:os';
+import { usage } from './freegate.js';
 
 // Default to a writable per-user location, NOT process.cwd(): when the gateway
 // runs as a login service its cwd is "/" (read-only → EROFS on save).
@@ -45,7 +46,9 @@ export function publicConfig(cfg, { proUnlocked = false } = {}) {
     },
     ner: cfg.ner,
     allowedOrigins: Array.isArray(cfg.allowedOrigins) ? cfg.allowedOrigins : [],
-    pro: { unlocked: proUnlocked, hasToken: !!cfg.pro?.entitlementToken, free: cfg.pro?.free },
+    // free = lifetime trial usage ({ used, cap, remaining }) — read-only; the cap
+    // is fixed and the count is server-authoritative (never settable from the UI).
+    pro: { unlocked: proUnlocked, hasToken: !!cfg.pro?.entitlementToken, free: usage(cfg) },
     logRequests: !!cfg.logRequests,
     logDetail: ['types', 'values'].includes(cfg.logDetail) ? cfg.logDetail : 'off',
     tools: {
@@ -102,8 +105,9 @@ export function applyConfigPatch(cfg, patch = {}) {
   if (Array.isArray(patch.allowedOrigins)) cfg.allowedOrigins = patch.allowedOrigins;
   if (patch.pro && typeof patch.pro === 'object') {
     if (typeof patch.pro.entitlementToken === 'string') cfg.pro.entitlementToken = patch.pro.entitlementToken;
-    const cap = patch.pro.free?.maxRequestsPerDay;
-    if (Number.isFinite(cap) && cap >= 0) cfg.pro.free.maxRequestsPerDay = cap;
+    // NOTE: the free trial is a FIXED lifetime cap (freegate.FREE_TOTAL_CAP) and
+    // its `used` count is server-authoritative — neither is editable here, so a
+    // client can't raise the cap or reset its own trial.
   }
   if (typeof patch.logRequests === 'boolean') cfg.logRequests = patch.logRequests;
   if (['off', 'types', 'values'].includes(patch.logDetail)) cfg.logDetail = patch.logDetail;

package/src/entitlement-refresh.js

@@ -0,0 +1,94 @@
+// Online entitlement re-validation — closes the refund/revoke abuse window.
+//
+// The gateway stores ONE offline-signed entitlement token (pushed once from the
+// extension via POST /config). Verified purely offline (entitlement.js), that token
+// keeps unlocking Pro until its `exp` — up to 7 days — EVEN AFTER the subscription
+// is refunded, cancelled, or the seat is revoked. The extension/bridge avoid this
+// by re-polling the license worker; the gateway didn't, so a refund left unlimited
+// redaction open for the rest of the token's life.
+//
+// So we also re-check ONLINE on an interval: poll the worker's /entitlement for the
+// token's install_id and either
+//   • REFRESH the stored token (still entitled) — so it never lapses while paid, and
+//   • CLEAR it (worker says valid:false → refunded/cancelled/revoked) — dropping the
+//     gateway to Free immediately instead of riding the offline exp.
+// Network/worker errors NEVER revoke (fail-open for paying users); the offline `exp`
+// still bounds the worst case. Bounds post-refund Pro to <= CHECK_INTERVAL_MS.
+
+import { persistConfig, configPath } from './configstore.js';
+
+// Same worker the extension/bridge use. Overridable for self-hosted/test.
+const API_BASE = (process.env.CHATPANEL_API_BASE || 'https://api.chatpanel.net').replace(/\/+$/, '');
+const CHECK_INTERVAL_MS = 60 * 60 * 1000; // 1h — the autonomous post-refund Pro window
+const FIRST_CHECK_DELAY_MS = 30 * 1000;   // let the server settle before first poll
+const MIN_RECHECK_MS = 2 * 60 * 1000;     // throttle on-demand (/status) re-checks
+
+let lastCheckAt = 0;
+
+// The token payload carries { typ, plan, install_id, sub, exp }; we only need the
+// install_id to ask the worker whether that seat is still entitled.
+function installIdFromToken(token) {
+  try {
+    const head = String(token).split('.')[0];
+    const json = Buffer.from(head.replace(/-/g, '+').replace(/_/g, '/'), 'base64').toString('utf8');
+    const p = JSON.parse(json);
+    return typeof p.install_id === 'string' && p.install_id ? p.install_id : null;
+  } catch {
+    return null;
+  }
+}
+
+async function revalidate(cfg) {
+  lastCheckAt = Date.now();
+  const token = cfg.pro?.entitlementToken;
+  if (!token) return;
+  const installId = installIdFromToken(token);
+  if (!installId) return; // legacy/opaque token — leave the offline exp to bound it
+
+  let data;
+  try {
+    const r = await fetch(`${API_BASE}/entitlement?install_id=${encodeURIComponent(installId)}`, {
+      signal: AbortSignal.timeout(8000),
+    });
+    if (!r.ok) return; // worker hiccup → fail-open, retry next interval
+    data = await r.json();
+  } catch {
+    return; // offline / network error → fail-open (never revoke a paying user)
+  }
+
+  if (data && data.valid && typeof data.token === 'string' && data.token) {
+    // Still entitled — adopt the freshly-signed token so Pro never lapses while paid.
+    if (data.token !== token) {
+      cfg.pro.entitlementToken = data.token;
+      try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
+    }
+  } else if (data && data.valid === false) {
+    // Refunded / cancelled / seat revoked → drop Pro NOW (don't wait out the exp).
+    cfg.pro.entitlementToken = '';
+    try { persistConfig(cfg, configPath()); } catch { /* best effort */ }
+    console.log('[gateway] entitlement no longer valid — Pro deactivated (refund/revoke/seat lost).');
+  }
+}
+
+// On-demand, throttled re-check — fire-and-forget from a hot path (the extension's
+// /status poll) so deactivation shows up within ~minutes of opening the gateway
+// tab, not just on the hourly tick. Never awaited; safe to call often.
+export function maybeRevalidate(cfg) {
+  if (process.env.CHATPANEL_NO_REVALIDATE) return;
+  if (!cfg.pro?.entitlementToken) return;
+  if (Date.now() - lastCheckAt < MIN_RECHECK_MS) return;
+  lastCheckAt = Date.now(); // claim the slot before the async hop (avoid stampede)
+  revalidate(cfg).catch(() => {});
+}
+
+// Start the periodic re-check. Timers are unref'd so they never keep the process
+// alive on their own. Returns a handle with stop() for clean shutdown.
+export function startEntitlementRefresh(cfg) {
+  if (process.env.CHATPANEL_NO_REVALIDATE) return { stop() {} };
+  const tick = () => { revalidate(cfg).catch(() => {}); };
+  const first = setTimeout(tick, FIRST_CHECK_DELAY_MS);
+  const iv = setInterval(tick, CHECK_INTERVAL_MS);
+  if (typeof first.unref === 'function') first.unref();
+  if (typeof iv.unref === 'function') iv.unref();
+  return { stop() { clearTimeout(first); clearInterval(iv); } };
+}

package/src/freegate.js

@@ -1,20 +1,28 @@
 // Free vs Pro for the gateway runtime — the "taste" gate.
 //
-// Free (no entitlement token): deterministic redaction only (basic tier) + a
-// capped number of metered requests per day, so anyone can try it. Pro (a valid
-// ChatPanel entitlement token — the same offline-signed token the extension and
-// bridge use) unlocks full-tier redaction (names/orgs via NER + full dictionary)
-// and unlimited usage. The cryptographic check (entitlement.js) means a forked UI
-// can't unlock it — only the configured/paid token does.
+// Free (no entitlement token): full-tier redaction works, but only for a fixed
+// LIFETIME number of redactions (FREE_TOTAL_CAP) — a real trial of the genuine
+// thing, then you buy. Pro (a valid ChatPanel entitlement token — the same
+// offline-signed token the extension and bridge use) unlocks UNLIMITED redaction.
+// The cryptographic check (entitlement.js) means a forked UI can't unlock it —
+// only the configured/paid token does.
+//
+// The cap is LIFETIME (overall), not per-day, and it is NOT user-editable — so a
+// free user gets exactly FREE_TOTAL_CAP genuine redactions, full stop. The count
+// persists in cfg.pro.free.used (written via configstore.persistConfig), so it
+// survives restarts.
 
 import { isProEntitled } from './entitlement.js';
 
+// The lifetime free allowance. Fixed — deliberately NOT configurable.
+export const FREE_TOTAL_CAP = 100;
+
 const proCache = { token: null, val: false };
-const counts = { day: '', n: 0 };
 
-// Today's metered usage — for the gateway's /status (the extension's monitoring).
+// Lifetime free usage — for the gateway's /status (the extension's monitoring).
 export function usage(cfg) {
-  return { day: counts.day, used: counts.n, cap: cfg.pro?.free?.maxRequestsPerDay ?? 25 };
+  const used = Number(cfg.pro?.free?.used) || 0;
+  return { used, cap: FREE_TOTAL_CAP, remaining: Math.max(0, FREE_TOTAL_CAP - used) };
 }
 
 export async function resolvePro(token) {
@@ -26,19 +34,23 @@ export async function resolvePro(token) {
   return val;
 }
 
-// UTC day bucket. (Runtime — Date is available here, unlike workflow scripts.)
-function dayKey() {
-  return new Date().toISOString().slice(0, 10);
+// May this request still redact? Pro = always. Free = allowed until the lifetime
+// cap is reached, then refused so the client gets a clear upsell. This only
+// CHECKS — the count is advanced by consume() AFTER a redaction actually happens,
+// so requests with nothing to redact don't burn the allowance.
+export function checkQuota(cfg, isPro) {
+  if (isPro) return { allowed: true, remaining: Infinity, isPro: true };
+  const used = Number(cfg.pro?.free?.used) || 0;
+  if (used >= FREE_TOTAL_CAP) return { allowed: false, remaining: 0, used, cap: FREE_TOTAL_CAP, isPro: false };
+  return { allowed: true, remaining: FREE_TOTAL_CAP - used, used, cap: FREE_TOTAL_CAP, isPro: false };
 }
 
-// Meter one redactable request. Pro = always allowed. Free = allowed until the
-// daily cap, then refused so the client gets a clear upsell.
-export function meter(cfg, isPro) {
-  if (isPro) return { allowed: true, remaining: Infinity, isPro: true };
-  const cap = cfg.pro?.free?.maxRequestsPerDay ?? 25;
-  const d = dayKey();
-  if (counts.day !== d) { counts.day = d; counts.n = 0; }
-  if (counts.n >= cap) return { allowed: false, remaining: 0, cap, isPro: false };
-  counts.n += 1;
-  return { allowed: true, remaining: cap - counts.n, cap, isPro: false };
+// Record one consumed free redaction (lifetime). No-op for Pro. Mutates cfg so
+// the caller can persist it. Returns the new used count.
+export function consume(cfg, isPro) {
+  if (isPro) return Infinity;
+  cfg.pro = cfg.pro || {};
+  cfg.pro.free = cfg.pro.free || {};
+  cfg.pro.free.used = (Number(cfg.pro.free.used) || 0) + 1;
+  return cfg.pro.free.used;
 }

package/src/redact.js

@@ -8,22 +8,39 @@
 // mapping is self-consistent within the request. (Same reasoning as the
 // extension's pii-pipeline.)
 
-import { createVault, redactText, detectEntities, effectiveTier, gatedDictionary } from '@chatpanel/pii';
+import { createVault, redactText, detectEntities, gatedDictionary, sanitizeUnicode } from '@chatpanel/pii';
 import * as engine from './ner-engine.js';
 
 // tier: 'basic' | 'full'. For 'full' we run the local detector over the combined
 // text to harvest names/orgs, then redact every segment against that entity set.
-// `isPro` applies the SAME free/Pro gating as the extension (shared package):
-// free → deterministic 'basic' tier + a capped dictionary; Pro → full tier.
+//
+// Free vs Pro on the gateway: the free trial is limited by a REQUEST QUOTA
+// (freegate.js), not by downgrading quality — so free users get the REAL tier
+// (names/orgs via NER) within their allowance. The custom dictionary, though, is
+// still a Pro power feature: gatedDictionary caps it to FREE_DICT_LIMIT for free.
 export async function redactSegments(segments, redactionCfg, { signal, isPro = true } = {}) {
   const vault = createVault();
+
+  // De-steganography FIRST (before detection). Invisible/format Unicode is a triple
+  // threat at this boundary: it can split a value so the detector misses it and the
+  // model reassembles real PII (redaction bypass), smuggle a hidden instruction via
+  // Tag chars (ASCII smuggling), or carry a fingerprint/watermark a client injected.
+  // We strip it in place so detection sees clean text and the forwarded request is
+  // clean too. Counted (not silently dropped) so the server can report it.
+  let sanitized = 0;
+  for (const seg of segments) {
+    const before = seg.get();
+    if (typeof before !== 'string' || !before) continue;
+    const { clean, removed } = sanitizeUnicode(before);
+    if (removed) { seg.set(clean); sanitized += removed; }
+  }
+
   const texts = segments.map((s) => s.get()).filter((t) => typeof t === 'string' && t);
-  if (texts.length === 0) return { vault, count: 0 };
+  if (texts.length === 0) return { vault, count: 0, sanitized };
 
-  // effectiveTier downgrades 'full'→'basic' for free; gatedDictionary trims to the
-  // free limit. This reuses chatpanel-pii's gating so the gateway and extension
-  // enforce free/Pro identically.
-  const tier = effectiveTier({ tier: redactionCfg.tier }, isPro);
+  // Use the configured tier as-is (no free downgrade — the quota is the free gate),
+  // but keep the dictionary capped for free via the shared chatpanel-pii gate.
+  const tier = redactionCfg.tier === 'full' ? 'full' : 'basic';
   const dictionary = gatedDictionary(redactionCfg, isPro);
 
   // Detection source: a USER-configured external detector takes precedence; else
@@ -62,7 +79,7 @@ export async function redactSegments(segments, redactionCfg, { signal, isPro = t
     if (after !== before) count++;
     seg.set(after);
   }
-  return { vault, count };
+  return { vault, count, sanitized };
 }
 
 // A `segment` is a tiny getter/setter over wherever the text lives in the parsed

package/src/server.js

@@ -19,23 +19,24 @@
 
 import { createServer } from 'node:http';
 import { loadConfig } from './config.js';
+import { startEntitlementRefresh, maybeRevalidate } from './entitlement-refresh.js';
 import { redactSegments } from './redact.js';
 import { pipeRestoredStream, pipeRestoredOpenAIStream, makeTokenRestorer } from './stream.js';
-import { restoreText, effectiveTier, gatedDictionary, narrowSpecs, makeToolHarness, placeholderToolNote } from '@chatpanel/pii';
+import { restoreText, gatedDictionary, narrowSpecs, makeToolHarness, placeholderToolNote } from '@chatpanel/pii';
 import { streamBridgeChat, readBridgeToken, openBridgeChat } from './bridge.js';
 import { createRelaySession, getRelaySession, endRelaySession, pumpBridgeStream, deliverToolResult, toolsToSpecs, parseToolCallId } from './toolrelay.js';
 import { shaperFor } from './shape.js';
 import { startNer } from './ner.js';
 import * as nerEngine from './ner-engine.js';
 import { MODEL_CATALOG, isKnownModel } from './models.js';
-import { resolvePro, meter, usage } from './freegate.js';
+import { resolvePro, checkQuota, consume, usage } from './freegate.js';
 import { publicConfig, applyConfigPatch, persistConfig, configPath } from './configstore.js';
 import { resolveDestination, aggregateModelsAsync } from './router.js';
 import * as openai from './openai.js';
 import * as responses from './responses.js';
 import * as anthropic from './anthropic.js';
 
-export const VERSION = '0.6.5';
+export const VERSION = '0.6.8';
 
 const KNOWN_AGENTS = new Set(['codex', 'claude', 'opencode', 'pi', 'kiro', 'antigravity']);
 
@@ -136,7 +137,7 @@ function mkTrace(sink) {
       const entry = /** @type {any} */ ({ ...this.meta, timings });
       setImmediate(() => {
         sink(entry);
-        console.log(`[gateway] model=${entry.model || '-'} → ${entry.dest ? `${entry.dest}(${entry.type})` : 'none'} · redacted ${entry.redacted || 0}${entry.narrowed ? ` · narrowed -${entry.narrowed}` : ''} · ${fmtTimings(timings)}`);
+        console.log(`[gateway] model=${entry.model || '-'} → ${entry.dest ? `${entry.dest}(${entry.type})` : 'none'} · redacted ${entry.redacted || 0}${entry.sanitized ? ` · scrubbed ${entry.sanitized} hidden` : ''}${entry.narrowed ? ` · narrowed -${entry.narrowed}` : ''} · ${fmtTimings(timings)}`);
       });
     },
   };
@@ -292,7 +293,9 @@ async function startRelay(req, res, { kind, adapter, agent }, body, vault, cfg,
   const { messages, system } = adapter.toTurn(body);
   const token = readBridgeToken(cfg.bridge.token);
   const shaper = shaperFor(kind, body?.model || agent);
-  const redactOpts = { tier: effectiveTier({ tier: cfg.redaction.tier }, isPro), dictionary: gatedDictionary(cfg.redaction, isPro), entities: [] };
+  // Full tier for everyone here (the free allowance is enforced by the quota gate
+  // in the main handler), but the custom dictionary stays capped for free.
+  const redactOpts = { tier: cfg.redaction.tier === 'full' ? 'full' : 'basic', dictionary: gatedDictionary(cfg.redaction, isPro), entities: [] };
   const s = createRelaySession({ vault, redactOpts, bridgeUrl: cfg.bridge.url, token, harness });
   const ttl = setTimeout(() => endRelaySession(s.id), 135_000); // bridge tool-call timeout is 120s
   // The placeholder note is already in `system` (injected into the body after
@@ -482,6 +485,7 @@ export function createGateway(cfg = loadConfig()) {
 
     // --- Config API (the extension's "Gateway" tab is a client of these) ---
     if (pathname === '/status' && req.method === 'GET') {
+      maybeRevalidate(cfg); // throttled, fire-and-forget: reflect a refund/revoke quickly
       const proUnlocked = await resolvePro(cfg.pro?.entitlementToken);
       const health = await probeNerHealth(cfg); // live GET /health on the detector
       return sendJson(res, 200, {
@@ -609,6 +613,7 @@ export function createGateway(cfg = loadConfig()) {
     let body = null;
     let outBody = raw;
     let redactedCount = 0;
+    let sanitizedCount = 0;
     let narrowedTools = 0;
     let isPro = true;
     // Off the hot path: only build a trace when logging is on, so it adds nothing
@@ -634,12 +639,14 @@ export function createGateway(cfg = loadConfig()) {
           body.tools = narrowSpecs(body.tools, latestUserText(body, r.kind), { cap, keep, name: toolName, description: toolDesc });
           narrowedTools = before - body.tools.length;
         }
-        // Free/Pro gate: meter the request and pick the effective tier.
+        // Free/Pro gate: free users get the REAL thing (full-tier redaction), but
+        // only for a fixed lifetime allowance — checked here, consumed below once a
+        // redaction actually happens. Over the cap → 402 upsell.
         isPro = await resolvePro(cfg.pro?.entitlementToken);
-        const allow = meter(cfg, isPro);
+        const allow = checkQuota(cfg, isPro);
         if (!allow.allowed) {
           return sendJson(res, 402, { error: {
-            message: `ChatPanel Gateway free limit reached (${allow.cap}/day). Add a ChatPanel Pro entitlement token to unlock unlimited usage + full-tier redaction (names/orgs).`,
+            message: `ChatPanel Gateway free trial used up (${allow.cap} redactions). Add a ChatPanel Pro entitlement token to unlock unlimited full-tier redaction (names/orgs).`,
             type: 'free_limit_reached',
           } });
         }
@@ -647,10 +654,20 @@ export function createGateway(cfg = loadConfig()) {
         const ac = new AbortController();
         req.on('close', () => ac.abort());
         const rd0 = trace ? trace.clock() : 0;
-        const { vault: v, count } = await redactSegments(segs, cfg.redaction, { signal: ac.signal, isPro });
+        // Redact at the configured tier for everyone (free users get genuine
+        // name/org redaction within their allowance, not a downgraded preview);
+        // the custom dictionary stays capped for free (isPro decides that inside).
+        const { vault: v, count, sanitized } = await redactSegments(segs, cfg.redaction, { signal: ac.signal, isPro });
         if (trace) trace.lap('redact', rd0);
         vault = v;
         redactedCount = count;
+        sanitizedCount = sanitized || 0;
+        // Burn one lifetime free credit only when we actually redacted something,
+        // then persist so the count survives a restart. (No-op / no write for Pro.)
+        if (!isPro && count > 0) {
+          consume(cfg, isPro);
+          try { persistConfig(cfg, configPath()); } catch { /* best effort — usage is advisory */ }
+        }
         // When tools are armed, tell the model placeholders are auto-restored for
         // tools (so privacy-aware models USE them instead of refusing). Injected
         // AFTER redaction so the note isn't itself redacted. Covers BOTH the API
@@ -672,7 +689,7 @@ export function createGateway(cfg = loadConfig()) {
     // API we forward to). Falls back to the legacy backend when none configured.
     const dest = resolveDestination(body?.model, cfg, r.kind);
     if (trace) {
-      trace.meta = { t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount, narrowed: narrowedTools, detail: redactionDetail(vault, cfg.logDetail) };
+      trace.meta = { t: Date.now(), model: body?.model || null, dest: dest ? dest.id : null, type: dest ? dest.type : null, redacted: redactedCount, sanitized: sanitizedCount, narrowed: narrowedTools, detail: redactionDetail(vault, cfg.logDetail) };
     }
     if (dest && dest.type === 'api') {
       if (!dest.baseUrl) { trace?.commit(); return sendJson(res, 502, { error: `destination "${dest.id}" has no baseUrl` }); }
@@ -689,13 +706,17 @@ export function createGateway(cfg = loadConfig()) {
 export function start(cfg = loadConfig()) {
   const server = createGateway(cfg);
   const ner = startNer(cfg); // may mutate cfg.redaction when it comes up
+  // Re-validate the stored Pro entitlement online on an interval, so a refunded /
+  // revoked subscription drops the gateway to Free instead of riding the offline
+  // token to its exp (see entitlement-refresh.js).
+  const entitlement = startEntitlementRefresh(cfg);
   server.listen(cfg.port, cfg.host, () => {
     console.log(`ChatPanel Privacy Gateway v${VERSION} on http://${cfg.host}:${cfg.port}`);
     console.log(`  backend  : ${cfg.backend}` + (cfg.backend === 'bridge' ? ` (agent: ${cfg.bridge.agent}, via ${cfg.bridge.url})` : ''));
     console.log(`  redaction: ${cfg.redaction.tier}` + (cfg.redaction.detection?.backend && cfg.redaction.detection.backend !== 'off'
       ? ` + ${cfg.redaction.detection.backend} detector` : (cfg.ner?.autostart ? ' (+ NER starting…)' : '')));
   });
-  const shutdown = () => { ner?.stop(); server.close(() => process.exit(0)); };
+  const shutdown = () => { ner?.stop(); entitlement.stop(); server.close(() => process.exit(0)); };
   process.on('SIGINT', shutdown);
   process.on('SIGTERM', shutdown);
   return server;