@datafog/fogclaw 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,16 @@
 # Changelog
 
+## 0.3.0
+
+### Added
+
+- **PII access request backlog** — agents can request access to redacted data via `fogclaw_request_access`, users review via `fogclaw_requests`, and resolve (approve/deny/follow-up) via `fogclaw_resolve`. Full async workflow with batch resolve support.
+- **RedactionMapStore** — captures placeholder-to-original text mappings from all three scanning hooks, enabling backlog approvals to reveal original data.
+- **Configurable `maxPendingRequests`** — caps the number of pending access requests per session (default: 50). Configurable in `fogclaw.config.json` and `openclaw.plugin.json`.
+- **FIFO eviction for redaction mappings** — `RedactionMapStore` caps at 10,000 entries by default with oldest-first eviction to prevent unbounded PII accumulation in memory.
+- **Access request audit events** — `access_request_created` and `access_request_resolved` structured audit log entries when `auditEnabled: true`. Never includes raw PII.
+- **ARCHITECTURE.md** — top-level architecture document covering components, scanning layers, tools, data flow, and key invariants.
+
 ## 0.2.0
 
 ### Added

package/dist/backlog-tools.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Tool handler factories for the PII access request backlog.
+ *
+ * Three tools:
+ * - fogclaw_request_access: agent submits a request for redacted data
+ * - fogclaw_requests: list/filter backlog requests
+ * - fogclaw_resolve: user approves, denies, or asks follow-up
+ */
+import type { BacklogStore } from "./backlog.js";
+import type { FogClawConfig } from "./types.js";
+interface Logger {
+    info(msg: string): void;
+    warn(msg: string): void;
+}
+interface ToolResponse {
+    content: Array<{
+        type: "text";
+        text: string;
+    }>;
+}
+/**
+ * Create handler for fogclaw_request_access tool.
+ *
+ * Agent calls this when it encounters redacted content and wants
+ * to request access to the original text.
+ */
+export declare function createRequestAccessHandler(backlog: BacklogStore, config: FogClawConfig, logger?: Logger): (params: {
+    placeholder: string;
+    entity_type: string;
+    reason: string;
+    context?: string;
+}) => ToolResponse;
+/**
+ * Create handler for fogclaw_requests tool.
+ *
+ * Lists backlog requests, optionally filtered by status.
+ * For approved requests, includes the original text.
+ */
+export declare function createRequestsListHandler(backlog: BacklogStore, config: FogClawConfig, logger?: Logger): (params: {
+    status?: string;
+}) => ToolResponse;
+/**
+ * Create handler for fogclaw_resolve tool.
+ *
+ * User resolves a request: approve (reveals original text),
+ * deny, or follow_up (asks agent for more context).
+ *
+ * Supports single request_id or batch request_ids.
+ */
+export declare function createResolveHandler(backlog: BacklogStore, config: FogClawConfig, logger?: Logger): (params: {
+    request_id?: string;
+    request_ids?: string[];
+    action: string;
+    message?: string;
+}) => ToolResponse;
+export {};
+//# sourceMappingURL=backlog-tools.d.ts.map

package/dist/backlog-tools.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog-tools.d.ts","sourceRoot":"","sources":["../src/backlog-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,UAAU,MAAM;IACd,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB;AAED,UAAU,YAAY;IACpB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AAYD;;;;;GAKG;AACH,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,MAAM,EAAE;IACV,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,KAAK,YAAY,CA6BjB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,YAAY,CAoD/C;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,YAAY,EACrB,MAAM,EAAE,aAAa,EACrB,MAAM,CAAC,EAAE,MAAM,GACd,CAAC,MAAM,EAAE;IACV,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,KAAK,YAAY,CAkGjB"}

package/dist/backlog-tools.js

@@ -0,0 +1,173 @@
+/**
+ * Tool handler factories for the PII access request backlog.
+ *
+ * Three tools:
+ * - fogclaw_request_access: agent submits a request for redacted data
+ * - fogclaw_requests: list/filter backlog requests
+ * - fogclaw_resolve: user approves, denies, or asks follow-up
+ */
+function jsonResponse(data) {
+    return {
+        content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+    };
+}
+function errorResponse(message) {
+    return jsonResponse({ error: message });
+}
+/**
+ * Create handler for fogclaw_request_access tool.
+ *
+ * Agent calls this when it encounters redacted content and wants
+ * to request access to the original text.
+ */
+export function createRequestAccessHandler(backlog, config, logger) {
+    return (params) => {
+        try {
+            const request = backlog.createRequest(params.placeholder, params.entity_type, params.reason, params.context);
+            if (config.auditEnabled && logger) {
+                logger.info(`[FOGCLAW AUDIT] access_request_created ${JSON.stringify({
+                    request_id: request.id,
+                    entity_type: request.entityType,
+                    source: "backlog",
+                })}`);
+            }
+            return jsonResponse({
+                request_id: request.id,
+                status: request.status,
+                message: `Access request ${request.id} created for ${params.entity_type} entity "${params.placeholder}". A user must review and approve this request before the original text is revealed.`,
+            });
+        }
+        catch (err) {
+            return errorResponse(err.message);
+        }
+    };
+}
+/**
+ * Create handler for fogclaw_requests tool.
+ *
+ * Lists backlog requests, optionally filtered by status.
+ * For approved requests, includes the original text.
+ */
+export function createRequestsListHandler(backlog, config, logger) {
+    return (params) => {
+        const validStatuses = ["pending", "approved", "denied", "follow_up"];
+        const statusFilter = params.status;
+        if (statusFilter && !validStatuses.includes(statusFilter)) {
+            return errorResponse(`Invalid status filter "${params.status}". Must be one of: ${validStatuses.join(", ")}`);
+        }
+        const requests = backlog.listRequests(statusFilter);
+        const items = requests.map((req) => {
+            const item = {
+                id: req.id,
+                placeholder: req.placeholder,
+                entity_type: req.entityType,
+                reason: req.reason,
+                context: req.context,
+                status: req.status,
+                created_at: req.createdAt,
+            };
+            if (req.status === "approved") {
+                item.original_text = req.originalText;
+                item.resolved_at = req.resolvedAt;
+            }
+            if (req.status === "denied") {
+                item.resolved_at = req.resolvedAt;
+                item.response_message = req.responseMessage;
+            }
+            if (req.status === "follow_up") {
+                item.follow_up_message = req.followUpMessage;
+            }
+            return item;
+        });
+        return jsonResponse({
+            requests: items,
+            total: items.length,
+            filter: statusFilter ?? "all",
+        });
+    };
+}
+/**
+ * Create handler for fogclaw_resolve tool.
+ *
+ * User resolves a request: approve (reveals original text),
+ * deny, or follow_up (asks agent for more context).
+ *
+ * Supports single request_id or batch request_ids.
+ */
+export function createResolveHandler(backlog, config, logger) {
+    return (params) => {
+        const validActions = ["approve", "deny", "follow_up"];
+        if (!validActions.includes(params.action)) {
+            return errorResponse(`Invalid action "${params.action}". Must be one of: ${validActions.join(", ")}`);
+        }
+        const action = params.action;
+        // Batch resolve
+        if (params.request_ids && params.request_ids.length > 0) {
+            const results = backlog.resolveMultiple(params.request_ids, action, params.message);
+            if (config.auditEnabled && logger) {
+                for (const r of results) {
+                    if (r.result) {
+                        logger.info(`[FOGCLAW AUDIT] access_request_resolved ${JSON.stringify({
+                            request_id: r.id,
+                            action,
+                            entity_type: r.result.entityType,
+                            source: "backlog",
+                        })}`);
+                    }
+                }
+            }
+            return jsonResponse({
+                results: results.map((r) => {
+                    if (r.error) {
+                        return { id: r.id, error: r.error };
+                    }
+                    const item = {
+                        id: r.id,
+                        status: r.result.status,
+                    };
+                    if (action === "approve") {
+                        item.original_text = r.result.originalText;
+                    }
+                    return item;
+                }),
+                action,
+            });
+        }
+        // Single resolve
+        if (!params.request_id) {
+            return errorResponse("Either request_id or request_ids must be provided.");
+        }
+        try {
+            const resolved = backlog.resolveRequest(params.request_id, action, params.message);
+            if (config.auditEnabled && logger) {
+                logger.info(`[FOGCLAW AUDIT] access_request_resolved ${JSON.stringify({
+                    request_id: resolved.id,
+                    action,
+                    entity_type: resolved.entityType,
+                    source: "backlog",
+                })}`);
+            }
+            const result = {
+                request_id: resolved.id,
+                status: resolved.status,
+            };
+            if (action === "approve") {
+                result.original_text = resolved.originalText;
+                result.message = resolved.originalText
+                    ? `Access approved. Original text: ${resolved.originalText}`
+                    : "Access approved, but original text was not captured during redaction.";
+            }
+            else if (action === "deny") {
+                result.message = params.message ?? "Access denied.";
+            }
+            else if (action === "follow_up") {
+                result.message = `Follow-up question sent to agent: "${params.message ?? ""}"`;
+            }
+            return jsonResponse(result);
+        }
+        catch (err) {
+            return errorResponse(err.message);
+        }
+    };
+}
+//# sourceMappingURL=backlog-tools.js.map

package/dist/backlog-tools.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog-tools.js","sourceRoot":"","sources":["../src/backlog-tools.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,SAAS,YAAY,CAAC,IAAa;IACjC,OAAO;QACL,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,CAAC;KACjE,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,YAAY,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CACxC,OAAqB,EACrB,MAAqB,EACrB,MAAe;IAOf,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CACnC,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,WAAW,EAClB,MAAM,CAAC,MAAM,EACb,MAAM,CAAC,OAAO,CACf,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CACT,0CAA0C,IAAI,CAAC,SAAS,CAAC;oBACvD,UAAU,EAAE,OAAO,CAAC,EAAE;oBACtB,WAAW,EAAE,OAAO,CAAC,UAAU;oBAC/B,MAAM,EAAE,SAAS;iBAClB,CAAC,EAAE,CACL,CAAC;YACJ,CAAC;YAED,OAAO,YAAY,CAAC;gBAClB,UAAU,EAAE,OAAO,CAAC,EAAE;gBACtB,MAAM,EAAE,OAAO,CAAC,MAAM;gBACtB,OAAO,EAAE,kBAAkB,OAAO,CAAC,EAAE,gBAAgB,MAAM,CAAC,WAAW,YAAY,MAAM,CAAC,WAAW,sFAAsF;aAC5L,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CACvC,OAAqB,EACrB,MAAqB,EACrB,MAAe;IAEf,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,aAAa,GAAG,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QACrE,MAAM,YAAY,GAAG,MAAM,CAAC,MAKf,CAAC;QAEd,IAAI,YAAY,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,YAAY,CAAC,EAAE,CAAC;YAC1D,OAAO,aAAa,CAClB,0BAA0B,MAAM,CAAC,MAAM,sBAAsB,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACxF,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAC,YAAY,CAAC,CAAC;QAEpD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACjC,MAAM,IAAI,GAA4B;gBACpC,EAAE,EAAE,GAAG,CAAC,EAAE;gBACV,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,WAAW,EAAE,GAAG,CAAC,UAAU;gBAC3B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,OAAO,EAAE,GAAG,CAAC,OAAO;gBACpB,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,UAAU,EAAE,GAAG,CAAC,SAAS;aAC1B,CAAC;YAEF,IAAI,GAAG,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAC9B,IAAI,CAAC,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC;gBACtC,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC;YACpC,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;gBAC5B,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC;gBAClC,IAAI,CAAC,gBAAgB,GAAG,GAAG,CAAC,eAAe,CAAC;YAC9C,CAAC;YAED,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;gBAC/B,IAAI,CAAC,iBAAiB,GAAG,GAAG,CAAC,eAAe,CAAC;YAC/C,CAAC;YAED,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QAEH,OAAO,YAAY,CAAC;YAClB,QAAQ,EAAE,KAAK;YACf,KAAK,EAAE,KAAK,CAAC,MAAM;YACnB,MAAM,EAAE,YAAY,IAAI,KAAK;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAqB,EACrB,MAAqB,EACrB,MAAe;IAOf,OAAO,CAAC,MAAM,EAAE,EAAE;QAChB,MAAM,YAAY,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QACtD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1C,OAAO,aAAa,CAClB,mBAAmB,MAAM,CAAC,MAAM,sBAAsB,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAChF,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,CAAC,MAA0C,CAAC;QAEjE,gBAAgB;QAChB,IAAI,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxD,MAAM,OAAO,GAAG,OAAO,CAAC,eAAe,CACrC,MAAM,CAAC,WAAW,EAClB,MAAM,EACN,MAAM,CAAC,OAAO,CACf,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;gBAClC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;oBACxB,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;wBACb,MAAM,CAAC,IAAI,CACT,2CAA2C,IAAI,CAAC,SAAS,CAAC;4BACxD,UAAU,EAAE,CAAC,CAAC,EAAE;4BAChB,MAAM;4BACN,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU;4BAChC,MAAM,EAAE,SAAS;yBAClB,CAAC,EAAE,CACL,CAAC;oBACJ,CAAC;gBACH,CAAC;YACH,CAAC;YAED,OAAO,YAAY,CAAC;gBAClB,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACzB,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;wBACZ,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;oBACtC,CAAC;oBACD,MAAM,IAAI,GAA4B;wBACpC,EAAE,EAAE,CAAC,CAAC,EAAE;wBACR,MAAM,EAAE,CAAC,CAAC,MAAO,CAAC,MAAM;qBACzB,CAAC;oBACF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;wBACzB,IAAI,CAAC,aAAa,GAAG,CAAC,CAAC,MAAO,CAAC,YAAY,CAAC;oBAC9C,CAAC;oBACD,OAAO,IAAI,CAAC;gBACd,CAAC,CAAC;gBACF,MAAM;aACP,CAAC,CAAC;QACL,CAAC;QAED,iBAAiB;QACjB,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;YACvB,OAAO,aAAa,CAClB,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,CACrC,MAAM,CAAC,UAAU,EACjB,MAAM,EACN,MAAM,CAAC,OAAO,CACf,CAAC;YAEF,IAAI,MAAM,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;gBAClC,MAAM,CAAC,IAAI,CACT,2CAA2C,IAAI,CAAC,SAAS,CAAC;oBACxD,UAAU,EAAE,QAAQ,CAAC,EAAE;oBACvB,MAAM;oBACN,WAAW,EAAE,QAAQ,CAAC,UAAU;oBAChC,MAAM,EAAE,SAAS;iBAClB,CAAC,EAAE,CACL,CAAC;YACJ,CAAC;YAED,MAAM,MAAM,GAA4B;gBACtC,UAAU,EAAE,QAAQ,CAAC,EAAE;gBACvB,MAAM,EAAE,QAAQ,CAAC,MAAM;aACxB,CAAC;YAEF,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,MAAM,CAAC,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC;gBAC7C,MAAM,CAAC,OAAO,GAAG,QAAQ,CAAC,YAAY;oBACpC,CAAC,CAAC,mCAAmC,QAAQ,CAAC,YAAY,EAAE;oBAC5D,CAAC,CAAC,uEAAuE,CAAC;YAC9E,CAAC;iBAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBAC7B,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,gBAAgB,CAAC;YACtD,CAAC;iBAAM,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;gBAClC,MAAM,CAAC,OAAO,GAAG,sCAAsC,MAAM,CAAC,OAAO,IAAI,EAAE,GAAG,CAAC;YACjF,CAAC;YAED,OAAO,YAAY,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,aAAa,CAAE,GAAa,CAAC,OAAO,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/backlog.d.ts

@@ -0,0 +1,82 @@
+/**
+ * In-memory backlog store for PII access requests.
+ *
+ * RedactionMapStore captures placeholder → original text mappings from hooks.
+ * BacklogStore manages the access request lifecycle (create, list, resolve).
+ *
+ * Both are session-scoped: state lives in runtime memory only and is
+ * discarded when the process exits.
+ */
+import type { AccessRequest, RequestStatus } from "./types.js";
+/**
+ * Stores redaction mappings from hook handlers so that access request
+ * approvals can retrieve the original pre-redaction text.
+ *
+ * Each time a hook redacts text, it calls addMapping() with the
+ * redactor's mapping (placeholder → original). When an access request
+ * is approved, the backlog looks up the original text here.
+ */
+export declare class RedactionMapStore {
+    private store;
+    private maxMappings;
+    constructor(maxMappings?: number);
+    /** Merge new placeholder → original entries into the store. */
+    addMapping(mapping: Record<string, string>): void;
+    /** Look up the original text for a redacted placeholder. */
+    getOriginal(placeholder: string): string | undefined;
+    /** Reset all stored mappings. */
+    clear(): void;
+    /** Number of stored mappings. */
+    get size(): number;
+    /** Evict oldest entries (FIFO by Map insertion order) when over capacity. */
+    private evict;
+}
+/**
+ * Manages PII access requests throughout their lifecycle.
+ *
+ * Requests transition through: pending → approved | denied | follow_up.
+ * A follow_up request can later be resolved to approved or denied.
+ */
+export declare class BacklogStore {
+    private requests;
+    private counter;
+    private redactionMap;
+    private maxPending;
+    constructor(redactionMap: RedactionMapStore, maxPending?: number);
+    /** Number of pending requests. */
+    get pendingCount(): number;
+    /** Total number of requests in any status. */
+    get totalCount(): number;
+    /**
+     * Create a new access request.
+     *
+     * Looks up the original text from the RedactionMapStore automatically.
+     * Throws if the pending request limit is reached.
+     */
+    createRequest(placeholder: string, entityType: string, reason: string, context?: string): AccessRequest;
+    /** Get a single request by ID. */
+    getRequest(id: string): AccessRequest | undefined;
+    /** List requests, optionally filtered by status. */
+    listRequests(statusFilter?: RequestStatus): AccessRequest[];
+    /**
+     * Resolve a single request.
+     *
+     * - approve: marks as approved, stores response message
+     * - deny: marks as denied, stores response message
+     * - follow_up: marks as follow_up, stores the follow-up question
+     *
+     * A follow_up request can be resolved again to approved or denied.
+     * Throws if request not found or already in a terminal state (approved/denied).
+     */
+    resolveRequest(id: string, action: "approve" | "deny" | "follow_up", message?: string): AccessRequest;
+    /**
+     * Resolve multiple requests with the same action.
+     * Returns an array of results (resolved request or error message per ID).
+     */
+    resolveMultiple(ids: string[], action: "approve" | "deny" | "follow_up", message?: string): Array<{
+        id: string;
+        result: AccessRequest | null;
+        error: string | null;
+    }>;
+}
+//# sourceMappingURL=backlog.d.ts.map

package/dist/backlog.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog.d.ts","sourceRoot":"","sources":["../src/backlog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAE/D;;;;;;;GAOG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,WAAW,CAAS;gBAEhB,WAAW,SAAS;IAIhC,+DAA+D;IAC/D,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI;IAOjD,4DAA4D;IAC5D,WAAW,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIpD,iCAAiC;IACjC,KAAK,IAAI,IAAI;IAIb,iCAAiC;IACjC,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,6EAA6E;IAC7E,OAAO,CAAC,KAAK;CASd;AAED;;;;;GAKG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,QAAQ,CAAoC;IACpD,OAAO,CAAC,OAAO,CAAK;IACpB,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,UAAU,CAAS;gBAEf,YAAY,EAAE,iBAAiB,EAAE,UAAU,SAAK;IAK5D,kCAAkC;IAClC,IAAI,YAAY,IAAI,MAAM,CAMzB;IAED,8CAA8C;IAC9C,IAAI,UAAU,IAAI,MAAM,CAEvB;IAED;;;;;OAKG;IACH,aAAa,CACX,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE,MAAM,GACf,aAAa;IA6BhB,kCAAkC;IAClC,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIjD,oDAAoD;IACpD,YAAY,CAAC,YAAY,CAAC,EAAE,aAAa,GAAG,aAAa,EAAE;IAM3D;;;;;;;;;OASG;IACH,cAAc,CACZ,EAAE,EAAE,MAAM,EACV,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,aAAa;IA0BhB;;;OAGG;IACH,eAAe,CACb,GAAG,EAAE,MAAM,EAAE,EACb,MAAM,EAAE,SAAS,GAAG,MAAM,GAAG,WAAW,EACxC,OAAO,CAAC,EAAE,MAAM,GACf,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC;CAU7E"}

package/dist/backlog.js

@@ -0,0 +1,169 @@
+/**
+ * In-memory backlog store for PII access requests.
+ *
+ * RedactionMapStore captures placeholder → original text mappings from hooks.
+ * BacklogStore manages the access request lifecycle (create, list, resolve).
+ *
+ * Both are session-scoped: state lives in runtime memory only and is
+ * discarded when the process exits.
+ */
+/**
+ * Stores redaction mappings from hook handlers so that access request
+ * approvals can retrieve the original pre-redaction text.
+ *
+ * Each time a hook redacts text, it calls addMapping() with the
+ * redactor's mapping (placeholder → original). When an access request
+ * is approved, the backlog looks up the original text here.
+ */
+export class RedactionMapStore {
+    store = new Map();
+    maxMappings;
+    constructor(maxMappings = 10_000) {
+        this.maxMappings = maxMappings;
+    }
+    /** Merge new placeholder → original entries into the store. */
+    addMapping(mapping) {
+        for (const [placeholder, original] of Object.entries(mapping)) {
+            this.store.set(placeholder, original);
+        }
+        this.evict();
+    }
+    /** Look up the original text for a redacted placeholder. */
+    getOriginal(placeholder) {
+        return this.store.get(placeholder);
+    }
+    /** Reset all stored mappings. */
+    clear() {
+        this.store.clear();
+    }
+    /** Number of stored mappings. */
+    get size() {
+        return this.store.size;
+    }
+    /** Evict oldest entries (FIFO by Map insertion order) when over capacity. */
+    evict() {
+        if (this.store.size <= this.maxMappings)
+            return;
+        const excess = this.store.size - this.maxMappings;
+        const iter = this.store.keys();
+        for (let i = 0; i < excess; i++) {
+            const key = iter.next().value;
+            if (key !== undefined)
+                this.store.delete(key);
+        }
+    }
+}
+/**
+ * Manages PII access requests throughout their lifecycle.
+ *
+ * Requests transition through: pending → approved | denied | follow_up.
+ * A follow_up request can later be resolved to approved or denied.
+ */
+export class BacklogStore {
+    requests = new Map();
+    counter = 0;
+    redactionMap;
+    maxPending;
+    constructor(redactionMap, maxPending = 50) {
+        this.redactionMap = redactionMap;
+        this.maxPending = maxPending;
+    }
+    /** Number of pending requests. */
+    get pendingCount() {
+        let count = 0;
+        for (const req of this.requests.values()) {
+            if (req.status === "pending" || req.status === "follow_up")
+                count++;
+        }
+        return count;
+    }
+    /** Total number of requests in any status. */
+    get totalCount() {
+        return this.requests.size;
+    }
+    /**
+     * Create a new access request.
+     *
+     * Looks up the original text from the RedactionMapStore automatically.
+     * Throws if the pending request limit is reached.
+     */
+    createRequest(placeholder, entityType, reason, context) {
+        if (this.pendingCount >= this.maxPending) {
+            throw new Error(`Maximum pending requests reached (${this.maxPending}). Resolve existing requests before submitting new ones.`);
+        }
+        this.counter++;
+        const id = `REQ-${this.counter}`;
+        const originalText = this.redactionMap.getOriginal(placeholder) ?? null;
+        const request = {
+            id,
+            placeholder,
+            entityType,
+            originalText,
+            reason,
+            context: context ?? null,
+            status: "pending",
+            createdAt: new Date().toISOString(),
+            resolvedAt: null,
+            followUpMessage: null,
+            responseMessage: null,
+        };
+        this.requests.set(id, request);
+        return request;
+    }
+    /** Get a single request by ID. */
+    getRequest(id) {
+        return this.requests.get(id);
+    }
+    /** List requests, optionally filtered by status. */
+    listRequests(statusFilter) {
+        const all = Array.from(this.requests.values());
+        if (!statusFilter)
+            return all;
+        return all.filter((req) => req.status === statusFilter);
+    }
+    /**
+     * Resolve a single request.
+     *
+     * - approve: marks as approved, stores response message
+     * - deny: marks as denied, stores response message
+     * - follow_up: marks as follow_up, stores the follow-up question
+     *
+     * A follow_up request can be resolved again to approved or denied.
+     * Throws if request not found or already in a terminal state (approved/denied).
+     */
+    resolveRequest(id, action, message) {
+        const request = this.requests.get(id);
+        if (!request) {
+            throw new Error(`Request "${id}" not found.`);
+        }
+        if (request.status === "approved" || request.status === "denied") {
+            throw new Error(`Request "${id}" is already ${request.status}. Cannot resolve again.`);
+        }
+        const now = new Date().toISOString();
+        if (action === "follow_up") {
+            request.status = "follow_up";
+            request.followUpMessage = message ?? null;
+            return request;
+        }
+        request.status = action === "approve" ? "approved" : "denied";
+        request.resolvedAt = now;
+        request.responseMessage = message ?? null;
+        return request;
+    }
+    /**
+     * Resolve multiple requests with the same action.
+     * Returns an array of results (resolved request or error message per ID).
+     */
+    resolveMultiple(ids, action, message) {
+        return ids.map((id) => {
+            try {
+                const resolved = this.resolveRequest(id, action, message);
+                return { id, result: resolved, error: null };
+            }
+            catch (err) {
+                return { id, result: null, error: err.message };
+            }
+        });
+    }
+}
+//# sourceMappingURL=backlog.js.map

package/dist/backlog.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"backlog.js","sourceRoot":"","sources":["../src/backlog.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IACpB,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IAClC,WAAW,CAAS;IAE5B,YAAY,WAAW,GAAG,MAAM;QAC9B,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;IACjC,CAAC;IAED,+DAA+D;IAC/D,UAAU,CAAC,OAA+B;QACxC,KAAK,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9D,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QACxC,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,4DAA4D;IAC5D,WAAW,CAAC,WAAmB;QAC7B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;IACrC,CAAC;IAED,iCAAiC;IACjC,KAAK;QACH,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;IAED,iCAAiC;IACjC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC;IACzB,CAAC;IAED,6EAA6E;IACrE,KAAK;QACX,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,IAAI,CAAC,WAAW;YAAE,OAAO;QAChD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC;QAClD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;QAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9B,IAAI,GAAG,KAAK,SAAS;gBAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;CACF;AAED;;;;;GAKG;AACH,MAAM,OAAO,YAAY;IACf,QAAQ,GAAG,IAAI,GAAG,EAAyB,CAAC;IAC5C,OAAO,GAAG,CAAC,CAAC;IACZ,YAAY,CAAoB;IAChC,UAAU,CAAS;IAE3B,YAAY,YAA+B,EAAE,UAAU,GAAG,EAAE;QAC1D,IAAI,CAAC,YAAY,GAAG,YAAY,CAAC;QACjC,IAAI,CAAC,UAAU,GAAG,UAAU,CAAC;IAC/B,CAAC;IAED,kCAAkC;IAClC,IAAI,YAAY;QACd,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,CAAC;YACzC,IAAI,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW;gBAAE,KAAK,EAAE,CAAC;QACtE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,8CAA8C;IAC9C,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC;IAC5B,CAAC;IAED;;;;;OAKG;IACH,aAAa,CACX,WAAmB,EACnB,UAAkB,EAClB,MAAc,EACd,OAAgB;QAEhB,IAAI,IAAI,CAAC,YAAY,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,qCAAqC,IAAI,CAAC,UAAU,0DAA0D,CAC/G,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,MAAM,EAAE,GAAG,OAAO,IAAI,CAAC,OAAO,EAAE,CAAC;QACjC,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAExE,MAAM,OAAO,GAAkB;YAC7B,EAAE;YACF,WAAW;YACX,UAAU;YACV,YAAY;YACZ,MAAM;YACN,OAAO,EAAE,OAAO,IAAI,IAAI;YACxB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,IAAI;YACrB,eAAe,EAAE,IAAI;SACtB,CAAC;QAEF,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,kCAAkC;IAClC,UAAU,CAAC,EAAU;QACnB,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,oDAAoD;IACpD,YAAY,CAAC,YAA4B;QACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/C,IAAI,CAAC,YAAY;YAAE,OAAO,GAAG,CAAC;QAC9B,OAAO,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,YAAY,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;OASG;IACH,cAAc,CACZ,EAAU,EACV,MAAwC,EACxC,OAAgB;QAEhB,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,OAAO,EAAE,CAAC;YACb,MAAM,IAAI,KAAK,CAAC,YAAY,EAAE,cAAc,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,YAAY,EAAE,gBAAgB,OAAO,CAAC,MAAM,yBAAyB,CACtE,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;QAErC,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;YAC3B,OAAO,CAAC,MAAM,GAAG,WAAW,CAAC;YAC7B,OAAO,CAAC,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC;YAC1C,OAAO,OAAO,CAAC;QACjB,CAAC;QAED,OAAO,CAAC,MAAM,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9D,OAAO,CAAC,UAAU,GAAG,GAAG,CAAC;QACzB,OAAO,CAAC,eAAe,GAAG,OAAO,IAAI,IAAI,CAAC;QAC1C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED;;;OAGG;IACH,eAAe,CACb,GAAa,EACb,MAAwC,EACxC,OAAgB;QAEhB,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE;YACpB,IAAI,CAAC;gBACH,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;YAC/C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAG,GAAa,CAAC,OAAO,EAAE,CAAC;YAC7D,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAoGpB,eAAO,MAAM,cAAc,EAAE,aAe5B,CAAC;AAEF,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CA2D3E"}
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAGL,KAAK,aAAa,EAGnB,MAAM,YAAY,CAAC;AAoGpB,eAAO,MAAM,cAAc,EAAE,aAgB5B,CAAC;AAEF,wBAAgB,UAAU,CAAC,SAAS,EAAE,OAAO,CAAC,aAAa,CAAC,GAAG,aAAa,CAqE3E"}

package/dist/config.js

@@ -84,6 +84,7 @@ export const DEFAULT_CONFIG = {
         entities: {},
     },
     auditEnabled: true,
+    maxPendingRequests: 50,
 };
 export function loadConfig(overrides) {
     const config = {
@@ -115,6 +116,11 @@ export function loadConfig(overrides) {
     if (typeof config.auditEnabled !== "boolean") {
         throw new Error(`auditEnabled must be true or false`);
     }
+    if (typeof config.maxPendingRequests !== "number" ||
+        !Number.isInteger(config.maxPendingRequests) ||
+        config.maxPendingRequests < 1) {
+        throw new Error(`maxPendingRequests must be a positive integer, got ${String(config.maxPendingRequests)}`);
+    }
     const normalizedActions = {};
     for (const [entityType, action] of Object.entries(config.entityActions)) {
         if (!VALID_GUARDRAIL_MODES.includes(action)) {

package/dist/config.js.map

@@ -1 +1 @@
-{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAKd,MAAM,YAAY,CAAC;AAEpB,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,uBAAuB,GAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5E,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAE5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5B,aAAa,KAAK,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,QAAQ,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,sBAAsB,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,KAAc;IAEd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,4CAA4C,MAAM,CACzF,YAAY,CACb,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,mCAAmC,YAAY,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACnD,UAAU,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,QAAQ;IACxB,cAAc,EAAE,OAAO;IACvB,KAAK,EAAE,kCAAkC;IACzC,oBAAoB,EAAE,GAAG;IACzB,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,EAAE;IACjB,0BAA0B,EAAE,EAAE;IAC9B,SAAS,EAAE;QACT,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;KACb;IACD,YAAY,EAAE,IAAI;CACnB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,SAAiC;IAC1D,MAAM,MAAM,GAAkB;QAC5B,GAAG,cAAc;QACjB,GAAG,SAAS;QACZ,aAAa,EAAE;YACb,GAAG,cAAc,CAAC,aAAa;YAC/B,GAAG,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC;SACnC;QACD,0BAA0B,EAAE;YAC1B,GAAG,cAAc,CAAC,0BAA0B;YAC5C,GAAG,CAAC,SAAS,CAAC,0BAA0B,IAAI,EAAE,CAAC;SAChD;KACF,CAAC;IAEF,MAAM,CAAC,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,CAAC,0BAA0B,GAAG,gCAAgC,CAClE,MAAM,CAAC,0BAA0B,CAClC,CAAC;IAEF,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,oBAAoB,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,iBAAiB,GAAoC,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,sBAAsB,UAAU,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,iBAAiB,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,aAAa,GAAG,iBAAiB,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,GAKd,MAAM,YAAY,CAAC;AAEpB,MAAM,qBAAqB,GAAsB,CAAC,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,uBAAuB,GAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAE5E,SAAS,gBAAgB,CAAC,KAAc,EAAE,IAAY;IACpD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,8BAA8B,CAAC,CAAC;IACzD,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE;QACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,GAAG,IAAI,4BAA4B,CAAC,CAAC;QACvD,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClF,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAc;IAC3C,IAAI,KAAK,IAAI,IAAI,EAAE,CAAC;QAClB,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IACpD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,kBAAkB,CAAC,CAAC;IACtE,MAAM,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,EAAE,oBAAoB,CAAC,CAAC;IAE5E,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,IAAI,MAAM,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,uDAAuD,OAAO,GAAG,CAAC,CAAC;QACrF,CAAC;IACH,CAAC;IAED,MAAM,aAAa,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACzC,IACE,OAAO,aAAa,KAAK,QAAQ;QACjC,KAAK,CAAC,OAAO,CAAC,aAAa,CAAC;QAC5B,aAAa,KAAK,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6EAA6E,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC;QACrE,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,QAAQ,CAAC,cAAc,CAAC,GAAG,gBAAgB,CAAC,UAAU,EAAE,sBAAsB,UAAU,EAAE,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO;QACL,MAAM,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QAChC,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gCAAgC,CACvC,KAAc;IAEd,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACxE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;IAClE,CAAC;IAED,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,UAAU,GAA2B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7D,IAAI,OAAO,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;YACnE,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,4CAA4C,MAAM,CACzF,YAAY,CACb,EAAE,CACJ,CAAC;QACJ,CAAC;QAED,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,KAAK,CACb,+BAA+B,UAAU,mCAAmC,YAAY,EAAE,CAC3F,CAAC;QACJ,CAAC;QAED,MAAM,gBAAgB,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACnD,UAAU,CAAC,gBAAgB,CAAC,GAAG,YAAY,CAAC;IAC9C,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,MAAM,CAAC,MAAM,cAAc,GAAkB;IAC3C,OAAO,EAAE,IAAI;IACb,cAAc,EAAE,QAAQ;IACxB,cAAc,EAAE,OAAO;IACvB,KAAK,EAAE,kCAAkC;IACzC,oBAAoB,EAAE,GAAG;IACzB,eAAe,EAAE,EAAE;IACnB,aAAa,EAAE,EAAE;IACjB,0BAA0B,EAAE,EAAE;IAC9B,SAAS,EAAE;QACT,MAAM,EAAE,EAAE;QACV,QAAQ,EAAE,EAAE;QACZ,QAAQ,EAAE,EAAE;KACb;IACD,YAAY,EAAE,IAAI;IAClB,kBAAkB,EAAE,EAAE;CACvB,CAAC;AAEF,MAAM,UAAU,UAAU,CAAC,SAAiC;IAC1D,MAAM,MAAM,GAAkB;QAC5B,GAAG,cAAc;QACjB,GAAG,SAAS;QACZ,aAAa,EAAE;YACb,GAAG,cAAc,CAAC,aAAa;YAC/B,GAAG,CAAC,SAAS,CAAC,aAAa,IAAI,EAAE,CAAC;SACnC;QACD,0BAA0B,EAAE;YAC1B,GAAG,cAAc,CAAC,0BAA0B;YAC5C,GAAG,CAAC,SAAS,CAAC,0BAA0B,IAAI,EAAE,CAAC;SAChD;KACF,CAAC;IAEF,MAAM,CAAC,SAAS,GAAG,qBAAqB,CAAC,SAAS,CAAC,SAAS,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;IAC1F,MAAM,CAAC,0BAA0B,GAAG,gCAAgC,CAClE,MAAM,CAAC,0BAA0B,CAClC,CAAC;IAEF,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACzG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CACb,2BAA2B,MAAM,CAAC,cAAc,sBAAsB,uBAAuB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,IAAI,MAAM,CAAC,oBAAoB,GAAG,CAAC,EAAE,CAAC;QACvE,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,oBAAoB,EAAE,CACnF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QAC7C,MAAM,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC;IACxD,CAAC;IAED,IACE,OAAO,MAAM,CAAC,kBAAkB,KAAK,QAAQ;QAC7C,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,kBAAkB,CAAC;QAC5C,MAAM,CAAC,kBAAkB,GAAG,CAAC,EAC7B,CAAC;QACD,MAAM,IAAI,KAAK,CACb,sDAAsD,MAAM,CAAC,MAAM,CAAC,kBAAkB,CAAC,EAAE,CAC1F,CAAC;IACJ,CAAC;IAED,MAAM,iBAAiB,GAAoC,EAAE,CAAC;IAC9D,KAAK,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,IAAI,CAAC,qBAAqB,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5C,MAAM,IAAI,KAAK,CACb,mBAAmB,MAAM,sBAAsB,UAAU,sBAAsB,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClH,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,aAAa,CAAC,UAAU,CAAC,CAAC;QACjD,iBAAiB,CAAC,cAAc,CAAC,GAAG,MAAM,CAAC;IAC7C,CAAC;IACD,MAAM,CAAC,aAAa,GAAG,iBAAiB,CAAC;IAEzC,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -1,7 +1,8 @@
 export { Scanner } from "./scanner.js";
 export { redact } from "./redactor.js";
 export { loadConfig, DEFAULT_CONFIG } from "./config.js";
-export type { Entity, FogClawConfig, ScanResult, RedactResult, RedactStrategy, GuardrailAction, } from "./types.js";
+export { RedactionMapStore, BacklogStore } from "./backlog.js";
+export type { Entity, FogClawConfig, ScanResult, RedactResult, RedactStrategy, GuardrailAction, AccessRequest, RequestStatus, } from "./types.js";
 /**
  * OpenClaw plugin definition.
  *

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAgBA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACzD,YAAY,EACV,MAAM,EACN,aAAa,EACb,UAAU,EACV,YAAY,EACZ,cAAc,EACd,eAAe,GAChB,MAAM,YAAY,CAAC;AAqEpB;;;;;;;;GAQG;AACH,QAAA,MAAM,OAAO;;;kBAIG,GAAG;CA8QlB,CAAC;AAEF,eAAe,OAAO,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAwBA,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC/D,YAAY,EACV,MAAM,EACN,aAAa,EACb,UAAU,EACV,YAAY,EACZ,cAAc,EACd,eAAe,EACf,aAAa,EACb,aAAa,GACd,MAAM,YAAY,CAAC;AAqEpB;;;;;;;;GAQG;AACH,QAAA,MAAM,OAAO;;;kBAIG,GAAG;CA8WlB,CAAC;AAEF,eAAe,OAAO,CAAC"}