@intutic/mcp-governance-proxy 2.1.0 → 2.3.0

package/dist/dlpPii.js

@@ -0,0 +1,235 @@
+/**
+ * dlpPii.ts — validated PII detectors (card and IBAN checksums, SSN issued ranges).
+ *
+ * The TypeScript twin of the Rust proxy's `packages/proxy/src/dlp/pii.rs`.
+ * Both read the same definition (`PII_DEFINITION` from
+ * `@intutic/shared-types`, a byte-identical copy of the proxy's
+ * `pii_detectors.json`) and implement its validators and boundary rule the
+ * same way; `packages/shared-types/fixtures/pii-detector-vectors.json` runs
+ * through both (`__tests__/dlpPii.test.ts`, `tests/pii_conformance_test.rs`).
+ * A change to a rule here needs the same change there, or the vectors fail on
+ * one side.
+ *
+ * The regex finds a candidate; the validator decides. Luhn plus the IIN table
+ * for cards, the country length table plus mod-97 for IBANs, the never-issued
+ * ranges for SSNs, structure for email, digit count for phone numbers.
+ *
+ * The boundary rule replaces `\b`, which means different things in the two
+ * engines. Neighbouring characters must not be ASCII letters, digits or `_`,
+ * except that a match right after a JSON escape (`\n`, `\r`, `\t`) counts as
+ * bounded — both scanners read JSON as sent. A match starting right after a
+ * backslash starts inside an escape and is rejected. `numeric` detectors
+ * also reject a match glued to more digits by `.` or `-` (a decimal fraction,
+ * a five-group serial). A rejected candidate resumes the search one character
+ * after its start, so a card number right after `12 ` is still found.
+ *
+ * @module
+ */
+import { PII_DEFINITION, PII_DETECTOR_IDS } from '@intutic/shared-types';
+const CARD_BRANDS = PII_DEFINITION.card_brands;
+const IBAN_LENGTHS = PII_DEFINITION.iban_lengths;
+const isDigit = (c) => c >= 48 && c <= 57;
+const isWord = (c) => isDigit(c) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95;
+const BACKSLASH = 92;
+const DOT = 46;
+const DASH = 45;
+function luhn(digits) {
+    let sum = 0;
+    for (let i = 0; i < digits.length; i++) {
+        let d = digits.charCodeAt(digits.length - 1 - i) - 48;
+        if (i % 2 === 1) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+    }
+    return sum % 10 === 0;
+}
+function card(span) {
+    const digits = span.replace(/[^0-9]/g, '');
+    const n = digits.length;
+    const known = CARD_BRANDS.some((b) => b.lengths.includes(n) &&
+        b.prefixes.some(([lo, hi]) => {
+            const head = digits.slice(0, lo.length);
+            return head >= lo && head <= hi;
+        }));
+    return known && luhn(digits);
+}
+/** Truncates to the country's length: the regex is greedy and runs on into `EUR`. */
+function iban(span) {
+    const want = IBAN_LENGTHS[span.slice(0, 2)];
+    if (want === undefined)
+        return null;
+    let chars = '';
+    let end = span.length;
+    for (let i = 0; i < span.length; i++) {
+        const c = span[i];
+        if (c === ' ')
+            continue;
+        if (chars.length === want) {
+            // A further character glued on (no space) makes it longer than any
+            // IBAN of this country.
+            if (span[i - 1] !== ' ')
+                return null;
+            break;
+        }
+        chars += c;
+        end = i + 1;
+    }
+    if (chars.length !== want)
+        return null;
+    const rotated = chars.slice(4) + chars.slice(0, 4);
+    let rem = 0;
+    for (const c of rotated) {
+        const code = c.charCodeAt(0);
+        const v = isDigit(code) ? code - 48 : code - 65 + 10;
+        rem = v >= 10 ? (rem * 100 + v) % 97 : (rem * 10 + v) % 97;
+    }
+    return rem === 1 ? end : null;
+}
+/** Never issued: area 000, 666 or 9xx; group 00; serial 0000. */
+function ssn(span) {
+    const area = span.slice(0, 3);
+    const group = span.slice(4, 6);
+    const serial = span.slice(7, 11);
+    return area !== '000' && area !== '666' && area[0] !== '9' && group !== '00' && serial !== '0000';
+}
+function email(span) {
+    const at = span.indexOf('@');
+    if (at < 0)
+        return false;
+    const local = span.slice(0, at);
+    const domain = span.slice(at + 1);
+    if (local.startsWith('.') || local.endsWith('.') || local.includes('..'))
+        return false;
+    const labels = domain.split('.');
+    if (labels.some((l) => l === '' || l.startsWith('-') || l.endsWith('-')))
+        return false;
+    const tld = labels[labels.length - 1];
+    if (tld.length < 2 || !/^[A-Za-z]+$/.test(tld))
+        return false;
+    // `icon@2x.png`: an asset scale suffix, not an address.
+    const first = labels[0];
+    return !/^[0-9]+x$/.test(first);
+}
+function phone(span) {
+    const n = span.replace(/[^0-9]/g, '').length;
+    return n >= 10 && n <= 15;
+}
+const whole = (check) => (span) => check(span) ? span.length : null;
+const VALIDATORS = {
+    card_luhn: whole(card),
+    iban_mod97: iban,
+    ssn_ranges: whole(ssn),
+    email_shape: whole(email),
+    phone_digits: whole(phone),
+};
+/** Every PII detector, in definition order, whatever its configured action. */
+export const PII_DETECTORS = PII_DEFINITION.detectors.map((d) => {
+    const validate = VALIDATORS[d.validator];
+    if (!validate)
+        throw new Error(`pii detector ${d.id} names unknown validator ${d.validator}`);
+    return {
+        id: d.id,
+        category: d.category,
+        description: d.description,
+        regex: new RegExp(d.regex, 'g'),
+        numeric: d.boundary === 'numeric',
+        validate,
+    };
+});
+function bounded(text, start, end, numeric) {
+    if (start > 0) {
+        const p = text.charCodeAt(start - 1);
+        if (p === BACKSLASH)
+            return false;
+        const escaped = (p === 110 || p === 114 || p === 116) && start >= 2 && text.charCodeAt(start - 2) === BACKSLASH;
+        if (isWord(p) && !escaped)
+            return false;
+        if (numeric && (p === DOT || p === DASH) && start >= 2 && isDigit(text.charCodeAt(start - 2)))
+            return false;
+    }
+    if (end < text.length) {
+        const q = text.charCodeAt(end);
+        if (isWord(q))
+            return false;
+        if (numeric && (q === DOT || q === DASH) && end + 1 < text.length && isDigit(text.charCodeAt(end + 1))) {
+            return false;
+        }
+    }
+    return true;
+}
+/** Validated matches of one detector, as `[start, end)` UTF-16 ranges, in text order. */
+export function findPii(det, text) {
+    const out = [];
+    const re = det.regex;
+    let pos = 0;
+    while (pos < text.length) {
+        re.lastIndex = pos;
+        const m = re.exec(text);
+        if (!m)
+            break;
+        const start = m.index;
+        const len = det.validate(m[0]);
+        const end = len === null ? null : start + len;
+        if (end !== null && bounded(text, start, end, det.numeric)) {
+            out.push([start, end]);
+            pos = end;
+        }
+        else {
+            pos = start + 1;
+        }
+    }
+    return out;
+}
+/**
+ * Every detector over `text`, actions ignored, in definition order then text
+ * order — what the conformance vectors measure.
+ */
+export function detectPii(text) {
+    const out = [];
+    for (const det of PII_DETECTORS) {
+        for (const [start, end] of findPii(det, text))
+            out.push({ id: det.id, start, end });
+    }
+    return out;
+}
+/**
+ * The detectors an `INTUTIC_MCP_DLP_DETECTORS` value names — a JSON object of
+ * detector id → `off` | `redact` | `block` — with their actions. Detectors it
+ * leaves out are not listed: they keep their defaults, or the workspace's
+ * action (`effectivePiiActions` in `@intutic/shared-types`). Never throws,
+ * like the other `INTUTIC_MCP_*` JSON settings: an unparseable value, an
+ * unknown id or an unknown action is reported in `problems` and that entry is
+ * left out, so it keeps its default, which for card, IBAN and SSN is on.
+ */
+export function parseLocalPiiActions(raw) {
+    const configured = {};
+    if (!raw)
+        return { configured, problems: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { configured, problems: ['INTUTIC_MCP_DLP_DETECTORS is not valid JSON; using the defaults'] };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return { configured, problems: ['INTUTIC_MCP_DLP_DETECTORS is not a JSON object; using the defaults'] };
+    }
+    const problems = [];
+    for (const [id, action] of Object.entries(parsed)) {
+        if (!PII_DETECTOR_IDS.includes(id)) {
+            problems.push(`INTUTIC_MCP_DLP_DETECTORS names unknown detector ${id}; known: ${PII_DETECTOR_IDS.join(', ')}`);
+        }
+        else if (action !== 'off' && action !== 'redact' && action !== 'block') {
+            problems.push(`INTUTIC_MCP_DLP_DETECTORS sets ${id} to ${String(action)}; only off, redact and block exist`);
+        }
+        else {
+            configured[id] = action;
+        }
+    }
+    return { configured, problems };
+}
+//# sourceMappingURL=dlpPii.js.map

package/dist/dlpPii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dlpPii.js","sourceRoot":"","sources":["../src/dlpPii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAexE,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAA;AAC9C,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,CAAA;AAEhD,MAAM,OAAO,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AAC1D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CACpC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;AACzE,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,GAAG,GAAG,EAAE,CAAA;AACd,MAAM,IAAI,GAAG,EAAE,CAAA;AAEf,SAAS,IAAI,CAAC,MAAc;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;QACrD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChB,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAA;IACV,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAA;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;YACvC,OAAO,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;QACjC,CAAC,CAAC,CACL,CAAA;IACD,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED,qFAAqF;AACrF,SAAS,IAAI,CAAC,IAAY;IACxB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAClB,IAAI,CAAC,KAAK,GAAG;YAAE,SAAQ;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1B,mEAAmE;YACnE,wBAAwB;YACxB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YACpC,MAAK;QACP,CAAC;QACD,KAAK,IAAI,CAAC,CAAA;QACV,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAClD,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAA;QACpD,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/B,CAAC;AAED,iEAAiE;AACjE,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,CAAA;AACnG,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IACtC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5D,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IACxB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;IAC5C,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED,MAAM,KAAK,GACT,CAAC,KAAgC,EAAE,EAAE,CACrC,CAAC,IAAY,EAAiB,EAAE,CAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AAEpC,MAAM,UAAU,GAAgF;IAC9F,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC;IACtB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC;IACzB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;CAC3B,CAAA;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,aAAa,GAA2B,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACtF,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACxC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IAC7F,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAmB;QACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS;QACjC,QAAQ;KACT,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAE,OAAgB;IACzE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACjC,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAA;QACjG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QACvC,IAAI,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC7G,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3B,IAAI,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,OAAO,CAAC,GAAgB,EAAE,IAAY;IACpD,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAA;IACpB,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,EAAE,CAAC,SAAS,GAAG,GAAG,CAAA;QAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,CAAC,CAAC;YAAE,MAAK;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAA;QAC7C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;YACtB,GAAG,GAAG,GAAG,CAAA;QACX,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,KAAK,GAAG,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,GAAG,GAAsD,EAAE,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAI1D,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC7C,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,iEAAiE,CAAC,EAAE,CAAA;IACtG,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,oEAAoE,CAAC,EAAE,CAAA;IACzG,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,oDAAoD,EAAE,YAAY,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChH,CAAC;aAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAA;QAC9G,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,EAAmB,CAAC,GAAG,MAAM,CAAA;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;AACjC,CAAC"}

package/dist/emitter.d.ts

@@ -4,13 +4,16 @@
  * Path A: HTTP POST to /api/v1/hook-events (same endpoint as claudeCodeHooks.ts)
  * Path B: Append JSONL line to ~/.intutic/events/hook-events.jsonl
  *
- * Mirrors the dual-path pattern from claudeCodeHooks.ts / syncLoop.ts.
+ * Mirrors the dual-path pattern from claudeCodeHooks.ts.
  *
  * @module
  */
+import type { CallerIdentity } from './identity.js';
+import type { AnomalyFinding } from './anomaly/index.js';
+import type { BudgetEventDetail } from './budget.js';
 export type EventKind = 'tool_allowed' | 'tool_blocked' | 'tool_redacted'
 /**
- * A `warn` SOP rule matched and the call was allowed (LLD #71): the same
+ * A `warn` SOP rule matched and the call was allowed: the same
  * event the harness gates log for a warn-severity rule, carrying the rule
  * id as `[<id>]` in `reason`, so a SHADOW guardrail seen through this
  * proxy counts toward its evidence like one seen through a gate.
@@ -39,22 +42,76 @@ export type EventKind = 'tool_allowed' | 'tool_blocked' | 'tool_redacted'
  * (block) alike — a Reask/Kill firing ALSO emits `tool_blocked`, the same
  * "existing consumers key on it" rule `injection_detected` follows.
  */
- | 'anomaly_detected';
+ | 'anomaly_detected'
+/**
+ * A `require_approval` rule held the call for a person's decision
+ * (approvalHold.ts). `reason` carries the rule id as `[<id>]`, as the hook
+ * gates' hold events do.
+ */
+ | 'tool_held'
+/** An approved, unexpired, exact-match bypass let a held call through. */
+ | 'hold_approved_bypass_used'
+/**
+ * An MCP call budget (budget.ts) reached its warning threshold. Once per
+ * budget per period, across every proxy sharing the Valkey; carries
+ * `budget` and a finding. The call itself was allowed.
+ */
+ | 'mcp_budget_threshold'
+/**
+ * An MCP call budget is used up. Once per budget per period, on the first
+ * refusal; every refusal also sends its own `tool_blocked`.
+ */
+ | 'mcp_budget_exceeded';
+/**
+ * What a detection-style event found, so the control plane can file it as a
+ * detector finding (adjudicable on the Findings page, routed as
+ * `anomaly.finding`). Carried by `injection_detected`, `anomaly_detected` and
+ * `tool_redacted` — the events that report something seen rather than a
+ * verdict on the call, which `tool_allowed`/`tool_blocked` carry.
+ */
+export interface DetectionFinding {
+    /** This proxy's detector id, e.g. `consecutive_repeat` or `injection:tool_result`. */
+    detectorId: string;
+    /** A taxonomy label (`anomaly-taxonomy`), lower-cased like the detectors' own. */
+    kind: string;
+    /** What the finding did to the call or result. */
+    disposition: 'steer' | 'reask' | 'kill';
+    severity: 'low' | 'medium' | 'high';
+    /** 0.0–1.0. A pattern match is certain about the pattern: 1. */
+    confidence: number;
+}
+/** An anomaly detector's finding as a {@link DetectionFinding}, with what it actually did. */
+export declare function detectionFinding(finding: AnomalyFinding, disposition: DetectionFinding['disposition'], severity: DetectionFinding['severity']): DetectionFinding;
 export interface GovernanceEvent {
     incidentId: string;
+    /**
+     * This event's id, made once in {@link GovernanceEmitter.emit} and carried
+     * on every path it is delivered by — the daemon socket, the direct post and
+     * the event file — so the control plane processes it once however many of
+     * them, and their retries, arrive.
+     */
+    eventId: string;
     kind: EventKind;
     toolName: string;
     toolInput: unknown;
     workspaceId: string;
     harnessType: string;
     reason?: string;
+    /** The finding's severity, for readers of the local event file. */
+    severity?: string;
+    /** Set on detection events; see {@link DetectionFinding}. */
+    finding?: DetectionFinding;
     /**
-     * Set only by `injection_detected`/`anomaly_detected` today — the
-     * escalation-rule mirror `injection.ts`'s `injectionSeverity` (Phase 1) and
-     * the per-detector disposition mapping (Phase 2) compute. Absent on every
-     * other event kind, matching how `reason` is already optional here.
+     * Who made the call, as this proxy observed it (identity.ts). The control
+     * plane adds the member the API key resolves to when it ingests the event.
+     * Absent only for an emitter constructed without one.
      */
-    severity?: string;
+    principal?: CallerIdentity;
+    /**
+     * Set on the budget events, and on the `tool_blocked` of a call a used-up
+     * budget refused: which budget, its limit, the calls made, when it resets.
+     */
+    budget?: BudgetEventDetail;
     timestamp: string;
 }
 export declare class GovernanceEmitter {
@@ -63,8 +120,9 @@ export declare class GovernanceEmitter {
     private readonly eventsFilePath;
     private readonly workspaceId;
     private readonly mcpProxyMode;
-    constructor(controlPlaneUrl: string, apiKey: string, eventsFilePath: string, workspaceId: string, mcpProxyMode?: string);
-    emit(kind: EventKind, toolName: string, toolInput: unknown, reason?: string, severity?: string): void;
+    private readonly identity;
+    constructor(controlPlaneUrl: string, apiKey: string, eventsFilePath: string, workspaceId: string, mcpProxyMode?: string, identity?: CallerIdentity | undefined);
+    emit(kind: EventKind, toolName: string, toolInput: unknown, reason?: string, finding?: DetectionFinding, budget?: BudgetEventDetail): void;
     private runDualPath;
     private postToControlPlane;
     private appendToFile;

package/dist/emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emitter.d.ts","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAYH,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,cAAc,GACd,eAAe;AACjB;;;;;GAKG;GACD,cAAc;AAChB;;;;;;GAMG;GACD,+BAA+B;AACjC;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;GAKG;GACD,kBAAkB,CAAA;AAEtB,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf;;;;;OAKG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;gBAJZ,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAsB;IAGvD,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;IAuCrG,OAAO,CAAC,WAAW;YAYL,kBAAkB;YA4BlB,YAAY;CAM3B"}
+{"version":3,"file":"emitter.d.ts","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAIpD,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,cAAc,GACd,eAAe;AACjB;;;;;GAKG;GACD,cAAc;AAChB;;;;;;GAMG;GACD,+BAA+B;AACjC;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;GAKG;GACD,kBAAkB;AACpB;;;;GAIG;GACD,WAAW;AACb,0EAA0E;GACxE,2BAA2B;AAC7B;;;;GAIG;GACD,sBAAsB;AACxB;;;GAGG;GACD,qBAAqB,CAAA;AAEzB;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAA;IAClB,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,kDAAkD;IAClD,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;IACvC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACnC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,GACrC,gBAAgB,CAElB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,SAAS,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBALR,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAsB,EACpC,QAAQ,GAAE,cAAc,GAAG,SAAqB;IAGnE,IAAI,CACF,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,gBAAgB,EAC1B,MAAM,CAAC,EAAE,iBAAiB,GACzB,IAAI;IAgDP,OAAO,CAAC,WAAW;YAYL,kBAAkB;YAgClB,YAAY;CAM3B"}

package/dist/emitter.js

@@ -4,41 +4,50 @@
  * Path A: HTTP POST to /api/v1/hook-events (same endpoint as claudeCodeHooks.ts)
  * Path B: Append JSONL line to ~/.intutic/events/hook-events.jsonl
  *
- * Mirrors the dual-path pattern from claudeCodeHooks.ts / syncLoop.ts.
+ * Mirrors the dual-path pattern from claudeCodeHooks.ts.
  *
  * @module
  */
 import * as node_fs from 'node:fs/promises';
-import * as node_https from 'node:https';
-import * as node_http from 'node:http';
 import * as node_path from 'node:path';
 import * as node_crypto from 'node:crypto';
 import { createStderrLogger as createLogger } from './stderrLog.js';
 import { callDaemonSocket } from './daemonClient.js';
+import { httpRequest } from './httpJson.js';
 const log = createLogger('mcp-proxy-emitter');
+/** An anomaly detector's finding as a {@link DetectionFinding}, with what it actually did. */
+export function detectionFinding(finding, disposition, severity) {
+    return { detectorId: finding.detectorId, kind: finding.kind, disposition, severity, confidence: finding.confidence };
+}
 export class GovernanceEmitter {
     controlPlaneUrl;
     apiKey;
     eventsFilePath;
     workspaceId;
     mcpProxyMode;
-    constructor(controlPlaneUrl, apiKey, eventsFilePath, workspaceId, mcpProxyMode = 'per-session') {
+    identity;
+    constructor(controlPlaneUrl, apiKey, eventsFilePath, workspaceId, mcpProxyMode = 'per-session', identity = undefined) {
         this.controlPlaneUrl = controlPlaneUrl;
         this.apiKey = apiKey;
         this.eventsFilePath = eventsFilePath;
         this.workspaceId = workspaceId;
         this.mcpProxyMode = mcpProxyMode;
+        this.identity = identity;
     }
-    emit(kind, toolName, toolInput, reason, severity) {
+    emit(kind, toolName, toolInput, reason, finding, budget) {
         const event = {
             incidentId: node_crypto.randomUUID(),
+            eventId: node_crypto.randomUUID(),
             kind,
             toolName,
             toolInput,
             workspaceId: this.workspaceId,
             harnessType: 'mcp-governance-proxy',
             reason,
-            severity,
+            severity: finding?.severity,
+            finding,
+            principal: this.identity,
+            budget,
             timestamp: new Date().toISOString(),
         };
         if (this.mcpProxyMode === 'daemon') {
@@ -50,10 +59,15 @@ export class GovernanceEmitter {
                 toolName,
                 workspaceId: this.workspaceId,
                 harnessType: 'mcp-governance-proxy',
+                incidentId: event.incidentId,
+                eventId: event.eventId,
                 timestamp: event.timestamp,
                 reason,
-                severity,
+                severity: event.severity,
+                finding,
                 toolInput,
+                principal: event.principal,
+                budget,
             };
             callDaemonSocket('telemetry.enqueue', eventPayload).then(() => {
                 log.debug({ action: 'telemetry_enqueued' }, 'Telemetry successfully enqueued to daemon');
@@ -86,8 +100,12 @@ export class GovernanceEmitter {
                     workspaceId: event.workspaceId,
                     harnessType: event.harnessType,
                     incidentId: event.incidentId,
+                    eventId: event.eventId,
                     reason: event.reason,
                     severity: event.severity,
+                    finding: event.finding,
+                    principal: event.principal,
+                    budget: event.budget,
                     timestamp: event.timestamp,
                 },
             ],
@@ -95,11 +113,11 @@ export class GovernanceEmitter {
         // POST /api/v1/hook-events — the batch governance-event ingest whose
         // BatchHookEventsSchema this payload already matches exactly. Path A used
         // to post to /api/v1/telemetry/enqueue, an endpoint that never existed in
-        // the control plane; because httpPost resolved on any response, every
-        // tool_allowed/tool_blocked event 404'd silently and the 'Path A failed'
-        // warning never fired.
+        // the control plane; because the old helper resolved on any response,
+        // every tool_allowed/tool_blocked event 404'd silently and the 'Path A
+        // failed' warning never fired. httpRequest rejects on an error status.
         const url = `${this.controlPlaneUrl}/api/v1/hook-events`;
-        await httpPost(url, this.apiKey, payload);
+        await httpRequest('POST', url, this.apiKey, payload, 4000);
     }
     async appendToFile(event) {
         const dir = node_path.dirname(this.eventsFilePath);
@@ -108,36 +126,4 @@ export class GovernanceEmitter {
         await node_fs.appendFile(this.eventsFilePath, line, 'utf-8');
     }
 }
-function httpPost(url, apiKey, body) {
-    return new Promise((resolve, reject) => {
-        const parsed = new URL(url);
-        const lib = parsed.protocol === 'https:' ? node_https : node_http;
-        const req = lib.request(url, {
-            method: 'POST',
-            headers: {
-                'Content-Type': 'application/json',
-                'Content-Length': Buffer.byteLength(body),
-                Authorization: `Bearer ${apiKey}`,
-            },
-            timeout: 4000,
-        }, (res) => {
-            // Drain response body to free socket
-            res.resume();
-            res.on('end', () => {
-                // Reject on error statuses so a wrong or removed endpoint surfaces as
-                // a caller-visible failure instead of silently succeeding.
-                const status = res.statusCode ?? 0;
-                if (status >= 400) {
-                    reject(new Error(`HTTP POST ${url} returned ${status}`));
-                    return;
-                }
-                resolve();
-            });
-        });
-        req.on('error', reject);
-        req.on('timeout', () => { req.destroy(); reject(new Error('HTTP POST timed out')); });
-        req.write(body);
-        req.end();
-    });
-}
 //# sourceMappingURL=emitter.js.map

package/dist/emitter.js.map

@@ -1 +1 @@
-{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,UAAU,MAAM,YAAY,CAAA;AACxC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AAEpD,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAwD7C,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IACA;IALnB,YACmB,eAAuB,EACvB,MAAc,EACd,cAAsB,EACtB,WAAmB,EACnB,eAAuB,aAAa;QAJpC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAQ;QACtB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAwB;IACpD,CAAC;IAEJ,IAAI,CAAC,IAAe,EAAE,QAAgB,EAAE,SAAkB,EAAE,MAAe,EAAE,QAAiB;QAC5F,MAAM,KAAK,GAAoB;YAC7B,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;YACpC,IAAI;YACJ,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB;YACnC,MAAM;YACN,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG;gBACnB,6DAA6D;gBAC7D,qEAAqE;gBACrE,sEAAsE;gBACtE,KAAK,EAAE,IAAI;gBACX,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,sBAAsB;gBACnC,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,QAAQ;gBACR,SAAS;aACV,CAAA;YACD,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,2CAA2C,CAAC,CAAA;YAC1F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0EAA0E,CAAC,CAAA;gBAC7I,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;QAEF,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE;gBACN;oBACE,+DAA+D;oBAC/D,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF;SACF,CAAC,CAAA;QAEF,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,yEAAyE;QACzE,uBAAuB;QACvB,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAA;QACxD,MAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;IAC3C,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAsB;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACzC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;CACF;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,MAAc,EAAE,IAAY;IACzD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;QAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAA;QACjE,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CACrB,GAAG,EACH;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,gBAAgB,EAAE,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC;gBACzC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,OAAO,EAAE,IAAI;SACd,EACD,CAAC,GAAG,EAAE,EAAE;YACN,qCAAqC;YACrC,GAAG,CAAC,MAAM,EAAE,CAAA;YACZ,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;gBACjB,sEAAsE;gBACtE,2DAA2D;gBAC3D,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAA;gBAClC,IAAI,MAAM,IAAI,GAAG,EAAE,CAAC;oBAClB,MAAM,CAAC,IAAI,KAAK,CAAC,aAAa,GAAG,aAAa,MAAM,EAAE,CAAC,CAAC,CAAA;oBACxD,OAAM;gBACR,CAAC;gBACD,OAAO,EAAE,CAAA;YACX,CAAC,CAAC,CAAA;QACJ,CAAC,CACF,CAAA;QACD,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;QACvB,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAA,CAAC,CAAC,CAAC,CAAA;QACpF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACf,GAAG,CAAC,GAAG,EAAE,CAAA;IACX,CAAC,CAAC,CAAA;AACJ,CAAC"}
+{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAK3C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AA4E7C,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,WAA4C,EAC5C,QAAsC;IAEtC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACtH,CAAC;AAmCD,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,eAAuB,EACvB,MAAc,EACd,cAAsB,EACtB,WAAmB,EACnB,eAAuB,aAAa,EACpC,WAAuC,SAAS;QALhD,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAQ;QACtB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAwB;QACpC,aAAQ,GAAR,QAAQ,CAAwC;IAChE,CAAC;IAEJ,IAAI,CACF,IAAe,EACf,QAAgB,EAChB,SAAkB,EAClB,MAAe,EACf,OAA0B,EAC1B,MAA0B;QAE1B,MAAM,KAAK,GAAoB;YAC7B,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;YACpC,OAAO,EAAE,WAAW,CAAC,UAAU,EAAE;YACjC,IAAI;YACJ,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB;YACnC,MAAM;YACN,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,MAAM;YACN,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG;gBACnB,6DAA6D;gBAC7D,qEAAqE;gBACrE,sEAAsE;gBACtE,KAAK,EAAE,IAAI;gBACX,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,sBAAsB;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO;gBACP,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;aACP,CAAA;YACD,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,2CAA2C,CAAC,CAAA;YAC1F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0EAA0E,CAAC,CAAA;gBAC7I,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;QAEF,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE;gBACN;oBACE,+DAA+D;oBAC/D,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF;SACF,CAAC,CAAA;QAEF,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAA;QACxD,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAsB;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACzC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;CACF"}

package/dist/guardedValkey.d.ts

@@ -0,0 +1,40 @@
+/**
+ * guardedValkey.ts — the one Valkey connection a proxy process holds, and the
+ * guard every command on it goes through.
+ *
+ * Two things in a proxy read and write Valkey: the shared session window
+ * (sessionStore.ts) and the MCP call budgets (budget.ts). They share this
+ * connection, and they share its rule: a command runs only on a connected
+ * client, never waits longer than a short timeout, and any failure comes back
+ * as `undefined`. What `undefined` means is each caller's business — the
+ * session window falls back to its per-process copy; a budget follows the
+ * proxy's fail setting.
+ *
+ * @module
+ */
+import { Redis } from 'ioredis';
+/** A command that takes longer than this is treated as Valkey being unavailable. */
+export declare const VALKEY_COMMAND_TIMEOUT_MS = 200;
+export interface GuardedValkeyOptions {
+    timeoutMs?: number;
+}
+export interface GuardedRunOptions {
+    /**
+     * Wait (within the timeout) for a connection that is still being set up,
+     * instead of answering `undefined` straight away. For a check whose
+     * `undefined` can refuse a call: the first call after the proxy starts
+     * must not be refused because the connection was a few milliseconds old.
+     */
+    awaitConnect?: boolean;
+}
+export declare class GuardedValkey {
+    readonly client: Redis;
+    private readonly timeoutMs;
+    private warned;
+    constructor(url: string, opts?: GuardedValkeyOptions);
+    /** Runs `op`, or answers `undefined` when Valkey is not connected, too slow, or fails. */
+    run<T>(op: (client: Redis) => Promise<T>, opts?: GuardedRunOptions): Promise<T | undefined>;
+    close(): Promise<void>;
+    private warnOnce;
+}
+//# sourceMappingURL=guardedValkey.d.ts.map

package/dist/guardedValkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardedValkey.d.ts","sourceRoot":"","sources":["../src/guardedValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAM/B,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,MAAM,CAAQ;gBAEV,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB;IAexD,0FAA0F;IACpF,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAsB/F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,OAAO,CAAC,QAAQ;CAYjB"}