@intutic/mcp-governance-proxy 2.2.0 → 2.4.0

package/dist/dlpPii.js

@@ -0,0 +1,235 @@
+/**
+ * dlpPii.ts — validated PII detectors (card and IBAN checksums, SSN issued ranges).
+ *
+ * The TypeScript twin of the Rust proxy's `packages/proxy/src/dlp/pii.rs`.
+ * Both read the same definition (`PII_DEFINITION` from
+ * `@intutic/shared-types`, a byte-identical copy of the proxy's
+ * `pii_detectors.json`) and implement its validators and boundary rule the
+ * same way; `packages/shared-types/fixtures/pii-detector-vectors.json` runs
+ * through both (`__tests__/dlpPii.test.ts`, `tests/pii_conformance_test.rs`).
+ * A change to a rule here needs the same change there, or the vectors fail on
+ * one side.
+ *
+ * The regex finds a candidate; the validator decides. Luhn plus the IIN table
+ * for cards, the country length table plus mod-97 for IBANs, the never-issued
+ * ranges for SSNs, structure for email, digit count for phone numbers.
+ *
+ * The boundary rule replaces `\b`, which means different things in the two
+ * engines. Neighbouring characters must not be ASCII letters, digits or `_`,
+ * except that a match right after a JSON escape (`\n`, `\r`, `\t`) counts as
+ * bounded — both scanners read JSON as sent. A match starting right after a
+ * backslash starts inside an escape and is rejected. `numeric` detectors
+ * also reject a match glued to more digits by `.` or `-` (a decimal fraction,
+ * a five-group serial). A rejected candidate resumes the search one character
+ * after its start, so a card number right after `12 ` is still found.
+ *
+ * @module
+ */
+import { PII_DEFINITION, PII_DETECTOR_IDS } from '@intutic/shared-types';
+const CARD_BRANDS = PII_DEFINITION.card_brands;
+const IBAN_LENGTHS = PII_DEFINITION.iban_lengths;
+const isDigit = (c) => c >= 48 && c <= 57;
+const isWord = (c) => isDigit(c) || (c >= 65 && c <= 90) || (c >= 97 && c <= 122) || c === 95;
+const BACKSLASH = 92;
+const DOT = 46;
+const DASH = 45;
+function luhn(digits) {
+    let sum = 0;
+    for (let i = 0; i < digits.length; i++) {
+        let d = digits.charCodeAt(digits.length - 1 - i) - 48;
+        if (i % 2 === 1) {
+            d *= 2;
+            if (d > 9)
+                d -= 9;
+        }
+        sum += d;
+    }
+    return sum % 10 === 0;
+}
+function card(span) {
+    const digits = span.replace(/[^0-9]/g, '');
+    const n = digits.length;
+    const known = CARD_BRANDS.some((b) => b.lengths.includes(n) &&
+        b.prefixes.some(([lo, hi]) => {
+            const head = digits.slice(0, lo.length);
+            return head >= lo && head <= hi;
+        }));
+    return known && luhn(digits);
+}
+/** Truncates to the country's length: the regex is greedy and runs on into `EUR`. */
+function iban(span) {
+    const want = IBAN_LENGTHS[span.slice(0, 2)];
+    if (want === undefined)
+        return null;
+    let chars = '';
+    let end = span.length;
+    for (let i = 0; i < span.length; i++) {
+        const c = span[i];
+        if (c === ' ')
+            continue;
+        if (chars.length === want) {
+            // A further character glued on (no space) makes it longer than any
+            // IBAN of this country.
+            if (span[i - 1] !== ' ')
+                return null;
+            break;
+        }
+        chars += c;
+        end = i + 1;
+    }
+    if (chars.length !== want)
+        return null;
+    const rotated = chars.slice(4) + chars.slice(0, 4);
+    let rem = 0;
+    for (const c of rotated) {
+        const code = c.charCodeAt(0);
+        const v = isDigit(code) ? code - 48 : code - 65 + 10;
+        rem = v >= 10 ? (rem * 100 + v) % 97 : (rem * 10 + v) % 97;
+    }
+    return rem === 1 ? end : null;
+}
+/** Never issued: area 000, 666 or 9xx; group 00; serial 0000. */
+function ssn(span) {
+    const area = span.slice(0, 3);
+    const group = span.slice(4, 6);
+    const serial = span.slice(7, 11);
+    return area !== '000' && area !== '666' && area[0] !== '9' && group !== '00' && serial !== '0000';
+}
+function email(span) {
+    const at = span.indexOf('@');
+    if (at < 0)
+        return false;
+    const local = span.slice(0, at);
+    const domain = span.slice(at + 1);
+    if (local.startsWith('.') || local.endsWith('.') || local.includes('..'))
+        return false;
+    const labels = domain.split('.');
+    if (labels.some((l) => l === '' || l.startsWith('-') || l.endsWith('-')))
+        return false;
+    const tld = labels[labels.length - 1];
+    if (tld.length < 2 || !/^[A-Za-z]+$/.test(tld))
+        return false;
+    // `icon@2x.png`: an asset scale suffix, not an address.
+    const first = labels[0];
+    return !/^[0-9]+x$/.test(first);
+}
+function phone(span) {
+    const n = span.replace(/[^0-9]/g, '').length;
+    return n >= 10 && n <= 15;
+}
+const whole = (check) => (span) => check(span) ? span.length : null;
+const VALIDATORS = {
+    card_luhn: whole(card),
+    iban_mod97: iban,
+    ssn_ranges: whole(ssn),
+    email_shape: whole(email),
+    phone_digits: whole(phone),
+};
+/** Every PII detector, in definition order, whatever its configured action. */
+export const PII_DETECTORS = PII_DEFINITION.detectors.map((d) => {
+    const validate = VALIDATORS[d.validator];
+    if (!validate)
+        throw new Error(`pii detector ${d.id} names unknown validator ${d.validator}`);
+    return {
+        id: d.id,
+        category: d.category,
+        description: d.description,
+        regex: new RegExp(d.regex, 'g'),
+        numeric: d.boundary === 'numeric',
+        validate,
+    };
+});
+function bounded(text, start, end, numeric) {
+    if (start > 0) {
+        const p = text.charCodeAt(start - 1);
+        if (p === BACKSLASH)
+            return false;
+        const escaped = (p === 110 || p === 114 || p === 116) && start >= 2 && text.charCodeAt(start - 2) === BACKSLASH;
+        if (isWord(p) && !escaped)
+            return false;
+        if (numeric && (p === DOT || p === DASH) && start >= 2 && isDigit(text.charCodeAt(start - 2)))
+            return false;
+    }
+    if (end < text.length) {
+        const q = text.charCodeAt(end);
+        if (isWord(q))
+            return false;
+        if (numeric && (q === DOT || q === DASH) && end + 1 < text.length && isDigit(text.charCodeAt(end + 1))) {
+            return false;
+        }
+    }
+    return true;
+}
+/** Validated matches of one detector, as `[start, end)` UTF-16 ranges, in text order. */
+export function findPii(det, text) {
+    const out = [];
+    const re = det.regex;
+    let pos = 0;
+    while (pos < text.length) {
+        re.lastIndex = pos;
+        const m = re.exec(text);
+        if (!m)
+            break;
+        const start = m.index;
+        const len = det.validate(m[0]);
+        const end = len === null ? null : start + len;
+        if (end !== null && bounded(text, start, end, det.numeric)) {
+            out.push([start, end]);
+            pos = end;
+        }
+        else {
+            pos = start + 1;
+        }
+    }
+    return out;
+}
+/**
+ * Every detector over `text`, actions ignored, in definition order then text
+ * order — what the conformance vectors measure.
+ */
+export function detectPii(text) {
+    const out = [];
+    for (const det of PII_DETECTORS) {
+        for (const [start, end] of findPii(det, text))
+            out.push({ id: det.id, start, end });
+    }
+    return out;
+}
+/**
+ * The detectors an `INTUTIC_MCP_DLP_DETECTORS` value names — a JSON object of
+ * detector id → `off` | `redact` | `block` — with their actions. Detectors it
+ * leaves out are not listed: they keep their defaults, or the workspace's
+ * action (`effectivePiiActions` in `@intutic/shared-types`). Never throws,
+ * like the other `INTUTIC_MCP_*` JSON settings: an unparseable value, an
+ * unknown id or an unknown action is reported in `problems` and that entry is
+ * left out, so it keeps its default, which for card, IBAN and SSN is on.
+ */
+export function parseLocalPiiActions(raw) {
+    const configured = {};
+    if (!raw)
+        return { configured, problems: [] };
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return { configured, problems: ['INTUTIC_MCP_DLP_DETECTORS is not valid JSON; using the defaults'] };
+    }
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        return { configured, problems: ['INTUTIC_MCP_DLP_DETECTORS is not a JSON object; using the defaults'] };
+    }
+    const problems = [];
+    for (const [id, action] of Object.entries(parsed)) {
+        if (!PII_DETECTOR_IDS.includes(id)) {
+            problems.push(`INTUTIC_MCP_DLP_DETECTORS names unknown detector ${id}; known: ${PII_DETECTOR_IDS.join(', ')}`);
+        }
+        else if (action !== 'off' && action !== 'redact' && action !== 'block') {
+            problems.push(`INTUTIC_MCP_DLP_DETECTORS sets ${id} to ${String(action)}; only off, redact and block exist`);
+        }
+        else {
+            configured[id] = action;
+        }
+    }
+    return { configured, problems };
+}
+//# sourceMappingURL=dlpPii.js.map

package/dist/dlpPii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dlpPii.js","sourceRoot":"","sources":["../src/dlpPii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,uBAAuB,CAAA;AAexE,MAAM,WAAW,GAAG,cAAc,CAAC,WAAW,CAAA;AAC9C,MAAM,YAAY,GAAG,cAAc,CAAC,YAAY,CAAA;AAEhD,MAAM,OAAO,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AAC1D,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CACpC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAA;AACzE,MAAM,SAAS,GAAG,EAAE,CAAA;AACpB,MAAM,GAAG,GAAG,EAAE,CAAA;AACd,MAAM,IAAI,GAAG,EAAE,CAAA;AAEf,SAAS,IAAI,CAAC,MAAc;IAC1B,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,GAAG,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;QACrD,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAChB,CAAC,IAAI,CAAC,CAAA;YACN,IAAI,CAAC,GAAG,CAAC;gBAAE,CAAC,IAAI,CAAC,CAAA;QACnB,CAAC;QACD,GAAG,IAAI,CAAC,CAAA;IACV,CAAC;IACD,OAAO,GAAG,GAAG,EAAE,KAAK,CAAC,CAAA;AACvB,CAAC;AAED,SAAS,IAAI,CAAC,IAAY;IACxB,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAA;IAC1C,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAA;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAC5B,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;QACrB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE;YAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAA;YACvC,OAAO,IAAI,IAAI,EAAE,IAAI,IAAI,IAAI,EAAE,CAAA;QACjC,CAAC,CAAC,CACL,CAAA;IACD,OAAO,KAAK,IAAI,IAAI,CAAC,MAAM,CAAC,CAAA;AAC9B,CAAC;AAED,qFAAqF;AACrF,SAAS,IAAI,CAAC,IAAY;IACxB,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC3C,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACnC,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAA;IACrB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,CAAA;QAClB,IAAI,CAAC,KAAK,GAAG;YAAE,SAAQ;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1B,mEAAmE;YACnE,wBAAwB;YACxB,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAA;YACpC,MAAK;QACP,CAAC;QACD,KAAK,IAAI,CAAC,CAAA;QACV,GAAG,GAAG,CAAC,GAAG,CAAC,CAAA;IACb,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,IAAI,CAAA;IACtC,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAClD,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAA;QAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,CAAA;QACpD,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,GAAG,CAAC,CAAC,GAAG,EAAE,CAAA;IAC5D,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAA;AAC/B,CAAC;AAED,iEAAiE;AACjE,SAAS,GAAG,CAAC,IAAY;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAA;IAC9B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAChC,OAAO,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,MAAM,CAAA;AACnG,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,EAAE,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAA;IACjC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAA;IACtF,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAChC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,KAAK,CAAA;IACtF,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAE,CAAA;IACtC,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5D,wDAAwD;IACxD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAE,CAAA;IACxB,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;AACjC,CAAC;AAED,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,MAAM,CAAA;IAC5C,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAA;AAC3B,CAAC;AAED,MAAM,KAAK,GACT,CAAC,KAAgC,EAAE,EAAE,CACrC,CAAC,IAAY,EAAiB,EAAE,CAC9B,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;AAEpC,MAAM,UAAU,GAAgF;IAC9F,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC;IACtB,UAAU,EAAE,IAAI;IAChB,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC;IACtB,WAAW,EAAE,KAAK,CAAC,KAAK,CAAC;IACzB,YAAY,EAAE,KAAK,CAAC,KAAK,CAAC;CAC3B,CAAA;AAED,+EAA+E;AAC/E,MAAM,CAAC,MAAM,aAAa,GAA2B,cAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;IACtF,MAAM,QAAQ,GAAG,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAA;IACxC,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,gBAAgB,CAAC,CAAC,EAAE,4BAA4B,CAAC,CAAC,SAAS,EAAE,CAAC,CAAA;IAC7F,OAAO;QACL,EAAE,EAAE,CAAC,CAAC,EAAmB;QACzB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC;QAC/B,OAAO,EAAE,CAAC,CAAC,QAAQ,KAAK,SAAS;QACjC,QAAQ;KACT,CAAA;AACH,CAAC,CAAC,CAAA;AAEF,SAAS,OAAO,CAAC,IAAY,EAAE,KAAa,EAAE,GAAW,EAAE,OAAgB;IACzE,IAAI,KAAK,GAAG,CAAC,EAAE,CAAC;QACd,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAA;QACpC,IAAI,CAAC,KAAK,SAAS;YAAE,OAAO,KAAK,CAAA;QACjC,MAAM,OAAO,GACX,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,SAAS,CAAA;QACjG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAA;QACvC,IAAI,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC7G,CAAC;IACD,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACtB,MAAM,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAC9B,IAAI,MAAM,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;QAC3B,IAAI,OAAO,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YACvG,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,OAAO,CAAC,GAAgB,EAAE,IAAY;IACpD,MAAM,GAAG,GAA4B,EAAE,CAAA;IACvC,MAAM,EAAE,GAAG,GAAG,CAAC,KAAK,CAAA;IACpB,IAAI,GAAG,GAAG,CAAC,CAAA;IACX,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QACzB,EAAE,CAAC,SAAS,GAAG,GAAG,CAAA;QAClB,MAAM,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACvB,IAAI,CAAC,CAAC;YAAE,MAAK;QACb,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAA;QACrB,MAAM,GAAG,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QAC9B,MAAM,GAAG,GAAG,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,GAAG,CAAA;QAC7C,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAA;YACtB,GAAG,GAAG,GAAG,CAAA;QACX,CAAC;aAAM,CAAC;YACN,GAAG,GAAG,KAAK,GAAG,CAAC,CAAA;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,GAAG,GAAsD,EAAE,CAAA;IACjE,KAAK,MAAM,GAAG,IAAI,aAAa,EAAE,CAAC;QAChC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAA;IACrF,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAuB;IAI1D,MAAM,UAAU,GAAwB,EAAE,CAAA;IAC1C,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAA;IAC7C,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,iEAAiE,CAAC,EAAE,CAAA;IACtG,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,oEAAoE,CAAC,EAAE,CAAA;IACzG,CAAC;IACD,MAAM,QAAQ,GAAa,EAAE,CAAA;IAC7B,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAiC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAE,gBAAsC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;YAC1D,QAAQ,CAAC,IAAI,CAAC,oDAAoD,EAAE,YAAY,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAChH,CAAC;aAAM,IAAI,MAAM,KAAK,KAAK,IAAI,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;YACzE,QAAQ,CAAC,IAAI,CAAC,kCAAkC,EAAE,OAAO,MAAM,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAA;QAC9G,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,EAAmB,CAAC,GAAG,MAAM,CAAA;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAA;AACjC,CAAC"}

package/dist/emitter.d.ts

@@ -10,9 +10,12 @@
  */
 import type { CallerIdentity } from './identity.js';
 import type { AnomalyFinding } from './anomaly/index.js';
+import type { BudgetEventDetail } from './budget.js';
+import type { ShadowReport } from './wasm/runner.js';
+import type { RuleLoadFailureReason } from '@intutic/shared-types';
 export type EventKind = 'tool_allowed' | 'tool_blocked' | 'tool_redacted'
 /**
- * A `warn` SOP rule matched and the call was allowed (LLD #71): the same
+ * A `warn` SOP rule matched and the call was allowed: the same
  * event the harness gates log for a warn-severity rule, carrying the rule
  * id as `[<id>]` in `reason`, so a SHADOW guardrail seen through this
  * proxy counts toward its evidence like one seen through a gate.
@@ -49,7 +52,50 @@ export type EventKind = 'tool_allowed' | 'tool_blocked' | 'tool_redacted'
  */
  | 'tool_held'
 /** An approved, unexpired, exact-match bypass let a held call through. */
- | 'hold_approved_bypass_used';
+ | 'hold_approved_bypass_used'
+/**
+ * An MCP call budget (budget.ts) reached its warning threshold. Once per
+ * budget per period, across every proxy sharing the Valkey; carries
+ * `budget` and a finding. The call itself was allowed.
+ */
+ | 'mcp_budget_threshold'
+/**
+ * An MCP call budget is used up. Once per budget per period, on the first
+ * refusal; every refusal also sends its own `tool_blocked`.
+ */
+ | 'mcp_budget_exceeded'
+/**
+ * A version of one of the workspace's control-plane rules was refused
+ * (wasm/cloudRules.ts): its binary is missing, does not hash to what its
+ * descriptor names, or cannot load. Sent once per hash and reason, with
+ * `toolName` carrying the rule id and `wasmRule` the detail; the control
+ * plane files one incident per version, as for the LLM proxy's refusals.
+ */
+ | 'wasm_rule_refused'
+/**
+ * The call was evaluated against custom rules in `SHADOW` mode: what each
+ * would have done, bypasses included, in `wasmShadowReports`. The same
+ * report the LLM proxy carries on a trace (`wasm_shadow_reports`); the
+ * control plane counts both toward the rule's promotion evidence.
+ */
+ | 'wasm_shadow_evaluated';
+/** What a custom-rule event carries: `wasmRule` on `wasm_rule_refused`, `wasmShadowReports` on `wasm_shadow_evaluated`. */
+export interface RuleEventDetail {
+    wasmRule?: WasmRuleRefusalDetail;
+    wasmShadowReports?: ShadowReport[];
+}
+/** Which rule version a `wasm_rule_refused` event is about, and why it was refused. */
+export interface WasmRuleRefusalDetail {
+    ruleId: string;
+    name: string;
+    sha256: string;
+    /** One of `RULE_LOAD_FAILURE_REASONS`, as the Rust proxy reports it too. */
+    refusal: RuleLoadFailureReason;
+    /** What the binary hashed to, on a hash mismatch. */
+    actualSha256?: string;
+    /** Whether an earlier version of the rule stays in force on this proxy. */
+    previousInForce: boolean;
+}
 /**
  * What a detection-style event found, so the control plane can file it as a
  * detector finding (adjudicable on the Findings page, routed as
@@ -72,6 +118,13 @@ export interface DetectionFinding {
 export declare function detectionFinding(finding: AnomalyFinding, disposition: DetectionFinding['disposition'], severity: DetectionFinding['severity']): DetectionFinding;
 export interface GovernanceEvent {
     incidentId: string;
+    /**
+     * This event's id, made once in {@link GovernanceEmitter.emit} and carried
+     * on every path it is delivered by — the daemon socket, the direct post and
+     * the event file — so the control plane processes it once however many of
+     * them, and their retries, arrive.
+     */
+    eventId: string;
     kind: EventKind;
     toolName: string;
     toolInput: unknown;
@@ -88,6 +141,15 @@ export interface GovernanceEvent {
      * Absent only for an emitter constructed without one.
      */
     principal?: CallerIdentity;
+    /**
+     * Set on the budget events, and on the `tool_blocked` of a call a used-up
+     * budget refused: which budget, its limit, the calls made, when it resets.
+     */
+    budget?: BudgetEventDetail;
+    /** Set on `wasm_rule_refused`. */
+    wasmRule?: WasmRuleRefusalDetail;
+    /** Set on `wasm_shadow_evaluated`. */
+    wasmShadowReports?: ShadowReport[];
     timestamp: string;
 }
 export declare class GovernanceEmitter {
@@ -98,7 +160,7 @@ export declare class GovernanceEmitter {
     private readonly mcpProxyMode;
     private readonly identity;
     constructor(controlPlaneUrl: string, apiKey: string, eventsFilePath: string, workspaceId: string, mcpProxyMode?: string, identity?: CallerIdentity | undefined);
-    emit(kind: EventKind, toolName: string, toolInput: unknown, reason?: string, finding?: DetectionFinding): void;
+    emit(kind: EventKind, toolName: string, toolInput: unknown, reason?: string, finding?: DetectionFinding, budget?: BudgetEventDetail, rule?: RuleEventDetail): void;
     private runDualPath;
     private postToControlPlane;
     private appendToFile;

package/dist/emitter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"emitter.d.ts","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AAIxD,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,cAAc,GACd,eAAe;AACjB;;;;;GAKG;GACD,cAAc;AAChB;;;;;;GAMG;GACD,+BAA+B;AACjC;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;GAKG;GACD,kBAAkB;AACpB;;;;GAIG;GACD,WAAW;AACb,0EAA0E;GACxE,2BAA2B,CAAA;AAE/B;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAA;IAClB,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,kDAAkD;IAClD,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;IACvC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACnC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,GACrC,gBAAgB,CAElB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,SAAS,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;IAC1B,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBALR,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAsB,EACpC,QAAQ,GAAE,cAAc,GAAG,SAAqB;IAGnE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,gBAAgB,GAAG,IAAI;IA4C9G,OAAO,CAAC,WAAW;YAYL,kBAAkB;YA8BlB,YAAY;CAM3B"}
+{"version":3,"file":"emitter.d.ts","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAQH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,eAAe,CAAA;AACnD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AACpD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAA;AACpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAA;AAIlE,MAAM,MAAM,SAAS,GACjB,cAAc,GACd,cAAc,GACd,eAAe;AACjB;;;;;GAKG;GACD,cAAc;AAChB;;;;;;GAMG;GACD,+BAA+B;AACjC;;;;;;;GAOG;GACD,oBAAoB;AACtB;;;;;GAKG;GACD,kBAAkB;AACpB;;;;GAIG;GACD,WAAW;AACb,0EAA0E;GACxE,2BAA2B;AAC7B;;;;GAIG;GACD,sBAAsB;AACxB;;;GAGG;GACD,qBAAqB;AACvB;;;;;;GAMG;GACD,mBAAmB;AACrB;;;;;GAKG;GACD,uBAAuB,CAAA;AAE3B,2HAA2H;AAC3H,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,iBAAiB,CAAC,EAAE,YAAY,EAAE,CAAA;CACnC;AAED,uFAAuF;AACvF,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,OAAO,EAAE,qBAAqB,CAAA;IAC9B,qDAAqD;IACrD,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,2EAA2E;IAC3E,eAAe,EAAE,OAAO,CAAA;CACzB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAA;IAClB,kFAAkF;IAClF,IAAI,EAAE,MAAM,CAAA;IACZ,kDAAkD;IAClD,WAAW,EAAE,OAAO,GAAG,OAAO,GAAG,MAAM,CAAA;IACvC,QAAQ,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAA;IACnC,gEAAgE;IAChE,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,8FAA8F;AAC9F,wBAAgB,gBAAgB,CAC9B,OAAO,EAAE,cAAc,EACvB,WAAW,EAAE,gBAAgB,CAAC,aAAa,CAAC,EAC5C,QAAQ,EAAE,gBAAgB,CAAC,UAAU,CAAC,GACrC,gBAAgB,CAElB;AAED,MAAM,WAAW,eAAe;IAC9B,UAAU,EAAE,MAAM,CAAA;IAClB;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,SAAS,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,OAAO,CAAA;IAClB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,mEAAmE;IACnE,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,6DAA6D;IAC7D,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B;;;;OAIG;IACH,SAAS,CAAC,EAAE,cAAc,CAAA;IAC1B;;;OAGG;IACH,MAAM,CAAC,EAAE,iBAAiB,CAAA;IAC1B,kCAAkC;IAClC,QAAQ,CAAC,EAAE,qBAAqB,CAAA;IAChC,sCAAsC;IACtC,iBAAiB,CAAC,EAAE,YAAY,EAAE,CAAA;IAClC,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,qBAAa,iBAAiB;IAE1B,OAAO,CAAC,QAAQ,CAAC,eAAe;IAChC,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY;IAC7B,OAAO,CAAC,QAAQ,CAAC,QAAQ;gBALR,eAAe,EAAE,MAAM,EACvB,MAAM,EAAE,MAAM,EACd,cAAc,EAAE,MAAM,EACtB,WAAW,EAAE,MAAM,EACnB,YAAY,GAAE,MAAsB,EACpC,QAAQ,GAAE,cAAc,GAAG,SAAqB;IAGnE,IAAI,CACF,IAAI,EAAE,SAAS,EACf,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,OAAO,EAClB,MAAM,CAAC,EAAE,MAAM,EACf,OAAO,CAAC,EAAE,gBAAgB,EAC1B,MAAM,CAAC,EAAE,iBAAiB,EAC1B,IAAI,CAAC,EAAE,eAAe,GACrB,IAAI;IAoDP,OAAO,CAAC,WAAW;YAYL,kBAAkB;YAkClB,YAAY;CAM3B"}

package/dist/emitter.js

@@ -34,9 +34,10 @@ export class GovernanceEmitter {
         this.mcpProxyMode = mcpProxyMode;
         this.identity = identity;
     }
-    emit(kind, toolName, toolInput, reason, finding) {
+    emit(kind, toolName, toolInput, reason, finding, budget, rule) {
         const event = {
             incidentId: node_crypto.randomUUID(),
+            eventId: node_crypto.randomUUID(),
             kind,
             toolName,
             toolInput,
@@ -46,6 +47,9 @@ export class GovernanceEmitter {
             severity: finding?.severity,
             finding,
             principal: this.identity,
+            budget,
+            wasmRule: rule?.wasmRule,
+            wasmShadowReports: rule?.wasmShadowReports,
             timestamp: new Date().toISOString(),
         };
         if (this.mcpProxyMode === 'daemon') {
@@ -58,12 +62,16 @@ export class GovernanceEmitter {
                 workspaceId: this.workspaceId,
                 harnessType: 'mcp-governance-proxy',
                 incidentId: event.incidentId,
+                eventId: event.eventId,
                 timestamp: event.timestamp,
                 reason,
                 severity: event.severity,
                 finding,
                 toolInput,
                 principal: event.principal,
+                budget,
+                wasmRule: event.wasmRule,
+                wasmShadowReports: event.wasmShadowReports,
             };
             callDaemonSocket('telemetry.enqueue', eventPayload).then(() => {
                 log.debug({ action: 'telemetry_enqueued' }, 'Telemetry successfully enqueued to daemon');
@@ -96,10 +104,14 @@ export class GovernanceEmitter {
                     workspaceId: event.workspaceId,
                     harnessType: event.harnessType,
                     incidentId: event.incidentId,
+                    eventId: event.eventId,
                     reason: event.reason,
                     severity: event.severity,
                     finding: event.finding,
                     principal: event.principal,
+                    budget: event.budget,
+                    wasmRule: event.wasmRule,
+                    wasmShadowReports: event.wasmShadowReports,
                     timestamp: event.timestamp,
                 },
             ],

package/dist/emitter.js.map

@@ -1 +1 @@
-{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAI3C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AAiE7C,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,WAA4C,EAC5C,QAAsC;IAEtC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACtH,CAAC;AAuBD,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,eAAuB,EACvB,MAAc,EACd,cAAsB,EACtB,WAAmB,EACnB,eAAuB,aAAa,EACpC,WAAuC,SAAS;QALhD,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAQ;QACtB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAwB;QACpC,aAAQ,GAAR,QAAQ,CAAwC;IAChE,CAAC;IAEJ,IAAI,CAAC,IAAe,EAAE,QAAgB,EAAE,SAAkB,EAAE,MAAe,EAAE,OAA0B;QACrG,MAAM,KAAK,GAAoB;YAC7B,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;YACpC,IAAI;YACJ,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB;YACnC,MAAM;YACN,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG;gBACnB,6DAA6D;gBAC7D,qEAAqE;gBACrE,sEAAsE;gBACtE,KAAK,EAAE,IAAI;gBACX,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,sBAAsB;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO;gBACP,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;aAC3B,CAAA;YACD,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,2CAA2C,CAAC,CAAA;YAC1F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0EAA0E,CAAC,CAAA;gBAC7I,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;QAEF,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE;gBACN;oBACE,+DAA+D;oBAC/D,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF;SACF,CAAC,CAAA;QAEF,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAA;QACxD,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAsB;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACzC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;CACF"}
+{"version":3,"file":"emitter.js","sourceRoot":"","sources":["../src/emitter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,OAAO,MAAM,kBAAkB,CAAA;AAC3C,OAAO,KAAK,SAAS,MAAM,WAAW,CAAA;AACtC,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAA;AAO3C,MAAM,GAAG,GAAG,YAAY,CAAC,mBAAmB,CAAC,CAAA;AA8G7C,8FAA8F;AAC9F,MAAM,UAAU,gBAAgB,CAC9B,OAAuB,EACvB,WAA4C,EAC5C,QAAsC;IAEtC,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAA;AACtH,CAAC;AAuCD,MAAM,OAAO,iBAAiB;IAET;IACA;IACA;IACA;IACA;IACA;IANnB,YACmB,eAAuB,EACvB,MAAc,EACd,cAAsB,EACtB,WAAmB,EACnB,eAAuB,aAAa,EACpC,WAAuC,SAAS;QALhD,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,mBAAc,GAAd,cAAc,CAAQ;QACtB,gBAAW,GAAX,WAAW,CAAQ;QACnB,iBAAY,GAAZ,YAAY,CAAwB;QACpC,aAAQ,GAAR,QAAQ,CAAwC;IAChE,CAAC;IAEJ,IAAI,CACF,IAAe,EACf,QAAgB,EAChB,SAAkB,EAClB,MAAe,EACf,OAA0B,EAC1B,MAA0B,EAC1B,IAAsB;QAEtB,MAAM,KAAK,GAAoB;YAC7B,UAAU,EAAE,WAAW,CAAC,UAAU,EAAE;YACpC,OAAO,EAAE,WAAW,CAAC,UAAU,EAAE;YACjC,IAAI;YACJ,QAAQ;YACR,SAAS;YACT,WAAW,EAAE,IAAI,CAAC,WAAW;YAC7B,WAAW,EAAE,sBAAsB;YACnC,MAAM;YACN,QAAQ,EAAE,OAAO,EAAE,QAAQ;YAC3B,OAAO;YACP,SAAS,EAAE,IAAI,CAAC,QAAQ;YACxB,MAAM;YACN,QAAQ,EAAE,IAAI,EAAE,QAAQ;YACxB,iBAAiB,EAAE,IAAI,EAAE,iBAAiB;YAC1C,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAA;QAED,IAAI,IAAI,CAAC,YAAY,KAAK,QAAQ,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG;gBACnB,6DAA6D;gBAC7D,qEAAqE;gBACrE,sEAAsE;gBACtE,KAAK,EAAE,IAAI;gBACX,QAAQ;gBACR,WAAW,EAAE,IAAI,CAAC,WAAW;gBAC7B,WAAW,EAAE,sBAAsB;gBACnC,UAAU,EAAE,KAAK,CAAC,UAAU;gBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,OAAO;gBACP,SAAS;gBACT,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,MAAM;gBACN,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C,CAAA;YACD,gBAAgB,CAAC,mBAAmB,EAAE,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE;gBAC5D,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,EAAE,2CAA2C,CAAC,CAAA;YAC1F,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;gBACf,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,EAAE,0EAA0E,CAAC,CAAA;gBAC7I,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;YACzB,CAAC,CAAC,CAAA;YACF,OAAM;QACR,CAAC;QAED,IAAI,CAAC,WAAW,CAAC,KAAK,CAAC,CAAA;IACzB,CAAC;IAEO,WAAW,CAAC,KAAsB;QACxC,kCAAkC;QAClC,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YAC3C,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;QAEF,0CAA0C;QAC1C,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;YACrC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,oBAAoB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,wBAAwB,CAAC,CAAA;QACnG,CAAC,CAAC,CAAA;IACJ,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,KAAsB;QACrD,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC;YAC7B,MAAM,EAAE;gBACN;oBACE,+DAA+D;oBAC/D,KAAK,EAAE,KAAK,CAAC,IAAI;oBACjB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,UAAU,EAAE,KAAK,CAAC,UAAU;oBAC5B,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,SAAS,EAAE,KAAK,CAAC,SAAS;oBAC1B,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,QAAQ,EAAE,KAAK,CAAC,QAAQ;oBACxB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;oBAC1C,SAAS,EAAE,KAAK,CAAC,SAAS;iBAC3B;aACF;SACF,CAAC,CAAA;QAEF,qEAAqE;QACrE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,uEAAuE;QACvE,uEAAuE;QACvE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,eAAe,qBAAqB,CAAA;QACxD,MAAM,WAAW,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,CAAA;IAC5D,CAAC;IAEO,KAAK,CAAC,YAAY,CAAC,KAAsB;QAC/C,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;QAClD,MAAM,OAAO,CAAC,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAC7C,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAA;QACzC,MAAM,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,cAAc,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IAC9D,CAAC;CACF"}

package/dist/guardedValkey.d.ts

@@ -0,0 +1,40 @@
+/**
+ * guardedValkey.ts — the one Valkey connection a proxy process holds, and the
+ * guard every command on it goes through.
+ *
+ * Two things in a proxy read and write Valkey: the shared session window
+ * (sessionStore.ts) and the MCP call budgets (budget.ts). They share this
+ * connection, and they share its rule: a command runs only on a connected
+ * client, never waits longer than a short timeout, and any failure comes back
+ * as `undefined`. What `undefined` means is each caller's business — the
+ * session window falls back to its per-process copy; a budget follows the
+ * proxy's fail setting.
+ *
+ * @module
+ */
+import { Redis } from 'ioredis';
+/** A command that takes longer than this is treated as Valkey being unavailable. */
+export declare const VALKEY_COMMAND_TIMEOUT_MS = 200;
+export interface GuardedValkeyOptions {
+    timeoutMs?: number;
+}
+export interface GuardedRunOptions {
+    /**
+     * Wait (within the timeout) for a connection that is still being set up,
+     * instead of answering `undefined` straight away. For a check whose
+     * `undefined` can refuse a call: the first call after the proxy starts
+     * must not be refused because the connection was a few milliseconds old.
+     */
+    awaitConnect?: boolean;
+}
+export declare class GuardedValkey {
+    readonly client: Redis;
+    private readonly timeoutMs;
+    private warned;
+    constructor(url: string, opts?: GuardedValkeyOptions);
+    /** Runs `op`, or answers `undefined` when Valkey is not connected, too slow, or fails. */
+    run<T>(op: (client: Redis) => Promise<T>, opts?: GuardedRunOptions): Promise<T | undefined>;
+    close(): Promise<void>;
+    private warnOnce;
+}
+//# sourceMappingURL=guardedValkey.d.ts.map

package/dist/guardedValkey.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardedValkey.d.ts","sourceRoot":"","sources":["../src/guardedValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAM/B,oFAAoF;AACpF,eAAO,MAAM,yBAAyB,MAAM,CAAA;AAE5C,MAAM,WAAW,oBAAoB;IACnC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,OAAO,CAAA;CACvB;AAED,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAA;IACtB,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,MAAM,CAAQ;gBAEV,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,oBAAyB;IAexD,0FAA0F;IACpF,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,EAAE,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,CAAC,GAAG,SAAS,CAAC;IAsB/F,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,OAAO,CAAC,QAAQ;CAYjB"}

package/dist/guardedValkey.js

@@ -0,0 +1,84 @@
+/**
+ * guardedValkey.ts — the one Valkey connection a proxy process holds, and the
+ * guard every command on it goes through.
+ *
+ * Two things in a proxy read and write Valkey: the shared session window
+ * (sessionStore.ts) and the MCP call budgets (budget.ts). They share this
+ * connection, and they share its rule: a command runs only on a connected
+ * client, never waits longer than a short timeout, and any failure comes back
+ * as `undefined`. What `undefined` means is each caller's business — the
+ * session window falls back to its per-process copy; a budget follows the
+ * proxy's fail setting.
+ *
+ * @module
+ */
+import { Redis } from 'ioredis';
+import { createStderrLogger } from './stderrLog.js';
+import { describeConnectionError } from './valkeyErrors.js';
+const log = createStderrLogger('mcp-proxy.valkey');
+/** A command that takes longer than this is treated as Valkey being unavailable. */
+export const VALKEY_COMMAND_TIMEOUT_MS = 200;
+export class GuardedValkey {
+    client;
+    timeoutMs;
+    warned = false;
+    constructor(url, opts = {}) {
+        this.timeoutMs = opts.timeoutMs ?? VALKEY_COMMAND_TIMEOUT_MS;
+        this.client = new Redis(url, {
+            lazyConnect: true,
+            // No offline queue: a command issued before the connection is up must
+            // fail now, not wait for a Valkey that may never answer.
+            enableOfflineQueue: false,
+            maxRetriesPerRequest: 1,
+            connectTimeout: 1000,
+            retryStrategy: (times) => Math.min(1000 * 2 ** Math.min(times, 5), 30_000),
+        });
+        this.client.on('error', (err) => this.warnOnce('Valkey unreachable', err));
+        void this.client.connect().catch((err) => this.warnOnce('Valkey connect failed', err));
+    }
+    /** Runs `op`, or answers `undefined` when Valkey is not connected, too slow, or fails. */
+    async run(op, opts = {}) {
+        let timer;
+        const timeout = new Promise((resolve) => {
+            timer = setTimeout(() => resolve(undefined), this.timeoutMs);
+            timer.unref();
+        });
+        try {
+            if (this.client.status !== 'ready') {
+                const settingUp = this.client.status === 'connecting' || this.client.status === 'connect';
+                if (!opts.awaitConnect || !settingUp)
+                    return undefined;
+                const ready = new Promise((resolve) => this.client.once('ready', () => resolve(true)));
+                if ((await Promise.race([ready, timeout])) !== true)
+                    return undefined;
+            }
+            return await Promise.race([op(this.client), timeout]);
+        }
+        catch (err) {
+            this.warnOnce('Valkey command failed', err);
+            return undefined;
+        }
+        finally {
+            if (timer)
+                clearTimeout(timer);
+        }
+    }
+    async close() {
+        try {
+            await this.client.quit();
+        }
+        catch {
+            this.client.disconnect();
+        }
+    }
+    warnOnce(msg, err) {
+        const detail = { err: describeConnectionError(err) };
+        if (this.warned) {
+            log.debug(detail, msg);
+            return;
+        }
+        this.warned = true;
+        log.warn(detail, `${msg} — the anomaly session window falls back to this process, and MCP call budgets follow the fail setting`);
+    }
+}
+//# sourceMappingURL=guardedValkey.js.map

package/dist/guardedValkey.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardedValkey.js","sourceRoot":"","sources":["../src/guardedValkey.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAE3D,MAAM,GAAG,GAAG,kBAAkB,CAAC,kBAAkB,CAAC,CAAA;AAElD,oFAAoF;AACpF,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAA;AAgB5C,MAAM,OAAO,aAAa;IACf,MAAM,CAAO;IACL,SAAS,CAAQ;IAC1B,MAAM,GAAG,KAAK,CAAA;IAEtB,YAAY,GAAW,EAAE,OAA6B,EAAE;QACtD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,yBAAyB,CAAA;QAC5D,IAAI,CAAC,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;YAC3B,WAAW,EAAE,IAAI;YACjB,sEAAsE;YACtE,yDAAyD;YACzD,kBAAkB,EAAE,KAAK;YACzB,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3E,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,CAAC,CAAA;QACnF,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,CAAA;IACjG,CAAC;IAED,0FAA0F;IAC1F,KAAK,CAAC,GAAG,CAAI,EAAiC,EAAE,OAA0B,EAAE;QAC1E,IAAI,KAAiC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YAC5D,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;QACF,IAAI,CAAC;YACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;gBACnC,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,YAAY,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAA;gBACzF,IAAI,CAAC,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS;oBAAE,OAAO,SAAS,CAAA;gBACtD,MAAM,KAAK,GAAG,IAAI,OAAO,CAAO,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;gBAC5F,IAAI,CAAC,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,OAAO,SAAS,CAAA;YACvE,CAAC;YACD,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC,CAAA;QACvD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAA;YAC3C,OAAO,SAAS,CAAA;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAY;QACxC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAA;QACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,GAAG,CAAC,IAAI,CACN,MAAM,EACN,GAAG,GAAG,wGAAwG,CAC/G,CAAA;IACH,CAAC;CACF"}

package/dist/httpJson.d.ts

@@ -14,6 +14,13 @@ export declare class HttpStatusError extends Error {
     constructor(status: number, message: string);
 }
 export declare function httpRequest(method: 'GET' | 'POST', url: string, apiKey: string, body?: string, timeoutMs?: number): Promise<string>;
+/**
+ * GETs a binary body, refusing one larger than `maxBytes` as soon as it is:
+ * the custom-rule binaries (`wasm/cloudRules.ts`) are the one non-JSON body
+ * this package reads, and their size is the control plane's to promise, not
+ * this process's to trust.
+ */
+export declare function getBytes(url: string, apiKey: string, maxBytes: number, timeoutMs?: number): Promise<Buffer>;
 export declare function getJson(url: string, apiKey: string, timeoutMs?: number): Promise<unknown>;
 export declare function postJson(url: string, apiKey: string, payload: unknown, timeoutMs?: number): Promise<unknown>;
 //# sourceMappingURL=httpJson.d.ts.map

package/dist/httpJson.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"httpJson.d.ts","sourceRoot":"","sources":["../src/httpJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,yFAAyF;AACzF,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIrD;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,GAAG,MAAM,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,EACb,SAAS,SAAO,GACf,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/F;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlH"}
+{"version":3,"file":"httpJson.d.ts","sourceRoot":"","sources":["../src/httpJson.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAKH,yFAAyF;AACzF,qBAAa,eAAgB,SAAQ,KAAK;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAAd,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;CAIrD;AAED,wBAAgB,WAAW,CACzB,MAAM,EAAE,KAAK,GAAG,MAAM,EACtB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,EACb,SAAS,SAAO,GACf,OAAO,CAAC,MAAM,CAAC,CA6BjB;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CA8BzG;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAE/F;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAGlH"}

package/dist/httpJson.js

@@ -52,6 +52,45 @@ export function httpRequest(method, url, apiKey, body, timeoutMs = 5000) {
         req.end();
     });
 }
+/**
+ * GETs a binary body, refusing one larger than `maxBytes` as soon as it is:
+ * the custom-rule binaries (`wasm/cloudRules.ts`) are the one non-JSON body
+ * this package reads, and their size is the control plane's to promise, not
+ * this process's to trust.
+ */
+export function getBytes(url, apiKey, maxBytes, timeoutMs = 5000) {
+    return new Promise((resolve, reject) => {
+        const lib = new URL(url).protocol === 'https:' ? node_https : node_http;
+        const headers = { Authorization: `Bearer ${apiKey}`, Accept: 'application/wasm' };
+        const req = lib.request(url, { method: 'GET', headers, timeout: timeoutMs }, (res) => {
+            const status = res.statusCode ?? 0;
+            const chunks = [];
+            let size = 0;
+            res.on('data', (c) => {
+                size += c.length;
+                if (size > maxBytes) {
+                    req.destroy();
+                    reject(new Error(`HTTP GET ${url} returned more than ${maxBytes} bytes`));
+                    return;
+                }
+                chunks.push(c);
+            });
+            res.on('end', () => {
+                const body = Buffer.concat(chunks);
+                if (status >= 400)
+                    reject(new HttpStatusError(status, `HTTP GET ${url} returned ${status}: ${body.toString('utf-8').slice(0, 200)}`));
+                else
+                    resolve(body);
+            });
+        });
+        req.on('error', reject);
+        req.on('timeout', () => {
+            req.destroy();
+            reject(new Error(`HTTP GET ${url} timed out`));
+        });
+        req.end();
+    });
+}
 export async function getJson(url, apiKey, timeoutMs) {
     return JSON.parse(await httpRequest('GET', url, apiKey, undefined, timeoutMs));
 }