@intutic/mcp-governance-proxy 2.2.0 → 2.4.0

package/dist/registryObserver.js

@@ -7,9 +7,12 @@
  * the proxy ever sees a server's tools/list. So the proxy reports its own
  * server: once at start (so a server refused under a `deny` default still
  * reaches the approval queue, even if its tools/list never gets through) and
- * again whenever the tool names it sees change (so the registry can offer
- * per-tool toggles). The control plane creates a candidate on first sight and
- * notifies the workspace.
+ * again whenever the tools it sees change — a tool added or removed, or a
+ * description or input schema changed. The report carries the tool names (for
+ * the registry's per-tool toggles) and the definitions as the server declared
+ * them, before curation, which the control plane compares with the last ones
+ * it stored to score the change's risk. The control plane creates a candidate
+ * on first sight and notifies the workspace.
  *
  * Best-effort and quiet: a failed report costs one registry refresh, never a
  * tool call.
@@ -32,22 +35,30 @@ export class RegistryObserver {
         this.transport = transport;
     }
     /**
-     * Reports the server, with `tools` when known. A report identical to the
+     * Reports the server, with its tools when known. A report identical to the
      * last successful one is skipped. Without an API key, or without a
      * `--server-name` to report, there is nothing the registry could record.
      */
     async observe(tools) {
         if (!this.apiKey || this.serverName === 'unknown')
             return;
-        const toolNames = tools ? [...new Set(tools)].sort() : undefined;
-        const key = JSON.stringify(toolNames ?? null);
-        if (key === this.lastReported || (toolNames === undefined && this.lastReported !== null))
+        let definitions;
+        if (tools) {
+            // One entry per name, the first declared — the rule the risk score matches by.
+            const byName = new Map();
+            for (const t of tools)
+                if (!byName.has(t.name))
+                    byName.set(t.name, t);
+            definitions = [...byName.values()].sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+        }
+        const key = JSON.stringify(definitions ?? null);
+        if (key === this.lastReported || (definitions === undefined && this.lastReported !== null))
             return;
         try {
             await postJson(`${this.controlPlaneUrl}/api/v1/mcp/servers/observe`, this.apiKey, {
                 serverName: this.serverName,
                 transport: this.transport,
-                ...(toolNames ? { tools: toolNames } : {}),
+                ...(definitions ? { tools: definitions.map((t) => t.name), toolDefinitions: definitions } : {}),
             });
             this.lastReported = key;
         }

package/dist/registryObserver.js.map

@@ -1 +1 @@
-{"version":3,"file":"registryObserver.js","sourceRoot":"","sources":["../src/registryObserver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C,MAAM,OAAO,gBAAgB;IAIR;IACA;IACA;IACA;IANX,YAAY,GAAkB,IAAI,CAAA;IAE1C,YACmB,eAAuB,EACvB,MAAc,EACd,UAAkB,EAClB,SAAmC;QAHnC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,cAAS,GAAT,SAAS,CAA0B;IACnD,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAyB;QACrC,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAM;QACzD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;QAChE,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,IAAI,CAAC,CAAA;QAC7C,IAAI,GAAG,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,SAAS,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;YAAE,OAAM;QAChG,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,eAAe,6BAA6B,EAAE,IAAI,CAAC,MAAM,EAAE;gBAChF,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3C,CAAC,CAAA;YACF,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,kDAAkD,CAAC,CAAA;QACnI,CAAC;IACH,CAAC;CACF"}
+{"version":3,"file":"registryObserver.js","sourceRoot":"","sources":["../src/registryObserver.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,kBAAkB,IAAI,YAAY,EAAE,MAAM,gBAAgB,CAAA;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAA;AAExC,MAAM,GAAG,GAAG,YAAY,CAAC,oBAAoB,CAAC,CAAA;AAE9C,MAAM,OAAO,gBAAgB;IAIR;IACA;IACA;IACA;IANX,YAAY,GAAkB,IAAI,CAAA;IAE1C,YACmB,eAAuB,EACvB,MAAc,EACd,UAAkB,EAClB,SAAmC;QAHnC,oBAAe,GAAf,eAAe,CAAQ;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,eAAU,GAAV,UAAU,CAAQ;QAClB,cAAS,GAAT,SAAS,CAA0B;IACnD,CAAC;IAEJ;;;;OAIG;IACH,KAAK,CAAC,OAAO,CAAC,KAAoC;QAChD,IAAI,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,OAAM;QACzD,IAAI,WAA4C,CAAA;QAChD,IAAI,KAAK,EAAE,CAAC;YACV,+EAA+E;YAC/E,MAAM,MAAM,GAAG,IAAI,GAAG,EAA6B,CAAA;YACnD,KAAK,MAAM,CAAC,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAA;YACrE,WAAW,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACrG,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,IAAI,CAAC,CAAA;QAC/C,IAAI,GAAG,KAAK,IAAI,CAAC,YAAY,IAAI,CAAC,WAAW,KAAK,SAAS,IAAI,IAAI,CAAC,YAAY,KAAK,IAAI,CAAC;YAAE,OAAM;QAClG,IAAI,CAAC;YACH,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,eAAe,6BAA6B,EAAE,IAAI,CAAC,MAAM,EAAE;gBAChF,UAAU,EAAE,IAAI,CAAC,UAAU;gBAC3B,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,eAAe,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAChG,CAAC,CAAA;YACF,IAAI,CAAC,YAAY,GAAG,GAAG,CAAA;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,yBAAyB,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EAAE,kDAAkD,CAAC,CAAA;QACnI,CAAC;IACH,CAAC;CACF"}

package/dist/session.d.ts

@@ -8,7 +8,7 @@
  * process (`mcpAutoWrite.ts`'s `wrapWithProxy`, in both `per-session` and
  * `daemon` mode), so one harness session runs one proxy per wrapped server.
  * This class holds the tool-call sequence and the per-detector reask counters
- * the anomaly detectors read. Until Wave 5.3 (TD-437) that state was
+ * the anomaly detectors read. Until Wave 5.3 that state was
  * per-process only — a cross-server ping-pong was invisible, a reask budget
  * reset per server and per restart — and the module doc claimed there was
  * "no second instance to share state with", which was never true of the

package/dist/session.js

@@ -8,7 +8,7 @@
  * process (`mcpAutoWrite.ts`'s `wrapWithProxy`, in both `per-session` and
  * `daemon` mode), so one harness session runs one proxy per wrapped server.
  * This class holds the tool-call sequence and the per-detector reask counters
- * the anomaly detectors read. Until Wave 5.3 (TD-437) that state was
+ * the anomaly detectors read. Until Wave 5.3 that state was
  * per-process only — a cross-server ping-pong was invisible, a reask budget
  * reset per server and per restart — and the module doc claimed there was
  * "no second instance to share state with", which was never true of the

package/dist/sessionScope.d.ts

@@ -1,6 +1,6 @@
 /**
  * sessionScope.ts — the shared-window scope a proxy process derives for
- * itself (TD-437, Wave 5.3).
+ * itself (Wave 5.3).
  *
  * The sync daemon wraps EACH MCP server entry with its own proxy process, so
  * one harness session runs several `McpGovernanceProxy` processes at once —

package/dist/sessionScope.js

@@ -1,6 +1,6 @@
 /**
  * sessionScope.ts — the shared-window scope a proxy process derives for
- * itself (TD-437, Wave 5.3).
+ * itself (Wave 5.3).
  *
  * The sync daemon wraps EACH MCP server entry with its own proxy process, so
  * one harness session runs several `McpGovernanceProxy` processes at once —

package/dist/sessionStore.d.ts

@@ -1,6 +1,6 @@
 /**
  * sessionStore.ts — the Valkey-backed session window the sibling proxy
- * processes of one harness session share (TD-437, Wave 5.3).
+ * processes of one harness session share (Wave 5.3).
  *
  * The Rust LLM proxy keeps a session's tool-call history in Valkey
  * (`store/valkey.rs`: a capped LIST for the sequence, a ZSET for the 60 s
@@ -12,15 +12,15 @@
  *
  * Never a hard dependency. Every operation fails open to `undefined`/`false`
  * and the caller (`SessionState`) falls back to its in-process window: when
- * no URL is configured, when the client is not connected (`status !==
- * 'ready'`, so an absent Valkey adds no latency), when a call takes longer
- * than {@link SHARED_WINDOW_TIMEOUT_MS}, or on any error. The proxy behaves
- * exactly as before Wave 5.3 in every one of those cases.
+ * no URL is configured, when the client is not connected (so an absent
+ * Valkey adds no latency), when a call takes longer than
+ * `VALKEY_COMMAND_TIMEOUT_MS`, or on any error — the guard every command on
+ * the proxy's one Valkey connection goes through (guardedValkey.ts). The
+ * proxy behaves exactly as before Wave 5.3 in every one of those cases.
  *
  * @module
  */
-/** A shared read or write that takes longer than this loses to the local window. */
-export declare const SHARED_WINDOW_TIMEOUT_MS = 200;
+import type { GuardedValkey } from './guardedValkey.js';
 /** Sliding lifetime of the sequence and call-window keys — the Rust `TOOL_SEQUENCE_TTL_SECS`. */
 export declare const SESSION_WINDOW_TTL_SECS = 86400;
 /** Lifetime of a reask allowance, set when the counter is created and never refreshed —
@@ -44,26 +44,13 @@ export interface SharedSessionStore {
     recordCall(scope: string, toolName: string, nowMs: number): Promise<boolean>;
     /** The count including this trip, or `undefined` when unavailable. */
     incrReaskAttempt(scope: string, key: string): Promise<number | undefined>;
-    close(): Promise<void>;
-}
-export interface ValkeySessionStoreOptions {
-    timeoutMs?: number;
 }
 export declare class ValkeySessionStore implements SharedSessionStore {
-    private readonly client;
-    private readonly timeoutMs;
-    private warned;
-    constructor(url: string, opts?: ValkeySessionStoreOptions);
+    private readonly valkey;
+    /** The proxy's one Valkey connection, shared with its call budgets; the proxy closes it. */
+    constructor(valkey: GuardedValkey);
     readWindow(scope: string, nowMs: number, windowMs: number): Promise<SharedWindowSnapshot | undefined>;
     recordCall(scope: string, toolName: string, nowMs: number): Promise<boolean>;
     incrReaskAttempt(scope: string, key: string): Promise<number | undefined>;
-    close(): Promise<void>;
-    /**
-     * The fail-open wrapper every operation goes through: nothing is attempted
-     * unless the client is connected, nothing waits longer than the timeout,
-     * and any failure is `undefined`.
-     */
-    private guarded;
-    private warnOnce;
 }
 //# sourceMappingURL=sessionStore.d.ts.map

package/dist/sessionStore.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAUH,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,MAAM,CAAA;AAC3C,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAC7C;0EAC0E;AAC1E,eAAO,MAAM,iBAAiB,OAAQ,CAAA;AAEtC,eAAO,MAAM,WAAW;4BACP,MAAM;4BACN,MAAM;4BACN,MAAM,OAAO,MAAM;CAC1B,CAAA;AAEV,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IACrG,sEAAsE;IACtE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5E,sEAAsE;IACtE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;IACzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAA;CACvB;AAED,MAAM,WAAW,yBAAyB;IACxC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,qBAAa,kBAAmB,YAAW,kBAAkB;IAC3D,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAO;IAC9B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,MAAM,CAAQ;gBAEV,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,yBAA8B;IAevD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAcrG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB5E,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;IASzE,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B;;;;OAIG;YACW,OAAO;IAiBrB,OAAO,CAAC,QAAQ;CASjB"}
+{"version":3,"file":"sessionStore.d.ts","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAA;AAGvD,iGAAiG;AACjG,eAAO,MAAM,uBAAuB,QAAS,CAAA;AAC7C;0EAC0E;AAC1E,eAAO,MAAM,iBAAiB,OAAQ,CAAA;AAEtC,eAAO,MAAM,WAAW;4BACP,MAAM;4BACN,MAAM;4BACN,MAAM,OAAO,MAAM;CAC1B,CAAA;AAEV,MAAM,WAAW,oBAAoB;IACnC,+DAA+D;IAC/D,QAAQ,EAAE,MAAM,EAAE,CAAA;IAClB,6EAA6E;IAC7E,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,mEAAmE;IACnE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC,CAAA;IACrG,sEAAsE;IACtE,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5E,sEAAsE;IACtE,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAA;CAC1E;AAED,qBAAa,kBAAmB,YAAW,kBAAkB;IAE/C,OAAO,CAAC,QAAQ,CAAC,MAAM;IADnC,4FAA4F;gBAC/D,MAAM,EAAE,aAAa;IAE5C,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAcrG,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAoB5E,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC;CAQhF"}

package/dist/sessionStore.js

@@ -1,6 +1,6 @@
 /**
  * sessionStore.ts — the Valkey-backed session window the sibling proxy
- * processes of one harness session share (TD-437, Wave 5.3).
+ * processes of one harness session share (Wave 5.3).
  *
  * The Rust LLM proxy keeps a session's tool-call history in Valkey
  * (`store/valkey.rs`: a capped LIST for the sequence, a ZSET for the 60 s
@@ -12,21 +12,16 @@
  *
  * Never a hard dependency. Every operation fails open to `undefined`/`false`
  * and the caller (`SessionState`) falls back to its in-process window: when
- * no URL is configured, when the client is not connected (`status !==
- * 'ready'`, so an absent Valkey adds no latency), when a call takes longer
- * than {@link SHARED_WINDOW_TIMEOUT_MS}, or on any error. The proxy behaves
- * exactly as before Wave 5.3 in every one of those cases.
+ * no URL is configured, when the client is not connected (so an absent
+ * Valkey adds no latency), when a call takes longer than
+ * `VALKEY_COMMAND_TIMEOUT_MS`, or on any error — the guard every command on
+ * the proxy's one Valkey connection goes through (guardedValkey.ts). The
+ * proxy behaves exactly as before Wave 5.3 in every one of those cases.
  *
  * @module
  */
 import * as node_crypto from 'node:crypto';
-import { Redis } from 'ioredis';
-import { createStderrLogger } from './stderrLog.js';
-import { describeConnectionError } from './valkeyErrors.js';
 import { TOOL_SEQUENCE_CAP } from './session.js';
-const log = createStderrLogger('mcp-proxy.sessionStore');
-/** A shared read or write that takes longer than this loses to the local window. */
-export const SHARED_WINDOW_TIMEOUT_MS = 200;
 /** Sliding lifetime of the sequence and call-window keys — the Rust `TOOL_SEQUENCE_TTL_SECS`. */
 export const SESSION_WINDOW_TTL_SECS = 86_400;
 /** Lifetime of a reask allowance, set when the counter is created and never refreshed —
@@ -38,26 +33,14 @@ export const sessionKeys = {
     reask: (scope, key) => `v2:mcpsession:${scope}:reask:${key}`,
 };
 export class ValkeySessionStore {
-    client;
-    timeoutMs;
-    warned = false;
-    constructor(url, opts = {}) {
-        this.timeoutMs = opts.timeoutMs ?? SHARED_WINDOW_TIMEOUT_MS;
-        this.client = new Redis(url, {
-            lazyConnect: true,
-            // No offline queue: a command issued before the connection is up must
-            // fail now, not wait for a Valkey that may never answer.
-            enableOfflineQueue: false,
-            maxRetriesPerRequest: 1,
-            connectTimeout: 1000,
-            retryStrategy: (times) => Math.min(1000 * 2 ** Math.min(times, 5), 30_000),
-        });
-        this.client.on('error', (err) => this.warnOnce('Valkey session store unreachable', err));
-        void this.client.connect().catch((err) => this.warnOnce('Valkey session store connect failed', err));
+    valkey;
+    /** The proxy's one Valkey connection, shared with its call budgets; the proxy closes it. */
+    constructor(valkey) {
+        this.valkey = valkey;
     }
     async readWindow(scope, nowMs, windowMs) {
-        return this.guarded(async () => {
-            const results = await this.client
+        return this.valkey.run(async (client) => {
+            const results = await client
                 .pipeline()
                 .lrange(sessionKeys.tools(scope), 0, -1)
                 .zcount(sessionKeys.calls(scope), nowMs - windowMs, '+inf')
@@ -70,10 +53,10 @@ export class ValkeySessionStore {
         });
     }
     async recordCall(scope, toolName, nowMs) {
-        const done = await this.guarded(async () => {
+        const done = await this.valkey.run(async (client) => {
             const tools = sessionKeys.tools(scope);
             const calls = sessionKeys.calls(scope);
-            await this.client
+            await client
                 .pipeline()
                 .rpush(tools, toolName)
                 .ltrim(tools, -TOOL_SEQUENCE_CAP, -1)
@@ -89,55 +72,13 @@ export class ValkeySessionStore {
         return done === true;
     }
     async incrReaskAttempt(scope, key) {
-        return this.guarded(async () => {
+        return this.valkey.run(async (client) => {
             const k = sessionKeys.reask(scope, key);
-            const n = await this.client.incr(k);
+            const n = await client.incr(k);
             if (n === 1)
-                await this.client.expire(k, REASK_WINDOW_SECS);
+                await client.expire(k, REASK_WINDOW_SECS);
             return n;
         });
     }
-    async close() {
-        try {
-            await this.client.quit();
-        }
-        catch {
-            this.client.disconnect();
-        }
-    }
-    /**
-     * The fail-open wrapper every operation goes through: nothing is attempted
-     * unless the client is connected, nothing waits longer than the timeout,
-     * and any failure is `undefined`.
-     */
-    async guarded(op) {
-        if (this.client.status !== 'ready')
-            return undefined;
-        let timer;
-        const timeout = new Promise((resolve) => {
-            timer = setTimeout(() => resolve(undefined), this.timeoutMs);
-            timer.unref();
-        });
-        try {
-            return await Promise.race([op(), timeout]);
-        }
-        catch (err) {
-            this.warnOnce('Valkey session store operation failed', err);
-            return undefined;
-        }
-        finally {
-            if (timer)
-                clearTimeout(timer);
-        }
-    }
-    warnOnce(msg, err) {
-        const detail = { err: describeConnectionError(err) };
-        if (this.warned) {
-            log.debug(detail, msg);
-            return;
-        }
-        this.warned = true;
-        log.warn(detail, `${msg} — falling back to the per-process session window`);
-    }
 }
 //# sourceMappingURL=sessionStore.js.map

package/dist/sessionStore.js.map

@@ -1 +1 @@
-{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAC1C,OAAO,EAAE,KAAK,EAAE,MAAM,SAAS,CAAA;AAC/B,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAA;AACnD,OAAO,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAA;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,MAAM,GAAG,GAAG,kBAAkB,CAAC,wBAAwB,CAAC,CAAA;AAExD,oFAAoF;AACpF,MAAM,CAAC,MAAM,wBAAwB,GAAG,GAAG,CAAA;AAC3C,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAC7C;0EAC0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAEtC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,iBAAiB,KAAK,UAAU,GAAG,EAAE;CACpE,CAAA;AAuBV,MAAM,OAAO,kBAAkB;IACZ,MAAM,CAAO;IACb,SAAS,CAAQ;IAC1B,MAAM,GAAG,KAAK,CAAA;IAEtB,YAAY,GAAW,EAAE,OAAkC,EAAE;QAC3D,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,wBAAwB,CAAA;QAC3D,IAAI,CAAC,MAAM,GAAG,IAAI,KAAK,CAAC,GAAG,EAAE;YAC3B,WAAW,EAAE,IAAI;YACjB,sEAAsE;YACtE,yDAAyD;YACzD,kBAAkB,EAAE,KAAK;YACzB,oBAAoB,EAAE,CAAC;YACvB,cAAc,EAAE,IAAI;YACpB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;SAC3E,CAAC,CAAA;QACF,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,kCAAkC,EAAE,GAAG,CAAC,CAAC,CAAA;QACjG,KAAK,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,qCAAqC,EAAE,GAAG,CAAC,CAAC,CAAA;IAC/G,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB;QAC7D,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM;iBAC9B,QAAQ,EAAE;iBACV,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;iBACvC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;iBAC1D,IAAI,EAAE,CAAA;YACT,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAClC,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACxF,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAClF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YACzC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,IAAI,CAAC,MAAM;iBACd,QAAQ,EAAE;iBACV,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC;iBACtB,KAAK,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;iBACpC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;gBAChD,qEAAqE;gBACrE,gBAAgB;iBACf,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;iBAC1D,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,IAAI,EAAE,CAAA;YACT,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,GAAW;QAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE;YAC7B,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YACnC,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;YAC3D,OAAO,CAAC,CAAA;QACV,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAA;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAA;QAC1B,CAAC;IACH,CAAC;IAED;;;;OAIG;IACK,KAAK,CAAC,OAAO,CAAI,EAAoB;QAC3C,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,OAAO;YAAE,OAAO,SAAS,CAAA;QACpD,IAAI,KAAiC,CAAA;QACrC,MAAM,OAAO,GAAG,IAAI,OAAO,CAAY,CAAC,OAAO,EAAE,EAAE;YACjD,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAA;YAC5D,KAAK,CAAC,KAAK,EAAE,CAAA;QACf,CAAC,CAAC,CAAA;QACF,IAAI,CAAC;YACH,OAAO,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,CAAC,CAAA;QAC5C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,QAAQ,CAAC,uCAAuC,EAAE,GAAG,CAAC,CAAA;YAC3D,OAAO,SAAS,CAAA;QAClB,CAAC;gBAAS,CAAC;YACT,IAAI,KAAK;gBAAE,YAAY,CAAC,KAAK,CAAC,CAAA;QAChC,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAW,EAAE,GAAY;QACxC,MAAM,MAAM,GAAG,EAAE,GAAG,EAAE,uBAAuB,CAAC,GAAG,CAAC,EAAE,CAAA;QACpD,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;YACtB,OAAM;QACR,CAAC;QACD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAA;QAClB,GAAG,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,GAAG,mDAAmD,CAAC,CAAA;IAC7E,CAAC;CACF"}
+{"version":3,"file":"sessionStore.js","sourceRoot":"","sources":["../src/sessionStore.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,KAAK,WAAW,MAAM,aAAa,CAAA;AAE1C,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAA;AAEhD,iGAAiG;AACjG,MAAM,CAAC,MAAM,uBAAuB,GAAG,MAAM,CAAA;AAC7C;0EAC0E;AAC1E,MAAM,CAAC,MAAM,iBAAiB,GAAG,KAAK,CAAA;AAEtC,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,iBAAiB,KAAK,QAAQ;IACxD,KAAK,EAAE,CAAC,KAAa,EAAE,GAAW,EAAE,EAAE,CAAC,iBAAiB,KAAK,UAAU,GAAG,EAAE;CACpE,CAAA;AAkBV,MAAM,OAAO,kBAAkB;IAEA;IAD7B,4FAA4F;IAC5F,YAA6B,MAAqB;QAArB,WAAM,GAAN,MAAM,CAAe;IAAG,CAAC;IAEtD,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,KAAa,EAAE,QAAgB;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,OAAO,GAAG,MAAM,MAAM;iBACzB,QAAQ,EAAE;iBACV,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;iBACvC,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,QAAQ,EAAE,MAAM,CAAC;iBAC1D,IAAI,EAAE,CAAA;YACT,MAAM,QAAQ,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAClC,MAAM,KAAK,GAAG,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;YAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;gBAAE,OAAO,SAAS,CAAA;YACxF,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;QAClF,CAAC,CAAC,CAAA;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,KAAa;QAC7D,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YAClD,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,CAAC,CAAA;YACtC,MAAM,MAAM;iBACT,QAAQ,EAAE;iBACV,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC;iBACtB,KAAK,CAAC,KAAK,EAAE,CAAC,iBAAiB,EAAE,CAAC,CAAC,CAAC;iBACpC,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;gBAChD,qEAAqE;gBACrE,gBAAgB;iBACf,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,KAAK,IAAI,WAAW,CAAC,UAAU,EAAE,EAAE,CAAC;iBAC1D,MAAM,CAAC,KAAK,EAAE,uBAAuB,CAAC;iBACtC,IAAI,EAAE,CAAA;YACT,OAAO,IAAI,CAAA;QACb,CAAC,CAAC,CAAA;QACF,OAAO,IAAI,KAAK,IAAI,CAAA;IACtB,CAAC;IAED,KAAK,CAAC,gBAAgB,CAAC,KAAa,EAAE,GAAW;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;YACtC,MAAM,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;YACvC,MAAM,CAAC,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;YAC9B,IAAI,CAAC,KAAK,CAAC;gBAAE,MAAM,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAA;YACtD,OAAO,CAAC,CAAA;QACV,CAAC,CAAC,CAAA;IACJ,CAAC;CACF"}

package/dist/wasm/cloudRules.d.ts

@@ -0,0 +1,138 @@
+/**
+ * wasm/cloudRules.ts — the workspace's custom rules from the control plane:
+ * the rules uploaded from the dashboard, the CLI or Terraform, which the LLM
+ * proxy enforces too.
+ *
+ * Port of the control-plane half of `packages/proxy/src/wasm/registry.rs`
+ * (`ensure_up_to_date`, `load_descriptor`, `report_refusal`). The descriptors
+ * arrive with the workspace policy this proxy already fetches (`wasmRules` on
+ * `GET /api/v1/sop/rules`, or on the MCP daemon's cached
+ * `GET /api/v1/policy/resolve`), so they refresh when the policy does. Each
+ * binary is fetched by the SHA-256 its descriptor names, only when no loaded
+ * rule already has that hash, and must hash to it before it is compiled:
+ * whoever can answer for that hash could otherwise swap a governance rule for
+ * one that allows everything.
+ *
+ * A version that cannot load — binary missing, hash mismatch, or a module the
+ * worker refuses — is reported once per hash and reason, and the version of
+ * that rule already loaded, if any, keeps enforcing. A control plane that
+ * cannot be reached for a binary leaves the whole loaded set as it was, as
+ * `registry.rs` does when its fetch fails.
+ *
+ * @module
+ */
+import type { WasmRuleDescriptor, WasmRuleMode } from '@intutic/shared-types';
+import type { WasmRuleRefusalDetail } from '../emitter.js';
+import { type CompileBridge, type CompileFailureReason } from './loader.js';
+/**
+ * Minimum time between attempts after a sync that could not reach the control
+ * plane or refused a version — the Rust proxy's 5-second rescan, so a binary
+ * published a moment after its descriptor is picked up as quickly there.
+ */
+export declare const CLOUD_RETRY_MS = 5000;
+/** A control-plane rule loaded into the worker. */
+export interface CloudRuleMeta {
+    /** The control plane's rule id (`wasm_…`), reported as is, like the Rust proxy does. */
+    ruleId: string;
+    name: string;
+    sha256: string;
+    priority: number;
+    mode: WasmRuleMode;
+    readsReferencedFiles: boolean;
+    rego: boolean;
+    /** Kept so a worker respawn can recompile without fetching again. */
+    bytes: Uint8Array;
+}
+/**
+ * Why a control-plane rule version was not loaded (`registry.rs`'s `Refusal`).
+ * `kind` is the reason the control plane files the incident under
+ * (`RULE_LOAD_FAILURE_REASONS`): a module the worker refuses carries the
+ * worker's own reason for it.
+ */
+export type CloudRuleRefusal = {
+    kind: 'missing';
+} | {
+    kind: 'hash_mismatch';
+    actual: string;
+} | {
+    kind: CompileFailureReason;
+    error: string;
+};
+/** One refused version, reported once per hash and reason. */
+export interface CloudRuleRefusalReport {
+    descriptor: WasmRuleDescriptor;
+    refusal: CloudRuleRefusal;
+    /** Whether an earlier version of the rule stays in force. */
+    hasPrevious: boolean;
+    /** The sentence the incident and the log line carry, in the Rust proxy's words. */
+    description: string;
+}
+/**
+ * The binary a hash names: its bytes, or `null` when the control plane has
+ * none. Throws when the control plane cannot be asked.
+ */
+export type FetchRuleBinary = (sha256: string) => Promise<Uint8Array | null>;
+/** What the sync needs from the worker, implemented by `WasmRunner`. */
+export interface CloudRuleBridge extends CompileBridge {
+    /** A rule's loaded version changed: whatever the previous version did no longer counts against it. */
+    replaced(ruleId: string): void;
+}
+/**
+ * Fetches binaries from the control plane's rule store by hash. A 404 is a
+ * binary the control plane does not have; any other failure means it could
+ * not be asked.
+ */
+export declare function fetchRuleBinaryFrom(controlPlaneUrl: string, apiKey: string): FetchRuleBinary;
+/** A refusal as the `wasm_rule_refused` event carries it. */
+export declare function refusalDetail(report: CloudRuleRefusalReport): WasmRuleRefusalDetail;
+/** Whether `bytes` are the binary `sha256` names; case is not significant in hex. */
+export declare function binaryMatches(bytes: Uint8Array, sha256: string): {
+    matches: boolean;
+    actual: string;
+};
+export declare function describeRefusal(descriptor: WasmRuleDescriptor, refusal: CloudRuleRefusal, hasPrevious: boolean): string;
+export declare class CloudRuleSet {
+    private readonly fetchBinary;
+    private readonly report;
+    private rules;
+    /** The descriptor list last applied, serialized; `undefined` until one has been. */
+    private appliedKey;
+    /** The list of the last attempt, applied or not, and when it ran. */
+    private attemptedKey;
+    private attemptedAt;
+    /** Whether the applied list left a version unloaded, so it is retried. */
+    private incomplete;
+    private syncing;
+    private readonly refusalsReported;
+    constructor(fetchBinary: FetchRuleBinary, report: (report: CloudRuleRefusalReport) => void);
+    /** Whether a descriptor list has been applied, so the loaded set is the workspace's. */
+    isLoaded(): boolean;
+    /** The loaded rules, in descriptor order. */
+    getRules(): readonly CloudRuleMeta[];
+    /**
+     * Brings the loaded set in line with `descriptors`.
+     *
+     * A changed list is applied before this resolves, so the call that follows
+     * a policy refresh is judged by the new set. Retrying versions the applied
+     * list refused, at most every {@link CLOUD_RETRY_MS}, runs in the
+     * background: the loaded set is already the workspace's. A list that could
+     * not be applied is retried no sooner either, so an unreachable control
+     * plane costs a call one fetch timeout at most every few seconds rather
+     * than on every call.
+     */
+    sync(descriptors: readonly WasmRuleDescriptor[], bridge: CloudRuleBridge): Promise<void>;
+    /**
+     * Recompiles every loaded rule from its kept bytes — the worker that held
+     * them was replaced. Waits for a sync in flight, which may have compiled
+     * into the old worker.
+     */
+    reload(bridge: CompileBridge): Promise<void>;
+    private run;
+    private apply;
+    /** A binary some loaded rule already has: compiled again only when it is new to this rule id. */
+    private reuse;
+    /** `load_descriptor`: the hash, then the same load checks as a local rule. */
+    private load;
+    private reportOnce;
+}
+//# sourceMappingURL=cloudRules.d.ts.map

package/dist/wasm/cloudRules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cloudRules.d.ts","sourceRoot":"","sources":["../../src/wasm/cloudRules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAGH,OAAO,KAAK,EAAE,kBAAkB,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAA;AAG7E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,eAAe,CAAA;AAC1D,OAAO,EAAuB,KAAK,aAAa,EAAE,KAAK,oBAAoB,EAAE,MAAM,aAAa,CAAA;AAIhG;;;;GAIG;AACH,eAAO,MAAM,cAAc,OAAQ,CAAA;AAEnC,mDAAmD;AACnD,MAAM,WAAW,aAAa;IAC5B,wFAAwF;IACxF,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,EAAE,YAAY,CAAA;IAClB,oBAAoB,EAAE,OAAO,CAAA;IAC7B,IAAI,EAAE,OAAO,CAAA;IACb,qEAAqE;IACrE,KAAK,EAAE,UAAU,CAAA;CAClB;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,eAAe,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACzC;IAAE,IAAI,EAAE,oBAAoB,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAA;AAEjD,8DAA8D;AAC9D,MAAM,WAAW,sBAAsB;IACrC,UAAU,EAAE,kBAAkB,CAAA;IAC9B,OAAO,EAAE,gBAAgB,CAAA;IACzB,6DAA6D;IAC7D,WAAW,EAAE,OAAO,CAAA;IACpB,mFAAmF;IACnF,WAAW,EAAE,MAAM,CAAA;CACpB;AAED;;;GAGG;AACH,MAAM,MAAM,eAAe,GAAG,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,GAAG,IAAI,CAAC,CAAA;AAE5E,wEAAwE;AACxE,MAAM,WAAW,eAAgB,SAAQ,aAAa;IACpD,sGAAsG;IACtG,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAC/B;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,eAAe,CAU5F;AAED,6DAA6D;AAC7D,wBAAgB,aAAa,CAAC,MAAM,EAAE,sBAAsB,GAAG,qBAAqB,CAUnF;AAED,qFAAqF;AACrF,wBAAgB,aAAa,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAGrG;AAQD,wBAAgB,eAAe,CAAC,UAAU,EAAE,kBAAkB,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,OAAO,GAAG,MAAM,CAWvH;AAED,qBAAa,YAAY;IAarB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,MAAM;IAbzB,OAAO,CAAC,KAAK,CAAsB;IACnC,oFAAoF;IACpF,OAAO,CAAC,UAAU,CAAoB;IACtC,qEAAqE;IACrE,OAAO,CAAC,YAAY,CAAoB;IACxC,OAAO,CAAC,WAAW,CAAI;IACvB,0EAA0E;IAC1E,OAAO,CAAC,UAAU,CAAQ;IAC1B,OAAO,CAAC,OAAO,CAA6B;IAC5C,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAoB;gBAGlC,WAAW,EAAE,eAAe,EAC5B,MAAM,EAAE,CAAC,MAAM,EAAE,sBAAsB,KAAK,IAAI;IAGnE,wFAAwF;IACxF,QAAQ,IAAI,OAAO;IAInB,6CAA6C;IAC7C,QAAQ,IAAI,SAAS,aAAa,EAAE;IAIpC;;;;;;;;;;OAUG;IACG,IAAI,CAAC,WAAW,EAAE,SAAS,kBAAkB,EAAE,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IAY9F;;;;OAIG;IACG,MAAM,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC;IAKlD,OAAO,CAAC,GAAG;YAcG,KAAK;IAyDnB,iGAAiG;YACnF,KAAK;IAYnB,8EAA8E;YAChE,IAAI;IAalB,OAAO,CAAC,UAAU;CAQnB"}