@intutic/shared-types 1.10.0 → 2.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (122) hide show
  1. package/README.md +1 -1
  2. package/dist/anomaly.d.ts +11 -0
  3. package/dist/anomaly.d.ts.map +1 -1
  4. package/dist/api-contracts.d.ts +97 -9
  5. package/dist/api-contracts.d.ts.map +1 -1
  6. package/dist/api-contracts.js +9 -0
  7. package/dist/api-contracts.js.map +1 -1
  8. package/dist/auth.d.ts +164 -1
  9. package/dist/auth.d.ts.map +1 -1
  10. package/dist/auth.js +39 -1
  11. package/dist/auth.js.map +1 -1
  12. package/dist/billing.d.ts +2 -99
  13. package/dist/billing.d.ts.map +1 -1
  14. package/dist/billing.js +2 -17
  15. package/dist/billing.js.map +1 -1
  16. package/dist/enums.d.ts +341 -4
  17. package/dist/enums.d.ts.map +1 -1
  18. package/dist/enums.js +369 -6
  19. package/dist/enums.js.map +1 -1
  20. package/dist/errors.d.ts +20 -1
  21. package/dist/errors.d.ts.map +1 -1
  22. package/dist/errors.js +20 -1
  23. package/dist/errors.js.map +1 -1
  24. package/dist/finops.d.ts +97 -1
  25. package/dist/finops.d.ts.map +1 -1
  26. package/dist/governanceCoverage.d.ts +82 -0
  27. package/dist/governanceCoverage.d.ts.map +1 -0
  28. package/dist/governanceCoverage.js +72 -0
  29. package/dist/governanceCoverage.js.map +1 -0
  30. package/dist/guardrailIr.d.ts +287 -0
  31. package/dist/guardrailIr.d.ts.map +1 -0
  32. package/dist/guardrailIr.js +301 -0
  33. package/dist/guardrailIr.js.map +1 -0
  34. package/dist/guardrailRender.d.ts +154 -0
  35. package/dist/guardrailRender.d.ts.map +1 -0
  36. package/dist/guardrailRender.js +440 -0
  37. package/dist/guardrailRender.js.map +1 -0
  38. package/dist/identity.d.ts +75 -0
  39. package/dist/identity.d.ts.map +1 -1
  40. package/dist/identity.js +5 -1
  41. package/dist/identity.js.map +1 -1
  42. package/dist/index.d.ts +34 -14
  43. package/dist/index.d.ts.map +1 -1
  44. package/dist/index.js +124 -2
  45. package/dist/index.js.map +1 -1
  46. package/dist/intelligence.d.ts +37 -11
  47. package/dist/intelligence.d.ts.map +1 -1
  48. package/dist/intelligence.js.map +1 -1
  49. package/dist/modelCatalog.d.ts +89 -0
  50. package/dist/modelCatalog.d.ts.map +1 -0
  51. package/dist/modelCatalog.generated.d.ts +7217 -0
  52. package/dist/modelCatalog.generated.d.ts.map +1 -0
  53. package/dist/modelCatalog.generated.js +577 -0
  54. package/dist/modelCatalog.generated.js.map +1 -0
  55. package/dist/modelCatalog.js +112 -0
  56. package/dist/modelCatalog.js.map +1 -0
  57. package/dist/notifications.d.ts +134 -2
  58. package/dist/notifications.d.ts.map +1 -1
  59. package/dist/observability.d.ts +4 -0
  60. package/dist/observability.d.ts.map +1 -1
  61. package/dist/policyGuardrails.d.ts +433 -0
  62. package/dist/policyGuardrails.d.ts.map +1 -0
  63. package/dist/policyGuardrails.js +91 -0
  64. package/dist/policyGuardrails.js.map +1 -0
  65. package/dist/posturePresets.d.ts +74 -0
  66. package/dist/posturePresets.d.ts.map +1 -0
  67. package/dist/posturePresets.js +139 -0
  68. package/dist/posturePresets.js.map +1 -0
  69. package/dist/providerVerification.d.ts +64 -0
  70. package/dist/providerVerification.d.ts.map +1 -0
  71. package/dist/providerVerification.js +184 -0
  72. package/dist/providerVerification.js.map +1 -0
  73. package/dist/providers.d.ts +93 -0
  74. package/dist/providers.d.ts.map +1 -0
  75. package/dist/providers.js +176 -0
  76. package/dist/providers.js.map +1 -0
  77. package/dist/rulePredicateDsl.d.ts +101 -0
  78. package/dist/rulePredicateDsl.d.ts.map +1 -0
  79. package/dist/rulePredicateDsl.js +263 -0
  80. package/dist/rulePredicateDsl.js.map +1 -0
  81. package/dist/rulePredicateEval.d.ts +38 -0
  82. package/dist/rulePredicateEval.d.ts.map +1 -0
  83. package/dist/rulePredicateEval.js +124 -0
  84. package/dist/rulePredicateEval.js.map +1 -0
  85. package/dist/scriptScan.d.ts +162 -0
  86. package/dist/scriptScan.d.ts.map +1 -0
  87. package/dist/scriptScan.js +362 -0
  88. package/dist/scriptScan.js.map +1 -0
  89. package/dist/secretPatterns.d.ts +43 -0
  90. package/dist/secretPatterns.d.ts.map +1 -0
  91. package/dist/secretPatterns.js +73 -0
  92. package/dist/secretPatterns.js.map +1 -0
  93. package/dist/skillScan.d.ts +166 -0
  94. package/dist/skillScan.d.ts.map +1 -0
  95. package/dist/skillScan.js +398 -0
  96. package/dist/skillScan.js.map +1 -0
  97. package/dist/sop.d.ts +188 -9
  98. package/dist/sop.d.ts.map +1 -1
  99. package/dist/sop.js +54 -2
  100. package/dist/sop.js.map +1 -1
  101. package/dist/sourceProviders.d.ts +41 -0
  102. package/dist/sourceProviders.d.ts.map +1 -0
  103. package/dist/sourceProviders.js +48 -0
  104. package/dist/sourceProviders.js.map +1 -0
  105. package/dist/sync.d.ts +98 -8
  106. package/dist/sync.d.ts.map +1 -1
  107. package/dist/sync.js.map +1 -1
  108. package/dist/toon.d.ts +80 -0
  109. package/dist/toon.d.ts.map +1 -0
  110. package/dist/toon.js +278 -0
  111. package/dist/toon.js.map +1 -0
  112. package/dist/usage.d.ts +23 -0
  113. package/dist/usage.d.ts.map +1 -1
  114. package/dist/wasmHost.d.ts +58 -0
  115. package/dist/wasmHost.d.ts.map +1 -0
  116. package/dist/wasmHost.js +80 -0
  117. package/dist/wasmHost.js.map +1 -0
  118. package/dist/workspaceSettings.d.ts +463 -21
  119. package/dist/workspaceSettings.d.ts.map +1 -1
  120. package/dist/workspaceSettings.js +86 -1
  121. package/dist/workspaceSettings.js.map +1 -1
  122. package/package.json +4 -3
package/dist/billing.d.ts CHANGED
@@ -1,14 +1,13 @@
1
1
  /**
2
2
  * Monetization & Financial Ledger types — LLD #20
3
3
  *
4
- * Stripe Metered Billing, FinOps Chargeback GL Export,
4
+ * Stripe Metered Billing,
5
5
  * and usage-based overage enforcement.
6
6
  *
7
- * HLD §3.19 (4D Attribution, Showback/Chargeback), §3.23 (PLG/Billing)
7
+ * HLD §3.23 (PLG/Billing)
8
8
  *
9
9
  * @module
10
10
  */
11
- import { z } from 'zod';
12
11
  /**
13
12
  * Status of a Stripe metered usage event report.
14
13
  * - PENDING: inserted, Stripe call not yet made
@@ -53,84 +52,6 @@ export interface ReconcileResult {
53
52
  /** Rows still FAILED after this run */
54
53
  stillFailed: number;
55
54
  }
56
- /**
57
- * Department → GL cost center code mapping.
58
- * Enterprise tier — maps FinOps attribution dimensions to ERP/SAP GL codes.
59
- * HLD §3.19 — Chargeback mode.
60
- */
61
- export interface ChargebackGlMapping {
62
- /** Unique mapping ID — `newId('cgl')` */
63
- mappingId: string;
64
- /** Workspace scope */
65
- workspaceId: string;
66
- /** FK to departments.department_id */
67
- departmentId: string;
68
- /** GL cost center code (e.g., 'CC-4200', 'ENG-PLATFORM') */
69
- glCode: string;
70
- /** Human-readable cost center label */
71
- costCenter: string | null;
72
- createdAt: string;
73
- updatedAt: string;
74
- }
75
- /**
76
- * Chargeback GL mapping with joined department name (for API responses).
77
- */
78
- export interface ChargebackGlMappingRow extends ChargebackGlMapping {
79
- /** Department name (joined from departments table) */
80
- departmentName: string;
81
- }
82
- /**
83
- * A single row in a chargeback export report.
84
- * Matched = has a GL code mapping; unmatched = no mapping defined.
85
- */
86
- export interface ChargebackExportRow {
87
- departmentId: string;
88
- departmentName: string;
89
- /** Null if unmatched (no GL mapping defined for this department) */
90
- glCode: string | null;
91
- costCenter: string | null;
92
- /** Total AI spend for this department in the period (USD) */
93
- totalCostUsd: number;
94
- /** Per-model cost breakdown: { 'claude-4': 12.40, 'gpt-4o': 3.20 } */
95
- modelBreakdown: Record<string, number>;
96
- /** Ratio of wasted tokens (0.0–1.0) */
97
- wasteRatio: number;
98
- /** true = GL code found; false = flagged for Finance review */
99
- matched: boolean;
100
- }
101
- /**
102
- * Full chargeback report (JSON format response).
103
- * HLD §3.19 — GL Code Mapping Data Model.
104
- */
105
- export interface ChargebackReport {
106
- period: {
107
- from: string;
108
- to: string;
109
- };
110
- generatedAt: string;
111
- rows: ChargebackExportRow[];
112
- summary: {
113
- totalCostUsd: number;
114
- matchedCostUsd: number;
115
- unmatchedCostUsd: number;
116
- departments: number;
117
- };
118
- }
119
- /** Zod schema for GL mapping upsert input. */
120
- export declare const UpsertGlMappingInputSchema: z.ZodObject<{
121
- departmentId: z.ZodString;
122
- glCode: z.ZodString;
123
- costCenter: z.ZodOptional<z.ZodString>;
124
- }, "strip", z.ZodTypeAny, {
125
- departmentId: string;
126
- glCode: string;
127
- costCenter?: string | undefined;
128
- }, {
129
- departmentId: string;
130
- glCode: string;
131
- costCenter?: string | undefined;
132
- }>;
133
- export type UpsertGlMappingInput = z.infer<typeof UpsertGlMappingInputSchema>;
134
55
  /**
135
56
  * Current period metered usage summary for a workspace.
136
57
  * Returned by GET /api/v1/billing/usage/current.
@@ -152,22 +73,4 @@ export interface BillingUsageSummary {
152
73
  /** True when budget:hard_block:{wid} Valkey key is set */
153
74
  hardCapActive: boolean;
154
75
  }
155
- /** Chargeback export query params schema. */
156
- export declare const ChargebackExportQuerySchema: z.ZodObject<{
157
- period: z.ZodDefault<z.ZodEnum<["month", "quarter", "custom"]>>;
158
- from: z.ZodOptional<z.ZodString>;
159
- to: z.ZodOptional<z.ZodString>;
160
- format: z.ZodDefault<z.ZodEnum<["csv", "json"]>>;
161
- }, "strip", z.ZodTypeAny, {
162
- period: "custom" | "month" | "quarter";
163
- format: "csv" | "json";
164
- from?: string | undefined;
165
- to?: string | undefined;
166
- }, {
167
- period?: "custom" | "month" | "quarter" | undefined;
168
- from?: string | undefined;
169
- to?: string | undefined;
170
- format?: "csv" | "json" | undefined;
171
- }>;
172
- export type ChargebackExportQuery = z.infer<typeof ChargebackExportQuerySchema>;
173
76
  //# sourceMappingURL=billing.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gDAAgD;IAChD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,gCAAgC;IAChC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;CACpB;AAID;;;;GAIG;AACH,MAAM,WAAW,mBAAmB;IAClC,yCAAyC;IACzC,SAAS,EAAE,MAAM,CAAA;IACjB,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,sCAAsC;IACtC,YAAY,EAAE,MAAM,CAAA;IACpB,4DAA4D;IAC5D,MAAM,EAAE,MAAM,CAAA;IACd,uCAAuC;IACvC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,sBAAuB,SAAQ,mBAAmB;IACjE,sDAAsD;IACtD,cAAc,EAAE,MAAM,CAAA;CACvB;AAED;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,YAAY,EAAE,MAAM,CAAA;IACpB,cAAc,EAAE,MAAM,CAAA;IACtB,oEAAoE;IACpE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;IACzB,6DAA6D;IAC7D,YAAY,EAAE,MAAM,CAAA;IACpB,sEAAsE;IACtE,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IACtC,uCAAuC;IACvC,UAAU,EAAE,MAAM,CAAA;IAClB,+DAA+D;IAC/D,OAAO,EAAE,OAAO,CAAA;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,WAAW,EAAE,MAAM,CAAA;IACnB,IAAI,EAAE,mBAAmB,EAAE,CAAA;IAC3B,OAAO,EAAE;QACP,YAAY,EAAE,MAAM,CAAA;QACpB,cAAc,EAAE,MAAM,CAAA;QACtB,gBAAgB,EAAE,MAAM,CAAA;QACxB,WAAW,EAAE,MAAM,CAAA;KACpB,CAAA;CACF;AAED,8CAA8C;AAC9C,eAAO,MAAM,0BAA0B;;;;;;;;;;;;EAIrC,CAAA;AACF,MAAM,MAAM,oBAAoB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,0BAA0B,CAAC,CAAA;AAI7E;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,iCAAiC;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0DAA0D;IAC1D,aAAa,EAAE,OAAO,CAAA;CACvB;AAED,6CAA6C;AAC7C,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;EAKtC,CAAA;AACF,MAAM,MAAM,qBAAqB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,2BAA2B,CAAC,CAAA"}
1
+ {"version":3,"file":"billing.d.ts","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAMH;;;;;GAKG;AACH,MAAM,MAAM,kBAAkB,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAA;AAElE;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,uCAAuC;IACvC,OAAO,EAAE,MAAM,CAAA;IACf,sBAAsB;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,qEAAqE;IACrE,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,gDAAgD;IAChD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,yCAAyC;IACzC,UAAU,EAAE,MAAM,CAAA;IAClB,0CAA0C;IAC1C,OAAO,EAAE,MAAM,CAAA;IACf,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,gCAAgC;IAChC,MAAM,EAAE,kBAAkB,CAAA;IAC1B,kCAAkC;IAClC,UAAU,EAAE,MAAM,CAAA;IAClB,8CAA8C;IAC9C,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CACzB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,kCAAkC;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,oDAAoD;IACpD,SAAS,EAAE,MAAM,CAAA;IACjB,uCAAuC;IACvC,WAAW,EAAE,MAAM,CAAA;CACpB;AAID;;;GAGG;AACH,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAA;IACnB,8BAA8B;IAC9B,WAAW,EAAE,MAAM,CAAA;IACnB,4BAA4B;IAC5B,SAAS,EAAE,MAAM,CAAA;IACjB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,CAAA;IAClB,iCAAiC;IACjC,cAAc,EAAE,MAAM,CAAA;IACtB,qEAAqE;IACrE,aAAa,EAAE,MAAM,CAAA;IACrB,qCAAqC;IACrC,mBAAmB,EAAE,MAAM,CAAA;IAC3B,0DAA0D;IAC1D,aAAa,EAAE,OAAO,CAAA;CACvB"}
package/dist/billing.js CHANGED
@@ -2,27 +2,12 @@
2
2
  /**
3
3
  * Monetization & Financial Ledger types — LLD #20
4
4
  *
5
- * Stripe Metered Billing, FinOps Chargeback GL Export,
5
+ * Stripe Metered Billing,
6
6
  * and usage-based overage enforcement.
7
7
  *
8
- * HLD §3.19 (4D Attribution, Showback/Chargeback), §3.23 (PLG/Billing)
8
+ * HLD §3.23 (PLG/Billing)
9
9
  *
10
10
  * @module
11
11
  */
12
12
  Object.defineProperty(exports, "__esModule", { value: true });
13
- exports.ChargebackExportQuerySchema = exports.UpsertGlMappingInputSchema = void 0;
14
- const zod_1 = require("zod");
15
- /** Zod schema for GL mapping upsert input. */
16
- exports.UpsertGlMappingInputSchema = zod_1.z.object({
17
- departmentId: zod_1.z.string().min(1),
18
- glCode: zod_1.z.string().min(1).max(64),
19
- costCenter: zod_1.z.string().max(128).optional(),
20
- });
21
- /** Chargeback export query params schema. */
22
- exports.ChargebackExportQuerySchema = zod_1.z.object({
23
- period: zod_1.z.enum(['month', 'quarter', 'custom']).default('month'),
24
- from: zod_1.z.string().datetime({ offset: true }).optional(),
25
- to: zod_1.z.string().datetime({ offset: true }).optional(),
26
- format: zod_1.z.enum(['csv', 'json']).default('csv'),
27
- });
28
13
  //# sourceMappingURL=billing.js.map
@@ -1 +1 @@
1
- {"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;;AAEH,6BAAuB;AAqHvB,8CAA8C;AACjC,QAAA,0BAA0B,GAAG,OAAC,CAAC,MAAM,CAAC;IACjD,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IAC/B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACjC,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;CAC3C,CAAC,CAAA;AA2BF,6CAA6C;AAChC,QAAA,2BAA2B,GAAG,OAAC,CAAC,MAAM,CAAC;IAClD,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACtD,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;IACpD,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC;CAC/C,CAAC,CAAA"}
1
+ {"version":3,"file":"billing.js","sourceRoot":"","sources":["../src/billing.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG"}
package/dist/enums.d.ts CHANGED
@@ -20,12 +20,44 @@ export declare const RiskLevel: {
20
20
  };
21
21
  /** Union of all risk level values. */
22
22
  export type RiskLevel = typeof RiskLevel[keyof typeof RiskLevel];
23
- /** PCAS enforcement action applied to a tool call. */
23
+ /**
24
+ * PCAS enforcement action applied to a tool call.
25
+ *
26
+ * BYPASS..KILL are listed in increasing severity. `REASK` sits between
27
+ * `HIJACK` and `KILL`: the attempt is refused and the reason handed back to
28
+ * the agent, which may retry a bounded number of times before the finding
29
+ * escalates to a block.
30
+ *
31
+ * It exists because the proxy's promotion rule
32
+ * (`packages/proxy/src/plugins/anomaly/mod.rs`) forbids a heuristic from
33
+ * killing until its false-positive rate has been measured, and five detectors
34
+ * were doing exactly that. Demoting them to `HIJACK` would have honoured the
35
+ * rule and lost the enforcement; `REASK` keeps both.
36
+ *
37
+ * Mirrors `enforcement_action_type` — see migration 114.
38
+ *
39
+ * `OBSERVED` (migration 156) is deliberately OUTSIDE that severity ladder —
40
+ * it does not mean "PCAS acted with this severity", it means "PCAS took no
41
+ * action because the request never produced a response to act on". It is
42
+ * `mapVerdict`'s (`services/control-plane/src/lib/valkeySubscriber.ts`)
43
+ * target for the proxy's `"upstream_error"` verdict — a provider 5xx or an
44
+ * unservable-model rejection. Before this value existed, `mapVerdict`'s
45
+ * fail-closed default mapped every unrecognised verdict to `KILL`, so every
46
+ * upstream_error trace was recorded as an enforcement block that never
47
+ * happened: an honest failure record read as PCAS having stopped the
48
+ * request. `BYPASS` was considered and rejected for the same reason in the
49
+ * other direction — it means the call went through and completed, which an
50
+ * upstream_error trace never did. Nothing existing fit, so this is the
51
+ * smallest addition that lets "PCAS did not enforce anything here, the
52
+ * provider itself failed" be recorded truthfully.
53
+ */
24
54
  export declare const EnforcementAction: {
25
55
  readonly BYPASS: "BYPASS";
26
56
  readonly ENHANCE: "ENHANCE";
27
57
  readonly HIJACK: "HIJACK";
58
+ readonly REASK: "REASK";
28
59
  readonly KILL: "KILL";
60
+ readonly OBSERVED: "OBSERVED";
29
61
  };
30
62
  /** Union of all enforcement action values. */
31
63
  export type EnforcementAction = typeof EnforcementAction[keyof typeof EnforcementAction];
@@ -94,9 +126,286 @@ export declare const HarnessType: {
94
126
  readonly GOOSE: "goose";
95
127
  readonly OPEN_WEBUI: "open-webui";
96
128
  readonly GITHUB_COPILOT: "github-copilot";
129
+ readonly LANGGRAPH: "langgraph";
130
+ /** Meta "Muse Code" — binary `muse`, model Muse Spark. Beta since 2026-08-05. */
131
+ readonly MUSE_CODE: "muse-code";
132
+ /** xAI Grok Build (binary `grok`, GA 2026-05, open-sourced 2026-07-15). */
133
+ readonly GROK: "grok";
134
+ /** OpenCode (the open-source terminal coding agent: npm `opencode-ai` 1.x,
135
+ * `@opencode/cli` 2.x). Gated by a generated plugin OpenCode loads into
136
+ * its own process — `.opencode/plugins/intutic-governance.js`, hook
137
+ * `tool.execute.before` (1.x) / `tool execute.before` (2.x), which throws
138
+ * to refuse — see `services/sync-daemon/src/harness/openCodeHooks.ts`. */
139
+ readonly OPENCODE: "opencode";
140
+ /** DeepSeek's "dsh" (binary `dsh`, `@deepseek-ai/dsh`). Developer preview
141
+ * since 2026-08-13; gated via a Cordis plugin (`@intutic/gate/dsh`), not a
142
+ * generated hook file — see gateRegistry.ts's `dsh` row. */
143
+ readonly DEEPSEEK_HARNESS: "dsh";
144
+ /**
145
+ * Spotify "Xirp" — macOS-only desktop orchestrator, beta since 2026-08-11.
146
+ * NOT itself an AI agent: it spawns already-installed CLI harnesses
147
+ * (Claude Code, Codex, Gemini CLI) each inside its own tmux session and
148
+ * `git worktree`, preserving each wrapped harness's native, unmodified
149
+ * config (per Xirp's own FAQ). Detected for reporting/reconciliation
150
+ * purposes only — see `tools/cli/src/harness/xirp.ts` and
151
+ * `gateRegistry.ts`'s NO_GATE row for why it writes no config of its own.
152
+ */
153
+ readonly XIRP: "xirp";
154
+ /**
155
+ * DoorDash's "Agentic Orchestrator" (binary `agentico`, Go, Apache-2.0,
156
+ * `doordash-oss/agentic-orchestrator` — CONFIRMED real/public: live-verified
157
+ * by running the actual released binary, not just reading its README).
158
+ * Desktop app + CLI, cross-platform (macOS AND Linux — unlike Xirp's
159
+ * macOS-only beta). NOT itself an AI agent: it wraps already-installed CLI
160
+ * backends — Claude Code, Codex, and OpenCode (CONFIRMED via `agentico
161
+ * server --help`'s `--providers` flag) — each running a feature in its own
162
+ * `git worktree` under `~/.agentic-orchestrator/worktrees/` (CONFIRMED via
163
+ * the project's own README). Detected for reporting/reconciliation
164
+ * purposes only — see `tools/cli/src/harness/agenticOrchestrator.ts` and
165
+ * `gateRegistry.ts`'s NO_GATE row for why it writes no config of its own
166
+ * (`GateKind: 'delegated'`, same as Xirp).
167
+ *
168
+ * All three wrapped backends are themselves supported harnesses: Claude
169
+ * Code and Codex through their hook files, and OpenCode (since TD-397
170
+ * closed, 2026-09-23) through the plugin `openCodeHooks.ts` generates —
171
+ * the worktree propagation re-runs every backend's writer per worktree,
172
+ * so a feature run against any `--providers` value is governed.
173
+ */
174
+ readonly AGENTIC_ORCHESTRATOR: "agentic-orchestrator";
175
+ /** LangChain — covers BOTH the Python (`langchain`/`langchain-core`) and
176
+ * JS/TS (`langchain` npm package) ecosystems for detection purposes, since
177
+ * the framework itself ships in both. This env-adapter (`langchain.ts`) is
178
+ * Python-only, matching intutic-clawde's `langchain.py` gate adapter; a
179
+ * JS/TS tool-call gate for LangChain.js is a `@intutic/gate` TypeScript
180
+ * package concern for a different phase, not this one. */
181
+ readonly LANGCHAIN: "langchain";
182
+ readonly CREWAI: "crewai";
183
+ /** Detected via any of autogen-agentchat / autogen-core / autogen-ext. */
184
+ readonly AUTOGEN: "autogen";
185
+ readonly AG2: "ag2";
186
+ readonly GOOGLE_ADK: "google-adk";
187
+ /** OpenAI Agents SDK — covers BOTH the Python (`openai-agents` on PyPI)
188
+ * and JS/TS (`@openai/agents` on npm) ecosystems, same dual-ecosystem
189
+ * pattern as LANGCHAIN above — but unlike LangChain, BOTH sides have a
190
+ * shipped gate: Python via `intutic_clawde.gate.adapters.openai_agents`
191
+ * (`intutic_tool_guardrail`), TypeScript via `@intutic/gate/openai`
192
+ * (packages/gate-js — tool input guardrails, `wrapAgent()` for
193
+ * mcpServers-derived tools, and the tracing-exporter DLP kill-switch).
194
+ * Detection (`tools/cli/src/harness/openaiAgents.ts`) matches Python
195
+ * manifests AND package.json `@openai/agents*` deps. */
196
+ readonly OPENAI_AGENTS: "openai-agents";
197
+ /** Detected via pydantic-ai / pydantic-ai-slim. */
198
+ readonly PYDANTIC_AI: "pydantic-ai";
199
+ readonly SMOLAGENTS: "smolagents";
200
+ /** AWS Strands Agents (`strands-agents` on PyPI — the default framework in
201
+ * Bedrock AgentCore's own quickstarts). Detected via `strands-agents` in
202
+ * Python dependency manifests. Gate: `intutic_clawde.gate.adapters.strands`'s
203
+ * `IntuticHookProvider`, built on Strands' documented
204
+ * `BeforeToolCallEvent.cancel_tool` veto (verified against a real
205
+ * strands-agents==1.52.0 install). NOTE: the framework's DEFAULT model
206
+ * provider (Bedrock, SigV4-signed via boto3) is NOT routable through the
207
+ * Intutic proxy — see apps/docs/integrations/strands.md. */
208
+ readonly STRANDS: "strands";
209
+ /** Detected via `@mastra/core`/`mastra` in `package.json`. Gate:
210
+ * `@intutic/gate/mastra`'s `intuticHooks()` — see that module's doc for
211
+ * the per-call-hooks-override bypass this framework's own design imposes. */
212
+ readonly MASTRA: "mastra";
213
+ /** Detected via `ai` (v6+) plus any `@ai-sdk/*` package in `package.json`.
214
+ * Gate: `@intutic/gate/vercel`'s `intuticToolApproval()`. Unlike most
215
+ * harnesses here, this framework has NO env-var LLM-egress routing — see
216
+ * `@intutic/gate/vercel`'s `withIntuticProxy()` and its module doc. */
217
+ readonly VERCEL_AI_SDK: "vercel-ai-sdk";
218
+ /** Vercel's "eve" (npm `eve`, github.com/vercel/eve) — filesystem-first
219
+ * durable backend AI agents; an agent is an `agent/` directory eve builds
220
+ * by walking the tree. Pre-1.0 PREVIEW (0.39.x). Detected via `eve` in
221
+ * `package.json` PLUS the characteristic `agent/` directory (a compound
222
+ * check — either alone is too generic; see tools/cli/src/harness/eve.ts).
223
+ * Gate: `@intutic/gate/eve`'s `intuticApproval()` on eve's per-tool /
224
+ * per-connection `approval` policy surface — see gateRegistry.ts's `eve`
225
+ * row and TD-410 for the preview-churn shield. */
226
+ readonly EVE: "eve";
227
+ /**
228
+ * TrueFoundry's "TrueForge" (github.com/truefoundry/trueforge, MIT,
229
+ * TS/Node) — an open-source agent-runtime library. Same JS/TS SDK-gated
230
+ * family as MASTRA/VERCEL_AI_SDK/EVE above, but TrueForge ships in two
231
+ * structurally different deployment modes with different detection and
232
+ * different governance surfaces, so it gets two `HarnessType` rows rather
233
+ * than one (see TRUEFORGE_SERVER's own doc below for why one enum value
234
+ * can't answer `gateKindForHarness` two ways). THIS row
235
+ * covers only the EMBEDDED mode: another team's Node process importing
236
+ * `@truefoundry/trueforge-core` directly and driving its
237
+ * `SessionHandle`/`TurnHandle` API in-process. Detected via
238
+ * `@truefoundry/trueforge-core` in `package.json`. Gate:
239
+ * `@intutic/gate/trueforge`'s `intuticApprovalResponder()` — confirmed
240
+ * against the real published package (`@truefoundry/trueforge-core@0.1.4`)
241
+ * that there is NO synchronous in-process approval callback anywhere in
242
+ * it; the only approval mechanism, embedded or not, is the same
243
+ * `tool.approval_required` / `user.tool_approval` turn-and-event contract
244
+ * TrueForge's standalone server exposes over HTTP, so this adapter is
245
+ * shaped like the AI_SDK_HARNESS/AI_SDK_WORKFLOW "approval responder"
246
+ * family rather than MASTRA/VERCEL_AI_SDK's single-callback shape — see
247
+ * that module's doc for the full record.
248
+ *
249
+ * TrueForge run as its OWN standalone/hosted server (`npx
250
+ * @truefoundry/trueforge`, Docker Compose, or the Helm chart) is
251
+ * deliberately NOT covered by this row — nobody embeds an Intutic gate
252
+ * into a third-party OSS server process, so that deployment mode needs
253
+ * governance running in an external Intutic-operated bridge service. See
254
+ * TRUEFORGE_SERVER below.
255
+ */
256
+ readonly TRUEFORGE: "trueforge";
257
+ /** Vercel `@ai-sdk/harness` (HarnessAgent — sandboxed coding-agent
258
+ * harnesses, e.g. `@ai-sdk/harness-claude-code`/`-grok-build`). Detected
259
+ * via `@ai-sdk/harness`, any `@ai-sdk/harness-*` adapter, or any
260
+ * `@ai-sdk/sandbox-*` provider in `package.json`. Gate:
261
+ * `@intutic/gate/harness`'s approval responder — the framework's
262
+ * `toolApproval` setting is a STATIC record without callback support, so
263
+ * per-call gating routes through the tool-approval flow; built-in sandbox
264
+ * tools are governed only by `permissionMode`, which DEFAULTS to
265
+ * 'allow-all'. See gateRegistry.ts's NO_GATE row and TD-415..417. */
266
+ readonly AI_SDK_HARNESS: "ai-sdk-harness";
267
+ /** Vercel `@ai-sdk/workflow` (WorkflowAgent — durable workflow agents on
268
+ * the Workflow DevKit). Detected via `@ai-sdk/workflow` in `package.json`
269
+ * (the unscoped `workflow` package alone is deliberately NOT a trigger —
270
+ * it is the durable runtime with no agent surface, and the bare name is
271
+ * too generic). Gate: `@intutic/gate/workflow`'s `intuticNeedsApproval()`
272
+ * on each tool — WorkflowAgent itself has zero approval fields; refusals
273
+ * are FatalError-compatible so the durable runtime aborts rather than
274
+ * retry-looping a governance denial. See gateRegistry.ts's NO_GATE row
275
+ * and TD-418..419. */
276
+ readonly AI_SDK_WORKFLOW: "ai-sdk-workflow";
277
+ /**
278
+ * AWS Bedrock AgentCore **Runtime** (GA 2025-10) — a managed hosting
279
+ * environment for a customer's OWN agent code (any framework), NOT itself
280
+ * an agent framework. Detected via the `bedrock-agentcore` SDK (PyPI
281
+ * `bedrock-agentcore`, CONFIRMED at 1.22.0; npm `bedrock-agentcore`,
282
+ * CONFIRMED at 0.4.3 — both live-checked via `pip index versions`/`npm
283
+ * view` and by downloading and inspecting the real packages, not assumed)
284
+ * OR the local dev-loop config files the `agentcore` CLI (npm
285
+ * `@aws/agentcore`, CONFIRMED at 0.27.0) and the Python
286
+ * `bedrock-agentcore-starter-toolkit` (CONFIRMED at 0.3.11) write:
287
+ * `.bedrock_agentcore.yaml`, `agentcore/agentcore.json`, `aws-targets.json`
288
+ * — all three confirmed by extracting the real published tarballs/wheels
289
+ * and grepping their compiled/source output for the literal filenames.
290
+ *
291
+ * Classified `'delegated'` (see `gateKind.ts`), the SAME kind as XIRP and
292
+ * AGENTIC_ORCHESTRATOR, for an analogous but distinct reason: Runtime
293
+ * hosts the customer's chosen framework's code UNCHANGED, so a tool call
294
+ * made inside it is governed by whichever already-supported framework
295
+ * adapter that code uses (Strands, LangGraph, CrewAI, ...) — this
296
+ * adapter's own `writeConfig` is a no-op, same as Xirp/Agentic
297
+ * Orchestrator's. Unlike those two, Runtime does not SPAWN another
298
+ * already-installed CLI harness as a subprocess; it hosts a customer's
299
+ * framework-SDK code as the deployment target, so if that code uses no
300
+ * framework this registry supports (raw boto3, a hand-rolled tool loop),
301
+ * coverage is genuinely zero — the same honest gap AGENTIC_ORCHESTRATOR's
302
+ * OpenCode backend has (TD-397). Deployment-target constraints that are
303
+ * NOT a gate concern (environment-variable caps, VPC/NAT egress topology,
304
+ * SigV4 traffic not being proxyable) are documented in
305
+ * apps/docs/integrations/agentcore.md rather than encoded here.
306
+ *
307
+ * AgentCore **Gateway** (the MCP-tool-call interceptor path) deliberately
308
+ * has NO enum entry here — same precedent QM set (see TD-400): it is a
309
+ * deployed AWS resource (a Lambda attached to a Gateway), never something
310
+ * `intutic init`/`intutic connect` finds on a developer's laptop. Its
311
+ * coverage is the `tools/agentcore-interceptor` Lambda calling
312
+ * `POST /api/v1/integrations/agentcore/gateway-check` — see TD-430.
313
+ *
314
+ * AgentCore **Policy** (Cedar/"Dogwood") has NO third-party HTTP policy
315
+ * backend at all (confirmed against `GatewayPolicyEngineConfiguration`'s
316
+ * real API reference: `arn` only ever names an AWS-native
317
+ * `policy-engine/...` resource) — not integrable by design, not a gap.
318
+ *
319
+ * See apps/docs/integrations/agentcore.md and TD-430..432.
320
+ */
321
+ readonly AGENTCORE_RUNTIME: "agentcore-runtime";
322
+ /**
323
+ * TrueFoundry's "TrueForge" (github.com/truefoundry/trueforge, MIT,
324
+ * TS/Node), run as its OWN standalone/hosted server process — `npx
325
+ * @truefoundry/trueforge`, its Docker Compose stack, or its Helm chart —
326
+ * rather than embedded into another team's Node process (see TRUEFORGE
327
+ * above for that mode). Not detected by `intutic init`'s repo scan: there
328
+ * is no per-repo `package.json` dependency or config file to find, because
329
+ * this is an operator-configured DEPLOYMENT, not a library dependency of
330
+ * whatever repo `intutic init` happens to run against. An operator points
331
+ * `services/trueforge-bridge` at their running instance instead — see
332
+ * that service's README and `apps/docs/integrations/trueforge.md`'s
333
+ * server-mode section.
334
+ *
335
+ * Gate: classified `'bridge'` (see `gateKind.ts`), a shape distinct from
336
+ * every other row in this enum. TrueForge exposes exactly one tool-call
337
+ * governance surface, embedded or standalone alike (see TRUEFORGE's own
338
+ * doc for how this was confirmed against the real package): a turn pauses
339
+ * with a `tool.approval_required` event naming each pending call only as
340
+ * `{id, source_event_id}`, resolved by starting a NEW turn
341
+ * (`POST /{session_id}/turns`, `previous_turn_id` chained) carrying a
342
+ * `user.tool_approval` input item. Nobody embeds an Intutic gate into a
343
+ * third-party OSS server process, so unlike TRUEFORGE this mode cannot be
344
+ * `'sdk'` — there is no host process of ours to run in. It also is not
345
+ * `'hook'` (no on-disk file this deployment reads) or `'delegated'` (it
346
+ * does not wrap another already-gated harness). The gate instead runs OUT
347
+ * OF PROCESS, in `services/trueforge-bridge` — an Intutic-operated service
348
+ * that watches each session's turn/event stream (SSE subscribe, or
349
+ * `listTurnEventsRoute` polling as a fallback; there is no webhook —
350
+ * TrueForge never pushes anything to an external system), resolves a
351
+ * pending call's `source_event_id` back to the real tool name and
352
+ * arguments via the referenced `model.message` event, evaluates it through
353
+ * the same `packages/gate-js` machinery every other JS/TS-native row here
354
+ * uses (`soprules.ts`'s `ruleMatches` plus `POST /api/v1/hook-gate`), and
355
+ * answers with `{status:'allow'}` or `{status:'deny', reason}`.
356
+ *
357
+ * The load-bearing caveat, stated plainly rather than buried: whether a
358
+ * tool call ever emits `tool.approval_required` in the first place is
359
+ * controlled by each registered MCP server's own approval-tool-selector
360
+ * config (`McpServerApprovalToolSelector`: `"@all" | "@write" |
361
+ * "@destructive" | <tool name>`). A narrow/default selector means some
362
+ * tool calls never pause and are invisible to the bridge — this is
363
+ * TrueForge's own design, not something this gate kind can work around.
364
+ * See `apps/docs/reference/harness-security-matrix.md` row 42 and
365
+ * `apps/docs/integrations/trueforge.md`'s server-mode section for the full
366
+ * scoping statement, including how this Hook(A) trust shape — the gate
367
+ * co-resident in a wholly SEPARATE process reacting to a pull-only event
368
+ * stream — is weaker than every other Hook(A) mark in this catalog, all
369
+ * of which run co-resident with or embedded in the harness's own process.
370
+ */
371
+ readonly TRUEFORGE_SERVER: "trueforge-server";
97
372
  };
98
373
  /** Union of all harness type values. */
99
374
  export type HarnessType = typeof HarnessType[keyof typeof HarnessType];
375
+ /**
376
+ * The real count of `HarnessType` members — one number, exported so no doc
377
+ * or README prose ever has to state it by hand again (Wave 8,
378
+ * audit-remediation). `check-harness-counts.js` (`lint:claims`) asserts
379
+ * every harness-count claim in `apps/docs/**` and `README.md` matches
380
+ * either this or `HARNESS_HEADLINE_COUNT` below, so this drifting out of
381
+ * sync with prose is now a lint failure, not a silent staleness.
382
+ */
383
+ export declare const HARNESS_COUNT: number;
384
+ /**
385
+ * `HARNESS_COUNT` minus the harnesses with a confirmed, currently-open
386
+ * support gap — the number safe to use in headline/marketing copy
387
+ * ("works with N coding agents") without overclaiming. Each exclusion must
388
+ * be a harness with its own `docs/TECH_DEBT.md` entry describing a REAL,
389
+ * currently-unactionable gap (not a caveat, not a "documented, not a
390
+ * defect" note). The list is EMPTY since 2026-09-23 and the mechanism is
391
+ * kept so the next real gap goes here and nowhere else:
392
+ *
393
+ * - `agentic-orchestrator` was excluded under TD-397 while its OpenCode
394
+ * backend had no gate; OpenCode is a harness of its own now.
395
+ * - `autogen` was excluded under TD-374 while `InterventionHandler.on_send`
396
+ * was blind to `AssistantAgent`'s own tool calls; `IntuticWorkbench`
397
+ * (2026-09-22) governs them.
398
+ *
399
+ * Deliberately does NOT exclude `mastra` — TD-380 is explicitly marked
400
+ * "🟢 Documented, not a defect" in TECH_DEBT.md, a caveat about a call-site
401
+ * hook override, not a coverage gap, so excluding it here would be the
402
+ * exact overclaim-avoidance discipline applied backwards. Also does NOT
403
+ * exclude `continue` over its headless-mode limitation (`cn -p` skips
404
+ * PreToolUse hooks): that is a secondary invocation mode of a harness whose
405
+ * primary (interactive) path is fully covered, not a reason to undercount
406
+ * the harness itself.
407
+ */
408
+ export declare const HARNESS_HEADLINE_COUNT: number;
100
409
  /** Agent execution mode controlling autonomy level. */
101
410
  export declare const ExecutionMode: {
102
411
  readonly STANDARD: "STANDARD";
@@ -125,6 +434,15 @@ export declare const PlanLifecycleState: {
125
434
  };
126
435
  /** Union of all plan lifecycle state values. */
127
436
  export type PlanLifecycleState = typeof PlanLifecycleState[keyof typeof PlanLifecycleState];
437
+ /** Result category for a closed (COMPLETED) stored plan. */
438
+ export declare const PlanExecutionOutcome: {
439
+ readonly SUCCESS: "SUCCESS";
440
+ readonly FAILED: "FAILED";
441
+ readonly PARTIAL: "PARTIAL";
442
+ readonly ABORTED: "ABORTED";
443
+ };
444
+ /** Union of all plan execution outcome values. */
445
+ export type PlanExecutionOutcome = typeof PlanExecutionOutcome[keyof typeof PlanExecutionOutcome];
128
446
  /** Lifecycle state for SOPs in the registry. */
129
447
  export declare const SopLifecycleState: {
130
448
  readonly DRAFT: "DRAFT";
@@ -182,8 +500,10 @@ export type WorkspaceRole = typeof WorkspaceRole[keyof typeof WorkspaceRole];
182
500
  * - `open` (default): pass through the tool call + emit a warning event
183
501
  * - `closed`: block the tool call with a user-visible error message
184
502
  *
185
- * Note: `closed` only affects harnesses with MCP proxy injection (13/17).
186
- * For harnesses without proxy (n8n, pi, codex, open-webui), see TD-151.
503
+ * Note: `closed` only affects harnesses with MCP proxy injection (9/20 —
504
+ * 10 config paths across 9 harnesses, see sync-daemon mcpAutoWrite.ts).
505
+ * For harnesses without MCP proxy injection (e.g. n8n, pi, codex,
506
+ * open-webui), see TD-151.
187
507
  */
188
508
  export declare const McpProxyFailBehavior: {
189
509
  readonly OPEN: "open";
@@ -195,7 +515,8 @@ export type McpProxyFailBehavior = typeof McpProxyFailBehavior[keyof typeof McpP
195
515
  * - `per-session` (default, Phase 4): new proxy process per MCP connection
196
516
  * - `daemon` (Phase 5): long-lived daemon, per-session shims delegate via Unix socket
197
517
  *
198
- * See TD-153 — daemon requires macOS notarization. Per-session is the only active mode in Phase 4.
518
+ * See TD-153 — daemon requires macOS notarization. Both modes are active: the
519
+ * mcp-proxy honours `daemon` by answering policy lookups over the daemon socket.
199
520
  */
200
521
  export declare const McpProxyMode: {
201
522
  readonly PER_SESSION: "per-session";
@@ -230,4 +551,20 @@ export declare const DriftDetectionMode: {
230
551
  readonly COMPLIANCE_SCORE_FALLBACK: "compliance_score_fallback";
231
552
  };
232
553
  export type DriftDetectionMode = typeof DriftDetectionMode[keyof typeof DriftDetectionMode];
554
+ /**
555
+ * Migration 163: which of `sop_amendments`' three producers wrote a row.
556
+ * INCIDENT_MINING (`dreamCycleService.runDreamCycle`, `runId` prefixed
557
+ * `dcr_`) and METACLAW (`promptEvolutionService.runEvolutionCycle`, `runId`
558
+ * prefixed `mcr_`, has a matching `metaclaw_runs` row — the only source a
559
+ * clause diff is meaningful for) are both manually/dashboard-triggered.
560
+ * HEALTH_CRON (`sopHealthCron.ts`, `runId` NULL) is the only one currently
561
+ * on a schedule — its output was invisible to every UI before this column
562
+ * existed, since the sole proposals feed filtered `runId IS NOT NULL`.
563
+ */
564
+ export declare const AmendmentSource: {
565
+ readonly INCIDENT_MINING: "INCIDENT_MINING";
566
+ readonly METACLAW: "METACLAW";
567
+ readonly HEALTH_CRON: "HEALTH_CRON";
568
+ };
569
+ export type AmendmentSource = typeof AmendmentSource[keyof typeof AmendmentSource];
233
570
  //# sourceMappingURL=enums.d.ts.map
@@ -1 +1 @@
1
- {"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,uEAAuE;AACvE,eAAO,MAAM,SAAS;;;;;CAKZ,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE,sDAAsD;AACtD,eAAO,MAAM,iBAAiB;;;;;CAKpB,CAAA;AAEV,8CAA8C;AAC9C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,0EAA0E;AAC1E,eAAO,MAAM,YAAY;;;CAGf,CAAA;AAEV,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAKzE,kEAAkE;AAClE,eAAO,MAAM,UAAU;;;;;CAKb,CAAA;AAEV,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAKnE,wDAAwD;AACxD,eAAO,MAAM,cAAc;;;;CAIjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,qEAAqE;AACrE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAKjG;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,YAAY,EACV,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAMlC,mDAAmD;AACnD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;CAmBd,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAKtE,uDAAuD;AACvD,eAAO,MAAM,aAAa;;;;;CAKhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAK5E,gDAAgD;AAChD,eAAO,MAAM,cAAc;;;;;CAKjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,kDAAkD;AAClD,eAAO,MAAM,kBAAkB;;;;;;CAMrB,CAAA;AAEV,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAM3F,gDAAgD;AAChD,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAA;AAEV,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,yDAAyD;AACzD,eAAO,MAAM,OAAO;IAClB,wDAAwD;;IAExD,sEAAsE;;CAE9D,CAAA;AAEV,oCAAoC;AACpC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,CAAA;AAK1D,kDAAkD;AAClD,eAAO,MAAM,SAAS;IACpB,mCAAmC;;IAEnC,kCAAkC;;IAElC,yCAAyC;;IAEzC,mCAAmC;;CAE3B,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE,gDAAgD;AAChD,eAAO,MAAM,WAAW;;;;CAId,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAKtE,+EAA+E;AAC/E,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAM5E;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;;CAGvB,CAAA;AACV,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAEjG;;;;;;GAMG;AACH,eAAO,MAAM,YAAY;;;CAGf,CAAA;AACV,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAA;AACV,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAA;AAKpG,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB;;;;CAItB,CAAA;AACV,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAE9F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB;;;CAGrB,CAAA;AACV,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA"}
1
+ {"version":3,"file":"enums.d.ts","sourceRoot":"","sources":["../src/enums.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAKH,uEAAuE;AACvE,eAAO,MAAM,SAAS;;;;;CAKZ,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,eAAO,MAAM,iBAAiB;;;;;;;CAOpB,CAAA;AAEV,8CAA8C;AAC9C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,0EAA0E;AAC1E,eAAO,MAAM,YAAY;;;CAGf,CAAA;AAEV,yCAAyC;AACzC,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAKzE,kEAAkE;AAClE,eAAO,MAAM,UAAU;;;;;CAKb,CAAA;AAEV,uCAAuC;AACvC,MAAM,MAAM,UAAU,GAAG,OAAO,UAAU,CAAC,MAAM,OAAO,UAAU,CAAC,CAAA;AAKnE,wDAAwD;AACxD,eAAO,MAAM,cAAc;;;;CAIjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,qEAAqE;AACrE,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,iDAAiD;AACjD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAKjG;;;;;;;;;GASG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,2BAA2B,CAAA;AACvD,YAAY,EACV,eAAe,GAChB,MAAM,2BAA2B,CAAA;AAYlC,mDAAmD;AACnD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;;;;;IAoBtB,iFAAiF;;IAEjF,2EAA2E;;IAE3E;;;;+EAI2E;;IAE3E;;iEAE6D;;IAE7D;;;;;;;;OAQG;;IAEH;;;;;;;;;;;;;;;;;;;OAmBG;;IAOH;;;;;+DAK2D;;;IAG3D,0EAA0E;;;;IAI1E;;;;;;;;6DAQyD;;IAEzD,mDAAmD;;;IAGnD;;;;;;;iEAO6D;;IAQ7D;;kFAE8E;;IAE9E;;;4EAGwE;;IAExE;;;;;;;uDAOmD;;IAEnD;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA4BG;;IAQH;;;;;;;;0EAQsE;;IAEtE;;;;;;;;2BAQuB;;IAGvB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OA2CG;;IAGH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;OAgDG;;CAEK,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAEtE;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,QAAkC,CAAA;AAE5D;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,eAAO,MAAM,sBAAsB,QAA4B,CAAA;AAK/D,uDAAuD;AACvD,eAAO,MAAM,aAAa;;;;;CAKhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAK5E,gDAAgD;AAChD,eAAO,MAAM,cAAc;;;;;CAKjB,CAAA;AAEV,2CAA2C;AAC3C,MAAM,MAAM,cAAc,GAAG,OAAO,cAAc,CAAC,MAAM,OAAO,cAAc,CAAC,CAAA;AAK/E,kDAAkD;AAClD,eAAO,MAAM,kBAAkB;;;;;;CAMrB,CAAA;AAEV,gDAAgD;AAChD,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAO3F,4DAA4D;AAC5D,eAAO,MAAM,oBAAoB;;;;;CAKvB,CAAA;AAEV,kDAAkD;AAClD,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAMjG,gDAAgD;AAChD,eAAO,MAAM,iBAAiB;;;;;;;;CAQpB,CAAA;AAEV,+CAA+C;AAC/C,MAAM,MAAM,iBAAiB,GAAG,OAAO,iBAAiB,CAAC,MAAM,OAAO,iBAAiB,CAAC,CAAA;AAKxF,yDAAyD;AACzD,eAAO,MAAM,OAAO;IAClB,wDAAwD;;IAExD,sEAAsE;;CAE9D,CAAA;AAEV,oCAAoC;AACpC,MAAM,MAAM,OAAO,GAAG,OAAO,OAAO,CAAC,MAAM,OAAO,OAAO,CAAC,CAAA;AAK1D,kDAAkD;AAClD,eAAO,MAAM,SAAS;IACpB,mCAAmC;;IAEnC,kCAAkC;;IAElC,yCAAyC;;IAEzC,mCAAmC;;CAE3B,CAAA;AAEV,sCAAsC;AACtC,MAAM,MAAM,SAAS,GAAG,OAAO,SAAS,CAAC,MAAM,OAAO,SAAS,CAAC,CAAA;AAKhE,gDAAgD;AAChD,eAAO,MAAM,WAAW;;;;CAId,CAAA;AAEV,wCAAwC;AACxC,MAAM,MAAM,WAAW,GAAG,OAAO,WAAW,CAAC,MAAM,OAAO,WAAW,CAAC,CAAA;AAKtE,+EAA+E;AAC/E,eAAO,MAAM,aAAa;;;;;;CAMhB,CAAA;AAEV,0CAA0C;AAC1C,MAAM,MAAM,aAAa,GAAG,OAAO,aAAa,CAAC,MAAM,OAAO,aAAa,CAAC,CAAA;AAM5E;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB;;;CAGvB,CAAA;AACV,MAAM,MAAM,oBAAoB,GAAG,OAAO,oBAAoB,CAAC,MAAM,OAAO,oBAAoB,CAAC,CAAA;AAEjG;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY;;;CAGf,CAAA;AACV,MAAM,MAAM,YAAY,GAAG,OAAO,YAAY,CAAC,MAAM,OAAO,YAAY,CAAC,CAAA;AAEzE;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB;;;;CAIxB,CAAA;AACV,MAAM,MAAM,qBAAqB,GAAG,OAAO,qBAAqB,CAAC,MAAM,OAAO,qBAAqB,CAAC,CAAA;AAKpG,8DAA8D;AAC9D,eAAO,MAAM,mBAAmB;;;;CAItB,CAAA;AACV,MAAM,MAAM,mBAAmB,GAAG,OAAO,mBAAmB,CAAC,MAAM,OAAO,mBAAmB,CAAC,CAAA;AAE9F,oFAAoF;AACpF,eAAO,MAAM,kBAAkB;;;CAGrB,CAAA;AACV,MAAM,MAAM,kBAAkB,GAAG,OAAO,kBAAkB,CAAC,MAAM,OAAO,kBAAkB,CAAC,CAAA;AAE3F;;;;;;;;;GASG;AACH,eAAO,MAAM,eAAe;;;;CAIlB,CAAA;AACV,MAAM,MAAM,eAAe,GAAG,OAAO,eAAe,CAAC,MAAM,OAAO,eAAe,CAAC,CAAA"}