@intutic/shared-types 2.1.0 → 2.3.0

package/dist/phrases.js

@@ -0,0 +1,241 @@
+"use strict";
+/**
+ * Phrase matching for shell commands and SQL in linear time.
+ *
+ * Every command classifier asks the same question: does this text contain
+ * `git push`, `drop table`, `curl --data`, whatever separates the words? The
+ * separators that count are the ones the shell or the database reads as a
+ * word break:
+ *
+ * - whitespace, a two-character escaped `\n`, `\t` or `\r`, and a backslash
+ *   before whitespace (a line continuation, or an escaped space);
+ * - a `/* … *\/` comment;
+ * - a `-- …` comment that runs to a newline (real or escaped);
+ * - a run of options starting with `--` (`git --no-pager push`,
+ *   `kubectl --context prod apply`), which stops at `;`, `&`, `|` or a real
+ *   newline — the end of the shell command it is in.
+ *
+ * The proxy's Rust classifier expresses this as a regex (`SQL_GAP` in
+ * `actions.rs`), which is safe there: Rust's engine is linear. JavaScript's
+ * and Python's backtrack, and that regex took seconds on a few hundred
+ * kilobytes of `git -- git -- …` — text an agent can be talked into producing.
+ * So here the text is cut into words in one pass, and a phrase is matched over
+ * the words right to left with one array per phrase word: O(length × words).
+ * No regex runs on the input.
+ *
+ * The two functions are self-contained on purpose — no imports, no module
+ * state — because the hook gates emit them as source (`phraseText.toString()`)
+ * and run them outside this package. `packages/gate-js/src/phrases.ts` is a
+ * byte-identical copy and `intutic_clawde/gate/phrases.py` a transliteration;
+ * all of them run `action_vectors.json` beside the proxy's `actions.rs`.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PHRASES_JS_SOURCE = void 0;
+exports.phraseText = phraseText;
+exports.hasPhrase = hasPhrase;
+/**
+ * Cuts `input` into words in one pass. A `--` inside a word starts a new one
+ * (`drop--why` is `drop` and `--why`), glued rather than separated, so it can
+ * open a comment or an option run but cannot stand for a plain gap.
+ */
+function phraseText(input) {
+    const s = String(input == null ? '' : input).toLowerCase();
+    const n = s.length;
+    const isSpace = (c) => c === ' ' || c === '\t' || c === '\n' || c === '\r' || c === '\v' || c === '\f' ||
+        c === '\u00a0' || c === '\u1680' || (c >= '\u2000' && c <= '\u200a') ||
+        c === '\u2028' || c === '\u2029' || c === '\u202f' || c === '\u205f' || c === '\u3000' || c === '\ufeff';
+    const t = { raw: s, joined: '', toks: [], sep: [], nl: [], eol: [], dash: [], bar: [], tail: false, memo: {}, next: null };
+    let start = -1;
+    let tokBar = false;
+    let pendSep = false;
+    let pendNl = false;
+    let pendEol = false;
+    // The next `*/` at or after the last search; -1 once there is none left.
+    let close = -2;
+    const end = (at) => {
+        if (start < 0)
+            return;
+        t.toks.push(s.slice(start, at));
+        t.sep.push(pendSep);
+        t.nl.push(pendNl);
+        t.eol.push(pendEol);
+        t.dash.push(s.charAt(start) === '-' && s.charAt(start + 1) === '-');
+        t.bar.push(tokBar);
+        start = -1;
+        tokBar = false;
+        pendSep = false;
+        pendNl = false;
+        pendEol = false;
+    };
+    const gap = (newline, eol) => {
+        end(i);
+        pendSep = true;
+        if (newline)
+            pendNl = true;
+        if (eol)
+            pendEol = true;
+    };
+    let i = 0;
+    while (i < n) {
+        const c = s.charAt(i);
+        const d = i + 1 < n ? s.charAt(i + 1) : '';
+        if (isSpace(c)) {
+            gap(c === '\n', c === '\n');
+            i += 1;
+        }
+        else if (c === '\\' && (d === 'n' || d === 't' || d === 'r')) {
+            gap(false, d === 'n');
+            i += 2;
+        }
+        else if (c === '\\' && d !== '' && isSpace(d)) {
+            gap(false, false);
+            i += 2;
+        }
+        else if (c === '/' && d === '*' && close !== -1 && (close >= i + 2 || (close = s.indexOf('*/', i + 2)) !== -1)) {
+            gap(false, false);
+            i = close + 2;
+        }
+        else {
+            if (c === '-' && d === '-' && start >= 0 && s.charAt(i - 1) !== '-')
+                end(i);
+            if (start < 0)
+                start = i;
+            if (c === ';' || c === '&' || c === '|')
+                tokBar = true;
+            i += 1;
+        }
+    }
+    end(n);
+    t.tail = pendSep;
+    t.joined = t.toks.join(' ');
+    return t;
+}
+/**
+ * Whether `t` contains `needle`, a phrase whose words are separated by single
+ * spaces. A one-word needle is a plain substring. In a longer one the first
+ * word may end a word of the text (`digit push` contains `git push`, as a
+ * substring would), the last may begin one, and the words between must be
+ * whole; a trailing space (`'update '`) asks for a separator after the last
+ * word. `bounded` additionally requires a non-word character (or the edge of
+ * the word) before the first word and after the last, where `.` also counts
+ * as part of a word (`table.log` is not `table`).
+ */
+function hasPhrase(t, needle, bounded) {
+    const words = needle.toLowerCase().split(' ');
+    if (words.length === 1)
+        return t.raw.indexOf(words[0]) !== -1;
+    const trailingGap = words[words.length - 1] === '';
+    if (trailingGap)
+        words.pop();
+    for (const w of words)
+        if (w === '' || t.joined.indexOf(w) === -1)
+            return false;
+    const T = t.toks.length;
+    const k = words.length;
+    const isWord = (c) => (c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || c === '_';
+    // Whether word `i` of the phrase can be the word at `q`, by its position.
+    // Typed arrays throughout: every array here has one entry per word of the
+    // text, and a classifier asks dozens of phrases of the same text.
+    const matches = (i) => {
+        const w = words[i];
+        const first = i === 0;
+        const last = i === k - 1 && !trailingGap;
+        const key = (first ? 'f' : '') + (last ? 'l' : '') + (bounded ? 'b' : '') + ':' + w;
+        const hit = t.memo[key];
+        if (hit)
+            return hit;
+        const out = new Uint8Array(T);
+        for (let q = 0; q < T; q++) {
+            const tok = t.toks[q];
+            let ok;
+            if (first && last)
+                ok = tok.indexOf(w) !== -1;
+            else if (first)
+                ok = tok.length >= w.length && tok.lastIndexOf(w) === tok.length - w.length;
+            else if (last)
+                ok = tok.lastIndexOf(w, 0) === 0;
+            else
+                ok = tok === w;
+            if (ok && bounded && first)
+                ok = tok.length === w.length || !isWord(tok.charAt(tok.length - w.length - 1));
+            if (ok && bounded && last)
+                ok = tok.length === w.length || !(isWord(tok.charAt(w.length)) || tok.charAt(w.length) === '.');
+            out[q] = ok ? 1 : 0;
+        }
+        t.memo[key] = out;
+        return out;
+    };
+    // nextBar[x]: first word at or after x containing `;&|`; nextNl[x]: first
+    // word at or after x with a real newline before it; nextEol likewise for any
+    // newline. T when there is none. Once per text, not once per phrase.
+    if (t.next === null) {
+        const bar = new Int32Array(T + 1);
+        const nl = new Int32Array(T + 1);
+        const eol = new Int32Array(T + 1);
+        bar[T] = T;
+        nl[T] = T;
+        eol[T] = T;
+        for (let x = T - 1; x >= 0; x--) {
+            bar[x] = t.bar[x] ? x : bar[x + 1];
+            nl[x] = t.nl[x] ? x : nl[x + 1];
+            eol[x] = t.eol[x] ? x : eol[x + 1];
+        }
+        t.next = { bar, nl, eol };
+    }
+    const nextBar = t.next.bar;
+    const nextNl = t.next.nl;
+    const nextEol = t.next.eol;
+    // ok[q]: the rest of the phrase, from the current word on, matches with
+    // that word at q. Start with the last word and walk back.
+    let ok = new Uint8Array(T + 1);
+    const lastHits = matches(k - 1);
+    for (let q = 0; q < T; q++) {
+        let v = lastHits[q] === 1;
+        if (v && trailingGap) {
+            const r = q + 1;
+            v = r < T ? t.sep[r] || (t.dash[r] && !t.bar[r] && (r + 1 < T || t.tail)) : t.tail;
+        }
+        ok[q] = v ? 1 : 0;
+    }
+    for (let i = k - 2; i >= 0; i--) {
+        // nextOk[x]: first word at or after x where the rest matches after a separator.
+        const nextOk = new Int32Array(T + 2);
+        nextOk[T] = T;
+        nextOk[T + 1] = T;
+        for (let x = T - 1; x >= 0; x--)
+            nextOk[x] = ok[x] === 1 && t.sep[x] ? x : nextOk[x + 1];
+        // reach[r]: the gap that starts at word r leads into the rest of the phrase.
+        const reach = new Uint8Array(T + 1);
+        for (let r = T - 1; r >= 0; r--) {
+            let v = t.sep[r] && ok[r] === 1;
+            if (!v && t.dash[r]) {
+                // A `--` comment runs to the next newline; more gap may follow it.
+                const after = nextEol[r + 1];
+                if (after < T && reach[after] === 1)
+                    v = true;
+                // An option run reaches any word before a `;&|` word or a real newline.
+                const limit = Math.min(nextBar[r], nextNl[r + 1], T - 1);
+                if (!v && nextOk[r + 1] <= limit)
+                    v = true;
+            }
+            reach[r] = v ? 1 : 0;
+        }
+        const hits = matches(i);
+        const prev = new Uint8Array(T + 1);
+        for (let p = 0; p < T; p++)
+            prev[p] = hits[p] & reach[p + 1];
+        ok = prev;
+    }
+    for (let p = 0; p < T; p++)
+        if (ok[p] === 1)
+            return true;
+    return false;
+}
+/**
+ * Both functions as JavaScript source, for a hook gate to emit: the gates run
+ * this exact code, not a retyped copy.
+ */
+exports.PHRASES_JS_SOURCE = `${phraseText.toString()}\n${hasPhrase.toString()}`;
+//# sourceMappingURL=phrases.js.map

package/dist/phrases.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"phrases.js","sourceRoot":"","sources":["../src/phrases.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;;;AAoCH,gCA8DC;AAYD,8BA6FC;AA5KD;;;;GAIG;AACH,SAAgB,UAAU,CAAC,KAAc;IACvC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAA;IAC1D,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAA;IAClB,MAAM,OAAO,GAAG,CAAC,CAAS,EAAW,EAAE,CACrC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,IAAI;QAC/E,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,CAAC;QACpE,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,QAAQ,CAAA;IAC1G,MAAM,CAAC,GAAe,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;IACtI,IAAI,KAAK,GAAG,CAAC,CAAC,CAAA;IACd,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,MAAM,GAAG,KAAK,CAAA;IAClB,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,yEAAyE;IACzE,IAAI,KAAK,GAAG,CAAC,CAAC,CAAA;IACd,MAAM,GAAG,GAAG,CAAC,EAAU,EAAQ,EAAE;QAC/B,IAAI,KAAK,GAAG,CAAC;YAAE,OAAM;QACrB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAA;QAC/B,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QACjB,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;QACnB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,GAAG,CAAC,CAAA;QACnE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;QAClB,KAAK,GAAG,CAAC,CAAC,CAAA;QACV,MAAM,GAAG,KAAK,CAAA;QACd,OAAO,GAAG,KAAK,CAAA;QACf,MAAM,GAAG,KAAK,CAAA;QACd,OAAO,GAAG,KAAK,CAAA;IACjB,CAAC,CAAA;IACD,MAAM,GAAG,GAAG,CAAC,OAAgB,EAAE,GAAY,EAAQ,EAAE;QACnD,GAAG,CAAC,CAAC,CAAC,CAAA;QACN,OAAO,GAAG,IAAI,CAAA;QACd,IAAI,OAAO;YAAE,MAAM,GAAG,IAAI,CAAA;QAC1B,IAAI,GAAG;YAAE,OAAO,GAAG,IAAI,CAAA;IACzB,CAAC,CAAA;IACD,IAAI,CAAC,GAAG,CAAC,CAAA;IACT,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACb,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;QACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC1C,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YACf,GAAG,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,KAAK,IAAI,CAAC,CAAA;YAC3B,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC;YAC/D,GAAG,CAAC,KAAK,EAAE,CAAC,KAAK,GAAG,CAAC,CAAA;YACrB,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAChD,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACjB,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YACjH,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;YACjB,CAAC,GAAG,KAAK,GAAG,CAAC,CAAA;QACf,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,GAAG;gBAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC3E,IAAI,KAAK,GAAG,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAA;YACxB,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;gBAAE,MAAM,GAAG,IAAI,CAAA;YACtD,CAAC,IAAI,CAAC,CAAA;QACR,CAAC;IACH,CAAC;IACD,GAAG,CAAC,CAAC,CAAC,CAAA;IACN,CAAC,CAAC,IAAI,GAAG,OAAO,CAAA;IAChB,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC3B,OAAO,CAAC,CAAA;AACV,CAAC;AAED;;;;;;;;;GASG;AACH,SAAgB,SAAS,CAAC,CAAa,EAAE,MAAc,EAAE,OAAiB;IACxE,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;IAC7C,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9D,MAAM,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE,CAAA;IAClD,IAAI,WAAW;QAAE,KAAK,CAAC,GAAG,EAAE,CAAA;IAC5B,KAAK,MAAM,CAAC,IAAI,KAAK;QAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,KAAK,CAAA;IAC/E,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAA;IACvB,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAA;IACtB,MAAM,MAAM,GAAG,CAAC,CAAS,EAAW,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,CAAA;IACpG,0EAA0E;IAC1E,0EAA0E;IAC1E,kEAAkE;IAClE,MAAM,OAAO,GAAG,CAAC,CAAS,EAAc,EAAE;QACxC,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,CAAE,CAAA;QACnB,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,CAAA;QACrB,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,WAAW,CAAA;QACxC,MAAM,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,CAAA;QACnF,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QACvB,IAAI,GAAG;YAAE,OAAO,GAAG,CAAA;QACnB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,CAAC,CAAA;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,CAAA;YACtB,IAAI,EAAW,CAAA;YACf,IAAI,KAAK,IAAI,IAAI;gBAAE,EAAE,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAA;iBACxC,IAAI,KAAK;gBAAE,EAAE,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAA;iBACtF,IAAI,IAAI;gBAAE,EAAE,GAAG,GAAG,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAA;;gBAC1C,EAAE,GAAG,GAAG,KAAK,CAAC,CAAA;YACnB,IAAI,EAAE,IAAI,OAAO,IAAI,KAAK;gBAAE,EAAE,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAA;YAC1G,IAAI,EAAE,IAAI,OAAO,IAAI,IAAI;gBAAE,EAAE,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,GAAG,CAAC,CAAA;YAC1H,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACrB,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,CAAA;QACjB,OAAO,GAAG,CAAA;IACZ,CAAC,CAAA;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,qEAAqE;IACrE,IAAI,CAAC,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACjC,MAAM,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAChC,MAAM,GAAG,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACjC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACV,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACT,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACV,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;YACnC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;YAChC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;QACrC,CAAC;QACD,CAAC,CAAC,IAAI,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAAA;IAC3B,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;IAC1B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAA;IACxB,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAA;IAC1B,wEAAwE;IACxE,0DAA0D;IAC1D,IAAI,EAAE,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,WAAW,EAAE,CAAC;YACrB,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAA;YACf,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;QACvF,CAAC;QACD,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;IACnB,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,gFAAgF;QAChF,MAAM,MAAM,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACpC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;QACb,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAA;QACjB,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;QACzF,6EAA6E;QAC7E,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QACnC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;YAChC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAA;YAChC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpB,mEAAmE;gBACnE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;gBAC7B,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC;oBAAE,CAAC,GAAG,IAAI,CAAA;gBAC7C,wEAAwE;gBACxE,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAE,EAAE,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAA;gBAC1D,IAAI,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,GAAG,CAAC,CAAE,IAAI,KAAK;oBAAE,CAAC,GAAG,IAAI,CAAA;YAC7C,CAAC;YACD,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;QACtB,CAAC;QACD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAA;QACvB,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAA;QAClC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;YAAE,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAE,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAE,CAAA;QAC9D,EAAE,GAAG,IAAI,CAAA;IACX,CAAC;IACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAA;IACxD,OAAO,KAAK,CAAA;AACd,CAAC;AAED;;;GAGG;AACU,QAAA,iBAAiB,GAAG,GAAG,UAAU,CAAC,QAAQ,EAAE,KAAK,SAAS,CAAC,QAAQ,EAAE,EAAE,CAAA"}

package/dist/piiDetectors.d.ts

@@ -0,0 +1,97 @@
+/**
+ * PII detector definitions, shared with the Rust proxy.
+ *
+ * `piiDetectors.json` is a byte-identical copy of
+ * `packages/proxy/src/dlp/pii_detectors.json`, which the Rust proxy embeds at
+ * compile time. The proxy's image is built from `packages/proxy` alone, so it
+ * cannot read this package, and this package ships to npm without the Rust
+ * tree — hence two copies, each tested against the other (`dlp/pii.rs` and
+ * the MCP proxy's `dlpPii.test.ts`). The validators the definition names are
+ * implemented in `packages/proxy/src/dlp/pii.rs` and
+ * `packages/mcp-proxy/src/dlpPii.ts`.
+ */
+import { z } from 'zod';
+/** What a detector does with a match, least to most strict. `off` detectors are not run. */
+export declare const PII_ACTIONS: readonly ["off", "redact", "block"];
+export type PiiAction = (typeof PII_ACTIONS)[number];
+/** Every detector's id, in `piiDetectors.json`'s order (a test holds the two equal). */
+export declare const PII_DETECTOR_IDS: readonly ["pii.card", "pii.iban", "pii.ssn", "pii.email", "pii.phone"];
+export type PiiDetectorId = (typeof PII_DETECTOR_IDS)[number];
+/**
+ * The workspace setting `piiDetectors`: an action for each detector the
+ * workspace governs centrally. Both proxies use it as the baseline for the
+ * workspace's traffic, and a machine's own config may only tighten it
+ * ({@link effectivePiiActions}). A detector left out keeps each machine's
+ * action. Unknown ids and actions are refused.
+ */
+export declare const PiiDetectorSettingsSchema: z.ZodRecord<z.ZodEnum<["pii.card", "pii.iban", "pii.ssn", "pii.email", "pii.phone"]>, z.ZodEnum<["off", "redact", "block"]>>;
+export type PiiDetectorSettings = Partial<Record<PiiDetectorId, PiiAction>>;
+/**
+ * The `piiDetectors` field of a control-plane answer, as a proxy reads it.
+ * The LLM proxy gets it from `/api/v1/auth/key-context`, the MCP proxy from
+ * `/api/v1/sop/rules` or `/api/v1/policy/resolve`; all three send the same
+ * value. `unreadable` goes to the proxy's fail mode.
+ */
+export type WorkspacePiiDetectors = {
+    kind: 'none';
+} | {
+    kind: 'set';
+    actions: PiiDetectorSettings;
+} | {
+    kind: 'unreadable';
+    reason: string;
+};
+/**
+ * Reads the field. Absent is a control plane older than the setting, and
+ * `{}` a workspace that sets none: both `none`. `null` is the control plane
+ * saying it could not read the stored setting. An id this build does not
+ * know is left out, since a newer control plane can name a detector an older
+ * proxy cannot run; an action that does not exist makes the whole field
+ * unreadable. The Rust proxy reads it the same way (`dlp/workspace.rs`), and
+ * `fixtures/pii-precedence-vectors.json` holds the two together.
+ */
+export declare function parseWorkspacePiiDetectors(field: unknown): WorkspacePiiDetectors;
+/**
+ * Every detector's action for a workspace's traffic on one machine.
+ *
+ * The workspace setting is the baseline for each detector it names, and the
+ * machine's own config (`local`, only the detectors it names) may tighten it
+ * (`off` → `redact` → `block`) but never loosen it, so a developer cannot
+ * switch off on their machine what the workspace turned on. A detector the
+ * workspace leaves out keeps the machine's action, else its default; with no
+ * workspace setting the machine's config applies alone. The Rust proxy's
+ * `effective_pii_actions` (`dlp.rs`) is the same rule, and both run
+ * `fixtures/pii-precedence-vectors.json`.
+ */
+export declare function effectivePiiActions(local: PiiDetectorSettings, workspace: PiiDetectorSettings | null): Record<PiiDetectorId, PiiAction>;
+export interface PiiDetectorDefinition {
+    /** Stable finding id, `pii.*`. */
+    id: string;
+    category: string;
+    description: string;
+    /** Rust regex ∩ JavaScript RegExp: ASCII classes, no `\b`, no lookaround. */
+    regex: string;
+    /** `numeric` adds the decimal/serial rule on top of the word boundary. */
+    boundary: 'word' | 'numeric';
+    validator: 'card_luhn' | 'iban_mod97' | 'ssn_ranges' | 'email_shape' | 'phone_digits';
+    default_action: PiiAction;
+}
+export interface PiiDefinition {
+    version: number;
+    detectors: PiiDetectorDefinition[];
+    /** Inclusive `[low, high]` IIN ranges, both bounds the same number of digits. */
+    card_brands: Array<{
+        brand: string;
+        prefixes: Array<[string, string]>;
+        lengths: number[];
+    }>;
+    /** IBAN length by ISO 3166 country code, from the SWIFT IBAN registry. */
+    iban_lengths: Record<string, number>;
+}
+/**
+ * JSON imports type their strings as `string`, not the unions above, hence
+ * the cast through `unknown`. The MCP proxy refuses to load an unknown
+ * validator name, and the conformance vectors pin the rest.
+ */
+export declare const PII_DEFINITION: PiiDefinition;
+//# sourceMappingURL=piiDetectors.d.ts.map

package/dist/piiDetectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"piiDetectors.d.ts","sourceRoot":"","sources":["../src/piiDetectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4FAA4F;AAC5F,eAAO,MAAM,WAAW,qCAAsC,CAAA;AAC9D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,wEAAyE,CAAA;AACtG,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,8HAA0D,CAAA;AAChG,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAK1C;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAkBhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,mBAAmB,GAAG,IAAI,GACpC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAYlC;AAED,MAAM,WAAW,qBAAqB;IACpC,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,SAAS,EAAE,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,cAAc,CAAA;IACrF,cAAc,EAAE,SAAS,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,iFAAiF;IACjF,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC3F,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAA4B,aAAa,CAAA"}

package/dist/piiDetectors.js

@@ -0,0 +1,96 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PII_DEFINITION = exports.PiiDetectorSettingsSchema = exports.PII_DETECTOR_IDS = exports.PII_ACTIONS = void 0;
+exports.parseWorkspacePiiDetectors = parseWorkspacePiiDetectors;
+exports.effectivePiiActions = effectivePiiActions;
+/**
+ * PII detector definitions, shared with the Rust proxy.
+ *
+ * `piiDetectors.json` is a byte-identical copy of
+ * `packages/proxy/src/dlp/pii_detectors.json`, which the Rust proxy embeds at
+ * compile time. The proxy's image is built from `packages/proxy` alone, so it
+ * cannot read this package, and this package ships to npm without the Rust
+ * tree — hence two copies, each tested against the other (`dlp/pii.rs` and
+ * the MCP proxy's `dlpPii.test.ts`). The validators the definition names are
+ * implemented in `packages/proxy/src/dlp/pii.rs` and
+ * `packages/mcp-proxy/src/dlpPii.ts`.
+ */
+const zod_1 = require("zod");
+const piiDetectors_json_1 = __importDefault(require("./piiDetectors.json"));
+/** What a detector does with a match, least to most strict. `off` detectors are not run. */
+exports.PII_ACTIONS = ['off', 'redact', 'block'];
+/** Every detector's id, in `piiDetectors.json`'s order (a test holds the two equal). */
+exports.PII_DETECTOR_IDS = ['pii.card', 'pii.iban', 'pii.ssn', 'pii.email', 'pii.phone'];
+/**
+ * The workspace setting `piiDetectors`: an action for each detector the
+ * workspace governs centrally. Both proxies use it as the baseline for the
+ * workspace's traffic, and a machine's own config may only tighten it
+ * ({@link effectivePiiActions}). A detector left out keeps each machine's
+ * action. Unknown ids and actions are refused.
+ */
+exports.PiiDetectorSettingsSchema = zod_1.z.record(zod_1.z.enum(exports.PII_DETECTOR_IDS), zod_1.z.enum(exports.PII_ACTIONS));
+const isPiiAction = (v) => exports.PII_ACTIONS.includes(v);
+const isPiiDetectorId = (v) => exports.PII_DETECTOR_IDS.includes(v);
+/**
+ * Reads the field. Absent is a control plane older than the setting, and
+ * `{}` a workspace that sets none: both `none`. `null` is the control plane
+ * saying it could not read the stored setting. An id this build does not
+ * know is left out, since a newer control plane can name a detector an older
+ * proxy cannot run; an action that does not exist makes the whole field
+ * unreadable. The Rust proxy reads it the same way (`dlp/workspace.rs`), and
+ * `fixtures/pii-precedence-vectors.json` holds the two together.
+ */
+function parseWorkspacePiiDetectors(field) {
+    if (field === undefined)
+        return { kind: 'none' };
+    if (field === null)
+        return { kind: 'unreadable', reason: "the control plane could not read the workspace's PII detector actions" };
+    if (typeof field !== 'object' || Array.isArray(field)) {
+        return { kind: 'unreadable', reason: `the workspace's PII detector actions are not an object: ${JSON.stringify(field)}` };
+    }
+    const actions = {};
+    for (const [id, action] of Object.entries(field)) {
+        if (!isPiiDetectorId(id))
+            continue;
+        if (!isPiiAction(action)) {
+            return {
+                kind: 'unreadable',
+                reason: `the workspace's piiDetectors setting sets '${id}' to ${JSON.stringify(action)}; only 'off', 'redact' and 'block' exist`,
+            };
+        }
+        actions[id] = action;
+    }
+    return Object.keys(actions).length > 0 ? { kind: 'set', actions } : { kind: 'none' };
+}
+/**
+ * Every detector's action for a workspace's traffic on one machine.
+ *
+ * The workspace setting is the baseline for each detector it names, and the
+ * machine's own config (`local`, only the detectors it names) may tighten it
+ * (`off` → `redact` → `block`) but never loosen it, so a developer cannot
+ * switch off on their machine what the workspace turned on. A detector the
+ * workspace leaves out keeps the machine's action, else its default; with no
+ * workspace setting the machine's config applies alone. The Rust proxy's
+ * `effective_pii_actions` (`dlp.rs`) is the same rule, and both run
+ * `fixtures/pii-precedence-vectors.json`.
+ */
+function effectivePiiActions(local, workspace) {
+    const rank = (a) => exports.PII_ACTIONS.indexOf(a);
+    const table = Object.fromEntries(exports.PII_DEFINITION.detectors.map((d) => [d.id, d.default_action]));
+    Object.assign(table, local);
+    for (const [id, baseline] of Object.entries(workspace ?? {})) {
+        const mine = local[id];
+        table[id] = mine !== undefined && rank(mine) > rank(baseline) ? mine : baseline;
+    }
+    return table;
+}
+/**
+ * JSON imports type their strings as `string`, not the unions above, hence
+ * the cast through `unknown`. The MCP proxy refuses to load an unknown
+ * validator name, and the conformance vectors pin the rest.
+ */
+exports.PII_DEFINITION = piiDetectors_json_1.default;
+//# sourceMappingURL=piiDetectors.js.map

package/dist/piiDetectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"piiDetectors.js","sourceRoot":"","sources":["../src/piiDetectors.ts"],"names":[],"mappings":";;;;;;AAwDA,gEAkBC;AAcD,kDAeC;AAvGD;;;;;;;;;;;GAWG;AACH,6BAAuB;AACvB,4EAA4C;AAE5C,4FAA4F;AAC/E,QAAA,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAA;AAG9D,wFAAwF;AAC3E,QAAA,gBAAgB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAU,CAAA;AAGtG;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,IAAI,CAAC,wBAAgB,CAAC,EAAE,OAAC,CAAC,IAAI,CAAC,mBAAW,CAAC,CAAC,CAAA;AAchG,MAAM,WAAW,GAAG,CAAC,CAAU,EAAkB,EAAE,CAAE,mBAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AACnG,MAAM,eAAe,GAAG,CAAC,CAAS,EAAsB,EAAE,CAAE,wBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AAE9G;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,KAAc;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAA;IAClI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2DAA2D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAA;IAC3H,CAAC;IACD,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAAE,SAAQ;QAClC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,8CAA8C,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,0CAA0C;aACjI,CAAA;QACH,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,GAAG,MAAM,CAAA;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACtF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,SAAqC;IAErC,MAAM,IAAI,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,mBAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,sBAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAG7F,CAAA;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAsC,EAAE,CAAC;QAClG,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAA;QACtB,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;IACjF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAwBD;;;;GAIG;AACU,QAAA,cAAc,GAAG,2BAAsC,CAAA"}

package/dist/piiDetectors.json

@@ -0,0 +1,71 @@
+{
+    "$comment": "PII detectors for both DLP scanners. The Rust proxy embeds this file (packages/proxy/src/dlp/pii_detectors.json); the MCP proxy reads a byte-identical copy (packages/shared-types/src/piiDetectors.json). Edit one, copy it over the other: a test on each side fails while they differ. Regexes are the subset Rust regex and JavaScript RegExp agree on — ASCII classes, no \\b, no \\d, no lookaround — and each match is then checked by the named validator and boundary rule, implemented identically in packages/proxy/src/dlp/pii.rs and packages/mcp-proxy/src/dlpPii.ts. Conformance vectors: packages/shared-types/fixtures/pii-detector-vectors.json.",
+    "version": 1,
+    "detectors": [
+        {
+            "id": "pii.card",
+            "category": "pii",
+            "description": "Payment card number",
+            "regex": "[0-9]{4}[ -][0-9]{4}[ -][0-9]{4}[ -][0-9]{4}|[0-9]{4}[ -][0-9]{6}[ -][0-9]{4,5}|[0-9]{13,19}",
+            "boundary": "numeric",
+            "validator": "card_luhn",
+            "default_action": "redact"
+        },
+        {
+            "id": "pii.iban",
+            "category": "pii",
+            "description": "IBAN",
+            "regex": "[A-Z]{2}[0-9]{2}(?: ?[A-Z0-9]){11,30}",
+            "boundary": "word",
+            "validator": "iban_mod97",
+            "default_action": "redact"
+        },
+        {
+            "id": "pii.ssn",
+            "category": "pii",
+            "description": "US Social Security Number",
+            "regex": "[0-9]{3}-[0-9]{2}-[0-9]{4}",
+            "boundary": "numeric",
+            "validator": "ssn_ranges",
+            "default_action": "redact"
+        },
+        {
+            "id": "pii.email",
+            "category": "pii",
+            "description": "Email address",
+            "regex": "[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\\.[A-Za-z0-9-]{1,63}){1,8}",
+            "boundary": "word",
+            "validator": "email_shape",
+            "default_action": "off"
+        },
+        {
+            "id": "pii.phone",
+            "category": "pii",
+            "description": "Phone number",
+            "regex": "\\+[1-9][0-9]{0,2}(?:[ .-]?\\([0-9]{1,4}\\)|[ .-]?[0-9]{1,4}){2,7}|(?:1[ .-])?(?:\\([2-9][0-9]{2}\\) ?|[2-9][0-9]{2}[ .-])[2-9][0-9]{2}[ .-][0-9]{4}",
+            "boundary": "numeric",
+            "validator": "phone_digits",
+            "default_action": "off"
+        }
+    ],
+    "card_brands": [
+        { "brand": "visa", "prefixes": [["4", "4"]], "lengths": [13, 16, 19] },
+        { "brand": "mastercard", "prefixes": [["51", "55"], ["2221", "2720"]], "lengths": [16] },
+        { "brand": "amex", "prefixes": [["34", "34"], ["37", "37"]], "lengths": [15] },
+        { "brand": "discover", "prefixes": [["6011", "6011"], ["644", "649"], ["65", "65"], ["622126", "622925"]], "lengths": [16, 17, 18, 19] },
+        { "brand": "jcb", "prefixes": [["3528", "3589"]], "lengths": [16, 17, 18, 19] },
+        { "brand": "diners", "prefixes": [["300", "305"], ["3095", "3095"], ["36", "36"], ["38", "39"]], "lengths": [14, 15, 16, 17, 18, 19] },
+        { "brand": "unionpay", "prefixes": [["62", "62"], ["81", "81"]], "lengths": [16, 17, 18, 19] }
+    ],
+    "iban_lengths": {
+        "AD": 24, "AE": 23, "AL": 28, "AT": 20, "AZ": 28, "BA": 20, "BE": 16, "BG": 22, "BH": 22, "BI": 27,
+        "BR": 29, "BY": 28, "CH": 21, "CR": 22, "CY": 28, "CZ": 24, "DE": 22, "DJ": 27, "DK": 18, "DO": 28,
+        "EE": 20, "EG": 29, "ES": 24, "FI": 18, "FK": 18, "FO": 18, "FR": 27, "GB": 22, "GE": 22, "GI": 23,
+        "GL": 18, "GR": 27, "GT": 28, "HN": 28, "HR": 21, "HU": 28, "IE": 22, "IL": 23, "IQ": 23, "IS": 26,
+        "IT": 27, "JO": 30, "KW": 30, "KZ": 20, "LB": 28, "LC": 32, "LI": 21, "LT": 20, "LU": 20, "LV": 21,
+        "LY": 25, "MC": 27, "MD": 24, "ME": 22, "MK": 19, "MN": 20, "MR": 27, "MT": 31, "MU": 30, "NI": 28,
+        "NL": 18, "NO": 15, "OM": 23, "PK": 24, "PL": 28, "PS": 29, "PT": 25, "QA": 29, "RO": 24, "RS": 22,
+        "RU": 33, "SA": 24, "SC": 31, "SD": 18, "SE": 24, "SI": 19, "SK": 24, "SM": 27, "SO": 23, "ST": 25,
+        "SV": 28, "TL": 23, "TN": 24, "TR": 26, "UA": 29, "VA": 22, "VG": 24, "XK": 20, "YE": 30
+    }
+}

package/dist/policy.d.ts

@@ -5,7 +5,7 @@
  * Delegation Capability Token (DCT) structures used by the Circuit
  * Breaker and PCAS subsystems.
  *
- * HLD §3.3 (PCAS), LLD 01-data-architecture §3.2
+ * HLD §3.3 (PCAS)
  *
  * @module
  */

package/dist/policy.js

@@ -6,7 +6,7 @@
  * Delegation Capability Token (DCT) structures used by the Circuit
  * Breaker and PCAS subsystems.
  *
- * HLD §3.3 (PCAS), LLD 01-data-architecture §3.2
+ * HLD §3.3 (PCAS)
  *
  * @module
  */