@intutic/shared-types 2.2.0 → 2.4.0

package/dist/modelCatalog.js

@@ -1,6 +1,6 @@
 "use strict";
 /**
- * Model catalog (LLD #70, model catalog & cohort wizard).
+ * Model catalog (model catalog & cohort wizard).
  *
  * `packages/shared-types/src/providers.ts` describes what a provider's
  * CREDENTIAL looks like — field names, types, docs URL. It says nothing about
@@ -78,7 +78,7 @@ function findCatalogModel(input) {
 /**
  * Providers whose models run on infrastructure the operator controls. Every
  * other registry provider is a hosted API. Judges are self-hosted only (owner
- * rule, 2026-10-03; LLD #72), so these are the only providers a judge model
+ * rule, 2026-10-03), so these are the only providers a judge model
  * may come from.
  */
 exports.SELF_HOSTED_MODEL_PROVIDER_IDS = new Set(['ollama']);

package/dist/notifications.d.ts

@@ -1,155 +1,11 @@
 export type NotificationChannel = 'slack' | 'email' | 'webhook' | 'pagerduty';
-export type NotificationEventType = 'anomaly.detected'
 /**
- * One attributed detector finding from the proxy, allowed or blocked.
- *
- * Distinct from `anomaly.detected`, which is raised by the control plane's own
- * classifier after the fact and only for requests that produced an incident.
- * This one fires for every finding on every trace — including the advisory and
- * reask ones on requests that proceeded — which is what makes "see everything,
- * block nothing" possible.
- *
- * Carries `detectorId`, so a rule can target one detector rather than a whole
- * taxonomy kind that sixteen of twenty-two detectors share.
+ * Every event a notification rule can subscribe to. The API refuses a rule
+ * naming anything else, and the CLI and the Terraform provider check
+ * against this list before they send one.
  */
- | 'anomaly.finding' | 'incident.created' | 'incident.escalated' | 'sop.status_changed' | 'session.ended' | 'adapter.write_back.failed' | 'decision.pending' | 'ssl.enforcement.violation' | 'context_gap.auto_injected' | 'trajectory.alert' | 'calibration.threshold_breach' | 'anomaly.drift.detected' | 'anomaly.capability_miss' | 'anomaly.trust.updated' | 'sop.stale.detected' | 'sop.cascade.alert' | 'sop.cascade.invalidated' | 'sop.integrity.drift' | 'sop.lifecycle.transitioned'
-/** A source-connector sync found an enforced SOP's upstream document changed and created a DRAFT successor awaiting review (TD-474 item 7). */
- | 'sop.upstream.changed'
-/** A SHADOW guardrail crossed the promotion thresholds; a named member decides. */
- | 'guardrail.ready'
-/** The passage a guardrail cites changed upstream; promotion is refused until re-confirmed. */
- | 'guardrail.stale'
-/** An MCP proxy reported a server this workspace's registry had never seen; it waits as a candidate for an OWNER or ADMIN to approve or block. */
- | 'mcp.server.candidate'
-/** A judged response is waiting for a person in the judge review queue: the typed judge was unsure, or it is a spot check of one it cleared (LLD #72). */
- | 'judge.review.queued' | 'finops.budget.exceeded' | 'finops.budget.threshold' | 'finops.tokens.classified' | 'trial.started' | 'trial.expired_downgraded' | 'trial.day7_report_sent' | 'trial.day13_report_sent' | 'plan.captured' | 'plan.approved' | 'plan.deviation.detected' | 'identity.offboarding.completed' | 'workspace.context.updated'
-/**
- * A registered, non-revoked self-hosted gateway has gone past
- * GATEWAY_HEARTBEAT_TTL without a heartbeat -- fired once per member
- * workspace of the gateway's org (gateways are org-scoped; notification
- * rules are workspace-scoped), not once per gateway.
- */
- | 'gateway.stale.detected'
-/**
- * A managed cell (`deployment_target='managed_cell'`) has sat `pending`
- * (registered, never heartbeated) past `CELL_STUCK_PENDING_THRESHOLD_MS`
- * (15 min) -- the provisioner is failing to converge it (TD-342(c)).
- * Fired by `detectStuckPendingCells` (gatewayHealthService.ts), same
- * org→workspace fan-out and stable-reason dedup as `gateway.stale.detected`.
- * Already wired into `notificationRouterService.ts`'s dispatch and
- * severity map before this union entry existed -- this only adds the type
- * contract those call sites were relying on via an `as` cast.
- */
- | 'gateway.cell.stuck_pending'
-/**
- * The control plane's CP→region Valkey sync heartbeat
- * (`intutic:cp:last-sync`) is missing or stale in a remote region --
- * cells there keep serving, but on progressively stale control metadata.
- * Fired by `detectStaleRegionSync` (gatewayHealthService.ts) per member
- * workspace of every org with a live cell in the affected region. Same
- * pre-existing-dispatch note as `gateway.cell.stuck_pending` above.
- */
- | 'region.sync.stale'
-/**
- * A managed cell was marked for removal because its org's plan tier no
- * longer covers it (`maxCellsPerOrg` in planSkuMap.ts) -- either a
- * voluntary downgrade or an involuntary loss of paid status (cancellation,
- * dunning). Fired by `scheduleCellReconciliation`
- * (cellDeprovisionService.ts) at most once per scheduled removal
- * (`deprovision_notified_at` is the idempotence gate). Carries
- * `deprovision_at` -- the grace-period deadline -- and `reason`.
- */
- | 'org.cells.deprovision_scheduled'
-/**
- * A previously-scheduled cell removal was cancelled because the org's
- * cell count is no longer over its plan-tier capacity -- typically a
- * re-upgrade landing before the grace period expired. Fired by the same
- * reconciler as `org.cells.deprovision_scheduled` above, the bidirectional
- * half of the same bidirectional-reconcile-marks design. MEDIUM, not
- * HIGH: this is good news for the org, not an incident.
- */
- | 'org.cells.deprovision_canceled'
-/**
- * A managed cell's deprovision grace period actually expired and the cell
- * was revoked -- fired by `sweepCellCapacity`'s deadline pass
- * (cellDeprovisionService.ts), the same revoke shape as a manual
- * `DELETE /api/v1/gateways/:id`. HIGH: an org's traffic capacity for that
- * region just changed, same tier as `gateway.stale.detected`.
- */
- | 'org.cells.deprovisioned'
-/**
- * A device's reported enforcement posture (firewall/CA-trust/system-hooks)
- * hasn't been refreshed past DEVICE_STALE_THRESHOLD_MS (72h) -- fired by
- * deviceHealthCron.ts. Most staleness is a closed laptop, not a
- * compromise -- MEDIUM, unlike gateway.stale.detected's HIGH.
- */
- | 'device.enforcement.stale'
-/**
- * A device's firewall went from active:true to active:false on a live
- * report -- an active bypass just occurred, not merely unreported.
- */
- | 'device.enforcement.disabled'
-/**
- * A harness installed in the workspace has sent no hook event of any kind,
- * allows included, for the whole liveness window: its gate may not be
- * running. Fired once when the gate goes silent, not on every hourly sweep.
- * Carries `harnessType` and `incidentId`.
- */
- | 'governance.gate.silent'
-/**
- * A harness with an open `governance.gate.silent` alert is reporting again.
- * Same `incidentId` as the alert it closes; PagerDuty resolves that incident.
- */
- | 'governance.gate.recovered'
-/**
- * The hourly audit-log integrity check found a failure of one kind
- * (`kind`: `chain_break`, `mirror_copy_mismatch`, `signature_invalid`,
- * `root_mismatch` or `guard_tampered`). Fired once per kind while it keeps
- * failing; a recurrence after it clears fires again.
- */
- | 'governance.integrity.failed'
-/**
- * A NEW provider_incidents window opened for a provider (Anthropic,
- * OpenAI, ...) -- fired once per incident open, not on every coalesced
- * failure that extends an already-open incident. Fired scoped to the
- * workspace whose trace triggered the open, since provider_incidents
- * itself is not workspace-scoped (see migration 157) and no complete
- * "every workspace routing through this provider" fan-out exists the way
- * gateway.stale.detected's org-membership join provides for gateways.
- */
- | 'provider.outage.detected'
-/**
- * A Stripe subscription reported `status: 'past_due'` or `'unpaid'` via
- * `customer.subscription.updated` -- visibility only, not a tier change
- * (repeated payment failure is the dunning flow's job, via
- * `invoice.payment_failed`'s own 3rd-attempt downgrade). MEDIUM: worth a
- * support/ops look, not yet the incident a full cancellation is.
- */
- | 'billing.subscription.past_due'
-/**
- * An opt-in `GET /api/v3/files/{sha256}` VirusTotal lookup on a
- * skill-bundled SCRIPT (never `SKILL.md` prose, never uploaded content —
- * see `virusTotalService.ts`'s doc comment) returned at least one AV
- * engine detection. HIGH: a confirmed-malicious file already sitting in a
- * developer's skill directory is a live incident, the same tier as
- * `provider.outage.detected` and `device.enforcement.disabled` above, not
- * a usage-pattern signal to review later.
- */
- | 'skill.malware.detected'
-/**
- * The opt-in LLM judge (`semanticSkillAnalysisEnabled`) called a skill's
- * `SKILL.md` prose `'suspicious'` or `'malicious'` — content that
- * `scanSkillContent`'s deterministic patterns may have missed entirely,
- * since the whole point of this judge is catching a rephrasing that
- * avoids every pattern's literal wording. Fired by
- * `analyzeSkillSemantics` (`services/semanticSkillAnalysisService.ts`)
- * only for a judge call that actually ran and returned one of those two
- * verdicts — never for `'clean'`, and never for `'unjudged'` (a failed or
- * capped-out call is an absence of signal, not a finding). Severity is
- * dynamic: HIGH for `'malicious'`, MEDIUM for `'suspicious'` — see
- * `mapSeverity` in `notificationRouterService.ts`.
- */
- | 'skill.semantic.flagged';
+export declare const NOTIFICATION_EVENT_TYPES: readonly ["anomaly.detected", "anomaly.finding", "incident.created", "incident.escalated", "sop.status_changed", "session.ended", "adapter.write_back.failed", "decision.pending", "decision.approved", "decision.rejected", "ssl.enforcement.violation", "context_gap.auto_injected", "trajectory.alert", "calibration.threshold_breach", "anomaly.drift.detected", "anomaly.capability_miss", "anomaly.trust.updated", "sop.stale.detected", "sop.cascade.alert", "sop.cascade.invalidated", "sop.integrity.drift", "sop.lifecycle.transitioned", "sop.upstream.changed", "guardrail.ready", "guardrail.stale", "mcp.server.candidate", "mcp.server.tool_change_risk", "mcp.server.decided", "mcp.server.tool_toggled", "mcp.budget.threshold", "mcp.budget.exceeded", "judge.review.queued", "finops.budget.exceeded", "finops.budget.threshold", "finops.tokens.classified", "trial.started", "trial.expired_downgraded", "trial.day7_report_sent", "trial.day13_report_sent", "plan.captured", "plan.approved", "plan.deviation.detected", "identity.offboarding.completed", "auth.login.failed", "scim.user.changed", "scim.group.changed", "webhook.secret.rotated", "evidence.exported", "credential.changed", "workspace.context.updated", "gateway.stale.detected", "gateway.cell.stuck_pending", "region.sync.stale", "org.cells.deprovision_scheduled", "org.cells.deprovision_canceled", "org.cells.deprovisioned", "device.enforcement.stale", "device.enforcement.disabled", "governance.gate.silent", "governance.gate.recovered", "governance.integrity.failed", "inventory.ungoverned.detected", "provider.outage.detected", "billing.subscription.past_due", "skill.malware.detected", "skill.semantic.flagged"];
+export type NotificationEventType = (typeof NOTIFICATION_EVENT_TYPES)[number];
 export type NotificationStatus = 'sent' | 'failed' | 'deduplicated' | 'filtered';
 export interface NotificationRule {
     ruleId: string;
@@ -182,7 +38,7 @@ export interface ChannelConfig {
     webhookSecretEnc?: string;
     /** PagerDuty Events API v2 integration/routing key. A credential — see
      *  `notificationHubService.ts`'s `getChannelTarget` for why it is masked
-     *  (`pd:${key.slice(0,6)}…`) before ever reaching `notification_log`,
+     *  (`${key.slice(0,6)}…`) before ever reaching `notification_log`,
      *  which is append-only and so unredactable forever once written. */
     pagerdutyRoutingKey?: string;
 }
@@ -219,15 +75,30 @@ export interface NotificationLogEntry {
     latencyMs: number | null;
     createdAt: string;
 }
+/** The severity a notification is sent at, which a rule's severity filter matches on. */
+export type NotificationSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
 export interface GovernanceEvent {
     type: NotificationEventType;
     workspaceId: string;
     sessionId?: string;
-    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+    severity: NotificationSeverity;
     summary: string;
     description: string;
     metadata: Record<string, unknown>;
 }
+/**
+ * The severity `incident.created` is sent at, from the incident's own
+ * (`governance_incidents.severity`). Until 2.4.0 every incident was sent at
+ * CRITICAL whatever its severity, so a rule filtered on CRITICAL received a
+ * MEDIUM incident and a rule filtered on HIGH received none.
+ */
+export declare const INCIDENT_NOTIFICATION_SEVERITY: Readonly<Record<'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW', NotificationSeverity>>;
+/**
+ * {@link INCIDENT_NOTIFICATION_SEVERITY} for an incident event's `severity`.
+ * One the map does not name (absent, or from an emitter that sent something
+ * else) is sent at CRITICAL: a malformed event must not quieten an alert.
+ */
+export declare function incidentNotificationSeverity(severity: unknown): NotificationSeverity;
 export interface DispatchResult {
     ruleId: string;
     channel: NotificationChannel;
@@ -312,6 +183,8 @@ export interface SlackInteraction {
     message: {
         ts: string;
     };
+    /** Where a reply to the clicker goes; Slack ignores the HTTP response body. */
+    response_url?: string;
 }
 export interface SlackSlashCommand {
     command: string;

package/dist/notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E,MAAM,MAAM,qBAAqB,GAE7B,kBAAkB;AACpB;;;;;;;;;;;GAWG;GACD,iBAAiB,GACjB,kBAAkB,GAClB,oBAAoB,GACpB,oBAAoB,GACpB,eAAe,GACf,2BAA2B,GAC3B,kBAAkB,GAClB,2BAA2B,GAC3B,2BAA2B,GAC3B,kBAAkB,GAElB,8BAA8B,GAC9B,wBAAwB,GACxB,yBAAyB,GACzB,uBAAuB,GAEvB,oBAAoB,GACpB,mBAAmB,GACnB,yBAAyB,GACzB,qBAAqB,GACrB,4BAA4B;AAC9B,+IAA+I;GAC7I,sBAAsB;AAExB,mFAAmF;GACjF,iBAAiB;AACnB,+FAA+F;GAC7F,iBAAiB;AAEnB,kJAAkJ;GAChJ,sBAAsB;AAExB,0JAA0J;GACxJ,qBAAqB,GAErB,wBAAwB,GACxB,yBAAyB,GACzB,0BAA0B,GAE1B,eAAe,GACf,0BAA0B,GAC1B,wBAAwB,GACxB,yBAAyB,GAEzB,eAAe,GACf,eAAe,GACf,yBAAyB,GAEzB,gCAAgC,GAEhC,2BAA2B;AAE7B;;;;;GAKG;GACD,wBAAwB;AAC1B;;;;;;;;;GASG;GACD,4BAA4B;AAC9B;;;;;;;GAOG;GACD,mBAAmB;AAErB;;;;;;;;GAQG;GACD,iCAAiC;AACnC;;;;;;;GAOG;GACD,gCAAgC;AAClC;;;;;;GAMG;GACD,yBAAyB;AAE3B;;;;;GAKG;GACD,0BAA0B;AAC5B;;;GAGG;GACD,6BAA6B;AAE/B;;;;;GAKG;GACD,wBAAwB;AAC1B;;;GAGG;GACD,2BAA2B;AAE7B;;;;;GAKG;GACD,6BAA6B;AAE/B;;;;;;;;GAQG;GACD,0BAA0B;AAE5B;;;;;;GAMG;GACD,+BAA+B;AAEjC;;;;;;;;GAQG;GACD,wBAAwB;AAE1B;;;;;;;;;;;;GAYG;GACD,wBAAwB,CAAA;AAE5B,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAA;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;yEAGqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACzD,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,GAAG,YAAY,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CACxB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B"}
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,qoDA2O3B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAA;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;yEAGqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAElF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE,oBAAoB,CAAC,CAKzH,CAAA;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,GAAG,oBAAoB,CAIpF;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,GAAG,YAAY,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B"}

package/dist/notifications.js

@@ -1,6 +1,271 @@
 "use strict";
 // ============================================
-// LLD #45-slack: Notification Hub + Slack Adapter
+// Notification Hub + Slack Adapter
 // ============================================
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.INCIDENT_NOTIFICATION_SEVERITY = exports.NOTIFICATION_EVENT_TYPES = void 0;
+exports.incidentNotificationSeverity = incidentNotificationSeverity;
+/**
+ * Every event a notification rule can subscribe to. The API refuses a rule
+ * naming anything else, and the CLI and the Terraform provider check
+ * against this list before they send one.
+ */
+exports.NOTIFICATION_EVENT_TYPES = [
+    // ── Core governance events (already wired) ──
+    'anomaly.detected',
+    /**
+     * One attributed detector finding from the proxy, allowed or blocked.
+     *
+     * Distinct from `anomaly.detected`, which is raised by the control plane's own
+     * classifier after the fact and only for requests that produced an incident.
+     * This one fires for every finding on every trace — including the advisory and
+     * reask ones on requests that proceeded — which is what makes "see everything,
+     * block nothing" possible.
+     *
+     * Carries `detectorId`, so a rule can target one detector rather than a whole
+     * taxonomy kind that sixteen of twenty-two detectors share.
+     */
+    'anomaly.finding',
+    'incident.created',
+    'incident.escalated',
+    'sop.status_changed',
+    'session.ended',
+    'adapter.write_back.failed',
+    'decision.pending',
+    /** An OWNER, ADMIN or EM approved a held decision, in Slack or through the API and CLI. Carries `entryId`, `reviewerId` and `via`. */
+    'decision.approved',
+    /** An OWNER, ADMIN or EM rejected a held decision, in Slack or through the API and CLI. */
+    'decision.rejected',
+    'ssl.enforcement.violation',
+    'context_gap.auto_injected',
+    'trajectory.alert',
+    // ── Calibration & drift (Q10 orphan audit) ──
+    'calibration.threshold_breach',
+    'anomaly.drift.detected',
+    'anomaly.capability_miss',
+    'anomaly.trust.updated',
+    // ── SOP lifecycle & integrity ──
+    'sop.stale.detected',
+    'sop.cascade.alert',
+    'sop.cascade.invalidated',
+    'sop.integrity.drift',
+    'sop.lifecycle.transitioned',
+    /** A source-connector sync found an enforced SOP's upstream document changed and created a DRAFT successor awaiting review. */
+    'sop.upstream.changed',
+    // ── Policy guardrails ──
+    /** A SHADOW guardrail crossed the promotion thresholds; a named member decides. */
+    'guardrail.ready',
+    /** The passage a guardrail cites changed upstream; promotion is refused until re-confirmed. */
+    'guardrail.stale',
+    // ── MCP server registry ──
+    /** An MCP proxy reported a server this workspace's registry had never seen; it waits as a candidate for an OWNER or ADMIN to approve or block. */
+    'mcp.server.candidate',
+    /** A server the registry knew declared a different tool set, and the change scored high risk (`mcpToolRisk.ts`). */
+    'mcp.server.tool_change_risk',
+    /** An OWNER or ADMIN approved, blocked or reset (returned to the approval queue) an MCP server. Carries `action`, `previousStatus` and `actorId`. */
+    'mcp.server.decided',
+    /** An OWNER or ADMIN switched one tool of an MCP server on or off. Carries `toolName`, `enabled` and `actorId`. */
+    'mcp.server.tool_toggled',
+    /** An MCP call budget reached its warning threshold for the period (sent once per budget per period). */
+    'mcp.budget.threshold',
+    /** An MCP call budget ran out and the proxy refused a call (sent once per budget per period). */
+    'mcp.budget.exceeded',
+    // ── Governance judge ──
+    /** A judged response is waiting for a person in the judge review queue: the typed judge was unsure, or it is a spot check of one it cleared. */
+    'judge.review.queued',
+    // ── FinOps & budget ──
+    'finops.budget.exceeded',
+    'finops.budget.threshold',
+    'finops.tokens.classified',
+    // ── Enterprise & trial ──
+    'trial.started',
+    'trial.expired_downgraded',
+    'trial.day7_report_sent',
+    'trial.day13_report_sent',
+    // ── Plans ──
+    'plan.captured',
+    'plan.approved',
+    'plan.deviation.detected',
+    // ── Identity & compliance ──
+    'identity.offboarding.completed',
+    /** A sign-in to the workspace was refused (wrong password, deactivated member, an SSO identity the workspace does not admit, a response that failed verification). The `login_events` row. */
+    'auth.login.failed',
+    /** The identity provider provisioned, changed or deprovisioned a user through SCIM. Carries `action` and the SCIM user id. */
+    'scim.user.changed',
+    /** The identity provider created, changed (members, name, mapped role) or deleted a group through SCIM. */
+    'scim.group.changed',
+    /** An OWNER or ADMIN replaced the signing secret of a notification webhook, a SIEM webhook destination or the GitHub pull-request webhook. Carries `target` and `targetId`, never the secret. */
+    'webhook.secret.rotated',
+    /** A member downloaded compliance evidence: a SOC 2 archive, a framework coverage report file or the human-oversight export. The `evidence_exports` row. */
+    'evidence.exported',
+    /** An API key, gateway token or SCIM token was created, rotated or revoked, or a provider credential was provisioned, replaced or removed. The `credential_changes` row: `credential_type`, `credential_id`, `action` and who; never the value. */
+    'credential.changed',
+    // ── Workspace context ──
+    'workspace.context.updated',
+    // ── Self-hosted gateway ──
+    /**
+     * A registered, non-revoked self-hosted gateway has gone past
+     * GATEWAY_HEARTBEAT_TTL without a heartbeat -- fired once per member
+     * workspace of the gateway's org (gateways are org-scoped; notification
+     * rules are workspace-scoped), not once per gateway.
+     */
+    'gateway.stale.detected',
+    /**
+     * A managed cell (`deployment_target='managed_cell'`) has sat `pending`
+     * (registered, never heartbeated) past `CELL_STUCK_PENDING_THRESHOLD_MS`
+     * (15 min) -- the provisioner is failing to converge it.
+     * Fired by `detectStuckPendingCells` (gatewayHealthService.ts), same
+     * org→workspace fan-out and stable-reason dedup as `gateway.stale.detected`.
+     * Already wired into `notificationRouterService.ts`'s dispatch and
+     * severity map before this union entry existed -- this only adds the type
+     * contract those call sites were relying on via an `as` cast.
+     */
+    'gateway.cell.stuck_pending',
+    /**
+     * The control plane's CP→region Valkey sync heartbeat
+     * (`intutic:cp:last-sync`) is missing or stale in a remote region --
+     * cells there keep serving, but on progressively stale control metadata.
+     * Fired by `detectStaleRegionSync` (gatewayHealthService.ts) per member
+     * workspace of every org with a live cell in the affected region. Same
+     * pre-existing-dispatch note as `gateway.cell.stuck_pending` above.
+     */
+    'region.sync.stale',
+    // ── Managed gateway cell deprovisioning ──
+    /**
+     * A managed cell was marked for removal because its org's plan tier no
+     * longer covers it (`maxCellsPerOrg` in planSkuMap.ts) -- either a
+     * voluntary downgrade or an involuntary loss of paid status (cancellation,
+     * dunning). Fired by `scheduleCellReconciliation`
+     * (cellDeprovisionService.ts) at most once per scheduled removal
+     * (`deprovision_notified_at` is the idempotence gate). Carries
+     * `deprovision_at` -- the grace-period deadline -- and `reason`.
+     */
+    'org.cells.deprovision_scheduled',
+    /**
+     * A previously-scheduled cell removal was cancelled because the org's
+     * cell count is no longer over its plan-tier capacity -- typically a
+     * re-upgrade landing before the grace period expired. Fired by the same
+     * reconciler as `org.cells.deprovision_scheduled` above, the bidirectional
+     * half of the same bidirectional-reconcile-marks design. MEDIUM, not
+     * HIGH: this is good news for the org, not an incident.
+     */
+    'org.cells.deprovision_canceled',
+    /**
+     * A managed cell's deprovision grace period actually expired and the cell
+     * was revoked -- fired by `sweepCellCapacity`'s deadline pass
+     * (cellDeprovisionService.ts), the same revoke shape as a manual
+     * `DELETE /api/v1/gateways/:id`. HIGH: an org's traffic capacity for that
+     * region just changed, same tier as `gateway.stale.detected`.
+     */
+    'org.cells.deprovisioned',
+    // ── Enforcement device visibility ──
+    /**
+     * A device's reported enforcement posture (firewall/CA-trust/system-hooks)
+     * hasn't been refreshed past DEVICE_STALE_THRESHOLD_MS (72h) -- fired by
+     * deviceHealthCron.ts. Most staleness is a closed laptop, not a
+     * compromise -- MEDIUM, unlike gateway.stale.detected's HIGH.
+     */
+    'device.enforcement.stale',
+    /**
+     * A device's firewall went from active:true to active:false on a live
+     * report -- an active bypass just occurred, not merely unreported.
+     */
+    'device.enforcement.disabled',
+    // ── Gate liveness ──
+    /**
+     * A harness installed in the workspace has sent no hook event of any kind,
+     * allows included, for the whole liveness window: its gate may not be
+     * running. Fired once when the gate goes silent, not on every hourly sweep.
+     * Carries `harnessType` and `incidentId`.
+     */
+    'governance.gate.silent',
+    /**
+     * A harness with an open `governance.gate.silent` alert is reporting again.
+     * Same `incidentId` as the alert it closes; PagerDuty resolves that incident.
+     */
+    'governance.gate.recovered',
+    // ── Trace integrity ──
+    /**
+     * The hourly audit-log integrity check found a failure of one kind
+     * (`kind`: `chain_break`, `mirror_copy_mismatch`, `signature_invalid`,
+     * `root_mismatch` or `guard_tampered`). Fired once per kind while it keeps
+     * failing; a recurrence after it clears fires again.
+     */
+    'governance.integrity.failed',
+    // ── AI inventory of developer machines ──
+    /**
+     * A machine's AI inventory listed an ungoverned harness or MCP server for
+     * the first time: a harness with no gate installed or none possible, or an
+     * MCP server the MCP proxy does not front. Once per machine and item.
+     */
+    'inventory.ungoverned.detected',
+    // ── Provider outage tracking (Phase 8b) ──
+    /**
+     * A NEW provider_incidents window opened for a provider (Anthropic,
+     * OpenAI, ...) -- fired once per incident open, not on every coalesced
+     * failure that extends an already-open incident. Fired scoped to the
+     * workspace whose trace triggered the open, since provider_incidents
+     * itself is not workspace-scoped (see migration 157) and no complete
+     * "every workspace routing through this provider" fan-out exists the way
+     * gateway.stale.detected's org-membership join provides for gateways.
+     */
+    'provider.outage.detected',
+    // ── Billing (customer.subscription.updated handling) ──
+    /**
+     * A Stripe subscription reported `status: 'past_due'` or `'unpaid'` via
+     * `customer.subscription.updated` -- visibility only, not a tier change
+     * (repeated payment failure is the dunning flow's job, via
+     * `invoice.payment_failed`'s own 3rd-attempt downgrade). MEDIUM: worth a
+     * support/ops look, not yet the incident a full cancellation is.
+     */
+    'billing.subscription.past_due',
+    // ── Skill-bundled-script malware detection (Phase S4, opt-in VirusTotal hash lookup) ──
+    /**
+     * An opt-in `GET /api/v3/files/{sha256}` VirusTotal lookup on a
+     * skill-bundled SCRIPT (never `SKILL.md` prose, never uploaded content —
+     * see `virusTotalService.ts`'s doc comment) returned at least one AV
+     * engine detection. HIGH: a confirmed-malicious file already sitting in a
+     * developer's skill directory is a live incident, the same tier as
+     * `provider.outage.detected` and `device.enforcement.disabled` above, not
+     * a usage-pattern signal to review later.
+     */
+    'skill.malware.detected',
+    // ── Semantic skill analysis (Phase S5) ──
+    /**
+     * The opt-in LLM judge (`semanticSkillAnalysisEnabled`) called a skill's
+     * `SKILL.md` prose `'suspicious'` or `'malicious'` — content that
+     * `scanSkillContent`'s deterministic patterns may have missed entirely,
+     * since the whole point of this judge is catching a rephrasing that
+     * avoids every pattern's literal wording. Fired by
+     * `analyzeSkillSemantics` (`services/semanticSkillAnalysisService.ts`)
+     * only for a judge call that actually ran and returned one of those two
+     * verdicts — never for `'clean'`, and never for `'unjudged'` (a failed or
+     * capped-out call is an absence of signal, not a finding). Severity is
+     * dynamic: HIGH for `'malicious'`, MEDIUM for `'suspicious'` — see
+     * `mapSeverity` in `notificationRouterService.ts`.
+     */
+    'skill.semantic.flagged',
+];
+/**
+ * The severity `incident.created` is sent at, from the incident's own
+ * (`governance_incidents.severity`). Until 2.4.0 every incident was sent at
+ * CRITICAL whatever its severity, so a rule filtered on CRITICAL received a
+ * MEDIUM incident and a rule filtered on HIGH received none.
+ */
+exports.INCIDENT_NOTIFICATION_SEVERITY = {
+    CRITICAL: 'CRITICAL',
+    HIGH: 'HIGH',
+    MEDIUM: 'MEDIUM',
+    LOW: 'LOW',
+};
+/**
+ * {@link INCIDENT_NOTIFICATION_SEVERITY} for an incident event's `severity`.
+ * One the map does not name (absent, or from an emitter that sent something
+ * else) is sent at CRITICAL: a malformed event must not quieten an alert.
+ */
+function incidentNotificationSeverity(severity) {
+    return typeof severity === 'string' && Object.hasOwn(exports.INCIDENT_NOTIFICATION_SEVERITY, severity)
+        ? exports.INCIDENT_NOTIFICATION_SEVERITY[severity]
+        : 'CRITICAL';
+}
 //# sourceMappingURL=notifications.js.map

package/dist/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,kDAAkD;AAClD,+CAA+C"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,mCAAmC;AACnC,+CAA+C;;;AAqW/C,oEAIC;AAnWD;;;;GAIG;AACU,QAAA,wBAAwB,GAAG;IACtC,+CAA+C;IAC/C,kBAAkB;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,eAAe;IACf,2BAA2B;IAC3B,kBAAkB;IAClB,sIAAsI;IACtI,mBAAmB;IACnB,2FAA2F;IAC3F,mBAAmB;IACnB,2BAA2B;IAC3B,2BAA2B;IAC3B,kBAAkB;IAClB,+CAA+C;IAC/C,8BAA8B;IAC9B,wBAAwB;IACxB,yBAAyB;IACzB,uBAAuB;IACvB,kCAAkC;IAClC,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+HAA+H;IAC/H,sBAAsB;IACtB,0BAA0B;IAC1B,mFAAmF;IACnF,iBAAiB;IACjB,+FAA+F;IAC/F,iBAAiB;IACjB,4BAA4B;IAC5B,kJAAkJ;IAClJ,sBAAsB;IACtB,oHAAoH;IACpH,6BAA6B;IAC7B,qJAAqJ;IACrJ,oBAAoB;IACpB,mHAAmH;IACnH,yBAAyB;IACzB,yGAAyG;IACzG,sBAAsB;IACtB,iGAAiG;IACjG,qBAAqB;IACrB,yBAAyB;IACzB,gJAAgJ;IAChJ,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,gCAAgC;IAChC,8LAA8L;IAC9L,mBAAmB;IACnB,8HAA8H;IAC9H,mBAAmB;IACnB,2GAA2G;IAC3G,oBAAoB;IACpB,iMAAiM;IACjM,wBAAwB;IACxB,4JAA4J;IAC5J,mBAAmB;IACnB,mPAAmP;IACnP,oBAAoB;IACpB,0BAA0B;IAC1B,2BAA2B;IAC3B,4BAA4B;IAC5B;;;;;OAKG;IACH,wBAAwB;IACxB;;;;;;;;;OASG;IACH,4BAA4B;IAC5B;;;;;;;OAOG;IACH,mBAAmB;IACnB,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,iCAAiC;IACjC;;;;;;;OAOG;IACH,gCAAgC;IAChC;;;;;;OAMG;IACH,yBAAyB;IACzB,sCAAsC;IACtC;;;;;OAKG;IACH,0BAA0B;IAC1B;;;OAGG;IACH,6BAA6B;IAC7B,sBAAsB;IACtB;;;;;OAKG;IACH,wBAAwB;IACxB;;;OAGG;IACH,2BAA2B;IAC3B,wBAAwB;IACxB;;;;;OAKG;IACH,6BAA6B;IAC7B,2CAA2C;IAC3C;;;;OAIG;IACH,+BAA+B;IAC/B,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,0BAA0B;IAC1B,yDAAyD;IACzD;;;;;;OAMG;IACH,+BAA+B;IAC/B,yFAAyF;IACzF;;;;;;;;OAQG;IACH,wBAAwB;IACxB,2CAA2C;IAC3C;;;;;;;;;;;;OAYG;IACH,wBAAwB;CAChB,CAAA;AA6FV;;;;;GAKG;AACU,QAAA,8BAA8B,GAAmF;IAC5H,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAA;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,QAAiB;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,sCAA8B,EAAE,QAAQ,CAAC;QAC5F,CAAC,CAAC,sCAA8B,CAAC,QAAuD,CAAC;QACzF,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}

package/dist/phrases.d.ts

@@ -0,0 +1,87 @@
+/**
+ * Phrase matching for shell commands and SQL in linear time.
+ *
+ * Every command classifier asks the same question: does this text contain
+ * `git push`, `drop table`, `curl --data`, whatever separates the words? The
+ * separators that count are the ones the shell or the database reads as a
+ * word break:
+ *
+ * - whitespace, a two-character escaped `\n`, `\t` or `\r`, and a backslash
+ *   before whitespace (a line continuation, or an escaped space);
+ * - a `/* … *\/` comment;
+ * - a `-- …` comment that runs to a newline (real or escaped);
+ * - a run of options starting with `--` (`git --no-pager push`,
+ *   `kubectl --context prod apply`), which stops at `;`, `&`, `|` or a real
+ *   newline — the end of the shell command it is in.
+ *
+ * The proxy's Rust classifier expresses this as a regex (`SQL_GAP` in
+ * `actions.rs`), which is safe there: Rust's engine is linear. JavaScript's
+ * and Python's backtrack, and that regex took seconds on a few hundred
+ * kilobytes of `git -- git -- …` — text an agent can be talked into producing.
+ * So here the text is cut into words in one pass, and a phrase is matched over
+ * the words right to left with one array per phrase word: O(length × words).
+ * No regex runs on the input.
+ *
+ * The two functions are self-contained on purpose — no imports, no module
+ * state — because the hook gates emit them as source (`phraseText.toString()`)
+ * and run them outside this package. `packages/gate-js/src/phrases.ts` is a
+ * byte-identical copy and `intutic_clawde/gate/phrases.py` a transliteration;
+ * all of them run `action_vectors.json` beside the proxy's `actions.rs`.
+ *
+ * @module
+ */
+/** A text cut into words, ready for any number of {@link hasPhrase} calls. */
+export interface PhraseText {
+    /** The whole text, lower-cased: one-word phrases are plain substrings of it. */
+    raw: string;
+    /** The words, lower-cased, separated by single spaces: a cheap filter. */
+    joined: string;
+    toks: string[];
+    /** A separator (not a glued `--`) stands before the word. */
+    sep: boolean[];
+    /** A real newline stands before the word: the end of an option run. */
+    nl: boolean[];
+    /** A real or escaped newline stands before the word: the end of a `--` comment. */
+    eol: boolean[];
+    /** The word starts with `--`. */
+    dash: boolean[];
+    /** The word contains `;`, `&` or `|`: an option run cannot cross it. */
+    bar: boolean[];
+    /** A separator follows the last word. */
+    tail: boolean;
+    /** Per-word match arrays already computed, by mode and word. */
+    memo: Record<string, Uint8Array>;
+    /**
+     * Per word x: the first word at or after x containing `;&|`, with a real
+     * newline before it, and with any newline before it (the word count when
+     * none). Built by the first {@link hasPhrase} call that needs them.
+     */
+    next: {
+        bar: Int32Array;
+        nl: Int32Array;
+        eol: Int32Array;
+    } | null;
+}
+/**
+ * Cuts `input` into words in one pass. A `--` inside a word starts a new one
+ * (`drop--why` is `drop` and `--why`), glued rather than separated, so it can
+ * open a comment or an option run but cannot stand for a plain gap.
+ */
+export declare function phraseText(input: unknown): PhraseText;
+/**
+ * Whether `t` contains `needle`, a phrase whose words are separated by single
+ * spaces. A one-word needle is a plain substring. In a longer one the first
+ * word may end a word of the text (`digit push` contains `git push`, as a
+ * substring would), the last may begin one, and the words between must be
+ * whole; a trailing space (`'update '`) asks for a separator after the last
+ * word. `bounded` additionally requires a non-word character (or the edge of
+ * the word) before the first word and after the last, where `.` also counts
+ * as part of a word (`table.log` is not `table`).
+ */
+export declare function hasPhrase(t: PhraseText, needle: string, bounded?: boolean): boolean;
+/**
+ * Both functions as JavaScript source, for a hook gate to emit: the gates run
+ * this exact code, not a retyped copy.
+ */
+export declare const PHRASES_JS_SOURCE: string;
+//# sourceMappingURL=phrases.d.ts.map

package/dist/phrases.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"phrases.d.ts","sourceRoot":"","sources":["../src/phrases.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AAEH,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,gFAAgF;IAChF,GAAG,EAAE,MAAM,CAAA;IACX,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,6DAA6D;IAC7D,GAAG,EAAE,OAAO,EAAE,CAAA;IACd,uEAAuE;IACvE,EAAE,EAAE,OAAO,EAAE,CAAA;IACb,mFAAmF;IACnF,GAAG,EAAE,OAAO,EAAE,CAAA;IACd,iCAAiC;IACjC,IAAI,EAAE,OAAO,EAAE,CAAA;IACf,wEAAwE;IACxE,GAAG,EAAE,OAAO,EAAE,CAAA;IACd,yCAAyC;IACzC,IAAI,EAAE,OAAO,CAAA;IACb,gEAAgE;IAChE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;IAChC;;;;OAIG;IACH,IAAI,EAAE;QAAE,GAAG,EAAE,UAAU,CAAC;QAAC,EAAE,EAAE,UAAU,CAAC;QAAC,GAAG,EAAE,UAAU,CAAA;KAAE,GAAG,IAAI,CAAA;CAClE;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,CA8DrD;AAED;;;;;;;;;GASG;AACH,wBAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,OAAO,GAAG,OAAO,CA6FnF;AAED;;;GAGG;AACH,eAAO,MAAM,iBAAiB,QAAsD,CAAA"}