@intutic/shared-types 2.3.0 → 2.5.0

package/dist/mcpBudgets.d.ts

@@ -70,80 +70,80 @@ export declare const McpBudgetSettingsSchema: z.ZodEffects<z.ZodObject<{
         period: z.ZodEnum<["hour", "day"]>;
         limit: z.ZodNumber;
     }, "strict", z.ZodTypeAny, {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }, {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }>, {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }, {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }>, "many">;
     warnAtPct: z.ZodOptional<z.ZodNumber>;
 }, "strict", z.ZodTypeAny, {
     budgets: {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }[];
     warnAtPct?: number | undefined;
 }, {
     budgets: {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }[];
     warnAtPct?: number | undefined;
 }>, {
     budgets: {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }[];
     warnAtPct?: number | undefined;
 }, {
     budgets: {
-        limit: number;
-        scope: "server" | "tool" | "member" | "member_server";
+        period: "day" | "hour";
         id: string;
-        period: "hour" | "day";
-        server?: string | undefined;
+        limit: number;
+        scope: "member" | "tool" | "server" | "member_server";
         tool?: string | undefined;
+        server?: string | undefined;
         memberId?: string | undefined;
     }[];
     warnAtPct?: number | undefined;

package/dist/notifications.d.ts

@@ -4,7 +4,7 @@ export type NotificationChannel = 'slack' | 'email' | 'webhook' | 'pagerduty';
  * naming anything else, and the CLI and the Terraform provider check
  * against this list before they send one.
  */
-export declare const NOTIFICATION_EVENT_TYPES: readonly ["anomaly.detected", "anomaly.finding", "incident.created", "incident.escalated", "sop.status_changed", "session.ended", "adapter.write_back.failed", "decision.pending", "decision.approved", "decision.rejected", "ssl.enforcement.violation", "context_gap.auto_injected", "trajectory.alert", "calibration.threshold_breach", "anomaly.drift.detected", "anomaly.capability_miss", "anomaly.trust.updated", "sop.stale.detected", "sop.cascade.alert", "sop.cascade.invalidated", "sop.integrity.drift", "sop.lifecycle.transitioned", "sop.upstream.changed", "guardrail.ready", "guardrail.stale", "mcp.server.candidate", "mcp.server.tool_change_risk", "mcp.server.decided", "mcp.server.tool_toggled", "mcp.budget.threshold", "mcp.budget.exceeded", "judge.review.queued", "finops.budget.exceeded", "finops.budget.threshold", "finops.tokens.classified", "trial.started", "trial.expired_downgraded", "trial.day7_report_sent", "trial.day13_report_sent", "plan.captured", "plan.approved", "plan.deviation.detected", "identity.offboarding.completed", "auth.login.failed", "scim.user.changed", "scim.group.changed", "webhook.secret.rotated", "evidence.exported", "workspace.context.updated", "gateway.stale.detected", "gateway.cell.stuck_pending", "region.sync.stale", "org.cells.deprovision_scheduled", "org.cells.deprovision_canceled", "org.cells.deprovisioned", "device.enforcement.stale", "device.enforcement.disabled", "governance.gate.silent", "governance.gate.recovered", "governance.integrity.failed", "inventory.ungoverned.detected", "provider.outage.detected", "billing.subscription.past_due", "skill.malware.detected", "skill.semantic.flagged"];
+export declare const NOTIFICATION_EVENT_TYPES: readonly ["anomaly.detected", "anomaly.finding", "incident.created", "incident.escalated", "sop.status_changed", "session.ended", "decision.pending", "decision.approved", "decision.rejected", "trajectory.alert", "calibration.threshold_breach", "anomaly.drift.detected", "anomaly.capability_miss", "anomaly.trust.updated", "sop.stale.detected", "sop.cascade.alert", "sop.cascade.invalidated", "sop.integrity.drift", "sop.lifecycle.transitioned", "sop.upstream.changed", "guardrail.ready", "guardrail.stale", "mcp.server.candidate", "mcp.server.tool_change_risk", "mcp.server.decided", "mcp.server.tool_toggled", "mcp.budget.threshold", "mcp.budget.exceeded", "judge.review.queued", "finops.budget.exceeded", "finops.budget.threshold", "finops.tokens.classified", "trial.started", "trial.expired_downgraded", "trial.day7_report_sent", "trial.day13_report_sent", "plan.captured", "plan.approved", "plan.deviation.detected", "identity.offboarding.completed", "auth.login.failed", "scim.user.changed", "scim.group.changed", "webhook.secret.rotated", "evidence.exported", "credential.changed", "workspace.context.updated", "gateway.stale.detected", "gateway.cell.stuck_pending", "region.sync.stale", "org.cells.deprovision_scheduled", "org.cells.deprovision_canceled", "org.cells.deprovisioned", "device.enforcement.stale", "device.enforcement.disabled", "governance.gate.silent", "governance.gate.recovered", "governance.integrity.failed", "inventory.ungoverned.detected", "provider.outage.detected", "billing.subscription.past_due", "skill.malware.detected", "skill.semantic.flagged"];
 export type NotificationEventType = (typeof NOTIFICATION_EVENT_TYPES)[number];
 export type NotificationStatus = 'sent' | 'failed' | 'deduplicated' | 'filtered';
 export interface NotificationRule {
@@ -75,15 +75,30 @@ export interface NotificationLogEntry {
     latencyMs: number | null;
     createdAt: string;
 }
+/** The severity a notification is sent at, which a rule's severity filter matches on. */
+export type NotificationSeverity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
 export interface GovernanceEvent {
     type: NotificationEventType;
     workspaceId: string;
     sessionId?: string;
-    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+    severity: NotificationSeverity;
     summary: string;
     description: string;
     metadata: Record<string, unknown>;
 }
+/**
+ * The severity `incident.created` is sent at, from the incident's own
+ * (`governance_incidents.severity`). Until 2.4.0 every incident was sent at
+ * CRITICAL whatever its severity, so a rule filtered on CRITICAL received a
+ * MEDIUM incident and a rule filtered on HIGH received none.
+ */
+export declare const INCIDENT_NOTIFICATION_SEVERITY: Readonly<Record<'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW', NotificationSeverity>>;
+/**
+ * {@link INCIDENT_NOTIFICATION_SEVERITY} for an incident event's `severity`.
+ * One the map does not name (absent, or from an emitter that sent something
+ * else) is sent at CRITICAL: a malformed event must not quieten an alert.
+ */
+export declare function incidentNotificationSeverity(severity: unknown): NotificationSeverity;
 export interface DispatchResult {
     ruleId: string;
     channel: NotificationChannel;

package/dist/notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,+mDAyO3B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAA;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;yEAGqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;IACzD,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,GAAG,YAAY,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B"}
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8iDAgP3B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAA;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;yEAGqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAElF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE,oBAAoB,CAAC,CAKzH,CAAA;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,GAAG,oBAAoB,CAIpF;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,GAAG,YAAY,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B"}

package/dist/notifications.js

@@ -3,7 +3,8 @@
 // Notification Hub + Slack Adapter
 // ============================================
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.NOTIFICATION_EVENT_TYPES = void 0;
+exports.INCIDENT_NOTIFICATION_SEVERITY = exports.NOTIFICATION_EVENT_TYPES = void 0;
+exports.incidentNotificationSeverity = incidentNotificationSeverity;
 /**
  * Every event a notification rule can subscribe to. The API refuses a rule
  * naming anything else, and the CLI and the Terraform provider check
@@ -29,17 +30,22 @@ exports.NOTIFICATION_EVENT_TYPES = [
     'incident.escalated',
     'sop.status_changed',
     'session.ended',
-    'adapter.write_back.failed',
     'decision.pending',
     /** An OWNER, ADMIN or EM approved a held decision, in Slack or through the API and CLI. Carries `entryId`, `reviewerId` and `via`. */
     'decision.approved',
     /** An OWNER, ADMIN or EM rejected a held decision, in Slack or through the API and CLI. */
     'decision.rejected',
-    'ssl.enforcement.violation',
-    'context_gap.auto_injected',
     'trajectory.alert',
     // ── Calibration & drift (Q10 orphan audit) ──
     'calibration.threshold_breach',
+    /**
+     * An enforced SOP's rolling compliance moved 0.15 or more from its stored
+     * baseline (`behavioralDriftService.ts`, the hourly SOP health sweep). Once per
+     * drift: the baseline is recaptured when it fires. Carries `sopId`,
+     * `driftScore`, `driftDirection` (`DEGRADING` or `IMPROVING`),
+     * `baselineCompliance` and `currentCompliance`. HIGH when degrading, INFO when
+     * improving.
+     */
     'anomaly.drift.detected',
     'anomaly.capability_miss',
     'anomaly.trust.updated',
@@ -97,6 +103,8 @@ exports.NOTIFICATION_EVENT_TYPES = [
     'webhook.secret.rotated',
     /** A member downloaded compliance evidence: a SOC 2 archive, a framework coverage report file or the human-oversight export. The `evidence_exports` row. */
     'evidence.exported',
+    /** An API key, gateway token or SCIM token was created, rotated or revoked, or a provider credential was provisioned, replaced or removed. The `credential_changes` row: `credential_type`, `credential_id`, `action` and who; never the value. */
+    'credential.changed',
     // ── Workspace context ──
     'workspace.context.updated',
     // ── Self-hosted gateway ──
@@ -185,7 +193,7 @@ exports.NOTIFICATION_EVENT_TYPES = [
     /**
      * The hourly audit-log integrity check found a failure of one kind
      * (`kind`: `chain_break`, `mirror_copy_mismatch`, `signature_invalid`,
-     * `root_mismatch` or `guard_tampered`). Fired once per kind while it keeps
+     * `root_mismatch`, `guard_tampered` or `foreign_key_unenforced`). Fired once per kind while it keeps
      * failing; a recurrence after it clears fires again.
      */
     'governance.integrity.failed',
@@ -243,4 +251,26 @@ exports.NOTIFICATION_EVENT_TYPES = [
      */
     'skill.semantic.flagged',
 ];
+/**
+ * The severity `incident.created` is sent at, from the incident's own
+ * (`governance_incidents.severity`). Until 2.4.0 every incident was sent at
+ * CRITICAL whatever its severity, so a rule filtered on CRITICAL received a
+ * MEDIUM incident and a rule filtered on HIGH received none.
+ */
+exports.INCIDENT_NOTIFICATION_SEVERITY = {
+    CRITICAL: 'CRITICAL',
+    HIGH: 'HIGH',
+    MEDIUM: 'MEDIUM',
+    LOW: 'LOW',
+};
+/**
+ * {@link INCIDENT_NOTIFICATION_SEVERITY} for an incident event's `severity`.
+ * One the map does not name (absent, or from an emitter that sent something
+ * else) is sent at CRITICAL: a malformed event must not quieten an alert.
+ */
+function incidentNotificationSeverity(severity) {
+    return typeof severity === 'string' && Object.hasOwn(exports.INCIDENT_NOTIFICATION_SEVERITY, severity)
+        ? exports.INCIDENT_NOTIFICATION_SEVERITY[severity]
+        : 'CRITICAL';
+}
 //# sourceMappingURL=notifications.js.map

package/dist/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,mCAAmC;AACnC,+CAA+C;;;AAM/C;;;;GAIG;AACU,QAAA,wBAAwB,GAAG;IACtC,+CAA+C;IAC/C,kBAAkB;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,eAAe;IACf,2BAA2B;IAC3B,kBAAkB;IAClB,sIAAsI;IACtI,mBAAmB;IACnB,2FAA2F;IAC3F,mBAAmB;IACnB,2BAA2B;IAC3B,2BAA2B;IAC3B,kBAAkB;IAClB,+CAA+C;IAC/C,8BAA8B;IAC9B,wBAAwB;IACxB,yBAAyB;IACzB,uBAAuB;IACvB,kCAAkC;IAClC,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+HAA+H;IAC/H,sBAAsB;IACtB,0BAA0B;IAC1B,mFAAmF;IACnF,iBAAiB;IACjB,+FAA+F;IAC/F,iBAAiB;IACjB,4BAA4B;IAC5B,kJAAkJ;IAClJ,sBAAsB;IACtB,oHAAoH;IACpH,6BAA6B;IAC7B,qJAAqJ;IACrJ,oBAAoB;IACpB,mHAAmH;IACnH,yBAAyB;IACzB,yGAAyG;IACzG,sBAAsB;IACtB,iGAAiG;IACjG,qBAAqB;IACrB,yBAAyB;IACzB,gJAAgJ;IAChJ,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,gCAAgC;IAChC,8LAA8L;IAC9L,mBAAmB;IACnB,8HAA8H;IAC9H,mBAAmB;IACnB,2GAA2G;IAC3G,oBAAoB;IACpB,iMAAiM;IACjM,wBAAwB;IACxB,4JAA4J;IAC5J,mBAAmB;IACnB,0BAA0B;IAC1B,2BAA2B;IAC3B,4BAA4B;IAC5B;;;;;OAKG;IACH,wBAAwB;IACxB;;;;;;;;;OASG;IACH,4BAA4B;IAC5B;;;;;;;OAOG;IACH,mBAAmB;IACnB,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,iCAAiC;IACjC;;;;;;;OAOG;IACH,gCAAgC;IAChC;;;;;;OAMG;IACH,yBAAyB;IACzB,sCAAsC;IACtC;;;;;OAKG;IACH,0BAA0B;IAC1B;;;OAGG;IACH,6BAA6B;IAC7B,sBAAsB;IACtB;;;;;OAKG;IACH,wBAAwB;IACxB;;;OAGG;IACH,2BAA2B;IAC3B,wBAAwB;IACxB;;;;;OAKG;IACH,6BAA6B;IAC7B,2CAA2C;IAC3C;;;;OAIG;IACH,+BAA+B;IAC/B,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,0BAA0B;IAC1B,yDAAyD;IACzD;;;;;;OAMG;IACH,+BAA+B;IAC/B,yFAAyF;IACzF;;;;;;;;OAQG;IACH,wBAAwB;IACxB,2CAA2C;IAC3C;;;;;;;;;;;;OAYG;IACH,wBAAwB;CAChB,CAAA"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,mCAAmC;AACnC,+CAA+C;;;AA0W/C,oEAIC;AAxWD;;;;GAIG;AACU,QAAA,wBAAwB,GAAG;IACtC,+CAA+C;IAC/C,kBAAkB;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,eAAe;IACf,kBAAkB;IAClB,sIAAsI;IACtI,mBAAmB;IACnB,2FAA2F;IAC3F,mBAAmB;IACnB,kBAAkB;IAClB,+CAA+C;IAC/C,8BAA8B;IAC9B;;;;;;;OAOG;IACH,wBAAwB;IACxB,yBAAyB;IACzB,uBAAuB;IACvB,kCAAkC;IAClC,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+HAA+H;IAC/H,sBAAsB;IACtB,0BAA0B;IAC1B,mFAAmF;IACnF,iBAAiB;IACjB,+FAA+F;IAC/F,iBAAiB;IACjB,4BAA4B;IAC5B,kJAAkJ;IAClJ,sBAAsB;IACtB,oHAAoH;IACpH,6BAA6B;IAC7B,qJAAqJ;IACrJ,oBAAoB;IACpB,mHAAmH;IACnH,yBAAyB;IACzB,yGAAyG;IACzG,sBAAsB;IACtB,iGAAiG;IACjG,qBAAqB;IACrB,yBAAyB;IACzB,gJAAgJ;IAChJ,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,gCAAgC;IAChC,8LAA8L;IAC9L,mBAAmB;IACnB,8HAA8H;IAC9H,mBAAmB;IACnB,2GAA2G;IAC3G,oBAAoB;IACpB,iMAAiM;IACjM,wBAAwB;IACxB,4JAA4J;IAC5J,mBAAmB;IACnB,mPAAmP;IACnP,oBAAoB;IACpB,0BAA0B;IAC1B,2BAA2B;IAC3B,4BAA4B;IAC5B;;;;;OAKG;IACH,wBAAwB;IACxB;;;;;;;;;OASG;IACH,4BAA4B;IAC5B;;;;;;;OAOG;IACH,mBAAmB;IACnB,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,iCAAiC;IACjC;;;;;;;OAOG;IACH,gCAAgC;IAChC;;;;;;OAMG;IACH,yBAAyB;IACzB,sCAAsC;IACtC;;;;;OAKG;IACH,0BAA0B;IAC1B;;;OAGG;IACH,6BAA6B;IAC7B,sBAAsB;IACtB;;;;;OAKG;IACH,wBAAwB;IACxB;;;OAGG;IACH,2BAA2B;IAC3B,wBAAwB;IACxB;;;;;OAKG;IACH,6BAA6B;IAC7B,2CAA2C;IAC3C;;;;OAIG;IACH,+BAA+B;IAC/B,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,0BAA0B;IAC1B,yDAAyD;IACzD;;;;;;OAMG;IACH,+BAA+B;IAC/B,yFAAyF;IACzF;;;;;;;;OAQG;IACH,wBAAwB;IACxB,2CAA2C;IAC3C;;;;;;;;;;;;OAYG;IACH,wBAAwB;CAChB,CAAA;AA6FV;;;;;GAKG;AACU,QAAA,8BAA8B,GAAmF;IAC5H,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAA;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,QAAiB;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,sCAA8B,EAAE,QAAQ,CAAC;QAC5F,CAAC,CAAC,sCAA8B,CAAC,QAAuD,CAAC;QACzF,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}

package/dist/observability.d.ts

@@ -1,34 +1,3 @@
-import { z } from 'zod';
-export declare const PromptEstimateInputSchema: z.ZodObject<{
-    prompt: z.ZodString;
-    modelName: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    prompt: string;
-    modelName: string;
-}, {
-    prompt: string;
-    modelName: string;
-}>;
-export type PromptEstimateInput = z.infer<typeof PromptEstimateInputSchema>;
-export interface PromptEstimateResult {
-    estimatedInputTokens: number;
-    estimatedOutputTokens: number;
-    estimatedCostUsd: number;
-    recommendations: string[];
-}
-export interface CostHistoryEntry {
-    date: string;
-    estimatedCostUsd: number;
-    actualCostUsd: number;
-}
-export interface CostHistoryResult {
-    history: CostHistoryEntry[];
-}
-export interface DriftReportResult {
-    driftPct: number;
-    totalEstimates: number;
-    totalActuals: number;
-}
 export interface TraceDagNode {
     sessionId: string;
     harnessType: string;

package/dist/observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAI3E,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,qBAAqB,EAAE,MAAM,CAAA;IAC7B,gBAAgB,EAAE,MAAM,CAAA;IACxB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB"}
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB"}

package/dist/observability.js

@@ -1,10 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PromptEstimateInputSchema = void 0;
-const zod_1 = require("zod");
-// ─── Zod Schemas ─────────────────────────────────────────────────────
-exports.PromptEstimateInputSchema = zod_1.z.object({
-    prompt: zod_1.z.string().min(1),
-    modelName: zod_1.z.string().min(1),
-});
 //# sourceMappingURL=observability.js.map

package/dist/observability.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.js","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,wEAAwE;AAE3D,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAA"}
+{"version":3,"file":"observability.js","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":""}

package/dist/opaqueRefusal.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The OPAQUE intervention mode: an agent is refused without being told which
+ * rule refused it.
+ *
+ * A refusal that names its rule, quotes the rule's text, or says which pattern
+ * matched teaches an agent the policy, and an agent that knows the policy can
+ * route around it. In an OPAQUE workspace every gate that refuses on workspace
+ * policy shows the agent {@link OPAQUE_REFUSAL_MESSAGE} instead, through the
+ * same refusal contract: the same exit code, HTTP status and refusal code, so
+ * harnesses and clients behave exactly as they would in a TRANSPARENT one.
+ * Only the text the agent reads changes. Audit records, trace records,
+ * `enforcement_log`, detector findings and the dashboard keep the full reason.
+ *
+ * Refusals that say nothing about the policy are not changed: a call too large
+ * to evaluate, a gate past its deadline, an unreadable payload, a crashed gate,
+ * a snapshot that failed its integrity check, and a chaos run's injected fault.
+ *
+ * `@intutic/gate` carries a byte-identical copy of this module
+ * (`packages/gate-js/src/opaqueRefusal.ts`); the Rust proxy (`refusal.rs`)
+ * and the Python SDK (`intutic_clawde/gate/opaque.py`) mirror the sentence.
+ * `refusal-codes.json` carries it as `opaqueMessage`, and
+ * `opaqueRefusalParity.test.ts` holds every copy to it. It carries no quote,
+ * dollar sign or backtick, so the hook gates can embed it in generated shell
+ * inside single quotes.
+ */
+export declare const OPAQUE_REFUSAL_MESSAGE = "Blocked by workspace policy. Ask a workspace admin if you need this action.";
+/**
+ * The policy snapshot's record of an OPAQUE workspace: a data line inside the
+ * digest, `@intervention_mode<TAB>OPAQUE`, written only when the mode is
+ * OPAQUE, so the snapshot of a TRANSPARENT or SILENT_LOG workspace is
+ * unchanged. Two columns, so every rule parser skips it.
+ */
+export declare const INTERVENTION_MODE_RECORD_TAG = "@intervention_mode";
+/** Whether a workspace's resolved intervention mode is OPAQUE. Any case. */
+export declare function isOpaqueInterventionMode(mode: unknown): boolean;
+/** The `.rules` line of an OPAQUE workspace. */
+export declare function encodeInterventionModeRecord(): string;
+/** Whether a `.rules` line is the record of an OPAQUE workspace. */
+export declare function isOpaqueInterventionModeRecord(line: string): boolean;
+//# sourceMappingURL=opaqueRefusal.d.ts.map

package/dist/opaqueRefusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaqueRefusal.d.ts","sourceRoot":"","sources":["../src/opaqueRefusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,sBAAsB,gFAC4C,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAA;AAEhE,4EAA4E;AAC5E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAE/D;AAED,gDAAgD;AAChD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpE"}

package/dist/opaqueRefusal.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERVENTION_MODE_RECORD_TAG = exports.OPAQUE_REFUSAL_MESSAGE = void 0;
+exports.isOpaqueInterventionMode = isOpaqueInterventionMode;
+exports.encodeInterventionModeRecord = encodeInterventionModeRecord;
+exports.isOpaqueInterventionModeRecord = isOpaqueInterventionModeRecord;
+/**
+ * The OPAQUE intervention mode: an agent is refused without being told which
+ * rule refused it.
+ *
+ * A refusal that names its rule, quotes the rule's text, or says which pattern
+ * matched teaches an agent the policy, and an agent that knows the policy can
+ * route around it. In an OPAQUE workspace every gate that refuses on workspace
+ * policy shows the agent {@link OPAQUE_REFUSAL_MESSAGE} instead, through the
+ * same refusal contract: the same exit code, HTTP status and refusal code, so
+ * harnesses and clients behave exactly as they would in a TRANSPARENT one.
+ * Only the text the agent reads changes. Audit records, trace records,
+ * `enforcement_log`, detector findings and the dashboard keep the full reason.
+ *
+ * Refusals that say nothing about the policy are not changed: a call too large
+ * to evaluate, a gate past its deadline, an unreadable payload, a crashed gate,
+ * a snapshot that failed its integrity check, and a chaos run's injected fault.
+ *
+ * `@intutic/gate` carries a byte-identical copy of this module
+ * (`packages/gate-js/src/opaqueRefusal.ts`); the Rust proxy (`refusal.rs`)
+ * and the Python SDK (`intutic_clawde/gate/opaque.py`) mirror the sentence.
+ * `refusal-codes.json` carries it as `opaqueMessage`, and
+ * `opaqueRefusalParity.test.ts` holds every copy to it. It carries no quote,
+ * dollar sign or backtick, so the hook gates can embed it in generated shell
+ * inside single quotes.
+ */
+exports.OPAQUE_REFUSAL_MESSAGE = 'Blocked by workspace policy. Ask a workspace admin if you need this action.';
+/**
+ * The policy snapshot's record of an OPAQUE workspace: a data line inside the
+ * digest, `@intervention_mode<TAB>OPAQUE`, written only when the mode is
+ * OPAQUE, so the snapshot of a TRANSPARENT or SILENT_LOG workspace is
+ * unchanged. Two columns, so every rule parser skips it.
+ */
+exports.INTERVENTION_MODE_RECORD_TAG = '@intervention_mode';
+/** Whether a workspace's resolved intervention mode is OPAQUE. Any case. */
+function isOpaqueInterventionMode(mode) {
+    return typeof mode === 'string' && mode.trim().toUpperCase() === 'OPAQUE';
+}
+/** The `.rules` line of an OPAQUE workspace. */
+function encodeInterventionModeRecord() {
+    return `${exports.INTERVENTION_MODE_RECORD_TAG}\tOPAQUE`;
+}
+/** Whether a `.rules` line is the record of an OPAQUE workspace. */
+function isOpaqueInterventionModeRecord(line) {
+    const [tag, mode, ...rest] = line.split('\t');
+    return tag === exports.INTERVENTION_MODE_RECORD_TAG && rest.length === 0 && isOpaqueInterventionMode(mode);
+}
+//# sourceMappingURL=opaqueRefusal.js.map

package/dist/opaqueRefusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaqueRefusal.js","sourceRoot":"","sources":["../src/opaqueRefusal.ts"],"names":[],"mappings":";;;AAqCA,4DAEC;AAGD,oEAEC;AAGD,wEAGC;AAlDD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACU,QAAA,sBAAsB,GACjC,6EAA6E,CAAA;AAE/E;;;;;GAKG;AACU,QAAA,4BAA4B,GAAG,oBAAoB,CAAA;AAEhE,4EAA4E;AAC5E,SAAgB,wBAAwB,CAAC,IAAa;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAA;AAC3E,CAAC;AAED,gDAAgD;AAChD,SAAgB,4BAA4B;IAC1C,OAAO,GAAG,oCAA4B,UAAU,CAAA;AAClD,CAAC;AAED,oEAAoE;AACpE,SAAgB,8BAA8B,CAAC,IAAY;IACzD,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,GAAG,KAAK,oCAA4B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAA;AACpG,CAAC"}

package/dist/policyGuardrails.d.ts

@@ -78,8 +78,8 @@ export declare const AuthoredGuardrailCreateSchema: z.ZodObject<{
     description?: string | null | undefined;
 }, {
     name: string;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }>;
 /**
  * `PUT /api/v1/policy-guardrails/guardrails/:guardrailId`: any of the three.
@@ -91,20 +91,20 @@ export declare const AuthoredGuardrailUpdateSchema: z.ZodEffects<z.ZodObject<{
     ir: z.ZodOptional<z.ZodUnknown>;
 }, "strict", z.ZodTypeAny, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }>, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }>;
 export type AuthoredGuardrailCreate = z.infer<typeof AuthoredGuardrailCreateSchema>;
 export type AuthoredGuardrailUpdate = z.infer<typeof AuthoredGuardrailUpdateSchema>;

package/dist/providerVerification.d.ts

@@ -29,8 +29,16 @@ export interface ProviderProbeRequest {
     url: string;
     method: 'GET' | 'POST';
     headers: Record<string, string>;
-    /** Present only for POST probes (currently: Anthropic's 1-token message). */
+    /** Present only for POST probes (the cloud token and STS calls). */
     body?: string;
+    /** A provider-specific reading of the answer; `classifyProbeResponse` otherwise. */
+    classify?: (status: number, headers: {
+        get(name: string): string | null;
+    }) => ProbeVerdict;
+    /** What a `valid` answer proves, when it is narrower than "the credential works". */
+    validDetail?: string;
+    /** Decided without a request (a key that cannot be used at all); nothing is sent. */
+    localVerdict?: ProbeVerdict;
 }
 /**
  * Build the cheapest authenticated request that proves a credential works,
@@ -38,18 +46,36 @@ export interface ProviderProbeRequest {
  *
  * `fields` is the provider's credential field map exactly as stored — the
  * same shape `PROVIDER_REGISTRY`'s `ProviderCredentialField.key`s describe
- * (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint,
- * deploymentName }` for Azure OpenAI.
+ * (`providers.ts`), e.g. `{ apiKey: '...' }` for Anthropic, `{ apiKey, endpoint }`
+ * for Azure OpenAI.
  *
- * Bedrock and Vertex AI return `null`: verifying them means SigV4 request
- * signing or a GCP OAuth2/JWT exchange, neither of which exists anywhere in
- * this codebase yet (the same "real per-provider engineering, not a config
- * change" boundary that also keeps routing those two providers out). A
- * caller seeing `null` should say "cannot verify automatically," not fail
- * the credential.
+ * Bedrock and Vertex AI return `null` here: their probe is signed per
+ * request, which takes WebCrypto and is asynchronous — see
+ * `buildVerificationProbeAsync`, which every executor calls. A caller seeing
+ * `null` from that should say "cannot verify automatically," not fail the
+ * credential.
  */
 export declare function buildVerificationProbe(provider: string, fields: Record<string, string>): ProviderProbeRequest | null;
 export type ProbeVerdict = 'valid' | 'invalid' | 'unknown';
+/**
+ * The model ids in a provider's list-models answer (the body a `valid`
+ * verification probe got back), deduplicated and sorted; `null` when this
+ * provider's probe does not list the models a request can name, or the body
+ * is not the expected shape.
+ *
+ * Azure OpenAI's probe lists base models, while a request names a deployment,
+ * so its list would mislead; Bedrock and Vertex AI probe identity, not models.
+ */
+export declare function parseProviderModels(provider: string, body: unknown): string[] | null;
+/**
+ * The probe for any provider: a signed cloud probe for Bedrock and Vertex AI
+ * (`cloudProbe.ts`), the plain request description otherwise.
+ */
+export declare function buildVerificationProbeAsync(provider: string, fields: Record<string, string>, now?: Date): Promise<ProviderProbeRequest | null>;
+/** The verdict for a probe's answer: the probe's own reading when it has one. */
+export declare function classifyProbe(probe: ProviderProbeRequest, status: number, headers?: {
+    get(name: string): string | null;
+}): ProbeVerdict;
 /**
  * Classify a probe's HTTP response. Deliberately narrow about what counts as
  * "invalid": only 401/403 mean the credential itself is wrong. A 429

package/dist/providerVerification.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providerVerification.d.ts","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAiBH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,6EAA6E;IAC7E,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,oBAAoB,GAAG,IAAI,CAkH7B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;AAE1D;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAItE"}
+{"version":3,"file":"providerVerification.d.ts","sourceRoot":"","sources":["../src/providerVerification.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAmBH,MAAM,WAAW,oBAAoB;IACnC,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,EAAE,KAAK,GAAG,MAAM,CAAA;IACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAC/B,oEAAoE;IACpE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,oFAAoF;IACpF,QAAQ,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE;QAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,YAAY,CAAA;IAC1F,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,qFAAqF;IACrF,YAAY,CAAC,EAAE,YAAY,CAAA;CAC5B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAC7B,oBAAoB,GAAG,IAAI,CA6G7B;AAED,MAAM,MAAM,YAAY,GAAG,OAAO,GAAG,SAAS,GAAG,SAAS,CAAA;AAe1D;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAuBpF;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC9B,GAAG,GAAE,IAAiB,GACrB,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,CAEtC;AAED,iFAAiF;AACjF,wBAAgB,aAAa,CAC3B,KAAK,EAAE,oBAAoB,EAC3B,MAAM,EAAE,MAAM,EACd,OAAO,CAAC,EAAE;IAAE,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAA;CAAE,GAC7C,YAAY,CAId;AAED;;;;;;;;;GASG;AACH,wBAAgB,qBAAqB,CAAC,UAAU,EAAE,MAAM,GAAG,YAAY,CAItE"}