@intutic/shared-types 2.4.0 → 2.5.1

package/dist/mcpDaemonPolicyCache.d.ts

@@ -0,0 +1,32 @@
+/**
+ * The keys of the MCP daemon's shared (Valkey) resolved-policy cache, built
+ * here so the daemon that reads and writes them
+ * (`packages/mcp-proxy/src/daemon/policyCache.ts`) and the control plane that
+ * invalidates them (`lib/policyCacheInvalidation.ts`) cannot disagree.
+ *
+ * What `GET /api/v1/policy/resolve` answers depends on who asks: the
+ * hook-rule guardrails served are those of the calling key's member role, and
+ * the `principal` (the member, their role and SSO groups) is that member. So
+ * an entry is keyed by the workspace AND the caller — a tag derived from the
+ * daemon's API key, which is what the control plane resolves the member from.
+ * Two daemons on one Valkey with different members' keys each get their own
+ * entry; neither can be served the other's, possibly less restrictive, set.
+ *
+ * Invalidation cannot name every caller's entry, so each key also carries the
+ * workspace's generation: the control plane bumps `mcpDaemonPolicyGenKey` on
+ * every policy change, which orphans every caller's entry at once (they expire
+ * on their own TTL), with no SCAN. A daemon reads the generation BEFORE it
+ * fetches, so a change that lands during the fetch files the result under the
+ * old generation, where no one reads it.
+ */
+/** The workspace's policy generation, bumped on every invalidation. Absent reads as `0`. */
+export declare function mcpDaemonPolicyGenKey(workspaceId: string): string;
+/** One caller's resolved policy for a workspace, at one generation. */
+export declare function mcpDaemonPolicyKey(workspaceId: string, generation: string, callerTag: string): string;
+/**
+ * The workspace-only key daemons wrote before entries were keyed by caller.
+ * No current daemon reads it; the control plane still deletes it on every
+ * change so an older daemon sharing the Valkey is not served a stale entry.
+ */
+export declare function legacyMcpDaemonPolicyKey(workspaceId: string): string;
+//# sourceMappingURL=mcpDaemonPolicyCache.d.ts.map

package/dist/mcpDaemonPolicyCache.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpDaemonPolicyCache.d.ts","sourceRoot":"","sources":["../src/mcpDaemonPolicyCache.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,4FAA4F;AAC5F,wBAAgB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED,uEAAuE;AACvE,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAErG;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAEpE"}

package/dist/mcpDaemonPolicyCache.js

@@ -0,0 +1,43 @@
+"use strict";
+/**
+ * The keys of the MCP daemon's shared (Valkey) resolved-policy cache, built
+ * here so the daemon that reads and writes them
+ * (`packages/mcp-proxy/src/daemon/policyCache.ts`) and the control plane that
+ * invalidates them (`lib/policyCacheInvalidation.ts`) cannot disagree.
+ *
+ * What `GET /api/v1/policy/resolve` answers depends on who asks: the
+ * hook-rule guardrails served are those of the calling key's member role, and
+ * the `principal` (the member, their role and SSO groups) is that member. So
+ * an entry is keyed by the workspace AND the caller — a tag derived from the
+ * daemon's API key, which is what the control plane resolves the member from.
+ * Two daemons on one Valkey with different members' keys each get their own
+ * entry; neither can be served the other's, possibly less restrictive, set.
+ *
+ * Invalidation cannot name every caller's entry, so each key also carries the
+ * workspace's generation: the control plane bumps `mcpDaemonPolicyGenKey` on
+ * every policy change, which orphans every caller's entry at once (they expire
+ * on their own TTL), with no SCAN. A daemon reads the generation BEFORE it
+ * fetches, so a change that lands during the fetch files the result under the
+ * old generation, where no one reads it.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.mcpDaemonPolicyGenKey = mcpDaemonPolicyGenKey;
+exports.mcpDaemonPolicyKey = mcpDaemonPolicyKey;
+exports.legacyMcpDaemonPolicyKey = legacyMcpDaemonPolicyKey;
+/** The workspace's policy generation, bumped on every invalidation. Absent reads as `0`. */
+function mcpDaemonPolicyGenKey(workspaceId) {
+    return `mcp_daemon:policy_gen:${workspaceId}`;
+}
+/** One caller's resolved policy for a workspace, at one generation. */
+function mcpDaemonPolicyKey(workspaceId, generation, callerTag) {
+    return `mcp_daemon:policy:${workspaceId}:g${generation}:${callerTag}`;
+}
+/**
+ * The workspace-only key daemons wrote before entries were keyed by caller.
+ * No current daemon reads it; the control plane still deletes it on every
+ * change so an older daemon sharing the Valkey is not served a stale entry.
+ */
+function legacyMcpDaemonPolicyKey(workspaceId) {
+    return `mcp_daemon:policy:${workspaceId}`;
+}
+//# sourceMappingURL=mcpDaemonPolicyCache.js.map

package/dist/mcpDaemonPolicyCache.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mcpDaemonPolicyCache.js","sourceRoot":"","sources":["../src/mcpDaemonPolicyCache.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;;AAGH,sDAEC;AAGD,gDAEC;AAOD,4DAEC;AAjBD,4FAA4F;AAC5F,SAAgB,qBAAqB,CAAC,WAAmB;IACvD,OAAO,yBAAyB,WAAW,EAAE,CAAA;AAC/C,CAAC;AAED,uEAAuE;AACvE,SAAgB,kBAAkB,CAAC,WAAmB,EAAE,UAAkB,EAAE,SAAiB;IAC3F,OAAO,qBAAqB,WAAW,KAAK,UAAU,IAAI,SAAS,EAAE,CAAA;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAgB,wBAAwB,CAAC,WAAmB;IAC1D,OAAO,qBAAqB,WAAW,EAAE,CAAA;AAC3C,CAAC"}

package/dist/notifications.d.ts

@@ -4,7 +4,7 @@ export type NotificationChannel = 'slack' | 'email' | 'webhook' | 'pagerduty';
  * naming anything else, and the CLI and the Terraform provider check
  * against this list before they send one.
  */
-export declare const NOTIFICATION_EVENT_TYPES: readonly ["anomaly.detected", "anomaly.finding", "incident.created", "incident.escalated", "sop.status_changed", "session.ended", "adapter.write_back.failed", "decision.pending", "decision.approved", "decision.rejected", "ssl.enforcement.violation", "context_gap.auto_injected", "trajectory.alert", "calibration.threshold_breach", "anomaly.drift.detected", "anomaly.capability_miss", "anomaly.trust.updated", "sop.stale.detected", "sop.cascade.alert", "sop.cascade.invalidated", "sop.integrity.drift", "sop.lifecycle.transitioned", "sop.upstream.changed", "guardrail.ready", "guardrail.stale", "mcp.server.candidate", "mcp.server.tool_change_risk", "mcp.server.decided", "mcp.server.tool_toggled", "mcp.budget.threshold", "mcp.budget.exceeded", "judge.review.queued", "finops.budget.exceeded", "finops.budget.threshold", "finops.tokens.classified", "trial.started", "trial.expired_downgraded", "trial.day7_report_sent", "trial.day13_report_sent", "plan.captured", "plan.approved", "plan.deviation.detected", "identity.offboarding.completed", "auth.login.failed", "scim.user.changed", "scim.group.changed", "webhook.secret.rotated", "evidence.exported", "credential.changed", "workspace.context.updated", "gateway.stale.detected", "gateway.cell.stuck_pending", "region.sync.stale", "org.cells.deprovision_scheduled", "org.cells.deprovision_canceled", "org.cells.deprovisioned", "device.enforcement.stale", "device.enforcement.disabled", "governance.gate.silent", "governance.gate.recovered", "governance.integrity.failed", "inventory.ungoverned.detected", "provider.outage.detected", "billing.subscription.past_due", "skill.malware.detected", "skill.semantic.flagged"];
+export declare const NOTIFICATION_EVENT_TYPES: readonly ["anomaly.detected", "anomaly.finding", "incident.created", "incident.escalated", "sop.status_changed", "session.ended", "decision.pending", "decision.approved", "decision.rejected", "trajectory.alert", "calibration.threshold_breach", "anomaly.drift.detected", "anomaly.capability_miss", "anomaly.trust.updated", "sop.stale.detected", "sop.cascade.alert", "sop.cascade.invalidated", "sop.integrity.drift", "sop.lifecycle.transitioned", "sop.upstream.changed", "guardrail.ready", "guardrail.stale", "mcp.server.candidate", "mcp.server.tool_change_risk", "mcp.server.decided", "mcp.server.tool_toggled", "mcp.budget.threshold", "mcp.budget.exceeded", "judge.review.queued", "finops.budget.exceeded", "finops.budget.threshold", "finops.tokens.classified", "trial.started", "trial.expired_downgraded", "trial.day7_report_sent", "trial.day13_report_sent", "plan.captured", "plan.approved", "plan.deviation.detected", "identity.offboarding.completed", "auth.login.failed", "scim.user.changed", "scim.group.changed", "webhook.secret.rotated", "evidence.exported", "credential.changed", "workspace.context.updated", "gateway.stale.detected", "gateway.cell.stuck_pending", "region.sync.stale", "org.cells.deprovision_scheduled", "org.cells.deprovision_canceled", "org.cells.deprovisioned", "device.enforcement.stale", "device.enforcement.disabled", "governance.gate.silent", "governance.gate.recovered", "governance.integrity.failed", "inventory.ungoverned.detected", "provider.outage.detected", "billing.subscription.past_due", "skill.malware.detected", "skill.semantic.flagged"];
 export type NotificationEventType = (typeof NOTIFICATION_EVENT_TYPES)[number];
 export type NotificationStatus = 'sent' | 'failed' | 'deduplicated' | 'filtered';
 export interface NotificationRule {

package/dist/notifications.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,qoDA2O3B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAA;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;yEAGqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAElF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE,oBAAoB,CAAC,CAKzH,CAAA;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,GAAG,oBAAoB,CAIpF;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,GAAG,YAAY,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B"}
+{"version":3,"file":"notifications.d.ts","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,mBAAmB,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,GAAG,WAAW,CAAA;AAE7E;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,8iDAgP3B,CAAA;AAEV,MAAM,MAAM,qBAAqB,GAAG,CAAC,OAAO,wBAAwB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7E,MAAM,MAAM,kBAAkB,GAAG,MAAM,GAAG,QAAQ,GAAG,cAAc,GAAG,UAAU,CAAA;AAEhF,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,EAAE,mBAAmB,CAAA;IAC5B,eAAe,EAAE,MAAM,CAAA;IACvB,OAAO,EAAE,OAAO,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;IACjB;;;;OAIG;IACH,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAA;IACvB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAA;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB;;;;OAIG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB;;;yEAGqE;IACrE,mBAAmB,CAAC,EAAE,MAAM,CAAA;CAC7B;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAA;IACtB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,EAAE,qBAAqB,CAAA;IAChC,OAAO,EAAE,mBAAmB,CAAA;IAC5B,aAAa,EAAE,aAAa,CAAA;IAC5B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,2BAA2B;IAC1C,SAAS,CAAC,EAAE,qBAAqB,CAAA;IACjC,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,aAAa,CAAC,EAAE,aAAa,CAAA;IAC7B,OAAO,CAAC,EAAE,mBAAmB,CAAA;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAA;IACxB,OAAO,CAAC,EAAE,OAAO,CAAA;CAClB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,yFAAyF;AACzF,MAAM,MAAM,oBAAoB,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAA;AAElF,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,qBAAqB,CAAA;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,QAAQ,EAAE,oBAAoB,CAAA;IAC9B,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED;;;;;GAKG;AACH,eAAO,MAAM,8BAA8B,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE,oBAAoB,CAAC,CAKzH,CAAA;AAED;;;;GAIG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,OAAO,GAAG,oBAAoB,CAIpF;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,mBAAmB,CAAA;IAC5B,MAAM,EAAE,kBAAkB,CAAA;IAC1B,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAID,MAAM,WAAW,iBAAiB;IAChC,cAAc,EAAE,MAAM,CAAA;IACtB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,EAAE,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;IACjB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,MAAM,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;IAC9C,QAAQ,CAAC,EAAE,iBAAiB,EAAE,CAAA;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,iBAAiB,CAAA;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACtD,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,GAAG,CAAC,EAAE,MAAM,CAAA;IACZ,KAAK,CAAC,EAAE,SAAS,GAAG,QAAQ,CAAA;CAC7B;AAED,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,OAAO,CAAA;IACX,OAAO,EAAE,MAAM,CAAA;IACf,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,oBAAoB;IACnC,aAAa,EAAE,WAAW,GAAG,YAAY,CAAA;IACzC,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,MAAM,CAAC,EAAE,UAAU,EAAE,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,eAAe,CAAA;IACrB,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACpD,IAAI,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAA;IACpC,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACrC,OAAO,EAAE,KAAK,CAAC;QACb,SAAS,EAAE,MAAM,CAAA;QACjB,QAAQ,EAAE,MAAM,CAAA;QAChB,KAAK,EAAE,MAAM,CAAA;QACb,IAAI,EAAE,MAAM,CAAA;KACb,CAAC,CAAA;IACF,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,+EAA+E;IAC/E,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAA;IACf,IAAI,EAAE,MAAM,CAAA;IACZ,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,YAAY,EAAE,MAAM,CAAA;IACpB,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,MAAM,WAAW,cAAc;IAC7B,UAAU,EAAE,MAAM,CAAA;IAClB,YAAY,EAAE,MAAM,CAAA;IACpB,QAAQ,EAAE,MAAM,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;IACf,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAClC;AAED,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAA;IACX,MAAM,CAAC,EAAE,MAAM,CAAA;IACf,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;IAChC,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,OAAO,CAAA;IACX,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAMD,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;IACzB,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAA;IACnB,WAAW,EAAE,MAAM,CAAA;IACnB,QAAQ,EAAE,MAAM,CAAA;IAChB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAA;CAC1B"}

package/dist/notifications.js

@@ -30,17 +30,22 @@ exports.NOTIFICATION_EVENT_TYPES = [
     'incident.escalated',
     'sop.status_changed',
     'session.ended',
-    'adapter.write_back.failed',
     'decision.pending',
     /** An OWNER, ADMIN or EM approved a held decision, in Slack or through the API and CLI. Carries `entryId`, `reviewerId` and `via`. */
     'decision.approved',
     /** An OWNER, ADMIN or EM rejected a held decision, in Slack or through the API and CLI. */
     'decision.rejected',
-    'ssl.enforcement.violation',
-    'context_gap.auto_injected',
     'trajectory.alert',
     // ── Calibration & drift (Q10 orphan audit) ──
     'calibration.threshold_breach',
+    /**
+     * An enforced SOP's rolling compliance moved 0.15 or more from its stored
+     * baseline (`behavioralDriftService.ts`, the hourly SOP health sweep). Once per
+     * drift: the baseline is recaptured when it fires. Carries `sopId`,
+     * `driftScore`, `driftDirection` (`DEGRADING` or `IMPROVING`),
+     * `baselineCompliance` and `currentCompliance`. HIGH when degrading, INFO when
+     * improving.
+     */
     'anomaly.drift.detected',
     'anomaly.capability_miss',
     'anomaly.trust.updated',
@@ -188,7 +193,7 @@ exports.NOTIFICATION_EVENT_TYPES = [
     /**
      * The hourly audit-log integrity check found a failure of one kind
      * (`kind`: `chain_break`, `mirror_copy_mismatch`, `signature_invalid`,
-     * `root_mismatch` or `guard_tampered`). Fired once per kind while it keeps
+     * `root_mismatch`, `guard_tampered` or `foreign_key_unenforced`). Fired once per kind while it keeps
      * failing; a recurrence after it clears fires again.
      */
     'governance.integrity.failed',

package/dist/notifications.js.map

@@ -1 +1 @@
-{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,mCAAmC;AACnC,+CAA+C;;;AAqW/C,oEAIC;AAnWD;;;;GAIG;AACU,QAAA,wBAAwB,GAAG;IACtC,+CAA+C;IAC/C,kBAAkB;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,eAAe;IACf,2BAA2B;IAC3B,kBAAkB;IAClB,sIAAsI;IACtI,mBAAmB;IACnB,2FAA2F;IAC3F,mBAAmB;IACnB,2BAA2B;IAC3B,2BAA2B;IAC3B,kBAAkB;IAClB,+CAA+C;IAC/C,8BAA8B;IAC9B,wBAAwB;IACxB,yBAAyB;IACzB,uBAAuB;IACvB,kCAAkC;IAClC,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+HAA+H;IAC/H,sBAAsB;IACtB,0BAA0B;IAC1B,mFAAmF;IACnF,iBAAiB;IACjB,+FAA+F;IAC/F,iBAAiB;IACjB,4BAA4B;IAC5B,kJAAkJ;IAClJ,sBAAsB;IACtB,oHAAoH;IACpH,6BAA6B;IAC7B,qJAAqJ;IACrJ,oBAAoB;IACpB,mHAAmH;IACnH,yBAAyB;IACzB,yGAAyG;IACzG,sBAAsB;IACtB,iGAAiG;IACjG,qBAAqB;IACrB,yBAAyB;IACzB,gJAAgJ;IAChJ,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,gCAAgC;IAChC,8LAA8L;IAC9L,mBAAmB;IACnB,8HAA8H;IAC9H,mBAAmB;IACnB,2GAA2G;IAC3G,oBAAoB;IACpB,iMAAiM;IACjM,wBAAwB;IACxB,4JAA4J;IAC5J,mBAAmB;IACnB,mPAAmP;IACnP,oBAAoB;IACpB,0BAA0B;IAC1B,2BAA2B;IAC3B,4BAA4B;IAC5B;;;;;OAKG;IACH,wBAAwB;IACxB;;;;;;;;;OASG;IACH,4BAA4B;IAC5B;;;;;;;OAOG;IACH,mBAAmB;IACnB,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,iCAAiC;IACjC;;;;;;;OAOG;IACH,gCAAgC;IAChC;;;;;;OAMG;IACH,yBAAyB;IACzB,sCAAsC;IACtC;;;;;OAKG;IACH,0BAA0B;IAC1B;;;OAGG;IACH,6BAA6B;IAC7B,sBAAsB;IACtB;;;;;OAKG;IACH,wBAAwB;IACxB;;;OAGG;IACH,2BAA2B;IAC3B,wBAAwB;IACxB;;;;;OAKG;IACH,6BAA6B;IAC7B,2CAA2C;IAC3C;;;;OAIG;IACH,+BAA+B;IAC/B,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,0BAA0B;IAC1B,yDAAyD;IACzD;;;;;;OAMG;IACH,+BAA+B;IAC/B,yFAAyF;IACzF;;;;;;;;OAQG;IACH,wBAAwB;IACxB,2CAA2C;IAC3C;;;;;;;;;;;;OAYG;IACH,wBAAwB;CAChB,CAAA;AA6FV;;;;;GAKG;AACU,QAAA,8BAA8B,GAAmF;IAC5H,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAA;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,QAAiB;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,sCAA8B,EAAE,QAAQ,CAAC;QAC5F,CAAC,CAAC,sCAA8B,CAAC,QAAuD,CAAC;QACzF,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}
+{"version":3,"file":"notifications.js","sourceRoot":"","sources":["../src/notifications.ts"],"names":[],"mappings":";AAAA,+CAA+C;AAC/C,mCAAmC;AACnC,+CAA+C;;;AA0W/C,oEAIC;AAxWD;;;;GAIG;AACU,QAAA,wBAAwB,GAAG;IACtC,+CAA+C;IAC/C,kBAAkB;IAClB;;;;;;;;;;;OAWG;IACH,iBAAiB;IACjB,kBAAkB;IAClB,oBAAoB;IACpB,oBAAoB;IACpB,eAAe;IACf,kBAAkB;IAClB,sIAAsI;IACtI,mBAAmB;IACnB,2FAA2F;IAC3F,mBAAmB;IACnB,kBAAkB;IAClB,+CAA+C;IAC/C,8BAA8B;IAC9B;;;;;;;OAOG;IACH,wBAAwB;IACxB,yBAAyB;IACzB,uBAAuB;IACvB,kCAAkC;IAClC,oBAAoB;IACpB,mBAAmB;IACnB,yBAAyB;IACzB,qBAAqB;IACrB,4BAA4B;IAC5B,+HAA+H;IAC/H,sBAAsB;IACtB,0BAA0B;IAC1B,mFAAmF;IACnF,iBAAiB;IACjB,+FAA+F;IAC/F,iBAAiB;IACjB,4BAA4B;IAC5B,kJAAkJ;IAClJ,sBAAsB;IACtB,oHAAoH;IACpH,6BAA6B;IAC7B,qJAAqJ;IACrJ,oBAAoB;IACpB,mHAAmH;IACnH,yBAAyB;IACzB,yGAAyG;IACzG,sBAAsB;IACtB,iGAAiG;IACjG,qBAAqB;IACrB,yBAAyB;IACzB,gJAAgJ;IAChJ,qBAAqB;IACrB,wBAAwB;IACxB,wBAAwB;IACxB,yBAAyB;IACzB,0BAA0B;IAC1B,2BAA2B;IAC3B,eAAe;IACf,0BAA0B;IAC1B,wBAAwB;IACxB,yBAAyB;IACzB,cAAc;IACd,eAAe;IACf,eAAe;IACf,yBAAyB;IACzB,8BAA8B;IAC9B,gCAAgC;IAChC,8LAA8L;IAC9L,mBAAmB;IACnB,8HAA8H;IAC9H,mBAAmB;IACnB,2GAA2G;IAC3G,oBAAoB;IACpB,iMAAiM;IACjM,wBAAwB;IACxB,4JAA4J;IAC5J,mBAAmB;IACnB,mPAAmP;IACnP,oBAAoB;IACpB,0BAA0B;IAC1B,2BAA2B;IAC3B,4BAA4B;IAC5B;;;;;OAKG;IACH,wBAAwB;IACxB;;;;;;;;;OASG;IACH,4BAA4B;IAC5B;;;;;;;OAOG;IACH,mBAAmB;IACnB,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,iCAAiC;IACjC;;;;;;;OAOG;IACH,gCAAgC;IAChC;;;;;;OAMG;IACH,yBAAyB;IACzB,sCAAsC;IACtC;;;;;OAKG;IACH,0BAA0B;IAC1B;;;OAGG;IACH,6BAA6B;IAC7B,sBAAsB;IACtB;;;;;OAKG;IACH,wBAAwB;IACxB;;;OAGG;IACH,2BAA2B;IAC3B,wBAAwB;IACxB;;;;;OAKG;IACH,6BAA6B;IAC7B,2CAA2C;IAC3C;;;;OAIG;IACH,+BAA+B;IAC/B,4CAA4C;IAC5C;;;;;;;;OAQG;IACH,0BAA0B;IAC1B,yDAAyD;IACzD;;;;;;OAMG;IACH,+BAA+B;IAC/B,yFAAyF;IACzF;;;;;;;;OAQG;IACH,wBAAwB;IACxB,2CAA2C;IAC3C;;;;;;;;;;;;OAYG;IACH,wBAAwB;CAChB,CAAA;AA6FV;;;;;GAKG;AACU,QAAA,8BAA8B,GAAmF;IAC5H,QAAQ,EAAE,UAAU;IACpB,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;IAChB,GAAG,EAAE,KAAK;CACX,CAAA;AAED;;;;GAIG;AACH,SAAgB,4BAA4B,CAAC,QAAiB;IAC5D,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,sCAA8B,EAAE,QAAQ,CAAC;QAC5F,CAAC,CAAC,sCAA8B,CAAC,QAAuD,CAAC;QACzF,CAAC,CAAC,UAAU,CAAA;AAChB,CAAC"}

package/dist/observability.d.ts

@@ -1,34 +1,3 @@
-import { z } from 'zod';
-export declare const PromptEstimateInputSchema: z.ZodObject<{
-    prompt: z.ZodString;
-    modelName: z.ZodString;
-}, "strip", z.ZodTypeAny, {
-    prompt: string;
-    modelName: string;
-}, {
-    prompt: string;
-    modelName: string;
-}>;
-export type PromptEstimateInput = z.infer<typeof PromptEstimateInputSchema>;
-export interface PromptEstimateResult {
-    estimatedInputTokens: number;
-    estimatedOutputTokens: number;
-    estimatedCostUsd: number;
-    recommendations: string[];
-}
-export interface CostHistoryEntry {
-    date: string;
-    estimatedCostUsd: number;
-    actualCostUsd: number;
-}
-export interface CostHistoryResult {
-    history: CostHistoryEntry[];
-}
-export interface DriftReportResult {
-    driftPct: number;
-    totalEstimates: number;
-    totalActuals: number;
-}
 export interface TraceDagNode {
     sessionId: string;
     harnessType: string;

package/dist/observability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAIvB,eAAO,MAAM,yBAAyB;;;;;;;;;EAGpC,CAAA;AAEF,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAA;AAI3E,MAAM,WAAW,oBAAoB;IACnC,oBAAoB,EAAE,MAAM,CAAA;IAC5B,qBAAqB,EAAE,MAAM,CAAA;IAC7B,gBAAgB,EAAE,MAAM,CAAA;IACxB,eAAe,EAAE,MAAM,EAAE,CAAA;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAA;IACZ,gBAAgB,EAAE,MAAM,CAAA;IACxB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,gBAAgB,EAAE,CAAA;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,MAAM,CAAA;IAChB,cAAc,EAAE,MAAM,CAAA;IACtB,YAAY,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB"}
+{"version":3,"file":"observability.d.ts","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAA;IACjB,WAAW,EAAE,MAAM,CAAA;IACnB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAA;IAC9B,YAAY,EAAE,MAAM,CAAA;IACpB,SAAS,EAAE,MAAM,CAAA;IACjB,UAAU,EAAE,MAAM,CAAA;IAClB,uFAAuF;IACvF,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAA;IACf,aAAa,EAAE,MAAM,CAAA;IACrB,4EAA4E;IAC5E,gBAAgB,EAAE,MAAM,CAAA;IACxB,KAAK,EAAE,YAAY,EAAE,CAAA;CACtB"}

package/dist/observability.js

@@ -1,10 +1,3 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PromptEstimateInputSchema = void 0;
-const zod_1 = require("zod");
-// ─── Zod Schemas ─────────────────────────────────────────────────────
-exports.PromptEstimateInputSchema = zod_1.z.object({
-    prompt: zod_1.z.string().min(1),
-    modelName: zod_1.z.string().min(1),
-});
 //# sourceMappingURL=observability.js.map

package/dist/observability.js.map

@@ -1 +1 @@
-{"version":3,"file":"observability.js","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":";;;AAAA,6BAAuB;AAEvB,wEAAwE;AAE3D,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;CAC7B,CAAC,CAAA"}
+{"version":3,"file":"observability.js","sourceRoot":"","sources":["../src/observability.ts"],"names":[],"mappings":""}

package/dist/opaqueRefusal.d.ts

@@ -0,0 +1,40 @@
+/**
+ * The OPAQUE intervention mode: an agent is refused without being told which
+ * rule refused it.
+ *
+ * A refusal that names its rule, quotes the rule's text, or says which pattern
+ * matched teaches an agent the policy, and an agent that knows the policy can
+ * route around it. In an OPAQUE workspace every gate that refuses on workspace
+ * policy shows the agent {@link OPAQUE_REFUSAL_MESSAGE} instead, through the
+ * same refusal contract: the same exit code, HTTP status and refusal code, so
+ * harnesses and clients behave exactly as they would in a TRANSPARENT one.
+ * Only the text the agent reads changes. Audit records, trace records,
+ * `enforcement_log`, detector findings and the dashboard keep the full reason.
+ *
+ * Refusals that say nothing about the policy are not changed: a call too large
+ * to evaluate, a gate past its deadline, an unreadable payload, a crashed gate,
+ * a snapshot that failed its integrity check, and a chaos run's injected fault.
+ *
+ * `@intutic/gate` carries a byte-identical copy of this module
+ * (`packages/gate-js/src/opaqueRefusal.ts`); the Rust proxy (`refusal.rs`)
+ * and the Python SDK (`intutic_clawde/gate/opaque.py`) mirror the sentence.
+ * `refusal-codes.json` carries it as `opaqueMessage`, and
+ * `opaqueRefusalParity.test.ts` holds every copy to it. It carries no quote,
+ * dollar sign or backtick, so the hook gates can embed it in generated shell
+ * inside single quotes.
+ */
+export declare const OPAQUE_REFUSAL_MESSAGE = "Blocked by workspace policy. Ask a workspace admin if you need this action.";
+/**
+ * The policy snapshot's record of an OPAQUE workspace: a data line inside the
+ * digest, `@intervention_mode<TAB>OPAQUE`, written only when the mode is
+ * OPAQUE, so the snapshot of a TRANSPARENT or SILENT_LOG workspace is
+ * unchanged. Two columns, so every rule parser skips it.
+ */
+export declare const INTERVENTION_MODE_RECORD_TAG = "@intervention_mode";
+/** Whether a workspace's resolved intervention mode is OPAQUE. Any case. */
+export declare function isOpaqueInterventionMode(mode: unknown): boolean;
+/** The `.rules` line of an OPAQUE workspace. */
+export declare function encodeInterventionModeRecord(): string;
+/** Whether a `.rules` line is the record of an OPAQUE workspace. */
+export declare function isOpaqueInterventionModeRecord(line: string): boolean;
+//# sourceMappingURL=opaqueRefusal.d.ts.map

package/dist/opaqueRefusal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaqueRefusal.d.ts","sourceRoot":"","sources":["../src/opaqueRefusal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,eAAO,MAAM,sBAAsB,gFAC4C,CAAA;AAE/E;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B,uBAAuB,CAAA;AAEhE,4EAA4E;AAC5E,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,OAAO,CAE/D;AAED,gDAAgD;AAChD,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,oEAAoE;AACpE,wBAAgB,8BAA8B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAGpE"}

package/dist/opaqueRefusal.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INTERVENTION_MODE_RECORD_TAG = exports.OPAQUE_REFUSAL_MESSAGE = void 0;
+exports.isOpaqueInterventionMode = isOpaqueInterventionMode;
+exports.encodeInterventionModeRecord = encodeInterventionModeRecord;
+exports.isOpaqueInterventionModeRecord = isOpaqueInterventionModeRecord;
+/**
+ * The OPAQUE intervention mode: an agent is refused without being told which
+ * rule refused it.
+ *
+ * A refusal that names its rule, quotes the rule's text, or says which pattern
+ * matched teaches an agent the policy, and an agent that knows the policy can
+ * route around it. In an OPAQUE workspace every gate that refuses on workspace
+ * policy shows the agent {@link OPAQUE_REFUSAL_MESSAGE} instead, through the
+ * same refusal contract: the same exit code, HTTP status and refusal code, so
+ * harnesses and clients behave exactly as they would in a TRANSPARENT one.
+ * Only the text the agent reads changes. Audit records, trace records,
+ * `enforcement_log`, detector findings and the dashboard keep the full reason.
+ *
+ * Refusals that say nothing about the policy are not changed: a call too large
+ * to evaluate, a gate past its deadline, an unreadable payload, a crashed gate,
+ * a snapshot that failed its integrity check, and a chaos run's injected fault.
+ *
+ * `@intutic/gate` carries a byte-identical copy of this module
+ * (`packages/gate-js/src/opaqueRefusal.ts`); the Rust proxy (`refusal.rs`)
+ * and the Python SDK (`intutic_clawde/gate/opaque.py`) mirror the sentence.
+ * `refusal-codes.json` carries it as `opaqueMessage`, and
+ * `opaqueRefusalParity.test.ts` holds every copy to it. It carries no quote,
+ * dollar sign or backtick, so the hook gates can embed it in generated shell
+ * inside single quotes.
+ */
+exports.OPAQUE_REFUSAL_MESSAGE = 'Blocked by workspace policy. Ask a workspace admin if you need this action.';
+/**
+ * The policy snapshot's record of an OPAQUE workspace: a data line inside the
+ * digest, `@intervention_mode<TAB>OPAQUE`, written only when the mode is
+ * OPAQUE, so the snapshot of a TRANSPARENT or SILENT_LOG workspace is
+ * unchanged. Two columns, so every rule parser skips it.
+ */
+exports.INTERVENTION_MODE_RECORD_TAG = '@intervention_mode';
+/** Whether a workspace's resolved intervention mode is OPAQUE. Any case. */
+function isOpaqueInterventionMode(mode) {
+    return typeof mode === 'string' && mode.trim().toUpperCase() === 'OPAQUE';
+}
+/** The `.rules` line of an OPAQUE workspace. */
+function encodeInterventionModeRecord() {
+    return `${exports.INTERVENTION_MODE_RECORD_TAG}\tOPAQUE`;
+}
+/** Whether a `.rules` line is the record of an OPAQUE workspace. */
+function isOpaqueInterventionModeRecord(line) {
+    const [tag, mode, ...rest] = line.split('\t');
+    return tag === exports.INTERVENTION_MODE_RECORD_TAG && rest.length === 0 && isOpaqueInterventionMode(mode);
+}
+//# sourceMappingURL=opaqueRefusal.js.map

package/dist/opaqueRefusal.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"opaqueRefusal.js","sourceRoot":"","sources":["../src/opaqueRefusal.ts"],"names":[],"mappings":";;;AAqCA,4DAEC;AAGD,oEAEC;AAGD,wEAGC;AAlDD;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACU,QAAA,sBAAsB,GACjC,6EAA6E,CAAA;AAE/E;;;;;GAKG;AACU,QAAA,4BAA4B,GAAG,oBAAoB,CAAA;AAEhE,4EAA4E;AAC5E,SAAgB,wBAAwB,CAAC,IAAa;IACpD,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAA;AAC3E,CAAC;AAED,gDAAgD;AAChD,SAAgB,4BAA4B;IAC1C,OAAO,GAAG,oCAA4B,UAAU,CAAA;AAClD,CAAC;AAED,oEAAoE;AACpE,SAAgB,8BAA8B,CAAC,IAAY;IACzD,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC7C,OAAO,GAAG,KAAK,oCAA4B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,wBAAwB,CAAC,IAAI,CAAC,CAAA;AACpG,CAAC"}

package/dist/piiDetectors.d.ts

@@ -74,7 +74,10 @@ export interface PiiDetectorDefinition {
     /** `numeric` adds the decimal/serial rule on top of the word boundary. */
     boundary: 'word' | 'numeric';
     validator: 'card_luhn' | 'iban_mod97' | 'ssn_ranges' | 'email_shape' | 'phone_digits';
+    /** The action on live traffic when neither the workspace nor the machine sets one. */
     default_action: PiiAction;
+    /** What happens to a match in a copy Intutic keeps (replay contexts, cached responses), whatever the live action. */
+    stored_action: Exclude<PiiAction, 'block'>;
 }
 export interface PiiDefinition {
     version: number;

package/dist/piiDetectors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"piiDetectors.d.ts","sourceRoot":"","sources":["../src/piiDetectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4FAA4F;AAC5F,eAAO,MAAM,WAAW,qCAAsC,CAAA;AAC9D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,wEAAyE,CAAA;AACtG,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,8HAA0D,CAAA;AAChG,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAK1C;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAkBhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,mBAAmB,GAAG,IAAI,GACpC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAYlC;AAED,MAAM,WAAW,qBAAqB;IACpC,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,SAAS,EAAE,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,cAAc,CAAA;IACrF,cAAc,EAAE,SAAS,CAAA;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,iFAAiF;IACjF,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC3F,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAA4B,aAAa,CAAA"}
+{"version":3,"file":"piiDetectors.d.ts","sourceRoot":"","sources":["../src/piiDetectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAGvB,4FAA4F;AAC5F,eAAO,MAAM,WAAW,qCAAsC,CAAA;AAC9D,MAAM,MAAM,SAAS,GAAG,CAAC,OAAO,WAAW,CAAC,CAAC,MAAM,CAAC,CAAA;AAEpD,wFAAwF;AACxF,eAAO,MAAM,gBAAgB,wEAAyE,CAAA;AACtG,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,yBAAyB,8HAA0D,CAAA;AAChG,MAAM,MAAM,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAAC,CAAA;AAE3E;;;;;GAKG;AACH,MAAM,MAAM,qBAAqB,GAC7B;IAAE,IAAI,EAAE,MAAM,CAAA;CAAE,GAChB;IAAE,IAAI,EAAE,KAAK,CAAC;IAAC,OAAO,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAA;AAK1C;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,KAAK,EAAE,OAAO,GAAG,qBAAqB,CAkBhF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,mBAAmB,EAC1B,SAAS,EAAE,mBAAmB,GAAG,IAAI,GACpC,MAAM,CAAC,aAAa,EAAE,SAAS,CAAC,CAYlC;AAED,MAAM,WAAW,qBAAqB;IACpC,kCAAkC;IAClC,EAAE,EAAE,MAAM,CAAA;IACV,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,6EAA6E;IAC7E,KAAK,EAAE,MAAM,CAAA;IACb,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAA;IAC5B,SAAS,EAAE,WAAW,GAAG,YAAY,GAAG,YAAY,GAAG,aAAa,GAAG,cAAc,CAAA;IACrF,sFAAsF;IACtF,cAAc,EAAE,SAAS,CAAA;IACzB,qHAAqH;IACrH,aAAa,EAAE,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;CAC3C;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAA;IACf,SAAS,EAAE,qBAAqB,EAAE,CAAA;IAClC,iFAAiF;IACjF,WAAW,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAA;IAC3F,0EAA0E;IAC1E,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CACrC;AAED;;;;GAIG;AACH,eAAO,MAAM,cAAc,EAA4B,aAAa,CAAA"}

package/dist/piiDetectors.js.map

@@ -1 +1 @@
-{"version":3,"file":"piiDetectors.js","sourceRoot":"","sources":["../src/piiDetectors.ts"],"names":[],"mappings":";;;;;;AAwDA,gEAkBC;AAcD,kDAeC;AAvGD;;;;;;;;;;;GAWG;AACH,6BAAuB;AACvB,4EAA4C;AAE5C,4FAA4F;AAC/E,QAAA,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAA;AAG9D,wFAAwF;AAC3E,QAAA,gBAAgB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAU,CAAA;AAGtG;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,IAAI,CAAC,wBAAgB,CAAC,EAAE,OAAC,CAAC,IAAI,CAAC,mBAAW,CAAC,CAAC,CAAA;AAchG,MAAM,WAAW,GAAG,CAAC,CAAU,EAAkB,EAAE,CAAE,mBAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AACnG,MAAM,eAAe,GAAG,CAAC,CAAS,EAAsB,EAAE,CAAE,wBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AAE9G;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,KAAc;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAA;IAClI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2DAA2D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAA;IAC3H,CAAC;IACD,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAAE,SAAQ;QAClC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,8CAA8C,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,0CAA0C;aACjI,CAAA;QACH,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,GAAG,MAAM,CAAA;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACtF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,SAAqC;IAErC,MAAM,IAAI,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,mBAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,sBAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAG7F,CAAA;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAsC,EAAE,CAAC;QAClG,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAA;QACtB,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;IACjF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAwBD;;;;GAIG;AACU,QAAA,cAAc,GAAG,2BAAsC,CAAA"}
+{"version":3,"file":"piiDetectors.js","sourceRoot":"","sources":["../src/piiDetectors.ts"],"names":[],"mappings":";;;;;;AAwDA,gEAkBC;AAcD,kDAeC;AAvGD;;;;;;;;;;;GAWG;AACH,6BAAuB;AACvB,4EAA4C;AAE5C,4FAA4F;AAC/E,QAAA,WAAW,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,CAAU,CAAA;AAG9D,wFAAwF;AAC3E,QAAA,gBAAgB,GAAG,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW,CAAU,CAAA;AAGtG;;;;;;GAMG;AACU,QAAA,yBAAyB,GAAG,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,IAAI,CAAC,wBAAgB,CAAC,EAAE,OAAC,CAAC,IAAI,CAAC,mBAAW,CAAC,CAAC,CAAA;AAchG,MAAM,WAAW,GAAG,CAAC,CAAU,EAAkB,EAAE,CAAE,mBAAkC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AACnG,MAAM,eAAe,GAAG,CAAC,CAAS,EAAsB,EAAE,CAAE,wBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAA;AAE9G;;;;;;;;GAQG;AACH,SAAgB,0BAA0B,CAAC,KAAc;IACvD,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;IAChD,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAA;IAClI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,2DAA2D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,CAAA;IAC3H,CAAC;IACD,MAAM,OAAO,GAAwB,EAAE,CAAA;IACvC,KAAK,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,CAAC,eAAe,CAAC,EAAE,CAAC;YAAE,SAAQ;QAClC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,MAAM,EAAE,8CAA8C,EAAE,QAAQ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,0CAA0C;aACjI,CAAA;QACH,CAAC;QACD,OAAO,CAAC,EAAE,CAAC,GAAG,MAAM,CAAA;IACtB,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAA;AACtF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAgB,mBAAmB,CACjC,KAA0B,EAC1B,SAAqC;IAErC,MAAM,IAAI,GAAG,CAAC,CAAY,EAAU,EAAE,CAAC,mBAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;IAC7D,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,sBAAc,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAG7F,CAAA;IACD,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAA;IAC3B,KAAK,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAsC,EAAE,CAAC;QAClG,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,CAAC,CAAA;QACtB,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAA;IACjF,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AA2BD;;;;GAIG;AACU,QAAA,cAAc,GAAG,2BAAsC,CAAA"}

package/dist/piiDetectors.json

@@ -1,5 +1,5 @@
 {
-    "$comment": "PII detectors for both DLP scanners. The Rust proxy embeds this file (packages/proxy/src/dlp/pii_detectors.json); the MCP proxy reads a byte-identical copy (packages/shared-types/src/piiDetectors.json). Edit one, copy it over the other: a test on each side fails while they differ. Regexes are the subset Rust regex and JavaScript RegExp agree on — ASCII classes, no \\b, no \\d, no lookaround — and each match is then checked by the named validator and boundary rule, implemented identically in packages/proxy/src/dlp/pii.rs and packages/mcp-proxy/src/dlpPii.ts. Conformance vectors: packages/shared-types/fixtures/pii-detector-vectors.json.",
+    "$comment": "PII detectors for both DLP scanners. The Rust proxy embeds this file (packages/proxy/src/dlp/pii_detectors.json); the MCP proxy reads a byte-identical copy (packages/shared-types/src/piiDetectors.json). Edit one, copy it over the other: a test on each side fails while they differ. Regexes are the subset Rust regex and JavaScript RegExp agree on — ASCII classes, no \\b, no \\d, no lookaround — and each match is then checked by the named validator and boundary rule, implemented identically in packages/proxy/src/dlp/pii.rs and packages/mcp-proxy/src/dlpPii.ts. Conformance vectors: packages/shared-types/fixtures/pii-detector-vectors.json. `default_action` is what a detector does to live traffic (the request sent to the model, the response returned to the client) when neither the workspace nor the machine sets an action; `stored_action` is what it does to the copies Intutic keeps, whatever the live action: matches are redacted in sampled replay contexts and change-manifest targets, and a prompt or response with a match is not written to the response cache. Email and phone stay off on live traffic because coding agents edit real addresses and numbers (package.json authors, git config, fixtures) and a redacted one gets written back as the placeholder; nothing an agent needs is lost by keeping them out of what Intutic stores.",
     "version": 1,
     "detectors": [
         {
@@ -9,7 +9,8 @@
             "regex": "[0-9]{4}[ -][0-9]{4}[ -][0-9]{4}[ -][0-9]{4}|[0-9]{4}[ -][0-9]{6}[ -][0-9]{4,5}|[0-9]{13,19}",
             "boundary": "numeric",
             "validator": "card_luhn",
-            "default_action": "redact"
+            "default_action": "redact",
+            "stored_action": "redact"
         },
         {
             "id": "pii.iban",
@@ -18,7 +19,8 @@
             "regex": "[A-Z]{2}[0-9]{2}(?: ?[A-Z0-9]){11,30}",
             "boundary": "word",
             "validator": "iban_mod97",
-            "default_action": "redact"
+            "default_action": "redact",
+            "stored_action": "redact"
         },
         {
             "id": "pii.ssn",
@@ -27,7 +29,8 @@
             "regex": "[0-9]{3}-[0-9]{2}-[0-9]{4}",
             "boundary": "numeric",
             "validator": "ssn_ranges",
-            "default_action": "redact"
+            "default_action": "redact",
+            "stored_action": "redact"
         },
         {
             "id": "pii.email",
@@ -36,7 +39,8 @@
             "regex": "[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9-]{1,63}(?:\\.[A-Za-z0-9-]{1,63}){1,8}",
             "boundary": "word",
             "validator": "email_shape",
-            "default_action": "off"
+            "default_action": "off",
+            "stored_action": "redact"
         },
         {
             "id": "pii.phone",
@@ -45,7 +49,8 @@
             "regex": "\\+[1-9][0-9]{0,2}(?:[ .-]?\\([0-9]{1,4}\\)|[ .-]?[0-9]{1,4}){2,7}|(?:1[ .-])?(?:\\([2-9][0-9]{2}\\) ?|[2-9][0-9]{2}[ .-])[2-9][0-9]{2}[ .-][0-9]{4}",
             "boundary": "numeric",
             "validator": "phone_digits",
-            "default_action": "off"
+            "default_action": "off",
+            "stored_action": "redact"
         }
     ],
     "card_brands": [

package/dist/policyGuardrails.d.ts

@@ -78,8 +78,8 @@ export declare const AuthoredGuardrailCreateSchema: z.ZodObject<{
     description?: string | null | undefined;
 }, {
     name: string;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }>;
 /**
  * `PUT /api/v1/policy-guardrails/guardrails/:guardrailId`: any of the three.
@@ -91,20 +91,20 @@ export declare const AuthoredGuardrailUpdateSchema: z.ZodEffects<z.ZodObject<{
     ir: z.ZodOptional<z.ZodUnknown>;
 }, "strict", z.ZodTypeAny, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }>, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }, {
     name?: string | undefined;
-    ir?: unknown;
     description?: string | null | undefined;
+    ir?: unknown;
 }>;
 export type AuthoredGuardrailCreate = z.infer<typeof AuthoredGuardrailCreateSchema>;
 export type AuthoredGuardrailUpdate = z.infer<typeof AuthoredGuardrailUpdateSchema>;

package/dist/posturePresets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"posturePresets.d.ts","sourceRoot":"","sources":["../src/posturePresets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAA;IAC1C,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACtC;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,aAAa,EAkD5C,CAAA;AAEV;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EA6CxC,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,CAAA;AAE7C,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAGtF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACpB"}
+{"version":3,"file":"posturePresets.d.ts","sourceRoot":"","sources":["../src/posturePresets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,KAAK,EAAE,MAAM,CAAA;IACb,WAAW,EAAE,MAAM,CAAA;IACnB,8CAA8C;IAC9C,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAA;IAC1C,wEAAwE;IACxE,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACtC;AAED;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS,aAAa,EAkD5C,CAAA;AAUV;;;;;;;GAOG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS,aAAa,EAgDxC,CAAA;AAEV,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,MAAM,CAAA;AAE7C,yEAAyE;AACzE,wBAAgB,WAAW,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAGtF;AAED;;;;;;;;GAQG;AACH,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,EAAE,MAAM,CAAA;IAClB,IAAI,EAAE,MAAM,CAAA;IACZ,uFAAuF;IACvF,MAAM,EAAE,MAAM,CAAA;IACd,oFAAoF;IACpF,OAAO,EAAE,OAAO,CAAA;IAChB,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,WAAW,EAAE,MAAM,CAAA;CACpB"}

package/dist/posturePresets.js

@@ -80,6 +80,12 @@ exports.SECURITY_POSTURES = [
         featureFlags: { ff_shadow_enforcement: true },
     },
 ];
+/**
+ * What every cost posture's response cache keeps, said where the posture is
+ * chosen: all three turn exact caching on, and a cache is stored data.
+ */
+const CACHE_STORAGE_NOTE = 'Cached answers are kept with their prompt text for 24 hours, scoped to this workspace; ' +
+    'an exchange in which DLP finds a secret or personal data is never cached.';
 /**
  * Cost postures: how aggressively the workspace pursues savings.
  *
@@ -94,7 +100,8 @@ exports.COST_POSTURES = [
         title: 'Max savings',
         description: 'Bandit routing enforces its selections, and both response caches serve ' +
             'repeats without an upstream call. Routing learns from measured integrity ' +
-            'and cost; it detects malformed and truncated responses, not subtly worse ones.',
+            'and cost; it detects malformed and truncated responses, not subtly worse ones. ' +
+            CACHE_STORAGE_NOTE,
         settings: {},
         featureFlags: {
             ff_bandit_routing: true,
@@ -108,7 +115,8 @@ exports.COST_POSTURES = [
         title: 'Balanced',
         description: 'Routing runs in shadow — it reports what it would have picked and what that ' +
             'would have saved, while every request is served by the model you asked for. ' +
-            'Exact-match caching on; semantic caching off.',
+            'Exact-match caching on; semantic caching off. ' +
+            CACHE_STORAGE_NOTE,
         settings: {},
         featureFlags: {
             ff_bandit_routing: false,
@@ -121,7 +129,8 @@ exports.COST_POSTURES = [
         name: 'quality-first',
         title: 'Quality first',
         description: 'No routing, no semantic cache: every request is served by the requested ' +
-            'model, fresh, with only exact repeats of a whole request served from cache.',
+            'model, fresh, with only exact repeats of a whole request served from cache. ' +
+            CACHE_STORAGE_NOTE,
         settings: {},
         featureFlags: {
             ff_bandit_routing: false,

package/dist/posturePresets.js.map

@@ -1 +1 @@
-{"version":3,"file":"posturePresets.js","sourceRoot":"","sources":["../src/posturePresets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AA6HH,kCAGC;AApHD;;GAEG;AACU,QAAA,iBAAiB,GAA6B;IACzD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,WAAW,EACT,iFAAiF;YACjF,2EAA2E;YAC3E,oEAAoE;QACtE,QAAQ,EAAE;YACR,qBAAqB,EAAE,WAAW;YAClC,oBAAoB,EAAE,QAAQ;SAC/B;QACD,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE;KAC/E;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,+EAA+E;YAC/E,0EAA0E;YAC1E,6BAA6B;QAC/B,QAAQ,EAAE;YACR,qBAAqB,EAAE,SAAS;YAChC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;KAC/C;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,gFAAgF;YAChF,gFAAgF;YAChF,4EAA4E;QAC9E,QAAQ,EAAE;YACR,qBAAqB,EAAE,YAAY;YACnC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;KAC9C;CACO,CAAA;AAEV;;;;;;;GAOG;AACU,QAAA,aAAa,GAA6B;IACrD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,yEAAyE;YACzE,2EAA2E;YAC3E,gFAAgF;QAClF,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,IAAI;YACvB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,IAAI;SACjC;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,8EAA8E;YAC9E,8EAA8E;YAC9E,+CAA+C;QACjD,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,0EAA0E;YAC1E,6EAA6E;QAC/E,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;CACO,CAAA;AAIV,yEAAyE;AACzE,SAAgB,WAAW,CAAC,IAAiB,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,yBAAiB,CAAC,CAAC,CAAC,qBAAa,CAAA;IACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AACzC,CAAC"}
+{"version":3,"file":"posturePresets.js","sourceRoot":"","sources":["../src/posturePresets.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;;;AAwIH,kCAGC;AA/HD;;GAEG;AACU,QAAA,iBAAiB,GAA6B;IACzD;QACE,IAAI,EAAE,QAAQ;QACd,KAAK,EAAE,QAAQ;QACf,WAAW,EACT,iFAAiF;YACjF,2EAA2E;YAC3E,oEAAoE;QACtE,QAAQ,EAAE;YACR,qBAAqB,EAAE,WAAW;YAClC,oBAAoB,EAAE,QAAQ;SAC/B;QACD,qEAAqE;QACrE,mEAAmE;QACnE,uEAAuE;QACvE,+DAA+D;QAC/D,kEAAkE;QAClE,kEAAkE;QAClE,kEAAkE;QAClE,sEAAsE;QACtE,yEAAyE;QACzE,uEAAuE;QACvE,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE,wBAAwB,EAAE,IAAI,EAAE;KAC/E;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,+EAA+E;YAC/E,0EAA0E;YAC1E,6BAA6B;QAC/B,QAAQ,EAAE;YACR,qBAAqB,EAAE,SAAS;YAChC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,KAAK,EAAE;KAC/C;IACD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,SAAS;QAChB,WAAW,EACT,gFAAgF;YAChF,gFAAgF;YAChF,4EAA4E;QAC9E,QAAQ,EAAE;YACR,qBAAqB,EAAE,YAAY;YACnC,oBAAoB,EAAE,MAAM;SAC7B;QACD,YAAY,EAAE,EAAE,qBAAqB,EAAE,IAAI,EAAE;KAC9C;CACO,CAAA;AAEV;;;GAGG;AACH,MAAM,kBAAkB,GACtB,yFAAyF;IACzF,2EAA2E,CAAA;AAE7E;;;;;;;GAOG;AACU,QAAA,aAAa,GAA6B;IACrD;QACE,IAAI,EAAE,SAAS;QACf,KAAK,EAAE,aAAa;QACpB,WAAW,EACT,yEAAyE;YACzE,2EAA2E;YAC3E,iFAAiF;YACjF,kBAAkB;QACpB,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,IAAI;YACvB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,IAAI;SACjC;KACF;IACD;QACE,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,UAAU;QACjB,WAAW,EACT,8EAA8E;YAC9E,8EAA8E;YAC9E,gDAAgD;YAChD,kBAAkB;QACpB,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,IAAI;YACvB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;IACD;QACE,IAAI,EAAE,eAAe;QACrB,KAAK,EAAE,eAAe;QACtB,WAAW,EACT,0EAA0E;YAC1E,8EAA8E;YAC9E,kBAAkB;QACpB,QAAQ,EAAE,EAAE;QACZ,YAAY,EAAE;YACZ,iBAAiB,EAAE,KAAK;YACxB,iBAAiB,EAAE,KAAK;YACxB,uBAAuB,EAAE,IAAI;YAC7B,0BAA0B,EAAE,KAAK;SAClC;KACF;CACO,CAAA;AAIV,yEAAyE;AACzE,SAAgB,WAAW,CAAC,IAAiB,EAAE,IAAY;IACzD,MAAM,GAAG,GAAG,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,yBAAiB,CAAC,CAAC,CAAC,qBAAa,CAAA;IACnE,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAA;AACzC,CAAC"}

package/dist/responses/common.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Building blocks of the control plane's response schemas.
+ *
+ * Each schema in `src/responses/` describes a response body as the client
+ * receives it: JSON, so a timestamp is a string and a field the handler left
+ * `undefined` is absent (`.optional()`), not `null` (`.nullable()`). A route
+ * declares its schema by answering through `respond(c, Schema, body)`
+ * (`services/control-plane/src/lib/respond.ts`); the OpenAPI document
+ * publishes it, `tsc` holds the handler's body to it, and the control plane's
+ * tests reject a body that does not match it or carries a field it does not
+ * declare. Write one from the handler and the service code it returns, never
+ * from what a client expects: where the two disagree, the handler is right.
+ *
+ * Conventions:
+ * - Top-level schemas are named `<Thing>Response` and exported with their
+ *   inferred type under the same name.
+ * - No transforms, defaults or coercions: a schema describes, it does not
+ *   convert.
+ * - In a union, put the branch with more fields first: zod keeps the first
+ *   branch that matches and drops the fields it does not declare, which the
+ *   tests then report as undeclared.
+ *
+ * @module
+ */
+import { z } from 'zod';
+/** A timestamp: a `Date` the handler returned, serialized by `JSON.stringify`. */
+export declare const IsoTimestamp: z.ZodString;
+/** How a list response's row keys are cased (`lib/listEnvelope.ts` in the control plane). */
+export declare const RowCase: z.ZodEnum<["snake", "camel", "mixed"]>;
+/**
+ * The two keys `applyListEnvelope` adds to a list response: the key that
+ * holds the rows, and how their keys are cased.
+ */
+export declare function listEnvelope<K extends string, C extends z.infer<typeof RowCase>>(listProperty: K, rowCase: C): z.ZodObject<{
+    listProperty: z.ZodLiteral<K>;
+    rowCase: z.ZodLiteral<C>;
+}, "strip", z.ZodTypeAny, z.objectUtil.addQuestionMarks<z.baseObjectOutputType<{
+    listProperty: z.ZodLiteral<K>;
+    rowCase: z.ZodLiteral<C>;
+}>, any> extends infer T ? { [k in keyof T]: T[k]; } : never, z.baseObjectInputType<{
+    listProperty: z.ZodLiteral<K>;
+    rowCase: z.ZodLiteral<C>;
+}> extends infer T_1 ? { [k_1 in keyof T_1]: T_1[k_1]; } : never>;
+/** `{ deleted: true }`, the answer of a delete that has nothing else to say. */
+export declare const DeletedResponse: z.ZodObject<{
+    deleted: z.ZodLiteral<true>;
+}, "strip", z.ZodTypeAny, {
+    deleted: true;
+}, {
+    deleted: true;
+}>;
+export type DeletedResponse = z.infer<typeof DeletedResponse>;
+//# sourceMappingURL=common.d.ts.map

package/dist/responses/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/responses/common.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,kFAAkF;AAClF,eAAO,MAAM,YAAY,aAAwC,CAAA;AAEjE,6FAA6F;AAC7F,eAAO,MAAM,OAAO,wCAAsC,CAAA;AAE1D;;;GAGG;AACH,wBAAgB,YAAY,CAAC,CAAC,SAAS,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,OAAO,OAAO,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;;;;;;;;;kEAE5G;AAED,gFAAgF;AAChF,eAAO,MAAM,eAAe;;;;;;EAAyC,CAAA;AACrE,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA"}