@mapick/cost-firewall 0.1.0

package/dist/provider/upstream/anthropic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.d.ts","sourceRoot":"","sources":["../../../src/provider/upstream/anthropic.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,GAAG,EAAE,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,wBAAuB,eAAe,CACpC,OAAO,EAAE,sBAAsB,GAC9B,cAAc,CAAC,GAAG,CAAC,CAgErB"}

package/dist/provider/upstream/anthropic.js

@@ -0,0 +1,62 @@
+/**
+ * Anthropic Messages API upstream transport
+ */
+export async function* streamAnthropic(options) {
+    const { apiKey, model, messages, max_tokens = 4096, stream = true, ...rest } = options;
+    const url = "https://api.anthropic.com/v1/messages";
+    // 30s timeout
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 30_000);
+    try {
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                "x-api-key": apiKey,
+                "anthropic-version": "2023-06-01",
+            },
+            body: JSON.stringify({
+                model,
+                messages,
+                max_tokens,
+                stream,
+                ...rest,
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`Anthropic upstream error ${response.status}: ${errorText}`);
+        }
+        if (!response.body) {
+            throw new Error("Anthropic upstream returned empty body");
+        }
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split("\n");
+            buffer = lines.pop() ?? "";
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed || !trimmed.startsWith("data: "))
+                    continue;
+                const data = trimmed.slice("data: ".length);
+                try {
+                    yield JSON.parse(data);
+                }
+                catch {
+                    // Skip invalid JSON
+                }
+            }
+        }
+    }
+    finally {
+        clearTimeout(timeoutId);
+    }
+}
+//# sourceMappingURL=anthropic.js.map

package/dist/provider/upstream/anthropic.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"anthropic.js","sourceRoot":"","sources":["../../../src/provider/upstream/anthropic.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,eAAe,CACpC,OAA+B;IAE/B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,GAAG,IAAI,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAEvF,MAAM,GAAG,GAAG,uCAAuC,CAAC;IAEpD,cAAc;IACd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,WAAW,EAAE,MAAM;gBACnB,mBAAmB,EAAE,YAAY;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,QAAQ;gBACR,UAAU;gBACV,MAAM;gBACN,GAAG,IAAI;aACR,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;QAC/E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;QAC5D,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAExD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAE5C,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,oBAAoB;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;IAC1B,CAAC;AACH,CAAC"}

package/dist/provider/upstream/openai.d.ts

@@ -0,0 +1,17 @@
+/**
+ * OpenAI-compatible upstream transport
+ *
+ * Supports /v1/chat/completions
+ * Compatible with OpenRouter, DeepSeek, Qwen and other OpenAI-compatible providers
+ */
+export interface OpenAiStreamOptions {
+    baseUrl: string;
+    apiKey: string;
+    model: string;
+    messages: any[];
+    stream?: boolean;
+    [key: string]: any;
+}
+export declare function streamOpenAi(options: OpenAiStreamOptions): AsyncGenerator<any>;
+export declare function getOpenAiBaseUrl(upstream: string): string;
+//# sourceMappingURL=openai.d.ts.map

package/dist/provider/upstream/openai.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.d.ts","sourceRoot":"","sources":["../../../src/provider/upstream/openai.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,GAAG,EAAE,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;CACpB;AAED,wBAAuB,YAAY,CACjC,OAAO,EAAE,mBAAmB,GAC3B,cAAc,CAAC,GAAG,CAAC,CAgErB;AAED,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CASzD"}

package/dist/provider/upstream/openai.js

@@ -0,0 +1,75 @@
+/**
+ * OpenAI-compatible upstream transport
+ *
+ * Supports /v1/chat/completions
+ * Compatible with OpenRouter, DeepSeek, Qwen and other OpenAI-compatible providers
+ */
+export async function* streamOpenAi(options) {
+    const { baseUrl, apiKey, model, messages, stream = true, ...rest } = options;
+    const url = `${baseUrl}/v1/chat/completions`;
+    // 30s timeout
+    const controller = new AbortController();
+    const timeoutId = setTimeout(() => controller.abort(), 30_000);
+    try {
+        const response = await fetch(url, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({
+                model,
+                messages,
+                stream,
+                ...rest,
+            }),
+            signal: controller.signal,
+        });
+        if (!response.ok) {
+            const errorText = await response.text();
+            throw new Error(`OpenAI upstream error ${response.status}: ${errorText}`);
+        }
+        if (!response.body) {
+            throw new Error("OpenAI upstream returned empty body");
+        }
+        const reader = response.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        while (true) {
+            const { done, value } = await reader.read();
+            if (done)
+                break;
+            buffer += decoder.decode(value, { stream: true });
+            const lines = buffer.split("\n");
+            buffer = lines.pop() ?? "";
+            for (const line of lines) {
+                const trimmed = line.trim();
+                if (!trimmed || !trimmed.startsWith("data: "))
+                    continue;
+                const data = trimmed.slice("data: ".length);
+                if (data === "[DONE]")
+                    return;
+                try {
+                    yield JSON.parse(data);
+                }
+                catch {
+                    // Skip invalid JSON
+                }
+            }
+        }
+    }
+    finally {
+        clearTimeout(timeoutId);
+        // Reader is released in the normal flow, no need to releaseLock here
+    }
+}
+export function getOpenAiBaseUrl(upstream) {
+    const baseUrls = {
+        openai: "https://api.openai.com",
+        openrouter: "https://openrouter.ai/api",
+        deepseek: "https://api.deepseek.com",
+        qwen: "https://dashscope.aliyuncs.com/compatible-mode",
+    };
+    return baseUrls[upstream] ?? `https://api.${upstream}.com`;
+}
+//# sourceMappingURL=openai.js.map

package/dist/provider/upstream/openai.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../../src/provider/upstream/openai.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAWH,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,YAAY,CACjC,OAA4B;IAE5B,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,CAAC;IAE7E,MAAM,GAAG,GAAG,GAAG,OAAO,sBAAsB,CAAC;IAE7C,cAAc;IACd,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,SAAS,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,CAAC;IAE/D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;gBACnB,KAAK;gBACL,QAAQ;gBACR,MAAM;gBACN,GAAG,IAAI;aACR,CAAC;YACF,MAAM,EAAE,UAAU,CAAC,MAAM;SAC1B,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,SAAS,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;YACxC,MAAM,IAAI,KAAK,CAAC,yBAAyB,QAAQ,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;QAClC,IAAI,MAAM,GAAG,EAAE,CAAC;QAEhB,OAAO,IAAI,EAAE,CAAC;YACZ,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;YAC5C,IAAI,IAAI;gBAAE,MAAM;YAEhB,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,MAAM,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;YAE3B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;gBAC5B,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,QAAQ,CAAC;oBAAE,SAAS;gBAExD,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBAC5C,IAAI,IAAI,KAAK,QAAQ;oBAAE,OAAO;gBAE9B,IAAI,CAAC;oBACH,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBACzB,CAAC;gBAAC,MAAM,CAAC;oBACP,oBAAoB;gBACtB,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,SAAS,CAAC,CAAC;QACxB,qEAAqE;IACvE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,QAAgB;IAC/C,MAAM,QAAQ,GAA2B;QACvC,MAAM,EAAE,wBAAwB;QAChC,UAAU,EAAE,2BAA2B;QACvC,QAAQ,EAAE,0BAA0B;QACpC,IAAI,EAAE,gDAAgD;KACvD,CAAC;IAEF,OAAO,QAAQ,CAAC,QAAQ,CAAC,IAAI,eAAe,QAAQ,MAAM,CAAC;AAC7D,CAAC"}

package/dist/source.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Source key resolution
+ *
+ * Priority:
+ * 1. agentId + sessionId
+ * 2. sessionKey
+ * 3. workspaceDir + provider + model
+ * 4. provider + model
+ */
+export interface HookContext {
+    agentId?: string;
+    sessionId?: string;
+    sessionKey?: string;
+}
+export interface ModelCallEvent {
+    runId?: string;
+    callId?: string;
+    sessionKey?: string;
+    sessionId?: string;
+    provider: string;
+    model: string;
+}
+export interface ProviderContext {
+    workspaceDir?: string;
+    provider?: string;
+    modelId?: string;
+}
+export interface RouteInfo {
+    upstream: string;
+    model: string;
+}
+export declare function sourceFromHookContext(event: Partial<HookContext>, ctx: Partial<HookContext>): string;
+export declare function sourceFromModelCall(event: ModelCallEvent, ctx: Partial<HookContext>): string;
+export declare function sourceFromProviderContext(ctx: ProviderContext, route: RouteInfo): string;
+//# sourceMappingURL=source.d.ts.map

package/dist/source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.d.ts","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,WAAW;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,OAAO,CAAC,WAAW,CAAC,EAC3B,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,GACxB,MAAM,CAcR;AAED,wBAAgB,mBAAmB,CACjC,KAAK,EAAE,cAAc,EACrB,GAAG,EAAE,OAAO,CAAC,WAAW,CAAC,GACxB,MAAM,CAWR;AAED,wBAAgB,yBAAyB,CACvC,GAAG,EAAE,eAAe,EACpB,KAAK,EAAE,SAAS,GACf,MAAM,CAQR"}

package/dist/source.js

@@ -0,0 +1,41 @@
+/**
+ * Source key resolution
+ *
+ * Priority:
+ * 1. agentId + sessionId
+ * 2. sessionKey
+ * 3. workspaceDir + provider + model
+ * 4. provider + model
+ */
+export function sourceFromHookContext(event, ctx) {
+    const agentId = event.agentId ?? ctx.agentId;
+    const sessionId = event.sessionId ?? ctx.sessionId;
+    if (agentId && sessionId) {
+        return `${agentId}/${sessionId}`;
+    }
+    const sessionKey = event.sessionKey ?? ctx.sessionKey;
+    if (sessionKey) {
+        return sessionKey;
+    }
+    return "unknown";
+}
+export function sourceFromModelCall(event, ctx) {
+    if (event.sessionId) {
+        const agentId = ctx.agentId ?? "unknown";
+        return `${agentId}/${event.sessionId}`;
+    }
+    if (event.sessionKey) {
+        return event.sessionKey;
+    }
+    return `${event.provider}/${event.model}`;
+}
+export function sourceFromProviderContext(ctx, route) {
+    if (ctx.workspaceDir) {
+        // Use last-level directory name instead of full path to avoid leaking user file paths
+        const parts = ctx.workspaceDir.replace(/\\/g, "/").split("/").filter(Boolean);
+        const basename = parts[parts.length - 1] || "ws";
+        return `${basename}/${route.upstream}/${route.model}`;
+    }
+    return `${route.upstream}/${route.model}`;
+}
+//# sourceMappingURL=source.js.map

package/dist/source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"source.js","sourceRoot":"","sources":["../src/source.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA4BH,MAAM,UAAU,qBAAqB,CACnC,KAA2B,EAC3B,GAAyB;IAEzB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,CAAC,OAAO,CAAC;IAC7C,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC;IAEnD,IAAI,OAAO,IAAI,SAAS,EAAE,CAAC;QACzB,OAAO,GAAG,OAAO,IAAI,SAAS,EAAE,CAAC;IACnC,CAAC;IAED,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,UAAU,CAAC;IACtD,IAAI,UAAU,EAAE,CAAC;QACf,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB,CACjC,KAAqB,EACrB,GAAyB;IAEzB,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,SAAS,CAAC;QACzC,OAAO,GAAG,OAAO,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;IACzC,CAAC;IAED,IAAI,KAAK,CAAC,UAAU,EAAE,CAAC;QACrB,OAAO,KAAK,CAAC,UAAU,CAAC;IAC1B,CAAC;IAED,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,GAAoB,EACpB,KAAgB;IAEhB,IAAI,GAAG,CAAC,YAAY,EAAE,CAAC;QACrB,sFAAsF;QACtF,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC;QACjD,OAAO,GAAG,QAAQ,IAAI,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;IACxD,CAAC;IACD,OAAO,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;AAC5C,CAAC"}

package/dist/state.d.ts

@@ -0,0 +1,56 @@
+/**
+ * Global state management (in-memory)
+ */
+import type { RunState, CallState, GlobalStats, SourceKey, FirewallConfig, PrecheckResult } from "./types.js";
+import { Breaker } from "./breaker.js";
+export declare class FirewallState {
+    readonly config: FirewallConfig;
+    readonly breaker: Breaker;
+    readonly globalStats: GlobalStats;
+    private runs;
+    private sourceStats;
+    private today;
+    private cleanupTimer;
+    private static readonly MAX_RUNS;
+    private static readonly CLEANUP_INTERVAL_MS;
+    private static readonly RUN_EXPIRY_MS;
+    private checkDayReset;
+    constructor(config?: Partial<FirewallConfig>);
+    private startCleanupTimer;
+    /**
+     * Purge runs older than RUN_EXPIRY_MS and enforce maxSize limit
+     */
+    private purgeOldRuns;
+    /**
+     * Stop cleanup timer (for graceful shutdown)
+     */
+    stopCleanupTimer(): void;
+    getRun(runId: string): RunState | undefined;
+    getOrCreateRun(runId: string, source: SourceKey, sessionId?: string, sessionKey?: string): RunState;
+    addCallToRun(runId: string, callId: string, call: CallState): void;
+    updateRunCost(runId: string, cost: number): void;
+    updateSourceStats(source: SourceKey, tokens: number): void;
+    /**
+     * Mark a run for cleanup (actual deletion happens via scheduled purgeOldRuns)
+     * This method is kept for compatibility with existing callers
+     */
+    cleanupRun(runId: string): void;
+    setEmergencyStop(enabled: boolean): void;
+    setMode(mode: "observe" | "protect"): void;
+    isLimitExceeded(): boolean;
+    /**
+     * Unified precheck for hook and provider layers
+     * Returns { allow: true } if all checks pass, otherwise { allow: false, reason, layer }
+     */
+    precheck(source: SourceKey): PrecheckResult;
+    getTodayTokens(): number;
+    /** Active run summary */
+    getActiveRuns(): {
+        runId: string;
+        source: string;
+        calls: number;
+        tokens: number;
+        status: string;
+    }[];
+}
+//# sourceMappingURL=state.d.ts.map

package/dist/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,EACV,QAAQ,EACR,SAAS,EACT,WAAW,EACX,SAAS,EACT,cAAc,EACd,cAAc,EACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAGvC,qBAAa,aAAa;IACxB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC;IAClC,OAAO,CAAC,IAAI,CAA+B;IAC3C,OAAO,CAAC,WAAW,CAAiD;IACpE,OAAO,CAAC,KAAK,CAA6B;IAC1C,OAAO,CAAC,YAAY,CAA+C;IAEnE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAO;IACvC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,mBAAmB,CAAU;IACrD,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,aAAa,CAAc;IAEnD,OAAO,CAAC,aAAa;gBAUT,MAAM,GAAE,OAAO,CAAC,cAAc,CAAM;IAahD,OAAO,CAAC,iBAAiB;IAUzB;;OAEG;IACH,OAAO,CAAC,YAAY;IAqBpB;;OAEG;IACH,gBAAgB,IAAI,IAAI;IAOxB,MAAM,CAAC,KAAK,EAAE,MAAM,GAAG,QAAQ,GAAG,SAAS;IAI3C,cAAc,CACZ,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,SAAS,EACjB,SAAS,CAAC,EAAE,MAAM,EAClB,UAAU,CAAC,EAAE,MAAM,GAClB,QAAQ;IAkBX,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,GAAG,IAAI;IAOlE,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI;IAOhD,iBAAiB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,GAAG,IAAI;IAS1D;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAQ/B,gBAAgB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI;IAIxC,OAAO,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,IAAI;IAI1C,eAAe,IAAI,OAAO;IAK1B;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,cAAc;IAsB3C,cAAc,IAAI,MAAM;IAIxB,yBAAyB;IACzB,aAAa,IAAI;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE;CAcpG"}

package/dist/state.js

@@ -0,0 +1,178 @@
+/**
+ * Global state management (in-memory)
+ */
+import { Breaker } from "./breaker.js";
+import { resolveConfig } from "./config.js";
+export class FirewallState {
+    config;
+    breaker;
+    globalStats;
+    runs = new Map();
+    sourceStats = new Map();
+    today = new Date().toDateString();
+    cleanupTimer = null;
+    static MAX_RUNS = 100;
+    static CLEANUP_INTERVAL_MS = 10_000;
+    static RUN_EXPIRY_MS = 5 * 60_000; // 5 minutes
+    checkDayReset() {
+        const now = new Date().toDateString();
+        if (now !== this.today) {
+            this.today = now;
+            this.globalStats.todayTokens = 0;
+            this.globalStats.todayBlocked = 0;
+            this.sourceStats.clear();
+        }
+    }
+    constructor(config = {}) {
+        this.config = resolveConfig(config);
+        this.breaker = new Breaker(this.config);
+        this.globalStats = {
+            emergencyStop: false,
+            mode: "observe",
+            todayTokens: 0,
+            todayBlocked: 0,
+            todaySavedEstimate: 0,
+        };
+        this.startCleanupTimer();
+    }
+    startCleanupTimer() {
+        this.cleanupTimer = setInterval(() => {
+            this.purgeOldRuns();
+        }, FirewallState.CLEANUP_INTERVAL_MS);
+        if (this.cleanupTimer.unref) {
+            this.cleanupTimer.unref();
+        }
+    }
+    /**
+     * Purge runs older than RUN_EXPIRY_MS and enforce maxSize limit
+     */
+    purgeOldRuns() {
+        const now = Date.now();
+        // Delete runs older than 5 minutes
+        for (const [runId, run] of this.runs) {
+            if (now - run.startedAt > FirewallState.RUN_EXPIRY_MS) {
+                this.runs.delete(runId);
+            }
+        }
+        // Enforce maxSize limit: delete oldest runs if exceeds limit
+        if (this.runs.size > FirewallState.MAX_RUNS) {
+            const sortedRuns = [...this.runs.entries()]
+                .sort((a, b) => a[1].startedAt - b[1].startedAt);
+            const toDelete = sortedRuns.slice(0, this.runs.size - FirewallState.MAX_RUNS);
+            for (const [runId] of toDelete) {
+                this.runs.delete(runId);
+            }
+        }
+    }
+    /**
+     * Stop cleanup timer (for graceful shutdown)
+     */
+    stopCleanupTimer() {
+        if (this.cleanupTimer) {
+            clearInterval(this.cleanupTimer);
+            this.cleanupTimer = null;
+        }
+    }
+    getRun(runId) {
+        return this.runs.get(runId);
+    }
+    getOrCreateRun(runId, source, sessionId, sessionKey) {
+        if (!this.runs.has(runId)) {
+            this.runs.set(runId, {
+                runId,
+                sessionId,
+                sessionKey,
+                source,
+                startedAt: Date.now(),
+                calls: new Map(),
+                llmCallTimestamps: [],
+                cumulativeCost: 0,
+                promptHashCounts: new Map(),
+                status: "healthy",
+            });
+        }
+        return this.runs.get(runId);
+    }
+    addCallToRun(runId, callId, call) {
+        const run = this.runs.get(runId);
+        if (run) {
+            run.calls.set(callId, call);
+        }
+    }
+    updateRunCost(runId, cost) {
+        const run = this.runs.get(runId);
+        if (run) {
+            run.cumulativeCost += cost;
+        }
+    }
+    updateSourceStats(source, tokens) {
+        this.checkDayReset();
+        if (!this.sourceStats.has(source)) {
+            this.sourceStats.set(source, { todayTokens: 0 });
+        }
+        this.sourceStats.get(source).todayTokens += tokens;
+        this.globalStats.todayTokens += tokens;
+    }
+    /**
+     * Mark a run for cleanup (actual deletion happens via scheduled purgeOldRuns)
+     * This method is kept for compatibility with existing callers
+     */
+    cleanupRun(runId) {
+        // No immediate deletion - scheduled cleanup will handle it
+        // Optionally force delete if runs exceeds maxSize
+        if (this.runs.size > FirewallState.MAX_RUNS) {
+            this.runs.delete(runId);
+        }
+    }
+    setEmergencyStop(enabled) {
+        this.globalStats.emergencyStop = enabled;
+    }
+    setMode(mode) {
+        this.globalStats.mode = mode;
+    }
+    isLimitExceeded() {
+        if (this.config.dailyTokenLimit == null)
+            return false;
+        return this.globalStats.todayTokens >= this.config.dailyTokenLimit;
+    }
+    /**
+     * Unified precheck for hook and provider layers
+     * Returns { allow: true } if all checks pass, otherwise { allow: false, reason, layer }
+     */
+    precheck(source) {
+        // Emergency stop is a global override - always blocks regardless of mode
+        if (this.globalStats.emergencyStop) {
+            return { allow: false, reason: "emergency_stop", layer: "hook" };
+        }
+        // Observe mode bypasses all other checks
+        if (this.globalStats.mode === "observe") {
+            return { allow: true, layer: "hook" };
+        }
+        if (this.isLimitExceeded()) {
+            return { allow: false, reason: "daily_token_limit", layer: "hook" };
+        }
+        if (this.breaker.isCoolingDown(source)) {
+            return { allow: false, reason: this.breaker.getBlockedReason(source) ?? "source_cooldown", layer: "provider" };
+        }
+        return { allow: true, layer: "hook" };
+    }
+    getTodayTokens() {
+        return this.globalStats.todayTokens;
+    }
+    /** Active run summary */
+    getActiveRuns() {
+        const result = [];
+        for (const [id, run] of this.runs) {
+            result.push({
+                runId: id,
+                source: run.source,
+                calls: run.calls.size,
+                tokens: run.cumulativeCost,
+                status: run.status,
+                reason: run.reason,
+            });
+        }
+        return result;
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../src/state.ts"],"names":[],"mappings":"AAAA;;GAEG;AAUH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,MAAM,OAAO,aAAa;IACf,MAAM,CAAiB;IACvB,OAAO,CAAU;IACjB,WAAW,CAAc;IAC1B,IAAI,GAAG,IAAI,GAAG,EAAoB,CAAC;IACnC,WAAW,GAAG,IAAI,GAAG,EAAsC,CAAC;IAC5D,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;IAClC,YAAY,GAA0C,IAAI,CAAC;IAE3D,MAAM,CAAU,QAAQ,GAAG,GAAG,CAAC;IAC/B,MAAM,CAAU,mBAAmB,GAAG,MAAM,CAAC;IAC7C,MAAM,CAAU,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,YAAY;IAExD,aAAa;QACnB,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,YAAY,EAAE,CAAC;QACtC,IAAI,GAAG,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC;YACjB,IAAI,CAAC,WAAW,CAAC,WAAW,GAAG,CAAC,CAAC;YACjC,IAAI,CAAC,WAAW,CAAC,YAAY,GAAG,CAAC,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,YAAY,SAAkC,EAAE;QAC9C,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,CAAC,WAAW,GAAG;YACjB,aAAa,EAAE,KAAK;YACpB,IAAI,EAAE,SAAS;YACf,WAAW,EAAE,CAAC;YACd,YAAY,EAAE,CAAC;YACf,kBAAkB,EAAE,CAAC;SACtB,CAAC;QACF,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAEO,iBAAiB;QACvB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;YACnC,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;QAEtC,IAAI,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;YAC5B,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE,CAAC;QAC5B,CAAC;IACH,CAAC;IAED;;OAEG;IACK,YAAY;QAClB,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,mCAAmC;QACnC,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACrC,IAAI,GAAG,GAAG,GAAG,CAAC,SAAS,GAAG,aAAa,CAAC,aAAa,EAAE,CAAC;gBACtD,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;QAED,6DAA6D;QAC7D,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5C,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;iBACxC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;YACnD,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;YAC9E,KAAK,MAAM,CAAC,KAAK,CAAC,IAAI,QAAQ,EAAE,CAAC;gBAC/B,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB;QACd,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACjC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAC3B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,cAAc,CACZ,KAAa,EACb,MAAiB,EACjB,SAAkB,EAClB,UAAmB;QAEnB,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE;gBACnB,KAAK;gBACL,SAAS;gBACT,UAAU;gBACV,MAAM;gBACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;gBACrB,KAAK,EAAE,IAAI,GAAG,EAAE;gBAChB,iBAAiB,EAAE,EAAE;gBACrB,cAAc,EAAE,CAAC;gBACjB,gBAAgB,EAAE,IAAI,GAAG,EAAE;gBAC3B,MAAM,EAAE,SAAS;aAClB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAE,CAAC;IAC/B,CAAC;IAED,YAAY,CAAC,KAAa,EAAE,MAAc,EAAE,IAAe;QACzD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,IAAY;QACvC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QACjC,IAAI,GAAG,EAAE,CAAC;YACR,GAAG,CAAC,cAAc,IAAI,IAAI,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,MAAiB,EAAE,MAAc;QACjD,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAClC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,CAAC;QACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAE,CAAC,WAAW,IAAI,MAAM,CAAC;QACpD,IAAI,CAAC,WAAW,CAAC,WAAW,IAAI,MAAM,CAAC;IACzC,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,KAAa;QACtB,2DAA2D;QAC3D,kDAAkD;QAClD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,GAAG,aAAa,CAAC,QAAQ,EAAE,CAAC;YAC5C,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC;IAED,gBAAgB,CAAC,OAAgB;QAC/B,IAAI,CAAC,WAAW,CAAC,aAAa,GAAG,OAAO,CAAC;IAC3C,CAAC;IAED,OAAO,CAAC,IAA2B;QACjC,IAAI,CAAC,WAAW,CAAC,IAAI,GAAG,IAAI,CAAC;IAC/B,CAAC;IAED,eAAe;QACb,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,IAAI,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC;IACrE,CAAC;IAED;;;OAGG;IACH,QAAQ,CAAC,MAAiB;QACxB,yEAAyE;QACzE,IAAI,IAAI,CAAC,WAAW,CAAC,aAAa,EAAE,CAAC;YACnC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACnE,CAAC;QAED,yCAAyC;QACzC,IAAI,IAAI,CAAC,WAAW,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACxC,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QAED,IAAI,IAAI,CAAC,eAAe,EAAE,EAAE,CAAC;YAC3B,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACtE,CAAC;QAED,IAAI,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YACvC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,MAAM,CAAC,IAAI,iBAAiB,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QACjH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAED,cAAc;QACZ,OAAO,IAAI,CAAC,WAAW,CAAC,WAAW,CAAC;IACtC,CAAC;IAED,yBAAyB;IACzB,aAAa;QACX,MAAM,MAAM,GAAU,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,EAAE,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC;gBACV,KAAK,EAAE,EAAE;gBACT,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,IAAI;gBACrB,MAAM,EAAE,GAAG,CAAC,cAAc;gBAC1B,MAAM,EAAE,GAAG,CAAC,MAAM;gBAClB,MAAM,EAAE,GAAG,CAAC,MAAM;aACnB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC"}

package/dist/store.d.ts

@@ -0,0 +1,23 @@
+/**
+ * JSONL event storage (async, non-blocking hook)
+ */
+import type { FirewallEvent } from "./types.js";
+export type { FirewallEvent };
+export declare class EventStore {
+    private buffer;
+    private flushTimer;
+    private dirReady;
+    constructor();
+    private ensureDir;
+    append(event: Omit<FirewallEvent, "timestamp">): void;
+    private startFlushTimer;
+    /**
+     * Flush buffer to disk (synchronous, copy-and-replace pattern)
+     * This prevents concurrent flushes from double-writing or interleaving events
+     */
+    flush(): void;
+    close(): Promise<void>;
+    getStateDir(): string;
+    getEventsFilePath(): string;
+}
+//# sourceMappingURL=store.d.ts.map

package/dist/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAKH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhD,YAAY,EAAE,aAAa,EAAE,CAAC;AAQ9B,qBAAa,UAAU;IACrB,OAAO,CAAC,MAAM,CAAuB;IACrC,OAAO,CAAC,UAAU,CAA+C;IACjE,OAAO,CAAC,QAAQ,CAAS;;IAMzB,OAAO,CAAC,SAAS;IAMjB,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,aAAa,EAAE,WAAW,CAAC,GAAG,IAAI;IAQrD,OAAO,CAAC,eAAe;IAUvB;;;OAGG;IACH,KAAK,IAAI,IAAI;IAYP,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAQ5B,WAAW,IAAI,MAAM;IAIrB,iBAAiB,IAAI,MAAM;CAG5B"}

package/dist/store.js

@@ -0,0 +1,68 @@
+/**
+ * JSONL event storage (async, non-blocking hook)
+ */
+import { writeFileSync, mkdirSync } from "node:fs";
+import { join } from "node:path";
+import { homedir } from "node:os";
+const FLUSH_INTERVAL_MS = 1000;
+const STATE_DIR = process.env.OPENCLAW_STATE_DIR
+    ? join(process.env.OPENCLAW_STATE_DIR, "plugins", "mapick-firewall")
+    : join(homedir(), ".openclaw", "plugins", "mapick-firewall");
+const EVENTS_FILE = join(STATE_DIR, "events.jsonl");
+export class EventStore {
+    buffer = [];
+    flushTimer = null;
+    dirReady = false;
+    constructor() {
+        this.startFlushTimer();
+    }
+    ensureDir() {
+        if (this.dirReady)
+            return;
+        mkdirSync(STATE_DIR, { recursive: true });
+        this.dirReady = true;
+    }
+    append(event) {
+        const fullEvent = {
+            ...event,
+            timestamp: Date.now(),
+        };
+        this.buffer.push(fullEvent);
+    }
+    startFlushTimer() {
+        this.flushTimer = setInterval(() => {
+            this.flush();
+        }, FLUSH_INTERVAL_MS);
+        if (this.flushTimer.unref) {
+            this.flushTimer.unref();
+        }
+    }
+    /**
+     * Flush buffer to disk (synchronous, copy-and-replace pattern)
+     * This prevents concurrent flushes from double-writing or interleaving events
+     */
+    flush() {
+        if (this.buffer.length === 0)
+            return;
+        // Copy-and-replace: grab current buffer and clear it atomically
+        const batch = this.buffer;
+        this.buffer = [];
+        this.ensureDir();
+        const lines = batch.map((e) => JSON.stringify(e)).join("\n") + "\n";
+        writeFileSync(EVENTS_FILE, lines, "utf-8");
+    }
+    async close() {
+        if (this.flushTimer) {
+            clearInterval(this.flushTimer);
+            this.flushTimer = null;
+        }
+        this.flush();
+    }
+    getStateDir() {
+        return STATE_DIR;
+    }
+    getEventsFilePath() {
+        return EVENTS_FILE;
+    }
+}
+//# sourceMappingURL=store.js.map

package/dist/store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAKlC,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB;IAC9C,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,SAAS,EAAE,iBAAiB,CAAC;IACpE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE,iBAAiB,CAAC,CAAC;AAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;AAEpD,MAAM,OAAO,UAAU;IACb,MAAM,GAAoB,EAAE,CAAC;IAC7B,UAAU,GAA0C,IAAI,CAAC;IACzD,QAAQ,GAAG,KAAK,CAAC;IAEzB;QACE,IAAI,CAAC,eAAe,EAAE,CAAC;IACzB,CAAC;IAEO,SAAS;QACf,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO;QAC1B,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC;IACvB,CAAC;IAED,MAAM,CAAC,KAAuC;QAC5C,MAAM,SAAS,GAAkB;YAC/B,GAAG,KAAK;YACR,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;SACtB,CAAC;QACF,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IAC9B,CAAC;IAEO,eAAe;QACrB,IAAI,CAAC,UAAU,GAAG,WAAW,CAAC,GAAG,EAAE;YACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACf,CAAC,EAAE,iBAAiB,CAAC,CAAC;QAEtB,IAAI,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QAC1B,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK;QACH,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO;QAErC,gEAAgE;QAChE,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC;QAEjB,IAAI,CAAC,SAAS,EAAE,CAAC;QACjB,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACpE,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAC7C,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;YACpB,aAAa,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,KAAK,EAAE,CAAC;IACf,CAAC;IAED,WAAW;QACT,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,iBAAiB;QACf,OAAO,WAAW,CAAC;IACrB,CAAC;CACF"}

package/dist/tools/index.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Agent Tools registration — users control Cost Firewall via conversation
+ *
+ * Usage:
+ *   /firewall status  → view status
+ *   /firewall stop    → emergency breaker
+ *   /firewall resume  → resume
+ *   /firewall log     → view recent events
+ */
+import type { FirewallState } from "../state.js";
+import type { EventStore } from "../store.js";
+export declare function registerTools(api: any, state: FirewallState, store: EventStore): void;
+//# sourceMappingURL=index.d.ts.map

package/dist/tools/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/tools/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAG9C,wBAAgB,aAAa,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI,CA+CrF"}