@senpi/runtime 1.1.0-dev.runtime-phase-2.20260527113015 → 1.1.1-dev.runtime-phase-2.20260604073249

package/dist/tracking/pending-open-store.js

@@ -0,0 +1,27 @@
+/** State key (→ `{baseDir}/pending-opens.json`). */
+const PENDING_KEY = "pending-opens";
+export class StateManagerPendingStore {
+    state;
+    constructor(state) {
+        this.state = state;
+    }
+    async load() {
+        return (await this.state.getOrLoad(PENDING_KEY)) ?? {};
+    }
+    async put(record) {
+        const map = await this.load();
+        map[record.key] = record;
+        await this.state.set(PENDING_KEY, map);
+    }
+    async delete(key) {
+        const map = await this.load();
+        if (key in map) {
+            delete map[key];
+            await this.state.set(PENDING_KEY, map);
+        }
+    }
+    async list() {
+        return Object.values(await this.load());
+    }
+}
+//# sourceMappingURL=pending-open-store.js.map

package/dist/tracking/pending-open-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pending-open-store.js","sourceRoot":"","sources":["../../src/tracking/pending-open-store.ts"],"names":[],"mappings":"AAWA,oDAAoD;AACpD,MAAM,WAAW,GAAG,eAAe,CAAC;AAIpC,MAAM,OAAO,wBAAwB;IACN;IAA7B,YAA6B,KAAmB;QAAnB,UAAK,GAAL,KAAK,CAAc;IAAG,CAAC;IAE5C,KAAK,CAAC,IAAI;QAChB,OAAO,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,SAAS,CAAa,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,MAAqB;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,GAAW;QACtB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC9B,IAAI,GAAG,IAAI,GAAG,EAAE,CAAC;YACf,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;YAChB,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,KAAK,CAAC,IAAI;QACR,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC;CACF"}

package/dist/tracking/position-id-registry.d.ts

@@ -0,0 +1,91 @@
+/**
+ * Build the registry key for a position. Normalizes dex the same way the
+ * position-tracker scanner's buildPositionKey does (empty/whitespace → "main"),
+ * scoped by wallet so the map is correct under multi-wallet deployment.
+ */
+export declare function positionRegistryKey(wallet: string, dex: string, asset: string): string;
+/** A client-order-id role. Entry/SL/TP are set at open; close accrues over the position's life. */
+export type CloidRole = "entry" | "sl" | "tp" | "close";
+/** The set of cloids associated with one position. */
+export interface Cloids {
+    entry?: string;
+    sl?: string;
+    tp?: string;
+    close?: string[];
+}
+export interface Entry {
+    positionId: string;
+    cloids: Cloids;
+}
+/** A pending-open record persisted between intent-mint and confirmed open. */
+export interface PendingRecord {
+    key: string;
+    /** The position.id minted at intent; reused (not re-minted) on confirmed open. */
+    positionId: string;
+    cloids: Cloids;
+    ts: number;
+}
+/** Durable store for pending-open records (so a restart in the open window keeps the cloids). */
+export interface PendingStore {
+    put(record: PendingRecord): Promise<void>;
+    delete(key: string): Promise<void>;
+    list(): Promise<PendingRecord[]>;
+}
+/** One unit of boot-time state to restore: a minted entry, a pending record, or both. */
+export interface RehydrateItem {
+    key: string;
+    entry?: Entry;
+    pending?: {
+        positionId: string;
+        cloids: Cloids;
+        ts: number;
+    };
+}
+export interface PositionIdRegistryOptions {
+    store?: PendingStore;
+    now?: () => number;
+}
+export declare class PositionIdRegistry {
+    private readonly entries;
+    /** Positions minted at intent, awaiting a confirmed open. */
+    private readonly pending;
+    private readonly store?;
+    private readonly now;
+    constructor(opts?: PositionIdRegistryOptions);
+    /**
+     * Mint a position.id at the moment the runtime decides to open, before the position
+     * is confirmed open. The id is returned immediately so callers can stamp it on the
+     * `action.open` emit. Idempotent: a re-submit (or an already-confirmed entry) reuses
+     * the existing id rather than minting a new one. Persisted so a restart in the
+     * submit→observe window keeps the id; promoted by the next {@link mintOnOpened}.
+     *
+     * If the open was already confirmed (e.g. the position tracker observed it before
+     * createPosition called this), the newly-supplied cloids are still merged into the
+     * confirmed entry — otherwise the exchange-returned entry cloid would be dropped and
+     * ON_OPEN_ORDER_SUBMITTED would omit __cloids.entry. New keys win; absent keys leave
+     * any existing confirmed cloid intact.
+     */
+    mintOnIntent(key: string, cloids?: Cloids): Promise<Entry>;
+    /**
+     * Confirm the open. Idempotent: if a confirmed entry already exists it is returned.
+     * If the position was minted at intent, that id is promoted (reused, never re-minted)
+     * and the pending record dropped. Otherwise — an externally-opened position with no
+     * prior runtime intent — a fresh id is minted.
+     */
+    mintOnOpened(key: string): Promise<Entry>;
+    /** Associate another cloid with a position (e.g. a DSL/runtime close order). */
+    addCloid(key: string, role: CloidRole, cloid: string): Promise<void>;
+    /**
+     * Read the current entry for a key (INCREASED/DECREASED/FLIPPED, DSL start). Surfaces
+     * an intent-mint that has not yet been confirmed open, so reads in the open window
+     * still resolve the position.id.
+     */
+    get(key: string): Entry | undefined;
+    /** Clear on confirmed close. The next open on this key mints a fresh id. */
+    clearOnClosed(key: string): Promise<void>;
+    /** Repopulate in-memory state at boot from persisted DSL entries + pending records. */
+    rehydrate(items: RehydrateItem[]): void;
+    /** Drop pending records older than maxAgeMs (orders that were submitted but never filled). */
+    sweepStalePendings(maxAgeMs: number): Promise<void>;
+}
+//# sourceMappingURL=position-id-registry.d.ts.map

package/dist/tracking/position-id-registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"position-id-registry.d.ts","sourceRoot":"","sources":["../../src/tracking/position-id-registry.ts"],"names":[],"mappings":"AAuBA;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGtF;AAED,mGAAmG;AACnG,MAAM,MAAM,SAAS,GAAG,OAAO,GAAG,IAAI,GAAG,IAAI,GAAG,OAAO,CAAC;AAExD,sDAAsD;AACtD,MAAM,WAAW,MAAM;IACrB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,KAAK;IACpB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8EAA8E;AAC9E,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,kFAAkF;IAClF,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,iGAAiG;AACjG,MAAM,WAAW,YAAY;IAC3B,GAAG,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1C,MAAM,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,IAAI,IAAI,OAAO,CAAC,aAAa,EAAE,CAAC,CAAC;CAClC;AAED,yFAAyF;AACzF,MAAM,WAAW,aAAa;IAC5B,GAAG,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,OAAO,CAAC,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,CAAC;CAC9D;AAED,MAAM,WAAW,yBAAyB;IACxC,KAAK,CAAC,EAAE,YAAY,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACpB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA4B;IACpD,6DAA6D;IAC7D,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyE;IACjG,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAe;IACtC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;gBAEvB,IAAI,GAAE,yBAA8B;IAKhD;;;;;;;;;;;;OAYG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,GAAE,MAAW,GAAG,OAAO,CAAC,KAAK,CAAC;IAgBpE;;;;;OAKG;IACG,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC;IAa/C,gFAAgF;IAC1E,QAAQ,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgB1E;;;;OAIG;IACH,GAAG,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS;IAOnC,4EAA4E;IACtE,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAM/C,uFAAuF;IACvF,SAAS,CAAC,KAAK,EAAE,aAAa,EAAE,GAAG,IAAI;IAavC,8FAA8F;IACxF,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAS1D"}

package/dist/tracking/position-id-registry.js

@@ -0,0 +1,149 @@
+/**
+ * PositionIdRegistry: cross-flow position.id state machine.
+ *
+ * Sibling of the intra-flow correlation_id in src/tracking/context.ts. Keyed on
+ * (wallet, dex, asset).
+ *
+ * **Mint-at-intent.** A stable position.id is minted the moment the runtime decides to
+ * open ({@link mintOnIntent}), so it is already on the `action.open` emit — the open
+ * trace correlates by position.id directly, with no read-side cloid bridge, and even a
+ * sub-minute open+close (which the tracker poll never observes) still has a lifecycle.
+ *
+ * Two internal phases:
+ *  - `pending` — minted at intent, awaiting a confirmed open. Stale-swept if the order
+ *    never fills ({@link sweepStalePendings}), persisted so a restart in the
+ *    submit→observe window keeps the id.
+ *  - `entries` — confirmed open. Reused for INCREASED/DECREASED/FLIPPED and DSL reads;
+ *    cleared on POSITION_CLOSED. Never stale-swept.
+ *
+ * {@link mintOnOpened} promotes a pending intent-mint to a confirmed entry (reusing the
+ * id), or mints fresh for an externally-opened position with no prior intent.
+ */
+import { randomUUID } from "node:crypto";
+/**
+ * Build the registry key for a position. Normalizes dex the same way the
+ * position-tracker scanner's buildPositionKey does (empty/whitespace → "main"),
+ * scoped by wallet so the map is correct under multi-wallet deployment.
+ */
+export function positionRegistryKey(wallet, dex, asset) {
+    const normalizedDex = dex.trim() || "main";
+    return `${wallet}|${normalizedDex}:${asset}`;
+}
+export class PositionIdRegistry {
+    entries = new Map();
+    /** Positions minted at intent, awaiting a confirmed open. */
+    pending = new Map();
+    store;
+    now;
+    constructor(opts = {}) {
+        this.store = opts.store;
+        this.now = opts.now ?? Date.now;
+    }
+    /**
+     * Mint a position.id at the moment the runtime decides to open, before the position
+     * is confirmed open. The id is returned immediately so callers can stamp it on the
+     * `action.open` emit. Idempotent: a re-submit (or an already-confirmed entry) reuses
+     * the existing id rather than minting a new one. Persisted so a restart in the
+     * submit→observe window keeps the id; promoted by the next {@link mintOnOpened}.
+     *
+     * If the open was already confirmed (e.g. the position tracker observed it before
+     * createPosition called this), the newly-supplied cloids are still merged into the
+     * confirmed entry — otherwise the exchange-returned entry cloid would be dropped and
+     * ON_OPEN_ORDER_SUBMITTED would omit __cloids.entry. New keys win; absent keys leave
+     * any existing confirmed cloid intact.
+     */
+    async mintOnIntent(key, cloids = {}) {
+        const confirmed = this.entries.get(key);
+        if (confirmed) {
+            confirmed.cloids = { ...confirmed.cloids, ...cloids };
+            return confirmed;
+        }
+        const ts = this.now();
+        const existing = this.pending.get(key);
+        const positionId = existing?.positionId ?? randomUUID();
+        const merged = { ...existing?.cloids, ...cloids };
+        this.pending.set(key, { positionId, cloids: merged, ts });
+        await this.store?.put({ key, positionId, cloids: { ...merged }, ts });
+        return { positionId, cloids: merged };
+    }
+    /**
+     * Confirm the open. Idempotent: if a confirmed entry already exists it is returned.
+     * If the position was minted at intent, that id is promoted (reused, never re-minted)
+     * and the pending record dropped. Otherwise — an externally-opened position with no
+     * prior runtime intent — a fresh id is minted.
+     */
+    async mintOnOpened(key) {
+        const existing = this.entries.get(key);
+        if (existing)
+            return existing;
+        const pending = this.pending.get(key);
+        const entry = pending
+            ? { positionId: pending.positionId, cloids: pending.cloids }
+            : { positionId: randomUUID(), cloids: {} };
+        this.entries.set(key, entry);
+        this.pending.delete(key);
+        await this.store?.delete(key);
+        return entry;
+    }
+    /** Associate another cloid with a position (e.g. a DSL/runtime close order). */
+    async addCloid(key, role, cloid) {
+        const confirmed = this.entries.get(key);
+        const cloids = confirmed?.cloids ?? this.pending.get(key)?.cloids;
+        if (!cloids)
+            return;
+        if (role === "close") {
+            (cloids.close ??= []).push(cloid);
+        }
+        else {
+            cloids[role] = cloid;
+        }
+        // Re-persist while still pending so a restart keeps the added cloid.
+        if (!confirmed) {
+            const p = this.pending.get(key);
+            await this.store?.put({ key, positionId: p.positionId, cloids: { ...p.cloids }, ts: p.ts });
+        }
+    }
+    /**
+     * Read the current entry for a key (INCREASED/DECREASED/FLIPPED, DSL start). Surfaces
+     * an intent-mint that has not yet been confirmed open, so reads in the open window
+     * still resolve the position.id.
+     */
+    get(key) {
+        const confirmed = this.entries.get(key);
+        if (confirmed)
+            return confirmed;
+        const pending = this.pending.get(key);
+        return pending ? { positionId: pending.positionId, cloids: pending.cloids } : undefined;
+    }
+    /** Clear on confirmed close. The next open on this key mints a fresh id. */
+    async clearOnClosed(key) {
+        this.entries.delete(key);
+        this.pending.delete(key);
+        await this.store?.delete(key);
+    }
+    /** Repopulate in-memory state at boot from persisted DSL entries + pending records. */
+    rehydrate(items) {
+        for (const item of items) {
+            if (item.entry)
+                this.entries.set(item.key, item.entry);
+            if (item.pending) {
+                this.pending.set(item.key, {
+                    positionId: item.pending.positionId,
+                    cloids: item.pending.cloids,
+                    ts: item.pending.ts,
+                });
+            }
+        }
+    }
+    /** Drop pending records older than maxAgeMs (orders that were submitted but never filled). */
+    async sweepStalePendings(maxAgeMs) {
+        const cutoff = this.now() - maxAgeMs;
+        for (const [key, rec] of this.pending) {
+            if (rec.ts < cutoff) {
+                this.pending.delete(key);
+                await this.store?.delete(key);
+            }
+        }
+    }
+}
+//# sourceMappingURL=position-id-registry.js.map

package/dist/tracking/position-id-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"position-id-registry.js","sourceRoot":"","sources":["../../src/tracking/position-id-registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,GAAW,EAAE,KAAa;IAC5E,MAAM,aAAa,GAAG,GAAG,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC;IAC3C,OAAO,GAAG,MAAM,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;AAC/C,CAAC;AA8CD,MAAM,OAAO,kBAAkB;IACZ,OAAO,GAAG,IAAI,GAAG,EAAiB,CAAC;IACpD,6DAA6D;IAC5C,OAAO,GAAG,IAAI,GAAG,EAA8D,CAAC;IAChF,KAAK,CAAgB;IACrB,GAAG,CAAe;IAEnC,YAAY,OAAkC,EAAE;QAC9C,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACxB,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW,EAAE,SAAiB,EAAE;QACjD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS,EAAE,CAAC;YACd,SAAS,CAAC,MAAM,GAAG,EAAE,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;YACtD,OAAO,SAAS,CAAC;QACnB,CAAC;QAED,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,MAAM,UAAU,GAAG,QAAQ,EAAE,UAAU,IAAI,UAAU,EAAE,CAAC;QACxD,MAAM,MAAM,GAAW,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,EAAE,CAAC;QAC1D,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QAC1D,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;QACtE,OAAO,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IACxC,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,YAAY,CAAC,GAAW;QAC5B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACvC,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,KAAK,GAAU,OAAO;YAC1B,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE;YAC5D,CAAC,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;QAC9B,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,QAAQ,CAAC,GAAW,EAAE,IAAe,EAAE,KAAa;QACxD,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,MAAM,MAAM,GAAG,SAAS,EAAE,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC;QAClE,IAAI,CAAC,MAAM;YAAE,OAAO;QACpB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACrB,CAAC,MAAM,CAAC,KAAK,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,qEAAqE;QACrE,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YACjC,MAAM,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,UAAU,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,GAAG,CAAC,GAAW;QACb,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,SAAS;YAAE,OAAO,SAAS,CAAC;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1F,CAAC;IAED,4EAA4E;IAC5E,KAAK,CAAC,aAAa,CAAC,GAAW;QAC7B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;IAChC,CAAC;IAED,uFAAuF;IACvF,SAAS,CAAC,KAAsB;QAC9B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,KAAK;gBAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;YACvD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE;oBACzB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;oBACnC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM;oBAC3B,EAAE,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE;iBACpB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAED,8FAA8F;IAC9F,KAAK,CAAC,kBAAkB,CAAC,QAAgB;QACvC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,CAAC;QACrC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACtC,IAAI,GAAG,CAAC,EAAE,GAAG,MAAM,EAAE,CAAC;gBACpB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACzB,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;CACF"}

package/dist/tracking/spans/plugin-span-tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-span-tracker.d.ts","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAIhD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,WAAW,CAWb"}
+{"version":3,"file":"plugin-span-tracker.d.ts","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAWA,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AA8BhD,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,GAAG,SAAS,GACzB,WAAW,CAYb"}

package/dist/tracking/spans/plugin-span-tracker.js

@@ -10,8 +10,26 @@ import { createLogger } from "../../utils/logger.js";
 import { TRACKING_API_BASE_URL } from "../constants.js";
 import { BatchingSpanTransport, NoOpSpanTransport } from "./span-transport.js";
 import { SpanTracker } from "./span-tracker.js";
+import { createOpenRedactionAdapter, setDefaultPiiRedactor, } from "./redact-pii.js";
 const logger = createLogger("[senpi-core][plugin-span-tracker]");
+/**
+ * Initialize the process-wide default PII redactor at plugin startup.
+ *
+ * Fire-and-forget. Failures are logged; spans continue flowing unredacted
+ * rather than blocking startup.
+ */
+function initPiiRedactor() {
+    createOpenRedactionAdapter()
+        .then((redactor) => {
+        setDefaultPiiRedactor(redactor);
+        logger.info("PII redaction enabled — spans will be scrubbed for emails, international phones (US/IN/CN/KR/JP/UK/BR/+intl), vendor API keys, EVM private keys, and BIP39 mnemonics before transport");
+    })
+        .catch((err) => {
+        logger.warn("PII redaction init failed — spans will flow UNredacted; check openredaction install", { err: err instanceof Error ? err.message : String(err) });
+    });
+}
 export function createPluginSpanTracker(apiKey) {
+    initPiiRedactor();
     const trackingBaseUrl = process.env.SENPI_TRACKING_URL ?? TRACKING_API_BASE_URL;
     const transport = apiKey
         ? new BatchingSpanTransport({ baseUrl: trackingBaseUrl, apiKey })

package/dist/tracking/spans/plugin-span-tracker.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-span-tracker.js","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,MAAM,MAAM,GAAG,YAAY,CAAC,mCAAmC,CAAC,CAAC;AAEjE,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,CAAC,IAAI,CACT,iIAAiI,CAClI,CAAC;YACF,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACjC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACxC,CAAC"}
+{"version":3,"file":"plugin-span-tracker.js","sourceRoot":"","sources":["../../../src/tracking/spans/plugin-span-tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,qBAAqB,EAAE,MAAM,iBAAiB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAC/E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EACL,0BAA0B,EAC1B,qBAAqB,GACtB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,MAAM,GAAG,YAAY,CAAC,mCAAmC,CAAC,CAAC;AAEjE;;;;;GAKG;AACH,SAAS,eAAe;IACtB,0BAA0B,EAAE;SACzB,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE;QACjB,qBAAqB,CAAC,QAAQ,CAAC,CAAC;QAChC,MAAM,CAAC,IAAI,CACT,uLAAuL,CACxL,CAAC;IACJ,CAAC,CAAC;SACD,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,MAAM,CAAC,IAAI,CACT,qFAAqF,EACrF,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC1D,CAAC;IACJ,CAAC,CAAC,CAAC;AACP,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAA0B;IAE1B,eAAe,EAAE,CAAC;IAClB,MAAM,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,qBAAqB,CAAC;IAChF,MAAM,SAAS,GAAG,MAAM;QACtB,CAAC,CAAC,IAAI,qBAAqB,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE,CAAC;QACjE,CAAC,CAAC,CAAC,GAAG,EAAE;YACJ,MAAM,CAAC,IAAI,CACT,iIAAiI,CAClI,CAAC;YACF,OAAO,IAAI,iBAAiB,EAAE,CAAC;QACjC,CAAC,CAAC,EAAE,CAAC;IACT,OAAO,IAAI,WAAW,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC;AACxC,CAAC"}

package/dist/tracking/spans/redact-pii.d.ts

@@ -0,0 +1,115 @@
+/**
+ * PII + secret redaction for span payloads.
+ *
+ * Walks the `data` field of each span and replaces matches in string values
+ * before the batch hits the wire. Runs at flush time (async) — the underlying
+ * redactor is async, and the producer is fire-and-forget, so we pay the
+ * latency on the network-bound path rather than on the caller's enqueue call.
+ *
+ * Scope (see createOpenRedactionAdapter): emails, phones (US, international,
+ * India, China, South Korea, Japan, UK mobile, Brazil), ~28 vendor API keys
+ * / tokens (AWS, GitHub, Stripe, OpenAI, etc.), EVM private keys, Anthropic
+ * `sk-ant-*` keys, generic `sk-*` keys, and BIP39 mnemonic phrases.
+ *
+ * Integration point: BatchingSpanTransport.flush() applies this to every
+ * span in the batch before JSON.stringify. Only `span.data` is walked;
+ * top-level columns (`address`, `correlationId`, etc.) are non-PII identifiers
+ * and stay as-is.
+ *
+ * Always on — the plugin initializes a default redactor at startup.
+ */
+import type { TrackingSpan } from "./types.js";
+/** Minimal interface so tests can inject a synchronous stub. */
+export interface PiiRedactor {
+    redact(text: string): Promise<string>;
+}
+/**
+ * Walks a JSON-shaped value. Strings are run through the redactor; arrays
+ * and plain objects are recursed; everything else (number, boolean, null,
+ * non-plain objects) is returned unchanged. Preserves reference identity
+ * when nothing changes — useful for short-circuit downstream comparisons.
+ */
+export declare function redactStringsDeep(value: unknown, redactor: PiiRedactor): Promise<unknown>;
+/**
+ * Redact PII inside `span.data` only. Top-level structural fields (address,
+ * correlationId, runId, etc.) are non-PII identifiers and skipped.
+ *
+ * Returns the same span if nothing changed (avoids object allocation when no
+ * PII was found).
+ */
+export declare function redactSpanData(span: TrackingSpan, redactor: PiiRedactor): Promise<TrackingSpan>;
+export declare function setDefaultPiiRedactor(r: PiiRedactor | null): void;
+export declare function getDefaultPiiRedactor(): PiiRedactor | null;
+/**
+ * Find BIP39-mnemonic spans in `text` using a true sliding window — not
+ * a greedy regex with a post-hoc validator.
+ *
+ * Why this and not a regex+validator:
+ *   - OpenRedaction calls the validator on whatever the regex captured. JS
+ *     regex matching is left-to-right with no backtracking across `lastIndex`
+ *     advances; once a (greedy) match is rejected, the engine moves past it
+ *     entirely. So a 17-word lowercase run like "my secret is <12 BIP39>
+ *     so keep safe" gets captured whole, fails validation on word count,
+ *     and the engine doesn't retry the 12-word window starting 3 tokens in.
+ *
+ * Algorithm:
+ *   1. Tokenize lowercase-only words and their offsets (skips capitalized
+ *      words and punctuation — real mnemonics from wallet exports are
+ *      always all-lowercase space-separated).
+ *   2. Walk left to right. At each token position, try valid mnemonic
+ *      counts largest-first (24, 21, 18, 15, 12) so a 24-word phrase
+ *      inside a longer prose run isn't missed by a premature 12-match.
+ *   3. A window is valid only when every word is BIP39 AND the gap between
+ *      consecutive tokens in the source is whitespace-only (rejects forms
+ *      with commas or other punctuation between words, which real wallet
+ *      exports don't use).
+ *   4. On match, record the source span and advance past it; otherwise step
+ *      forward one token.
+ */
+export declare function findMnemonicSpans(text: string, bip39: Set<string>): Array<{
+    start: number;
+    end: number;
+}>;
+/**
+ * Pre-redact BIP39 mnemonics in `text` before handing the result to
+ * OpenRedaction. Returns the original string when no mnemonics are present
+ * (cheap path — only the tokenizer runs and finds nothing).
+ */
+export declare function redactMnemonicsPreRedaction(text: string): Promise<string>;
+/**
+ * Build an OpenRedaction-backed PiiRedactor.
+ *
+ * Detects:
+ *   - Contact PII: emails.
+ *   - Phones (all custom — upstream phone patterns are unreliable, see
+ *     ALLOWLISTED_PATTERN_TYPES docstring): US, international (`+` prefix),
+ *     India, China, South Korea, Japan, UK mobile, Brazil. Each requires
+ *     either an explicit country code OR a country-specific mobile prefix
+ *     plus separators, so bare numeric IDs (timestamps, span IDs, UUIDs)
+ *     survive untouched.
+ *   - Credentials (upstream): cloud / vendor API keys + tokens (AWS, Azure,
+ *     GCP, GitHub, Slack, Stripe, OpenAI, Twilio, …), bearer + JWT tokens,
+ *     OAuth secrets, generic API keys, SSH/PEM private keys, URLs with
+ *     embedded auth.
+ *   - Crypto secrets (custom patterns): EVM private keys (0x + 64 hex),
+ *     Anthropic `sk-ant-*` keys, generic `sk-*` keys (OpenAI/OpenRouter).
+ *   - BIP39 mnemonic phrases (out-of-band sliding-window pre-pass — see
+ *     `redactMnemonicsPreRedaction`): 12/15/18/21/24 BIP39 words, found and
+ *     redacted before the OpenRedaction pass so embedded phrases like
+ *     "my key is <12 words> keep safe" are caught.
+ *
+ * Tuning:
+ *   - `enableFalsePositiveFilter: false` — explicit; the library defaults
+ *     this to truthy in practice and suppresses valid international-phone
+ *     matches in some contexts.
+ *   - `enableContextAnalysis: false` — saves CPU; context rules add
+ *     latency and aren't load-bearing for the patterns we keep.
+ *   - `enableCache: true` — chat history repeats; cache skips re-scan.
+ *   - `confidenceThreshold: 0.5` — kept conservative; custom patterns score
+ *     1.0 so this only affects built-ins.
+ *
+ * Lazy-imports `openredaction` and `bip39` — both deps stay cold for builds
+ * / tests that don't enable redaction.
+ */
+export declare function createOpenRedactionAdapter(): Promise<PiiRedactor>;
+//# sourceMappingURL=redact-pii.d.ts.map

package/dist/tracking/spans/redact-pii.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact-pii.d.ts","sourceRoot":"","sources":["../../../src/tracking/spans/redact-pii.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAK/C,gEAAgE;AAChE,MAAM,WAAW,WAAW;IAC1B,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC;AAQD;;;;;GAKG;AACH,wBAAsB,iBAAiB,CACrC,KAAK,EAAE,OAAO,EACd,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,OAAO,CAAC,CAgClB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,YAAY,EAClB,QAAQ,EAAE,WAAW,GACpB,OAAO,CAAC,YAAY,CAAC,CAKvB;AASD,wBAAgB,qBAAqB,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,GAAG,IAAI,CAEjE;AAED,wBAAgB,qBAAqB,IAAI,WAAW,GAAG,IAAI,CAE1D;AAqOD;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,iBAAiB,CAC/B,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,GAAG,CAAC,MAAM,CAAC,GACjB,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA0CvC;AAsBD;;;;GAIG;AACH,wBAAsB,2BAA2B,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAI/E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,wBAAsB,0BAA0B,IAAI,OAAO,CAAC,WAAW,CAAC,CAkCvE"}