haechi 0.3.2 → 0.4.0

package/packages/proxy/index.mjs

@@ -54,6 +54,7 @@ export function createHaechiProxy({ runtime, port = DEFAULT_PROXY_PORT, host = "
         ? await haechi.protectJson(json, {
           ...routeContext,
           operation: `request:${routeContext.operation}`,
+          direction: "request",
           mode: config.policy.mode ?? config.mode
         })
         : { payload: json, blocked: false };
@@ -77,7 +78,8 @@ export function createHaechiProxy({ runtime, port = DEFAULT_PROXY_PORT, host = "
       const forwarded = await maybeProtectResponse({
         upstreamResponse,
         routeContext,
-        runtime
+        runtime,
+        issuedTokens: result.issuedTokens ?? []
       });
 
       response.writeHead(forwarded.status, forwarded.headers);
@@ -112,7 +114,7 @@ export function createHaechiProxy({ runtime, port = DEFAULT_PROXY_PORT, host = "
   };
 }
 
-async function maybeProtectResponse({ upstreamResponse, routeContext, runtime }) {
+async function maybeProtectResponse({ upstreamResponse, routeContext, runtime, issuedTokens = [] }) {
   const headers = Object.fromEntries(upstreamResponse.headers.entries());
 
   if (!runtime.config.responseProtection.enabled || !routeContext.protectResponse) {
@@ -203,6 +205,7 @@ async function maybeProtectResponse({ upstreamResponse, routeContext, runtime })
   const result = await runtime.haechi.protectJson(json, {
     ...routeContext,
     operation: `response:${routeContext.operation}`,
+    direction: "response",
     mode: runtime.config.responseProtection.mode ?? runtime.config.policy.mode ?? runtime.config.mode
   });
 
@@ -218,13 +221,47 @@ async function maybeProtectResponse({ upstreamResponse, routeContext, runtime })
     };
   }
 
+  let responsePayload = result.payload;
+
+  // Request-scoped token round-trip: restore ONLY tokens issued/reused while
+  // protecting this request, so the model sees tokens but the caller sees
+  // plaintext. Explicit opt-in; runs after response protection, so an opt-in
+  // here intentionally overrides response-direction transforms for values the
+  // caller already sent.
+  if (runtime.config.tokenVault.detokenizeResponses
+    && issuedTokens.length > 0
+    && typeof runtime.tokenVault?.detokenize === "function") {
+    const values = await runtime.tokenVault.detokenize({ tokens: issuedTokens });
+    if (values.size > 0) {
+      responsePayload = restoreTokens(responsePayload, values);
+    }
+  }
+
   return {
     status: upstreamResponse.status,
     headers: transformedJsonHeaders(headers),
-    body: Buffer.from(`${JSON.stringify(result.payload)}\n`)
+    body: Buffer.from(`${JSON.stringify(responsePayload)}\n`)
   };
 }
 
+function restoreTokens(value, tokenValues) {
+  if (typeof value === "string") {
+    let output = value;
+    for (const [token, plaintext] of tokenValues) {
+      output = output.split(`[TOKEN:${token}]`).join(plaintext);
+    }
+    return output;
+  }
+  if (Array.isArray(value)) {
+    return value.map((item) => restoreTokens(item, tokenValues));
+  }
+  if (value && typeof value === "object") {
+    return Object.fromEntries(Object.entries(value)
+      .map(([key, item]) => [restoreTokens(key, tokenValues), restoreTokens(item, tokenValues)]));
+  }
+  return value;
+}
+
 async function forward({ upstream, request, body, timeoutMs = null }) {
   const target = buildUpstreamUrl({ upstream, requestUrl: request.url });
   try {
@@ -462,6 +499,7 @@ async function recordProxyDecision({ runtime, routeContext, decision, reason, en
     protocol: routeContext?.protocol ?? "proxy",
     operation: routeContext ? `proxy:${routeContext.protocol}:${routeContext.routeId ?? "unknown"}` : "proxy",
     mode: runtime.config.policy.mode ?? runtime.config.mode,
+    identity: null,
     enforced,
     blocked,
     decision,

package/packages/token-vault/index.mjs

@@ -3,13 +3,33 @@ import { dirname } from "node:path";
 import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { setTimeout as delay } from "node:timers/promises";
 
-export function createLocalTokenVault({ path, cryptoProvider, revealPolicy = "disabled", retentionDays = 30, auditSink = null }) {
+const DETERMINISTIC_DOMAIN = "haechi:token-vault:deterministic:v1";
+
+export function createLocalTokenVault({
+  path,
+  cryptoProvider,
+  revealPolicy = "disabled",
+  retentionDays = 30,
+  auditSink = null,
+  deterministic = false,
+  deterministicTypes = null
+}) {
   if (!path) {
     throw new Error("Local token vault requires path");
   }
   if (!cryptoProvider) {
     throw new Error("Local token vault requires cryptoProvider");
   }
+  if (deterministic && typeof cryptoProvider.hmac !== "function") {
+    throw new Error("Deterministic tokenization requires a cryptoProvider with hmac()");
+  }
+
+  function isDeterministicType(type) {
+    if (!deterministic) {
+      return false;
+    }
+    return !deterministicTypes || deterministicTypes.includes(type);
+  }
 
   let mutationQueue = Promise.resolve();
   async function enqueueMutation(operation) {
@@ -32,6 +52,7 @@ export function createLocalTokenVault({ path, cryptoProvider, revealPolicy = "di
       timestamp: new Date().toISOString(),
       protocol: "token-vault",
       operation,
+      identity: null,
       mode: "n/a",
       enforced: true,
       blocked: decision.endsWith("_denied"),
@@ -62,10 +83,26 @@ export function createLocalTokenVault({ path, cryptoProvider, revealPolicy = "di
       revealPolicy
     },
     async tokenize({ plaintext, type, context = {}, metadata = {} }) {
+      // Deterministic tokens are derived outside the mutation lock (HMAC reads
+      // only the key file); the same (type, value) always maps to one token.
+      const token = isDeterministicType(type)
+        ? `tok_${type}_${(await cryptoProvider.hmac({
+          data: `${type}:${plaintext}`,
+          domain: DETERMINISTIC_DOMAIN
+        })).slice(0, 32)}`
+        : `tok_${type}_${shortHash(`${plaintext}:${randomBytes(16).toString("hex")}`)}`;
+
       return enqueueMutation(async () => {
         const vault = await readVault(path);
         pruneExpiredTokens(vault);
-        const token = `tok_${type}_${shortHash(`${plaintext}:${randomBytes(16).toString("hex")}`)}`;
+
+        const existing = vault.tokens[token];
+        if (existing) {
+          existing.expiresAt = addDays(new Date(), retentionDays).toISOString();
+          await writeVault(path, vault);
+          return { token, type, reused: true };
+        }
+
         const createdAt = new Date();
         const aad = {
           purpose: "token-vault",
@@ -127,6 +164,37 @@ export function createLocalTokenVault({ path, cryptoProvider, revealPolicy = "di
         throw error;
       }
     },
+    // Request-scoped response restoration. Deliberately NOT gated by
+    // revealPolicy: that governs manual/CLI reveal, while detokenize is only
+    // reachable through the proxy's explicit detokenizeResponses opt-in and is
+    // limited to the caller-supplied token set. Audited by count, no plaintext.
+    async detokenize({ tokens }) {
+      const vault = await readVault(path);
+      const values = new Map();
+      let skipped = 0;
+
+      for (const token of tokens) {
+        const record = vault.tokens[token];
+        if (!record || (record.expiresAt && Date.parse(record.expiresAt) < Date.now())) {
+          skipped += 1;
+          continue;
+        }
+        try {
+          values.set(token, await cryptoProvider.decrypt({ envelope: record.envelope, aad: record.aad }));
+        } catch {
+          skipped += 1;
+        }
+      }
+
+      await recordVaultEvent({
+        operation: "token-vault:detokenize",
+        decision: "detokenize",
+        count: values.size,
+        reason: skipped > 0 ? `${skipped} tokens not restored` : null
+      });
+
+      return values;
+    },
     async purge({ token }) {
       return enqueueMutation(async () => {
         const vault = await readVault(path);