haechi 1.2.0 → 1.3.0

package/packages/privacy-profiles/index.mjs

@@ -12,7 +12,11 @@ const PROFILES = {
         email: "redact",
         card: "block",
         api_key: "block",
-        secret: "block"
+        secret: "block",
+        // A Japan My Number leak is as sensitive as a national ID and is a
+        // checksummed true-positive — block it in every profile so a non-JP
+        // deployment that happens to process JP data is still covered.
+        jp_mynumber: "block"
       }
     },
     transfer: {
@@ -31,7 +35,17 @@ const PROFILES = {
         card: "block",
         api_key: "block",
         secret: "block",
-        kr_rrn: "block"
+        kr_rrn: "block",
+        // EU national IDs — France NIR, Spain DNI/NIE, UK National Insurance
+        // Number, Italy codice fiscale, Germany tax ID, Netherlands BSN — are
+        // GDPR special-category-adjacent identifiers; block them.
+        fr_nir: "block",
+        es_dni: "block",
+        uk_nino: "block",
+        it_codice_fiscale: "block",
+        de_steuer_id: "block",
+        nl_bsn: "block",
+        jp_mynumber: "block"
       }
     },
     transfer: {
@@ -39,6 +53,37 @@ const PROFILES = {
       note: "Treat model/tool transfer as processor/subprocessor transfer and document SCC/TIA evidence outside Haechi."
     }
   },
+  "asia-pdpa": {
+    id: "asia-pdpa",
+    region: "ASIA",
+    regulations: ["Singapore PDPA", "India DPDP Act"],
+    policy: {
+      actions: {
+        // Asia national IDs — Singapore NRIC/FIN and India Aadhaar — are sensitive
+        // identifiers under the Singapore PDPA / India DPDP Act; block them. The
+        // other checksummed national IDs are also blocked so a mixed-region payload
+        // is covered, matching the cross-profile convention.
+        sg_nric: "block",
+        in_aadhaar: "block",
+        jp_mynumber: "block",
+        kr_rrn: "block",
+        fr_nir: "block",
+        es_dni: "block",
+        it_codice_fiscale: "block",
+        de_steuer_id: "block",
+        nl_bsn: "block",
+        phone: "mask",
+        email: "redact",
+        card: "block",
+        api_key: "block",
+        secret: "block"
+      }
+    },
+    transfer: {
+      requiresAssessment: true,
+      note: "Document the PDPA/DPDP handling basis, purpose limitation, and cross-border transfer notice before production use."
+    }
+  },
   "us-general": {
     id: "us-general",
     region: "US",
@@ -49,13 +94,37 @@ const PROFILES = {
         phone: "mask",
         card: "block",
         api_key: "block",
-        secret: "block"
+        secret: "block",
+        jp_mynumber: "block"
       }
     },
     transfer: {
       requiresAssessment: false,
       note: "Classify sector rules separately before using protected health, payment, or children's data."
     }
+  },
+  "jp-appi": {
+    id: "jp-appi",
+    region: "JP",
+    regulations: ["APPI"],
+    policy: {
+      actions: {
+        // My Number (個人番号) is a special-care personal-information identifier
+        // under the My Number Act; block it. The EU/KR IDs are also blocked so a
+        // mixed-region payload is covered, matching the cross-profile convention.
+        jp_mynumber: "block",
+        phone: "mask",
+        email: "redact",
+        card: "block",
+        api_key: "block",
+        secret: "block",
+        kr_rrn: "block"
+      }
+    },
+    transfer: {
+      requiresAssessment: true,
+      note: "Document the My Number Act handling basis, purpose limitation, and cross-border transfer notice before production use."
+    }
   }
 };
 

package/packages/protocol-adapters/index.mjs

@@ -8,6 +8,28 @@ const SSE_RESPONSES = { format: "sse", deltaPath: null };
 const SSE_LLAMA_LEGACY = { format: "sse", deltaPath: ["content"] };
 const NDJSON_OLLAMA_CHAT = { format: "ndjson", deltaPath: ["message", "content"] };
 const NDJSON_OLLAMA_GENERATE = { format: "ndjson", deltaPath: ["response"] };
+// Anthropic Messages API streams event-typed SSE frames; the incremental text
+// channel is `delta.text` inside a `content_block_delta` frame. Other frame
+// types (message_start, ping, etc.) don't carry deltaPath, so they get
+// within-frame protection but no cross-frame buffering. The stream-filter
+// preserves each frame's `event:` line on re-serialize. `flushOnType` lists the
+// frame types that END a delta sequence: before one of them the held cross-frame
+// buffer tail is flushed as a valid `content_block_delta`, so the residual lands
+// IN ORDER (before content_block_stop/message_stop) rather than after the stream
+// terminates. `ping` is intentionally absent — a match split across a keepalive
+// must still be caught by the sliding buffer. Legacy /v1/complete streams a
+// `completion` delta (no block framing, so no flushOnType needed).
+const SSE_ANTHROPIC_MESSAGES = {
+  format: "sse",
+  deltaPath: ["delta", "text"],
+  flushOnType: { path: ["type"], values: ["content_block_stop", "message_delta", "message_stop"] }
+};
+const SSE_ANTHROPIC_COMPLETE = { format: "sse", deltaPath: ["completion"] };
+// Google Gemini streams :streamGenerateContent as DATA-ONLY SSE (no `event:`
+// lines, like OpenAI). Each `data:` frame is a FULL GenerateContentResponse;
+// the incremental text channel is just deeper. Because frames are data-only,
+// the held cross-frame tail can flush at end-of-stream — no flushOnType needed.
+const SSE_GEMINI = { format: "sse", deltaPath: ["candidates", 0, "content", "parts", 0, "text"] };
 
 const ADAPTERS = {
   "openai-compatible": {
@@ -50,6 +72,47 @@ const ADAPTERS = {
       route("/api/embed", "embed"),
       route("/api/embeddings", "embeddings")
     ]
+  },
+  "anthropic": {
+    id: "anthropic",
+    protocol: "anthropic",
+    routes: [
+      // Anthropic Messages API. PII can sit in the top-level `system` string/blocks
+      // or any `messages[].content` string or content-block text/input — the core
+      // tree walk (collectStringEntries) covers every string leaf, so no custom
+      // extraction is needed. Streams via content_block_delta `delta.text`.
+      route("/v1/messages", "messages", { streaming: SSE_ANTHROPIC_MESSAGES }),
+      // count_tokens is a utility, but it carries prompt content, so protect it.
+      route("/v1/messages/count_tokens", "count-tokens", { protectRequest: true }),
+      // Legacy text completions: `prompt` is a top-level string; streams a `completion` delta.
+      route("/v1/complete", "complete", { streaming: SSE_ANTHROPIC_COMPLETE })
+    ]
+  },
+  "gemini": {
+    id: "gemini",
+    protocol: "gemini",
+    routes: [
+      // Google Gemini API. Endpoints are MODEL-IN-PATH with a `:method` suffix:
+      // POST /v1beta/models/{model}:generateContent (and /v1, and arbitrary
+      // model names like gemini-2.0-flash). The route key is therefore the
+      // `:method` SUFFIX, not a fixed path — declared via `methodSuffix`, which
+      // matchRoute checks only AFTER exact-path matches (so existing adapters
+      // are unaffected). PII can sit in systemInstruction.parts[].text and any
+      // contents[].parts[].text; the core tree walk (collectStringEntries)
+      // covers every string leaf, so no custom extraction is needed.
+      suffixRoute("generateContent", "generate-content"),
+      // Streaming variant: data-only SSE, full GenerateContentResponse per frame;
+      // delta text lives at candidates[0].content.parts[0].text. The :stream*
+      // endpoint ALWAYS streams (the intent is in the path, not a body flag), so
+      // mark it streamingDefault — there is no `stream:false` body field for
+      // Gemini, so isStreamingRequest always classifies it as streaming.
+      suffixRoute("streamGenerateContent", "stream-generate-content", { streamingDefault: true, streaming: SSE_GEMINI }),
+      // countTokens carries prompt content (contents/systemInstruction), so protect it.
+      suffixRoute("countTokens", "count-tokens", { protectRequest: true }),
+      // Embedding endpoints: request carries text to embed; protect it.
+      suffixRoute("embedContent", "embed", { protectRequest: true }),
+      suffixRoute("batchEmbedContents", "batch-embed", { protectRequest: true })
+    ]
   }
 };
 
@@ -121,10 +184,45 @@ function route(path, operation, options = {}) {
   };
 }
 
+// A SUFFIX route matches by a `:method` suffix instead of an exact pathname —
+// for model-in-path APIs (Gemini) where the path embeds an arbitrary model name
+// and a version prefix (e.g. /v1beta/models/gemini-2.0-flash:generateContent).
+// `path` stays null (there is no fixed path); `methodSuffix` carries the bare
+// method name and matchRoute matches when the pathname ends with `:${suffix}`.
+// matchRoute tries exact-path routes FIRST, so this never changes existing
+// exact-match behavior for openai/anthropic/ollama/llama-cpp.
+function suffixRoute(methodSuffix, operation, options = {}) {
+  return {
+    id: operation,
+    path: null,
+    methodSuffix,
+    operation,
+    protectRequest: options.protectRequest ?? true,
+    protectResponse: options.protectResponse ?? true,
+    streamingDefault: options.streamingDefault ?? false,
+    streaming: options.streaming ?? null
+  };
+}
+
 function pathFromRequestUrl(url) {
   return new URL(url, "http://haechi.local").pathname;
 }
 
 function matchRoute(routes, pathname) {
-  return routes.find((candidate) => candidate.path === pathname);
+  // 1) EXACT pathname match (unchanged) — the only matcher for openai/anthropic/
+  //    ollama/llama-cpp, so their classification is byte-for-byte identical.
+  const exact = routes.find((candidate) => candidate.path === pathname);
+  if (exact) {
+    return exact;
+  }
+  // 2) ADDITIVE: `:method`-SUFFIX match for model-in-path APIs (Gemini). A path
+  //    like /v1beta/models/gemini-2.0-flash:generateContent matches the route
+  //    whose methodSuffix the pathname ends with (`...:generateContent`). The
+  //    `:` guard prevents a bare substring (e.g. a model literally named
+  //    "generateContent") from matching without the method delimiter.
+  return routes.find(
+    (candidate) =>
+      typeof candidate.methodSuffix === "string" &&
+      pathname.endsWith(`:${candidate.methodSuffix}`)
+  );
 }

package/packages/proxy/index.mjs

@@ -545,7 +545,13 @@ async function authorizeRequest({ runtime, request, routeContext, rateLimiter, m
 
   if (resolved.rate && resolved.rate.requestsPerMinute) {
     const key = identity?.id ?? "anonymous";
-    if (!rateLimiter.allow(key, resolved.rate.requestsPerMinute)) {
+    // allow() may return a boolean OR a Promise<boolean>: the built-in default is
+    // synchronous, but a shared-store (e.g. Redis-backed) limiter is inherently
+    // async. We await unconditionally — `await <boolean>` returns the boolean
+    // unchanged, so the sync default keeps working, while `!somePromise` (always
+    // false, because a Promise is truthy) can no longer let an async limiter
+    // silently fail open. See haechi-ratelimit-redis (shared-store satellite).
+    if (!(await rateLimiter.allow(key, resolved.rate.requestsPerMinute))) {
       await recordProxyDecision({
         runtime, routeContext, identity, profile: resolved.profile, correlationId,
         decision: "rate_limited",

package/packages/stream-filter/index.mjs

@@ -10,10 +10,40 @@ const SSE_DONE = "[DONE]";
 export async function inspectResponseStream({ source, sink, streaming, protector, format }) {
   const wireFormat = format ?? streaming?.format ?? "ndjson";
   const deltaPath = streaming?.deltaPath ?? null;
+  // Frame types that TERMINATE a delta sequence (declared per-adapter, e.g.
+  // Anthropic's content_block_stop/message_delta/message_stop). Before such a
+  // frame the held cross-frame buffer tail is flushed as a valid delta frame, so
+  // the residual lands in-order BEFORE the terminator — never after message_stop.
+  // Keepalives (ping) are deliberately NOT listed, so a match split across a ping
+  // is still caught by the sliding buffer.
+  const flushOnType = streaming?.flushOnType ?? null;
   const decoder = new TextDecoder("utf-8");
   const frames = createFrameSplitter(wireFormat);
 
   let blocked = false;
+  // A structural template of the last frame that carried delta text, used to
+  // re-emit a held buffer tail as a VALID delta frame (preserving its wire
+  // wrapper — Anthropic's `event:` line — plus sibling fields like type/index).
+  let lastDeltaTemplate = null;
+
+  async function flushHeldTail() {
+    const flushed = await protector.flush();
+    if (flushed.blocked) {
+      blocked = true;
+      return;
+    }
+    if (!flushed.text || !deltaPath) {
+      return;
+    }
+    if (lastDeltaTemplate) {
+      const object = structuredClone(lastDeltaTemplate.object);
+      setByPath(object, deltaPath, flushed.text);
+      sink.write(serializeFrame(object, wireFormat, lastDeltaTemplate.original));
+    } else {
+      // No prior delta frame to model — fall back to a minimal synthesized frame.
+      sink.write(serializeFrame(buildPathObject(deltaPath, flushed.text), wireFormat, null));
+    }
+  }
 
   async function handleFrame(raw) {
     const frame = { raw, body: raw.trim() };
@@ -26,6 +56,16 @@ export async function inspectResponseStream({ source, sink, streaming, protector
     }
 
     const json = parsed.json;
+
+    // A delta-terminating frame: flush the held tail (as a valid delta frame)
+    // before emitting it, so the residual is correctly ordered.
+    if (flushOnType && flushOnType.values.includes(getByPath(json, flushOnType.path))) {
+      await flushHeldTail();
+      if (blocked) {
+        return;
+      }
+    }
+
     let deltaText = null;
     if (deltaPath) {
       const found = getByPath(json, deltaPath);
@@ -50,6 +90,8 @@ export async function inspectResponseStream({ source, sink, streaming, protector
         return;
       }
       setByPath(frameObject, deltaPath, pushed.text);
+      // Snapshot this frame's structure + wire wrapper as the flush template.
+      lastDeltaTemplate = { object: structuredClone(frameObject), original: frame };
     }
 
     sink.write(serializeFrame(frameObject, wireFormat, frame));
@@ -77,13 +119,8 @@ export async function inspectResponseStream({ source, sink, streaming, protector
   }
 
   if (!blocked) {
-    // Flush the held tail of the delta buffer as a synthesized final frame.
-    const flushed = await protector.flush();
-    if (flushed.blocked) {
-      blocked = true;
-    } else if (flushed.text && deltaPath) {
-      sink.write(serializeFrame(buildPathObject(deltaPath, flushed.text), wireFormat, null));
-    }
+    // Flush any remaining held tail (a stream that ended on a delta frame).
+    await flushHeldTail();
   }
 
   // The caller closes the sink AFTER recording the stream decision, so the
@@ -148,6 +185,31 @@ function parseFrame(frame, format) {
 function serializeFrame(json, format, original) {
   const body = JSON.stringify(json);
   if (format === "sse") {
+    // Preserve the original SSE field lines (`event:`, `id:`, `retry:`, `:`
+    // comments) and substitute only the data payload. Event-typed streams
+    // (Anthropic Messages) dispatch on the `event:` line, so dropping it would
+    // make the stream unconsumable. OpenAI-style frames carry only a `data:`
+    // line, so the output is byte-identical to `data: ${body}\n\n`.
+    if (original && typeof original.raw === "string") {
+      const lines = original.raw.replace(/\n+$/, "").split("\n");
+      const out = [];
+      let dataWritten = false;
+      for (const line of lines) {
+        if (line.startsWith("data:")) {
+          // Collapse any (multi-line) data payload into the single new body.
+          if (!dataWritten) {
+            out.push(`data: ${body}`);
+            dataWritten = true;
+          }
+        } else {
+          out.push(line);
+        }
+      }
+      if (!dataWritten) {
+        out.push(`data: ${body}`);
+      }
+      return `${out.join("\n")}\n\n`;
+    }
     return `data: ${body}\n\n`;
   }
   // NDJSON: preserve the original trailing newline style when available.