usertrust 1.4.0 → 2.0.0

package/dist/anomaly/signals/token-rate.js

@@ -1,5 +1,32 @@
 // SPDX-License-Identifier: Apache-2.0
 // Copyright 2026 Usertools, Inc.
+/**
+ * token-rate.ts — Token-rate anomaly signal.
+ *
+ * Buckets observed chunks into fixed-width windows (default 2 s) and counts
+ * tokens-per-second within each window. Trips when N consecutive windows
+ * exceed the effective threshold (default 500 tok/s, 3 windows).
+ *
+ * Brief spikes (1-2 hot windows) are ignored — only sustained runaway
+ * behavior trips the circuit.
+ *
+ * M2 scoped thresholds: each observation may carry the event's model and
+ * endpointClass. Local-scope events select `perModel` (trailing-* glob,
+ * matched via matchModelPattern) first, then `localThresholdTokPerSec`
+ * (default 5000 — fast local GPU inference legitimately exceeds the cloud
+ * 500). Cloud/unscoped events keep the legacy `thresholdTokPerSec`. The
+ * check() result names which threshold applied via `thresholdLabel`.
+ *
+ * Cross-scope isolation: cloud and local keep SEPARATE rolling windows, each
+ * judged against its own threshold. A shared detector observes interleaved
+ * cloud+local streams, so a single mutable threshold/window would let one
+ * scope's chunks contaminate the other's verdict — a cloud runaway inheriting
+ * the 10x local threshold (evasion), or a local burst false-tripping the cloud
+ * 500. Mirrors the dual-series pattern in spend-velocity.ts.
+ */
+import { matchModelPattern } from "../../ledger/pricing.js";
+/** Default local-scope threshold, applied where consumed (resolved config keeps it optional). */
+const LOCAL_THRESHOLD_TOK_PER_SEC_DEFAULT = 5_000;
 export const TOKEN_RATE_DEFAULTS = {
     thresholdTokPerSec: 500,
     windowMs: 2_000,
@@ -8,82 +35,141 @@ export const TOKEN_RATE_DEFAULTS = {
 export function resolveTokenRateConfig(cfg) {
     return {
         thresholdTokPerSec: cfg?.thresholdTokPerSec ?? TOKEN_RATE_DEFAULTS.thresholdTokPerSec,
+        // M2 fields stay optional in resolved config — defaulted where consumed.
+        localThresholdTokPerSec: cfg?.localThresholdTokPerSec,
+        perModel: cfg?.perModel,
         windowMs: cfg?.windowMs ?? TOKEN_RATE_DEFAULTS.windowMs,
         consecutiveWindows: cfg?.consecutiveWindows ?? TOKEN_RATE_DEFAULTS.consecutiveWindows,
     };
 }
 export function createTokenRateSignal(cfg) {
-    const state = {
-        currentWindowTokens: 0,
-        currentWindowStartMs: 0,
-        consecutiveHotWindows: 0,
-        lastWindowRateTokPerSec: 0,
-    };
-    let initialized = false;
-    function rollWindowsTo(nowMs) {
+    const localDefaultThreshold = cfg.localThresholdTokPerSec ?? LOCAL_THRESHOLD_TOK_PER_SEC_DEFAULT;
+    function makeWindow(threshold, label) {
+        return {
+            currentWindowTokens: 0,
+            currentWindowStartMs: 0,
+            consecutiveHotWindows: 0,
+            lastWindowRateTokPerSec: 0,
+            initialized: false,
+            threshold,
+            thresholdLabel: label,
+        };
+    }
+    // Independent per-scope windows: cloud/unscoped events accumulate against the
+    // legacy threshold, local events against the local/perModel threshold. Neither
+    // can move the other's threshold or window (evasion + false-trip fix).
+    const cloud = makeWindow(cfg.thresholdTokPerSec, "thresholdTokPerSec");
+    const local = makeWindow(localDefaultThreshold, "localThresholdTokPerSec");
+    const state = { cloud, local };
+    /** Resolve the local-scope threshold/label for an event's model (perModel glob first). */
+    function applyLocalThreshold(model) {
+        if (model !== undefined && cfg.perModel !== undefined) {
+            const match = matchModelPattern(model, cfg.perModel);
+            if (match !== undefined) {
+                local.threshold = match.value;
+                local.thresholdLabel = `perModel["${match.pattern}"]`;
+                return;
+            }
+        }
+        local.threshold = localDefaultThreshold;
+        local.thresholdLabel = "localThresholdTokPerSec";
+    }
+    function rollWindowsTo(w, nowMs) {
         // Roll forward: close completed windows, evaluate threshold, advance.
-        while (nowMs - state.currentWindowStartMs >= cfg.windowMs) {
-            const windowEndMs = state.currentWindowStartMs + cfg.windowMs;
+        while (nowMs - w.currentWindowStartMs >= cfg.windowMs) {
+            const windowEndMs = w.currentWindowStartMs + cfg.windowMs;
             const seconds = cfg.windowMs / 1_000;
-            const rate = state.currentWindowTokens / seconds;
-            state.lastWindowRateTokPerSec = rate;
-            if (rate >= cfg.thresholdTokPerSec) {
-                state.consecutiveHotWindows += 1;
+            const rate = w.currentWindowTokens / seconds;
+            w.lastWindowRateTokPerSec = rate;
+            if (rate >= w.threshold) {
+                w.consecutiveHotWindows += 1;
             }
             else {
-                state.consecutiveHotWindows = 0;
+                w.consecutiveHotWindows = 0;
             }
-            state.currentWindowStartMs = windowEndMs;
-            state.currentWindowTokens = 0;
+            w.currentWindowStartMs = windowEndMs;
+            w.currentWindowTokens = 0;
         }
     }
-    function observe(deltaTokens, nowMs) {
-        if (!initialized) {
-            state.currentWindowStartMs = nowMs;
-            initialized = true;
+    function observe(deltaTokens, nowMs, context) {
+        const w = context?.endpointClass === "local" ? local : cloud;
+        if (w === local) {
+            applyLocalThreshold(context?.model);
+        }
+        if (!w.initialized) {
+            w.currentWindowStartMs = nowMs;
+            w.initialized = true;
         }
-        rollWindowsTo(nowMs);
-        state.currentWindowTokens += Math.max(0, deltaTokens);
+        rollWindowsTo(w, nowMs);
+        w.currentWindowTokens += Math.max(0, deltaTokens);
     }
-    function check(nowMs) {
-        if (!initialized) {
+    /** Evaluate one scope's window against its own threshold. */
+    function evaluate(w, nowMs) {
+        if (!w.initialized) {
             return {
                 tripped: false,
                 metric: 0,
-                threshold: cfg.thresholdTokPerSec,
+                threshold: w.threshold,
                 hotWindows: 0,
+                thresholdLabel: w.thresholdLabel,
             };
         }
-        rollWindowsTo(nowMs);
+        rollWindowsTo(w, nowMs);
         // Also evaluate the current (incomplete) window if it has surpassed threshold
         // by enough margin to count: only if it would already be a "hot" window.
-        const elapsedMs = nowMs - state.currentWindowStartMs;
+        const elapsedMs = nowMs - w.currentWindowStartMs;
         let inFlightHot = false;
         let inFlightRate = 0;
         if (elapsedMs > 0) {
-            inFlightRate = state.currentWindowTokens / (elapsedMs / 1_000);
+            inFlightRate = w.currentWindowTokens / (elapsedMs / 1_000);
             // Only consider in-flight as "hot" once the window has accumulated meaningful
             // data (>=50% elapsed) to avoid false positives from one large early chunk.
-            if (elapsedMs >= cfg.windowMs / 2 && inFlightRate >= cfg.thresholdTokPerSec) {
+            if (elapsedMs >= cfg.windowMs / 2 && inFlightRate >= w.threshold) {
                 inFlightHot = true;
             }
         }
-        const effectiveHot = state.consecutiveHotWindows + (inFlightHot ? 1 : 0);
+        const effectiveHot = w.consecutiveHotWindows + (inFlightHot ? 1 : 0);
         const tripped = effectiveHot >= cfg.consecutiveWindows;
-        const metric = Math.max(state.lastWindowRateTokPerSec, inFlightRate);
+        const metric = Math.max(w.lastWindowRateTokPerSec, inFlightRate);
         return {
             tripped,
             metric,
-            threshold: cfg.thresholdTokPerSec,
+            threshold: w.threshold,
             hotWindows: effectiveHot,
+            thresholdLabel: w.thresholdLabel,
         };
     }
+    function check(nowMs) {
+        // Cloud is evaluated first so a cloud runaway is reported with the cloud
+        // threshold even while a slower local stream interleaves.
+        const cloudResult = evaluate(cloud, nowMs);
+        if (cloudResult.tripped)
+            return cloudResult;
+        const localResult = evaluate(local, nowMs);
+        if (localResult.tripped)
+            return localResult;
+        // Neither tripped: report the initialized scope closer to its threshold
+        // (higher metric/threshold ratio); default to cloud (legacy) otherwise.
+        if (!local.initialized)
+            return cloudResult;
+        if (!cloud.initialized)
+            return localResult;
+        const cloudRatio = cloudResult.threshold > 0 ? cloudResult.metric / cloudResult.threshold : 0;
+        const localRatio = localResult.threshold > 0 ? localResult.metric / localResult.threshold : 0;
+        return localRatio > cloudRatio ? localResult : cloudResult;
+    }
     function reset() {
-        state.currentWindowTokens = 0;
-        state.currentWindowStartMs = 0;
-        state.consecutiveHotWindows = 0;
-        state.lastWindowRateTokPerSec = 0;
-        initialized = false;
+        for (const w of [cloud, local]) {
+            w.currentWindowTokens = 0;
+            w.currentWindowStartMs = 0;
+            w.consecutiveHotWindows = 0;
+            w.lastWindowRateTokPerSec = 0;
+            w.initialized = false;
+        }
+        cloud.threshold = cfg.thresholdTokPerSec;
+        cloud.thresholdLabel = "thresholdTokPerSec";
+        local.threshold = localDefaultThreshold;
+        local.thresholdLabel = "localThresholdTokPerSec";
     }
     return { state, observe, check, reset };
 }

package/dist/anomaly/signals/token-rate.js.map

@@ -1 +1 @@
-{"version":3,"file":"token-rate.js","sourceRoot":"","sources":["../../../src/anomaly/signals/token-rate.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAiDjC,MAAM,CAAC,MAAM,mBAAmB,GAA4B;IAC3D,kBAAkB,EAAE,GAAG;IACvB,QAAQ,EAAE,KAAK;IACf,kBAAkB,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,GAAqB;IAC3D,OAAO;QACN,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,mBAAmB,CAAC,kBAAkB;QACrF,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;QACvD,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,mBAAmB,CAAC,kBAAkB;KACrF,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,GAA4B;IACjE,MAAM,KAAK,GAAyB;QACnC,mBAAmB,EAAE,CAAC;QACtB,oBAAoB,EAAE,CAAC;QACvB,qBAAqB,EAAE,CAAC;QACxB,uBAAuB,EAAE,CAAC;KAC1B,CAAC;IACF,IAAI,WAAW,GAAG,KAAK,CAAC;IAExB,SAAS,aAAa,CAAC,KAAa;QACnC,sEAAsE;QACtE,OAAO,KAAK,GAAG,KAAK,CAAC,oBAAoB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,oBAAoB,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC9D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;YACrC,MAAM,IAAI,GAAG,KAAK,CAAC,mBAAmB,GAAG,OAAO,CAAC;YACjD,KAAK,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACrC,IAAI,IAAI,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBACpC,KAAK,CAAC,qBAAqB,IAAI,CAAC,CAAC;YAClC,CAAC;iBAAM,CAAC;gBACP,KAAK,CAAC,qBAAqB,GAAG,CAAC,CAAC;YACjC,CAAC;YACD,KAAK,CAAC,oBAAoB,GAAG,WAAW,CAAC;YACzC,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC/B,CAAC;IACF,CAAC;IAED,SAAS,OAAO,CAAC,WAAmB,EAAE,KAAa;QAClD,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,KAAK,CAAC,oBAAoB,GAAG,KAAK,CAAC;YACnC,WAAW,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,KAAK,CAAC,mBAAmB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACvD,CAAC;IAED,SAAS,KAAK,CAAC,KAAa;QAM3B,IAAI,CAAC,WAAW,EAAE,CAAC;YAClB,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,GAAG,CAAC,kBAAkB;gBACjC,UAAU,EAAE,CAAC;aACb,CAAC;QACH,CAAC;QACD,aAAa,CAAC,KAAK,CAAC,CAAC;QACrB,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,SAAS,GAAG,KAAK,GAAG,KAAK,CAAC,oBAAoB,CAAC;QACrD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACnB,YAAY,GAAG,KAAK,CAAC,mBAAmB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;YAC/D,8EAA8E;YAC9E,4EAA4E;YAC5E,IAAI,SAAS,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,YAAY,IAAI,GAAG,CAAC,kBAAkB,EAAE,CAAC;gBAC7E,WAAW,GAAG,IAAI,CAAC;YACpB,CAAC;QACF,CAAC;QACD,MAAM,YAAY,GAAG,KAAK,CAAC,qBAAqB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACzE,MAAM,OAAO,GAAG,YAAY,IAAI,GAAG,CAAC,kBAAkB,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uBAAuB,EAAE,YAAY,CAAC,CAAC;QACrE,OAAO;YACN,OAAO;YACP,MAAM;YACN,SAAS,EAAE,GAAG,CAAC,kBAAkB;YACjC,UAAU,EAAE,YAAY;SACxB,CAAC;IACH,CAAC;IAED,SAAS,KAAK;QACb,KAAK,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC9B,KAAK,CAAC,oBAAoB,GAAG,CAAC,CAAC;QAC/B,KAAK,CAAC,qBAAqB,GAAG,CAAC,CAAC;QAChC,KAAK,CAAC,uBAAuB,GAAG,CAAC,CAAC;QAClC,WAAW,GAAG,KAAK,CAAC;IACrB,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC"}
+{"version":3,"file":"token-rate.js","sourceRoot":"","sources":["../../../src/anomaly/signals/token-rate.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AAI5D,iGAAiG;AACjG,MAAM,mCAAmC,GAAG,KAAK,CAAC;AAoElD,MAAM,CAAC,MAAM,mBAAmB,GAA4B;IAC3D,kBAAkB,EAAE,GAAG;IACvB,QAAQ,EAAE,KAAK;IACf,kBAAkB,EAAE,CAAC;CACrB,CAAC;AAEF,MAAM,UAAU,sBAAsB,CAAC,GAAqB;IAC3D,OAAO;QACN,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,mBAAmB,CAAC,kBAAkB;QACrF,yEAAyE;QACzE,uBAAuB,EAAE,GAAG,EAAE,uBAAuB;QACrD,QAAQ,EAAE,GAAG,EAAE,QAAQ;QACvB,QAAQ,EAAE,GAAG,EAAE,QAAQ,IAAI,mBAAmB,CAAC,QAAQ;QACvD,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,IAAI,mBAAmB,CAAC,kBAAkB;KACrF,CAAC;AACH,CAAC;AAUD,MAAM,UAAU,qBAAqB,CAAC,GAA4B;IACjE,MAAM,qBAAqB,GAAG,GAAG,CAAC,uBAAuB,IAAI,mCAAmC,CAAC;IAEjG,SAAS,UAAU,CAAC,SAAiB,EAAE,KAA8B;QACpE,OAAO;YACN,mBAAmB,EAAE,CAAC;YACtB,oBAAoB,EAAE,CAAC;YACvB,qBAAqB,EAAE,CAAC;YACxB,uBAAuB,EAAE,CAAC;YAC1B,WAAW,EAAE,KAAK;YAClB,SAAS;YACT,cAAc,EAAE,KAAK;SACrB,CAAC;IACH,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,uEAAuE;IACvE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,kBAAkB,EAAE,oBAAoB,CAAC,CAAC;IACvE,MAAM,KAAK,GAAG,UAAU,CAAC,qBAAqB,EAAE,yBAAyB,CAAC,CAAC;IAC3E,MAAM,KAAK,GAAyB,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;IAErD,0FAA0F;IAC1F,SAAS,mBAAmB,CAAC,KAAyB;QACrD,IAAI,KAAK,KAAK,SAAS,IAAI,GAAG,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YACvD,MAAM,KAAK,GAAG,iBAAiB,CAAC,KAAK,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,KAAK,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC9B,KAAK,CAAC,cAAc,GAAG,aAAa,KAAK,CAAC,OAAO,IAAI,CAAC;gBACtD,OAAO;YACR,CAAC;QACF,CAAC;QACD,KAAK,CAAC,SAAS,GAAG,qBAAqB,CAAC;QACxC,KAAK,CAAC,cAAc,GAAG,yBAAyB,CAAC;IAClD,CAAC;IAED,SAAS,aAAa,CAAC,CAAmB,EAAE,KAAa;QACxD,sEAAsE;QACtE,OAAO,KAAK,GAAG,CAAC,CAAC,oBAAoB,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;YACvD,MAAM,WAAW,GAAG,CAAC,CAAC,oBAAoB,GAAG,GAAG,CAAC,QAAQ,CAAC;YAC1D,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,GAAG,KAAK,CAAC;YACrC,MAAM,IAAI,GAAG,CAAC,CAAC,mBAAmB,GAAG,OAAO,CAAC;YAC7C,CAAC,CAAC,uBAAuB,GAAG,IAAI,CAAC;YACjC,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBACzB,CAAC,CAAC,qBAAqB,IAAI,CAAC,CAAC;YAC9B,CAAC;iBAAM,CAAC;gBACP,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC;YAC7B,CAAC;YACD,CAAC,CAAC,oBAAoB,GAAG,WAAW,CAAC;YACrC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC;QAC3B,CAAC;IACF,CAAC;IAED,SAAS,OAAO,CAAC,WAAmB,EAAE,KAAa,EAAE,OAAiC;QACrF,MAAM,CAAC,GAAG,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;QAC7D,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YACjB,mBAAmB,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QACD,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACpB,CAAC,CAAC,oBAAoB,GAAG,KAAK,CAAC;YAC/B,CAAC,CAAC,WAAW,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,mBAAmB,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACnD,CAAC;IAED,6DAA6D;IAC7D,SAAS,QAAQ,CAAC,CAAmB,EAAE,KAAa;QACnD,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;YACpB,OAAO;gBACN,OAAO,EAAE,KAAK;gBACd,MAAM,EAAE,CAAC;gBACT,SAAS,EAAE,CAAC,CAAC,SAAS;gBACtB,UAAU,EAAE,CAAC;gBACb,cAAc,EAAE,CAAC,CAAC,cAAc;aAChC,CAAC;QACH,CAAC;QACD,aAAa,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxB,8EAA8E;QAC9E,yEAAyE;QACzE,MAAM,SAAS,GAAG,KAAK,GAAG,CAAC,CAAC,oBAAoB,CAAC;QACjD,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,IAAI,YAAY,GAAG,CAAC,CAAC;QACrB,IAAI,SAAS,GAAG,CAAC,EAAE,CAAC;YACnB,YAAY,GAAG,CAAC,CAAC,mBAAmB,GAAG,CAAC,SAAS,GAAG,KAAK,CAAC,CAAC;YAC3D,8EAA8E;YAC9E,4EAA4E;YAC5E,IAAI,SAAS,IAAI,GAAG,CAAC,QAAQ,GAAG,CAAC,IAAI,YAAY,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBAClE,WAAW,GAAG,IAAI,CAAC;YACpB,CAAC;QACF,CAAC;QACD,MAAM,YAAY,GAAG,CAAC,CAAC,qBAAqB,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACrE,MAAM,OAAO,GAAG,YAAY,IAAI,GAAG,CAAC,kBAAkB,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,uBAAuB,EAAE,YAAY,CAAC,CAAC;QACjE,OAAO;YACN,OAAO;YACP,MAAM;YACN,SAAS,EAAE,CAAC,CAAC,SAAS;YACtB,UAAU,EAAE,YAAY;YACxB,cAAc,EAAE,CAAC,CAAC,cAAc;SAChC,CAAC;IACH,CAAC;IAED,SAAS,KAAK,CAAC,KAAa;QAC3B,yEAAyE;QACzE,0DAA0D;QAC1D,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC;QAC5C,MAAM,WAAW,GAAG,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,WAAW,CAAC,OAAO;YAAE,OAAO,WAAW,CAAC;QAC5C,wEAAwE;QACxE,wEAAwE;QACxE,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAO,WAAW,CAAC;QAC3C,IAAI,CAAC,KAAK,CAAC,WAAW;YAAE,OAAO,WAAW,CAAC;QAC3C,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,MAAM,UAAU,GAAG,WAAW,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,GAAG,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9F,OAAO,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,WAAW,CAAC;IAC5D,CAAC;IAED,SAAS,KAAK;QACb,KAAK,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;YAChC,CAAC,CAAC,mBAAmB,GAAG,CAAC,CAAC;YAC1B,CAAC,CAAC,oBAAoB,GAAG,CAAC,CAAC;YAC3B,CAAC,CAAC,qBAAqB,GAAG,CAAC,CAAC;YAC5B,CAAC,CAAC,uBAAuB,GAAG,CAAC,CAAC;YAC9B,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC;QACvB,CAAC;QACD,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,kBAAkB,CAAC;QACzC,KAAK,CAAC,cAAc,GAAG,oBAAoB,CAAC;QAC5C,KAAK,CAAC,SAAS,GAAG,qBAAqB,CAAC;QACxC,KAAK,CAAC,cAAc,GAAG,yBAAyB,CAAC;IAClD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC;AACzC,CAAC"}

package/dist/anomaly/types.d.ts

@@ -7,13 +7,17 @@
  * should VOID the PENDING hold, throw `AnomalyError`, and emit a hash-chained
  * `anomaly_detected` audit event.
  */
-import type { LLMClientKind } from "../shared/types.js";
+import type { EndpointClass, LLMClientKind } from "../shared/types.js";
 /** The three signal types the detector watches. */
 export type AnomalyKind = "token_rate" | "spend_velocity" | "injection_cascade";
 /** Token-rate signal config. */
 export interface TokenRateConfig {
     /** Threshold tokens-per-second above which a window is "hot". Default 500. */
     thresholdTokPerSec?: number;
+    /** Local-scope threshold tokens-per-second (M2). Default 5000. */
+    localThresholdTokPerSec?: number | undefined;
+    /** Per-model threshold overrides. Keys: exact model or trailing-* glob (M2). */
+    perModel?: Record<string, number> | undefined;
     /** Window size in milliseconds. Default 2000. */
     windowMs?: number;
     /** Number of consecutive hot windows required to trip. Default 3. */
@@ -23,6 +27,8 @@ export interface TokenRateConfig {
 export interface SpendVelocityConfig {
     /** Maximum dollars per minute (rolling). Default 1.00. */
     thresholdDollarsPerMin?: number;
+    /** Local-scope threshold in nominal usertokens per minute (M2). Default 10000. */
+    localThresholdUsertokensPerMin?: number | undefined;
     /** Rolling window in milliseconds. Default 10000. */
     windowMs?: number;
 }
@@ -43,11 +49,17 @@ export interface AnomalyConfig {
     /** Cooldown after a trip before auto-reset. Default 30000 ms. */
     cooldownMs?: number;
 }
-/** Resolved (defaulted) config used internally. */
+/**
+ * Resolved (defaulted) config used internally.
+ *
+ * Legacy fields are fully defaulted; the M2 local-scope fields
+ * (localThresholdTokPerSec, perModel, localThresholdUsertokensPerMin) stay
+ * optional here and are defaulted at the signal when absent.
+ */
 export interface ResolvedAnomalyConfig {
     enabled: boolean;
-    tokenRate: Required<TokenRateConfig>;
-    spendVelocity: Required<SpendVelocityConfig>;
+    tokenRate: Required<Omit<TokenRateConfig, "localThresholdTokPerSec" | "perModel">> & Pick<TokenRateConfig, "localThresholdTokPerSec" | "perModel">;
+    spendVelocity: Required<Omit<SpendVelocityConfig, "localThresholdUsertokensPerMin">> & Pick<SpendVelocityConfig, "localThresholdUsertokensPerMin">;
     injectionCascade: Required<InjectionCascadeConfig>;
     cooldownMs: number;
 }
@@ -62,6 +74,10 @@ export interface AnomalyChunkEvent {
     cumulativeOutputTokens: number;
     /** Wall-clock timestamp. Defaults to Date.now() if omitted. */
     at?: number;
+    /** Model of the call this chunk belongs to. Overrides options.model when present (M2). */
+    model?: string | undefined;
+    /** Endpoint scope of the call this chunk belongs to. Default scope: cloud (M2). */
+    endpointClass?: EndpointClass | undefined;
 }
 /** Out-of-band injection event (fired when detect.injection finds something). */
 export interface AnomalyInjectionEvent {
@@ -87,8 +103,14 @@ export interface AnomalyDetectorOptions {
     provider?: LLMClientKind;
     /** Model name being observed (used for cost calculation in spend-velocity). */
     model?: string;
-    /** Override the cost calculator (for testing). Returns dollars for given tokens. */
-    costCalculator?: (model: string, inputTokens: number, outputTokens: number) => number;
+    /**
+     * Override the cost calculator. Returns the cost for the given cumulative tokens —
+     * dollars for cloud-scope events, nominal usertokens for local-scope events.
+     * The observed chunk event is passed as the optional 4th argument so an injected
+     * calculator can price per-event (scoped by event.model/event.endpointClass); 3-arg
+     * implementations remain assignable (backward compatible).
+     */
+    costCalculator?: (model: string, inputTokens: number, outputTokens: number, event?: AnomalyChunkEvent) => number;
     /** Time source override (for deterministic tests). */
     now?: () => number;
 }

package/dist/anomaly/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/anomaly/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAIxD,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAIhF,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC/B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IACnC,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC7B,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,mDAAmD;AACnD,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,QAAQ,CAAC,eAAe,CAAC,CAAC;IACrC,aAAa,EAAE,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IAC7C,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACnB;AAID,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,sBAAsB,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,EAAE,CAAC,EAAE,MAAM,CAAC;CACZ;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAIrE,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GACvB;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAClB;IACA,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACjB,CAAC;AAIL,MAAM,WAAW,sBAAsB;IACtC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,oFAAoF;IACpF,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,KAAK,MAAM,CAAC;IACtF,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACpC,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yCAAyC;IACzC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CAChC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/anomaly/types.ts"],"names":[],"mappings":"AAGA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAIvE,mDAAmD;AACnD,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,gBAAgB,GAAG,mBAAmB,CAAC;AAIhF,gCAAgC;AAChC,MAAM,WAAW,eAAe;IAC/B,8EAA8E;IAC9E,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,kEAAkE;IAClE,uBAAuB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7C,gFAAgF;IAChF,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,SAAS,CAAC;IAC9C,iDAAiD;IACjD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,oCAAoC;AACpC,MAAM,WAAW,mBAAmB;IACnC,0DAA0D;IAC1D,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kFAAkF;IAClF,8BAA8B,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpD,qDAAqD;IACrD,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,uCAAuC;AACvC,MAAM,WAAW,sBAAsB;IACtC,qDAAqD;IACrD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,iEAAiE;AACjE,MAAM,WAAW,aAAa;IAC7B,mEAAmE;IACnE,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,CAAC,EAAE,eAAe,CAAC;IAC5B,aAAa,CAAC,EAAE,mBAAmB,CAAC;IACpC,gBAAgB,CAAC,EAAE,sBAAsB,CAAC;IAC1C,iEAAiE;IACjE,UAAU,CAAC,EAAE,MAAM,CAAC;CACpB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACrC,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,QAAQ,CAAC,IAAI,CAAC,eAAe,EAAE,yBAAyB,GAAG,UAAU,CAAC,CAAC,GACjF,IAAI,CAAC,eAAe,EAAE,yBAAyB,GAAG,UAAU,CAAC,CAAC;IAC/D,aAAa,EAAE,QAAQ,CAAC,IAAI,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC,GACnF,IAAI,CAAC,mBAAmB,EAAE,gCAAgC,CAAC,CAAC;IAC7D,gBAAgB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;CACnB;AAID,oDAAoD;AACpD,MAAM,WAAW,iBAAiB;IACjC,IAAI,EAAE,OAAO,CAAC;IACd,8DAA8D;IAC9D,WAAW,EAAE,MAAM,CAAC;IACpB,8EAA8E;IAC9E,qBAAqB,EAAE,MAAM,CAAC;IAC9B,+EAA+E;IAC/E,sBAAsB,EAAE,MAAM,CAAC;IAC/B,+DAA+D;IAC/D,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,0FAA0F;IAC1F,KAAK,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,mFAAmF;IACnF,aAAa,CAAC,EAAE,aAAa,GAAG,SAAS,CAAC;CAC1C;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACrC,IAAI,EAAE,WAAW,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,MAAM,MAAM,YAAY,GAAG,iBAAiB,GAAG,qBAAqB,CAAC;AAIrE,4DAA4D;AAC5D,MAAM,MAAM,cAAc,GACvB;IAAE,OAAO,EAAE,KAAK,CAAA;CAAE,GAClB;IACA,OAAO,EAAE,IAAI,CAAC;IACd,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,SAAS,EAAE,MAAM,CAAC;CACjB,CAAC;AAIL,MAAM,WAAW,sBAAsB;IACtC,qEAAqE;IACrE,QAAQ,CAAC,EAAE,aAAa,CAAC;IACzB,+EAA+E;IAC/E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;;;OAMG;IACH,cAAc,CAAC,EAAE,CAChB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,MAAM,EACnB,YAAY,EAAE,MAAM,EACpB,KAAK,CAAC,EAAE,iBAAiB,KACrB,MAAM,CAAC;IACZ,sDAAsD;IACtD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACpC,sFAAsF;IACtF,OAAO,EAAE,OAAO,CAAC;IACjB,2DAA2D;IAC3D,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,yCAAyC;IACzC,WAAW,EAAE,WAAW,GAAG,IAAI,CAAC;CAChC"}

package/dist/audit/anchor-doctor.d.ts

@@ -0,0 +1,42 @@
+export interface DoctorCheck {
+    name: string;
+    status: "pass" | "fail" | "info";
+    detail: string;
+}
+export interface DoctorReport {
+    sink: string;
+    checks: DoctorCheck[];
+    failed: boolean;
+}
+/**
+ * Injectable HTTP transport — the probe's only impure edge, so tests script
+ * store responses instead of reaching the network. Response `headers` are
+ * optional because only the S3 versioning probe reads one.
+ */
+export type HttpTransport = (opts: {
+    method: string;
+    url: string;
+    headers: Record<string, string>;
+    body: Buffer;
+}) => Promise<{
+    status: number;
+    body: string;
+    headers?: Record<string, string>;
+}>;
+export interface S3ProbeConfig {
+    bucket: string;
+    region: string;
+    prefix?: string;
+    endpoint?: string;
+}
+/**
+ * Probe the directory holding a file sink. The probe object is created next to
+ * the store file (same directory, hence same permissions) and removed again.
+ */
+export declare function doctorFileSink(sinkPath: string): DoctorReport;
+/**
+ * Probe an S3-compatible store: write a probe object, then attempt the two
+ * operations an append-only store must refuse against that same key.
+ */
+export declare function doctorS3Sink(cfg: S3ProbeConfig, transport?: HttpTransport): Promise<DoctorReport>;
+//# sourceMappingURL=anchor-doctor.d.ts.map

package/dist/audit/anchor-doctor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"anchor-doctor.d.ts","sourceRoot":"","sources":["../../src/audit/anchor-doctor.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,WAAW;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IACjC,MAAM,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,MAAM,EAAE,OAAO,CAAC;CAChB;AAED;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,IAAI,EAAE;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,EAAE,MAAM,CAAC;CACb,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CAAC;AAElF,MAAM,WAAW,aAAa;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CAClB;AA2CD;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAmD7D;AA6BD;;;GAGG;AACH,wBAAsB,YAAY,CACjC,GAAG,EAAE,aAAa,EAClB,SAAS,GAAE,aAA8B,GACvC,OAAO,CAAC,YAAY,CAAC,CAsCvB"}

package/dist/audit/anchor-doctor.js

@@ -0,0 +1,285 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright 2026 Usertools, Inc.
+/**
+ * `anchor doctor` — append-only store PERMISSION PROBES.
+ *
+ * What this module establishes is narrow and worth stating precisely: it writes
+ * a throwaway probe object to the store and reports whether THIS identity, with
+ * the credentials in THIS environment, could delete or overwrite that object
+ * RIGHT NOW. It does not prove the store is append-only. A store can deny these
+ * operations today and allow them tomorrow, deny them for this identity and
+ * allow them for an admin one, or accept an overwrite as a new object version.
+ * Immutability comes from the store's own configuration (S3 Object Lock
+ * retention, POSIX directory permissions, an appliance's WORM mode) — the
+ * doctor only tells an operator whether their configuration is doing anything
+ * at all, which is the failure mode worth catching before an audit.
+ *
+ * The two probes are independent on purpose: on POSIX, deletion is governed by
+ * write permission on the DIRECTORY while in-place truncation is governed by
+ * permission on the FILE, so a store can deny one and allow the other.
+ *
+ * The S3 probe leaves its probe object behind whenever the store denies
+ * deletion — that is the store working as intended, not a leak, and the probe
+ * key is named in every check detail so it can be reconciled or lifecycled.
+ *
+ * Never in the output: credentials, the `authorization` header, or the session
+ * token — a diagnostic that gets pasted into an issue tracker must be safe to
+ * paste (plan delta D6).
+ */
+import { closeSync, openSync, unlinkSync, writeSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { sigV4Headers } from "./sigv4.js";
+const PROBE_BODY = Buffer.from(`${JSON.stringify({ probe: "usertrust-anchor-doctor", note: "safe to delete" })}\n`, "utf8");
+// ── Report helpers ──
+const pass = (name, detail) => ({ name, status: "pass", detail });
+const fail = (name, detail) => ({ name, status: "fail", detail });
+const info = (name, detail) => ({ name, status: "info", detail });
+function report(sink, checks) {
+    return { sink, checks, failed: checks.some((c) => c.status === "fail") };
+}
+/**
+ * Untrusted text (store error bodies, transport error messages) on its way into
+ * a check detail. Anything that could carry a signed header is dropped to the
+ * end of its line rather than partially masked — a diagnostic is worth less
+ * than a credential.
+ */
+function redact(text) {
+    const scrubbed = text
+        .replace(/authorization[^\n]*/gi, "[redacted]")
+        .replace(/x-amz-security-token[^\n]*/gi, "[redacted]")
+        .replace(/AWS4-HMAC-SHA256[^\n]*/g, "[redacted]")
+        .replace(/Credential=[^\s,]*/g, "[redacted]")
+        .replace(/Signature=[^\s,]*/g, "[redacted]")
+        .replace(/\s+/g, " ")
+        .trim();
+    return scrubbed.length > 120 ? `${scrubbed.slice(0, 120)}…` : scrubbed;
+}
+const messageOf = (err) => redact(err instanceof Error ? err.message : String(err));
+const errnoOf = (err) => typeof err.code === "string" ? err.code : "unknown";
+// ── File sink ──
+/**
+ * Probe the directory holding a file sink. The probe object is created next to
+ * the store file (same directory, hence same permissions) and removed again.
+ */
+export function doctorFileSink(sinkPath) {
+    const sink = `file:${sinkPath}`;
+    const dir = dirname(sinkPath);
+    // PID-scoped so concurrent doctors never probe each other's object; opened
+    // with "w" so a stale probe from a crashed run is reused, not fatal.
+    const probe = join(dir, `.doctor-probe-${process.pid}`);
+    const created = writeProbe(probe);
+    if (created !== null) {
+        return report(sink, [
+            info("probe", `cannot probe: this identity could not create a probe object in ${dir} (${created}) — ` +
+                "the store's delete and overwrite permissions were not exercised"),
+        ]);
+    }
+    const checks = [];
+    let deleted = false;
+    try {
+        unlinkSync(probe);
+        deleted = true;
+        checks.push(fail("delete-denied", `this identity could delete a probe object at ${probe} right now`));
+    }
+    catch (err) {
+        checks.push(pass("delete-denied", `this identity could not delete a probe object at ${probe} right now (${errnoOf(err)})`));
+    }
+    // The delete probe consumed the object when it succeeded; the overwrite
+    // probe needs one to truncate.
+    const recreated = deleted ? writeProbe(probe) : null;
+    if (recreated !== null) {
+        checks.push(info("overwrite-denied", `cannot probe overwrite: ${recreated}`));
+        return report(sink, checks);
+    }
+    checks.push(overwriteProbe(probe));
+    try {
+        unlinkSync(probe);
+    }
+    catch {
+        // Best effort: a store that refuses the delete is the passing case, and
+        // the probe object is named in the check detail either way.
+    }
+    return report(sink, checks);
+}
+/** Creates or truncates the probe object; returns an errno on failure, else null. */
+function writeProbe(probe) {
+    try {
+        const fd = openSync(probe, "w", 0o600);
+        try {
+            writeSync(fd, PROBE_BODY);
+        }
+        finally {
+            closeSync(fd);
+        }
+        return null;
+    }
+    catch (err) {
+        return errnoOf(err);
+    }
+}
+function overwriteProbe(probe) {
+    const errno = writeProbe(probe);
+    return errno === null
+        ? fail("overwrite-denied", `this identity could overwrite a probe object at ${probe} right now`)
+        : pass("overwrite-denied", `this identity could not overwrite a probe object at ${probe} right now (${errno})`);
+}
+// ── S3 sink ──
+/**
+ * Probe an S3-compatible store: write a probe object, then attempt the two
+ * operations an append-only store must refuse against that same key.
+ */
+export async function doctorS3Sink(cfg, transport = httpsTransport) {
+    const prefix = (cfg.prefix ?? "anchors").replace(/^\/+|\/+$/g, "");
+    const sink = `s3:${cfg.bucket}/${prefix}`;
+    const creds = credentialsFromEnv();
+    if (creds === null) {
+        return report(sink, [
+            info("probe", "cannot probe: AWS credentials not found in the environment " +
+                "(AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY)"),
+        ]);
+    }
+    const target = probeTarget(cfg, prefix);
+    const loc = `s3://${cfg.bucket}/${target.key}`;
+    const send = (method, payload) => s3Request(transport, target, cfg.region, method, payload, creds);
+    const put = await attempt(() => send("PUT", PROBE_BODY));
+    if (put.error !== null) {
+        return report(sink, [info("probe", `cannot probe: writing ${loc} failed — ${put.error}`)]);
+    }
+    if (!is2xx(put.status)) {
+        return report(sink, [
+            info("probe", `cannot probe: writing ${loc} returned HTTP ${put.status}${snippet(put.body)} — ` +
+                "the store's delete and overwrite permissions were not exercised"),
+        ]);
+    }
+    return report(sink, [
+        verdict("delete-denied", "delete", loc, await attempt(() => send("DELETE", Buffer.alloc(0)))),
+        verdict("overwrite-denied", "overwrite", loc, await attempt(() => send("PUT", PROBE_BODY))),
+    ]);
+}
+async function attempt(run) {
+    try {
+        const res = await run();
+        const headers = res.headers ?? {};
+        const versionId = Object.entries(headers).find(([k]) => k.toLowerCase() === "x-amz-version-id")?.[1] ?? null;
+        return { status: res.status, body: res.body, versionId, error: null };
+    }
+    catch (err) {
+        return { status: 0, body: "", versionId: null, error: messageOf(err) };
+    }
+}
+/**
+ * Turn one store response into a verdict. 403 is the shape a store takes when
+ * its policy refuses; a 2xx that carries `x-amz-version-id` is neither a
+ * refusal nor a true overwrite, so it reports as info rather than a verdict.
+ */
+function verdict(name, op, loc, res) {
+    if (res.error !== null) {
+        return info(name, `cannot probe ${op}: ${loc} — ${res.error}`);
+    }
+    if (res.status === 403) {
+        return pass(name, `this identity could not ${op} a probe object at ${loc} right now (HTTP 403)`);
+    }
+    if (!is2xx(res.status)) {
+        return info(name, `inconclusive: ${op} of ${loc} returned HTTP ${res.status}${snippet(res.body)}`);
+    }
+    if (op === "overwrite" && res.versionId !== null) {
+        return info(name, `this identity could write a new version of a probe object at ${loc} right now ` +
+            `(HTTP ${res.status}, x-amz-version-id) — a new version does not remove the previous ` +
+            "one; confirm Object Lock retention denies deletion of individual versions");
+    }
+    return fail(name, `this identity could ${op} a probe object at ${loc} right now (HTTP ${res.status})`);
+}
+const is2xx = (status) => status >= 200 && status < 300;
+const snippet = (body) => (body === "" ? "" : `: ${redact(body)}`);
+function credentialsFromEnv() {
+    const accessKeyId = process.env.AWS_ACCESS_KEY_ID;
+    const secretAccessKey = process.env.AWS_SECRET_ACCESS_KEY;
+    if (!accessKeyId || !secretAccessKey)
+        return null;
+    const sessionToken = process.env.AWS_SESSION_TOKEN;
+    return { accessKeyId, secretAccessKey, ...(sessionToken ? { sessionToken } : {}) };
+}
+/** Virtual-host addressing by default; path-style when an endpoint is configured. */
+function probeTarget(cfg, prefix) {
+    const key = `${prefix === "" ? "" : `${prefix}/`}doctor-probe/${process.pid}-${amzDate()}.json`;
+    const encoded = key.split("/").map(encodeURIComponent).join("/");
+    if (cfg.endpoint !== undefined) {
+        const base = parseEndpoint(cfg.endpoint);
+        const path = `/${encodeURIComponent(cfg.bucket)}/${encoded}`;
+        return { host: base.host, path, url: `${base.protocol}//${base.host}${path}`, key };
+    }
+    const host = `${cfg.bucket}.s3.${cfg.region}.amazonaws.com`;
+    return { host, path: `/${encoded}`, url: `https://${host}/${encoded}`, key };
+}
+/**
+ * Endpoint for an S3-compatible store, under the SAME rule as the sink
+ * (rekor.ts / s3-sink): plaintext is refused off-loopback. The doctor's probes
+ * are SigV4-signed like any other request, so an http endpoint on the network
+ * would put the credential-bearing headers on the wire — and a diagnostic
+ * command is exactly where an operator would paste an attacker-suggested URL.
+ * Loopback stays allowed for dev MinIO/LocalStack.
+ */
+function parseEndpoint(endpoint) {
+    let url;
+    try {
+        url = new URL(endpoint);
+    }
+    catch {
+        throw new Error(`s3 doctor: endpoint must include a scheme, got "${endpoint.slice(0, 60)}"`);
+    }
+    const loopback = url.hostname === "localhost" || url.hostname === "127.0.0.1";
+    if (url.protocol !== "https:" && !(url.protocol === "http:" && loopback)) {
+        throw new Error(`s3 doctor: endpoint must be https (http is allowed only for localhost/127.0.0.1), got "${url.protocol}//${url.host}"`);
+    }
+    return url;
+}
+/** `YYYYMMDDTHHMMSSZ` — also the probe key's uniqueness across runs. */
+function amzDate() {
+    return `${new Date().toISOString().replace(/[-:]/g, "").slice(0, 15)}Z`;
+}
+function s3Request(transport, target, region, method, payload, creds) {
+    const extra = payload.length > 0 ? { "content-type": "application/json" } : {};
+    const signed = sigV4Headers({
+        method,
+        host: target.host,
+        path: target.path,
+        headers: extra,
+        payload,
+        region,
+        service: "s3",
+        amzDate: amzDate(),
+    }, creds);
+    // sigV4Headers signs caller headers but returns only its own — the caller
+    // must send both, or the signature covers headers that never arrive.
+    return transport({ method, url: target.url, headers: { ...extra, ...signed }, body: payload });
+}
+/** Default transport. `http://` endpoints (dev MinIO) require an injected one. */
+async function httpsTransport(opts) {
+    const { request } = await import("node:https");
+    return new Promise((resolve, reject) => {
+        const req = request(opts.url, {
+            method: opts.method,
+            headers: { ...opts.headers, "content-length": String(opts.body.length) },
+            timeout: 15_000,
+        }, (res) => {
+            const chunks = [];
+            res.on("data", (c) => chunks.push(c));
+            res.on("end", () => {
+                const headers = {};
+                for (const [name, value] of Object.entries(res.headers)) {
+                    if (typeof value === "string")
+                        headers[name] = value;
+                }
+                resolve({
+                    status: res.statusCode ?? 0,
+                    body: Buffer.concat(chunks).toString("utf8").slice(0, 4096),
+                    headers,
+                });
+            });
+        });
+        req.on("timeout", () => req.destroy(new Error("s3 doctor: request timeout")));
+        req.on("error", reject);
+        req.end(opts.body);
+    });
+}
+//# sourceMappingURL=anchor-doctor.js.map