@connexum/ai-governance 1.0.0-beta.11

package/dist/esm/governance/prohibited-practices.js

@@ -0,0 +1,230 @@
+/**
+ * ProhibitedPractices -- EU AI Act Art. 5 enforcement.
+ *
+ * Detects and blocks AI practices explicitly prohibited under
+ * EU AI Act Article 5, including social scoring, real-time
+ * biometric identification, subliminal manipulation, and
+ * exploitation of vulnerabilities.
+ *
+ * T-073: Map to EU AI Act Art. 5 prohibited practices.
+ *
+ * @connexum/ai-governance
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import { createLogger } from '../util/log.js';
+const log = createLogger('prohibited-practices');
+/** Default prohibited practice patterns based on EU AI Act Art. 5 */
+const DEFAULT_PATTERNS = [
+    {
+        id: 'art5-1a-subliminal',
+        article: 'Art. 5(1)(a)',
+        category: 'SUBLIMINAL_MANIPULATION',
+        description: 'Subliminal techniques beyond consciousness to materially distort behavior',
+        indicators: [
+            'subliminal', 'subconscious manipulation', 'below consciousness',
+            'hidden persuasion', 'dark pattern', 'manipulate without awareness',
+            'covert influence', 'behavioral nudge without consent',
+        ],
+        severity: 'CRITICAL',
+    },
+    {
+        id: 'art5-1b-exploitation',
+        article: 'Art. 5(1)(b)',
+        category: 'EXPLOITATION',
+        description: 'Exploiting vulnerabilities due to age, disability, or social/economic situation',
+        indicators: [
+            'exploit vulnerability', 'target elderly', 'target children',
+            'exploit disability', 'exploit poverty', 'predatory targeting',
+            'vulnerable population targeting', 'exploit mental health',
+            'target cognitive impairment',
+        ],
+        severity: 'CRITICAL',
+    },
+    {
+        id: 'art5-1c-social-scoring',
+        article: 'Art. 5(1)(c)',
+        category: 'SOCIAL_SCORING',
+        description: 'Social scoring leading to detrimental treatment',
+        indicators: [
+            'social score', 'social credit', 'citizen score', 'trustworthiness score',
+            'social rating', 'behavioral score', 'reputation score for access',
+            'score based on social behavior', 'credit score from social media',
+        ],
+        severity: 'CRITICAL',
+    },
+    {
+        id: 'art5-1d-biometric-realtime',
+        article: 'Art. 5(1)(d)',
+        category: 'REAL_TIME_BIOMETRIC',
+        description: 'Real-time remote biometric identification in public spaces',
+        indicators: [
+            'real-time biometric', 'live facial recognition', 'mass surveillance',
+            'public space identification', 'realtime face detection',
+            'biometric surveillance', 'live face matching',
+        ],
+        severity: 'CRITICAL',
+    },
+    {
+        id: 'art5-1d-predictive-policing',
+        article: 'Art. 5(1)(d)',
+        category: 'PREDICTIVE_POLICING',
+        description: 'Individual risk assessment for criminal offences based solely on profiling',
+        indicators: [
+            'predictive policing', 'crime prediction', 'criminal profiling',
+            'pre-crime', 'risk of offending', 'recidivism prediction',
+            'criminal risk score', 'predict criminal behavior',
+        ],
+        severity: 'CRITICAL',
+    },
+    {
+        id: 'art5-1e-facial-db',
+        article: 'Art. 5(1)(e)',
+        category: 'FACIAL_RECOGNITION_DB',
+        description: 'Untargeted scraping of facial images for recognition databases',
+        indicators: [
+            'scrape faces', 'facial recognition database', 'mass face collection',
+            'untargeted facial scraping', 'bulk biometric collection',
+            'facial image harvesting', 'clearview',
+        ],
+        severity: 'CRITICAL',
+    },
+    {
+        id: 'art5-1f-emotion-workplace',
+        article: 'Art. 5(1)(f)',
+        category: 'EMOTION_RECOGNITION',
+        description: 'Emotion recognition in workplace or educational settings',
+        indicators: [
+            'emotion detection workplace', 'employee emotion', 'student emotion',
+            'workplace sentiment analysis faces', 'classroom emotion monitoring',
+            'affect recognition employee', 'emotional state worker',
+        ],
+        severity: 'HIGH',
+    },
+];
+export class ProhibitedPractices {
+    config;
+    patterns;
+    violationFile;
+    constructor(config) {
+        this.config = {
+            enforceBlock: true,
+            customPatterns: [],
+            ...config,
+        };
+        if (!fs.existsSync(config.dataDir)) {
+            fs.mkdirSync(config.dataDir, { recursive: true });
+        }
+        this.patterns = [...DEFAULT_PATTERNS, ...this.config.customPatterns];
+        this.violationFile = path.join(config.dataDir, 'prohibited-violations.jsonl');
+    }
+    /**
+     * Check content for prohibited practices.
+     */
+    check(content) {
+        const lower = content.toLowerCase();
+        const violations = [];
+        for (const pattern of this.patterns) {
+            const matched = pattern.indicators.filter(ind => lower.includes(ind.toLowerCase()));
+            if (matched.length > 0) {
+                const violation = {
+                    id: `viol_${Date.now()}_${pattern.id}`,
+                    pattern,
+                    content: content.substring(0, 200), // Truncate for logging
+                    matchedIndicators: matched,
+                    action: this.config.enforceBlock ? 'BLOCKED' : 'WARNED',
+                    agentName: this.config.agentName,
+                    detectedAt: new Date().toISOString(),
+                };
+                violations.push(violation);
+                this.persistViolation(violation);
+                log.warn(`Prohibited practice detected: ${pattern.category}`, {
+                    article: pattern.article,
+                    agent: this.config.agentName,
+                    action: violation.action,
+                    indicators: matched.length,
+                });
+            }
+        }
+        return {
+            allowed: this.config.enforceBlock ? violations.length === 0 : true,
+            violations,
+            checkedPatterns: this.patterns.length,
+        };
+    }
+    /**
+     * Check a tool call for prohibited practices.
+     * Inspects tool name and arguments.
+     */
+    checkToolCall(toolName, args) {
+        const content = `${toolName} ${JSON.stringify(args)}`;
+        return this.check(content);
+    }
+    /**
+     * Get all recorded violations.
+     */
+    getViolations(limit = 100) {
+        if (!fs.existsSync(this.violationFile))
+            return [];
+        try {
+            const lines = fs.readFileSync(this.violationFile, 'utf-8')
+                .trim()
+                .split('\n')
+                .filter(Boolean);
+            return lines
+                .slice(-limit)
+                .map(line => {
+                try {
+                    return JSON.parse(line);
+                }
+                catch {
+                    return null;
+                }
+            })
+                .filter((v) => v !== null);
+        }
+        catch {
+            return [];
+        }
+    }
+    /**
+     * Get statistics.
+     */
+    getStats() {
+        const violations = this.getViolations(1000);
+        const byCategory = {};
+        const byArticle = {};
+        let blocked = 0;
+        let warned = 0;
+        for (const v of violations) {
+            byCategory[v.pattern.category] = (byCategory[v.pattern.category] || 0) + 1;
+            byArticle[v.pattern.article] = (byArticle[v.pattern.article] || 0) + 1;
+            if (v.action === 'BLOCKED')
+                blocked++;
+            else
+                warned++;
+        }
+        return { totalViolations: violations.length, byCategory, byArticle, blocked, warned };
+    }
+    /**
+     * Get all active patterns.
+     */
+    getPatterns() {
+        return [...this.patterns];
+    }
+    /**
+     * Add a custom pattern at runtime.
+     */
+    addPattern(pattern) {
+        this.patterns.push(pattern);
+    }
+    persistViolation(violation) {
+        try {
+            fs.appendFileSync(this.violationFile, JSON.stringify(violation) + '\n');
+        }
+        catch {
+            log.error('Failed to persist prohibited practice violation');
+        }
+    }
+}
+//# sourceMappingURL=prohibited-practices.js.map

package/dist/esm/governance/prohibited-practices.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"prohibited-practices.js","sourceRoot":"","sources":["../../../src/governance/prohibited-practices.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,GAAG,GAAG,YAAY,CAAC,sBAAsB,CAAC,CAAC;AAiDjD,qEAAqE;AACrE,MAAM,gBAAgB,GAAwB;IAC5C;QACE,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,yBAAyB;QACnC,WAAW,EAAE,2EAA2E;QACxF,UAAU,EAAE;YACV,YAAY,EAAE,2BAA2B,EAAE,qBAAqB;YAChE,mBAAmB,EAAE,cAAc,EAAE,8BAA8B;YACnE,kBAAkB,EAAE,kCAAkC;SACvD;QACD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,iFAAiF;QAC9F,UAAU,EAAE;YACV,uBAAuB,EAAE,gBAAgB,EAAE,iBAAiB;YAC5D,oBAAoB,EAAE,iBAAiB,EAAE,qBAAqB;YAC9D,iCAAiC,EAAE,uBAAuB;YAC1D,6BAA6B;SAC9B;QACD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,gBAAgB;QAC1B,WAAW,EAAE,iDAAiD;QAC9D,UAAU,EAAE;YACV,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,uBAAuB;YACzE,eAAe,EAAE,kBAAkB,EAAE,6BAA6B;YAClE,gCAAgC,EAAE,gCAAgC;SACnE;QACD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,4BAA4B;QAChC,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,qBAAqB;QAC/B,WAAW,EAAE,4DAA4D;QACzE,UAAU,EAAE;YACV,qBAAqB,EAAE,yBAAyB,EAAE,mBAAmB;YACrE,6BAA6B,EAAE,yBAAyB;YACxD,wBAAwB,EAAE,oBAAoB;SAC/C;QACD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,6BAA6B;QACjC,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,qBAAqB;QAC/B,WAAW,EAAE,4EAA4E;QACzF,UAAU,EAAE;YACV,qBAAqB,EAAE,kBAAkB,EAAE,oBAAoB;YAC/D,WAAW,EAAE,mBAAmB,EAAE,uBAAuB;YACzD,qBAAqB,EAAE,2BAA2B;SACnD;QACD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,uBAAuB;QACjC,WAAW,EAAE,gEAAgE;QAC7E,UAAU,EAAE;YACV,cAAc,EAAE,6BAA6B,EAAE,sBAAsB;YACrE,4BAA4B,EAAE,2BAA2B;YACzD,yBAAyB,EAAE,WAAW;SACvC;QACD,QAAQ,EAAE,UAAU;KACrB;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,OAAO,EAAE,cAAc;QACvB,QAAQ,EAAE,qBAAqB;QAC/B,WAAW,EAAE,0DAA0D;QACvE,UAAU,EAAE;YACV,6BAA6B,EAAE,kBAAkB,EAAE,iBAAiB;YACpE,oCAAoC,EAAE,8BAA8B;YACpE,6BAA6B,EAAE,wBAAwB;SACxD;QACD,QAAQ,EAAE,MAAM;KACjB;CACF,CAAC;AAEF,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAsC;IAC5C,QAAQ,CAAsB;IAC9B,aAAa,CAAS;IAE9B,YAAY,MAAiC;QAC3C,IAAI,CAAC,MAAM,GAAG;YACZ,YAAY,EAAE,IAAI;YAClB,cAAc,EAAE,EAAE;YAClB,GAAG,MAAM;SACV,CAAC;QAEF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YACnC,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC;QAED,IAAI,CAAC,QAAQ,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QACrE,IAAI,CAAC,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC,CAAC;IAChF,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,OAAe;QACnB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;QACpC,MAAM,UAAU,GAAwB,EAAE,CAAC;QAE3C,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACpC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;YAEpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,MAAM,SAAS,GAAsB;oBACnC,EAAE,EAAE,QAAQ,IAAI,CAAC,GAAG,EAAE,IAAI,OAAO,CAAC,EAAE,EAAE;oBACtC,OAAO;oBACP,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,uBAAuB;oBAC3D,iBAAiB,EAAE,OAAO;oBAC1B,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;oBACvD,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAChC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;iBACrC,CAAC;gBAEF,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBAC3B,IAAI,CAAC,gBAAgB,CAAC,SAAS,CAAC,CAAC;gBAEjC,GAAG,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,QAAQ,EAAE,EAAE;oBAC5D,OAAO,EAAE,OAAO,CAAC,OAAO;oBACxB,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,SAAS;oBAC5B,MAAM,EAAE,SAAS,CAAC,MAAM;oBACxB,UAAU,EAAE,OAAO,CAAC,MAAM;iBAC3B,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;YAClE,UAAU;YACV,eAAe,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM;SACtC,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,QAAgB,EAAE,IAA6B;QAC3D,MAAM,OAAO,GAAG,GAAG,QAAQ,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,QAAgB,GAAG;QAC/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,CAAC;QAElD,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,CAAC;iBACvD,IAAI,EAAE;iBACN,KAAK,CAAC,IAAI,CAAC;iBACX,MAAM,CAAC,OAAO,CAAC,CAAC;YAEnB,OAAO,KAAK;iBACT,KAAK,CAAC,CAAC,KAAK,CAAC;iBACb,GAAG,CAAC,IAAI,CAAC,EAAE;gBACV,IAAI,CAAC;oBAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,OAAO,IAAI,CAAC;gBAAC,CAAC;YACzD,CAAC,CAAC;iBACD,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IAED;;OAEG;IACH,QAAQ;QAON,MAAM,UAAU,GAAG,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,UAAU,GAA2B,EAAE,CAAC;QAC9C,MAAM,SAAS,GAA2B,EAAE,CAAC;QAC7C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,IAAI,MAAM,GAAG,CAAC,CAAC;QAEf,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;YAC3B,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YAC3E,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;gBAAE,OAAO,EAAE,CAAC;;gBACjC,MAAM,EAAE,CAAC;QAChB,CAAC;QAED,OAAO,EAAE,eAAe,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACxF,CAAC;IAED;;OAEG;IACH,WAAW;QACT,OAAO,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,OAA0B;QACnC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9B,CAAC;IAEO,gBAAgB,CAAC,SAA4B;QACnD,IAAI,CAAC;YACH,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QAC1E,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,KAAK,CAAC,iDAAiD,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;CACF"}

package/dist/esm/governance/proxy-onboarding.js

@@ -0,0 +1,302 @@
+/**
+ * Proxy Self-Serve Onboarding (W4.4 of F-NEW-PRODUCT-AGENT-VISIBILITY-CLUSTER-2026-05-12).
+ *
+ * Generates the customer-side onboarding payload for the already-shipped
+ * F-NEW-PRODUCT-PROXY-TIER Mode A v1 (PRs #696-#715, all 8 LLM providers).
+ * Customer signs up, picks a provider, gets a copy-paste snippet that swaps
+ * one URL/header to start routing through governed.my-cc.io. Zero infra.
+ *
+ * Honors the existing Mode A invariants:
+ *   - Customer's LLM API key flows per-request via X-LLM-API-Key
+ *   - Keys never persist on our side
+ *   - Pass-through if our proxy degrades (Invariant 2)
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-PROXY-SELFSERVE-ONBOARDING
+ */
+const DEFAULT_PROXY_HOST = 'proxy.my-cc.io';
+function providerLabel(p) {
+    return p
+        .split('-')
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+        .join(' ');
+}
+function snippetFor(provider, language, proxyBaseUrl, tenantId) {
+    if (language === 'typescript') {
+        switch (provider) {
+            case 'anthropic':
+                return tsAnthropic(proxyBaseUrl, tenantId);
+            case 'openai':
+                return tsOpenai(proxyBaseUrl, tenantId);
+            case 'azure-openai':
+                return tsAzureOpenai(proxyBaseUrl, tenantId);
+            case 'bedrock':
+                return tsBedrock(proxyBaseUrl, tenantId);
+            case 'gemini-aistudio':
+                return tsGeminiAistudio(proxyBaseUrl, tenantId);
+            case 'gemini-vertex':
+                return tsGeminiVertex(proxyBaseUrl, tenantId);
+            case 'deepseek':
+                return tsDeepseek(proxyBaseUrl, tenantId);
+            case 'replicate':
+                return tsReplicate(proxyBaseUrl, tenantId);
+            case 'huggingface':
+                return tsHuggingface(proxyBaseUrl, tenantId);
+        }
+    }
+    // python
+    switch (provider) {
+        case 'anthropic':
+            return pyAnthropic(proxyBaseUrl, tenantId);
+        case 'openai':
+            return pyOpenai(proxyBaseUrl, tenantId);
+        case 'azure-openai':
+            return pyAzureOpenai(proxyBaseUrl, tenantId);
+        case 'bedrock':
+            return pyBedrock(proxyBaseUrl, tenantId);
+        case 'gemini-aistudio':
+            return pyGeminiAistudio(proxyBaseUrl, tenantId);
+        case 'gemini-vertex':
+            return pyGeminiVertex(proxyBaseUrl, tenantId);
+        case 'deepseek':
+            return pyDeepseek(proxyBaseUrl, tenantId);
+        case 'replicate':
+            return pyReplicate(proxyBaseUrl, tenantId);
+        case 'huggingface':
+            return pyHuggingface(proxyBaseUrl, tenantId);
+    }
+}
+function tsAnthropic(host, tenant) {
+    return `import Anthropic from '@anthropic-ai/sdk';
+
+const client = new Anthropic({
+  apiKey: 'governed-by-my-cc',                       // placeholder; real key in header
+  baseURL: '${host}/anthropic',
+  defaultHeaders: {
+    'X-LLM-API-Key': process.env.ANTHROPIC_API_KEY!,
+    'X-Connexum-Tenant': '${tenant}',
+  },
+});
+// Use client.messages.create(...) as usual.`;
+}
+function tsOpenai(host, tenant) {
+    return `import OpenAI from 'openai';
+
+const client = new OpenAI({
+  apiKey: 'governed-by-my-cc',
+  baseURL: '${host}/openai/v1',
+  defaultHeaders: {
+    'X-LLM-API-Key': process.env.OPENAI_API_KEY!,
+    'X-Connexum-Tenant': '${tenant}',
+  },
+});`;
+}
+function tsAzureOpenai(host, tenant) {
+    return `import OpenAI from 'openai';
+
+const client = new OpenAI({
+  apiKey: 'governed-by-my-cc',
+  baseURL: '${host}/azure-openai',
+  defaultHeaders: {
+    'X-LLM-API-Key': process.env.AZURE_OPENAI_KEY!,
+    'X-Azure-Resource': process.env.AZURE_RESOURCE_NAME!,
+    'X-Connexum-Tenant': '${tenant}',
+  },
+});`;
+}
+function tsBedrock(host, tenant) {
+    return `// AWS Bedrock — keep your SigV4 creds local; we route via proxy:
+const client = new BedrockRuntimeClient({
+  endpoint: '${host}/bedrock',
+  credentials: { /* your local SigV4 creds */ },
+  customUserAgent: 'x-connexum-tenant/${tenant}',
+});`;
+}
+function tsGeminiAistudio(host, tenant) {
+    return `import { GoogleGenerativeAI } from '@google/generative-ai';
+
+const proxy = '${host}/gemini-aistudio';
+// Use fetch directly or wrap the SDK with baseUrl=proxy + headers:
+//   X-LLM-API-Key: <your GEMINI_API_KEY>
+//   X-Connexum-Tenant: ${tenant}`;
+}
+function tsGeminiVertex(host, tenant) {
+    return `// Gemini Vertex AI via proxy:
+const url = '${host}/gemini-vertex/v1/projects/<project>/locations/<region>/publishers/google/models/<model>:generateContent';
+// Headers:
+//   X-LLM-API-Key: <Vertex access token>
+//   X-Connexum-Tenant: ${tenant}`;
+}
+function tsDeepseek(host, tenant) {
+    return `import OpenAI from 'openai';
+
+const client = new OpenAI({
+  apiKey: 'governed-by-my-cc',
+  baseURL: '${host}/deepseek/v1',
+  defaultHeaders: {
+    'X-LLM-API-Key': process.env.DEEPSEEK_API_KEY!,
+    'X-Connexum-Tenant': '${tenant}',
+  },
+});`;
+}
+function tsReplicate(host, tenant) {
+    return `import Replicate from 'replicate';
+
+const client = new Replicate({
+  auth: 'governed-by-my-cc',
+  baseUrl: '${host}/replicate',
+  // headers via fetch override:
+  //   Authorization: Token <REPLICATE_API_TOKEN>   -> we extract to X-LLM-API-Key
+  //   X-Connexum-Tenant: ${tenant}
+});`;
+}
+function tsHuggingface(host, tenant) {
+    return `// Hugging Face Inference API via proxy:
+const url = '${host}/huggingface/v1/chat/completions';
+// Headers:
+//   Authorization: Bearer <HF_TOKEN>   -> we extract to X-LLM-API-Key
+//   X-Connexum-Tenant: ${tenant}`;
+}
+function pyAnthropic(host, tenant) {
+    return `from anthropic import Anthropic
+
+client = Anthropic(
+    api_key="governed-by-my-cc",
+    base_url="${host}/anthropic",
+    default_headers={
+        "X-LLM-API-Key": os.environ["ANTHROPIC_API_KEY"],
+        "X-Connexum-Tenant": "${tenant}",
+    },
+)`;
+}
+function pyOpenai(host, tenant) {
+    return `from openai import OpenAI
+
+client = OpenAI(
+    api_key="governed-by-my-cc",
+    base_url="${host}/openai/v1",
+    default_headers={
+        "X-LLM-API-Key": os.environ["OPENAI_API_KEY"],
+        "X-Connexum-Tenant": "${tenant}",
+    },
+)`;
+}
+function pyAzureOpenai(host, tenant) {
+    return `from openai import OpenAI
+
+client = OpenAI(
+    api_key="governed-by-my-cc",
+    base_url="${host}/azure-openai",
+    default_headers={
+        "X-LLM-API-Key": os.environ["AZURE_OPENAI_KEY"],
+        "X-Azure-Resource": os.environ["AZURE_RESOURCE_NAME"],
+        "X-Connexum-Tenant": "${tenant}",
+    },
+)`;
+}
+function pyBedrock(host, tenant) {
+    return `# Bedrock via proxy — keep SigV4 local:
+import boto3
+client = boto3.client(
+    "bedrock-runtime",
+    endpoint_url="${host}/bedrock",
+)
+# Headers via botocore event-handler: X-Connexum-Tenant: ${tenant}`;
+}
+function pyGeminiAistudio(host, tenant) {
+    return `# Gemini AI Studio via proxy:
+url = "${host}/gemini-aistudio"
+# Headers:
+#   X-LLM-API-Key: <GEMINI_API_KEY>
+#   X-Connexum-Tenant: ${tenant}`;
+}
+function pyGeminiVertex(host, tenant) {
+    return `# Gemini Vertex AI via proxy:
+url = "${host}/gemini-vertex/v1/projects/<project>/locations/<region>/publishers/google/models/<model>:generateContent"
+# Headers:
+#   X-LLM-API-Key: <Vertex access token>
+#   X-Connexum-Tenant: ${tenant}`;
+}
+function pyDeepseek(host, tenant) {
+    return `from openai import OpenAI
+
+client = OpenAI(
+    api_key="governed-by-my-cc",
+    base_url="${host}/deepseek/v1",
+    default_headers={
+        "X-LLM-API-Key": os.environ["DEEPSEEK_API_KEY"],
+        "X-Connexum-Tenant": "${tenant}",
+    },
+)`;
+}
+function pyReplicate(host, tenant) {
+    return `import replicate
+
+# Set base_url + extract Token to X-LLM-API-Key in your http client:
+client = replicate.Client(api_token="governed-by-my-cc")
+client.base_url = "${host}/replicate"
+# Headers via session.headers:
+#   Authorization: Token <REPLICATE_API_TOKEN>
+#   X-Connexum-Tenant: ${tenant}`;
+}
+function pyHuggingface(host, tenant) {
+    return `# Hugging Face Inference API via proxy:
+url = "${host}/huggingface/v1/chat/completions"
+# Headers:
+#   Authorization: Bearer <HF_TOKEN>
+#   X-Connexum-Tenant: ${tenant}`;
+}
+function envVarsFor(provider) {
+    switch (provider) {
+        case 'anthropic':
+            return { ANTHROPIC_API_KEY: 'your Anthropic key — never sent to our backend' };
+        case 'openai':
+            return { OPENAI_API_KEY: 'your OpenAI key — never sent to our backend' };
+        case 'azure-openai':
+            return {
+                AZURE_OPENAI_KEY: 'your Azure OpenAI key',
+                AZURE_RESOURCE_NAME: 'your Azure OpenAI resource name',
+            };
+        case 'bedrock':
+            return { AWS_ACCESS_KEY_ID: 'your AWS access key', AWS_SECRET_ACCESS_KEY: 'your AWS secret', AWS_REGION: 'us-east-1' };
+        case 'gemini-aistudio':
+            return { GEMINI_API_KEY: 'your Gemini AI Studio key' };
+        case 'gemini-vertex':
+            return { GOOGLE_APPLICATION_CREDENTIALS: 'path to your Vertex SA key' };
+        case 'deepseek':
+            return { DEEPSEEK_API_KEY: 'your DeepSeek key' };
+        case 'replicate':
+            return { REPLICATE_API_TOKEN: 'your Replicate token' };
+        case 'huggingface':
+            return { HF_TOKEN: 'your Hugging Face token' };
+    }
+}
+export function buildProxyOnboardingPayload(input) {
+    if (!input.tenantId || input.tenantId.trim() === '') {
+        throw new Error('buildProxyOnboardingPayload: tenantId is required');
+    }
+    const language = input.language ?? 'typescript';
+    const proxyHost = input.proxyHost ?? DEFAULT_PROXY_HOST;
+    const proxyBaseUrl = `https://${proxyHost}`;
+    return {
+        tenantId: input.tenantId,
+        provider: input.provider,
+        language,
+        proxyBaseUrl,
+        apiKeyHeader: 'X-LLM-API-Key',
+        envVars: envVarsFor(input.provider),
+        snippet: snippetFor(input.provider, language, proxyBaseUrl, input.tenantId),
+        firstEventEndpoint: `${proxyBaseUrl}/api/v1/onboarding/first-event?tenant=${encodeURIComponent(input.tenantId)}`,
+    };
+}
+export const SUPPORTED_PROVIDERS = [
+    'anthropic',
+    'openai',
+    'gemini-aistudio',
+    'gemini-vertex',
+    'bedrock',
+    'azure-openai',
+    'deepseek',
+    'replicate',
+    'huggingface',
+].map((p) => ({ id: p, label: providerLabel(p) }));
+//# sourceMappingURL=proxy-onboarding.js.map

package/dist/esm/governance/proxy-onboarding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-onboarding.js","sourceRoot":"","sources":["../../../src/governance/proxy-onboarding.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAwCH,MAAM,kBAAkB,GAAG,gBAAgB,CAAC;AAE5C,SAAS,aAAa,CAAC,CAAgB;IACrC,OAAO,CAAC;SACL,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CACjB,QAAuB,EACvB,QAAiC,EACjC,YAAoB,EACpB,QAAgB;IAEhB,IAAI,QAAQ,KAAK,YAAY,EAAE,CAAC;QAC9B,QAAQ,QAAQ,EAAE,CAAC;YACjB,KAAK,WAAW;gBACd,OAAO,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC7C,KAAK,QAAQ;gBACX,OAAO,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC1C,KAAK,cAAc;gBACjB,OAAO,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC/C,KAAK,SAAS;gBACZ,OAAO,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC3C,KAAK,iBAAiB;gBACpB,OAAO,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAClD,KAAK,eAAe;gBAClB,OAAO,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAChD,KAAK,UAAU;gBACb,OAAO,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC5C,KAAK,WAAW;gBACd,OAAO,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;YAC7C,KAAK,aAAa;gBAChB,OAAO,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IACD,SAAS;IACT,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC7C,KAAK,QAAQ;YACX,OAAO,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC1C,KAAK,cAAc;YACjB,OAAO,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC/C,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC3C,KAAK,iBAAiB;YACpB,OAAO,gBAAgB,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAClD,KAAK,eAAe;YAClB,OAAO,cAAc,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAChD,KAAK,UAAU;YACb,OAAO,UAAU,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC5C,KAAK,WAAW;YACd,OAAO,WAAW,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;QAC7C,KAAK,aAAa;YAChB,OAAO,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO;;;;cAIK,IAAI;;;4BAGU,MAAM;;;6CAGW,CAAC;AAC9C,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,OAAO;;;;cAIK,IAAI;;;4BAGU,MAAM;;IAE9B,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,OAAO;;;;cAIK,IAAI;;;;4BAIU,MAAM;;IAE9B,CAAC;AACL,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,OAAO;;eAEM,IAAI;;wCAEqB,MAAM;IAC1C,CAAC;AACL,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc;IACpD,OAAO;;iBAEQ,IAAI;;;0BAGK,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,OAAO;eACM,IAAI;;;0BAGO,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,OAAO;;;;cAIK,IAAI;;;4BAGU,MAAM;;IAE9B,CAAC;AACL,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO;;;;cAIK,IAAI;;;4BAGU,MAAM;IAC9B,CAAC;AACL,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,OAAO;eACM,IAAI;;;0BAGO,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO;;;;gBAIO,IAAI;;;gCAGY,MAAM;;EAEpC,CAAC;AACH,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,MAAc;IAC5C,OAAO;;;;gBAIO,IAAI;;;gCAGY,MAAM;;EAEpC,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,OAAO;;;;gBAIO,IAAI;;;;gCAIY,MAAM;;EAEpC,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,OAAO;;;;oBAIW,IAAI;;2DAEmC,MAAM,EAAE,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,MAAc;IACpD,OAAO;SACA,IAAI;;;yBAGY,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc;IAClD,OAAO;SACA,IAAI;;;yBAGY,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,MAAc;IAC9C,OAAO;;;;gBAIO,IAAI;;;gCAGY,MAAM;;EAEpC,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,OAAO;;;;qBAIY,IAAI;;;yBAGA,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,MAAc;IACjD,OAAO;SACA,IAAI;;;yBAGY,MAAM,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,UAAU,CAAC,QAAuB;IACzC,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,WAAW;YACd,OAAO,EAAE,iBAAiB,EAAE,gDAAgD,EAAE,CAAC;QACjF,KAAK,QAAQ;YACX,OAAO,EAAE,cAAc,EAAE,6CAA6C,EAAE,CAAC;QAC3E,KAAK,cAAc;YACjB,OAAO;gBACL,gBAAgB,EAAE,uBAAuB;gBACzC,mBAAmB,EAAE,iCAAiC;aACvD,CAAC;QACJ,KAAK,SAAS;YACZ,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,qBAAqB,EAAE,iBAAiB,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC;QACzH,KAAK,iBAAiB;YACpB,OAAO,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC;QACzD,KAAK,eAAe;YAClB,OAAO,EAAE,8BAA8B,EAAE,4BAA4B,EAAE,CAAC;QAC1E,KAAK,UAAU;YACb,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,CAAC;QACnD,KAAK,WAAW;YACd,OAAO,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,CAAC;QACzD,KAAK,aAAa;YAChB,OAAO,EAAE,QAAQ,EAAE,yBAAyB,EAAE,CAAC;IACnD,CAAC;AACH,CAAC;AAED,MAAM,UAAU,2BAA2B,CACzC,KAA2B;IAE3B,IAAI,CAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACpD,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACvE,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,YAAY,CAAC;IAChD,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,IAAI,kBAAkB,CAAC;IACxD,MAAM,YAAY,GAAG,WAAW,SAAS,EAAE,CAAC;IAC5C,OAAO;QACL,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,QAAQ;QACR,YAAY;QACZ,YAAY,EAAE,eAAe;QAC7B,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QACnC,OAAO,EAAE,UAAU,CAAC,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,QAAQ,CAAC;QAC3E,kBAAkB,EAAE,GAAG,YAAY,yCAAyC,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE;KACjH,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,mBAAmB,GAAwD;IACtF,WAAW;IACX,QAAQ;IACR,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,UAAU;IACV,WAAW;IACX,aAAa;CACd,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAkB,EAAE,KAAK,EAAE,aAAa,CAAC,CAAkB,CAAC,EAAE,CAAC,CAAC,CAAC"}

package/dist/esm/governance/proxy-onboarding.test.js

@@ -0,0 +1,100 @@
+/**
+ * RED-GREEN tests for F-NEW-PRODUCT-PROXY-SELFSERVE-ONBOARDING (W4.4).
+ *
+ * @connexum/ai-governance  F-NEW-PRODUCT-PROXY-SELFSERVE-ONBOARDING
+ */
+import { describe, it } from 'node:test';
+import * as assert from 'node:assert/strict';
+import { buildProxyOnboardingPayload, SUPPORTED_PROVIDERS, } from './proxy-onboarding.js';
+const ALL_PROVIDERS = [
+    'anthropic',
+    'openai',
+    'gemini-aistudio',
+    'gemini-vertex',
+    'bedrock',
+    'azure-openai',
+    'deepseek',
+    'replicate',
+    'huggingface',
+];
+describe('F-NEW-PRODUCT-PROXY-SELFSERVE-ONBOARDING (W4.4)', () => {
+    it('SUPPORTED_PROVIDERS covers all 9 Mode A v1 providers', () => {
+        assert.equal(SUPPORTED_PROVIDERS.length, 9);
+        const ids = SUPPORTED_PROVIDERS.map((p) => p.id).sort();
+        assert.deepEqual(ids, [...ALL_PROVIDERS].sort());
+    });
+    it('every provider produces a non-empty TypeScript snippet', () => {
+        for (const provider of ALL_PROVIDERS) {
+            const payload = buildProxyOnboardingPayload({ tenantId: 'tenant-1', provider });
+            assert.equal(payload.language, 'typescript');
+            assert.ok(payload.snippet.length > 0, `${provider} TS snippet`);
+            assert.ok(payload.snippet.includes('proxy.my-cc.io'), `${provider} TS snippet must reference proxy host`);
+        }
+    });
+    it('every provider produces a non-empty Python snippet', () => {
+        for (const provider of ALL_PROVIDERS) {
+            const payload = buildProxyOnboardingPayload({
+                tenantId: 'tenant-1',
+                provider,
+                language: 'python',
+            });
+            assert.equal(payload.language, 'python');
+            assert.ok(payload.snippet.length > 0, `${provider} Python snippet`);
+            assert.ok(payload.snippet.includes('proxy.my-cc.io'), `${provider} Python snippet must reference proxy host`);
+        }
+    });
+    it('snippet embeds the tenantId', () => {
+        const payload = buildProxyOnboardingPayload({
+            tenantId: 'org-acme-7821',
+            provider: 'anthropic',
+        });
+        assert.ok(payload.snippet.includes('org-acme-7821'));
+    });
+    it('Anthropic TS snippet references X-LLM-API-Key header', () => {
+        const payload = buildProxyOnboardingPayload({
+            tenantId: 'tenant-1',
+            provider: 'anthropic',
+        });
+        assert.ok(payload.snippet.includes('X-LLM-API-Key'));
+    });
+    it('OpenAI TS snippet uses /openai/v1 path', () => {
+        const payload = buildProxyOnboardingPayload({
+            tenantId: 'tenant-1',
+            provider: 'openai',
+        });
+        assert.ok(payload.snippet.includes('/openai/v1'));
+    });
+    it('Azure OpenAI snippet includes X-Azure-Resource header', () => {
+        const payload = buildProxyOnboardingPayload({
+            tenantId: 'tenant-1',
+            provider: 'azure-openai',
+        });
+        assert.ok(payload.snippet.includes('X-Azure-Resource'));
+    });
+    it('proxyHost override is honored', () => {
+        const payload = buildProxyOnboardingPayload({
+            tenantId: 'tenant-1',
+            provider: 'anthropic',
+            proxyHost: 'staging-proxy.my-cc.io',
+        });
+        assert.equal(payload.proxyBaseUrl, 'https://staging-proxy.my-cc.io');
+        assert.ok(payload.snippet.includes('staging-proxy.my-cc.io'));
+    });
+    it('envVars match the provider', () => {
+        const a = buildProxyOnboardingPayload({ tenantId: 't', provider: 'anthropic' });
+        const b = buildProxyOnboardingPayload({ tenantId: 't', provider: 'bedrock' });
+        assert.ok('ANTHROPIC_API_KEY' in a.envVars);
+        assert.ok('AWS_ACCESS_KEY_ID' in b.envVars);
+    });
+    it('firstEventEndpoint includes URL-encoded tenant id', () => {
+        const payload = buildProxyOnboardingPayload({
+            tenantId: 'acme co/123',
+            provider: 'anthropic',
+        });
+        assert.ok(payload.firstEventEndpoint.includes('acme%20co%2F123'));
+    });
+    it('missing tenantId throws (fail-closed)', () => {
+        assert.throws(() => buildProxyOnboardingPayload({ tenantId: '', provider: 'anthropic' }), /tenantId is required/);
+    });
+});
+//# sourceMappingURL=proxy-onboarding.test.js.map

package/dist/esm/governance/proxy-onboarding.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"proxy-onboarding.test.js","sourceRoot":"","sources":["../../../src/governance/proxy-onboarding.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,KAAK,MAAM,MAAM,oBAAoB,CAAC;AAE7C,OAAO,EACL,2BAA2B,EAC3B,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,aAAa,GAAoB;IACrC,WAAW;IACX,QAAQ;IACR,iBAAiB;IACjB,eAAe;IACf,SAAS;IACT,cAAc;IACd,UAAU;IACV,WAAW;IACX,aAAa;CACd,CAAC;AAEF,QAAQ,CAAC,iDAAiD,EAAE,GAAG,EAAE;IAC/D,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,KAAK,CAAC,mBAAmB,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC5C,MAAM,GAAG,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACxD,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC;YAChF,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,YAAY,CAAC,CAAC;YAC7C,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,QAAQ,aAAa,CAAC,CAAC;YAChE,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAC1C,GAAG,QAAQ,uCAAuC,CACnD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC5D,KAAK,MAAM,QAAQ,IAAI,aAAa,EAAE,CAAC;YACrC,MAAM,OAAO,GAAG,2BAA2B,CAAC;gBAC1C,QAAQ,EAAE,UAAU;gBACpB,QAAQ;gBACR,QAAQ,EAAE,QAAQ;aACnB,CAAC,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;YACzC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,GAAG,QAAQ,iBAAiB,CAAC,CAAC;YACpE,MAAM,CAAC,EAAE,CACP,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAC1C,GAAG,QAAQ,2CAA2C,CACvD,CAAC;QACJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6BAA6B,EAAE,GAAG,EAAE;QACrC,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,eAAe;YACzB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,cAAc;SACzB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,UAAU;YACpB,QAAQ,EAAE,WAAW;YACrB,SAAS,EAAE,wBAAwB;SACpC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,gCAAgC,CAAC,CAAC;QACrE,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QAChF,MAAM,CAAC,GAAG,2BAA2B,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;QAC9E,MAAM,CAAC,EAAE,CAAC,mBAAmB,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QAC5C,MAAM,CAAC,EAAE,CAAC,mBAAmB,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,OAAO,GAAG,2BAA2B,CAAC;YAC1C,QAAQ,EAAE,aAAa;YACvB,QAAQ,EAAE,WAAW;SACtB,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,kBAAkB,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uCAAuC,EAAE,GAAG,EAAE;QAC/C,MAAM,CAAC,MAAM,CACX,GAAG,EAAE,CACH,2BAA2B,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,EACtE,sBAAsB,CACvB,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}