@inso_web/els-mcp 0.1.0 → 0.2.0

package/README.md

@@ -1,13 +1,12 @@
-# @inso/els-mcp
+# @inso_web/els-mcp
 
-MCP-сервер поверх INSO Error Logs Service (ELS). Даёт LLM-агентам (Claude
-Desktop, mcp-inspector, любой MCP-клиент) read-only доступ к логам ошибок и
-аналитическим эндпоинтам — для триажа, поиска паттернов и анализа трендов.
+MCP-сервер поверх INSO Error Logs Service (ELS). Даёт LLM-агентам
+(Claude Desktop, mcp-inspector, любой MCP-клиент) read-only доступ к логам
+ошибок и аналитическим эндпоинтам — для триажа, поиска паттернов и анализа
+трендов.
 
-> **Phase 1+3 готовы.** stdio + Streamable HTTP transport, 8 базовых read-only
-> tools, OIDC через INSO Auth, RFC 9728 resource metadata.
-> Полный roadmap (resources, prompts, cache, AI) —
-> в `/todo/error-logs-service/mcp/` (см. `12-migration-rollout.md`).
+> stdio + Streamable HTTP transport, 18 read-only tools, OIDC через INSO Auth,
+> RFC 9728 resource metadata, PII redaction, audit log, tier-based quotas.
 
 ## TL;DR
 
@@ -81,9 +80,9 @@ npm run typecheck
 }
 ```
 
-Перезапустите Claude Desktop — в списке инструментов появятся 8 ELS-tools.
+Перезапустите Claude Desktop — в списке инструментов появятся ELS-tools.
 
-## Доступные tools (Phase 1)
+## Доступные tools
 
 | Tool | ELS endpoint | Описание |
 |------|---|---|
@@ -115,9 +114,9 @@ Listing-tools используют opaque `cursor` (НЕ `page`/`offset`). Вн
 зашит `filtersHash` — если клиент сменил фильтры между страницами,
 сервер вернёт `INVALID_ARGS` с предложением начать с первой страницы.
 
-> Phase 1 — cursor transitional: внутри хранятся `page`/`limit` (ELS пока
-> offset-based). Phase 4 переключится на настоящий seek `(receivedAt, id)` —
-> формат cursor останется тот же.
+> Cursor — transitional wrapper: внутри хранятся `page`/`limit` (ELS пока
+> offset-based). При переходе ELS на настоящий seek `(receivedAt, id)` формат
+> cursor останется тот же.
 
 ## Error shape
 
@@ -144,7 +143,7 @@ Listing-tools используют opaque `cursor` (НЕ `page`/`offset`). Вн
 | `MCP_DISABLE_TOOLS` | — | CSV с именами tools для отключения. |
 | `MCP_UPSTREAM_TIMEOUT_MS` | `30000` | Таймаут одного ELS-запроса. |
 
-## HTTP transport (Phase 3)
+## HTTP transport
 
 В дополнение к stdio сервер поддерживает Streamable HTTP transport через
 `MCP_TRANSPORT=http`. Используется для hosted endpoint'а
@@ -222,12 +221,14 @@ resource_metadata="https://mcp.insoweb.ru/els/.well-known/oauth-protected-resour
 ### Sessions
 
 `Mcp-Session-Id` header возвращается на первый `initialize`-запрос и должен
-передаваться во все последующие. TTL — 30 мин idle. В Phase 3 хранение
-in-memory (Map); Phase 4 переедет в Redis.
+передаваться во все последующие. TTL — 30 мин idle. Хранение in-memory (Map),
+будет переведено в Redis в следующих релизах.
 
-> **Phase 3 workaround:** OIDC `sub → appSlug` resolver пока не подключён к
-> LK API — все OIDC-юзеры мапятся на один app через `MCP_OIDC_DEMO_APP_SLUG`.
-> TODO: реализовать настоящий resolver в Phase 4.
+> **OIDC sub → appSlug resolver.** При наличии LK API эндпоинта
+> `GET /api/internal/users/{sub}/apps` сервис резолвит доступные пользователю
+> apps и кэширует результат в Redis 5 минут. Если эндпоинт недоступен —
+> graceful fallback на `MCP_OIDC_DEMO_APP_SLUG`. Если у пользователя несколько
+> apps, tool принимает optional `appSlug` параметр; иначе берётся первый.
 
 ### ENV-переменные транспорта
 
@@ -239,10 +240,10 @@ in-memory (Map); Phase 4 переедет в Redis.
 | `MCP_OIDC_ISSUER` | `https://auth.insoweb.ru` | OIDC issuer |
 | `MCP_OIDC_JWKS_URL` | derived | JWKS endpoint |
 | `MCP_OIDC_AUDIENCE` | `els-mcp` | Expected `aud` claim |
-| `MCP_OIDC_DEMO_APP_SLUG` | — | Phase 3 workaround для всех OIDC-юзеров |
+| `MCP_OIDC_DEMO_APP_SLUG` | — | Fallback appSlug при недоступности LK resolver |
 | `MCP_CORS_ORIGINS` | `https://claude.ai,https://chat.openai.com` | CSV allowed origins (в dev добавляется localhost) |
 
-## Security: PII redaction (Phase 5)
+## Security: PII redaction
 
 По умолчанию все ответы tools проходят через redaction pipeline до отдачи
 LLM. Применяемые правила:
@@ -276,7 +277,7 @@ instructions`, `system:`, `jailbreak`, …) в `_meta.suspiciousContentBlocked
 | `MCP_REDACTION_ENABLED` | `true` | Включена ли редакция целиком |
 | `MCP_REDACTION_FIELDS` | — | CSV whitelist полей (пусто → редактим все) |
 
-## Billing / quotas (Phase 5)
+## Billing / quotas
 
 Tier-matrix (см. также
 `todo/error-logs-service/mcp/08-billing-integration.md` §1):
@@ -328,7 +329,7 @@ npm run prisma:generate
 psql $MCP_DATABASE_URL -f prisma/migrations/init/migration.sql
 ```
 
-## Cache & Observability (Phase 4)
+## Cache & Observability
 
 ### Redis cache
 
@@ -452,10 +453,9 @@ Auto-instrumentation: HTTP, undici (ELS calls), ioredis, Express.
 - `GET /els/healthz` — liveness (всегда 200 если процесс жив).
 - `GET /els/readyz` — readiness: проверяет Redis ping + ELS upstream
   reachability. Возвращает 503 если хотя бы одна зависимость не отвечает.
-  Готовые handler'ы — `src/http/routes/metrics.ts` (подключаются
-  Phase 3 transport-роутером).
+  Готовые handler'ы — `src/http/routes/metrics.ts`.
 
-### ENV-переменные (Phase 4)
+### ENV-переменные (cache & observability)
 
 | ENV | Default | Описание |
 |---|---|---|
@@ -466,17 +466,22 @@ Auto-instrumentation: HTTP, undici (ELS calls), ioredis, Express.
 | `OTEL_EXPORTER_OTLP_ENDPOINT` | — | OTLP traces; если не задан → no-op |
 | `MCP_LOG_PRETTY` | `true` в dev | Pretty-print pino |
 
-## Что дальше (roadmap)
-
-Полная дорожная карта — `/todo/error-logs-service/mcp/12-migration-rollout.md`:
-
-- **Phase 2** — оставшиеся 10 tools + Resources (5 URI) + Prompts (4 templates) ✓
-- **Phase 3** — Streamable HTTP transport + OIDC через INSO Auth ✓
-- **Phase 4** — Redis cache + observability (Prometheus, OTel) + LK resolver для OIDC sub ✓
-- **Phase 5** — PII redaction + audit log + billing tracking ✓
-- **Phase 6** — Security hardening (deny-list, STRIDE), Mistral `explain_error`
-- **Phase 7** — Packaging (npm, Docker, Helm)
+## Limitations / TODO
+
+- **DCR (Dynamic Client Registration).** Rate-limit middleware готов
+  (`src/http/middleware/dcrRateLimit.ts`), но `/oauth/register` endpoint
+  планируется в v2. Сейчас используется OIDC discovery без runtime
+  регистрации клиентов.
+- **Mistral AI summary в `explain_error`.** Сейчас tool возвращает контекст
+  ошибки без AI-обёртки (`aiAvailable=false`); LLM-клиент сам синтезирует
+  объяснение из переданных данных. Планируется в следующих релизах.
+- **OIDC sub → apps resolver через LK API.** Эндпоинт
+  `GET /api/internal/users/{sub}/apps` ожидается на LK backend; до его
+  появления используется fallback на `MCP_OIDC_DEMO_APP_SLUG`.
+- **Tier resolver через LK API.** Эндпоинт
+  `GET /api/internal/apps/{appSlug}/billing/tier` ожидается на LK backend;
+  до его появления используется `MCP_DEFAULT_TIER`.
 
 ## License
 
-Internal INSO project. Not for public distribution.
+MIT

package/dist/audit/prisma.d.ts

@@ -5,8 +5,8 @@
  *   - Импорт `@prisma/client` (path: ../../node_modules/.prisma/mcp) делается
  *     лениво и в try/catch — если пакет не сгенерирован, audit/billing
  *     модули переходят в no-op режим.
- *   - В Phase 5 мы НЕ требуем live Postgres для тестов / dev — все
- *     `prisma.*`-операции в тестах подменяются через `vi.mock`.
+ *   - Не требуем live Postgres для тестов / dev — все `prisma.*`-операции
+ *     в тестах подменяются через `vi.mock`.
  *
  * Контракт:
  *   - `getPrisma()` возвращает либо живой client, либо null (если MCP_DATABASE_URL
@@ -29,6 +29,13 @@ export interface McpPrismaClient {
         }): Promise<{
             rowHash: string;
         } | null>;
+        findMany(args: {
+            where?: Record<string, unknown>;
+            orderBy?: Record<string, 'asc' | 'desc'>;
+            select?: Record<string, boolean>;
+            take?: number;
+            skip?: number;
+        }): Promise<Array<Record<string, unknown>>>;
         create(args: {
             data: Record<string, unknown>;
         }): Promise<unknown>;

package/dist/audit/prisma.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.d.ts","sourceRoot":"","sources":["../../src/audit/prisma.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,WAAW,EAAE;QACX,SAAS,CAAC,IAAI,EAAE;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;YACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,GAAG,OAAO,CAAC;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACxC,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACnE,CAAC;IACF,aAAa,EAAE;QACb,MAAM,CAAC,IAAI,EAAE;YACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,EAAE;YACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,EAAE;gBAAE,KAAK,EAAE,IAAI,CAAA;aAAE,CAAC;SACvB,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;CACH;AAKD,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoC7F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI,CAGtE;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}
+{"version":3,"file":"prisma.d.ts","sourceRoot":"","sources":["../../src/audit/prisma.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AAEnC;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,WAAW,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,YAAY,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACrE,WAAW,EAAE;QACX,SAAS,CAAC,IAAI,EAAE;YACd,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;YACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SAClC,GAAG,OAAO,CAAC;YAAE,OAAO,EAAE,MAAM,CAAA;SAAE,GAAG,IAAI,CAAC,CAAC;QACxC,QAAQ,CAAC,IAAI,EAAE;YACb,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC,CAAC;YACzC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YACjC,IAAI,CAAC,EAAE,MAAM,CAAC;YACd,IAAI,CAAC,EAAE,MAAM,CAAC;SACf,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,IAAI,EAAE;YAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;SAAE,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;KACnE,CAAC;IACF,aAAa,EAAE;QACb,MAAM,CAAC,IAAI,EAAE;YACX,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;SACjC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;QACrB,SAAS,CAAC,IAAI,EAAE;YACd,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC/B,IAAI,EAAE;gBAAE,KAAK,EAAE,IAAI,CAAA;aAAE,CAAC;SACvB,GAAG,OAAO,CAAC;YAAE,IAAI,EAAE;gBAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;aAAE,CAAA;SAAE,CAAC,CAAC;KACjD,CAAC;CACH;AAKD,MAAM,WAAW,iBAAiB;IAChC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;GAEG;AACH,wBAAsB,SAAS,CAAC,IAAI,GAAE,iBAAsB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAoC7F;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,MAAM,EAAE,eAAe,GAAG,IAAI,GAAG,IAAI,CAGtE;AAED,wBAAgB,mBAAmB,IAAI,IAAI,CAG1C"}

package/dist/audit/prisma.js

@@ -5,8 +5,8 @@
  *   - Импорт `@prisma/client` (path: ../../node_modules/.prisma/mcp) делается
  *     лениво и в try/catch — если пакет не сгенерирован, audit/billing
  *     модули переходят в no-op режим.
- *   - В Phase 5 мы НЕ требуем live Postgres для тестов / dev — все
- *     `prisma.*`-операции в тестах подменяются через `vi.mock`.
+ *   - Не требуем live Postgres для тестов / dev — все `prisma.*`-операции
+ *     в тестах подменяются через `vi.mock`.
  *
  * Контракт:
  *   - `getPrisma()` возвращает либо живой client, либо null (если MCP_DATABASE_URL

package/dist/audit/prisma.js.map

@@ -1 +1 @@
-{"version":3,"file":"prisma.js","sourceRoot":"","sources":["../../src/audit/prisma.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAgCH,IAAI,YAAY,GAA2B,IAAI,CAAC;AAChD,IAAI,SAAS,GAAG,KAAK,CAAC;AAOtB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B,EAAE;IAC1D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,SAAS,GAAG,IAAI,CAAC;IAEjB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,uDAAuD,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAW,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE/D,CAAC;QAET,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CACd,oHAAoH,CACrH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC;YAClC,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,0DAA0D,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,YAAY,GAAG,MAAM,CAAC;IACtB,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,YAAY,GAAG,IAAI,CAAC;IACpB,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC"}
+{"version":3,"file":"prisma.js","sourceRoot":"","sources":["../../src/audit/prisma.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAuCH,IAAI,YAAY,GAA2B,IAAI,CAAC;AAChD,IAAI,SAAS,GAAG,KAAK,CAAC;AAOtB;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,OAA0B,EAAE;IAC1D,IAAI,YAAY;QAAE,OAAO,YAAY,CAAC;IACtC,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,SAAS,GAAG,IAAI,CAAC;IAEjB,IAAI,CAAC,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvD,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,uDAAuD,CAAC,CAAC;QAC3E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,qDAAqD;QACrD,MAAM,QAAQ,GAAG,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;QAC5E,MAAM,OAAO,GAAW,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,GAAG,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAE/D,CAAC;QAET,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,CAAC,YAAY,KAAK,UAAU,EAAE,CAAC;YACnD,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CACd,oHAAoH,CACrH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QACD,YAAY,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC;YAClC,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,WAAW,EAAE,EAAE;SAC/C,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,+BAA+B,CAAC,CAAC;QAClD,OAAO,YAAY,CAAC;IACtB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,0DAA0D,CAAC,CAAC;QACtF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAA8B;IAC9D,YAAY,GAAG,MAAM,CAAC;IACtB,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,YAAY,GAAG,IAAI,CAAC;IACpB,SAAS,GAAG,KAAK,CAAC;AACpB,CAAC"}

package/dist/audit/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,cAAc,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,MAAM,CAeT;AAWD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kCAAkC;IAClC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CAwE/E;AAID,wBAAgB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CAG5E;AAED,kBAAkB;AAClB,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEtE"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAE9D,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,MAAM,CAAC;IACd,gDAAgD;IAChD,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,cAAc,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAED;;;;GAIG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,GAAG,MAAM,CAeT;AAWD,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,MAAM,WAAW,YAAY;IAC3B,cAAc,CAAC,MAAM,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC5D,kCAAkC;IAClC,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACzE;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CAyE/E;AAID,wBAAgB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CAG5E;AAED,kBAAkB;AAClB,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEtE"}

package/dist/audit/service.js

@@ -114,12 +114,13 @@ export function createAuditService(opts = {}) {
             }
         },
         async verifyChain(appId) {
-            // Используется в тестах. Phase 5: проходим в порядке createdAt asc и
-            // пересчитываем hash. Для production-job можно вынести в отдельный модуль.
+            // Lightweight wrapper, использующийся для smoke / health-checks.
+            // Полноценная верификация цепочки — отдельный модуль `audit/verify.ts`
+            // (доступен через `npm run audit:verify` или CLI команду
+            // `els-mcp verify-audit`).
             const client = await getClient();
             if (!client)
                 return { ok: true };
-            // Phase 5: для упрощения возвращаем ok, реальная проверка — Phase 6 cron.
             return { ok: true, ...(appId ? {} : {}) };
         },
     };

package/dist/audit/service.js.map

@@ -1 +1 @@
-{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAyB9D;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,CAY1B;IACC,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAQD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA4B,EAAE;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAErB,KAAK,UAAU,SAAS;QACtB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAClE,OAAO,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,CAAuB;YAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,QAAQ;YAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;YAErC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACrC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;wBAC1C,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;wBACzB,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;wBAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;qBAC1B,CAAC,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;oBACvC,MAAM,OAAO,GAAG,UAAU,CAAC;wBACzB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;wBACtB,QAAQ;wBACR,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;wBACrF,SAAS;wBACT,QAAQ;qBACT,CAAC,CAAC;oBACH,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC;oBAEtD,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;wBAC1B,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,KAAK;4BACd,KAAK,EAAE,CAAC,CAAC,KAAK;4BACd,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,WAAW,EAAE,CAAC,CAAC,WAAW;4BAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;4BACtB,QAAQ;4BACR,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI;4BAChB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;4BAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;4BAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;4BACxB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;4BACtB,QAAQ;4BACR,OAAO;4BACP,SAAS;yBACV;qBACF,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,qEAAqE;YACrE,2EAA2E;YAC3E,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,0EAA0E;YAC1E,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,WAAW,GAAwB,IAAI,CAAC;AAE5C,MAAM,UAAU,eAAe,CAAC,OAA4B,EAAE;IAC5D,IAAI,CAAC,WAAW;QAAE,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,WAAW,GAAG,GAAG,CAAC;AACpB,CAAC"}
+{"version":3,"file":"service.js","sourceRoot":"","sources":["../../src/audit/service.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAyB9D;;;;GAIG;AACH,MAAM,UAAU,UAAU,CAAC,CAY1B;IACC,MAAM,MAAM,GAAG;QACb,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,IAAI,EAAE,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC;QAC7B,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;QACtB,KAAK,EAAE,CAAC,CAAC,KAAK;QACd,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,EAAE;QAC1B,WAAW,EAAE,CAAC,CAAC,WAAW;QAC1B,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI;KACb,CAAC;IACF,OAAO,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;AAChC,CAAC;AAED,SAAS,eAAe,CAAC,CAAU;IACjC,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACjD,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACpD,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACrE,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,OAAO,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;AAC7F,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AAQD;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAA4B,EAAE;IAC/D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IAErB,KAAK,UAAU,SAAS;QACtB,IAAI,IAAI,CAAC,cAAc,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAClE,OAAO,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAChH,CAAC;IAED,OAAO;QACL,KAAK,CAAC,cAAc,CAAC,CAAuB;YAC1C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,CAAC,QAAQ;YAC7B,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;YAC3C,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,IAAI,KAAK,CAAC;YAErC,IAAI,CAAC;gBACH,MAAM,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,EAAE,EAAE,EAAE;oBACrC,MAAM,IAAI,GAAG,MAAM,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC;wBAC1C,KAAK,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE;wBACzB,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE;wBAC9B,MAAM,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE;qBAC1B,CAAC,CAAC;oBACH,MAAM,QAAQ,GAAG,IAAI,EAAE,OAAO,IAAI,IAAI,CAAC;oBACvC,MAAM,OAAO,GAAG,UAAU,CAAC;wBACzB,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,KAAK,EAAE,CAAC,CAAC,KAAK;wBACd,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,IAAI,EAAE,CAAC,CAAC,IAAI;wBACZ,WAAW,EAAE,CAAC,CAAC,WAAW;wBAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;wBACtB,QAAQ;wBACR,UAAU,EAAE,CAAC,CAAC,UAAU;wBACxB,GAAG,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;wBACrF,SAAS;wBACT,QAAQ;qBACT,CAAC,CAAC;oBACH,MAAM,OAAO,GAAG,SAAS,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC;oBAEtD,MAAM,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC;wBAC1B,IAAI,EAAE;4BACJ,KAAK,EAAE,CAAC,CAAC,KAAK;4BACd,KAAK,EAAE,CAAC,CAAC,KAAK;4BACd,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,IAAI,EAAE,CAAC,CAAC,IAAI;4BACZ,WAAW,EAAE,CAAC,CAAC,WAAW;4BAC1B,SAAS,EAAE,CAAC,CAAC,SAAS;4BACtB,QAAQ;4BACR,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,IAAI;4BAChB,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;4BAC9B,SAAS,EAAE,CAAC,CAAC,SAAS,IAAI,IAAI;4BAC9B,UAAU,EAAE,CAAC,CAAC,UAAU;4BACxB,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI;4BACtB,QAAQ;4BACR,OAAO;4BACP,SAAS;yBACV;qBACF,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,EAAE,uCAAuC,CAAC,CAAC;YAC9F,CAAC;QACH,CAAC;QAED,KAAK,CAAC,WAAW,CAAC,KAAa;YAC7B,iEAAiE;YACjE,uEAAuE;YACvE,yDAAyD;YACzD,2BAA2B;YAC3B,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAC;YACjC,IAAI,CAAC,MAAM;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACjC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5C,CAAC;KACF,CAAC;AACJ,CAAC;AAED,IAAI,WAAW,GAAwB,IAAI,CAAC;AAE5C,MAAM,UAAU,eAAe,CAAC,OAA4B,EAAE;IAC5D,IAAI,CAAC,WAAW;QAAE,WAAW,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzD,OAAO,WAAW,CAAC;AACrB,CAAC;AAED,kBAAkB;AAClB,MAAM,UAAU,uBAAuB,CAAC,GAAwB;IAC9D,WAAW,GAAG,GAAG,CAAC;AACpB,CAAC"}

package/dist/audit/verify.d.ts

@@ -0,0 +1,55 @@
+/**
+ * Audit chain verification.
+ *
+ * Проходит по строкам `mcp_audit.audit_log` в порядке `createdAt ASC` для
+ * заданного `appId` (и опционального диапазона дат) и проверяет, что
+ * `rowHash = sha256(prevRowHash + content)` совпадает со stored значением.
+ *
+ * Используется:
+ *   - в CLI команде `els-mcp verify-audit --app=X --from=Y --to=Z`
+ *     (см. `src/cli.ts`)
+ *   - в smoke / health-check скриптах
+ *
+ * Поведение при отсутствии Prisma client — корректно возвращает пустой
+ * результат с `prismaAvailable=false`.
+ */
+import type { Logger } from 'pino';
+import { type McpPrismaClient } from './prisma.js';
+export interface VerifyChainOptions {
+    appId: string;
+    /** ISO-дата (inclusive). Если не задана — с начала. */
+    from?: string | Date;
+    /** ISO-дата (exclusive). Если не задана — до конца. */
+    to?: string | Date;
+    /** Batch size для пагинации. Default 1000. */
+    batchSize?: number;
+    databaseUrl?: string;
+    log?: Logger;
+    prismaOverride?: McpPrismaClient | null;
+}
+export interface VerifyBreakInfo {
+    /** Row id (или string-представление), на котором сломалась chain. */
+    id: string;
+    /** ISO-timestamp проблемной строки. */
+    createdAt: string;
+    /** Ожидаемый rowHash (пересчитанный). */
+    expectedHash: string;
+    /** Stored rowHash. */
+    actualHash: string;
+}
+export interface VerifyChainResult {
+    totalChecked: number;
+    prismaAvailable: boolean;
+    /** null если цепочка корректна. Иначе — детали первого разрыва. */
+    breakAt: VerifyBreakInfo | null;
+}
+/**
+ * Verifies the audit hash-chain integrity for `appId`.
+ * Не модифицирует БД, читает в batch'ах для крупных таблиц.
+ */
+export declare function verifyChain(opts: VerifyChainOptions): Promise<VerifyChainResult>;
+/**
+ * Pretty-printer для CLI: возвращает многострочный отчёт.
+ */
+export declare function formatVerifyResult(result: VerifyChainResult): string;
+//# sourceMappingURL=verify.d.ts.map

package/dist/audit/verify.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.d.ts","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9D,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,MAAM,CAAC;IACd,uDAAuD;IACvD,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,uDAAuD;IACvD,EAAE,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnB,8CAA8C;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAED,MAAM,WAAW,eAAe;IAC9B,qEAAqE;IACrE,EAAE,EAAE,MAAM,CAAC;IACX,uCAAuC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,yCAAyC;IACzC,YAAY,EAAE,MAAM,CAAC;IACrB,sBAAsB;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,OAAO,CAAC;IACzB,mEAAmE;IACnE,OAAO,EAAE,eAAe,GAAG,IAAI,CAAC;CACjC;AAiCD;;;GAGG;AACH,wBAAsB,WAAW,CAAC,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAiFtF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAgBpE"}

package/dist/audit/verify.js

@@ -0,0 +1,131 @@
+/**
+ * Audit chain verification.
+ *
+ * Проходит по строкам `mcp_audit.audit_log` в порядке `createdAt ASC` для
+ * заданного `appId` (и опционального диапазона дат) и проверяет, что
+ * `rowHash = sha256(prevRowHash + content)` совпадает со stored значением.
+ *
+ * Используется:
+ *   - в CLI команде `els-mcp verify-audit --app=X --from=Y --to=Z`
+ *     (см. `src/cli.ts`)
+ *   - в smoke / health-check скриптах
+ *
+ * Поведение при отсутствии Prisma client — корректно возвращает пустой
+ * результат с `prismaAvailable=false`.
+ */
+import { getPrisma } from './prisma.js';
+import { rowContent, sha256Hex } from './service.js';
+function toIso(d) {
+    if (d === undefined)
+        return undefined;
+    return typeof d === 'string' ? d : d.toISOString();
+}
+function pickIso(v) {
+    if (v instanceof Date)
+        return v.toISOString();
+    if (typeof v === 'string')
+        return v;
+    return String(v);
+}
+function pickRowId(v) {
+    return v === undefined || v === null ? '<unknown>' : String(v);
+}
+/**
+ * Verifies the audit hash-chain integrity for `appId`.
+ * Не модифицирует БД, читает в batch'ах для крупных таблиц.
+ */
+export async function verifyChain(opts) {
+    const batchSize = Math.max(1, opts.batchSize ?? 1000);
+    const fromIso = toIso(opts.from);
+    const toIsoStr = toIso(opts.to);
+    const client = opts.prismaOverride !== undefined
+        ? opts.prismaOverride
+        : await getPrisma({
+            ...(opts.databaseUrl ? { databaseUrl: opts.databaseUrl } : {}),
+            ...(opts.log ? { log: opts.log } : {}),
+        });
+    if (!client) {
+        return { totalChecked: 0, prismaAvailable: false, breakAt: null };
+    }
+    const where = { appId: opts.appId };
+    if (fromIso || toIsoStr) {
+        const createdAt = {};
+        if (fromIso)
+            createdAt.gte = fromIso;
+        if (toIsoStr)
+            createdAt.lt = toIsoStr;
+        where.createdAt = createdAt;
+    }
+    let prevHash = null;
+    let totalChecked = 0;
+    let skip = 0;
+    for (;;) {
+        const rows = (await client.mcpAuditLog.findMany({
+            where,
+            orderBy: { createdAt: 'asc' },
+            take: batchSize,
+            skip,
+        }));
+        if (rows.length === 0)
+            break;
+        for (const row of rows) {
+            const args = (typeof row.args === 'object' && row.args !== null
+                ? row.args
+                : {});
+            const createdAtIso = pickIso(row.createdAt);
+            const content = rowContent({
+                appId: row.appId,
+                keyId: row.keyId,
+                tool: row.tool,
+                args,
+                resultBytes: row.resultBytes,
+                latencyMs: row.latencyMs,
+                cacheHit: row.cacheHit === true,
+                statusCode: row.statusCode,
+                error: row.error ?? null,
+                createdAt: createdAtIso,
+                prevHash,
+            });
+            const expectedHash = sha256Hex((prevHash ?? '') + content);
+            if (expectedHash !== row.rowHash) {
+                return {
+                    totalChecked: totalChecked + 1,
+                    prismaAvailable: true,
+                    breakAt: {
+                        id: pickRowId(row.id),
+                        createdAt: createdAtIso,
+                        expectedHash,
+                        actualHash: row.rowHash,
+                    },
+                };
+            }
+            prevHash = row.rowHash;
+            totalChecked += 1;
+        }
+        if (rows.length < batchSize)
+            break;
+        skip += batchSize;
+    }
+    return { totalChecked, prismaAvailable: true, breakAt: null };
+}
+/**
+ * Pretty-printer для CLI: возвращает многострочный отчёт.
+ */
+export function formatVerifyResult(result) {
+    if (!result.prismaAvailable) {
+        return [
+            'Audit verification skipped: Prisma client not available.',
+            'Ensure MCP_DATABASE_URL is set and `npm run prisma:generate` has been run.',
+        ].join('\n');
+    }
+    if (result.breakAt) {
+        return [
+            `Audit chain BROKEN after ${result.totalChecked} rows.`,
+            `  break at id=${result.breakAt.id}, createdAt=${result.breakAt.createdAt}`,
+            `  expected rowHash=${result.breakAt.expectedHash}`,
+            `  stored   rowHash=${result.breakAt.actualHash}`,
+        ].join('\n');
+    }
+    return `Audit chain OK: ${result.totalChecked} rows verified.`;
+}
+//# sourceMappingURL=verify.js.map

package/dist/audit/verify.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"verify.js","sourceRoot":"","sources":["../../src/audit/verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAGH,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAiDrD,SAAS,KAAK,CAAC,CAA4B;IACzC,IAAI,CAAC,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACrD,CAAC;AAED,SAAS,OAAO,CAAC,CAAU;IACzB,IAAI,CAAC,YAAY,IAAI;QAAE,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,CAAC,CAAC;IACpC,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;AACnB,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,OAAO,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;AACjE,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAwB;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;IACtD,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEhC,MAAM,MAAM,GACV,IAAI,CAAC,cAAc,KAAK,SAAS;QAC/B,CAAC,CAAC,IAAI,CAAC,cAAc;QACrB,CAAC,CAAC,MAAM,SAAS,CAAC;YACd,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACvC,CAAC,CAAC;IAET,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,YAAY,EAAE,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,KAAK,GAA4B,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;IAC7D,IAAI,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,IAAI,OAAO;YAAE,SAAS,CAAC,GAAG,GAAG,OAAO,CAAC;QACrC,IAAI,QAAQ;YAAE,SAAS,CAAC,EAAE,GAAG,QAAQ,CAAC;QACtC,KAAK,CAAC,SAAS,GAAG,SAAS,CAAC;IAC9B,CAAC;IAED,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,IAAI,IAAI,GAAG,CAAC,CAAC;IAEb,SAAS,CAAC;QACR,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC;YAC9C,KAAK;YACL,OAAO,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE;YAC7B,IAAI,EAAE,SAAS;YACf,IAAI;SACL,CAAC,CAA0B,CAAC;QAE7B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM;QAE7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI;gBAC7D,CAAC,CAAE,GAAG,CAAC,IAAgC;gBACvC,CAAC,CAAC,EAAE,CAAC,CAAC;YACR,MAAM,YAAY,GAAG,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,OAAO,GAAG,UAAU,CAAC;gBACzB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,KAAK,EAAE,GAAG,CAAC,KAAK;gBAChB,IAAI,EAAE,GAAG,CAAC,IAAI;gBACd,IAAI;gBACJ,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,SAAS,EAAE,GAAG,CAAC,SAAS;gBACxB,QAAQ,EAAE,GAAG,CAAC,QAAQ,KAAK,IAAI;gBAC/B,UAAU,EAAE,GAAG,CAAC,UAAU;gBAC1B,KAAK,EAAE,GAAG,CAAC,KAAK,IAAI,IAAI;gBACxB,SAAS,EAAE,YAAY;gBACvB,QAAQ;aACT,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,SAAS,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,CAAC;YAE3D,IAAI,YAAY,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;gBACjC,OAAO;oBACL,YAAY,EAAE,YAAY,GAAG,CAAC;oBAC9B,eAAe,EAAE,IAAI;oBACrB,OAAO,EAAE;wBACP,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC;wBACrB,SAAS,EAAE,YAAY;wBACvB,YAAY;wBACZ,UAAU,EAAE,GAAG,CAAC,OAAO;qBACxB;iBACF,CAAC;YACJ,CAAC;YAED,QAAQ,GAAG,GAAG,CAAC,OAAO,CAAC;YACvB,YAAY,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,IAAI,IAAI,CAAC,MAAM,GAAG,SAAS;YAAE,MAAM;QACnC,IAAI,IAAI,SAAS,CAAC;IACpB,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,MAAyB;IAC1D,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;QAC5B,OAAO;YACL,0DAA0D;YAC1D,4EAA4E;SAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;QACnB,OAAO;YACL,4BAA4B,MAAM,CAAC,YAAY,QAAQ;YACvD,iBAAiB,MAAM,CAAC,OAAO,CAAC,EAAE,eAAe,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;YAC3E,sBAAsB,MAAM,CAAC,OAAO,CAAC,YAAY,EAAE;YACnD,sBAAsB,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE;SAClD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACf,CAAC;IACD,OAAO,mBAAmB,MAAM,CAAC,YAAY,iBAAiB,CAAC;AACjE,CAAC"}

package/dist/billing/limits.d.ts

@@ -1,10 +1,10 @@
 /**
- * Tier matrix MCP — single source of truth (см. 08-billing-integration.md §1).
+ * Tier matrix MCP — single source of truth.
  *
  * Поля:
  *   - reqPerDay         — основной cut-off limit для tool-calls
- *   - concurrentSse     — SSE-сессий per app (Phase 4)
- *   - aiPerDay          — лимит на AI-explain (Phase 4)
+ *   - concurrentSse     — SSE-сессий per app
+ *   - aiPerDay          — лимит на AI-explain (отдельный counter)
  *   - graceFraction     — 10 % grace выше дневного лимита перед hard cut-off
  */
 export type Tier = 'FREE' | 'STANDARD' | 'PREMIUM' | 'UNLIMITED';
@@ -31,4 +31,15 @@ export interface QuotaDecision {
 export declare function secondsUntilUtcMidnight(now?: Date): number;
 /** Чистое решение: принимает текущий счётчик и tier, возвращает decision. */
 export declare function decideQuota(currentUsed: number, tier: Tier): QuotaDecision;
+/**
+ * Чистое решение для AI-quota: принимает текущий AI-счётчик и tier.
+ * Используется только для tools, помеченных как AI (например, `explain_error`).
+ *
+ * Семантика отличается от `decideQuota`: AI-quota — hard cut-off без grace
+ * (генерация дорогая, нет смысла превышать).
+ */
+export declare function decideAiQuota(currentUsed: number, tier: Tier): QuotaDecision;
+/** Список tool-имён, считающихся AI (используют отдельную AI-квоту). */
+export declare const AI_TOOL_NAMES: ReadonlySet<string>;
+export declare function isAiTool(toolName: string): boolean;
 //# sourceMappingURL=limits.d.ts.map

package/dist/billing/limits.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/billing/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAUhD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAWtE;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,aAAa,CAuB1E"}
+{"version":3,"file":"limits.d.ts","sourceRoot":"","sources":["../../src/billing/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,MAAM,IAAI,GAAG,MAAM,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,CAAC;AAEjE,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,eAAO,MAAM,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE,UAAU,CAUhD,CAAC;AAEF,MAAM,WAAW,aAAa;IAC5B,sCAAsC;IACtC,OAAO,EAAE,OAAO,CAAC;IACjB,4EAA4E;IAC5E,SAAS,EAAE,MAAM,CAAC;IAClB,4DAA4D;IAC5D,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gDAAgD;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,gCAAgC;IAChC,IAAI,EAAE,IAAI,CAAC;CACZ;AAED,yCAAyC;AACzC,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,IAAiB,GAAG,MAAM,CAWtE;AAED,6EAA6E;AAC7E,wBAAgB,WAAW,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,aAAa,CAuB1E;AAED;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,WAAW,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,GAAG,aAAa,CAc5E;AAED,wEAAwE;AACxE,eAAO,MAAM,aAAa,EAAE,WAAW,CAAC,MAAM,CAA8B,CAAC;AAE7E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAElD"}

package/dist/billing/limits.js

@@ -1,10 +1,10 @@
 /**
- * Tier matrix MCP — single source of truth (см. 08-billing-integration.md §1).
+ * Tier matrix MCP — single source of truth.
  *
  * Поля:
  *   - reqPerDay         — основной cut-off limit для tool-calls
- *   - concurrentSse     — SSE-сессий per app (Phase 4)
- *   - aiPerDay          — лимит на AI-explain (Phase 4)
+ *   - concurrentSse     — SSE-сессий per app
+ *   - aiPerDay          — лимит на AI-explain (отдельный counter)
  *   - graceFraction     — 10 % grace выше дневного лимита перед hard cut-off
  */
 export const TIER_LIMITS = {
@@ -48,4 +48,31 @@ export function decideQuota(currentUsed, tier) {
         tier,
     };
 }
+/**
+ * Чистое решение для AI-quota: принимает текущий AI-счётчик и tier.
+ * Используется только для tools, помеченных как AI (например, `explain_error`).
+ *
+ * Семантика отличается от `decideQuota`: AI-quota — hard cut-off без grace
+ * (генерация дорогая, нет смысла превышать).
+ */
+export function decideAiQuota(currentUsed, tier) {
+    const limits = TIER_LIMITS[tier];
+    if (!Number.isFinite(limits.aiPerDay)) {
+        return { allowed: true, remaining: Number.POSITIVE_INFINITY, tier };
+    }
+    if (currentUsed < limits.aiPerDay) {
+        return { allowed: true, remaining: limits.aiPerDay - currentUsed, tier };
+    }
+    return {
+        allowed: false,
+        remaining: 0,
+        retryAfter: secondsUntilUtcMidnight(),
+        tier,
+    };
+}
+/** Список tool-имён, считающихся AI (используют отдельную AI-квоту). */
+export const AI_TOOL_NAMES = new Set(['explain_error']);
+export function isAiTool(toolName) {
+    return AI_TOOL_NAMES.has(toolName);
+}
 //# sourceMappingURL=limits.js.map

package/dist/billing/limits.js.map

@@ -1 +1 @@
-{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/billing/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,MAAM,CAAC,MAAM,WAAW,GAA6B;IACnD,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE;IAC9E,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;IACrF,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE;IACxF,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,aAAa,EAAE,CAAC;KACjB;CACF,CAAC;AAeF,yCAAyC;AACzC,MAAM,UAAU,uBAAuB,CAAC,MAAY,IAAI,IAAI,EAAE;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,GAAG,CAAC,cAAc,EAAE,EACpB,GAAG,CAAC,WAAW,EAAE,EACjB,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EACpB,CAAC,EACD,CAAC,EACD,CAAC,EACD,CAAC,CACF,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,IAAU;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,IAAI,WAAW,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,IAAI;SACL,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,uBAAuB,EAAE;QACrC,IAAI;KACL,CAAC;AACJ,CAAC"}
+{"version":3,"file":"limits.js","sourceRoot":"","sources":["../../src/billing/limits.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAWH,MAAM,CAAC,MAAM,WAAW,GAA6B;IACnD,IAAI,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,aAAa,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,aAAa,EAAE,GAAG,EAAE;IAC9E,QAAQ,EAAE,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,aAAa,EAAE,GAAG,EAAE;IACrF,OAAO,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,EAAE;IACxF,SAAS,EAAE;QACT,SAAS,EAAE,MAAM,CAAC,iBAAiB;QACnC,aAAa,EAAE,GAAG;QAClB,QAAQ,EAAE,MAAM,CAAC,iBAAiB;QAClC,aAAa,EAAE,CAAC;KACjB;CACF,CAAC;AAeF,yCAAyC;AACzC,MAAM,UAAU,uBAAuB,CAAC,MAAY,IAAI,IAAI,EAAE;IAC5D,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CACnB,GAAG,CAAC,cAAc,EAAE,EACpB,GAAG,CAAC,WAAW,EAAE,EACjB,GAAG,CAAC,UAAU,EAAE,GAAG,CAAC,EACpB,CAAC,EACD,CAAC,EACD,CAAC,EACD,CAAC,CACF,CAAC;IACF,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,WAAmB,EAAE,IAAU;IACzD,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;IACzE,IAAI,WAAW,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;IAC5E,CAAC;IACD,IAAI,WAAW,GAAG,MAAM,EAAE,CAAC;QACzB,OAAO;YACL,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,CAAC;YACZ,OAAO,EAAE,IAAI;YACb,IAAI;SACL,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,uBAAuB,EAAE;QACrC,IAAI;KACL,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,WAAmB,EAAE,IAAU;IAC3D,MAAM,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;QACtC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,iBAAiB,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IACD,IAAI,WAAW,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;QAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ,GAAG,WAAW,EAAE,IAAI,EAAE,CAAC;IAC3E,CAAC;IACD,OAAO;QACL,OAAO,EAAE,KAAK;QACd,SAAS,EAAE,CAAC;QACZ,UAAU,EAAE,uBAAuB,EAAE;QACrC,IAAI;KACL,CAAC;AACJ,CAAC;AAED,wEAAwE;AACxE,MAAM,CAAC,MAAM,aAAa,GAAwB,IAAI,GAAG,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;AAE7E,MAAM,UAAU,QAAQ,CAAC,QAAgB;IACvC,OAAO,aAAa,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACrC,CAAC"}

package/dist/billing/tracker.d.ts

@@ -1,13 +1,15 @@
 /**
- * Phase 5 usage tracker.
+ * Usage tracker.
  *
  * Пишет напрямую в Postgres `mcp_billing.usage_daily` (UPSERT per app+date+tool).
- * В Phase 4 заменим на Redis INCR + hourly flush — интерфейс останется тем же,
- * так что вызывающий код не нужно будет править.
+ * Со временем будет заменён на Redis INCR + hourly flush — интерфейс останется
+ * тем же, так что вызывающий код не нужно будет править.
  *
  * Поведение:
  *   - Silent fail при ошибке БД (как и audit) — usage tracking не блокирует tool-call.
  *   - Fire-and-forget: caller вызывает через `void trackUsage(...)`.
+ *   - AI-tools (см. `isAiTool` из `./limits.ts`) дополнительно учитываются в
+ *     отдельной AI-квоте через `aiTodayUsage` + `checkAiQuota`.
  */
 import type { Logger } from 'pino';
 import { type McpPrismaClient } from '../audit/prisma.js';
@@ -32,6 +34,12 @@ export interface UsageTracker {
      */
     todayUsage(appId: string, now?: Date): Promise<number>;
     checkQuota(appId: string, tier: Tier, now?: Date): Promise<QuotaDecision>;
+    /**
+     * Возвращает текущее число AI-tool вызовов за сегодня UTC (sum по
+     * tools, отвечающим `isAiTool`).
+     */
+    aiTodayUsage(appId: string, now?: Date): Promise<number>;
+    checkAiQuota(appId: string, tier: Tier, now?: Date): Promise<QuotaDecision>;
 }
 export declare function createUsageTracker(opts?: UsageTrackerOptions): UsageTracker;
 export declare function getUsageTracker(opts?: UsageTrackerOptions): UsageTracker;

package/dist/billing/tracker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tracker.d.ts","sourceRoot":"","sources":["../../src/billing/tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAe,KAAK,aAAa,EAAE,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAEzE,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAMD,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CA+D/E;AAID,wBAAgB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CAG5E;AAED,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEpE"}
+{"version":3,"file":"tracker.d.ts","sourceRoot":"","sources":["../../src/billing/tracker.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,MAAM,CAAC;AACnC,OAAO,EAAa,KAAK,eAAe,EAAE,MAAM,oBAAoB,CAAC;AACrE,OAAO,EAAwC,KAAK,aAAa,EAAE,KAAK,IAAI,EAAE,MAAM,aAAa,CAAC;AAElG,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,qEAAqE;IACrE,IAAI,CAAC,EAAE,IAAI,CAAC;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,cAAc,CAAC,EAAE,eAAe,GAAG,IAAI,CAAC;CACzC;AAMD,MAAM,WAAW,YAAY;IAC3B,UAAU,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACpD;;;OAGG;IACH,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACvD,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzD,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,IAAI,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC7E;AAED,wBAAgB,kBAAkB,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CA2F/E;AAOD,wBAAgB,eAAe,CAAC,IAAI,GAAE,mBAAwB,GAAG,YAAY,CAG5E;AAED,wBAAgB,uBAAuB,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEpE"}