@itphx/synth-core 0.2.0

package/dist/engine/gateway/gateway-provider.test.js

@@ -0,0 +1,251 @@
+/**
+ * Интеграционные юнит-тесты GatewayProvider (AD-036) — декоратор над BaseProvider.
+ * Мок BaseProvider со статическими capture-перехватчиками (паттерн
+ * security/integration.test.ts — MockIPIProvider).
+ */
+import { describe, it, expect, beforeEach, afterEach, vi } from 'vitest';
+import { mkdtemp, rm, readFile, readdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { BaseProvider } from '../../providers/base.js';
+import { AuditLogger, GatewayProvider, RateLimiter } from './index.js';
+const SK_KEY = 'sk-abcdefghijklmnopqrst';
+/** Мок-провайдер: фиксирует вход, возвращает настраиваемый контент. */
+class MockCaptureProvider extends BaseProvider {
+    static calls = 0;
+    static capturedMessages = null;
+    static capturedSystemPrompt = null;
+    static capturedTools = null;
+    static responseContent = 'ok';
+    async chat(messages, systemPrompt, tools, _stream, _debugCollector) {
+        MockCaptureProvider.calls++;
+        MockCaptureProvider.capturedMessages = messages;
+        MockCaptureProvider.capturedSystemPrompt = systemPrompt ?? null;
+        MockCaptureProvider.capturedTools = tools ?? null;
+        return {
+            content: MockCaptureProvider.responseContent,
+            model: this.model,
+            usage: { inputTokens: 1, outputTokens: 1, totalTokens: 2 },
+        };
+    }
+    async *chatAsync(messages, systemPrompt, tools, _debugCollector, _cancellationToken) {
+        MockCaptureProvider.calls++;
+        MockCaptureProvider.capturedMessages = messages;
+        MockCaptureProvider.capturedSystemPrompt = systemPrompt ?? null;
+        MockCaptureProvider.capturedTools = tools ?? null;
+        yield {
+            content: MockCaptureProvider.responseContent,
+            isFinal: true,
+            model: this.model,
+            usage: { inputTokens: 1, outputTokens: 1, totalTokens: 2 },
+        };
+    }
+    getProviderName() {
+        return 'mockgw2';
+    }
+}
+function makeConfig(overrides = {}) {
+    return {
+        enabled: true,
+        inputMode: 'obfuscate',
+        logPayloads: false,
+        payloadLogPath: '',
+        rateLimit: { userPerMinute: 60, providerPerMinute: 120 },
+        audit: { enabled: true, logPath: '' },
+        ...overrides,
+    };
+}
+function makeMessage(content) {
+    return {
+        id: 'm1',
+        role: 'user',
+        content,
+        usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
+        disabled: false,
+        pinned: false,
+        branchId: 'b1',
+    };
+}
+describe('GatewayProvider (AD-036)', () => {
+    let tmpDir;
+    beforeEach(async () => {
+        tmpDir = await mkdtemp(join(tmpdir(), 'synth-gwprov-'));
+        MockCaptureProvider.calls = 0;
+        MockCaptureProvider.capturedMessages = null;
+        MockCaptureProvider.capturedSystemPrompt = null;
+        MockCaptureProvider.capturedTools = null;
+        MockCaptureProvider.responseContent = 'ok';
+    });
+    afterEach(async () => {
+        vi.restoreAllMocks();
+        await rm(tmpDir, { recursive: true, force: true });
+    });
+    function makeGateway(opts = {}) {
+        const inner = new MockCaptureProvider({ url: 'http://mock', apiKey: 'k', model: 'm' });
+        const audit = new AuditLogger(join(tmpDir, 'audit.jsonl'));
+        const auditSpy = vi.spyOn(audit, 'append');
+        let map = opts.initialMap ?? {};
+        const rateLimiter = opts.rateLimiter ?? new RateLimiter(100, 100);
+        const gw = new GatewayProvider(inner, makeConfig(opts.config), {
+            getMap: async () => ({ ...map }),
+            saveMap: async (m) => {
+                map = { ...m };
+            },
+            getAudit: () => audit,
+            getRateLimiter: () => rateLimiter,
+            payloadLogPath: opts.payloadLogPath,
+            sessionId: 's1',
+            userId: 'u1',
+        });
+        return { gw, inner, auditSpy, getMap: () => ({ ...map }) };
+    }
+    it('enabled + секрет: inner получает обфусцированные сообщения, в ответе плейсхолдер', async () => {
+        const { gw, getMap } = makeGateway();
+        MockCaptureProvider.responseContent = 'Подключение с ⟦SYNTH_SECRET_1⟧ установлено';
+        const res = await gw.chat([makeMessage(`ключ ${SK_KEY}`)]);
+        expect(MockCaptureProvider.calls).toBe(1);
+        expect(MockCaptureProvider.capturedMessages?.[0]?.content).toContain('⟦SYNTH_SECRET_1⟧');
+        expect(MockCaptureProvider.capturedMessages?.[0]?.content).not.toContain('sk-');
+        // Ответ идёт как есть (деобфускация — в точках потребления)
+        expect(res.content).toBe('Подключение с ⟦SYNTH_SECRET_1⟧ установлено');
+        // Карта сохранена в сессию
+        expect(getMap()['⟦SYNTH_SECRET_1⟧']).toBe(SK_KEY);
+    });
+    it('enabled + секрет: systemPrompt обфусцируется', async () => {
+        const { gw } = makeGateway();
+        await gw.chat([makeMessage('привет')], `системный промпт с ${SK_KEY}`);
+        expect(MockCaptureProvider.capturedSystemPrompt).toContain('⟦SYNTH_SECRET_1⟧');
+        expect(MockCaptureProvider.capturedSystemPrompt).not.toContain('sk-');
+    });
+    it('enabled=false → passthrough без изменений', async () => {
+        const { gw } = makeGateway({ config: { enabled: false } });
+        const msgs = [makeMessage(`ключ ${SK_KEY}`)];
+        const res = await gw.chat(msgs, 'system');
+        expect(MockCaptureProvider.calls).toBe(1);
+        expect(MockCaptureProvider.capturedMessages).toEqual(msgs); // секрет не тронут
+        expect(MockCaptureProvider.capturedSystemPrompt).toBe('system');
+        expect(res.content).toBe('ok');
+    });
+    it('rate limit превышен → warning-ответ, inner НЕ вызван', async () => {
+        const rateLimiter = new RateLimiter(1, 100);
+        const { gw } = makeGateway({ rateLimiter });
+        const first = await gw.chat([makeMessage('hi')]);
+        expect(MockCaptureProvider.calls).toBe(1);
+        expect(first.content).toBe('ok');
+        const second = await gw.chat([makeMessage('hi again')]);
+        expect(MockCaptureProvider.calls).toBe(1); // inner не вызван повторно
+        expect(second.content).toContain('Rate limit');
+    });
+    it('block-режим → warning-ответ, inner НЕ вызван', async () => {
+        const { gw } = makeGateway({ config: { inputMode: 'block' } });
+        const res = await gw.chat([makeMessage(`мой ключ ${SK_KEY}`)]);
+        expect(MockCaptureProvider.calls).toBe(0);
+        expect(res.content).toContain('Обнаружены секреты');
+        expect(res.content).not.toContain(SK_KEY);
+    });
+    it('block-режим в стриме → warning-чанки, inner НЕ вызван', async () => {
+        const { gw } = makeGateway({ config: { inputMode: 'block' } });
+        const chunks = [];
+        for await (const chunk of gw.chatAsync([makeMessage(SK_KEY)])) {
+            chunks.push(chunk.content);
+        }
+        expect(MockCaptureProvider.calls).toBe(0);
+        expect(chunks.join('')).toContain('Обнаружены секреты');
+    });
+    it('стрим: чанки идут как есть, output guard на финальном собранном ответе', async () => {
+        const { gw, auditSpy } = makeGateway();
+        // Чанк без секрета — output guard не срабатывает
+        MockCaptureProvider.responseContent = 'обычный ответ';
+        const chunks1 = [];
+        for await (const chunk of gw.chatAsync([makeMessage('hi')])) {
+            chunks1.push(chunk.content);
+        }
+        expect(chunks1).toEqual(['обычный ответ']); // чанки не модифицированы
+        // Чанк с секретом → аудит output_guard
+        MockCaptureProvider.responseContent = `здесь ключ ${SK_KEY}`;
+        const chunks2 = [];
+        for await (const chunk of gw.chatAsync([makeMessage('hi2')])) {
+            chunks2.push(chunk.content);
+        }
+        expect(chunks2).toEqual([`здесь ключ ${SK_KEY}`]); // чанки идут как есть
+        expect(auditSpy).toHaveBeenCalledWith(expect.objectContaining({ type: 'output_guard', reason: 'секреты в ответе модели' }));
+    });
+    it('rate limit в стриме → warning-чанки, inner НЕ вызван', async () => {
+        const rateLimiter = new RateLimiter(1, 100);
+        const { gw } = makeGateway({ rateLimiter });
+        await gw.chat([makeMessage('first')]);
+        expect(MockCaptureProvider.calls).toBe(1);
+        const chunks = [];
+        for await (const chunk of gw.chatAsync([makeMessage('second')])) {
+            chunks.push(chunk.content);
+        }
+        expect(MockCaptureProvider.calls).toBe(1); // inner не вызван
+        expect(chunks.join('')).toContain('Rate limit');
+    });
+    it('logPayloads + payloadLogPath: chat пишет полный лог (запрос после обфускации)', async () => {
+        const payloadPath = join(tmpDir, 'payloads.jsonl');
+        const { gw } = makeGateway({ config: { logPayloads: true }, payloadLogPath: payloadPath });
+        MockCaptureProvider.responseContent = 'ответ';
+        await gw.chat([makeMessage(`ключ ${SK_KEY}`)], 'система');
+        const raw = await readFile(payloadPath, 'utf8');
+        const entry = JSON.parse(raw.trim());
+        expect(entry.sessionId).toBe('s1');
+        expect(entry.userId).toBe('u1');
+        expect(entry.provider).toBe('mockgw2');
+        // Запрос сохранён ПОСЛЕ обфускации — секрета в логе нет
+        expect(entry.request.messages[0]?.content).toContain('⟦SYNTH_SECRET_1⟧');
+        expect(entry.request.messages[0]?.content).not.toContain(SK_KEY);
+        expect(entry.request.systemPrompt).toBe('система');
+        expect(entry.response.content).toBe('ответ');
+        expect(entry.response.usage?.inputTokens).toBe(1);
+    });
+    it('logPayloads + payloadLogPath: chatAsync пишет накопленный ответ', async () => {
+        const payloadPath = join(tmpDir, 'payloads.jsonl');
+        const { gw } = makeGateway({ config: { logPayloads: true }, payloadLogPath: payloadPath });
+        MockCaptureProvider.responseContent = 'стрим-ответ';
+        const chunks = [];
+        for await (const chunk of gw.chatAsync([makeMessage('hi')])) {
+            chunks.push(chunk.content);
+        }
+        expect(chunks.join('')).toBe('стрим-ответ');
+        const raw = await readFile(payloadPath, 'utf8');
+        const entry = JSON.parse(raw.trim());
+        expect(entry.response.content).toBe('стрим-ответ');
+    });
+    it('logPayloads выключен — полный лог НЕ пишется', async () => {
+        const payloadPath = join(tmpDir, 'payloads.jsonl');
+        const { gw } = makeGateway({ config: { logPayloads: false }, payloadLogPath: payloadPath });
+        await gw.chat([makeMessage('hi')]);
+        await expect(readFile(payloadPath, 'utf8')).rejects.toMatchObject({ code: 'ENOENT' });
+    });
+    it('payloadLogPath не задан — полный лог НЕ пишется', async () => {
+        const { gw } = makeGateway({ config: { logPayloads: true } });
+        await gw.chat([makeMessage('hi')]);
+        // Никаких файлов в tmpDir не создано (audit.jsonl тоже отсутствует — аудит не сработал)
+        const entries = await readdir(tmpDir);
+        expect(entries).toHaveLength(0);
+    });
+    it('chatAsync с финальным чанком полного контента НЕ дублирует ответ в payload (регрессия)', async () => {
+        const payloadPath = join(tmpDir, 'payloads.jsonl');
+        const { gw } = makeGateway({ config: { logPayloads: true }, payloadLogPath: payloadPath });
+        // Реальный openai.ts: delta-чанки («т», «ест») + финальный чанк с ПОЛНЫМ контентом («тест»).
+        const inner = gw;
+        const originalChatAsync = inner._inner.chatAsync.bind(inner._inner);
+        inner._inner.chatAsync = async function* () {
+            yield { content: 'т', isFinal: false, usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 } };
+            yield { content: 'ест', isFinal: false, usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 } };
+            yield { content: 'тест', isFinal: true, usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 } };
+        };
+        // Потребитель (оркестратор) обрабатывает финальный чанк заменой — контент не дублируется.
+        let accumulated = '';
+        for await (const chunk of gw.chatAsync([makeMessage('hi')])) {
+            accumulated = chunk.isFinal && chunk.content ? chunk.content : accumulated + chunk.content;
+        }
+        expect(accumulated).toBe('тест');
+        const raw = await readFile(payloadPath, 'utf8');
+        const entry = JSON.parse(raw.trim());
+        expect(entry.response.content).toBe('тест');
+        void originalChatAsync;
+    });
+});
+//# sourceMappingURL=gateway-provider.test.js.map

package/dist/engine/gateway/gateway-provider.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gateway-provider.test.js","sourceRoot":"","sources":["../../../src/engine/gateway/gateway-provider.test.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAClE,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAIjC,OAAO,EAAE,YAAY,EAA2C,MAAM,yBAAyB,CAAC;AAChG,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAEvE,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC,uEAAuE;AACvE,MAAM,mBAAoB,SAAQ,YAAY;IAC5C,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC;IACjB,MAAM,CAAC,gBAAgB,GAAwB,IAAI,CAAC;IACpD,MAAM,CAAC,oBAAoB,GAAkB,IAAI,CAAC;IAClD,MAAM,CAAC,aAAa,GAAqC,IAAI,CAAC;IAC9D,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;IAE9B,KAAK,CAAC,IAAI,CACR,QAAsB,EACtB,YAAqB,EACrB,KAAiC,EACjC,OAAiB,EACjB,eAAyB;QAEzB,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAC5B,mBAAmB,CAAC,gBAAgB,GAAG,QAAQ,CAAC;QAChD,mBAAmB,CAAC,oBAAoB,GAAG,YAAY,IAAI,IAAI,CAAC;QAChE,mBAAmB,CAAC,aAAa,GAAG,KAAK,IAAI,IAAI,CAAC;QAClD,OAAO;YACL,OAAO,EAAE,mBAAmB,CAAC,eAAe;YAC5C,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,CAAC,SAAS,CACd,QAAsB,EACtB,YAAqB,EACrB,KAAiC,EACjC,eAAyB,EACzB,kBAAsC;QAEtC,mBAAmB,CAAC,KAAK,EAAE,CAAC;QAC5B,mBAAmB,CAAC,gBAAgB,GAAG,QAAQ,CAAC;QAChD,mBAAmB,CAAC,oBAAoB,GAAG,YAAY,IAAI,IAAI,CAAC;QAChE,mBAAmB,CAAC,aAAa,GAAG,KAAK,IAAI,IAAI,CAAC;QAClD,MAAM;YACJ,OAAO,EAAE,mBAAmB,CAAC,eAAe;YAC5C,OAAO,EAAE,IAAI;YACb,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;SAC3D,CAAC;IACJ,CAAC;IAED,eAAe;QACb,OAAO,SAAS,CAAC;IACnB,CAAC;;AAGH,SAAS,UAAU,CAAC,YAAuC,EAAE;IAC3D,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,cAAc,EAAE,EAAE;QAClB,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE;QACxD,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACrC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM;QACZ,OAAO;QACP,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;QAC1D,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,MAAc,CAAC;IAEnB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC;QACxD,mBAAmB,CAAC,KAAK,GAAG,CAAC,CAAC;QAC9B,mBAAmB,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC5C,mBAAmB,CAAC,oBAAoB,GAAG,IAAI,CAAC;QAChD,mBAAmB,CAAC,aAAa,GAAG,IAAI,CAAC;QACzC,mBAAmB,CAAC,eAAe,GAAG,IAAI,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,EAAE,CAAC,eAAe,EAAE,CAAC;QACrB,MAAM,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,SAAS,WAAW,CAAC,OAKjB,EAAE;QACJ,MAAM,KAAK,GAAG,IAAI,mBAAmB,CAAC,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;QACvF,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC,CAAC;QAC3D,MAAM,QAAQ,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC3C,IAAI,GAAG,GAAG,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC;QAChC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE;YAC7D,MAAM,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC;YAChC,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,EAAE;gBACnB,GAAG,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACjB,CAAC;YACD,QAAQ,EAAE,GAAG,EAAE,CAAC,KAAK;YACrB,cAAc,EAAE,GAAG,EAAE,CAAC,WAAW;YACjC,cAAc,EAAE,IAAI,CAAC,cAAc;YACnC,SAAS,EAAE,IAAI;YACf,MAAM,EAAE,IAAI;SACb,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;IAC7D,CAAC;IAED,EAAE,CAAC,kFAAkF,EAAE,KAAK,IAAI,EAAE;QAChG,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,GAAG,WAAW,EAAE,CAAC;QACrC,mBAAmB,CAAC,eAAe,GAAG,4CAA4C,CAAC;QAEnF,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAE3D,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACzF,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAChF,4DAA4D;QAC5D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,4CAA4C,CAAC,CAAC;QACvE,2BAA2B;QAC3B,MAAM,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,EAAE,CAAC;QAE7B,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EAAE,sBAAsB,MAAM,EAAE,CAAC,CAAC;QAEvE,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC/E,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACxE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;QAC3D,MAAM,IAAI,GAAG,CAAC,WAAW,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC;QAE7C,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;QAE1C,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,mBAAmB,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,mBAAmB;QAC/E,MAAM,CAAC,mBAAmB,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAChE,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5C,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAEjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QACxD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,2BAA2B;QACtE,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAE/D,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;QAE/D,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;QACpD,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC;QAE/D,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAED,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,oBAAoB,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,GAAG,WAAW,EAAE,CAAC;QAEvC,iDAAiD;QACjD,mBAAmB,CAAC,eAAe,GAAG,eAAe,CAAC;QACtD,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,0BAA0B;QAEtE,uCAAuC;QACvC,mBAAmB,CAAC,eAAe,GAAG,cAAc,MAAM,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC9B,CAAC;QACD,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,CAAC,cAAc,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC,sBAAsB;QACzE,MAAM,CAAC,QAAQ,CAAC,CAAC,oBAAoB,CACnC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC,CACrF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC5C,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5C,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACtC,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAE1C,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,mBAAmB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,kBAAkB;QAC7D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+EAA+E,EAAE,KAAK,IAAI,EAAE;QAC7F,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACnD,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3F,mBAAmB,CAAC,eAAe,GAAG,OAAO,CAAC;QAE9C,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAE1D,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAOlC,CAAC;QACF,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACvC,wDAAwD;QACxD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACzE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACnD,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iEAAiE,EAAE,KAAK,IAAI,EAAE;QAC/E,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACnD,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QAC3F,mBAAmB,CAAC,eAAe,GAAG,aAAa,CAAC;QAEpD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QACD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QAE5C,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,KAAK,IAAI,EAAE;QAC5D,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACnD,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,KAAK,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QAE5F,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnC,MAAM,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;IACxF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,KAAK,IAAI,EAAE;QAC/D,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;QAE9D,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEnC,wFAAwF;QACxF,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACtC,MAAM,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wFAAwF,EAAE,KAAK,IAAI,EAAE;QACtG,MAAM,WAAW,GAAG,IAAI,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACnD,MAAM,EAAE,EAAE,EAAE,GAAG,WAAW,CAAC,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;QAE3F,6FAA6F;QAC7F,MAAM,KAAK,GAAG,EAAgD,CAAC;QAC/D,MAAM,iBAAiB,GAAG,KAAK,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACpE,KAAK,CAAC,MAAM,CAAC,SAAS,GAAG,KAAK,SAAS,CAAC;YACtC,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACnG,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;YACrG,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE,CAAC;QACvG,CAAC,CAAC;QAEF,0FAA0F;QAC1F,IAAI,WAAW,GAAG,EAAE,CAAC;QACrB,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAC5D,WAAW,GAAG,KAAK,CAAC,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC;QAC7F,CAAC;QACD,MAAM,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAEjC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,CAAsC,CAAC;QAC1E,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,iBAAiB,CAAC;IACzB,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/gateway/index.d.ts

@@ -0,0 +1,23 @@
+/**
+ * LLM Gateway (AD-036) — независимый слой безопасности.
+ * Реэкспорт всех публичных сущностей.
+ */
+export { detectSecrets, maskSecret, DEFAULT_PATTERNS } from './secret-detector.js';
+export type { SecretDetectorPattern } from './secret-detector.js';
+export { SecretPatternStore } from './secret-pattern-store.js';
+export type { SecretPattern, SecretPatternStoreOptions, SecretPatternsRaw } from './secret-pattern-store.js';
+export { obfuscateSecrets, deobfuscateSecrets, restoreSecrets, PLACEHOLDER_PATTERN, PLACEHOLDER_REGEX } from './obfuscator.js';
+export type { ObfuscateResult } from './obfuscator.js';
+export { runInputGuard } from './input-guard.js';
+export type { InputGuardResult, InputGuardMeta } from './input-guard.js';
+export { runOutputGuard } from './output-guard.js';
+export type { OutputGuardResult } from './output-guard.js';
+export { RateLimiter } from './rate-limiter.js';
+export { AuditLogger, readAuditLog } from './audit-logger.js';
+export type { AuditEventType, AuditEntry, AuditLogQuery } from './audit-logger.js';
+export { PayloadLogger, writePayloadLog, readPayloadLog } from './payload-logger.js';
+export type { LlmPayloadEntry, LlmPayloadRequest, LlmPayloadResponse, PayloadLogQuery } from './payload-logger.js';
+export { GatewayProvider } from './gateway-provider.js';
+export type { GatewayProviderOptions } from './gateway-provider.js';
+export { ObfuscationMapStore } from './obfuscation-map-store.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/engine/gateway/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACnF,YAAY,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAClE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,YAAY,EAAE,aAAa,EAAE,yBAAyB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC7G,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAC/H,YAAY,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,YAAY,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AACnD,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAC9D,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AACnF,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrF,YAAY,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACnH,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,YAAY,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/engine/gateway/index.js

@@ -0,0 +1,15 @@
+/**
+ * LLM Gateway (AD-036) — независимый слой безопасности.
+ * Реэкспорт всех публичных сущностей.
+ */
+export { detectSecrets, maskSecret, DEFAULT_PATTERNS } from './secret-detector.js';
+export { SecretPatternStore } from './secret-pattern-store.js';
+export { obfuscateSecrets, deobfuscateSecrets, restoreSecrets, PLACEHOLDER_PATTERN, PLACEHOLDER_REGEX } from './obfuscator.js';
+export { runInputGuard } from './input-guard.js';
+export { runOutputGuard } from './output-guard.js';
+export { RateLimiter } from './rate-limiter.js';
+export { AuditLogger, readAuditLog } from './audit-logger.js';
+export { PayloadLogger, writePayloadLog, readPayloadLog } from './payload-logger.js';
+export { GatewayProvider } from './gateway-provider.js';
+export { ObfuscationMapStore } from './obfuscation-map-store.js';
+//# sourceMappingURL=index.js.map

package/dist/engine/gateway/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/engine/gateway/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAE/D,OAAO,EAAE,gBAAgB,EAAE,kBAAkB,EAAE,cAAc,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAE/H,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAE9D,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAErF,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,OAAO,EAAE,mBAAmB,EAAE,MAAM,4BAA4B,CAAC"}

package/dist/engine/gateway/input-guard.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Input Guard (AD-036): обфускация или блокировка секретов во входящем запросе
+ * (messages + systemPrompt + tools) перед отправкой в LLM.
+ */
+import { type LLMGatewayConfig } from '@itphx/synth-shared';
+import type { LLMMessage } from '../../providers/base.js';
+import type { AuditLogger } from './audit-logger.js';
+import type { SecretPattern } from './secret-pattern-store.js';
+export interface InputGuardResult {
+    /** true — можно отправлять в LLM. */
+    ok: boolean;
+    /** Обфусцированные сообщения. */
+    messages: LLMMessage[];
+    systemPrompt?: string;
+    tools?: Record<string, unknown>[];
+    /** Обновлённая карта обфускации. */
+    map: Record<string, string>;
+    secretsFound: string[];
+    /** Заполняется в режиме block при найденных секретах. */
+    blocked?: {
+        reason: string;
+        message: string;
+    };
+}
+export interface InputGuardMeta {
+    sessionId: string;
+    userId: string;
+    provider: string;
+    model: string;
+}
+/**
+ * Прогоняет секреты по content всех сообщений, systemPrompt и JSON-сериализованным tools.
+ * - Режим obfuscate: секреты заменяются на плейсхолдеры, карта обновляется.
+ * - Режим block: ok=false, секреты в LLM не уходят; reason — замаскированный префикс.
+ * В аудит секреты пишутся только в замаскированном виде.
+ */
+export declare function runInputGuard(config: LLMGatewayConfig, messages: LLMMessage[], systemPrompt: string | undefined, tools: Record<string, unknown>[] | undefined, map: Record<string, string>, audit: AuditLogger, meta: InputGuardMeta, patterns?: SecretPattern[]): Promise<InputGuardResult>;
+//# sourceMappingURL=input-guard.d.ts.map

package/dist/engine/gateway/input-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-guard.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/input-guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAU,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEpE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAE/D,MAAM,WAAW,gBAAgB;IAC/B,qCAAqC;IACrC,EAAE,EAAE,OAAO,CAAC;IACZ,iCAAiC;IACjC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IAClC,oCAAoC;IACpC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,yDAAyD;IACzD,OAAO,CAAC,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CAC/C;AAED,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,UAAU,EAAE,EACtB,YAAY,EAAE,MAAM,GAAG,SAAS,EAChC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,SAAS,EAC5C,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAC3B,KAAK,EAAE,WAAW,EAClB,IAAI,EAAE,cAAc,EACpB,QAAQ,CAAC,EAAE,aAAa,EAAE,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAiG3B"}

package/dist/engine/gateway/input-guard.js

@@ -0,0 +1,109 @@
+/**
+ * Input Guard (AD-036): обфускация или блокировка секретов во входящем запросе
+ * (messages + systemPrompt + tools) перед отправкой в LLM.
+ */
+import { nowISO } from '@itphx/synth-shared';
+import { detectSecrets, maskSecret } from './secret-detector.js';
+import { obfuscateSecrets } from './obfuscator.js';
+/**
+ * Прогоняет секреты по content всех сообщений, systemPrompt и JSON-сериализованным tools.
+ * - Режим obfuscate: секреты заменяются на плейсхолдеры, карта обновляется.
+ * - Режим block: ok=false, секреты в LLM не уходят; reason — замаскированный префикс.
+ * В аудит секреты пишутся только в замаскированном виде.
+ */
+export async function runInputGuard(config, messages, systemPrompt, tools, map, audit, meta, patterns) {
+    if (!config.enabled) {
+        return { ok: true, messages, systemPrompt, tools, map, secretsFound: [] };
+    }
+    const allFound = [];
+    const collect = (text) => {
+        for (const secret of detectSecrets(text, patterns)) {
+            if (!allFound.includes(secret))
+                allFound.push(secret);
+        }
+    };
+    for (const message of messages)
+        collect(message.content);
+    if (systemPrompt)
+        collect(systemPrompt);
+    if (tools?.length)
+        collect(JSON.stringify(tools));
+    if (allFound.length === 0) {
+        return { ok: true, messages, systemPrompt, tools, map, secretsFound: [] };
+    }
+    if (config.inputMode === 'block') {
+        const reason = maskSecret(allFound[0]);
+        await audit.append({
+            ts: nowISO(),
+            type: 'blocked',
+            sessionId: meta.sessionId,
+            userId: meta.userId,
+            provider: meta.provider,
+            model: meta.model,
+            secretsFound: allFound.map(maskSecret),
+            reason,
+        });
+        return {
+            ok: false,
+            messages,
+            systemPrompt,
+            tools,
+            map,
+            secretsFound: allFound,
+            blocked: {
+                reason,
+                message: `Обнаружены секреты в запросе (${reason}). Запрос заблокирован LLM Gateway.`,
+            },
+        };
+    }
+    let currentMap = map;
+    const newPlaceholders = [];
+    const obfuscatedMessages = messages.map((message) => {
+        const result = obfuscateSecrets(message.content, currentMap, patterns);
+        currentMap = result.map;
+        for (const key of Object.keys(currentMap)) {
+            if (!(key in map) && !newPlaceholders.includes(key))
+                newPlaceholders.push(key);
+        }
+        return result.text === message.content ? message : { ...message, content: result.text };
+    });
+    let obfuscatedSystem = systemPrompt;
+    if (systemPrompt) {
+        const result = obfuscateSecrets(systemPrompt, currentMap, patterns);
+        currentMap = result.map;
+        for (const key of Object.keys(currentMap)) {
+            if (!(key in map) && !newPlaceholders.includes(key))
+                newPlaceholders.push(key);
+        }
+        obfuscatedSystem = result.text;
+    }
+    let obfuscatedTools = tools;
+    if (tools?.length) {
+        const result = obfuscateSecrets(JSON.stringify(tools), currentMap, patterns);
+        currentMap = result.map;
+        for (const key of Object.keys(currentMap)) {
+            if (!(key in map) && !newPlaceholders.includes(key))
+                newPlaceholders.push(key);
+        }
+        obfuscatedTools = JSON.parse(result.text);
+    }
+    await audit.append({
+        ts: nowISO(),
+        type: 'obfuscated',
+        sessionId: meta.sessionId,
+        userId: meta.userId,
+        provider: meta.provider,
+        model: meta.model,
+        secretsFound: allFound.map(maskSecret),
+        placeholders: newPlaceholders,
+    });
+    return {
+        ok: true,
+        messages: obfuscatedMessages,
+        systemPrompt: obfuscatedSystem,
+        tools: obfuscatedTools,
+        map: currentMap,
+        secretsFound: allFound,
+    };
+}
+//# sourceMappingURL=input-guard.js.map

package/dist/engine/gateway/input-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-guard.js","sourceRoot":"","sources":["../../../src/engine/gateway/input-guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,MAAM,EAAyB,MAAM,qBAAqB,CAAC;AAGpE,OAAO,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAyBnD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAwB,EACxB,QAAsB,EACtB,YAAgC,EAChC,KAA4C,EAC5C,GAA2B,EAC3B,KAAkB,EAClB,IAAoB,EACpB,QAA0B;IAE1B,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,OAAO,GAAG,CAAC,IAAY,EAAQ,EAAE;QACrC,KAAK,MAAM,MAAM,IAAI,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;YACnD,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC;gBAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxD,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACzD,IAAI,YAAY;QAAE,OAAO,CAAC,YAAY,CAAC,CAAC;IACxC,IAAI,KAAK,EAAE,MAAM;QAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IAElD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,EAAE,GAAG,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC5E,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,MAAM,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,CAAC;QACxC,MAAM,KAAK,CAAC,MAAM,CAAC;YACjB,EAAE,EAAE,MAAM,EAAE;YACZ,IAAI,EAAE,SAAS;YACf,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;YACtC,MAAM;SACP,CAAC,CAAC;QACH,OAAO;YACL,EAAE,EAAE,KAAK;YACT,QAAQ;YACR,YAAY;YACZ,KAAK;YACL,GAAG;YACH,YAAY,EAAE,QAAQ;YACtB,OAAO,EAAE;gBACP,MAAM;gBACN,OAAO,EAAE,iCAAiC,MAAM,qCAAqC;aACtF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,GAAG,GAAG,CAAC;IACrB,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,MAAM,kBAAkB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE;QAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACvE,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,IAAI,gBAAgB,GAAG,YAAY,CAAC;IACpC,IAAI,YAAY,EAAE,CAAC;QACjB,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QACpE,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,gBAAgB,GAAG,MAAM,CAAC,IAAI,CAAC;IACjC,CAAC;IAED,IAAI,eAAe,GAAG,KAAK,CAAC;IAC5B,IAAI,KAAK,EAAE,MAAM,EAAE,CAAC;QAClB,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC7E,UAAU,GAAG,MAAM,CAAC,GAAG,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC1C,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC,GAAG,CAAC;gBAAE,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjF,CAAC;QACD,eAAe,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAA8B,CAAC;IACzE,CAAC;IAED,MAAM,KAAK,CAAC,MAAM,CAAC;QACjB,EAAE,EAAE,MAAM,EAAE;QACZ,IAAI,EAAE,YAAY;QAClB,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;QACvB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,YAAY,EAAE,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC;QACtC,YAAY,EAAE,eAAe;KAC9B,CAAC,CAAC;IAEH,OAAO;QACL,EAAE,EAAE,IAAI;QACR,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,gBAAgB;QAC9B,KAAK,EAAE,eAAe;QACtB,GAAG,EAAE,UAAU;QACf,YAAY,EAAE,QAAQ;KACvB,CAAC;AACJ,CAAC"}

package/dist/engine/gateway/input-guard.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Юнит-тесты Input Guard (AD-036): обфускация/блокировка секретов
+ * в messages + systemPrompt + tools перед отправкой в LLM.
+ */
+export {};
+//# sourceMappingURL=input-guard.test.d.ts.map

package/dist/engine/gateway/input-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-guard.test.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/input-guard.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/engine/gateway/input-guard.test.js

@@ -0,0 +1,109 @@
+/**
+ * Юнит-тесты Input Guard (AD-036): обфускация/блокировка секретов
+ * в messages + systemPrompt + tools перед отправкой в LLM.
+ */
+import { describe, it, expect, vi } from 'vitest';
+import { runInputGuard } from './input-guard.js';
+const SK_KEY = 'sk-abcdefghijklmnopqrst';
+function makeConfig(overrides = {}) {
+    return {
+        enabled: true,
+        inputMode: 'obfuscate',
+        logPayloads: false,
+        payloadLogPath: '',
+        rateLimit: { userPerMinute: 60, providerPerMinute: 120 },
+        audit: { enabled: true, logPath: '' },
+        ...overrides,
+    };
+}
+function makeMessage(content) {
+    return {
+        id: 'm1',
+        role: 'user',
+        content,
+        usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
+        disabled: false,
+        pinned: false,
+        branchId: 'b1',
+    };
+}
+function makeMeta() {
+    return { sessionId: 's1', userId: 'u1', provider: 'p1', model: 'm1' };
+}
+function makeAudit() {
+    return { append: vi.fn().mockResolvedValue(undefined) };
+}
+describe('runInputGuard', () => {
+    it('obfuscate: сообщение с секретом → ok:true, messages обфусцированы, map содержит', async () => {
+        const audit = makeAudit();
+        const result = await runInputGuard(makeConfig(), [makeMessage(`мой ключ ${SK_KEY}`)], undefined, undefined, {}, audit, makeMeta());
+        expect(result.ok).toBe(true);
+        expect(result.messages[0]?.content).toContain('⟦SYNTH_SECRET_1⟧');
+        expect(result.messages[0]?.content).not.toContain('sk-');
+        expect(result.map['⟦SYNTH_SECRET_1⟧']).toBe(SK_KEY);
+        expect(result.secretsFound).toEqual([SK_KEY]);
+        expect(audit.append).toHaveBeenCalledWith(expect.objectContaining({ type: 'obfuscated' }));
+    });
+    it('obfuscate: повторный вызов с сохранённой картой не создаёт новый плейсхолдер', async () => {
+        const audit = makeAudit();
+        const first = await runInputGuard(makeConfig(), [makeMessage(SK_KEY)], undefined, undefined, {}, audit, makeMeta());
+        const second = await runInputGuard(makeConfig(), [makeMessage(`снова ${SK_KEY}`)], undefined, undefined, first.map, audit, makeMeta());
+        expect(second.messages[0]?.content).toBe('снова ⟦SYNTH_SECRET_1⟧');
+        expect(second.map).toEqual(first.map);
+    });
+    it('block: секрет найден → ok:false, reason замаскирован, message без полного секрета', async () => {
+        const audit = makeAudit();
+        const result = await runInputGuard(makeConfig({ inputMode: 'block' }), [makeMessage(`мой ключ ${SK_KEY}`)], undefined, undefined, {}, audit, makeMeta());
+        expect(result.ok).toBe(false);
+        expect(result.blocked?.reason).toBe('sk-***');
+        expect(result.blocked?.message).toContain('sk-***');
+        expect(result.blocked?.message).not.toContain(SK_KEY);
+        expect(audit.append).toHaveBeenCalledWith(expect.objectContaining({ type: 'blocked' }));
+    });
+    it('block: секреты не покидают guard (в LLM уходят только при ok:true)', async () => {
+        // Фактическое поведение реализации: messages возвращаются без изменений,
+        // но ok:false запрещает вызывающему коду отправлять их в LLM
+        // (GatewayProvider не вызывает inner при blocked — см. gateway-provider.test.ts).
+        const audit = makeAudit();
+        const result = await runInputGuard(makeConfig({ inputMode: 'block' }), [makeMessage(SK_KEY)], undefined, undefined, {}, audit, makeMeta());
+        expect(result.ok).toBe(false);
+        expect(result.secretsFound).toContain(SK_KEY);
+    });
+    it('systemPrompt обфусцируется', async () => {
+        const audit = makeAudit();
+        const result = await runInputGuard(makeConfig(), [], `системный промпт с ${SK_KEY}`, undefined, {}, audit, makeMeta());
+        expect(result.ok).toBe(true);
+        expect(result.systemPrompt).toContain('⟦SYNTH_SECRET_1⟧');
+        expect(result.systemPrompt).not.toContain('sk-');
+    });
+    it('tools (JSON) обфусцируются', async () => {
+        const audit = makeAudit();
+        const tools = [
+            { type: 'function', function: { name: 'web_fetch', parameters: { url: `https://x.example/?key=${SK_KEY}` } } },
+        ];
+        const result = await runInputGuard(makeConfig(), [], undefined, tools, {}, audit, makeMeta());
+        expect(result.ok).toBe(true);
+        const json = JSON.stringify(result.tools);
+        expect(json).not.toContain('sk-');
+        expect(json).toContain('⟦SYNTH_SECRET_1⟧');
+    });
+    it('чистый промпт → ok:true, карта пустая, аудит не пишется', async () => {
+        const audit = makeAudit();
+        const result = await runInputGuard(makeConfig(), [makeMessage('привет')], 'system', undefined, {}, audit, makeMeta());
+        expect(result.ok).toBe(true);
+        expect(result.messages[0]?.content).toBe('привет');
+        expect(result.map).toEqual({});
+        expect(result.secretsFound).toEqual([]);
+        expect(audit.append).not.toHaveBeenCalled();
+    });
+    it('enabled:false → passthrough без изменений', async () => {
+        const audit = makeAudit();
+        const messages = [makeMessage(`ключ ${SK_KEY}`)];
+        const result = await runInputGuard(makeConfig({ enabled: false }), messages, 'system', undefined, {}, audit, makeMeta());
+        expect(result.ok).toBe(true);
+        expect(result.messages).toEqual(messages); // секрет не тронут
+        expect(result.map).toEqual({});
+        expect(audit.append).not.toHaveBeenCalled();
+    });
+});
+//# sourceMappingURL=input-guard.test.js.map

package/dist/engine/gateway/input-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"input-guard.test.js","sourceRoot":"","sources":["../../../src/engine/gateway/input-guard.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAMlD,OAAO,EAAE,aAAa,EAAuB,MAAM,kBAAkB,CAAC;AAEtE,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC,SAAS,UAAU,CAAC,YAAuC,EAAE;IAC3D,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,WAAW;QACtB,WAAW,EAAE,KAAK;QAClB,cAAc,EAAE,EAAE;QAClB,SAAS,EAAE,EAAE,aAAa,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE;QACxD,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE;QACrC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI,EAAE,MAAM;QACZ,OAAO;QACP,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;QAC1D,QAAQ,EAAE,KAAK;QACf,MAAM,EAAE,KAAK;QACb,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,SAAS,QAAQ;IACf,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;AACxE,CAAC;AAED,SAAS,SAAS;IAChB,OAAO,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,SAAS,CAAC,EAEpD,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,iFAAiF,EAAE,KAAK,IAAI,EAAE;QAC/F,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,UAAU,EAAE,EACZ,CAAC,WAAW,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,EACnC,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAC9C,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8EAA8E,EAAE,KAAK,IAAI,EAAE;QAC5F,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,aAAa,CAC/B,UAAU,EAAE,EACZ,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EACrB,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,UAAU,EAAE,EACZ,CAAC,WAAW,CAAC,SAAS,MAAM,EAAE,CAAC,CAAC,EAChC,SAAS,EACT,SAAS,EACT,KAAK,CAAC,GAAG,EACT,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mFAAmF,EAAE,KAAK,IAAI,EAAE;QACjG,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAClC,CAAC,WAAW,CAAC,YAAY,MAAM,EAAE,CAAC,CAAC,EACnC,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;IAC1F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,oEAAoE,EAAE,KAAK,IAAI,EAAE;QAClF,yEAAyE;QACzE,6DAA6D;QAC7D,kFAAkF;QAClF,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,UAAU,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAClC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,EACrB,SAAS,EACT,SAAS,EACT,EAAE,EACF,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,UAAU,EAAE,EACZ,EAAE,EACF,sBAAsB,MAAM,EAAE,EAC9B,SAAS,EACT,EAAE,EACF,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAC1D,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4BAA4B,EAAE,KAAK,IAAI,EAAE;QAC1C,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG;YACZ,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,EAAE,GAAG,EAAE,0BAA0B,MAAM,EAAE,EAAE,EAAE,EAAE;SAC/G,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,UAAU,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAE9F,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;IAC7C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,KAAK,IAAI,EAAE;QACvE,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,UAAU,EAAE,EACZ,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,EACvB,QAAQ,EACR,SAAS,EACT,EAAE,EACF,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,KAAK,IAAI,EAAE;QACzD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;QAC1B,MAAM,QAAQ,GAAG,CAAC,WAAW,CAAC,QAAQ,MAAM,EAAE,CAAC,CAAC,CAAC;QACjD,MAAM,MAAM,GAAG,MAAM,aAAa,CAChC,UAAU,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAC9B,QAAQ,EACR,QAAQ,EACR,SAAS,EACT,EAAE,EACF,KAAK,EACL,QAAQ,EAAE,CACX,CAAC;QAEF,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,mBAAmB;QAC9D,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,gBAAgB,EAAE,CAAC;IAC9C,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/gateway/integration.test.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Интеграция ChatOrchestrator × LLM Gateway (AD-036), слой 3:
+ * - _getProvider оборачивает провайдер в GatewayProvider когда gateway включён;
+ * - при выключенном gateway возвращается исходный провайдер;
+ * - _saveAssistantMessage добавляет metadata.secrets для существующих плейсхолдеров.
+ */
+export {};
+//# sourceMappingURL=integration.test.d.ts.map

package/dist/engine/gateway/integration.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.test.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/integration.test.ts"],"names":[],"mappings":"AAAA;;;;;GAKG"}