@itphx/synth-core 0.2.0

package/dist/engine/gateway/obfuscator.test.js

@@ -0,0 +1,104 @@
+/**
+ * Юнит-тесты обфускатора секретов (AD-036).
+ * Плейсхолдер: ⟦SYNTH_SECRET_N⟧ (юникод-скобки U+27E6/27E7, префикс SYNTH_).
+ */
+import { describe, it, expect } from 'vitest';
+import { obfuscateSecrets, deobfuscateSecrets, restoreSecrets, PLACEHOLDER_PATTERN, PLACEHOLDER_REGEX, } from './obfuscator.js';
+const SK1 = 'sk-aaaaaaaaaaaaaaaaaaaa';
+const SK2 = 'sk-bbbbbbbbbbbbbbbbbbbb';
+describe('obfuscateSecrets', () => {
+    it('обфускация нового секрета создаёт ⟦SYNTH_SECRET_1⟧ и добавляет в карту', () => {
+        const result = obfuscateSecrets(`мой ключ ${SK1}`, {});
+        expect(result.text).toContain('⟦SYNTH_SECRET_1⟧');
+        expect(result.text).not.toContain('sk-');
+        expect(result.map).toEqual({ '⟦SYNTH_SECRET_1⟧': SK1 });
+        expect(result.found).toEqual([SK1]);
+    });
+    it('повторный секрет → тот же плейсхолдер (карта не растёт)', () => {
+        const first = obfuscateSecrets(`ключ ${SK1}`, {});
+        const second = obfuscateSecrets(`снова ключ ${SK1}`, first.map);
+        expect(second.text).toBe('снова ключ ⟦SYNTH_SECRET_1⟧');
+        expect(second.map).toEqual(first.map); // размер не увеличился
+    });
+    it('несколько разных секретов → SECRET_1, SECRET_2...', () => {
+        const result = obfuscateSecrets(`${SK1} и ${SK2}`, {});
+        expect(result.text).toBe('⟦SYNTH_SECRET_1⟧ и ⟦SYNTH_SECRET_2⟧');
+        expect(result.map).toEqual({
+            '⟦SYNTH_SECRET_1⟧': SK1,
+            '⟦SYNTH_SECRET_2⟧': SK2,
+        });
+    });
+    it('одинаковый секрет в тексте несколько раз заменяется одним плейсхолдером', () => {
+        const result = obfuscateSecrets(`${SK1} ... ${SK1} ... ${SK1}`, {});
+        expect(result.text.match(/⟦SYNTH_SECRET_1⟧/g)).toHaveLength(3);
+        expect(Object.keys(result.map)).toHaveLength(1);
+    });
+    it('текст без секретов → без изменений, карта пустая', () => {
+        const result = obfuscateSecrets('обычный текст', {});
+        expect(result.text).toBe('обычный текст');
+        expect(result.map).toEqual({});
+        expect(result.found).toEqual([]);
+    });
+    it('пустой текст → без изменений', () => {
+        const result = obfuscateSecrets('', {});
+        expect(result.text).toBe('');
+        expect(result.map).toEqual({});
+    });
+    it('следующий свободный номер учитывает существующую карту', () => {
+        const map = { '⟦SYNTH_SECRET_1⟧': SK1 };
+        const result = obfuscateSecrets(`новый ${SK2}`, map);
+        expect(result.text).toBe('новый ⟦SYNTH_SECRET_2⟧');
+        expect(result.map['⟦SYNTH_SECRET_2⟧']).toBe(SK2);
+    });
+});
+describe('deobfuscateSecrets', () => {
+    const map = { '⟦SYNTH_SECRET_1⟧': SK1, '⟦SYNTH_SECRET_2⟧': SK2 };
+    it('возвращает оригинал для известных плейсхолдеров', () => {
+        expect(deobfuscateSecrets('Подключение с ⟦SYNTH_SECRET_1⟧ и ⟦SYNTH_SECRET_2⟧', map)).toBe(`Подключение с ${SK1} и ${SK2}`);
+    });
+    it('неизвестный плейсхолдер (нет в карте) остаётся как есть', () => {
+        expect(deobfuscateSecrets('⟦SYNTH_SECRET_99⟧', map)).toBe('⟦SYNTH_SECRET_99⟧');
+    });
+    it('текст без плейсхолдеров → без изменений', () => {
+        expect(deobfuscateSecrets('просто текст', map)).toBe('просто текст');
+    });
+    it('пустой текст или пустая карта → без изменений', () => {
+        expect(deobfuscateSecrets('', map)).toBe('');
+        expect(deobfuscateSecrets('⟦SYNTH_SECRET_1⟧', {})).toBe('⟦SYNTH_SECRET_1⟧');
+    });
+});
+describe('restoreSecrets', () => {
+    const map = { '⟦SYNTH_SECRET_1⟧': SK1, '⟦SYNTH_SECRET_2⟧': SK2 };
+    it('рекурсивно деобфусцирует вложенные объекты и массивы', () => {
+        const input = {
+            a: ['x ⟦SYNTH_SECRET_1⟧ y'],
+            b: { c: '⟦SYNTH_SECRET_2⟧', d: [42, '⟦SYNTH_SECRET_1⟧'] },
+            n: 42,
+            flag: true,
+            nil: null,
+        };
+        const restored = restoreSecrets(input, map);
+        expect(restored.a[0]).toBe(`x ${SK1} y`);
+        expect(restored.b.c).toBe(SK2);
+        expect(restored.b.d[1]).toBe(SK1);
+        expect(restored.n).toBe(42);
+        expect(restored.flag).toBe(true);
+        expect(restored.nil).toBeNull();
+    });
+    it('плоская строка восстанавливается как deobfuscateSecrets', () => {
+        expect(restoreSecrets('⟦SYNTH_SECRET_1⟧', map)).toBe(SK1);
+    });
+    it('неизвестный плейсхолдер остаётся как есть', () => {
+        expect(restoreSecrets({ x: '⟦SYNTH_SECRET_77⟧' }, map)).toEqual({ x: '⟦SYNTH_SECRET_77⟧' });
+    });
+});
+describe('константы плейсхолдера', () => {
+    it('PLACEHOLDER_PATTERN и PLACEHOLDER_REGEX матчат ⟦SYNTH_SECRET_N⟧', () => {
+        expect('⟦SYNTH_SECRET_1⟧'.match(PLACEHOLDER_PATTERN)?.[1]).toBe('1');
+        expect('a ⟦SYNTH_SECRET_12⟧ b'.replace(PLACEHOLDER_REGEX, 'X')).toBe('a X b');
+    });
+    it('PLACEHOLDER_PATTERN не матчит произвольный текст', () => {
+        expect('обычный текст'.match(PLACEHOLDER_PATTERN)).toBeNull();
+    });
+});
+//# sourceMappingURL=obfuscator.test.js.map

package/dist/engine/gateway/obfuscator.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"obfuscator.test.js","sourceRoot":"","sources":["../../../src/engine/gateway/obfuscator.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EACL,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AAEzB,MAAM,GAAG,GAAG,yBAAyB,CAAC;AACtC,MAAM,GAAG,GAAG,yBAAyB,CAAC;AAEtC,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,wEAAwE,EAAE,GAAG,EAAE;QAChF,MAAM,MAAM,GAAG,gBAAgB,CAAC,YAAY,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QAClD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACzC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,KAAK,GAAG,gBAAgB,CAAC,QAAQ,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,gBAAgB,CAAC,cAAc,GAAG,EAAE,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,uBAAuB;IAChE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,GAAG,MAAM,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACvD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,qCAAqC,CAAC,CAAC;QAChE,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;YACzB,kBAAkB,EAAE,GAAG;YACvB,kBAAkB,EAAE,GAAG;SACxB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yEAAyE,EAAE,GAAG,EAAE;QACjF,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,GAAG,QAAQ,GAAG,QAAQ,GAAG,EAAE,EAAE,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/D,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,MAAM,GAAG,gBAAgB,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC1C,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,MAAM,GAAG,gBAAgB,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;QACxC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7B,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wDAAwD,EAAE,GAAG,EAAE;QAChE,MAAM,GAAG,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,gBAAgB,CAAC,SAAS,GAAG,EAAE,EAAE,GAAG,CAAC,CAAC;QACrD,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC;QACnD,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,MAAM,GAAG,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC;IAEjE,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,kBAAkB,CAAC,mDAAmD,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CACvF,iBAAiB,GAAG,MAAM,GAAG,EAAE,CAChC,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,kBAAkB,CAAC,mBAAmB,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,kBAAkB,CAAC,cAAc,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,CAAC,kBAAkB,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,kBAAkB,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC9E,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,GAAG,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,kBAAkB,EAAE,GAAG,EAAE,CAAC;IAEjE,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,KAAK,GAAG;YACZ,CAAC,EAAE,CAAC,sBAAsB,CAAC;YAC3B,CAAC,EAAE,EAAE,CAAC,EAAE,kBAAkB,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,kBAAkB,CAAC,EAAE;YACzD,CAAC,EAAE,EAAE;YACL,IAAI,EAAE,IAAI;YACV,GAAG,EAAE,IAAI;SACV,CAAC;QACF,MAAM,QAAQ,GAAG,cAAc,CAAC,KAAK,EAAE,GAAG,CAAiB,CAAC;QAC5D,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC;QACzC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC5B,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QACjE,MAAM,CAAC,cAAc,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC,EAAE,mBAAmB,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,mBAAmB,EAAE,CAAC,CAAC;IAC9F,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE;IACtC,EAAE,CAAC,iEAAiE,EAAE,GAAG,EAAE;QACzE,MAAM,CAAC,kBAAkB,CAAC,KAAK,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrE,MAAM,CAAC,uBAAuB,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAChF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,kDAAkD,EAAE,GAAG,EAAE;QAC1D,MAAM,CAAC,eAAe,CAAC,KAAK,CAAC,mBAAmB,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;IAChE,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/gateway/output-guard.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Output Guard (AD-036): детекция секретов в ответе модели.
+ * Галлюцинированные/украденные ключи фиксируются, но не модифицируют ответ.
+ */
+import type { SecretPattern } from './secret-pattern-store.js';
+export interface OutputGuardResult {
+    found: string[];
+    /** Есть ли что-то подозрительное: секреты или http-ссылки внутри контента. */
+    suspicious: boolean;
+}
+export declare function runOutputGuard(text: string, patterns?: SecretPattern[]): OutputGuardResult;
+//# sourceMappingURL=output-guard.d.ts.map

package/dist/engine/gateway/output-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-guard.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/output-guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAI/D,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,8EAA8E;IAC9E,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,aAAa,EAAE,GAAG,iBAAiB,CAI1F"}

package/dist/engine/gateway/output-guard.js

@@ -0,0 +1,12 @@
+/**
+ * Output Guard (AD-036): детекция секретов в ответе модели.
+ * Галлюцинированные/украденные ключи фиксируются, но не модифицируют ответ.
+ */
+import { detectSecrets } from './secret-detector.js';
+const SUSPICIOUS_URL_REGEX = /https?:\/\/[^\s]+/gi;
+export function runOutputGuard(text, patterns) {
+    const found = detectSecrets(text, patterns);
+    const hasHttpLinks = SUSPICIOUS_URL_REGEX.test(text);
+    return { found, suspicious: found.length > 0 || hasHttpLinks };
+}
+//# sourceMappingURL=output-guard.js.map

package/dist/engine/gateway/output-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-guard.js","sourceRoot":"","sources":["../../../src/engine/gateway/output-guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAGrD,MAAM,oBAAoB,GAAG,qBAAqB,CAAC;AAQnD,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,QAA0B;IACrE,MAAM,KAAK,GAAG,aAAa,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC5C,MAAM,YAAY,GAAG,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACrD,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,YAAY,EAAE,CAAC;AACjE,CAAC"}

package/dist/engine/gateway/output-guard.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Юнит-тесты Output Guard (AD-036): детекция секретов в ответе модели.
+ */
+export {};
+//# sourceMappingURL=output-guard.test.d.ts.map

package/dist/engine/gateway/output-guard.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-guard.test.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/output-guard.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/engine/gateway/output-guard.test.js

@@ -0,0 +1,31 @@
+/**
+ * Юнит-тесты Output Guard (AD-036): детекция секретов в ответе модели.
+ */
+import { describe, it, expect } from 'vitest';
+import { runOutputGuard } from './output-guard.js';
+const SK_KEY = 'sk-abcdefghijklmnopqrst';
+describe('runOutputGuard', () => {
+    it('ответ содержит sk-ключ → found непустой, suspicious true', () => {
+        const result = runOutputGuard(`вот мой ключ ${SK_KEY}`);
+        expect(result.found).toContain(SK_KEY);
+        expect(result.suspicious).toBe(true);
+    });
+    it('чистый ответ → found пустой, suspicious false', () => {
+        const result = runOutputGuard('обычный ответ без секретов');
+        expect(result.found).toEqual([]);
+        expect(result.suspicious).toBe(false);
+    });
+    it('http-ссылка → suspicious true, но это не секрет (found пустой)', () => {
+        // Реализация: подозрительность = найденные секреты ИЛИ http-ссылки.
+        // Ссылка сама по себе не считается секретом (в found не попадает).
+        const result = runOutputGuard('смотри https://example.com/path?q=1');
+        expect(result.found).toEqual([]);
+        expect(result.suspicious).toBe(true);
+    });
+    it('пустая строка → ничего не найдено', () => {
+        const result = runOutputGuard('');
+        expect(result.found).toEqual([]);
+        expect(result.suspicious).toBe(false);
+    });
+});
+//# sourceMappingURL=output-guard.test.js.map

package/dist/engine/gateway/output-guard.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"output-guard.test.js","sourceRoot":"","sources":["../../../src/engine/gateway/output-guard.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,MAAM,GAAG,yBAAyB,CAAC;AAEzC,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,MAAM,GAAG,cAAc,CAAC,gBAAgB,MAAM,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,cAAc,CAAC,4BAA4B,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gEAAgE,EAAE,GAAG,EAAE;QACxE,oEAAoE;QACpE,mEAAmE;QACnE,MAAM,MAAM,GAAG,cAAc,CAAC,qCAAqC,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC3C,MAAM,MAAM,GAAG,cAAc,CAAC,EAAE,CAAC,CAAC;QAClC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QACjC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/gateway/payload-logger.d.ts

@@ -0,0 +1,52 @@
+/**
+ * Полное логирование запросов/ответов LLM: append-only JSONL, одна строка = одна запись.
+ * Данные пишутся ПОСЛЕ обфускации — секреты (реальные значения) в лог не попадают.
+ * Запись не должна ронять запрос: при ошибке — warning и продолжение.
+ */
+import type { TokenUsage } from '@itphx/synth-shared';
+import type { LLMMessage } from '../../providers/base.js';
+export interface LlmPayloadRequest {
+    messages: LLMMessage[];
+    systemPrompt?: string;
+}
+export interface LlmPayloadResponse {
+    content: string;
+    usage?: TokenUsage;
+}
+export interface LlmPayloadEntry {
+    ts: string;
+    sessionId?: string;
+    userId?: string;
+    provider?: string;
+    model?: string;
+    request: LlmPayloadRequest;
+    response: LlmPayloadResponse;
+}
+export declare class PayloadLogger {
+    private _logPath;
+    private _dirReady;
+    constructor(_logPath: string);
+    get logPath(): string;
+    /** Атомарный append: open 'a', write JSON + '\n'. Не бросает при ошибке записи. */
+    append(entry: LlmPayloadEntry): Promise<void>;
+    private _ensureDir;
+}
+/** Функциональная обёртка записи одной записи полного лога в JSONL-файл. */
+export declare function writePayloadLog(logPath: string, entry: LlmPayloadEntry): Promise<void>;
+/** Фильтры чтения JSONL полного лога. */
+export interface PayloadLogQuery {
+    sessionId?: string;
+    /** Сколько последних записей вернуть (по умолчанию 100). */
+    limit?: number;
+}
+/**
+ * Читает append-only JSONL полного лога, парсит построчно и фильтрует.
+ * Если файла нет или строка повреждена — строка пропускается, файла нет —
+ * возвращается пустой результат (без ошибки). `entries` — последние `limit`
+ * записей, `total` — количество после фильтрации (до лимита).
+ */
+export declare function readPayloadLog(logPath: string, query?: PayloadLogQuery): Promise<{
+    entries: LlmPayloadEntry[];
+    total: number;
+}>;
+//# sourceMappingURL=payload-logger.d.ts.map

package/dist/engine/gateway/payload-logger.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-logger.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/payload-logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,EAAE,UAAU,EAAE,CAAC;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,UAAU,CAAC;CACpB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,iBAAiB,CAAC;IAC3B,QAAQ,EAAE,kBAAkB,CAAC;CAC9B;AAED,qBAAa,aAAa;IAGZ,OAAO,CAAC,QAAQ;IAF5B,OAAO,CAAC,SAAS,CAA8B;gBAE3B,QAAQ,EAAE,MAAM;IAEpC,IAAI,OAAO,IAAI,MAAM,CAEpB;IAED,mFAAmF;IAC7E,MAAM,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC;IASnD,OAAO,CAAC,UAAU;CAWnB;AAED,4EAA4E;AAC5E,wBAAsB,eAAe,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,IAAI,CAAC,CAO5F;AAED,yCAAyC;AACzC,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,MAAM,EACf,KAAK,GAAE,eAAoB,GAC1B,OAAO,CAAC;IAAE,OAAO,EAAE,eAAe,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAwBxD"}

package/dist/engine/gateway/payload-logger.js

@@ -0,0 +1,82 @@
+/**
+ * Полное логирование запросов/ответов LLM: append-only JSONL, одна строка = одна запись.
+ * Данные пишутся ПОСЛЕ обфускации — секреты (реальные значения) в лог не попадают.
+ * Запись не должна ронять запрос: при ошибке — warning и продолжение.
+ */
+import { appendFile, mkdir, readFile } from 'node:fs/promises';
+import { dirname } from 'node:path';
+import { warning } from '../../logger.js';
+export class PayloadLogger {
+    _logPath;
+    _dirReady = null;
+    constructor(_logPath) {
+        this._logPath = _logPath;
+    }
+    get logPath() {
+        return this._logPath;
+    }
+    /** Атомарный append: open 'a', write JSON + '\n'. Не бросает при ошибке записи. */
+    async append(entry) {
+        try {
+            await this._ensureDir();
+            await appendFile(this._logPath, `${JSON.stringify(entry)}\n`, { encoding: 'utf8' });
+        }
+        catch (e) {
+            warning('GATEWAY', `Ошибка записи полного лога: ${e instanceof Error ? e.message : String(e)}`);
+        }
+    }
+    _ensureDir() {
+        if (!this._dirReady) {
+            this._dirReady = mkdir(dirname(this._logPath), { recursive: true })
+                .then(() => undefined)
+                .catch((e) => {
+                this._dirReady = null;
+                throw e;
+            });
+        }
+        return this._dirReady;
+    }
+}
+/** Функциональная обёртка записи одной записи полного лога в JSONL-файл. */
+export async function writePayloadLog(logPath, entry) {
+    try {
+        await mkdir(dirname(logPath), { recursive: true });
+        await appendFile(logPath, `${JSON.stringify(entry)}\n`, { encoding: 'utf8' });
+    }
+    catch (e) {
+        warning('GATEWAY', `Ошибка записи полного лога: ${e instanceof Error ? e.message : String(e)}`);
+    }
+}
+/**
+ * Читает append-only JSONL полного лога, парсит построчно и фильтрует.
+ * Если файла нет или строка повреждена — строка пропускается, файла нет —
+ * возвращается пустой результат (без ошибки). `entries` — последние `limit`
+ * записей, `total` — количество после фильтрации (до лимита).
+ */
+export async function readPayloadLog(logPath, query = {}) {
+    let entries = [];
+    try {
+        const raw = await readFile(logPath, 'utf8');
+        for (const line of raw.split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                entries.push(JSON.parse(trimmed));
+            }
+            catch {
+                // повреждённая строка — пропускаем
+            }
+        }
+    }
+    catch {
+        return { entries: [], total: 0 };
+    }
+    if (query.sessionId) {
+        entries = entries.filter((e) => e.sessionId === query.sessionId);
+    }
+    const total = entries.length;
+    const limit = Number.isFinite(query.limit) && (query.limit ?? 0) > 0 ? Math.floor(query.limit) : 100;
+    return { entries: entries.slice(-limit), total };
+}
+//# sourceMappingURL=payload-logger.js.map

package/dist/engine/gateway/payload-logger.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-logger.js","sourceRoot":"","sources":["../../../src/engine/gateway/payload-logger.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAsB1C,MAAM,OAAO,aAAa;IAGJ;IAFZ,SAAS,GAAyB,IAAI,CAAC;IAE/C,YAAoB,QAAgB;QAAhB,aAAQ,GAAR,QAAQ,CAAQ;IAAG,CAAC;IAExC,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,mFAAmF;IACnF,KAAK,CAAC,MAAM,CAAC,KAAsB;QACjC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,UAAU,EAAE,CAAC;YACxB,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACtF,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,OAAO,CAAC,SAAS,EAAE,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClG,CAAC;IACH,CAAC;IAEO,UAAU;QAChB,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;iBAChE,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;iBACrB,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;gBACX,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;gBACtB,MAAM,CAAC,CAAC;YACV,CAAC,CAAC,CAAC;QACP,CAAC;QACD,OAAO,IAAI,CAAC,SAAU,CAAC;IACzB,CAAC;CACF;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAe,EAAE,KAAsB;IAC3E,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACnD,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAChF,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,SAAS,EAAE,+BAA+B,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAAe,EACf,QAAyB,EAAE;IAE3B,IAAI,OAAO,GAAsB,EAAE,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5C,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC;gBACH,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAoB,CAAC,CAAC;YACvD,CAAC;YAAC,MAAM,CAAC;gBACP,mCAAmC;YACrC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IACnC,CAAC;IAED,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;QACpB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,KAAK,CAAC,SAAS,CAAC,CAAC;IACnE,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC;IAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IACtG,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,CAAC;AACnD,CAAC"}

package/dist/engine/gateway/payload-logger.test.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Юнит-тесты PayloadLogger/writePayloadLog/readPayloadLog: append-only JSONL
+ * полного лога запросов/ответов LLM. Запись не должна ронять запрос.
+ */
+export {};
+//# sourceMappingURL=payload-logger.test.d.ts.map

package/dist/engine/gateway/payload-logger.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-logger.test.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/payload-logger.test.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/engine/gateway/payload-logger.test.js

@@ -0,0 +1,106 @@
+/**
+ * Юнит-тесты PayloadLogger/writePayloadLog/readPayloadLog: append-only JSONL
+ * полного лога запросов/ответов LLM. Запись не должна ронять запрос.
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdtemp, rm, readFile, appendFile, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { PayloadLogger, writePayloadLog, readPayloadLog, } from './payload-logger.js';
+function makeEntry(ts, sessionId) {
+    return {
+        ts,
+        sessionId,
+        userId: 'u1',
+        provider: 'itphx',
+        model: 'local.qwen3:14b',
+        request: {
+            messages: [{
+                    id: 'm1',
+                    role: 'user',
+                    content: 'привет',
+                    usage: { inputTokens: 0, outputTokens: 0, totalTokens: 0 },
+                    disabled: false,
+                    pinned: false,
+                    branchId: 'b1',
+                }],
+            systemPrompt: 'ты помощник',
+        },
+        response: { content: 'здравствуйте', usage: { inputTokens: 5, outputTokens: 3, totalTokens: 8 } },
+    };
+}
+describe('PayloadLogger', () => {
+    let dir;
+    beforeEach(async () => {
+        dir = await mkdtemp(join(tmpdir(), 'synth-payload-'));
+    });
+    afterEach(async () => {
+        await rm(dir, { recursive: true, force: true });
+    });
+    it('append пишет JSON-строку в файл (создаёт директорию)', async () => {
+        const logPath = join(dir, 'audit', 'llm-payloads.jsonl');
+        const logger = new PayloadLogger(logPath);
+        const entry = makeEntry('2026-01-01T00:00:00Z', 's1');
+        await logger.append(entry);
+        const content = await readFile(logPath, 'utf8');
+        expect(content.trim()).toBe(JSON.stringify(entry));
+    });
+    it('каждая запись на новой строке (append-only)', async () => {
+        const logPath = join(dir, 'payloads.jsonl');
+        const logger = new PayloadLogger(logPath);
+        await logger.append(makeEntry('1', 's1'));
+        await logger.append(makeEntry('2', 's2'));
+        await logger.append(makeEntry('3', 's1'));
+        const content = await readFile(logPath, 'utf8');
+        const lines = content.split('\n').filter((l) => l.trim().length > 0);
+        expect(lines).toHaveLength(3);
+        expect(JSON.parse(lines[0]).ts).toBe('1');
+        expect(JSON.parse(lines[2]).ts).toBe('3');
+    });
+    it('writePayloadLog не бросает при ошибке записи (директория заблокирована файлом)', async () => {
+        const blocker = join(dir, 'blocker');
+        await writeFile(blocker, 'x');
+        await expect(writePayloadLog(join(blocker, 'sub', 'payloads.jsonl'), makeEntry('1', 's1')))
+            .resolves.toBeUndefined();
+    });
+    it('readPayloadLog читает записи и фильтрует по sessionId', async () => {
+        const logPath = join(dir, 'payloads.jsonl');
+        const logger = new PayloadLogger(logPath);
+        await logger.append(makeEntry('1', 's1'));
+        await logger.append(makeEntry('2', 's2'));
+        await logger.append(makeEntry('3', 's1'));
+        const all = await readPayloadLog(logPath);
+        expect(all.total).toBe(3);
+        expect(all.entries).toHaveLength(3);
+        const s1 = await readPayloadLog(logPath, { sessionId: 's1' });
+        expect(s1.total).toBe(2);
+        expect(s1.entries.every((e) => e.sessionId === 's1')).toBe(true);
+    });
+    it('readPayloadLog поддерживает limit (последние N записей, total до лимита)', async () => {
+        const logPath = join(dir, 'payloads.jsonl');
+        const logger = new PayloadLogger(logPath);
+        await logger.append(makeEntry('1', 's1'));
+        await logger.append(makeEntry('2', 's2'));
+        await logger.append(makeEntry('3', 's3'));
+        const res = await readPayloadLog(logPath, { limit: 2 });
+        expect(res.total).toBe(3);
+        expect(res.entries).toHaveLength(2);
+        expect(res.entries[0]?.ts).toBe('2');
+        expect(res.entries[1]?.ts).toBe('3');
+    });
+    it('readPayloadLog пропускает повреждённые строки', async () => {
+        const logPath = join(dir, 'payloads.jsonl');
+        const logger = new PayloadLogger(logPath);
+        await logger.append(makeEntry('1', 's1'));
+        await appendFile(logPath, 'not-json-garbage\n', 'utf8');
+        await logger.append(makeEntry('2', 's2'));
+        const res = await readPayloadLog(logPath);
+        expect(res.total).toBe(2);
+    });
+    it('readPayloadLog для несуществующего файла → пустой результат без ошибки', async () => {
+        const res = await readPayloadLog(join(dir, 'missing.jsonl'));
+        expect(res.entries).toEqual([]);
+        expect(res.total).toBe(0);
+    });
+});
+//# sourceMappingURL=payload-logger.test.js.map

package/dist/engine/gateway/payload-logger.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"payload-logger.test.js","sourceRoot":"","sources":["../../../src/engine/gateway/payload-logger.test.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,QAAQ,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EACL,aAAa,EACb,eAAe,EACf,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAE7B,SAAS,SAAS,CAAC,EAAU,EAAE,SAAiB;IAC9C,OAAO;QACL,EAAE;QACF,SAAS;QACT,MAAM,EAAE,IAAI;QACZ,QAAQ,EAAE,OAAO;QACjB,KAAK,EAAE,iBAAiB;QACxB,OAAO,EAAE;YACP,QAAQ,EAAE,CAAC;oBACT,EAAE,EAAE,IAAI;oBACR,IAAI,EAAE,MAAM;oBACZ,OAAO,EAAE,QAAQ;oBACjB,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE;oBAC1D,QAAQ,EAAE,KAAK;oBACf,MAAM,EAAE,KAAK;oBACb,QAAQ,EAAE,IAAI;iBACf,CAAC;YACF,YAAY,EAAE,aAAa;SAC5B;QACD,QAAQ,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,WAAW,EAAE,CAAC,EAAE,EAAE;KAClG,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,IAAI,GAAW,CAAC;IAEhB,UAAU,CAAC,KAAK,IAAI,EAAE;QACpB,GAAG,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,gBAAgB,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,KAAK,IAAI,EAAE;QACnB,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,KAAK,IAAI,EAAE;QACpE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;QACzD,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,KAAK,GAAG,SAAS,CAAC,sBAAsB,EAAE,IAAI,CAAC,CAAC;QAEtD,MAAM,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE3B,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,KAAK,IAAI,EAAE;QAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAChD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACrE,MAAM,CAAC,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC9B,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAW,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gFAAgF,EAAE,KAAK,IAAI,EAAE;QAC9F,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;QACrC,MAAM,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC9B,MAAM,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,gBAAgB,CAAC,EAAE,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;aACxF,QAAQ,CAAC,aAAa,EAAE,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,uDAAuD,EAAE,KAAK,IAAI,EAAE;QACrE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAEpC,MAAM,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9D,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACzB,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0EAA0E,EAAE,KAAK,IAAI,EAAE;QACxF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAE1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QACxD,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACpC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACrC,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,KAAK,IAAI,EAAE;QAC7D,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,IAAI,aAAa,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAC1C,MAAM,UAAU,CAAC,OAAO,EAAE,oBAAoB,EAAE,MAAM,CAAC,CAAC;QACxD,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;QAE1C,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;QAC1C,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wEAAwE,EAAE,KAAK,IAAI,EAAE;QACtF,MAAM,GAAG,GAAG,MAAM,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC;QAC7D,MAAM,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/engine/gateway/rate-limiter.d.ts

@@ -0,0 +1,18 @@
+/**
+ * In-memory sliding window rate limiter (AD-036).
+ * Хранит timestamp-ы вызовов в Map<key, number[]>, чистит устаревшие (> 60s).
+ */
+export declare class RateLimiter {
+    private _userPerMinute;
+    private _providerPerMinute;
+    private _userCalls;
+    private _providerCalls;
+    constructor(_userPerMinute: number, _providerPerMinute: number);
+    /** Проверяет лимит на пользователя. Возвращает false, если лимит превышен. */
+    checkUser(userId: string): boolean;
+    /** Проверяет лимит на провайдера. Возвращает false, если лимит превышен. */
+    checkProvider(provider: string): boolean;
+    reset(): void;
+    private _check;
+}
+//# sourceMappingURL=rate-limiter.d.ts.map

package/dist/engine/gateway/rate-limiter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,qBAAa,WAAW;IAKpB,OAAO,CAAC,cAAc;IACtB,OAAO,CAAC,kBAAkB;IAL5B,OAAO,CAAC,UAAU,CAA+B;IACjD,OAAO,CAAC,cAAc,CAA+B;gBAG3C,cAAc,EAAE,MAAM,EACtB,kBAAkB,EAAE,MAAM;IAGpC,8EAA8E;IAC9E,SAAS,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAKlC,4EAA4E;IAC5E,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO;IAKxC,KAAK,IAAI,IAAI;IAKb,OAAO,CAAC,MAAM;CAcf"}

package/dist/engine/gateway/rate-limiter.js

@@ -0,0 +1,44 @@
+/**
+ * In-memory sliding window rate limiter (AD-036).
+ * Хранит timestamp-ы вызовов в Map<key, number[]>, чистит устаревшие (> 60s).
+ */
+const WINDOW_MS = 60_000;
+export class RateLimiter {
+    _userPerMinute;
+    _providerPerMinute;
+    _userCalls = new Map();
+    _providerCalls = new Map();
+    constructor(_userPerMinute, _providerPerMinute) {
+        this._userPerMinute = _userPerMinute;
+        this._providerPerMinute = _providerPerMinute;
+    }
+    /** Проверяет лимит на пользователя. Возвращает false, если лимит превышен. */
+    checkUser(userId) {
+        if (!userId)
+            return true;
+        return this._check(this._userCalls, userId, this._userPerMinute);
+    }
+    /** Проверяет лимит на провайдера. Возвращает false, если лимит превышен. */
+    checkProvider(provider) {
+        if (!provider)
+            return true;
+        return this._check(this._providerCalls, provider, this._providerPerMinute);
+    }
+    reset() {
+        this._userCalls.clear();
+        this._providerCalls.clear();
+    }
+    _check(map, key, limit) {
+        const now = Date.now();
+        const history = map.get(key) ?? [];
+        const fresh = history.filter((t) => now - t < WINDOW_MS);
+        if (fresh.length >= limit) {
+            map.set(key, fresh);
+            return false;
+        }
+        fresh.push(now);
+        map.set(key, fresh);
+        return true;
+    }
+}
+//# sourceMappingURL=rate-limiter.js.map

package/dist/engine/gateway/rate-limiter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.js","sourceRoot":"","sources":["../../../src/engine/gateway/rate-limiter.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,SAAS,GAAG,MAAM,CAAC;AAEzB,MAAM,OAAO,WAAW;IAKZ;IACA;IALF,UAAU,GAAG,IAAI,GAAG,EAAoB,CAAC;IACzC,cAAc,GAAG,IAAI,GAAG,EAAoB,CAAC;IAErD,YACU,cAAsB,EACtB,kBAA0B;QAD1B,mBAAc,GAAd,cAAc,CAAQ;QACtB,uBAAkB,GAAlB,kBAAkB,CAAQ;IACjC,CAAC;IAEJ,8EAA8E;IAC9E,SAAS,CAAC,MAAc;QACtB,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,CAAC,cAAc,CAAC,CAAC;IACnE,CAAC;IAED,4EAA4E;IAC5E,aAAa,CAAC,QAAgB;QAC5B,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,OAAO,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAC7E,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC;IAC9B,CAAC;IAEO,MAAM,CAAC,GAA0B,EAAE,GAAW,EAAE,KAAa;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,CAAC,GAAG,SAAS,CAAC,CAAC;QAEzD,IAAI,KAAK,CAAC,MAAM,IAAI,KAAK,EAAE,CAAC;YAC1B,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACpB,OAAO,KAAK,CAAC;QACf,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACpB,OAAO,IAAI,CAAC;IACd,CAAC;CACF"}

package/dist/engine/gateway/rate-limiter.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Юнит-тесты RateLimiter (AD-036): in-memory sliding window 60s.
+ */
+export {};
+//# sourceMappingURL=rate-limiter.test.d.ts.map

package/dist/engine/gateway/rate-limiter.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rate-limiter.test.d.ts","sourceRoot":"","sources":["../../../src/engine/gateway/rate-limiter.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/engine/gateway/rate-limiter.test.js

@@ -0,0 +1,61 @@
+/**
+ * Юнит-тесты RateLimiter (AD-036): in-memory sliding window 60s.
+ */
+import { describe, it, expect, afterEach, vi } from 'vitest';
+import { RateLimiter } from './rate-limiter.js';
+afterEach(() => {
+    vi.restoreAllMocks();
+});
+describe('RateLimiter', () => {
+    it('userPerMinute=2: 2 вызова ок, 3-й false', () => {
+        const rl = new RateLimiter(2, 100);
+        expect(rl.checkUser('u1')).toBe(true);
+        expect(rl.checkUser('u1')).toBe(true);
+        expect(rl.checkUser('u1')).toBe(false);
+    });
+    it('providerPerMinute аналогично', () => {
+        const rl = new RateLimiter(100, 2);
+        expect(rl.checkProvider('p1')).toBe(true);
+        expect(rl.checkProvider('p1')).toBe(true);
+        expect(rl.checkProvider('p1')).toBe(false);
+    });
+    it('reset() сбрасывает счётчики', () => {
+        const rl = new RateLimiter(1, 1);
+        expect(rl.checkUser('u1')).toBe(true);
+        expect(rl.checkUser('u1')).toBe(false);
+        rl.reset();
+        expect(rl.checkUser('u1')).toBe(true);
+        expect(rl.checkProvider('p1')).toBe(true);
+        expect(rl.checkProvider('p1')).toBe(false);
+        rl.reset();
+        expect(rl.checkProvider('p1')).toBe(true);
+    });
+    it('разные userId не влияют друг на друга', () => {
+        const rl = new RateLimiter(1, 100);
+        expect(rl.checkUser('u1')).toBe(true);
+        expect(rl.checkUser('u2')).toBe(true); // u2 не затронут лимитом u1
+        expect(rl.checkUser('u1')).toBe(false);
+        expect(rl.checkUser('u2')).toBe(false); // лимит u2 тоже достигнут
+    });
+    it('пустой userId/provider → всегда true (без лимита)', () => {
+        const rl = new RateLimiter(1, 1);
+        expect(rl.checkUser('')).toBe(true);
+        expect(rl.checkUser('')).toBe(true);
+        expect(rl.checkProvider('')).toBe(true);
+    });
+    it('старые записи истекают после окна 60s', () => {
+        const nowSpy = vi.spyOn(Date, 'now').mockReturnValue(1_000_000);
+        const rl = new RateLimiter(1, 100);
+        expect(rl.checkUser('u1')).toBe(true); // запись при t=1_000_000
+        expect(rl.checkUser('u1')).toBe(false); // лимит 1 достигнут
+        // окно (60_000 мс) истекло → запись становится старой
+        nowSpy.mockReturnValue(1_000_000 + 60_001);
+        expect(rl.checkUser('u1')).toBe(true);
+    });
+    it('лимит 0/отрицательный — каждый вызов отклоняется (нет записей в окне)', () => {
+        const rl = new RateLimiter(0, 100);
+        expect(rl.checkUser('u1')).toBe(false);
+        expect(rl.checkUser('u1')).toBe(false);
+    });
+});
+//# sourceMappingURL=rate-limiter.test.js.map