@open-mercato/ai-assistant 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6785.1.1dd7cfac55

package/src/modules/ai_assistant/events.ts

@@ -61,6 +61,12 @@ const events = [
     category: 'lifecycle' as const,
     clientBroadcast: true,
   },
+  {
+    id: 'ai_assistant.moderation_flag.created',
+    label: 'AI Moderation Flag Created',
+    entity: 'ai_moderation_flag',
+    category: 'system' as const,
+  },
 ] as const
 
 export const eventsConfig = createModuleEvents({
@@ -148,4 +154,19 @@ export interface AiConversationUnsharedPayload {
   participantUserId: string
 }
 
+/**
+ * Emitted (best-effort) when the input moderation gate blocks a turn and the
+ * audit row is persisted. Carries category flags only — never prompt content.
+ *
+ * Spec `2026-06-04-ai-input-moderation-and-safety-identifiers`.
+ */
+export interface AiModerationFlagCreatedPayload {
+  id: string
+  tenantId: string
+  organizationId: string | null
+  agentId: string
+  userId: string
+  categories: string[]
+}
+
 export default eventsConfig

package/src/modules/ai_assistant/i18n/de.json

@@ -62,6 +62,18 @@
   "ai_assistant.agents.model_override.subtitle": "Überschreibe Standardanbieter und -modell für diesen Mandanten und Agenten.",
   "ai_assistant.agents.model_override.tenantOverride": "Mandanten-Überschreibung",
   "ai_assistant.agents.model_override.title": "Anbieter und Modell",
+  "ai_assistant.agents.moderation.controlLabel": "Moderation",
+  "ai_assistant.agents.moderation.effectiveEnforced": "Erzwungen",
+  "ai_assistant.agents.moderation.effectiveOff": "Aus",
+  "ai_assistant.agents.moderation.effectiveOn": "Ein",
+  "ai_assistant.agents.moderation.enforcedBadge": "Erzwungen",
+  "ai_assistant.agents.moderation.enforcedHint": "Dieser Agent akzeptiert nicht vertrauenswürdige Eingaben, daher ist die Moderation immer aktiv und kann hier nicht deaktiviert werden.",
+  "ai_assistant.agents.moderation.inheritLabel": "Erben",
+  "ai_assistant.agents.moderation.offLabel": "Aus",
+  "ai_assistant.agents.moderation.onLabel": "Ein",
+  "ai_assistant.agents.moderation.saved": "Eingabe-Moderationseinstellung gespeichert.",
+  "ai_assistant.agents.moderation.subtitle": "Benutzereingaben vor dem Modelllauf auf unsichere Inhalte prüfen. Gilt nur, wenn der aufgelöste Anbieter Moderation unterstützt.",
+  "ai_assistant.agents.moderation.title": "Eingabe-Moderation",
   "ai_assistant.agents.mutation_policy.clear": "Überschreibung löschen",
   "ai_assistant.agents.mutation_policy.clearedMessage": "Überschreibung der Mutationsrichtlinie gelöscht; Agent verwendet die im Code deklarierte Richtlinie.",
   "ai_assistant.agents.mutation_policy.codeDeclared": "Im Code deklariert",
@@ -297,6 +309,8 @@
   "ai_assistant.dock.left": "Links andocken",
   "ai_assistant.dock.minimize": "Minimieren",
   "ai_assistant.dock.right": "Rechts andocken",
+  "ai_assistant.errors.moderationBlocked": "Ihre Nachricht wurde vom Inhaltssicherheitsfilter blockiert. Bitte formulieren Sie sie um und versuchen Sie es erneut.",
+  "ai_assistant.errors.moderationUnavailable": "Die Inhaltssicherheitsprüfung ist vorübergehend nicht verfügbar. Bitte versuchen Sie es in einem Moment erneut.",
   "ai_assistant.launcher.composerPlaceholder": "Fragen Sie mich etwas…",
   "ai_assistant.launcher.dialogDescription": "Wähle einen Assistenten. Mit ↑/↓ navigieren, Enter startet, Esc schließt.",
   "ai_assistant.launcher.dialogTitle": "AI assistants",
@@ -342,6 +356,18 @@
   "ai_assistant.modelPicker.triggerAriaLabel": "KI-Modell auswählen",
   "ai_assistant.modelPicker.useDefault": "Standard des Agenten verwenden",
   "ai_assistant.modelPicker.useDefaultWithModel": "Standard des Agenten verwenden: {{model}}",
+  "ai_assistant.moderationFlags.columns.agent": "Agent",
+  "ai_assistant.moderationFlags.columns.categories": "Kategorien",
+  "ai_assistant.moderationFlags.columns.createdAt": "Markiert am",
+  "ai_assistant.moderationFlags.columns.user": "Benutzer",
+  "ai_assistant.moderationFlags.empty": "Keine markierten Nachrichten.",
+  "ai_assistant.moderationFlags.filters.agentPlaceholder": "modul.agent",
+  "ai_assistant.moderationFlags.filters.apply": "Anwenden",
+  "ai_assistant.moderationFlags.filters.from": "Von",
+  "ai_assistant.moderationFlags.filters.to": "Bis",
+  "ai_assistant.moderationFlags.navTitle": "Moderations-Flags",
+  "ai_assistant.moderationFlags.subtitle": "Vom Inhaltssicherheitsfilter blockierte Eingaben. Nur Kategorie-Flags und Scores — es wird kein Prompt-Inhalt gespeichert.",
+  "ai_assistant.moderationFlags.title": "Moderations-Flags",
   "ai_assistant.notifications.conversation_shared.body": "Eine KI-Konversation wurde mit Ihnen geteilt.",
   "ai_assistant.notifications.conversation_shared.title": "Konversation mit Ihnen geteilt",
   "ai_assistant.notifications.conversation_shared.view_button": "Konversation öffnen",

package/src/modules/ai_assistant/i18n/en.json

@@ -62,6 +62,18 @@
   "ai_assistant.agents.model_override.subtitle": "Override the default provider and model for this tenant and agent.",
   "ai_assistant.agents.model_override.tenantOverride": "Tenant override",
   "ai_assistant.agents.model_override.title": "Provider and model",
+  "ai_assistant.agents.moderation.controlLabel": "Moderation",
+  "ai_assistant.agents.moderation.effectiveEnforced": "Enforced",
+  "ai_assistant.agents.moderation.effectiveOff": "Off",
+  "ai_assistant.agents.moderation.effectiveOn": "On",
+  "ai_assistant.agents.moderation.enforcedBadge": "Enforced",
+  "ai_assistant.agents.moderation.enforcedHint": "This agent accepts untrusted input, so moderation is always on and cannot be disabled here.",
+  "ai_assistant.agents.moderation.inheritLabel": "Inherit",
+  "ai_assistant.agents.moderation.offLabel": "Off",
+  "ai_assistant.agents.moderation.onLabel": "On",
+  "ai_assistant.agents.moderation.saved": "Input moderation setting saved.",
+  "ai_assistant.agents.moderation.subtitle": "Screen user input for unsafe content before the model runs. Applies only when the resolved provider supports moderation.",
+  "ai_assistant.agents.moderation.title": "Input moderation",
   "ai_assistant.agents.mutation_policy.clear": "Clear override",
   "ai_assistant.agents.mutation_policy.clearedMessage": "Mutation policy override cleared; agent is using its code-declared policy.",
   "ai_assistant.agents.mutation_policy.codeDeclared": "Code-declared",
@@ -297,6 +309,8 @@
   "ai_assistant.dock.left": "Dock Left",
   "ai_assistant.dock.minimize": "Minimize",
   "ai_assistant.dock.right": "Dock Right",
+  "ai_assistant.errors.moderationBlocked": "Your message was blocked by the content safety filter. Please rephrase and try again.",
+  "ai_assistant.errors.moderationUnavailable": "The content safety check is temporarily unavailable. Please try again in a moment.",
   "ai_assistant.launcher.composerPlaceholder": "Ask anything…",
   "ai_assistant.launcher.dialogDescription": "Pick an assistant. Use ↑/↓ to navigate, Enter to launch, Esc to close.",
   "ai_assistant.launcher.dialogTitle": "AI assistants",
@@ -342,6 +356,18 @@
   "ai_assistant.modelPicker.triggerAriaLabel": "Select AI model",
   "ai_assistant.modelPicker.useDefault": "Use agent default",
   "ai_assistant.modelPicker.useDefaultWithModel": "Use agent default: {{model}}",
+  "ai_assistant.moderationFlags.columns.agent": "Agent",
+  "ai_assistant.moderationFlags.columns.categories": "Categories",
+  "ai_assistant.moderationFlags.columns.createdAt": "Flagged at",
+  "ai_assistant.moderationFlags.columns.user": "User",
+  "ai_assistant.moderationFlags.empty": "No flagged messages.",
+  "ai_assistant.moderationFlags.filters.agentPlaceholder": "module.agent",
+  "ai_assistant.moderationFlags.filters.apply": "Apply",
+  "ai_assistant.moderationFlags.filters.from": "From",
+  "ai_assistant.moderationFlags.filters.to": "To",
+  "ai_assistant.moderationFlags.navTitle": "Moderation flags",
+  "ai_assistant.moderationFlags.subtitle": "Inputs blocked by the content safety filter. Category flags and scores only — no prompt content is stored.",
+  "ai_assistant.moderationFlags.title": "Moderation flags",
   "ai_assistant.notifications.conversation_shared.body": "An AI conversation has been shared with you.",
   "ai_assistant.notifications.conversation_shared.title": "Conversation shared with you",
   "ai_assistant.notifications.conversation_shared.view_button": "View Conversation",

package/src/modules/ai_assistant/i18n/es.json

@@ -62,6 +62,18 @@
   "ai_assistant.agents.model_override.subtitle": "Anula el proveedor y el modelo predeterminados para este inquilino y agente.",
   "ai_assistant.agents.model_override.tenantOverride": "Sobrescritura del tenant",
   "ai_assistant.agents.model_override.title": "Proveedor y modelo",
+  "ai_assistant.agents.moderation.controlLabel": "Moderación",
+  "ai_assistant.agents.moderation.effectiveEnforced": "Forzada",
+  "ai_assistant.agents.moderation.effectiveOff": "Desactivada",
+  "ai_assistant.agents.moderation.effectiveOn": "Activada",
+  "ai_assistant.agents.moderation.enforcedBadge": "Forzada",
+  "ai_assistant.agents.moderation.enforcedHint": "Este agente acepta entradas no confiables, por lo que la moderación siempre está activada y no se puede desactivar aquí.",
+  "ai_assistant.agents.moderation.inheritLabel": "Heredar",
+  "ai_assistant.agents.moderation.offLabel": "Desactivada",
+  "ai_assistant.agents.moderation.onLabel": "Activada",
+  "ai_assistant.agents.moderation.saved": "Ajuste de moderación de entrada guardado.",
+  "ai_assistant.agents.moderation.subtitle": "Filtra la entrada del usuario en busca de contenido no seguro antes de ejecutar el modelo. Solo aplica cuando el proveedor resuelto admite moderación.",
+  "ai_assistant.agents.moderation.title": "Moderación de entrada",
   "ai_assistant.agents.mutation_policy.clear": "Eliminar sobrescritura",
   "ai_assistant.agents.mutation_policy.clearedMessage": "Sobrescritura de política de mutación eliminada; el agente usa la política declarada en el código.",
   "ai_assistant.agents.mutation_policy.codeDeclared": "Declarada en el código",
@@ -297,6 +309,8 @@
   "ai_assistant.dock.left": "Anclar a la izquierda",
   "ai_assistant.dock.minimize": "Minimizar",
   "ai_assistant.dock.right": "Anclar a la derecha",
+  "ai_assistant.errors.moderationBlocked": "Tu mensaje fue bloqueado por el filtro de seguridad de contenido. Reformúlalo e inténtalo de nuevo.",
+  "ai_assistant.errors.moderationUnavailable": "La verificación de seguridad de contenido no está disponible temporalmente. Inténtalo de nuevo en un momento.",
   "ai_assistant.launcher.composerPlaceholder": "Pregunte lo que necesite…",
   "ai_assistant.launcher.dialogDescription": "Elige un asistente. Usa ↑/↓ para navegar, Enter para iniciar, Esc para cerrar.",
   "ai_assistant.launcher.dialogTitle": "AI assistants",
@@ -342,6 +356,18 @@
   "ai_assistant.modelPicker.triggerAriaLabel": "Selector de modelo de IA",
   "ai_assistant.modelPicker.useDefault": "Usar predeterminado",
   "ai_assistant.modelPicker.useDefaultWithModel": "Usar predeterminado del agente: {{model}}",
+  "ai_assistant.moderationFlags.columns.agent": "Agente",
+  "ai_assistant.moderationFlags.columns.categories": "Categorías",
+  "ai_assistant.moderationFlags.columns.createdAt": "Marcado el",
+  "ai_assistant.moderationFlags.columns.user": "Usuario",
+  "ai_assistant.moderationFlags.empty": "No hay mensajes marcados.",
+  "ai_assistant.moderationFlags.filters.agentPlaceholder": "modulo.agente",
+  "ai_assistant.moderationFlags.filters.apply": "Aplicar",
+  "ai_assistant.moderationFlags.filters.from": "Desde",
+  "ai_assistant.moderationFlags.filters.to": "Hasta",
+  "ai_assistant.moderationFlags.navTitle": "Marcas de moderación",
+  "ai_assistant.moderationFlags.subtitle": "Entradas bloqueadas por el filtro de seguridad de contenido. Solo indicadores de categoría y puntuaciones — no se almacena el contenido del prompt.",
+  "ai_assistant.moderationFlags.title": "Marcas de moderación",
   "ai_assistant.notifications.conversation_shared.body": "Se ha compartido una conversación de IA con usted.",
   "ai_assistant.notifications.conversation_shared.title": "Conversación compartida con usted",
   "ai_assistant.notifications.conversation_shared.view_button": "Ver conversación",

package/src/modules/ai_assistant/i18n/pl.json

@@ -62,6 +62,18 @@
   "ai_assistant.agents.model_override.subtitle": "Nadpisz domyślnego dostawcę i model dla tego najemcy i agenta.",
   "ai_assistant.agents.model_override.tenantOverride": "Nadpisanie tenant",
   "ai_assistant.agents.model_override.title": "Dostawca i model",
+  "ai_assistant.agents.moderation.controlLabel": "Moderacja",
+  "ai_assistant.agents.moderation.effectiveEnforced": "Wymuszona",
+  "ai_assistant.agents.moderation.effectiveOff": "Wyłączona",
+  "ai_assistant.agents.moderation.effectiveOn": "Włączona",
+  "ai_assistant.agents.moderation.enforcedBadge": "Wymuszona",
+  "ai_assistant.agents.moderation.enforcedHint": "Ten agent przyjmuje niezaufane dane wejściowe, więc moderacja jest zawsze włączona i nie można jej tutaj wyłączyć.",
+  "ai_assistant.agents.moderation.inheritLabel": "Dziedzicz",
+  "ai_assistant.agents.moderation.offLabel": "Wyłączona",
+  "ai_assistant.agents.moderation.onLabel": "Włączona",
+  "ai_assistant.agents.moderation.saved": "Zapisano ustawienie moderacji danych wejściowych.",
+  "ai_assistant.agents.moderation.subtitle": "Filtruj dane wejściowe użytkownika pod kątem niebezpiecznych treści przed uruchomieniem modelu. Działa tylko, gdy wybrany dostawca obsługuje moderację.",
+  "ai_assistant.agents.moderation.title": "Moderacja danych wejściowych",
   "ai_assistant.agents.mutation_policy.clear": "Wyczyść nadpisanie",
   "ai_assistant.agents.mutation_policy.clearedMessage": "Nadpisanie polityki mutacji usunięte; agent korzysta z polityki zadeklarowanej w kodzie.",
   "ai_assistant.agents.mutation_policy.codeDeclared": "Zadeklarowane w kodzie",
@@ -297,6 +309,8 @@
   "ai_assistant.dock.left": "Dokuj po lewej",
   "ai_assistant.dock.minimize": "Minimalizuj",
   "ai_assistant.dock.right": "Dokuj po prawej",
+  "ai_assistant.errors.moderationBlocked": "Twoja wiadomość została zablokowana przez filtr bezpieczeństwa treści. Przeformułuj ją i spróbuj ponownie.",
+  "ai_assistant.errors.moderationUnavailable": "Sprawdzanie bezpieczeństwa treści jest chwilowo niedostępne. Spróbuj ponownie za chwilę.",
   "ai_assistant.launcher.composerPlaceholder": "Zapytaj o cokolwiek…",
   "ai_assistant.launcher.dialogDescription": "Wybierz asystenta. Nawiguj klawiszami ↑/↓, Enter uruchamia, Esc zamyka.",
   "ai_assistant.launcher.dialogTitle": "Asystenci AI",
@@ -342,6 +356,18 @@
   "ai_assistant.modelPicker.triggerAriaLabel": "Wybierz model AI",
   "ai_assistant.modelPicker.useDefault": "Użyj domyślnego agenta",
   "ai_assistant.modelPicker.useDefaultWithModel": "Użyj domyślnego agenta: {{model}}",
+  "ai_assistant.moderationFlags.columns.agent": "Agent",
+  "ai_assistant.moderationFlags.columns.categories": "Kategorie",
+  "ai_assistant.moderationFlags.columns.createdAt": "Oznaczono",
+  "ai_assistant.moderationFlags.columns.user": "Użytkownik",
+  "ai_assistant.moderationFlags.empty": "Brak oznaczonych wiadomości.",
+  "ai_assistant.moderationFlags.filters.agentPlaceholder": "moduł.agent",
+  "ai_assistant.moderationFlags.filters.apply": "Zastosuj",
+  "ai_assistant.moderationFlags.filters.from": "Od",
+  "ai_assistant.moderationFlags.filters.to": "Do",
+  "ai_assistant.moderationFlags.navTitle": "Flagi moderacji",
+  "ai_assistant.moderationFlags.subtitle": "Dane wejściowe zablokowane przez filtr bezpieczeństwa treści. Tylko flagi kategorii i wyniki — treść promptu nie jest przechowywana.",
+  "ai_assistant.moderationFlags.title": "Flagi moderacji",
   "ai_assistant.notifications.conversation_shared.body": "Udostępniono Ci konwersację z asystentem AI.",
   "ai_assistant.notifications.conversation_shared.title": "Udostępniono Ci konwersację",
   "ai_assistant.notifications.conversation_shared.view_button": "Otwórz konwersację",

package/src/modules/ai_assistant/lib/__tests__/auth.test.ts

@@ -137,7 +137,7 @@ describe('hasRequiredFeatures', () => {
     ).toBe(true)
   })
 
-  it('delegates to rbacService when provided', () => {
+  it('uses the shared policy even when a legacy rbacService argument is provided', () => {
     const rbacService = {
       hasAllFeatures: jest.fn().mockReturnValue(true),
     }
@@ -148,9 +148,6 @@ describe('hasRequiredFeatures', () => {
       rbacService as any
     )
     expect(result).toBe(true)
-    expect(rbacService.hasAllFeatures).toHaveBeenCalledWith(
-      ['customers.view'],
-      ['customers.view']
-    )
+    expect(rbacService.hasAllFeatures).not.toHaveBeenCalled()
   })
 })

package/src/modules/ai_assistant/lib/__tests__/input-moderation-gate.test.ts

@@ -0,0 +1,121 @@
+import { extractLatestUserText, runInputModerationGate } from '../agent-runtime'
+import {
+  AiModerationBlockedError,
+  AiModerationUnavailableError,
+  type ModerationResult,
+  type ModerationService,
+} from '../moderation'
+
+function serviceReturning(result: ModerationResult): ModerationService {
+  return { checkInput: jest.fn(async () => result) }
+}
+function serviceThrowing(error: unknown): ModerationService {
+  return { checkInput: jest.fn(async () => { throw error }) }
+}
+
+const CLEAN: ModerationResult = { flagged: false, categories: { hate: { flagged: false, score: 0.01 } } }
+const FLAGGED: ModerationResult = { flagged: true, categories: { hate: { flagged: true, score: 0.98 } } }
+
+const base = {
+  supportsInputModeration: true,
+  userText: 'hello there',
+  resolveApiKey: () => 'sk-test' as string | null,
+  env: {} as Record<string, string | undefined>,
+}
+
+describe('extractLatestUserText', () => {
+  it('returns the text parts of the most recent user message', () => {
+    const messages = [
+      { role: 'user', parts: [{ type: 'text', text: 'first' }] },
+      { role: 'assistant', parts: [{ type: 'text', text: 'reply' }] },
+      { role: 'user', parts: [{ type: 'text', text: 'second' }, { type: 'text', text: 'line' }] },
+    ] as never
+    expect(extractLatestUserText(messages)).toBe('second\nline')
+  })
+
+  it('falls back to string content and returns empty when no user message', () => {
+    expect(extractLatestUserText([{ role: 'user', content: 'plain' }] as never)).toBe('plain')
+    expect(extractLatestUserText([{ role: 'assistant', parts: [{ type: 'text', text: 'x' }] }] as never)).toBe('')
+  })
+})
+
+describe('runInputModerationGate', () => {
+  it('skips entirely when policy resolves to off (no untrusted, no override, no env)', async () => {
+    const service = serviceReturning(FLAGGED)
+    await expect(runInputModerationGate({ ...base, service })).resolves.toBeUndefined()
+    expect(service.checkInput).not.toHaveBeenCalled()
+  })
+
+  it('skips when the provider does not support moderation, even on an enforced surface', async () => {
+    const service = serviceReturning(FLAGGED)
+    await expect(
+      runInputModerationGate({ ...base, untrustedInput: true, supportsInputModeration: false, service }),
+    ).resolves.toBeUndefined()
+    expect(service.checkInput).not.toHaveBeenCalled()
+  })
+
+  it('skips when the user text is empty', async () => {
+    const service = serviceReturning(FLAGGED)
+    await expect(
+      runInputModerationGate({ ...base, untrustedInput: true, userText: '   ', service }),
+    ).resolves.toBeUndefined()
+    expect(service.checkInput).not.toHaveBeenCalled()
+  })
+
+  it('passes clean input through on an enabled surface', async () => {
+    const service = serviceReturning(CLEAN)
+    await expect(
+      runInputModerationGate({ ...base, perAgentOverride: true, service }),
+    ).resolves.toBeUndefined()
+    expect(service.checkInput).toHaveBeenCalledTimes(1)
+  })
+
+  it('throws AiModerationBlockedError (with categories) on flagged input', async () => {
+    const service = serviceReturning(FLAGGED)
+    const error = await runInputModerationGate({ ...base, untrustedInput: true, service }).catch((e) => e)
+    expect(error).toBeInstanceOf(AiModerationBlockedError)
+    expect((error as AiModerationBlockedError).categories.hate.flagged).toBe(true)
+  })
+
+  it('runs the onFlagged side effect before throwing, and the throw still applies if it fails', async () => {
+    const service = serviceReturning(FLAGGED)
+    const onFlagged = jest.fn(async () => { throw new Error('db down') })
+    const error = await runInputModerationGate({ ...base, untrustedInput: true, service, onFlagged }).catch((e) => e)
+    expect(onFlagged).toHaveBeenCalledWith(FLAGGED.categories)
+    expect(error).toBeInstanceOf(AiModerationBlockedError)
+  })
+
+  it('fails CLOSED on an enforced surface when the endpoint is unavailable', async () => {
+    const service = serviceThrowing(new AiModerationUnavailableError('endpoint down'))
+    await expect(
+      runInputModerationGate({ ...base, untrustedInput: true, service }),
+    ).rejects.toBeInstanceOf(AiModerationUnavailableError)
+  })
+
+  it('fails OPEN on an opt-in (on) surface when the endpoint is unavailable', async () => {
+    const service = serviceThrowing(new AiModerationUnavailableError('endpoint down'))
+    await expect(
+      runInputModerationGate({ ...base, perAgentOverride: true, service }),
+    ).resolves.toBeUndefined()
+  })
+
+  it('fails CLOSED on enforced when the service is missing from the container', async () => {
+    await expect(
+      runInputModerationGate({ ...base, untrustedInput: true, service: null }),
+    ).rejects.toBeInstanceOf(AiModerationUnavailableError)
+  })
+
+  it('fails OPEN on opt-in when the API key is missing', async () => {
+    const service = serviceReturning(CLEAN)
+    await expect(
+      runInputModerationGate({ ...base, perAgentOverride: true, resolveApiKey: () => null, service }),
+    ).resolves.toBeUndefined()
+    expect(service.checkInput).not.toHaveBeenCalled()
+  })
+
+  it('does not resolve the API key on the common skip path (policy off)', async () => {
+    const resolveApiKey = jest.fn(() => 'sk-test' as string | null)
+    await expect(runInputModerationGate({ ...base, resolveApiKey, service: serviceReturning(CLEAN) })).resolves.toBeUndefined()
+    expect(resolveApiKey).not.toHaveBeenCalled()
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/llm-adapters-anthropic.test.ts

@@ -87,4 +87,17 @@ describe('AnthropicAdapter', () => {
     })
     expect(model).toBeDefined()
   })
+
+  it('maps an end-user identifier into the Anthropic metadata.userId providerOptions fragment', () => {
+    // Key MUST be the AI SDK provider-option name `userId` (camelCase); the SDK
+    // translates it to the `metadata.user_id` request-body field and strips
+    // unknown providerOptions keys, so a snake_case key would be dropped.
+    expect(adapter.mapEndUserIdentifier?.('hashed-id')).toEqual({
+      anthropic: { metadata: { userId: 'hashed-id' } },
+    })
+  })
+
+  it('does not advertise input moderation support (Anthropic has no moderation endpoint)', () => {
+    expect(adapter.supportsInputModeration).toBeFalsy()
+  })
 })

package/src/modules/ai_assistant/lib/__tests__/llm-adapters-openai.test.ts

@@ -330,3 +330,44 @@ describe('LM Studio preset', () => {
     expect(model).toBeDefined()
   })
 })
+
+describe('OpenAIAdapter — safety identifier + moderation capability', () => {
+  it('maps an end-user identifier into the OpenAI safetyIdentifier providerOptions fragment', () => {
+    // Key MUST be the AI SDK provider-option name `safetyIdentifier` (camelCase);
+    // the SDK translates it to the `safety_identifier` request-body field and
+    // strips unknown providerOptions keys, so a snake_case key would be dropped.
+    const openaiPreset = OPENAI_COMPATIBLE_PRESETS.find((preset) => preset.id === 'openai')!
+    const provider = createOpenAICompatibleProvider(openaiPreset)
+    expect(provider.mapEndUserIdentifier?.('hashed-id')).toEqual({
+      openai: { safetyIdentifier: 'hashed-id' },
+    })
+  })
+
+  it('does not map a safety identifier for OpenAI-compatible backends (OpenAI-only param)', () => {
+    // `safety_identifier` is an OpenAI-specific body field; compatible/self-hosted
+    // backends (Groq, DeepInfra, Azure, Ollama, …) may reject the unknown param,
+    // so they must not advertise the mapping.
+    const provider = createOpenAICompatibleProvider(DEEPINFRA_PRESET)
+    expect(provider.mapEndUserIdentifier).toBeUndefined()
+    for (const preset of OPENAI_COMPATIBLE_PRESETS) {
+      const built = createOpenAICompatibleProvider(preset)
+      if (preset.id === 'openai') {
+        expect(built.mapEndUserIdentifier).toBeDefined()
+      } else {
+        expect(built.mapEndUserIdentifier).toBeUndefined()
+      }
+    }
+  })
+
+  it('marks the native OpenAI preset as supporting input moderation', () => {
+    const openaiPreset = OPENAI_COMPATIBLE_PRESETS.find((preset) => preset.id === 'openai')
+    expect(openaiPreset).toBeDefined()
+    const provider = createOpenAICompatibleProvider(openaiPreset!)
+    expect(provider.supportsInputModeration).toBe(true)
+  })
+
+  it('leaves OpenAI-compatible backends without moderation support', () => {
+    const provider = createOpenAICompatibleProvider(DEEPINFRA_PRESET)
+    expect(provider.supportsInputModeration).toBe(false)
+  })
+})

package/src/modules/ai_assistant/lib/__tests__/model-factory.test.ts

@@ -1216,6 +1216,66 @@ describe('Phase 4a — tenantOverride, requestOverride, allowRuntimeOverride (re
   })
 })
 
+describe('createModelFactory — end-user safety identifier + moderation capability', () => {
+  // The shared makeProvider helper lists fields explicitly and does not carry
+  // the optional mapEndUserIdentifier / supportsInputModeration members, so we
+  // build providers inline here.
+  type IdentifierProvider = FakeProvider & {
+    mapEndUserIdentifier?: (identifier: string) => Record<string, unknown>
+    supportsInputModeration?: boolean
+  }
+  function makeIdentifierProvider(overrides: Partial<IdentifierProvider> = {}): IdentifierProvider {
+    return {
+      id: 'test-provider',
+      defaultModel: 'provider-default-model',
+      resolveApiKey: () => 'test-api-key',
+      createModel: (options) => ({ kind: 'fake-model', ...options }),
+      isConfigured: () => true,
+      ...overrides,
+    }
+  }
+
+  it('emits the provider-mapped providerOptions fragment when an identifier is supplied', () => {
+    const mapEndUserIdentifier = jest.fn((id: string) => ({ openai: { safetyIdentifier: id } }))
+    const provider = makeIdentifierProvider({ mapEndUserIdentifier, supportsInputModeration: true })
+    const factory = createModelFactory(fakeContainer, makeFactoryDeps(provider))
+    const resolution = factory.resolveModel({ endUserIdentifier: 'hashed-user' })
+    expect(mapEndUserIdentifier).toHaveBeenCalledWith('hashed-user')
+    expect(resolution.providerOptions).toEqual({ openai: { safetyIdentifier: 'hashed-user' } })
+    expect(resolution.supportsInputModeration).toBe(true)
+  })
+
+  it('forwards the identifier to the adapter createModel options', () => {
+    const createModel = jest.fn((options: { modelId: string; apiKey: string }) => ({ ...options }))
+    const provider = makeIdentifierProvider({
+      createModel,
+      mapEndUserIdentifier: (id: string) => ({ openai: { safetyIdentifier: id } }),
+    })
+    const factory = createModelFactory(fakeContainer, makeFactoryDeps(provider))
+    factory.resolveModel({ endUserIdentifier: 'hashed-user' })
+    expect(createModel).toHaveBeenCalledWith(
+      expect.objectContaining({ endUserIdentifier: 'hashed-user' }),
+    )
+  })
+
+  it('omits providerOptions when no identifier is supplied', () => {
+    const mapEndUserIdentifier = jest.fn((id: string) => ({ openai: { safety_identifier: id } }))
+    const provider = makeIdentifierProvider({ mapEndUserIdentifier })
+    const factory = createModelFactory(fakeContainer, makeFactoryDeps(provider))
+    const resolution = factory.resolveModel({})
+    expect(mapEndUserIdentifier).not.toHaveBeenCalled()
+    expect(resolution.providerOptions).toBeUndefined()
+  })
+
+  it('omits providerOptions when the provider has no mapping, and reports moderation unsupported', () => {
+    const provider = makeIdentifierProvider()
+    const factory = createModelFactory(fakeContainer, makeFactoryDeps(provider))
+    const resolution = factory.resolveModel({ endUserIdentifier: 'hashed-user' })
+    expect(resolution.providerOptions).toBeUndefined()
+    expect(resolution.supportsInputModeration).toBe(false)
+  })
+})
+
 describe('createModelFactory — vendor-prefix gateways', () => {
   function gatewayProviders(
     overrides: { openrouterConfigured?: boolean } = {},

package/src/modules/ai_assistant/lib/__tests__/moderation-flag-recorder.test.ts

@@ -0,0 +1,76 @@
+import type { AwilixContainer } from 'awilix'
+
+const createMock = jest.fn()
+const emitMock = jest.fn()
+
+jest.mock('../../events', () => ({
+  emitAiAssistantEvent: (...args: unknown[]) => emitMock(...args),
+}))
+jest.mock('../../data/repositories/AiModerationFlagRepository', () => ({
+  AiModerationFlagRepository: jest.fn().mockImplementation(() => ({ create: createMock })),
+}))
+
+import { recordModerationFlag } from '../moderation-flag-recorder'
+
+function fakeContainer(): AwilixContainer {
+  return {
+    resolve: () => ({ fork: () => ({}) }),
+  } as unknown as AwilixContainer
+}
+
+const baseInput = {
+  tenantId: 'tenant-1',
+  organizationId: 'org-1',
+  agentId: 'customers.account_assistant',
+  userId: 'user-1',
+  providerId: 'openai',
+  modelId: 'gpt-5-mini',
+  categories: {
+    hate: { flagged: true, score: 0.97 },
+    violence: { flagged: false, score: 0.01 },
+  },
+}
+
+describe('recordModerationFlag', () => {
+  beforeEach(() => {
+    createMock.mockReset()
+    emitMock.mockReset()
+    createMock.mockResolvedValue({ id: 'flag-1' })
+    emitMock.mockResolvedValue(undefined)
+  })
+
+  it('persists the audit row and emits the event with only flagged categories', async () => {
+    await recordModerationFlag(baseInput, fakeContainer())
+    expect(createMock).toHaveBeenCalledWith(
+      expect.objectContaining({ tenantId: 'tenant-1', agentId: 'customers.account_assistant', providerId: 'openai' }),
+    )
+    expect(emitMock).toHaveBeenCalledWith(
+      'ai_assistant.moderation_flag.created',
+      expect.objectContaining({ id: 'flag-1', tenantId: 'tenant-1', categories: ['hate'] }),
+    )
+  })
+
+  it('skips entirely when tenantId is null (cannot tenant-scope the audit row)', async () => {
+    await recordModerationFlag({ ...baseInput, tenantId: null }, fakeContainer())
+    expect(createMock).not.toHaveBeenCalled()
+    expect(emitMock).not.toHaveBeenCalled()
+  })
+
+  it('skips when no container is available', async () => {
+    await recordModerationFlag(baseInput, undefined)
+    expect(createMock).not.toHaveBeenCalled()
+    expect(emitMock).not.toHaveBeenCalled()
+  })
+
+  it('swallows a persistence failure (never throws) and does not emit', async () => {
+    createMock.mockRejectedValue(new Error('db down'))
+    await expect(recordModerationFlag(baseInput, fakeContainer())).resolves.toBeUndefined()
+    expect(emitMock).not.toHaveBeenCalled()
+  })
+
+  it('swallows an emit failure after a successful persist (never throws)', async () => {
+    emitMock.mockRejectedValue(new Error('bus down'))
+    await expect(recordModerationFlag(baseInput, fakeContainer())).resolves.toBeUndefined()
+    expect(createMock).toHaveBeenCalledTimes(1)
+  })
+})