@open-mercato/shared 0.6.7-develop.6784.1.f80b9afce5 → 0.6.7-develop.6785.1.1dd7cfac55

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 250 entry points
+[build:shared] found 251 entry points
 [build:shared] built successfully

package/dist/lib/ai/safety-identifier.js

@@ -0,0 +1,32 @@
+import crypto from "node:crypto";
+const SAFETY_IDENTIFIER_SECRET_LABEL = "open-mercato:ai-safety-identifier:v1";
+const derivedSecretCache = /* @__PURE__ */ new Map();
+function readBaseSecret(explicit) {
+  const secret = explicit ?? process.env.JWT_SECRET;
+  if (!secret) {
+    throw new Error("[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret");
+  }
+  return secret;
+}
+function deriveAiSafetyIdentifierSecret(baseSecret) {
+  const base = readBaseSecret(baseSecret);
+  const cached = derivedSecretCache.get(base);
+  if (cached !== void 0) return cached;
+  const derived = crypto.createHmac("sha256", base).update(SAFETY_IDENTIFIER_SECRET_LABEL).digest("hex");
+  derivedSecretCache.set(base, derived);
+  return derived;
+}
+function computeEndUserIdentifier(tenantId, userId, options) {
+  const normalizedUser = (userId ?? "").trim();
+  if (!normalizedUser) {
+    throw new Error("[internal] computeEndUserIdentifier requires a non-empty userId");
+  }
+  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret);
+  const salt = (tenantId ?? "").trim();
+  return crypto.createHmac("sha256", key).update(`${salt}:${normalizedUser}`).digest("hex");
+}
+export {
+  computeEndUserIdentifier,
+  deriveAiSafetyIdentifierSecret
+};
+//# sourceMappingURL=safety-identifier.js.map

package/dist/lib/ai/safety-identifier.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/ai/safety-identifier.ts"],
+  "sourcesContent": ["/**\n * End-user safety identifiers for AI provider calls.\n *\n * Providers such as OpenAI let developers attach an opaque per-end-user\n * identifier to each request so abuse enforcement can target one user instead\n * of suspending the whole API-key organization. We never send a reversible id:\n * the value is a tenant-salted HMAC computed from the platform's existing auth\n * secret, so no PII or internal id leaves the platform and the same end user in\n * two tenants produces two unrelated hashes.\n *\n * The per-process secret derivation mirrors `deriveJwtAudienceSecret`\n * (`@open-mercato/shared/lib/auth/jwt`): one HMAC from the base `JWT_SECRET`\n * under a versioned purpose label, memoized for the process lifetime. No new\n * secret to provision.\n *\n * @see .ai/specs/2026-06-04-ai-input-moderation-and-safety-identifiers.md\n */\n\nimport crypto from 'node:crypto'\n\nconst SAFETY_IDENTIFIER_SECRET_LABEL = 'open-mercato:ai-safety-identifier:v1'\n\nconst derivedSecretCache = new Map<string, string>()\n\nfunction readBaseSecret(explicit?: string): string {\n  const secret = explicit ?? process.env.JWT_SECRET\n  if (!secret) {\n    throw new Error('[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret')\n  }\n  return secret\n}\n\n/**\n * Derive the per-process safety-identifier HMAC key from the base auth secret.\n *\n * Deterministic HMAC-SHA256 of a versioned purpose label keyed by the base\n * secret, memoized per base secret. Rotating the base secret rotates every\n * derived identifier \u2014 documented as accepted (identifiers are advisory\n * provider-side metadata, not an in-platform security control).\n */\nexport function deriveAiSafetyIdentifierSecret(baseSecret?: string): string {\n  const base = readBaseSecret(baseSecret)\n  const cached = derivedSecretCache.get(base)\n  if (cached !== undefined) return cached\n  const derived = crypto\n    .createHmac('sha256', base)\n    .update(SAFETY_IDENTIFIER_SECRET_LABEL)\n    .digest('hex')\n  derivedSecretCache.set(base, derived)\n  return derived\n}\n\n/**\n * Compute the opaque end-user safety identifier for a (tenant, user) pair.\n *\n * Returns a 64-char lowercase hex HMAC-SHA256 of `${tenantId}:${userId}` keyed\n * by the derived secret. Throws (with an `[internal]` message) when the base\n * secret is missing or `userId` is empty \u2014 callers in the runtime wrap this in\n * a best-effort try/catch so identifier-derivation failures never break chat.\n */\nexport function computeEndUserIdentifier(\n  tenantId: string | null | undefined,\n  userId: string,\n  options?: { baseSecret?: string },\n): string {\n  const normalizedUser = (userId ?? '').trim()\n  if (!normalizedUser) {\n    throw new Error('[internal] computeEndUserIdentifier requires a non-empty userId')\n  }\n  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret)\n  const salt = (tenantId ?? '').trim()\n  return crypto.createHmac('sha256', key).update(`${salt}:${normalizedUser}`).digest('hex')\n}\n"],
+  "mappings": "AAkBA,OAAO,YAAY;AAEnB,MAAM,iCAAiC;AAEvC,MAAM,qBAAqB,oBAAI,IAAoB;AAEnD,SAAS,eAAe,UAA2B;AACjD,QAAM,SAAS,YAAY,QAAQ,IAAI;AACvC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,6EAA6E;AAAA,EAC/F;AACA,SAAO;AACT;AAUO,SAAS,+BAA+B,YAA6B;AAC1E,QAAM,OAAO,eAAe,UAAU;AACtC,QAAM,SAAS,mBAAmB,IAAI,IAAI;AAC1C,MAAI,WAAW,OAAW,QAAO;AACjC,QAAM,UAAU,OACb,WAAW,UAAU,IAAI,EACzB,OAAO,8BAA8B,EACrC,OAAO,KAAK;AACf,qBAAmB,IAAI,MAAM,OAAO;AACpC,SAAO;AACT;AAUO,SAAS,yBACd,UACA,QACA,SACQ;AACR,QAAM,kBAAkB,UAAU,IAAI,KAAK;AAC3C,MAAI,CAAC,gBAAgB;AACnB,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,QAAM,MAAM,+BAA+B,SAAS,UAAU;AAC9D,QAAM,QAAQ,YAAY,IAAI,KAAK;AACnC,SAAO,OAAO,WAAW,UAAU,GAAG,EAAE,OAAO,GAAG,IAAI,IAAI,cAAc,EAAE,EAAE,OAAO,KAAK;AAC1F;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.7-develop.6784.1.f80b9afce5";
+const APP_VERSION = "0.6.7-develop.6785.1.1dd7cfac55";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6784.1.f80b9afce5'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6785.1.1dd7cfac55'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7-develop.6784.1.f80b9afce5",
+  "version": "0.6.7-develop.6785.1.1dd7cfac55",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -105,7 +105,7 @@
     "@mikro-orm/core": "^7.1.5",
     "@mikro-orm/decorators": "^7.1.5",
     "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7-develop.6784.1.f80b9afce5",
+    "@open-mercato/cache": "0.6.7-develop.6785.1.1dd7cfac55",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",

package/src/lib/ai/__tests__/llm-provider-contract.test.ts

@@ -0,0 +1,59 @@
+import type { EnvLookup, LlmProvider, LlmCreateModelOptions } from '../llm-provider'
+
+function makeBaseProvider(overrides: Partial<LlmProvider> = {}): LlmProvider {
+  const id = overrides.id ?? 'contract-provider'
+  const envKeys = overrides.envKeys ?? [`${id.toUpperCase()}_API_KEY`]
+  const base: LlmProvider = {
+    id,
+    name: `Contract Provider ${id}`,
+    envKeys,
+    defaultModel: 'contract-model',
+    defaultModels: [{ id: 'contract-model', name: 'Contract Model', contextWindow: 8192 }],
+    isConfigured(env?: EnvLookup): boolean {
+      const lookup = env ?? process.env
+      return envKeys.some((key) => {
+        const value = lookup[key]
+        return typeof value === 'string' && value.trim().length > 0
+      })
+    },
+    resolveApiKey(): string | null {
+      return null
+    },
+    getConfiguredEnvKey(): string {
+      return envKeys[0]
+    },
+    createModel(options: LlmCreateModelOptions) {
+      return { __kind: 'contract-model', modelId: options.modelId }
+    },
+  }
+  return { ...base, ...overrides }
+}
+
+describe('LlmProvider contract — moderation/safety-identifier additive members', () => {
+  it('treats mapEndUserIdentifier and supportsInputModeration as optional (legacy adapters)', () => {
+    const provider = makeBaseProvider()
+    expect(provider.mapEndUserIdentifier).toBeUndefined()
+    expect(provider.supportsInputModeration).toBeUndefined()
+  })
+
+  it('accepts an optional endUserIdentifier on createModel options without changing behavior', () => {
+    const provider = makeBaseProvider()
+    const withIdentifier: LlmCreateModelOptions = {
+      modelId: 'contract-model',
+      apiKey: 'sk-test',
+      endUserIdentifier: 'hashed-identifier',
+    }
+    expect(provider.createModel(withIdentifier)).toEqual({ __kind: 'contract-model', modelId: 'contract-model' })
+  })
+
+  it('exposes a providerOptions fragment when mapEndUserIdentifier is implemented', () => {
+    const provider = makeBaseProvider({
+      mapEndUserIdentifier(identifier: string) {
+        return { contract: { user_id: identifier } }
+      },
+      supportsInputModeration: true,
+    })
+    expect(provider.supportsInputModeration).toBe(true)
+    expect(provider.mapEndUserIdentifier?.('abc123')).toEqual({ contract: { user_id: 'abc123' } })
+  })
+})

package/src/lib/ai/__tests__/safety-identifier.test.ts

@@ -0,0 +1,71 @@
+import { computeEndUserIdentifier, deriveAiSafetyIdentifierSecret } from '../safety-identifier'
+
+const BASE_SECRET = 'unit-test-base-secret'
+const HEX_64 = /^[0-9a-f]{64}$/
+
+describe('safety-identifier', () => {
+  describe('deriveAiSafetyIdentifierSecret', () => {
+    it('is deterministic and memoized for a given base secret', () => {
+      const first = deriveAiSafetyIdentifierSecret(BASE_SECRET)
+      const second = deriveAiSafetyIdentifierSecret(BASE_SECRET)
+      expect(first).toBe(second)
+      expect(first).toMatch(HEX_64)
+    })
+
+    it('produces a different key for a different base secret', () => {
+      expect(deriveAiSafetyIdentifierSecret(BASE_SECRET)).not.toBe(
+        deriveAiSafetyIdentifierSecret('other-base-secret'),
+      )
+    })
+
+    it('throws when no base secret is available', () => {
+      const previous = process.env.JWT_SECRET
+      delete process.env.JWT_SECRET
+      try {
+        expect(() => deriveAiSafetyIdentifierSecret()).toThrow(/JWT_SECRET/)
+      } finally {
+        if (previous !== undefined) process.env.JWT_SECRET = previous
+      }
+    })
+  })
+
+  describe('computeEndUserIdentifier', () => {
+    it('is stable for the same (tenant, user) pair', () => {
+      const a = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      const b = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      expect(a).toBe(b)
+      expect(a).toMatch(HEX_64)
+    })
+
+    it('separates the same user across tenants (tenant-salted)', () => {
+      const t1 = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      const t2 = computeEndUserIdentifier('tenant-2', 'user-1', { baseSecret: BASE_SECRET })
+      expect(t1).not.toBe(t2)
+    })
+
+    it('separates different users within the same tenant', () => {
+      const u1 = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      const u2 = computeEndUserIdentifier('tenant-1', 'user-2', { baseSecret: BASE_SECRET })
+      expect(u1).not.toBe(u2)
+    })
+
+    it('never leaks the raw tenant or user id', () => {
+      const id = computeEndUserIdentifier('tenant-1', 'user-1', { baseSecret: BASE_SECRET })
+      expect(id).not.toContain('tenant-1')
+      expect(id).not.toContain('user-1')
+    })
+
+    it('treats a null tenant as an empty salt without throwing', () => {
+      const withNull = computeEndUserIdentifier(null, 'user-1', { baseSecret: BASE_SECRET })
+      const withEmpty = computeEndUserIdentifier('', 'user-1', { baseSecret: BASE_SECRET })
+      expect(withNull).toMatch(HEX_64)
+      expect(withNull).toBe(withEmpty)
+    })
+
+    it('throws when userId is empty', () => {
+      expect(() => computeEndUserIdentifier('tenant-1', '   ', { baseSecret: BASE_SECRET })).toThrow(
+        /userId/,
+      )
+    })
+  })
+})

package/src/lib/ai/llm-provider.ts

@@ -62,6 +62,16 @@ export interface LlmCreateModelOptions {
    * proxy); Google honors it when the SDK supports it (@ai-sdk/google ≥3.0).
    */
   baseURL?: string
+  /**
+   * Optional opaque, non-reversible end-user identifier attached to the model
+   * call so provider-side abuse enforcement can target a single end user
+   * instead of the whole API-key organization. The runtime computes this as a
+   * tenant-salted HMAC (no PII leaves the platform); the adapter decides how to
+   * map it into per-call `providerOptions` via
+   * {@link LlmProvider.mapEndUserIdentifier}. Adapters without a mapping ignore
+   * it. Always optional — absent identifiers reproduce today's behavior.
+   */
+  endUserIdentifier?: string
 }
 
 /**
@@ -146,4 +156,27 @@ export interface LlmProvider {
    * behavior at `packages/ai-assistant/src/modules/ai_assistant/api/route/route.ts`.
    */
   createModel(options: LlmCreateModelOptions): unknown
+
+  /**
+   * Optional. Maps a runtime-computed end-user identifier (see
+   * {@link LlmCreateModelOptions.endUserIdentifier}) into the AI SDK
+   * `providerOptions` fragment this provider understands — e.g. OpenAI returns
+   * `{ openai: { safetyIdentifier } }`, Anthropic returns
+   * `{ anthropic: { metadata: { userId } } }`. Keys MUST be the AI SDK
+   * provider-option names (camelCase); the SDK translates them to the
+   * provider's request-body fields and strips unknown keys. The runtime merges
+   * the returned fragment into the per-call `providerOptions`. Adapters that
+   * omit this method send no identifier (today's behavior). Implementations
+   * MUST be pure and stateless.
+   */
+  mapEndUserIdentifier?(identifier: string): Record<string, unknown>
+
+  /**
+   * Optional. When `true`, the runtime may run input pre-moderation through
+   * this provider's moderation endpoint before the model call. Only providers
+   * that actually expose a moderation API (initially the OpenAI adapter) set
+   * this. Absent/`false` means the moderation gate is skipped for this provider
+   * and the surface relies on the provider's own server-side filtering.
+   */
+  readonly supportsInputModeration?: boolean
 }

package/src/lib/ai/safety-identifier.ts

@@ -0,0 +1,73 @@
+/**
+ * End-user safety identifiers for AI provider calls.
+ *
+ * Providers such as OpenAI let developers attach an opaque per-end-user
+ * identifier to each request so abuse enforcement can target one user instead
+ * of suspending the whole API-key organization. We never send a reversible id:
+ * the value is a tenant-salted HMAC computed from the platform's existing auth
+ * secret, so no PII or internal id leaves the platform and the same end user in
+ * two tenants produces two unrelated hashes.
+ *
+ * The per-process secret derivation mirrors `deriveJwtAudienceSecret`
+ * (`@open-mercato/shared/lib/auth/jwt`): one HMAC from the base `JWT_SECRET`
+ * under a versioned purpose label, memoized for the process lifetime. No new
+ * secret to provision.
+ *
+ * @see .ai/specs/2026-06-04-ai-input-moderation-and-safety-identifiers.md
+ */
+
+import crypto from 'node:crypto'
+
+const SAFETY_IDENTIFIER_SECRET_LABEL = 'open-mercato:ai-safety-identifier:v1'
+
+const derivedSecretCache = new Map<string, string>()
+
+function readBaseSecret(explicit?: string): string {
+  const secret = explicit ?? process.env.JWT_SECRET
+  if (!secret) {
+    throw new Error('[internal] JWT_SECRET is not set; cannot derive AI safety-identifier secret')
+  }
+  return secret
+}
+
+/**
+ * Derive the per-process safety-identifier HMAC key from the base auth secret.
+ *
+ * Deterministic HMAC-SHA256 of a versioned purpose label keyed by the base
+ * secret, memoized per base secret. Rotating the base secret rotates every
+ * derived identifier — documented as accepted (identifiers are advisory
+ * provider-side metadata, not an in-platform security control).
+ */
+export function deriveAiSafetyIdentifierSecret(baseSecret?: string): string {
+  const base = readBaseSecret(baseSecret)
+  const cached = derivedSecretCache.get(base)
+  if (cached !== undefined) return cached
+  const derived = crypto
+    .createHmac('sha256', base)
+    .update(SAFETY_IDENTIFIER_SECRET_LABEL)
+    .digest('hex')
+  derivedSecretCache.set(base, derived)
+  return derived
+}
+
+/**
+ * Compute the opaque end-user safety identifier for a (tenant, user) pair.
+ *
+ * Returns a 64-char lowercase hex HMAC-SHA256 of `${tenantId}:${userId}` keyed
+ * by the derived secret. Throws (with an `[internal]` message) when the base
+ * secret is missing or `userId` is empty — callers in the runtime wrap this in
+ * a best-effort try/catch so identifier-derivation failures never break chat.
+ */
+export function computeEndUserIdentifier(
+  tenantId: string | null | undefined,
+  userId: string,
+  options?: { baseSecret?: string },
+): string {
+  const normalizedUser = (userId ?? '').trim()
+  if (!normalizedUser) {
+    throw new Error('[internal] computeEndUserIdentifier requires a non-empty userId')
+  }
+  const key = deriveAiSafetyIdentifierSecret(options?.baseSecret)
+  const salt = (tenantId ?? '').trim()
+  return crypto.createHmac('sha256', key).update(`${salt}:${normalizedUser}`).digest('hex')
+}