@salimassili/ai-costguard 1.1.3

package/dist/security/TrustBoundaryValidator.js

@@ -0,0 +1,305 @@
+"use strict";
+/**
+ * TrustBoundaryValidator.ts - Enterprise API Security Layer
+ *
+ * Stripe-level API discipline:
+ * - HMAC-signed API requests (prevents tampering)
+ * - Request expiration timestamps (prevents replay attacks)
+ * - Rate limiting per API key (hard enforcement)
+ * - Idempotency keys (prevents duplicate processing)
+ * - Environment isolation (dev/staging/production)
+ * - Schema validation at runtime
+ * - Unsafe payload blocking
+ *
+ * Core principle: Trust nothing, validate everything
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.trustBoundary = exports.TrustBoundaryValidator = void 0;
+exports.createTrustBoundary = createTrustBoundary;
+const crypto = __importStar(require("crypto"));
+/**
+ * TrustBoundaryValidator - Enterprise-grade API security
+ *
+ * Behaves like Stripe: every request is signed, timestamped, and rate-limited.
+ * No request crosses the boundary without validation.
+ */
+class TrustBoundaryValidator {
+    constructor() {
+        this.apiKeySecrets = new Map();
+        this.rateLimits = new Map();
+        this.idempotencyStore = new Map();
+        this.environments = new Map();
+        this.requestLog = new Set();
+        this.setupEnvironments();
+    }
+    /**
+     * Validate incoming request against trust boundary
+     * This is the ONLY entry point for API requests
+     */
+    validateRequest(params) {
+        const env = this.detectEnvironment(params.apiKey);
+        const config = this.environments.get(env);
+        // 1. Validate API key format
+        const keyId = this.extractKeyId(params.apiKey);
+        if (!keyId) {
+            return this.reject('INVALID_SIGNATURE', 'Invalid API key format', env);
+        }
+        // 2. Check request age (prevent replay attacks)
+        const now = Date.now();
+        const requestAge = now - params.timestamp;
+        if (requestAge > config.requestMaxAgeMs || requestAge < -5000) {
+            return this.reject('EXPIRED_REQUEST', `Request expired or future-dated (${requestAge}ms)`, env);
+        }
+        // 3. Validate HMAC signature
+        const secret = this.apiKeySecrets.get(params.apiKey);
+        if (!secret) {
+            return this.reject('INVALID_SIGNATURE', 'Unknown API key', env);
+        }
+        const expectedSignature = this.computeHMAC(params, secret);
+        if (!crypto.timingSafeEqual(Buffer.from(params.signature), Buffer.from(expectedSignature))) {
+            return this.reject('INVALID_SIGNATURE', 'Signature mismatch', env);
+        }
+        // 4. Verify body hash (if required)
+        if (config.requireBodyHash && params.body && params.bodyHash) {
+            const computedHash = crypto.createHash('sha256').update(params.body).digest('hex');
+            if (computedHash !== params.bodyHash) {
+                return this.reject('MALFORMED_PAYLOAD', 'Body hash mismatch', env);
+            }
+        }
+        // 5. Rate limiting (hard enforcement)
+        const rateLimit = this.checkRateLimit(params.apiKey, config);
+        if (rateLimit.exceeded) {
+            return this.reject('RATE_LIMITED', `Rate limit exceeded. Reset at ${new Date(rateLimit.resetAt).toISOString()}`, env, undefined, rateLimit.remaining);
+        }
+        // 6. Idempotency check
+        if (config.requireIdempotency && params.idempotencyKey) {
+            if (this.idempotencyStore.has(params.idempotencyKey)) {
+                return {
+                    valid: false,
+                    rejected: true,
+                    code: 'IDEMPOTENCY_CONFLICT',
+                    reason: 'Idempotency key already used',
+                    environment: env,
+                    idempotencyKey: params.idempotencyKey,
+                };
+            }
+        }
+        // 7. Payload schema validation (in production)
+        if (config.strictMode && params.body) {
+            const schemaCheck = this.validatePayloadSchema(params.body, params.path);
+            if (!schemaCheck.valid) {
+                return this.reject('MALFORMED_PAYLOAD', schemaCheck.error || 'Invalid payload', env);
+            }
+        }
+        // All checks passed
+        return {
+            valid: true,
+            rejected: false,
+            code: 'VALID',
+            apiKeyId: keyId,
+            userId: this.extractUserId(params.apiKey),
+            environment: env,
+            rateLimitRemaining: rateLimit.remaining,
+            idempotencyKey: params.idempotencyKey,
+        };
+    }
+    /**
+     * Register idempotency key as processed
+     */
+    recordIdempotency(key, result) {
+        this.idempotencyStore.set(key, {
+            processedAt: Date.now(),
+            result,
+        });
+        // Cleanup old entries after 24 hours
+        setTimeout(() => this.idempotencyStore.delete(key), 24 * 60 * 60 * 1000);
+    }
+    /**
+     * Register API key with its signing secret
+     */
+    registerApiKey(apiKey, userId, environment) {
+        // Generate deterministic secret from key
+        const secret = crypto.createHmac('sha256', 'master-secret').update(apiKey).digest('hex');
+        this.apiKeySecrets.set(apiKey, secret);
+    }
+    /**
+     * Generate signed request (for client SDK)
+     */
+    generateSignedRequest(apiKey, body, idempotencyKey) {
+        const timestamp = Date.now();
+        const bodyHash = crypto.createHash('sha256').update(body).digest('hex');
+        const secret = this.apiKeySecrets.get(apiKey);
+        if (!secret)
+            throw new Error('Unknown API key');
+        const signaturePayload = `${apiKey}:${timestamp}:${bodyHash}:${idempotencyKey || ''}`;
+        const signature = crypto.createHmac('sha256', secret).update(signaturePayload).digest('hex');
+        return {
+            apiKey,
+            timestamp,
+            signature,
+            idempotencyKey,
+            bodyHash,
+        };
+    }
+    /**
+     * Get current rate limit status
+     */
+    getRateLimitStatus(apiKey) {
+        const state = this.rateLimits.get(apiKey);
+        const env = this.detectEnvironment(apiKey);
+        const config = this.environments.get(env);
+        if (!state || Date.now() > state.resetAt) {
+            return {
+                remaining: config.rateLimitMaxRequests,
+                resetAt: Date.now() + config.rateLimitWindowMs,
+                windowMs: config.rateLimitWindowMs,
+            };
+        }
+        return {
+            remaining: Math.max(0, config.rateLimitMaxRequests - state.count),
+            resetAt: state.resetAt,
+            windowMs: config.rateLimitWindowMs,
+        };
+    }
+    // Private methods
+    setupEnvironments() {
+        this.environments.set('dev', {
+            name: 'dev',
+            strictMode: false,
+            requestMaxAgeMs: 5 * 60 * 1000, // 5 minutes
+            rateLimitWindowMs: 60 * 1000,
+            rateLimitMaxRequests: 1000,
+            requireIdempotency: false,
+            requireBodyHash: false,
+        });
+        this.environments.set('staging', {
+            name: 'staging',
+            strictMode: true,
+            requestMaxAgeMs: 2 * 60 * 1000, // 2 minutes
+            rateLimitWindowMs: 60 * 1000,
+            rateLimitMaxRequests: 500,
+            requireIdempotency: true,
+            requireBodyHash: true,
+        });
+        this.environments.set('production', {
+            name: 'production',
+            strictMode: true,
+            requestMaxAgeMs: 60 * 1000, // 1 minute
+            rateLimitWindowMs: 60 * 1000,
+            rateLimitMaxRequests: 100,
+            requireIdempotency: true,
+            requireBodyHash: true,
+        });
+    }
+    detectEnvironment(apiKey) {
+        if (apiKey.startsWith('ak_live_prod_'))
+            return 'production';
+        if (apiKey.startsWith('ak_live_staging_'))
+            return 'staging';
+        return 'dev';
+    }
+    extractKeyId(apiKey) {
+        const parts = apiKey.split('_');
+        return parts[parts.length - 1]?.substring(0, 12);
+    }
+    extractUserId(apiKey) {
+        // In real implementation, would decode from key
+        return 'user_' + this.extractKeyId(apiKey);
+    }
+    computeHMAC(params, secret) {
+        const bodyHash = params.bodyHash || crypto.createHash('sha256').update(params.body || '').digest('hex');
+        const payload = `${params.apiKey}:${params.timestamp}:${bodyHash}:${params.idempotencyKey || ''}:${params.path}:${params.method}`;
+        return crypto.createHmac('sha256', secret).update(payload).digest('hex');
+    }
+    checkRateLimit(apiKey, config) {
+        const now = Date.now();
+        let state = this.rateLimits.get(apiKey);
+        if (!state || now > state.resetAt) {
+            state = {
+                count: 0,
+                resetAt: now + config.rateLimitWindowMs,
+                windowMs: config.rateLimitWindowMs,
+            };
+            this.rateLimits.set(apiKey, state);
+        }
+        state.count++;
+        const remaining = Math.max(0, config.rateLimitMaxRequests - state.count);
+        const exceeded = state.count > config.rateLimitMaxRequests;
+        return { exceeded, remaining, resetAt: state.resetAt };
+    }
+    validatePayloadSchema(body, path) {
+        try {
+            const parsed = JSON.parse(body);
+            // Basic schema checks based on path
+            if (path.includes('/api/protection/')) {
+                if (!parsed.model || typeof parsed.model !== 'string') {
+                    return { valid: false, error: 'Missing or invalid model field' };
+                }
+                if (!parsed.requestId || typeof parsed.requestId !== 'string') {
+                    return { valid: false, error: 'Missing or invalid requestId field' };
+                }
+            }
+            // Check for unsafe payloads
+            const bodyStr = JSON.stringify(parsed).toLowerCase();
+            const unsafePatterns = ['__proto__', 'constructor', 'prototype', '<script'];
+            if (unsafePatterns.some(p => bodyStr.includes(p))) {
+                return { valid: false, error: 'Unsafe payload detected' };
+            }
+            return { valid: true };
+        }
+        catch {
+            return { valid: false, error: 'Invalid JSON payload' };
+        }
+    }
+    reject(code, reason, environment, apiKeyId, rateLimitRemaining) {
+        return {
+            valid: false,
+            rejected: true,
+            code,
+            reason,
+            environment,
+            apiKeyId,
+            rateLimitRemaining,
+        };
+    }
+}
+exports.TrustBoundaryValidator = TrustBoundaryValidator;
+// Singleton
+exports.trustBoundary = new TrustBoundaryValidator();
+function createTrustBoundary() {
+    return new TrustBoundaryValidator();
+}
+//# sourceMappingURL=TrustBoundaryValidator.js.map

package/dist/security/TrustBoundaryValidator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TrustBoundaryValidator.js","sourceRoot":"","sources":["../../src/security/TrustBoundaryValidator.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;GAaG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuVH,kDAEC;AAvVD,+CAAiC;AAsCjC;;;;;GAKG;AACH,MAAa,sBAAsB;IAOjC;QANQ,kBAAa,GAAwB,IAAI,GAAG,EAAE,CAAC;QAC/C,eAAU,GAAgC,IAAI,GAAG,EAAE,CAAC;QACpD,qBAAgB,GAA0D,IAAI,GAAG,EAAE,CAAC;QACpF,iBAAY,GAAmC,IAAI,GAAG,EAAE,CAAC;QACzD,eAAU,GAAgB,IAAI,GAAG,EAAE,CAAC;QAG1C,IAAI,CAAC,iBAAiB,EAAE,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,eAAe,CAAC,MASf;QACC,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAE3C,6BAA6B;QAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,wBAAwB,EAAE,GAAG,CAAC,CAAC;QACzE,CAAC;QAED,gDAAgD;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,GAAG,GAAG,MAAM,CAAC,SAAS,CAAC;QAC1C,IAAI,UAAU,GAAG,MAAM,CAAC,eAAe,IAAI,UAAU,GAAG,CAAC,IAAI,EAAE,CAAC;YAC9D,OAAO,IAAI,CAAC,MAAM,CAAC,iBAAiB,EAAE,oCAAoC,UAAU,KAAK,EAAE,GAAG,CAAC,CAAC;QAClG,CAAC;QAED,6BAA6B;QAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,iBAAiB,EAAE,GAAG,CAAC,CAAC;QAClE,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,EAAE,CAAC;YAC3F,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;QACrE,CAAC;QAED,oCAAoC;QACpC,IAAI,MAAM,CAAC,eAAe,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7D,MAAM,YAAY,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnF,IAAI,YAAY,KAAK,MAAM,CAAC,QAAQ,EAAE,CAAC;gBACrC,OAAO,IAAI,CAAC,MAAM,CAAC,mBAAmB,EAAE,oBAAoB,EAAE,GAAG,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,SAAS,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,QAAQ,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,iCAAiC,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC;QACxJ,CAAC;QAED,uBAAuB;QACvB,IAAI,MAAM,CAAC,kBAAkB,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;YACvD,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;gBACrD,OAAO;oBACL,KAAK,EAAE,KAAK;oBACZ,QAAQ,EAAE,IAAI;oBACd,IAAI,EAAE,sBAAsB;oBAC5B,MAAM,EAAE,8BAA8B;oBACtC,WAAW,EAAE,GAAG;oBAChB,cAAc,EAAE,MAAM,CAAC,cAAc;iBACtC,CAAC;YACJ,CAAC;QACH,CAAC;QAED,+CAA+C;QAC/C,IAAI,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,MAAM,WAAW,GAAG,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;YACzE,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,CAAC;gBACvB,OAAO,IAAI,CAAC,MAAM,CAChB,mBAAmB,EACnB,WAAW,CAAC,KAAK,IAAI,iBAAiB,EACtC,GAAG,CACJ,CAAC;YACJ,CAAC;QACH,CAAC;QAED,oBAAoB;QACpB,OAAO;YACL,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,KAAK;YACf,IAAI,EAAE,OAAO;YACb,QAAQ,EAAE,KAAK;YACf,MAAM,EAAE,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC;YACzC,WAAW,EAAE,GAAG;YAChB,kBAAkB,EAAE,SAAS,CAAC,SAAS;YACvC,cAAc,EAAE,MAAM,CAAC,cAAc;SACtC,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,iBAAiB,CAAC,GAAW,EAAE,MAAe;QAC5C,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE;YAC7B,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE;YACvB,MAAM;SACP,CAAC,CAAC;QAEH,qCAAqC;QACrC,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3E,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAc,EAAE,MAAc,EAAE,WAA6C;QAC1F,yCAAyC;QACzC,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACzF,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,MAAc,EAAE,IAAY,EAAE,cAAuB;QACzE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAExE,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,KAAK,CAAC,iBAAiB,CAAC,CAAC;QAEhD,MAAM,gBAAgB,GAAG,GAAG,MAAM,IAAI,SAAS,IAAI,QAAQ,IAAI,cAAc,IAAI,EAAE,EAAE,CAAC;QACtF,MAAM,SAAS,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAE7F,OAAO;YACL,MAAM;YACN,SAAS;YACT,SAAS;YACT,cAAc;YACd,QAAQ;SACT,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,kBAAkB,CAAC,MAAc;QAC/B,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;QAE3C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YACzC,OAAO;gBACL,SAAS,EAAE,MAAM,CAAC,oBAAoB;gBACtC,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,iBAAiB;gBAC9C,QAAQ,EAAE,MAAM,CAAC,iBAAiB;aACnC,CAAC;QACJ,CAAC;QAED,OAAO;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,oBAAoB,GAAG,KAAK,CAAC,KAAK,CAAC;YACjE,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,QAAQ,EAAE,MAAM,CAAC,iBAAiB;SACnC,CAAC;IACJ,CAAC;IAED,kBAAkB;IAEV,iBAAiB;QACvB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE;YAC3B,IAAI,EAAE,KAAK;YACX,UAAU,EAAE,KAAK;YACjB,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,YAAY;YAC5C,iBAAiB,EAAE,EAAE,GAAG,IAAI;YAC5B,oBAAoB,EAAE,IAAI;YAC1B,kBAAkB,EAAE,KAAK;YACzB,eAAe,EAAE,KAAK;SACvB,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,EAAE;YAC/B,IAAI,EAAE,SAAS;YACf,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,YAAY;YAC5C,iBAAiB,EAAE,EAAE,GAAG,IAAI;YAC5B,oBAAoB,EAAE,GAAG;YACzB,kBAAkB,EAAE,IAAI;YACxB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;QAEH,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,YAAY,EAAE;YAClC,IAAI,EAAE,YAAY;YAClB,UAAU,EAAE,IAAI;YAChB,eAAe,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW;YACvC,iBAAiB,EAAE,EAAE,GAAG,IAAI;YAC5B,oBAAoB,EAAE,GAAG;YACzB,kBAAkB,EAAE,IAAI;YACxB,eAAe,EAAE,IAAI;SACtB,CAAC,CAAC;IACL,CAAC;IAEO,iBAAiB,CAAC,MAAc;QACtC,IAAI,MAAM,CAAC,UAAU,CAAC,eAAe,CAAC;YAAE,OAAO,YAAY,CAAC;QAC5D,IAAI,MAAM,CAAC,UAAU,CAAC,kBAAkB,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,YAAY,CAAC,MAAc;QACjC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnD,CAAC;IAEO,aAAa,CAAC,MAAc;QAClC,gDAAgD;QAChD,OAAO,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAEO,WAAW,CAAC,MAAkD,EAAE,MAAc;QACpF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACxG,MAAM,OAAO,GAAG,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,SAAS,IAAI,QAAQ,IAAI,MAAM,CAAC,cAAc,IAAI,EAAE,IAAI,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClI,OAAO,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC;IAEO,cAAc,CAAC,MAAc,EAAE,MAAyB;QAC9D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,IAAI,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExC,IAAI,CAAC,KAAK,IAAI,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC;YAClC,KAAK,GAAG;gBACN,KAAK,EAAE,CAAC;gBACR,OAAO,EAAE,GAAG,GAAG,MAAM,CAAC,iBAAiB;gBACvC,QAAQ,EAAE,MAAM,CAAC,iBAAiB;aACnC,CAAC;YACF,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACrC,CAAC;QAED,KAAK,CAAC,KAAK,EAAE,CAAC;QAEd,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,oBAAoB,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,GAAG,MAAM,CAAC,oBAAoB,CAAC;QAE3D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IACzD,CAAC;IAEO,qBAAqB,CAAC,IAAY,EAAE,IAAY;QACtD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAEhC,oCAAoC;YACpC,IAAI,IAAI,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACtC,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;oBACtD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE,CAAC;gBACnE,CAAC;gBACD,IAAI,CAAC,MAAM,CAAC,SAAS,IAAI,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;oBAC9D,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,oCAAoC,EAAE,CAAC;gBACvE,CAAC;YACH,CAAC;YAED,4BAA4B;YAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,WAAW,EAAE,CAAC;YACrD,MAAM,cAAc,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,WAAW,EAAE,SAAS,CAAC,CAAC;YAC5E,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,yBAAyB,EAAE,CAAC;YAC5D,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACzB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,sBAAsB,EAAE,CAAC;QACzD,CAAC;IACH,CAAC;IAEO,MAAM,CACZ,IAA8B,EAC9B,MAAc,EACd,WAA6C,EAC7C,QAAiB,EACjB,kBAA2B;QAE3B,OAAO;YACL,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,IAAI;YACd,IAAI;YACJ,MAAM;YACN,WAAW;YACX,QAAQ;YACR,kBAAkB;SACnB,CAAC;IACJ,CAAC;CACF;AArSD,wDAqSC;AAED,YAAY;AACC,QAAA,aAAa,GAAG,IAAI,sBAAsB,EAAE,CAAC;AAC1D,SAAgB,mBAAmB;IACjC,OAAO,IAAI,sBAAsB,EAAE,CAAC;AACtC,CAAC"}

package/dist/starters/express-protected.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Starter Template: Express Protected Server
+ *
+ * Full working Express server with automatic protection.
+ * Already protected. Zero configuration. Production ready.
+ */
+export declare const STARTER_EXPRESS_PROTECTED: {
+    name: string;
+    description: string;
+    files: {
+        'package.json': string;
+        'server.js': string;
+        '.env.example': string;
+        'README.md': string;
+    };
+};
+export declare function generateExpressStarter(): string;
+//# sourceMappingURL=express-protected.d.ts.map

package/dist/starters/express-protected.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-protected.d.ts","sourceRoot":"","sources":["../../src/starters/express-protected.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,yBAAyB;;;;;;;;;CAkFrC,CAAC;AAEF,wBAAgB,sBAAsB,IAAI,MAAM,CAE/C"}

package/dist/starters/express-protected.js

@@ -0,0 +1,93 @@
+"use strict";
+/**
+ * Starter Template: Express Protected Server
+ *
+ * Full working Express server with automatic protection.
+ * Already protected. Zero configuration. Production ready.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STARTER_EXPRESS_PROTECTED = void 0;
+exports.generateExpressStarter = generateExpressStarter;
+exports.STARTER_EXPRESS_PROTECTED = {
+    name: 'express-protected',
+    description: 'Express server with automatic AI cost protection',
+    files: {
+        'package.json': JSON.stringify({
+            name: 'express-ai-server',
+            version: '1.0.0',
+            type: 'module',
+            dependencies: {
+                'ai-costguard': '^2.0.0',
+                'express': '^4.18.0',
+                'openai': '^4.0.0',
+            },
+            scripts: {
+                start: 'node server.js',
+                dev: 'node --watch server.js',
+            },
+        }, null, 2),
+        'server.js': `// AI Cost Guard automatically activates on import
+// All AI calls in this server are protected
+import express from 'express';
+import { OpenAI } from 'ai-costguard/openai';
+
+const app = express();
+app.use(express.json());
+
+const openai = new OpenAI({
+  apiKey: process.env.OPENAI_API_KEY,
+});
+
+// This endpoint is automatically protected
+app.post('/chat', async (req, res) => {
+  const { message } = req.body;
+  
+  // Protection is automatic - no code changes needed
+  const response = await openai.chat.completions.create({
+    model: 'gpt-4',
+    messages: [{ role: 'user', content: message }],
+  });
+  
+  res.json({ 
+    reply: response.choices[0].message.content,
+    protected: true,
+  });
+});
+
+app.listen(3000, () => {
+  console.log('Server running on port 3000');
+  console.log('AI Cost Guard: Execution secured');
+});
+`,
+        '.env.example': `OPENAI_API_KEY=sk-...
+AI_COSTGUARD_API_KEY=ak-...
+PORT=3000
+`,
+        'README.md': `# Protected Express Server
+
+Express server with automatic AI cost explosion protection.
+
+## Usage
+
+\`\`\`bash
+npm install
+npm start
+\`\`\`
+
+All AI calls are automatically protected.
+
+## API
+
+\`\`\`
+POST /chat
+{ "message": "Hello" }
+\`\`\`
+
+Protection is automatic. No configuration required.
+`,
+    },
+};
+function generateExpressStarter() {
+    return JSON.stringify(exports.STARTER_EXPRESS_PROTECTED, null, 2);
+}
+//# sourceMappingURL=express-protected.js.map

package/dist/starters/express-protected.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"express-protected.js","sourceRoot":"","sources":["../../src/starters/express-protected.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAsFH,wDAEC;AAtFY,QAAA,yBAAyB,GAAG;IACvC,IAAI,EAAE,mBAAmB;IACzB,WAAW,EAAE,kDAAkD;IAE/D,KAAK,EAAE;QACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,EAAE,mBAAmB;YACzB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE;gBACZ,cAAc,EAAE,QAAQ;gBACxB,SAAS,EAAE,SAAS;gBACpB,QAAQ,EAAE,QAAQ;aACnB;YACD,OAAO,EAAE;gBACP,KAAK,EAAE,gBAAgB;gBACvB,GAAG,EAAE,wBAAwB;aAC9B;SACF,EAAE,IAAI,EAAE,CAAC,CAAC;QAEX,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAgChB;QAEG,cAAc,EAAE;;;CAGnB;QAEG,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBhB;KACE;CACF,CAAC;AAEF,SAAgB,sBAAsB;IACpC,OAAO,IAAI,CAAC,SAAS,CAAC,iCAAyB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC5D,CAAC"}

package/dist/starters/langchain-protected.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Starter Template: LangChain Protected Project
+ *
+ * Full working LangChain app with automatic cost protection.
+ * Already protected. Zero configuration. Production ready.
+ */
+export declare const STARTER_LANGCHAIN_PROTECTED: {
+    name: string;
+    description: string;
+    files: {
+        'package.json': string;
+        'app.js': string;
+        '.env.example': string;
+        'README.md': string;
+    };
+};
+export declare function generateLangChainStarter(): string;
+//# sourceMappingURL=langchain-protected.d.ts.map

package/dist/starters/langchain-protected.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain-protected.d.ts","sourceRoot":"","sources":["../../src/starters/langchain-protected.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,2BAA2B;;;;;;;;;CA0EvC,CAAC;AAEF,wBAAgB,wBAAwB,IAAI,MAAM,CAEjD"}

package/dist/starters/langchain-protected.js

@@ -0,0 +1,85 @@
+"use strict";
+/**
+ * Starter Template: LangChain Protected Project
+ *
+ * Full working LangChain app with automatic cost protection.
+ * Already protected. Zero configuration. Production ready.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STARTER_LANGCHAIN_PROTECTED = void 0;
+exports.generateLangChainStarter = generateLangChainStarter;
+exports.STARTER_LANGCHAIN_PROTECTED = {
+    name: 'langchain-protected',
+    description: 'LangChain project with automatic AI cost protection',
+    files: {
+        'package.json': JSON.stringify({
+            name: 'langchain-ai-app',
+            version: '1.0.0',
+            type: 'module',
+            dependencies: {
+                'ai-costguard': '^2.0.0',
+                'langchain': '^0.1.0',
+                '@langchain/openai': '^0.0.14',
+            },
+            scripts: {
+                start: 'node app.js',
+                dev: 'node --watch app.js',
+            },
+        }, null, 2),
+        'app.js': `// AI Cost Guard automatically activates on import
+// All LangChain AI calls are protected
+import 'ai-costguard';
+import { ChatOpenAI } from '@langchain/openai';
+import { ChatPromptTemplate } from '@langchain/core/prompts';
+
+const model = new ChatOpenAI({
+  modelName: 'gpt-4',
+  openAIApiKey: process.env.OPENAI_API_KEY,
+});
+
+const prompt = ChatPromptTemplate.fromMessages([
+  ['system', 'You are a helpful assistant.'],
+  ['user', '{input}'],
+]);
+
+const chain = prompt.pipe(model);
+
+// This call is automatically protected
+const response = await chain.invoke({
+  input: 'What is the weather like?',
+});
+
+console.log(response.content);
+`,
+        '.env.example': `OPENAI_API_KEY=sk-...
+AI_COSTGUARD_API_KEY=ak-...
+`,
+        'README.md': `# Protected LangChain Project
+
+LangChain application with automatic AI cost explosion protection.
+
+## Usage
+
+\`\`\`bash
+npm install
+npm start
+\`\`\`
+
+That's it. Protection is automatically active.
+
+## How It Works
+
+The import \`'ai-costguard'\` at the top of the file automatically:
+1. Activates runtime protection
+2. Intercepts all AI calls (including LangChain's)
+3. Blocks cost explosions
+4. Logs all activity
+
+No configuration. No setup. Already protected.
+`,
+    },
+};
+function generateLangChainStarter() {
+    return JSON.stringify(exports.STARTER_LANGCHAIN_PROTECTED, null, 2);
+}
+//# sourceMappingURL=langchain-protected.js.map

package/dist/starters/langchain-protected.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"langchain-protected.js","sourceRoot":"","sources":["../../src/starters/langchain-protected.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA8EH,4DAEC;AA9EY,QAAA,2BAA2B,GAAG;IACzC,IAAI,EAAE,qBAAqB;IAC3B,WAAW,EAAE,qDAAqD;IAElE,KAAK,EAAE;QACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,EAAE,kBAAkB;YACxB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE;gBACZ,cAAc,EAAE,QAAQ;gBACxB,WAAW,EAAE,QAAQ;gBACrB,mBAAmB,EAAE,SAAS;aAC/B;YACD,OAAO,EAAE;gBACP,KAAK,EAAE,aAAa;gBACpB,GAAG,EAAE,qBAAqB;aAC3B;SACF,EAAE,IAAI,EAAE,CAAC,CAAC;QAEX,QAAQ,EAAE;;;;;;;;;;;;;;;;;;;;;;;;CAwBb;QAEG,cAAc,EAAE;;CAEnB;QAEG,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBhB;KACE;CACF,CAAC;AAEF,SAAgB,wBAAwB;IACtC,OAAO,IAAI,CAAC,SAAS,CAAC,mCAA2B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC9D,CAAC"}

package/dist/starters/openai-protected.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Starter Template: OpenAI Protected Project
+ *
+ * Full working repo structure for instant deployment.
+ * Already protected. Zero configuration. Production ready.
+ */
+export declare const STARTER_OPENAI_PROTECTED: {
+    name: string;
+    description: string;
+    files: {
+        'package.json': string;
+        'index.js': string;
+        '.env.example': string;
+        'README.md': string;
+    };
+    instructions: string;
+};
+export declare function generateOpenAIStarter(): string;
+//# sourceMappingURL=openai-protected.d.ts.map

package/dist/starters/openai-protected.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-protected.d.ts","sourceRoot":"","sources":["../../src/starters/openai-protected.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,wBAAwB;;;;;;;;;;CA0EpC,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,MAAM,CAE9C"}

package/dist/starters/openai-protected.js

@@ -0,0 +1,84 @@
+"use strict";
+/**
+ * Starter Template: OpenAI Protected Project
+ *
+ * Full working repo structure for instant deployment.
+ * Already protected. Zero configuration. Production ready.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STARTER_OPENAI_PROTECTED = void 0;
+exports.generateOpenAIStarter = generateOpenAIStarter;
+exports.STARTER_OPENAI_PROTECTED = {
+    name: 'openai-protected',
+    description: 'OpenAI project with automatic cost protection',
+    files: {
+        'package.json': JSON.stringify({
+            name: 'my-ai-project',
+            version: '1.0.0',
+            type: 'module',
+            dependencies: {
+                'ai-costguard': '^2.0.0',
+                'openai': '^4.0.0',
+            },
+            scripts: {
+                start: 'node index.js',
+                dev: 'node --watch index.js',
+            },
+        }, null, 2),
+        'index.js': `// AI Cost Guard automatically activates on import
+// No configuration required. No setup needed.
+import { OpenAI } from 'ai-costguard/openai';
+
+const openai = new OpenAI({
+  apiKey: process.env.OPENAI_API_KEY,
+});
+
+// This call is automatically protected
+const response = await openai.chat.completions.create({
+  model: 'gpt-4',
+  messages: [{ role: 'user', content: 'Hello' }],
+});
+
+console.log(response.choices[0].message.content);
+`,
+        '.env.example': `# Copy to .env and fill in your keys
+OPENAI_API_KEY=sk-...
+AI_COSTGUARD_API_KEY=ak-...
+`,
+        'README.md': `# Protected OpenAI Project
+
+This project has automatic cost explosion protection built-in.
+
+## Usage
+
+\`\`\`bash
+npm install
+npm start
+\`\`\`
+
+That's it. Protection is automatically active.
+
+## How It Works
+
+The import \`from 'ai-costguard/openai'\` automatically:
+1. Activates runtime protection
+2. Intercepts all AI calls
+3. Blocks cost explosions
+4. Logs all activity
+
+No configuration. No setup. Already protected.
+`,
+    },
+    instructions: [
+        '1. Copy these files to a new directory',
+        '2. Run: npm install',
+        '3. Copy .env.example to .env and add your keys',
+        '4. Run: npm start',
+        '',
+        'Result: Project is running with automatic cost protection',
+    ].join('\n'),
+};
+function generateOpenAIStarter() {
+    return JSON.stringify(exports.STARTER_OPENAI_PROTECTED, null, 2);
+}
+//# sourceMappingURL=openai-protected.js.map

package/dist/starters/openai-protected.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openai-protected.js","sourceRoot":"","sources":["../../src/starters/openai-protected.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA8EH,sDAEC;AA9EY,QAAA,wBAAwB,GAAG;IACtC,IAAI,EAAE,kBAAkB;IACxB,WAAW,EAAE,+CAA+C;IAE5D,KAAK,EAAE;QACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,EAAE,eAAe;YACrB,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE;gBACZ,cAAc,EAAE,QAAQ;gBACxB,QAAQ,EAAE,QAAQ;aACnB;YACD,OAAO,EAAE;gBACP,KAAK,EAAE,eAAe;gBACtB,GAAG,EAAE,uBAAuB;aAC7B;SACF,EAAE,IAAI,EAAE,CAAC,CAAC;QAEX,UAAU,EAAE;;;;;;;;;;;;;;;CAef;QAEG,cAAc,EAAE;;;CAGnB;QAEG,WAAW,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBhB;KACE;IAED,YAAY,EAAE;QACZ,wCAAwC;QACxC,qBAAqB;QACrB,gDAAgD;QAChD,mBAAmB;QACnB,EAAE;QACF,2DAA2D;KAC5D,CAAC,IAAI,CAAC,IAAI,CAAC;CACb,CAAC;AAEF,SAAgB,qBAAqB;IACnC,OAAO,IAAI,CAAC,SAAS,CAAC,gCAAwB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}