@salimassili/ai-costguard 1.1.3

package/dist/starters/serverless-protected.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Starter Template: Serverless Protected Function
+ *
+ * AWS Lambda / Vercel / Cloud Functions with automatic protection.
+ * Already protected. Zero configuration. Production ready.
+ */
+export declare const STARTER_SERVERLESS_PROTECTED: {
+    name: string;
+    description: string;
+    files: {
+        'package.json': string;
+        'index.js': string;
+        'vercel.json': string;
+        '.env.example': string;
+        'README.md': string;
+    };
+};
+export declare function generateServerlessStarter(): string;
+//# sourceMappingURL=serverless-protected.d.ts.map

package/dist/starters/serverless-protected.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverless-protected.d.ts","sourceRoot":"","sources":["../../src/starters/serverless-protected.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,eAAO,MAAM,4BAA4B;;;;;;;;;;CAyExC,CAAC;AAEF,wBAAgB,yBAAyB,IAAI,MAAM,CAElD"}

package/dist/starters/serverless-protected.js

@@ -0,0 +1,83 @@
+"use strict";
+/**
+ * Starter Template: Serverless Protected Function
+ *
+ * AWS Lambda / Vercel / Cloud Functions with automatic protection.
+ * Already protected. Zero configuration. Production ready.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.STARTER_SERVERLESS_PROTECTED = void 0;
+exports.generateServerlessStarter = generateServerlessStarter;
+exports.STARTER_SERVERLESS_PROTECTED = {
+    name: 'serverless-protected',
+    description: 'Serverless function with automatic AI cost protection',
+    files: {
+        'package.json': JSON.stringify({
+            name: 'serverless-ai-function',
+            version: '1.0.0',
+            type: 'module',
+            dependencies: {
+                'ai-costguard': '^2.0.0',
+                'openai': '^4.0.0',
+            },
+        }, null, 2),
+        'index.js': `// AI Cost Guard automatically activates on import
+// All AI calls in this function are protected
+import { OpenAI } from 'ai-costguard/openai';
+
+const openai = new OpenAI({
+  apiKey: process.env.OPENAI_API_KEY,
+});
+
+export default async function handler(request) {
+  const { message } = await request.json();
+  
+  // Protection is automatic
+  const response = await openai.chat.completions.create({
+    model: 'gpt-4',
+    messages: [{ role: 'user', content: message }],
+  });
+  
+  return new Response(
+    JSON.stringify({
+      reply: response.choices[0].message.content,
+      protected: true,
+    }),
+    { headers: { 'Content-Type': 'application/json' } }
+  );
+}
+`,
+        'vercel.json': JSON.stringify({
+            functions: {
+                'index.js': {
+                    maxDuration: 30,
+                },
+            },
+        }, null, 2),
+        '.env.example': `OPENAI_API_KEY=sk-...
+AI_COSTGUARD_API_KEY=ak-...
+`,
+        'README.md': `# Protected Serverless Function
+
+Serverless function with automatic AI cost explosion protection.
+
+## Deploy
+
+\`\`\`bash
+npm install
+vercel deploy
+\`\`\`
+
+All AI calls are automatically protected.
+
+## How It Works
+
+The import \`from 'ai-costguard/openai'\` activates automatic protection.
+No configuration needed. Already protected on deployment.
+`,
+    },
+};
+function generateServerlessStarter() {
+    return JSON.stringify(exports.STARTER_SERVERLESS_PROTECTED, null, 2);
+}
+//# sourceMappingURL=serverless-protected.js.map

package/dist/starters/serverless-protected.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serverless-protected.js","sourceRoot":"","sources":["../../src/starters/serverless-protected.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AA6EH,8DAEC;AA7EY,QAAA,4BAA4B,GAAG;IAC1C,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,uDAAuD;IAEpE,KAAK,EAAE;QACL,cAAc,EAAE,IAAI,CAAC,SAAS,CAAC;YAC7B,IAAI,EAAE,wBAAwB;YAC9B,OAAO,EAAE,OAAO;YAChB,IAAI,EAAE,QAAQ;YACd,YAAY,EAAE;gBACZ,cAAc,EAAE,QAAQ;gBACxB,QAAQ,EAAE,QAAQ;aACnB;SACF,EAAE,IAAI,EAAE,CAAC,CAAC;QAEX,UAAU,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;CAyBf;QAEG,aAAa,EAAE,IAAI,CAAC,SAAS,CAAC;YAC5B,SAAS,EAAE;gBACT,UAAU,EAAE;oBACV,WAAW,EAAE,EAAE;iBAChB;aACF;SACF,EAAE,IAAI,EAAE,CAAC,CAAC;QAEX,cAAc,EAAE;;CAEnB;QAEG,WAAW,EAAE;;;;;;;;;;;;;;;;;CAiBhB;KACE;CACF,CAAC;AAEF,SAAgB,yBAAyB;IACvC,OAAO,IAAI,CAAC,SAAS,CAAC,oCAA4B,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/D,CAAC"}

package/dist/storage/adapters.d.ts

@@ -0,0 +1,24 @@
+import { StorageAdapterType, StorageConfig } from '../config/userConfig';
+export interface StorageAdapter<TRecord> {
+    readonly type: StorageAdapterType;
+    load(): TRecord[];
+    append(record: TRecord): void;
+    clear(): void;
+}
+export declare class MemoryStorageAdapter<TRecord> implements StorageAdapter<TRecord> {
+    readonly type: "memory";
+    private records;
+    load(): TRecord[];
+    append(record: TRecord): void;
+    clear(): void;
+}
+export declare class JsonlStorageAdapter<TRecord> implements StorageAdapter<TRecord> {
+    readonly type: "jsonl";
+    private filePath;
+    constructor(filePath?: string);
+    load(): TRecord[];
+    append(record: TRecord): void;
+    clear(): void;
+}
+export declare function createStorageAdapter<TRecord>(config?: Partial<StorageConfig>): StorageAdapter<TRecord>;
+//# sourceMappingURL=adapters.d.ts.map

package/dist/storage/adapters.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.d.ts","sourceRoot":"","sources":["../../src/storage/adapters.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAEzE,MAAM,WAAW,cAAc,CAAC,OAAO;IACrC,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC;IAClC,IAAI,IAAI,OAAO,EAAE,CAAC;IAClB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,KAAK,IAAI,IAAI,CAAC;CACf;AAED,qBAAa,oBAAoB,CAAC,OAAO,CAAE,YAAW,cAAc,CAAC,OAAO,CAAC;IAC3E,QAAQ,CAAC,IAAI,EAAG,QAAQ,CAAU;IAClC,OAAO,CAAC,OAAO,CAAiB;IAEhC,IAAI,IAAI,OAAO,EAAE;IAIjB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAI7B,KAAK,IAAI,IAAI;CAGd;AAED,qBAAa,mBAAmB,CAAC,OAAO,CAAE,YAAW,cAAc,CAAC,OAAO,CAAC;IAC1E,QAAQ,CAAC,IAAI,EAAG,OAAO,CAAU;IACjC,OAAO,CAAC,QAAQ,CAAS;gBAEb,QAAQ,CAAC,EAAE,MAAM;IAQ7B,IAAI,IAAI,OAAO,EAAE;IAYjB,MAAM,CAAC,MAAM,EAAE,OAAO,GAAG,IAAI;IAQ7B,KAAK,IAAI,IAAI;CAWd;AA8BD,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAE,OAAO,CAAC,aAAa,CAAM,GAAG,cAAc,CAAC,OAAO,CAAC,CAY1G"}

package/dist/storage/adapters.js

@@ -0,0 +1,123 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.JsonlStorageAdapter = exports.MemoryStorageAdapter = void 0;
+exports.createStorageAdapter = createStorageAdapter;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const constants_1 = require("../config/constants");
+class MemoryStorageAdapter {
+    constructor() {
+        this.type = 'memory';
+        this.records = [];
+    }
+    load() {
+        return [...this.records];
+    }
+    append(record) {
+        this.records.push(record);
+    }
+    clear() {
+        this.records = [];
+    }
+}
+exports.MemoryStorageAdapter = MemoryStorageAdapter;
+class JsonlStorageAdapter {
+    constructor(filePath) {
+        this.type = 'jsonl';
+        const appDir = path.join(os.homedir(), constants_1.PATHS.APP_DIR);
+        if (!fs.existsSync(appDir)) {
+            fs.mkdirSync(appDir, { recursive: true });
+        }
+        this.filePath = filePath || path.join(appDir, constants_1.PATHS.HISTORY_FILE);
+    }
+    load() {
+        if (!fs.existsSync(this.filePath)) {
+            return [];
+        }
+        return fs
+            .readFileSync(this.filePath, 'utf-8')
+            .split('\n')
+            .filter((line) => line.trim().length > 0)
+            .map((line) => JSON.parse(line));
+    }
+    append(record) {
+        const dir = path.dirname(this.filePath);
+        if (!fs.existsSync(dir)) {
+            fs.mkdirSync(dir, { recursive: true });
+        }
+        fs.appendFileSync(this.filePath, JSON.stringify(record) + '\n', 'utf-8');
+    }
+    clear() {
+        try {
+            if (fs.existsSync(this.filePath)) {
+                fs.unlinkSync(this.filePath);
+            }
+        }
+        catch (error) {
+            if (error?.code !== 'ENOENT') {
+                throw error;
+            }
+        }
+    }
+}
+exports.JsonlStorageAdapter = JsonlStorageAdapter;
+class OptionalExternalStorageAdapter {
+    constructor(type) {
+        this.type = type;
+        this.name = type === 'sqlite' ? 'SQLite' : 'Postgres';
+    }
+    load() {
+        throw new Error(`${this.name} storage is configured but the production adapter is not installed in this package build yet. Use "jsonl" or "memory", or provide a custom adapter with createStorageAdapter().`);
+    }
+    append() {
+        throw new Error(`${this.name} storage is configured but the production adapter is not installed in this package build yet. Use "jsonl" or "memory", or provide a custom adapter with createStorageAdapter().`);
+    }
+    clear() {
+        throw new Error(`${this.name} storage is configured but the production adapter is not installed in this package build yet. Use "jsonl" or "memory", or provide a custom adapter with createStorageAdapter().`);
+    }
+}
+function createStorageAdapter(config = {}) {
+    const adapter = config.adapter || 'jsonl';
+    if (adapter === 'memory') {
+        return new MemoryStorageAdapter();
+    }
+    if (adapter === 'jsonl') {
+        return new JsonlStorageAdapter(config.path);
+    }
+    return new OptionalExternalStorageAdapter(adapter);
+}
+//# sourceMappingURL=adapters.js.map

package/dist/storage/adapters.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"adapters.js","sourceRoot":"","sources":["../../src/storage/adapters.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuGA,oDAYC;AAnHD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,mDAA4C;AAU5C,MAAa,oBAAoB;IAAjC;QACW,SAAI,GAAG,QAAiB,CAAC;QAC1B,YAAO,GAAc,EAAE,CAAC;IAalC,CAAC;IAXC,IAAI;QACF,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3B,CAAC;IAED,MAAM,CAAC,MAAe;QACpB,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC;IAED,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,EAAE,CAAC;IACpB,CAAC;CACF;AAfD,oDAeC;AAED,MAAa,mBAAmB;IAI9B,YAAY,QAAiB;QAHpB,SAAI,GAAG,OAAgB,CAAC;QAI/B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAK,CAAC,OAAO,CAAC,CAAC;QACtD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5C,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,QAAQ,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,iBAAK,CAAC,YAAY,CAAC,CAAC;IACpE,CAAC;IAED,IAAI;QACF,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClC,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,OAAO,EAAE;aACN,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC;aACpC,KAAK,CAAC,IAAI,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;aACxC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC;IAChD,CAAC;IAED,MAAM,CAAC,MAAe;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3E,CAAC;IAED,KAAK;QACH,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACjC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;IACH,CAAC;CACF;AA3CD,kDA2CC;AAED,MAAM,8BAA8B;IAIlC,YAAY,IAA2B;QACrC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,IAAI,GAAG,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC;IACxD,CAAC;IAED,IAAI;QACF,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,iLAAiL,CAC9L,CAAC;IACJ,CAAC;IAED,MAAM;QACJ,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,iLAAiL,CAC9L,CAAC;IACJ,CAAC;IAED,KAAK;QACH,MAAM,IAAI,KAAK,CACb,GAAG,IAAI,CAAC,IAAI,iLAAiL,CAC9L,CAAC;IACJ,CAAC;CACF;AAED,SAAgB,oBAAoB,CAAU,SAAiC,EAAE;IAC/E,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;IAE1C,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,OAAO,IAAI,oBAAoB,EAAW,CAAC;IAC7C,CAAC;IAED,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QACxB,OAAO,IAAI,mBAAmB,CAAU,MAAM,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC;IAED,OAAO,IAAI,8BAA8B,CAAU,OAAO,CAAC,CAAC;AAC9D,CAAC"}

package/dist/storage/index.d.ts

@@ -0,0 +1,2 @@
+export { StorageAdapter, MemoryStorageAdapter, JsonlStorageAdapter, createStorageAdapter } from './adapters';
+//# sourceMappingURL=index.d.ts.map

package/dist/storage/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC"}

package/dist/storage/index.js

@@ -0,0 +1,8 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createStorageAdapter = exports.JsonlStorageAdapter = exports.MemoryStorageAdapter = void 0;
+var adapters_1 = require("./adapters");
+Object.defineProperty(exports, "MemoryStorageAdapter", { enumerable: true, get: function () { return adapters_1.MemoryStorageAdapter; } });
+Object.defineProperty(exports, "JsonlStorageAdapter", { enumerable: true, get: function () { return adapters_1.JsonlStorageAdapter; } });
+Object.defineProperty(exports, "createStorageAdapter", { enumerable: true, get: function () { return adapters_1.createStorageAdapter; } });
+//# sourceMappingURL=index.js.map

package/dist/storage/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/storage/index.ts"],"names":[],"mappings":";;;AAAA,uCAA6G;AAApF,gHAAA,oBAAoB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AAAE,gHAAA,oBAAoB,OAAA"}

package/dist/tests/b2b-hardening.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=b2b-hardening.test.d.ts.map

package/dist/tests/b2b-hardening.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"b2b-hardening.test.d.ts","sourceRoot":"","sources":["../../src/tests/b2b-hardening.test.ts"],"names":[],"mappings":""}

package/dist/tests/b2b-hardening.test.js

@@ -0,0 +1,164 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const DetectionEngine_1 = require("../core/DetectionEngine");
+const config_1 = require("../config");
+describe('B2B production hardening', () => {
+    let engine;
+    let config;
+    let originalConfig;
+    beforeEach(() => {
+        engine = DetectionEngine_1.DetectionEngine.getInstance();
+        config = new config_1.ConfigManager();
+        originalConfig = config.getConfig();
+        engine.clear();
+    });
+    afterEach(() => {
+        config.updateConfig(originalConfig);
+        engine.reset();
+    });
+    test('stores hash-only prompt history by default', () => {
+        config.updateConfig({
+            privacy: {
+                ...originalConfig.privacy,
+                promptStorage: 'hash',
+            },
+        });
+        engine.reset();
+        const secretPrompt = 'customer email test@example.com with api key sk-testsecret1234567890';
+        engine.analyze({
+            model: 'gpt-4',
+            prompt: secretPrompt,
+            estimatedCost: 0.001,
+        });
+        const historyPath = path.join(os.homedir(), '.aifw', 'history.jsonl');
+        const persisted = fs.readFileSync(historyPath, 'utf-8');
+        expect(persisted).not.toContain(secretPrompt);
+        expect(persisted).not.toContain('test@example.com');
+        expect(persisted).toContain('[hash:');
+    });
+    test('applies scoped daily budgets from request metadata', () => {
+        config.updateConfig({
+            trustMode: 'block',
+            budgets: {
+                ...originalConfig.budgets,
+                perRequestUsd: 1,
+                dailyUsd: 50,
+                monthlyUsd: 1000,
+            },
+            policies: [
+                {
+                    id: 'tenant-low-budget',
+                    scope: { orgId: 'org-low' },
+                    budgets: { dailyUsd: 0.015 },
+                },
+            ],
+        });
+        engine.reset();
+        const first = engine.analyze({
+            model: 'gpt-4',
+            prompt: 'first tenant budget request',
+            estimatedCost: 0.01,
+            metadata: { orgId: 'org-low', userId: 'user-1' },
+        });
+        expect(first.decision).toBe('allow');
+        const second = engine.analyze({
+            model: 'gpt-4',
+            prompt: 'second unrelated tenant request',
+            estimatedCost: 0.01,
+            metadata: { orgId: 'org-low', userId: 'user-1' },
+        });
+        expect(second.decision).toBe('block');
+        expect(second.category).toBe('budget');
+        expect(second.metadata.policyId).toBe('tenant-low-budget');
+    });
+    test('scoped budgets block before cost-spike warnings in warn mode', () => {
+        config.updateConfig({
+            trustMode: 'warn',
+            policies: [
+                {
+                    id: 'tenant-hard-cap',
+                    scope: { orgId: 'org-hard-cap' },
+                    budgets: {
+                        perRequestUsd: 0.05,
+                        dailyUsd: 1,
+                        monthlyUsd: 10,
+                    },
+                },
+            ],
+        });
+        engine.reset();
+        const result = engine.analyze({
+            model: 'gpt-4',
+            prompt: 'request over tenant cap',
+            estimatedCost: 0.1,
+            trustMode: 'warn',
+            metadata: { orgId: 'org-hard-cap' },
+        });
+        expect(result.decision).toBe('block');
+        expect(result.category).toBe('budget');
+        expect(result.metadata.policyId).toBe('tenant-hard-cap');
+    });
+    test('registers custom pricing models and aliases', () => {
+        (0, config_1.registerPricingModel)('acme-agent-model', {
+            provider: 'custom',
+            inputPrice: 0.002,
+            outputPrice: 0.004,
+            cachedInputPrice: 0.001,
+            aliases: ['openrouter/acme-agent-model'],
+        });
+        const pricing = (0, config_1.getModelPricing)('openrouter/acme-agent-model');
+        const cost = (0, config_1.estimateCost)('openrouter/acme-agent-model', 1000, 1000, {
+            cachedInputTokens: 500,
+        });
+        expect(pricing?.model).toBe('acme-agent-model');
+        expect(cost).toBeCloseTo(0.0055);
+    });
+    test('returns budget status for metadata scopes', () => {
+        engine.analyze({
+            model: 'gpt-4',
+            prompt: 'budget status request',
+            estimatedCost: 0.01,
+            metadata: { orgId: 'org-status', workflowId: 'wf-1' },
+        });
+        const status = engine.getBudgetStatus({ orgId: 'org-status', workflowId: 'wf-1' });
+        expect(status.dailySpend).toBeCloseTo(0.01);
+        expect(status.workflowSpend).toBeCloseTo(0.01);
+    });
+});
+//# sourceMappingURL=b2b-hardening.test.js.map

package/dist/tests/b2b-hardening.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"b2b-hardening.test.js","sourceRoot":"","sources":["../../src/tests/b2b-hardening.test.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAC7B,6DAA0D;AAC1D,sCAA+F;AAE/F,QAAQ,CAAC,0BAA0B,EAAE,GAAG,EAAE;IACxC,IAAI,MAAuB,CAAC;IAC5B,IAAI,MAAqB,CAAC;IAC1B,IAAI,cAAsD,CAAC;IAE3D,UAAU,CAAC,GAAG,EAAE;QACd,MAAM,GAAG,iCAAe,CAAC,WAAW,EAAE,CAAC;QACvC,MAAM,GAAG,IAAI,sBAAa,EAAE,CAAC;QAC7B,cAAc,GAAG,MAAM,CAAC,SAAS,EAAE,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,YAAY,CAAC,cAAc,CAAC,CAAC;QACpC,MAAM,CAAC,KAAK,EAAE,CAAC;IACjB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACtD,MAAM,CAAC,YAAY,CAAC;YAClB,OAAO,EAAE;gBACP,GAAG,cAAc,CAAC,OAAO;gBACzB,aAAa,EAAE,MAAM;aACtB;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,YAAY,GAAG,sEAAsE,CAAC;QAE5F,MAAM,CAAC,OAAO,CAAC;YACb,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,YAAY;YACpB,aAAa,EAAE,KAAK;SACrB,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,eAAe,CAAC,CAAC;QACtE,MAAM,SAAS,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QAExD,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC9C,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,kBAAkB,CAAC,CAAC;QACpD,MAAM,CAAC,SAAS,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACxC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,oDAAoD,EAAE,GAAG,EAAE;QAC9D,MAAM,CAAC,YAAY,CAAC;YAClB,SAAS,EAAE,OAAO;YAClB,OAAO,EAAE;gBACP,GAAG,cAAc,CAAC,OAAO;gBACzB,aAAa,EAAE,CAAC;gBAChB,QAAQ,EAAE,EAAE;gBACZ,UAAU,EAAE,IAAI;aACjB;YACD,QAAQ,EAAE;gBACR;oBACE,EAAE,EAAE,mBAAmB;oBACvB,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE;oBAC3B,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;iBAC7B;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,6BAA6B;YACrC,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;SACjD,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAErC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;YAC5B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,iCAAiC;YACzC,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE;SACjD,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACxE,MAAM,CAAC,YAAY,CAAC;YAClB,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE;gBACR;oBACE,EAAE,EAAE,iBAAiB;oBACrB,KAAK,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;oBAChC,OAAO,EAAE;wBACP,aAAa,EAAE,IAAI;wBACnB,QAAQ,EAAE,CAAC;wBACX,UAAU,EAAE,EAAE;qBACf;iBACF;aACF;SACF,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QAEf,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC;YAC5B,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,yBAAyB;YACjC,aAAa,EAAE,GAAG;YAClB,SAAS,EAAE,MAAM;YACjB,QAAQ,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE;SACpC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACvC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,IAAA,6BAAoB,EAAC,kBAAkB,EAAE;YACvC,QAAQ,EAAE,QAAQ;YAClB,UAAU,EAAE,KAAK;YACjB,WAAW,EAAE,KAAK;YAClB,gBAAgB,EAAE,KAAK;YACvB,OAAO,EAAE,CAAC,6BAA6B,CAAC;SACzC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,IAAA,wBAAe,EAAC,6BAA6B,CAAC,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAA,qBAAY,EAAC,6BAA6B,EAAE,IAAI,EAAE,IAAI,EAAE;YACnE,iBAAiB,EAAE,GAAG;SACvB,CAAC,CAAC;QAEH,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAChD,MAAM,CAAC,IAAI,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,OAAO,CAAC;YACb,KAAK,EAAE,OAAO;YACd,MAAM,EAAE,uBAAuB;YAC/B,aAAa,EAAE,IAAI;YACnB,QAAQ,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE;SACtD,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC;QAEnF,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;QAC5C,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACjD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/cli.contract.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=cli.contract.test.d.ts.map

package/dist/tests/cli.contract.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.contract.test.d.ts","sourceRoot":"","sources":["../../src/tests/cli.contract.test.ts"],"names":[],"mappings":""}

package/dist/tests/cli.contract.test.js

@@ -0,0 +1,28 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const outputContract_1 = require("../cli/outputContract");
+describe('CLI Output Contract', () => {
+    test('validates frozen schema shape', () => {
+        const output = (0, outputContract_1.createCliOutputContract)('report', { hours: 24, stats: { totalRequests: 1 } }, {
+            total_cost_saved: 1.23,
+            blocked_requests_count: 2,
+            false_positive_indicator: 0.1,
+            avg_analysis_latency_ms: 1.5,
+            storage_backend: 'file',
+        });
+        expect((0, outputContract_1.validateCliOutputContract)(output)).toBe(true);
+    });
+    test('snapshot protects output contract', () => {
+        const output = (0, outputContract_1.createCliOutputContract)('metrics', { hours: 24 }, {
+            total_cost_saved: 10.5,
+            blocked_requests_count: 7,
+            false_positive_indicator: 0.2,
+            avg_analysis_latency_ms: 0.9,
+            storage_backend: 'redis',
+        });
+        expect(output).toMatchSnapshot({
+            timestamp: expect.any(String),
+        });
+    });
+});
+//# sourceMappingURL=cli.contract.test.js.map

package/dist/tests/cli.contract.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.contract.test.js","sourceRoot":"","sources":["../../src/tests/cli.contract.test.ts"],"names":[],"mappings":";;AAAA,0DAA2F;AAE3F,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,IAAI,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,IAAA,wCAAuB,EACpC,QAAQ,EACR,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,aAAa,EAAE,CAAC,EAAE,EAAE,EAC1C;YACE,gBAAgB,EAAE,IAAI;YACtB,sBAAsB,EAAE,CAAC;YACzB,wBAAwB,EAAE,GAAG;YAC7B,uBAAuB,EAAE,GAAG;YAC5B,eAAe,EAAE,MAAM;SACxB,CACF,CAAC;QACF,MAAM,CAAC,IAAA,0CAAyB,EAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,mCAAmC,EAAE,GAAG,EAAE;QAC7C,MAAM,MAAM,GAAG,IAAA,wCAAuB,EACpC,SAAS,EACT,EAAE,KAAK,EAAE,EAAE,EAAE,EACb;YACE,gBAAgB,EAAE,IAAI;YACtB,sBAAsB,EAAE,CAAC;YACzB,wBAAwB,EAAE,GAAG;YAC7B,uBAAuB,EAAE,GAAG;YAC5B,eAAe,EAAE,OAAO;SACzB,CACF,CAAC;QACF,MAAM,CAAC,MAAM,CAAC,CAAC,eAAe,CAAC;YAC7B,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC;SAC9B,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/tests/cli.snapshot.test.d.ts

@@ -0,0 +1,14 @@
+/**
+ * CLI OUTPUT FORMAT SNAPSHOT TESTS
+ * Freezes CLI output format to prevent string drift
+ *
+ * These tests use snapshot-style exact matching to ensure
+ * CLI output format never changes without explicit intent.
+ *
+ * If you need to change the format:
+ * 1. Update the test expectations
+ * 2. Document the change in CHANGELOG
+ * 3. Update any dependent integrations
+ */
+export {};
+//# sourceMappingURL=cli.snapshot.test.d.ts.map

package/dist/tests/cli.snapshot.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.snapshot.test.d.ts","sourceRoot":"","sources":["../../src/tests/cli.snapshot.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG"}