avantgate 1.6.1 → 1.7.0

package/dist/input-guard.d.ts

@@ -6,8 +6,8 @@ export interface InputGuardResult {
     valid: boolean;
     blockedReason?: string;
 }
-export declare function validateUserInput(input: string, options?: {
+export declare const validateUserInput: (input: string, options?: {
     detectInjection?: boolean;
     maxLength?: number;
-}): InputGuardResult;
+}) => InputGuardResult;
 //# sourceMappingURL=input-guard.d.ts.map

package/dist/input-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"input-guard.d.ts","sourceRoot":"","sources":["../src/input-guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,GAC1D,gBAAgB,CAqBlB"}
+{"version":3,"file":"input-guard.d.ts","sourceRoot":"","sources":["../src/input-guard.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAWH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,UAAU;IAAE,eAAe,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAE,KAC1D,gBAqBF,CAAA"}

package/dist/pricing.d.ts

@@ -1,5 +1,6 @@
 import type { ModelPrice, PricingAdapter } from "./types";
 export type { ModelPrice, PricingAdapter };
+export * from "./sqlite-pricing-adapter";
 export interface CalculateCostOptions {
     provider?: string;
     providerPricing?: ModelPrice;
@@ -17,10 +18,10 @@ export declare class CachedPricingAdapter implements PricingAdapter {
     private ttlMs;
     private delegate;
     constructor(delegate: PricingAdapter, ttlMs?: number);
-    fetchPrice(model: string, provider?: string): Promise<ModelPrice | undefined>;
-    peek(model: string, provider?: string): ModelPrice | undefined;
-    clearCache(): void;
-    invalidate(model?: string, provider?: string): void;
+    fetchPrice: (model: string, provider?: string) => Promise<ModelPrice | undefined>;
+    peek: (model: string, provider?: string) => ModelPrice | undefined;
+    clearCache: () => void;
+    invalidate: (model?: string, provider?: string) => void;
 }
 /**
  * Registre de tarification dynamique.
@@ -29,21 +30,21 @@ export declare class CachedPricingAdapter implements PricingAdapter {
 export declare class PricingRegistry {
     private static prices;
     private static adapter?;
-    static registerPrice(identifier: string, price: ModelPrice): void;
-    static registerDistributorPrices(distributor: string, priceMap: Record<string, ModelPrice>): void;
-    static registerPrices(prices: Record<string, ModelPrice>): void;
-    static getPrice(model: string, provider?: string): ModelPrice | undefined;
-    static setAdapter(adapter: PricingAdapter): void;
-    static getAdapter(): PricingAdapter | undefined;
-    static clear(): void;
+    static registerPrice: (identifier: string, price: ModelPrice) => void;
+    static registerDistributorPrices: (distributor: string, priceMap: Record<string, ModelPrice>) => void;
+    static registerPrices: (prices: Record<string, ModelPrice>) => void;
+    static getPrice: (model: string, provider?: string) => ModelPrice | undefined;
+    static setAdapter: (adapter: PricingAdapter) => void;
+    static getAdapter: () => PricingAdapter | undefined;
+    static clear: () => void;
     /**
      * Réinitialise le registre en chargeant le catalogue d'exemple SEED_MODEL_PRICES.
      */
-    static loadSeedPrices(): void;
-    static getAllPrices(): Record<string, ModelPrice>;
+    static loadSeedPrices: () => void;
+    static getAllPrices: () => Record<string, ModelPrice>;
 }
 export declare const DEFAULT_MODEL_PRICES: Record<string, ModelPrice>;
-export declare function resolveModelPrice(model: string, options?: CalculateCostOptions | string): ModelPrice | undefined;
-export declare function resolveModelPriceAsync(model: string, options?: CalculateCostOptions | string): Promise<ModelPrice | undefined>;
-export declare function calculateCostUSD(model: string, promptTokens: number, completionTokens: number, cacheHitTokens?: number, options?: CalculateCostOptions | string): number;
+export declare const resolveModelPrice: (model: string, options?: CalculateCostOptions | string) => ModelPrice | undefined;
+export declare const resolveModelPriceAsync: (model: string, options?: CalculateCostOptions | string) => Promise<ModelPrice | undefined>;
+export declare const calculateCostUSD: (model: string, promptTokens: number, completionTokens: number, cacheHitTokens?: number, options?: CalculateCostOptions | string) => number;
 //# sourceMappingURL=pricing.d.ts.map

package/dist/pricing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../src/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAE3C,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA0BxD,CAAC;AAMF,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,KAAK,CAA+D;IAC5E,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAiB;gBAErB,QAAQ,EAAE,cAAc,EAAE,KAAK,GAAE,MAAsB;IAK7D,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC;IAwBnF,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAK9D,UAAU,IAAI,IAAI;IAIlB,UAAU,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI;CAQpD;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAiC;IACtD,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAiB;IAExC,MAAM,CAAC,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,IAAI;IAIjE,MAAM,CAAC,yBAAyB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI;IAMjG,MAAM,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,IAAI;IAM/D,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,SAAS;IAWzE,MAAM,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI;IAIhD,MAAM,CAAC,UAAU,IAAI,cAAc,GAAG,SAAS;IAI/C,MAAM,CAAC,KAAK,IAAI,IAAI;IAKpB;;OAEG;IACH,MAAM,CAAC,cAAc,IAAI,IAAI;IAI7B,MAAM,CAAC,YAAY,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC;CAOlD;AAGD,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAiB1D,CAAC;AAEH,wBAAgB,iBAAiB,CAC/B,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM,GACtC,UAAU,GAAG,SAAS,CA2CxB;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM,GACtC,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAiBjC;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,MAAM,EACb,YAAY,EAAE,MAAM,EACpB,gBAAgB,EAAE,MAAM,EACxB,cAAc,GAAE,MAAU,EAC1B,OAAO,CAAC,EAAE,oBAAoB,GAAG,MAAM,GACtC,MAAM,CAcR"}
+{"version":3,"file":"pricing.d.ts","sourceRoot":"","sources":["../src/pricing.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC1D,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,CAAC;AAC3C,cAAc,0BAA0B,CAAC;AAEzC,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,UAAU,CAAC;IAC7B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,OAAO,CAAC,EAAE,cAAc,CAAC;CAC1B;AAED;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CA0BxD,CAAC;AAMF,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,KAAK,CAA+D;IAC5E,OAAO,CAAC,KAAK,CAAS;IACtB,OAAO,CAAC,QAAQ,CAAiB;gBAErB,QAAQ,EAAE,cAAc,EAAE,KAAK,GAAE,MAAsB;IAKnE,UAAU,GAAU,OAAO,MAAM,EAAE,WAAW,MAAM,KAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,CAsBpF;IAEF,IAAI,GAAI,OAAO,MAAM,EAAE,WAAW,MAAM,KAAG,UAAU,GAAG,SAAS,CAO/D;IAEF,UAAU,QAAO,IAAI,CAEnB;IAEF,UAAU,GAAI,QAAQ,MAAM,EAAE,WAAW,MAAM,KAAG,IAAI,CAOpD;CACH;AAED;;;GAGG;AACH,qBAAa,eAAe;IAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAiC;IACtD,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAiB;IAExC,MAAM,CAAC,aAAa,GAAI,YAAY,MAAM,EAAE,OAAO,UAAU,KAAG,IAAI,CAElE;IAEF,MAAM,CAAC,yBAAyB,GAAI,aAAa,MAAM,EAAE,UAAU,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,KAAG,IAAI,CAIlG;IAEF,MAAM,CAAC,cAAc,GAAI,QAAQ,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,KAAG,IAAI,CAIhE;IAEF,MAAM,CAAC,QAAQ,GAAI,OAAO,MAAM,EAAE,WAAW,MAAM,KAAG,UAAU,GAAG,SAAS,CAS1E;IAEF,MAAM,CAAC,UAAU,GAAI,SAAS,cAAc,KAAG,IAAI,CAEjD;IAEF,MAAM,CAAC,UAAU,QAAO,cAAc,GAAG,SAAS,CAEhD;IAEF,MAAM,CAAC,KAAK,QAAO,IAAI,CAGrB;IAEF;;OAEG;IACH,MAAM,CAAC,cAAc,QAAO,IAAI,CAE9B;IAEF,MAAM,CAAC,YAAY,QAAO,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAMlD;CACH;AAGD,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAiB1D,CAAC;AAEH,eAAO,MAAM,iBAAiB,GAC5B,OAAO,MAAM,EACb,UAAU,oBAAoB,GAAG,MAAM,KACtC,UAAU,GAAG,SA2Cf,CAAC;AAEF,eAAO,MAAM,sBAAsB,GACjC,OAAO,MAAM,EACb,UAAU,oBAAoB,GAAG,MAAM,KACtC,OAAO,CAAC,UAAU,GAAG,SAAS,CAiBhC,CAAC;AAEF,eAAO,MAAM,gBAAgB,GAC3B,OAAO,MAAM,EACb,cAAc,MAAM,EACpB,kBAAkB,MAAM,EACxB,iBAAgB,MAAU,EAC1B,UAAU,oBAAoB,GAAG,MAAM,KACtC,MAcF,CAAC"}

package/dist/providers/http-client.d.ts

@@ -9,10 +9,10 @@ export declare class HttpProviderClient implements LLMProviderPort {
     private buildHeaders;
     private buildPayload;
     private extractUsage;
-    complete(options: LLMCompletionOptions): Promise<{
+    complete: (options: LLMCompletionOptions) => Promise<{
         text: string;
         usage?: LLMUsage;
     }>;
 }
-export declare function createHttpProviderClient(config: ProviderConfig): HttpProviderClient;
+export declare const createHttpProviderClient: (config: ProviderConfig) => HttpProviderClient;
 //# sourceMappingURL=http-client.d.ts.map

package/dist/providers/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/providers/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,QAAQ,EAER,cAAc,EACf,MAAM,UAAU,CAAC;AA+BlB,qBAAa,kBAAmB,YAAW,eAAe;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,MAAM,EAAE,cAAc;IAOlC,OAAO,CAAC,eAAe;IAQvB,OAAO,CAAC,YAAY;IAiBpB,OAAO,CAAC,YAAY;IAYpB,OAAO,CAAC,YAAY;IAYd,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC;CAyB3F;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,cAAc,GAAG,kBAAkB,CAEnF"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/providers/http-client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,eAAe,EACf,oBAAoB,EACpB,QAAQ,EAER,cAAc,EACf,MAAM,UAAU,CAAC;AA+BlB,qBAAa,kBAAmB,YAAW,eAAe;IACxD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAS;gBAE1B,MAAM,EAAE,cAAc;IAOlC,OAAO,CAAC,eAAe,CAMrB;IAEF,OAAO,CAAC,YAAY,CAelB;IAEF,OAAO,CAAC,YAAY,CAUlB;IAEF,OAAO,CAAC,YAAY,CAUlB;IAEF,QAAQ,GAAU,SAAS,oBAAoB,KAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAwB3F;CACH;AAED,eAAO,MAAM,wBAAwB,GAAI,QAAQ,cAAc,KAAG,kBAEjE,CAAC"}

package/dist/response-validator.d.ts

@@ -9,10 +9,10 @@ export interface ValidateOptions {
  * Nettoie et extrait un bloc JSON valide depuis une réponse de LLM
  * (gère les blocs markdown ```json ... ```, les balises de réflexion, etc.)
  */
-export declare function extractAndCleanJSON(rawText: string): string;
+export declare const extractAndCleanJSON: (rawText: string) => string;
 /**
  * Valide et auto-répare une sortie JSON contre un schéma Zod.
  * Supporte l'option de normalisation financière (parenthèses négatives, formats comptables).
  */
-export declare function validateWithZod<T>(rawText: string, schema: z.ZodType<T>, options?: ValidateOptions): T;
+export declare const validateWithZod: <T>(rawText: string, schema: z.ZodType<T>, options?: ValidateOptions) => T;
 //# sourceMappingURL=response-validator.d.ts.map

package/dist/response-validator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"response-validator.d.ts","sourceRoot":"","sources":["../src/response-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,yBAAyB,CAAC;CAC1C;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAkC3D;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,CAAC,EAC/B,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,OAAO,CAAC,EAAE,eAAe,GACxB,CAAC,CAsBH"}
+{"version":3,"file":"response-validator.d.ts","sourceRoot":"","sources":["../src/response-validator.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8BAA8B,CAAC;AAE9E,MAAM,WAAW,eAAe;IAC9B,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IACzC,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,YAAY,CAAC,EAAE,yBAAyB,CAAC;CAC1C;AAED;;;GAGG;AACH,eAAO,MAAM,mBAAmB,GAAI,SAAS,MAAM,KAAG,MAkCrD,CAAA;AAED;;;GAGG;AACH,eAAO,MAAM,eAAe,GAAI,CAAC,EAC/B,SAAS,MAAM,EACf,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EACpB,UAAU,eAAe,KACxB,CAsBF,CAAA"}

package/dist/sanitizer.d.ts

@@ -7,5 +7,5 @@ export interface SanitizeResult {
     text: string;
     maskedCount: number;
 }
-export declare function sanitizePII(input: string): SanitizeResult;
+export declare const sanitizePII: (input: string) => SanitizeResult;
 //# sourceMappingURL=sanitizer.d.ts.map

package/dist/sanitizer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../src/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,CA2DzD"}
+{"version":3,"file":"sanitizer.d.ts","sourceRoot":"","sources":["../src/sanitizer.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAkBH,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,eAAO,MAAM,WAAW,GAAI,OAAO,MAAM,KAAG,cA2D3C,CAAA"}

package/dist/sqlite-pricing-adapter.d.ts

@@ -0,0 +1,87 @@
+import type { ModelPrice, PricingAdapter } from "./types";
+export interface SqliteDatabaseLike {
+    exec(sql: string): void;
+    prepare(sql: string): {
+        run(...params: unknown[]): unknown;
+        all(...params: unknown[]): unknown[];
+        get(...params: unknown[]): unknown;
+    };
+    close?(): void;
+}
+export interface SqlitePricingAdapterOptions {
+    /**
+     * Chemin vers le fichier SQLite local (par exemple "./data/gatewall.db" ou "./data/pricing.db").
+     * Utilisez ":memory:" pour une base volatile en mémoire.
+     */
+    dbPath?: string;
+    /**
+     * Instance personnalisée compatible SQLite (DatabaseSync de node:sqlite ou better-sqlite3).
+     */
+    db?: SqliteDatabaseLike;
+    /**
+     * Nom de la table de tarification (défaut : "model_pricing").
+     */
+    tableName?: string;
+    /**
+     * Si true, injecte automatiquement SEED_MODEL_PRICES si la table est vide lors de l'initialisation.
+     */
+    autoSeed?: boolean;
+}
+export interface StoredModelPriceRow {
+    provider: string;
+    model: string;
+    prompt_usd_per_million: number;
+    completion_usd_per_million: number;
+    cache_hit_usd_per_million: number | null;
+    is_active: number;
+    updated_at: string;
+}
+export interface ModelPricingRecord {
+    provider: string;
+    model: string;
+    price: ModelPrice;
+    isActive: boolean;
+    updatedAt: string;
+}
+/**
+ * Adaptateur de tarification SQLite Zero-Infrastructure pour avantGate.
+ * Implémente le port PricingAdapter avec persistance locale et support hot-reload.
+ */
+export declare class SqlitePricingAdapter implements PricingAdapter {
+    private db;
+    private tableName;
+    constructor(options?: SqlitePricingAdapterOptions);
+    private initDatabase;
+    private initSchema;
+    /**
+     * Implémentation du port avantGate PricingAdapter.
+     * Résolution hiérarchique : (provider, model) -> (provider/model) -> (model).
+     */
+    fetchPrice: (model: string, provider?: string) => ModelPrice | undefined;
+    private queryActiveRow;
+    private queryByModelOnly;
+    private mapRowToPrice;
+    /**
+     * Enregistre ou met à jour la tarification d'un modèle.
+     */
+    upsertPrice: (provider: string, model: string, price: ModelPrice, isActive?: boolean) => void;
+    /**
+     * Supprime une règle tarifaire de la base de données.
+     */
+    deletePrice: (provider: string, model: string) => boolean;
+    /**
+     * Retourne l'ensemble des règles tarifaires enregistrées.
+     */
+    getAllPrices: () => ModelPricingRecord[];
+    /**
+     * Remplit la base avec le catalogue de départ SEED_MODEL_PRICES.
+     * @param force Si true, écrase les tarifs existants. Si false, insère uniquement les modèles manquants.
+     * @returns Le nombre d'enregistrements insérés.
+     */
+    seedDefaultPrices: (force?: boolean) => number;
+    /**
+     * Ferme la connexion SQLite sous-jacente si supporté.
+     */
+    close: () => void;
+}
+//# sourceMappingURL=sqlite-pricing-adapter.d.ts.map

package/dist/sqlite-pricing-adapter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sqlite-pricing-adapter.d.ts","sourceRoot":"","sources":["../src/sqlite-pricing-adapter.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAI1D,MAAM,WAAW,kBAAkB;IACjC,IAAI,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG;QACpB,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;QACnC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAAC;QACrC,GAAG,CAAC,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC;KACpC,CAAC;IACF,KAAK,CAAC,IAAI,IAAI,CAAC;CAChB;AAED,MAAM,WAAW,2BAA2B;IAC1C;;;OAGG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;OAEG;IACH,EAAE,CAAC,EAAE,kBAAkB,CAAC;IACxB;;OAEG;IACH,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,sBAAsB,EAAE,MAAM,CAAC;IAC/B,0BAA0B,EAAE,MAAM,CAAC;IACnC,yBAAyB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,UAAU,CAAC;IAClB,QAAQ,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAMD;;;GAGG;AACH,qBAAa,oBAAqB,YAAW,cAAc;IACzD,OAAO,CAAC,EAAE,CAAqB;IAC/B,OAAO,CAAC,SAAS,CAAS;gBAEd,OAAO,GAAE,2BAAgC;IAUrD,OAAO,CAAC,YAAY,CAmBlB;IAEF,OAAO,CAAC,UAAU,CAehB;IAEF;;;OAGG;IACH,UAAU,GAAI,OAAO,MAAM,EAAE,WAAW,MAAM,KAAG,UAAU,GAAG,SAAS,CAyBrE;IAEF,OAAO,CAAC,cAAc,CAQpB;IAEF,OAAO,CAAC,gBAAgB,CAQtB;IAEF,OAAO,CAAC,aAAa,CAQnB;IAEF;;OAEG;IACH,WAAW,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,EAAE,OAAO,UAAU,EAAE,WAAU,OAAc,KAAG,IAAI,CAoBhG;IAEF;;OAEG;IACH,WAAW,GAAI,UAAU,MAAM,EAAE,OAAO,MAAM,KAAG,OAAO,CAUtD;IAEF;;OAEG;IACH,YAAY,QAAO,kBAAkB,EAAE,CAerC;IAEF;;;;OAIG;IACH,iBAAiB,GAAI,QAAO,OAAe,KAAG,MAAM,CAgDlD;IAEF;;OAEG;IACH,KAAK,QAAO,IAAI,CAId;CACH"}

package/dist/workflow/index.js

@@ -89,7 +89,7 @@ var SPI_LABELLED_REGEX = /(?:(?:num[ée]ro\s+fiscal|spi|n[°o]\s*fiscal|d[ée]cl
 var SPI_FORMATTED_REGEX = /\b[0-3]\d(?:\s+\d{2}){5}\s+\d\b/g;
 var IBAN_REGEX = /\b[A-Z]{2}\s*[0-9]{2}(?:[\s\r\n.-]*[A-Z0-9]){11,30}\b/g;
 var BIC_LABELLED_REGEX = /(?:(?:bic|swift)\s*[:=]?\s*)\b([A-Z]{4}[A-Z]{2}[A-Z0-9]{2}(?:[A-Z0-9]{3})?)\b/gi;
-function sanitizePII(input) {
+var sanitizePII = (input) => {
   let count = 0;
   let result = input;
   result = result.replace(EMAIL_REGEX, () => {
@@ -132,7 +132,7 @@ function sanitizePII(input) {
     return match;
   });
   return { text: result, maskedCount: count };
-}
+};
 
 // src/agent/guardrails.ts
 function sanitizeString(value) {
@@ -187,7 +187,23 @@ function auditToolResult(data, options) {
 }
 
 // src/agent/isolated-tool.ts
-async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
+var verifyRoles = (configuredRoles, context, toolIdentifier) => {
+  if (!configuredRoles || configuredRoles.length === 0) {
+    return;
+  }
+  const userRoles = [
+    ...context.roles ?? [],
+    ...context.role ? [context.role] : []
+  ];
+  const hasAllowedRole = configuredRoles.some((role) => userRoles.includes(role));
+  if (!hasAllowedRole) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: insufficient role permissions"
+    );
+  }
+};
+var verifyDataAccessGuard = async (guard, args, context, toolIdentifier) => {
   if (!guard) {
     return;
   }
@@ -195,8 +211,55 @@ async function verifyDataAccessGuard(guard, args, context, toolIdentifier) {
   if (!isAllowed) {
     throw new ToolAccessDeniedError(toolIdentifier, "Access denied by data access guard");
   }
-}
-async function resolveInvalidationTags(config, args, rawResult, context) {
+};
+var verifyTenantIsolation = (assertTenant, rawResult, context, toolIdentifier) => {
+  if (!assertTenant) {
+    return;
+  }
+  if (!context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Access denied: missing session tenantId in execution context for multi-tenant tool"
+    );
+  }
+  const recordTenantId = assertTenant(rawResult);
+  if (recordTenantId && recordTenantId !== context.tenantId) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      `Cross-tenant IDOR access violation: record tenant '${recordTenantId}' does not match session tenant '${context.tenantId}'`
+    );
+  }
+};
+var verifyResourceOwnership = async (assertOwnership, rawResult, context, toolIdentifier) => {
+  if (!assertOwnership) {
+    return;
+  }
+  const isOwner = await assertOwnership(rawResult, context);
+  if (!isOwner) {
+    throw new ToolAccessDeniedError(
+      toolIdentifier,
+      "Ownership IDOR access violation: user does not own or have access to this resource"
+    );
+  }
+};
+var checkSuspiciousParameters = (parameters, toolName) => {
+  if (!parameters || typeof parameters !== "object") {
+    return;
+  }
+  const zodShape = parameters.shape;
+  if (!zodShape || typeof zodShape !== "object") {
+    return;
+  }
+  const suspiciousKeys = ["tenantId", "tenant_id", "ownerTenantId"];
+  for (const key of suspiciousKeys) {
+    if (key in zodShape) {
+      console.warn(
+        `[avantGate Security Warning] Tool '${toolName}' defines '${key}' as a model parameter. Tenancy should be inferred from the trusted server context (context.tenantId) rather than supplied by the untrusted model to prevent IDOR attacks.`
+      );
+    }
+  }
+};
+var resolveInvalidationTags = async (config, args, rawResult, context) => {
   if (!config.invalidationTags) {
     return void 0;
   }
@@ -205,33 +268,29 @@ async function resolveInvalidationTags(config, args, rawResult, context) {
     await context.onInvalidationTags(tags);
   }
   return tags;
-}
-async function dispatchClientData(rawResult, callback) {
+};
+var dispatchClientData = async (rawResult, callback) => {
   if (!callback) {
     return;
   }
   await callback(rawResult);
-}
-async function produceLlmPayload(rawResult, args, context, transformer) {
+};
+var produceLlmPayload = async (rawResult, args, context, transformer) => {
   if (transformer) {
     return await transformer(rawResult, args, context);
   }
   return rawResult;
-}
-function validateLlmDto(payload, schema, toolIdentifier) {
+};
+var validateLlmDto = (payload, schema, toolIdentifier) => {
   const parseResult = schema.safeParse(payload);
   if (!parseResult.success) {
     const issues = parseResult.error.issues ?? [];
     const errorMessages = issues.map((issue) => `${issue.path.join(".") || "root"}: ${issue.message}`).join(", ");
-    throw new DtoValidationError(
-      toolIdentifier,
-      errorMessages,
-      issues
-    );
+    throw new DtoValidationError(toolIdentifier, errorMessages, issues);
   }
   return parseResult.data;
-}
-function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnPii = false) {
+};
+var protectLlmPayload = (payload, toolIdentifier, sanitizePii = true, throwOnPii = false) => {
   if (!sanitizePii) {
     return { sanitized: payload, count: 0 };
   }
@@ -240,8 +299,8 @@ function protectLlmPayload(payload, toolIdentifier, sanitizePii = true, throwOnP
     throwOnPii
   });
   return { sanitized: sanitizedData, count: maskedCount };
-}
-async function processLlmPayload(rawResult, args, context, config, toolIdentifier) {
+};
+var processLlmPayload = async (rawResult, args, context, config, toolIdentifier) => {
   let payload = await produceLlmPayload(rawResult, args, context, config.llmDto);
   if (config.llmDtoSchema) {
     payload = validateLlmDto(payload, config.llmDtoSchema, toolIdentifier);
@@ -252,14 +311,15 @@ async function processLlmPayload(rawResult, args, context, config, toolIdentifie
     config.sanitizePii !== false,
     config.throwOnPii === true
   );
-}
-function createIsolatedTool(config) {
+};
+var createIsolatedTool = (config) => {
   const toolId = config.id || config.name;
   const toolAlias = config.alias;
   const clientCallback = config.clientDto;
   const toolIdentifier = toolAlias || config.name;
   const toolImpact = config.impact ?? "READ_ONLY";
   const requireApproval = config.requireApproval ?? toolImpact === "DESTRUCTIVE";
+  checkSuspiciousParameters(config.parameters, config.name);
   const tool = {
     description: config.description,
     parameters: config.parameters,
@@ -275,11 +335,12 @@ function createIsolatedTool(config) {
     _requireApproval: requireApproval,
     _lastPiiFilteredCount: 0,
     _lastInvalidationTags: void 0,
-    async execute(args, context) {
+    execute: async (args, context) => {
       const updatedContext = {
         ...context,
         callChain: context?.callChain ?? Object.freeze([toolId])
       };
+      verifyRoles(config.roles, updatedContext, toolIdentifier);
       await verifyDataAccessGuard(
         config.dataAccessGuard,
         args,
@@ -287,6 +348,13 @@ function createIsolatedTool(config) {
         toolIdentifier
       );
       const rawResult = await config.execute(args, updatedContext);
+      verifyTenantIsolation(config.assertTenant, rawResult, updatedContext, toolIdentifier);
+      await verifyResourceOwnership(
+        config.assertOwnership,
+        rawResult,
+        updatedContext,
+        toolIdentifier
+      );
       const tags = await resolveInvalidationTags(
         config,
         args,
@@ -309,7 +377,7 @@ function createIsolatedTool(config) {
     }
   };
   return tool;
-}
+};
 
 // src/workflow/errors.ts
 var WorkflowSagaRollbackError = class extends Error {

package/dist/workflow/index.mjs

@@ -5,8 +5,9 @@ import {
   defineWorkflow,
   executeWorkflow,
   isWorkflowAbortSignal
-} from "../chunk-4XWO3NZW.mjs";
-import "../chunk-5VA3EKPJ.mjs";
+} from "../chunk-AH5XXSS4.mjs";
+import "../chunk-W27A25DK.mjs";
+import "../chunk-Y6FXYEAI.mjs";
 export {
   WorkflowAbortSignal,
   WorkflowSagaRollbackError,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "avantgate",
-  "version": "1.6.1",
+  "version": "1.7.0",
   "description": "Zero-infrastructure, in-process AI Application Firewall (AI-WAF) & privacy control plane for TypeScript: real-time prompt guardrails, zero-egress PII redaction, agent tool isolation, anti-IDOR defense, pre-flight token budgets, and multi-model failover.",
   "author": "Gatewall Team",
   "license": "MIT",
@@ -82,7 +82,8 @@
   ],
   "scripts": {
     "build": "tsup src/index.ts src/finance/index.ts src/agent/index.ts src/workflow/index.ts src/client/index.ts --format cjs --format esm --clean && tsc --emitDeclarationOnly --outDir dist",
-    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && npm run test:agent && npm run test:workflow && npm run test:client",
+    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/sqlite-pricing-adapter.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && npm run test:agent && npm run test:workflow && npm run test:client",
+    "test:pricing": "tsx tests/sqlite-pricing-adapter.test.ts",
     "test:finance": "tsx tests/financial-normalizer.test.ts",
     "test:prompts": "tsx tests/prompt-builder.test.ts",
     "test:pii": "tsx tests/pii-extended.test.ts",
@@ -102,6 +103,7 @@
     "zod": "^3.23.0 || ^4.0.0"
   },
   "devDependencies": {
+    "@types/node": "^26.6.2",
     "@types/react": "^18.3.18",
     "react": "^18.3.1",
     "tsup": "^8.3.5",