avantgate 1.6.1 → 1.8.0

package/dist/index.mjs

@@ -1,7 +1,7 @@
 import {
   extractAndCleanJSON,
   validateWithZod
-} from "./chunk-CO26LNFD.mjs";
+} from "./chunk-36ULFTM2.mjs";
 import {
   WorkflowAbortSignal,
   WorkflowSagaRollbackError,
@@ -9,10 +9,13 @@ import {
   defineWorkflow,
   executeWorkflow,
   isWorkflowAbortSignal
-} from "./chunk-4XWO3NZW.mjs";
+} from "./chunk-AH5XXSS4.mjs";
 import {
   sanitizePII
-} from "./chunk-5VA3EKPJ.mjs";
+} from "./chunk-W27A25DK.mjs";
+import {
+  __require
+} from "./chunk-Y6FXYEAI.mjs";
 
 // src/types.ts
 var ConfigurationError = class extends Error {
@@ -27,6 +30,221 @@ var BudgetExceededError = class extends Error {
     this.name = "BudgetExceededError";
   }
 };
+var SecretLeakBlockedError = class extends Error {
+  detections;
+  constructor(message, detections) {
+    super(message);
+    this.name = "SecretLeakBlockedError";
+    this.detections = detections;
+  }
+};
+
+// src/sqlite-pricing-adapter.ts
+import fs from "fs";
+import path from "path";
+var normalizeIdentifier = (val) => {
+  return val.trim().toLowerCase().replace(":", "/");
+};
+var SqlitePricingAdapter = class {
+  db;
+  tableName;
+  constructor(options = {}) {
+    this.tableName = options.tableName ?? "model_pricing";
+    this.db = options.db ?? this.initDatabase(options.dbPath ?? ":memory:");
+    this.initSchema();
+    if (options.autoSeed) {
+      this.seedDefaultPrices(false);
+    }
+  }
+  initDatabase = (dbPath) => {
+    if (dbPath !== ":memory:") {
+      const dir = path.dirname(path.resolve(dbPath));
+      if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+      }
+    }
+    try {
+      const { DatabaseSync } = __require("sqlite");
+      return new DatabaseSync(dbPath);
+    } catch (err) {
+      throw new ConfigurationError(
+        `[avantGate] Failed to initialize native SQLite at '${dbPath}'. Ensure you are running on Node.js 22+ or provide a custom 'db' instance in options. Error: ${String(err)}`
+      );
+    }
+  };
+  initSchema = () => {
+    this.db.exec(`
+      CREATE TABLE IF NOT EXISTS ${this.tableName} (
+        provider TEXT NOT NULL,
+        model TEXT NOT NULL,
+        prompt_usd_per_million REAL NOT NULL,
+        completion_usd_per_million REAL NOT NULL,
+        cache_hit_usd_per_million REAL,
+        is_active INTEGER DEFAULT 1,
+        updated_at TEXT NOT NULL,
+        PRIMARY KEY (provider, model)
+      );
+      CREATE INDEX IF NOT EXISTS idx_${this.tableName}_lookup 
+      ON ${this.tableName}(provider, model, is_active);
+    `);
+  };
+  /**
+   * Implémentation du port avantGate PricingAdapter.
+   * Résolution hiérarchique : (provider, model) -> (provider/model) -> (model).
+   */
+  fetchPrice = (model, provider) => {
+    const normModel = normalizeIdentifier(model);
+    const normProvider = provider ? normalizeIdentifier(provider) : void 0;
+    if (normProvider) {
+      const row = this.queryActiveRow(normProvider, normModel);
+      if (row) return this.mapRowToPrice(row);
+    }
+    if (normModel.includes("/")) {
+      const firstSlashIdx = normModel.indexOf("/");
+      const extractedProvider = normModel.slice(0, firstSlashIdx);
+      const extractedModel = normModel.slice(firstSlashIdx + 1);
+      const splitRow = this.queryActiveRow(extractedProvider, extractedModel);
+      if (splitRow) return this.mapRowToPrice(splitRow);
+    }
+    const directRow = this.queryByModelOnly(normModel);
+    if (directRow) return this.mapRowToPrice(directRow);
+    return void 0;
+  };
+  queryActiveRow = (provider, model) => {
+    const stmt = this.db.prepare(`
+      SELECT provider, model, prompt_usd_per_million, completion_usd_per_million, cache_hit_usd_per_million, is_active, updated_at
+      FROM ${this.tableName}
+      WHERE provider = ? AND model = ? AND is_active = 1
+      LIMIT 1
+    `);
+    return stmt.get(provider, model);
+  };
+  queryByModelOnly = (model) => {
+    const stmt = this.db.prepare(`
+      SELECT provider, model, prompt_usd_per_million, completion_usd_per_million, cache_hit_usd_per_million, is_active, updated_at
+      FROM ${this.tableName}
+      WHERE model = ? AND is_active = 1
+      LIMIT 1
+    `);
+    return stmt.get(model);
+  };
+  mapRowToPrice = (row) => {
+    return {
+      promptUSDPerMillion: Number(row.prompt_usd_per_million),
+      completionUSDPerMillion: Number(row.completion_usd_per_million),
+      cacheHitUSDPerMillion: row.cache_hit_usd_per_million != null ? Number(row.cache_hit_usd_per_million) : void 0
+    };
+  };
+  /**
+   * Enregistre ou met à jour la tarification d'un modèle.
+   */
+  upsertPrice = (provider, model, price, isActive = true) => {
+    const normProvider = normalizeIdentifier(provider);
+    const normModel = normalizeIdentifier(model);
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    const stmt = this.db.prepare(`
+      INSERT OR REPLACE INTO ${this.tableName}
+      (provider, model, prompt_usd_per_million, completion_usd_per_million, cache_hit_usd_per_million, is_active, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+    stmt.run(
+      normProvider,
+      normModel,
+      price.promptUSDPerMillion,
+      price.completionUSDPerMillion,
+      price.cacheHitUSDPerMillion ?? null,
+      isActive ? 1 : 0,
+      now
+    );
+  };
+  /**
+   * Supprime une règle tarifaire de la base de données.
+   */
+  deletePrice = (provider, model) => {
+    const normProvider = normalizeIdentifier(provider);
+    const normModel = normalizeIdentifier(model);
+    const stmt = this.db.prepare(`
+      DELETE FROM ${this.tableName}
+      WHERE provider = ? AND model = ?
+    `);
+    const result = stmt.run(normProvider, normModel);
+    return Boolean(result && typeof result.changes === "number" && result.changes > 0);
+  };
+  /**
+   * Retourne l'ensemble des règles tarifaires enregistrées.
+   */
+  getAllPrices = () => {
+    const stmt = this.db.prepare(`
+      SELECT provider, model, prompt_usd_per_million, completion_usd_per_million, cache_hit_usd_per_million, is_active, updated_at
+      FROM ${this.tableName}
+      ORDER BY provider ASC, model ASC
+    `);
+    const rows = stmt.all();
+    return rows.map((row) => ({
+      provider: row.provider,
+      model: row.model,
+      price: this.mapRowToPrice(row),
+      isActive: Boolean(row.is_active),
+      updatedAt: row.updated_at
+    }));
+  };
+  /**
+   * Remplit la base avec le catalogue de départ SEED_MODEL_PRICES.
+   * @param force Si true, écrase les tarifs existants. Si false, insère uniquement les modèles manquants.
+   * @returns Le nombre d'enregistrements insérés.
+   */
+  seedDefaultPrices = (force = false) => {
+    const conflictClause = force ? "INSERT OR REPLACE" : "INSERT OR IGNORE";
+    const stmt = this.db.prepare(`
+      ${conflictClause} INTO ${this.tableName}
+      (provider, model, prompt_usd_per_million, completion_usd_per_million, cache_hit_usd_per_million, is_active, updated_at)
+      VALUES (?, ?, ?, ?, ?, ?, ?)
+    `);
+    let inserted = 0;
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    for (const [key, price] of Object.entries(SEED_MODEL_PRICES)) {
+      const normKey = normalizeIdentifier(key);
+      let provider = "direct";
+      let model = normKey;
+      if (normKey.includes("/")) {
+        const slashIdx = normKey.indexOf("/");
+        provider = normKey.slice(0, slashIdx);
+        model = normKey.slice(slashIdx + 1);
+      }
+      const res1 = stmt.run(
+        provider,
+        model,
+        price.promptUSDPerMillion,
+        price.completionUSDPerMillion,
+        price.cacheHitUSDPerMillion ?? null,
+        1,
+        now
+      );
+      if (res1?.changes && res1.changes > 0) inserted++;
+      if (provider !== "direct") {
+        const res2 = stmt.run(
+          "direct",
+          normKey,
+          price.promptUSDPerMillion,
+          price.completionUSDPerMillion,
+          price.cacheHitUSDPerMillion ?? null,
+          1,
+          now
+        );
+        if (res2?.changes && res2.changes > 0) inserted++;
+      }
+    }
+    return inserted;
+  };
+  /**
+   * Ferme la connexion SQLite sous-jacente si supporté.
+   */
+  close = () => {
+    if (typeof this.db.close === "function") {
+      this.db.close();
+    }
+  };
+};
 
 // src/pricing.ts
 var SEED_MODEL_PRICES = {
@@ -52,9 +270,9 @@ var SEED_MODEL_PRICES = {
   // Local Ollama (Toujours $0)
   "ollama": { promptUSDPerMillion: 0, completionUSDPerMillion: 0 }
 };
-function normalizeKey(identifier) {
+var normalizeKey = (identifier) => {
   return identifier.trim().toLowerCase().replace(":", "/");
-}
+};
 var CachedPricingAdapter = class {
   cache = /* @__PURE__ */ new Map();
   ttlMs;
@@ -63,7 +281,7 @@ var CachedPricingAdapter = class {
     this.delegate = delegate;
     this.ttlMs = ttlMs;
   }
-  async fetchPrice(model, provider) {
+  fetchPrice = async (model, provider) => {
     const key = provider ? normalizeKey(`${provider}/${model}`) : normalizeKey(model);
     const cached = this.cache.get(key);
     if (cached && Date.now() < cached.expiresAt) {
@@ -81,72 +299,76 @@ var CachedPricingAdapter = class {
       }
     }
     return void 0;
-  }
-  peek(model, provider) {
+  };
+  peek = (model, provider) => {
     const key = provider ? normalizeKey(`${provider}/${model}`) : normalizeKey(model);
-    return this.cache.get(key)?.price;
-  }
-  clearCache() {
+    const cached = this.cache.get(key);
+    if (cached && Date.now() < cached.expiresAt) {
+      return cached.price;
+    }
+    return void 0;
+  };
+  clearCache = () => {
     this.cache.clear();
-  }
-  invalidate(model, provider) {
+  };
+  invalidate = (model, provider) => {
     if (!model) {
       this.clearCache();
       return;
     }
     const key = provider ? normalizeKey(`${provider}/${model}`) : normalizeKey(model);
     this.cache.delete(key);
-  }
+  };
 };
-var PricingRegistry = class {
+var PricingRegistry = class _PricingRegistry {
   static prices = /* @__PURE__ */ new Map();
   static adapter;
-  static registerPrice(identifier, price) {
-    this.prices.set(normalizeKey(identifier), price);
-  }
-  static registerDistributorPrices(distributor, priceMap) {
+  static registerPrice = (identifier, price) => {
+    _PricingRegistry.prices.set(normalizeKey(identifier), price);
+  };
+  static registerDistributorPrices = (distributor, priceMap) => {
     for (const [model, price] of Object.entries(priceMap)) {
-      this.prices.set(normalizeKey(`${distributor}/${model}`), price);
+      _PricingRegistry.prices.set(normalizeKey(`${distributor}/${model}`), price);
     }
-  }
-  static registerPrices(prices) {
+  };
+  static registerPrices = (prices) => {
     for (const [key, price] of Object.entries(prices)) {
-      this.prices.set(normalizeKey(key), price);
+      _PricingRegistry.prices.set(normalizeKey(key), price);
     }
-  }
-  static getPrice(model, provider) {
+  };
+  static getPrice = (model, provider) => {
     if (provider) {
       const distributorKey = normalizeKey(`${provider}/${model}`);
-      const directDistributorPrice = this.prices.get(distributorKey);
+      const directDistributorPrice = _PricingRegistry.prices.get(distributorKey);
       if (directDistributorPrice) {
         return directDistributorPrice;
       }
     }
-    return this.prices.get(normalizeKey(model));
-  }
-  static setAdapter(adapter) {
-    this.adapter = adapter;
-  }
-  static getAdapter() {
-    return this.adapter;
-  }
-  static clear() {
-    this.prices.clear();
-    this.adapter = void 0;
-  }
+    return _PricingRegistry.prices.get(normalizeKey(model));
+  };
+  static setAdapter = (adapter) => {
+    _PricingRegistry.adapter = adapter;
+  };
+  static getAdapter = () => {
+    return _PricingRegistry.adapter;
+  };
+  static clear = () => {
+    _PricingRegistry.prices.clear();
+    _PricingRegistry.adapter = void 0;
+  };
   /**
    * Réinitialise le registre en chargeant le catalogue d'exemple SEED_MODEL_PRICES.
    */
-  static loadSeedPrices() {
-    this.registerPrices(SEED_MODEL_PRICES);
-  }
-  static getAllPrices() {
+  static loadSeedPrices = () => {
+    _PricingRegistry.registerPrices(SEED_MODEL_PRICES);
+  };
+  static getAllPrices = () => {
     const out = {};
-    for (const [k, v] of this.prices.entries()) {
+    for (const [k, v] of _PricingRegistry.prices.entries()) {
       out[k] = v;
     }
     return out;
-  }
+  };
 };
 var DEFAULT_MODEL_PRICES = new Proxy({}, {
   get(_target, prop) {
@@ -166,7 +388,7 @@ var DEFAULT_MODEL_PRICES = new Proxy({}, {
     return void 0;
   }
 });
-function resolveModelPrice(model, options) {
+var resolveModelPrice = (model, options) => {
   const opts = typeof options === "string" ? { provider: options } : options ?? {};
   if (opts.providerPricing) {
     return opts.providerPricing;
@@ -197,8 +419,8 @@ function resolveModelPrice(model, options) {
     return { promptUSDPerMillion: 0, completionUSDPerMillion: 0 };
   }
   return void 0;
-}
-async function resolveModelPriceAsync(model, options) {
+};
+var resolveModelPriceAsync = async (model, options) => {
   const opts = typeof options === "string" ? { provider: options } : options ?? {};
   const activeAdapter = opts.adapter ?? PricingRegistry.getAdapter();
   if (activeAdapter) {
@@ -211,8 +433,8 @@ async function resolveModelPriceAsync(model, options) {
     }
   }
   return resolveModelPrice(model, options);
-}
-function calculateCostUSD(model, promptTokens, completionTokens, cacheHitTokens = 0, options) {
+};
+var calculateCostUSD = (model, promptTokens, completionTokens, cacheHitTokens = 0, options) => {
   const pricing = resolveModelPrice(model, options);
   if (!pricing) {
     return 0;
@@ -221,7 +443,7 @@ function calculateCostUSD(model, promptTokens, completionTokens, cacheHitTokens
   const completionCost = completionTokens / 1e6 * pricing.completionUSDPerMillion;
   const cacheDiscount = cacheHitTokens && pricing.cacheHitUSDPerMillion ? cacheHitTokens / 1e6 * (pricing.promptUSDPerMillion - pricing.cacheHitUSDPerMillion) : 0;
   return Math.max(0, promptCost + completionCost - cacheDiscount);
-}
+};
 
 // src/input-guard.ts
 var INJECTION_PATTERNS = [
@@ -232,7 +454,7 @@ var INJECTION_PATTERNS = [
   /output\s+(?:your\s+)?(?:system\s+prompt|initial\s+instructions)/i,
   /repeat\s+(?:the\s+words\s+above|everything\s+above)/i
 ];
-function validateUserInput(input, options) {
+var validateUserInput = (input, options) => {
   const maxLength = options?.maxLength ?? 5e4;
   if (input.length > maxLength) {
     return {
@@ -251,7 +473,7 @@ function validateUserInput(input, options) {
     }
   }
   return { valid: true };
-}
+};
 
 // src/providers/http-client.ts
 var DEFAULT_BASE_URLS = {
@@ -272,14 +494,14 @@ var HttpProviderClient = class {
     this.apiKey = config.apiKey;
     this.baseUrl = config.baseUrl || DEFAULT_BASE_URLS[config.provider] || "https://api.openai.com/v1";
   }
-  resolveEndpoint() {
+  resolveEndpoint = () => {
     const trimmed = this.baseUrl.replace(/\/+$/, "");
     if (trimmed.endsWith("/chat/completions")) {
       return trimmed;
     }
     return `${trimmed}/chat/completions`;
-  }
-  buildHeaders() {
+  };
+  buildHeaders = () => {
     const headers = {
       "Content-Type": "application/json"
     };
@@ -291,8 +513,8 @@ var HttpProviderClient = class {
       headers["X-Title"] = "AvantGate";
     }
     return headers;
-  }
-  buildPayload(options, model) {
+  };
+  buildPayload = (options, model) => {
     return {
       model,
       messages: options.messages.map((m) => ({
@@ -302,8 +524,8 @@ var HttpProviderClient = class {
       temperature: options.temperature ?? 0.2,
       ...options.responseFormat ? { response_format: options.responseFormat } : {}
     };
-  }
-  extractUsage(usageData) {
+  };
+  extractUsage = (usageData) => {
     if (!usageData) {
       return void 0;
     }
@@ -313,8 +535,8 @@ var HttpProviderClient = class {
       totalTokens: usageData.total_tokens,
       promptCacheHitTokens: usageData.prompt_tokens_details?.cached_tokens
     };
-  }
-  async complete(options) {
+  };
+  complete = async (options) => {
     const endpoint = this.resolveEndpoint();
     const model = options.model ?? "default";
     const headers = this.buildHeaders();
@@ -334,11 +556,114 @@ var HttpProviderClient = class {
     const text = data.choices?.[0]?.message?.content ?? "";
     const usage = this.extractUsage(data.usage);
     return { text, usage };
-  }
+  };
 };
-function createHttpProviderClient(config) {
+var createHttpProviderClient = (config) => {
   return new HttpProviderClient(config);
-}
+};
+
+// src/secret-guard.ts
+var SECRET_PATTERNS = [
+  // 1. Clés privées (RSA, OpenSSH, EC, DSA)
+  {
+    type: "PRIVATE_KEY",
+    regex: /-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9_-]+ )?PRIVATE KEY-----/g,
+    mask: "[REDACTED_PRIVATE_KEY]"
+  },
+  // 2. Clés Anthropic Claude (avant OpenAI pour éviter collision sk-)
+  {
+    type: "ANTHROPIC_API_KEY",
+    regex: /\bsk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{20,}\b/g,
+    mask: "[REDACTED_ANTHROPIC_KEY]"
+  },
+  // 3. Clés OpenAI (standard, projet, admin) - exclut explicitement sk-ant-
+  {
+    type: "OPENAI_API_KEY",
+    regex: /\bsk-(?!ant-)(?:proj-|admin-|org-)?[A-Za-z0-9_-]{20,}\b/g,
+    mask: "[REDACTED_OPENAI_KEY]"
+  },
+  // 4. Clés AWS Access Key ID
+  {
+    type: "AWS_ACCESS_KEY",
+    regex: /\b(?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16}\b/g,
+    mask: "[REDACTED_AWS_KEY]"
+  },
+  // 5. Tokens GitHub (Personal, OAuth, User, Server)
+  {
+    type: "GITHUB_TOKEN",
+    regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/g,
+    mask: "[REDACTED_GITHUB_TOKEN]"
+  },
+  // 6. JSON Web Tokens (JWT)
+  {
+    type: "JWT_TOKEN",
+    regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g,
+    mask: "[REDACTED_JWT]"
+  },
+  // 7. Tokens Slack
+  {
+    type: "SLACK_TOKEN",
+    regex: /\bxox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}\b/g,
+    mask: "[REDACTED_SLACK_TOKEN]"
+  },
+  // 8. Mots de passe dans URL de connexion (Postgres, Mongo, Redis, MySQL)
+  {
+    type: "DATABASE_CONNECTION_SECRET",
+    regex: /(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:\s\/@]+:([^@\s]+)@/gi,
+    mask: "[REDACTED_DB_SECRET]"
+  }
+];
+var sanitizeSecrets = (input) => {
+  let text = input;
+  const detections = [];
+  for (const pattern of SECRET_PATTERNS) {
+    let matchCount = 0;
+    if (pattern.type === "DATABASE_CONNECTION_SECRET") {
+      text = text.replace(pattern.regex, (fullMatch, password) => {
+        matchCount++;
+        return fullMatch.replace(password, pattern.mask);
+      });
+    } else {
+      text = text.replace(pattern.regex, () => {
+        matchCount++;
+        return pattern.mask;
+      });
+    }
+    if (matchCount > 0) {
+      detections.push({ type: pattern.type, matchedCount: matchCount });
+    }
+  }
+  return {
+    text,
+    hasSecrets: detections.length > 0,
+    detections
+  };
+};
+var applyOutputGuards = (rawOutput, options) => {
+  let currentText = rawOutput;
+  let piiCount = 0;
+  if (options?.maskPII) {
+    const piiResult = sanitizePII(currentText);
+    currentText = piiResult.text;
+    piiCount = piiResult.maskedCount;
+  }
+  const secretResult = sanitizeSecrets(currentText);
+  currentText = secretResult.text;
+  if (secretResult.hasSecrets && options?.secretLeakAction === "BLOCK") {
+    const types = secretResult.detections.map((d) => d.type).join(", ");
+    throw new SecretLeakBlockedError(
+      `[AvantGate Output Guard] Response blocked: detected potential secret leak (${types})`,
+      secretResult.detections
+    );
+  }
+  return {
+    text: currentText,
+    sanitized: piiCount > 0 || secretResult.hasSecrets,
+    secretDetected: secretResult.hasSecrets,
+    piiMaskedCount: piiCount,
+    detections: secretResult.detections
+  };
+};
 
 // src/control-layer.ts
 var AvantGateControlLayer = class {
@@ -358,7 +683,7 @@ var AvantGateControlLayer = class {
       );
     }
   }
-  resolveProviderConfig(provider) {
+  resolveProviderConfig = (provider) => {
     if (!provider) return void 0;
     if (provider.client) return provider;
     if (provider.apiKey || provider.baseUrl || provider.provider === "ollama") {
@@ -368,8 +693,8 @@ var AvantGateControlLayer = class {
       };
     }
     return provider;
-  }
-  findProviderConfig(provider, model) {
+  };
+  findProviderConfig = (provider, model) => {
     const list = [this.config.primary, this.config.fallback, this.config.emergencyFallback].filter(
       (p) => Boolean(p)
     );
@@ -382,8 +707,8 @@ var AvantGateControlLayer = class {
       if (matchModel) return matchModel;
     }
     return this.config.primary;
-  }
-  calculateCost(model, promptTokens, completionTokens, cacheHitTokens = 0, provider) {
+  };
+  calculateCost = (model, promptTokens, completionTokens, cacheHitTokens = 0, provider) => {
     const providerCfg = this.findProviderConfig(provider, model);
     return calculateCostUSD(model, promptTokens, completionTokens, cacheHitTokens, {
       provider: provider ?? providerCfg?.provider,
@@ -391,8 +716,8 @@ var AvantGateControlLayer = class {
       customPricing: this.config.customPricing,
       adapter: this.cachedPricingAdapter
     });
-  }
-  applySecurityGuards(userQuery) {
+  };
+  applySecurityGuards = (userQuery) => {
     const guard = validateUserInput(userQuery, {
       detectInjection: this.config.security?.detectPromptInjection,
       maxLength: this.config.security?.maxInputLength
@@ -404,8 +729,21 @@ var AvantGateControlLayer = class {
       return sanitizePII(userQuery).text;
     }
     return userQuery;
-  }
-  checkPreflightBudget(estimatedPromptTokens, targetModel, provider) {
+  };
+  applyOutputSecurityGuards = (rawOutput) => {
+    const isDlpEnabled = this.config.security?.outputDLP ?? this.config.security?.maskPII ?? false;
+    const shouldCheckSecrets = this.config.security?.blockSecretLeaks ?? true;
+    if (!isDlpEnabled && !shouldCheckSecrets) {
+      return rawOutput;
+    }
+    const guardResult = applyOutputGuards(rawOutput, {
+      maskPII: isDlpEnabled,
+      blockSecretLeaks: shouldCheckSecrets,
+      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT"
+    });
+    return guardResult.text;
+  };
+  checkPreflightBudget = async (estimatedPromptTokens, targetModel, provider) => {
     if (this.config.maxTokenBudget !== void 0 && estimatedPromptTokens > this.config.maxTokenBudget) {
       throw new BudgetExceededError(
         `[AvantGate Budget Guard] Pre-flight token budget exceeded: estimated prompt (${estimatedPromptTokens} tokens) exceeds maxTokenBudget (${this.config.maxTokenBudget}).`
@@ -414,7 +752,7 @@ var AvantGateControlLayer = class {
     if (this.config.maxCostUSD !== void 0) {
       const isLocalFree = provider === "ollama" || targetModel.toLowerCase().includes("ollama");
       const providerCfg = this.findProviderConfig(provider, targetModel);
-      const price = resolveModelPrice(targetModel, {
+      const price = await resolveModelPriceAsync(targetModel, {
         provider: provider ?? providerCfg?.provider,
         providerPricing: providerCfg?.pricing,
         customPricing: this.config.customPricing,
@@ -432,8 +770,8 @@ var AvantGateControlLayer = class {
         );
       }
     }
-  }
-  checkPostExecutionBudget(tokensTotal, costUSD) {
+  };
+  checkPostExecutionBudget = (tokensTotal, costUSD) => {
     if (this.config.maxTokenBudget !== void 0 && tokensTotal > this.config.maxTokenBudget) {
       throw new BudgetExceededError(
         `[AvantGate Budget Guard] Execution total tokens (${tokensTotal}) exceeded maxTokenBudget (${this.config.maxTokenBudget}).`
@@ -444,16 +782,16 @@ var AvantGateControlLayer = class {
         `[AvantGate Budget Guard] Execution cost ($${costUSD.toFixed(6)}) exceeded maxCostUSD ($${this.config.maxCostUSD}).`
       );
     }
-  }
-  buildMessages(systemPrompt, query) {
+  };
+  buildMessages = (systemPrompt, query) => {
     const messages = [];
     if (systemPrompt) {
       messages.push({ role: "system", content: systemPrompt });
     }
     messages.push({ role: "user", content: query });
     return messages;
-  }
-  resolveTokens(rawUsage, query, text) {
+  };
+  resolveTokens = (rawUsage, query, text) => {
     const promptTokens = rawUsage?.promptTokens ?? Math.ceil(query.length / 4);
     const completionTokens = rawUsage?.completionTokens ?? Math.ceil(text.length / 4);
     const totalTokens = rawUsage?.totalTokens ?? promptTokens + completionTokens;
@@ -463,15 +801,15 @@ var AvantGateControlLayer = class {
       totalTokens,
       promptCacheHitTokens: rawUsage?.promptCacheHitTokens
     };
-  }
-  getProviderChain() {
+  };
+  getProviderChain = () => {
     return [
       this.config.primary,
       this.config.fallback,
       this.config.emergencyFallback
     ].filter((provider) => Boolean(provider?.client));
-  }
-  executeSimulation(query, systemPrompt) {
+  };
+  executeSimulation = (query, systemPrompt) => {
     const promptTokens = Math.ceil(((systemPrompt?.length ?? 0) + query.length) / 4);
     const completionTokens = 50;
     const cost = this.calculateCost(this.config.primary.model, promptTokens, completionTokens);
@@ -487,8 +825,8 @@ var AvantGateControlLayer = class {
       failoverOccurred: false,
       attempts: 1
     };
-  }
-  async executeOverrideProvider(provider, messages, query, temperature) {
+  };
+  executeOverrideProvider = async (provider, messages, query, temperature) => {
     const response = await provider.complete({
       model: this.config.primary.model,
       messages,
@@ -502,8 +840,8 @@ var AvantGateControlLayer = class {
       failoverOccurred: false,
       attempts: 1
     };
-  }
-  async executeProviderPipeline(messages, query, temperature, modelOverride) {
+  };
+  executeProviderPipeline = async (messages, query, temperature, modelOverride) => {
     const chain = this.getProviderChain();
     let lastError;
     for (let index = 0; index < chain.length; index++) {
@@ -528,8 +866,9 @@ var AvantGateControlLayer = class {
       }
     }
     throw lastError;
-  }
-  assembleResult(output) {
+  };
+  assembleResult = (output) => {
+    const sanitizedText = this.applyOutputSecurityGuards(output.responseText);
     const costUSD = this.calculateCost(
       output.modelUsed,
       output.usage.promptTokens,
@@ -537,7 +876,7 @@ var AvantGateControlLayer = class {
       output.usage.promptCacheHitTokens ?? 0
     );
     return {
-      text: output.responseText,
+      text: sanitizedText,
       tokens: {
         prompt: output.usage.promptTokens,
         completion: output.usage.completionTokens,
@@ -548,8 +887,8 @@ var AvantGateControlLayer = class {
       failoverOccurred: output.failoverOccurred,
       attempts: output.attempts
     };
-  }
-  async notifyAuditSink(result) {
+  };
+  notifyAuditSink = async (result) => {
     if (!this.config.auditSink) {
       return;
     }
@@ -561,16 +900,16 @@ var AvantGateControlLayer = class {
       failoverOccurred: result.failoverOccurred,
       attempts: result.attempts
     });
-  }
+  };
   /**
    * Exécute une requête avec garde d'entrée, masquage PII, garde pré-vol et calcul des coûts.
    */
-  async execute(options) {
+  execute = async (options) => {
     const sanitizedQuery = this.applySecurityGuards(options.userQuery);
     const messages = this.buildMessages(options.systemPrompt, sanitizedQuery);
     const promptLength = (options.systemPrompt?.length ?? 0) + sanitizedQuery.length;
     const estimatedPromptTokens = Math.ceil(promptLength / 4);
-    this.checkPreflightBudget(estimatedPromptTokens, this.config.primary.model, this.config.primary.provider);
+    await this.checkPreflightBudget(estimatedPromptTokens, this.config.primary.model, this.config.primary.provider);
     if (!options.providerOverride && this.getProviderChain().length === 0) {
       if (this.config.mockSimulation) {
         const simResult = this.executeSimulation(sanitizedQuery, options.systemPrompt);
@@ -586,11 +925,11 @@ var AvantGateControlLayer = class {
     this.checkPostExecutionBudget(result.tokens.total, result.costUSD);
     await this.notifyAuditSink(result);
     return result;
-  }
+  };
   /**
    * Exécute une requête et valide/répare le résultat selon un schéma Zod.
    */
-  async executeStructured(options) {
+  executeStructured = async (options) => {
     const rawResult = await this.execute({
       userQuery: options.userQuery,
       systemPrompt: options.systemPrompt,
@@ -612,12 +951,12 @@ var AvantGateControlLayer = class {
       modelUsed: rawResult.modelUsed,
       failoverOccurred: rawResult.failoverOccurred
     };
-  }
+  };
   /**
    * Méthode unifiée de premier niveau pour l'extraction structurée sans code boilerplate.
    * Gère le failover multi-fournisseurs, les retries, la validation Zod et la normalisation financière.
    */
-  async generateStructuredOutput(options) {
+  generateStructuredOutput = async (options) => {
     const maxRetries = options.maxRetries ?? this.config.retryOptions?.maxRetries ?? 2;
     const modelToUse = options.model ?? this.config.primary.model;
     const processedMessages = options.messages.map((msg) => {
@@ -628,7 +967,7 @@ var AvantGateControlLayer = class {
     });
     const promptLength = processedMessages.reduce((sum, msg) => sum + msg.content.length, 0);
     const estimatedPromptTokens = Math.ceil(promptLength / 4);
-    this.checkPreflightBudget(estimatedPromptTokens, modelToUse);
+    await this.checkPreflightBudget(estimatedPromptTokens, modelToUse);
     let lastError;
     let accumulatedPromptTokens = 0;
     let accumulatedCompletionTokens = 0;
@@ -676,10 +1015,11 @@ var AvantGateControlLayer = class {
         }
         accumulatedPromptTokens += attemptPromptTokens;
         accumulatedCompletionTokens += attemptCompletionTokens;
+        const sanitizedResponse = this.applyOutputSecurityGuards(responseText);
         const isFinancial = options.financialNormalizer ?? Boolean(
           this.config.features?.finance?.enableFrenchAccounting || this.config.features?.finance
         );
-        const parsedData = validateWithZod(responseText, options.schema, {
+        const parsedData = validateWithZod(sanitizedResponse, options.schema, {
           financialNormalizer: isFinancial,
           jurisdiction: this.config.features?.finance?.jurisdiction
         });
@@ -688,7 +1028,7 @@ var AvantGateControlLayer = class {
         this.checkPostExecutionBudget(totalTokens, costUSD);
         const result = {
           data: parsedData,
-          rawText: responseText,
+          rawText: sanitizedResponse,
           tokens: {
             prompt: accumulatedPromptTokens,
             completion: accumulatedCompletionTokens,
@@ -716,11 +1056,11 @@ var AvantGateControlLayer = class {
       }
     }
     throw lastError;
-  }
+  };
 };
-function createLLMControlLayer(config) {
+var createLLMControlLayer = (config) => {
   return new AvantGateControlLayer(config);
-}
+};
 var createAvantGate = createLLMControlLayer;
 
 // src/prompts/prompt-template.ts
@@ -1041,6 +1381,7 @@ export {
   BudgetExceededError as AvantGateBudgetExceededError,
   ConfigurationError as AvantGateConfigurationError,
   AvantGateControlLayer,
+  SecretLeakBlockedError as AvantGateSecretLeakBlockedError,
   BudgetExceededError,
   CachedPricingAdapter,
   ConfigurationError,
@@ -1051,10 +1392,13 @@ export {
   PromptRegistry,
   PromptTemplate,
   SEED_MODEL_PRICES,
+  SecretLeakBlockedError,
+  SqlitePricingAdapter,
   WorkflowAbortSignal,
   WorkflowSagaRollbackError,
   WorkflowValidationError,
   AvantGateControlLayer as ZenLLMControlLayer,
+  applyOutputGuards,
   calculateCostUSD,
   createAvantGate,
   createHttpProviderClient,
@@ -1066,6 +1410,7 @@ export {
   resolveModelPrice,
   resolveModelPriceAsync,
   sanitizePII,
+  sanitizeSecrets,
   validateUserInput,
   validateWithZod
 };