avantgate 1.7.0 → 1.8.1

package/README.md

@@ -86,17 +86,12 @@ Contact our team at [contact@gatewall.fr](mailto:contact@gatewall.fr) for privat
 
 ## 🚀 Key Security & Defense Features
 
-- 🛡️ **Active Threat Defense & Prompt Guardrails**: Blocks prompt injections, DAN jailbreaks, adversarial noise, and system prompt exfiltration *before* external API invocation.
-- 🔒 **Zero-Egress Data Loss Prevention (DLP)**: Automated local redaction of emails, phone numbers, IBAN/BIC, and French/EU identifiers (NIR SSN, SPI tax ID) before network egress.
-- ⚡ **Deterministic Workflow Engine (`avantgate/workflow`)**: In-process sequential state machine for multi-step agent orchestrations. Features automatic reverse compensation (Saga Pattern), non-blocking Human-in-the-Loop checkpoints, and safe-by-default AI tool conversion (`asTool()`).
-- 🎭 **Dual-Channel Tool Isolation (`avantgate/agent`)**: Decouples sensitive database records (streamed out-of-band directly to client UIs) from minimal cognitive LLM context (`llmDto`), keeping confidential fields out of context windows.
-- 🛑 **Anti-IDOR & Multi-Tenant Defense**: Strict Row-Level Security, compile-time tenant tool enforcement (`createTenantTool`), post-fetch runtime assertions (`assertTenant`, `assertOwnership`), and native RBAC authorization at the agent tool boundary. See the [Anti-IDOR Architecture Guide](docs/anti-idor.md).
-- 💰 **Denial-of-Wallet & Pre-Flight Budgeting**: Enforces strict token and cent-level USD budget limits, rejecting abusive requests before paying for upstream inference.
-- 🔀 **Zero-Downtime Multi-Model Failover**: Seamless client-side failover to fallback providers (or local zero-cost Ollama) when upstream APIs return HTTP 429/500 errors.
-- 🔧 **Self-Repairing Structured Outputs**: Strict Zod schema compliance with automated heuristic markdown/JSON repair if the model hallucinates formatting.
-- 📡 **Zero-Dependency Telemetry Bridge (`HttpTelemetryExporter`, `PlatformStorageAdapter`)**: Mirror execution audits and hierarchical tool traces asynchronously without adding heavy external dependencies.
-- 🌐 **Lightweight Front-End SDK & React Hook (`avantgate/client`)**: Micro-bundle (< 1.7 KB gzipped) for browser UIs. Captures client-side security alerts (blocked API keys, prompt injection attempts), UI render metrics, and user feedback, streaming them directly to gateWall via `fetch(keepalive)` without loading backend infrastructure.
-- 📦 **100% Framework Agnostic**: Works seamlessly in Next.js, Express, Fastify, NestJS, Cloudflare Workers, AWS Lambda, or CLI scripts.
+| Pillar | Core Capabilities & Architecture |
+|---|---|
+| 🛡️ **AI-WAF & Privacy** | • **Prompt Guardrails**: Blocks prompt injections, jailbreaks & exfiltration *pre-flight*.<br/>• **Zero-Egress DLP**: In-process redaction of emails, phone numbers, IBANs & EU tax IDs.<br/>• **Self-Repairing Outputs**: Native Zod validation with automatic JSON heuristic repair. |
+| 🛑 **Agent Isolation & Anti-IDOR** | • **Dual-Channel DTOs**: Streams full records to UI while injecting sanitized summaries into LLM.<br/>• **Anti-IDOR Boundary**: Compile-time tenant scoping (`createTenantTool`) & runtime ownership checks.<br/>• **Infinite Loop Shield**: Detects and breaks recursive agent tool execution loops. |
+| 💰 **FinOps & Resilience** | • **Denial-of-Wallet**: Enforces hard token & USD budgets *before* external inference spend.<br/>• **Multi-Model Failover**: Instant client-side routing to fallback models or local Ollama on 429/500.<br/>• **Live Cost Ledger**: Token burn calculation & pricing adapters with zero external DB. |
+| ⚡ **Sagas & Telemetry** | • **Deterministic Sagas (`avantgate/workflow`)**: In-process FSM with automatic reverse compensation ($k-1 \to 0$).<br/>• **Human-in-the-Loop (HITL)**: Non-blocking suspension & approval queues for high-risk tools.<br/>• **Lightweight Telemetry (`avantgate/client`)**: < 1.7 KB client SDK & async audit bridge to GateWall. |
 
 ---
 
@@ -153,19 +148,6 @@ yarn add avantgate zod
 
 ---
 
-## 📖 Documentation & Guides
-
-Comprehensive guides, copy-pasteable integration recipes, and architectural references are available in the dedicated documentation:
-
-| Guide | Description |
-|---|---|
-| **[Deterministic Workflow Engine](docs/workflow.md)** | Zero-infra Saga orchestrator, linear FSM rationale, reverse compensation, HITL checkpoints & agent tool conversion. |
-| **[Code Examples & Recipes](docs/examples.md)** | End-to-end security guardrails, PII redaction, anti-IDOR tool boundaries, cost tracking, Zod self-repair, and multi-model failover. |
-| **[Decoupled Pricing & DB Adapters](docs/pricing.md)** | Dynamic token pricing, database integration (Prisma / PostgreSQL / Drizzle), in-memory TTL caching, and runtime overrides. |
-| **[Durable Agent Harness & Tool Isolation](docs/agent.md)** | Serverless durable step execution, Human-in-the-Loop suspension, dual-channel DTO tool isolation, and telemetry streaming. |
-
----
-
 ## 🏗️ Architecture & Extensibility
 
 AvantGate is built around clean **Ports and Adapters**:
@@ -177,41 +159,7 @@ AvantGate is built around clean **Ports and Adapters**:
 
 ## 🗺️ Roadmap & Milestones
 
-### 🎯 Core Control Plane (`avantgate`)
-
-1. ⏱️ **In-Process Sliding-Window Rate Limiter & User Quotas**
-   - In-memory token bucket per User ID, IP address, or session without Redis.
-   - Per-user daily & hourly token budget limits with automatic graceful throttling.
-
-2. 🔒 **Bidirectional Sanitizer & Secret Leak Prevention**
-   - Extend PII protection from input queries to **model outputs and audit logs**.
-   - Active inspection to prevent LLM hallucinations from leaking server credentials, environment variables (`sk-...`, JWTs), or raw system instructions to client frontends.
-
-3. ⚡ **Spend Velocity Circuit Breaker & Exponential Backoff**
-   - Real-time spend velocity detection (trips if spend exceeds $X within Y minutes).
-   - Configurable exponential backoff retries before triggering provider failover.
-   - Safe degradation returning user-friendly messages instead of raw provider crashes.
-
-4. ⚖️ **Real-Time Evaluation Quality Gates**
-   - Replace gut-feel and vibe-based evaluations with in-process, measurable output quality gates.
-   - Built-in sub-millisecond heuristic gates:
-     - **Refusal & Boilerplate Gate**: Detects unwanted refusal phrasing (*"As an AI..."*) and triggers fallback.
-     - **Context Grounding Gate**: Verifies factual entity containment against supplied reference text.
-   - Automated corrective retry loop (`onFailure: "retry_with_feedback"`) or instant model failover.
-
-5. 🔌 **Lifecycle Middleware Hooks (`beforeRequest`, `afterResponse`)**
-   - Extensible middleware pipeline to inspect, enrich, or modify prompts and completions without modifying core logic.
-   - Universal hook allowing any external RAG system or context engine to compose with AvantGate seamlessly.
-
-6. 🚀 **One-Line Launch-Safe Presets (`PRESETS.LAUNCH_SAFE`)**
-   - Zero-config hardened setup with sensible defaults for security, budgets, and failovers.
-
-### 📦 Modular Ecosystem & Extensions
-
-- **`avantgate/workflow`**: Deterministic sequential state machine, automatic reverse Saga rollback ($k-1 \to 0$), and durable HITL checkpoints.
-- **`avantgate/agent`**: Zero-infra durable step orchestration, human-in-the-loop pauses, and dual-channel PII tool isolation.
-- **`avantgate/finance`**: Zero-overhead financial accounting normalizer across international jurisdictions (FR PCG, US GAAP, UK IFRS, Swiss CO).
-- **Launch Readiness Linter**: Standalone developer tool to audit codebases before launch for exposed keys, unbudgeted endpoints, and missing guards.
+Interested in upcoming features (output DLP & secret leak guard, lifecycle hooks, launch-safe presets) or release history See [**ROADMAP.md**](ROADMAP.md).
 
 ---
 

package/dist/control-layer.d.ts

@@ -8,6 +8,7 @@ export declare class AvantGateControlLayer {
     private findProviderConfig;
     private calculateCost;
     private applySecurityGuards;
+    private applyOutputSecurityGuards;
     private checkPreflightBudget;
     private checkPostExecutionBudget;
     private buildMessages;
@@ -18,18 +19,12 @@ export declare class AvantGateControlLayer {
     private executeProviderPipeline;
     private assembleResult;
     private notifyAuditSink;
-    /**
-     * Exécute une requête avec garde d'entrée, masquage PII, garde pré-vol et calcul des coûts.
-     */
     execute: (options: {
         userQuery: string;
         systemPrompt?: string;
         temperature?: number;
         providerOverride?: LLMProviderPort;
     }) => Promise<ExecutionResult>;
-    /**
-     * Exécute une requête et valide/répare le résultat selon un schéma Zod.
-     */
     executeStructured: <T>(options: {
         userQuery: string;
         systemPrompt?: string;
@@ -37,10 +32,16 @@ export declare class AvantGateControlLayer {
         temperature?: number;
         providerOverride?: LLMProviderPort;
     }) => Promise<StructuredExecutionResult<T>>;
-    /**
-     * Méthode unifiée de premier niveau pour l'extraction structurée sans code boilerplate.
-     * Gère le failover multi-fournisseurs, les retries, la validation Zod et la normalisation financière.
-     */
+    private sanitizeIncomingMessages;
+    private verifyPromptBudget;
+    private dispatchOverrideAttempt;
+    private dispatchSimulatedAttempt;
+    private dispatchPipelineAttempt;
+    private dispatchProviderAttempt;
+    private parseAndValidateStructuredResult;
+    private buildStructuredResult;
+    private notifyAuditSinkSafe;
+    private waitRetryBackoff;
     generateStructuredOutput: <T>(options: GenerateStructuredOutputOptions<T>) => Promise<StructuredExecutionResult<T>>;
 }
 export declare const createLLMControlLayer: (config: ControlLayerConfig) => AvantGateControlLayer;

package/dist/control-layer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-layer.d.ts","sourceRoot":"","sources":["../src/control-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,+BAA+B,EAC/B,eAAe,EAIhB,MAAM,SAAS,CAAC;AAgBjB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,oBAAoB,CAAC,CAAuB;gBAExC,MAAM,EAAE,kBAAkB;IAgBtC,OAAO,CAAC,qBAAqB,CAU3B;IAEF,OAAO,CAAC,kBAAkB,CAaxB;IAEF,OAAO,CAAC,aAAa,CAcnB;IAEF,OAAO,CAAC,mBAAmB,CAezB;IAEF,OAAO,CAAC,oBAAoB,CAkC1B;IAEF,OAAO,CAAC,wBAAwB,CAW9B;IAEF,OAAO,CAAC,aAAa,CAOnB;IAEF,OAAO,CAAC,aAAa,CAUnB;IAEF,OAAO,CAAC,gBAAgB,CAMtB;IAEF,OAAO,CAAC,iBAAiB,CAiBvB;IAEF,OAAO,CAAC,uBAAuB,CAmB7B;IAEF,OAAO,CAAC,uBAAuB,CA+B7B;IAEF,OAAO,CAAC,cAAc,CAoBpB;IAEF,OAAO,CAAC,eAAe,CAarB;IAEF;;OAEG;IACH,OAAO,GAAU,SAAS;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,eAAe,CAAC,CA2B1B;IAEF;;OAEG;IACH,iBAAiB,GAAU,CAAC,EAAE,SAAS;QACrC,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAyBvC;IAEF;;;OAGG;IACH,wBAAwB,GAAU,CAAC,EACjC,SAAS,+BAA+B,CAAC,CAAC,CAAC,KAC1C,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAqHtC;CACH;AAED,eAAO,MAAM,qBAAqB,GAAI,QAAQ,kBAAkB,KAAG,qBAElE,CAAC;AAEF,eAAO,MAAM,eAAe,WAJkB,kBAAkB,KAAG,qBAIf,CAAC;AACrD,OAAO,EAAE,qBAAqB,IAAI,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"control-layer.d.ts","sourceRoot":"","sources":["../src/control-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,+BAA+B,EAC/B,eAAe,EAIhB,MAAM,SAAS,CAAC;AAiBjB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,oBAAoB,CAAC,CAAuB;gBAExC,MAAM,EAAE,kBAAkB;IAgBtC,OAAO,CAAC,qBAAqB,CAU3B;IAEF,OAAO,CAAC,kBAAkB,CAaxB;IAEF,OAAO,CAAC,aAAa,CAcnB;IAEF,OAAO,CAAC,mBAAmB,CAezB;IAEF,OAAO,CAAC,yBAAyB,CAe/B;IAEF,OAAO,CAAC,oBAAoB,CAkC1B;IAEF,OAAO,CAAC,wBAAwB,CAW9B;IAEF,OAAO,CAAC,aAAa,CAOnB;IAEF,OAAO,CAAC,aAAa,CAUnB;IAEF,OAAO,CAAC,gBAAgB,CAMtB;IAEF,OAAO,CAAC,iBAAiB,CAsBvB;IAEF,OAAO,CAAC,uBAAuB,CAmB7B;IAEF,OAAO,CAAC,uBAAuB,CA+B7B;IAEF,OAAO,CAAC,cAAc,CAqBpB;IAEF,OAAO,CAAC,eAAe,CAarB;IAEF,OAAO,GAAU,SAAS;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,eAAe,CAAC,CA2B1B;IAGF,iBAAiB,GAAU,CAAC,EAAE,SAAS;QACrC,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAyBvC;IAEF,OAAO,CAAC,wBAAwB,CAO9B;IAEF,OAAO,CAAC,kBAAkB,CAIxB;IAEF,OAAO,CAAC,uBAAuB,CAe7B;IAEF,OAAO,CAAC,wBAAwB,CAqB9B;IAEF,OAAO,CAAC,uBAAuB,CAkB7B;IAEF,OAAO,CAAC,uBAAuB,CAY7B;IAEF,OAAO,CAAC,gCAAgC,CAiBtC;IAEF,OAAO,CAAC,qBAAqB,CAwB3B;IAEF,OAAO,CAAC,mBAAmB,CAazB;IAEF,OAAO,CAAC,gBAAgB,CAQtB;IAEF,wBAAwB,GAAU,CAAC,EACjC,SAAS,+BAA+B,CAAC,CAAC,CAAC,KAC1C,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAwCtC;CACH;AAED,eAAO,MAAM,qBAAqB,GAAI,QAAQ,kBAAkB,KAAG,qBAElE,CAAC;AAEF,eAAO,MAAM,eAAe,WAJkB,kBAAkB,KAAG,qBAIf,CAAC;AACrD,OAAO,EAAE,qBAAqB,IAAI,kBAAkB,EAAE,CAAC"}

package/dist/index.d.ts

@@ -8,4 +8,5 @@ export * from "./control-layer";
 export * from "./prompts";
 export * from "./providers/http-client";
 export * from "./workflow";
+export * from "./secret-guard";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -33,6 +33,7 @@ __export(index_exports, {
   AvantGateBudgetExceededError: () => BudgetExceededError,
   AvantGateConfigurationError: () => ConfigurationError,
   AvantGateControlLayer: () => AvantGateControlLayer,
+  AvantGateSecretLeakBlockedError: () => SecretLeakBlockedError,
   BudgetExceededError: () => BudgetExceededError,
   CachedPricingAdapter: () => CachedPricingAdapter,
   ConfigurationError: () => ConfigurationError,
@@ -43,11 +44,13 @@ __export(index_exports, {
   PromptRegistry: () => PromptRegistry,
   PromptTemplate: () => PromptTemplate,
   SEED_MODEL_PRICES: () => SEED_MODEL_PRICES,
+  SecretLeakBlockedError: () => SecretLeakBlockedError,
   SqlitePricingAdapter: () => SqlitePricingAdapter,
   WorkflowAbortSignal: () => WorkflowAbortSignal,
   WorkflowSagaRollbackError: () => WorkflowSagaRollbackError,
   WorkflowValidationError: () => WorkflowValidationError,
   ZenLLMControlLayer: () => AvantGateControlLayer,
+  applyOutputGuards: () => applyOutputGuards,
   calculateCostUSD: () => calculateCostUSD,
   createAvantGate: () => createAvantGate,
   createHttpProviderClient: () => createHttpProviderClient,
@@ -59,6 +62,7 @@ __export(index_exports, {
   resolveModelPrice: () => resolveModelPrice,
   resolveModelPriceAsync: () => resolveModelPriceAsync,
   sanitizePII: () => sanitizePII,
+  sanitizeSecrets: () => sanitizeSecrets,
   validateUserInput: () => validateUserInput,
   validateWithZod: () => validateWithZod
 });
@@ -77,6 +81,14 @@ var BudgetExceededError = class extends Error {
     this.name = "BudgetExceededError";
   }
 };
+var SecretLeakBlockedError = class extends Error {
+  detections;
+  constructor(message, detections) {
+    super(message);
+    this.name = "SecretLeakBlockedError";
+    this.detections = detections;
+  }
+};
 
 // src/sqlite-pricing-adapter.ts
 var import_fs = __toESM(require("fs"));
@@ -1160,6 +1172,109 @@ var createHttpProviderClient = (config) => {
   return new HttpProviderClient(config);
 };
 
+// src/secret-guard.ts
+var SECRET_PATTERNS = [
+  // 1. Clés privées (RSA, OpenSSH, EC, DSA)
+  {
+    type: "PRIVATE_KEY",
+    regex: /-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9_-]+ )?PRIVATE KEY-----/g,
+    mask: "[REDACTED_PRIVATE_KEY]"
+  },
+  // 2. Clés Anthropic Claude (avant OpenAI pour éviter collision sk-)
+  {
+    type: "ANTHROPIC_API_KEY",
+    regex: /\bsk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{20,}\b/g,
+    mask: "[REDACTED_ANTHROPIC_KEY]"
+  },
+  // 3. Clés OpenAI (standard, projet, admin) - exclut explicitement sk-ant-
+  {
+    type: "OPENAI_API_KEY",
+    regex: /\bsk-(?!ant-)(?:proj-|admin-|org-)?[A-Za-z0-9_-]{20,}\b/g,
+    mask: "[REDACTED_OPENAI_KEY]"
+  },
+  // 4. Clés AWS Access Key ID
+  {
+    type: "AWS_ACCESS_KEY",
+    regex: /\b(?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16}\b/g,
+    mask: "[REDACTED_AWS_KEY]"
+  },
+  // 5. Tokens GitHub (Personal, OAuth, User, Server)
+  {
+    type: "GITHUB_TOKEN",
+    regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/g,
+    mask: "[REDACTED_GITHUB_TOKEN]"
+  },
+  // 6. JSON Web Tokens (JWT)
+  {
+    type: "JWT_TOKEN",
+    regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g,
+    mask: "[REDACTED_JWT]"
+  },
+  // 7. Tokens Slack
+  {
+    type: "SLACK_TOKEN",
+    regex: /\bxox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}\b/g,
+    mask: "[REDACTED_SLACK_TOKEN]"
+  },
+  // 8. Mots de passe dans URL de connexion (Postgres, Mongo, Redis, MySQL)
+  {
+    type: "DATABASE_CONNECTION_SECRET",
+    regex: /(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:\s\/@]+:([^@\s]+)@/gi,
+    mask: "[REDACTED_DB_SECRET]"
+  }
+];
+var sanitizeSecrets = (input) => {
+  let text = input;
+  const detections = [];
+  for (const pattern of SECRET_PATTERNS) {
+    let matchCount = 0;
+    if (pattern.type === "DATABASE_CONNECTION_SECRET") {
+      text = text.replace(pattern.regex, (fullMatch, password) => {
+        matchCount++;
+        return fullMatch.replace(password, pattern.mask);
+      });
+    } else {
+      text = text.replace(pattern.regex, () => {
+        matchCount++;
+        return pattern.mask;
+      });
+    }
+    if (matchCount > 0) {
+      detections.push({ type: pattern.type, matchedCount: matchCount });
+    }
+  }
+  return {
+    text,
+    hasSecrets: detections.length > 0,
+    detections
+  };
+};
+var applyOutputGuards = (rawOutput, options) => {
+  let currentText = rawOutput;
+  let piiCount = 0;
+  if (options?.maskPII) {
+    const piiResult = sanitizePII(currentText);
+    currentText = piiResult.text;
+    piiCount = piiResult.maskedCount;
+  }
+  const secretResult = sanitizeSecrets(currentText);
+  currentText = secretResult.text;
+  if (secretResult.hasSecrets && options?.secretLeakAction === "BLOCK") {
+    const types = secretResult.detections.map((d) => d.type).join(", ");
+    throw new SecretLeakBlockedError(
+      `[AvantGate Output Guard] Response blocked: detected potential secret leak (${types})`,
+      secretResult.detections
+    );
+  }
+  return {
+    text: currentText,
+    sanitized: piiCount > 0 || secretResult.hasSecrets,
+    secretDetected: secretResult.hasSecrets,
+    piiMaskedCount: piiCount,
+    detections: secretResult.detections
+  };
+};
+
 // src/control-layer.ts
 var AvantGateControlLayer = class {
   config;
@@ -1225,6 +1340,19 @@ var AvantGateControlLayer = class {
     }
     return userQuery;
   };
+  applyOutputSecurityGuards = (rawOutput) => {
+    const isDlpEnabled = this.config.security?.outputDLP ?? this.config.security?.maskPII ?? false;
+    const shouldCheckSecrets = this.config.security?.blockSecretLeaks ?? true;
+    if (!isDlpEnabled && !shouldCheckSecrets) {
+      return rawOutput;
+    }
+    const guardResult = applyOutputGuards(rawOutput, {
+      maskPII: isDlpEnabled,
+      blockSecretLeaks: shouldCheckSecrets,
+      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT"
+    });
+    return guardResult.text;
+  };
   checkPreflightBudget = async (estimatedPromptTokens, targetModel, provider) => {
     if (this.config.maxTokenBudget !== void 0 && estimatedPromptTokens > this.config.maxTokenBudget) {
       throw new BudgetExceededError(
@@ -1291,19 +1419,20 @@ var AvantGateControlLayer = class {
       this.config.emergencyFallback
     ].filter((provider) => Boolean(provider?.client));
   };
-  executeSimulation = (query, systemPrompt) => {
+  executeSimulation = (query, systemPrompt, modelOverride) => {
+    const targetModel = modelOverride ?? this.config.primary.model;
     const promptTokens = Math.ceil(((systemPrompt?.length ?? 0) + query.length) / 4);
     const completionTokens = 50;
-    const cost = this.calculateCost(this.config.primary.model, promptTokens, completionTokens);
+    const cost = this.calculateCost(targetModel, promptTokens, completionTokens);
     return {
-      text: `[AvantGate In-Process Engine] Response simulation for model: ${this.config.primary.model}`,
+      text: `[AvantGate In-Process Engine] Response simulation for model: ${targetModel}`,
       tokens: {
         prompt: promptTokens,
         completion: completionTokens,
         total: promptTokens + completionTokens
       },
       costUSD: cost,
-      modelUsed: this.config.primary.model,
+      modelUsed: targetModel,
       failoverOccurred: false,
       attempts: 1
     };
@@ -1350,6 +1479,7 @@ var AvantGateControlLayer = class {
     throw lastError;
   };
   assembleResult = (output) => {
+    const sanitizedText = this.applyOutputSecurityGuards(output.responseText);
     const costUSD = this.calculateCost(
       output.modelUsed,
       output.usage.promptTokens,
@@ -1357,7 +1487,7 @@ var AvantGateControlLayer = class {
       output.usage.promptCacheHitTokens ?? 0
     );
     return {
-      text: output.responseText,
+      text: sanitizedText,
       tokens: {
         prompt: output.usage.promptTokens,
         completion: output.usage.completionTokens,
@@ -1382,9 +1512,6 @@ var AvantGateControlLayer = class {
       attempts: result.attempts
     });
   };
-  /**
-   * Exécute une requête avec garde d'entrée, masquage PII, garde pré-vol et calcul des coûts.
-   */
   execute = async (options) => {
     const sanitizedQuery = this.applySecurityGuards(options.userQuery);
     const messages = this.buildMessages(options.systemPrompt, sanitizedQuery);
@@ -1407,9 +1534,6 @@ var AvantGateControlLayer = class {
     await this.notifyAuditSink(result);
     return result;
   };
-  /**
-   * Exécute une requête et valide/répare le résultat selon un schéma Zod.
-   */
   executeStructured = async (options) => {
     const rawResult = await this.execute({
       userQuery: options.userQuery,
@@ -1433,106 +1557,147 @@ var AvantGateControlLayer = class {
       failoverOccurred: rawResult.failoverOccurred
     };
   };
-  /**
-   * Méthode unifiée de premier niveau pour l'extraction structurée sans code boilerplate.
-   * Gère le failover multi-fournisseurs, les retries, la validation Zod et la normalisation financière.
-   */
-  generateStructuredOutput = async (options) => {
-    const maxRetries = options.maxRetries ?? this.config.retryOptions?.maxRetries ?? 2;
-    const modelToUse = options.model ?? this.config.primary.model;
-    const processedMessages = options.messages.map((msg) => {
+  sanitizeIncomingMessages = (messages) => {
+    return messages.map((msg) => {
       if (msg.role === "user") {
         return { ...msg, content: this.applySecurityGuards(msg.content) };
       }
       return msg;
     });
-    const promptLength = processedMessages.reduce((sum, msg) => sum + msg.content.length, 0);
+  };
+  verifyPromptBudget = async (messages, model) => {
+    const promptLength = messages.reduce((sum, msg) => sum + msg.content.length, 0);
     const estimatedPromptTokens = Math.ceil(promptLength / 4);
-    await this.checkPreflightBudget(estimatedPromptTokens, modelToUse);
+    await this.checkPreflightBudget(estimatedPromptTokens, model);
+  };
+  dispatchOverrideAttempt = async (override, messages, model, temperature) => {
+    const res = await override.complete({ model, messages, temperature: temperature ?? 0.1 });
+    const usage = this.resolveTokens(res.usage, JSON.stringify(messages), res.text);
+    return {
+      responseText: res.text,
+      promptTokens: usage.promptTokens,
+      completionTokens: usage.completionTokens,
+      modelUsed: model,
+      failoverOccurred: false
+    };
+  };
+  dispatchSimulatedAttempt = (messages, modelOverride) => {
+    if (!this.config.mockSimulation) {
+      throw new ConfigurationError(
+        "[AvantGate Configuration Error] No active LLM provider configured. Provide a client implementing LLMProviderPort or configure credentials (apiKey / baseUrl)."
+      );
+    }
+    const sim = this.executeSimulation(JSON.stringify(messages), void 0, modelOverride);
+    const responseText = sim.text.includes("{") ? sim.text : JSON.stringify({ simulation: true, model: sim.modelUsed });
+    return {
+      responseText,
+      promptTokens: sim.tokens.prompt,
+      completionTokens: sim.tokens.completion,
+      modelUsed: sim.modelUsed,
+      failoverOccurred: false
+    };
+  };
+  dispatchPipelineAttempt = async (messages, modelOverride, temperature) => {
+    const output = await this.executeProviderPipeline(
+      messages,
+      JSON.stringify(messages),
+      temperature ?? 0.1,
+      modelOverride
+    );
+    return {
+      responseText: output.responseText,
+      promptTokens: output.usage.promptTokens,
+      completionTokens: output.usage.completionTokens,
+      modelUsed: output.modelUsed,
+      failoverOccurred: output.failoverOccurred
+    };
+  };
+  dispatchProviderAttempt = async (options, messages, targetModel) => {
+    if (options.providerOverride) {
+      return this.dispatchOverrideAttempt(options.providerOverride, messages, targetModel, options.temperature);
+    }
+    if (this.getProviderChain().length === 0) {
+      return this.dispatchSimulatedAttempt(messages, options.model);
+    }
+    return this.dispatchPipelineAttempt(messages, options.model ?? targetModel, options.temperature);
+  };
+  parseAndValidateStructuredResult = (rawText, options) => {
+    const sanitizedResponse = this.applyOutputSecurityGuards(rawText);
+    const isFinancial = options.financialNormalizer ?? Boolean(
+      this.config.features?.finance?.enableFrenchAccounting || this.config.features?.finance
+    );
+    const parsedData = validateWithZod(sanitizedResponse, options.schema, {
+      financialNormalizer: isFinancial,
+      jurisdiction: this.config.features?.finance?.jurisdiction
+    });
+    return { parsedData, sanitizedResponse };
+  };
+  buildStructuredResult = (params) => {
+    const totalTokens = params.promptTokens + params.completionTokens;
+    const costUSD = this.calculateCost(params.modelUsed, params.promptTokens, params.completionTokens);
+    this.checkPostExecutionBudget(totalTokens, costUSD);
+    return {
+      data: params.data,
+      rawText: params.rawText,
+      tokens: {
+        prompt: params.promptTokens,
+        completion: params.completionTokens,
+        total: totalTokens
+      },
+      costUSD,
+      modelUsed: params.modelUsed,
+      failoverOccurred: params.failoverOccurred
+    };
+  };
+  notifyAuditSinkSafe = async (sanitizedText, result, attempts) => {
+    await this.notifyAuditSink({
+      text: sanitizedText,
+      tokens: result.tokens,
+      costUSD: result.costUSD,
+      modelUsed: result.modelUsed,
+      failoverOccurred: result.failoverOccurred,
+      attempts
+    });
+  };
+  waitRetryBackoff = async (attempt, maxRetries) => {
+    if (attempt >= maxRetries) {
+      return;
+    }
+    const initialDelay = this.config.retryOptions?.initialDelayMs ?? 200;
+    const factor = this.config.retryOptions?.backoffFactor ?? 1.5;
+    const delay = initialDelay * Math.pow(factor, attempt);
+    await new Promise((resolve) => setTimeout(resolve, delay));
+  };
+  generateStructuredOutput = async (options) => {
+    const maxRetries = options.maxRetries ?? this.config.retryOptions?.maxRetries ?? 2;
+    const targetModel = options.model ?? this.config.primary.model;
+    const processedMessages = this.sanitizeIncomingMessages(options.messages);
+    await this.verifyPromptBudget(processedMessages, targetModel);
     let lastError;
     let accumulatedPromptTokens = 0;
     let accumulatedCompletionTokens = 0;
-    let failoverOccurred = false;
-    let modelUsed = modelToUse;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
-        let responseText = "";
-        let attemptPromptTokens = 0;
-        let attemptCompletionTokens = 0;
-        if (options.providerOverride) {
-          const res = await options.providerOverride.complete({
-            model: modelToUse,
-            messages: processedMessages,
-            temperature: options.temperature ?? 0.1
-          });
-          responseText = res.text;
-          const usage = this.resolveTokens(res.usage, JSON.stringify(processedMessages), responseText);
-          attemptPromptTokens = usage.promptTokens;
-          attemptCompletionTokens = usage.completionTokens;
-          modelUsed = modelToUse;
-        } else if (this.getProviderChain().length === 0) {
-          if (this.config.mockSimulation) {
-            const sim = this.executeSimulation(JSON.stringify(processedMessages));
-            responseText = sim.text;
-            attemptPromptTokens = sim.tokens.prompt;
-            attemptCompletionTokens = sim.tokens.completion;
-          } else {
-            throw new ConfigurationError(
-              "[AvantGate Configuration Error] No active LLM provider configured. Provide a client implementing LLMProviderPort or configure credentials (apiKey / baseUrl)."
-            );
-          }
-        } else {
-          const output = await this.executeProviderPipeline(
-            processedMessages,
-            JSON.stringify(processedMessages),
-            options.temperature ?? 0.1,
-            options.model
-          );
-          responseText = output.responseText;
-          attemptPromptTokens = output.usage.promptTokens;
-          attemptCompletionTokens = output.usage.completionTokens;
-          modelUsed = output.modelUsed;
-          failoverOccurred = output.failoverOccurred;
-        }
-        accumulatedPromptTokens += attemptPromptTokens;
-        accumulatedCompletionTokens += attemptCompletionTokens;
-        const isFinancial = options.financialNormalizer ?? Boolean(
-          this.config.features?.finance?.enableFrenchAccounting || this.config.features?.finance
+        const output = await this.dispatchProviderAttempt(options, processedMessages, targetModel);
+        accumulatedPromptTokens += output.promptTokens;
+        accumulatedCompletionTokens += output.completionTokens;
+        const { parsedData, sanitizedResponse } = this.parseAndValidateStructuredResult(
+          output.responseText,
+          options
         );
-        const parsedData = validateWithZod(responseText, options.schema, {
-          financialNormalizer: isFinancial,
-          jurisdiction: this.config.features?.finance?.jurisdiction
-        });
-        const totalTokens = accumulatedPromptTokens + accumulatedCompletionTokens;
-        const costUSD = this.calculateCost(modelUsed, accumulatedPromptTokens, accumulatedCompletionTokens);
-        this.checkPostExecutionBudget(totalTokens, costUSD);
-        const result = {
+        const result = this.buildStructuredResult({
           data: parsedData,
-          rawText: responseText,
-          tokens: {
-            prompt: accumulatedPromptTokens,
-            completion: accumulatedCompletionTokens,
-            total: totalTokens
-          },
-          costUSD,
-          modelUsed,
-          failoverOccurred
-        };
-        await this.notifyAuditSink({
-          text: responseText,
-          tokens: result.tokens,
-          costUSD: result.costUSD,
-          modelUsed: result.modelUsed,
-          failoverOccurred: result.failoverOccurred,
-          attempts: attempt + 1
+          rawText: sanitizedResponse,
+          promptTokens: accumulatedPromptTokens,
+          completionTokens: accumulatedCompletionTokens,
+          modelUsed: output.modelUsed,
+          failoverOccurred: output.failoverOccurred
         });
+        await this.notifyAuditSinkSafe(sanitizedResponse, result, attempt + 1);
         return result;
       } catch (err) {
         lastError = err;
-        if (attempt < maxRetries) {
-          const delay = (this.config.retryOptions?.initialDelayMs ?? 200) * Math.pow(this.config.retryOptions?.backoffFactor ?? 1.5, attempt);
-          await new Promise((resolve) => setTimeout(resolve, delay));
-        }
+        await this.waitRetryBackoff(attempt, maxRetries);
       }
     }
     throw lastError;
@@ -2449,6 +2614,7 @@ var defineWorkflow = (config) => {
   AvantGateBudgetExceededError,
   AvantGateConfigurationError,
   AvantGateControlLayer,
+  AvantGateSecretLeakBlockedError,
   BudgetExceededError,
   CachedPricingAdapter,
   ConfigurationError,
@@ -2459,11 +2625,13 @@ var defineWorkflow = (config) => {
   PromptRegistry,
   PromptTemplate,
   SEED_MODEL_PRICES,
+  SecretLeakBlockedError,
   SqlitePricingAdapter,
   WorkflowAbortSignal,
   WorkflowSagaRollbackError,
   WorkflowValidationError,
   ZenLLMControlLayer,
+  applyOutputGuards,
   calculateCostUSD,
   createAvantGate,
   createHttpProviderClient,
@@ -2475,6 +2643,7 @@ var defineWorkflow = (config) => {
   resolveModelPrice,
   resolveModelPriceAsync,
   sanitizePII,
+  sanitizeSecrets,
   validateUserInput,
   validateWithZod
 });

package/dist/index.mjs

@@ -30,6 +30,14 @@ var BudgetExceededError = class extends Error {
     this.name = "BudgetExceededError";
   }
 };
+var SecretLeakBlockedError = class extends Error {
+  detections;
+  constructor(message, detections) {
+    super(message);
+    this.name = "SecretLeakBlockedError";
+    this.detections = detections;
+  }
+};
 
 // src/sqlite-pricing-adapter.ts
 import fs from "fs";
@@ -554,6 +562,109 @@ var createHttpProviderClient = (config) => {
   return new HttpProviderClient(config);
 };
 
+// src/secret-guard.ts
+var SECRET_PATTERNS = [
+  // 1. Clés privées (RSA, OpenSSH, EC, DSA)
+  {
+    type: "PRIVATE_KEY",
+    regex: /-----BEGIN (?:[A-Z0-9_-]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z0-9_-]+ )?PRIVATE KEY-----/g,
+    mask: "[REDACTED_PRIVATE_KEY]"
+  },
+  // 2. Clés Anthropic Claude (avant OpenAI pour éviter collision sk-)
+  {
+    type: "ANTHROPIC_API_KEY",
+    regex: /\bsk-ant-(?:api\d{2}-)?[A-Za-z0-9_-]{20,}\b/g,
+    mask: "[REDACTED_ANTHROPIC_KEY]"
+  },
+  // 3. Clés OpenAI (standard, projet, admin) - exclut explicitement sk-ant-
+  {
+    type: "OPENAI_API_KEY",
+    regex: /\bsk-(?!ant-)(?:proj-|admin-|org-)?[A-Za-z0-9_-]{20,}\b/g,
+    mask: "[REDACTED_OPENAI_KEY]"
+  },
+  // 4. Clés AWS Access Key ID
+  {
+    type: "AWS_ACCESS_KEY",
+    regex: /\b(?:AKIA|ABIA|ACCA|ASIA)[0-9A-Z]{16}\b/g,
+    mask: "[REDACTED_AWS_KEY]"
+  },
+  // 5. Tokens GitHub (Personal, OAuth, User, Server)
+  {
+    type: "GITHUB_TOKEN",
+    regex: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,255}\b/g,
+    mask: "[REDACTED_GITHUB_TOKEN]"
+  },
+  // 6. JSON Web Tokens (JWT)
+  {
+    type: "JWT_TOKEN",
+    regex: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9._-]{10,}\.[A-Za-z0-9._-]{10,}\b/g,
+    mask: "[REDACTED_JWT]"
+  },
+  // 7. Tokens Slack
+  {
+    type: "SLACK_TOKEN",
+    regex: /\bxox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}\b/g,
+    mask: "[REDACTED_SLACK_TOKEN]"
+  },
+  // 8. Mots de passe dans URL de connexion (Postgres, Mongo, Redis, MySQL)
+  {
+    type: "DATABASE_CONNECTION_SECRET",
+    regex: /(?:postgres|postgresql|mysql|mongodb(?:\+srv)?|redis|amqp):\/\/[^:\s\/@]+:([^@\s]+)@/gi,
+    mask: "[REDACTED_DB_SECRET]"
+  }
+];
+var sanitizeSecrets = (input) => {
+  let text = input;
+  const detections = [];
+  for (const pattern of SECRET_PATTERNS) {
+    let matchCount = 0;
+    if (pattern.type === "DATABASE_CONNECTION_SECRET") {
+      text = text.replace(pattern.regex, (fullMatch, password) => {
+        matchCount++;
+        return fullMatch.replace(password, pattern.mask);
+      });
+    } else {
+      text = text.replace(pattern.regex, () => {
+        matchCount++;
+        return pattern.mask;
+      });
+    }
+    if (matchCount > 0) {
+      detections.push({ type: pattern.type, matchedCount: matchCount });
+    }
+  }
+  return {
+    text,
+    hasSecrets: detections.length > 0,
+    detections
+  };
+};
+var applyOutputGuards = (rawOutput, options) => {
+  let currentText = rawOutput;
+  let piiCount = 0;
+  if (options?.maskPII) {
+    const piiResult = sanitizePII(currentText);
+    currentText = piiResult.text;
+    piiCount = piiResult.maskedCount;
+  }
+  const secretResult = sanitizeSecrets(currentText);
+  currentText = secretResult.text;
+  if (secretResult.hasSecrets && options?.secretLeakAction === "BLOCK") {
+    const types = secretResult.detections.map((d) => d.type).join(", ");
+    throw new SecretLeakBlockedError(
+      `[AvantGate Output Guard] Response blocked: detected potential secret leak (${types})`,
+      secretResult.detections
+    );
+  }
+  return {
+    text: currentText,
+    sanitized: piiCount > 0 || secretResult.hasSecrets,
+    secretDetected: secretResult.hasSecrets,
+    piiMaskedCount: piiCount,
+    detections: secretResult.detections
+  };
+};
+
 // src/control-layer.ts
 var AvantGateControlLayer = class {
   config;
@@ -619,6 +730,19 @@ var AvantGateControlLayer = class {
     }
     return userQuery;
   };
+  applyOutputSecurityGuards = (rawOutput) => {
+    const isDlpEnabled = this.config.security?.outputDLP ?? this.config.security?.maskPII ?? false;
+    const shouldCheckSecrets = this.config.security?.blockSecretLeaks ?? true;
+    if (!isDlpEnabled && !shouldCheckSecrets) {
+      return rawOutput;
+    }
+    const guardResult = applyOutputGuards(rawOutput, {
+      maskPII: isDlpEnabled,
+      blockSecretLeaks: shouldCheckSecrets,
+      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT"
+    });
+    return guardResult.text;
+  };
   checkPreflightBudget = async (estimatedPromptTokens, targetModel, provider) => {
     if (this.config.maxTokenBudget !== void 0 && estimatedPromptTokens > this.config.maxTokenBudget) {
       throw new BudgetExceededError(
@@ -685,19 +809,20 @@ var AvantGateControlLayer = class {
       this.config.emergencyFallback
     ].filter((provider) => Boolean(provider?.client));
   };
-  executeSimulation = (query, systemPrompt) => {
+  executeSimulation = (query, systemPrompt, modelOverride) => {
+    const targetModel = modelOverride ?? this.config.primary.model;
     const promptTokens = Math.ceil(((systemPrompt?.length ?? 0) + query.length) / 4);
     const completionTokens = 50;
-    const cost = this.calculateCost(this.config.primary.model, promptTokens, completionTokens);
+    const cost = this.calculateCost(targetModel, promptTokens, completionTokens);
     return {
-      text: `[AvantGate In-Process Engine] Response simulation for model: ${this.config.primary.model}`,
+      text: `[AvantGate In-Process Engine] Response simulation for model: ${targetModel}`,
       tokens: {
         prompt: promptTokens,
         completion: completionTokens,
         total: promptTokens + completionTokens
       },
       costUSD: cost,
-      modelUsed: this.config.primary.model,
+      modelUsed: targetModel,
       failoverOccurred: false,
       attempts: 1
     };
@@ -744,6 +869,7 @@ var AvantGateControlLayer = class {
     throw lastError;
   };
   assembleResult = (output) => {
+    const sanitizedText = this.applyOutputSecurityGuards(output.responseText);
     const costUSD = this.calculateCost(
       output.modelUsed,
       output.usage.promptTokens,
@@ -751,7 +877,7 @@ var AvantGateControlLayer = class {
       output.usage.promptCacheHitTokens ?? 0
     );
     return {
-      text: output.responseText,
+      text: sanitizedText,
       tokens: {
         prompt: output.usage.promptTokens,
         completion: output.usage.completionTokens,
@@ -776,9 +902,6 @@ var AvantGateControlLayer = class {
       attempts: result.attempts
     });
   };
-  /**
-   * Exécute une requête avec garde d'entrée, masquage PII, garde pré-vol et calcul des coûts.
-   */
   execute = async (options) => {
     const sanitizedQuery = this.applySecurityGuards(options.userQuery);
     const messages = this.buildMessages(options.systemPrompt, sanitizedQuery);
@@ -801,9 +924,6 @@ var AvantGateControlLayer = class {
     await this.notifyAuditSink(result);
     return result;
   };
-  /**
-   * Exécute une requête et valide/répare le résultat selon un schéma Zod.
-   */
   executeStructured = async (options) => {
     const rawResult = await this.execute({
       userQuery: options.userQuery,
@@ -827,106 +947,147 @@ var AvantGateControlLayer = class {
       failoverOccurred: rawResult.failoverOccurred
     };
   };
-  /**
-   * Méthode unifiée de premier niveau pour l'extraction structurée sans code boilerplate.
-   * Gère le failover multi-fournisseurs, les retries, la validation Zod et la normalisation financière.
-   */
-  generateStructuredOutput = async (options) => {
-    const maxRetries = options.maxRetries ?? this.config.retryOptions?.maxRetries ?? 2;
-    const modelToUse = options.model ?? this.config.primary.model;
-    const processedMessages = options.messages.map((msg) => {
+  sanitizeIncomingMessages = (messages) => {
+    return messages.map((msg) => {
       if (msg.role === "user") {
         return { ...msg, content: this.applySecurityGuards(msg.content) };
       }
       return msg;
     });
-    const promptLength = processedMessages.reduce((sum, msg) => sum + msg.content.length, 0);
+  };
+  verifyPromptBudget = async (messages, model) => {
+    const promptLength = messages.reduce((sum, msg) => sum + msg.content.length, 0);
     const estimatedPromptTokens = Math.ceil(promptLength / 4);
-    await this.checkPreflightBudget(estimatedPromptTokens, modelToUse);
+    await this.checkPreflightBudget(estimatedPromptTokens, model);
+  };
+  dispatchOverrideAttempt = async (override, messages, model, temperature) => {
+    const res = await override.complete({ model, messages, temperature: temperature ?? 0.1 });
+    const usage = this.resolveTokens(res.usage, JSON.stringify(messages), res.text);
+    return {
+      responseText: res.text,
+      promptTokens: usage.promptTokens,
+      completionTokens: usage.completionTokens,
+      modelUsed: model,
+      failoverOccurred: false
+    };
+  };
+  dispatchSimulatedAttempt = (messages, modelOverride) => {
+    if (!this.config.mockSimulation) {
+      throw new ConfigurationError(
+        "[AvantGate Configuration Error] No active LLM provider configured. Provide a client implementing LLMProviderPort or configure credentials (apiKey / baseUrl)."
+      );
+    }
+    const sim = this.executeSimulation(JSON.stringify(messages), void 0, modelOverride);
+    const responseText = sim.text.includes("{") ? sim.text : JSON.stringify({ simulation: true, model: sim.modelUsed });
+    return {
+      responseText,
+      promptTokens: sim.tokens.prompt,
+      completionTokens: sim.tokens.completion,
+      modelUsed: sim.modelUsed,
+      failoverOccurred: false
+    };
+  };
+  dispatchPipelineAttempt = async (messages, modelOverride, temperature) => {
+    const output = await this.executeProviderPipeline(
+      messages,
+      JSON.stringify(messages),
+      temperature ?? 0.1,
+      modelOverride
+    );
+    return {
+      responseText: output.responseText,
+      promptTokens: output.usage.promptTokens,
+      completionTokens: output.usage.completionTokens,
+      modelUsed: output.modelUsed,
+      failoverOccurred: output.failoverOccurred
+    };
+  };
+  dispatchProviderAttempt = async (options, messages, targetModel) => {
+    if (options.providerOverride) {
+      return this.dispatchOverrideAttempt(options.providerOverride, messages, targetModel, options.temperature);
+    }
+    if (this.getProviderChain().length === 0) {
+      return this.dispatchSimulatedAttempt(messages, options.model);
+    }
+    return this.dispatchPipelineAttempt(messages, options.model ?? targetModel, options.temperature);
+  };
+  parseAndValidateStructuredResult = (rawText, options) => {
+    const sanitizedResponse = this.applyOutputSecurityGuards(rawText);
+    const isFinancial = options.financialNormalizer ?? Boolean(
+      this.config.features?.finance?.enableFrenchAccounting || this.config.features?.finance
+    );
+    const parsedData = validateWithZod(sanitizedResponse, options.schema, {
+      financialNormalizer: isFinancial,
+      jurisdiction: this.config.features?.finance?.jurisdiction
+    });
+    return { parsedData, sanitizedResponse };
+  };
+  buildStructuredResult = (params) => {
+    const totalTokens = params.promptTokens + params.completionTokens;
+    const costUSD = this.calculateCost(params.modelUsed, params.promptTokens, params.completionTokens);
+    this.checkPostExecutionBudget(totalTokens, costUSD);
+    return {
+      data: params.data,
+      rawText: params.rawText,
+      tokens: {
+        prompt: params.promptTokens,
+        completion: params.completionTokens,
+        total: totalTokens
+      },
+      costUSD,
+      modelUsed: params.modelUsed,
+      failoverOccurred: params.failoverOccurred
+    };
+  };
+  notifyAuditSinkSafe = async (sanitizedText, result, attempts) => {
+    await this.notifyAuditSink({
+      text: sanitizedText,
+      tokens: result.tokens,
+      costUSD: result.costUSD,
+      modelUsed: result.modelUsed,
+      failoverOccurred: result.failoverOccurred,
+      attempts
+    });
+  };
+  waitRetryBackoff = async (attempt, maxRetries) => {
+    if (attempt >= maxRetries) {
+      return;
+    }
+    const initialDelay = this.config.retryOptions?.initialDelayMs ?? 200;
+    const factor = this.config.retryOptions?.backoffFactor ?? 1.5;
+    const delay = initialDelay * Math.pow(factor, attempt);
+    await new Promise((resolve) => setTimeout(resolve, delay));
+  };
+  generateStructuredOutput = async (options) => {
+    const maxRetries = options.maxRetries ?? this.config.retryOptions?.maxRetries ?? 2;
+    const targetModel = options.model ?? this.config.primary.model;
+    const processedMessages = this.sanitizeIncomingMessages(options.messages);
+    await this.verifyPromptBudget(processedMessages, targetModel);
     let lastError;
     let accumulatedPromptTokens = 0;
     let accumulatedCompletionTokens = 0;
-    let failoverOccurred = false;
-    let modelUsed = modelToUse;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
-        let responseText = "";
-        let attemptPromptTokens = 0;
-        let attemptCompletionTokens = 0;
-        if (options.providerOverride) {
-          const res = await options.providerOverride.complete({
-            model: modelToUse,
-            messages: processedMessages,
-            temperature: options.temperature ?? 0.1
-          });
-          responseText = res.text;
-          const usage = this.resolveTokens(res.usage, JSON.stringify(processedMessages), responseText);
-          attemptPromptTokens = usage.promptTokens;
-          attemptCompletionTokens = usage.completionTokens;
-          modelUsed = modelToUse;
-        } else if (this.getProviderChain().length === 0) {
-          if (this.config.mockSimulation) {
-            const sim = this.executeSimulation(JSON.stringify(processedMessages));
-            responseText = sim.text;
-            attemptPromptTokens = sim.tokens.prompt;
-            attemptCompletionTokens = sim.tokens.completion;
-          } else {
-            throw new ConfigurationError(
-              "[AvantGate Configuration Error] No active LLM provider configured. Provide a client implementing LLMProviderPort or configure credentials (apiKey / baseUrl)."
-            );
-          }
-        } else {
-          const output = await this.executeProviderPipeline(
-            processedMessages,
-            JSON.stringify(processedMessages),
-            options.temperature ?? 0.1,
-            options.model
-          );
-          responseText = output.responseText;
-          attemptPromptTokens = output.usage.promptTokens;
-          attemptCompletionTokens = output.usage.completionTokens;
-          modelUsed = output.modelUsed;
-          failoverOccurred = output.failoverOccurred;
-        }
-        accumulatedPromptTokens += attemptPromptTokens;
-        accumulatedCompletionTokens += attemptCompletionTokens;
-        const isFinancial = options.financialNormalizer ?? Boolean(
-          this.config.features?.finance?.enableFrenchAccounting || this.config.features?.finance
+        const output = await this.dispatchProviderAttempt(options, processedMessages, targetModel);
+        accumulatedPromptTokens += output.promptTokens;
+        accumulatedCompletionTokens += output.completionTokens;
+        const { parsedData, sanitizedResponse } = this.parseAndValidateStructuredResult(
+          output.responseText,
+          options
         );
-        const parsedData = validateWithZod(responseText, options.schema, {
-          financialNormalizer: isFinancial,
-          jurisdiction: this.config.features?.finance?.jurisdiction
-        });
-        const totalTokens = accumulatedPromptTokens + accumulatedCompletionTokens;
-        const costUSD = this.calculateCost(modelUsed, accumulatedPromptTokens, accumulatedCompletionTokens);
-        this.checkPostExecutionBudget(totalTokens, costUSD);
-        const result = {
+        const result = this.buildStructuredResult({
           data: parsedData,
-          rawText: responseText,
-          tokens: {
-            prompt: accumulatedPromptTokens,
-            completion: accumulatedCompletionTokens,
-            total: totalTokens
-          },
-          costUSD,
-          modelUsed,
-          failoverOccurred
-        };
-        await this.notifyAuditSink({
-          text: responseText,
-          tokens: result.tokens,
-          costUSD: result.costUSD,
-          modelUsed: result.modelUsed,
-          failoverOccurred: result.failoverOccurred,
-          attempts: attempt + 1
+          rawText: sanitizedResponse,
+          promptTokens: accumulatedPromptTokens,
+          completionTokens: accumulatedCompletionTokens,
+          modelUsed: output.modelUsed,
+          failoverOccurred: output.failoverOccurred
         });
+        await this.notifyAuditSinkSafe(sanitizedResponse, result, attempt + 1);
         return result;
       } catch (err) {
         lastError = err;
-        if (attempt < maxRetries) {
-          const delay = (this.config.retryOptions?.initialDelayMs ?? 200) * Math.pow(this.config.retryOptions?.backoffFactor ?? 1.5, attempt);
-          await new Promise((resolve) => setTimeout(resolve, delay));
-        }
+        await this.waitRetryBackoff(attempt, maxRetries);
       }
     }
     throw lastError;
@@ -1255,6 +1416,7 @@ export {
   BudgetExceededError as AvantGateBudgetExceededError,
   ConfigurationError as AvantGateConfigurationError,
   AvantGateControlLayer,
+  SecretLeakBlockedError as AvantGateSecretLeakBlockedError,
   BudgetExceededError,
   CachedPricingAdapter,
   ConfigurationError,
@@ -1265,11 +1427,13 @@ export {
   PromptRegistry,
   PromptTemplate,
   SEED_MODEL_PRICES,
+  SecretLeakBlockedError,
   SqlitePricingAdapter,
   WorkflowAbortSignal,
   WorkflowSagaRollbackError,
   WorkflowValidationError,
   AvantGateControlLayer as ZenLLMControlLayer,
+  applyOutputGuards,
   calculateCostUSD,
   createAvantGate,
   createHttpProviderClient,
@@ -1281,6 +1445,7 @@ export {
   resolveModelPrice,
   resolveModelPriceAsync,
   sanitizePII,
+  sanitizeSecrets,
   validateUserInput,
   validateWithZod
 };

package/dist/secret-guard.d.ts

@@ -0,0 +1,29 @@
+export interface SecretPatternDef {
+    type: string;
+    regex: RegExp;
+    mask: string;
+}
+export interface SecretDetection {
+    type: string;
+    matchedCount: number;
+}
+export interface SanitizeSecretsResult {
+    text: string;
+    hasSecrets: boolean;
+    detections: SecretDetection[];
+}
+export declare const sanitizeSecrets: (input: string) => SanitizeSecretsResult;
+export interface OutputGuardOptions {
+    maskPII?: boolean;
+    blockSecretLeaks?: boolean;
+    secretLeakAction?: "REDACT" | "BLOCK";
+}
+export interface OutputGuardResult {
+    text: string;
+    sanitized: boolean;
+    secretDetected: boolean;
+    piiMaskedCount: number;
+    detections: SecretDetection[];
+}
+export declare const applyOutputGuards: (rawOutput: string, options?: OutputGuardOptions) => OutputGuardResult;
+//# sourceMappingURL=secret-guard.d.ts.map

package/dist/secret-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-guard.d.ts","sourceRoot":"","sources":["../src/secret-guard.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAqDD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,qBA4B/C,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,UAAU,kBAAkB,KAC3B,iBA+BF,CAAC"}

package/dist/types.d.ts

@@ -46,8 +46,19 @@ export declare class ConfigurationError extends Error {
 export declare class BudgetExceededError extends Error {
     constructor(message: string);
 }
+export declare class SecretLeakBlockedError extends Error {
+    readonly detections?: Array<{
+        type: string;
+        matchedCount: number;
+    }>;
+    constructor(message: string, detections?: Array<{
+        type: string;
+        matchedCount: number;
+    }>);
+}
 export { ConfigurationError as AvantGateConfigurationError };
 export { BudgetExceededError as AvantGateBudgetExceededError };
+export { SecretLeakBlockedError as AvantGateSecretLeakBlockedError };
 export interface ProviderConfig {
     provider: "deepseek" | "mistral" | "openai" | "ollama" | "openrouter" | "custom";
     model: string;
@@ -60,6 +71,9 @@ export interface SecurityConfig {
     detectPromptInjection?: boolean;
     maskPII?: boolean;
     maxInputLength?: number;
+    outputDLP?: boolean;
+    blockSecretLeaks?: boolean;
+    secretLeakAction?: "REDACT" | "BLOCK";
 }
 export interface RetryConfig {
     maxRetries?: number;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACrF,MAAM,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACrF,wBAAwB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;CACxG;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,CAAC;AAC7D,OAAO,EAAE,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;AAE/D,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,eAAe,CAAC;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACrF,MAAM,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACrF,wBAAwB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;CACxG;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAExD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAKxF;AAED,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,CAAC;AAC7D,OAAO,EAAE,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;AAC/D,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,EAAE,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,eAAe,CAAC;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "avantgate",
-  "version": "1.7.0",
+  "version": "1.8.1",
   "description": "Zero-infrastructure, in-process AI Application Firewall (AI-WAF) & privacy control plane for TypeScript: real-time prompt guardrails, zero-egress PII redaction, agent tool isolation, anti-IDOR defense, pre-flight token budgets, and multi-model failover.",
   "author": "Gatewall Team",
   "license": "MIT",
@@ -82,7 +82,8 @@
   ],
   "scripts": {
     "build": "tsup src/index.ts src/finance/index.ts src/agent/index.ts src/workflow/index.ts src/client/index.ts --format cjs --format esm --clean && tsc --emitDeclarationOnly --outDir dist",
-    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/sqlite-pricing-adapter.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && npm run test:agent && npm run test:workflow && npm run test:client",
+    "test": "tsx tests/avantgate.test.ts && tsx tests/preflight-budget.test.ts && tsx tests/sqlite-pricing-adapter.test.ts && tsx tests/financial-normalizer.test.ts && tsx tests/prompt-builder.test.ts && tsx tests/pii-extended.test.ts && tsx tests/output-dlp-secret-guard.test.ts && npm run test:agent && npm run test:workflow && npm run test:client",
+    "test:secrets": "tsx tests/output-dlp-secret-guard.test.ts",
     "test:pricing": "tsx tests/sqlite-pricing-adapter.test.ts",
     "test:finance": "tsx tests/financial-normalizer.test.ts",
     "test:prompts": "tsx tests/prompt-builder.test.ts",