avantgate 2.1.0 → 2.3.0

package/dist/index.js

@@ -39,6 +39,7 @@ __export(index_exports, {
   ConfigurationError: () => ConfigurationError,
   DEFAULT_MODEL_PRICES: () => DEFAULT_MODEL_PRICES,
   HttpProviderClient: () => HttpProviderClient,
+  PRESETS: () => PRESETS,
   PricingRegistry: () => PricingRegistry,
   PromptBuilder: () => PromptBuilder,
   PromptRegistry: () => PromptRegistry,
@@ -51,16 +52,24 @@ __export(index_exports, {
   WorkflowValidationError: () => WorkflowValidationError,
   ZenLLMControlLayer: () => AvantGateControlLayer,
   applyOutputGuards: () => applyOutputGuards,
+  applySingleAfterMiddleware: () => applySingleAfterMiddleware,
+  applySingleBeforeMiddleware: () => applySingleBeforeMiddleware,
   calculateCostUSD: () => calculateCostUSD,
   createAvantGate: () => createAvantGate,
+  createDevPermissiveConfig: () => createDevPermissiveConfig,
+  createEnterpriseStrictConfig: () => createEnterpriseStrictConfig,
   createHttpProviderClient: () => createHttpProviderClient,
   createLLMControlLayer: () => createLLMControlLayer,
+  createLaunchSafeConfig: () => createLaunchSafeConfig,
   defineWorkflow: () => defineWorkflow,
+  executeAfterResponseHooks: () => executeAfterResponseHooks,
+  executeBeforeRequestHooks: () => executeBeforeRequestHooks,
   executeWorkflow: () => executeWorkflow,
   extractAndCleanJSON: () => extractAndCleanJSON,
   isWorkflowAbortSignal: () => isWorkflowAbortSignal,
   resolveModelPrice: () => resolveModelPrice,
   resolveModelPriceAsync: () => resolveModelPriceAsync,
+  sanitizeCustomTerms: () => sanitizeCustomTerms,
   sanitizePII: () => sanitizePII,
   sanitizeSecrets: () => sanitizeSecrets,
   validateUserInput: () => validateUserInput,
@@ -1172,6 +1181,70 @@ var createHttpProviderClient = (config) => {
   return new HttpProviderClient(config);
 };
 
+// src/custom-terms.ts
+var DEFAULT_MASKS = {
+  PROJECT: "[REDACTED_PROJECT]",
+  COMPANY: "[REDACTED_COMPANY]",
+  INFRA: "[REDACTED_INFRA]",
+  CUSTOM: "[REDACTED_CUSTOM]"
+};
+var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var resolveTermDefinition = (entry) => {
+  if (typeof entry === "string") {
+    return {
+      term: entry.trim(),
+      mask: DEFAULT_MASKS.CUSTOM,
+      category: "CUSTOM",
+      caseSensitive: false
+    };
+  }
+  const category = entry.category ?? "CUSTOM";
+  return {
+    term: entry.term.trim(),
+    mask: entry.mask ?? (DEFAULT_MASKS[category] ?? DEFAULT_MASKS.CUSTOM),
+    category,
+    caseSensitive: Boolean(entry.caseSensitive)
+  };
+};
+var buildTermRegex = (def) => {
+  const escaped = escapeRegex(def.term);
+  const leadingBoundary = /^\w/.test(def.term) ? "\\b" : "";
+  const trailingBoundary = /\w$/.test(def.term) ? "\\b" : "";
+  return new RegExp(`${leadingBoundary}${escaped}${trailingBoundary}`, def.caseSensitive ? "g" : "gi");
+};
+var replaceTermsInText = (initialText, definitions) => {
+  let currentText = initialText;
+  let totalMaskedCount = 0;
+  const matchedTermsSet = /* @__PURE__ */ new Set();
+  for (const item of definitions) {
+    const regex = buildTermRegex(item);
+    let matchCount = 0;
+    currentText = currentText.replace(regex, () => {
+      matchCount++;
+      return item.mask;
+    });
+    if (matchCount > 0) {
+      totalMaskedCount += matchCount;
+      matchedTermsSet.add(item.term);
+    }
+  }
+  return {
+    text: currentText,
+    maskedCount: totalMaskedCount,
+    matchedTerms: Array.from(matchedTermsSet)
+  };
+};
+var sanitizeCustomTerms = (input, terms) => {
+  if (!input || !terms || terms.length === 0) {
+    return { text: input, maskedCount: 0, matchedTerms: [] };
+  }
+  const normalized = terms.map(resolveTermDefinition).filter((t) => t.term.length > 0).sort((a, b) => b.term.length - a.term.length);
+  if (normalized.length === 0) {
+    return { text: input, maskedCount: 0, matchedTerms: [] };
+  }
+  return replaceTermsInText(input, normalized);
+};
+
 // src/secret-guard.ts
 var SECRET_PATTERNS = [
   // 1. Clés privées (RSA, OpenSSH, EC, DSA)
@@ -1252,6 +1325,7 @@ var sanitizeSecrets = (input) => {
 var applyOutputGuards = (rawOutput, options) => {
   let currentText = rawOutput;
   let piiCount = 0;
+  let customTermsCount = 0;
   if (options?.maskPII) {
     const piiResult = sanitizePII(currentText);
     currentText = piiResult.text;
@@ -1259,6 +1333,11 @@ var applyOutputGuards = (rawOutput, options) => {
   }
   const secretResult = sanitizeSecrets(currentText);
   currentText = secretResult.text;
+  if (options?.customRedactionTerms && options.customRedactionTerms.length > 0) {
+    const customResult = sanitizeCustomTerms(currentText, options.customRedactionTerms);
+    currentText = customResult.text;
+    customTermsCount = customResult.maskedCount;
+  }
   if (secretResult.hasSecrets && options?.secretLeakAction === "BLOCK") {
     const types = secretResult.detections.map((d) => d.type).join(", ");
     throw new SecretLeakBlockedError(
@@ -1268,13 +1347,71 @@ var applyOutputGuards = (rawOutput, options) => {
   }
   return {
     text: currentText,
-    sanitized: piiCount > 0 || secretResult.hasSecrets,
+    sanitized: piiCount > 0 || secretResult.hasSecrets || customTermsCount > 0,
     secretDetected: secretResult.hasSecrets,
     piiMaskedCount: piiCount,
+    customTermsMaskedCount: customTermsCount,
     detections: secretResult.detections
   };
 };
 
+// src/middleware.ts
+var applySingleBeforeMiddleware = async (middleware, current, model, temperature) => {
+  if (!middleware.beforeRequest) return current;
+  const result = await middleware.beforeRequest({
+    messages: current.messages,
+    model,
+    temperature,
+    metadata: current.metadata
+  });
+  if (!result) return current;
+  return {
+    messages: result.messages ?? current.messages,
+    shortCircuit: result.shortCircuit,
+    metadata: current.metadata
+  };
+};
+var executeBeforeRequestHooks = async (middlewares, context) => {
+  if (!middlewares || middlewares.length === 0) {
+    return { messages: context.messages, metadata: context.metadata };
+  }
+  let current = {
+    messages: context.messages,
+    metadata: context.metadata
+  };
+  for (const middleware of middlewares) {
+    current = await applySingleBeforeMiddleware(middleware, current, context.model, context.temperature);
+    if (current.shortCircuit) return current;
+  }
+  return current;
+};
+var applySingleAfterMiddleware = async (middleware, current, baseContext) => {
+  if (!middleware.afterResponse) return current;
+  const result = await middleware.afterResponse({
+    ...baseContext,
+    responseText: current.responseText,
+    metadata: current.metadata
+  });
+  if (!result) return current;
+  return {
+    responseText: result.responseText ?? current.responseText,
+    metadata: result.metadata ?? current.metadata
+  };
+};
+var executeAfterResponseHooks = async (middlewares, context) => {
+  if (!middlewares || middlewares.length === 0) {
+    return { responseText: context.responseText, metadata: context.metadata };
+  }
+  let current = {
+    responseText: context.responseText,
+    metadata: context.metadata
+  };
+  for (const middleware of middlewares) {
+    current = await applySingleAfterMiddleware(middleware, current, context);
+  }
+  return current;
+};
+
 // src/control-layer.ts
 var AvantGateControlLayer = class {
   config;
@@ -1335,21 +1472,27 @@ var AvantGateControlLayer = class {
     if (!guard.valid) {
       throw new Error(`[AvantGate Security Guard] Request blocked: ${guard.blockedReason}`);
     }
+    let processed = userQuery;
+    if (this.config.security?.customRedactionTerms && this.config.security.customRedactionTerms.length > 0) {
+      processed = sanitizeCustomTerms(processed, this.config.security.customRedactionTerms).text;
+    }
     if (this.config.security?.maskPII) {
-      return sanitizePII(userQuery).text;
+      return sanitizePII(processed).text;
     }
-    return userQuery;
+    return processed;
   };
   applyOutputSecurityGuards = (rawOutput) => {
     const isDlpEnabled = this.config.security?.outputDLP ?? this.config.security?.maskPII ?? false;
     const shouldCheckSecrets = this.config.security?.blockSecretLeaks ?? true;
-    if (!isDlpEnabled && !shouldCheckSecrets) {
+    const customTerms = this.config.security?.customRedactionTerms;
+    if (!isDlpEnabled && !shouldCheckSecrets && (!customTerms || customTerms.length === 0)) {
       return rawOutput;
     }
     const guardResult = applyOutputGuards(rawOutput, {
       maskPII: isDlpEnabled,
       blockSecretLeaks: shouldCheckSecrets,
-      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT"
+      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT",
+      customRedactionTerms: customTerms
     });
     return guardResult.text;
   };
@@ -1512,28 +1655,103 @@ var AvantGateControlLayer = class {
       attempts: result.attempts
     });
   };
-  execute = async (options) => {
-    const sanitizedQuery = this.applySecurityGuards(options.userQuery);
-    const messages = this.buildMessages(options.systemPrompt, sanitizedQuery);
-    const promptLength = (options.systemPrompt?.length ?? 0) + sanitizedQuery.length;
-    const estimatedPromptTokens = Math.ceil(promptLength / 4);
-    await this.checkPreflightBudget(estimatedPromptTokens, this.config.primary.model, this.config.primary.provider);
-    if (!options.providerOverride && this.getProviderChain().length === 0) {
+  prepareInputMessages = (options) => {
+    if (options.messages && options.messages.length > 0) {
+      return this.sanitizeIncomingMessages(options.messages);
+    }
+    if (options.userQuery !== void 0) {
+      const sanitizedQuery = this.applySecurityGuards(options.userQuery);
+      return this.buildMessages(options.systemPrompt, sanitizedQuery);
+    }
+    throw new ConfigurationError("[AvantGate Input Guard] Either 'userQuery' or 'messages' must be provided.");
+  };
+  handleShortCircuit = async (shortCircuit, targetModel) => {
+    const sanitizedText = this.applyOutputSecurityGuards(shortCircuit.text);
+    const result = {
+      text: sanitizedText,
+      tokens: {
+        prompt: shortCircuit.tokens?.promptTokens ?? 0,
+        completion: shortCircuit.tokens?.completionTokens ?? 0,
+        total: shortCircuit.tokens?.totalTokens ?? 0
+      },
+      costUSD: shortCircuit.costUSD ?? 0,
+      modelUsed: `${targetModel}:shortcircuit`,
+      failoverOccurred: false,
+      attempts: 0
+    };
+    await this.notifyAuditSink(result);
+    return result;
+  };
+  dispatchPromptExecution = async (messages, temperature, providerOverride) => {
+    const query = messages[messages.length - 1]?.content ?? "";
+    if (providerOverride) {
+      return this.executeOverrideProvider(providerOverride, messages, query, temperature);
+    }
+    if (this.getProviderChain().length === 0) {
       if (this.config.mockSimulation) {
-        const simResult = this.executeSimulation(sanitizedQuery, options.systemPrompt);
-        await this.notifyAuditSink(simResult);
-        return simResult;
+        const sim = this.executeSimulation(query);
+        return {
+          responseText: sim.text,
+          usage: { promptTokens: sim.tokens.prompt, completionTokens: sim.tokens.completion, totalTokens: sim.tokens.total },
+          modelUsed: sim.modelUsed,
+          failoverOccurred: false,
+          attempts: 1
+        };
       }
       throw new ConfigurationError(
         "[AvantGate Configuration Error] No active LLM provider configured. Provide a client implementing LLMProviderPort or configure credentials (apiKey / baseUrl)."
       );
     }
-    const output = options.providerOverride ? await this.executeOverrideProvider(options.providerOverride, messages, sanitizedQuery, options.temperature) : await this.executeProviderPipeline(messages, sanitizedQuery, options.temperature);
-    const result = this.assembleResult(output);
-    this.checkPostExecutionBudget(result.tokens.total, result.costUSD);
+    return this.executeProviderPipeline(messages, query, temperature);
+  };
+  finalizeExecutionResult = async (output, responseText) => {
+    const sanitizedText = this.applyOutputSecurityGuards(responseText);
+    const hitTokens = output.usage.promptCacheHitTokens ?? 0;
+    const costUSD = this.calculateCost(output.modelUsed, output.usage.promptTokens, output.usage.completionTokens, hitTokens);
+    this.checkPostExecutionBudget(output.usage.totalTokens, costUSD);
+    const tokens = { prompt: output.usage.promptTokens, completion: output.usage.completionTokens, total: output.usage.totalTokens };
+    const result = {
+      text: sanitizedText,
+      tokens,
+      costUSD,
+      modelUsed: output.modelUsed,
+      failoverOccurred: output.failoverOccurred,
+      attempts: output.attempts
+    };
     await this.notifyAuditSink(result);
     return result;
   };
+  runAfterHooks = async (beforeState, output) => {
+    const tokens = { prompt: output.usage.promptTokens, completion: output.usage.completionTokens, total: output.usage.totalTokens };
+    const costUSD = this.calculateCost(output.modelUsed, output.usage.promptTokens, output.usage.completionTokens);
+    return executeAfterResponseHooks(this.config.middlewares, {
+      messages: beforeState.messages,
+      responseText: output.responseText,
+      modelUsed: output.modelUsed,
+      tokens,
+      costUSD,
+      attempts: output.attempts,
+      failoverOccurred: output.failoverOccurred,
+      metadata: beforeState.metadata
+    });
+  };
+  execute = async (options) => {
+    const inputMessages = this.prepareInputMessages(options);
+    const beforeState = await executeBeforeRequestHooks(this.config.middlewares, {
+      messages: inputMessages,
+      model: this.config.primary.model,
+      temperature: options.temperature,
+      metadata: options.metadata
+    });
+    if (beforeState.shortCircuit) {
+      return this.handleShortCircuit(beforeState.shortCircuit, this.config.primary.model);
+    }
+    await this.verifyPromptBudget(beforeState.messages, this.config.primary.model);
+    const output = await this.dispatchPromptExecution(beforeState.messages, options.temperature, options.providerOverride);
+    const afterState = await this.runAfterHooks(beforeState, output);
+    return this.finalizeExecutionResult(output, afterState.responseText);
+  };
+  executePrompt = this.execute;
   executeStructured = async (options) => {
     const rawResult = await this.execute({
       userQuery: options.userQuery,
@@ -1668,28 +1886,56 @@ var AvantGateControlLayer = class {
     const delay = initialDelay * Math.pow(factor, attempt);
     await new Promise((resolve) => setTimeout(resolve, delay));
   };
-  generateStructuredOutput = async (options) => {
-    const maxRetries = options.maxRetries ?? this.config.retryOptions?.maxRetries ?? 2;
-    const targetModel = options.model ?? this.config.primary.model;
-    const processedMessages = this.sanitizeIncomingMessages(options.messages);
-    await this.verifyPromptBudget(processedMessages, targetModel);
+  handleStructuredShortCircuit = async (shortCircuit, options, targetModel) => {
+    const { parsedData, sanitizedResponse } = this.parseAndValidateStructuredResult(
+      shortCircuit.text,
+      options
+    );
+    const tokens = {
+      prompt: shortCircuit.tokens?.promptTokens ?? 0,
+      completion: shortCircuit.tokens?.completionTokens ?? 0,
+      total: shortCircuit.tokens?.totalTokens ?? 0
+    };
+    const result = {
+      data: parsedData,
+      rawText: sanitizedResponse,
+      tokens,
+      costUSD: shortCircuit.costUSD ?? 0,
+      modelUsed: `${targetModel}:shortcircuit`,
+      failoverOccurred: false
+    };
+    await this.notifyAuditSinkSafe(sanitizedResponse, result, 0);
+    return result;
+  };
+  runStructuredAfterHooks = async (messages, output, attempt) => {
+    const tokens = { prompt: output.promptTokens, completion: output.completionTokens, total: output.promptTokens + output.completionTokens };
+    const costUSD = this.calculateCost(output.modelUsed, output.promptTokens, output.completionTokens);
+    return executeAfterResponseHooks(this.config.middlewares, {
+      messages,
+      responseText: output.responseText,
+      modelUsed: output.modelUsed,
+      tokens,
+      costUSD,
+      attempts: attempt,
+      failoverOccurred: output.failoverOccurred
+    });
+  };
+  executeStructuredLoop = async (options, messages, targetModel, maxRetries) => {
     let lastError;
-    let accumulatedPromptTokens = 0;
-    let accumulatedCompletionTokens = 0;
+    let accPrompt = 0;
+    let accComp = 0;
     for (let attempt = 0; attempt <= maxRetries; attempt++) {
       try {
-        const output = await this.dispatchProviderAttempt(options, processedMessages, targetModel);
-        accumulatedPromptTokens += output.promptTokens;
-        accumulatedCompletionTokens += output.completionTokens;
-        const { parsedData, sanitizedResponse } = this.parseAndValidateStructuredResult(
-          output.responseText,
-          options
-        );
+        const output = await this.dispatchProviderAttempt(options, messages, targetModel);
+        accPrompt += output.promptTokens;
+        accComp += output.completionTokens;
+        const afterState = await this.runStructuredAfterHooks(messages, output, attempt + 1);
+        const { parsedData, sanitizedResponse } = this.parseAndValidateStructuredResult(afterState.responseText, options);
         const result = this.buildStructuredResult({
           data: parsedData,
           rawText: sanitizedResponse,
-          promptTokens: accumulatedPromptTokens,
-          completionTokens: accumulatedCompletionTokens,
+          promptTokens: accPrompt,
+          completionTokens: accComp,
           modelUsed: output.modelUsed,
           failoverOccurred: output.failoverOccurred
         });
@@ -1702,6 +1948,21 @@ var AvantGateControlLayer = class {
     }
     throw lastError;
   };
+  generateStructuredOutput = async (options) => {
+    const maxRetries = options.maxRetries ?? this.config.retryOptions?.maxRetries ?? 2;
+    const targetModel = options.model ?? this.config.primary.model;
+    const processedMessages = this.sanitizeIncomingMessages(options.messages);
+    const beforeState = await executeBeforeRequestHooks(this.config.middlewares, {
+      messages: processedMessages,
+      model: targetModel,
+      temperature: options.temperature
+    });
+    if (beforeState.shortCircuit) {
+      return this.handleStructuredShortCircuit(beforeState.shortCircuit, options, targetModel);
+    }
+    await this.verifyPromptBudget(beforeState.messages, targetModel);
+    return this.executeStructuredLoop(options, beforeState.messages, targetModel, maxRetries);
+  };
 };
 var createLLMControlLayer = (config) => {
   return new AvantGateControlLayer(config);
@@ -2609,6 +2870,69 @@ var defineWorkflow = (config) => {
     }
   };
 };
+
+// src/presets.ts
+var createLaunchSafeConfig = (options) => {
+  const defaultSecurity = {
+    detectPromptInjection: true,
+    maskPII: true,
+    outputDLP: true,
+    blockSecretLeaks: true,
+    secretLeakAction: "REDACT"
+  };
+  const defaultRetries = { maxRetries: 2, initialDelayMs: 300, backoffFactor: 1.5 };
+  return {
+    maxTokenBudget: 8192,
+    maxCostUSD: 0.5,
+    ...options,
+    retryOptions: { ...defaultRetries, ...options.retryOptions },
+    security: { ...defaultSecurity, ...options.security }
+  };
+};
+var createEnterpriseStrictConfig = (options) => {
+  const defaultSecurity = {
+    detectPromptInjection: true,
+    maskPII: true,
+    outputDLP: true,
+    blockSecretLeaks: true,
+    secretLeakAction: "BLOCK"
+  };
+  const defaultRetries = {
+    maxRetries: 3,
+    initialDelayMs: 500,
+    backoffFactor: 2
+  };
+  return {
+    maxTokenBudget: 4096,
+    maxCostUSD: 0.15,
+    ...options,
+    retryOptions: { ...defaultRetries, ...options.retryOptions },
+    security: { ...defaultSecurity, ...options.security }
+  };
+};
+var createDevPermissiveConfig = (options) => {
+  const defaultSecurity = {
+    detectPromptInjection: false,
+    maskPII: false,
+    outputDLP: false,
+    blockSecretLeaks: false
+  };
+  const defaultRetries = {
+    maxRetries: 1,
+    initialDelayMs: 200,
+    backoffFactor: 1
+  };
+  return {
+    ...options,
+    retryOptions: { ...defaultRetries, ...options.retryOptions },
+    security: { ...defaultSecurity, ...options.security }
+  };
+};
+var PRESETS = {
+  LAUNCH_SAFE: createLaunchSafeConfig,
+  ENTERPRISE_STRICT: createEnterpriseStrictConfig,
+  DEV_PERMISSIVE: createDevPermissiveConfig
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   AvantGateBudgetExceededError,
@@ -2620,6 +2944,7 @@ var defineWorkflow = (config) => {
   ConfigurationError,
   DEFAULT_MODEL_PRICES,
   HttpProviderClient,
+  PRESETS,
   PricingRegistry,
   PromptBuilder,
   PromptRegistry,
@@ -2632,16 +2957,24 @@ var defineWorkflow = (config) => {
   WorkflowValidationError,
   ZenLLMControlLayer,
   applyOutputGuards,
+  applySingleAfterMiddleware,
+  applySingleBeforeMiddleware,
   calculateCostUSD,
   createAvantGate,
+  createDevPermissiveConfig,
+  createEnterpriseStrictConfig,
   createHttpProviderClient,
   createLLMControlLayer,
+  createLaunchSafeConfig,
   defineWorkflow,
+  executeAfterResponseHooks,
+  executeBeforeRequestHooks,
   executeWorkflow,
   extractAndCleanJSON,
   isWorkflowAbortSignal,
   resolveModelPrice,
   resolveModelPriceAsync,
+  sanitizeCustomTerms,
   sanitizePII,
   sanitizeSecrets,
   validateUserInput,