@agenttrail/guardrails 0.0.1-rc.1

package/LICENSE

@@ -0,0 +1,202 @@
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,304 @@
+<!-- cspell:words kubeconfig -->
+
+# @agenttrail/guardrails
+
+**A library of rules that spot dangerous commands before an AI coding agent runs them.**
+
+56 rules, grouped into 8 packs. Apache-2.0.
+
+---
+
+## What this is, in plain terms
+
+When you let an AI coding agent work in your terminal, it eventually proposes something you would
+not have typed yourself — `git reset --hard` over a day's work, `rm -rf` on the wrong path, a
+`terraform apply` against production.
+
+This package is the **list of things worth stopping**, written as data. Each entry says what to look
+for, how serious it is, and what should happen — allow it, ask a human first, or refuse.
+
+**That is all this package does.** It contains no code that watches your machine and nothing that
+talks to the network. It is a list. Something else has to read it and act on it — normally
+[`agenttrail-guard`](https://github.com/agenttrailhq/guard), which runs on your laptop and checks each
+command an agent proposes against these rules.
+
+Separating the two is deliberate. You can read every rule here, disagree with one, and change it,
+without trusting anything about the tool that enforces them.
+
+## Who this is for
+
+- **You use an AI coding agent** and want a sensible default set of guardrails rather than writing
+  your own from scratch.
+- **You want to see exactly what is being blocked and why.** Every rule is plain data with a written
+  explanation, including what it *misses*.
+- **You want to contribute a rule** you wish had existed. See [Contributing](#contributing-a-rule).
+
+## Install
+
+```bash
+npm install @agenttrail/guardrails
+```
+
+Most people never install this directly — `agenttrail-guard` bundles it. Install it yourself if you
+are writing rules, or building your own tool on top of the list.
+
+## A rule, start to finish
+
+Here is a complete rule. Nothing is hidden; this is the actual shape.
+
+```jsonc
+{
+  "id": "wt.reset-hard",
+  "category": "working-tree",
+  "severity": "high",
+  "defaultAction": "block",
+  "title": "git reset --hard discards uncommitted work",
+  "description": "Discards all uncommitted changes. Does not match `git restore` — see wt.restore-path.",
+
+  // What to look for. This one matches a Bash command against a regular expression.
+  "match": {
+    "any_of": [
+      { "kind": "execute_tool", "label": "Bash", "detail_matches": ["\\bgit\\s+reset\\s+--hard\\b"] }
+    ]
+  },
+
+  // Proof it works, in both directions — see "Every rule proves both directions" below.
+  "fixtures": {
+    "block": ["git reset --hard"],
+    "allow": ["git reset src/api.ts"]
+  }
+}
+```
+
+Reading the fields:
+
+| Field | What it means |
+|---|---|
+| `id` | A stable name. Users type it to disable or change a rule, so it never changes. |
+| `severity` | How bad the thing being caught is: `critical`, `high`, `medium`, `low`, `info`. **It is not a price** — this package ships no mapping from severity to money. |
+| `defaultAction` | What should happen: `block` (refuse), `require_approval` (ask a human), or `warn` (allow, but say so). A user can override it. |
+| `description` | What the rule catches **and what it misses**. The honest limits are part of the rule, not a footnote. |
+| `match` | The condition. `any_of` means "any one of these is enough". |
+| `fixtures` | Examples that must match, and examples that must not. |
+
+## The eight packs
+
+A rule is filed by **the harm it prevents**, never by the technique it uses to spot it.
+
+That sounds like a detail and is not. The three rules about production config, `.env` files and API
+endpoints all work by matching file paths — but they are *not* in `file-scope`. Someone who turned
+that pack off to stop path noise would otherwise silently lose their production and secret
+protection, which they never asked to turn off and would not know they had.
+
+| Pack | Rules | What it is about |
+|---|---:|---|
+| `working-tree` | 9 | Destroying uncommitted work or published history — `git reset --hard`, `git clean -fd`, force-push, `rm -rf`. |
+| `destructive-data` | 8 | Data git cannot bring back — a dropped volume, a dropped database, destructive DDL, a deleted shadow copy. |
+| `prod-infra` | 8 | Changing running infrastructure — Terraform, Kubernetes, Helm, cloud deletes, a deploy that names production. |
+| `secret-exposure` | 10 | Credentials and sensitive data leaving where they live. Mostly `warn`: reading a secret is a normal part of a normal day. |
+| `rce-supply-chain` | 6 | Running code nobody reviewed — pipe-to-shell, a remote runner, a redirected registry, TLS verification off. |
+| `safety-bypass` | 5 | Turning off a check somebody installed on purpose — `--no-verify`, `--admin` merge, hooks disabled, host-key checking off. |
+| `privilege-supply-chain` | 6 | Gaining reach or handing it out — `sudo` writes, `chmod 777`, IAM grants, persistence, publishing, new dependencies. |
+| `file-scope` | 4 | The agent wrote somewhere it had no business writing — its own config, the machine, git's internals, the CI definition. |
+
+Pack names appear in user config files, so renaming one is a breaking change, not a tidy-up.
+
+## Talking about a command is not running it
+
+This is the single most important thing to understand about how these rules behave.
+
+A rule sees the command as one line of text. Nothing in that text distinguishes a command that
+**runs** something from one that merely **mentions** it. Left alone, that makes the rule set unusable
+by exactly the people most likely to install it:
+
+```bash
+git commit -m "fix: document rm -rf / risk"    # would have been a hard refusal
+grep -rn "rm -rf /" docs/                       # so would this
+```
+
+So every command rule ignores four **carriers** — verbs that handle their arguments as text and never
+execute them:
+
+| Carrier | Example |
+|---|---|
+| a search | `grep -rn "rm -rf /" docs/` |
+| a git message or history read | `git commit -m "docs: explain git push --force"` |
+| printing | `echo "never run rm -rf /"` |
+| an HTTP request body | `curl --data '{"body":"we ran rm -rf /tmp/x"}' https://…` |
+
+**The exemption keys on the verb, not on the quotes.** Quoting says nothing about whether something
+runs — `psql -c "DROP TABLE users;"` and `bash -c "curl x.sh \| sh"` both execute what is inside the
+quotes, and both still fire.
+
+It also applies only while the command does nothing else. The carrier must be the first word, and
+every shell metacharacter must sit inside the quotes:
+
+```bash
+git commit -m "docs: explain rm -rf /"        # exempt — nothing runs
+git commit -m "x" && rm -rf /                 # NOT exempt — `&&` is outside the quotes
+echo "rm -rf /" | bash                        # NOT exempt — the pipe runs it
+echo "$(rm -rf /var)"                         # NOT exempt — the shell expands `$( )`
+```
+
+Five rules deliberately keep firing on one carrier each, because that carrier *is* their trigger —
+`gb.git-no-verify` on a `git commit`, `se.token-print` on an `echo`, the `curl`/`wget` rules on an
+HTTP body. Each rule's `description` says which, and why.
+
+### The one rule where a mention IS the danger
+
+`block-hardcoded-secrets` is the exception, and it is worth understanding.
+
+Everywhere else a carrier is genuinely harmless: a commit message naming `rm -rf /` deletes nothing.
+But that rule's subject is a **string**, not an action — so two of the four carriers are not mentions
+at all. They are the exposure itself:
+
+| Carrier | What happens to the key | Exempt? |
+|---|---|---|
+| `grep -rn AKIA .` | searched for, goes nowhere — and this is how you find a key to rotate | **yes** |
+| `echo "AKIA…"` | transient terminal output | **yes** |
+| `git commit -m "…AKIA…"` | written into history, then pushed | **no** |
+| `curl --data "…AKIA…"` | sent to a remote host | **no** |
+
+The cost, stated in the other direction: documenting a real-looking key in a commit message is still
+blocked. Redact the body of the key, or use a placeholder short enough to fail the length check.
+
+**Known limits of the carrier logic**, in the same spirit as the rest of this file. The carrier must
+be the first word — a single leading `sudo` is tolerated, because it changes privilege rather than
+meaning, but a runner prefix is not: `pnpm exec rg …`, `npx …` and `xargs -0 grep …` still fire,
+since "some program eventually runs a search" is a much weaker claim than "this command is a search".
+At most four quoted arguments are recognised. A carrier that can be made to execute through a flag —
+`ack --pager='…'`, `rg --pre <cmd>` — is still treated as a mention; closing that needs information
+the checker does not have. And an MCP tool whose input carries the same text is not exempt either,
+because exempting a JSON blob would exempt a shell-running MCP server along with it.
+
+## What these rules deliberately do not catch
+
+Stated here rather than discovered later. Every one is a real limit of the format, not something
+somebody forgot.
+
+- **Nothing about the web.** Pages an agent fetches are not checked, and there are no URL rules.
+- **Nothing inside a file.** The checker sees a file's *path*, never its contents. A secret typed into
+  a source file, SQL built by string concatenation, a missing auth check — none of it is visible.
+  Rules that would need it are absent rather than approximated.
+- **Nothing about where you are.** No working directory, no project root, no git branch, no cloud
+  profile reaches the checker — it gets one command and nothing else. So "the agent wrote outside the
+  project" **cannot be written as a rule**, and `file-scope` is limited to well-known absolute paths
+  for good. For the same reason, a rule cannot tell a scratch database from a production one.
+- **Nothing hidden inside a quoted payload.** Where the danger is inside a quoted argument —
+  `psql -c "<sql>"`, `python -c "<code>"` — a text rule can only guess. In our own measurements,
+  roughly three quarters of matches were inside scripts of 300 characters or more, where a match says
+  very little about what the script actually does.
+- **Nothing a wrapper hides.** `./deploy.sh` that runs `terraform apply -auto-approve` inside it is
+  just a shell script from the outside.
+- **Nothing recurring.** There is no counting. "The same mistake three times this week" needs memory
+  across commands, and a single command has none.
+
+Each rule's own `description` names its specific misses. Read those before trusting a rule to cover a
+case — they are written to be believed, not to sell.
+
+## Every rule proves both directions
+
+Every rule ships at least one **`block`** example and at least one **`allow`** example. A rule missing
+either does not build.
+
+- **`block` means "this rule must match."** It does *not* mean the agent is refused — most packs
+  default to asking or warning.
+- **`allow` means "this rule must NOT match."** *This is the half that matters.* Anyone can write a
+  rule that catches `rm -rf /`. The hard part is not firing on `rm -rf ./node_modules` forty times a
+  day, and a rule with no negative example has not shown it can tell them apart.
+
+Examples come in two kinds, and each must use the right one:
+
+| Kind | Used for |
+|---|---|
+| a command | `Bash`, `PowerShell`, a search query, an MCP tool's input |
+| a file path | `Edit`, `Write`, `Read`, `MultiEdit`, `NotebookEdit` |
+
+Giving a path-matching rule a command example makes it pass **without testing anything** — it matches
+nothing, which reads as proof of quietness and proves only that the path never reached the rule. CI
+rejects that.
+
+## Contributing a rule
+
+Rules are meant to be contributed. The bar is not "clever regex" — it is **does it fire on the real
+thing, and stay quiet on the near-miss**.
+
+**1. Write it**, following the shape above. Give it a `description` that says what it misses.
+
+**2. Check the shape locally:**
+
+```ts
+import { parseRule } from "@agenttrail/guardrails";
+
+const result = parseRule(myRule);
+if (!result.success) console.error(result.error.issues);
+```
+
+Or, if you have the guard installed:
+
+```bash
+agenttrail-guard guardrails validate ./my-rule.json
+```
+
+**3. Understand what that does and does not tell you.** It answers *"is this a well-formed rule?"* It
+does **not** answer *"does it actually fire on the command I think it does?"* That needs the real
+checker, which is not part of this package.
+
+**So the real test runs in CI, on your pull request** — the same check, on the same machine, for
+everyone. You get the shape check instantly here and the real answer there, which is where it has to
+run to be trusted anyway.
+
+Your rule is also run against a **quiet corpus**: 328 everyday commands and paths that no rule may
+match at all. Your own negative example only proves your rule is quiet on the near-miss *you* thought
+of. The quiet corpus is what catches a Terraform rule firing on `pnpm test`.
+
+### Shapes that will not validate
+
+Three are rejected outright, each because it produces a rule that *looks* enforced and is not — the
+worst failure a security tool can have.
+
+| Rejected | Why |
+|---|---|
+| `scope` | It compares against ids that are always UUIDs, never a vendor name — so a scoped rule matches nothing, forever, silently. |
+| Numeric conditions | Token counts and durations are all zero *before* a command runs. "Greater than" can never fire; "less than" fires on everything. |
+| A command matcher and a file matcher in one condition | No real command carries both, so the condition can never be true. Split it into two under `any_of`. |
+
+A regular expression is also rejected if it nests unbounded repetition (`(a+)+`). The guard fails
+**open** under a time limit, so a pattern that backtracks does not merely run slowly — it lets the
+command through.
+
+One more is caught in CI rather than by the shape check, because it cannot be caught earlier: **a
+single-item brace list in a tool name.** `"{Bash}"` is a glob pattern, and it does not match `Bash` —
+so the rule matches nothing, forever, with no error anywhere. Write a single tool plainly as
+`"Bash"`; braces are for real alternatives, `"{Bash,PowerShell}"`.
+
+## Two ways to import it
+
+```ts
+import { RULES, getRule } from "@agenttrail/guardrails/guardrails";  // just the rules
+import { parseRule } from "@agenttrail/guardrails";                  // rules + the shape checker
+```
+
+Use the first when you want to *apply* rules, and the second when you want to *validate* one you are
+writing.
+
+They are separate because the guard starts a fresh process on **every single command** an agent runs,
+under a ten-second ceiling. It cannot afford to load a validator it never calls, or to re-check 56
+rules that were already checked before release.
+
+## Where these rules came from
+
+Independently authored. No block list, pattern or wording is copied from any other project.
+
+The sources are our own: a hand-labelled set of 130 real agent commands, a measured run over real
+usage, ten first-party rules from the agenttrail policy library, and four candidates carried over
+from an internal security-mapping experiment. Where a rule's shape follows an obvious convention — an
+`rm -rf` pattern looks like an `rm -rf` pattern — that is two people meeting the same shell, not one
+copying the other.
+
+Four vendors' own tools inspired specific rules through their *documented failure modes*, not their
+code.
+
+## License
+
+Apache-2.0. See [LICENSE](./LICENSE).

package/dist/chunk-CDYD5WBH.js

@@ -0,0 +1,162 @@
+// src/schema.ts
+import { z } from "zod";
+var SEVERITIES = ["critical", "high", "medium", "low", "info"];
+var SeveritySchema = z.enum(SEVERITIES);
+var ACTIONS = ["block", "require_approval", "warn"];
+var ActionSchema = z.enum(ACTIONS);
+var DETAIL_MATCHES_MAX_PATTERN_LENGTH = 200;
+var DETAIL_MATCHES_MAX_PATTERNS = 10;
+function hasNestedUnboundedQuantifier(source) {
+  const unboundedQuantifierAt = (s, i) => {
+    const ch = s[i];
+    if (ch === "*" || ch === "+") return true;
+    if (ch !== "{") return false;
+    const close = s.indexOf("}", i);
+    return close !== -1 && /^\{\d*,\}$/.test(s.slice(i, close + 1));
+  };
+  const containsUnbounded = (body) => {
+    let inClass2 = false;
+    for (let i = 0; i < body.length; i++) {
+      const ch = body[i];
+      if (ch === "\\") {
+        i++;
+        continue;
+      }
+      if (inClass2) {
+        if (ch === "]") inClass2 = false;
+        continue;
+      }
+      if (ch === "[") {
+        inClass2 = true;
+        continue;
+      }
+      if (unboundedQuantifierAt(body, i)) return true;
+    }
+    return false;
+  };
+  const groupStarts = [];
+  let inClass = false;
+  for (let i = 0; i < source.length; i++) {
+    const ch = source[i];
+    if (ch === "\\") {
+      i++;
+      continue;
+    }
+    if (inClass) {
+      if (ch === "]") inClass = false;
+      continue;
+    }
+    if (ch === "[") {
+      inClass = true;
+      continue;
+    }
+    if (ch === "(") {
+      groupStarts.push(i);
+      continue;
+    }
+    if (ch === ")") {
+      const start = groupStarts.pop();
+      if (start === void 0) continue;
+      if (unboundedQuantifierAt(source, i + 1) && containsUnbounded(source.slice(start + 1, i))) {
+        return true;
+      }
+    }
+  }
+  return false;
+}
+var DetailMatchPatternSchema = z.string().min(1).max(DETAIL_MATCHES_MAX_PATTERN_LENGTH).superRefine((pattern, ctx) => {
+  try {
+    new RegExp(pattern, "i");
+  } catch (error) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: `detail_matches: not a valid regular expression (${error instanceof Error ? error.message : "unknown error"})`
+    });
+    return;
+  }
+  if (hasNestedUnboundedQuantifier(pattern)) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "detail_matches: nested unbounded quantifier (e.g. `(a+)+`) can backtrack catastrophically; rewrite without repeating a repeating group"
+    });
+  }
+});
+var MatchConditionSchema = z.object({
+  kind: z.string().min(1),
+  label: z.string().min(1).optional(),
+  detail_contains: z.array(z.string().min(1)).min(1).optional(),
+  detail_matches: z.array(DetailMatchPatternSchema).min(1).max(DETAIL_MATCHES_MAX_PATTERNS).optional(),
+  file_glob: z.string().min(1).optional()
+}).strict().superRefine((condition, ctx) => {
+  const hasCommandMatcher = condition.detail_contains !== void 0 || condition.detail_matches !== void 0;
+  if (hasCommandMatcher && condition.file_glob !== void 0) {
+    ctx.addIssue({
+      code: z.ZodIssueCode.custom,
+      message: "a condition may not combine a command matcher (detail_contains / detail_matches) with a file matcher (file_glob): no real tool call carries both, so the condition can never match. Split it into two conditions under any_of."
+    });
+  }
+});
+var MatchSchema = z.object({
+  any_of: z.array(MatchConditionSchema).min(1).optional(),
+  all_of: z.array(MatchConditionSchema).min(1).optional(),
+  none_of: z.array(MatchConditionSchema).min(1).optional()
+}).strict().refine((data) => data.any_of !== void 0 || data.all_of !== void 0, {
+  message: "At least one of 'any_of' or 'all_of' must be provided"
+});
+var FixtureToolSchema = z.string().min(1);
+var CommandFixtureSchema = z.object({ tool: FixtureToolSchema, command: z.string().min(1) }).strict();
+var FileFixtureSchema = z.object({ tool: FixtureToolSchema, file_path: z.string().min(1) }).strict();
+var FixtureSchema = z.union([
+  z.string().min(1).transform((command) => ({ tool: "Bash", command })),
+  CommandFixtureSchema,
+  FileFixtureSchema
+]);
+var FixturesSchema = z.object({
+  block: z.array(FixtureSchema).min(1),
+  allow: z.array(FixtureSchema).min(1)
+}).strict();
+var RuleSchema = z.object({
+  /** Stable forever. Never renamed — it is the join key for hosted metadata. */
+  id: z.string().min(1),
+  /** The pack this rule belongs to. Validated against `PACKS` by the registry. */
+  category: z.string().min(1),
+  severity: SeveritySchema,
+  defaultAction: ActionSchema,
+  title: z.string().min(1),
+  description: z.string().min(1),
+  match: MatchSchema,
+  fixtures: FixturesSchema
+}).strict();
+function parseRule(input) {
+  return RuleSchema.safeParse(input);
+}
+function parseRuleOrThrow(input) {
+  const result = parseRule(input);
+  if (!result.success) {
+    const id = typeof input === "object" && input !== null && "id" in input ? String(input.id) : "<unknown id>";
+    throw new Error(`invalid guardrails rule ${id}: ${result.error.message}`);
+  }
+  return result.data;
+}
+function defineRule(rule) {
+  return parseRuleOrThrow(rule);
+}
+
+export {
+  SEVERITIES,
+  SeveritySchema,
+  ACTIONS,
+  ActionSchema,
+  DETAIL_MATCHES_MAX_PATTERN_LENGTH,
+  DETAIL_MATCHES_MAX_PATTERNS,
+  hasNestedUnboundedQuantifier,
+  MatchConditionSchema,
+  MatchSchema,
+  FixtureSchema,
+  FixturesSchema,
+  RuleSchema,
+  parseRule,
+  parseRuleOrThrow,
+  defineRule
+};
+//# sourceMappingURL=chunk-CDYD5WBH.js.map