@agenttrail/guardrails 0.2.1 → 0.2.4

package/dist/schema-B2pYoi9Z.d.cts

@@ -0,0 +1,951 @@
+import { z } from 'zod';
+
+/**
+ * The two OWASP lists a guardrail's `owasp` field may cite, as plain data.
+ *
+ * No zod here, so the corpus entry (`./rules.ts`) can re-export it and stay validator-free.
+ * `schema.ts` validates a guardrail's `owasp` field against `OWASP_IDS`.
+ *
+ * - OWASP Top 10 for Agentic Applications (v1.0, the 2026 edition): ASI01 to ASI10.
+ * - OWASP Top 10 for LLM Applications 2026 (v1.0): LLM01 to LLM10.
+ *
+ * An id names the risk a guardrail addresses at the point where it becomes a command or a file
+ * change. It is never a claim that the guardrail covers the whole risk.
+ */
+/** Every id a guardrail may cite, in list order: the agentic list first, then the LLM list. */
+declare const OWASP_IDS: readonly ["ASI01", "ASI02", "ASI03", "ASI04", "ASI05", "ASI06", "ASI07", "ASI08", "ASI09", "ASI10", "LLM01", "LLM02", "LLM03", "LLM04", "LLM05", "LLM06", "LLM07", "LLM08", "LLM09", "LLM10"];
+/** One OWASP risk id, e.g. `ASI02` or `LLM06`. */
+type OwaspId = (typeof OWASP_IDS)[number];
+/** One risk on an OWASP list. */
+interface OwaspRisk {
+    readonly id: OwaspId;
+    readonly title: string;
+}
+/** OWASP Top 10 for Agentic Applications, v1.0. */
+declare const OWASP_AGENTIC: readonly OwaspRisk[];
+/** OWASP Top 10 for LLM Applications 2026, v1.0. */
+declare const OWASP_LLM: readonly OwaspRisk[];
+/** Where each list is published. */
+declare const OWASP_SOURCES: {
+    readonly agentic: "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/";
+    readonly llm: "https://genai.owasp.org/resource/owasp-genai-llm-top-10-2026/";
+};
+/** True when `value` is one of `OWASP_IDS`, spelled exactly (upper-case, no suffix). */
+declare function isOwaspId(value: unknown): value is OwaspId;
+/** The id's position in `OWASP_IDS`, or -1. The order a guardrail must list its ids in. */
+declare function owaspIndex(id: string): number;
+/** The risk's title, e.g. `owaspTitle("ASI02")` is "Tool Misuse and Exploitation". */
+declare function owaspTitle(id: OwaspId): string;
+
+/**
+ * The guardrail format — self-contained, and deliberately so.
+ *
+ * This file defines the guardrail format and imports nothing but zod and the OWASP id list
+ * (`./owasp.ts`, plain data), so the package builds on its own. The condition and match
+ * shapes mirror the evaluator's rather than importing them; a change to either has to be
+ * made in both places.
+ *
+ * A guardrail carries `defaultAction` (what the guard does when it matches) and no
+ * `version`; the package version is the corpus version.
+ */
+
+/**
+ * The five severities, in order, most→least severe.
+ *
+ * `info` earns its place: seven of the eleven packs default to `ask`/`warn`, and a
+ * warn-only guardrail labelled `low` overstates itself.
+ *
+ * Severity says how serious a match is. This package maps it to nothing else,
+ * including cost: the guard prints no currency.
+ */
+declare const SEVERITIES: readonly ["critical", "high", "medium", "low", "info"];
+/** How dangerous the thing a guardrail catches is. An authoring signal, not a price. */
+declare const SeveritySchema: z.ZodEnum<["critical", "high", "medium", "low", "info"]>;
+/**
+ * What the guard does when a guardrail matches.
+ *
+ * The guard maps these onto Claude Code's `PreToolUse` verdicts:
+ * `block` → deny, `require_approval` → ask, `warn` → allow-but-recorded.
+ */
+declare const ACTIONS: readonly ["block", "require_approval", "warn"];
+/** The action a guardrail takes by default, before any user override. */
+declare const ActionSchema: z.ZodEnum<["block", "require_approval", "warn"]>;
+/**
+ * Longest accepted `detail_matches` pattern. Long enough for any real guardrail; raised
+ * from 200 to fit the compound-command quoted-mention exemption, whose longest arm
+ * (a carrier wrapped in a bounded chain of read-only surrounding segments) is ~300.
+ * Kept in lockstep with the engine's own copy of this limit.
+ */
+declare const DETAIL_MATCHES_MAX_PATTERN_LENGTH = 320;
+/** Most `detail_matches` patterns allowed on one condition (they are ORed). */
+declare const DETAIL_MATCHES_MAX_PATTERNS = 10;
+/**
+ * Reject a regex that can backtrack catastrophically, at PARSE time.
+ *
+ * Node has no regex timeout, so the only real bounds are a non-backtracking
+ * engine (RE2 — a runtime dependency deliberately not taken) or a syntactic
+ * restriction. This is the syntactic one: it rejects **star height >= 2**, an
+ * unbounded quantifier applied to a group that itself contains an unbounded
+ * quantifier — `(a+)+`, `(a*)*`, `(\s+x?)+` — the shape behind essentially every
+ * practical ReDoS.
+ *
+ * The guard's hook has a 10s Claude Code timeout, no internal watchdog, and it
+ * **fails open**: a pattern that backtracks does not merely make enforcement slow,
+ * it lets the action through. A slow guardrail in the guard is a disabled guardrail.
+ *
+ * HONEST LIMIT: this is a bound, not a proof. Star height 1 can still be
+ * quadratic (`(a|a)*`), which is slow but not exponential, and is acceptable
+ * against the length cap above. A hard guarantee needs RE2.
+ *
+ * @param source - The regex body (no delimiters, no flags).
+ * @returns `true` when the pattern nests unbounded quantifiers.
+ */
+declare function hasNestedUnboundedQuantifier(source: string): boolean;
+/**
+ * One condition matched against a tool call.
+ *
+ * - `kind`: required. The span kind, e.g. `execute_tool`. Case-insensitive.
+ * - `label`: optional. The tool name — a case-insensitive GLOB, so
+ *   `mcp__chrome__*` and `{Bash,PowerShell}` are one condition rather than a
+ *   list that rots. A plain label has no glob character and matches exactly.
+ * - `detail_contains`: optional. Substrings that must ALL appear (AND).
+ *   **CASE-SENSITIVE**, and deliberately: `AKIA`, `ghp_`, `sk_live_` and the
+ *   upper-case `TRUNCATE` arm are guardrails where case IS the signal. Author
+ *   case-insensitive text matches with `detail_matches` instead.
+ * - `detail_matches`: optional. Regex patterns against the same text; at least
+ *   one must match (OR, unlike `detail_contains`). Case-insensitive.
+ * - `file_glob`: optional. Case-insensitive glob against the file path.
+ *
+ * ── Two engine fields are deliberately absent ────────────────────────────────
+ *
+ * `numeric` is BANNED. At guard decision time `tokens`,
+ * `cachedTokens` and `durationMs` are all 0, because the action has not run yet.
+ * `gt` is therefore always false — the guardrail can never fire — and, worse, **`lt`
+ * is always true, so the guardrail fires on every single command.** Omitting the key
+ * from a `.strict()` object makes that a parse error rather than a lint finding.
+ *
+ * `scope` is BANNED for the same class of reason and is absent from the guardrail
+ * envelope below: `agent_in` compares literally against an agent id that is
+ * always a UUID, never the string `"claude-code"`, so a scoped guardrail matches
+ * nothing, forever, silently.
+ *
+ * ── The third ban needs an actual check ──────────────────────────────────────
+ *
+ * A command matcher (`detail_contains` / `detail_matches`) and a file matcher
+ * (`file_glob`) in ONE condition can never both be satisfied: the guard's mapper
+ * is an if/else chain, so no real tool call ever carries both a command and a
+ * file path. This schema refuses the combination.
+ */
+declare const MatchConditionSchema: z.ZodEffects<z.ZodObject<{
+    kind: z.ZodString;
+    label: z.ZodOptional<z.ZodString>;
+    detail_contains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+    detail_matches: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+    file_glob: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    kind: string;
+    label?: string | undefined;
+    detail_contains?: string[] | undefined;
+    detail_matches?: string[] | undefined;
+    file_glob?: string | undefined;
+}, {
+    kind: string;
+    label?: string | undefined;
+    detail_contains?: string[] | undefined;
+    detail_matches?: string[] | undefined;
+    file_glob?: string | undefined;
+}>, {
+    kind: string;
+    label?: string | undefined;
+    detail_contains?: string[] | undefined;
+    detail_matches?: string[] | undefined;
+    file_glob?: string | undefined;
+}, {
+    kind: string;
+    label?: string | undefined;
+    detail_contains?: string[] | undefined;
+    detail_matches?: string[] | undefined;
+    file_glob?: string | undefined;
+}>;
+/**
+ * Match composition — conditions combined with `any_of` (OR), `all_of` (AND)
+ * and/or `none_of` (negation).
+ *
+ * At least one of `any_of` or `all_of` must be present. `none_of` is an optional
+ * refinement that CANNOT stand alone: a match must positively select calls
+ * before excluding some. A pure-negation match is satisfied by every
+ * non-matching call and, at `block`, would deny everything the agent does.
+ */
+declare const MatchSchema: z.ZodEffects<z.ZodObject<{
+    any_of: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        detail_contains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        detail_matches: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        file_glob: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }>, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }>, "many">>;
+    all_of: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        detail_contains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        detail_matches: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        file_glob: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }>, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }>, "many">>;
+    none_of: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
+        kind: z.ZodString;
+        label: z.ZodOptional<z.ZodString>;
+        detail_contains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+        detail_matches: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+        file_glob: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }>, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }, {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }>, "many">>;
+}, "strict", z.ZodTypeAny, {
+    any_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    all_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    none_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+}, {
+    any_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    all_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    none_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+}>, {
+    any_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    all_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    none_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+}, {
+    any_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    all_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+    none_of?: {
+        kind: string;
+        label?: string | undefined;
+        detail_contains?: string[] | undefined;
+        detail_matches?: string[] | undefined;
+        file_glob?: string | undefined;
+    }[] | undefined;
+}>;
+/**
+ * One fixture: a tool call this guardrail must match, or must not.
+ *
+ * A bare string is shorthand for `{ tool: "Bash", command: "<string>" }`, which
+ * covers most guardrails and keeps them terse. Anything else is an object with a
+ * `tool` plus **exactly one** of `command` or `file_path` — the two channels.
+ * `.strict()` on each variant is what makes "exactly one" true: a
+ * `command` object carrying a `file_path` matches neither variant.
+ *
+ * The parse output is always normalized to the object form, so the harness has
+ * exactly one shape to feed the evaluator.
+ *
+ * ── There is no `url` channel ─────────────────────────────────────────────────
+ *
+ * **The evaluator cannot see a URL**: the only two attribute keys any matcher
+ * reads are `detail` and `file_path`, and there is no `url` field in the condition
+ * schema. A value written to `url` would be read by nothing, so a `WebFetch` guardrail
+ * would match nothing, silently — the same failure `scope` is banned for. There
+ * are no website guardrails and `WebFetch` is not intercepted; `WebSearch` is, because
+ * its query is text on the command channel.
+ *
+ * A `url` key therefore fails to parse rather than becoming a fixture that tests
+ * nothing. `__tests__/schema.test.ts` pins that.
+ */
+declare const FixtureSchema: z.ZodUnion<[z.ZodEffects<z.ZodString, {
+    tool: "Bash";
+    command: string;
+}, string>, z.ZodObject<{
+    tool: z.ZodString;
+    command: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    tool: string;
+    command: string;
+}, {
+    tool: string;
+    command: string;
+}>, z.ZodObject<{
+    tool: z.ZodString;
+    file_path: z.ZodString;
+}, "strict", z.ZodTypeAny, {
+    tool: string;
+    file_path: string;
+}, {
+    tool: string;
+    file_path: string;
+}>]>;
+/**
+ * The two directions every guardrail must prove, through the real evaluator.
+ *
+ * **`block` means "this guardrail MUST match"; `allow` means "this guardrail MUST NOT
+ * match".** They are not verdicts. Seven of the eleven packs default to `ask` or
+ * `warn`, and `warn` folds into an allow verdict, so reading `block` as "the
+ * guard denies" would fail every `warn` guardrail and make the negative fixture
+ * vacuous for them.
+ *
+ * Both are `.min(1)`: CI only has to fail on a guardrail missing a
+ * negative fixture, but requiring it here moves that failure to authoring time,
+ * where it costs a keystroke instead of a pull-request round trip.
+ */
+declare const FixturesSchema: z.ZodObject<{
+    block: z.ZodArray<z.ZodUnion<[z.ZodEffects<z.ZodString, {
+        tool: "Bash";
+        command: string;
+    }, string>, z.ZodObject<{
+        tool: z.ZodString;
+        command: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        tool: string;
+        command: string;
+    }, {
+        tool: string;
+        command: string;
+    }>, z.ZodObject<{
+        tool: z.ZodString;
+        file_path: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        tool: string;
+        file_path: string;
+    }, {
+        tool: string;
+        file_path: string;
+    }>]>, "many">;
+    allow: z.ZodArray<z.ZodUnion<[z.ZodEffects<z.ZodString, {
+        tool: "Bash";
+        command: string;
+    }, string>, z.ZodObject<{
+        tool: z.ZodString;
+        command: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        tool: string;
+        command: string;
+    }, {
+        tool: string;
+        command: string;
+    }>, z.ZodObject<{
+        tool: z.ZodString;
+        file_path: z.ZodString;
+    }, "strict", z.ZodTypeAny, {
+        tool: string;
+        file_path: string;
+    }, {
+        tool: string;
+        file_path: string;
+    }>]>, "many">;
+}, "strict", z.ZodTypeAny, {
+    block: ({
+        tool: string;
+        command: string;
+    } | {
+        tool: string;
+        file_path: string;
+    } | {
+        tool: "Bash";
+        command: string;
+    })[];
+    allow: ({
+        tool: string;
+        command: string;
+    } | {
+        tool: string;
+        file_path: string;
+    } | {
+        tool: "Bash";
+        command: string;
+    })[];
+}, {
+    block: (string | {
+        tool: string;
+        command: string;
+    } | {
+        tool: string;
+        file_path: string;
+    })[];
+    allow: (string | {
+        tool: string;
+        command: string;
+    } | {
+        tool: string;
+        file_path: string;
+    })[];
+}>;
+/**
+ * The OWASP risks a guardrail addresses, e.g. `["ASI02", "LLM03"]`.
+ *
+ * - Every entry is one of `OWASP_IDS`, spelled exactly: upper-case, no `:2026` suffix.
+ * - No id twice, and the list is in `OWASP_IDS` order (ASI ids before LLM ids, each ascending),
+ *   so a guardrail's ids have one spelling and a diff of them is a diff of meaning.
+ * - Not empty. A guardrail that cites no risk omits the field.
+ *
+ * The parsed type is `OwaspId[]`, so a typo is a compile error for a TypeScript author too.
+ * Each problem is reported at the entry it concerns (`owasp.<i>`), or at `owasp` for order and
+ * emptiness, in words a person can act on, because `guardrails validate` prints them.
+ */
+declare const OwaspIdsSchema: z.ZodType<OwaspId[], z.ZodTypeDef, OwaspId[]>;
+/**
+ * One published guardrail.
+ *
+ * `.strict()` rejects any key not declared here, so an unknown field fails to parse
+ * rather than riding along into the published package.
+ *
+ * `description` carries the guardrail's COVERAGE LIMITS, verbatim — e.g. that an
+ * `rm -rf` guardrail misses `rm -fr`. It is a convention rather than a schema
+ * constraint, because no validator can tell a real limit from a sentence shaped
+ * like one.
+ */
+declare const RuleSchema: z.ZodObject<{
+    /** Stable: a guardrail id is never renamed. */
+    id: z.ZodString;
+    /** The pack this guardrail belongs to. Validated against `PACKS` by the registry. */
+    category: z.ZodString;
+    severity: z.ZodEnum<["critical", "high", "medium", "low", "info"]>;
+    defaultAction: z.ZodEnum<["block", "require_approval", "warn"]>;
+    title: z.ZodString;
+    description: z.ZodString;
+    /**
+     * The OWASP risks this guardrail addresses. Optional: a guardrail that cites none omits it. An id is
+     * never a claim that the guardrail covers the whole risk, only that it acts where the risk turns
+     * into a command or a file change.
+     */
+    owasp: z.ZodOptional<z.ZodType<("ASI01" | "ASI02" | "ASI03" | "ASI04" | "ASI05" | "ASI06" | "ASI07" | "ASI08" | "ASI09" | "ASI10" | "LLM01" | "LLM02" | "LLM03" | "LLM04" | "LLM05" | "LLM06" | "LLM07" | "LLM08" | "LLM09" | "LLM10")[], z.ZodTypeDef, ("ASI01" | "ASI02" | "ASI03" | "ASI04" | "ASI05" | "ASI06" | "ASI07" | "ASI08" | "ASI09" | "ASI10" | "LLM01" | "LLM02" | "LLM03" | "LLM04" | "LLM05" | "LLM06" | "LLM07" | "LLM08" | "LLM09" | "LLM10")[]>>;
+    match: z.ZodEffects<z.ZodObject<{
+        any_of: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
+            kind: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            detail_contains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            detail_matches: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+            file_glob: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }>, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }>, "many">>;
+        all_of: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
+            kind: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            detail_contains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            detail_matches: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+            file_glob: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }>, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }>, "many">>;
+        none_of: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{
+            kind: z.ZodString;
+            label: z.ZodOptional<z.ZodString>;
+            detail_contains: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
+            detail_matches: z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodString, string, string>, "many">>;
+            file_glob: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }>, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }, {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }>, "many">>;
+    }, "strict", z.ZodTypeAny, {
+        any_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        all_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        none_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+    }, {
+        any_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        all_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        none_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+    }>, {
+        any_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        all_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        none_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+    }, {
+        any_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        all_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        none_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+    }>;
+    fixtures: z.ZodObject<{
+        block: z.ZodArray<z.ZodUnion<[z.ZodEffects<z.ZodString, {
+            tool: "Bash";
+            command: string;
+        }, string>, z.ZodObject<{
+            tool: z.ZodString;
+            command: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            tool: string;
+            command: string;
+        }, {
+            tool: string;
+            command: string;
+        }>, z.ZodObject<{
+            tool: z.ZodString;
+            file_path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            tool: string;
+            file_path: string;
+        }, {
+            tool: string;
+            file_path: string;
+        }>]>, "many">;
+        allow: z.ZodArray<z.ZodUnion<[z.ZodEffects<z.ZodString, {
+            tool: "Bash";
+            command: string;
+        }, string>, z.ZodObject<{
+            tool: z.ZodString;
+            command: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            tool: string;
+            command: string;
+        }, {
+            tool: string;
+            command: string;
+        }>, z.ZodObject<{
+            tool: z.ZodString;
+            file_path: z.ZodString;
+        }, "strict", z.ZodTypeAny, {
+            tool: string;
+            file_path: string;
+        }, {
+            tool: string;
+            file_path: string;
+        }>]>, "many">;
+    }, "strict", z.ZodTypeAny, {
+        block: ({
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        } | {
+            tool: "Bash";
+            command: string;
+        })[];
+        allow: ({
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        } | {
+            tool: "Bash";
+            command: string;
+        })[];
+    }, {
+        block: (string | {
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        })[];
+        allow: (string | {
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        })[];
+    }>;
+}, "strict", z.ZodTypeAny, {
+    id: string;
+    category: string;
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    defaultAction: "block" | "require_approval" | "warn";
+    title: string;
+    description: string;
+    match: {
+        any_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        all_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        none_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+    };
+    fixtures: {
+        block: ({
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        } | {
+            tool: "Bash";
+            command: string;
+        })[];
+        allow: ({
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        } | {
+            tool: "Bash";
+            command: string;
+        })[];
+    };
+    owasp?: ("ASI01" | "ASI02" | "ASI03" | "ASI04" | "ASI05" | "ASI06" | "ASI07" | "ASI08" | "ASI09" | "ASI10" | "LLM01" | "LLM02" | "LLM03" | "LLM04" | "LLM05" | "LLM06" | "LLM07" | "LLM08" | "LLM09" | "LLM10")[] | undefined;
+}, {
+    id: string;
+    category: string;
+    severity: "critical" | "high" | "medium" | "low" | "info";
+    defaultAction: "block" | "require_approval" | "warn";
+    title: string;
+    description: string;
+    match: {
+        any_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        all_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+        none_of?: {
+            kind: string;
+            label?: string | undefined;
+            detail_contains?: string[] | undefined;
+            detail_matches?: string[] | undefined;
+            file_glob?: string | undefined;
+        }[] | undefined;
+    };
+    fixtures: {
+        block: (string | {
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        })[];
+        allow: (string | {
+            tool: string;
+            command: string;
+        } | {
+            tool: string;
+            file_path: string;
+        })[];
+    };
+    owasp?: ("ASI01" | "ASI02" | "ASI03" | "ASI04" | "ASI05" | "ASI06" | "ASI07" | "ASI08" | "ASI09" | "ASI10" | "LLM01" | "LLM02" | "LLM03" | "LLM04" | "LLM05" | "LLM06" | "LLM07" | "LLM08" | "LLM09" | "LLM10")[] | undefined;
+}>;
+/** How dangerous the caught action is. Never a price. */
+type Severity = (typeof SEVERITIES)[number];
+/** What the guard does on a match. */
+type Action = (typeof ACTIONS)[number];
+/** One condition matched against a tool call. */
+type MatchCondition = z.infer<typeof MatchConditionSchema>;
+/** A composed match — `any_of` / `all_of` / `none_of`. */
+type Match = z.infer<typeof MatchSchema>;
+/** A fixture as authored: a bare command string, or a tagged single-channel object. */
+type FixtureInput = z.input<typeof FixtureSchema>;
+/** A fixture after parsing — always the tagged object form. */
+type Fixture = z.output<typeof FixtureSchema>;
+/** The must-match / must-not-match pair every guardrail ships. */
+type Fixtures = z.infer<typeof FixturesSchema>;
+/** One published guardrail, as authored. */
+type RuleInput = z.input<typeof RuleSchema>;
+/** One published guardrail, parsed and normalized. */
+type Rule = z.output<typeof RuleSchema>;
+/**
+ * Validate a guardrail from unknown input.
+ *
+ * It answers "is this a well-formed guardrail?" — it does NOT answer "does this guardrail
+ * actually fire on the command you think it does." That needs the evaluator, which
+ * is not part of this package.
+ *
+ * @param input - Unknown input, e.g. parsed JSON or a guardrail module's default export.
+ * @returns A Zod SafeParseReturnType — check `.success` before reading `.data`.
+ */
+declare function parseRule(input: unknown): z.SafeParseReturnType<unknown, Rule>;
+/**
+ * Parse a guardrail, or throw with the reason.
+ *
+ * Used by guardrail modules themselves via {@link defineRule}, so an authoring
+ * mistake fails at import — which is to say, at test time — rather than
+ * surviving into a corpus that only validates what it remembers to check.
+ */
+declare function parseRuleOrThrow(input: unknown): Rule;
+/**
+ * Declare a guardrail. Validates at module load, so a malformed guardrail cannot reach the
+ * registry — the corpus is only as trustworthy as its weakest unvalidated entry.
+ */
+declare function defineRule(rule: RuleInput): Rule;
+
+export { type Action as A, parseRuleOrThrow as B, DETAIL_MATCHES_MAX_PATTERNS as D, type Fixture as F, type MatchCondition as M, OWASP_AGENTIC as O, type Rule as R, type Severity as S, type FixtureInput as a, type Fixtures as b, type Match as c, OWASP_IDS as d, OWASP_LLM as e, OWASP_SOURCES as f, type OwaspId as g, type OwaspRisk as h, type RuleInput as i, isOwaspId as j, owaspTitle as k, ACTIONS as l, ActionSchema as m, DETAIL_MATCHES_MAX_PATTERN_LENGTH as n, owaspIndex as o, FixtureSchema as p, FixturesSchema as q, MatchConditionSchema as r, MatchSchema as s, OwaspIdsSchema as t, RuleSchema as u, SEVERITIES as v, SeveritySchema as w, defineRule as x, hasNestedUnboundedQuantifier as y, parseRule as z };