@agenttrail/guardrails 0.2.2 → 0.2.4

package/dist/guardrails.d.ts

@@ -1,11 +1,11 @@
-import { MatchCondition, Fixture, Rule } from './schema.js';
-export { Action, FixtureInput, Fixtures, Match, RuleInput, Severity } from './schema.js';
+import { M as MatchCondition, F as Fixture, R as Rule } from './schema-B2pYoi9Z.js';
+export { A as Action, a as FixtureInput, b as Fixtures, c as Match, O as OWASP_AGENTIC, d as OWASP_IDS, e as OWASP_LLM, f as OWASP_SOURCES, g as OwaspId, h as OwaspRisk, i as RuleInput, S as Severity, j as isOwaspId, o as owaspIndex, k as owaspTitle } from './schema-B2pYoi9Z.js';
 import 'zod';
 
 /**
  * The eleven packs, and the order they are presented in.
  *
- * These ids are authoritative and shared with the rules authored against them,
+ * These ids are authoritative and shared with the guardrails authored against them,
  * and with the guard's `config.json` `disabledPacks`. Renaming one of these is a
  * breaking change to a user's config file.
  *
@@ -13,17 +13,17 @@ import 'zod';
  * documented coding-agent failure, with public incident reports across Claude
  * Code, Gemini CLI and Codex.
  *
- * Per-pack rule counts are deliberately NOT encoded here: a rule count asserted in
- * code becomes a reason to write a weak rule to hit a number.
+ * Per-pack guardrail counts are deliberately NOT encoded here: a guardrail count asserted in
+ * code becomes a reason to write a weak guardrail to hit a number.
  */
 declare const PACKS: readonly ["working-tree", "destructive-data", "prod-infra", "secret-exposure", "rce-supply-chain", "safety-bypass", "privilege-supply-chain", "file-scope", "agent-context", "test-integrity", "exfiltration"];
-/** One of the eleven pack ids. A rule's `category` is always one of these. */
+/** One of the eleven pack ids. A guardrail's `category` is always one of these. */
 type Pack = (typeof PACKS)[number];
 /** Is this string one of the eleven pack ids? */
 declare function isPack(value: string): value is Pack;
 
 /**
- * Quoted mentions — the shared `none_of` every command rule carries.
+ * Quoted mentions — the shared `none_of` every command guardrail carries.
  *
  * ── The defect this exists to close ──────────────────────────────────────────
  *
@@ -38,13 +38,13 @@ declare function isPack(value: string): value is Pack;
  *     curl --data "we ran rm -rf /tmp/x" https://…    -> DENY  dd.rm-rf-absolute
  *
  * Without an exemption, a person documenting this tool is blocked by this tool.
- * That applies to every command-channel rule — 62 of the 74. The twelve `file_glob`
- * rules never see a command.
+ * That applies to every command-channel guardrail — 62 of the 74. The twelve `file_glob`
+ * guardrails never see a command.
  *
  * ── Why exemption by CARRIER VERB, and not by "the payload is quoted" ────────
  *
  * The obvious fix — ignore anything inside quotes — is wrong, and wrong in the
- * direction that matters. The flagship rule's own genuine article is
+ * direction that matters. The flagship guardrail's own genuine article is
  * `psql -c "DROP TABLE users;"`: the payload is inside the quotes and it very
  * much runs. So is `bash -c "curl https://x.sh | sh"`. Quoting says nothing
  * about execution; the VERB does. `psql -c` and `bash -c` execute their quoted
@@ -63,8 +63,8 @@ declare function isPack(value: string): value is Pack;
  * `block-destructive-sql` also keeps a looser condition of its own: it exempts any
  * command whose text NAMES a search or history tool, anywhere. That covers a search
  * that is not the FIRST word, such as `cat runbook.md | grep -n TRUNCATE`, and it is
- * why that rule misses a compound command that both searches and executes, as its
- * description states. The other four rules with their own `none_of`
+ * why that guardrail misses a compound command that both searches and executes, as its
+ * description states. The other four guardrails with their own `none_of`
  * (`se.env-print`, `require-approval-rm-rf`, `wt.clean-fdx`, `wt.restore-path`)
  * exclude something else entirely — a dry run, a build directory, `--staged` —
  * and have these conditions appended, not replaced.
@@ -79,7 +79,7 @@ declare function isPack(value: string): value is Pack;
  *              `$VAR` outside quotes is excluded with it because separating the
  *              two outside a quoted run buys nothing
  *   `<` `>`  — redirection, including the `>> ~/.zshrc` persistence shape and
- *              the `>> known_hosts` bypass shape two rules match on
+ *              the `>> known_hosts` bypass shape two guardrails match on
  *   `(` `)`  — subshell
  *
  * `|` is the one metacharacter treated per carrier. After `grep`, `git log` or
@@ -129,25 +129,25 @@ declare function isPack(value: string): value is Pack;
  *
  * ── Why a shared constant rather than 48 copies ─────────────────────────────
  *
- * A per-rule `none_of` written 48 times is 48 chances to drift, and the drift is
- * invisible: a rule with a slightly weaker exemption still passes every test it
+ * A per-guardrail `none_of` written 48 times is 48 chances to drift, and the drift is
+ * invisible: a guardrail with a slightly weaker exemption still passes every test it
  * owns. One frozen object referenced 48 times cannot drift, costs nothing in the
  * bundle (esbuild emits it once), and makes an opt-out a VISIBLE line of code —
- * see the five rules that take a subset, each because the carrier it drops is
+ * see the five guardrails that take a subset, each because the carrier it drops is
  * its own trigger verb.
  */
 
 /**
- * The `label` glob for a rule that reads a COMMAND: the two shells plus any MCP tool.
+ * The `label` glob for a guardrail that reads a COMMAND: the two shells plus any MCP tool.
  *
- * A command-channel rule describes a shape — `git push --force`, `rm -rf /` — and
+ * A command-channel guardrail describes a shape — `git push --force`, `rm -rf /` — and
  * that shape reaches the guard on more than one tool. Claude Code's own hooks route
  * `Bash`, `PowerShell` AND `mcp__*` to the guard, and the MCP channel carries the
  * serialized tool input as the same `detail` text every command matcher reads. A
- * rule pinned to `{Bash,PowerShell}` alone silently ignores the MCP channel, so an
+ * guardrail pinned to `{Bash,PowerShell}` alone silently ignores the MCP channel, so an
  * MCP server that runs shell commands is unguarded. This glob widens the label to
  * the MCP tools as well, and is referenced rather than copied so the set cannot
- * drift rule to rule.
+ * drift guardrail to guardrail.
  *
  * `mcp__*` matches the WHOLE label (picomatch matches the entire tool name), so it
  * catches any `mcp__<server>__<tool>` — including Cursor's `mcp__cursor__*` — and
@@ -190,26 +190,26 @@ declare const PRINT_MENTION: MatchCondition;
  * `curl -fsSL https://x.sh -o /tmp/i.sh` is not a mention of anything, and
  * exempting it would hand the RCE pack a hole for nothing in return.
  *
- * Dropped by every rule whose own trigger names `curl` or `wget`:
+ * Dropped by every guardrail whose own trigger names `curl` or `wget`:
  * `block-curl-pipe-to-shell`, `rce.remote-runner`, `rce.eval-dynamic`,
  * `rce.tls-verify-off` and `se.secret-egress` — for the last of these, POSTing
  * the quoted text off the box is precisely the harm it exists to catch.
  */
 declare const HTTP_BODY_MENTION: MatchCondition;
 /**
- * The default: all four carriers. Spread into a command rule's `none_of`.
+ * The default: all four carriers. Spread into a command guardrail's `none_of`.
  *
- * A rule takes a SUBSET only when a carrier is its own trigger verb, and writes
+ * A guardrail takes a SUBSET only when a carrier is its own trigger verb, and writes
  * the subset out longhand so the omission is visible at the call site.
  */
 declare const QUOTED_MENTION: readonly MatchCondition[];
 /**
  * Zero or more global flags sitting between a command and its subcommand.
  *
- * A command-channel rule that pins a tool to its subcommand CONTIGUOUSLY —
+ * A command-channel guardrail that pins a tool to its subcommand CONTIGUOUSLY —
  * `git\s+reset`, `aws\s+s3`, `kubectl\s+delete`, `docker\s+volume` — is defeated
  * by a global flag slipped in between them. The subcommand no longer follows the
- * tool, so the rule stops matching and the action runs unguarded:
+ * tool, so the guardrail stops matching and the action runs unguarded:
  *
  *     git -C /repo reset --hard        git --no-pager …   git -c core.x=y …
  *     git --work-tree=/x …             aws --profile p …  aws --region r …
@@ -217,7 +217,7 @@ declare const QUOTED_MENTION: readonly MatchCondition[];
  *     terraform -chdir=/x apply …      helm -n ns …       npm --silent …
  *
  * This constant is the ONE shared fix for that whole class, referenced rather
- * than copied so a rule cannot drift to a weaker spelling. It is spliced in RIGHT
+ * than copied so a guardrail cannot drift to a weaker spelling. It is spliced in RIGHT
  * AFTER the tool name and BEFORE the `\s+` that precedes the subcommand:
  * `\\bgit${LEADING_FLAGS}\\s+reset\\s+--hard\\b`. Empty (zero flags) it collapses
  * back to the original `tool\s+subcommand`, so the plain form still matches.
@@ -253,16 +253,16 @@ declare const LEADING_FLAGS = "(?:\\s+-{1,2}[A-Za-z][\\w-]{0,24}(?:=\\S{1,40})?(
  *
  * `FixtureSchema` accepts a bare string as shorthand for
  * `{ tool: "Bash", command: … }`, but that shorthand is a **zod transform**: it
- * only becomes the object form when a rule is PARSED. Rule files export plain
+ * only becomes the object form when a guardrail is PARSED. Guardrail files export plain
  * typed literals so that nothing on the guard's hot path reaches the validator
  * (see `rules.ts`), so there is no parse at load and therefore no transform —
- * a bare string in a rule file would be a bare string at runtime, and the
+ * a bare string in a guardrail file would be a bare string at runtime, and the
  * harness reads `"command" in fixture`.
  *
  * Writing every fixture out longhand would work and would be unreadable, so
  * these exist instead. They also make the CHANNEL visible at every single
  * fixture, and the channel is the thing
- * that silently makes a fixture vacuous — a `file_glob` rule handed a command
+ * that silently makes a fixture vacuous — a `file_glob` guardrail handed a command
  * fixture matches nothing, and an `allow` fixture that matches nothing passes.
  */
 
@@ -271,8 +271,8 @@ declare function bash(command: string): Fixture;
 /**
  * A fixture on the command channel, from the `PowerShell` tool.
  *
- * Worth spelling out at least once per shell rule: on Windows without Git Bash,
- * Claude Code does not register `Bash` at all, so a rule proven only against
+ * Worth spelling out at least once per shell guardrail: on Windows without Git Bash,
+ * Claude Code does not register `Bash` at all, so a guardrail proven only against
  * `Bash` is proven on one platform.
  */
 declare function pwsh(command: string): Fixture;
@@ -281,7 +281,7 @@ declare function pwsh(command: string): Fixture;
  *
  * `tool` defaults to `Edit`. The guard's mapper routes `Edit`, `Write`, `Read`,
  * `MultiEdit`, `NotebookEdit`, `Grep` and `Glob` to this channel, and WHICH ONE a
- * fixture names is load-bearing: a file rule that names an operation in its id or
+ * fixture names is load-bearing: a file guardrail that names an operation in its id or
  * title excludes the read tools in its `none_of` (`{Read,Grep}`), so the same path
  * matches under `Edit` and does not match under `Read`. Naming the tool is
  * therefore part of the case a fixture proves, not documentation of it — an
@@ -297,7 +297,7 @@ declare function file(filePath: string, tool?: string): Fixture;
  * name; the widened `{Bash,PowerShell,mcp__*}` label matches any `mcp__*`.
  *
  * The point is to prove a command SHAPE carried by an MCP server still fires the
- * rule (`{ command: "rm -rf /" }`), and that a serialized MENTION is NOT exempted:
+ * guardrail (`{ command: "rm -rf /" }`), and that a serialized MENTION is NOT exempted:
  * the `none_of` carriers are anchored to the shell, and JSON does not start with a
  * carrier verb.
  */
@@ -316,9 +316,9 @@ declare function mentionInEcho(text: string): Fixture;
 declare function mentionInPost(text: string): Fixture;
 /**
  * All four near misses for one payload: a commit message, a search, an echo and
- * an HTTP body. Spread into a rule's `allow` fixtures.
+ * an HTTP body. Spread into a guardrail's `allow` fixtures.
  *
- * A rule whose own trigger verb IS one of the carriers writes the other three
+ * A guardrail whose own trigger verb IS one of the carriers writes the other three
  * out longhand instead — see `exemptions.ts` for the five that do.
  */
 declare function mentions(text: string): Fixture[];
@@ -327,37 +327,32 @@ declare function mentions(text: string): Fixture[];
  * The catalog's own version and publication date.
  *
  * These are the two facts the offline guard needs in order to tell someone how old
- * their protection is. The guard has no update check and no network path for rules,
- * so a user's rules are frozen on the day they installed and nothing else can tell
+ * their protection is. The guard has no update check and no network path for guardrails,
+ * so a user's guardrails are frozen on the day they installed and nothing else can tell
  * them that.
  *
  * ── Why the stamp lives HERE and not in `@agenttrail/guard` ──────────────────
  * The guard BUNDLES this package at build time, so it is *this* package's version
- * that determines which rules a user is actually running. The guard's own version
+ * that determines which guardrails a user is actually running. The guard's own version
  * answers a different question and would be the wrong number: `guard@0.4.1` may ship
- * an unchanged catalog, and two different guard versions may carry the same rules.
+ * an unchanged catalog, and two different guard versions may carry the same guardrails.
  *
  * ── This module imports nothing, and that is load-bearing ───────────────────
  * It is exported from `rules.ts`, the zod-free entry the guard bundles into the
  * file Claude Code runs before every tool call. Two string constants add nothing to
  * that bundle; an import of `schema.ts` here would add zod to it. Add no imports here.
  *
- * ── Both constants are hand-written, and that is deliberate ──────────────────
+ * ── Both constants live in source, and that is deliberate ────────────────────
  * A build-time `define` would reach `dist/` only, so the value would exist in the
  * published tarball and be absent from the source every test imports — the shipped
  * value would be the one value never exercised. `__tests__/stamp.test.ts` pins
  * `CATALOG_VERSION` to `package.json` so the two cannot drift in silence.
  *
- * ── AT RELEASE, BUMP BOTH CONSTANTS BELOW, TOGETHER ──────────────────────────
- * Bumping `package.json`'s version alone turns `stamp.test.ts` red, and that is the
- * point: it is what brings whoever cut the release into this file, where the date is
- * a few lines away. Publish order is `guardrails` first, then `guard`;
- * a guard release carries whatever stamp was here when it was built.
- *
- * Forgetting to advance the date understates how fresh the rules are, which tells a
- * user to update when they need not. Forgetting in the other direction would tell a
- * user they are current when they are stale. The first is the safe failure and the
- * one this arrangement produces.
+ * ── The release writes both constants below ─────────────────────────────────
+ * `scripts/sr-stamp.mjs` sets `CATALOG_VERSION` to the release version and
+ * `CATALOG_PUBLISHED_AT` to the release time, in the same step that bumps
+ * `package.json`. Do not edit them by hand. Publish order is `guardrails` first,
+ * then `guard`; a guard release carries whatever stamp was here when it was built.
  */
 /**
  * The corpus version.
@@ -365,20 +360,20 @@ declare function mentions(text: string): Fixture[];
  * Pinned to `package.json`'s `version` by `__tests__/stamp.test.ts` — this is a copy
  * of that value, not an independent one, and the test is what makes the copy safe.
  */
-declare const CATALOG_VERSION = "0.2.2";
+declare const CATALOG_VERSION = "0.2.4";
 /**
- * When the rules in this catalog reached their current state, as an ISO-8601
+ * When the guardrails in this catalog reached their current state, as an ISO-8601
  * instant. The question it answers is not "when did this reach a registry" but "how
- * old are the rules I am running".
+ * old are the guardrails I am running".
  *
  * If a release cannot source a real date, leave it absent rather than approximate:
  * the guard handles a missing date, and a wrong date that looks right is worse than
  * a missing one.
  */
-declare const CATALOG_PUBLISHED_AT = "2026-10-06T13:41:00Z";
+declare const CATALOG_PUBLISHED_AT = "2026-10-16T16:15:37Z";
 
 /**
- * The corpus itself — rules only, and **deliberately free of zod**.
+ * The corpus itself — guardrails only, and **deliberately free of zod**.
  *
  * ── Why this is a separate entry point from `index.ts` ───────────────────────
  *
@@ -388,30 +383,30 @@ declare const CATALOG_PUBLISHED_AT = "2026-10-06T13:41:00Z";
  *
  * The package ROOT cannot satisfy that: `index.ts` re-exports `./schema.js`, which
  * value-imports zod. So the guard imports `@agenttrail/guardrails/guardrails` — this
- * file — whose whole import graph is `./packs.js`, `./exemptions.js` and
- * `./fixtures.js` (all three plain data) plus a TYPE-only
+ * file — whose whole import graph is `./packs.js`, `./exemptions.js`, `./fixtures.js`
+ * and `./owasp.js` (all four plain data) plus a TYPE-only
  * reference to `./schema.js`, which esbuild erases. Everyone else keeps using the
  * root and gets the schema with it.
  *
- * A cold import of the package root, validating every rule through `defineRule`,
+ * A cold import of the package root, validating every guardrail through `defineRule`,
  * takes about twice as long as an empty Node process. The subpath avoids that on
  * every tool call.
  *
  * ── Where validation runs ───────────────────────────────────────────────────
  *
- * At test time: `__tests__/corpus.test.ts` runs `parseRule()` over every rule and
+ * At test time: `__tests__/corpus.test.ts` runs `parseRule()` over every guardrail and
  * fails on any invalid one, and proves that sweep bites with a deliberately
- * malformed rule. `defineRule` is exported for contributors authoring locally.
+ * malformed guardrail. `defineRule` is exported for contributors authoring locally.
  *
- * So every rule file exports a plain object literal typed `satisfies Rule` with a
+ * So every guardrail file exports a plain object literal typed `satisfies Rule` with a
  * TYPE-only schema import. `corpus.test.ts` is what stops one from drifting.
  */
 
 /**
- * Every pack's rules, keyed by pack id.
+ * Every pack's guardrails, keyed by pack id.
  *
  * `Record<Pack, …>` is doing real work: adding a pack to `PACKS` without wiring
- * its rules here is a compile error, not a pack that silently ships empty.
+ * its guardrails here is a compile error, not a pack that silently ships empty.
  */
 declare const RULES_BY_PACK: Record<Pack, readonly Rule[]>;
 /**
@@ -421,9 +416,9 @@ declare const RULES_BY_PACK: Record<Pack, readonly Rule[]>;
  * the declared one and a pack cannot be omitted by a missed line.
  */
 declare const RULES: readonly Rule[];
-/** Look up one rule by id. `undefined` when nothing matches. */
+/** Look up one guardrail by id. `undefined` when nothing matches. */
 declare function getRule(id: string): Rule | undefined;
-/** Every rule in one pack, in authored order. */
+/** Every guardrail in one pack, in authored order. */
 declare function rulesForPack(pack: Pack): readonly Rule[];
 
 export { CATALOG_PUBLISHED_AT, CATALOG_VERSION, Fixture, GIT_TEXT_MENTION, HTTP_BODY_MENTION, LEADING_FLAGS, MatchCondition, PACKS, PRINT_MENTION, type Pack, QUOTED_MENTION, RULES, RULES_BY_PACK, Rule, SEARCH_MENTION, SHELL_AND_MCP, bash, file, getRule, isPack, mcp, mentionInCommit, mentionInEcho, mentionInPost, mentionInSearch, mentions, pwsh, rulesForPack };

package/dist/guardrails.js

@@ -23,13 +23,26 @@ import {
   mentions,
   pwsh,
   rulesForPack
-} from "./chunk-GNN4TGRY.js";
+} from "./chunk-6YROGDEH.js";
+import {
+  OWASP_AGENTIC,
+  OWASP_IDS,
+  OWASP_LLM,
+  OWASP_SOURCES,
+  isOwaspId,
+  owaspIndex,
+  owaspTitle
+} from "./chunk-T6MJIV52.js";
 export {
   CATALOG_PUBLISHED_AT,
   CATALOG_VERSION,
   GIT_TEXT_MENTION,
   HTTP_BODY_MENTION,
   LEADING_FLAGS,
+  OWASP_AGENTIC,
+  OWASP_IDS,
+  OWASP_LLM,
+  OWASP_SOURCES,
   PACKS,
   PRINT_MENTION,
   QUOTED_MENTION,
@@ -40,6 +53,7 @@ export {
   bash,
   file,
   getRule,
+  isOwaspId,
   isPack,
   mcp,
   mentionInCommit,
@@ -47,6 +61,8 @@ export {
   mentionInPost,
   mentionInSearch,
   mentions,
+  owaspIndex,
+  owaspTitle,
   pwsh,
   rulesForPack
 };