@auxdynamics/mastguard-agent-sdk 0.1.0

package/dist/index.mjs

@@ -0,0 +1,862 @@
+// src/AuditLogger.ts
+import { createHash } from "crypto";
+var AuditLogger = class _AuditLogger {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  static computeChainHash(prevHash, contentJson, salt) {
+    const contentHash = createHash("sha256").update(contentJson).digest("hex");
+    const prev = prevHash ?? salt;
+    return createHash("sha256").update(prev + contentHash).digest("hex");
+  }
+  static verifyChain(entries, salt) {
+    let prevHash = null;
+    for (const entry of entries) {
+      const expected = _AuditLogger.computeChainHash(prevHash, entry.content, salt);
+      if (expected !== entry.hash) return false;
+      prevHash = entry.hash;
+    }
+    return true;
+  }
+  // Fire-and-forget POST /api/v1/security/ingest. Never throws — returns
+  // null on any failure. The caller does not need to await this in monitor
+  // mode; a failure must never break the customer's AI call.
+  async ingest(payload) {
+    const baseUrl = this.config.apiBaseUrl ?? "https://api.mastguard.io";
+    const timeoutMs = this.config.timeoutMs ?? 5e3;
+    const url = `${baseUrl}/api/v1/security/ingest`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetch(url, {
+        method: "POST",
+        headers: {
+          "Content-Type": "application/json",
+          "X-API-Key": this.config.apiKey
+        },
+        body: JSON.stringify(payload),
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        console.error(
+          `[MastGuard] ingest non-200: ${res.status} ${res.statusText}`
+        );
+        return null;
+      }
+      const body = await res.json();
+      return body?.data?.audit_id ?? body?.audit_id ?? null;
+    } catch (err) {
+      console.error("[MastGuard] ingest error:", err);
+      return null;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+};
+
+// src/ThreatDetector.ts
+var EVIDENCE_MAX = 100;
+var TOKEN_BUDGET_LIMIT = parseInt(
+  process.env["MASTGUARD_SEC_TOKEN_BUDGET_LIMIT"] ?? "50000",
+  10
+);
+var ZERO_WIDTH = /[​-‍⁠­͏]/g;
+var CONTROL_TO_SPACE = /[\x00-\x08\x0b-\x1f\x7f‎‏‪-‮]/g;
+var DECORATOR_BETWEEN_LETTERS = /(?<=[A-Za-z])[\-._](?=[A-Za-z])/g;
+var HOMOGLYPHS = {
+  // uppercase
+  \u0410: "A",
+  \u0412: "B",
+  \u0415: "E",
+  \u041A: "K",
+  \u041C: "M",
+  \u041D: "H",
+  \u041E: "O",
+  \u0420: "P",
+  \u0421: "C",
+  \u0422: "T",
+  \u0425: "X",
+  \u0423: "Y",
+  \u0406: "I",
+  \u0408: "J",
+  // lowercase
+  \u0430: "a",
+  \u0435: "e",
+  \u043A: "k",
+  \u043C: "m",
+  \u043E: "o",
+  \u0440: "p",
+  \u0441: "c",
+  \u0442: "t",
+  \u0445: "x",
+  \u0443: "y",
+  \u0456: "i",
+  \u0458: "j"
+};
+function foldHomoglyphs(text) {
+  let out = "";
+  for (const ch of text) {
+    out += HOMOGLYPHS[ch] ?? ch;
+  }
+  return out;
+}
+var LITERAL_ESCAPES = /\\[nrt]/g;
+function normalize(text) {
+  let s = text.replace(CONTROL_TO_SPACE, " ");
+  s = s.replace(LITERAL_ESCAPES, " ");
+  s = s.normalize("NFKC");
+  s = s.replace(ZERO_WIDTH, "");
+  s = foldHomoglyphs(s);
+  s = s.toLowerCase();
+  s = s.replace(DECORATOR_BETWEEN_LETTERS, "");
+  return s;
+}
+function base64Candidates(text) {
+  const out = [];
+  const re = /[A-Za-z0-9+/]{16,}={0,2}/g;
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    const tok = m[0];
+    const padded = tok + "=".repeat((4 - tok.length % 4) % 4);
+    try {
+      const decoded = Buffer.from(padded, "base64").toString("utf-8");
+      if (decoded && /[\x20-\x7e]/.test(decoded)) {
+        out.push(decoded);
+      }
+    } catch {
+    }
+  }
+  return out;
+}
+function urlDecodeCandidate(text) {
+  if (!/%[0-9A-Fa-f]{2}/.test(text)) return null;
+  try {
+    return decodeURIComponent(text);
+  } catch {
+    return text.replace(
+      /%([0-9A-Fa-f]{2})/g,
+      (_, hex) => String.fromCharCode(parseInt(hex, 16))
+    );
+  }
+}
+function unicodeEscapeCandidate(text) {
+  if (!/\\u[0-9A-Fa-f]{4}/.test(text)) return null;
+  return text.replace(
+    /\\u([0-9A-Fa-f]{4})/g,
+    (_, hex) => String.fromCharCode(parseInt(hex, 16))
+  );
+}
+function expandSources(text) {
+  const sources = [text];
+  const url = urlDecodeCandidate(text);
+  if (url && url !== text) sources.push(url);
+  const uesc = unicodeEscapeCandidate(text);
+  if (uesc && uesc !== text) sources.push(uesc);
+  for (const b of base64Candidates(text)) sources.push(b);
+  return sources;
+}
+var INJECTION_PATTERNS = [
+  // Direct override imperatives
+  {
+    pattern: /\bignore\s+(?:all\s+|the\s+)?(?:previous|prior|above|earlier|safety|my)\s+(?:instructions?|guidelines?|rules?|directives?|message)/,
+    severity: "high",
+    description: "instruction-override imperative"
+  },
+  {
+    pattern: /\bignore\s+the\s+above\b/,
+    severity: "high",
+    description: "ignore-the-above directive"
+  },
+  {
+    pattern: /\bignore\s+(?:all\s+)?(?:previous|prior|above|earlier)\b/,
+    severity: "high",
+    description: "ignore-previous directive"
+  },
+  {
+    pattern: /\bdisregard\s+(?:all\s+|your\s+|the\s+|previous\s+|prior\s+)?(?:instructions?|previous|prior)/,
+    severity: "high",
+    description: "instruction-override imperative"
+  },
+  {
+    pattern: /\bforget\s+(?:everything|all|your\s+(?:instructions?|prompt)|what\s+you)/,
+    severity: "high",
+    description: "instruction-forget directive"
+  },
+  {
+    pattern: /\bnew\s+system\s+prompt\b/,
+    severity: "high",
+    description: "system-prompt-override marker"
+  },
+  {
+    pattern: /\byour\s+new\s+instructions?\b/,
+    severity: "high",
+    description: "new-instruction injection"
+  },
+  {
+    pattern: /\bsystem\s*:\s*(?:forget|ignore|new|override)\b/,
+    severity: "high",
+    description: "system-tag override"
+  },
+  {
+    pattern: /\bsystem\s+override\b/,
+    severity: "high",
+    description: "system-override marker"
+  },
+  {
+    pattern: /\[\s*system\s*\][\s\S]{0,200}?\bnew\s+task\b/,
+    severity: "high",
+    description: "[SYSTEM] new-task injection"
+  },
+  {
+    pattern: /\bprevious\s+instructions?\s+(?:were|are)\s+wrong\b/,
+    severity: "high",
+    description: "instructions-were-wrong override"
+  },
+  // Roleplay / persona jailbreak
+  {
+    pattern: /\byou\s+are\s+(?:now\s+)?(?:dan|do\s+anything\s+now|jailbreak|gpt-?4chan|an?\s+ai\s+with\s+no\s+restrictions|in\s+developer\s+mode|unrestricted)\b/,
+    severity: "high",
+    description: "roleplay jailbreak (DAN-class)"
+  },
+  {
+    pattern: /\bdan\s+(?:mode|stands\s+for)\b/,
+    severity: "high",
+    description: "DAN persona marker"
+  },
+  {
+    pattern: /\benable\s+dan\s+mode\b/,
+    severity: "high",
+    description: "enable-DAN directive"
+  },
+  {
+    pattern: /\bswitch\s+to\s+(?:unrestricted|jailbreak|dan)\s+mode\b/,
+    severity: "high",
+    description: "switch-mode jailbreak"
+  },
+  {
+    pattern: /\bpretend\s+you\s+(?:have|are)\s+(?:no\s+restrictions|unrestricted)\b/,
+    severity: "high",
+    description: "pretend-unrestricted directive"
+  },
+  {
+    pattern: /\b(?:as\s+a\s+)?developer\s+(?:in\s+)?(?:debug\s+)?mode\b.*\b(?:bypass|disabled|no\s+restrictions)/,
+    severity: "high",
+    description: "developer/debug-mode roleplay"
+  },
+  {
+    pattern: /\bdeveloper\s+mode\b/,
+    severity: "high",
+    description: "developer-mode marker"
+  },
+  {
+    pattern: /\bbypass\s+(?:all\s+)?(?:restrictions|safety|guidelines|rules)\b/,
+    severity: "high",
+    description: "explicit bypass directive"
+  },
+  {
+    pattern: /\bact\s+as\s+an\s+ai\b/,
+    severity: "high",
+    description: "act-as-AI roleplay"
+  },
+  {
+    pattern: /\broleplay\s+as\s+an\s+ai\b/,
+    severity: "high",
+    description: "roleplay-as-AI directive"
+  },
+  {
+    pattern: /\bbefore\s+safety\s+training\b/,
+    severity: "high",
+    description: "pre-safety-training roleplay"
+  },
+  {
+    pattern: /\bsafety\s+training\s+was\s+invented\b/,
+    severity: "high",
+    description: "safety-training-invented roleplay"
+  },
+  {
+    pattern: /\bwithout\s+safety\s+(?:guidelines?|training|filters?)\b/,
+    severity: "high",
+    description: "without-safety claim"
+  },
+  {
+    pattern: /\bwithout\s+alignment\s+training\b/,
+    severity: "high",
+    description: "without-alignment claim"
+  },
+  {
+    pattern: /\bsimulate\s+an\s+ai\b/,
+    severity: "high",
+    description: "simulate-AI directive"
+  },
+  {
+    pattern: /\bno\s+ethical\s+guidelines\b/,
+    severity: "high",
+    description: "no-ethical-guidelines claim"
+  },
+  {
+    pattern: /\bno\s+(?:rules|restrictions|guidelines)\b/,
+    severity: "high",
+    description: "no-rules assertion"
+  },
+  {
+    pattern: /\bignores?\s+content\s+policy\b/,
+    severity: "high",
+    description: "content-policy bypass"
+  },
+  {
+    pattern: /\byour\s+true\s+self\b/,
+    severity: "high",
+    description: "true-self jailbreak frame"
+  },
+  {
+    pattern: /\bsafety\s+(?:filters?|guidelines?|mode)\s+(?:are\s+|is\s+|was\s+)?disabled\b/,
+    severity: "high",
+    description: "safety-disabled claim"
+  },
+  {
+    pattern: /\bfictional\s+scenario\b/,
+    severity: "high",
+    description: "fictional-scenario jailbreak frame"
+  },
+  // Chat-template / structured tag injections
+  {
+    pattern: /\[inst\][\s\S]*?\[\/inst\]/,
+    severity: "high",
+    description: "[INST] chat-template injection"
+  },
+  {
+    pattern: /<\|im_start\|>/,
+    severity: "high",
+    description: "ChatML tag injection"
+  },
+  {
+    pattern: /#{2,}\s*override\s*#{2,}/,
+    severity: "high",
+    description: "###OVERRIDE### sentinel"
+  },
+  {
+    pattern: /\{\{\s*system/,
+    severity: "high",
+    description: "{{system}} template injection"
+  },
+  // System prompt extraction
+  {
+    pattern: /\brepeat\s+your\s+system\s+prompt\b/,
+    severity: "high",
+    description: "system-prompt extraction request"
+  },
+  {
+    pattern: /\b(?:your\s+)?exact\s+instructions\b/,
+    severity: "high",
+    description: "exact-instructions extraction"
+  },
+  {
+    pattern: /\bprint\s+everything\s+above\b/,
+    severity: "high",
+    description: "print-above extraction"
+  },
+  {
+    pattern: /\boutput\s+your\s+(?:initial\s+|system\s+)?(?:prompt|message|instructions)\b/,
+    severity: "high",
+    description: "output-prompt extraction"
+  },
+  {
+    pattern: /\bshow\s+me\s+your\s+(?:configuration|config|system\s+prompt)\b/,
+    severity: "high",
+    description: "show-configuration extraction"
+  },
+  {
+    pattern: /\bwhat\s+were\s+you\s+told\b/,
+    severity: "high",
+    description: "what-were-you-told extraction"
+  },
+  {
+    pattern: /\breveal\s+your\s+(?:base\s+|hidden\s+)?(?:instructions|directives|prompt|system\s+prompt)\b/,
+    severity: "high",
+    description: "reveal-instructions extraction"
+  },
+  {
+    pattern: /\b(?:hidden|secret)\s+directives\b/,
+    severity: "high",
+    description: "hidden-directives extraction"
+  },
+  {
+    pattern: /\bfull\s+text\s+of\s+your\s+(?:system\s+)?prompt\b/,
+    severity: "high",
+    description: "full-prompt extraction"
+  },
+  {
+    pattern: /\boutput\s+your\s+system\s+message\b/,
+    severity: "high",
+    description: "system-message extraction"
+  }
+];
+var EXFILTRATION_PATTERNS = [
+  {
+    pattern: /\b\d{3}-\d{2}-\d{4}\b/,
+    severity: "high",
+    description: "SSN-pattern (XXX-XX-XXXX) in response"
+  },
+  {
+    pattern: /\b(?:4\d{12}(?:\d{3})?|5[1-5]\d{14}|3[47]\d{13})\b/,
+    severity: "high",
+    description: "credit-card sequence in response"
+  },
+  {
+    pattern: /sk-(?:proj-|live-|test-)?[A-Za-z0-9_-]{20,}/,
+    severity: "critical",
+    description: "OpenAI-style API key in response"
+  },
+  {
+    pattern: /\bghp_[A-Za-z0-9]{30,}\b/,
+    severity: "critical",
+    description: "GitHub PAT in response"
+  },
+  {
+    pattern: /\bgh[ousr]_[A-Za-z0-9]{30,}\b/,
+    severity: "critical",
+    description: "GitHub token in response"
+  },
+  {
+    pattern: /-----BEGIN\s+(?:RSA\s+|EC\s+|DSA\s+|OPENSSH\s+|PGP\s+|ENCRYPTED\s+)?PRIVATE\s+KEY-----/,
+    severity: "critical",
+    description: "private-key block in response"
+  },
+  {
+    pattern: /\bAKIA[0-9A-Z]{16}\b/,
+    severity: "critical",
+    description: "AWS access key ID in response"
+  },
+  {
+    pattern: /\bpassword\s*[:=]\s*\S+/i,
+    severity: "high",
+    description: "password literal in response"
+  }
+];
+var DANGEROUS_TOOL_SEQUENCES = [
+  ["read_file", "send_email"],
+  ["list_files", "read_file", "http_request"],
+  ["read_database", "write_file"],
+  ["get_credentials", "http_request"],
+  ["read_env", "send_email"]
+];
+function truncate(s) {
+  const trimmed = s.trim().replace(/\n/g, " ");
+  if (trimmed.length <= EVIDENCE_MAX) return trimmed;
+  return trimmed.slice(0, EVIDENCE_MAX - 3) + "...";
+}
+function redactValue(s) {
+  if (s.length <= 20) return s;
+  return s.slice(0, 20) + "...";
+}
+var SEVERITY_RANK = {
+  critical: 5,
+  high: 4,
+  medium: 3,
+  low: 2,
+  info: 1
+};
+function worstSeverity(violations) {
+  if (violations.length === 0) return null;
+  let worst = violations[0].severity;
+  for (const v of violations) {
+    if (SEVERITY_RANK[v.severity] > SEVERITY_RANK[worst]) {
+      worst = v.severity;
+    }
+  }
+  return worst;
+}
+function isSubsequence(needle, haystack) {
+  if (needle.length === 0) return true;
+  let i = 0;
+  for (const item of haystack) {
+    if (item === needle[i]) {
+      i += 1;
+      if (i === needle.length) return true;
+    }
+  }
+  return false;
+}
+var ThreatDetector = class _ThreatDetector {
+  static detect(options) {
+    const violations = [];
+    violations.push(..._ThreatDetector.detectPromptInjection(options.prompt ?? ""));
+    violations.push(..._ThreatDetector.detectScopeViolation(
+      options.toolCalls ?? [],
+      options.allowedTools ?? []
+    ));
+    violations.push(..._ThreatDetector.detectDataExfiltration(options.response ?? ""));
+    violations.push(..._ThreatDetector.detectIndirectInjection(options.toolOutputs ?? []));
+    violations.push(..._ThreatDetector.detectMultiStepAttack(
+      options.sessionHistory ?? [],
+      options.toolCalls ?? [],
+      options.tokenCount ?? 0
+    ));
+    return {
+      violations,
+      allow: true,
+      // detector never blocks — PolicyEngine decides
+      worstSeverity: worstSeverity(violations)
+    };
+  }
+  static detectPromptInjection(prompt) {
+    if (!prompt) return [];
+    const hits = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const source of expandSources(prompt)) {
+      const normalised = normalize(source);
+      for (const { pattern, severity, description } of INJECTION_PATTERNS) {
+        const m = pattern.exec(normalised);
+        if (!m) continue;
+        const key = `${pattern.source}|${description}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        hits.push({
+          category: "prompt_injection",
+          severity,
+          description,
+          action: "block",
+          evidence: truncate(m[0])
+        });
+      }
+    }
+    return hits;
+  }
+  static detectScopeViolation(toolCalls, allowedTools) {
+    if (!toolCalls.length) return [];
+    if (!allowedTools.length) return [];
+    const allowed = new Set(allowedTools);
+    const hits = [];
+    for (const call of toolCalls) {
+      if (!call?.name) continue;
+      if (allowed.has(call.name)) continue;
+      hits.push({
+        category: "scope_violation",
+        severity: "critical",
+        description: `tool '${call.name}' not in allowed_tools`,
+        action: "block",
+        evidence: truncate(`Undeclared tool: ${call.name}`)
+      });
+    }
+    return hits;
+  }
+  static detectDataExfiltration(response) {
+    if (!response) return [];
+    const hits = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const { pattern, severity, description } of EXFILTRATION_PATTERNS) {
+      const re = new RegExp(pattern.source, pattern.flags.includes("g") ? pattern.flags : pattern.flags + "g");
+      let m;
+      while ((m = re.exec(response)) !== null) {
+        const key = `${pattern.source}|${m[0]}`;
+        if (seen.has(key)) continue;
+        seen.add(key);
+        hits.push({
+          category: "data_exfiltration",
+          severity,
+          description,
+          action: "flag",
+          evidence: truncate(redactValue(m[0]))
+        });
+        if (re.lastIndex === m.index) re.lastIndex += 1;
+      }
+    }
+    return hits;
+  }
+  // KNOWN GAP: indirect injection via nested tool output — Python parity
+  // needed. See test_threat_detector.py. Phase 8 hardening backlog.
+  static detectIndirectInjection(toolOutputs) {
+    if (!toolOutputs.length) return [];
+    const hits = [];
+    const seen = /* @__PURE__ */ new Set();
+    for (const raw of toolOutputs) {
+      if (!raw) continue;
+      for (const source of expandSources(raw)) {
+        const normalised = normalize(source);
+        for (const { pattern, description } of INJECTION_PATTERNS) {
+          const m = pattern.exec(normalised);
+          if (!m) continue;
+          const key = `${pattern.source}|${description}`;
+          if (seen.has(key)) continue;
+          seen.add(key);
+          hits.push({
+            category: "indirect_injection",
+            severity: "high",
+            description: `indirect: ${description}`,
+            action: "block",
+            evidence: truncate(m[0])
+          });
+        }
+      }
+    }
+    return hits;
+  }
+  static detectMultiStepAttack(sessionHistory, toolCalls, tokenCount) {
+    const hits = [];
+    const sequence = [];
+    for (const turn of sessionHistory) {
+      for (const call of turn.toolCalls ?? []) {
+        if (call?.name) sequence.push(call.name);
+      }
+    }
+    for (const call of toolCalls) {
+      if (call?.name) sequence.push(call.name);
+    }
+    for (const seq of DANGEROUS_TOOL_SEQUENCES) {
+      if (isSubsequence(seq, sequence)) {
+        hits.push({
+          category: "multi_step_attack",
+          severity: "high",
+          description: `dangerous tool sequence: ${seq.join(" -> ")}`,
+          action: "flag",
+          evidence: truncate(seq.join(" -> "))
+        });
+      }
+    }
+    if (tokenCount > TOKEN_BUDGET_LIMIT) {
+      hits.push({
+        category: "multi_step_attack",
+        severity: "critical",
+        description: `session token budget exceeded (${tokenCount} > ${TOKEN_BUDGET_LIMIT})`,
+        action: "block",
+        evidence: truncate(String(tokenCount))
+      });
+    }
+    return hits;
+  }
+};
+
+// src/PolicyEngine.ts
+var DEFAULT_POLICY = {
+  name: "default",
+  tier: "standard",
+  rules: [{ type: "all", action: "log" }]
+};
+var CACHE_TTL_MS = 5 * 60 * 1e3;
+var PolicyEngine = class {
+  constructor(config) {
+    this.config = config;
+  }
+  config;
+  policyCache = /* @__PURE__ */ new Map();
+  async evaluate(options, policyName) {
+    const policy = await this.fetchPolicy(policyName);
+    const detection = ThreatDetector.detect(options);
+    let allow = true;
+    for (const v of detection.violations) {
+      if (v.action === "block" || v.severity === "critical") {
+        allow = false;
+        break;
+      }
+    }
+    if (policy.name === "default" && policy.rules[0]?.action === "log") {
+    }
+    return {
+      violations: detection.violations,
+      allow,
+      worstSeverity: detection.worstSeverity
+    };
+  }
+  async fetchPolicy(policyName) {
+    const cached = this.policyCache.get(policyName);
+    if (cached && Date.now() - cached.fetchedAt < CACHE_TTL_MS) {
+      return cached.policy;
+    }
+    const baseUrl = this.config.apiBaseUrl ?? "https://api.mastguard.io";
+    const timeoutMs = this.config.timeoutMs ?? 5e3;
+    const url = `${baseUrl}/api/v1/security/policies?name=${encodeURIComponent(policyName)}`;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetch(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${this.config.apiKey}` },
+        signal: controller.signal
+      });
+      if (!res.ok) {
+        this.policyCache.set(policyName, { policy: DEFAULT_POLICY, fetchedAt: Date.now() });
+        return DEFAULT_POLICY;
+      }
+      const body = await res.json();
+      const policy = body?.data ?? body;
+      const safe = {
+        name: policy?.name ?? policyName,
+        tier: policy?.tier ?? "standard",
+        rules: Array.isArray(policy?.rules) ? policy.rules : DEFAULT_POLICY.rules
+      };
+      this.policyCache.set(policyName, { policy: safe, fetchedAt: Date.now() });
+      return safe;
+    } catch (err) {
+      console.error("[MastGuard] policy fetch error:", err);
+      this.policyCache.set(policyName, { policy: DEFAULT_POLICY, fetchedAt: Date.now() });
+      return DEFAULT_POLICY;
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  invalidateCache() {
+    this.policyCache.clear();
+  }
+};
+
+// src/SessionTracker.ts
+var SessionTracker = class {
+  sessions = /* @__PURE__ */ new Map();
+  addTurn(sessionId, turn) {
+    const now = Date.now();
+    const existing = this.sessions.get(sessionId);
+    if (existing) {
+      existing.history.push(turn);
+      existing.lastActivityAt = now;
+      return;
+    }
+    this.sessions.set(sessionId, {
+      history: [turn],
+      createdAt: now,
+      lastActivityAt: now
+    });
+  }
+  getHistory(sessionId) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return [];
+    return state.history.slice();
+  }
+  getToolCallSequence(sessionId) {
+    const state = this.sessions.get(sessionId);
+    if (!state) return [];
+    const out = [];
+    for (const turn of state.history) {
+      for (const call of turn.toolCalls ?? []) {
+        if (call?.name) out.push(call.name);
+      }
+    }
+    return out;
+  }
+  clearSession(sessionId) {
+    this.sessions.delete(sessionId);
+  }
+  getSessionCount() {
+    return this.sessions.size;
+  }
+  pruneOldSessions(maxAgeMs = 36e5) {
+    const cutoff = Date.now() - maxAgeMs;
+    for (const [id, state] of this.sessions) {
+      if (state.lastActivityAt < cutoff) {
+        this.sessions.delete(id);
+      }
+    }
+  }
+};
+
+// src/MastGuardShield.ts
+function extractResponseText(response) {
+  if (typeof response === "string") return response;
+  if (response && typeof response === "object") {
+    const r = response;
+    if (Array.isArray(r["choices"]) && r["choices"].length > 0) {
+      const choice = r["choices"][0];
+      const msg = choice["message"];
+      if (typeof msg?.["content"] === "string") return msg["content"];
+    }
+    if (Array.isArray(r["content"]) && r["content"].length > 0) {
+      const block = r["content"][0];
+      if (typeof block["text"] === "string") return block["text"];
+    }
+  }
+  return "";
+}
+var MastGuardShield = class {
+  config;
+  sessionTracker;
+  policyEngine;
+  auditLogger;
+  constructor(config) {
+    this.config = {
+      apiKey: config.apiKey,
+      organizationId: config.organizationId,
+      agentId: config.agentId,
+      policy: config.policy ?? "default",
+      mode: config.mode ?? "monitor",
+      apiBaseUrl: config.apiBaseUrl ?? "https://api.mastguard.io",
+      timeoutMs: config.timeoutMs ?? 5e3
+    };
+    this.sessionTracker = new SessionTracker();
+    this.policyEngine = new PolicyEngine(this.config);
+    this.auditLogger = new AuditLogger(this.config);
+  }
+  async protect(llmCall, options) {
+    const startMs = Date.now();
+    const sessionHistory = this.sessionTracker.getHistory(options.sessionId);
+    const llmResponse = await llmCall;
+    const responseText = extractResponseText(llmResponse);
+    let evaluation;
+    try {
+      evaluation = await this.policyEngine.evaluate(
+        {
+          prompt: "",
+          response: responseText,
+          toolCalls: options.toolCalls ?? [],
+          toolOutputs: options.toolOutputs ?? [],
+          sessionHistory,
+          allowedTools: [],
+          // populated from agent_registrations in v0.2.0
+          tokenCount: options.tokenCount ?? 0
+        },
+        this.config.policy
+      );
+    } catch (sdkErr) {
+      console.error("[MastGuard] PolicyEngine error:", sdkErr);
+      if (this.config.mode === "block") throw sdkErr;
+      return { data: llmResponse, allowed: true, violations: [] };
+    }
+    this.sessionTracker.addTurn(options.sessionId, {
+      role: "assistant",
+      content: responseText,
+      ...options.toolCalls ? { toolCalls: options.toolCalls } : {}
+    });
+    const durationMs = Date.now() - startMs;
+    void this.auditLogger.ingest({
+      session_id: options.sessionId,
+      agent_id: this.config.agentId,
+      org_id: this.config.organizationId,
+      policy_id: null,
+      event_type: evaluation.violations.length > 0 ? evaluation.violations[0]?.category ?? "normal" : "normal",
+      prompt: "",
+      response: responseText.length ? responseText : null,
+      tool_calls: (options.toolCalls ?? []).map((tc) => ({
+        name: tc.name,
+        ...tc.parameters !== void 0 ? { parameters: tc.parameters } : {}
+      })),
+      tool_outputs: options.toolOutputs ?? [],
+      session_history: sessionHistory.map((t) => ({ role: t.role, content: t.content })),
+      token_count: options.tokenCount ?? 0,
+      duration_ms: durationMs
+    });
+    if (this.config.mode === "block" && !evaluation.allow) {
+      return {
+        data: null,
+        allowed: false,
+        violations: evaluation.violations
+      };
+    }
+    return {
+      data: llmResponse,
+      allowed: evaluation.allow,
+      violations: evaluation.violations
+    };
+  }
+  clearSession(sessionId) {
+    this.sessionTracker.clearSession(sessionId);
+  }
+  invalidatePolicyCache() {
+    this.policyEngine.invalidateCache();
+  }
+};
+export {
+  AuditLogger,
+  MastGuardShield,
+  PolicyEngine,
+  SessionTracker,
+  ThreatDetector
+};