@axiorank/ai-sdk 0.1.0

package/dist/index.cjs

@@ -0,0 +1,1457 @@
+'use strict';
+
+// src/extract.ts
+function extractPromptText(prompt) {
+  const out = [];
+  for (const message of prompt) {
+    if (typeof message.content === "string") {
+      out.push(message.content);
+      continue;
+    }
+    for (const part of message.content) {
+      if (part.type === "text") out.push(part.text);
+    }
+  }
+  return out.join("\n");
+}
+function extractCompletionText(content) {
+  return content.flatMap((part) => part.type === "text" ? [part.text] : []).join("");
+}
+function extractToolCalls(content) {
+  return content.filter(
+    (part) => part.type === "tool-call"
+  );
+}
+function parseToolInput(input) {
+  try {
+    const parsed = JSON.parse(input);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+    return { input: parsed };
+  } catch {
+    return { input };
+  }
+}
+
+// ../sdk/dist/chunk-I4IYZBCH.js
+var LIMITS = {
+  /** Max object/array nesting inspected before passing values through. */
+  maxDepth: 8,
+  /** Max number of string leaves inspected. */
+  maxLeaves: 2e3,
+  /** Max total bytes of string content inspected. */
+  maxTotalBytes: 256 * 1024,
+  /** Per-leaf: only the first N chars are scanned by detectors. */
+  maxLeafScan: 64 * 1024,
+  /** Max signals retained per evaluation (bounds the stored array). */
+  maxSignals: 50
+};
+function transformStrings(value, fn, state, path = "", depth = 0) {
+  if (typeof value === "string") {
+    if (state.leaves >= LIMITS.maxLeaves || state.bytes >= LIMITS.maxTotalBytes) {
+      state.truncated = true;
+      return value;
+    }
+    state.leaves += 1;
+    state.bytes += value.length;
+    return fn(path, value, state);
+  }
+  if (Array.isArray(value)) {
+    if (depth >= LIMITS.maxDepth) {
+      state.truncated = true;
+      return value;
+    }
+    return value.map(
+      (item, i) => transformStrings(item, fn, state, `${path}[${i}]`, depth + 1)
+    );
+  }
+  if (value !== null && typeof value === "object") {
+    if (depth >= LIMITS.maxDepth) {
+      state.truncated = true;
+      return value;
+    }
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+      const childPath = path ? `${path}.${key}` : key;
+      out[key] = transformStrings(child, fn, state, childPath, depth + 1);
+    }
+    return out;
+  }
+  return value;
+}
+var INVISIBLES = /[\u00AD\u034F\u200B-\u200F\u202A-\u202E\u2060-\u2064\u206A-\u206F\uFEFF]/g;
+var CONFUSABLES = {
+  // Cyrillic lowercase
+  \u0430: "a",
+  \u0435: "e",
+  \u043E: "o",
+  \u0440: "p",
+  \u0441: "c",
+  \u0443: "y",
+  \u0445: "x",
+  \u0456: "i",
+  \u0458: "j",
+  \u0455: "s",
+  "\u0501": "d",
+  // Cyrillic uppercase
+  \u0410: "A",
+  \u0412: "B",
+  \u0415: "E",
+  \u041A: "K",
+  \u041C: "M",
+  \u041D: "H",
+  \u041E: "O",
+  \u0420: "P",
+  \u0421: "C",
+  \u0422: "T",
+  \u0423: "Y",
+  \u0425: "X",
+  // Greek lowercase
+  \u03B1: "a",
+  \u03B9: "i",
+  \u03BD: "v",
+  \u03BF: "o",
+  \u03C1: "p",
+  \u03C5: "u",
+  // Greek uppercase
+  \u0391: "A",
+  \u0392: "B",
+  \u0395: "E",
+  \u0396: "Z",
+  \u0397: "H",
+  \u0399: "I",
+  \u039A: "K",
+  \u039C: "M",
+  \u039D: "N",
+  \u039F: "O",
+  \u03A1: "P",
+  \u03A4: "T",
+  \u03A5: "Y",
+  \u03A7: "X"
+};
+var CONFUSABLE_RE = new RegExp(`[${Object.keys(CONFUSABLES).join("")}]`, "g");
+function canonicalize(value) {
+  return value.normalize("NFKC").replace(INVISIBLES, "").replace(CONFUSABLE_RE, (ch) => CONFUSABLES[ch] ?? ch);
+}
+function makeCanonicalVariantScanner() {
+  return (value) => {
+    const text = value.length > LIMITS.maxLeafScan ? value.slice(0, LIMITS.maxLeafScan) : value;
+    const canonical = canonicalize(text);
+    return canonical !== text ? [{ kind: "canonical", value: canonical }] : [];
+  };
+}
+function fnv1a(value) {
+  let h = 2166136261;
+  for (let i = 0; i < value.length; i++) {
+    h ^= value.charCodeAt(i);
+    h = Math.imul(h, 16777619);
+  }
+  return (h >>> 0).toString(16).padStart(8, "0");
+}
+function cosmeticFingerprint(value) {
+  return `redacted \xB7 sha256:${fnv1a(value)}`;
+}
+function maskMiddle(value, keep = 2) {
+  if (value.length <= keep * 2) return "\u2022".repeat(value.length);
+  const head = value.slice(0, keep);
+  const tail = keep > 0 ? value.slice(-keep) : "";
+  const middle = "\u2022".repeat(Math.max(3, value.length - keep * 2));
+  return `${head}${middle}${tail}`;
+}
+function truncateEvidence(value, max = 80) {
+  const oneLine = value.replace(/\s+/g, " ").trim();
+  return oneLine.length > max ? `${oneLine.slice(0, max)}\u2026` : oneLine;
+}
+function applyRedactions(value, spans) {
+  if (spans.length === 0) return value;
+  const sorted = [...spans].sort((a, b) => a.start - b.start);
+  const merged = [];
+  for (const span of sorted) {
+    const last = merged[merged.length - 1];
+    if (last && span.start <= last.end) {
+      last.end = Math.max(last.end, span.end);
+    } else {
+      merged.push({ ...span });
+    }
+  }
+  let out = value;
+  for (let i = merged.length - 1; i >= 0; i--) {
+    const s = merged[i];
+    out = out.slice(0, s.start) + s.mask + out.slice(s.end);
+  }
+  return out;
+}
+function withFlags(re, required) {
+  let flags = re.flags;
+  for (const f of required) if (!flags.includes(f)) flags += f;
+  return flags === re.flags ? re : new RegExp(re.source, flags);
+}
+function scanSecrets(value, specs, fingerprint = cosmeticFingerprint) {
+  const matches = [];
+  for (const spec of specs) {
+    const re = withFlags(spec.regex, "gd");
+    for (const m of value.matchAll(re)) {
+      const group = spec.group ?? 0;
+      const secret = m[group];
+      const span = m.indices?.[group];
+      if (!secret || !span) continue;
+      matches.push({
+        detector: spec.id,
+        category: "secret",
+        severity: spec.severity,
+        label: spec.label,
+        evidence: fingerprint(secret),
+        ...spec.critical ? { critical: true } : {},
+        redact: { start: span[0], end: span[1], mask: `\u2039redacted:${spec.id}\u203A` }
+      });
+    }
+  }
+  return matches;
+}
+function scanFindings(value, category, specs) {
+  const matches = [];
+  for (const spec of specs) {
+    const re = withFlags(spec.regex, "g");
+    for (const m of value.matchAll(re)) {
+      const whole = m[0];
+      if (!whole) continue;
+      matches.push({
+        detector: spec.id,
+        category,
+        severity: spec.severity,
+        label: spec.label,
+        evidence: (spec.evidence ?? truncateEvidence)(whole),
+        ...spec.critical ? { critical: true } : {}
+      });
+    }
+  }
+  return matches;
+}
+var ABUSE_PATTERNS = [
+  {
+    id: "rate_abuse.path_probe",
+    label: "Sensitive path probe",
+    severity: "high",
+    regex: /(?:^|\/)(?:\.env\b|\.git(?:\/|\b)|\.aws(?:\/|\b)|\.ssh(?:\/|\b)|id_rsa\b|wp-login\.php|wp-admin\b|xmlrpc\.php|phpmyadmin\b|actuator\/env|server-status\b)/i
+  },
+  {
+    id: "rate_abuse.enumeration",
+    label: "Deep pagination / enumeration",
+    severity: "medium",
+    regex: /(?:^|[?&])(?:page|offset|start|p)=\d{4,}/i
+  },
+  {
+    id: "rate_abuse.bulk_limit",
+    label: "Oversized result window",
+    severity: "medium",
+    regex: /(?:^|[?&])(?:limit|per_page|page_size|count|size)=(?:[1-9]\d{3,})/i
+  },
+  {
+    id: "rate_abuse.graphql_introspection",
+    label: "GraphQL introspection",
+    severity: "medium",
+    regex: /\b__schema\b|\bIntrospectionQuery\b/
+  },
+  {
+    id: "rate_abuse.wildcard_fields",
+    label: "Wildcard field selection",
+    severity: "low",
+    regex: /(?:^|[?&])(?:fields|select|include)=\*/i
+  },
+  {
+    id: "rate_abuse.automation_client",
+    label: "Automation / scraper client",
+    severity: "low",
+    regex: /\b(?:python-requests|aiohttp|httpx|scrapy|go-http-client|node-fetch|okhttp|libwww-perl|wget|curl\/[\d.]+|headlesschrome|phantomjs|puppeteer|playwright)\b/i
+  }
+];
+var abuseDetector = {
+  id: "rate_abuse",
+  category: "rate_abuse",
+  inspect(ctx) {
+    return scanFindings(ctx.value, "rate_abuse", ABUSE_PATTERNS);
+  }
+};
+var CARD_PATTERNS = [
+  {
+    id: "supply_chain.code_execution",
+    label: "Code-execution capability",
+    severity: "high",
+    regex: /\b(?:exec|execute|eval|spawn|shell|sudo|run command|os command|terminal)\b/i
+  },
+  {
+    id: "supply_chain.fund_movement",
+    label: "Payment / fund-movement capability",
+    severity: "high",
+    regex: /\b(?:payment|transfer|wire|payout|withdraw|charge|refund|disburse)\b/i
+  },
+  {
+    id: "supply_chain.credential_access",
+    label: "Credential / secret access capability",
+    severity: "high",
+    regex: /\b(?:credential|secret|password|api key|private key|ssh key|access token)\b/i
+  },
+  {
+    id: "supply_chain.admin_reach",
+    label: "Administrative capability",
+    severity: "medium",
+    regex: /\b(?:admin|administrator|superuser|impersonate|grant role)\b/i
+  },
+  {
+    id: "supply_chain.wildcard_scope",
+    label: "Wildcard scope / permission",
+    severity: "medium",
+    regex: /\b(?:read|write|admin|scope|access|permissions?)\s\*|(?:^|\s)\*(?:\s|$)/i
+  }
+];
+function normalize(value) {
+  return value.replace(/([a-z])([A-Z])/g, "$1 $2").replace(/[_\-./:]+/g, " ");
+}
+var cardCapabilityDetector = {
+  id: "supply_chain.capability",
+  category: "supply_chain",
+  inspect(ctx) {
+    return scanFindings(normalize(ctx.value), "supply_chain", CARD_PATTERNS);
+  }
+};
+var RM_RF = /\brm\s+-[a-zA-Z]*[rf][a-zA-Z]*\b/g;
+var SQL_DROP = /\b(?:drop|truncate)\s+(?:table|database|schema|index|view)\b/gi;
+var SQL_MUTATE = /\b(?:delete\s+from|update)\s+["'`\w.]+/gi;
+var RESOURCE_DELETE = /\b(?:delete|destroy|terminate|remove|teardown)[-_\s]?(?:bucket|instance|volume|database|cluster|stack|deployment|namespace|table|repo(?:sitory)?)\b/gi;
+var FORCE_PUSH = /\bgit\s+push\b[\s\S]{0,30}?(?:--force\b|--force-with-lease\b|\s-f\b)/gi;
+var DANGEROUS_FLAG = /(?:^|\s)(?:--all|--recursive|--no-preserve-root|--force)\b/gi;
+function mk(detector, label, severity, match) {
+  return {
+    detector,
+    category: "destructive",
+    severity,
+    label,
+    evidence: truncateEvidence(match)
+  };
+}
+var destructiveDetector = {
+  id: "destructive",
+  category: "destructive",
+  inspect(ctx) {
+    const v = ctx.value;
+    const out = [];
+    for (const m of v.matchAll(RM_RF)) {
+      out.push(mk("destructive.rm_rf", "Recursive/forced file delete", "high", m[0]));
+    }
+    for (const m of v.matchAll(SQL_DROP)) {
+      out.push(mk("destructive.sql_drop", "SQL DROP/TRUNCATE", "high", m[0]));
+    }
+    for (const m of v.matchAll(SQL_MUTATE)) {
+      const start = m.index ?? 0;
+      if (!/\bwhere\b/i.test(v.slice(start, start + 160))) {
+        out.push(
+          mk("destructive.sql_no_where", "SQL DELETE/UPDATE without WHERE", "high", m[0])
+        );
+      }
+    }
+    for (const m of v.matchAll(RESOURCE_DELETE)) {
+      out.push(mk("destructive.resource_delete", "Resource destruction", "high", m[0]));
+    }
+    for (const m of v.matchAll(FORCE_PUSH)) {
+      out.push(mk("destructive.force_push", "Git force push", "medium", m[0]));
+    }
+    for (const m of v.matchAll(DANGEROUS_FLAG)) {
+      out.push(mk("destructive.dangerous_flag", "Dangerous CLI flag", "low", m[0]));
+    }
+    return out;
+  }
+};
+var SELECT_STAR = /\bselect\s+\*\s+from\b/gi;
+var BULK_EXPORT = /\b(?:export|dump|download|scrape)\s+(?:all|everything|\*|database|table|users|customers|records)\b/gi;
+var LARGE_VALUE = 2e4;
+var egressDetector = {
+  id: "egress",
+  category: "egress",
+  inspect(ctx) {
+    const v = ctx.value;
+    const out = [];
+    for (const m of v.matchAll(SELECT_STAR)) {
+      out.push({
+        detector: "egress.select_star",
+        category: "egress",
+        severity: "medium",
+        label: "Unbounded SELECT *",
+        evidence: truncateEvidence(m[0])
+      });
+    }
+    for (const m of v.matchAll(BULK_EXPORT)) {
+      out.push({
+        detector: "egress.bulk_export",
+        category: "egress",
+        severity: "high",
+        label: "Bulk data export",
+        evidence: truncateEvidence(m[0])
+      });
+    }
+    if (v.length >= LARGE_VALUE) {
+      out.push({
+        detector: "egress.large_value",
+        category: "egress",
+        severity: "low",
+        label: "Large field value",
+        evidence: `${v.length.toLocaleString("en-US")} chars`
+      });
+    }
+    return out;
+  }
+};
+var SPECS = [
+  {
+    id: "injection.prompt",
+    label: "Prompt injection",
+    severity: "high",
+    regex: /\b(?:ignore|disregard|forget|override)\b[\s\S]{0,40}?\b(?:previous|prior|above|earlier|all|your)\b[\s\S]{0,20}?\b(?:instructions?|prompts?|rules?|guidelines?|context|directives?)\b/gi
+  },
+  {
+    id: "injection.system_override",
+    label: "System-prompt override",
+    severity: "high",
+    regex: /\b(?:you\s+are\s+now|act\s+as(?:\s+if)?|pretend\s+to\s+be|new\s+system\s+prompt|developer\s+mode|jailbreak)\b/gi
+  },
+  {
+    id: "injection.sql",
+    label: "SQL injection",
+    severity: "high",
+    regex: /(?:'|%27)\s*(?:or|and)\s*(?:'|%27|\d)|\bunion\s+select\b|\bor\s+1\s*=\s*1\b|;\s*drop\s+table\b/gi
+  },
+  {
+    id: "injection.shell",
+    label: "Shell/command injection",
+    severity: "high",
+    regex: /[;&|]\s*(?:rm|cat|curl|wget|nc|bash|sh|chmod|chown|kill|mkfs|dd|eval)\b|\$\([^)]{0,120}\)|`[^`]{0,120}`/g
+  },
+  {
+    id: "injection.ssrf",
+    label: "SSRF / internal endpoint",
+    severity: "high",
+    regex: /\b(?:169\.254\.169\.254|metadata\.google\.internal|127\.0\.0\.1|0\.0\.0\.0)\b|\bfile:\/\/|\bgopher:\/\//gi
+  },
+  {
+    id: "injection.path_traversal",
+    label: "Path traversal",
+    severity: "medium",
+    regex: /(?:\.\.[/\\]){2,}|\/etc\/(?:passwd|shadow)\b|c:\\windows\\system32/gi
+  }
+];
+var injectionDetector = {
+  id: "injection",
+  category: "injection",
+  inspect: (ctx) => scanFindings(ctx.value, "injection", SPECS)
+};
+var SPECS2 = [
+  {
+    id: "injection.jailbreak.dan",
+    label: "DAN-style jailbreak",
+    severity: "high",
+    regex: /\bDAN\b|\bdo\s+anything\s+now\b|\bstay\s+in\s+character\b/gi
+  },
+  {
+    id: "injection.jailbreak.no_restrictions",
+    label: "No-restrictions jailbreak",
+    severity: "high",
+    regex: /\b(?:unrestricted|unfiltered|uncensored|jailbroken|no\s+longer\s+bound)\b|\b(?:no|without|free\s+(?:from|of))\s+(?:restrictions?|rules?|filters?|limitations?|guidelines?|guardrails?|censorship|safety\s+(?:rules|guidelines))\b/gi
+  },
+  {
+    id: "injection.jailbreak.policy_override",
+    label: "Safety-policy override",
+    severity: "high",
+    regex: /\b(?:ignore|bypass|disable|turn\s+off|switch\s+off|forget)\b[\s\S]{0,30}?\b(?:safety|content\s+(?:policy|filter)|moderation|guardrails?|ethical\s+guidelines?|restrictions?)\b/gi
+  },
+  {
+    id: "injection.jailbreak.roleplay_escape",
+    label: "Roleplay-escape jailbreak",
+    severity: "medium",
+    regex: /\b(?:hypothetically|in\s+a\s+(?:fictional|hypothetical)\s+(?:story|scenario|world)|for\s+(?:educational|research)\s+purposes\s+only)\b[\s\S]{0,60}?\b(?:no\s+rules|without\s+restrictions?|anything|illegal|harmful)\b/gi
+  },
+  {
+    id: "injection.jailbreak.persona",
+    label: "Adversarial persona",
+    severity: "high",
+    regex: /\b(?:evil\s+(?:mode|assistant|confidant|ai)|opposite\s+day|do\s+not\s+(?:follow|obey)\s+(?:any\s+)?(?:rules?|policies|guidelines?)|you\s+have\s+no\s+(?:rules?|restrictions?|guidelines?|filters?))\b/gi
+  }
+];
+var jailbreakDetector = {
+  id: "jailbreak",
+  category: "injection",
+  inspect: (ctx) => scanFindings(ctx.value, "injection", SPECS2)
+};
+var SPECS3 = [
+  {
+    id: "injection.tool_output_override",
+    label: "Instruction override in tool output",
+    severity: "high",
+    // Three shapes aimed at hijacking the agent from inside untrusted content:
+    // classic "ignore previous instructions", a re-tasking ("your new task
+    // is…"), and a secrecy directive ("do not tell the user…").
+    regex: /\b(?:ignore|disregard|forget|override)\b[\s\S]{0,40}?\b(?:previous|prior|above|earlier|all|the)\b[\s\S]{0,20}?\b(?:instructions?|prompts?|rules?|context|messages?|directives?)\b|\byour\s+(?:new\s+|real\s+|actual\s+)?(?:task|instruction|goal|objective|job)\s+is\b|\bdo\s+not\s+(?:tell|inform|reveal\s+to|mention\s+to|notify)\s+(?:the\s+)?(?:user|human|operator)\b/gi
+  },
+  {
+    id: "injection.exfil_markdown",
+    label: "Data-exfiltration markdown link or image",
+    severity: "high",
+    // A markdown image/link whose URL carries query data or a template
+    // placeholder - the classic "render this image to leak the conversation"
+    // vector. A plain link with no params is not flagged (too noisy).
+    regex: /!?\[[^\]]*\]\(\s*(?:https?:)?\/\/[^)\s]*(?:\?[^)\s]+|\{\{[^)\s]*\}\}|\$\{[^)\s]*\})[^)\s]*\)/gi
+  },
+  {
+    id: "injection.tool_directive",
+    label: "Embedded tool-call directive",
+    severity: "high",
+    // Content instructing the agent to invoke a tool/function, or a fake
+    // function-call object smuggled into prose.
+    regex: /\b(?:call|invoke|use|run|execute|trigger)\s+(?:the\s+)?[`"']?[\w.\-]{2,}[`"']?\s+(?:tool|function|command|endpoint|api)\b|"(?:tool_name|tool_call|function_call|function)"\s*:/gi
+  },
+  {
+    id: "injection.role_marker",
+    label: "Fake role or chat marker in content",
+    severity: "medium",
+    // Chat-template / role markers embedded in untrusted text to forge a new
+    // turn or a system message.
+    regex: /<\|im_(?:start|end)\|>|<\/?(?:system|assistant)\b[^>]*>|\[\/?INST\]|\[\/?SYS\]|(?:^|\n)\s{0,3}#{1,3}\s*system\s*:/gi
+  },
+  {
+    id: "injection.encoded_payload",
+    label: "Suspicious encoded blob",
+    severity: "medium",
+    // A long contiguous base64 run embedded in otherwise-readable content - a
+    // common way to hide instructions from prose-level detectors. Kept long to
+    // avoid flagging short ids/hashes; medium severity, monitor-first.
+    regex: /[A-Za-z0-9+/]{200,}={0,2}/g
+  }
+];
+var HIDDEN_UNICODE = /[\u{200B}-\u{200D}\u{2060}\u{FEFF}\u{202A}-\u{202E}\u{2066}-\u{2069}\u{E0000}-\u{E007F}]/gu;
+var outputInjectionDetector = {
+  id: "injection.output",
+  category: "injection",
+  inspect(ctx) {
+    if (ctx.phase !== "result") return [];
+    const matches = scanFindings(ctx.value, "injection", SPECS3);
+    const hidden = ctx.value.match(HIDDEN_UNICODE);
+    if (hidden) {
+      matches.push({
+        detector: "injection.hidden_unicode",
+        category: "injection",
+        severity: "high",
+        label: "Hidden unicode smuggling",
+        evidence: `${hidden.length} hidden/bidirectional character${hidden.length === 1 ? "" : "s"} in output`
+      });
+    }
+    return matches;
+  }
+};
+var PII_MASK = {
+  "pii.email": "\u2039redacted:pii.email\u203A",
+  "pii.ssn": "\u2039redacted:pii.ssn\u203A",
+  "pii.phone": "\u2039redacted:pii.phone\u203A",
+  "pii.credit_card": "\u2039redacted:pii.card\u203A"
+};
+function piiRedact(enabled, detector, index, length) {
+  if (!enabled) return void 0;
+  return { start: index, end: index + length, mask: PII_MASK[detector] };
+}
+var EMAIL = /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g;
+var SSN = /\b(?!000|666|9\d\d)\d{3}-(?!00)\d{2}-(?!0000)\d{4}\b/g;
+var PHONE = /\b(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/g;
+var CARD = /\b(?:\d[ -]?){13,19}\b/g;
+function luhnValid(digits) {
+  let sum = 0;
+  let alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (d < 0 || d > 9) return false;
+    if (alt) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+var piiDetector = {
+  id: "pii",
+  category: "pii",
+  inspect(ctx) {
+    const v = ctx.value;
+    const out = [];
+    for (const m of v.matchAll(EMAIL)) {
+      out.push({
+        detector: "pii.email",
+        category: "pii",
+        severity: "medium",
+        label: "Email address",
+        evidence: maskMiddle(m[0]),
+        redact: piiRedact(ctx.redactPii, "pii.email", m.index, m[0].length)
+      });
+    }
+    for (const m of v.matchAll(SSN)) {
+      out.push({
+        detector: "pii.ssn",
+        category: "pii",
+        severity: "high",
+        label: "US Social Security Number",
+        evidence: maskMiddle(m[0], 0),
+        redact: piiRedact(ctx.redactPii, "pii.ssn", m.index, m[0].length)
+      });
+    }
+    for (const m of v.matchAll(PHONE)) {
+      out.push({
+        detector: "pii.phone",
+        category: "pii",
+        severity: "low",
+        label: "Phone number",
+        evidence: maskMiddle(m[0]),
+        redact: piiRedact(ctx.redactPii, "pii.phone", m.index, m[0].length)
+      });
+    }
+    for (const m of v.matchAll(CARD)) {
+      const digits = m[0].replace(/[ -]/g, "");
+      if (digits.length >= 13 && digits.length <= 19 && luhnValid(digits)) {
+        out.push({
+          detector: "pii.credit_card",
+          category: "pii",
+          severity: "high",
+          critical: true,
+          label: "Credit card number",
+          evidence: maskMiddle(digits, 0),
+          redact: piiRedact(ctx.redactPii, "pii.credit_card", m.index, m[0].length)
+        });
+      }
+    }
+    return out;
+  }
+};
+var SECRET_PATTERNS = [
+  {
+    id: "secret.aws_access_key",
+    label: "AWS access key id",
+    severity: "critical",
+    critical: true,
+    regex: /\b(?:AKIA|ASIA|AGPA|AIDA|AROA)[0-9A-Z]{16}\b/
+  },
+  {
+    id: "secret.aws_secret_key",
+    label: "AWS secret access key",
+    severity: "critical",
+    critical: true,
+    regex: /aws.{0,24}?(?:secret|private).{0,24}?["'=:\s]([A-Za-z0-9/+]{40})\b/i,
+    group: 1
+  },
+  {
+    id: "secret.github_token",
+    label: "GitHub token",
+    severity: "critical",
+    critical: true,
+    regex: /\bgh[posru]_[A-Za-z0-9]{36,}\b/
+  },
+  {
+    id: "secret.github_pat",
+    label: "GitHub fine-grained PAT",
+    severity: "critical",
+    critical: true,
+    regex: /\bgithub_pat_[A-Za-z0-9_]{22,}\b/
+  },
+  {
+    id: "secret.slack_token",
+    label: "Slack token",
+    severity: "critical",
+    critical: true,
+    regex: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/
+  },
+  {
+    id: "secret.google_api_key",
+    label: "Google API key",
+    severity: "high",
+    regex: /\bAIza[0-9A-Za-z_-]{35}\b/
+  },
+  {
+    id: "secret.llm_key",
+    label: "LLM provider API key",
+    severity: "critical",
+    critical: true,
+    regex: /\bsk-(?:ant-|proj-|live-)?[A-Za-z0-9_-]{20,}\b/
+  },
+  {
+    id: "secret.stripe_key",
+    label: "Stripe live key",
+    severity: "critical",
+    critical: true,
+    regex: /\b[sr]k_live_[A-Za-z0-9]{16,}\b/
+  },
+  {
+    id: "secret.private_key",
+    label: "Private key (PEM)",
+    severity: "critical",
+    critical: true,
+    regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----/
+  },
+  {
+    id: "secret.jwt",
+    label: "JSON Web Token",
+    severity: "high",
+    regex: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\b/
+  },
+  {
+    id: "secret.bearer",
+    label: "Bearer token",
+    severity: "high",
+    regex: /\bbearer\s+([A-Za-z0-9._-]{16,})\b/i,
+    group: 1
+  },
+  {
+    id: "secret.assignment",
+    label: "Hardcoded credential",
+    severity: "medium",
+    regex: /(?:password|passwd|pwd|secret|api[_-]?key|access[_-]?token|auth[_-]?token)["']?\s*[:=]\s*["']?([^\s"']{8,})/i,
+    group: 1
+  }
+];
+var secretsDetector = {
+  id: "secrets",
+  category: "secret",
+  // `ctx.fingerprint` is injected by the engine (salted SHA-256 on the server,
+  // a cosmetic hash in the universal build); scanSecrets falls back to the
+  // cosmetic default when it is unset.
+  inspect: (ctx) => scanSecrets(ctx.value, SECRET_PATTERNS, ctx.fingerprint)
+};
+var DETECTORS = [
+  secretsDetector,
+  piiDetector,
+  destructiveDetector,
+  injectionDetector,
+  jailbreakDetector,
+  outputInjectionDetector,
+  egressDetector
+];
+[...DETECTORS, abuseDetector];
+[...DETECTORS, cardCapabilityDetector];
+var SEVERITY_POINTS = {
+  low: 8,
+  medium: 18,
+  high: 35,
+  critical: 55
+};
+var DECAY = 0.6;
+var CRITICAL_FLOOR = 90;
+function clamp(n, min, max) {
+  return Math.min(max, Math.max(min, n));
+}
+function pointsFor(severity) {
+  return SEVERITY_POINTS[severity];
+}
+function combine(base, signals) {
+  const points = signals.map((s) => s.points).sort((a, b2) => b2 - a);
+  const contribution = Math.min(
+    points.reduce((acc, p, i) => acc + p * DECAY ** i, 0),
+    100
+  );
+  const b = clamp(base, 0, 100) / 100;
+  let final = 100 * (1 - (1 - b) * (1 - contribution / 100));
+  if (signals.some((s) => s.critical)) {
+    final = Math.max(final, CRITICAL_FLOOR);
+  }
+  return clamp(Math.round(final), 0, 100);
+}
+var RISK_MAP = {
+  "github.read": 10,
+  "github.push": 40,
+  "gmail.send": 80,
+  "slack.post": 50,
+  "aws.delete": 100,
+  "db.query": 70,
+  // Inbound HTTP methods (the verify path scores requests as `inbound.<method>`).
+  // Reads are cheap; writes/deletes warrant a higher prior.
+  "inbound.get": 10,
+  "inbound.head": 5,
+  "inbound.options": 5,
+  "inbound.post": 35,
+  "inbound.put": 40,
+  "inbound.patch": 40,
+  "inbound.delete": 60
+};
+var RISK_PREFIX_MAP = {
+  "aws.": 90,
+  "github.": 30,
+  "gmail.": 70,
+  "inbound.": 25
+};
+var DEFAULT_RISK = 50;
+function calculateRisk(toolName) {
+  const tool = toolName.trim().toLowerCase();
+  const exact = RISK_MAP[tool];
+  if (exact !== void 0) return exact;
+  let best = null;
+  let bestLen = -1;
+  for (const [prefix, score] of Object.entries(RISK_PREFIX_MAP)) {
+    if (tool.startsWith(prefix) && prefix.length > bestLen) {
+      best = score;
+      bestLen = prefix.length;
+    }
+  }
+  return best ?? DEFAULT_RISK;
+}
+var TOOL_NAME_LOCATION = "(tool_name)";
+var PAYLOAD_LOCATION = "(payload)";
+var ENCODED_SECRET_MASK = "\u2039redacted:obfuscation.encoded_secret\u203A";
+var UNIVERSAL_DEPS = {
+  fingerprint: cosmeticFingerprint,
+  makeVariantScanner: makeCanonicalVariantScanner
+};
+function runVariantDetectors(ctx, detectors, scanVariants) {
+  const signals = [];
+  const hitKinds = [];
+  let secretInVariant = false;
+  for (const variant of scanVariants(ctx.value)) {
+    const result = runDetectors(
+      { ...ctx, path: `${ctx.path} (${variant.kind})`, value: variant.value },
+      detectors
+    );
+    if (result.signals.length > 0) {
+      signals.push(...result.signals);
+      hitKinds.push(variant.kind);
+    }
+    if (result.redactions.length > 0) secretInVariant = true;
+  }
+  return { signals, secretInVariant, hitKinds };
+}
+function obfuscationSignal(location, hitKinds) {
+  return {
+    detector: "obfuscation.encoded_payload",
+    category: "injection",
+    severity: "medium",
+    label: "Obfuscated content",
+    points: pointsFor("medium"),
+    location,
+    evidence: `signals surfaced only after ${[...new Set(hitKinds)].join(", ")}`
+  };
+}
+function runDetectors(ctx, detectors) {
+  const scanCtx = ctx.value.length > LIMITS.maxLeafScan ? { ...ctx, value: ctx.value.slice(0, LIMITS.maxLeafScan) } : ctx;
+  const signals = [];
+  const redactions = [];
+  for (const detector of detectors) {
+    for (const match of detector.inspect(scanCtx)) {
+      signals.push({
+        detector: match.detector,
+        category: match.category,
+        severity: match.severity,
+        label: match.label,
+        points: pointsFor(match.severity),
+        location: ctx.path,
+        evidence: match.evidence,
+        ...match.critical ? { critical: true } : {}
+      });
+      if (match.redact) redactions.push(match.redact);
+    }
+  }
+  return { signals, redactions };
+}
+var CATEGORY_ORDER = {
+  secret: 0,
+  bot_spoof: 1,
+  supply_chain: 2,
+  destructive: 3,
+  injection: 4,
+  rate_abuse: 5,
+  pii: 6,
+  egress: 7
+};
+function finalize(signals) {
+  const seen = /* @__PURE__ */ new Set();
+  const unique = [];
+  for (const s of signals) {
+    const key = `${s.detector}|${s.location}`;
+    if (seen.has(key)) continue;
+    seen.add(key);
+    unique.push(s);
+  }
+  unique.sort(
+    (a, b) => b.points - a.points || CATEGORY_ORDER[a.category] - CATEGORY_ORDER[b.category] || a.location.localeCompare(b.location)
+  );
+  return unique.slice(0, LIMITS.maxSignals);
+}
+function inspectContent(toolName, args, detectors = DETECTORS, phase = "request", deps = UNIVERSAL_DEPS) {
+  const normalizedTool = canonicalize(toolName).trim().toLowerCase();
+  const collected = [];
+  const state = { leaves: 0, bytes: 0, truncated: false };
+  const scanVariants = deps.makeVariantScanner();
+  collected.push(
+    ...runDetectors(
+      {
+        toolName: normalizedTool,
+        path: TOOL_NAME_LOCATION,
+        value: normalizedTool,
+        phase,
+        fingerprint: deps.fingerprint,
+        redactPii: deps.redactPii
+      },
+      detectors
+    ).signals
+  );
+  const redactedPayload = transformStrings(
+    args,
+    (path, value) => {
+      const ctx = {
+        toolName: normalizedTool,
+        path,
+        value,
+        phase,
+        fingerprint: deps.fingerprint,
+        redactPii: deps.redactPii
+      };
+      const { signals, redactions } = runDetectors(ctx, detectors);
+      collected.push(...signals);
+      const variants = runVariantDetectors(ctx, detectors, scanVariants);
+      if (variants.hitKinds.length > 0) {
+        collected.push(...variants.signals);
+        collected.push(obfuscationSignal(path, variants.hitKinds));
+      }
+      if (variants.secretInVariant) return ENCODED_SECRET_MASK;
+      return applyRedactions(value, redactions);
+    },
+    state
+  );
+  if (state.truncated) {
+    collected.push({
+      detector: "egress.oversized_payload",
+      category: "egress",
+      severity: "medium",
+      label: "Oversized payload",
+      points: pointsFor("medium"),
+      location: PAYLOAD_LOCATION,
+      evidence: "payload too large to fully inspect"
+    });
+  }
+  return { signals: finalize(collected), redactedPayload };
+}
+function scoreToolCall(toolName, args, detectors = DETECTORS, phase = "request", deps = UNIVERSAL_DEPS) {
+  const { signals, redactedPayload } = inspectContent(
+    toolName,
+    args,
+    detectors,
+    phase,
+    deps
+  );
+  const base = calculateRisk(canonicalize(toolName));
+  const score = combine(base, signals);
+  return { score, base, signals, redactedPayload };
+}
+var DEFAULT_DENY_RISK = 75;
+var DEFAULT_HOLD_RISK = 50;
+function localDecision(score, signals) {
+  if (signals.some((s) => s.category === "secret")) {
+    return {
+      decision: "deny",
+      reason: "A live secret was detected in the payload.",
+      rule: "deny-live-secret"
+    };
+  }
+  if (signals.some((s) => s.category === "destructive")) {
+    return {
+      decision: "deny",
+      reason: "A destructive operation was detected.",
+      rule: "deny-destructive"
+    };
+  }
+  if (score >= DEFAULT_DENY_RISK) {
+    return {
+      decision: "deny",
+      reason: `Risk score ${score} is at or above the ${DEFAULT_DENY_RISK} threshold.`,
+      rule: `risk>=${DEFAULT_DENY_RISK}`
+    };
+  }
+  if (score >= DEFAULT_HOLD_RISK && signals.length > 0) {
+    return {
+      decision: "hold",
+      reason: `Risk score ${score} is in the review band (${DEFAULT_HOLD_RISK} to ${DEFAULT_DENY_RISK - 1}). A human should approve this call.`,
+      rule: `risk>=${DEFAULT_HOLD_RISK}`
+    };
+  }
+  return {
+    decision: "allow",
+    reason: "No default policy rule matched.",
+    rule: null
+  };
+}
+function toPublicSignal(s) {
+  return {
+    detector: s.detector,
+    category: s.category,
+    severity: s.severity,
+    label: s.label,
+    location: s.location,
+    evidence: s.evidence
+  };
+}
+function inspect(tool, args = {}) {
+  const { score, signals, redactedPayload } = scoreToolCall(tool, args);
+  const verdict = localDecision(score, signals);
+  return {
+    decision: verdict.decision,
+    risk: score,
+    reason: verdict.reason,
+    signals: signals.map(toPublicSignal),
+    redactedPayload
+  };
+}
+function inspectPrompt(text) {
+  const { score, signals, redactedPayload } = scoreToolCall("model.prompt", {
+    prompt: text
+  });
+  const verdict = localDecision(score, signals);
+  return {
+    decision: verdict.decision,
+    risk: score,
+    reason: verdict.reason,
+    signals: signals.map(toPublicSignal),
+    redactedPayload
+  };
+}
+function inspectCompletion(text) {
+  const { score, signals, redactedPayload } = scoreToolCall(
+    "model.completion",
+    { completion: text },
+    void 0,
+    "result"
+  );
+  const verdict = localDecision(score, signals);
+  return {
+    decision: verdict.decision,
+    risk: score,
+    reason: verdict.reason,
+    signals: signals.map(toPublicSignal),
+    redactedPayload
+  };
+}
+
+// ../sdk/dist/chunk-KPEPLFMX.js
+var AxioRankError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AxioRankError";
+  }
+};
+var AxioRankDeniedError = class extends AxioRankError {
+  result;
+  constructor(result) {
+    super(`AxioRank denied tool call: ${result.reason}`);
+    this.name = "AxioRankDeniedError";
+    this.result = result;
+  }
+};
+
+// src/guard-result.ts
+var ZERO_USAGE = {
+  inputTokens: { total: 0, noCache: 0, cacheRead: 0, cacheWrite: 0 },
+  outputTokens: { total: 0, text: 0, reasoning: 0 }
+};
+function deniedError(verdict) {
+  const result = {
+    decision: "deny",
+    reason: verdict.reason,
+    risk: verdict.risk,
+    auditLogId: "",
+    signals: verdict.signals
+  };
+  return new AxioRankDeniedError(result);
+}
+function blockedGenerateResult(refusal) {
+  return {
+    content: [{ type: "text", text: refusal }],
+    finishReason: { unified: "content-filter", raw: void 0 },
+    usage: ZERO_USAGE,
+    warnings: []
+  };
+}
+function redactCompletionContent(content, redactedText) {
+  const out = [];
+  let replaced = false;
+  for (const part of content) {
+    if (part.type === "text") {
+      if (!replaced) {
+        out.push({ type: "text", text: redactedText });
+        replaced = true;
+      }
+      continue;
+    }
+    out.push(part);
+  }
+  if (!replaced) out.push({ type: "text", text: redactedText });
+  return out;
+}
+function blockCompletionContent(refusal) {
+  return [{ type: "text", text: refusal }];
+}
+function stripToolCalls(content, blockedIds, note) {
+  const out = content.filter(
+    (part) => !(part.type === "tool-call" && blockedIds.has(part.toolCallId))
+  );
+  if (note) out.push({ type: "text", text: note });
+  return out;
+}
+function refusalStream(refusal) {
+  const id = "axiorank-refusal";
+  return new ReadableStream({
+    start(controller) {
+      controller.enqueue({ type: "stream-start", warnings: [] });
+      controller.enqueue({ type: "text-start", id });
+      controller.enqueue({ type: "text-delta", id, delta: refusal });
+      controller.enqueue({ type: "text-end", id });
+      controller.enqueue({
+        type: "finish",
+        usage: ZERO_USAGE,
+        finishReason: { unified: "content-filter", raw: void 0 }
+      });
+      controller.close();
+    }
+  });
+}
+
+// src/inspect-client.ts
+function createInspector(opts) {
+  return opts.mode === "hosted" ? createHostedInspector(opts) : createLocalInspector();
+}
+function verdictFromLocal(phase, r) {
+  return {
+    phase,
+    decision: r.decision,
+    blocked: r.decision !== "allow",
+    reason: r.reason,
+    risk: r.risk,
+    signals: r.signals
+  };
+}
+function createLocalInspector() {
+  return {
+    async prompt(text) {
+      return verdictFromLocal("prompt", inspectPrompt(text));
+    },
+    async completion(text) {
+      return verdictFromLocal("completion", inspectCompletion(text));
+    },
+    async toolCall(tool, args) {
+      return verdictFromLocal("tool-call", inspect(tool, args));
+    }
+  };
+}
+function verdictFromHosted(phase, j) {
+  const decision = j.decision === "deny" ? "deny" : j.decision === "hold" ? "hold" : j.transform === "redact" ? "redact" : "allow";
+  return {
+    phase,
+    decision,
+    blocked: decision === "deny" || decision === "hold",
+    reason: j.reason ?? "",
+    risk: typeof j.risk === "number" ? j.risk : 0,
+    signals: j.signals ?? [],
+    redactedText: j.transform === "redact" ? j.redactedText ?? "" : void 0
+  };
+}
+function failVerdict(phase, opts, reason) {
+  const blocked = !opts.failOpen;
+  return {
+    phase,
+    decision: blocked ? "deny" : "allow",
+    blocked,
+    reason: `AxioRank ${reason} (${opts.failOpen ? "fail-open" : "fail-closed"})`,
+    risk: 0,
+    signals: []
+  };
+}
+function createHostedInspector(opts) {
+  const url = `${opts.baseUrl}/api/gateway/tool-call`;
+  const post = async (phase, body) => {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), opts.timeoutMs);
+    try {
+      const res = await opts.fetch(url, {
+        method: "POST",
+        headers: {
+          "content-type": "application/json",
+          authorization: `Bearer ${opts.apiKey}`
+        },
+        body: JSON.stringify(body),
+        signal: controller.signal
+      });
+      if (!res.ok) return failVerdict(phase, opts, `returned ${res.status}`);
+      const json = await res.json();
+      return verdictFromHosted(phase, json);
+    } catch {
+      return failVerdict(phase, opts, "was unreachable");
+    } finally {
+      clearTimeout(timer);
+    }
+  };
+  return {
+    prompt(text, meta) {
+      const model = meta.model ?? opts.model;
+      return post("prompt", {
+        tool: model ?? "model",
+        phase: "prompt",
+        promptText: text,
+        model,
+        traceId: meta.traceId,
+        source: "sdk"
+      });
+    },
+    completion(text, meta) {
+      const model = meta.model ?? opts.model;
+      return post("completion", {
+        tool: model ?? "model",
+        phase: "completion",
+        completionText: text,
+        model,
+        traceId: meta.traceId,
+        source: "sdk"
+      });
+    },
+    toolCall(tool, args, meta) {
+      return post("tool-call", {
+        tool,
+        arguments: args,
+        model: meta.model ?? opts.model,
+        traceId: meta.traceId,
+        source: "sdk"
+      });
+    }
+  };
+}
+
+// src/stream.ts
+async function guardStream(args, opts, inspector) {
+  const meta = { model: opts.model ?? args.model.modelId };
+  if (opts.inspectPrompts) {
+    const verdict = await inspector.prompt(
+      extractPromptText(args.params.prompt),
+      meta
+    );
+    opts.onDecision?.("prompt", verdict);
+    if (verdict.blocked) {
+      if (opts.onDeny === "throw") throw deniedError(verdict);
+      return { stream: refusalStream(opts.refusal) };
+    }
+  }
+  const result = await args.doStream();
+  const transform = opts.stream === "passthrough" ? passthroughGuard(opts, inspector, meta) : bufferGuard(opts, inspector, meta);
+  return { ...result, stream: result.stream.pipeThrough(transform) };
+}
+function collectText(parts) {
+  return parts.flatMap((part) => part.type === "text-delta" ? [part.delta] : []).join("");
+}
+function bufferGuard(opts, inspector, meta) {
+  const parts = [];
+  return new TransformStream({
+    transform(chunk) {
+      parts.push(chunk);
+    },
+    async flush(controller) {
+      let redactedText;
+      let blockCompletion = false;
+      if (opts.inspectCompletions) {
+        const text = collectText(parts);
+        if (text) {
+          const verdict = await inspector.completion(text, meta);
+          opts.onDecision?.("completion", verdict);
+          if (verdict.blocked) {
+            if (opts.onDeny === "throw") {
+              controller.error(deniedError(verdict));
+              return;
+            }
+            blockCompletion = true;
+          } else if (verdict.decision === "redact" && verdict.redactedText !== void 0) {
+            redactedText = verdict.redactedText;
+          }
+        }
+      }
+      const blockedIds = /* @__PURE__ */ new Set();
+      if (opts.inspectToolCalls) {
+        for (const part of parts) {
+          if (part.type !== "tool-call") continue;
+          const verdict = await inspector.toolCall(
+            part.toolName,
+            parseToolInput(part.input),
+            meta
+          );
+          opts.onDecision?.("tool-call", verdict);
+          if (verdict.blocked) {
+            if (opts.onDeny === "throw") {
+              controller.error(deniedError(verdict));
+              return;
+            }
+            blockedIds.add(part.toolCallId);
+          }
+        }
+      }
+      emitBuffered(
+        controller,
+        parts,
+        blockCompletion ? opts.refusal : redactedText,
+        blockedIds
+      );
+    }
+  });
+}
+function emitBuffered(controller, parts, finalText, blockedIds) {
+  let emittedText = false;
+  for (const part of parts) {
+    if (part.type === "text-start" || part.type === "text-delta" || part.type === "text-end") {
+      if (finalText === void 0) {
+        controller.enqueue(part);
+        continue;
+      }
+      if (!emittedText) {
+        const id = part.id;
+        controller.enqueue({ type: "text-start", id });
+        controller.enqueue({ type: "text-delta", id, delta: finalText });
+        controller.enqueue({ type: "text-end", id });
+        emittedText = true;
+      }
+      continue;
+    }
+    if (part.type === "tool-call" && blockedIds.has(part.toolCallId)) continue;
+    if ((part.type === "tool-input-start" || part.type === "tool-input-delta" || part.type === "tool-input-end") && blockedIds.has(part.id)) {
+      continue;
+    }
+    controller.enqueue(part);
+  }
+}
+function passthroughGuard(opts, inspector, meta) {
+  let text = "";
+  const toolCalls = [];
+  return new TransformStream({
+    transform(chunk, controller) {
+      controller.enqueue(chunk);
+      if (chunk.type === "text-delta") text += chunk.delta;
+      else if (chunk.type === "tool-call") {
+        toolCalls.push({
+          tool: chunk.toolName,
+          args: parseToolInput(chunk.input)
+        });
+      }
+    },
+    async flush(controller) {
+      if (opts.inspectCompletions && text) {
+        const verdict = await inspector.completion(text, meta);
+        opts.onDecision?.("completion", verdict);
+        if (verdict.blocked && opts.onDeny === "throw") {
+          controller.error(deniedError(verdict));
+          return;
+        }
+      }
+      if (opts.inspectToolCalls) {
+        for (const call of toolCalls) {
+          const verdict = await inspector.toolCall(call.tool, call.args, meta);
+          opts.onDecision?.("tool-call", verdict);
+          if (verdict.blocked && opts.onDeny === "throw") {
+            controller.error(deniedError(verdict));
+            return;
+          }
+        }
+      }
+    }
+  });
+}
+
+// src/types.ts
+var DEFAULT_BASE_URL = "https://app.axiorank.com";
+var DEFAULT_REFUSAL = "[blocked by AxioRank]";
+function resolveOptions(o = {}) {
+  const apiKey = o.apiKey ?? process.env.AXIORANK_API_KEY ?? process.env.AXIORANK_KEY;
+  const baseUrl = (o.baseUrl ?? process.env.AXIORANK_BASE_URL ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const requested = o.mode ?? (apiKey ? "hosted" : "local");
+  const mode = requested === "hosted" && !apiKey ? "local" : requested;
+  return {
+    mode,
+    apiKey,
+    baseUrl,
+    onDeny: o.onDeny ?? "block",
+    failOpen: o.failOpen ?? true,
+    inspectPrompts: o.inspectPrompts ?? true,
+    inspectCompletions: o.inspectCompletions ?? true,
+    inspectToolCalls: o.inspectToolCalls ?? true,
+    stream: o.stream ?? "buffer",
+    refusal: o.refusal ?? DEFAULT_REFUSAL,
+    onDecision: o.onDecision,
+    timeoutMs: o.timeoutMs ?? 1e4,
+    model: o.model,
+    fetch: o.fetch ?? globalThis.fetch
+  };
+}
+
+// src/middleware.ts
+function createAxioRankMiddleware(options = {}) {
+  const opts = resolveOptions(options);
+  const inspector = createInspector(opts);
+  return {
+    specificationVersion: "v4",
+    async wrapGenerate({ doGenerate, params, model }) {
+      const meta = { model: opts.model ?? model.modelId };
+      if (opts.inspectPrompts) {
+        const verdict = await inspector.prompt(
+          extractPromptText(params.prompt),
+          meta
+        );
+        opts.onDecision?.("prompt", verdict);
+        if (verdict.blocked) {
+          if (opts.onDeny === "throw") throw deniedError(verdict);
+          return blockedGenerateResult(opts.refusal);
+        }
+      }
+      const result = await doGenerate();
+      let content = result.content;
+      if (opts.inspectCompletions) {
+        const text = extractCompletionText(content);
+        if (text) {
+          const verdict = await inspector.completion(text, meta);
+          opts.onDecision?.("completion", verdict);
+          if (verdict.blocked) {
+            if (opts.onDeny === "throw") throw deniedError(verdict);
+            content = blockCompletionContent(opts.refusal);
+          } else if (verdict.decision === "redact" && verdict.redactedText !== void 0) {
+            content = redactCompletionContent(content, verdict.redactedText);
+          }
+        }
+      }
+      if (opts.inspectToolCalls) {
+        const calls = extractToolCalls(content);
+        if (calls.length > 0) {
+          const blockedIds = /* @__PURE__ */ new Set();
+          for (const call of calls) {
+            const verdict = await inspector.toolCall(
+              call.toolName,
+              parseToolInput(call.input),
+              meta
+            );
+            opts.onDecision?.("tool-call", verdict);
+            if (verdict.blocked) {
+              if (opts.onDeny === "throw") throw deniedError(verdict);
+              blockedIds.add(call.toolCallId);
+            }
+          }
+          if (blockedIds.size > 0) {
+            content = stripToolCalls(
+              content,
+              blockedIds,
+              `${opts.refusal} (${blockedIds.size} tool call(s) removed)`
+            );
+          }
+        }
+      }
+      return content === result.content ? result : { ...result, content };
+    },
+    async wrapStream({ doStream, params, model }) {
+      return guardStream({ doStream, params, model }, opts, inspector);
+    }
+  };
+}
+
+exports.AxioRankDeniedError = AxioRankDeniedError;
+exports.createAxioRankMiddleware = createAxioRankMiddleware;
+//# sourceMappingURL=index.cjs.map
+//# sourceMappingURL=index.cjs.map