@directive-run/ai 1.18.0 → 1.19.1

package/dist/guardrails.d.cts

@@ -1,7 +1,7 @@
 import { m as GuardrailFn, I as InputGuardrailData, O as OutputGuardrailData, aW as SchemaValidator, T as ToolCallGuardrailData } from './types-DJ09LjZX.cjs';
 import { a as Embedding } from './semantic-cache-DM7ev7NQ.cjs';
 export { B as BatchedEmbedder, C as CacheEntry, b as CacheLookupResult, c as CacheStats, E as EmbedderFn, S as SemanticCache, d as SemanticCacheConfig, e as SemanticCacheStorage, f as createBatchedEmbedder, g as createInMemoryStorage, h as createSemanticCache, i as createSemanticCacheGuardrail, j as createTestEmbedder } from './semantic-cache-DM7ev7NQ.cjs';
-import '@directive-run/core';
+import { Plugin } from '@directive-run/core';
 
 /**
  * Built-in guardrails for AI adapter — PII, moderation, rate limiting, tool allowlists, schema validation.
@@ -215,6 +215,190 @@ declare function createContentFilterGuardrail(options: {
     caseSensitive?: boolean;
 }): GuardrailFn<OutputGuardrailData>;
 
+/**
+ * Fact-PII Guardrail — input guardrail at the fact-store boundary
+ *
+ * Closes the source → fact → agent prompt PII bypass surfaced by R5's
+ * red-team / privacy / AI-integration reviewers: `createPIIGuardrail`
+ * only inspects the `data.input` string at runStream entry, so PII that
+ * a source publishes into a fact (a Supabase realtime row carrying a
+ * customer email, a webhook payload with a SSN, an MCP server's
+ * resource notification with a card number) reaches the agent's
+ * prompt — via fact injection — without ever hitting the input
+ * guardrail chain.
+ *
+ * This plugin runs as a Directive plugin (`onFactSet` / `onFactsBatch`),
+ * scans every write to a pii-tagged fact against a sync regex matcher
+ * for the three highest-volume PII categories (SSN, credit card, email),
+ * and either **redacts** the value (the default — safe shipping posture)
+ * or **rejects** the write (throws so the source's publish handler can
+ * surface the violation). Operators wire it once at `createSystem`; no
+ * per-source / per-fact changes are required.
+ *
+ * The async PII detector from `pii-enhanced.ts` is unsuitable here:
+ * `onFactSet` is synchronous and a deferred detection would let the
+ * raw PII reach observers + breakpoints + audit-ledger before the
+ * redaction completed. Built-in matching is therefore inlined as
+ * synchronous regex. Consumers who need richer detection pass a
+ * synchronous `customDetector`.
+ *
+ * @example Defensive (redact PII writes into pii-tagged facts)
+ * ```ts
+ * import { createSystem, t } from '@directive-run/core';
+ * import { createFactPIIGuardrail } from '@directive-run/ai/guardrails';
+ *
+ * const customer = createModule('customer', {
+ *   schema: {
+ *     facts: {
+ *       email: t.string().meta({ tags: ['pii'] }),
+ *       ssn: t.string().meta({ tags: ['pii'] }),
+ *     },
+ *   },
+ *   sources: {
+ *     supabase: { attach: (publish) => subscribe(publish) },
+ *   },
+ * });
+ *
+ * const system = createSystem({
+ *   module: customer,
+ *   plugins: [
+ *     createFactPIIGuardrail({
+ *       mode: 'redact',
+ *       onBlocked: (key, detected) => {
+ *         console.warn(`[fact-pii] redacted ${detected.length} match(es) in ${key}`);
+ *       },
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @example Monitor-only (alert on every PII match; don't mutate the fact)
+ * ```ts
+ * createFactPIIGuardrail({
+ *   mode: 'alert',
+ *   onBlocked: (key) => Sentry.captureException(new Error(`pii match: ${key}`)),
+ * });
+ * ```
+ *
+ * @example Allow specific keys (not just by tag)
+ * ```ts
+ * createFactPIIGuardrail({
+ *   includeKeys: ['customer.email', 'customer.phone'],
+ * });
+ * ```
+ */
+
+/**
+ * Public match record for a single PII finding. Mirrors `DetectedPII` from
+ * `pii-enhanced.ts` so a downstream guardrail can normalize against either
+ * detection path.
+ */
+interface FactPIIMatch {
+    type: FactPIICategory;
+    value: string;
+    start: number;
+    end: number;
+}
+/** PII categories the built-in synchronous detector covers. */
+type FactPIICategory = "ssn" | "credit_card" | "email";
+/**
+ * Behavior when a pii-tagged fact's incoming value contains detected PII.
+ *
+ * - `"redact"` (default): the fact is rewritten with redacted text (e.g.
+ *   `"[SSN]"`) via a follow-up store write. The system briefly observes
+ *   the raw value during the same microtask the publish landed in, then
+ *   the redacted value overwrites it before any reconcile / agent runs.
+ *   Safe shipping posture for production: the LLM call always sees the
+ *   redacted value.
+ * - `"alert"`: fire `onBlocked` but DO NOT mutate the fact. The raw value
+ *   stays in the store. Use this for monitoring-only deployments where
+ *   the source's transport is already trusted but a regression detector
+ *   is needed (paging ops on every match).
+ *
+ * Note: Directive plugin hooks (`onFactSet`, `onFactsBatch`) are
+ * wrapped by the plugin manager's `safeCall` so a throw from inside the
+ * hook is swallowed. The guardrail therefore cannot reject the write
+ * itself — it can only observe + redact-via-followup-write or alert.
+ * For hard rejection at the publish boundary, a future RFC will add a
+ * pre-commit transform hook on the source primitive.
+ */
+type FactPIIGuardrailMode = "redact" | "alert";
+interface FactPIIGuardrailOptions {
+    /** Default: `"redact"` */
+    mode?: FactPIIGuardrailMode;
+    /**
+     * Built-in categories to scan for. Default: all three (`ssn`,
+     * `credit_card`, `email`). Pass `[]` to opt out of the built-ins and
+     * rely entirely on `customDetector`.
+     */
+    types?: readonly FactPIICategory[];
+    /**
+     * Specific fact keys to scan in addition to the auto-detected
+     * `pii`-tagged set. Useful when a consumer can't change the schema's
+     * meta but knows the key should be screened.
+     */
+    includeKeys?: readonly string[];
+    /**
+     * Exclude these fact keys even if they're pii-tagged. Escape hatch for
+     * a key that's already pre-sanitized upstream of the manager.
+     */
+    excludeKeys?: readonly string[];
+    /**
+     * Called whenever the guardrail detects PII and acts on it. Receives the
+     * fact key, the detected matches, and the action that was taken. Fires
+     * AFTER redact + before any throw in `reject` mode. Use this to alert
+     * SREs without coupling the guardrail to a specific logging backend.
+     */
+    onBlocked?: (key: string, detected: readonly FactPIIMatch[], action: FactPIIGuardrailMode) => void;
+    /**
+     * Custom synchronous detector that runs alongside the built-in regex
+     * scanner. The union of detections is acted on. Useful when the
+     * consumer ships a domain-specific PII detector (e.g. internal
+     * account-number format). MUST be synchronous — `onFactSet` cannot
+     * await deferred work.
+     */
+    customDetector?: (text: string) => readonly FactPIIMatch[];
+    /**
+     * Maximum nesting depth to walk when scanning a structured fact
+     * value. Default `1` — the scanner inspects top-level strings, then
+     * descends one level into the object/array. Arrays and plain objects
+     * count as one depth level each. Maps and Sets are still NOT walked
+     * by the built-in scanner; PII inside those structures must go
+     * through a `customDetector`.
+     *
+     * Per R13-C6 the walker recurses into arrays (Supabase realtime
+     * payloads ship as `payload.new = [{...}]`, MCP resource lists ship
+     * as arrays — those shapes silently bypassed the Tier 0 guard before).
+     *
+     * Consumers with deeply-nested PII shapes have two options:
+     * 1. Pass `walkDepth: 2` (or higher) — the scanner walks plain
+     *    objects and arrays to that depth. Maps and Sets are still
+     *    skipped.
+     * 2. Pass a `customDetector` that walks the consumer-specific shape
+     *    and returns concrete matches — the right answer for
+     *    domain-specific structures (Maps, Sets, getters, Symbol keys).
+     *
+     * Maximum is `5` to prevent pathological recursion on cyclic
+     * structures. Passing anything higher clamps to `5`.
+     *
+     * Property iteration uses `Object.entries`, which skips
+     * Symbol-keyed properties and non-enumerable string keys. If you
+     * store PII under a Symbol key (unusual), a `customDetector` is the
+     * right escape hatch.
+     */
+    walkDepth?: number;
+}
+/**
+ * Create a Directive plugin that scans pii-tagged fact writes for PII and
+ * redacts or rejects them at the manager boundary.
+ *
+ * Wire it once at `createSystem({ plugins: [...] })`. The plugin caches
+ * the pii-tagged key set on `onInit` so per-write hooks are O(1) lookups.
+ *
+ * @returns a `Plugin` instance ready to add to `SystemConfig.plugins`.
+ */
+declare function createFactPIIGuardrail(options?: FactPIIGuardrailOptions): Plugin;
+
 /**
  * Enhanced PII Detection Guardrail
  *
@@ -615,4 +799,4 @@ interface VPTreeIndexConfig {
  */
 declare function createVPTreeIndex(vpConfig?: VPTreeIndexConfig): ANNIndex;
 
-export { type ANNIndex, type ANNSearchResult, DEFAULT_INJECTION_PATTERNS, type DetectedPII, Embedding, type EnhancedPIIGuardrailOptions, type InjectionDetectionResult, type PIIDetectionResult, type PIIDetector, type PIIType, type PromptInjectionGuardrailOptions, type RateLimitGuardrail, type RedactionStyle, STRICT_INJECTION_PATTERNS, type VPTreeIndexConfig, createBruteForceIndex, createContentFilterGuardrail, createEnhancedPIIGuardrail, createLengthGuardrail, createModerationGuardrail, createOutputPIIGuardrail, createOutputSchemaGuardrail, createOutputTypeGuardrail, createPIIGuardrail, createPromptInjectionGuardrail, createRateLimitGuardrail, createToolGuardrail, createUntrustedContentGuardrail, createVPTreeIndex, detectAndRedactPII, detectPII, detectPromptInjection, markUntrustedContent, redactPII, sanitizeInjection };
+export { type ANNIndex, type ANNSearchResult, DEFAULT_INJECTION_PATTERNS, type DetectedPII, Embedding, type EnhancedPIIGuardrailOptions, type FactPIICategory, type FactPIIGuardrailMode, type FactPIIGuardrailOptions, type FactPIIMatch, type InjectionDetectionResult, type PIIDetectionResult, type PIIDetector, type PIIType, type PromptInjectionGuardrailOptions, type RateLimitGuardrail, type RedactionStyle, STRICT_INJECTION_PATTERNS, type VPTreeIndexConfig, createBruteForceIndex, createContentFilterGuardrail, createEnhancedPIIGuardrail, createFactPIIGuardrail, createLengthGuardrail, createModerationGuardrail, createOutputPIIGuardrail, createOutputSchemaGuardrail, createOutputTypeGuardrail, createPIIGuardrail, createPromptInjectionGuardrail, createRateLimitGuardrail, createToolGuardrail, createUntrustedContentGuardrail, createVPTreeIndex, detectAndRedactPII, detectPII, detectPromptInjection, markUntrustedContent, redactPII, sanitizeInjection };

package/dist/guardrails.d.ts

@@ -1,7 +1,7 @@
 import { m as GuardrailFn, I as InputGuardrailData, O as OutputGuardrailData, aW as SchemaValidator, T as ToolCallGuardrailData } from './types-DJ09LjZX.js';
 import { a as Embedding } from './semantic-cache-DM7ev7NQ.js';
 export { B as BatchedEmbedder, C as CacheEntry, b as CacheLookupResult, c as CacheStats, E as EmbedderFn, S as SemanticCache, d as SemanticCacheConfig, e as SemanticCacheStorage, f as createBatchedEmbedder, g as createInMemoryStorage, h as createSemanticCache, i as createSemanticCacheGuardrail, j as createTestEmbedder } from './semantic-cache-DM7ev7NQ.js';
-import '@directive-run/core';
+import { Plugin } from '@directive-run/core';
 
 /**
  * Built-in guardrails for AI adapter — PII, moderation, rate limiting, tool allowlists, schema validation.
@@ -215,6 +215,190 @@ declare function createContentFilterGuardrail(options: {
     caseSensitive?: boolean;
 }): GuardrailFn<OutputGuardrailData>;
 
+/**
+ * Fact-PII Guardrail — input guardrail at the fact-store boundary
+ *
+ * Closes the source → fact → agent prompt PII bypass surfaced by R5's
+ * red-team / privacy / AI-integration reviewers: `createPIIGuardrail`
+ * only inspects the `data.input` string at runStream entry, so PII that
+ * a source publishes into a fact (a Supabase realtime row carrying a
+ * customer email, a webhook payload with a SSN, an MCP server's
+ * resource notification with a card number) reaches the agent's
+ * prompt — via fact injection — without ever hitting the input
+ * guardrail chain.
+ *
+ * This plugin runs as a Directive plugin (`onFactSet` / `onFactsBatch`),
+ * scans every write to a pii-tagged fact against a sync regex matcher
+ * for the three highest-volume PII categories (SSN, credit card, email),
+ * and either **redacts** the value (the default — safe shipping posture)
+ * or **rejects** the write (throws so the source's publish handler can
+ * surface the violation). Operators wire it once at `createSystem`; no
+ * per-source / per-fact changes are required.
+ *
+ * The async PII detector from `pii-enhanced.ts` is unsuitable here:
+ * `onFactSet` is synchronous and a deferred detection would let the
+ * raw PII reach observers + breakpoints + audit-ledger before the
+ * redaction completed. Built-in matching is therefore inlined as
+ * synchronous regex. Consumers who need richer detection pass a
+ * synchronous `customDetector`.
+ *
+ * @example Defensive (redact PII writes into pii-tagged facts)
+ * ```ts
+ * import { createSystem, t } from '@directive-run/core';
+ * import { createFactPIIGuardrail } from '@directive-run/ai/guardrails';
+ *
+ * const customer = createModule('customer', {
+ *   schema: {
+ *     facts: {
+ *       email: t.string().meta({ tags: ['pii'] }),
+ *       ssn: t.string().meta({ tags: ['pii'] }),
+ *     },
+ *   },
+ *   sources: {
+ *     supabase: { attach: (publish) => subscribe(publish) },
+ *   },
+ * });
+ *
+ * const system = createSystem({
+ *   module: customer,
+ *   plugins: [
+ *     createFactPIIGuardrail({
+ *       mode: 'redact',
+ *       onBlocked: (key, detected) => {
+ *         console.warn(`[fact-pii] redacted ${detected.length} match(es) in ${key}`);
+ *       },
+ *     }),
+ *   ],
+ * });
+ * ```
+ *
+ * @example Monitor-only (alert on every PII match; don't mutate the fact)
+ * ```ts
+ * createFactPIIGuardrail({
+ *   mode: 'alert',
+ *   onBlocked: (key) => Sentry.captureException(new Error(`pii match: ${key}`)),
+ * });
+ * ```
+ *
+ * @example Allow specific keys (not just by tag)
+ * ```ts
+ * createFactPIIGuardrail({
+ *   includeKeys: ['customer.email', 'customer.phone'],
+ * });
+ * ```
+ */
+
+/**
+ * Public match record for a single PII finding. Mirrors `DetectedPII` from
+ * `pii-enhanced.ts` so a downstream guardrail can normalize against either
+ * detection path.
+ */
+interface FactPIIMatch {
+    type: FactPIICategory;
+    value: string;
+    start: number;
+    end: number;
+}
+/** PII categories the built-in synchronous detector covers. */
+type FactPIICategory = "ssn" | "credit_card" | "email";
+/**
+ * Behavior when a pii-tagged fact's incoming value contains detected PII.
+ *
+ * - `"redact"` (default): the fact is rewritten with redacted text (e.g.
+ *   `"[SSN]"`) via a follow-up store write. The system briefly observes
+ *   the raw value during the same microtask the publish landed in, then
+ *   the redacted value overwrites it before any reconcile / agent runs.
+ *   Safe shipping posture for production: the LLM call always sees the
+ *   redacted value.
+ * - `"alert"`: fire `onBlocked` but DO NOT mutate the fact. The raw value
+ *   stays in the store. Use this for monitoring-only deployments where
+ *   the source's transport is already trusted but a regression detector
+ *   is needed (paging ops on every match).
+ *
+ * Note: Directive plugin hooks (`onFactSet`, `onFactsBatch`) are
+ * wrapped by the plugin manager's `safeCall` so a throw from inside the
+ * hook is swallowed. The guardrail therefore cannot reject the write
+ * itself — it can only observe + redact-via-followup-write or alert.
+ * For hard rejection at the publish boundary, a future RFC will add a
+ * pre-commit transform hook on the source primitive.
+ */
+type FactPIIGuardrailMode = "redact" | "alert";
+interface FactPIIGuardrailOptions {
+    /** Default: `"redact"` */
+    mode?: FactPIIGuardrailMode;
+    /**
+     * Built-in categories to scan for. Default: all three (`ssn`,
+     * `credit_card`, `email`). Pass `[]` to opt out of the built-ins and
+     * rely entirely on `customDetector`.
+     */
+    types?: readonly FactPIICategory[];
+    /**
+     * Specific fact keys to scan in addition to the auto-detected
+     * `pii`-tagged set. Useful when a consumer can't change the schema's
+     * meta but knows the key should be screened.
+     */
+    includeKeys?: readonly string[];
+    /**
+     * Exclude these fact keys even if they're pii-tagged. Escape hatch for
+     * a key that's already pre-sanitized upstream of the manager.
+     */
+    excludeKeys?: readonly string[];
+    /**
+     * Called whenever the guardrail detects PII and acts on it. Receives the
+     * fact key, the detected matches, and the action that was taken. Fires
+     * AFTER redact + before any throw in `reject` mode. Use this to alert
+     * SREs without coupling the guardrail to a specific logging backend.
+     */
+    onBlocked?: (key: string, detected: readonly FactPIIMatch[], action: FactPIIGuardrailMode) => void;
+    /**
+     * Custom synchronous detector that runs alongside the built-in regex
+     * scanner. The union of detections is acted on. Useful when the
+     * consumer ships a domain-specific PII detector (e.g. internal
+     * account-number format). MUST be synchronous — `onFactSet` cannot
+     * await deferred work.
+     */
+    customDetector?: (text: string) => readonly FactPIIMatch[];
+    /**
+     * Maximum nesting depth to walk when scanning a structured fact
+     * value. Default `1` — the scanner inspects top-level strings, then
+     * descends one level into the object/array. Arrays and plain objects
+     * count as one depth level each. Maps and Sets are still NOT walked
+     * by the built-in scanner; PII inside those structures must go
+     * through a `customDetector`.
+     *
+     * Per R13-C6 the walker recurses into arrays (Supabase realtime
+     * payloads ship as `payload.new = [{...}]`, MCP resource lists ship
+     * as arrays — those shapes silently bypassed the Tier 0 guard before).
+     *
+     * Consumers with deeply-nested PII shapes have two options:
+     * 1. Pass `walkDepth: 2` (or higher) — the scanner walks plain
+     *    objects and arrays to that depth. Maps and Sets are still
+     *    skipped.
+     * 2. Pass a `customDetector` that walks the consumer-specific shape
+     *    and returns concrete matches — the right answer for
+     *    domain-specific structures (Maps, Sets, getters, Symbol keys).
+     *
+     * Maximum is `5` to prevent pathological recursion on cyclic
+     * structures. Passing anything higher clamps to `5`.
+     *
+     * Property iteration uses `Object.entries`, which skips
+     * Symbol-keyed properties and non-enumerable string keys. If you
+     * store PII under a Symbol key (unusual), a `customDetector` is the
+     * right escape hatch.
+     */
+    walkDepth?: number;
+}
+/**
+ * Create a Directive plugin that scans pii-tagged fact writes for PII and
+ * redacts or rejects them at the manager boundary.
+ *
+ * Wire it once at `createSystem({ plugins: [...] })`. The plugin caches
+ * the pii-tagged key set on `onInit` so per-write hooks are O(1) lookups.
+ *
+ * @returns a `Plugin` instance ready to add to `SystemConfig.plugins`.
+ */
+declare function createFactPIIGuardrail(options?: FactPIIGuardrailOptions): Plugin;
+
 /**
  * Enhanced PII Detection Guardrail
  *
@@ -615,4 +799,4 @@ interface VPTreeIndexConfig {
  */
 declare function createVPTreeIndex(vpConfig?: VPTreeIndexConfig): ANNIndex;
 
-export { type ANNIndex, type ANNSearchResult, DEFAULT_INJECTION_PATTERNS, type DetectedPII, Embedding, type EnhancedPIIGuardrailOptions, type InjectionDetectionResult, type PIIDetectionResult, type PIIDetector, type PIIType, type PromptInjectionGuardrailOptions, type RateLimitGuardrail, type RedactionStyle, STRICT_INJECTION_PATTERNS, type VPTreeIndexConfig, createBruteForceIndex, createContentFilterGuardrail, createEnhancedPIIGuardrail, createLengthGuardrail, createModerationGuardrail, createOutputPIIGuardrail, createOutputSchemaGuardrail, createOutputTypeGuardrail, createPIIGuardrail, createPromptInjectionGuardrail, createRateLimitGuardrail, createToolGuardrail, createUntrustedContentGuardrail, createVPTreeIndex, detectAndRedactPII, detectPII, detectPromptInjection, markUntrustedContent, redactPII, sanitizeInjection };
+export { type ANNIndex, type ANNSearchResult, DEFAULT_INJECTION_PATTERNS, type DetectedPII, Embedding, type EnhancedPIIGuardrailOptions, type FactPIICategory, type FactPIIGuardrailMode, type FactPIIGuardrailOptions, type FactPIIMatch, type InjectionDetectionResult, type PIIDetectionResult, type PIIDetector, type PIIType, type PromptInjectionGuardrailOptions, type RateLimitGuardrail, type RedactionStyle, STRICT_INJECTION_PATTERNS, type VPTreeIndexConfig, createBruteForceIndex, createContentFilterGuardrail, createEnhancedPIIGuardrail, createFactPIIGuardrail, createLengthGuardrail, createModerationGuardrail, createOutputPIIGuardrail, createOutputSchemaGuardrail, createOutputTypeGuardrail, createPIIGuardrail, createPromptInjectionGuardrail, createRateLimitGuardrail, createToolGuardrail, createUntrustedContentGuardrail, createVPTreeIndex, detectAndRedactPII, detectPII, detectPromptInjection, markUntrustedContent, redactPII, sanitizeInjection };

package/dist/guardrails.js

@@ -1,2 +1,2 @@
-export{n as DEFAULT_INJECTION_PATTERNS,o as STRICT_INJECTION_PATTERNS,z as createBatchedEmbedder,A as createBruteForceIndex,h as createContentFilterGuardrail,j as createEnhancedPIIGuardrail,v as createInMemoryStorage,g as createLengthGuardrail,b as createModerationGuardrail,k as createOutputPIIGuardrail,e as createOutputSchemaGuardrail,f as createOutputTypeGuardrail,a as createPIIGuardrail,r as createPromptInjectionGuardrail,c as createRateLimitGuardrail,w as createSemanticCache,x as createSemanticCacheGuardrail,y as createTestEmbedder,d as createToolGuardrail,t as createUntrustedContentGuardrail,B as createVPTreeIndex,m as detectAndRedactPII,l as detectPII,p as detectPromptInjection,s as markUntrustedContent,i as redactPII,q as sanitizeInjection}from'./chunk-BFSRYCOS.js';import'./chunk-UR5BMWEN.js';//# sourceMappingURL=guardrails.js.map
+export{o as DEFAULT_INJECTION_PATTERNS,p as STRICT_INJECTION_PATTERNS,A as createBatchedEmbedder,B as createBruteForceIndex,h as createContentFilterGuardrail,k as createEnhancedPIIGuardrail,i as createFactPIIGuardrail,w as createInMemoryStorage,g as createLengthGuardrail,b as createModerationGuardrail,l as createOutputPIIGuardrail,e as createOutputSchemaGuardrail,f as createOutputTypeGuardrail,a as createPIIGuardrail,s as createPromptInjectionGuardrail,c as createRateLimitGuardrail,x as createSemanticCache,y as createSemanticCacheGuardrail,z as createTestEmbedder,d as createToolGuardrail,u as createUntrustedContentGuardrail,C as createVPTreeIndex,n as detectAndRedactPII,m as detectPII,q as detectPromptInjection,t as markUntrustedContent,j as redactPII,r as sanitizeInjection}from'./chunk-WERHNNUD.js';import'./chunk-UR5BMWEN.js';//# sourceMappingURL=guardrails.js.map
 //# sourceMappingURL=guardrails.js.map