@dudousxd/nestjs-agent-core 0.15.5 → 0.17.0

package/dist/guardrails/index.js

@@ -0,0 +1,2445 @@
+var __defProp = Object.defineProperty;
+var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
+
+// src/guardrails/types.ts
+var GUARDRAIL_STAGES = [
+  "llm_request",
+  "llm_response",
+  "tool_args",
+  "tool_result",
+  "tool_description"
+];
+var ACTION_SEVERITY = {
+  allow: 0,
+  log: 1,
+  redact: 2,
+  approve: 3,
+  block: 4
+};
+var PII_TYPES = [
+  "email",
+  "phone",
+  "cpf",
+  "cnpj",
+  "ssn",
+  "credit_card",
+  "iban",
+  "ip_address"
+];
+var SECRET_TYPES = [
+  "openai_key",
+  "anthropic_key",
+  "aws_access_key",
+  "aws_secret_key",
+  "github_token",
+  "gitlab_token",
+  "slack_token",
+  "google_api_key",
+  "stripe_key",
+  "jwt",
+  "bearer_token",
+  "private_key",
+  "generic_secret"
+];
+
+// src/guardrails/detectors/pii.ts
+function isIPv4(raw) {
+  const parts = raw.split(".");
+  return parts.length === 4 && parts.every((p) => /^(?:0|[1-9]\d{0,2})$/.test(p) && Number(p) <= 255);
+}
+__name(isIPv4, "isIPv4");
+function luhnValid(digits) {
+  if (!/^\d+$/.test(digits)) return false;
+  let sum = 0;
+  let double = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let d = digits.charCodeAt(i) - 48;
+    if (double) {
+      d *= 2;
+      if (d > 9) d -= 9;
+    }
+    sum += d;
+    double = !double;
+  }
+  return sum % 10 === 0;
+}
+__name(luhnValid, "luhnValid");
+function cardBrand(digits) {
+  const p2 = Number(digits.slice(0, 2));
+  const p3 = Number(digits.slice(0, 3));
+  const p4 = Number(digits.slice(0, 4));
+  const p6 = Number(digits.slice(0, 6));
+  const len = digits.length;
+  if ([
+    401178,
+    401179,
+    431274,
+    438935,
+    451416,
+    457393,
+    457631,
+    457632,
+    504175,
+    627780,
+    636297,
+    636368
+  ].includes(p6)) return "elo";
+  if (p6 >= 506699 && p6 <= 506778 || p6 >= 509e3 && p6 <= 509999 || p6 >= 650031 && p6 <= 650051) return "elo";
+  if (p6 === 606282 || p4 === 3841) return "hipercard";
+  if (digits.startsWith("4") && (len === 13 || len === 16 || len === 19)) return "visa";
+  if ((p2 >= 51 && p2 <= 55 || p4 >= 2221 && p4 <= 2720) && len === 16) return "mastercard";
+  if ((p2 === 34 || p2 === 37) && len === 15) return "amex";
+  if ((p4 === 6011 || p2 === 65 || p3 >= 644 && p3 <= 649) && len >= 16) return "discover";
+  if ((p2 === 36 || p2 === 38 || p3 >= 300 && p3 <= 305) && len >= 14) return "diners";
+  if (p4 >= 3528 && p4 <= 3589 && len >= 16) return "jcb";
+  if ((p2 === 62 || p2 === 81) && len >= 16) return "unionpay";
+  if ((p4 === 5018 || p4 === 5020 || p4 === 5038 || p4 === 6304 || p4 === 6759 || p4 === 6761) && len >= 12) return "maestro";
+  return void 0;
+}
+__name(cardBrand, "cardBrand");
+function cpfValid(raw) {
+  const d = raw.replace(/\D/g, "");
+  if (d.length !== 11 || /^(\d)\1{10}$/.test(d)) return false;
+  const check = /* @__PURE__ */ __name((len) => {
+    let sum = 0;
+    for (let i = 0; i < len; i++) sum += (d.charCodeAt(i) - 48) * (len + 1 - i);
+    const r = sum * 10 % 11;
+    return r === 10 ? 0 : r;
+  }, "check");
+  return check(9) === d.charCodeAt(9) - 48 && check(10) === d.charCodeAt(10) - 48;
+}
+__name(cpfValid, "cpfValid");
+function cnpjValid(raw) {
+  const c = raw.replace(/[.\-/\s]/g, "").toUpperCase();
+  if (!/^[0-9A-Z]{12}\d{2}$/.test(c) || /^(\d)\1{13}$/.test(c)) return false;
+  const value = /* @__PURE__ */ __name((i) => c.charCodeAt(i) - 48, "value");
+  const check = /* @__PURE__ */ __name((len) => {
+    const weights = len === 12 ? [
+      5,
+      4,
+      3,
+      2,
+      9,
+      8,
+      7,
+      6,
+      5,
+      4,
+      3,
+      2
+    ] : [
+      6,
+      5,
+      4,
+      3,
+      2,
+      9,
+      8,
+      7,
+      6,
+      5,
+      4,
+      3,
+      2
+    ];
+    let sum = 0;
+    for (let i = 0; i < len; i++) sum += value(i) * (weights[i] ?? 0);
+    const r = sum % 11;
+    return r < 2 ? 0 : 11 - r;
+  }, "check");
+  return check(12) === value(12) && check(13) === value(13);
+}
+__name(cnpjValid, "cnpjValid");
+function ssnValid(raw) {
+  const m = /^(\d{3})[- ](\d{2})[- ](\d{4})$/.exec(raw);
+  if (!m) return false;
+  const area = m[1] ?? "";
+  const group = m[2] ?? "";
+  const serial = m[3] ?? "";
+  if (area === "000" || area === "666" || area.startsWith("9")) return false;
+  if (group === "00" || serial === "0000") return false;
+  if ([
+    "078-05-1120",
+    "219-09-9999",
+    "123-45-6789"
+  ].includes(`${area}-${group}-${serial}`)) return false;
+  return true;
+}
+__name(ssnValid, "ssnValid");
+var IBAN_LENGTHS = {
+  AD: 24,
+  AE: 23,
+  AT: 20,
+  BE: 16,
+  BG: 22,
+  BH: 22,
+  BR: 29,
+  CH: 21,
+  CR: 22,
+  CY: 28,
+  CZ: 24,
+  DE: 22,
+  DK: 18,
+  DO: 28,
+  EE: 20,
+  ES: 24,
+  FI: 18,
+  FO: 18,
+  FR: 27,
+  GB: 22,
+  GI: 23,
+  GL: 18,
+  GR: 27,
+  GT: 28,
+  HR: 21,
+  HU: 28,
+  IE: 22,
+  IL: 23,
+  IS: 26,
+  IT: 27,
+  JO: 30,
+  KW: 30,
+  KZ: 20,
+  LB: 28,
+  LI: 21,
+  LT: 20,
+  LU: 20,
+  LV: 21,
+  MC: 27,
+  MD: 24,
+  ME: 22,
+  MK: 19,
+  MR: 27,
+  MT: 31,
+  MU: 30,
+  NL: 18,
+  NO: 15,
+  PK: 24,
+  PL: 28,
+  PS: 29,
+  PT: 25,
+  QA: 29,
+  RO: 24,
+  RS: 22,
+  SA: 24,
+  SE: 24,
+  SI: 19,
+  SK: 24,
+  SM: 27,
+  TN: 24,
+  TR: 26,
+  UA: 29,
+  VG: 24,
+  XK: 20
+};
+function ibanValid(raw) {
+  const s = raw.replace(/\s/g, "").toUpperCase();
+  if (!/^[A-Z]{2}\d{2}[A-Z0-9]{11,30}$/.test(s)) return false;
+  const expected = IBAN_LENGTHS[s.slice(0, 2)];
+  if (expected !== void 0 && s.length !== expected) return false;
+  if (expected === void 0) return false;
+  const rearranged = s.slice(4) + s.slice(0, 4);
+  let rem = 0;
+  for (const ch of rearranged) {
+    const v = ch >= "A" ? String(ch.charCodeAt(0) - 55) : ch;
+    for (const digit of v) rem = (rem * 10 + (digit.charCodeAt(0) - 48)) % 97;
+  }
+  return rem === 1;
+}
+__name(ibanValid, "ibanValid");
+function phoneValid(raw) {
+  const digits = raw.replace(/\D/g, "");
+  if (raw.trim().startsWith("+")) return digits.length >= 8 && digits.length <= 15;
+  if (digits.length < 10 || digits.length > 11) return false;
+  if (/^\(?\d{2}\)?[\s.-]?9?\d{4}[\s.-]\d{4}$/.test(raw.trim())) return true;
+  if (/^\(?\d{3}\)?[\s.-]?\d{3}[\s.-]\d{4}$/.test(raw.trim())) return true;
+  return false;
+}
+__name(phoneValid, "phoneValid");
+var PATTERNS = [
+  {
+    type: "email",
+    re: /(?<![\w.+-])[A-Za-z0-9](?:[A-Za-z0-9._%+-]{0,63})@(?:[A-Za-z0-9](?:[A-Za-z0-9-]{0,62})\.)+[A-Za-z]{2,24}(?![\w-])/g,
+    score: 0.99
+  },
+  {
+    type: "iban",
+    re: /(?<![A-Za-z0-9])[A-Z]{2}\d{2}(?: ?[A-Z0-9]){11,30}(?![A-Za-z0-9])/g,
+    valid: ibanValid,
+    score: 0.99
+  },
+  {
+    type: "cnpj",
+    re: /(?<![\w./-])[0-9A-Z]{2}\.?[0-9A-Z]{3}\.?[0-9A-Z]{3}\/?[0-9A-Z]{4}-?\d{2}(?![\w/-])/g,
+    valid: /* @__PURE__ */ __name((m) => cnpjValid(m) && (/^\d/.test(m.replace(/\D/g, "")) || /[./-]/.test(m)) && !/^[A-Z]+$/.test(m), "valid"),
+    score: 0.98
+  },
+  {
+    type: "cpf",
+    re: /(?<![\w./-])\d{3}\.?\d{3}\.?\d{3}-?\d{2}(?![\w/-])/g,
+    valid: cpfValid,
+    score: 0.95
+  },
+  {
+    type: "credit_card",
+    re: /(?<![\d-])\d(?:[ -]?\d){11,18}(?![\d-])/g,
+    valid: /* @__PURE__ */ __name((m) => {
+      const digits = m.replace(/\D/g, "");
+      if (/ /.test(m) && /-/.test(m)) return false;
+      return digits.length >= 13 && digits.length <= 19 && luhnValid(digits) && !!cardBrand(digits);
+    }, "valid"),
+    score: 0.97
+  },
+  {
+    type: "ssn",
+    re: /(?<![\d-])\d{3}[- ]\d{2}[- ]\d{4}(?![\d-])/g,
+    valid: ssnValid,
+    score: 0.85
+  },
+  {
+    type: "phone",
+    re: /(?<![\w+])(?:\+\d{1,3}[\s.-]?)?\(?\d{2,4}\)?[\s.-]?\d{3,5}[\s.-]\d{4}(?![\w])/g,
+    valid: phoneValid,
+    score: 0.75
+  },
+  {
+    type: "ip_address",
+    re: /(?<![\d.])(?:\d{1,3}\.){3}\d{1,3}(?![\d.])/g,
+    valid: /* @__PURE__ */ __name((m) => isIPv4(m) && !m.startsWith("0.") && m !== "127.0.0.1", "valid"),
+    score: 0.6
+  }
+];
+function detectPii(text, types = PII_TYPES) {
+  const want = new Set(types);
+  const out = [];
+  for (const p of PATTERNS) {
+    if (!want.has(p.type)) continue;
+    p.re.lastIndex = 0;
+    for (let m = p.re.exec(text); m; m = p.re.exec(text)) {
+      const value = m[0];
+      if (p.valid && !p.valid(value)) continue;
+      out.push({
+        detector: "pii",
+        category: `pii.${p.type}`,
+        start: m.index,
+        end: m.index + value.length,
+        score: p.score,
+        value,
+        spanned: true
+      });
+    }
+  }
+  return out;
+}
+__name(detectPii, "detectPii");
+
+// src/guardrails/detectors/secrets.ts
+function entropy(s) {
+  if (!s) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const c of counts.values()) {
+    const p = c / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+__name(entropy, "entropy");
+var PATTERNS2 = [
+  {
+    type: "private_key",
+    re: /-----BEGIN (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----[\s\S]*?(?:-----END (?:[A-Z0-9]+ )*PRIVATE KEY(?: BLOCK)?-----|$)/g,
+    score: 0.99
+  },
+  {
+    type: "anthropic_key",
+    re: /(?<![\w-])sk-ant-(?:api|admin|oat)\d{0,2}-?[A-Za-z0-9_-]{20,}/g,
+    score: 0.99
+  },
+  {
+    type: "openai_key",
+    re: /(?<![\w-])sk-(?!ant-)(?:proj-|svcacct-|admin-|None-)?[A-Za-z0-9_-]{20,}/g,
+    score: 0.95,
+    valid: /* @__PURE__ */ __name((v) => entropy(v) > 3.5, "valid")
+  },
+  {
+    type: "aws_access_key",
+    re: /(?<![A-Z0-9])(?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16}(?![A-Z0-9])/g,
+    score: 0.98
+  },
+  {
+    type: "aws_secret_key",
+    re: /(?:aws_?secret_?access_?key|aws_?secret|secretaccesskey)["']?\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})(?![A-Za-z0-9/+=])/gi,
+    group: 1,
+    score: 0.97
+  },
+  {
+    type: "github_token",
+    re: /(?<![\w])(?:(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{22,255})/g,
+    score: 0.99
+  },
+  {
+    type: "gitlab_token",
+    re: /(?<![\w-])glpat-[A-Za-z0-9_-]{20,}/g,
+    score: 0.99
+  },
+  {
+    type: "slack_token",
+    re: /(?<![\w-])(?:xox[abprseo]-[A-Za-z0-9-]{10,}|https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/]{20,})/g,
+    score: 0.98
+  },
+  {
+    type: "google_api_key",
+    re: /(?<![\w-])AIza[0-9A-Za-z_-]{35}(?![\w-])/g,
+    score: 0.97
+  },
+  {
+    type: "stripe_key",
+    re: /(?<![\w])(?:sk|rk|pk)_(?:live|test)_[0-9A-Za-z]{16,}/g,
+    score: 0.97
+  },
+  {
+    type: "jwt",
+    re: /(?<![\w-])eyJ[A-Za-z0-9_-]{8,}\.eyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}(?![\w-])/g,
+    score: 0.9
+  },
+  {
+    type: "bearer_token",
+    re: /\bbearer\s+([A-Za-z0-9._~+/-]{20,}=*)/gi,
+    group: 1,
+    score: 0.85,
+    valid: /* @__PURE__ */ __name((v) => entropy(v) > 3.5, "valid")
+  },
+  {
+    type: "generic_secret",
+    re: /\b(?:api[_-]?key|api[_-]?secret|client[_-]?secret|secret[_-]?key|access[_-]?token|auth[_-]?token|password|passwd|senha)\b["']?\s*[:=]\s*["']?([^\s"',;]{8,200})/gi,
+    group: 1,
+    score: 0.7,
+    // Words and placeholders ("changeme", "<your-key>", "${API_KEY}") are not secrets.
+    valid: /* @__PURE__ */ __name((v) => entropy(v) >= 3 && !/^[<{$[]/.test(v) && !/^(?:x+|\*+|\.+)$/i.test(v), "valid")
+  }
+];
+function detectSecrets(text, types = SECRET_TYPES) {
+  const want = new Set(types);
+  const out = [];
+  for (const p of PATTERNS2) {
+    if (!want.has(p.type)) continue;
+    p.re.lastIndex = 0;
+    for (let m = p.re.exec(text); m; m = p.re.exec(text)) {
+      if (m[0].length === 0) {
+        p.re.lastIndex++;
+        continue;
+      }
+      const group = p.group ?? 0;
+      const value = m[group];
+      if (!value) continue;
+      if (p.valid && !p.valid(value)) continue;
+      const start = m.index + (group === 0 ? 0 : m[0].lastIndexOf(value));
+      out.push({
+        detector: "secrets",
+        category: `secret.${p.type}`,
+        start,
+        end: start + value.length,
+        score: p.score,
+        value,
+        spanned: true
+      });
+    }
+  }
+  return out;
+}
+__name(detectSecrets, "detectSecrets");
+
+// src/guardrails/detectors/injection.ts
+var W = String.raw`[\s\S]{0,40}?`;
+var INJECTION_SIGNALS = [
+  // Instruction override.
+  {
+    id: "ignore_previous",
+    re: new RegExp(String.raw`\b(?:ignore|disregard|forget|override|bypass|skip)\b${W}\b(?:all\s+|any\s+|the\s+|your\s+|my\s+)?(?:previous|prior|above|earlier|preceding|original|system|initial)\b${W}\b(?:instructions?|prompts?|rules?|directions?|guidelines?|messages?|context)\b`, "gi"),
+    weight: 0.75
+  },
+  {
+    id: "ignore_previous_pt",
+    re: new RegExp(String.raw`\b(?:ignore|ignora|desconsidere|desconsidera|esque[çc]a|esquece|descarte)\b${W}\b(?:as\s+|todas\s+as\s+|suas\s+|tuas\s+)?(?:instru[çc][õo]es|regras|orienta[çc][õo]es|mensagens|prompts?)\b${W}\b(?:anteriores|acima|pr[ée]vias|do\s+sistema|originais)\b`, "gi"),
+    weight: 0.75
+  },
+  {
+    id: "ignore_previous_es",
+    re: new RegExp(String.raw`\b(?:ignora|ignore|olvida|olvide|descarta)\b${W}\b(?:las\s+|todas\s+las\s+|tus\s+)?(?:instrucciones|reglas|indicaciones)\b${W}\b(?:anteriores|previas|del\s+sistema)\b`, "gi"),
+    weight: 0.75
+  },
+  {
+    id: "new_instructions",
+    re: /\b(?:new|updated|real|actual|true)\s+(?:system\s+)?instructions?\s*(?::|follow|are)|\bnovas\s+instru[çc][õo]es\s*:|\bnuevas\s+instrucciones\s*:/gi,
+    weight: 0.45
+  },
+  // Role hijack / persona jailbreaks.
+  {
+    id: "role_hijack",
+    re: /\b(?:you\s+are\s+now|from\s+now\s+on\s+you\s+(?:are|will)|act\s+as\s+(?:an?\s+)?(?:unrestricted|unfiltered|evil|jailbroken)|pretend\s+(?:to\s+be|you\s+are)\s+(?:an?\s+)?(?:unrestricted|unfiltered|different\s+ai)|a\s+partir\s+de\s+agora\s+voc[êe]\s+(?:[ée]|ser[áa])|voc[êe]\s+agora\s+[ée]|ahora\s+eres)\b/gi,
+    weight: 0.45
+  },
+  {
+    id: "jailbreak_persona",
+    re: /\b(?:DAN|do\s+anything\s+now|developer\s+mode|god\s+mode|jailbreak(?:ed)?|STAN|DUDE\s+mode|AIM\s+mode|no\s+(?:restrictions|filters|guidelines|limits)\s+mode|modo\s+desenvolvedor|sem\s+restri[çc][õo]es)\b/g,
+    weight: 0.55
+  },
+  // Prompt / secret extraction.
+  {
+    id: "prompt_leak",
+    re: /\b(?:reveal|print|show|repeat|output|display|leak|tell\s+me|write\s+out)\b[\s\S]{0,30}?\b(?:your|the)\s+(?:system\s+prompt|initial\s+(?:prompt|instructions)|hidden\s+(?:prompt|instructions)|instructions\s+above|developer\s+message)\b|\b(?:mostre|revele|repita|imprima)\b[\s\S]{0,30}?\b(?:seu|o)\s+prompt\s+(?:do\s+sistema|inicial)\b/gi,
+    weight: 0.6
+  },
+  // Role / delimiter spoofing: chat-template tokens and fake headers.
+  {
+    id: "role_tokens",
+    re: /<\|(?:im_start|im_end|system|endoftext|start_header_id|end_header_id|eot_id)\|>|\[\/?INST\]|<<\/?SYS>>|<\/?(?:system|assistant|developer)>|^\s*#{2,}\s*(?:system|assistant|developer)\s*(?:prompt|message)?\s*:?\s*$/gim,
+    weight: 0.55
+  },
+  {
+    id: "fake_system",
+    re: /^\s*(?:system|assistant|developer)\s*(?:message|prompt|note|override)?\s*:\s*\S/gim,
+    weight: 0.3
+  },
+  // Indirect injection aimed at the agent reading the content.
+  {
+    id: "addressed_to_ai",
+    re: /\b(?:(?:note|message|instructions?)\s+(?:to|for)\s+(?:the\s+)?(?:ai|assistant|llm|agent|model|chatbot)|(?:ai|assistant|llm|agent)s?\s*(?:reading|processing|summari[sz]ing)\s+this|if\s+you\s+are\s+an?\s+(?:ai|assistant|llm|language\s+model|agent)|aten[çc][ãa]o\s*,?\s*(?:ia|assistente|agente)|se\s+voc[êe]\s+[ée]\s+(?:uma\s+)?(?:ia|intelig[êe]ncia\s+artificial|assistente))\b/gi,
+    weight: 0.55
+  },
+  {
+    id: "tool_directive",
+    re: /\b(?:call|invoke|use|run|execute|chame|use|execute)\s+(?:the\s+|a\s+|o\s+|a\s+ferramenta\s+)?[`'"]?[\w-]+(?:__[\w-]+)[`'"]?\s*(?:tool|function|ferramenta)?|\b(?:send|forward|email|post|upload|exfiltrate|envie|encaminhe)\b[\s\S]{0,40}?\b(?:(?:all|every|the)\s+)?(?:(?:user'?s?|their|this|todos\s+os|os)\s+)?(?:emails?|files?|documents?|credentials?|passwords?|secrets?|tokens?|keys?|conversation|chat\s+history|dados|arquivos|senhas)\b[\s\S]{0,40}?\b(?:to|para)\s+\S+@\S+|\bto\s+https?:\/\//gi,
+    weight: 0.45
+  },
+  {
+    id: "secrecy",
+    re: /\b(?:do\s+not|don'?t|never)\s+(?:tell|inform|mention|reveal|show|alert|notify)\s+(?:this\s+to\s+)?(?:the\s+)?user\b|\bwithout\s+(?:telling|informing|notifying)\s+the\s+user\b|\bn[ãa]o\s+(?:conte|informe|mencione|avise)\s+(?:ao|o)\s+usu[áa]rio\b/gi,
+    weight: 0.5
+  },
+  // Exfiltration through rendered markdown/HTML.
+  {
+    id: "exfil_markdown",
+    re: /!\[[^\]]*\]\(\s*https?:\/\/[^)\s]+\?[^)\s]*=[^)\s]*(?:\{|%7B|\$|<)?[^)]*\)|<img\b[^>]*\bsrc\s*=\s*["']?https?:\/\/[^"'>\s]+\?[^"'>\s]*=/gi,
+    weight: 0.4
+  },
+  {
+    id: "html_comment_instructions",
+    re: /<!--[\s\S]{0,500}?\b(?:ignore|instruction|assistant|ai|agent|system|prompt|instru[çc][ãa]o|assistente)\b[\s\S]{0,500}?-->/gi,
+    weight: 0.45
+  }
+];
+var TAG_CHARS = /[\u{E0000}-\u{E007F}]+/gu;
+var BIDI = /[\u202A-\u202E\u2066-\u2069]/g;
+var ZERO_WIDTH_RUN = /[\u200B-\u200D\u2060\uFEFF]{3,}/g;
+function decodeBase64Ascii(b64) {
+  try {
+    return atob(b64);
+  } catch {
+    return void 0;
+  }
+}
+__name(decodeBase64Ascii, "decodeBase64Ascii");
+function decodeTagChars(s) {
+  let out = "";
+  for (const ch of s) {
+    const cp = ch.codePointAt(0) ?? 0;
+    if (cp >= 917536 && cp <= 917630) out += String.fromCharCode(cp - 917504);
+  }
+  return out;
+}
+__name(decodeTagChars, "decodeTagChars");
+function matchSignals(text, offset, into, weights) {
+  for (const s of INJECTION_SIGNALS) {
+    s.re.lastIndex = 0;
+    for (let m = s.re.exec(text); m; m = s.re.exec(text)) {
+      if (m[0].length === 0) {
+        s.re.lastIndex++;
+        continue;
+      }
+      weights.set(s.id, Math.max(weights.get(s.id) ?? 0, s.weight));
+      const list = into.get(s.id) ?? [];
+      list.push({
+        detector: "injection",
+        category: `injection.${s.id}`,
+        start: offset < 0 ? m.index : offset,
+        end: offset < 0 ? m.index + m[0].length : offset,
+        score: s.weight,
+        value: m[0],
+        spanned: offset < 0
+      });
+      into.set(s.id, list);
+    }
+  }
+}
+__name(matchSignals, "matchSignals");
+function scoreInjection(text, threshold = 0.5) {
+  const byId = /* @__PURE__ */ new Map();
+  const weights = /* @__PURE__ */ new Map();
+  matchSignals(text, -1, byId, weights);
+  TAG_CHARS.lastIndex = 0;
+  for (let m = TAG_CHARS.exec(text); m; m = TAG_CHARS.exec(text)) {
+    weights.set("hidden_unicode", 0.8);
+    const list = byId.get("hidden_unicode") ?? [];
+    list.push({
+      detector: "injection",
+      category: "injection.hidden_unicode",
+      start: m.index,
+      end: m.index + m[0].length,
+      score: 0.8,
+      value: m[0],
+      spanned: true
+    });
+    byId.set("hidden_unicode", list);
+    const decoded = decodeTagChars(m[0]);
+    if (decoded) matchSignals(decoded, m.index, byId, weights);
+  }
+  for (const re of [
+    BIDI,
+    ZERO_WIDTH_RUN
+  ]) {
+    re.lastIndex = 0;
+    for (let m = re.exec(text); m; m = re.exec(text)) {
+      weights.set("invisible_chars", Math.max(weights.get("invisible_chars") ?? 0, 0.3));
+      const list = byId.get("invisible_chars") ?? [];
+      list.push({
+        detector: "injection",
+        category: "injection.invisible_chars",
+        start: m.index,
+        end: m.index + m[0].length,
+        score: 0.3,
+        value: m[0],
+        spanned: true
+      });
+      byId.set("invisible_chars", list);
+    }
+  }
+  const B64 = /(?<![A-Za-z0-9+/=])[A-Za-z0-9+/]{40,}={0,2}(?![A-Za-z0-9+/=])/g;
+  for (let m = B64.exec(text); m; m = B64.exec(text)) {
+    const decoded = decodeBase64Ascii(m[0]);
+    if (decoded === void 0) continue;
+    if (!/^[\x20-\x7E\s]+$/.test(decoded)) continue;
+    const inner = /* @__PURE__ */ new Map();
+    const innerWeights = /* @__PURE__ */ new Map();
+    matchSignals(decoded, m.index, inner, innerWeights);
+    if (innerWeights.size > 0) {
+      weights.set("encoded_instructions", 0.6);
+      byId.set("encoded_instructions", [
+        {
+          detector: "injection",
+          category: "injection.encoded_instructions",
+          start: m.index,
+          end: m.index + m[0].length,
+          score: 0.6,
+          value: m[0],
+          spanned: true
+        }
+      ]);
+    }
+  }
+  let keep = 1;
+  for (const w of weights.values()) keep *= 1 - w;
+  const score = Math.round((1 - keep) * 1e3) / 1e3;
+  if (score < threshold) return {
+    score,
+    findings: []
+  };
+  const findings = [
+    ...byId.values()
+  ].flat().map((f) => ({
+    ...f,
+    score: Math.max(f.score, score)
+  }));
+  return {
+    score,
+    findings
+  };
+}
+__name(scoreInjection, "scoreInjection");
+
+// src/guardrails/detectors/tool-poisoning.ts
+var POISON_SIGNALS = [
+  {
+    id: "important_tag",
+    re: /<\s*\/?\s*(?:important|system|instructions?|secret|hidden|critical)\s*>/gi,
+    weight: 0.55
+  },
+  {
+    id: "sensitive_files",
+    re: /(?:~\/\.ssh|id_rsa|id_ed25519|\.aws\/credentials|\.env\b|mcp\.json|\.netrc|\.npmrc|\.pypirc|\.git-credentials|\/etc\/passwd|\/etc\/shadow|kubeconfig|\.kube\/config|credentials\.json|cookies\.sqlite|wallet\.dat)/gi,
+    weight: 0.65
+  },
+  {
+    id: "read_before_use",
+    re: /\b(?:before|prior\s+to)\s+(?:using|calling|invoking|running)\s+(?:this|any|the)\s+(?:tool|function)\b[\s\S]{0,80}?\b(?:read|open|cat|fetch|call|send|include|pass|load)\b/gi,
+    weight: 0.5
+  },
+  {
+    id: "hidden_parameter",
+    re: /\b(?:pass|put|include|add|send|store)\b[\s\S]{0,40}?\b(?:content|contents|value|output|result|key|token|file)s?\b[\s\S]{0,40}?\b(?:as|in|into)\s+(?:the\s+)?[`'"]?(?:sidenote|side_note|note|notes|metadata|context|extra|comment|debug)[`'"]?\b/gi,
+    weight: 0.55
+  },
+  {
+    id: "cross_tool",
+    re: /\b(?:when|whenever|if)\s+(?:the\s+)?[`'"]?[\w.-]+[`'"]?\s+(?:tool|function)\s+is\s+(?:called|used|invoked)\b|\b(?:instead\s+of|rather\s+than)\s+(?:calling|using)\s+(?:the\s+)?[`'"]?[\w.-]+[`'"]?\s*(?:tool|function)?\b|\b(?:all|every)\s+(?:emails?|messages?)\s+(?:must|should)\s+(?:be\s+)?(?:sent|forwarded|bcc'?d|cc'?d)\s+to\b/gi,
+    weight: 0.5
+  },
+  {
+    id: "override_behaviour",
+    re: /\b(?:this\s+(?:tool|instruction)\s+(?:takes|has)\s+(?:precedence|priority)|overrides?\s+(?:all\s+)?(?:other|previous)\s+(?:tools?|instructions?)|very\s+(?:very\s+)?important\s*:?|you\s+must\s+(?:always|first|never))\b/gi,
+    weight: 0.35
+  }
+];
+var LONG_DESCRIPTION = 2e3;
+function scoreToolText(text, threshold = 0.5) {
+  const weights = /* @__PURE__ */ new Map();
+  const findings = [];
+  for (const s of POISON_SIGNALS) {
+    s.re.lastIndex = 0;
+    for (let m = s.re.exec(text); m; m = s.re.exec(text)) {
+      weights.set(s.id, s.weight);
+      findings.push({
+        detector: "tool_poisoning",
+        category: `tool_poisoning.${s.id}`,
+        start: m.index,
+        end: m.index + m[0].length,
+        score: s.weight,
+        value: m[0],
+        spanned: true
+      });
+    }
+  }
+  const injection = scoreInjection(text, 0);
+  for (const f of injection.findings) {
+    const id = f.category.slice("injection.".length);
+    const sig = INJECTION_SIGNALS.find((s) => s.id === id);
+    weights.set(`inj:${id}`, sig?.weight ?? f.score);
+    findings.push({
+      ...f,
+      detector: "tool_poisoning",
+      category: `tool_poisoning.${id}`
+    });
+  }
+  if (text.length > LONG_DESCRIPTION) weights.set("long_description", 0.2);
+  let keep = 1;
+  for (const w of weights.values()) keep *= 1 - w;
+  const score = Math.round((1 - keep) * 1e3) / 1e3;
+  return score >= threshold ? {
+    score,
+    findings
+  } : {
+    score,
+    findings: []
+  };
+}
+__name(scoreToolText, "scoreToolText");
+function toolText(tool) {
+  const parts = [];
+  if (tool.title) parts.push(tool.title);
+  if (tool.description) parts.push(tool.description);
+  const walk = /* @__PURE__ */ __name((schema, depth) => {
+    if (!schema || typeof schema !== "object" || depth > 6) return;
+    const s = schema;
+    if (typeof s.description === "string") parts.push(s.description);
+    if (typeof s.title === "string") parts.push(s.title);
+    for (const key of [
+      "properties",
+      "definitions",
+      "$defs"
+    ]) {
+      const props = s[key];
+      if (props && typeof props === "object") for (const [name, child] of Object.entries(props)) {
+        parts.push(name);
+        walk(child, depth + 1);
+      }
+    }
+    for (const key of [
+      "items",
+      "additionalProperties"
+    ]) walk(s[key], depth + 1);
+    for (const key of [
+      "anyOf",
+      "oneOf",
+      "allOf"
+    ]) {
+      const list = s[key];
+      if (Array.isArray(list)) for (const child of list) walk(child, depth + 1);
+    }
+    if (Array.isArray(s.enum)) {
+      for (const e of s.enum) if (typeof e === "string") parts.push(e);
+    }
+    if (typeof s.default === "string") parts.push(s.default);
+  }, "walk");
+  walk(tool.inputSchema, 0);
+  return parts.join("\n");
+}
+__name(toolText, "toolText");
+
+// src/guardrails/detectors/custom.ts
+function compileFlagged(pattern) {
+  return pattern.startsWith("(?i)") ? new RegExp(pattern.slice(4), "i") : new RegExp(pattern);
+}
+__name(compileFlagged, "compileFlagged");
+var compiled = /* @__PURE__ */ new Map();
+function compileGuardPattern(pattern) {
+  let re = compiled.get(pattern);
+  if (!re) {
+    const base = compileFlagged(pattern);
+    re = new RegExp(base.source, `${base.flags.replace("g", "")}g`);
+    if (compiled.size > 5e3) compiled.clear();
+    compiled.set(pattern, re);
+  }
+  return re;
+}
+__name(compileGuardPattern, "compileGuardPattern");
+function detectRegex(text, patterns, label = "custom") {
+  const out = [];
+  for (const p of patterns) {
+    let re;
+    try {
+      re = compileGuardPattern(p);
+    } catch {
+      continue;
+    }
+    re.lastIndex = 0;
+    let guard = 0;
+    for (let m = re.exec(text); m && guard < 1e3; m = re.exec(text), guard++) {
+      if (m[0].length === 0) {
+        re.lastIndex++;
+        continue;
+      }
+      out.push({
+        detector: "regex",
+        category: `regex.${label}`,
+        start: m.index,
+        end: m.index + m[0].length,
+        score: 1,
+        value: m[0],
+        spanned: true
+      });
+    }
+  }
+  return out;
+}
+__name(detectRegex, "detectRegex");
+var COMBINING = /[\u0300-\u036f]/g;
+function fold(s) {
+  let out = "";
+  for (const ch of s) {
+    const base = ch.normalize("NFD").replace(COMBINING, "");
+    const c = (base.length === ch.length ? base : ch).toLowerCase();
+    out += c.length === ch.length ? c : ch;
+  }
+  return out;
+}
+__name(fold, "fold");
+var escapeRe = /* @__PURE__ */ __name((s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "escapeRe");
+function detectKeywords(text, words, label = "keywords") {
+  const clean = words.map((w) => fold(w.trim())).filter(Boolean);
+  if (clean.length === 0) return [];
+  const re = new RegExp(`(?<![\\p{L}\\p{N}_])(?:${clean.map(escapeRe).join("|")})(?![\\p{L}\\p{N}_])`, "gu");
+  const folded = fold(text);
+  const out = [];
+  for (let m = re.exec(folded); m; m = re.exec(folded)) {
+    out.push({
+      detector: "keywords",
+      category: `keywords.${label}`,
+      start: m.index,
+      end: m.index + m[0].length,
+      score: 1,
+      value: text.slice(m.index, m.index + m[0].length),
+      spanned: true
+    });
+  }
+  return out;
+}
+__name(detectKeywords, "detectKeywords");
+
+// src/guardrails/glob.ts
+var cache = /* @__PURE__ */ new Map();
+function globToRegExp(pattern) {
+  let re = cache.get(pattern);
+  if (!re) {
+    const body = pattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*").replace(/\?/g, ".");
+    re = new RegExp(`^${body}$`);
+    cache.set(pattern, re);
+  }
+  return re;
+}
+__name(globToRegExp, "globToRegExp");
+function matchesAny(value, patterns) {
+  if (!patterns || patterns.length === 0) return true;
+  return patterns.some((p) => globToRegExp(p).test(value));
+}
+__name(matchesAny, "matchesAny");
+
+// src/guardrails/vault.ts
+var Vault = class _Vault {
+  static {
+    __name(this, "Vault");
+  }
+  byValue = /* @__PURE__ */ new Map();
+  byToken = /* @__PURE__ */ new Map();
+  counters = /* @__PURE__ */ new Map();
+  /**
+  * Placeholder for `value` under `label` (e.g. `CREDIT_CARD`). Reversible placeholders look like
+  * `[CREDIT_CARD_1]`; one-way ones (tool results, answers, rules with `restore: false`) like
+  * `[REDACTED_CREDIT_CARD_1]`, so they can never be mistaken for a reversible one.
+  */
+  tokenFor(label, value, restorable) {
+    const ns = restorable ? label : `REDACTED_${label}`;
+    const key = `${ns}\0${value}`;
+    const existing = this.byValue.get(key);
+    if (existing) return existing;
+    const n = (this.counters.get(ns) ?? 0) + 1;
+    this.counters.set(ns, n);
+    const token = `[${ns}_${n}]`;
+    this.byValue.set(key, token);
+    this.byToken.set(token, {
+      value,
+      restorable
+    });
+    return token;
+  }
+  get size() {
+    return this.byToken.size;
+  }
+  get restorableCount() {
+    let n = 0;
+    for (const e of this.byToken.values()) if (e.restorable) n++;
+    return n;
+  }
+  /** Longest placeholder, for stream hold-back windows. */
+  get maxTokenLength() {
+    let n = 0;
+    for (const t of this.byToken.keys()) n = Math.max(n, t.length);
+    return n;
+  }
+  /** Puts restorable values back. `jsonString`: the text is inside a JSON string literal. */
+  restore(text, jsonString = false) {
+    if (this.byToken.size === 0 || !text.includes("[")) return text;
+    return text.replace(/\[([A-Z][A-Z0-9_]*_\d+)\]/g, (whole) => {
+      const entry = this.byToken.get(whole);
+      if (!entry?.restorable) return whole;
+      return jsonString ? JSON.stringify(entry.value).slice(1, -1) : entry.value;
+    });
+  }
+  /** Whether `text` ends with what could be the beginning of a placeholder (streaming). */
+  pendingPrefix(text) {
+    const i = text.lastIndexOf("[");
+    if (i === -1) return 0;
+    const tail = text.slice(i);
+    if (tail.length > this.maxTokenLength) return 0;
+    return /^\[[A-Z0-9_]*$/.test(tail) ? tail.length : 0;
+  }
+  /** Every entry, in the order the placeholders were minted. */
+  toJSON() {
+    return {
+      entries: [
+        ...this.byToken
+      ].map(([token, e]) => ({
+        token,
+        value: e.value,
+        restorable: e.restorable
+      }))
+    };
+  }
+  /** Rebuilds a vault from {@link toJSON}; placeholders keep their numbers and counters resume. */
+  static fromJSON(snapshot) {
+    const vault = new _Vault();
+    for (const { token, value, restorable } of snapshot.entries) {
+      const m = /^\[([A-Z][A-Z0-9_]*)_(\d+)\]$/.exec(token);
+      if (!m) continue;
+      const ns = m[1] ?? "";
+      const n = Number(m[2]);
+      vault.byValue.set(`${ns}\0${value}`, token);
+      vault.byToken.set(token, {
+        value,
+        restorable
+      });
+      vault.counters.set(ns, Math.max(vault.counters.get(ns) ?? 0, n));
+    }
+    return vault;
+  }
+};
+function labelFor(category) {
+  const tail = category.includes(".") ? category.slice(category.indexOf(".") + 1) : category;
+  const label = tail.replace(/[^A-Za-z0-9]+/g, "_").toUpperCase();
+  return label || "REDACTED";
+}
+__name(labelFor, "labelFor");
+
+// src/guardrails/engine.ts
+var DEFAULT_MESSAGES = {
+  llm_request: "This message was blocked by your organization's AI guardrails.",
+  llm_response: "The answer was withheld by your organization's AI guardrails.",
+  tool_args: "This tool call was blocked by your organization's AI guardrails.",
+  tool_result: "The tool's result was withheld by your organization's AI guardrails.",
+  tool_description: "This tool was quarantined by your organization's AI guardrails."
+};
+var DEFAULT_APPROVAL_MESSAGE = "This needs approval under your organization's AI guardrails before it can go ahead.";
+var INJECTION_REPLACEMENT = "[removed: suspected prompt injection]";
+var ruleName = /* @__PURE__ */ __name((rule) => rule.name ?? rule.id, "ruleName");
+function ruleApplies(rule, ctx) {
+  if (rule.enabled === false || !rule.stages.includes(ctx.stage)) return false;
+  const tools = rule.match?.tools;
+  if (tools?.length) {
+    const toolStage = ctx.stage === "tool_args" || ctx.stage === "tool_result" || ctx.stage === "tool_description";
+    if (!toolStage || !matchesAny(ctx.tool ?? "", tools)) return false;
+  }
+  return rule.when === void 0 || rule.when(ctx);
+}
+__name(ruleApplies, "ruleApplies");
+function orderRules(rules) {
+  return [
+    ...rules
+  ].sort((a, b) => (a.priority ?? 100) - (b.priority ?? 100) || ruleName(a).localeCompare(ruleName(b)));
+}
+__name(orderRules, "orderRules");
+async function runDetector(spec, text, ctx) {
+  if (!text) return [];
+  switch (spec.kind) {
+    case "pii":
+      return detectPii(text, spec.types?.length ? spec.types : void 0);
+    case "secrets":
+      return detectSecrets(text, spec.types?.length ? spec.types : void 0);
+    case "injection":
+      return scoreInjection(text, spec.threshold ?? 0.5).findings;
+    case "tool_poisoning":
+      return scoreToolText(text, spec.threshold ?? 0.5).findings;
+    case "regex":
+      return detectRegex(text, spec.patterns, spec.label ?? "custom");
+    case "keywords":
+      return detectKeywords(text, spec.words, spec.label ?? "keywords");
+    case "custom":
+      return spec.detect(text, ctx);
+  }
+}
+__name(runDetector, "runDetector");
+function spanLocator(rules) {
+  const specs = rules.flatMap((r) => r.detectors).filter((d) => d.kind !== "custom" && d.kind !== "tool_poisoning");
+  if (specs.length === 0) return void 0;
+  return (text) => specs.flatMap((d) => {
+    switch (d.kind) {
+      case "pii":
+        return detectPii(text, d.types?.length ? d.types : void 0);
+      case "secrets":
+        return detectSecrets(text, d.types?.length ? d.types : void 0);
+      case "regex":
+        return detectRegex(text, d.patterns);
+      case "keywords":
+        return detectKeywords(text, d.words);
+      case "injection":
+        return scoreInjection(text, 0).findings;
+      default:
+        return [];
+    }
+  });
+}
+__name(spanLocator, "spanLocator");
+function resolveOverlaps(findings, text) {
+  const sorted = [
+    ...findings
+  ].filter((f) => f.spanned !== false && f.end > f.start).sort((a, b) => a.start - b.start || b.end - a.end || b.score - a.score);
+  const out = [];
+  for (const f of sorted) {
+    const last = out[out.length - 1];
+    if (!last || f.start >= last.end) {
+      out.push({
+        ...f
+      });
+      continue;
+    }
+    const longer = f.end - f.start > last.end - last.start || f.end - f.start === last.end - last.start && f.score > last.score ? f : last;
+    const merged = {
+      ...longer,
+      start: last.start,
+      end: Math.max(last.end, f.end)
+    };
+    if (text !== void 0) merged.value = text.slice(merged.start, merged.end);
+    out[out.length - 1] = merged;
+  }
+  return out;
+}
+__name(resolveOverlaps, "resolveOverlaps");
+function replacementFor(f, vault, restorable) {
+  if (f.replacement !== void 0) return f.replacement;
+  if (f.detector === "injection" || f.detector === "tool_poisoning") return INJECTION_REPLACEMENT;
+  return vault.tokenFor(labelFor(f.category), f.value, restorable);
+}
+__name(replacementFor, "replacementFor");
+function applyRedactions(text, findings, vault, restorable) {
+  const whole = findings.find((f) => f.spanned === false);
+  if (whole) {
+    return {
+      text: whole.replacement ?? `[removed: ${whole.category}]`,
+      count: 1
+    };
+  }
+  const spans = resolveOverlaps(findings, text);
+  if (spans.length === 0) return {
+    text,
+    count: 0
+  };
+  let out = "";
+  let at = 0;
+  for (const f of spans) {
+    out += text.slice(at, f.start) + replacementFor(f, vault, restorable);
+    at = f.end;
+  }
+  return {
+    text: out + text.slice(at),
+    count: spans.length
+  };
+}
+__name(applyRedactions, "applyRedactions");
+function memoKey(spec) {
+  return spec.kind === "custom" ? `custom\0${spec.name}` : JSON.stringify(spec);
+}
+__name(memoKey, "memoKey");
+async function scan(rules, ctx, segments, vault = new Vault(), options = {}) {
+  const started = performance.now();
+  const applicable = orderRules(rules).filter((r) => ruleApplies(r, ctx));
+  const result = {
+    stage: ctx.stage,
+    action: "allow",
+    segments: segments.map((s) => s.text),
+    changed: false,
+    hits: [],
+    vault,
+    redactions: 0,
+    latencyMs: 0
+  };
+  if (applicable.length === 0 || segments.length === 0) {
+    result.latencyMs = performance.now() - started;
+    return result;
+  }
+  const stageMessage = options.messages?.[ctx.stage] ?? DEFAULT_MESSAGES[ctx.stage];
+  const restorableStage = (options.restorableStages ?? [
+    "llm_request"
+  ]).includes(ctx.stage);
+  const memo = /* @__PURE__ */ new Map();
+  const detect = /* @__PURE__ */ __name((spec, index) => {
+    const key = `${index}\0${memoKey(spec)}`;
+    let p = memo.get(key);
+    if (!p) {
+      p = Promise.resolve().then(() => runDetector(spec, segments[index]?.text ?? "", ctx));
+      memo.set(key, p);
+    }
+    return p;
+  }, "detect");
+  const outcomes = [];
+  for (const rule of applicable) {
+    const sources = rule.match?.sources;
+    const indexes = segments.map((s, i) => ({
+      s,
+      i
+    })).filter(({ s }) => !sources?.length || !s.source || sources.includes(s.source)).map(({ i }) => i);
+    const outcome = {
+      rule,
+      bySegment: /* @__PURE__ */ new Map()
+    };
+    if (rule.detectors.length === 0) {
+      if (rule.action === "allow" || rule.action === "block" || rule.action === "approve") outcomes.push(outcome);
+      if (rule.action === "allow") break;
+      continue;
+    }
+    const jobs = rule.detectors.flatMap((spec) => indexes.map(async (i) => ({
+      i,
+      found: await detect(spec, i)
+    })));
+    const settled = await Promise.allSettled(jobs);
+    for (const s of settled) {
+      if (s.status === "rejected") {
+        outcome.failed = s.reason?.message ?? String(s.reason);
+        continue;
+      }
+      if (s.value.found.length === 0) continue;
+      const list = outcome.bySegment.get(s.value.i) ?? [];
+      list.push(...s.value.found);
+      outcome.bySegment.set(s.value.i, list);
+    }
+    if (outcome.bySegment.size === 0 && !outcome.failed) continue;
+    outcomes.push(outcome);
+    if (rule.action === "allow" && outcome.bySegment.size > 0) break;
+  }
+  const redactBySegment = /* @__PURE__ */ new Map();
+  for (const o of outcomes) {
+    const { rule } = o;
+    const name = ruleName(rule);
+    const failMode = rule.options?.failMode ?? "open";
+    let action = rule.action;
+    if (o.failed) {
+      result.hits.push({
+        ruleId: rule.id,
+        ruleName: name,
+        action: failMode === "closed" ? "block" : "log",
+        detector: "detector_error",
+        category: "error.detector_unavailable",
+        score: 0,
+        count: 1,
+        values: [],
+        fresh: true,
+        error: o.failed.slice(0, 300),
+        failMode
+      });
+      if (failMode === "closed" && o.bySegment.size === 0) action = "block";
+      else if (o.bySegment.size === 0) continue;
+    }
+    const historyOnly = (action === "block" || action === "approve") && o.bySegment.size > 0 && [
+      ...o.bySegment.keys()
+    ].every((i) => segments[i]?.fresh === false);
+    if (historyOnly) {
+      action = "redact";
+      for (const [i, findings] of o.bySegment) {
+        const entry = redactBySegment.get(i) ?? {
+          findings: [],
+          restorable: false
+        };
+        entry.findings.push(...findings);
+        redactBySegment.set(i, entry);
+      }
+    }
+    if (ACTION_SEVERITY[action] > ACTION_SEVERITY[result.action]) {
+      result.action = action;
+      if (action === "block" || action === "approve") {
+        result.decisive = {
+          id: rule.id,
+          name,
+          message: rule.options?.message || (o.failed && o.bySegment.size === 0 ? `${stageMessage} (a required check could not run)` : action === "approve" ? options.approvalMessage ?? DEFAULT_APPROVAL_MESSAGE : stageMessage)
+        };
+      }
+    }
+    if (o.bySegment.size === 0 && rule.detectors.length === 0) {
+      result.hits.push({
+        ruleId: rule.id,
+        ruleName: name,
+        action,
+        detector: "scope",
+        category: "scope.match",
+        score: 1,
+        count: 1,
+        values: [],
+        fresh: true
+      });
+      continue;
+    }
+    const grouped = /* @__PURE__ */ new Map();
+    for (const [i, findings] of o.bySegment) {
+      for (const f of findings) {
+        const hit = grouped.get(f.category) ?? {
+          ruleId: rule.id,
+          ruleName: name,
+          action,
+          detector: f.detector,
+          category: f.category,
+          score: 0,
+          count: 0,
+          values: [],
+          fresh: false
+        };
+        hit.count++;
+        hit.score = Math.max(hit.score, f.score);
+        if (f.value && !hit.values.includes(f.value) && hit.values.length < 20) hit.values.push(f.value);
+        if (segments[i]?.fresh !== false) hit.fresh = true;
+        grouped.set(f.category, hit);
+      }
+      if (action === "redact" && !historyOnly) {
+        const entry = redactBySegment.get(i) ?? {
+          findings: [],
+          restorable: false
+        };
+        entry.findings.push(...findings);
+        entry.restorable ||= restorableStage && rule.options?.restore !== false;
+        redactBySegment.set(i, entry);
+      }
+    }
+    result.hits.push(...grouped.values());
+  }
+  if (result.action !== "block" && result.action !== "approve") {
+    for (const [i, { findings, restorable }] of redactBySegment) {
+      const original = segments[i]?.text ?? "";
+      const { text, count } = applyRedactions(original, findings, vault, restorable);
+      if (count > 0 && text !== original) {
+        result.segments[i] = text;
+        result.redactions += count;
+        result.changed = true;
+      }
+    }
+  }
+  result.latencyMs = performance.now() - started;
+  return result;
+}
+__name(scan, "scan");
+
+// src/guardrails/segments.ts
+var MAX_SLOTS = 2e3;
+function sourceOf(role) {
+  if (role === "system" || role === "developer") return "system";
+  if (role === "assistant") return "assistant";
+  if (role === "tool" || role === "function") return "tool";
+  return "user";
+}
+__name(sourceOf, "sourceOf");
+function freshFrom(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) if (messages[i]?.role === "assistant") return i + 1;
+  return 0;
+}
+__name(freshFrom, "freshFrom");
+function jsonSlots(root, source, fresh, replaceRoot) {
+  const out = [];
+  const walk = /* @__PURE__ */ __name((value, set, depth) => {
+    if (out.length >= MAX_SLOTS || depth > 10) return;
+    if (typeof value === "string") {
+      if (value) out.push({
+        segment: {
+          text: value,
+          source,
+          fresh
+        },
+        set
+      });
+      return;
+    }
+    if (Array.isArray(value)) {
+      for (let i = 0; i < value.length; i++) {
+        walk(value[i], (t) => {
+          value[i] = t;
+        }, depth + 1);
+      }
+      return;
+    }
+    if (value && typeof value === "object") {
+      const o = value;
+      for (const k of Object.keys(o)) walk(o[k], (t) => {
+        o[k] = t;
+      }, depth + 1);
+    }
+  }, "walk");
+  walk(root, replaceRoot ?? (() => void 0), 0);
+  return out;
+}
+__name(jsonSlots, "jsonSlots");
+function jsonStringSlot(holder, key, source, fresh) {
+  const v = holder[key];
+  if (typeof v !== "string" || !v) return [];
+  return [
+    {
+      segment: {
+        text: v,
+        source,
+        fresh
+      },
+      set: /* @__PURE__ */ __name((t) => {
+        holder[key] = t;
+      }, "set"),
+      json: true
+    }
+  ];
+}
+__name(jsonStringSlot, "jsonStringSlot");
+function contentSlots(holder, source, fresh) {
+  const content = holder.content;
+  if (typeof content === "string") {
+    return content ? [
+      {
+        segment: {
+          text: content,
+          source,
+          fresh
+        },
+        set: /* @__PURE__ */ __name((t) => {
+          holder.content = t;
+        }, "set")
+      }
+    ] : [];
+  }
+  if (!Array.isArray(content)) return [];
+  const out = [];
+  for (const part of content) {
+    if (!part || typeof part !== "object") continue;
+    const p = part;
+    if ((p.type === "text" || p.type === "input_text" || p.type === "output_text") && typeof p.text === "string") {
+      out.push({
+        segment: {
+          text: p.text,
+          source,
+          fresh
+        },
+        set: /* @__PURE__ */ __name((t) => {
+          p.text = t;
+        }, "set")
+      });
+    } else if (p.type === "tool_result") {
+      out.push(...contentSlots(p, "tool", fresh));
+    } else if (p.type === "tool_use" && p.input && typeof p.input === "object") {
+      out.push(...jsonSlots(p.input, "assistant", fresh));
+    }
+  }
+  return out;
+}
+__name(contentSlots, "contentSlots");
+function requestSlots(api, body) {
+  const out = [];
+  if (api === "anthropic") {
+    if (typeof body.system === "string" && body.system) {
+      out.push({
+        segment: {
+          text: body.system,
+          source: "system",
+          fresh: true
+        },
+        set: /* @__PURE__ */ __name((t) => {
+          body.system = t;
+        }, "set")
+      });
+    } else if (Array.isArray(body.system)) {
+      out.push(...contentSlots({
+        content: body.system
+      }, "system", true));
+    }
+  }
+  if (Array.isArray(body.messages)) {
+    const messages = body.messages;
+    const from = freshFrom(messages);
+    messages.forEach((m, i) => {
+      if (!m || typeof m !== "object") return;
+      const fresh = i >= from || m.role === "system";
+      const source = sourceOf(m.role);
+      out.push(...contentSlots(m, source, fresh));
+      if (Array.isArray(m.tool_calls)) {
+        for (const call of m.tool_calls) if (call?.function) out.push(...jsonStringSlot(call.function, "arguments", "assistant", fresh));
+      }
+    });
+  }
+  if (typeof body.input === "string" || Array.isArray(body.input)) {
+    const holder = body;
+    if (typeof holder.input === "string") {
+      out.push({
+        segment: {
+          text: holder.input,
+          source: "user",
+          fresh: true
+        },
+        set: /* @__PURE__ */ __name((t) => {
+          holder.input = t;
+        }, "set")
+      });
+    } else {
+      const list = holder.input;
+      list.forEach((v, i) => {
+        if (typeof v === "string" && v) out.push({
+          segment: {
+            text: v,
+            source: "user",
+            fresh: true
+          },
+          set: /* @__PURE__ */ __name((t) => {
+            list[i] = t;
+          }, "set")
+        });
+      });
+    }
+  }
+  return out.slice(0, MAX_SLOTS);
+}
+__name(requestSlots, "requestSlots");
+function responseSlots(api, body) {
+  if (!body || typeof body !== "object") return [];
+  const b = body;
+  const out = [];
+  if (api === "anthropic") {
+    if (Array.isArray(b.content)) out.push(...contentSlots(b, "assistant", true));
+    return out;
+  }
+  for (const choice of Array.isArray(b.choices) ? b.choices : []) {
+    const msg = choice?.message;
+    if (!msg || typeof msg !== "object") continue;
+    out.push(...contentSlots(msg, "assistant", true));
+    if (Array.isArray(msg.tool_calls)) {
+      for (const call of msg.tool_calls) if (call?.function) out.push(...jsonStringSlot(call.function, "arguments", "assistant", true));
+    }
+  }
+  return out;
+}
+__name(responseSlots, "responseSlots");
+function refuseResponse(api, body, message) {
+  if (!body || typeof body !== "object") return body;
+  const b = body;
+  if (api === "anthropic") {
+    return {
+      ...b,
+      content: [
+        {
+          type: "text",
+          text: message
+        }
+      ],
+      stop_reason: "refusal"
+    };
+  }
+  return {
+    ...b,
+    choices: (Array.isArray(b.choices) && b.choices.length > 0 ? b.choices : [
+      {
+        index: 0
+      }
+    ]).map((c) => ({
+      ...c,
+      message: {
+        role: "assistant",
+        content: message
+      },
+      finish_reason: "content_filter"
+    }))
+  };
+}
+__name(refuseResponse, "refuseResponse");
+function toolResultSlots(result) {
+  const out = [];
+  if (Array.isArray(result.content)) {
+    for (const item of result.content) {
+      if (!item || typeof item !== "object") continue;
+      if (item.type === "text" && typeof item.text === "string") {
+        out.push({
+          segment: {
+            text: item.text,
+            source: "tool",
+            fresh: true
+          },
+          set: /* @__PURE__ */ __name((t) => {
+            item.text = t;
+          }, "set")
+        });
+      } else if (item.type === "resource" && item.resource && typeof item.resource.text === "string") {
+        out.push({
+          segment: {
+            text: item.resource.text,
+            source: "tool",
+            fresh: true
+          },
+          set: /* @__PURE__ */ __name((t) => {
+            item.resource.text = t;
+          }, "set")
+        });
+      }
+    }
+  }
+  if (result.structuredContent && typeof result.structuredContent === "object") out.push(...jsonSlots(result.structuredContent, "tool", true));
+  return out.slice(0, MAX_SLOTS);
+}
+__name(toolResultSlots, "toolResultSlots");
+
+// src/guardrails/stream-guard.ts
+var Channel = class Channel2 {
+  static {
+    __name(this, "Channel");
+  }
+  json;
+  pending = "";
+  constructor(json) {
+    this.json = json;
+  }
+};
+var StreamGuard = class {
+  static {
+    __name(this, "StreamGuard");
+  }
+  opts;
+  buffer = "";
+  decoder = new TextDecoder();
+  channels = /* @__PURE__ */ new Map();
+  window;
+  holdback;
+  blocked;
+  template;
+  openBlocks = /* @__PURE__ */ new Set();
+  maxBlock = -1;
+  done = false;
+  constructor(opts) {
+    this.opts = opts;
+    this.window = opts.window ?? 256;
+    this.holdback = opts.holdback ?? 64;
+  }
+  /** Whether the guard changes anything (else the caller can pass bytes straight through). */
+  get active() {
+    return !!this.opts.scan || this.opts.restore && this.opts.vault.restorableCount > 0;
+  }
+  async push(chunk) {
+    this.buffer += typeof chunk === "string" ? chunk : this.decoder.decode(chunk, {
+      stream: true
+    });
+    let out = "";
+    for (; ; ) {
+      const m = /\r?\n\r?\n/.exec(this.buffer);
+      if (!m) break;
+      const raw = this.buffer.slice(0, m.index + m[0].length);
+      this.buffer = this.buffer.slice(m.index + m[0].length);
+      out += await this.frame(parseFrame(raw));
+    }
+    return out;
+  }
+  async end() {
+    let out = "";
+    if (this.buffer.trim()) out += await this.frame(parseFrame(`${this.buffer}
+
+`));
+    this.buffer = "";
+    if (!this.blocked && !this.done) out += await this.flushAll();
+    return out;
+  }
+  async frame(f) {
+    if (this.blocked) return "";
+    if (this.opts.api === "openai") return this.openaiFrame(f);
+    return this.anthropicFrame(f);
+  }
+  // ---- OpenAI chat-completion chunks ---------------------------------------------------------
+  async openaiFrame(f) {
+    if (!f.data) return f.raw;
+    if (f.data.trim() === "[DONE]") {
+      const tail = await this.flushAll();
+      this.done = true;
+      return tail + f.raw;
+    }
+    let chunk;
+    try {
+      chunk = JSON.parse(f.data);
+    } catch {
+      return f.raw;
+    }
+    this.template ??= {
+      id: chunk.id,
+      object: chunk.object,
+      created: chunk.created,
+      model: chunk.model
+    };
+    if (!Array.isArray(chunk.choices) || chunk.choices.length === 0) return f.raw;
+    let prefix = "";
+    let keep = false;
+    for (const choice of chunk.choices) {
+      const delta = choice.delta ?? {};
+      const ci = choice.index ?? 0;
+      if (typeof delta.content === "string" && delta.content) {
+        const r = await this.feed(`c:${ci}`, delta.content, false);
+        if (this.blocked) return prefix + this.openaiBlock(ci);
+        delta.content = r;
+        if (r) keep = true;
+      }
+      if (Array.isArray(delta.tool_calls)) {
+        for (const call of delta.tool_calls) {
+          const fn = call.function;
+          if (fn && typeof fn.arguments === "string" && fn.arguments) {
+            const r = await this.feed(`t:${ci}:${call.index ?? 0}`, fn.arguments, true);
+            if (this.blocked) return prefix + this.openaiBlock(ci);
+            fn.arguments = r;
+          }
+          if (call.id || fn?.name || fn?.arguments) keep = true;
+        }
+      }
+      if (delta.role || delta.reasoning_content || delta.refusal) keep = true;
+      if (choice.finish_reason) {
+        prefix += await this.flushChoice(ci);
+        if (this.blocked) return prefix + this.openaiBlock(ci);
+        keep = true;
+      }
+    }
+    if (chunk.usage) keep = true;
+    return keep ? `${prefix}data: ${JSON.stringify(chunk)}
+
+` : prefix;
+  }
+  openaiChunk(ci, delta, finish = null) {
+    return `data: ${JSON.stringify({
+      ...this.template ?? {
+        object: "chat.completion.chunk"
+      },
+      choices: [
+        {
+          index: ci,
+          delta,
+          finish_reason: finish
+        }
+      ]
+    })}
+
+`;
+  }
+  openaiBlock(ci) {
+    const msg = this.blocked?.message ?? "";
+    this.done = true;
+    return `${this.openaiChunk(ci, {
+      content: `
+
+${msg}`
+    })}${this.openaiChunk(ci, {}, "content_filter")}data: [DONE]
+
+`;
+  }
+  async flushChoice(ci) {
+    let out = "";
+    for (const [key, ch] of this.channels) {
+      if (!key.startsWith(`c:${ci}`) && !key.startsWith(`t:${ci}:`)) continue;
+      const text = await this.release(key, ch, true);
+      if (this.blocked) return out;
+      if (!text) continue;
+      out += key.startsWith("c:") ? this.openaiChunk(ci, {
+        content: text
+      }) : this.openaiChunk(ci, {
+        tool_calls: [
+          {
+            index: Number(key.split(":")[2]),
+            function: {
+              arguments: text
+            }
+          }
+        ]
+      });
+    }
+    return out;
+  }
+  // ---- Anthropic Messages events -------------------------------------------------------------
+  async anthropicFrame(f) {
+    if (!f.data) return f.raw;
+    let ev;
+    try {
+      ev = JSON.parse(f.data);
+    } catch {
+      return f.raw;
+    }
+    const type = ev.type ?? f.event;
+    if (type === "content_block_start") {
+      this.openBlocks.add(ev.index);
+      this.maxBlock = Math.max(this.maxBlock, ev.index);
+      return f.raw;
+    }
+    if (type === "content_block_delta") {
+      const d = ev.delta ?? {};
+      if (d.type === "text_delta" && typeof d.text === "string") {
+        const r = await this.feed(`b:${ev.index}`, d.text, false);
+        if (this.blocked) return this.anthropicBlock(ev.index);
+        if (!r) return "";
+        d.text = r;
+        return sseEvent("content_block_delta", ev);
+      }
+      if (d.type === "input_json_delta" && typeof d.partial_json === "string") {
+        const r = await this.feed(`b:${ev.index}`, d.partial_json, true);
+        if (this.blocked) return this.anthropicBlock(ev.index);
+        if (!r) return "";
+        d.partial_json = r;
+        return sseEvent("content_block_delta", ev);
+      }
+      return f.raw;
+    }
+    if (type === "content_block_stop") {
+      const pre = await this.flushBlock(ev.index);
+      if (this.blocked) return pre + this.anthropicBlock(ev.index);
+      this.openBlocks.delete(ev.index);
+      return pre + f.raw;
+    }
+    if (type === "message_delta" || type === "message_stop") {
+      let pre = "";
+      for (const i of [
+        ...this.openBlocks
+      ]) {
+        pre += await this.flushBlock(i);
+        if (this.blocked) return pre + this.anthropicBlock(i);
+      }
+      if (type === "message_stop") this.done = true;
+      return pre + f.raw;
+    }
+    return f.raw;
+  }
+  async flushBlock(index) {
+    const key = `b:${index}`;
+    const ch = this.channels.get(key);
+    if (!ch) return "";
+    const text = await this.release(key, ch, true);
+    if (this.blocked || !text) return "";
+    return sseEvent("content_block_delta", {
+      type: "content_block_delta",
+      index,
+      delta: ch.json ? {
+        type: "input_json_delta",
+        partial_json: text
+      } : {
+        type: "text_delta",
+        text
+      }
+    });
+  }
+  anthropicBlock(index) {
+    const msg = this.blocked?.message ?? "";
+    this.done = true;
+    let out = "";
+    let i = index;
+    const ch = this.channels.get(`b:${index}`);
+    if (!this.openBlocks.has(index) || ch?.json) {
+      if (this.openBlocks.has(index)) out += sseEvent("content_block_stop", {
+        type: "content_block_stop",
+        index
+      });
+      i = this.maxBlock + 1;
+      out += sseEvent("content_block_start", {
+        type: "content_block_start",
+        index: i,
+        content_block: {
+          type: "text",
+          text: ""
+        }
+      });
+    }
+    out += sseEvent("content_block_delta", {
+      type: "content_block_delta",
+      index: i,
+      delta: {
+        type: "text_delta",
+        text: `
+
+${msg}`
+      }
+    });
+    out += sseEvent("content_block_stop", {
+      type: "content_block_stop",
+      index: i
+    });
+    out += sseEvent("message_delta", {
+      type: "message_delta",
+      delta: {
+        stop_reason: "refusal",
+        stop_sequence: null
+      },
+      usage: {
+        output_tokens: 0
+      }
+    });
+    out += sseEvent("message_stop", {
+      type: "message_stop"
+    });
+    return out;
+  }
+  // ---- windows -------------------------------------------------------------------------------
+  async flushAll() {
+    if (this.opts.api === "openai") {
+      const choices = new Set([
+        ...this.channels.keys()
+      ].map((k) => Number(k.split(":")[1])));
+      let out2 = "";
+      for (const ci of choices) {
+        out2 += await this.flushChoice(ci);
+        if (this.blocked) return out2 + this.openaiBlock(ci);
+      }
+      return out2;
+    }
+    let out = "";
+    for (const i of [
+      ...this.openBlocks
+    ]) {
+      out += await this.flushBlock(i);
+      if (this.blocked) return out + this.anthropicBlock(i);
+    }
+    return out;
+  }
+  async feed(key, text, json) {
+    let ch = this.channels.get(key);
+    if (!ch) {
+      ch = new Channel(json);
+      this.channels.set(key, ch);
+    }
+    ch.pending += text;
+    if (ch.pending.length < this.window + this.holdback) return "";
+    return this.release(key, ch, false);
+  }
+  /** Releases a window (everything when `all`), scanned and restored. */
+  async release(key, ch, all) {
+    if (!ch.pending) return "";
+    let cut = all ? ch.pending.length : ch.pending.length - this.holdback;
+    if (!all) {
+      const spans = resolveOverlaps(this.opts.locate?.(ch.pending) ?? []);
+      const straddling = spans.find((f) => f.start < cut && f.end > cut);
+      if (straddling) cut = straddling.end < ch.pending.length ? straddling.end : straddling.start;
+      const head = ch.pending.slice(0, cut);
+      cut -= this.opts.vault.pendingPrefix(head);
+      if (cut <= 0) return "";
+    }
+    let text = ch.pending.slice(0, cut);
+    ch.pending = ch.pending.slice(cut);
+    if (this.opts.scan) {
+      const verdict = await this.opts.scan(text, key);
+      if (verdict.block) {
+        this.blocked = verdict.block;
+        return "";
+      }
+      text = verdict.text;
+    }
+    return this.opts.restore ? this.opts.vault.restore(text, ch.json) : text;
+  }
+};
+function parseFrame(raw) {
+  let event;
+  const data = [];
+  for (const line of raw.split(/\r?\n/)) {
+    if (line.startsWith("event:")) event = line.slice(6).trim();
+    else if (line.startsWith("data:")) data.push(line.slice(5).replace(/^ /, ""));
+  }
+  return {
+    event,
+    data: data.join("\n"),
+    raw
+  };
+}
+__name(parseFrame, "parseFrame");
+function sseEvent(event, data) {
+  return `event: ${event}
+data: ${JSON.stringify(data)}
+
+`;
+}
+__name(sseEvent, "sseEvent");
+
+// src/guardrails/agent.ts
+var InMemoryVaultStore = class {
+  static {
+    __name(this, "InMemoryVaultStore");
+  }
+  maxThreads;
+  vaults = /* @__PURE__ */ new Map();
+  constructor(maxThreads = 1e3) {
+    this.maxThreads = maxThreads;
+  }
+  load(threadId) {
+    const vault = this.vaults.get(threadId);
+    if (vault !== void 0) {
+      this.vaults.delete(threadId);
+      this.vaults.set(threadId, vault);
+    }
+    return vault;
+  }
+  save(threadId, vault) {
+    this.vaults.delete(threadId);
+    this.vaults.set(threadId, vault);
+    while (this.vaults.size > this.maxThreads) {
+      const oldest = this.vaults.keys().next().value;
+      if (oldest === void 0) break;
+      this.vaults.delete(oldest);
+    }
+  }
+};
+var GuardrailBlockedError = class extends Error {
+  static {
+    __name(this, "GuardrailBlockedError");
+  }
+  stage;
+  userMessage;
+  rule;
+  constructor(stage, userMessage, rule) {
+    super(userMessage), this.stage = stage, this.userMessage = userMessage, this.rule = rule;
+    this.name = "GuardrailBlockedError";
+  }
+};
+var ALL_CONTENT = [
+  "llm_request",
+  "tool_args",
+  "tool_result",
+  "llm_response"
+];
+var RESTORABLE_STAGES = [
+  "llm_request",
+  "tool_result"
+];
+var PII_STAGES = [
+  "llm_request",
+  "tool_result",
+  "llm_response"
+];
+function shorthandRules(options) {
+  const rules = [];
+  if (options.pii !== void 0) {
+    const pii = typeof options.pii === "string" ? {
+      action: options.pii
+    } : options.pii;
+    rules.push({
+      id: "pii",
+      name: "PII",
+      stages: pii.stages ?? PII_STAGES,
+      detectors: [
+        {
+          kind: "pii",
+          ...pii.types !== void 0 ? {
+            types: pii.types
+          } : {}
+        }
+      ],
+      action: pii.action,
+      options: {
+        restore: pii.restore ?? true
+      }
+    });
+  }
+  if (options.secrets !== void 0) {
+    const secrets = typeof options.secrets === "string" ? {
+      action: options.secrets
+    } : options.secrets;
+    rules.push({
+      id: "secrets",
+      name: "Secrets",
+      stages: secrets.stages ?? ALL_CONTENT,
+      detectors: [
+        {
+          kind: "secrets",
+          ...secrets.types !== void 0 ? {
+            types: secrets.types
+          } : {}
+        }
+      ],
+      action: secrets.action,
+      // A secret sent to a model is not handed back: the reader should not see it echoed either.
+      options: {
+        restore: false
+      }
+    });
+  }
+  if (options.injection !== void 0) {
+    const injection = typeof options.injection === "string" ? {
+      action: options.injection
+    } : options.injection;
+    rules.push({
+      id: "injection",
+      name: "Prompt injection",
+      // The prompt (a jailbreak typed by the user) and tool results (indirect injection).
+      stages: injection.stages ?? [
+        "llm_request",
+        "tool_result"
+      ],
+      detectors: [
+        {
+          kind: "injection",
+          ...injection.threshold !== void 0 ? {
+            threshold: injection.threshold
+          } : {}
+        }
+      ],
+      action: injection.action ?? "block",
+      // What the user typed and what tools returned. Not the system prompt — the app's own text,
+      // which legitimately carries role tags and imperatives — nor the model's earlier answers.
+      match: {
+        sources: [
+          "user",
+          "tool"
+        ]
+      }
+    });
+  }
+  if (options.toolPoisoning !== void 0 && options.toolPoisoning !== false) {
+    const poisoning = options.toolPoisoning === true ? {} : options.toolPoisoning;
+    rules.push({
+      id: "tool_poisoning",
+      name: "Tool poisoning",
+      stages: [
+        "tool_description"
+      ],
+      detectors: [
+        {
+          kind: "tool_poisoning",
+          ...poisoning.threshold !== void 0 ? {
+            threshold: poisoning.threshold
+          } : {}
+        }
+      ],
+      action: poisoning.action ?? "block"
+    });
+  }
+  return rules;
+}
+__name(shorthandRules, "shorthandRules");
+var isRefusal = /* @__PURE__ */ __name((action) => action === "block" || action === "approve", "isRefusal");
+function sourceOf2(role) {
+  return role === "system" ? "system" : role === "assistant" ? "assistant" : "user";
+}
+__name(sourceOf2, "sourceOf");
+function turnStart(messages) {
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const message = messages[i];
+    if (message?.role === "user" && message.content) return i;
+  }
+  return 0;
+}
+__name(turnStart, "turnStart");
+function cloneJson(value) {
+  return value === void 0 ? value : structuredClone(value);
+}
+__name(cloneJson, "cloneJson");
+function writeBack(slots, result) {
+  if (!result.changed) return;
+  slots.forEach((slot, i) => {
+    const text = result.segments[i];
+    if (text !== void 0 && text !== slot.segment.text) slot.set(text);
+  });
+}
+__name(writeBack, "writeBack");
+var Guardrails = class {
+  static {
+    __name(this, "Guardrails");
+  }
+  options;
+  /** Scans every prompt; redacts in place, withholds tool results, throws on a blocked prompt. */
+  input;
+  /** Scans every answer and the tool calls it asks for; redacts, restores placeholders, or rejects. */
+  output;
+  shorthand;
+  vaults;
+  /** Per thread: hits already reported this turn, so re-scans of the same content stay quiet. */
+  reported = /* @__PURE__ */ new Map();
+  constructor(options = {}) {
+    this.options = options;
+    this.shorthand = shorthandRules(options);
+    this.vaults = options.vaults ?? new InMemoryVaultStore();
+    const name = options.name ?? "guardrails";
+    this.input = {
+      name,
+      process: /* @__PURE__ */ __name((prompt, ctx) => this.processInput(prompt, ctx), "process")
+    };
+    const incremental = options.incremental === false ? void 0 : {
+      lookbackChars: options.incremental?.lookbackChars ?? 256
+    };
+    this.output = {
+      name,
+      ...incremental !== void 0 ? {
+        incremental
+      } : {},
+      process: /* @__PURE__ */ __name((answer, ctx) => this.processOutput(answer, ctx), "process")
+    };
+  }
+  /** Every rule in force for `ctx`: the shorthands, then {@link GuardrailsOptions.rules}. */
+  async rulesFor(ctx) {
+    const extra = this.options.rules;
+    const resolved = typeof extra === "function" ? await extra(ctx) : extra ?? [];
+    return [
+      ...this.shorthand,
+      ...resolved
+    ];
+  }
+  /**
+  * Scans arbitrary segments at one stage with the configured rules, reporting through `onEvent`.
+  * What the processors use; also the entry point for traffic that never meets the loop.
+  */
+  async scan(ctx, segments, vault = new Vault()) {
+    const rules = await this.rulesFor(ctx);
+    const result = await scan(rules, ctx, segments, vault, {
+      ...this.options.messages !== void 0 ? {
+        messages: this.options.messages
+      } : {},
+      // A tool result is the app's own data: a value redacted out of it is handed back to the
+      // reader and to the next tool call like one the user typed. `restore: false` opts a rule out.
+      restorableStages: RESTORABLE_STAGES
+    });
+    await this.report(ctx, result);
+    return result;
+  }
+  /**
+  * Screens one tool definition (name, title, description, and every description in its input
+  * schema) for hidden instructions. `allowed: false` means a `block`/`approve` rule fired — leave
+  * the tool out of the catalog. Shaped to be handed straight to an MCP importer's screen hook.
+  */
+  async screenTool(tool) {
+    const ctx = {
+      stage: "tool_description",
+      tool: tool.name,
+      ...tool.server !== void 0 ? {
+        server: tool.server
+      } : {}
+    };
+    const result = await this.scan(ctx, [
+      {
+        text: toolText(tool)
+      }
+    ]);
+    if (isRefusal(result.action)) {
+      const categories = [
+        ...new Set(result.hits.map((h) => h.category))
+      ].join(", ");
+      return {
+        allowed: false,
+        reason: `${result.decisive?.message ?? "quarantined by guardrails"} (${categories})`
+      };
+    }
+    return {
+      allowed: true
+    };
+  }
+  /**
+  * Wraps a tool handler so its arguments are guarded where the loop cannot rewrite them: the
+  * thread's placeholders are restored (the model only ever saw `[EMAIL_1]`, the tool needs the
+  * address), then the `tool_args` rules run — `redact` rewrites what the tool receives, `block`
+  * throws a {@link GuardrailBlockedError}, which the model reads as the tool's failure.
+  */
+  wrapTool(toolName, handler) {
+    return {
+      execute: /* @__PURE__ */ __name(async (input, ctx) => {
+        const vault = await this.vaults.load(ctx.threadId) ?? new Vault();
+        const box = {
+          value: cloneJson(input)
+        };
+        const slots = jsonSlots(box.value, "assistant", true, (text) => {
+          box.value = text;
+        });
+        for (const slot of slots) slot.set(vault.restore(slot.segment.text));
+        const guardCtx = {
+          stage: "tool_args",
+          tool: toolName,
+          threadId: ctx.threadId,
+          actor: ctx.actor,
+          ...ctx.agentName !== void 0 ? {
+            agentName: ctx.agentName
+          } : {}
+        };
+        const restoredSlots = jsonSlots(box.value, "assistant", true, (text) => {
+          box.value = text;
+        });
+        const result = await this.scan(guardCtx, restoredSlots.map((s) => s.segment), vault);
+        if (isRefusal(result.action)) {
+          throw new GuardrailBlockedError("tool_args", result.decisive?.message ?? "blocked", result.decisive);
+        }
+        writeBack(restoredSlots, result);
+        return handler.execute(box.value, ctx);
+      }, "execute"),
+      ...handler.isEnabled !== void 0 ? {
+        isEnabled: /* @__PURE__ */ __name(() => handler.isEnabled?.call(handler) ?? true, "isEnabled")
+      } : {},
+      ...handler.canUse !== void 0 ? {
+        canUse: /* @__PURE__ */ __name((actor) => handler.canUse?.call(handler, actor) ?? true, "canUse")
+      } : {}
+    };
+  }
+  contextOf(stage, ctx, tool) {
+    return {
+      stage,
+      threadId: ctx.threadId,
+      actor: ctx.actor,
+      step: ctx.step,
+      ...ctx.agentName !== void 0 ? {
+        agentName: ctx.agentName
+      } : {},
+      ...tool !== void 0 ? {
+        tool
+      } : {}
+    };
+  }
+  async processInput(prompt, pctx) {
+    if (pctx.step === 0) {
+      this.reported.delete(pctx.threadId);
+    }
+    const vault = await this.vaults.load(pctx.threadId) ?? new Vault();
+    const out = {
+      system: prompt.system,
+      messages: cloneJson(prompt.messages)
+    };
+    const from = turnStart(out.messages);
+    const slots = [];
+    if (out.system) {
+      slots.push({
+        segment: {
+          text: out.system,
+          source: "system",
+          fresh: true
+        },
+        set: /* @__PURE__ */ __name((text) => {
+          out.system = text;
+        }, "set")
+      });
+    }
+    out.messages.forEach((message, i) => {
+      const fresh = i >= from;
+      if (message.content) {
+        slots.push({
+          segment: {
+            text: message.content,
+            source: sourceOf2(message.role),
+            fresh
+          },
+          set: /* @__PURE__ */ __name((text) => {
+            message.content = text;
+          }, "set")
+        });
+      }
+      for (const call of message.toolCalls ?? []) {
+        slots.push(...jsonSlots(call.input, "assistant", fresh, (text) => {
+          call.input = text;
+        }));
+      }
+    });
+    const request = await this.scan(this.contextOf("llm_request", pctx), slots.map((s) => s.segment), vault);
+    if (isRefusal(request.action)) {
+      await this.vaults.save(pctx.threadId, vault);
+      throw new GuardrailBlockedError("llm_request", request.decisive?.message ?? "blocked", request.decisive);
+    }
+    writeBack(slots, request);
+    for (const [i, message] of out.messages.entries()) {
+      for (const result of message.toolResults ?? []) {
+        await this.guardToolResult(result, i >= from, pctx, vault);
+      }
+    }
+    await this.vaults.save(pctx.threadId, vault);
+    return out;
+  }
+  async guardToolResult(result, fresh, pctx, vault) {
+    const slots = jsonSlots(result.output, "tool", fresh, (text) => {
+      result.output = text;
+    });
+    if (result.error) {
+      slots.push({
+        segment: {
+          text: result.error,
+          source: "tool",
+          fresh
+        },
+        set: /* @__PURE__ */ __name((text) => {
+          result.error = text;
+        }, "set")
+      });
+    }
+    if (slots.length === 0) return;
+    const scanned = await this.scan(this.contextOf("tool_result", pctx, result.name), slots.map((s) => s.segment), vault);
+    if (isRefusal(scanned.action)) {
+      result.output = scanned.decisive?.message ?? "withheld";
+      if (result.error !== void 0) result.error = result.output;
+      return;
+    }
+    writeBack(slots, scanned);
+  }
+  async processOutput(answer, pctx) {
+    for (const call of answer.toolCalls) {
+      const slots = jsonSlots(cloneJson(call.input), "assistant", true);
+      if (slots.length === 0) continue;
+      const args = await this.scan(this.contextOf("tool_args", pctx, call.name), slots.map((s) => s.segment));
+      if (isRefusal(args.action)) {
+        return {
+          action: "reject",
+          reason: args.decisive?.message ?? "blocked"
+        };
+      }
+    }
+    if (!answer.text) return {
+      action: "pass"
+    };
+    const response = await this.scan(this.contextOf("llm_response", pctx), [
+      {
+        text: answer.text,
+        source: "assistant"
+      }
+    ], new Vault());
+    if (isRefusal(response.action)) {
+      return {
+        action: "reject",
+        reason: response.decisive?.message ?? "blocked"
+      };
+    }
+    const vault = await this.vaults.load(pctx.threadId);
+    const redacted = response.segments[0] ?? answer.text;
+    const text = vault !== void 0 ? vault.restore(redacted) : redacted;
+    return text === answer.text ? {
+      action: "pass"
+    } : {
+      action: "replace",
+      text
+    };
+  }
+  async report(ctx, result) {
+    const onEvent = this.options.onEvent;
+    if (onEvent === void 0 || result.hits.length === 0) return;
+    const seen = ctx.threadId !== void 0 ? this.reported.get(ctx.threadId) ?? this.reported.set(ctx.threadId, /* @__PURE__ */ new Set()).get(ctx.threadId) : void 0;
+    const fingerprint = this.options.fingerprint;
+    const hits = [];
+    for (const { values, ...hit } of result.hits) {
+      if (!hit.fresh) continue;
+      const key = `${ctx.stage}\0${ctx.tool ?? ""}\0${hit.ruleId}\0${hit.category}\0${values.join("
")}`;
+      if (seen?.has(key)) continue;
+      seen?.add(key);
+      hits.push({
+        ...hit,
+        fingerprints: fingerprint !== void 0 ? values.map(fingerprint) : []
+      });
+    }
+    if (hits.length === 0) return;
+    if (this.reported.size > 1e3) {
+      const oldest = this.reported.keys().next().value;
+      if (oldest !== void 0) this.reported.delete(oldest);
+    }
+    try {
+      await onEvent({
+        stage: result.stage,
+        action: result.action,
+        ...result.decisive !== void 0 ? {
+          decisive: result.decisive
+        } : {},
+        hits,
+        redactions: result.redactions,
+        latencyMs: result.latencyMs,
+        context: ctx
+      });
+    } catch {
+    }
+  }
+};
+function createGuardrails(options = {}) {
+  return new Guardrails(options);
+}
+__name(createGuardrails, "createGuardrails");
+function screenToolDefinition(tool, threshold = 0.5) {
+  return scoreToolText(toolText(tool), threshold);
+}
+__name(screenToolDefinition, "screenToolDefinition");
+export {
+  ACTION_SEVERITY,
+  DEFAULT_APPROVAL_MESSAGE,
+  DEFAULT_MESSAGES,
+  GUARDRAIL_STAGES,
+  GuardrailBlockedError,
+  Guardrails,
+  INJECTION_REPLACEMENT,
+  INJECTION_SIGNALS,
+  InMemoryVaultStore,
+  PII_TYPES,
+  SECRET_TYPES,
+  StreamGuard,
+  Vault,
+  applyRedactions,
+  cardBrand,
+  cnpjValid,
+  compileGuardPattern,
+  cpfValid,
+  createGuardrails,
+  decodeTagChars,
+  detectKeywords,
+  detectPii,
+  detectRegex,
+  detectSecrets,
+  entropy,
+  fold,
+  globToRegExp,
+  ibanValid,
+  isIPv4,
+  jsonSlots,
+  labelFor,
+  luhnValid,
+  matchesAny,
+  orderRules,
+  phoneValid,
+  refuseResponse,
+  requestSlots,
+  resolveOverlaps,
+  responseSlots,
+  ruleApplies,
+  runDetector,
+  scan,
+  scoreInjection,
+  scoreToolText,
+  screenToolDefinition,
+  shorthandRules,
+  spanLocator,
+  ssnValid,
+  toolResultSlots,
+  toolText
+};
+//# sourceMappingURL=index.js.map