@grindfree/guard 0.0.0-stage → 0.2.0

package/dist/guard.d.ts

@@ -0,0 +1,161 @@
+import { type ClientOptions } from "./client.js";
+import { type EnforceOptions, type NormalizedDecision } from "./decisions.js";
+export type ToolCallInput = {
+    tool: string;
+    destination?: {
+        host?: string;
+        scheme?: string;
+        port?: number;
+        path_class?: string;
+    };
+    arg_classes?: string[];
+    taint?: string[];
+    secret_labels?: string[];
+    policy?: Record<string, unknown>;
+    policy_hash?: string;
+    rule_pack?: string;
+};
+export type CommandInput = {
+    command: string;
+    shell?: "bash" | "sh" | "zsh" | "fish" | "powershell" | "cmd";
+    policy?: Record<string, unknown>;
+};
+export type SqlInput = {
+    sql: string;
+    dialect?: "postgres" | "mysql" | "mariadb" | "sqlite" | "mssql" | "snowflake" | "bigquery" | "other";
+    policy?: Record<string, unknown>;
+};
+export type PromptInput = {
+    content: string;
+    format?: "text" | "html";
+};
+export type CrawlInput = {
+    url: string;
+    user_agent?: string;
+    check_page?: boolean;
+};
+export type MemoryInput = {
+    content?: string;
+    source?: "user" | "assistant" | "tool" | "web" | "document" | "email" | "retrieved" | "mcp" | "unknown";
+    memory_type?: "fact" | "preference" | "instruction" | "episodic" | "summary";
+    entries?: Array<{
+        key?: string;
+        content: string;
+        source?: string;
+    }>;
+    policy?: Record<string, unknown>;
+};
+export type OutputInput = {
+    content: string;
+    format?: "markdown" | "text" | "html" | "json";
+    allowed_domains?: string[];
+    canaries?: string[];
+    system_prompt?: string;
+    policy?: Record<string, unknown>;
+};
+export type DocumentInput = {
+    content?: string;
+    content_base64?: string;
+    format?: "html" | "markdown" | "text";
+    filename?: string;
+    include_text?: boolean;
+    policy?: Record<string, unknown>;
+};
+export type ReadInput = {
+    url: string;
+    format?: "markdown" | "text";
+    mode?: "strip" | "flag";
+    max_chars?: number;
+    include_links?: boolean;
+    include_images?: boolean;
+    main_content?: boolean;
+    policy?: Record<string, unknown>;
+};
+export type SafeReadResult = {
+    /** Clean Markdown/text with hidden content and injected instructions removed (strip mode). */
+    text: string;
+    title?: string;
+    finalUrl?: string;
+    decision: NormalizedDecision;
+};
+export type GuardOptions = ClientOptions & EnforceOptions & {
+    /** Default ToolGuard / CommandGuard policy sent when a call omits one. */
+    policy?: Record<string, unknown>;
+};
+export type GuardedResult<T> = {
+    value: T;
+    decision: NormalizedDecision;
+};
+export declare class GrindFreeGuard {
+    readonly options: GuardOptions;
+    private readonly paidFetch;
+    constructor(options?: GuardOptions);
+    private enforceOpts;
+    private call;
+    private callAndEnforce;
+    /** ToolGuard evaluate only (no enforcement). */
+    evaluateTool(input: ToolCallInput): Promise<NormalizedDecision>;
+    /**
+     * Screen a tool call with ToolGuard, enforce allow/review/deny, then run `fn`.
+     * On deny (or review with default onReview=throw) `fn` is not called.
+     */
+    guardToolCall<T>(input: ToolCallInput, fn: () => Promise<T> | T): Promise<GuardedResult<T>>;
+    /**
+     * Wrap any tool function so ToolGuard runs first.
+     * `classify` maps arguments to a ToolGuard body; defaults to `{ tool: name }`.
+     */
+    wrapTool<Args extends unknown[], R>(name: string, fn: (...args: Args) => Promise<R> | R, classify?: (...args: Args) => ToolCallInput | Promise<ToolCallInput>): (...args: Args) => Promise<R>;
+    checkCommand(input: CommandInput): Promise<NormalizedDecision>;
+    guardCommand<T>(input: CommandInput, fn: () => Promise<T> | T): Promise<GuardedResult<T>>;
+    checkSql(input: SqlInput): Promise<NormalizedDecision>;
+    guardSql<T>(input: SqlInput, fn: () => Promise<T> | T): Promise<GuardedResult<T>>;
+    screenPrompt(input: PromptInput): Promise<NormalizedDecision>;
+    /**
+     * Screen untrusted text/HTML. Throws on high risk (deny). Returns sanitized
+     * text (or the original when the service did not supply one).
+     */
+    requireSafePrompt(input: PromptInput): Promise<{
+        text: string;
+        decision: NormalizedDecision;
+    }>;
+    cleanHtml(content: string): Promise<{
+        text: string;
+        raw: Record<string, unknown>;
+    }>;
+    checkCrawl(input: CrawlInput): Promise<NormalizedDecision>;
+    requireCrawlAllowed(input: CrawlInput): Promise<NormalizedDecision>;
+    screenMemory(input: MemoryInput): Promise<NormalizedDecision>;
+    requireSafeMemory(input: MemoryInput): Promise<{
+        text?: string;
+        decision: NormalizedDecision;
+    }>;
+    scanOutput(input: OutputInput): Promise<NormalizedDecision>;
+    requireSafeOutput(input: OutputInput): Promise<{
+        text: string;
+        decision: NormalizedDecision;
+    }>;
+    scanDocument(input: DocumentInput): Promise<NormalizedDecision>;
+    requireSafeDocument(input: DocumentInput): Promise<{
+        text?: string;
+        decision: NormalizedDecision;
+    }>;
+    /** SafeRead raw call (no enforcement): fetch a URL as clean Markdown/text. */
+    readUrl(input: ReadInput | string): Promise<NormalizedDecision>;
+    /**
+     * Fetch a URL through SafeRead and return clean text. Does NOT throw on a
+     * "block" verdict: injected instructions are already removed from `text`;
+     * inspect `decision.verdict` / `decision.findings` to see what was taken out.
+     */
+    safeRead(input: ReadInput | string): Promise<SafeReadResult>;
+    /** Like safeRead, but enforces: block → GuardDenied, warn → onReview policy. */
+    requireSafeRead(input: ReadInput | string): Promise<SafeReadResult>;
+}
+export declare function createGuard(options?: GuardOptions): GrindFreeGuard;
+/** Convenience wrapper around `createGuard(...).guardToolCall`. */
+export declare function guardToolCall<T>(input: ToolCallInput, fn: () => Promise<T> | T, options?: GuardOptions): Promise<GuardedResult<T>>;
+/**
+ * Express/fetch-style middleware: evaluate an outbound tool described by
+ * `classify(request)` and only call `next` when the verdict allows it.
+ */
+export declare function createGuardMiddleware(options?: GuardOptions): <Req, Res>(classify: (req: Req) => ToolCallInput | Promise<ToolCallInput>, next: (req: Req) => Promise<Res> | Res, req: Req) => Promise<GuardedResult<Res>>;
+//# sourceMappingURL=guard.d.ts.map

package/dist/guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6B,KAAK,aAAa,EAAkB,MAAM,aAAa,CAAC;AAC5F,OAAO,EAA4C,KAAK,cAAc,EAAE,KAAK,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AAIxH,MAAM,MAAM,aAAa,GAAG;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACrF,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,KAAK,GAAG,MAAM,GAAG,YAAY,GAAG,KAAK,CAAC;IAC9D,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,SAAS,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,UAAU,GAAG,OAAO,CAAC;IACrG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,GAAG,MAAM,CAAA;CAAE,CAAC;AAExE,MAAM,MAAM,UAAU,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,WAAW,GAAG,MAAM,GAAG,KAAK,GAAG,UAAU,GAAG,OAAO,GAAG,WAAW,GAAG,KAAK,GAAG,SAAS,CAAC;IACxG,WAAW,CAAC,EAAE,MAAM,GAAG,YAAY,GAAG,aAAa,GAAG,UAAU,GAAG,SAAS,CAAC;IAC7E,OAAO,CAAC,EAAE,KAAK,CAAC;QAAE,GAAG,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC/C,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,CAAC,EAAE,UAAU,GAAG,MAAM,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,8FAA8F;IAC9F,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,kBAAkB,CAAC;CAC9B,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG,aAAa,GACtC,cAAc,GAAG;IACf,0EAA0E;IAC1E,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAEJ,MAAM,MAAM,aAAa,CAAC,CAAC,IAAI;IAC7B,KAAK,EAAE,CAAC,CAAC;IACT,QAAQ,EAAE,kBAAkB,CAAC;CAC9B,CAAC;AAMF,qBAAa,cAAc;IACzB,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAY;gBAE1B,OAAO,GAAE,YAAiB;IAKtC,OAAO,CAAC,WAAW;YAIL,IAAI;YAyBJ,cAAc;IAK5B,gDAAgD;IAChD,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAK/D;;;OAGG;IACG,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAMjG;;;OAGG;IACH,QAAQ,CAAC,IAAI,SAAS,OAAO,EAAE,EAAE,CAAC,EAChC,IAAI,EAAE,MAAM,EACZ,EAAE,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACrC,QAAQ,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,GACnE,CAAC,GAAG,IAAI,EAAE,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC;IAQhC,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIxD,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAK/F,QAAQ,CAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIhD,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IAKvF,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI7D;;;OAGG;IACG,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAK9F,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC;IAezF,UAAU,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIpD,mBAAmB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIzE,YAAY,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIvD,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAKrG,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIrD,iBAAiB,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAKpG,YAAY,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAIzD,mBAAmB,CAAC,KAAK,EAAE,aAAa,GAAG,OAAO,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,kBAAkB,CAAA;KAAE,CAAC;IAKzG,8EAA8E;IAC9E,OAAO,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAI/D;;;;OAIG;IACG,QAAQ,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;IAIlE,gFAAgF;IAC1E,eAAe,CAAC,KAAK,EAAE,SAAS,GAAG,MAAM,GAAG,OAAO,CAAC,cAAc,CAAC;CAG1E;AAgBD,wBAAgB,WAAW,CAAC,OAAO,GAAE,YAAiB,GAAG,cAAc,CAEtE;AAED,mEAAmE;AACnE,wBAAgB,aAAa,CAAC,CAAC,EAC7B,KAAK,EAAE,aAAa,EACpB,EAAE,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,EACxB,OAAO,GAAE,YAAiB,GACzB,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAE3B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CAAC,OAAO,GAAE,YAAiB,IAEpB,GAAG,EAAE,GAAG,EAChD,UAAU,CAAC,GAAG,EAAE,GAAG,KAAK,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC,EAC9D,MAAM,CAAC,GAAG,EAAE,GAAG,KAAK,OAAO,CAAC,GAAG,CAAC,GAAG,GAAG,EACtC,KAAK,GAAG,KACP,OAAO,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAI/B"}

package/dist/guard.js

@@ -0,0 +1,187 @@
+import { createPaidFetch, postJson } from "./client.js";
+import { enforce, enforceError, normalizeDecision } from "./decisions.js";
+import { GuardDenied } from "./errors.js";
+import { serviceUrl } from "./services.js";
+function clean(obj) {
+    return Object.fromEntries(Object.entries(obj).filter(([, v]) => v !== undefined));
+}
+export class GrindFreeGuard {
+    options;
+    paidFetch;
+    constructor(options = {}) {
+        this.options = options;
+        this.paidFetch = createPaidFetch(options);
+    }
+    enforceOpts() {
+        return { onReview: this.options.onReview, onError: this.options.onError };
+    }
+    async call(service, endpoint, body) {
+        const url = serviceUrl(service, endpoint);
+        try {
+            const raw = await postJson(this.paidFetch, url, body, {
+                timeoutMs: this.options.timeoutMs,
+                service,
+            });
+            return normalizeDecision(service, endpoint, raw);
+        }
+        catch (err) {
+            if (this.options.onError === "allow") {
+                if (err instanceof GuardDenied)
+                    throw err;
+                const message = err instanceof Error ? err.message : String(err);
+                return {
+                    verdict: "allow",
+                    service,
+                    endpoint,
+                    reasons: [`transport failure allowed by onError=allow: ${message}`],
+                    findings: [],
+                    raw: { error: message },
+                };
+            }
+            enforceError(err, service, this.enforceOpts());
+        }
+    }
+    async callAndEnforce(service, endpoint, body) {
+        const decision = await this.call(service, endpoint, body);
+        return enforce(decision, this.enforceOpts());
+    }
+    /** ToolGuard evaluate only (no enforcement). */
+    evaluateTool(input) {
+        const body = clean({ ...input, policy: input.policy ?? this.options.policy });
+        return this.call("toolguard", "evaluate", body);
+    }
+    /**
+     * Screen a tool call with ToolGuard, enforce allow/review/deny, then run `fn`.
+     * On deny (or review with default onReview=throw) `fn` is not called.
+     */
+    async guardToolCall(input, fn) {
+        const decision = await this.callAndEnforce("toolguard", "evaluate", clean({ ...input, policy: input.policy ?? this.options.policy }));
+        const value = await fn();
+        return { value, decision };
+    }
+    /**
+     * Wrap any tool function so ToolGuard runs first.
+     * `classify` maps arguments to a ToolGuard body; defaults to `{ tool: name }`.
+     */
+    wrapTool(name, fn, classify) {
+        return async (...args) => {
+            const input = classify ? await classify(...args) : { tool: name };
+            const { value } = await this.guardToolCall({ ...input, tool: input.tool ?? name }, () => fn(...args));
+            return value;
+        };
+    }
+    checkCommand(input) {
+        return this.call("commandguard", "command", clean({ ...input, policy: input.policy ?? this.options.policy }));
+    }
+    async guardCommand(input, fn) {
+        const decision = await this.callAndEnforce("commandguard", "command", clean({ ...input, policy: input.policy ?? this.options.policy }));
+        return { value: await fn(), decision };
+    }
+    checkSql(input) {
+        return this.call("commandguard", "sql", clean({ ...input, policy: input.policy ?? this.options.policy }));
+    }
+    async guardSql(input, fn) {
+        const decision = await this.callAndEnforce("commandguard", "sql", clean({ ...input, policy: input.policy ?? this.options.policy }));
+        return { value: await fn(), decision };
+    }
+    screenPrompt(input) {
+        return this.call("promptshield", "screen", input);
+    }
+    /**
+     * Screen untrusted text/HTML. Throws on high risk (deny). Returns sanitized
+     * text (or the original when the service did not supply one).
+     */
+    async requireSafePrompt(input) {
+        const decision = await this.callAndEnforce("promptshield", "screen", input);
+        return { text: decision.sanitized ?? input.content, decision };
+    }
+    async cleanHtml(content) {
+        try {
+            const raw = await postJson(this.paidFetch, serviceUrl("promptshield", "clean"), { content }, {
+                timeoutMs: this.options.timeoutMs,
+                service: "promptshield",
+            });
+            return { text: typeof raw.text === "string" ? raw.text : "", raw };
+        }
+        catch (err) {
+            if (this.options.onError === "allow") {
+                return { text: content, raw: { error: err instanceof Error ? err.message : String(err) } };
+            }
+            enforceError(err, "promptshield", this.enforceOpts());
+        }
+    }
+    checkCrawl(input) {
+        return this.call("crawlsafe", "check", input);
+    }
+    async requireCrawlAllowed(input) {
+        return this.callAndEnforce("crawlsafe", "check", input);
+    }
+    screenMemory(input) {
+        return this.call("memoryguard", "screen", clean({ ...input, policy: input.policy ?? this.options.policy }));
+    }
+    async requireSafeMemory(input) {
+        const decision = await this.callAndEnforce("memoryguard", "screen", clean({ ...input, policy: input.policy ?? this.options.policy }));
+        return { text: decision.sanitized ?? input.content, decision };
+    }
+    scanOutput(input) {
+        return this.call("wireshield", "scan", clean({ ...input, policy: input.policy ?? this.options.policy }));
+    }
+    async requireSafeOutput(input) {
+        const decision = await this.callAndEnforce("wireshield", "scan", clean({ ...input, policy: input.policy ?? this.options.policy }));
+        return { text: decision.sanitized ?? input.content, decision };
+    }
+    scanDocument(input) {
+        return this.call("docshield", "scan", clean({ ...input, policy: input.policy ?? this.options.policy }));
+    }
+    async requireSafeDocument(input) {
+        const decision = await this.callAndEnforce("docshield", "scan", clean({ ...input, policy: input.policy ?? this.options.policy }));
+        return { text: decision.safeText ?? decision.sanitized ?? input.content, decision };
+    }
+    /** SafeRead raw call (no enforcement): fetch a URL as clean Markdown/text. */
+    readUrl(input) {
+        return this.call("saferead", "read", clean({ ...toReadInput(input) }));
+    }
+    /**
+     * Fetch a URL through SafeRead and return clean text. Does NOT throw on a
+     * "block" verdict: injected instructions are already removed from `text`;
+     * inspect `decision.verdict` / `decision.findings` to see what was taken out.
+     */
+    async safeRead(input) {
+        return toReadResult(await this.readUrl(input));
+    }
+    /** Like safeRead, but enforces: block → GuardDenied, warn → onReview policy. */
+    async requireSafeRead(input) {
+        return toReadResult(await this.callAndEnforce("saferead", "read", clean({ ...toReadInput(input) })));
+    }
+}
+function toReadInput(input) {
+    return typeof input === "string" ? { url: input } : input;
+}
+function toReadResult(decision) {
+    const raw = decision.raw;
+    return {
+        text: decision.safeText ?? "",
+        title: typeof raw.title === "string" ? raw.title : undefined,
+        finalUrl: typeof raw.final_url === "string" ? raw.final_url : undefined,
+        decision,
+    };
+}
+export function createGuard(options = {}) {
+    return new GrindFreeGuard(options);
+}
+/** Convenience wrapper around `createGuard(...).guardToolCall`. */
+export function guardToolCall(input, fn, options = {}) {
+    return createGuard(options).guardToolCall(input, fn);
+}
+/**
+ * Express/fetch-style middleware: evaluate an outbound tool described by
+ * `classify(request)` and only call `next` when the verdict allows it.
+ */
+export function createGuardMiddleware(options = {}) {
+    const guard = createGuard(options);
+    return async function grindfreeMiddleware(classify, next, req) {
+        const input = await classify(req);
+        return guard.guardToolCall(input, () => next(req));
+    };
+}
+//# sourceMappingURL=guard.js.map

package/dist/guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard.js","sourceRoot":"","sources":["../src/guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAsC,MAAM,aAAa,CAAC;AAC5F,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,iBAAiB,EAAgD,MAAM,gBAAgB,CAAC;AACxH,OAAO,EAAE,WAAW,EAAc,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,UAAU,EAAoB,MAAM,eAAe,CAAC;AAqF7D,SAAS,KAAK,CAAoC,GAAM;IACtD,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAM,CAAC;AACzF,CAAC;AAED,MAAM,OAAO,cAAc;IAChB,OAAO,CAAe;IACd,SAAS,CAAY;IAEtC,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;QACvB,IAAI,CAAC,SAAS,GAAG,eAAe,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC;IAEO,WAAW;QACjB,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;IAC5E,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,OAAoB,EAAE,QAAgB,EAAE,IAAa;QACtE,MAAM,GAAG,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAC1C,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE;gBACpD,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,OAAO;aACR,CAAC,CAAC;YACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACrC,IAAI,GAAG,YAAY,WAAW;oBAAE,MAAM,GAAG,CAAC;gBAC1C,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjE,OAAO;oBACL,OAAO,EAAE,OAAO;oBAChB,OAAO;oBACP,QAAQ;oBACR,OAAO,EAAE,CAAC,+CAA+C,OAAO,EAAE,CAAC;oBACnE,QAAQ,EAAE,EAAE;oBACZ,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE;iBACxB,CAAC;YACJ,CAAC;YACD,YAAY,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,OAAoB,EAAE,QAAgB,EAAE,IAAa;QAChF,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC1D,OAAO,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,gDAAgD;IAChD,YAAY,CAAC,KAAoB;QAC/B,MAAM,IAAI,GAAG,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,EAAE,IAAI,CAAC,CAAC;IAClD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,aAAa,CAAI,KAAoB,EAAE,EAAwB;QACnE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,UAAU,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtI,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE,CAAC;QACzB,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,QAAQ,CACN,IAAY,EACZ,EAAqC,EACrC,QAAoE;QAEpE,OAAO,KAAK,EAAE,GAAG,IAAU,EAAE,EAAE;YAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAClE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,aAAa,CAAC,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACtG,OAAO,KAAK,CAAC;QACf,CAAC,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,KAAmB;QAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAChH,CAAC;IAED,KAAK,CAAC,YAAY,CAAI,KAAmB,EAAE,EAAwB;QACjE,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,SAAS,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACxI,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,QAAQ,CAAC,KAAe;QACtB,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC5G,CAAC;IAED,KAAK,CAAC,QAAQ,CAAI,KAAe,EAAE,EAAwB;QACzD,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,KAAK,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACpI,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,YAAY,CAAC,KAAkB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAkB;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,cAAc,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC5E,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,OAAe;QAC7B,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,cAAc,EAAE,OAAO,CAAC,EAAE,EAAE,OAAO,EAAE,EAAE;gBAC3F,SAAS,EAAE,IAAI,CAAC,OAAO,CAAC,SAAS;gBACjC,OAAO,EAAE,cAAc;aACxB,CAAC,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC;QACrE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,IAAI,CAAC,OAAO,CAAC,OAAO,KAAK,OAAO,EAAE,CAAC;gBACrC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YAC7F,CAAC;YACD,YAAY,CAAC,GAAG,EAAE,cAAc,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAED,UAAU,CAAC,KAAiB;QAC1B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAChD,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAiB;QACzC,OAAO,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,CAAC;IAC1D,CAAC;IAED,YAAY,CAAC,KAAkB;QAC7B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC9G,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAkB;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,aAAa,EAAE,QAAQ,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACtI,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,UAAU,CAAC,KAAkB;QAC3B,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3G,CAAC;IAED,KAAK,CAAC,iBAAiB,CAAC,KAAkB;QACxC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,YAAY,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACnI,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IACjE,CAAC;IAED,YAAY,CAAC,KAAoB;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1G,CAAC;IAED,KAAK,CAAC,mBAAmB,CAAC,KAAoB;QAC5C,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,cAAc,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAClI,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,QAAQ,IAAI,QAAQ,CAAC,SAAS,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;IACtF,CAAC;IAED,8EAA8E;IAC9E,OAAO,CAAC,KAAyB;QAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;IACzE,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,QAAQ,CAAC,KAAyB;QACtC,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACjD,CAAC;IAED,gFAAgF;IAChF,KAAK,CAAC,eAAe,CAAC,KAAyB;QAC7C,OAAO,YAAY,CAAC,MAAM,IAAI,CAAC,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,GAAG,WAAW,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvG,CAAC;CACF;AAED,SAAS,WAAW,CAAC,KAAyB;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;AAC5D,CAAC;AAED,SAAS,YAAY,CAAC,QAA4B;IAChD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,CAAC;IACzB,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,QAAQ,IAAI,EAAE;QAC7B,KAAK,EAAE,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC5D,QAAQ,EAAE,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACvE,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,UAAwB,EAAE;IACpD,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,CAAC;AACrC,CAAC;AAED,mEAAmE;AACnE,MAAM,UAAU,aAAa,CAC3B,KAAoB,EACpB,EAAwB,EACxB,UAAwB,EAAE;IAE1B,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qBAAqB,CAAC,UAAwB,EAAE;IAC9D,MAAM,KAAK,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACnC,OAAO,KAAK,UAAU,mBAAmB,CACvC,QAA8D,EAC9D,IAAsC,EACtC,GAAQ;QAER,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,GAAG,CAAC,CAAC;QAClC,OAAO,KAAK,CAAC,aAAa,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACrD,CAAC,CAAC;AACJ,CAAC"}

package/dist/index.d.ts

@@ -0,0 +1,12 @@
+export { createGuard, guardToolCall, createGuardMiddleware, GrindFreeGuard } from "./guard.js";
+export type { GuardOptions, GuardedResult, ToolCallInput, CommandInput, SqlInput, PromptInput, CrawlInput, MemoryInput, OutputInput, DocumentInput, ReadInput, SafeReadResult, } from "./guard.js";
+export { createPaidFetch, postJson, readPrivateKey } from "./client.js";
+export type { ClientOptions, PaidFetch } from "./client.js";
+export { normalizeDecision, enforce, enforceError } from "./decisions.js";
+export type { Verdict, ReviewMode, ErrorMode, NormalizedDecision, EnforceOptions } from "./decisions.js";
+export { GuardConfigError, GuardError, GuardDenied, GuardReviewRequired } from "./errors.js";
+export { SERVICES, NETWORK, PAY_TO, serviceUrl } from "./services.js";
+export type { ServiceName, ServiceSpec, EndpointSpec } from "./services.js";
+export { wrapMcpClient } from "./wrap-mcp.js";
+export type { WrapMcpOptions } from "./wrap-mcp.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC/F,YAAY,EACV,YAAY,EACZ,aAAa,EACb,aAAa,EACb,YAAY,EACZ,QAAQ,EACR,WAAW,EACX,UAAU,EACV,WAAW,EACX,WAAW,EACX,aAAa,EACb,SAAS,EACT,cAAc,GACf,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACxE,YAAY,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC1E,YAAY,EAAE,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACzG,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AACtE,YAAY,EAAE,WAAW,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC5E,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAC9C,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/index.js

@@ -0,0 +1,7 @@
+export { createGuard, guardToolCall, createGuardMiddleware, GrindFreeGuard } from "./guard.js";
+export { createPaidFetch, postJson, readPrivateKey } from "./client.js";
+export { normalizeDecision, enforce, enforceError } from "./decisions.js";
+export { GuardConfigError, GuardError, GuardDenied, GuardReviewRequired } from "./errors.js";
+export { SERVICES, NETWORK, PAY_TO, serviceUrl } from "./services.js";
+export { wrapMcpClient } from "./wrap-mcp.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,qBAAqB,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAe/F,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAExE,OAAO,EAAE,iBAAiB,EAAE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE1E,OAAO,EAAE,gBAAgB,EAAE,UAAU,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAC7F,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtE,OAAO,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC"}

package/dist/services.d.ts

@@ -0,0 +1,96 @@
+/** Live GrindFree x402 origins, prices, and paths. USDC on Base. */
+export declare const NETWORK: "eip155:8453";
+export declare const PAY_TO: "0xe4b5827994B7B3Cd38F9830d9ECF58b51B77721b";
+export type ServiceName = "promptshield" | "crawlsafe" | "toolguard" | "commandguard" | "memoryguard" | "wireshield" | "docshield" | "saferead";
+export interface EndpointSpec {
+    path: string;
+    priceUsdc: string;
+}
+export interface ServiceSpec {
+    origin: string;
+    endpoints: Record<string, EndpointSpec>;
+}
+export declare const SERVICES: {
+    readonly promptshield: {
+        readonly origin: "https://promptshield.grindfree.net";
+        readonly endpoints: {
+            readonly screen: {
+                readonly path: "/v1/screen";
+                readonly priceUsdc: "0.002";
+            };
+            readonly clean: {
+                readonly path: "/v1/clean";
+                readonly priceUsdc: "0.002";
+            };
+        };
+    };
+    readonly crawlsafe: {
+        readonly origin: "https://crawlsafe.grindfree.net";
+        readonly endpoints: {
+            readonly check: {
+                readonly path: "/v1/check";
+                readonly priceUsdc: "0.002";
+            };
+        };
+    };
+    readonly toolguard: {
+        readonly origin: "https://toolguard.grindfree.net";
+        readonly endpoints: {
+            readonly evaluate: {
+                readonly path: "/v1/evaluate";
+                readonly priceUsdc: "0.002";
+            };
+        };
+    };
+    readonly commandguard: {
+        readonly origin: "https://commandguard.grindfree.net";
+        readonly endpoints: {
+            readonly command: {
+                readonly path: "/v1/command";
+                readonly priceUsdc: "0.001";
+            };
+            readonly sql: {
+                readonly path: "/v1/sql";
+                readonly priceUsdc: "0.001";
+            };
+        };
+    };
+    readonly memoryguard: {
+        readonly origin: "https://memoryguard.grindfree.net";
+        readonly endpoints: {
+            readonly screen: {
+                readonly path: "/v1/screen";
+                readonly priceUsdc: "0.002";
+            };
+        };
+    };
+    readonly wireshield: {
+        readonly origin: "https://wireshield.grindfree.net";
+        readonly endpoints: {
+            readonly scan: {
+                readonly path: "/v1/scan";
+                readonly priceUsdc: "0.002";
+            };
+        };
+    };
+    readonly docshield: {
+        readonly origin: "https://docshield.grindfree.net";
+        readonly endpoints: {
+            readonly scan: {
+                readonly path: "/v1/scan";
+                readonly priceUsdc: "0.004";
+            };
+        };
+    };
+    readonly saferead: {
+        readonly origin: "https://saferead.grindfree.net";
+        readonly endpoints: {
+            readonly read: {
+                readonly path: "/v1/read";
+                readonly priceUsdc: "0.003";
+            };
+        };
+    };
+};
+export declare function serviceUrl(service: ServiceName, endpoint: string): string;
+//# sourceMappingURL=services.d.ts.map

package/dist/services.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.d.ts","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,eAAO,MAAM,OAAO,EAAG,aAAsB,CAAC;AAC9C,eAAO,MAAM,MAAM,EAAG,4CAAqD,CAAC;AAE5E,MAAM,MAAM,WAAW,GACnB,cAAc,GACd,WAAW,GACX,WAAW,GACX,cAAc,GACd,aAAa,GACb,YAAY,GACZ,WAAW,GACX,UAAU,CAAC;AAEf,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;CACzC;AAED,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDgC,CAAC;AAEtD,wBAAgB,UAAU,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAKzE"}

package/dist/services.js

@@ -0,0 +1,63 @@
+/** Live GrindFree x402 origins, prices, and paths. USDC on Base. */
+export const NETWORK = "eip155:8453";
+export const PAY_TO = "0xe4b5827994B7B3Cd38F9830d9ECF58b51B77721b";
+export const SERVICES = {
+    promptshield: {
+        origin: "https://promptshield.grindfree.net",
+        endpoints: {
+            screen: { path: "/v1/screen", priceUsdc: "0.002" },
+            clean: { path: "/v1/clean", priceUsdc: "0.002" },
+        },
+    },
+    crawlsafe: {
+        origin: "https://crawlsafe.grindfree.net",
+        endpoints: {
+            check: { path: "/v1/check", priceUsdc: "0.002" },
+        },
+    },
+    toolguard: {
+        origin: "https://toolguard.grindfree.net",
+        endpoints: {
+            evaluate: { path: "/v1/evaluate", priceUsdc: "0.002" },
+        },
+    },
+    commandguard: {
+        origin: "https://commandguard.grindfree.net",
+        endpoints: {
+            command: { path: "/v1/command", priceUsdc: "0.001" },
+            sql: { path: "/v1/sql", priceUsdc: "0.001" },
+        },
+    },
+    memoryguard: {
+        origin: "https://memoryguard.grindfree.net",
+        endpoints: {
+            screen: { path: "/v1/screen", priceUsdc: "0.002" },
+        },
+    },
+    wireshield: {
+        origin: "https://wireshield.grindfree.net",
+        endpoints: {
+            scan: { path: "/v1/scan", priceUsdc: "0.002" },
+        },
+    },
+    docshield: {
+        origin: "https://docshield.grindfree.net",
+        endpoints: {
+            scan: { path: "/v1/scan", priceUsdc: "0.004" },
+        },
+    },
+    saferead: {
+        origin: "https://saferead.grindfree.net",
+        endpoints: {
+            read: { path: "/v1/read", priceUsdc: "0.003" },
+        },
+    },
+};
+export function serviceUrl(service, endpoint) {
+    const spec = SERVICES[service];
+    const ep = spec.endpoints[endpoint];
+    if (!ep)
+        throw new Error(`Unknown endpoint ${service} ${endpoint}`);
+    return `${spec.origin}${ep.path}`;
+}
+//# sourceMappingURL=services.js.map

package/dist/services.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"services.js","sourceRoot":"","sources":["../src/services.ts"],"names":[],"mappings":"AAAA,oEAAoE;AAEpE,MAAM,CAAC,MAAM,OAAO,GAAG,aAAsB,CAAC;AAC9C,MAAM,CAAC,MAAM,MAAM,GAAG,4CAAqD,CAAC;AAsB5E,MAAM,CAAC,MAAM,QAAQ,GAAG;IACtB,YAAY,EAAE;QACZ,MAAM,EAAE,oCAAoC;QAC5C,SAAS,EAAE;YACT,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE;YAClD,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE;SACjD;KACF;IACD,SAAS,EAAE;QACT,MAAM,EAAE,iCAAiC;QACzC,SAAS,EAAE;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE;SACjD;KACF;IACD,SAAS,EAAE;QACT,MAAM,EAAE,iCAAiC;QACzC,SAAS,EAAE;YACT,QAAQ,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,SAAS,EAAE,OAAO,EAAE;SACvD;KACF;IACD,YAAY,EAAE;QACZ,MAAM,EAAE,oCAAoC;QAC5C,SAAS,EAAE;YACT,OAAO,EAAE,EAAE,IAAI,EAAE,aAAa,EAAE,SAAS,EAAE,OAAO,EAAE;YACpD,GAAG,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE;SAC7C;KACF;IACD,WAAW,EAAE;QACX,MAAM,EAAE,mCAAmC;QAC3C,SAAS,EAAE;YACT,MAAM,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,OAAO,EAAE;SACnD;KACF;IACD,UAAU,EAAE;QACV,MAAM,EAAE,kCAAkC;QAC1C,SAAS,EAAE;YACT,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE;SAC/C;KACF;IACD,SAAS,EAAE;QACT,MAAM,EAAE,iCAAiC;QACzC,SAAS,EAAE;YACT,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE;SAC/C;KACF;IACD,QAAQ,EAAE;QACR,MAAM,EAAE,gCAAgC;QACxC,SAAS,EAAE;YACT,IAAI,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE;SAC/C;KACF;CACkD,CAAC;AAEtD,MAAM,UAAU,UAAU,CAAC,OAAoB,EAAE,QAAgB;IAC/D,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAgB,CAAC;IAC9C,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IACpC,IAAI,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,IAAI,QAAQ,EAAE,CAAC,CAAC;IACpE,OAAO,GAAG,IAAI,CAAC,MAAM,GAAG,EAAE,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC"}

package/dist/wrap-mcp.d.ts

@@ -0,0 +1,24 @@
+/**
+ * MCP client wrapper: evaluate ToolGuard before client.callTool, and
+ * CommandGuard when the tool looks like a shell/SQL execution.
+ *
+ * No MCP SDK dependency. Pass any client with callTool().
+ * export X402_PRIVATE_KEY=0xYOUR_BASE_USDC_PRIVATE_KEY
+ */
+import { type GrindFreeGuard } from "./guard.js";
+export type WrapMcpOptions = {
+    guard?: GrindFreeGuard;
+    /** Tool names treated as shell execution (CommandGuard). */
+    commandTools?: string[];
+    /** Tool names treated as SQL execution (CommandGuard /v1/sql). */
+    sqlTools?: string[];
+    policy?: Record<string, unknown>;
+};
+/**
+ * Wrap an MCP client so every callTool is screened first. The original
+ * client is returned for chaining; callTool is replaced in place.
+ */
+export declare function wrapMcpClient<T extends {
+    callTool: (...args: any[]) => any;
+}>(client: T, opts?: WrapMcpOptions): T;
+//# sourceMappingURL=wrap-mcp.d.ts.map

package/dist/wrap-mcp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wrap-mcp.d.ts","sourceRoot":"","sources":["../src/wrap-mcp.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAe,KAAK,cAAc,EAAE,MAAM,YAAY,CAAC;AAG9D,MAAM,MAAM,cAAc,GAAG;IAC3B,KAAK,CAAC,EAAE,cAAc,CAAC;IACvB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,kEAAkE;IAClE,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC,CAAC;AAcF;;;GAGG;AACH,wBAAgB,aAAa,CAAC,CAAC,SAAS;IAAE,QAAQ,EAAE,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,KAAK,GAAG,CAAA;CAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,GAAE,cAAmB,GAAG,CAAC,CA8BtH"}