@groovysec/whiteout-ai 0.3.0

package/dist/appGuard.js

@@ -0,0 +1,627 @@
+import { AsyncLocalStorage } from "node:async_hooks";
+/**
+ * App-key client for the Whiteout Guard API (`/v1/guard/*`).
+ *
+ * `AppGuard` covers a customer's own LLM application (a Custom AI App in the
+ * admin console). It authenticates with an app key (`WHITEOUT_APP_KEY`,
+ * `wo_app_<env>_...`), needs no registration, and blocks on both sides of the
+ * model call:
+ *
+ *   const guard = new AppGuard();                     // reads WHITEOUT_APP_KEY
+ *   const client = guard.openai(new OpenAI());        // same client, governed
+ *   await client.chat.completions.create({ model: "gpt-4o", messages });
+ *
+ * Fail behaviour: when Whiteout can't be reached, the policy group's
+ * `fail_behavior` (from `/v1/guard/config`) decides unless `failOpen` is set.
+ * With no config yet the default is fail-open.
+ *
+ * Streaming: `streamMode: "buffered"` (default) holds the whole response until
+ * the output check passes. `"passthrough"` yields chunks as they arrive and
+ * checks every `checkEvery` characters plus once at the end; text already
+ * shown can't be retracted, so use buffered mode where you enforce.
+ *
+ * The enrollment-token `WhiteoutGuard` (`/infra-agent/*`) is unchanged.
+ */
+import { WhiteoutBlockedError, WhiteoutConfigError } from "./exceptions.js";
+export const DEFAULT_BASE_URL = "https://api.whiteout.groovysec.com";
+export const SCAN_TARGETS = ["user", "system", "context", "tool"];
+const MAX_TEXT = 200_000;
+const MAX_MESSAGES = 500;
+const MAX_EVENTS_PER_BATCH = 100;
+const CONFIG_TTL_MS = 300_000;
+const CONFIG_RETRY_MS = 60_000;
+const ROLE_ALIASES = { developer: "system", function: "tool", human: "user", ai: "assistant" };
+const ROLES = new Set(["system", "user", "assistant", "tool"]);
+export const SDK_VERSION = "0.3.0";
+/** What a quarantined system / tool turn is replaced with before the model sees it (ids kept, so tool calls stay paired). */
+export const QUARANTINE_NOTICE = "[Removed by Whiteout: this content contained instructions aimed at the AI assistant and was not passed to the model.]";
+/** `docs` minus the ones Whiteout quarantined — pass the same list you sent as `context`. */
+export function cleanContext(docs, decision) {
+    const drop = new Set(decision.quarantine?.context ?? []);
+    return docs.filter((_, i) => !drop.has(i));
+}
+// ── helpers ─────────────────────────────────────────────────────────────────
+const get = (obj, key) => obj !== null && typeof obj === "object" ? obj[key] : undefined;
+function blockText(content) {
+    if (content == null)
+        return "";
+    if (typeof content === "string")
+        return content;
+    if (Array.isArray(content)) {
+        return content
+            .map((b) => {
+            if (typeof b === "string")
+                return b;
+            const t = get(b, "type");
+            if (["text", "input_text", "output_text"].includes(t) || (t === undefined && typeof get(b, "text") === "string"))
+                return get(b, "text") ?? "";
+            return "";
+        })
+            .filter(Boolean)
+            .join("\n");
+    }
+    return String(content);
+}
+/** Chat history from OpenAI, Anthropic or LangChain shapes → Guard API messages. */
+export function normalizeMessages(messages, system) {
+    return normalizeWithOrigin(messages, system).map((e) => e.msg);
+}
+function normalizeWithOrigin(messages, system) {
+    let out = [];
+    const sys = blockText(system);
+    if (sys)
+        out.push({ msg: { role: "system", content: sys.slice(0, MAX_TEXT) }, origin: { i: "system" } });
+    (messages ?? []).forEach((m, i) => {
+        // LangChain JS messages expose their kind via _getType() ("human", "ai", ...).
+        const lcType = typeof get(m, "_getType") === "function" ? m._getType() : undefined;
+        let role = get(m, "role") ?? lcType ?? get(m, "type");
+        role = ROLE_ALIASES[role] ?? role;
+        if (!ROLES.has(role))
+            return;
+        const content = get(m, "content");
+        const text = blockText(content);
+        if (text)
+            out.push({ msg: { role, content: text.slice(0, MAX_TEXT) }, origin: { i } });
+        if (Array.isArray(content)) {
+            content.forEach((b, bi) => {
+                if (get(b, "type") !== "tool_result")
+                    return;
+                const t = blockText(get(b, "content"));
+                if (t)
+                    out.push({ msg: { role: "tool", content: t.slice(0, MAX_TEXT) }, origin: { i, b: bi } });
+            });
+        }
+    });
+    if (out.length > MAX_MESSAGES) {
+        const systems = out.filter((e) => e.msg.role === "system").slice(0, MAX_MESSAGES);
+        const keep = MAX_MESSAGES - systems.length;
+        const rest = out.filter((e) => e.msg.role !== "system");
+        out = systems.concat(keep ? rest.slice(-keep) : []);
+    }
+    return out;
+}
+/**
+ * A copy of the provider params with every quarantined system / tool turn replaced by
+ * QUARANTINE_NOTICE. Tool results keep their ids; the caller's objects are never mutated.
+ */
+export function applyQuarantine(params, decision, systemKey = "system") {
+    const idx = decision.quarantine?.messages ?? [];
+    if (!idx.length)
+        return params;
+    const origins = normalizeWithOrigin(params.messages, systemKey ? params[systemKey] : undefined).map((e) => e.origin);
+    const messages = [...(params.messages ?? [])];
+    const out = { ...params };
+    for (const n of idx) {
+        const o = origins[n];
+        if (!o)
+            continue;
+        if (o.i === "system") {
+            if (systemKey)
+                out[systemKey] = QUARANTINE_NOTICE;
+            continue;
+        }
+        const m = messages[o.i];
+        if (o.b === undefined)
+            messages[o.i] = { ...m, content: QUARANTINE_NOTICE };
+        else {
+            const blocks = [...(m.content ?? [])];
+            blocks[o.b] = { ...blocks[o.b], content: QUARANTINE_NOTICE };
+            messages[o.i] = { ...m, content: blocks };
+        }
+    }
+    out.messages = messages;
+    return out;
+}
+function normalizeContext(context) {
+    if (!context?.length)
+        return undefined;
+    return context.slice(0, 100).map((d) => {
+        if (typeof d === "string")
+            return { content: d.slice(0, MAX_TEXT) };
+        const doc = { content: String(d.content ?? get(d, "pageContent") ?? "").slice(0, MAX_TEXT) };
+        const source = d.source ?? get(get(d, "metadata"), "source");
+        if (source)
+            doc.source = String(source).slice(0, 300);
+        return doc;
+    });
+}
+function toDecision(data) {
+    const reason = String(data.reason ?? "");
+    const decision = (data.decision ?? "allow");
+    return {
+        decision,
+        violatedPolicies: Array.isArray(data.violated_policies) ? data.violated_policies : [],
+        reason,
+        evaluationId: data.evaluation_id ?? undefined,
+        failOpen: Boolean(data.fail_open),
+        mode: String(data.mode ?? ""),
+        latencyMs: data.latency_ms,
+        rule: data.rule,
+        responseFlagged: Boolean(data.response_flagged),
+        failedClosed: reason.endsWith("(fail-closed)"),
+        allowed: decision !== "block",
+        ...(data.user ? { user: data.user } : {}),
+        ...(data.identity ? { identity: data.identity } : {}),
+        ...(data.injection ? { injection: data.injection } : {}),
+        quarantine: {
+            messages: Array.isArray(data.quarantine?.messages) ? data.quarantine.messages : [],
+            context: Array.isArray(data.quarantine?.context) ? data.quarantine.context : [],
+        },
+    };
+}
+/**
+ * True while a governed model call is in flight — auto-instrumentation passes such
+ * calls straight through, so a hand-wrapped client is never checked twice.
+ * @internal
+ */
+export const guarding = new AsyncLocalStorage();
+const randomId = () => globalThis.crypto?.randomUUID?.().replace(/-/g, "") ?? `${Date.now().toString(16)}${Math.random().toString(16).slice(2)}`;
+export const OPENAI = {
+    systemKey: null,
+    name: "openai",
+    createPath: ["chat", "completions", "create"],
+    text: (r) => blockText(get(get(get(r, "choices")?.[0], "message"), "content")),
+    usage: (r) => [get(get(r, "usage"), "prompt_tokens"), get(get(r, "usage"), "completion_tokens")],
+    chunk: (c) => {
+        const text = get(get(get(c, "choices")?.[0], "delta"), "content") ?? "";
+        return [typeof text === "string" ? text : "", get(get(c, "usage"), "prompt_tokens"), get(get(c, "usage"), "completion_tokens")];
+    },
+};
+/** OpenAI Responses API: `input` (string or items) + `instructions`. */
+export const OPENAI_RESPONSES = {
+    name: "openai",
+    createPath: ["responses", "create"],
+    text: (r) => {
+        const t = get(r, "output_text");
+        if (typeof t === "string")
+            return t;
+        return (get(r, "output") ?? [])
+            .flatMap((item) => get(item, "content") ?? [])
+            .filter((c) => get(c, "type") === "output_text")
+            .map((c) => get(c, "text") ?? "")
+            .join("");
+    },
+    usage: (r) => [get(get(r, "usage"), "input_tokens"), get(get(r, "usage"), "output_tokens")],
+    chunk: (e) => {
+        const type = get(e, "type");
+        if (type === "response.output_text.delta")
+            return [get(e, "delta") ?? "", undefined, undefined];
+        if (type === "response.completed") {
+            const u = get(get(e, "response"), "usage");
+            return ["", get(u, "input_tokens"), get(u, "output_tokens")];
+        }
+        return ["", undefined, undefined];
+    },
+    messagesOf: (p) => {
+        const input = p.input;
+        if (typeof input === "string")
+            return [[{ role: "user", content: input }], p.instructions];
+        const msgs = (Array.isArray(input) ? input : []).flatMap((item) => get(item, "type") === "function_call_output" ? [{ role: "tool", content: String(get(item, "output") ?? "") }]
+            : get(item, "role") ? [{ role: get(item, "role"), content: get(item, "content") }] : []);
+        return [msgs, p.instructions];
+    },
+    quarantine: false,
+};
+export const ANTHROPIC = {
+    systemKey: "system",
+    name: "anthropic",
+    createPath: ["messages", "create"],
+    text: (r) => blockText(get(r, "content")),
+    usage: (r) => [get(get(r, "usage"), "input_tokens"), get(get(r, "usage"), "output_tokens")],
+    chunk: (e) => {
+        const type = get(e, "type");
+        if (type === "content_block_delta") {
+            const d = get(e, "delta");
+            return [["text_delta", undefined].includes(get(d, "type")) ? get(d, "text") ?? "" : "", undefined, undefined];
+        }
+        if (type === "message_start")
+            return ["", get(get(get(e, "message"), "usage"), "input_tokens"), undefined];
+        if (type === "message_delta")
+            return ["", undefined, get(get(e, "usage"), "output_tokens")];
+        return ["", undefined, undefined];
+    },
+};
+/** Proxy that swaps in `replacement` at a dotted path and delegates everything else. */
+function patchPath(target, path, replacement) {
+    const [head, ...rest] = path;
+    return new Proxy(target, {
+        // Read through the real object (not the proxy) so #private getters keep working.
+        get(obj, prop) {
+            if (prop === head) {
+                if (!rest.length)
+                    return replacement;
+                return patchPath(Reflect.get(obj, prop), rest, replacement);
+            }
+            const value = Reflect.get(obj, prop);
+            return typeof value === "function" ? value.bind(obj) : value;
+        },
+    });
+}
+// ── client ──────────────────────────────────────────────────────────────────
+export class AppGuard {
+    key;
+    baseUrl;
+    timeoutMs;
+    failOpen;
+    blockOutput;
+    scan;
+    streamMode;
+    checkEvery;
+    fetchFn;
+    log;
+    cfg = null;
+    cfgEtag = null;
+    cfgCheckedAt = null;
+    cfgInflight = null;
+    pending = new Set();
+    enforce;
+    auto;
+    appRef;
+    constructor(opts = {}) {
+        const env = typeof process !== "undefined" ? process.env : {};
+        const key = opts.appKey ?? env.WHITEOUT_APP_KEY ?? env.WHITEOUT_GATEWAY_KEY ?? "";
+        if (!key)
+            throw new WhiteoutConfigError("appKey is required (or set WHITEOUT_APP_KEY)");
+        if (!key.startsWith("wo_app_") && !key.startsWith("wo_gw_"))
+            throw new WhiteoutConfigError("appKey must be a Whiteout app key (wo_app_...) or gateway key (wo_gw_...). Enrollment tokens belong to WhiteoutGuard.");
+        this.scan = AppGuard.checkScan(opts.scan ?? ["user"]);
+        const streamMode = opts.streamMode ?? "buffered";
+        if (streamMode !== "buffered" && streamMode !== "passthrough")
+            throw new WhiteoutConfigError('streamMode must be "buffered" or "passthrough"');
+        const checkEvery = opts.checkEvery ?? 2000;
+        if (!(checkEvery >= 1))
+            throw new WhiteoutConfigError("checkEvery must be positive");
+        const fetchFn = opts.fetch ?? globalThis.fetch;
+        if (!fetchFn)
+            throw new WhiteoutConfigError("global fetch is unavailable; pass options.fetch (Node 18+ has it)");
+        this.key = key;
+        this.baseUrl = (opts.baseUrl ?? env.WHITEOUT_BASE_URL ?? DEFAULT_BASE_URL).replace(/\/+$/, "");
+        this.timeoutMs = opts.timeoutMs ?? 10_000;
+        this.failOpen = opts.failOpen;
+        this.blockOutput = opts.blockOutput ?? true;
+        this.streamMode = streamMode;
+        this.checkEvery = checkEvery;
+        this.fetchFn = fetchFn;
+        this.log = opts.logger ?? console;
+        this.enforce = opts.enforce ?? true;
+        this.auto = opts.auto ?? false;
+        this.appRef = opts.appRef ?? env.WHITEOUT_APP_REF ?? undefined;
+    }
+    static checkScan(scan) {
+        if (!scan.length || scan.some((s) => !SCAN_TARGETS.includes(s)))
+            throw new WhiteoutConfigError(`scan must be a non-empty subset of ${SCAN_TARGETS.join(", ")}`);
+        return [...scan];
+    }
+    async request(method, path, body, headers = {}) {
+        try {
+            return await this.fetchFn(this.baseUrl + path, {
+                method,
+                headers: {
+                    Authorization: `Bearer ${this.key}`,
+                    "User-Agent": `whiteout-ai-node/${SDK_VERSION}${this.auto ? " (auto)" : ""}`,
+                    ...(this.appRef ? { "X-Whiteout-App": this.appRef } : {}),
+                    ...(body !== undefined ? { "Content-Type": "application/json" } : {}),
+                    ...headers,
+                },
+                body: body !== undefined ? JSON.stringify(body) : undefined,
+                signal: AbortSignal.timeout(this.timeoutMs),
+            });
+        }
+        catch (e) {
+            return e instanceof Error ? e : new Error(String(e));
+        }
+    }
+    configStale() {
+        return this.cfgCheckedAt === null || Date.now() - this.cfgCheckedAt >= CONFIG_TTL_MS;
+    }
+    effectiveFailOpen() {
+        return this.failOpen ?? this.cfg?.fail_behavior !== "closed";
+    }
+    /** The app's policy-group settings (mode, fail behaviour, ...). Cached with ETag. */
+    async config(refresh = false) {
+        if (!refresh && !this.configStale())
+            return this.cfg;
+        if (this.cfgInflight)
+            return this.cfgInflight;
+        this.cfgInflight = (async () => {
+            const resp = await this.request("GET", "/v1/guard/config", undefined, this.cfgEtag ? { "If-None-Match": this.cfgEtag } : {});
+            const now = Date.now();
+            this.cfgCheckedAt = now;
+            if (resp instanceof Error || (resp.status !== 200 && resp.status !== 304)) {
+                this.cfgCheckedAt = now - (CONFIG_TTL_MS - CONFIG_RETRY_MS);
+                if (!(resp instanceof Error) && (resp.status === 401 || resp.status === 403))
+                    this.log.error(`[Whiteout] app key rejected by /v1/guard/config (${resp.status})`);
+            }
+            else if (resp.status === 200) {
+                try {
+                    this.cfg = (await resp.json());
+                    this.cfgEtag = resp.headers.get("etag");
+                }
+                catch {
+                    /* keep the previous config */
+                }
+            }
+            return this.cfg;
+        })().finally(() => {
+            this.cfgInflight = null;
+        });
+        return this.cfgInflight;
+    }
+    fail(what, evaluationId) {
+        const fo = this.effectiveFailOpen();
+        this.log.warn(`[Whiteout] ${what} — ${fo ? "failing open" : "failing closed"}`);
+        return {
+            decision: fo ? "allow" : "block",
+            violatedPolicies: [],
+            reason: `${what} (${fo ? "fail-open" : "fail-closed"})`,
+            evaluationId,
+            failOpen: fo,
+            mode: "",
+            responseFlagged: false,
+            failedClosed: !fo,
+            allowed: fo,
+            quarantine: { messages: [], context: [] },
+        };
+    }
+    async interpret(resp, what, evaluationId) {
+        if (resp instanceof Error)
+            return this.fail(`${what}: Whiteout unreachable (${resp.name})`, evaluationId);
+        if (resp.status === 200) {
+            try {
+                return toDecision((await resp.json()));
+            }
+            catch {
+                return this.fail(`${what}: unreadable response`, evaluationId);
+            }
+        }
+        let code = "";
+        try {
+            const detail = (await resp.json())?.detail;
+            code = typeof detail === "object" && detail ? String(detail.code ?? "") : "";
+        }
+        catch {
+            /* no body */
+        }
+        if (resp.status === 401 || resp.status === 403)
+            this.log.error(`[Whiteout] app key rejected (${resp.status} ${code || "unauthorized"}) — coverage is NOT being applied`);
+        return this.fail(`${what}: HTTP ${resp.status}${code ? " " + code : ""}`, evaluationId);
+    }
+    raiseIfBlocked(d, stage) {
+        if (d.decision === "block" && this.enforce)
+            throw new WhiteoutBlockedError({
+                reason: d.reason,
+                violatedPolicies: d.violatedPolicies,
+                rule: d.rule == null ? "" : String(d.rule),
+                stage,
+                evaluationId: d.evaluationId,
+                failedClosed: d.failedClosed,
+            });
+        return d;
+    }
+    /** Evaluate a prompt before it reaches the model. Throws WhiteoutBlockedError on block. */
+    async checkInput(opts) {
+        if (this.failOpen === undefined && this.configStale())
+            await this.config();
+        const messages = opts.messages !== undefined || opts.system ? normalizeMessages(opts.messages, opts.system) : undefined;
+        const body = { scan: opts.scan ? AppGuard.checkScan(opts.scan) : this.scan };
+        if (messages?.length)
+            body.messages = messages;
+        if (opts.text !== undefined)
+            body.text = String(opts.text).slice(0, MAX_TEXT);
+        else if (!messages?.length)
+            body.text = "";
+        const extra = {
+            context: normalizeContext(opts.context),
+            end_user: opts.endUser,
+            session_id: opts.sessionId,
+            model: opts.model,
+            provider: opts.provider,
+            token_count_in: opts.tokenCountIn,
+            metadata: opts.metadata,
+        };
+        for (const [k, v] of Object.entries(extra))
+            if (v !== undefined && v !== null)
+                body[k] = v;
+        const userHeaders = {
+            ...(opts.userToken ? { "X-Whiteout-User-Token": String(opts.userToken) } : {}),
+            ...(opts.appRef ? { "X-Whiteout-App": String(opts.appRef) } : {}),
+        };
+        const d = await this.interpret(await this.request("POST", "/v1/guard/input", body, userHeaders), "input check");
+        return opts.raiseOnBlock === false ? d : this.raiseIfBlocked(d, "input");
+    }
+    /** Evaluate a model response. `finish: false` marks a streaming checkpoint. */
+    async checkOutput(evaluationId, text, opts = {}) {
+        const body = {
+            evaluation_id: evaluationId || randomId(),
+            text: (text ?? "").slice(0, MAX_TEXT),
+            finish: opts.finish ?? true,
+        };
+        const extra = {
+            model: opts.model,
+            provider: opts.provider,
+            token_count_in: opts.tokenCountIn,
+            token_count_out: opts.tokenCountOut,
+        };
+        for (const [k, v] of Object.entries(extra))
+            if (v !== undefined && v !== null)
+                body[k] = v;
+        const outHeaders = opts.appRef ? { "X-Whiteout-App": String(opts.appRef) } : {};
+        const d = await this.interpret(await this.request("POST", "/v1/guard/output", body, outHeaders), "output check", body.evaluation_id);
+        return opts.raiseOnBlock === false ? d : this.raiseIfBlocked(d, "output");
+    }
+    /** @internal Blocking or fire-and-forget output check, per `blockOutput`. */
+    async afterOutput(evaluationId, text, opts) {
+        if (this.blockOutput) {
+            await this.checkOutput(evaluationId, text, opts);
+            return;
+        }
+        const p = this.checkOutput(evaluationId, text, { ...opts, raiseOnBlock: false }).catch(() => undefined);
+        this.pending.add(p);
+        void p.finally(() => this.pending.delete(p));
+    }
+    /** Report calls after the fact (observe-only). Batched 100 per request. */
+    async sendEvents(events) {
+        let accepted = 0;
+        let flagged = 0;
+        for (let i = 0; i < events.length; i += MAX_EVENTS_PER_BATCH) {
+            const resp = await this.request("POST", "/v1/guard/events", { events: events.slice(i, i + MAX_EVENTS_PER_BATCH) });
+            if (resp instanceof Error || resp.status !== 202) {
+                this.log.warn(`[Whiteout] event batch not accepted (${resp instanceof Error ? resp.name : resp.status})`);
+                continue;
+            }
+            const data = (await resp.json());
+            accepted += data.accepted ?? 0;
+            flagged += data.flagged ?? 0;
+        }
+        return { accepted, flagged };
+    }
+    /** Wait for fire-and-forget output checks (call before a serverless handler returns). */
+    async flush() {
+        await Promise.all([...this.pending]);
+    }
+    /** Govern `client.chat.completions.create` and `client.responses.create` on an `openai` client. */
+    openai(client) {
+        const wrapped = this.wrapClient(client, OPENAI);
+        return client.responses?.create ? this.wrapClient(wrapped, OPENAI_RESPONSES) : wrapped;
+    }
+    /** Govern `client.messages.create` on an `@anthropic-ai/sdk` client. */
+    anthropic(client) {
+        return this.wrapClient(client, ANTHROPIC);
+    }
+    /**
+     * @internal One governed model call: input check, quarantine, the call, output check.
+     * `call` sends the (possibly rewritten) params to the provider.
+     */
+    async guardedCreate(provider, call, params) {
+        const { whiteout, ...providerParams } = params ?? {};
+        const opts = (whiteout ?? {});
+        const model = providerParams.model;
+        const [messages, system] = provider.messagesOf
+            ? provider.messagesOf(providerParams)
+            : [providerParams.messages, providerParams.system];
+        const d = await this.checkInput({
+            messages,
+            system,
+            model,
+            provider: provider.name,
+            endUser: opts.endUser,
+            userToken: opts.userToken,
+            appRef: opts.appRef,
+            sessionId: opts.sessionId,
+            scan: opts.scan,
+            context: opts.context,
+            metadata: opts.metadata,
+        });
+        const sent = provider.quarantine !== false && d.quarantine.messages.length
+            ? applyQuarantine(providerParams, d, provider.systemKey ?? null)
+            : providerParams;
+        const resp = await guarding.run(true, () => call(sent));
+        if (providerParams.stream)
+            return guardStream(this, resp, d.evaluationId, provider, model);
+        const [tokenCountIn, tokenCountOut] = provider.usage(resp);
+        await this.afterOutput(d.evaluationId, provider.text(resp), { model, provider: provider.name, tokenCountIn, tokenCountOut });
+        return resp;
+    }
+    wrapClient(client, provider) {
+        const parent = provider.createPath.slice(0, -1).reduce((o, k) => o?.[k], client);
+        const method = provider.createPath[provider.createPath.length - 1];
+        if (typeof parent?.[method] !== "function")
+            throw new WhiteoutConfigError(`client has no ${provider.createPath.join(".")}() — is this a ${provider.name} client?`);
+        const create = (params, ...rest) => this.guardedCreate(provider, (p) => parent[method](p, ...rest), params);
+        return patchPath(client, provider.createPath, create);
+    }
+}
+/** Wrap a provider stream so iterating it runs the output checks. Other properties delegate. */
+function guardStream(guard, stream, evaluationId, provider, model) {
+    const parts = [];
+    let length = 0;
+    let checkedAt = 0;
+    let tin;
+    let tout;
+    const feed = (chunk) => {
+        const [text, i, o] = provider.chunk(chunk);
+        if (i !== undefined)
+            tin = i;
+        if (o !== undefined)
+            tout = o;
+        if (text) {
+            parts.push(text);
+            length += text.length;
+        }
+        return length - checkedAt >= guard.checkEvery;
+    };
+    const opts = (finish) => {
+        checkedAt = length;
+        return finish
+            ? { finish, model, provider: provider.name, tokenCountIn: tin, tokenCountOut: tout }
+            : { finish, model, provider: provider.name };
+    };
+    const source = stream;
+    const abort = () => {
+        const ctl = get(stream, "controller");
+        if (ctl && typeof ctl.abort === "function")
+            ctl.abort();
+    };
+    async function* iterate() {
+        if (!guard.blockOutput) {
+            for await (const chunk of source) {
+                feed(chunk);
+                yield chunk;
+            }
+            await guard.afterOutput(evaluationId, parts.join(""), opts(true));
+            return;
+        }
+        if (guard.streamMode === "buffered") {
+            const chunks = [];
+            for await (const chunk of source) {
+                feed(chunk);
+                chunks.push(chunk);
+            }
+            await guard.checkOutput(evaluationId, parts.join(""), opts(true));
+            yield* chunks;
+            return;
+        }
+        for await (const chunk of source) {
+            if (feed(chunk)) {
+                try {
+                    await guard.checkOutput(evaluationId, parts.join(""), opts(false));
+                }
+                catch (e) {
+                    abort();
+                    throw e;
+                }
+            }
+            yield chunk;
+        }
+        await guard.checkOutput(evaluationId, parts.join(""), opts(true));
+    }
+    return new Proxy(stream, {
+        get(obj, prop) {
+            if (prop === Symbol.asyncIterator)
+                return () => iterate();
+            const value = Reflect.get(obj, prop);
+            return typeof value === "function" ? value.bind(obj) : value;
+        },
+    });
+}
+//# sourceMappingURL=appGuard.js.map