@guardbee/guard-core 0.9.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (17) hide show
  1. package/dist/cjs/index.d.ts +1 -1
  2. package/dist/cjs/index.d.ts.map +1 -1
  3. package/dist/cjs/index.js +2 -1
  4. package/dist/cjs/index.js.map +1 -1
  5. package/dist/cjs/policy.d.ts +87 -0
  6. package/dist/cjs/policy.d.ts.map +1 -1
  7. package/dist/cjs/policy.js +32 -1
  8. package/dist/cjs/policy.js.map +1 -1
  9. package/dist/index.d.ts +1 -1
  10. package/dist/index.d.ts.map +1 -1
  11. package/dist/index.js +1 -1
  12. package/dist/index.js.map +1 -1
  13. package/dist/policy.d.ts +87 -0
  14. package/dist/policy.d.ts.map +1 -1
  15. package/dist/policy.js +31 -0
  16. package/dist/policy.js.map +1 -1
  17. package/package.json +1 -1
package/dist/cjs/index.d.ts CHANGED
@@ -7,7 +7,7 @@ export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjec
7
7
  export type { ScanResult, InjectionRule, InjectionCategory, InjectionFinding } from "./injection.js";
8
8
  export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
9
9
  export type { Capability, FlowCategory, ToolRecord } from "./classify.js";
10
- export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
10
+ export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, quotaRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
11
11
  export type { GatewayPolicy, PolicyValidation } from "./policy.js";
12
12
  export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./tool-poisoning.js";
13
13
  export type { DescriptionInjectionPattern, MismatchSinkRule, ToolPoisoningCategory } from "./tool-poisoning.js";
package/dist/cjs/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1G,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1G,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
package/dist/cjs/index.js CHANGED
@@ -1,6 +1,6 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.scanToolCatalog = exports.matchSurface = exports.annotationContradicts = exports.READ_ONLY_HINT = exports.MISMATCH_SINK_RULES = exports.DESCRIPTION_INJECTION_PATTERNS = exports.validatePolicy = exports.gatewayPolicySchema = exports.policyShape = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = exports.textOf = exports.classifyTool = exports.CAPABILITY_RULES = exports.scanToolResult = exports.scanForPromptInjection = exports.findInjections = exports.INJECTION_PATTERNS = exports.INJECTION_RULES = exports.SECRET_RULES = exports.maskPiiInValue = exports.maskPiiInText = exports.PII_PATTERNS = exports.isValidTrPhone = exports.isValidVkn = exports.isValidIban = exports.isValidLuhn = exports.isValidTcKimlik = void 0;
3
+ exports.scanToolCatalog = exports.matchSurface = exports.annotationContradicts = exports.READ_ONLY_HINT = exports.MISMATCH_SINK_RULES = exports.DESCRIPTION_INJECTION_PATTERNS = exports.validatePolicy = exports.gatewayPolicySchema = exports.policyShape = exports.quotaRuleSchema = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = exports.textOf = exports.classifyTool = exports.CAPABILITY_RULES = exports.scanToolResult = exports.scanForPromptInjection = exports.findInjections = exports.INJECTION_PATTERNS = exports.INJECTION_RULES = exports.SECRET_RULES = exports.maskPiiInValue = exports.maskPiiInText = exports.PII_PATTERNS = exports.isValidTrPhone = exports.isValidVkn = exports.isValidIban = exports.isValidLuhn = exports.isValidTcKimlik = void 0;
4
4
  var validators_js_1 = require("./validators.js");
5
5
  Object.defineProperty(exports, "isValidTcKimlik", { enumerable: true, get: function () { return validators_js_1.isValidTcKimlik; } });
6
6
  Object.defineProperty(exports, "isValidLuhn", { enumerable: true, get: function () { return validators_js_1.isValidLuhn; } });
@@ -27,6 +27,7 @@ var policy_js_1 = require("./policy.js");
27
27
  Object.defineProperty(exports, "POLICY_LABELS", { enumerable: true, get: function () { return policy_js_1.POLICY_LABELS; } });
28
28
  Object.defineProperty(exports, "POLICY_ACTIONS", { enumerable: true, get: function () { return policy_js_1.POLICY_ACTIONS; } });
29
29
  Object.defineProperty(exports, "policyRuleSchema", { enumerable: true, get: function () { return policy_js_1.policyRuleSchema; } });
30
+ Object.defineProperty(exports, "quotaRuleSchema", { enumerable: true, get: function () { return policy_js_1.quotaRuleSchema; } });
30
31
  Object.defineProperty(exports, "policyShape", { enumerable: true, get: function () { return policy_js_1.policyShape; } });
31
32
  Object.defineProperty(exports, "gatewayPolicySchema", { enumerable: true, get: function () { return policy_js_1.gatewayPolicySchema; } });
32
33
  Object.defineProperty(exports, "validatePolicy", { enumerable: true, get: function () { return policy_js_1.validatePolicy; } });
package/dist/cjs/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAwG;AAA/F,gHAAA,eAAe,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,2GAAA,UAAU,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC9E,mCAAuE;AAA9D,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,wGAAA,cAAc,OAAA;AAEpD,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AAErB,+CAMwB;AALtB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,8GAAA,cAAc,OAAA;AACd,sHAAA,sBAAsB,OAAA;AACtB,8GAAA,cAAc,OAAA;AAGhB,6CAAuE;AAA9D,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA;AAE/C,yCAAgI;AAAvH,0GAAA,aAAa,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAE1G,yDAA0G;AAAjG,mIAAA,8BAA8B,OAAA;AAAE,wHAAA,mBAAmB,OAAA;AAAE,mHAAA,cAAc,OAAA;AAE5E,qDAAyF;AAAhF,wHAAA,qBAAqB,OAAA;AAAE,+GAAA,YAAY,OAAA;AAAE,kHAAA,eAAe,OAAA"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":";;;AAAA,iDAAwG;AAA/F,gHAAA,eAAe,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,4GAAA,WAAW,OAAA;AAAE,2GAAA,UAAU,OAAA;AAAE,+GAAA,cAAc,OAAA;AAC9E,mCAAuE;AAA9D,sGAAA,YAAY,OAAA;AAAE,uGAAA,aAAa,OAAA;AAAE,wGAAA,cAAc,OAAA;AAEpD,2CAA4C;AAAnC,0GAAA,YAAY,OAAA;AAErB,+CAMwB;AALtB,+GAAA,eAAe,OAAA;AACf,kHAAA,kBAAkB,OAAA;AAClB,8GAAA,cAAc,OAAA;AACd,sHAAA,sBAAsB,OAAA;AACtB,8GAAA,cAAc,OAAA;AAGhB,6CAAuE;AAA9D,+GAAA,gBAAgB,OAAA;AAAE,2GAAA,YAAY,OAAA;AAAE,qGAAA,MAAM,OAAA;AAE/C,yCAAiJ;AAAxI,0GAAA,aAAa,OAAA;AAAE,2GAAA,cAAc,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,4GAAA,eAAe,OAAA;AAAE,wGAAA,WAAW,OAAA;AAAE,gHAAA,mBAAmB,OAAA;AAAE,2GAAA,cAAc,OAAA;AAE3H,yDAA0G;AAAjG,mIAAA,8BAA8B,OAAA;AAAE,wHAAA,mBAAmB,OAAA;AAAE,mHAAA,cAAc,OAAA;AAE5E,qDAAyF;AAAhF,wHAAA,qBAAqB,OAAA;AAAE,+GAAA,YAAY,OAAA;AAAE,kHAAA,eAAe,OAAA"}
package/dist/cjs/policy.d.ts CHANGED
@@ -38,6 +38,29 @@ export declare const policyRuleSchema: z.ZodObject<{
38
38
  fields: z.ZodArray<z.ZodString>;
39
39
  }, z.core.$strict>>;
40
40
  }, z.core.$strict>;
41
+ /** At most `limit` calls per `windowSeconds`, counted across sessions per user, session or gateway. */
42
+ export declare const quotaRuleSchema: z.ZodObject<{
43
+ id: z.ZodOptional<z.ZodString>;
44
+ match: z.ZodDefault<z.ZodObject<{
45
+ tool: z.ZodOptional<z.ZodString>;
46
+ upstream: z.ZodOptional<z.ZodString>;
47
+ label: z.ZodOptional<z.ZodEnum<{
48
+ destructive: "destructive";
49
+ untrusted: "untrusted";
50
+ sensitive: "sensitive";
51
+ egress: "egress";
52
+ }>>;
53
+ user: z.ZodOptional<z.ZodString>;
54
+ group: z.ZodOptional<z.ZodString>;
55
+ }, z.core.$strict>>;
56
+ limit: z.ZodNumber;
57
+ windowSeconds: z.ZodNumber;
58
+ per: z.ZodDefault<z.ZodEnum<{
59
+ session: "session";
60
+ user: "user";
61
+ gateway: "gateway";
62
+ }>>;
63
+ }, z.core.$strict>;
41
64
  /** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
42
65
  export declare const policyShape: {
43
66
  labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<{
@@ -87,6 +110,28 @@ export declare const policyShape: {
87
110
  fields: z.ZodArray<z.ZodString>;
88
111
  }, z.core.$strict>>;
89
112
  }, z.core.$strict>>>;
113
+ quotas: z.ZodDefault<z.ZodArray<z.ZodObject<{
114
+ id: z.ZodOptional<z.ZodString>;
115
+ match: z.ZodDefault<z.ZodObject<{
116
+ tool: z.ZodOptional<z.ZodString>;
117
+ upstream: z.ZodOptional<z.ZodString>;
118
+ label: z.ZodOptional<z.ZodEnum<{
119
+ destructive: "destructive";
120
+ untrusted: "untrusted";
121
+ sensitive: "sensitive";
122
+ egress: "egress";
123
+ }>>;
124
+ user: z.ZodOptional<z.ZodString>;
125
+ group: z.ZodOptional<z.ZodString>;
126
+ }, z.core.$strict>>;
127
+ limit: z.ZodNumber;
128
+ windowSeconds: z.ZodNumber;
129
+ per: z.ZodDefault<z.ZodEnum<{
130
+ session: "session";
131
+ user: "user";
132
+ gateway: "gateway";
133
+ }>>;
134
+ }, z.core.$strict>>>;
90
135
  taint: z.ZodDefault<z.ZodObject<{
91
136
  mode: z.ZodDefault<z.ZodEnum<{
92
137
  warn: "warn";
@@ -156,6 +201,16 @@ export declare const policyShape: {
156
201
  }>;
157
202
  allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
158
203
  }, z.core.$strict>>;
204
+ sampling: z.ZodOptional<z.ZodObject<{
205
+ enabled: z.ZodBoolean;
206
+ action: z.ZodEnum<{
207
+ block: "block";
208
+ warn: "warn";
209
+ }>;
210
+ maxTokens: z.ZodOptional<z.ZodNumber>;
211
+ maxPerCall: z.ZodOptional<z.ZodNumber>;
212
+ approval: z.ZodOptional<z.ZodBoolean>;
213
+ }, z.core.$strict>>;
159
214
  piiMasking: z.ZodOptional<z.ZodObject<{
160
215
  enabled: z.ZodBoolean;
161
216
  patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -232,6 +287,28 @@ export declare const gatewayPolicySchema: z.ZodObject<{
232
287
  fields: z.ZodArray<z.ZodString>;
233
288
  }, z.core.$strict>>;
234
289
  }, z.core.$strict>>>;
290
+ quotas: z.ZodDefault<z.ZodArray<z.ZodObject<{
291
+ id: z.ZodOptional<z.ZodString>;
292
+ match: z.ZodDefault<z.ZodObject<{
293
+ tool: z.ZodOptional<z.ZodString>;
294
+ upstream: z.ZodOptional<z.ZodString>;
295
+ label: z.ZodOptional<z.ZodEnum<{
296
+ destructive: "destructive";
297
+ untrusted: "untrusted";
298
+ sensitive: "sensitive";
299
+ egress: "egress";
300
+ }>>;
301
+ user: z.ZodOptional<z.ZodString>;
302
+ group: z.ZodOptional<z.ZodString>;
303
+ }, z.core.$strict>>;
304
+ limit: z.ZodNumber;
305
+ windowSeconds: z.ZodNumber;
306
+ per: z.ZodDefault<z.ZodEnum<{
307
+ session: "session";
308
+ user: "user";
309
+ gateway: "gateway";
310
+ }>>;
311
+ }, z.core.$strict>>>;
235
312
  taint: z.ZodDefault<z.ZodObject<{
236
313
  mode: z.ZodDefault<z.ZodEnum<{
237
314
  warn: "warn";
@@ -301,6 +378,16 @@ export declare const gatewayPolicySchema: z.ZodObject<{
301
378
  }>;
302
379
  allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
303
380
  }, z.core.$strict>>;
381
+ sampling: z.ZodOptional<z.ZodObject<{
382
+ enabled: z.ZodBoolean;
383
+ action: z.ZodEnum<{
384
+ block: "block";
385
+ warn: "warn";
386
+ }>;
387
+ maxTokens: z.ZodOptional<z.ZodNumber>;
388
+ maxPerCall: z.ZodOptional<z.ZodNumber>;
389
+ approval: z.ZodOptional<z.ZodBoolean>;
390
+ }, z.core.$strict>>;
304
391
  piiMasking: z.ZodOptional<z.ZodObject<{
305
392
  enabled: z.ZodBoolean;
306
393
  patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
package/dist/cjs/policy.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
1
+ {"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzB,CAAC;AAEL,uGAAuG;AACvG,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;kBAiBjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuEJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
package/dist/cjs/policy.js CHANGED
@@ -1,6 +1,6 @@
1
1
  "use strict";
2
2
  Object.defineProperty(exports, "__esModule", { value: true });
3
- exports.gatewayPolicySchema = exports.policyShape = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = void 0;
3
+ exports.gatewayPolicySchema = exports.policyShape = exports.quotaRuleSchema = exports.policyRuleSchema = exports.POLICY_ACTIONS = exports.POLICY_LABELS = void 0;
4
4
  exports.validatePolicy = validatePolicy;
5
5
  const zod_1 = require("zod");
6
6
  /**
@@ -41,6 +41,25 @@ exports.policyRuleSchema = zod_1.z
41
41
  message: "mask.fields only applies to action: mask",
42
42
  path: ["mask"],
43
43
  });
44
+ /** At most `limit` calls per `windowSeconds`, counted across sessions per user, session or gateway. */
45
+ exports.quotaRuleSchema = zod_1.z
46
+ .object({
47
+ id: zod_1.z.string().optional(),
48
+ match: zod_1.z
49
+ .object({
50
+ tool: zod_1.z.string().optional(),
51
+ upstream: zod_1.z.string().optional(),
52
+ label: labelSchema.optional(),
53
+ user: zod_1.z.string().min(1).optional(),
54
+ group: zod_1.z.string().min(1).optional(),
55
+ })
56
+ .strict()
57
+ .default({}),
58
+ limit: zod_1.z.number().int().positive(),
59
+ windowSeconds: zod_1.z.number().int().positive().max(2_592_000),
60
+ per: zod_1.z.enum(["user", "session", "gateway"]).default("user"),
61
+ })
62
+ .strict();
44
63
  /** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
45
64
  exports.policyShape = {
46
65
  labels: zod_1.z.record(zod_1.z.string(), zod_1.z.array(labelSchema)).default({}),
@@ -59,6 +78,7 @@ exports.policyShape = {
59
78
  .strict()
60
79
  .default({ hide: [], descriptions: {} }),
61
80
  rules: zod_1.z.array(exports.policyRuleSchema).default([]),
81
+ quotas: zod_1.z.array(exports.quotaRuleSchema).default([]),
62
82
  taint: zod_1.z
63
83
  .object({
64
84
  mode: zod_1.z.enum(["strict", "approve", "warn", "off"]).default("strict"),
@@ -87,6 +107,17 @@ exports.policyShape = {
87
107
  toolPoisoning: interceptorSchema.optional(),
88
108
  /** Credentials (provider keys, private keys, DB URLs with passwords) in the arguments of an egress tool. */
89
109
  egressSecrets: interceptorSchema.extend({ allowTools: zod_1.z.array(zod_1.z.string().min(1)).optional() }).optional(),
110
+ /**
111
+ * Servers asking the agent's model for a completion (sampling/createMessage).
112
+ * Off: the proxy does not offer sampling to servers. Read at start: a change needs a restart.
113
+ */
114
+ sampling: interceptorSchema
115
+ .extend({
116
+ maxTokens: zod_1.z.number().int().positive().max(100_000).optional(),
117
+ maxPerCall: zod_1.z.number().int().positive().max(100).optional(),
118
+ approval: zod_1.z.boolean().optional(),
119
+ })
120
+ .optional(),
90
121
  piiMasking: zod_1.z
91
122
  .object({
92
123
  enabled: zod_1.z.boolean(),
package/dist/cjs/policy.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";;;AAwHA,wCAOC;AA/HD,6BAAwB;AAExB;;;;;;GAMG;AAEU,QAAA,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC7E,QAAA,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrF,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACzE,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,OAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,0GAA0G;QAC1G,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC3C,4GAA4G;QAC5G,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzG,UAAU,EAAE,OAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,2BAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":";;;AAwJA,wCAOC;AA/JD,6BAAwB;AAExB;;;;;;GAMG;AAEU,QAAA,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC7E,QAAA,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,OAAC,CAAC,IAAI,CAAC,qBAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,OAAC,CAAC,IAAI,CAAC,sBAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,OAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,OAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEC,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrF,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,uGAAuG;AAC1F,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;IACd,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;IACzD,GAAG,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,sFAAsF;AACzE,QAAA,WAAW,GAAG;IACzB,MAAM,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,wBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,uBAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,OAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,OAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,OAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,0GAA0G;QAC1G,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC3C,4GAA4G;QAC5G,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzG;;;WAGG;QACH,QAAQ,EAAE,iBAAiB;aACxB,MAAM,CAAC;YACN,SAAS,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;YAC9D,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC3D,QAAQ,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SACjC,CAAC;aACD,QAAQ,EAAE;QACb,UAAU,EAAE,OAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,OAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEW,QAAA,mBAAmB,GAAG,OAAC,CAAC,MAAM,CAAC,mBAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,SAAgB,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,2BAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
package/dist/index.d.ts CHANGED
@@ -7,7 +7,7 @@ export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjec
7
7
  export type { ScanResult, InjectionRule, InjectionCategory, InjectionFinding } from "./injection.js";
8
8
  export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
9
9
  export type { Capability, FlowCategory, ToolRecord } from "./classify.js";
10
- export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
10
+ export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, quotaRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
11
11
  export type { GatewayPolicy, PolicyValidation } from "./policy.js";
12
12
  export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./tool-poisoning.js";
13
13
  export type { DescriptionInjectionPattern, MismatchSinkRule, ToolPoisoningCategory } from "./tool-poisoning.js";
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAChI,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1G,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,UAAU,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAC5C,YAAY,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AACxB,YAAY,EAAE,UAAU,EAAE,aAAa,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AACrG,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC1E,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AACjJ,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1G,YAAY,EAAE,2BAA2B,EAAE,gBAAgB,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAChH,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACzF,YAAY,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC"}
package/dist/index.js CHANGED
@@ -3,7 +3,7 @@ export { PII_PATTERNS, maskPiiInText, maskPiiInValue } from "./pii.js";
3
3
  export { SECRET_RULES } from "./secrets.js";
4
4
  export { INJECTION_RULES, INJECTION_PATTERNS, findInjections, scanForPromptInjection, scanToolResult, } from "./injection.js";
5
5
  export { CAPABILITY_RULES, classifyTool, textOf } from "./classify.js";
6
- export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
6
+ export { POLICY_LABELS, POLICY_ACTIONS, policyRuleSchema, quotaRuleSchema, policyShape, gatewayPolicySchema, validatePolicy } from "./policy.js";
7
7
  export { DESCRIPTION_INJECTION_PATTERNS, MISMATCH_SINK_RULES, READ_ONLY_HINT } from "./tool-poisoning.js";
8
8
  export { annotationContradicts, matchSurface, scanToolCatalog } from "./tool-catalog.js";
9
9
  //# sourceMappingURL=index.js.map
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEhI,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1G,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AACxG,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAEvE,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,OAAO,EACL,eAAe,EACf,kBAAkB,EAClB,cAAc,EACd,sBAAsB,EACtB,cAAc,GACf,MAAM,gBAAgB,CAAC;AAExB,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,eAAe,CAAC;AAEvE,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,gBAAgB,EAAE,eAAe,EAAE,WAAW,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAEjJ,OAAO,EAAE,8BAA8B,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1G,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC"}
package/dist/policy.d.ts CHANGED
@@ -38,6 +38,29 @@ export declare const policyRuleSchema: z.ZodObject<{
38
38
  fields: z.ZodArray<z.ZodString>;
39
39
  }, z.core.$strict>>;
40
40
  }, z.core.$strict>;
41
+ /** At most `limit` calls per `windowSeconds`, counted across sessions per user, session or gateway. */
42
+ export declare const quotaRuleSchema: z.ZodObject<{
43
+ id: z.ZodOptional<z.ZodString>;
44
+ match: z.ZodDefault<z.ZodObject<{
45
+ tool: z.ZodOptional<z.ZodString>;
46
+ upstream: z.ZodOptional<z.ZodString>;
47
+ label: z.ZodOptional<z.ZodEnum<{
48
+ destructive: "destructive";
49
+ untrusted: "untrusted";
50
+ sensitive: "sensitive";
51
+ egress: "egress";
52
+ }>>;
53
+ user: z.ZodOptional<z.ZodString>;
54
+ group: z.ZodOptional<z.ZodString>;
55
+ }, z.core.$strict>>;
56
+ limit: z.ZodNumber;
57
+ windowSeconds: z.ZodNumber;
58
+ per: z.ZodDefault<z.ZodEnum<{
59
+ session: "session";
60
+ user: "user";
61
+ gateway: "gateway";
62
+ }>>;
63
+ }, z.core.$strict>;
41
64
  /** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
42
65
  export declare const policyShape: {
43
66
  labels: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodArray<z.ZodEnum<{
@@ -87,6 +110,28 @@ export declare const policyShape: {
87
110
  fields: z.ZodArray<z.ZodString>;
88
111
  }, z.core.$strict>>;
89
112
  }, z.core.$strict>>>;
113
+ quotas: z.ZodDefault<z.ZodArray<z.ZodObject<{
114
+ id: z.ZodOptional<z.ZodString>;
115
+ match: z.ZodDefault<z.ZodObject<{
116
+ tool: z.ZodOptional<z.ZodString>;
117
+ upstream: z.ZodOptional<z.ZodString>;
118
+ label: z.ZodOptional<z.ZodEnum<{
119
+ destructive: "destructive";
120
+ untrusted: "untrusted";
121
+ sensitive: "sensitive";
122
+ egress: "egress";
123
+ }>>;
124
+ user: z.ZodOptional<z.ZodString>;
125
+ group: z.ZodOptional<z.ZodString>;
126
+ }, z.core.$strict>>;
127
+ limit: z.ZodNumber;
128
+ windowSeconds: z.ZodNumber;
129
+ per: z.ZodDefault<z.ZodEnum<{
130
+ session: "session";
131
+ user: "user";
132
+ gateway: "gateway";
133
+ }>>;
134
+ }, z.core.$strict>>>;
90
135
  taint: z.ZodDefault<z.ZodObject<{
91
136
  mode: z.ZodDefault<z.ZodEnum<{
92
137
  warn: "warn";
@@ -156,6 +201,16 @@ export declare const policyShape: {
156
201
  }>;
157
202
  allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
158
203
  }, z.core.$strict>>;
204
+ sampling: z.ZodOptional<z.ZodObject<{
205
+ enabled: z.ZodBoolean;
206
+ action: z.ZodEnum<{
207
+ block: "block";
208
+ warn: "warn";
209
+ }>;
210
+ maxTokens: z.ZodOptional<z.ZodNumber>;
211
+ maxPerCall: z.ZodOptional<z.ZodNumber>;
212
+ approval: z.ZodOptional<z.ZodBoolean>;
213
+ }, z.core.$strict>>;
159
214
  piiMasking: z.ZodOptional<z.ZodObject<{
160
215
  enabled: z.ZodBoolean;
161
216
  patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
@@ -232,6 +287,28 @@ export declare const gatewayPolicySchema: z.ZodObject<{
232
287
  fields: z.ZodArray<z.ZodString>;
233
288
  }, z.core.$strict>>;
234
289
  }, z.core.$strict>>>;
290
+ quotas: z.ZodDefault<z.ZodArray<z.ZodObject<{
291
+ id: z.ZodOptional<z.ZodString>;
292
+ match: z.ZodDefault<z.ZodObject<{
293
+ tool: z.ZodOptional<z.ZodString>;
294
+ upstream: z.ZodOptional<z.ZodString>;
295
+ label: z.ZodOptional<z.ZodEnum<{
296
+ destructive: "destructive";
297
+ untrusted: "untrusted";
298
+ sensitive: "sensitive";
299
+ egress: "egress";
300
+ }>>;
301
+ user: z.ZodOptional<z.ZodString>;
302
+ group: z.ZodOptional<z.ZodString>;
303
+ }, z.core.$strict>>;
304
+ limit: z.ZodNumber;
305
+ windowSeconds: z.ZodNumber;
306
+ per: z.ZodDefault<z.ZodEnum<{
307
+ session: "session";
308
+ user: "user";
309
+ gateway: "gateway";
310
+ }>>;
311
+ }, z.core.$strict>>>;
235
312
  taint: z.ZodDefault<z.ZodObject<{
236
313
  mode: z.ZodDefault<z.ZodEnum<{
237
314
  warn: "warn";
@@ -301,6 +378,16 @@ export declare const gatewayPolicySchema: z.ZodObject<{
301
378
  }>;
302
379
  allowTools: z.ZodOptional<z.ZodArray<z.ZodString>>;
303
380
  }, z.core.$strict>>;
381
+ sampling: z.ZodOptional<z.ZodObject<{
382
+ enabled: z.ZodBoolean;
383
+ action: z.ZodEnum<{
384
+ block: "block";
385
+ warn: "warn";
386
+ }>;
387
+ maxTokens: z.ZodOptional<z.ZodNumber>;
388
+ maxPerCall: z.ZodOptional<z.ZodNumber>;
389
+ approval: z.ZodOptional<z.ZodBoolean>;
390
+ }, z.core.$strict>>;
304
391
  piiMasking: z.ZodOptional<z.ZodObject<{
305
392
  enabled: z.ZodBoolean;
306
393
  patterns: z.ZodOptional<z.ZodArray<z.ZodString>>;
package/dist/policy.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzB,CAAC;AAEL,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2DJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
1
+ {"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,eAAO,MAAM,aAAa,8DAA+D,CAAC;AAC1F,eAAO,MAAM,cAAc,uDAAwD,CAAC;AAUpF,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAqBzB,CAAC;AAEL,uGAAuG;AACvG,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;kBAiBjB,CAAC;AAEZ,sFAAsF;AACtF,eAAO,MAAM,WAAW;;;;;;;IAEtB;;;;;OAKG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuEJ,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;kBAAiC,CAAC;AAElE,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAEhE,MAAM,MAAM,gBAAgB,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAAC;AAErG,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,gBAAgB,CAO/D"}
package/dist/policy.js CHANGED
@@ -37,6 +37,25 @@ export const policyRuleSchema = z
37
37
  message: "mask.fields only applies to action: mask",
38
38
  path: ["mask"],
39
39
  });
40
+ /** At most `limit` calls per `windowSeconds`, counted across sessions per user, session or gateway. */
41
+ export const quotaRuleSchema = z
42
+ .object({
43
+ id: z.string().optional(),
44
+ match: z
45
+ .object({
46
+ tool: z.string().optional(),
47
+ upstream: z.string().optional(),
48
+ label: labelSchema.optional(),
49
+ user: z.string().min(1).optional(),
50
+ group: z.string().min(1).optional(),
51
+ })
52
+ .strict()
53
+ .default({}),
54
+ limit: z.number().int().positive(),
55
+ windowSeconds: z.number().int().positive().max(2_592_000),
56
+ per: z.enum(["user", "session", "gateway"]).default("user"),
57
+ })
58
+ .strict();
40
59
  /** Every field has a default, so `{}` is a valid (allow-all, strict-taint) policy. */
41
60
  export const policyShape = {
42
61
  labels: z.record(z.string(), z.array(labelSchema)).default({}),
@@ -55,6 +74,7 @@ export const policyShape = {
55
74
  .strict()
56
75
  .default({ hide: [], descriptions: {} }),
57
76
  rules: z.array(policyRuleSchema).default([]),
77
+ quotas: z.array(quotaRuleSchema).default([]),
58
78
  taint: z
59
79
  .object({
60
80
  mode: z.enum(["strict", "approve", "warn", "off"]).default("strict"),
@@ -83,6 +103,17 @@ export const policyShape = {
83
103
  toolPoisoning: interceptorSchema.optional(),
84
104
  /** Credentials (provider keys, private keys, DB URLs with passwords) in the arguments of an egress tool. */
85
105
  egressSecrets: interceptorSchema.extend({ allowTools: z.array(z.string().min(1)).optional() }).optional(),
106
+ /**
107
+ * Servers asking the agent's model for a completion (sampling/createMessage).
108
+ * Off: the proxy does not offer sampling to servers. Read at start: a change needs a restart.
109
+ */
110
+ sampling: interceptorSchema
111
+ .extend({
112
+ maxTokens: z.number().int().positive().max(100_000).optional(),
113
+ maxPerCall: z.number().int().positive().max(100).optional(),
114
+ approval: z.boolean().optional(),
115
+ })
116
+ .optional(),
86
117
  piiMasking: z
87
118
  .object({
88
119
  enabled: z.boolean(),
package/dist/policy.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,0GAA0G;QAC1G,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC3C,4GAA4G;QAC5G,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzG,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"policy.js","sourceRoot":"","sources":["../src/policy.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB;;;;;;GAMG;AAEH,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAU,CAAC;AAC1F,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,CAAU,CAAC;AAEpF,MAAM,WAAW,GAAG,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;AAC1C,MAAM,YAAY,GAAG,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;AAC5C,MAAM,iBAAiB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AACzG,uFAAuF;AACvF,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;KACtG,MAAM,EAAE,CAAC;AAEZ,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC;KAC9B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC,QAAQ,EAAE;QAChD,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QACrF,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;IACX,MAAM,EAAE,YAAY;IACpB,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;CAC3E,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE;IACnE,OAAO,EAAE,0CAA0C;IACnD,IAAI,EAAE,CAAC,MAAM,CAAC;CACf,CAAC,CAAC;AAEL,uGAAuG;AACvG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC;KAC7B,MAAM,CAAC;IACN,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IACzB,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC3B,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC/B,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;QAC7B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;KACpC,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;IACd,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE;IAClC,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,SAAS,CAAC;IACzD,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;CAC5D,CAAC;KACD,MAAM,EAAE,CAAC;AAEZ,sFAAsF;AACtF,MAAM,CAAC,MAAM,WAAW,GAAG;IACzB,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC9D;;;;;OAKG;IACH,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;QAC7C,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5C,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC5E,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IAC1C,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;IAC5C,KAAK,EAAE,CAAC;SACL,MAAM,CAAC;QACN,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;QACpE;;;WAGG;QACH,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC;KAC5D,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACnD,QAAQ,EAAE,CAAC;SACR,MAAM,CAAC;QACN,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC;QACxD,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC;KACxF,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,cAAc,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,aAAa,CAAC,EAAE,CAAC;IAC9D,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACnG,YAAY,EAAE,CAAC;SACZ,MAAM,CAAC;QACN,eAAe,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC7C,mBAAmB,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QACjD,eAAe,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACjH,0GAA0G;QAC1G,aAAa,EAAE,iBAAiB,CAAC,QAAQ,EAAE;QAC3C,4GAA4G;QAC5G,aAAa,EAAE,iBAAiB,CAAC,MAAM,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE;QACzG;;;WAGG;QACH,QAAQ,EAAE,iBAAiB;aACxB,MAAM,CAAC;YACN,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE;YAC9D,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE;YAC3D,QAAQ,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SACjC,CAAC;aACD,QAAQ,EAAE;QACb,UAAU,EAAE,CAAC;aACV,MAAM,CAAC;YACN,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE;YACpB,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;YACxC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,EAAE;YAC/C,mBAAmB,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE;SAC5C,CAAC;aACD,MAAM,EAAE;aACR,QAAQ,EAAE;QACb,iHAAiH;QACjH,OAAO,EAAE,iBAAiB;aACvB,MAAM,CAAC;YACN,SAAS,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YACzC,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAC9C,gBAAgB,EAAE,mBAAmB,CAAC,QAAQ,EAAE;YAChD,cAAc,EAAE,mBAAmB,CAAC,QAAQ,EAAE;SAC/C,CAAC;aACD,QAAQ,EAAE;KACd,CAAC;SACD,MAAM,EAAE;SACR,OAAO,CAAC,EAAE,CAAC;CACf,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,MAAM,EAAE,CAAC;AAMlE,+EAA+E;AAC/E,MAAM,UAAU,cAAc,CAAC,KAAc;IAC3C,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC1D,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;KACpG,CAAC;AACJ,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@guardbee/guard-core",
3
- "version": "0.9.0",
3
+ "version": "0.11.0",
4
4
  "description": "Shared detectors for GuardBee MCP packages — checksum-validated PII masking, prompt injection patterns, and lethal-trifecta tool classification",
5
5
  "type": "module",
6
6
  "main": "./dist/index.js",