@guardbee/mcp-security-proxy 0.3.1 → 1.0.0

package/dist/gateway/tokens.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.d.ts","sourceRoot":"","sources":["../../src/gateway/tokens.ts"],"names":[],"mappings":"AAKA;;;;;GAKG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IAErD,IAAI,IAAI,IAAI,MAAM,CAEjB;IAED,2GAA2G;IAC3G,QAAQ,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC;IAaxB,4FAA4F;IAC5F,UAAU,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC;IAW1B,6DAA6D;IAC7D,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO;CAMrC"}

package/dist/gateway/tokens.js

@@ -0,0 +1,60 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PiiVault = void 0;
+const crypto_1 = require("crypto");
+const guard_core_1 = require("@guardbee/guard-core");
+const TOKEN = /<pii:[a-z_]+:[0-9a-f]{8}>/g;
+/**
+ * Session-scoped reversible PII tokens. The model sees `<pii:tc_kimlik:7f3a9b21>`
+ * instead of the value, and can still pass that token to another tool; the
+ * gateway puts the real value back on the way to the upstream. The table lives
+ * only in memory and dies with the session.
+ */
+class PiiVault {
+    constructor() {
+        this.byToken = new Map();
+        this.byValue = new Map();
+    }
+    get size() {
+        return this.byToken.size;
+    }
+    /** Replace validated PII in any JSON-like value with tokens; the same value always gets the same token. */
+    tokenize(value) {
+        return (0, guard_core_1.maskPiiInValue)(value, (name, match) => {
+            const known = this.byValue.get(match);
+            if (known)
+                return known;
+            let token;
+            do
+                token = `<pii:${name}:${(0, crypto_1.randomBytes)(4).toString("hex")}>`;
+            while (this.byToken.has(token));
+            this.byToken.set(token, match);
+            this.byValue.set(match, token);
+            return token;
+        });
+    }
+    /** Put real values back for tokens this session issued; unknown tokens stay as they are. */
+    detokenize(value) {
+        if (typeof value === "string") {
+            return value.replace(TOKEN, (token) => this.byToken.get(token) ?? token);
+        }
+        if (Array.isArray(value))
+            return value.map((item) => this.detokenize(item));
+        if (value && typeof value === "object") {
+            return Object.fromEntries(Object.entries(value).map(([k, v]) => [k, this.detokenize(v)]));
+        }
+        return value;
+    }
+    /** True if the value carries a token this session issued. */
+    holdsTokens(value) {
+        if (typeof value === "string")
+            return (value.match(TOKEN) ?? []).some((token) => this.byToken.has(token));
+        if (Array.isArray(value))
+            return value.some((item) => this.holdsTokens(item));
+        if (value && typeof value === "object")
+            return Object.values(value).some((v) => this.holdsTokens(v));
+        return false;
+    }
+}
+exports.PiiVault = PiiVault;
+//# sourceMappingURL=tokens.js.map

package/dist/gateway/tokens.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tokens.js","sourceRoot":"","sources":["../../src/gateway/tokens.ts"],"names":[],"mappings":";;;AAAA,mCAAqC;AACrC,qDAAsD;AAEtD,MAAM,KAAK,GAAG,4BAA4B,CAAC;AAE3C;;;;;GAKG;AACH,MAAa,QAAQ;IAArB;QACmB,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;QACpC,YAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAuCvD,CAAC;IArCC,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;IAED,2GAA2G;IAC3G,QAAQ,CAAI,KAAQ;QAClB,OAAO,IAAA,2BAAc,EAAC,KAAK,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,KAAK;gBAAE,OAAO,KAAK,CAAC;YACxB,IAAI,KAAa,CAAC;YAClB;gBAAG,KAAK,GAAG,QAAQ,IAAI,IAAI,IAAA,oBAAW,EAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC;mBACtD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE;YAChC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/B,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YAC/B,OAAO,KAAK,CAAC;QACf,CAAC,CAAM,CAAC;IACV,CAAC;IAED,4FAA4F;IAC5F,UAAU,CAAI,KAAQ;QACpB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,KAAK,CAAM,CAAC;QAChF,CAAC;QACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAM,CAAC;QACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YACvC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAM,CAAC;QACjG,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,6DAA6D;IAC7D,WAAW,CAAC,KAAc;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1G,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAC9E,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACrG,OAAO,KAAK,CAAC;IACf,CAAC;CACF;AAzCD,4BAyCC"}

package/dist/gateway/upstream.d.ts

@@ -0,0 +1,20 @@
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { CallToolResult, GetPromptResult, Prompt, ReadResourceResult, Resource, Tool } from "@modelcontextprotocol/sdk/types.js";
+import type { McpServerConfig } from "../types.js";
+/** One MCP server behind the gateway. */
+export interface Upstream {
+    readonly name: string;
+    listTools(): Promise<Tool[]>;
+    callTool(name: string, args: Record<string, unknown>): Promise<CallToolResult>;
+    listResources(): Promise<Resource[]>;
+    readResource(uri: string): Promise<ReadResourceResult>;
+    listPrompts(): Promise<Prompt[]>;
+    getPrompt(name: string, args?: Record<string, string>): Promise<GetPromptResult>;
+    /** Register for the server's tools/list_changed notification. */
+    onToolsChanged?(listener: () => void): void;
+    close(): Promise<void>;
+}
+/** Wrap a connected MCP client. Resources and prompts are empty when the server does not offer them. */
+export declare function clientUpstream(name: string, client: Client): Upstream;
+export declare function connectStdioUpstream(name: string, server: McpServerConfig): Promise<Upstream>;
+//# sourceMappingURL=upstream.d.ts.map

package/dist/gateway/upstream.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.d.ts","sourceRoot":"","sources":["../../src/gateway/upstream.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AAGnE,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,MAAM,EACN,kBAAkB,EAClB,QAAQ,EACR,IAAI,EACL,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEnD,yCAAyC;AACzC,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,cAAc,CAAC,CAAC;IAC/E,aAAa,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC;IACrC,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACvD,WAAW,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACjC,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAAC;IACjF,iEAAiE;IACjE,cAAc,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC;IAC5C,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACxB;AAED,wGAAwG;AACxG,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,QAAQ,CA6BrE;AAED,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CASnG"}

package/dist/gateway/upstream.js

@@ -0,0 +1,49 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientUpstream = clientUpstream;
+exports.connectStdioUpstream = connectStdioUpstream;
+const index_js_1 = require("@modelcontextprotocol/sdk/client/index.js");
+const stdio_js_1 = require("@modelcontextprotocol/sdk/client/stdio.js");
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+/** Wrap a connected MCP client. Resources and prompts are empty when the server does not offer them. */
+function clientUpstream(name, client) {
+    const caps = () => client.getServerCapabilities() ?? {};
+    return {
+        name,
+        async listTools() {
+            return (await client.listTools()).tools;
+        },
+        async callTool(tool, args) {
+            return (await client.callTool({ name: tool, arguments: args }));
+        },
+        async listResources() {
+            return caps().resources ? (await client.listResources()).resources : [];
+        },
+        readResource(uri) {
+            return client.readResource({ uri });
+        },
+        async listPrompts() {
+            return caps().prompts ? (await client.listPrompts()).prompts : [];
+        },
+        getPrompt(prompt, args) {
+            return client.getPrompt({ name: prompt, arguments: args });
+        },
+        onToolsChanged(listener) {
+            client.setNotificationHandler(types_js_1.ToolListChangedNotificationSchema, () => listener());
+        },
+        close() {
+            return client.close();
+        },
+    };
+}
+async function connectStdioUpstream(name, server) {
+    const client = new index_js_1.Client({ name: "guardbee-proxy-client", version: "1.0.0" }, { capabilities: {} });
+    const transport = new stdio_js_1.StdioClientTransport({
+        command: server.command,
+        args: server.args ?? [],
+        env: { ...process.env, ...(server.env ?? {}) },
+    });
+    await client.connect(transport);
+    return clientUpstream(name, client);
+}
+//# sourceMappingURL=upstream.js.map

package/dist/gateway/upstream.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"upstream.js","sourceRoot":"","sources":["../../src/gateway/upstream.ts"],"names":[],"mappings":";;AA4BA,wCA6BC;AAED,oDASC;AApED,wEAAmE;AACnE,wEAAiF;AACjF,iEAAuF;AAyBvF,wGAAwG;AACxG,SAAgB,cAAc,CAAC,IAAY,EAAE,MAAc;IACzD,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC,qBAAqB,EAAE,IAAI,EAAE,CAAC;IACxD,OAAO;QACL,IAAI;QACJ,KAAK,CAAC,SAAS;YACb,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC;QAC1C,CAAC;QACD,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI;YACvB,OAAO,CAAC,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAmB,CAAC;QACpF,CAAC;QACD,KAAK,CAAC,aAAa;YACjB,OAAO,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,aAAa,EAAE,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,CAAC;QACD,YAAY,CAAC,GAAG;YACd,OAAO,MAAM,CAAC,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;QACtC,CAAC;QACD,KAAK,CAAC,WAAW;YACf,OAAO,IAAI,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,CAAC;QACD,SAAS,CAAC,MAAM,EAAE,IAAI;YACpB,OAAO,MAAM,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC7D,CAAC;QACD,cAAc,CAAC,QAAQ;YACrB,MAAM,CAAC,sBAAsB,CAAC,4CAAiC,EAAE,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QACrF,CAAC;QACD,KAAK;YACH,OAAO,MAAM,CAAC,KAAK,EAAE,CAAC;QACxB,CAAC;KACF,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAAuB;IAC9E,MAAM,MAAM,GAAG,IAAI,iBAAM,CAAC,EAAE,IAAI,EAAE,uBAAuB,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;IACrG,MAAM,SAAS,GAAG,IAAI,+BAAoB,CAAC;QACzC,OAAO,EAAE,MAAM,CAAC,OAAO;QACvB,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,EAAE;QACvB,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC,EAA4B;KACzE,CAAC,CAAC;IACH,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAChC,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AACtC,CAAC"}

package/dist/index.d.ts

@@ -1,9 +1,27 @@
-export { startProxy } from "./proxy.js";
+export { startProxy, startGateway, createProxyServer, createGatewayServer } from "./proxy.js";
+export { elicitationApprover } from "./gateway/approval.js";
+export type { Approver, ApprovalRequest, ApprovalOutcome } from "./gateway/approval.js";
+export { PiiVault } from "./gateway/tokens.js";
+export { maskFields } from "./gateway/fields.js";
 export { loadProxyConfig } from "./config.js";
+export { loadGatewayConfig, parseGatewayYaml, fromLegacyConfig } from "./gateway/config.js";
+export type { GatewayConfig } from "./gateway/config.js";
+export { Gateway } from "./gateway/gateway.js";
+export { clientUpstream, connectStdioUpstream } from "./gateway/upstream.js";
+export type { Upstream } from "./gateway/upstream.js";
+export { labelTool, LABELS } from "./gateway/labels.js";
+export type { Label } from "./gateway/labels.js";
+export { evaluatePolicy, globToRegExp } from "./gateway/policy.js";
+export type { PolicyAction, PolicyRule, PolicyDecision } from "./gateway/policy.js";
+export { TaintTracker } from "./gateway/taint.js";
+export type { TaintMode, TaintSnapshot } from "./gateway/taint.js";
 export { scanForPromptInjection } from "./interceptors/prompt-injection.js";
 export { scanToolResult } from "./interceptors/tool-result.js";
 export { ToolDefinitionPin } from "./interceptors/definition-drift.js";
 export { maskPiiInValue, maskPiiInText } from "./interceptors/pii-masker.js";
-export { AuditLogger } from "./audit/logger.js";
-export type { ProxyConfig, McpServerConfig, InterceptResult, AuditEvent } from "./types.js";
+export { AuditLogger, verifyAuditChain } from "./audit/logger.js";
+export type { ChainVerification } from "./audit/logger.js";
+export type { ProxyConfig, McpServerConfig, InterceptResult, AuditEvent, AuditConfig } from "./types.js";
+export { planInit, runInit, clientConfigPath } from "./init.js";
+export type { ClientName, InitPlan, InitOptions, InitResult } from "./init.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAC9F,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,YAAY,EAAE,QAAQ,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5F,YAAY,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAC7E,YAAY,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACtD,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AACxD,YAAY,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACpF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,YAAY,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnE,OAAO,EAAE,sBAAsB,EAAE,MAAM,oCAAoC,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAC/D,OAAO,EAAE,iBAAiB,EAAE,MAAM,oCAAoC,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAClE,YAAY,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAC3D,YAAY,EAAE,WAAW,EAAE,eAAe,EAAE,eAAe,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzG,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,WAAW,CAAC;AAChE,YAAY,EAAE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC"}

package/dist/index.js

@@ -1,10 +1,36 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.AuditLogger = exports.maskPiiInText = exports.maskPiiInValue = exports.ToolDefinitionPin = exports.scanToolResult = exports.scanForPromptInjection = exports.loadProxyConfig = exports.startProxy = void 0;
+exports.clientConfigPath = exports.runInit = exports.planInit = exports.verifyAuditChain = exports.AuditLogger = exports.maskPiiInText = exports.maskPiiInValue = exports.ToolDefinitionPin = exports.scanToolResult = exports.scanForPromptInjection = exports.TaintTracker = exports.globToRegExp = exports.evaluatePolicy = exports.LABELS = exports.labelTool = exports.connectStdioUpstream = exports.clientUpstream = exports.Gateway = exports.fromLegacyConfig = exports.parseGatewayYaml = exports.loadGatewayConfig = exports.loadProxyConfig = exports.maskFields = exports.PiiVault = exports.elicitationApprover = exports.createGatewayServer = exports.createProxyServer = exports.startGateway = exports.startProxy = void 0;
 var proxy_js_1 = require("./proxy.js");
 Object.defineProperty(exports, "startProxy", { enumerable: true, get: function () { return proxy_js_1.startProxy; } });
+Object.defineProperty(exports, "startGateway", { enumerable: true, get: function () { return proxy_js_1.startGateway; } });
+Object.defineProperty(exports, "createProxyServer", { enumerable: true, get: function () { return proxy_js_1.createProxyServer; } });
+Object.defineProperty(exports, "createGatewayServer", { enumerable: true, get: function () { return proxy_js_1.createGatewayServer; } });
+var approval_js_1 = require("./gateway/approval.js");
+Object.defineProperty(exports, "elicitationApprover", { enumerable: true, get: function () { return approval_js_1.elicitationApprover; } });
+var tokens_js_1 = require("./gateway/tokens.js");
+Object.defineProperty(exports, "PiiVault", { enumerable: true, get: function () { return tokens_js_1.PiiVault; } });
+var fields_js_1 = require("./gateway/fields.js");
+Object.defineProperty(exports, "maskFields", { enumerable: true, get: function () { return fields_js_1.maskFields; } });
 var config_js_1 = require("./config.js");
 Object.defineProperty(exports, "loadProxyConfig", { enumerable: true, get: function () { return config_js_1.loadProxyConfig; } });
+var config_js_2 = require("./gateway/config.js");
+Object.defineProperty(exports, "loadGatewayConfig", { enumerable: true, get: function () { return config_js_2.loadGatewayConfig; } });
+Object.defineProperty(exports, "parseGatewayYaml", { enumerable: true, get: function () { return config_js_2.parseGatewayYaml; } });
+Object.defineProperty(exports, "fromLegacyConfig", { enumerable: true, get: function () { return config_js_2.fromLegacyConfig; } });
+var gateway_js_1 = require("./gateway/gateway.js");
+Object.defineProperty(exports, "Gateway", { enumerable: true, get: function () { return gateway_js_1.Gateway; } });
+var upstream_js_1 = require("./gateway/upstream.js");
+Object.defineProperty(exports, "clientUpstream", { enumerable: true, get: function () { return upstream_js_1.clientUpstream; } });
+Object.defineProperty(exports, "connectStdioUpstream", { enumerable: true, get: function () { return upstream_js_1.connectStdioUpstream; } });
+var labels_js_1 = require("./gateway/labels.js");
+Object.defineProperty(exports, "labelTool", { enumerable: true, get: function () { return labels_js_1.labelTool; } });
+Object.defineProperty(exports, "LABELS", { enumerable: true, get: function () { return labels_js_1.LABELS; } });
+var policy_js_1 = require("./gateway/policy.js");
+Object.defineProperty(exports, "evaluatePolicy", { enumerable: true, get: function () { return policy_js_1.evaluatePolicy; } });
+Object.defineProperty(exports, "globToRegExp", { enumerable: true, get: function () { return policy_js_1.globToRegExp; } });
+var taint_js_1 = require("./gateway/taint.js");
+Object.defineProperty(exports, "TaintTracker", { enumerable: true, get: function () { return taint_js_1.TaintTracker; } });
 var prompt_injection_js_1 = require("./interceptors/prompt-injection.js");
 Object.defineProperty(exports, "scanForPromptInjection", { enumerable: true, get: function () { return prompt_injection_js_1.scanForPromptInjection; } });
 var tool_result_js_1 = require("./interceptors/tool-result.js");
@@ -16,4 +42,9 @@ Object.defineProperty(exports, "maskPiiInValue", { enumerable: true, get: functi
 Object.defineProperty(exports, "maskPiiInText", { enumerable: true, get: function () { return pii_masker_js_1.maskPiiInText; } });
 var logger_js_1 = require("./audit/logger.js");
 Object.defineProperty(exports, "AuditLogger", { enumerable: true, get: function () { return logger_js_1.AuditLogger; } });
+Object.defineProperty(exports, "verifyAuditChain", { enumerable: true, get: function () { return logger_js_1.verifyAuditChain; } });
+var init_js_1 = require("./init.js");
+Object.defineProperty(exports, "planInit", { enumerable: true, get: function () { return init_js_1.planInit; } });
+Object.defineProperty(exports, "runInit", { enumerable: true, get: function () { return init_js_1.runInit; } });
+Object.defineProperty(exports, "clientConfigPath", { enumerable: true, get: function () { return init_js_1.clientConfigPath; } });
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAAwC;AAA/B,sGAAA,UAAU,OAAA;AACnB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AACxB,0EAA4E;AAAnE,6HAAA,sBAAsB,OAAA;AAC/B,gEAA+D;AAAtD,gHAAA,cAAc,OAAA;AACvB,0EAAuE;AAA9D,wHAAA,iBAAiB,OAAA;AAC1B,8DAA6E;AAApE,+GAAA,cAAc,OAAA;AAAE,8GAAA,aAAa,OAAA;AACtC,+CAAgD;AAAvC,wGAAA,WAAW,OAAA"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";;;AAAA,uCAA8F;AAArF,sGAAA,UAAU,OAAA;AAAE,wGAAA,YAAY,OAAA;AAAE,6GAAA,iBAAiB,OAAA;AAAE,+GAAA,mBAAmB,OAAA;AACzE,qDAA4D;AAAnD,kHAAA,mBAAmB,OAAA;AAE5B,iDAA+C;AAAtC,qGAAA,QAAQ,OAAA;AACjB,iDAAiD;AAAxC,uGAAA,UAAU,OAAA;AACnB,yCAA8C;AAArC,4GAAA,eAAe,OAAA;AACxB,iDAA4F;AAAnF,8GAAA,iBAAiB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAE9D,mDAA+C;AAAtC,qGAAA,OAAO,OAAA;AAChB,qDAA6E;AAApE,6GAAA,cAAc,OAAA;AAAE,mHAAA,oBAAoB,OAAA;AAE7C,iDAAwD;AAA/C,sGAAA,SAAS,OAAA;AAAE,mGAAA,MAAM,OAAA;AAE1B,iDAAmE;AAA1D,2GAAA,cAAc,OAAA;AAAE,yGAAA,YAAY,OAAA;AAErC,+CAAkD;AAAzC,wGAAA,YAAY,OAAA;AAErB,0EAA4E;AAAnE,6HAAA,sBAAsB,OAAA;AAC/B,gEAA+D;AAAtD,gHAAA,cAAc,OAAA;AACvB,0EAAuE;AAA9D,wHAAA,iBAAiB,OAAA;AAC1B,8DAA6E;AAApE,+GAAA,cAAc,OAAA;AAAE,8GAAA,aAAa,OAAA;AACtC,+CAAkE;AAAzD,wGAAA,WAAW,OAAA;AAAE,6GAAA,gBAAgB,OAAA;AAGtC,qCAAgE;AAAvD,mGAAA,QAAQ,OAAA;AAAE,kGAAA,OAAO,OAAA;AAAE,2GAAA,gBAAgB,OAAA"}

package/dist/init.d.ts

@@ -0,0 +1,34 @@
+export type ClientName = "claude-desktop" | "cursor" | "claude-code";
+/** Where each client keeps its user-level MCP config. */
+export declare function clientConfigPath(client: ClientName, platform?: NodeJS.Platform, home?: string): string;
+export interface InitPlan {
+    /** guardbee-proxy.yaml contents. */
+    yaml: string;
+    /** The client config rewritten to launch the proxy. */
+    clientConfig: string;
+    /** Server entries moved behind the proxy: config key → upstream name. */
+    migrated: Record<string, string>;
+    /** Entries left in the client config, and why. */
+    kept: {
+        name: string;
+        reason: string;
+    }[];
+}
+/**
+ * Work out the migration without touching the disk. stdio servers move into
+ * the YAML; HTTP servers, disabled entries and an existing proxy entry stay.
+ */
+export declare function planInit(clientConfigText: string, yamlPath: string, auditPath: string): InitPlan;
+export interface InitOptions {
+    clientConfigPath: string;
+    yamlPath: string;
+    dryRun?: boolean;
+    force?: boolean;
+    now?: Date;
+}
+export interface InitResult extends InitPlan {
+    backupPath?: string;
+}
+/** Write the YAML (mode 0600, it may hold tokens), back up the client config, then rewrite it. */
+export declare function runInit(options: InitOptions): InitResult;
+//# sourceMappingURL=init.d.ts.map

package/dist/init.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.d.ts","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":"AAMA,MAAM,MAAM,UAAU,GAAG,gBAAgB,GAAG,QAAQ,GAAG,aAAa,CAAC;AAErE,yDAAyD;AACzD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,kBAAmB,EAAE,IAAI,SAAe,GAAG,MAAM,CAW7G;AAED,MAAM,WAAW,QAAQ;IACvB,oCAAoC;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,uDAAuD;IACvD,YAAY,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACjC,kDAAkD;IAClD,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CAC1C;AAmCD;;;GAGG;AACH,wBAAgB,QAAQ,CAAC,gBAAgB,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,QAAQ,CAyDhG;AAED,MAAM,WAAW,WAAW;IAC1B,gBAAgB,EAAE,MAAM,CAAC;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,IAAI,CAAC;CACZ;AAED,MAAM,WAAW,UAAW,SAAQ,QAAQ;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,kGAAkG;AAClG,wBAAgB,OAAO,CAAC,OAAO,EAAE,WAAW,GAAG,UAAU,CAqBxD"}

package/dist/init.js

@@ -0,0 +1,140 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.clientConfigPath = clientConfigPath;
+exports.planInit = planInit;
+exports.runInit = runInit;
+const fs_1 = __importDefault(require("fs"));
+const os_1 = __importDefault(require("os"));
+const path_1 = __importDefault(require("path"));
+const yaml_1 = require("yaml");
+/** Where each client keeps its user-level MCP config. */
+function clientConfigPath(client, platform = process.platform, home = os_1.default.homedir()) {
+    switch (client) {
+        case "claude-desktop":
+            if (platform === "darwin")
+                return path_1.default.join(home, "Library", "Application Support", "Claude", "claude_desktop_config.json");
+            if (platform === "win32")
+                return path_1.default.join(process.env["APPDATA"] ?? path_1.default.join(home, "AppData", "Roaming"), "Claude", "claude_desktop_config.json");
+            return path_1.default.join(home, ".config", "Claude", "claude_desktop_config.json");
+        case "cursor":
+            return path_1.default.join(home, ".cursor", "mcp.json");
+        case "claude-code":
+            return path_1.default.join(home, ".claude.json");
+    }
+}
+const PROXY_PACKAGE = "@guardbee/mcp-security-proxy";
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function isProxyEntry(entry) {
+    const words = [entry["command"], ...(Array.isArray(entry["args"]) ? entry["args"] : [])].map(String);
+    return words.some((word) => word.includes(PROXY_PACKAGE) || /(^|[/\\])guardbee-proxy(\.cmd)?$/.test(word));
+}
+/** Config keys become upstream names: letters, digits, - and single _. */
+function upstreamName(key, taken) {
+    const base = key
+        .replace(/[^A-Za-z0-9_-]+/g, "-")
+        .replace(/_{2,}/g, "_")
+        .replace(/^[_-]+|[_-]+$/g, "") || "server";
+    let name = base;
+    for (let i = 2; taken.has(name); i++)
+        name = `${base}-${i}`;
+    taken.add(name);
+    return name;
+}
+function stringRecord(value) {
+    const rec = asRecord(value);
+    if (!rec)
+        return undefined;
+    const out = Object.fromEntries(Object.entries(rec).flatMap(([k, v]) => (typeof v === "string" || typeof v === "number" || typeof v === "boolean" ? [[k, String(v)]] : [])));
+    return Object.keys(out).length > 0 ? out : undefined;
+}
+/**
+ * Work out the migration without touching the disk. stdio servers move into
+ * the YAML; HTTP servers, disabled entries and an existing proxy entry stay.
+ */
+function planInit(clientConfigText, yamlPath, auditPath) {
+    const root = asRecord(JSON.parse(clientConfigText));
+    if (!root)
+        throw new Error("The client config is not a JSON object");
+    const servers = asRecord(root["mcpServers"]);
+    if (!servers || Object.keys(servers).length === 0)
+        throw new Error("No mcpServers found in the client config");
+    const upstreams = {};
+    const migrated = {};
+    const kept = [];
+    const remaining = {};
+    const taken = new Set();
+    for (const [key, value] of Object.entries(servers)) {
+        const entry = asRecord(value);
+        if (!entry) {
+            remaining[key] = value;
+            kept.push({ name: key, reason: "not an object" });
+        }
+        else if (isProxyEntry(entry)) {
+            remaining[key] = value;
+            kept.push({ name: key, reason: "already the GuardBee proxy" });
+        }
+        else if (entry["disabled"] === true) {
+            remaining[key] = value;
+            kept.push({ name: key, reason: "disabled" });
+        }
+        else if (typeof entry["command"] !== "string") {
+            remaining[key] = value;
+            kept.push({ name: key, reason: "HTTP server: the proxy does not front HTTP servers yet, so this one bypasses the policy" });
+        }
+        else {
+            const name = upstreamName(key, taken);
+            const args = Array.isArray(entry["args"]) ? entry["args"].map(String) : undefined;
+            const env = stringRecord(entry["env"]);
+            upstreams[name] = { command: entry["command"], ...(args?.length ? { args } : {}), ...(env ? { env } : {}) };
+            migrated[key] = name;
+        }
+    }
+    if (Object.keys(upstreams).length === 0)
+        throw new Error("No stdio MCP servers to move behind the proxy");
+    const proxyKey = !("guardbee" in remaining) ? "guardbee" : "guardbee-gateway";
+    // Pinned to 1.x: 0.x does not understand --config and would fail to start.
+    remaining[proxyKey] = { command: "npx", args: ["-y", `${PROXY_PACKAGE}@^1`, "--config", yamlPath] };
+    const yaml = "# GuardBee MCP gateway — generated by `guardbee-proxy init`.\n" +
+        "# Tools appear to the agent as <upstream>__<tool>. Check a change with `guardbee-proxy validate --config <this file>`.\n" +
+        "# env values were copied from the client config; move secrets to ${VAR} references where you can.\n" +
+        (0, yaml_1.stringify)({
+            version: 1,
+            upstreams,
+            taint: { mode: "strict" },
+            audit: { sink: "file", filePath: auditPath },
+        });
+    return {
+        yaml,
+        clientConfig: JSON.stringify({ ...root, mcpServers: remaining }, null, 2) + "\n",
+        migrated,
+        kept,
+    };
+}
+/** Write the YAML (mode 0600, it may hold tokens), back up the client config, then rewrite it. */
+function runInit(options) {
+    const clientPath = path_1.default.resolve(options.clientConfigPath);
+    const yamlPath = path_1.default.resolve(options.yamlPath);
+    const auditPath = path_1.default.join(path_1.default.dirname(yamlPath), "guardbee-audit.jsonl");
+    if (!fs_1.default.existsSync(clientPath))
+        throw new Error(`Client config not found: ${clientPath}`);
+    if (fs_1.default.existsSync(yamlPath) && !options.force && !options.dryRun) {
+        throw new Error(`${yamlPath} already exists; pass --force to overwrite it`);
+    }
+    const plan = planInit(fs_1.default.readFileSync(clientPath, "utf8"), yamlPath, auditPath);
+    if (options.dryRun)
+        return plan;
+    const stamp = (options.now ?? new Date()).toISOString().replace(/[:.]/g, "-");
+    const backupPath = `${clientPath}.guardbee-backup-${stamp}`;
+    fs_1.default.mkdirSync(path_1.default.dirname(yamlPath), { recursive: true });
+    fs_1.default.writeFileSync(yamlPath, plan.yaml, { mode: 0o600 });
+    fs_1.default.chmodSync(yamlPath, 0o600); // `mode` only applies when the file is created; --force may overwrite a wider one
+    fs_1.default.copyFileSync(clientPath, backupPath);
+    fs_1.default.writeFileSync(clientPath, plan.clientConfig);
+    return { ...plan, backupPath };
+}
+//# sourceMappingURL=init.js.map

package/dist/init.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"init.js","sourceRoot":"","sources":["../src/init.ts"],"names":[],"mappings":";;;;;AASA,4CAWC;AAkDD,4BAyDC;AAeD,0BAqBC;AAnKD,4CAAoB;AACpB,4CAAoB;AACpB,gDAAwB;AACxB,+BAA2C;AAK3C,yDAAyD;AACzD,SAAgB,gBAAgB,CAAC,MAAkB,EAAE,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,GAAG,YAAE,CAAC,OAAO,EAAE;IACnG,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,gBAAgB;YACnB,IAAI,QAAQ,KAAK,QAAQ;gBAAE,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YAC5H,IAAI,QAAQ,KAAK,OAAO;gBAAE,OAAO,cAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;YACpJ,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,4BAA4B,CAAC,CAAC;QAC5E,KAAK,QAAQ;YACX,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;QAChD,KAAK,aAAa;YAChB,OAAO,cAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AAaD,MAAM,aAAa,GAAG,8BAA8B,CAAC;AAErD,SAAS,QAAQ,CAAC,KAAc;IAC9B,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAiC,CAAC,CAAC,CAAC,IAAI,CAAC;AACjH,CAAC;AAED,SAAS,YAAY,CAAC,KAA8B;IAClD,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrG,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,IAAI,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7G,CAAC;AAED,0EAA0E;AAC1E,SAAS,YAAY,CAAC,GAAW,EAAE,KAAkB;IACnD,MAAM,IAAI,GACR,GAAG;SACA,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAChC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC;SACtB,OAAO,CAAC,gBAAgB,EAAE,EAAE,CAAC,IAAI,QAAQ,CAAC;IAC/C,IAAI,IAAI,GAAG,IAAI,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;IAC5D,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC5B,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAC3B,MAAM,GAAG,GAAG,MAAM,CAAC,WAAW,CAC5B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAC5I,CAAC;IACF,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED;;;GAGG;AACH,SAAgB,QAAQ,CAAC,gBAAwB,EAAE,QAAgB,EAAE,SAAiB;IACpF,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,CAAC,CAAC;IACrE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;IAC7C,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC;IAE/G,MAAM,SAAS,GAAoC,EAAE,CAAC;IACtD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,MAAM,IAAI,GAAqB,EAAE,CAAC;IAClC,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAEhC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACpD,CAAC;aAAM,IAAI,YAAY,CAAC,KAAK,CAAC,EAAE,CAAC;YAC/B,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,4BAA4B,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC;YACtC,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QAC/C,CAAC;aAAM,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,KAAK,QAAQ,EAAE,CAAC;YAChD,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;YACvB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,yFAAyF,EAAE,CAAC,CAAC;QAC9H,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;YAClF,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;YACvC,SAAS,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;YAC5G,QAAQ,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACvB,CAAC;IACH,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAE1G,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,IAAI,SAAS,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC;IAC9E,2EAA2E;IAC3E,SAAS,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,aAAa,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,CAAC;IAEpG,MAAM,IAAI,GACR,gEAAgE;QAChE,0HAA0H;QAC1H,qGAAqG;QACrG,IAAA,gBAAM,EAAC;YACL,OAAO,EAAE,CAAC;YACV,SAAS;YACT,KAAK,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE;YACzB,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE;SAC7C,CAAC,CAAC;IAEL,OAAO;QACL,IAAI;QACJ,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI;QAChF,QAAQ;QACR,IAAI;KACL,CAAC;AACJ,CAAC;AAcD,kGAAkG;AAClG,SAAgB,OAAO,CAAC,OAAoB;IAC1C,MAAM,UAAU,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,MAAM,SAAS,GAAG,cAAI,CAAC,IAAI,CAAC,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,sBAAsB,CAAC,CAAC;IAC5E,IAAI,CAAC,YAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,4BAA4B,UAAU,EAAE,CAAC,CAAC;IAC1F,IAAI,YAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,GAAG,QAAQ,+CAA+C,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,SAAS,CAAC,CAAC;IAChF,IAAI,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAEhC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC9E,MAAM,UAAU,GAAG,GAAG,UAAU,oBAAoB,KAAK,EAAE,CAAC;IAC5D,YAAE,CAAC,SAAS,CAAC,cAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,YAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACvD,YAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,kFAAkF;IAEjH,YAAE,CAAC,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;IACxC,YAAE,CAAC,aAAa,CAAC,UAAU,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;IAChD,OAAO,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,CAAC;AACjC,CAAC"}

package/dist/interceptors/definition-drift.d.ts

@@ -6,6 +6,7 @@ export interface PinFinding {
 export type ToolRecord = Record<string, unknown> & {
     name?: unknown;
 };
+export declare function stable(value: unknown): string;
 export declare function hashToolDefinition(tool: ToolRecord): string;
 /**
  * Pins the first tools/list a session sees. Later lists are compared to that

package/dist/interceptors/definition-drift.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"definition-drift.d.ts","sourceRoot":"","sources":["../../src/interceptors/definition-drift.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AActE,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAW3D;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAyD;IACvE,OAAO,CAAC,KAAK,CAAS;IAEtB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;KAAE;IAiDvG,8FAA8F;IAC9F,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI;IAIvC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,GAAG,IAAI;CAelE"}
+{"version":3,"file":"definition-drift.d.ts","sourceRoot":"","sources":["../../src/interceptors/definition-drift.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,OAAO,GAAG,SAAS,GAAG,SAAS,CAAC;IACtC,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC;AAEtE,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAU7C;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,UAAU,GAAG,MAAM,CAW3D;AAED;;;GAGG;AACH,qBAAa,iBAAiB;IAC5B,OAAO,CAAC,MAAM,CAAyD;IACvE,OAAO,CAAC,KAAK,CAAS;IAEtB,OAAO,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,MAAM,EAAE,OAAO,GAAG,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,EAAE,CAAC;QAAC,QAAQ,EAAE,UAAU,EAAE,CAAA;KAAE;IAiDvG,8FAA8F;IAC9F,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI;IAIvC,OAAO,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,GAAG,UAAU,GAAG,IAAI;CAelE"}

package/dist/interceptors/definition-drift.js

@@ -1,6 +1,7 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ToolDefinitionPin = void 0;
+exports.stable = stable;
 exports.hashToolDefinition = hashToolDefinition;
 const crypto_1 = require("crypto");
 function stable(value) {

package/dist/interceptors/definition-drift.js.map

@@ -1 +1 @@
-{"version":3,"file":"definition-drift.js","sourceRoot":"","sources":["../../src/interceptors/definition-drift.ts"],"names":[],"mappings":";;;AAsBA,gDAWC;AAjCD,mCAAoC;AAUpC,SAAS,MAAM,CAAC,KAAc;IAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAgB;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CACL,MAAM,CAAC;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAa,iBAAiB;IAA9B;QACU,WAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;QAC/D,UAAK,GAAG,KAAK,CAAC;IAuExB,CAAC;IArEC,OAAO,CAAC,KAAmB,EAAE,MAAwB;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAyC,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC3G,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,MAAM,UAAU,GAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,gDAAgD;iBAC3E,CAAC,CAAC;gBACH,IAAI,MAAM,KAAK,MAAM;oBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,uEAAuE;iBAClG,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,SAAS,IAAI,mDAAmD;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,8FAA8F;IAC9F,YAAY,CAAC,KAAmB;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,KAAmB;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,QAAQ,4CAA4C,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,QAAQ,IAAI,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,QAAQ;gBACR,MAAM,EAAE,SAAS,QAAQ,6CAA6C;aACvE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAzED,8CAyEC"}
+{"version":3,"file":"definition-drift.js","sourceRoot":"","sources":["../../src/interceptors/definition-drift.ts"],"names":[],"mappings":";;;AAUA,wBAUC;AAED,gDAWC;AAjCD,mCAAoC;AAUpC,SAAgB,MAAM,CAAC,KAAc;IACnC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IACpF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,KAAgC,CAAC;QAC7C,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;aACxB,IAAI,EAAE;aACN,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;aAC1D,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;IAClB,CAAC;IACD,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC;AACzC,CAAC;AAED,SAAgB,kBAAkB,CAAC,IAAgB;IACjD,OAAO,IAAA,mBAAU,EAAC,QAAQ,CAAC;SACxB,MAAM,CACL,MAAM,CAAC;QACL,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;QAC7B,WAAW,EAAE,IAAI,CAAC,WAAW;KAC9B,CAAC,CACH;SACA,MAAM,CAAC,KAAK,CAAC,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAa,iBAAiB;IAA9B;QACU,WAAM,GAAG,IAAI,GAAG,EAA8C,CAAC;QAC/D,UAAK,GAAG,KAAK,CAAC;IAuExB,CAAC;IArEC,OAAO,CAAC,KAAmB,EAAE,MAAwB;QACnD,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAyC,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC3G,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;YAChB,KAAK,MAAM,IAAI,IAAI,KAAK;gBAAE,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;YAC/F,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;YAClB,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,QAAQ,GAAiB,EAAE,CAAC;QAClC,MAAM,UAAU,GAAiB,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACpB,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC5C,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,OAAO;oBACb,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,gDAAgD;iBAC3E,CAAC,CAAC;gBACH,IAAI,MAAM,KAAK,MAAM;oBAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;gBAC/C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI,CAAC,IAAI;oBACnB,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,uEAAuE;iBAClG,CAAC,CAAC;gBACH,UAAU,CAAC,IAAI,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAC3D,SAAS;YACX,CAAC;YACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAED,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;YACtC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACpB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,SAAS;oBACf,QAAQ,EAAE,IAAI;oBACd,MAAM,EAAE,SAAS,IAAI,mDAAmD;iBACzE,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;IACzC,CAAC;IAED,8FAA8F;IAC9F,YAAY,CAAC,KAAmB;QAC9B,IAAI,CAAC,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAED,OAAO,CAAC,QAAgB,EAAE,KAAmB;QAC3C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QAC3C,IAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,CAAC;YACtB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,QAAQ,4CAA4C,EAAE,CAAC;QAC5G,CAAC;QACD,IAAI,QAAQ,IAAI,IAAI,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,QAAQ,CAAC,IAAI,EAAE,CAAC;YACnE,OAAO;gBACL,IAAI,EAAE,SAAS;gBACf,QAAQ;gBACR,MAAM,EAAE,SAAS,QAAQ,6CAA6C;aACvE,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;CACF;AAzED,8CAyEC"}

package/dist/interceptors/pii-masker.d.ts

@@ -1,3 +1,2 @@
-export declare function maskPiiInText(text: string): string;
-export declare function maskPiiInValue(value: unknown): unknown;
+export { maskPiiInText, maskPiiInValue } from "@guardbee/guard-core";
 //# sourceMappingURL=pii-masker.d.ts.map

package/dist/interceptors/pii-masker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pii-masker.d.ts","sourceRoot":"","sources":["../../src/interceptors/pii-masker.ts"],"names":[],"mappings":"AAuCA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAUlD;AAED,wBAAgB,cAAc,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAetD"}
+{"version":3,"file":"pii-masker.d.ts","sourceRoot":"","sources":["../../src/interceptors/pii-masker.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC"}

package/dist/interceptors/pii-masker.js

@@ -1,71 +1,8 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.maskPiiInText = maskPiiInText;
-exports.maskPiiInValue = maskPiiInValue;
-// PII patterns for response masking
-const PII_PATTERNS = [
-    {
-        name: "tc_kimlik",
-        pattern: /\b[1-9]\d{10}\b/g,
-        replacement: "[TC-KİMLİK]",
-    },
-    {
-        name: "iban",
-        pattern: /\bTR\d{2}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{4}[\s-]?\d{2}\b/gi,
-        replacement: "TR**[IBAN]",
-    },
-    {
-        name: "credit_card",
-        pattern: /\b(?:\d{4}[\s-]?){3}\d{4}\b/g,
-        replacement: "****-****-****-[KART]",
-    },
-    {
-        name: "email",
-        pattern: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b/g,
-        replacement: "***@[EMAIL]",
-    },
-    {
-        name: "phone_tr",
-        pattern: /\b(?:\+90|0090|0)?[\s-]?(?:\d{3})[\s-]?\d{3}[\s-]?\d{2}[\s-]?\d{2}\b/g,
-        replacement: "+90-***-***-**[TELEFON]",
-    },
-    {
-        name: "api_key",
-        pattern: /\b(?:sk|pk|api|key|token|secret)[-_]?[A-Za-z0-9]{16,}\b/gi,
-        replacement: "[API-KEY]",
-    },
-    {
-        name: "jwt",
-        pattern: /\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g,
-        replacement: "[JWT-TOKEN]",
-    },
-];
-function maskPiiInText(text) {
-    let result = text;
-    for (const { pattern, replacement } of PII_PATTERNS) {
-        if (typeof replacement === "string") {
-            result = result.replace(pattern, replacement);
-        }
-        else {
-            result = result.replace(pattern, replacement);
-        }
-    }
-    return result;
-}
-function maskPiiInValue(value) {
-    if (typeof value === "string") {
-        return maskPiiInText(value);
-    }
-    if (Array.isArray(value)) {
-        return value.map(maskPiiInValue);
-    }
-    if (typeof value === "object" && value !== null) {
-        const result = {};
-        for (const [k, v] of Object.entries(value)) {
-            result[k] = maskPiiInValue(v);
-        }
-        return result;
-    }
-    return value;
-}
+exports.maskPiiInValue = exports.maskPiiInText = void 0;
+// Checksum-validated PII masking lives in @guardbee/guard-core, shared with the gateway.
+var guard_core_1 = require("@guardbee/guard-core");
+Object.defineProperty(exports, "maskPiiInText", { enumerable: true, get: function () { return guard_core_1.maskPiiInText; } });
+Object.defineProperty(exports, "maskPiiInValue", { enumerable: true, get: function () { return guard_core_1.maskPiiInValue; } });
 //# sourceMappingURL=pii-masker.js.map

package/dist/interceptors/pii-masker.js.map

@@ -1 +1 @@
-{"version":3,"file":"pii-masker.js","sourceRoot":"","sources":["../../src/interceptors/pii-masker.ts"],"names":[],"mappings":";;AAuCA,sCAUC;AAED,wCAeC;AAlED,oCAAoC;AACpC,MAAM,YAAY,GAA6D;IAC7E;QACE,IAAI,EAAE,WAAW;QACjB,OAAO,EAAE,kBAAkB;QAC3B,WAAW,EAAE,aAAa;KAC3B;IACD;QACE,IAAI,EAAE,MAAM;QACZ,OAAO,EAAE,iFAAiF;QAC1F,WAAW,EAAE,YAAY;KAC1B;IACD;QACE,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,8BAA8B;QACvC,WAAW,EAAE,uBAAuB;KACrC;IACD;QACE,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,sDAAsD;QAC/D,WAAW,EAAE,aAAa;KAC3B;IACD;QACE,IAAI,EAAE,UAAU;QAChB,OAAO,EAAE,uEAAuE;QAChF,WAAW,EAAE,yBAAyB;KACvC;IACD;QACE,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,2DAA2D;QACpE,WAAW,EAAE,WAAW;KACzB;IACD;QACE,IAAI,EAAE,KAAK;QACX,OAAO,EAAE,wDAAwD;QACjE,WAAW,EAAE,aAAa;KAC3B;CACF,CAAC;AAEF,SAAgB,aAAa,CAAC,IAAY;IACxC,IAAI,MAAM,GAAG,IAAI,CAAC;IAClB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,YAAY,EAAE,CAAC;QACpD,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,CAAC;YACpC,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QAChD,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,cAAc,CAAC,KAAc;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,aAAa,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,CAAC,CAAC,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC;QAChC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}
+{"version":3,"file":"pii-masker.js","sourceRoot":"","sources":["../../src/interceptors/pii-masker.ts"],"names":[],"mappings":";;;AAAA,yFAAyF;AACzF,mDAAqE;AAA5D,2GAAA,aAAa,OAAA;AAAE,4GAAA,cAAc,OAAA"}

package/dist/interceptors/prompt-injection.d.ts

@@ -1,3 +1,2 @@
-import type { InterceptResult } from "../types.js";
-export declare function scanForPromptInjection(input: unknown, mode?: "block" | "warn"): InterceptResult;
+export { scanForPromptInjection } from "@guardbee/guard-core";
 //# sourceMappingURL=prompt-injection.d.ts.map

package/dist/interceptors/prompt-injection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompt-injection.d.ts","sourceRoot":"","sources":["../../src/interceptors/prompt-injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AA8BnD,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,OAAO,EACd,IAAI,GAAE,OAAO,GAAG,MAAgB,GAC/B,eAAe,CAajB"}
+{"version":3,"file":"prompt-injection.d.ts","sourceRoot":"","sources":["../../src/interceptors/prompt-injection.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC"}