@intflows/genkit-guard 0.0.13 → 0.1.0

package/dist/core/audit.js

@@ -0,0 +1,23 @@
+import { randomUUID } from 'node:crypto';
+export async function publishDecision(config, start, fields) {
+    const decision = Object.freeze({
+        schemaVersion: '1', decisionId: randomUUID(), timestamp: new Date().toISOString(),
+        policyVersion: config?.policyVersion ?? 'unversioned',
+        latencyMs: Math.max(0, performance.now() - start), ...fields,
+    });
+    const warning = decision.action === 'block' || decision.action === 'approval-required';
+    const level = config?.logging?.level ?? 'info';
+    if ((config?.logging?.enabled ?? true) && level !== 'error' && (level !== 'warn' || warning)) {
+        const record = {
+            timestamp: decision.timestamp, severityText: warning ? 'WARN' : 'INFO',
+            severityNumber: warning ? 13 : 9, body: 'Guard policy decision',
+            resource: { attributes: { 'service.name': config?.logging?.serviceName ?? '@intflows/genkit-guard' } },
+            attributes: { 'event.name': 'guard.decision', 'code.namespace': 'genkit-guard', decision },
+        };
+        (warning ? console.warn : console.log)(JSON.stringify(record));
+    }
+    // Persist before invoking the callback. Neither failure may trigger a model fallback.
+    await config?.logging?.store?.append(decision);
+    await config?.logging?.onDecision?.(decision);
+    return decision;
+}

package/dist/core/decision-storage.d.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod';
+import type { GuardDecision } from './decision.js';
+export interface GuardDecisionStore {
+    append(decision: GuardDecision): void | Promise<void>;
+}
+/** Validates the v1 contract and strips unknown fields before persistence. */
+export declare const guardDecisionSchema: z.ZodObject<{
+    schemaVersion: z.ZodLiteral<"1">;
+    decisionId: z.ZodString;
+    timestamp: z.ZodString;
+    guard: z.ZodEnum<{
+        injection: "injection";
+        intent: "intent";
+        pii: "pii";
+        tool: "tool";
+    }>;
+    policyVersion: z.ZodString;
+    action: z.ZodEnum<{
+        allow: "allow";
+        block: "block";
+        redact: "redact";
+        "approval-required": "approval-required";
+    }>;
+    reasonCode: z.ZodEnum<{
+        INJECTION_PATTERN: "INJECTION_PATTERN";
+        INJECTION_CLEAR: "INJECTION_CLEAR";
+        INTENT_ALLOWED: "INTENT_ALLOWED";
+        INTENT_REJECTED: "INTENT_REJECTED";
+        PII_DETECTED: "PII_DETECTED";
+        PII_CLEAR: "PII_CLEAR";
+        TOOL_ALLOWED: "TOOL_ALLOWED";
+        TOOL_BLOCKED: "TOOL_BLOCKED";
+        TOOL_REDACTED: "TOOL_REDACTED";
+        TOOL_APPROVAL_REQUIRED: "TOOL_APPROVAL_REQUIRED";
+        TOOL_APPROVED: "TOOL_APPROVED";
+        TOOL_APPROVAL_DENIED: "TOOL_APPROVAL_DENIED";
+        TOOL_POLICY_ERROR: "TOOL_POLICY_ERROR";
+        MODEL_FALLBACK_USED: "MODEL_FALLBACK_USED";
+        MODEL_UNAVAILABLE: "MODEL_UNAVAILABLE";
+    }>;
+    latencyMs: z.ZodNumber;
+    confidence: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare function createGuardDecisionStore(adapter: GuardDecisionStore): GuardDecisionStore;
+export interface JsonlDecisionStore extends GuardDecisionStore {
+    /** Read the complete file. Missing files return []; malformed records reject. */
+    read(): Promise<GuardDecision[]>;
+}
+/** Single-process JSONL writer. Each append is flushed before it resolves. */
+export declare function createJsonlDecisionStore(filePath: string): JsonlDecisionStore;

package/dist/core/decision-storage.js

@@ -0,0 +1,84 @@
+import { open, mkdir, readFile } from 'node:fs/promises';
+import { dirname, resolve } from 'node:path';
+import { z } from 'zod';
+/** Validates the v1 contract and strips unknown fields before persistence. */
+export const guardDecisionSchema = z.object({
+    schemaVersion: z.literal('1'),
+    decisionId: z.string().min(1), timestamp: z.string().datetime(),
+    guard: z.enum(['injection', 'intent', 'pii', 'tool']),
+    policyVersion: z.string(),
+    action: z.enum(['allow', 'block', 'redact', 'approval-required']),
+    reasonCode: z.enum([
+        'INJECTION_PATTERN', 'INJECTION_CLEAR', 'INTENT_ALLOWED', 'INTENT_REJECTED',
+        'PII_DETECTED', 'PII_CLEAR', 'TOOL_ALLOWED', 'TOOL_BLOCKED', 'TOOL_REDACTED',
+        'TOOL_APPROVAL_REQUIRED', 'TOOL_APPROVED', 'TOOL_APPROVAL_DENIED', 'TOOL_POLICY_ERROR',
+        'MODEL_FALLBACK_USED', 'MODEL_UNAVAILABLE',
+    ]),
+    latencyMs: z.number().finite().nonnegative(), confidence: z.number().finite().optional(),
+});
+export function createGuardDecisionStore(adapter) {
+    return { append: decision => adapter.append(guardDecisionSchema.parse(decision)) };
+}
+// Serialize instances targeting the same resolved path within this process.
+const queues = new Map();
+function enqueue(path, task) {
+    const result = (queues.get(path) ?? Promise.resolve()).catch(() => { }).then(task);
+    queues.set(path, result);
+    void result.then(() => { if (queues.get(path) === result)
+        queues.delete(path); }, () => { if (queues.get(path) === result)
+        queues.delete(path); });
+    return result;
+}
+/** Single-process JSONL writer. Each append is flushed before it resolves. */
+export function createJsonlDecisionStore(filePath) {
+    const path = resolve(filePath);
+    return {
+        append(decision) {
+            // Serialize immediately so callers cannot change a queued record.
+            const line = JSON.stringify(guardDecisionSchema.parse(decision)) + '\n';
+            return enqueue(path, async () => {
+                await mkdir(dirname(path), { recursive: true });
+                const file = await open(path, 'a+', 0o600);
+                try {
+                    const { size } = await file.stat();
+                    if (size > 0) {
+                        const tail = Buffer.alloc(1);
+                        await file.read(tail, 0, 1, size - 1);
+                        if (tail[0] !== 10)
+                            throw new Error('Incomplete decision log record');
+                    }
+                    await file.writeFile(line, 'utf8');
+                    await file.sync();
+                }
+                finally {
+                    await file.close();
+                }
+            });
+        },
+        read() {
+            return enqueue(path, async () => {
+                let contents;
+                try {
+                    contents = await readFile(path, 'utf8');
+                }
+                catch (error) {
+                    if (error.code === 'ENOENT')
+                        return [];
+                    throw error;
+                }
+                if (!contents)
+                    return [];
+                if (!contents.endsWith('\n'))
+                    throw new Error('Incomplete decision log record');
+                return contents.slice(0, -1).split('\n').map((line, index) => {
+                    try {
+                        return guardDecisionSchema.parse(JSON.parse(line));
+                    }
+                    catch {
+                        throw new Error(`Invalid decision log record at line ${index + 1}`);
+                    }
+                });
+            });
+        },
+    };
+}

package/dist/core/decision.d.ts

@@ -0,0 +1,33 @@
+export type GuardAction = 'allow' | 'block' | 'redact' | 'approval-required';
+export type GuardReasonCode = 'INJECTION_PATTERN' | 'INJECTION_CLEAR' | 'INTENT_ALLOWED' | 'INTENT_REJECTED' | 'PII_DETECTED' | 'PII_CLEAR' | 'TOOL_ALLOWED' | 'TOOL_BLOCKED' | 'TOOL_REDACTED' | 'TOOL_APPROVAL_REQUIRED' | 'TOOL_APPROVED' | 'TOOL_APPROVAL_DENIED' | 'TOOL_POLICY_ERROR' | 'MODEL_FALLBACK_USED' | 'MODEL_UNAVAILABLE';
+/** Content-free audit contract. Version independently of the npm package. */
+export interface GuardDecision {
+    schemaVersion: '1';
+    decisionId: string;
+    timestamp: string;
+    guard: 'injection' | 'intent' | 'pii' | 'tool';
+    policyVersion: string;
+    action: GuardAction;
+    reasonCode: GuardReasonCode;
+    latencyMs: number;
+    confidence?: number;
+}
+export interface ToolPolicyContext {
+    toolName: string;
+    /** A copy of the restored arguments. Never included in GuardDecision events. */
+    input: unknown;
+    /** Trusted application context supplied by Genkit, not model arguments. */
+    context: unknown;
+}
+export interface ToolGuardConfig {
+    /** Default allow preserves existing behavior. Use block for an allowlist. */
+    defaultAction?: GuardAction;
+    rules?: Record<string, GuardAction>;
+    /** Called only for approval-required rules; only literal true authorizes execution. */
+    approve?: (call: ToolPolicyContext) => boolean | Promise<boolean>;
+}
+/** Thrown before tool execution for blocked, pending, denied or failed policies. */
+export declare class GuardToolError extends Error {
+    readonly decision: GuardDecision;
+    constructor(decision: GuardDecision);
+}

package/dist/core/decision.js

@@ -0,0 +1,9 @@
+/** Thrown before tool execution for blocked, pending, denied or failed policies. */
+export class GuardToolError extends Error {
+    decision;
+    constructor(decision) {
+        super(`Tool execution stopped: ${decision.reasonCode}`);
+        this.decision = decision;
+        this.name = 'GuardToolError';
+    }
+}

package/dist/guard.config.d.ts

@@ -0,0 +1,10 @@
+import type { GuardConfig } from './middleware/middleware.js';
+/** Model labels (case insensitive, optional BIOES prefix) to masking token types. */
+export type PiiLabelMappings = Record<string, string | null>;
+/** Define an application-owned guard.config.ts and pass it to both public APIs. */
+export declare function defineGuardConfig(config: GuardConfig): GuardConfig;
+export declare function resolveGuardModels(config?: GuardConfig): {
+    extractor: string;
+    mode: "ner" | "classifier";
+    pii: string;
+};

package/dist/guard.config.js

@@ -0,0 +1,12 @@
+/** Define an application-owned guard.config.ts and pass it to both public APIs. */
+export function defineGuardConfig(config) {
+    return config;
+}
+export function resolveGuardModels(config) {
+    const mode = config?.pii?.mode ?? 'ner';
+    return {
+        extractor: config?.models?.extractor ?? 'Xenova/all-MiniLM-L6-v2',
+        mode,
+        pii: config?.pii?.model ?? (mode === 'ner' ? 'Xenova/bert-base-NER' : 'openai/privacy-filter'),
+    };
+}

package/dist/index.d.ts

@@ -1,3 +1,10 @@
+export { createGuardDecisionStore, createJsonlDecisionStore, guardDecisionSchema } from './core/decision-storage.js';
+export type { GuardDecisionStore, JsonlDecisionStore } from './core/decision-storage.js';
+export { GuardModelError } from './util/fallback.js';
+export * from './core/decision.js';
+import type { GuardConfig } from './middleware/middleware.js';
+export { defineGuardConfig } from './guard.config.js';
+export type { PiiLabelMappings } from './guard.config.js';
 export { guard, guardAction, guardMiddleware, guardPlugin } from './middleware/middleware.js';
 export type { GuardConfig } from './middleware/middleware.js';
 export { InMemoryPiiVaultStorage, createPiiVaultStorage, createRedisPiiVaultStorage, defaultPiiVaultStorage, } from './pii/storage.js';
@@ -6,4 +13,4 @@ export * from './core/types.js';
 /**
  * Pre-load the model to avoid cold-start delay on first user request.
  */
-export declare function initGuard(config?: any): Promise<void>;
+export declare function initGuard(config?: GuardConfig): Promise<void>;

package/dist/index.js

@@ -1,3 +1,9 @@
+export { createGuardDecisionStore, createJsonlDecisionStore, guardDecisionSchema } from './core/decision-storage.js';
+export { GuardModelError } from './util/fallback.js';
+import { runGuardModel } from './util/fallback.js';
+export * from './core/decision.js';
+import { resolveGuardModels } from './guard.config.js';
+export { defineGuardConfig } from './guard.config.js';
 import { ModelSingleton } from './util/singleton.js';
 // export { intentGuard, piiGuard  } from './middleware/middleware.js';
 export { guard, guardAction, guardMiddleware, guardPlugin } from './middleware/middleware.js';
@@ -26,16 +32,11 @@ function logGuardEvent(eventName, body, attributes = {}) {
  */
 export async function initGuard(config) {
     logGuardEvent('guard.models.loading', 'Loading local guard models');
-    const extractorModel = config?.models?.extractor ?? 'Xenova/all-MiniLM-L6-v2';
-    const piiModel = config?.pii?.model;
-    const piiMode = config?.pii?.mode ?? 'ner';
-    const tasks = [ModelSingleton.getExtractor(extractorModel)];
-    if (piiMode === 'ner') {
-        tasks.push(ModelSingleton.getNER(piiModel ?? 'Xenova/bert-base-NER'));
-    }
-    else {
-        tasks.push(ModelSingleton.getPIIClassifier(piiModel ?? 'openai/privacy-filter'));
-    }
+    const { extractor, pii, mode: piiMode } = resolveGuardModels(config);
+    const loadPii = (model, mode) => mode === 'ner'
+        ? ModelSingleton.getNER(model) : ModelSingleton.getPIIClassifier(model);
+    const tasks = [runGuardModel(config, 'intent', () => ModelSingleton.getExtractor(extractor), config?.models?.extractorFallback ? () => ModelSingleton.getExtractor(config.models.extractorFallback) : undefined)];
+    tasks.push(runGuardModel(config, 'pii', () => loadPii(pii, piiMode), config?.pii?.fallback ? () => loadPii(config.pii.fallback.model, config.pii.fallback.mode ?? piiMode) : undefined));
     await Promise.all(tasks);
     logGuardEvent('guard.models.loaded', 'Local guard models loaded', {
         piiMode,

package/dist/intent/intentAnalyzer.d.ts

@@ -1,5 +1,5 @@
 export declare function detectInjection(userInput: string): Promise<boolean>;
-export declare function analyzeIntentStructured(input: string, intents: Record<string, string>, threshold: number): Promise<{
+export declare function analyzeIntentStructured(input: string, intents: Record<string, string>, threshold: number, model?: string): Promise<{
     intent: string;
     score: number;
     allowed: boolean;

package/dist/intent/intentAnalyzer.js

@@ -58,8 +58,8 @@ const INJECTION_PATTERNS = [
 export async function detectInjection(userInput) {
     return INJECTION_PATTERNS.some(p => userInput.toLowerCase().includes(p));
 }
-export async function analyzeIntentStructured(input, intents, threshold) {
-    const extractor = await ModelSingleton.getExtractor();
+export async function analyzeIntentStructured(input, intents, threshold, model) {
+    const extractor = await ModelSingleton.getExtractor(model);
     let bestIntent = '';
     let bestScore = 0;
     for (const [key, desc] of Object.entries(intents)) {

package/dist/middleware/middleware.d.ts

@@ -1,6 +1,11 @@
+import type { GuardDecisionStore } from '../core/decision-storage.js';
+import { type GuardDecision, type ToolGuardConfig } from '../core/decision.js';
+import { type PiiLabelMappings } from '../guard.config.js';
 import { z } from 'genkit';
 import { type PiiVaultStorage } from '../pii/storage.js';
 export type GuardConfig = {
+    policyVersion?: string;
+    tools?: ToolGuardConfig;
     intent?: {
         mode?: string;
         allowedIntent?: string;
@@ -13,6 +18,12 @@ export type GuardConfig = {
         reversible?: boolean;
         model?: string;
         mode?: 'ner' | 'classifier';
+        fallback?: {
+            model: string;
+            mode?: 'ner' | 'classifier';
+            labelMappings?: PiiLabelMappings;
+        };
+        labelMappings?: PiiLabelMappings;
         vault?: {
             storage?: PiiVaultStorage;
             scopeId?: string | ((req: any, ctx: any) => string | undefined);
@@ -22,14 +33,33 @@ export type GuardConfig = {
         enabled?: boolean;
         level?: LogSeverity;
         serviceName?: string;
+        /** Awaited audit callback, independent of console logging level/enabled. Failure stops execution. */
+        onDecision?: (decision: GuardDecision) => void | Promise<void>;
+        /** Durable audit delivery. Failure stops execution; called before onDecision. */
+        store?: GuardDecisionStore;
     };
     models?: {
         extractor?: string;
+        extractorFallback?: string;
     };
     [key: string]: any;
 };
 type LogSeverity = 'debug' | 'info' | 'warn' | 'error';
 export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodObject<{
+    policyVersion: z.ZodOptional<z.ZodString>;
+    tools: z.ZodOptional<z.ZodObject<{
+        defaultAction: z.ZodOptional<z.ZodEnum<["allow", "block", "redact", "approval-required"]>>;
+        rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["allow", "block", "redact", "approval-required"]>>>;
+        approve: z.ZodOptional<z.ZodAny>;
+    }, "strip", z.ZodTypeAny, {
+        defaultAction?: "allow" | "block" | "redact" | "approval-required" | undefined;
+        rules?: Record<string, "allow" | "block" | "redact" | "approval-required"> | undefined;
+        approve?: any;
+    }, {
+        defaultAction?: "allow" | "block" | "redact" | "approval-required" | undefined;
+        rules?: Record<string, "allow" | "block" | "redact" | "approval-required"> | undefined;
+        approve?: any;
+    }>>;
     intent: z.ZodOptional<z.ZodObject<{
         mode: z.ZodOptional<z.ZodString>;
         allowedIntent: z.ZodOptional<z.ZodString>;
@@ -62,6 +92,20 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
         reversible: z.ZodOptional<z.ZodBoolean>;
         model: z.ZodOptional<z.ZodString>;
         mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+        fallback: z.ZodOptional<z.ZodObject<{
+            model: z.ZodString;
+            mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+            labelMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+        }, "strip", z.ZodTypeAny, {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        }, {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        }>>;
+        labelMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
         vault: z.ZodOptional<z.ZodObject<{
             storage: z.ZodOptional<z.ZodAny>;
             scopeId: z.ZodOptional<z.ZodAny>;
@@ -73,17 +117,29 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
             scopeId?: any;
         }>>;
     }, "strip", z.ZodTypeAny, {
+        model?: string | undefined;
+        fallback?: {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        } | undefined;
         mode?: "ner" | "classifier" | undefined;
         reversible?: boolean | undefined;
-        model?: string | undefined;
+        labelMappings?: Record<string, string | null> | undefined;
         vault?: {
             storage?: any;
             scopeId?: any;
         } | undefined;
     }, {
+        model?: string | undefined;
+        fallback?: {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        } | undefined;
         mode?: "ner" | "classifier" | undefined;
         reversible?: boolean | undefined;
-        model?: string | undefined;
+        labelMappings?: Record<string, string | null> | undefined;
         vault?: {
             storage?: any;
             scopeId?: any;
@@ -93,23 +149,46 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
         enabled: z.ZodOptional<z.ZodBoolean>;
         level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
         serviceName: z.ZodOptional<z.ZodString>;
+        onDecision: z.ZodOptional<z.ZodAny>;
+        store: z.ZodOptional<z.ZodAny>;
     }, "strip", z.ZodTypeAny, {
         enabled?: boolean | undefined;
         level?: "debug" | "info" | "warn" | "error" | undefined;
         serviceName?: string | undefined;
+        onDecision?: any;
+        store?: any;
     }, {
         enabled?: boolean | undefined;
         level?: "debug" | "info" | "warn" | "error" | undefined;
         serviceName?: string | undefined;
+        onDecision?: any;
+        store?: any;
     }>>;
     models: z.ZodOptional<z.ZodObject<{
         extractor: z.ZodOptional<z.ZodString>;
+        extractorFallback: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         extractor?: string | undefined;
+        extractorFallback?: string | undefined;
     }, {
         extractor?: string | undefined;
+        extractorFallback?: string | undefined;
     }>>;
 }, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    policyVersion: z.ZodOptional<z.ZodString>;
+    tools: z.ZodOptional<z.ZodObject<{
+        defaultAction: z.ZodOptional<z.ZodEnum<["allow", "block", "redact", "approval-required"]>>;
+        rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["allow", "block", "redact", "approval-required"]>>>;
+        approve: z.ZodOptional<z.ZodAny>;
+    }, "strip", z.ZodTypeAny, {
+        defaultAction?: "allow" | "block" | "redact" | "approval-required" | undefined;
+        rules?: Record<string, "allow" | "block" | "redact" | "approval-required"> | undefined;
+        approve?: any;
+    }, {
+        defaultAction?: "allow" | "block" | "redact" | "approval-required" | undefined;
+        rules?: Record<string, "allow" | "block" | "redact" | "approval-required"> | undefined;
+        approve?: any;
+    }>>;
     intent: z.ZodOptional<z.ZodObject<{
         mode: z.ZodOptional<z.ZodString>;
         allowedIntent: z.ZodOptional<z.ZodString>;
@@ -142,6 +221,20 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
         reversible: z.ZodOptional<z.ZodBoolean>;
         model: z.ZodOptional<z.ZodString>;
         mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+        fallback: z.ZodOptional<z.ZodObject<{
+            model: z.ZodString;
+            mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+            labelMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+        }, "strip", z.ZodTypeAny, {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        }, {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        }>>;
+        labelMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
         vault: z.ZodOptional<z.ZodObject<{
             storage: z.ZodOptional<z.ZodAny>;
             scopeId: z.ZodOptional<z.ZodAny>;
@@ -153,17 +246,29 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
             scopeId?: any;
         }>>;
     }, "strip", z.ZodTypeAny, {
+        model?: string | undefined;
+        fallback?: {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        } | undefined;
         mode?: "ner" | "classifier" | undefined;
         reversible?: boolean | undefined;
-        model?: string | undefined;
+        labelMappings?: Record<string, string | null> | undefined;
         vault?: {
             storage?: any;
             scopeId?: any;
         } | undefined;
     }, {
+        model?: string | undefined;
+        fallback?: {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        } | undefined;
         mode?: "ner" | "classifier" | undefined;
         reversible?: boolean | undefined;
-        model?: string | undefined;
+        labelMappings?: Record<string, string | null> | undefined;
         vault?: {
             storage?: any;
             scopeId?: any;
@@ -173,23 +278,46 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
         enabled: z.ZodOptional<z.ZodBoolean>;
         level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
         serviceName: z.ZodOptional<z.ZodString>;
+        onDecision: z.ZodOptional<z.ZodAny>;
+        store: z.ZodOptional<z.ZodAny>;
     }, "strip", z.ZodTypeAny, {
         enabled?: boolean | undefined;
         level?: "debug" | "info" | "warn" | "error" | undefined;
         serviceName?: string | undefined;
+        onDecision?: any;
+        store?: any;
     }, {
         enabled?: boolean | undefined;
         level?: "debug" | "info" | "warn" | "error" | undefined;
         serviceName?: string | undefined;
+        onDecision?: any;
+        store?: any;
     }>>;
     models: z.ZodOptional<z.ZodObject<{
         extractor: z.ZodOptional<z.ZodString>;
+        extractorFallback: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         extractor?: string | undefined;
+        extractorFallback?: string | undefined;
     }, {
         extractor?: string | undefined;
+        extractorFallback?: string | undefined;
     }>>;
 }, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    policyVersion: z.ZodOptional<z.ZodString>;
+    tools: z.ZodOptional<z.ZodObject<{
+        defaultAction: z.ZodOptional<z.ZodEnum<["allow", "block", "redact", "approval-required"]>>;
+        rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["allow", "block", "redact", "approval-required"]>>>;
+        approve: z.ZodOptional<z.ZodAny>;
+    }, "strip", z.ZodTypeAny, {
+        defaultAction?: "allow" | "block" | "redact" | "approval-required" | undefined;
+        rules?: Record<string, "allow" | "block" | "redact" | "approval-required"> | undefined;
+        approve?: any;
+    }, {
+        defaultAction?: "allow" | "block" | "redact" | "approval-required" | undefined;
+        rules?: Record<string, "allow" | "block" | "redact" | "approval-required"> | undefined;
+        approve?: any;
+    }>>;
     intent: z.ZodOptional<z.ZodObject<{
         mode: z.ZodOptional<z.ZodString>;
         allowedIntent: z.ZodOptional<z.ZodString>;
@@ -222,6 +350,20 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
         reversible: z.ZodOptional<z.ZodBoolean>;
         model: z.ZodOptional<z.ZodString>;
         mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+        fallback: z.ZodOptional<z.ZodObject<{
+            model: z.ZodString;
+            mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+            labelMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
+        }, "strip", z.ZodTypeAny, {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        }, {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        }>>;
+        labelMappings: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodNullable<z.ZodString>>>;
         vault: z.ZodOptional<z.ZodObject<{
             storage: z.ZodOptional<z.ZodAny>;
             scopeId: z.ZodOptional<z.ZodAny>;
@@ -233,17 +375,29 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
             scopeId?: any;
         }>>;
     }, "strip", z.ZodTypeAny, {
+        model?: string | undefined;
+        fallback?: {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        } | undefined;
         mode?: "ner" | "classifier" | undefined;
         reversible?: boolean | undefined;
-        model?: string | undefined;
+        labelMappings?: Record<string, string | null> | undefined;
         vault?: {
             storage?: any;
             scopeId?: any;
         } | undefined;
     }, {
+        model?: string | undefined;
+        fallback?: {
+            model: string;
+            mode?: "ner" | "classifier" | undefined;
+            labelMappings?: Record<string, string | null> | undefined;
+        } | undefined;
         mode?: "ner" | "classifier" | undefined;
         reversible?: boolean | undefined;
-        model?: string | undefined;
+        labelMappings?: Record<string, string | null> | undefined;
         vault?: {
             storage?: any;
             scopeId?: any;
@@ -253,24 +407,46 @@ export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodO
         enabled: z.ZodOptional<z.ZodBoolean>;
         level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
         serviceName: z.ZodOptional<z.ZodString>;
+        onDecision: z.ZodOptional<z.ZodAny>;
+        store: z.ZodOptional<z.ZodAny>;
     }, "strip", z.ZodTypeAny, {
         enabled?: boolean | undefined;
         level?: "debug" | "info" | "warn" | "error" | undefined;
         serviceName?: string | undefined;
+        onDecision?: any;
+        store?: any;
     }, {
         enabled?: boolean | undefined;
         level?: "debug" | "info" | "warn" | "error" | undefined;
         serviceName?: string | undefined;
+        onDecision?: any;
+        store?: any;
     }>>;
     models: z.ZodOptional<z.ZodObject<{
         extractor: z.ZodOptional<z.ZodString>;
+        extractorFallback: z.ZodOptional<z.ZodString>;
     }, "strip", z.ZodTypeAny, {
         extractor?: string | undefined;
+        extractorFallback?: string | undefined;
     }, {
         extractor?: string | undefined;
+        extractorFallback?: string | undefined;
     }>>;
 }, z.ZodTypeAny, "passthrough">>, void>;
 export declare const guardPlugin: (pluginOptions: void) => import("@genkit-ai/ai").GenkitPluginV2;
-export declare function guard(config?: GuardConfig): (req: any, ctxOrNext: any, maybeNext?: any) => Promise<any>;
+type GuardHooks = ReturnType<typeof createGuardHooks>;
+type NativeGuard = ReturnType<typeof guardMiddleware> & GuardHooks;
+type LegacyGuard = ((req: any, ctxOrNext: any, maybeNext?: any) => Promise<any>) & GuardHooks;
+export declare function guard(config: GuardConfig & {
+    tools: ToolGuardConfig;
+}): NativeGuard;
+export declare function guard(config?: GuardConfig & {
+    tools?: undefined;
+}): LegacyGuard;
+export declare function guard(config: GuardConfig): NativeGuard | LegacyGuard;
 export declare const guardAction: typeof guard;
+declare function createGuardHooks(config?: GuardConfig): {
+    model: (req: any, ctx: any, next: any) => Promise<any>;
+    tool: (req: any, ctx: any, next: any) => Promise<any>;
+};
 export {};