@intflows/genkit-guard 0.0.8 → 0.0.9-alpha.1

package/README.md

@@ -1,4 +1,7 @@
-# **@intflows/genkit-guard**  
+# **@intflows/genkit-guard** 
+
+#### _This version uses OpenAI/privacy-filter instead of bert-base-NER_
+
 ### **Lightweight Intent, PII, and Safety Guardrails for Genkit**
 
 `@intflows/genkit-guard` provides a modular guardrail layer for Genkit flows.  
@@ -24,7 +27,7 @@ This library is designed for developers who want **practical, production‑ready
   Blocks jailbreak attempts using pattern‑based heuristics.
 
 - **Model‑Light Architecture**  
-  The package uses local `all-MiniLM-L6-v2` and `bert-base-NER` Models, these Models are downloaded once and cached locally.
+  The package uses local `all-MiniLM-L6-v2` and `openai/privacy-filter` Models, these Models are downloaded once and cached locally.
 
 - **Drop‑in Genkit Middleware**  
   Works with `ai.generate`, `ai.generateStream`, and Genkit flows.
@@ -38,12 +41,12 @@ This library is designed for developers who want **practical, production‑ready
 npm install @intflows/genkit-guard
 ```
 
-This library uses lightweight transformer models (MiniLM + BERT‑NER).  
+This library uses lightweight transformer models (MiniLM + Openai/privacy-filter).  
 
 Download them once. 
 
 ```bash
-## Download the transformer models (MiniLM + BERT‑NER)
+## Download the transformer models (MiniLM + OpenAI/privacy-filter)
 node node_modules/@intflows/genkit-guard/scripts/download-model.js
 ```
 
@@ -62,6 +65,7 @@ npm install @intflows/genkit-guard
 # Download Local Models (Only needed once)
 node node_modules/@intflows/genkit-guard/scripts/download-model.js
 ```
+_ This downloads the models to ./models folder, the total size is ~1.5 GB ( 1GB for Openai/privacy-filter + .5 GB for MiniLM-L6-v2) 
 
 ### 2. Update genkit
 
@@ -133,9 +137,9 @@ Before the LLM sees the prompt:
 Detected PII includes:
 
 - Emails  
-- Phone numbers  
-- Names (NER)  
+- Phone numbers    
 - AU identifiers (Medicare, TFN, ABN, etc.)
+- PII detected by local Model (OpenAI/privacy-filter)
 
 ### **3. LLM Call**
 The masked prompt is sent to the model.

package/dist/index.d.ts

@@ -1,6 +1,6 @@
-export { guard } from './middleware/middleware.js';
+export { guard, guardAction, guardMiddleware, guardPlugin } from './middleware/middleware.js';
 export * from './core/types.js';
 /**
  * Pre-load the model to avoid cold-start delay on first user request.
  */
-export declare function initGuard(): Promise<void>;
+export declare function initGuard(config?: any): Promise<void>;

package/dist/index.js

@@ -1,15 +1,42 @@
 import { ModelSingleton } from './util/singleton.js';
 // export { intentGuard, piiGuard  } from './middleware/middleware.js';
-export { guard } from './middleware/middleware.js';
+export { guard, guardAction, guardMiddleware, guardPlugin } from './middleware/middleware.js';
 export * from './core/types.js';
+function logGuardEvent(eventName, body, attributes = {}) {
+    console.log(JSON.stringify({
+        timestamp: new Date().toISOString(),
+        severityText: 'INFO',
+        severityNumber: 9,
+        body,
+        resource: {
+            attributes: {
+                'service.name': '@intflows/genkit-guard',
+            },
+        },
+        attributes: {
+            'event.name': eventName,
+            'code.namespace': 'genkit-guard',
+            ...attributes,
+        },
+    }));
+}
 /**
  * Pre-load the model to avoid cold-start delay on first user request.
  */
-export async function initGuard() {
-    console.log('[Guard] Loading local models...');
-    await Promise.all([
-        ModelSingleton.getExtractor(),
-        ModelSingleton.getNER()
-    ]);
-    console.log('[Guard] Models loaded');
+export async function initGuard(config) {
+    logGuardEvent('guard.models.loading', 'Loading local guard models');
+    const extractorModel = config?.models?.extractor ?? 'Xenova/all-MiniLM-L6-v2';
+    const piiModel = config?.pii?.model;
+    const piiMode = config?.pii?.mode ?? 'ner';
+    const tasks = [ModelSingleton.getExtractor(extractorModel)];
+    if (piiMode === 'ner') {
+        tasks.push(ModelSingleton.getNER(piiModel ?? 'Xenova/bert-base-NER'));
+    }
+    else {
+        tasks.push(ModelSingleton.getPIIClassifier(piiModel ?? 'openai/privacy-filter'));
+    }
+    await Promise.all(tasks);
+    logGuardEvent('guard.models.loaded', 'Local guard models loaded', {
+        piiMode,
+    });
 }

package/dist/middleware/middleware.d.ts

@@ -1 +1,380 @@
-export declare function guard(config: any): (req: any, next: any) => Promise<any>;
+import { z } from 'genkit';
+declare const guardConfigSchema: z.ZodObject<{
+    intent: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodString>;
+        allowedIntent: z.ZodOptional<z.ZodString>;
+        semantic: z.ZodObject<{
+            threshold: z.ZodOptional<z.ZodNumber>;
+            intents: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }>>;
+    pii: z.ZodOptional<z.ZodObject<{
+        reversible: z.ZodOptional<z.ZodBoolean>;
+        model: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+        serviceName: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }>>;
+    models: z.ZodOptional<z.ZodObject<{
+        extractor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        extractor?: string | undefined;
+    }, {
+        extractor?: string | undefined;
+    }>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    intent: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodString>;
+        allowedIntent: z.ZodOptional<z.ZodString>;
+        semantic: z.ZodObject<{
+            threshold: z.ZodOptional<z.ZodNumber>;
+            intents: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }>>;
+    pii: z.ZodOptional<z.ZodObject<{
+        reversible: z.ZodOptional<z.ZodBoolean>;
+        model: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+        serviceName: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }>>;
+    models: z.ZodOptional<z.ZodObject<{
+        extractor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        extractor?: string | undefined;
+    }, {
+        extractor?: string | undefined;
+    }>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    intent: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodString>;
+        allowedIntent: z.ZodOptional<z.ZodString>;
+        semantic: z.ZodObject<{
+            threshold: z.ZodOptional<z.ZodNumber>;
+            intents: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }>>;
+    pii: z.ZodOptional<z.ZodObject<{
+        reversible: z.ZodOptional<z.ZodBoolean>;
+        model: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+        serviceName: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }>>;
+    models: z.ZodOptional<z.ZodObject<{
+        extractor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        extractor?: string | undefined;
+    }, {
+        extractor?: string | undefined;
+    }>>;
+}, z.ZodTypeAny, "passthrough">>;
+type GuardConfig = z.infer<typeof guardConfigSchema>;
+export declare const guardMiddleware: import("genkit").GenerateMiddleware<z.ZodObject<{
+    intent: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodString>;
+        allowedIntent: z.ZodOptional<z.ZodString>;
+        semantic: z.ZodObject<{
+            threshold: z.ZodOptional<z.ZodNumber>;
+            intents: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }>>;
+    pii: z.ZodOptional<z.ZodObject<{
+        reversible: z.ZodOptional<z.ZodBoolean>;
+        model: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+        serviceName: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }>>;
+    models: z.ZodOptional<z.ZodObject<{
+        extractor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        extractor?: string | undefined;
+    }, {
+        extractor?: string | undefined;
+    }>>;
+}, "passthrough", z.ZodTypeAny, z.objectOutputType<{
+    intent: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodString>;
+        allowedIntent: z.ZodOptional<z.ZodString>;
+        semantic: z.ZodObject<{
+            threshold: z.ZodOptional<z.ZodNumber>;
+            intents: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }>>;
+    pii: z.ZodOptional<z.ZodObject<{
+        reversible: z.ZodOptional<z.ZodBoolean>;
+        model: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+        serviceName: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }>>;
+    models: z.ZodOptional<z.ZodObject<{
+        extractor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        extractor?: string | undefined;
+    }, {
+        extractor?: string | undefined;
+    }>>;
+}, z.ZodTypeAny, "passthrough">, z.objectInputType<{
+    intent: z.ZodOptional<z.ZodObject<{
+        mode: z.ZodOptional<z.ZodString>;
+        allowedIntent: z.ZodOptional<z.ZodString>;
+        semantic: z.ZodObject<{
+            threshold: z.ZodOptional<z.ZodNumber>;
+            intents: z.ZodRecord<z.ZodString, z.ZodString>;
+        }, "strip", z.ZodTypeAny, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }, {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        }>;
+    }, "strip", z.ZodTypeAny, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }, {
+        semantic: {
+            intents: Record<string, string>;
+            threshold?: number | undefined;
+        };
+        mode?: string | undefined;
+        allowedIntent?: string | undefined;
+    }>>;
+    pii: z.ZodOptional<z.ZodObject<{
+        reversible: z.ZodOptional<z.ZodBoolean>;
+        model: z.ZodOptional<z.ZodString>;
+        mode: z.ZodOptional<z.ZodEnum<["ner", "classifier"]>>;
+    }, "strip", z.ZodTypeAny, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }, {
+        mode?: "ner" | "classifier" | undefined;
+        reversible?: boolean | undefined;
+        model?: string | undefined;
+    }>>;
+    logging: z.ZodOptional<z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+        level: z.ZodOptional<z.ZodEnum<["debug", "info", "warn", "error"]>>;
+        serviceName: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }, {
+        enabled?: boolean | undefined;
+        level?: "debug" | "info" | "warn" | "error" | undefined;
+        serviceName?: string | undefined;
+    }>>;
+    models: z.ZodOptional<z.ZodObject<{
+        extractor: z.ZodOptional<z.ZodString>;
+    }, "strip", z.ZodTypeAny, {
+        extractor?: string | undefined;
+    }, {
+        extractor?: string | undefined;
+    }>>;
+}, z.ZodTypeAny, "passthrough">>, void>;
+export declare const guardPlugin: (pluginOptions: void) => import("@genkit-ai/ai").GenkitPluginV2;
+export declare function guard(config?: GuardConfig): (req: any, ctxOrNext: any, maybeNext?: any) => Promise<any>;
+export declare const guardAction: typeof guard;
+export {};

package/dist/middleware/middleware.js

@@ -1,113 +1,316 @@
+import { generateMiddleware, z } from 'genkit';
 import { analyzeIntentStructured, detectInjection } from '../intent/intentAnalyzer.js';
 import { detectPII } from '../pii/detector.js';
 import { PiiTokenizer } from '../pii/tokenizer.js';
+const GUARD_CONTEXT_KEY = '__genkitGuard';
+const guardConfigSchema = z.object({
+    intent: z.object({
+        mode: z.string().optional(),
+        allowedIntent: z.string().optional(),
+        semantic: z.object({
+            threshold: z.number().optional(),
+            intents: z.record(z.string(), z.string()),
+        }),
+    }).optional(),
+    pii: z.object({
+        reversible: z.boolean().optional(),
+        model: z.string().optional(),
+        mode: z.enum(['ner', 'classifier']).optional(),
+    }).optional(),
+    logging: z.object({
+        enabled: z.boolean().optional(),
+        level: z.enum(['debug', 'info', 'warn', 'error']).optional(),
+        serviceName: z.string().optional(),
+    }).optional(),
+    models: z.object({
+        extractor: z.string().optional(),
+    }).optional(),
+}).passthrough();
+export const guardMiddleware = generateMiddleware({
+    name: 'genkitGuard',
+    description: 'Blocks prompt injection and disallowed intent, masks PII before model calls, restores PII for tool calls, and audits tool PII access.',
+    configSchema: guardConfigSchema,
+}, ({ config }) => createGuardHooks(config));
+export const guardPlugin = guardMiddleware.plugin;
 export function guard(config) {
-    return async (req, next) => {
-        const input = req.prompt ||
-            req.messages?.[req.messages.length - 1]?.content?.[0]?.text ||
-            "";
-        // -------------------------
-        // 1. INTENT ANALYSIS
-        // -------------------------
-        const isInjection = await detectInjection(input);
-        if (isInjection) {
-            console.warn(`[Intent Guard] Prompt injection pattern detected in input`);
-            return block("Prompt injection detected", {
-                reason: "pattern_match"
-            });
+    const hooks = createGuardHooks(config);
+    const baseMiddleware = guardMiddleware(config);
+    const fnRunner = async (req, ctxOrNext, maybeNext) => {
+        if (typeof maybeNext === 'function') {
+            return hooks.model(req, ctxOrNext, maybeNext);
         }
-        console.log(`[Intent Guard] Analyzing intent for user's input`);
-        const intentResult = await analyzeIntentStructured(input, config.intent.semantic.intents, config.intent.semantic.threshold);
-        console.log(`[Intent Guard] Detected intent: ${intentResult.intent} (score: ${intentResult.score.toFixed(2)})`);
-        if (!intentResult.allowed) {
-            console.warn(`[Intent Guard] Intent "${intentResult.intent}" not allowed ${intentResult.allowed}`);
-            return block("Intent not allowed", {
+        return hooks.model(req, {}, async (modifiedReq) => ctxOrNext(modifiedReq || req));
+    };
+    const source = Object.assign({}, baseMiddleware, hooks);
+    for (const key of Object.keys(source)) {
+        if (key === 'name')
+            continue;
+        Object.defineProperty(fnRunner, key, {
+            value: source[key],
+            writable: true,
+            configurable: true,
+            enumerable: true,
+        });
+    }
+    return fnRunner;
+}
+export const guardAction = guard;
+function createGuardHooks(config) {
+    const logger = createLogger(config);
+    return {
+        model: async (req, ctx, next) => {
+            const input = getInputText(req);
+            logger('info', 'guard.model.start', 'Starting guard checks for model request');
+            const isInjection = await detectInjection(input);
+            if (isInjection) {
+                logger('warn', 'guard.intent.blocked', 'Prompt injection pattern detected', {
+                    reason: 'pattern_match',
+                });
+                return block('Prompt injection detected', {
+                    reason: 'pattern_match',
+                });
+            }
+            logger('info', 'guard.intent.analysis.start', 'Analyzing request intent');
+            const intentResult = await analyzeIntentStructured(input, config?.intent?.semantic?.intents ?? {}, config?.intent?.semantic?.threshold ?? 0.7);
+            logger('info', 'guard.intent.analysis.complete', 'Intent analysis completed', {
                 intent: intentResult.intent,
-                score: intentResult.score
+                score: roundScore(intentResult.score),
+                allowed: intentResult.allowed,
+            });
+            if (!intentResult.allowed) {
+                logger('warn', 'guard.intent.blocked', 'Intent not allowed', {
+                    intent: intentResult.intent,
+                    score: roundScore(intentResult.score),
+                });
+                return block('Intent not allowed', {
+                    intent: intentResult.intent,
+                    score: intentResult.score,
+                });
+            }
+            const textForPii = collectModelRequestText(req);
+            const piiResponse = await scanPII(textForPii, config);
+            const piiMatches = piiResponse?.matches || [];
+            const tokenizer = new PiiTokenizer();
+            const piiTypes = uniqueTypes(piiMatches);
+            maskModelRequest(req, tokenizer, piiMatches);
+            pushTokenizer(ctx, tokenizer);
+            logger(piiMatches.length > 0 ? 'warn' : 'info', 'guard.model.pii.masked', 'PII scan completed for model request', {
+                piiDetected: piiMatches.length > 0,
+                piiMatchCount: piiMatches.length,
+                piiTypes,
+                piiMode: config?.pii?.mode ?? 'ner',
+                classifierOutputPresent: Boolean(piiResponse.classifier),
+            });
+            req.metadata = {
+                ...req.metadata,
+                intent: intentResult.intent,
+                score: intentResult.score,
+                piiDetected: piiMatches.length > 0,
+                piiTypes,
+                maskedInput: getInputText(req),
+                piiModel: config?.pii?.model,
+                piiMode: config?.pii?.mode,
+                piiClassifierOutput: piiResponse.classifier,
+            };
+            const res = await next(req, ctx);
+            const unmaskedResponse = unmaskObject(res, [tokenizer]);
+            logger('info', 'guard.model.response.unmasked', 'Model response unmasked for downstream execution', {
+                piiTypes,
+            });
+            return unmaskedResponse;
+        },
+        tool: async (req, ctx, next) => {
+            const state = getGuardState(ctx);
+            const toolName = req?.toolRequest?.name;
+            if (req?.toolRequest && 'input' in req.toolRequest) {
+                req.toolRequest.input = unmaskObject(req.toolRequest.input, state.tokenizers);
+            }
+            const toolInputText = collectStrings(req?.toolRequest?.input).join('\n');
+            const piiResponse = await scanPII(toolInputText, config);
+            const piiMatches = piiResponse?.matches || [];
+            const piiTypes = uniqueTypes(piiMatches);
+            req.metadata = {
+                ...req.metadata,
+                piiDetected: piiMatches.length > 0,
+                piiTypes,
+                piiMatchCount: piiMatches.length,
+            };
+            logger(piiMatches.length > 0 ? 'warn' : 'info', 'guard.tool.pii.checked', 'Tool request PII scan completed', {
+                toolName,
+                piiDetected: piiMatches.length > 0,
+                piiMatchCount: piiMatches.length,
+                piiTypes,
             });
+            const res = await next(req, ctx);
+            const toolResponseText = collectStrings(res).join('\n');
+            if (toolResponseText) {
+                const responsePii = await scanPII(toolResponseText, config);
+                const responseMatches = responsePii?.matches || [];
+                logger(responseMatches.length > 0 ? 'warn' : 'info', 'guard.tool.response.pii.checked', 'Tool response PII scan completed', {
+                    toolName,
+                    piiDetected: responseMatches.length > 0,
+                    piiMatchCount: responseMatches.length,
+                    piiTypes: uniqueTypes(responseMatches),
+                });
+            }
+            return res;
+        },
+    };
+}
+function getInputText(req) {
+    if (typeof req.prompt === 'string') {
+        return req.prompt;
+    }
+    const lastMessage = req.messages?.[req.messages.length - 1];
+    const firstContent = lastMessage?.content?.[0];
+    if (typeof firstContent?.text === 'string') {
+        return firstContent.text;
+    }
+    if (typeof firstContent === 'string') {
+        return firstContent;
+    }
+    return collectStrings(lastMessage).join('\n');
+}
+function collectModelRequestText(req) {
+    return [
+        ...collectStrings(req?.prompt),
+        ...collectStrings(req?.messages),
+        ...collectStrings(req?.docs),
+    ].join('\n');
+}
+function maskModelRequest(req, tokenizer, matches) {
+    if (typeof req.prompt === 'string') {
+        req.prompt = tokenizer.mask(req.prompt, matches).maskedText;
+    }
+    if (req.messages) {
+        req.messages = transformStrings(req.messages, (value) => tokenizer.mask(value, matches).maskedText);
+    }
+    if (req.docs) {
+        req.docs = transformStrings(req.docs, (value) => tokenizer.mask(value, matches).maskedText);
+    }
+}
+function unmaskObject(obj, tokenizers) {
+    return transformStrings(obj, (value) => {
+        let result = value;
+        for (const tokenizer of tokenizers) {
+            result = tokenizer.unmask(result);
         }
-        // -------------------------
-        // 2. PII DETECTION + MASKING
-        // -------------------------
-        const piiMatches = await detectPII(input);
-        console.log(`[PII Guard] Detected PII: ${piiMatches.length} matches found`);
-        const tokenizer = new PiiTokenizer(); // <-- SINGLE INSTANCE
-        const piiResult = tokenizer.mask(input, piiMatches);
-        console.log(`[PII Guard] Masked PII: ${piiResult.piiTypes.length} types found`);
-        // Attach tokenizer so response can unmask
-        req.metadata = {
-            ...req.metadata,
-            piiTokenizer: tokenizer,
-            intent: intentResult.intent,
-            score: intentResult.score,
-            piiDetected: piiMatches.length > 0,
-            piiTypes: piiResult.piiTypes,
-            maskedInput: piiResult.maskedText
+        return result;
+    });
+}
+function transformStrings(obj, transform) {
+    if (typeof obj === 'string') {
+        return transform(obj);
+    }
+    if (Array.isArray(obj)) {
+        for (let i = 0; i < obj.length; i++) {
+            obj[i] = transformStrings(obj[i], transform);
+        }
+        return obj;
+    }
+    if (obj !== null && typeof obj === 'object') {
+        for (const key of Object.keys(obj)) {
+            obj[key] = transformStrings(obj[key], transform);
+        }
+        return obj;
+    }
+    return obj;
+}
+function collectStrings(obj) {
+    if (typeof obj === 'string') {
+        return [obj];
+    }
+    if (Array.isArray(obj)) {
+        return obj.flatMap(collectStrings);
+    }
+    if (obj !== null && typeof obj === 'object') {
+        return Object.values(obj).flatMap(collectStrings);
+    }
+    return [];
+}
+async function scanPII(text, config) {
+    if (!text.trim()) {
+        return {
+            matches: [],
+            classifier: undefined,
         };
-        // Replace input
-        req.prompt = piiResult.maskedText;
-        req.messages = [
-            {
-                role: 'user',
-                content: [{ text: piiResult.maskedText }],
+    }
+    return detectPII(text, {
+        model: config?.pii?.model,
+        mode: config?.pii?.mode,
+    });
+}
+function getGuardState(ctx = {}) {
+    ctx.context = ctx.context || {};
+    ctx.context[GUARD_CONTEXT_KEY] = ctx.context[GUARD_CONTEXT_KEY] || { tokenizers: [] };
+    return ctx.context[GUARD_CONTEXT_KEY];
+}
+function pushTokenizer(ctx, tokenizer) {
+    const state = getGuardState(ctx);
+    state.tokenizers.push(tokenizer);
+}
+function uniqueTypes(matches) {
+    return Array.from(new Set(matches.map((match) => match.type.toLowerCase())));
+}
+function roundScore(score) {
+    return Math.round(score * 10000) / 10000;
+}
+function createLogger(config) {
+    const enabled = config?.logging?.enabled ?? true;
+    const minimumLevel = config?.logging?.level ?? 'info';
+    const serviceName = config?.logging?.serviceName ?? '@intflows/genkit-guard';
+    const levelRank = {
+        debug: 10,
+        info: 20,
+        warn: 30,
+        error: 40,
+    };
+    const severityNumber = {
+        debug: 5,
+        info: 9,
+        warn: 13,
+        error: 17,
+    };
+    return (severity, eventName, body, attributes = {}) => {
+        if (!enabled || levelRank[severity] < levelRank[minimumLevel]) {
+            return;
+        }
+        const record = {
+            timestamp: new Date().toISOString(),
+            severityText: severity.toUpperCase(),
+            severityNumber: severityNumber[severity],
+            body,
+            resource: {
+                attributes: {
+                    'service.name': serviceName,
+                },
             },
-        ];
-        // -------------------------
-        // 3. LLM CALL
-        // -------------------------
-        const res = await next(req);
-        // -------------------------
-        // 4. RESPONSE UNMASK
-        // -------------------------
-        console.log(`[PII Guard] Unmasking response if needed`);
-        if (tokenizer) {
-            /**
-             * RECURSIVE TRANSFORMER
-             * This will find every string in the Genkit response (no matter if it's in
-             * candidates, message, custom, or output) and unmask it.
-             */
-            const transform = (obj) => {
-                // 1. If it's a string, unmask it
-                if (typeof obj === 'string') {
-                    return tokenizer.unmask(obj);
-                }
-                // 2. If it's an array, transform each element
-                if (Array.isArray(obj)) {
-                    return obj.map(transform);
-                }
-                // 3. If it's an object, transform each value
-                if (obj !== null && typeof obj === 'object') {
-                    // Note: We iterate keys and mutate the object directly 
-                    // to ensure Genkit's internal references are updated.
-                    for (const key of Object.keys(obj)) {
-                        obj[key] = transform(obj[key]);
-                    }
-                    return obj;
-                }
-                // 4. Return as-is for numbers/booleans/null
-                return obj;
-            };
-            // ----------------------------------------------------------------------
-            // 5. Transform the entire response object in-place to unmask all strings
-            // ----------------------------------------------------------------------      
-            transform(res);
-            console.log("[PII Guard] Deep unmasking complete across all candidates and custom fields.");
+            attributes: {
+                'event.name': eventName,
+                'code.namespace': 'genkit-guard',
+                ...attributes,
+            },
+        };
+        const line = JSON.stringify(record);
+        if (severity === 'error') {
+            console.error(line);
+        }
+        else if (severity === 'warn') {
+            console.warn(line);
+        }
+        else {
+            console.log(line);
         }
-        // ---------------------------------------------------------
-        // 6. Return the modified response with unmasked content
-        // ---------------------------------------------------------
-        return res;
     };
 }
-// Helper to create a blocked response
 function block(message, metadata) {
     return {
         finishReason: 'blocked',
         output: {
-            type: "error",
-            status: "BLOCKED",
-            message
+            type: 'error',
+            status: 'BLOCKED',
+            message,
         },
-        metadata
+        metadata,
     };
 }

package/dist/pii/detector.d.ts

@@ -1,4 +1,10 @@
-export declare function detectPII(text: string): Promise<{
-    type: string;
-    value: string;
-}[]>;
+export declare function detectPII(text: string, opts?: {
+    model?: string;
+    mode?: 'ner' | 'classifier';
+}): Promise<{
+    matches: {
+        type: string;
+        value: string;
+    }[];
+    classifier: any;
+}>;

package/dist/pii/detector.js

@@ -15,20 +15,33 @@ const REGEX_RULES = [
     // CREDIT CARD (keep your existing one if needed)
     { type: 'CREDIT_CARD', pattern: /\b(?:\d[ -]*?){13,16}\b/g }
 ];
-export async function detectPII(text) {
-    const ner = await ModelSingleton.getNER();
+export async function detectPII(text, opts) {
+    const mode = opts?.mode ?? 'ner';
+    const model = opts?.model;
     const results = [];
-    // ---- NER ----
-    const entities = await ner(text);
-    for (const e of entities) {
-        if (e.entity.includes('PER')) {
-            results.push({ type: 'NAME', value: e.word.replace('##', '') });
-        }
-    }
-    // ---- REGEX ----
+    // ---- REGEX (always run) ----
     for (const rule of REGEX_RULES) {
         const matches = text.match(rule.pattern) || [];
         matches.forEach(m => results.push({ type: rule.type, value: m }));
     }
-    return results;
+    // ---- NER ----
+    let classifierOutput = undefined;
+    if (mode === 'ner') {
+        const ner = await ModelSingleton.getNER(model);
+        const entities = await ner(text);
+        for (const e of entities) {
+            if (e.entity && e.entity.includes('PER')) {
+                results.push({ type: 'NAME', value: (e.word || '').replace(/##/g, '') });
+            }
+        }
+    }
+    else {
+        // classifier mode: we call the classifier and return its output alongside regex matches.
+        const cls = await ModelSingleton.getPIIClassifier(model);
+        classifierOutput = await cls(text);
+    }
+    return {
+        matches: results,
+        classifier: classifierOutput
+    };
 }

package/dist/pii/tokenizer.d.ts

@@ -5,6 +5,7 @@ export type PiiResult = {
 };
 export declare class PiiTokenizer {
     private vault;
+    private valueToToken;
     private counter;
     private piiTypes;
     private createToken;

package/dist/pii/tokenizer.js

@@ -1,5 +1,6 @@
 export class PiiTokenizer {
     vault = new Map();
+    valueToToken = new Map();
     counter = 0;
     piiTypes = new Set();
     createToken(type) {
@@ -8,8 +9,16 @@ export class PiiTokenizer {
     mask(text, matches) {
         let masked = text;
         for (const match of matches) {
-            const token = this.createToken(match.type);
-            this.vault.set(token, match.value);
+            if (!masked.includes(match.value)) {
+                continue;
+            }
+            const key = `${match.type}:${match.value}`;
+            let token = this.valueToToken.get(key);
+            if (!token) {
+                token = this.createToken(match.type);
+                this.valueToToken.set(key, token);
+                this.vault.set(token, match.value);
+            }
             this.piiTypes.add(match.type.toLowerCase());
             masked = masked.split(match.value).join(token);
         }

package/dist/util/singleton.d.ts

@@ -1,7 +1,14 @@
 export declare class ModelSingleton {
-    private static extractor;
-    private static classifier;
+    private static extractors;
+    private static nerClassifiers;
+    private static textClassifiers;
     static init(): void;
-    static getExtractor(): Promise<any>;
-    static getNER(): Promise<any>;
+    static getExtractor(modelName?: string): Promise<any>;
+    static getNER(modelName?: string): Promise<any>;
+    static getPIIClassifier(modelName?: string): Promise<any>;
+    static preload(models?: {
+        extractor?: string;
+        ner?: string;
+        pii?: string;
+    }): Promise<void>;
 }

package/dist/util/singleton.js

@@ -6,8 +6,9 @@ const __dirname = path.dirname(fileURLToPath(import.meta.url));
 env.allowRemoteModels = false;
 env.localModelPath = path.join(__dirname, '../../models');
 export class ModelSingleton {
-    static extractor = null;
-    static classifier = null;
+    static extractors = new Map();
+    static nerClassifiers = new Map();
+    static textClassifiers = new Map();
     static init() {
         // Always resolve model path relative to the client app, not the library
         const projectRoot = process.cwd();
@@ -20,21 +21,55 @@ export class ModelSingleton {
         env.localModelPath = modelPath;
         // Allow remote download if missing
         env.allowRemoteModels = true;
-        console.log("[Guard] Using model directory:", modelPath);
+        console.log(JSON.stringify({
+            timestamp: new Date().toISOString(),
+            severityText: 'INFO',
+            severityNumber: 9,
+            body: 'Using guard model directory',
+            resource: {
+                attributes: {
+                    'service.name': '@intflows/genkit-guard',
+                },
+            },
+            attributes: {
+                'event.name': 'guard.models.directory',
+                'code.namespace': 'genkit-guard',
+                modelPath,
+            },
+        }));
     }
-    static async getExtractor() {
-        if (!this.extractor) {
+    static async getExtractor(modelName = 'Xenova/all-MiniLM-L6-v2') {
+        if (!this.extractors.has(modelName)) {
             this.init();
-            this.extractor = await pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2');
+            const inst = await pipeline('feature-extraction', modelName);
+            this.extractors.set(modelName, inst);
         }
-        return this.extractor;
+        return this.extractors.get(modelName);
     }
-    static async getNER() {
-        if (!this.classifier) {
+    static async getNER(modelName = 'Xenova/bert-base-NER') {
+        if (!this.nerClassifiers.has(modelName)) {
             this.init();
-            // Token classification model for identifying sensitive entities
-            this.classifier = await pipeline('token-classification', 'Xenova/bert-base-NER');
+            const inst = await pipeline('token-classification', modelName);
+            this.nerClassifiers.set(modelName, inst);
         }
-        return this.classifier;
+        return this.nerClassifiers.get(modelName);
+    }
+    static async getPIIClassifier(modelName = 'openai/privacy-filter') {
+        if (!this.textClassifiers.has(modelName)) {
+            this.init();
+            const inst = await pipeline('text-classification', modelName);
+            this.textClassifiers.set(modelName, inst);
+        }
+        return this.textClassifiers.get(modelName);
+    }
+    static async preload(models) {
+        const tasks = [];
+        if (models?.extractor)
+            tasks.push(this.getExtractor(models.extractor));
+        if (models?.ner)
+            tasks.push(this.getNER(models.ner));
+        if (models?.pii)
+            tasks.push(this.getPIIClassifier(models.pii));
+        await Promise.all(tasks);
     }
 }

package/package.json

@@ -4,6 +4,10 @@
   "maintainers": [
     "Hemant Kohli"
   ],
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/IntFlows/genkit-guard"
+  },
   "keywords": [
     "genkit",
     "genkit-guard",
@@ -18,7 +22,7 @@
     "huggingface"
   ],
   "license": "Apache-2.0",
-  "version": "0.0.8",
+  "version": "0.0.9-alpha.1",
   "type": "module",
   "exports": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -33,15 +37,16 @@
     "build": "tsc",
     "prepublishOnly": "npm run build"
   },
-  "peerDependencies": {
-    "genkit": ">=0.5.0"
-  },
   "dependencies": {
-    "@huggingface/transformers": "^3.0.0",
-    "zod": "^3.23.0"
+    "@huggingface/transformers": "^4.2.0",
+    "zod": "^4.4.3"
+  },
+  "peerDependencies": {
+    "genkit": "1.39.0"
   },
   "devDependencies": {
-    "typescript": "^5.6.0",
-    "@types/node": "^20.0.0"
+    "@types/node": "^25.8.0",
+    "genkit": "^1.39.0",
+    "typescript": "^6.0.3"
   }
 }

package/scripts/download-model.js

@@ -13,9 +13,14 @@ async function download() {
   await pipeline('feature-extraction', 'Xenova/all-MiniLM-L6-v2', {
     device: 'cpu'
   });
-  console.log('Downloading BERT-NER to ./models...');
-  await pipeline('token-classification', 'Xenova/bert-base-NER', {
-    device: 'cpu'
+  //console.log('Downloading BERT-NER to ./models...');
+  // await pipeline('token-classification', 'Xenova/bert-base-NER', {
+  //   device: 'cpu'
+  // });
+  
+  console.log('Downloading openai/privacy-filter to ./models...');
+  await pipeline('token-classification', 'openai/privacy-filter', {
+    device: 'cpu', dtype: "q4"
   });
   console.log('Model downloaded successfully.');
 }