@neuraltrust/trustguard-sdk 0.1.4 → 0.1.6

package/README.md

@@ -33,7 +33,8 @@ if (response.isBlocked) {
 
 ```typescript
 const response = await client.guard({
-  payload: { input: "user text" },
+  // A model response goes in an assistant message; `{ input }` is read as the user's text.
+  payload: { messages: [{ role: "assistant", content: "model response" }] },
   direction: "output",                // "input" (default) or "output"
   protocol: "llm",                    // "all" (default), "llm", "mcp", or "a2a"
   sessionId: "conversation-42",       // groups multi-turn traffic
@@ -78,6 +79,55 @@ try {
 }
 ```
 
+## Vercel AI SDK
+
+`@neuraltrust/trustguard-sdk/ai-sdk` guards an [AI SDK](https://ai-sdk.dev) agent end to end: the prompt, the response, every tool call and every tool result. It needs `ai` 7 or later, which stays an optional peer dependency: the main entry point never loads it.
+
+```typescript
+import { streamText, wrapLanguageModel } from "ai";
+import { openai } from "@ai-sdk/openai";
+import { TrustGuard } from "@neuraltrust/trustguard-sdk";
+import { trustguard } from "@neuraltrust/trustguard-sdk/ai-sdk";
+
+const client = new TrustGuard({ baseUrl: process.env.TRUSTGUARD_BASE_URL!, apiKey: process.env.TRUSTGUARD_API_KEY! });
+
+// One instance per request, so every evaluation carries the user and the conversation.
+const tg = trustguard(client, { consumerId: user.id, sessionId: chatId });
+
+const result = streamText({
+  model: wrapLanguageModel({ model: openai("gpt-5.2"), middleware: tg.middleware }),
+  tools: tg.tools(tools),
+  toolApproval: tg.toolApproval,
+  experimental_toolApprovalSecret: process.env.TOOL_APPROVAL_SECRET, // signs approval requests
+  messages,
+});
+```
+
+| Piece | Guards | Block | Transform | Ask |
+|---|---|---|---|---|
+| `middleware` | The user turn, before the model call | Throws `TrustGuardBlockedError` | Sends the masked text | Blocks, or passes with `promptAsk: "allow"` |
+| `middleware` | The response | Replaces it with `blockedMessage` | Replaces it with the masked text | Not evaluated on output |
+| `toolApproval` | Each tool call, before it runs | Denied, with the policy as the reason | Denied: approval cannot rewrite the arguments | `user-approval`, or denied with `toolAsk: "deny"` |
+| `tools()` | Each tool result, before the model reads it | The tool fails with `TrustGuardBlockedError`, which the model sees as a tool error | Returns the masked result | Not evaluated on output |
+
+Steps that continue a tool loop are not evaluated as prompts again: the tool results in them are covered by `tools()`. Wrap MCP tools the same way: `tg.tools(await mcpClient.tools())`.
+
+A complete Next.js app, with approvals and a live verdict panel, is in [`examples/ai-sdk`](../examples/ai-sdk).
+
+**Streaming.** By default a streamed response is monitored: text streams untouched and is evaluated when the response finishes, so findings reach **Activity** but nothing is enforced. `stream: "buffer"` holds each text block until it ends, evaluates it, then releases it, masked or replaced. That enforces the policy and gives up streaming.
+
+**Failures.** With the default `failMode: "closed"`, an evaluation error throws on the prompt and the response, and denies the tool call. `failMode: "open"` lets the traffic through. `onError` sees every error either way, and `onVerdict` every verdict.
+
+**Not evaluated.** The system prompt, which your code writes. Files in the user turn, such as images and PDFs: only their text parts are sent. Reasoning parts of the response, which pass through unchanged.
+
+**Approvals.** The answer to an approval request comes back in the message history the browser sends. Set the AI SDK's `experimental_toolApprovalSecret` so it signs each request and a client cannot forge an approval. When the answer arrives, the AI SDK calls `toolApproval` again: a call the policy now blocks stays denied even after the user allowed it.
+
+**Composing approvals.** `toolApproval` returns `undefined` when TrustGuard lets a call through, so your own rules can follow it:
+
+```typescript
+toolApproval: async (options) => (await tg.toolApproval(options)) ?? myApproval(options),
+```
+
 ## Documentation
 
 The full guide is at [docs.neuraltrust.ai](https://docs.neuraltrust.ai/sdks/trustguard/node): setting up the collector

package/dist/ai-sdk/index.cjs

@@ -0,0 +1,373 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/ai-sdk/index.ts
+var ai_sdk_exports = {};
+__export(ai_sdk_exports, {
+  TrustGuardBlockedError: () => TrustGuardBlockedError,
+  trustguard: () => trustguard
+});
+module.exports = __toCommonJS(ai_sdk_exports);
+
+// src/ai-sdk/trustguard.ts
+var TrustGuardBlockedError = class extends Error {
+  phase;
+  response;
+  constructor(phase, response, message) {
+    super(message);
+    this.name = "TrustGuardBlockedError";
+    this.phase = phase;
+    this.response = response;
+  }
+};
+var SOURCE_APPLICATION = "vercel-ai-sdk";
+var DEFAULT_BLOCKED_MESSAGE = "This response was blocked by policy.";
+function trustguard(client, options = {}) {
+  const guard = new Guard(client, options);
+  return {
+    middleware: guard.middleware(),
+    toolApproval: (approval) => guard.approveToolCall(approval.toolCall),
+    tools: (tools) => guard.wrapTools(tools)
+  };
+}
+var Guard = class {
+  #client;
+  #options;
+  constructor(client, options) {
+    this.#client = client;
+    this.#options = options;
+  }
+  middleware() {
+    return {
+      specificationVersion: "v4",
+      transformParams: async ({ params, model }) => this.#guardPrompt(params, model),
+      wrapGenerate: async ({ doGenerate, model }) => {
+        const result = await doGenerate();
+        return { ...result, content: await this.#guardContent(result.content, model) };
+      },
+      wrapStream: async ({ doStream, model }) => {
+        const result = await doStream();
+        const transform = this.#options.stream === "buffer" ? this.#bufferStream(model) : this.#monitorStream(model);
+        return { ...result, stream: result.stream.pipeThrough(transform) };
+      }
+    };
+  }
+  async approveToolCall(call) {
+    let response;
+    try {
+      response = await this.#evaluate("tool-call", {
+        payload: toolsCall(call.toolName, call.input),
+        direction: "input",
+        protocol: "mcp",
+        attributes: { tool: { name: call.toolName } }
+      });
+    } catch (error) {
+      if (this.#failOpen("tool-call", error)) return void 0;
+      return { type: "denied", reason: "TrustGuard could not evaluate this tool call." };
+    }
+    switch (response.status) {
+      case "block":
+        return { type: "denied", reason: reasonFor(response, "Blocked by TrustGuard") };
+      case "ask":
+        return this.#options.toolAsk === "deny" ? { type: "denied", reason: reasonFor(response, "TrustGuard requires approval") } : { type: "user-approval", reason: reasonFor(response, "TrustGuard requires approval") };
+      case "transform":
+        return {
+          type: "denied",
+          reason: reasonFor(response, "Blocked by TrustGuard because the arguments contain data the policy masks")
+        };
+      default:
+        return void 0;
+    }
+  }
+  wrapTools(tools) {
+    const wrapped = {};
+    for (const [name, tool] of Object.entries(tools)) {
+      const execute = tool.execute;
+      if (typeof execute !== "function") {
+        wrapped[name] = tool;
+        continue;
+      }
+      wrapped[name] = {
+        ...tool,
+        execute: (input, executeOptions) => {
+          const output = execute.call(tool, input, executeOptions);
+          return isAsyncIterable(output) ? this.#guardIterableResult(name, output) : Promise.resolve(output).then((value) => this.#guardResult(name, value));
+        }
+      };
+    }
+    return wrapped;
+  }
+  async #guardPrompt(params, model) {
+    const index = lastUserTurn(params.prompt);
+    if (index < 0) return params;
+    const message = params.prompt[index];
+    const text = joinText(message.content);
+    if (!text.trim()) return params;
+    let response;
+    try {
+      response = await this.#evaluate("input", {
+        payload: { input: text },
+        direction: "input",
+        protocol: "llm",
+        attributes: modelAttributes(model)
+      });
+    } catch (error) {
+      if (this.#failOpen("input", error)) return params;
+      throw error;
+    }
+    const status = response.status === "ask" && this.#options.promptAsk !== "allow" ? "block" : response.status;
+    if (status === "block") {
+      throw new TrustGuardBlockedError("input", response, reasonFor(response, "Prompt blocked by TrustGuard"));
+    }
+    if (status !== "transform") return params;
+    const masked = transformedText(response, sentInput);
+    if (masked === void 0) {
+      throw new TrustGuardBlockedError(
+        "input",
+        response,
+        "Prompt blocked by TrustGuard: the policy masked it but returned no masked text"
+      );
+    }
+    const prompt = [...params.prompt];
+    prompt[index] = { ...message, content: replaceText(message.content, masked) };
+    return { ...params, prompt };
+  }
+  async #guardContent(content, model) {
+    const text = joinText(content);
+    if (!text.trim()) return content;
+    const replacement = await this.#outputReplacement(text, model);
+    return replacement === void 0 ? content : replaceText(content, replacement);
+  }
+  /** The text that must replace a response, or undefined when it can go out as is. Throws when failing closed. */
+  async #outputReplacement(text, model) {
+    let response;
+    try {
+      response = await this.#evaluate("output", {
+        payload: assistantTurn(text),
+        direction: "output",
+        protocol: "llm",
+        attributes: modelAttributes(model)
+      });
+    } catch (error) {
+      if (this.#failOpen("output", error)) return void 0;
+      throw error;
+    }
+    if (response.status === "block") return this.#blockedMessage();
+    if (response.status === "transform") return transformedText(response, sentAssistant) ?? this.#blockedMessage();
+    return void 0;
+  }
+  #monitorStream(model) {
+    let text = "";
+    const evaluate = async () => {
+      if (!text.trim()) return;
+      try {
+        await this.#evaluate("output", {
+          payload: assistantTurn(text),
+          direction: "output",
+          protocol: "llm",
+          attributes: modelAttributes(model)
+        });
+      } catch (error) {
+        this.#options.onError?.({ phase: "output", error });
+      }
+    };
+    return new TransformStream({
+      transform(part, controller) {
+        if (part.type === "text-delta") text += part.delta;
+        controller.enqueue(part);
+      },
+      // The stream does not close until this resolves, so a serverless function stays alive until the evaluation is sent.
+      async flush() {
+        await evaluate();
+      }
+    });
+  }
+  #bufferStream(model) {
+    const open = /* @__PURE__ */ new Map();
+    const release = async (id, end, controller) => {
+      const parts = open.get(id) ?? [];
+      open.delete(id);
+      const text = parts.map((p) => p.type === "text-delta" ? p.delta : "").join("");
+      const replacement = text.trim() ? await this.#outputReplacement(text, model) : void 0;
+      if (replacement === void 0) {
+        for (const p of parts) controller.enqueue(p);
+      } else {
+        for (const p of parts) if (p.type !== "text-delta") controller.enqueue(p);
+        controller.enqueue({ type: "text-delta", id, delta: replacement });
+      }
+      if (end) controller.enqueue(end);
+    };
+    return new TransformStream({
+      async transform(part, controller) {
+        switch (part.type) {
+          case "text-start":
+            open.set(part.id, [part]);
+            return;
+          case "text-delta": {
+            const parts = open.get(part.id);
+            if (parts) parts.push(part);
+            else controller.enqueue(part);
+            return;
+          }
+          case "text-end":
+            if (open.has(part.id)) await release(part.id, part, controller);
+            else controller.enqueue(part);
+            return;
+          default:
+            controller.enqueue(part);
+        }
+      },
+      async flush(controller) {
+        for (const id of [...open.keys()]) await release(id, void 0, controller);
+      }
+    });
+  }
+  async #guardResult(toolName, output) {
+    const text = typeof output === "string" ? output : JSON.stringify(output);
+    if (text === void 0 || !text.trim()) return output;
+    let response;
+    try {
+      response = await this.#evaluate("tool-result", {
+        payload: toolsResult(text),
+        direction: "output",
+        protocol: "mcp",
+        attributes: { tool: { name: toolName } }
+      });
+    } catch (error) {
+      if (this.#failOpen("tool-result", error)) return output;
+      throw error;
+    }
+    if (response.status === "block") {
+      throw new TrustGuardBlockedError(
+        "tool-result",
+        response,
+        reasonFor(response, `TrustGuard withheld the result of ${toolName}`)
+      );
+    }
+    if (response.status !== "transform") return output;
+    const masked = transformedText(response, sentToolResult);
+    if (masked === void 0) {
+      throw new TrustGuardBlockedError(
+        "tool-result",
+        response,
+        `TrustGuard withheld the result of ${toolName}: the policy masked it but returned no masked text`
+      );
+    }
+    if (typeof output === "string") return masked;
+    try {
+      return JSON.parse(masked);
+    } catch {
+      return masked;
+    }
+  }
+  async *#guardIterableResult(toolName, output) {
+    let last;
+    let seen = false;
+    for await (const value of output) {
+      last = value;
+      seen = true;
+      yield value;
+    }
+    if (!seen) return;
+    const guarded = await this.#guardResult(toolName, last);
+    if (guarded !== last) yield guarded;
+  }
+  async #evaluate(phase, request) {
+    const response = await this.#client.guard({
+      ...request,
+      sessionId: this.#options.sessionId,
+      consumerId: this.#options.consumerId,
+      attributes: {
+        ...this.#options.attributes,
+        ...request.attributes,
+        source: { application: SOURCE_APPLICATION }
+      }
+    });
+    this.#options.onVerdict?.({ phase, response });
+    return response;
+  }
+  #failOpen(phase, error) {
+    this.#options.onError?.({ phase, error });
+    return this.#options.failMode === "open";
+  }
+  #blockedMessage() {
+    return this.#options.blockedMessage ?? DEFAULT_BLOCKED_MESSAGE;
+  }
+};
+function lastUserTurn(prompt) {
+  const last = prompt.length - 1;
+  return last >= 0 && prompt[last]?.role === "user" ? last : -1;
+}
+function joinText(parts) {
+  return parts.filter((p) => p.type === "text" && typeof p.text === "string").map((p) => p.text).join("\n");
+}
+function replaceText(parts, text) {
+  let placed = false;
+  const out = [];
+  for (const part of parts) {
+    if (part.type !== "text") {
+      out.push(part);
+    } else if (!placed) {
+      out.push({ ...part, text });
+      placed = true;
+    }
+  }
+  return out;
+}
+function transformedText(response, at) {
+  const payload = response.transformedPayload;
+  const text = payload ? at(payload) : void 0;
+  return typeof text === "string" ? text : void 0;
+}
+var sentInput = (payload) => payload.input;
+var sentAssistant = (payload) => firstItem(payload.messages)?.content;
+var sentToolResult = (payload) => firstItem(asRecord(payload.result)?.content)?.text;
+function firstItem(value) {
+  return Array.isArray(value) ? asRecord(value[0]) : void 0;
+}
+function asRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value) ? value : void 0;
+}
+function assistantTurn(text) {
+  return { messages: [{ role: "assistant", content: text }] };
+}
+function toolsResult(text) {
+  return { jsonrpc: "2.0", id: 1, result: { content: [{ type: "text", text }] } };
+}
+function toolsCall(name, input) {
+  const args = input !== null && typeof input === "object" && !Array.isArray(input) ? input : { input };
+  return { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } };
+}
+function modelAttributes(model) {
+  return { model: { name: model.modelId, provider: model.provider } };
+}
+function reasonFor(response, reason) {
+  const finding = response.findings.find((f) => f.outcome?.action === response.status) ?? response.findings.find((f) => f.outcome);
+  const name = finding?.source.gateName || finding?.source.detectorName || finding?.signal?.type;
+  return name ? `${reason}: ${name}` : reason;
+}
+function isAsyncIterable(value) {
+  return value !== null && typeof value === "object" && Symbol.asyncIterator in value;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  TrustGuardBlockedError,
+  trustguard
+});
+//# sourceMappingURL=index.cjs.map

package/dist/ai-sdk/index.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/ai-sdk/index.ts","../../src/ai-sdk/trustguard.ts"],"sourcesContent":["export { trustguard, TrustGuardBlockedError } from \"./trustguard.js\";\nexport type { ApprovalToolCall, GuardPhase, TrustGuardAISDK, TrustGuardAISDKOptions } from \"./trustguard.js\";\n","import type {\n  LanguageModelV4,\n  LanguageModelV4CallOptions,\n  LanguageModelV4Content,\n  LanguageModelV4Middleware,\n  LanguageModelV4Prompt,\n  LanguageModelV4StreamPart,\n} from \"@ai-sdk/provider\";\nimport type { ToolApprovalStatus, ToolSet } from \"ai\";\n\nimport type { TrustGuard } from \"../client.js\";\nimport type { GuardRequest, GuardResponse } from \"../types.js\";\n\n/** Where in the agent loop an evaluation ran. */\nexport type GuardPhase = \"input\" | \"output\" | \"tool-call\" | \"tool-result\";\n\n/** Options for {@link trustguard}. Create one instance per request so every evaluation carries the right user. */\nexport interface TrustGuardAISDKOptions {\n  /** The end user the request runs for. Findings are grouped under it and gates match it as `consumer.id`. */\n  consumerId?: string;\n  /** The conversation key. Without it TrustGuard synthesises one per evaluation and turns lose their grouping. */\n  sessionId?: string;\n  /** Extra attributes merged into every evaluation, for gates and rule conditions. */\n  attributes?: Record<string, unknown>;\n  /**\n   * How streamed responses are guarded.\n   * - `\"monitor\"` (default): text streams untouched and is evaluated when the response finishes. Findings are recorded, nothing is enforced.\n   * - `\"buffer\"`: each text block is held until it ends, evaluated, then released, redacted or replaced. Enforces the policy at the cost of streaming.\n   */\n  stream?: \"monitor\" | \"buffer\";\n  /** What an `ask` verdict on the prompt does. The model call has no one to ask, so the default is `\"block\"`. */\n  promptAsk?: \"block\" | \"allow\";\n  /** What an `ask` verdict on a tool call does. The default, `\"user-approval\"`, asks the user through the AI SDK approval flow. */\n  toolAsk?: \"user-approval\" | \"deny\";\n  /** Text that replaces a response the policy blocked. */\n  blockedMessage?: string;\n  /**\n   * What happens when TrustGuard cannot be reached or returns an error.\n   * `\"closed\"` (default) throws on the prompt and the response and denies the tool call. `\"open\"` lets the traffic through.\n   * Monitor-mode stream evaluations never fail the stream.\n   */\n  failMode?: \"closed\" | \"open\";\n  /** Called with every verdict, for logging. */\n  onVerdict?: (event: { phase: GuardPhase; response: GuardResponse }) => void;\n  /** Called with every evaluation error, including the ones `failMode: \"open\"` swallows. */\n  onError?: (event: { phase: GuardPhase; error: unknown }) => void;\n}\n\n/** Thrown when the policy blocks the prompt or the response, and by guarded tools whose result was withheld. */\nexport class TrustGuardBlockedError extends Error {\n  readonly phase: GuardPhase;\n  readonly response: GuardResponse;\n\n  constructor(phase: GuardPhase, response: GuardResponse, message: string) {\n    super(message);\n    this.name = \"TrustGuardBlockedError\";\n    this.phase = phase;\n    this.response = response;\n  }\n}\n\n/** The tool call the approval function receives. Structural, so it matches static and dynamic tool calls alike. */\nexport interface ApprovalToolCall {\n  toolName: string;\n  toolCallId: string;\n  input: unknown;\n}\n\nexport interface TrustGuardAISDK {\n  /** Language model middleware for `wrapLanguageModel`: guards the prompt and the response. */\n  middleware: LanguageModelV4Middleware;\n  /** A `toolApproval` function for `generateText` / `streamText`: guards each tool call before it runs. */\n  toolApproval: (options: { toolCall: ApprovalToolCall }) => Promise<ToolApprovalStatus>;\n  /** Wraps a tool set so every result is evaluated before the model reads it. */\n  tools: <TOOLS extends ToolSet>(tools: TOOLS) => TOOLS;\n}\n\nconst SOURCE_APPLICATION = \"vercel-ai-sdk\";\nconst DEFAULT_BLOCKED_MESSAGE = \"This response was blocked by policy.\";\n\n/**\n * Connects a TrustGuard client to the Vercel AI SDK.\n *\n * ```ts\n * const tg = trustguard(client, { consumerId: user.id, sessionId: chatId });\n * streamText({\n *   model: wrapLanguageModel({ model, middleware: tg.middleware }),\n *   tools: tg.tools(tools),\n *   toolApproval: tg.toolApproval,\n *   messages,\n * });\n * ```\n */\nexport function trustguard(client: TrustGuard, options: TrustGuardAISDKOptions = {}): TrustGuardAISDK {\n  const guard = new Guard(client, options);\n  return {\n    middleware: guard.middleware(),\n    toolApproval: (approval) => guard.approveToolCall(approval.toolCall),\n    tools: (tools) => guard.wrapTools(tools),\n  };\n}\n\nclass Guard {\n  readonly #client: TrustGuard;\n  readonly #options: TrustGuardAISDKOptions;\n\n  constructor(client: TrustGuard, options: TrustGuardAISDKOptions) {\n    this.#client = client;\n    this.#options = options;\n  }\n\n  middleware(): LanguageModelV4Middleware {\n    return {\n      specificationVersion: \"v4\",\n      transformParams: async ({ params, model }) => this.#guardPrompt(params, model),\n      wrapGenerate: async ({ doGenerate, model }) => {\n        const result = await doGenerate();\n        return { ...result, content: await this.#guardContent(result.content, model) };\n      },\n      wrapStream: async ({ doStream, model }) => {\n        const result = await doStream();\n        const transform =\n          this.#options.stream === \"buffer\" ? this.#bufferStream(model) : this.#monitorStream(model);\n        return { ...result, stream: result.stream.pipeThrough(transform) };\n      },\n    };\n  }\n\n  async approveToolCall(call: ApprovalToolCall): Promise<ToolApprovalStatus> {\n    let response: GuardResponse | undefined;\n    try {\n      response = await this.#evaluate(\"tool-call\", {\n        payload: toolsCall(call.toolName, call.input),\n        direction: \"input\",\n        protocol: \"mcp\",\n        attributes: { tool: { name: call.toolName } },\n      });\n    } catch (error) {\n      if (this.#failOpen(\"tool-call\", error)) return undefined;\n      return { type: \"denied\", reason: \"TrustGuard could not evaluate this tool call.\" };\n    }\n\n    switch (response.status) {\n      case \"block\":\n        return { type: \"denied\", reason: reasonFor(response, \"Blocked by TrustGuard\") };\n      case \"ask\":\n        return this.#options.toolAsk === \"deny\"\n          ? { type: \"denied\", reason: reasonFor(response, \"TrustGuard requires approval\") }\n          : { type: \"user-approval\", reason: reasonFor(response, \"TrustGuard requires approval\") };\n      case \"transform\":\n        // Approval cannot rewrite the arguments, and running the call unredacted would leak what the policy masks.\n        return {\n          type: \"denied\",\n          reason: reasonFor(response, \"Blocked by TrustGuard because the arguments contain data the policy masks\"),\n        };\n      default:\n        return undefined;\n    }\n  }\n\n  wrapTools<TOOLS extends ToolSet>(tools: TOOLS): TOOLS {\n    const wrapped: Record<string, unknown> = {};\n    for (const [name, tool] of Object.entries(tools)) {\n      const execute = tool.execute as ((input: unknown, options: unknown) => unknown) | undefined;\n      if (typeof execute !== \"function\") {\n        wrapped[name] = tool;\n        continue;\n      }\n      wrapped[name] = {\n        ...tool,\n        execute: (input: unknown, executeOptions: unknown) => {\n          const output = execute.call(tool, input, executeOptions);\n          return isAsyncIterable(output)\n            ? this.#guardIterableResult(name, output)\n            : Promise.resolve(output).then((value) => this.#guardResult(name, value));\n        },\n      };\n    }\n    return wrapped as TOOLS;\n  }\n\n  async #guardPrompt(params: LanguageModelV4CallOptions, model: LanguageModelV4): Promise<LanguageModelV4CallOptions> {\n    const index = lastUserTurn(params.prompt);\n    if (index < 0) return params;\n    const message = params.prompt[index] as Extract<LanguageModelV4Prompt[number], { role: \"user\" }>;\n    const text = joinText(message.content);\n    if (!text.trim()) return params;\n\n    let response: GuardResponse;\n    try {\n      response = await this.#evaluate(\"input\", {\n        payload: { input: text },\n        direction: \"input\",\n        protocol: \"llm\",\n        attributes: modelAttributes(model),\n      });\n    } catch (error) {\n      if (this.#failOpen(\"input\", error)) return params;\n      throw error;\n    }\n\n    const status = response.status === \"ask\" && this.#options.promptAsk !== \"allow\" ? \"block\" : response.status;\n    if (status === \"block\") {\n      throw new TrustGuardBlockedError(\"input\", response, reasonFor(response, \"Prompt blocked by TrustGuard\"));\n    }\n    if (status !== \"transform\") return params;\n\n    const masked = transformedText(response, sentInput);\n    if (masked === undefined) {\n      throw new TrustGuardBlockedError(\n        \"input\",\n        response,\n        \"Prompt blocked by TrustGuard: the policy masked it but returned no masked text\",\n      );\n    }\n    const prompt = [...params.prompt];\n    prompt[index] = { ...message, content: replaceText(message.content, masked) };\n    return { ...params, prompt };\n  }\n\n  async #guardContent(content: LanguageModelV4Content[], model: LanguageModelV4): Promise<LanguageModelV4Content[]> {\n    const text = joinText(content);\n    if (!text.trim()) return content;\n\n    const replacement = await this.#outputReplacement(text, model);\n    return replacement === undefined ? content : replaceText(content, replacement);\n  }\n\n  /** The text that must replace a response, or undefined when it can go out as is. Throws when failing closed. */\n  async #outputReplacement(text: string, model: LanguageModelV4): Promise<string | undefined> {\n    let response: GuardResponse;\n    try {\n      response = await this.#evaluate(\"output\", {\n        payload: assistantTurn(text),\n        direction: \"output\",\n        protocol: \"llm\",\n        attributes: modelAttributes(model),\n      });\n    } catch (error) {\n      if (this.#failOpen(\"output\", error)) return undefined;\n      throw error;\n    }\n    if (response.status === \"block\") return this.#blockedMessage();\n    if (response.status === \"transform\") return transformedText(response, sentAssistant) ?? this.#blockedMessage();\n    return undefined;\n  }\n\n  #monitorStream(model: LanguageModelV4): TransformStream<LanguageModelV4StreamPart, LanguageModelV4StreamPart> {\n    let text = \"\";\n    const evaluate = async () => {\n      if (!text.trim()) return;\n      try {\n        await this.#evaluate(\"output\", {\n          payload: assistantTurn(text),\n          direction: \"output\",\n          protocol: \"llm\",\n          attributes: modelAttributes(model),\n        });\n      } catch (error) {\n        this.#options.onError?.({ phase: \"output\", error });\n      }\n    };\n    return new TransformStream({\n      transform(part, controller) {\n        if (part.type === \"text-delta\") text += part.delta;\n        controller.enqueue(part);\n      },\n      // The stream does not close until this resolves, so a serverless function stays alive until the evaluation is sent.\n      async flush() {\n        await evaluate();\n      },\n    });\n  }\n\n  #bufferStream(model: LanguageModelV4): TransformStream<LanguageModelV4StreamPart, LanguageModelV4StreamPart> {\n    const open = new Map<string, LanguageModelV4StreamPart[]>();\n    const release = async (\n      id: string,\n      end: LanguageModelV4StreamPart | undefined,\n      controller: TransformStreamDefaultController<LanguageModelV4StreamPart>,\n    ) => {\n      const parts = open.get(id) ?? [];\n      open.delete(id);\n      const text = parts.map((p) => (p.type === \"text-delta\" ? p.delta : \"\")).join(\"\");\n      const replacement = text.trim() ? await this.#outputReplacement(text, model) : undefined;\n      if (replacement === undefined) {\n        for (const p of parts) controller.enqueue(p);\n      } else {\n        for (const p of parts) if (p.type !== \"text-delta\") controller.enqueue(p);\n        controller.enqueue({ type: \"text-delta\", id, delta: replacement });\n      }\n      if (end) controller.enqueue(end);\n    };\n    return new TransformStream({\n      async transform(part, controller) {\n        switch (part.type) {\n          case \"text-start\":\n            open.set(part.id, [part]);\n            return;\n          case \"text-delta\": {\n            const parts = open.get(part.id);\n            if (parts) parts.push(part);\n            else controller.enqueue(part);\n            return;\n          }\n          case \"text-end\":\n            if (open.has(part.id)) await release(part.id, part, controller);\n            else controller.enqueue(part);\n            return;\n          default:\n            controller.enqueue(part);\n        }\n      },\n      async flush(controller) {\n        // A stream that ends without text-end still goes through the policy before anything is released.\n        for (const id of [...open.keys()]) await release(id, undefined, controller);\n      },\n    });\n  }\n\n  async #guardResult(toolName: string, output: unknown): Promise<unknown> {\n    const text = typeof output === \"string\" ? output : JSON.stringify(output);\n    if (text === undefined || !text.trim()) return output;\n\n    let response: GuardResponse;\n    try {\n      response = await this.#evaluate(\"tool-result\", {\n        payload: toolsResult(text),\n        direction: \"output\",\n        protocol: \"mcp\",\n        attributes: { tool: { name: toolName } },\n      });\n    } catch (error) {\n      if (this.#failOpen(\"tool-result\", error)) return output;\n      throw error;\n    }\n\n    if (response.status === \"block\") {\n      throw new TrustGuardBlockedError(\n        \"tool-result\",\n        response,\n        reasonFor(response, `TrustGuard withheld the result of ${toolName}`),\n      );\n    }\n    if (response.status !== \"transform\") return output;\n\n    const masked = transformedText(response, sentToolResult);\n    if (masked === undefined) {\n      throw new TrustGuardBlockedError(\n        \"tool-result\",\n        response,\n        `TrustGuard withheld the result of ${toolName}: the policy masked it but returned no masked text`,\n      );\n    }\n    if (typeof output === \"string\") return masked;\n    try {\n      return JSON.parse(masked) as unknown;\n    } catch {\n      return masked;\n    }\n  }\n\n  async *#guardIterableResult(toolName: string, output: AsyncIterable<unknown>): AsyncGenerator<unknown> {\n    // Preliminary outputs reach the UI only. The last one is what the model reads, so that is the one guarded:\n    // when the policy changes it, the guarded value is yielded after it and becomes the final output.\n    let last: unknown;\n    let seen = false;\n    for await (const value of output) {\n      last = value;\n      seen = true;\n      yield value;\n    }\n    if (!seen) return;\n    const guarded = await this.#guardResult(toolName, last);\n    if (guarded !== last) yield guarded;\n  }\n\n  async #evaluate(phase: GuardPhase, request: GuardRequest): Promise<GuardResponse> {\n    const response = await this.#client.guard({\n      ...request,\n      sessionId: this.#options.sessionId,\n      consumerId: this.#options.consumerId,\n      attributes: {\n        ...this.#options.attributes,\n        ...request.attributes,\n        source: { application: SOURCE_APPLICATION },\n      },\n    });\n    this.#options.onVerdict?.({ phase, response });\n    return response;\n  }\n\n  #failOpen(phase: GuardPhase, error: unknown): boolean {\n    this.#options.onError?.({ phase, error });\n    return this.#options.failMode === \"open\";\n  }\n\n  #blockedMessage(): string {\n    return this.#options.blockedMessage ?? DEFAULT_BLOCKED_MESSAGE;\n  }\n}\n\n/** Index of the user message that starts this model call, or -1 when the call continues a tool loop. */\nfunction lastUserTurn(prompt: LanguageModelV4Prompt): number {\n  const last = prompt.length - 1;\n  return last >= 0 && prompt[last]?.role === \"user\" ? last : -1;\n}\n\ntype TextLike = { type: string; text?: string };\n\nfunction joinText(parts: readonly TextLike[]): string {\n  return parts\n    .filter((p) => p.type === \"text\" && typeof p.text === \"string\")\n    .map((p) => p.text)\n    .join(\"\\n\");\n}\n\n/** Puts `text` in place of the first text part and drops the others, keeping every non-text part where it was. */\nfunction replaceText<T extends TextLike>(parts: readonly T[], text: string): T[] {\n  let placed = false;\n  const out: T[] = [];\n  for (const part of parts) {\n    if (part.type !== \"text\") {\n      out.push(part);\n    } else if (!placed) {\n      out.push({ ...part, text });\n      placed = true;\n    }\n  }\n  return out;\n}\n\ntype Payload = Record<string, unknown>;\n\n/** The masked text of a transform verdict. TrustGuard returns the payload it was sent, rewritten, so `at` reads it from where it was sent. */\nfunction transformedText(response: GuardResponse, at: (payload: Payload) => unknown): string | undefined {\n  const payload = response.transformedPayload;\n  const text = payload ? at(payload) : undefined;\n  return typeof text === \"string\" ? text : undefined;\n}\n\nconst sentInput = (payload: Payload): unknown => payload.input;\nconst sentAssistant = (payload: Payload): unknown => firstItem(payload.messages)?.content;\nconst sentToolResult = (payload: Payload): unknown => firstItem(asRecord(payload.result)?.content)?.text;\n\nfunction firstItem(value: unknown): Payload | undefined {\n  return Array.isArray(value) ? asRecord(value[0]) : undefined;\n}\n\nfunction asRecord(value: unknown): Payload | undefined {\n  return value !== null && typeof value === \"object\" && !Array.isArray(value) ? (value as Payload) : undefined;\n}\n\n// TrustGuard reads `{ input }` as the user's message, so on output Toxicity Detection and Custom Moderation would skip the\n// response. It is sent as the assistant turn it is.\nfunction assistantTurn(text: string): Payload {\n  return { messages: [{ role: \"assistant\", content: text }] };\n}\n\n// An MCP payload must be a JSON-RPC envelope, so a tool result is sent as the result of the call that produced it.\nfunction toolsResult(text: string): Payload {\n  return { jsonrpc: \"2.0\", id: 1, result: { content: [{ type: \"text\", text }] } };\n}\n\nfunction toolsCall(name: string, input: unknown): Record<string, unknown> {\n  const args = input !== null && typeof input === \"object\" && !Array.isArray(input) ? input : { input };\n  return { jsonrpc: \"2.0\", id: 1, method: \"tools/call\", params: { name, arguments: args } };\n}\n\nfunction modelAttributes(model: LanguageModelV4): Record<string, unknown> {\n  return { model: { name: model.modelId, provider: model.provider } };\n}\n\n/** `reason`, followed by the gate or detector that produced the verdict when the response names one. */\nfunction reasonFor(response: GuardResponse, reason: string): string {\n  const finding =\n    response.findings.find((f) => f.outcome?.action === response.status) ?? response.findings.find((f) => f.outcome);\n  const name = finding?.source.gateName || finding?.source.detectorName || finding?.signal?.type;\n  return name ? `${reason}: ${name}` : reason;\n}\n\nfunction isAsyncIterable(value: unknown): value is AsyncIterable<unknown> {\n  return value !== null && typeof value === \"object\" && Symbol.asyncIterator in value;\n}\n\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACiDO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EAET,YAAY,OAAmB,UAAyB,SAAiB;AACvE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,QAAQ;AACb,SAAK,WAAW;AAAA,EAClB;AACF;AAkBA,IAAM,qBAAqB;AAC3B,IAAM,0BAA0B;AAezB,SAAS,WAAW,QAAoB,UAAkC,CAAC,GAAoB;AACpG,QAAM,QAAQ,IAAI,MAAM,QAAQ,OAAO;AACvC,SAAO;AAAA,IACL,YAAY,MAAM,WAAW;AAAA,IAC7B,cAAc,CAAC,aAAa,MAAM,gBAAgB,SAAS,QAAQ;AAAA,IACnE,OAAO,CAAC,UAAU,MAAM,UAAU,KAAK;AAAA,EACzC;AACF;AAEA,IAAM,QAAN,MAAY;AAAA,EACD;AAAA,EACA;AAAA,EAET,YAAY,QAAoB,SAAiC;AAC/D,SAAK,UAAU;AACf,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,aAAwC;AACtC,WAAO;AAAA,MACL,sBAAsB;AAAA,MACtB,iBAAiB,OAAO,EAAE,QAAQ,MAAM,MAAM,KAAK,aAAa,QAAQ,KAAK;AAAA,MAC7E,cAAc,OAAO,EAAE,YAAY,MAAM,MAAM;AAC7C,cAAM,SAAS,MAAM,WAAW;AAChC,eAAO,EAAE,GAAG,QAAQ,SAAS,MAAM,KAAK,cAAc,OAAO,SAAS,KAAK,EAAE;AAAA,MAC/E;AAAA,MACA,YAAY,OAAO,EAAE,UAAU,MAAM,MAAM;AACzC,cAAM,SAAS,MAAM,SAAS;AAC9B,cAAM,YACJ,KAAK,SAAS,WAAW,WAAW,KAAK,cAAc,KAAK,IAAI,KAAK,eAAe,KAAK;AAC3F,eAAO,EAAE,GAAG,QAAQ,QAAQ,OAAO,OAAO,YAAY,SAAS,EAAE;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,MAAqD;AACzE,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,aAAa;AAAA,QAC3C,SAAS,UAAU,KAAK,UAAU,KAAK,KAAK;AAAA,QAC5C,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,aAAa,KAAK,EAAG,QAAO;AAC/C,aAAO,EAAE,MAAM,UAAU,QAAQ,gDAAgD;AAAA,IACnF;AAEA,YAAQ,SAAS,QAAQ;AAAA,MACvB,KAAK;AACH,eAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,UAAU,uBAAuB,EAAE;AAAA,MAChF,KAAK;AACH,eAAO,KAAK,SAAS,YAAY,SAC7B,EAAE,MAAM,UAAU,QAAQ,UAAU,UAAU,8BAA8B,EAAE,IAC9E,EAAE,MAAM,iBAAiB,QAAQ,UAAU,UAAU,8BAA8B,EAAE;AAAA,MAC3F,KAAK;AAEH,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,UAAU,UAAU,2EAA2E;AAAA,QACzG;AAAA,MACF;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAAA,EAEA,UAAiC,OAAqB;AACpD,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,YAAM,UAAU,KAAK;AACrB,UAAI,OAAO,YAAY,YAAY;AACjC,gBAAQ,IAAI,IAAI;AAChB;AAAA,MACF;AACA,cAAQ,IAAI,IAAI;AAAA,QACd,GAAG;AAAA,QACH,SAAS,CAAC,OAAgB,mBAA4B;AACpD,gBAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,cAAc;AACvD,iBAAO,gBAAgB,MAAM,IACzB,KAAK,qBAAqB,MAAM,MAAM,IACtC,QAAQ,QAAQ,MAAM,EAAE,KAAK,CAAC,UAAU,KAAK,aAAa,MAAM,KAAK,CAAC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,QAAoC,OAA6D;AAClH,UAAM,QAAQ,aAAa,OAAO,MAAM;AACxC,QAAI,QAAQ,EAAG,QAAO;AACtB,UAAM,UAAU,OAAO,OAAO,KAAK;AACnC,UAAM,OAAO,SAAS,QAAQ,OAAO;AACrC,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO;AAEzB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,SAAS;AAAA,QACvC,SAAS,EAAE,OAAO,KAAK;AAAA,QACvB,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,gBAAgB,KAAK;AAAA,MACnC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,SAAS,KAAK,EAAG,QAAO;AAC3C,YAAM;AAAA,IACR;AAEA,UAAM,SAAS,SAAS,WAAW,SAAS,KAAK,SAAS,cAAc,UAAU,UAAU,SAAS;AACrG,QAAI,WAAW,SAAS;AACtB,YAAM,IAAI,uBAAuB,SAAS,UAAU,UAAU,UAAU,8BAA8B,CAAC;AAAA,IACzG;AACA,QAAI,WAAW,YAAa,QAAO;AAEnC,UAAM,SAAS,gBAAgB,UAAU,SAAS;AAClD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,CAAC,GAAG,OAAO,MAAM;AAChC,WAAO,KAAK,IAAI,EAAE,GAAG,SAAS,SAAS,YAAY,QAAQ,SAAS,MAAM,EAAE;AAC5E,WAAO,EAAE,GAAG,QAAQ,OAAO;AAAA,EAC7B;AAAA,EAEA,MAAM,cAAc,SAAmC,OAA2D;AAChH,UAAM,OAAO,SAAS,OAAO;AAC7B,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO;AAEzB,UAAM,cAAc,MAAM,KAAK,mBAAmB,MAAM,KAAK;AAC7D,WAAO,gBAAgB,SAAY,UAAU,YAAY,SAAS,WAAW;AAAA,EAC/E;AAAA;AAAA,EAGA,MAAM,mBAAmB,MAAc,OAAqD;AAC1F,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,UAAU;AAAA,QACxC,SAAS,cAAc,IAAI;AAAA,QAC3B,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,gBAAgB,KAAK;AAAA,MACnC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,UAAU,KAAK,EAAG,QAAO;AAC5C,YAAM;AAAA,IACR;AACA,QAAI,SAAS,WAAW,QAAS,QAAO,KAAK,gBAAgB;AAC7D,QAAI,SAAS,WAAW,YAAa,QAAO,gBAAgB,UAAU,aAAa,KAAK,KAAK,gBAAgB;AAC7G,WAAO;AAAA,EACT;AAAA,EAEA,eAAe,OAA+F;AAC5G,QAAI,OAAO;AACX,UAAM,WAAW,YAAY;AAC3B,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AACF,cAAM,KAAK,UAAU,UAAU;AAAA,UAC7B,SAAS,cAAc,IAAI;AAAA,UAC3B,WAAW;AAAA,UACX,UAAU;AAAA,UACV,YAAY,gBAAgB,KAAK;AAAA,QACnC,CAAC;AAAA,MACH,SAAS,OAAO;AACd,aAAK,SAAS,UAAU,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MACpD;AAAA,IACF;AACA,WAAO,IAAI,gBAAgB;AAAA,MACzB,UAAU,MAAM,YAAY;AAC1B,YAAI,KAAK,SAAS,aAAc,SAAQ,KAAK;AAC7C,mBAAW,QAAQ,IAAI;AAAA,MACzB;AAAA;AAAA,MAEA,MAAM,QAAQ;AACZ,cAAM,SAAS;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,cAAc,OAA+F;AAC3G,UAAM,OAAO,oBAAI,IAAyC;AAC1D,UAAM,UAAU,OACd,IACA,KACA,eACG;AACH,YAAM,QAAQ,KAAK,IAAI,EAAE,KAAK,CAAC;AAC/B,WAAK,OAAO,EAAE;AACd,YAAM,OAAO,MAAM,IAAI,CAAC,MAAO,EAAE,SAAS,eAAe,EAAE,QAAQ,EAAG,EAAE,KAAK,EAAE;AAC/E,YAAM,cAAc,KAAK,KAAK,IAAI,MAAM,KAAK,mBAAmB,MAAM,KAAK,IAAI;AAC/E,UAAI,gBAAgB,QAAW;AAC7B,mBAAW,KAAK,MAAO,YAAW,QAAQ,CAAC;AAAA,MAC7C,OAAO;AACL,mBAAW,KAAK,MAAO,KAAI,EAAE,SAAS,aAAc,YAAW,QAAQ,CAAC;AACxE,mBAAW,QAAQ,EAAE,MAAM,cAAc,IAAI,OAAO,YAAY,CAAC;AAAA,MACnE;AACA,UAAI,IAAK,YAAW,QAAQ,GAAG;AAAA,IACjC;AACA,WAAO,IAAI,gBAAgB;AAAA,MACzB,MAAM,UAAU,MAAM,YAAY;AAChC,gBAAQ,KAAK,MAAM;AAAA,UACjB,KAAK;AACH,iBAAK,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;AACxB;AAAA,UACF,KAAK,cAAc;AACjB,kBAAM,QAAQ,KAAK,IAAI,KAAK,EAAE;AAC9B,gBAAI,MAAO,OAAM,KAAK,IAAI;AAAA,gBACrB,YAAW,QAAQ,IAAI;AAC5B;AAAA,UACF;AAAA,UACA,KAAK;AACH,gBAAI,KAAK,IAAI,KAAK,EAAE,EAAG,OAAM,QAAQ,KAAK,IAAI,MAAM,UAAU;AAAA,gBACzD,YAAW,QAAQ,IAAI;AAC5B;AAAA,UACF;AACE,uBAAW,QAAQ,IAAI;AAAA,QAC3B;AAAA,MACF;AAAA,MACA,MAAM,MAAM,YAAY;AAEtB,mBAAW,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,EAAG,OAAM,QAAQ,IAAI,QAAW,UAAU;AAAA,MAC5E;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,aAAa,UAAkB,QAAmC;AACtE,UAAM,OAAO,OAAO,WAAW,WAAW,SAAS,KAAK,UAAU,MAAM;AACxE,QAAI,SAAS,UAAa,CAAC,KAAK,KAAK,EAAG,QAAO;AAE/C,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,eAAe;AAAA,QAC7C,SAAS,YAAY,IAAI;AAAA,QACzB,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE;AAAA,MACzC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,eAAe,KAAK,EAAG,QAAO;AACjD,YAAM;AAAA,IACR;AAEA,QAAI,SAAS,WAAW,SAAS;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,UAAU,UAAU,qCAAqC,QAAQ,EAAE;AAAA,MACrE;AAAA,IACF;AACA,QAAI,SAAS,WAAW,YAAa,QAAO;AAE5C,UAAM,SAAS,gBAAgB,UAAU,cAAc;AACvD,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,qCAAqC,QAAQ;AAAA,MAC/C;AAAA,IACF;AACA,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI;AACF,aAAO,KAAK,MAAM,MAAM;AAAA,IAC1B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,OAAO,qBAAqB,UAAkB,QAAyD;AAGrG,QAAI;AACJ,QAAI,OAAO;AACX,qBAAiB,SAAS,QAAQ;AAChC,aAAO;AACP,aAAO;AACP,YAAM;AAAA,IACR;AACA,QAAI,CAAC,KAAM;AACX,UAAM,UAAU,MAAM,KAAK,aAAa,UAAU,IAAI;AACtD,QAAI,YAAY,KAAM,OAAM;AAAA,EAC9B;AAAA,EAEA,MAAM,UAAU,OAAmB,SAA+C;AAChF,UAAM,WAAW,MAAM,KAAK,QAAQ,MAAM;AAAA,MACxC,GAAG;AAAA,MACH,WAAW,KAAK,SAAS;AAAA,MACzB,YAAY,KAAK,SAAS;AAAA,MAC1B,YAAY;AAAA,QACV,GAAG,KAAK,SAAS;AAAA,QACjB,GAAG,QAAQ;AAAA,QACX,QAAQ,EAAE,aAAa,mBAAmB;AAAA,MAC5C;AAAA,IACF,CAAC;AACD,SAAK,SAAS,YAAY,EAAE,OAAO,SAAS,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,OAAmB,OAAyB;AACpD,SAAK,SAAS,UAAU,EAAE,OAAO,MAAM,CAAC;AACxC,WAAO,KAAK,SAAS,aAAa;AAAA,EACpC;AAAA,EAEA,kBAA0B;AACxB,WAAO,KAAK,SAAS,kBAAkB;AAAA,EACzC;AACF;AAGA,SAAS,aAAa,QAAuC;AAC3D,QAAM,OAAO,OAAO,SAAS;AAC7B,SAAO,QAAQ,KAAK,OAAO,IAAI,GAAG,SAAS,SAAS,OAAO;AAC7D;AAIA,SAAS,SAAS,OAAoC;AACpD,SAAO,MACJ,OAAO,CAAC,MAAM,EAAE,SAAS,UAAU,OAAO,EAAE,SAAS,QAAQ,EAC7D,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,KAAK,IAAI;AACd;AAGA,SAAS,YAAgC,OAAqB,MAAmB;AAC/E,MAAI,SAAS;AACb,QAAM,MAAW,CAAC;AAClB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,SAAS,QAAQ;AACxB,UAAI,KAAK,IAAI;AAAA,IACf,WAAW,CAAC,QAAQ;AAClB,UAAI,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC;AAC1B,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAKA,SAAS,gBAAgB,UAAyB,IAAuD;AACvG,QAAM,UAAU,SAAS;AACzB,QAAM,OAAO,UAAU,GAAG,OAAO,IAAI;AACrC,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEA,IAAM,YAAY,CAAC,YAA8B,QAAQ;AACzD,IAAM,gBAAgB,CAAC,YAA8B,UAAU,QAAQ,QAAQ,GAAG;AAClF,IAAM,iBAAiB,CAAC,YAA8B,UAAU,SAAS,QAAQ,MAAM,GAAG,OAAO,GAAG;AAEpG,SAAS,UAAU,OAAqC;AACtD,SAAO,MAAM,QAAQ,KAAK,IAAI,SAAS,MAAM,CAAC,CAAC,IAAI;AACrD;AAEA,SAAS,SAAS,OAAqC;AACrD,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAK,QAAoB;AACrG;AAIA,SAAS,cAAc,MAAuB;AAC5C,SAAO,EAAE,UAAU,CAAC,EAAE,MAAM,aAAa,SAAS,KAAK,CAAC,EAAE;AAC5D;AAGA,SAAS,YAAY,MAAuB;AAC1C,SAAO,EAAE,SAAS,OAAO,IAAI,GAAG,QAAQ,EAAE,SAAS,CAAC,EAAE,MAAM,QAAQ,KAAK,CAAC,EAAE,EAAE;AAChF;AAEA,SAAS,UAAU,MAAc,OAAyC;AACxE,QAAM,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAQ,EAAE,MAAM;AACpG,SAAO,EAAE,SAAS,OAAO,IAAI,GAAG,QAAQ,cAAc,QAAQ,EAAE,MAAM,WAAW,KAAK,EAAE;AAC1F;AAEA,SAAS,gBAAgB,OAAiD;AACxE,SAAO,EAAE,OAAO,EAAE,MAAM,MAAM,SAAS,UAAU,MAAM,SAAS,EAAE;AACpE;AAGA,SAAS,UAAU,UAAyB,QAAwB;AAClE,QAAM,UACJ,SAAS,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,WAAW,SAAS,MAAM,KAAK,SAAS,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO;AACjH,QAAM,OAAO,SAAS,OAAO,YAAY,SAAS,OAAO,gBAAgB,SAAS,QAAQ;AAC1F,SAAO,OAAO,GAAG,MAAM,KAAK,IAAI,KAAK;AACvC;AAEA,SAAS,gBAAgB,OAAiD;AACxE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,iBAAiB;AAChF;","names":[]}

package/dist/ai-sdk/index.d.cts

@@ -0,0 +1,81 @@
+import { LanguageModelV4Middleware } from '@ai-sdk/provider';
+import { ToolApprovalStatus, ToolSet } from 'ai';
+import { G as GuardResponse, T as TrustGuard } from '../client-ZoD3M6yg.cjs';
+
+/** Where in the agent loop an evaluation ran. */
+type GuardPhase = "input" | "output" | "tool-call" | "tool-result";
+/** Options for {@link trustguard}. Create one instance per request so every evaluation carries the right user. */
+interface TrustGuardAISDKOptions {
+    /** The end user the request runs for. Findings are grouped under it and gates match it as `consumer.id`. */
+    consumerId?: string;
+    /** The conversation key. Without it TrustGuard synthesises one per evaluation and turns lose their grouping. */
+    sessionId?: string;
+    /** Extra attributes merged into every evaluation, for gates and rule conditions. */
+    attributes?: Record<string, unknown>;
+    /**
+     * How streamed responses are guarded.
+     * - `"monitor"` (default): text streams untouched and is evaluated when the response finishes. Findings are recorded, nothing is enforced.
+     * - `"buffer"`: each text block is held until it ends, evaluated, then released, redacted or replaced. Enforces the policy at the cost of streaming.
+     */
+    stream?: "monitor" | "buffer";
+    /** What an `ask` verdict on the prompt does. The model call has no one to ask, so the default is `"block"`. */
+    promptAsk?: "block" | "allow";
+    /** What an `ask` verdict on a tool call does. The default, `"user-approval"`, asks the user through the AI SDK approval flow. */
+    toolAsk?: "user-approval" | "deny";
+    /** Text that replaces a response the policy blocked. */
+    blockedMessage?: string;
+    /**
+     * What happens when TrustGuard cannot be reached or returns an error.
+     * `"closed"` (default) throws on the prompt and the response and denies the tool call. `"open"` lets the traffic through.
+     * Monitor-mode stream evaluations never fail the stream.
+     */
+    failMode?: "closed" | "open";
+    /** Called with every verdict, for logging. */
+    onVerdict?: (event: {
+        phase: GuardPhase;
+        response: GuardResponse;
+    }) => void;
+    /** Called with every evaluation error, including the ones `failMode: "open"` swallows. */
+    onError?: (event: {
+        phase: GuardPhase;
+        error: unknown;
+    }) => void;
+}
+/** Thrown when the policy blocks the prompt or the response, and by guarded tools whose result was withheld. */
+declare class TrustGuardBlockedError extends Error {
+    readonly phase: GuardPhase;
+    readonly response: GuardResponse;
+    constructor(phase: GuardPhase, response: GuardResponse, message: string);
+}
+/** The tool call the approval function receives. Structural, so it matches static and dynamic tool calls alike. */
+interface ApprovalToolCall {
+    toolName: string;
+    toolCallId: string;
+    input: unknown;
+}
+interface TrustGuardAISDK {
+    /** Language model middleware for `wrapLanguageModel`: guards the prompt and the response. */
+    middleware: LanguageModelV4Middleware;
+    /** A `toolApproval` function for `generateText` / `streamText`: guards each tool call before it runs. */
+    toolApproval: (options: {
+        toolCall: ApprovalToolCall;
+    }) => Promise<ToolApprovalStatus>;
+    /** Wraps a tool set so every result is evaluated before the model reads it. */
+    tools: <TOOLS extends ToolSet>(tools: TOOLS) => TOOLS;
+}
+/**
+ * Connects a TrustGuard client to the Vercel AI SDK.
+ *
+ * ```ts
+ * const tg = trustguard(client, { consumerId: user.id, sessionId: chatId });
+ * streamText({
+ *   model: wrapLanguageModel({ model, middleware: tg.middleware }),
+ *   tools: tg.tools(tools),
+ *   toolApproval: tg.toolApproval,
+ *   messages,
+ * });
+ * ```
+ */
+declare function trustguard(client: TrustGuard, options?: TrustGuardAISDKOptions): TrustGuardAISDK;
+
+export { type ApprovalToolCall, type GuardPhase, type TrustGuardAISDK, type TrustGuardAISDKOptions, TrustGuardBlockedError, trustguard };

package/dist/ai-sdk/index.d.ts

@@ -0,0 +1,81 @@
+import { LanguageModelV4Middleware } from '@ai-sdk/provider';
+import { ToolApprovalStatus, ToolSet } from 'ai';
+import { G as GuardResponse, T as TrustGuard } from '../client-ZoD3M6yg.js';
+
+/** Where in the agent loop an evaluation ran. */
+type GuardPhase = "input" | "output" | "tool-call" | "tool-result";
+/** Options for {@link trustguard}. Create one instance per request so every evaluation carries the right user. */
+interface TrustGuardAISDKOptions {
+    /** The end user the request runs for. Findings are grouped under it and gates match it as `consumer.id`. */
+    consumerId?: string;
+    /** The conversation key. Without it TrustGuard synthesises one per evaluation and turns lose their grouping. */
+    sessionId?: string;
+    /** Extra attributes merged into every evaluation, for gates and rule conditions. */
+    attributes?: Record<string, unknown>;
+    /**
+     * How streamed responses are guarded.
+     * - `"monitor"` (default): text streams untouched and is evaluated when the response finishes. Findings are recorded, nothing is enforced.
+     * - `"buffer"`: each text block is held until it ends, evaluated, then released, redacted or replaced. Enforces the policy at the cost of streaming.
+     */
+    stream?: "monitor" | "buffer";
+    /** What an `ask` verdict on the prompt does. The model call has no one to ask, so the default is `"block"`. */
+    promptAsk?: "block" | "allow";
+    /** What an `ask` verdict on a tool call does. The default, `"user-approval"`, asks the user through the AI SDK approval flow. */
+    toolAsk?: "user-approval" | "deny";
+    /** Text that replaces a response the policy blocked. */
+    blockedMessage?: string;
+    /**
+     * What happens when TrustGuard cannot be reached or returns an error.
+     * `"closed"` (default) throws on the prompt and the response and denies the tool call. `"open"` lets the traffic through.
+     * Monitor-mode stream evaluations never fail the stream.
+     */
+    failMode?: "closed" | "open";
+    /** Called with every verdict, for logging. */
+    onVerdict?: (event: {
+        phase: GuardPhase;
+        response: GuardResponse;
+    }) => void;
+    /** Called with every evaluation error, including the ones `failMode: "open"` swallows. */
+    onError?: (event: {
+        phase: GuardPhase;
+        error: unknown;
+    }) => void;
+}
+/** Thrown when the policy blocks the prompt or the response, and by guarded tools whose result was withheld. */
+declare class TrustGuardBlockedError extends Error {
+    readonly phase: GuardPhase;
+    readonly response: GuardResponse;
+    constructor(phase: GuardPhase, response: GuardResponse, message: string);
+}
+/** The tool call the approval function receives. Structural, so it matches static and dynamic tool calls alike. */
+interface ApprovalToolCall {
+    toolName: string;
+    toolCallId: string;
+    input: unknown;
+}
+interface TrustGuardAISDK {
+    /** Language model middleware for `wrapLanguageModel`: guards the prompt and the response. */
+    middleware: LanguageModelV4Middleware;
+    /** A `toolApproval` function for `generateText` / `streamText`: guards each tool call before it runs. */
+    toolApproval: (options: {
+        toolCall: ApprovalToolCall;
+    }) => Promise<ToolApprovalStatus>;
+    /** Wraps a tool set so every result is evaluated before the model reads it. */
+    tools: <TOOLS extends ToolSet>(tools: TOOLS) => TOOLS;
+}
+/**
+ * Connects a TrustGuard client to the Vercel AI SDK.
+ *
+ * ```ts
+ * const tg = trustguard(client, { consumerId: user.id, sessionId: chatId });
+ * streamText({
+ *   model: wrapLanguageModel({ model, middleware: tg.middleware }),
+ *   tools: tg.tools(tools),
+ *   toolApproval: tg.toolApproval,
+ *   messages,
+ * });
+ * ```
+ */
+declare function trustguard(client: TrustGuard, options?: TrustGuardAISDKOptions): TrustGuardAISDK;
+
+export { type ApprovalToolCall, type GuardPhase, type TrustGuardAISDK, type TrustGuardAISDKOptions, TrustGuardBlockedError, trustguard };