@polpo-ai/core 0.15.43 → 0.15.45

package/dist/guardrails/detectors.js

@@ -0,0 +1,416 @@
+import { Ajv } from "ajv";
+const SECRET_PATTERNS = [
+    /\bgh[pousr]_[A-Za-z0-9]{30,255}\b/g,
+    /\bAKIA[A-Z0-9]{16}\b/g,
+    /\bxox[baprs]-[A-Za-z0-9-]{10,255}\b/g,
+    /\bsk-(?:(?:proj|svcacct)-)?[A-Za-z0-9_-]{32,255}\b/g,
+    /\bsk_[a-f0-9]{40,255}\b/gi,
+    /\beyJ[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\.[A-Za-z0-9_-]{5,}\b/g,
+    /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+];
+function redactString(value) {
+    let redacted = value;
+    let matches = 0;
+    for (const pattern of SECRET_PATTERNS) {
+        redacted = redacted.replace(pattern, () => {
+            matches++;
+            return "[REDACTED]";
+        });
+    }
+    return { value: redacted, matches };
+}
+function mapStrings(value, mapper, seen = new WeakMap()) {
+    if (typeof value === "string")
+        return mapper(value);
+    if (value === null || typeof value !== "object")
+        return { value, matches: 0 };
+    const existing = seen.get(value);
+    if (existing !== undefined)
+        return { value: existing, matches: 0 };
+    if (Array.isArray(value)) {
+        const output = [];
+        seen.set(value, output);
+        let matches = 0;
+        for (const item of value) {
+            const mapped = mapStrings(item, mapper, seen);
+            output.push(mapped.value);
+            matches += mapped.matches;
+        }
+        return { value: output, matches };
+    }
+    const output = {};
+    seen.set(value, output);
+    let matches = 0;
+    for (const [key, item] of Object.entries(value)) {
+        const mapped = mapStrings(item, mapper, seen);
+        output[key] = mapped.value;
+        matches += mapped.matches;
+    }
+    return { value: output, matches };
+}
+function collectStrings(value, output = [], seen = new WeakSet()) {
+    if (typeof value === "string")
+        output.push(value);
+    else if (value && typeof value === "object" && !seen.has(value)) {
+        seen.add(value);
+        for (const item of Array.isArray(value)
+            ? value
+            : Object.values(value)) {
+            collectStrings(item, output, seen);
+        }
+    }
+    return output;
+}
+export function createSecretPatternPolicy(options = {}) {
+    const action = options.action ?? "redact";
+    return {
+        id: options.id ?? "secrets.common-patterns",
+        version: options.version ?? "1",
+        priority: options.priority ?? 500,
+        phases: options.phases ?? ["input", "context", "tool.before", "tool.after", "output"],
+        evaluate(input) {
+            const redacted = mapStrings(input.value, redactString);
+            if (redacted.matches === 0)
+                return null;
+            return {
+                action,
+                risk: options.risk ?? "high",
+                reason: `Detected ${redacted.matches} common secret pattern${redacted.matches === 1 ? "" : "s"}`,
+                ...(action === "redact" || action === "rewrite" ? { value: redacted.value } : {}),
+            };
+        },
+    };
+}
+const DESTRUCTIVE_PATTERNS = [
+    /\brm\s+(?:-[^\s]*[rf][^\s]*\s+){1,}(?:\/(?:\s|$)|~(?:\/|\s|$)|\$HOME(?:\/|\s|$))/i,
+    /\b(?:mkfs(?:\.[a-z0-9]+)?|wipefs)\b/i,
+    /\bdd\s+if=.*\bof=\/dev\//i,
+    /:\(\)\s*\{\s*:\|:&\s*\};:/,
+    /\bDROP\s+(?:DATABASE|SCHEMA|TABLE)\b/i,
+    /\bTRUNCATE\s+(?:TABLE\s+)?\S+/i,
+    /\bDELETE\s+FROM\s+\S+(?![\s\S]*\bWHERE\b)/i,
+    /\bUPDATE\s+\S+\s+SET\b(?![\s\S]*\bWHERE\b)/i,
+];
+export function createDestructiveOperationPolicy(options = {}) {
+    return {
+        id: options.id ?? "tools.destructive-operation",
+        version: options.version ?? "1",
+        priority: options.priority ?? 200,
+        phases: ["tool.before"],
+        evaluate(input) {
+            const toolName = input.tool?.name.toLowerCase() ?? "";
+            if (!/(bash|shell|command|exec|sql|query)/.test(toolName))
+                return null;
+            const matched = collectStrings(input.value).some((value) => DESTRUCTIVE_PATTERNS.some((pattern) => pattern.test(value)));
+            if (!matched)
+                return null;
+            return {
+                action: options.action ?? "approval",
+                risk: options.risk ?? "critical",
+                reason: "Potentially destructive shell or SQL operation",
+            };
+        },
+    };
+}
+function isPrivateIpv4(hostname) {
+    const parts = hostname.split(".");
+    if (parts.length !== 4 || parts.some((part) => !/^\d{1,3}$/.test(part)))
+        return false;
+    const values = parts.map(Number);
+    if (values.some((value) => value > 255))
+        return false;
+    return values[0] === 10
+        || values[0] === 127
+        || (values[0] === 169 && values[1] === 254)
+        || (values[0] === 172 && values[1] >= 16 && values[1] <= 31)
+        || (values[0] === 192 && values[1] === 168)
+        || (values[0] === 100 && values[1] >= 64 && values[1] <= 127)
+        || (values[0] === 198 && (values[1] === 18 || values[1] === 19))
+        || values[0] >= 224
+        || values[0] === 0;
+}
+function mappedIpv4(hostname) {
+    const match = /^::ffff:([0-9a-f]{1,4}):([0-9a-f]{1,4})$/i.exec(hostname);
+    if (!match)
+        return undefined;
+    const high = Number.parseInt(match[1], 16);
+    const low = Number.parseInt(match[2], 16);
+    return [
+        high >>> 8,
+        high & 0xff,
+        low >>> 8,
+        low & 0xff,
+    ].join(".");
+}
+function isPrivateHostname(rawHostname) {
+    const hostname = rawHostname.toLowerCase().replace(/^\[|\]$/g, "").replace(/\.$/, "");
+    const ipv4 = mappedIpv4(hostname);
+    return hostname === "localhost"
+        || hostname === "::"
+        || hostname === "::1"
+        || hostname === "0:0:0:0:0:0:0:1"
+        || /^f[cd][0-9a-f]{2}(?::|$)/.test(hostname)
+        || /^fe[89ab][0-9a-f](?::|$)/.test(hostname)
+        || /^ff[0-9a-f]{2}(?::|$)/.test(hostname)
+        || hostname.endsWith(".localhost")
+        || hostname.endsWith(".local")
+        || hostname.endsWith(".internal")
+        || hostname.endsWith(".home.arpa")
+        || hostname === "metadata.google.internal"
+        || (ipv4 !== undefined && isPrivateIpv4(ipv4))
+        || isPrivateIpv4(hostname);
+}
+function findPrivateTarget(value, seen = new WeakSet()) {
+    if (value && typeof value === "object") {
+        if (seen.has(value))
+            return undefined;
+        seen.add(value);
+        for (const [key, item] of Object.entries(value)) {
+            if (typeof item === "string" &&
+                /^(?:host|hostname|address)$/i.test(key) &&
+                isPrivateHostname(item)) {
+                return item.toLowerCase();
+            }
+            const nested = findPrivateTarget(item, seen);
+            if (nested)
+                return nested;
+        }
+        return undefined;
+    }
+    if (typeof value !== "string")
+        return undefined;
+    const candidates = value.match(/https?:\/\/[^\s"'<>]+/gi) ?? [];
+    for (const candidate of candidates) {
+        try {
+            const hostname = new URL(candidate).hostname.replace(/^\[|\]$/g, "");
+            if (isPrivateHostname(hostname))
+                return hostname.toLowerCase();
+        }
+        catch {
+            // Malformed URLs belong to argument-schema validation, not SSRF policy.
+        }
+    }
+    return undefined;
+}
+export function createPrivateNetworkPolicy(options = {}) {
+    return {
+        id: options.id ?? "network.private-target",
+        version: options.version ?? "1",
+        priority: options.priority ?? 220,
+        phases: ["tool.before"],
+        evaluate(input) {
+            const toolName = input.tool?.name.toLowerCase() ?? "";
+            if (!/(http|fetch|request|browser|navigate|webhook|url|download|connect|network|api)/.test(toolName))
+                return null;
+            const target = findPrivateTarget(input.value);
+            if (!target)
+                return null;
+            return {
+                action: options.action ?? "block",
+                risk: options.risk ?? "critical",
+                reason: `Outbound request targets a non-public network address: ${target}`,
+            };
+        },
+    };
+}
+const toolSchemaAjv = new Ajv({
+    allErrors: false,
+    allowUnionTypes: true,
+    strict: false,
+    validateFormats: false,
+});
+const toolSchemaValidators = new WeakMap();
+async function resolveToolArgumentSchema(value, seen = new WeakSet()) {
+    let current = await value;
+    for (let depth = 0; depth < 8; depth++) {
+        if (!current || typeof current !== "object" || Array.isArray(current)) {
+            return undefined;
+        }
+        if (seen.has(current))
+            return undefined;
+        seen.add(current);
+        const candidate = current;
+        if (candidate.type !== undefined
+            || candidate.properties !== undefined
+            || candidate.required !== undefined
+            || candidate.$ref !== undefined
+            || candidate.allOf !== undefined
+            || candidate.anyOf !== undefined
+            || candidate.oneOf !== undefined) {
+            return candidate;
+        }
+        if (!("jsonSchema" in candidate))
+            return candidate;
+        current = await candidate.jsonSchema;
+    }
+    return undefined;
+}
+function validateToolArguments(schema, value) {
+    let validate = toolSchemaValidators.get(schema);
+    if (!validate) {
+        const compiled = toolSchemaAjv.compile(schema);
+        toolSchemaValidators.set(schema, compiled);
+        validate = compiled;
+    }
+    if (validate(value))
+        return undefined;
+    const error = validate.errors?.[0];
+    const path = error?.instancePath || "$";
+    return `${path} ${error?.message ?? "does not match the tool schema"}`;
+}
+export function createToolArgumentsPolicy(options = {}) {
+    return {
+        id: options.id ?? "tools.arguments-schema",
+        version: options.version ?? "1",
+        priority: options.priority ?? 100,
+        phases: ["tool.before"],
+        async evaluate(input) {
+            if (input.tool?.schema === undefined)
+                return null;
+            let schema;
+            try {
+                schema = await resolveToolArgumentSchema(input.tool.schema);
+            }
+            catch {
+                schema = undefined;
+            }
+            if (!schema) {
+                return {
+                    action: options.action ?? "block",
+                    risk: options.risk ?? "high",
+                    reason: "Tool parameter schema is malformed",
+                };
+            }
+            if (schema.type !== "object") {
+                return {
+                    action: options.action ?? "block",
+                    risk: options.risk ?? "high",
+                    reason: "Tool parameter root must be an object schema",
+                };
+            }
+            let error;
+            try {
+                error = validateToolArguments(schema, input.value);
+            }
+            catch {
+                return {
+                    action: options.action ?? "block",
+                    risk: options.risk ?? "high",
+                    reason: "Tool parameter schema could not be validated",
+                };
+            }
+            if (!error)
+                return null;
+            return {
+                action: options.action ?? "block",
+                risk: options.risk ?? "high",
+                reason: `Invalid tool arguments: ${error}`,
+            };
+        },
+    };
+}
+export function createCrossScopePolicy(options = {}) {
+    return {
+        id: options.id ?? "context.cross-scope",
+        version: options.version ?? "1",
+        priority: options.priority ?? 50,
+        phases: ["input", "context", "model.preflight", "tool.before", "tool.after", "output"],
+        evaluate(input) {
+            const expected = input.context.scope?.expected;
+            const actual = input.context.scope?.actual;
+            if (!expected || !actual)
+                return null;
+            const mismatch = Object.entries(expected).find(([key, expectedValue]) => expectedValue !== undefined && actual[key] !== expectedValue);
+            if (!mismatch)
+                return null;
+            return {
+                action: options.action ?? "block",
+                risk: options.risk ?? "critical",
+                reason: `Runtime context scope mismatch for "${mismatch[0]}"`,
+            };
+        },
+    };
+}
+function countCharacters(value, limit, seen = new WeakSet()) {
+    if (typeof value === "string")
+        return value.length;
+    if (value === null || value === undefined)
+        return String(value).length;
+    if (typeof value !== "object")
+        return String(value).length;
+    if (seen.has(value))
+        return limit + 1;
+    seen.add(value);
+    let total = Array.isArray(value) ? 2 : 2;
+    const entries = Array.isArray(value)
+        ? value
+        : Object.entries(value);
+    for (const entry of entries) {
+        if (Array.isArray(entry) && !Array.isArray(value)) {
+            total += entry[0].length + countCharacters(entry[1], limit - total, seen);
+        }
+        else {
+            total += countCharacters(entry, limit - total, seen);
+        }
+        if (total > limit)
+            return total;
+    }
+    return total;
+}
+export function createBoundedValuePolicy(options) {
+    if (!Number.isSafeInteger(options.maxCharacters) || options.maxCharacters < 1) {
+        throw new TypeError("maxCharacters must be a positive safe integer");
+    }
+    return {
+        id: options.id ?? "context.bounded-value",
+        version: options.version ?? "1",
+        priority: options.priority ?? 80,
+        phases: options.phases,
+        evaluate(input) {
+            if (countCharacters(input.value, options.maxCharacters) <= options.maxCharacters)
+                return null;
+            return {
+                action: options.action ?? "block",
+                risk: options.risk ?? "high",
+                reason: `Value exceeds the ${options.maxCharacters}-character guardrail limit`,
+            };
+        },
+    };
+}
+export function createDefaultToolGuardrailPolicies() {
+    return Object.freeze([
+        createCrossScopePolicy(),
+        createToolArgumentsPolicy(),
+        createDestructiveOperationPolicy(),
+        createPrivateNetworkPolicy(),
+        createSecretPatternPolicy({
+            id: "secrets.tool-input",
+            phases: ["tool.before"],
+            action: "redact",
+        }),
+        createSecretPatternPolicy({
+            id: "secrets.tool-output",
+            phases: ["tool.after"],
+            action: "redact",
+        }),
+    ]);
+}
+export function createDefaultOutputGuardrailPolicies(maxCharacters) {
+    return Object.freeze([
+        createCrossScopePolicy(),
+        ...(maxCharacters !== undefined
+            ? [createBoundedValuePolicy({
+                    id: "output.bounded-value",
+                    phases: ["output"],
+                    maxCharacters,
+                    action: "block",
+                })]
+            : []),
+        createSecretPatternPolicy({
+            id: "secrets.output",
+            phases: ["output"],
+            action: "redact",
+        }),
+    ]);
+}
+//# sourceMappingURL=detectors.js.map

package/dist/guardrails/detectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"detectors.js","sourceRoot":"","sources":["../../src/guardrails/detectors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,GAAG,EAAyB,MAAM,KAAK,CAAC;AAmBjD,MAAM,eAAe,GAAsB;IACzC,oCAAoC;IACpC,uBAAuB;IACvB,sCAAsC;IACtC,qDAAqD;IACrD,2BAA2B;IAC3B,iEAAiE;IACjE,2GAA2G;CAC5G,CAAC;AAEF,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,OAAO,IAAI,eAAe,EAAE,CAAC;QACtC,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE;YACxC,OAAO,EAAE,CAAC;YACV,OAAO,YAAY,CAAC;QACtB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC;AACtC,CAAC;AAED,SAAS,UAAU,CACjB,KAAc,EACd,MAA6D,EAC7D,OAAO,IAAI,OAAO,EAAmB;IAErC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACpD,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACnE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,MAAM,GAAc,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QACxB,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC1B,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;QAC5B,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACpC,CAAC;IACD,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG,CAAC,KAAe,EAAE,MAAM,CAAC,CAAC;IAClC,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC3E,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;QAC3B,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC;IAC5B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,cAAc,CACrB,KAAc,EACd,SAAmB,EAAE,EACrB,OAAO,IAAI,OAAO,EAAU;IAE5B,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;SAC7C,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,EAAE,CAAC;QAC1E,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;QAC1B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YACrC,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC,EAAE,CAAC;YACpD,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,yBAAyB,CAAC,UAEtC,EAAE;IACJ,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,IAAI,QAAQ,CAAC;IAC1C,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,yBAAyB;QAC3C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;QACrF,QAAQ,CAAC,KAAK;YACZ,MAAM,QAAQ,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;YACvD,IAAI,QAAQ,CAAC,OAAO,KAAK,CAAC;gBAAE,OAAO,IAAI,CAAC;YACxC,OAAO;gBACL,MAAM;gBACN,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;gBAC5B,MAAM,EAAE,YAAY,QAAQ,CAAC,OAAO,yBAAyB,QAAQ,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE;gBAChG,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAClD,CAAC;QACpC,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,oBAAoB,GAAsB;IAC9C,mFAAmF;IACnF,sCAAsC;IACtC,2BAA2B;IAC3B,2BAA2B;IAC3B,uCAAuC;IACvC,gCAAgC;IAChC,4CAA4C;IAC5C,6CAA6C;CAC9C,CAAC;AAEF,MAAM,UAAU,gCAAgC,CAC9C,UAA2B,EAAE;IAE7B,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,6BAA6B;QAC/C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,MAAM,EAAE,CAAC,aAAa,CAAC;QACvB,QAAQ,CAAC,KAAK;YACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,qCAAqC,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YACvE,MAAM,OAAO,GAAG,cAAc,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,oBAAoB,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC5D,CAAC;YACF,IAAI,CAAC,OAAO;gBAAE,OAAO,IAAI,CAAC;YAC1B,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;gBACpC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,UAAU;gBAChC,MAAM,EAAE,gDAAgD;aACzD,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,QAAgB;IACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACtF,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtD,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE;WAClB,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG;WACjB,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;WACxC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;WACzD,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC;WACxC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;WAC1D,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;WAC7D,MAAM,CAAC,CAAC,CAAC,IAAI,GAAG;WAChB,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,QAAgB;IAClC,MAAM,KAAK,GAAG,2CAA2C,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzE,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAE,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO;QACL,IAAI,KAAK,CAAC;QACV,IAAI,GAAG,IAAI;QACX,GAAG,KAAK,CAAC;QACT,GAAG,GAAG,IAAI;KACX,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,SAAS,iBAAiB,CAAC,WAAmB;IAC5C,MAAM,QAAQ,GAAG,WAAW,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACtF,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,OAAO,QAAQ,KAAK,WAAW;WAC1B,QAAQ,KAAK,IAAI;WACjB,QAAQ,KAAK,KAAK;WAClB,QAAQ,KAAK,iBAAiB;WAC9B,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;WACzC,0BAA0B,CAAC,IAAI,CAAC,QAAQ,CAAC;WACzC,uBAAuB,CAAC,IAAI,CAAC,QAAQ,CAAC;WACtC,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;WAC/B,QAAQ,CAAC,QAAQ,CAAC,QAAQ,CAAC;WAC3B,QAAQ,CAAC,QAAQ,CAAC,WAAW,CAAC;WAC9B,QAAQ,CAAC,QAAQ,CAAC,YAAY,CAAC;WAC/B,QAAQ,KAAK,0BAA0B;WACvC,CAAC,IAAI,KAAK,SAAS,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC;WAC3C,aAAa,CAAC,QAAQ,CAAC,CAAC;AAC/B,CAAC;AAED,SAAS,iBAAiB,CACxB,KAAc,EACd,OAAO,IAAI,OAAO,EAAU;IAE5B,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;YAAE,OAAO,SAAS,CAAC;QAChD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;QAC1B,KAAK,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YAC3E,IACE,OAAO,IAAI,KAAK,QAAQ;gBACxB,8BAA8B,CAAC,IAAI,CAAC,GAAG,CAAC;gBACxC,iBAAiB,CAAC,IAAI,CAAC,EACvB,CAAC;gBACD,OAAO,IAAI,CAAC,WAAW,EAAE,CAAC;YAC5B,CAAC;YACD,MAAM,MAAM,GAAG,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YAC7C,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAEhD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,yBAAyB,CAAC,IAAI,EAAE,CAAC;IAChE,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YACrE,IAAI,iBAAiB,CAAC,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,WAAW,EAAE,CAAC;QACjE,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,UAA2B,EAAE;IAE7B,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,wBAAwB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,MAAM,EAAE,CAAC,aAAa,CAAC;QACvB,QAAQ,CAAC,KAAK;YACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC;YACtD,IAAI,CAAC,gFAAgF,CAAC,IAAI,CAAC,QAAQ,CAAC;gBAAE,OAAO,IAAI,CAAC;YAClH,MAAM,MAAM,GAAG,iBAAiB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9C,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACzB,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,UAAU;gBAChC,MAAM,EAAE,0DAA0D,MAAM,EAAE;aAC3E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,SAAS,EAAE,KAAK;IAChB,eAAe,EAAE,IAAI;IACrB,MAAM,EAAE,KAAK;IACb,eAAe,EAAE,KAAK;CACvB,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,IAAI,OAAO,EAA4B,CAAC;AAErE,KAAK,UAAU,yBAAyB,CACtC,KAAc,EACd,OAAO,IAAI,OAAO,EAAU;IAE5B,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC;IAC1B,KAAK,IAAI,KAAK,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;QACvC,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtE,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,GAAG,CAAC,OAAiB,CAAC;YAAE,OAAO,SAAS,CAAC;QAClD,IAAI,CAAC,GAAG,CAAC,OAAiB,CAAC,CAAC;QAE5B,MAAM,SAAS,GAAG,OAAkC,CAAC;QACrD,IACE,SAAS,CAAC,IAAI,KAAK,SAAS;eACzB,SAAS,CAAC,UAAU,KAAK,SAAS;eAClC,SAAS,CAAC,QAAQ,KAAK,SAAS;eAChC,SAAS,CAAC,IAAI,KAAK,SAAS;eAC5B,SAAS,CAAC,KAAK,KAAK,SAAS;eAC7B,SAAS,CAAC,KAAK,KAAK,SAAS;eAC7B,SAAS,CAAC,KAAK,KAAK,SAAS,EAChC,CAAC;YACD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,IAAI,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QACnD,OAAO,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC;IACvC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAA+B,EAC/B,KAAc;IAEd,IAAI,QAAQ,GAAG,oBAAoB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,QAAQ,GAAG,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,oBAAoB,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC3C,QAAQ,GAAG,QAAQ,CAAC;IACtB,CAAC;IACD,IAAI,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,CAAC;IACnC,MAAM,IAAI,GAAG,KAAK,EAAE,YAAY,IAAI,GAAG,CAAC;IACxC,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,OAAO,IAAI,gCAAgC,EAAE,CAAC;AACzE,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAA2B,EAAE;IAE7B,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,wBAAwB;QAC1C,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,GAAG;QACjC,MAAM,EAAE,CAAC,aAAa,CAAC;QACvB,KAAK,CAAC,QAAQ,CAAC,KAAK;YAClB,IAAI,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,SAAS;gBAAE,OAAO,IAAI,CAAC;YAClD,IAAI,MAA2C,CAAC;YAChD,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAC9D,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,GAAG,SAAS,CAAC;YACrB,CAAC;YACD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;oBAC5B,MAAM,EAAE,oCAAoC;iBAC7C,CAAC;YACJ,CAAC;YACD,IAAI,MAAM,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7B,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;oBAC5B,MAAM,EAAE,8CAA8C;iBACvD,CAAC;YACJ,CAAC;YACD,IAAI,KAAyB,CAAC;YAC9B,IAAI,CAAC;gBACH,KAAK,GAAG,qBAAqB,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;YACrD,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;oBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;oBAC5B,MAAM,EAAE,8CAA8C;iBACvD,CAAC;YACJ,CAAC;YACD,IAAI,CAAC,KAAK;gBAAE,OAAO,IAAI,CAAC;YACxB,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;gBAC5B,MAAM,EAAE,2BAA2B,KAAK,EAAE;aAC3C,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CACpC,UAA2B,EAAE;IAE7B,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,qBAAqB;QACvC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;QAChC,MAAM,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,aAAa,EAAE,YAAY,EAAE,QAAQ,CAAC;QACtF,QAAQ,CAAC,KAAK;YACZ,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,QAAQ,CAAC;YAC/C,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;YAC3C,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;gBAAE,OAAO,IAAI,CAAC;YACtC,MAAM,QAAQ,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5C,CAAC,CAAC,GAAG,EAAE,aAAa,CAAC,EAAE,EAAE,CACvB,aAAa,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,aAAa,CAC/D,CAAC;YACF,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,UAAU;gBAChC,MAAM,EAAE,uCAAuC,QAAQ,CAAC,CAAC,CAAC,GAAG;aAC9D,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,KAAc,EAAE,KAAa,EAAE,OAAO,IAAI,OAAO,EAAU;IAClF,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IACnD,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IACvE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC;IAC3D,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;QAAE,OAAO,KAAK,GAAG,CAAC,CAAC;IAChD,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC1B,IAAI,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAClC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,CAAC;IACrD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAClD,KAAK,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,KAAK,IAAI,eAAe,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,KAAK,GAAG,KAAK;YAAE,OAAO,KAAK,CAAC;IAClC,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,OAGxC;IACC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,IAAI,SAAS,CAAC,+CAA+C,CAAC,CAAC;IACvE,CAAC;IACD,OAAO;QACL,EAAE,EAAE,OAAO,CAAC,EAAE,IAAI,uBAAuB;QACzC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,GAAG;QAC/B,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,EAAE;QAChC,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,QAAQ,CAAC,KAAK;YACZ,IAAI,eAAe,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,aAAa,CAAC,IAAI,OAAO,CAAC,aAAa;gBAAE,OAAO,IAAI,CAAC;YAC9F,OAAO;gBACL,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO;gBACjC,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,MAAM;gBAC5B,MAAM,EAAE,qBAAqB,OAAO,CAAC,aAAa,4BAA4B;aAC/E,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,kCAAkC;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,sBAAsB,EAAE;QACxB,yBAAyB,EAAE;QAC3B,gCAAgC,EAAE;QAClC,0BAA0B,EAAE;QAC5B,yBAAyB,CAAC;YACxB,EAAE,EAAE,oBAAoB;YACxB,MAAM,EAAE,CAAC,aAAa,CAAC;YACvB,MAAM,EAAE,QAAQ;SACjB,CAAC;QACF,yBAAyB,CAAC;YACxB,EAAE,EAAE,qBAAqB;YACzB,MAAM,EAAE,CAAC,YAAY,CAAC;YACtB,MAAM,EAAE,QAAQ;SACjB,CAAC;KACH,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,aAAsB;IAEtB,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,sBAAsB,EAAE;QACxB,GAAG,CAAC,aAAa,KAAK,SAAS;YAC7B,CAAC,CAAC,CAAC,wBAAwB,CAAC;oBACxB,EAAE,EAAE,sBAAsB;oBAC1B,MAAM,EAAE,CAAC,QAAQ,CAAC;oBAClB,aAAa;oBACb,MAAM,EAAE,OAAO;iBAChB,CAAC,CAAC;YACL,CAAC,CAAC,EAAE,CAAC;QACP,yBAAyB,CAAC;YACxB,EAAE,EAAE,gBAAgB;YACpB,MAAM,EAAE,CAAC,QAAQ,CAAC;YAClB,MAAM,EAAE,QAAQ;SACjB,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/dist/guardrails/engine.d.ts

@@ -0,0 +1,12 @@
+import type { RuntimeGuardrailEngineOptions, RuntimeGuardrailEvaluation, RuntimeGuardrailEvaluationInput, RuntimeGuardrailPolicy } from "./types.js";
+export declare class RuntimeGuardrailEngine {
+    private readonly policies;
+    private readonly options;
+    private sequence;
+    constructor(policies: readonly RuntimeGuardrailPolicy[], options?: RuntimeGuardrailEngineOptions);
+    evaluate<T>(input: RuntimeGuardrailEvaluationInput<T>): Promise<RuntimeGuardrailEvaluation<T>>;
+    private createId;
+    private throwIfAborted;
+    private emitDecision;
+}
+//# sourceMappingURL=engine.d.ts.map

package/dist/guardrails/engine.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../../src/guardrails/engine.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,6BAA6B,EAC7B,0BAA0B,EAC1B,+BAA+B,EAC/B,sBAAsB,EAEvB,MAAM,YAAY,CAAC;AA0FpB,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA2B;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAgC;IACxD,OAAO,CAAC,QAAQ,CAAK;gBAGnB,QAAQ,EAAE,SAAS,sBAAsB,EAAE,EAC3C,OAAO,GAAE,6BAAkC;IASvC,QAAQ,CAAC,CAAC,EACd,KAAK,EAAE,+BAA+B,CAAC,CAAC,CAAC,GACxC,OAAO,CAAC,0BAA0B,CAAC,CAAC,CAAC,CAAC;IAsEzC,OAAO,CAAC,QAAQ;IAIhB,OAAO,CAAC,cAAc;YAOR,YAAY;CAyB3B"}

package/dist/guardrails/engine.js

@@ -0,0 +1,189 @@
+import { GuardrailAbortedError } from "./errors.js";
+const VALID_ACTIONS = new Set([
+    "allow",
+    "audit",
+    "taint",
+    "redact",
+    "rewrite",
+    "block",
+    "approval",
+]);
+const VALID_RISKS = new Set([
+    "none",
+    "low",
+    "medium",
+    "high",
+    "critical",
+]);
+function cloneValue(value, seen = new WeakMap()) {
+    if (value === null || typeof value !== "object")
+        return value;
+    const existing = seen.get(value);
+    if (existing !== undefined)
+        return existing;
+    if (Array.isArray(value)) {
+        const clone = [];
+        seen.set(value, clone);
+        for (const item of value)
+            clone.push(cloneValue(item, seen));
+        return clone;
+    }
+    if (value instanceof Date)
+        return new Date(value.getTime());
+    const clone = {};
+    seen.set(value, clone);
+    for (const [key, entry] of Object.entries(value)) {
+        clone[key] = cloneValue(entry, seen);
+    }
+    return clone;
+}
+function freezeValue(value, seen = new WeakSet()) {
+    if (value === null || typeof value !== "object" || seen.has(value))
+        return value;
+    seen.add(value);
+    for (const entry of Object.values(value))
+        freezeValue(entry, seen);
+    return Object.freeze(value);
+}
+function freezeEvaluation(value, decisions, terminalAction) {
+    const frozenDecisions = Object.freeze(decisions.map((decision) => Object.freeze(decision)));
+    return Object.freeze({
+        value: freezeValue(value),
+        decisions: frozenDecisions,
+        ...(terminalAction ? { terminalAction } : {}),
+    });
+}
+function assertPolicyResult(policy, result) {
+    if (!VALID_ACTIONS.has(result.action)) {
+        throw new Error(`Policy "${policy.id}" returned an invalid action`);
+    }
+    if (!VALID_RISKS.has(result.risk)) {
+        throw new Error(`Policy "${policy.id}" returned an invalid risk`);
+    }
+    if (typeof result.reason !== "string" || result.reason.trim().length === 0) {
+        throw new Error(`Policy "${policy.id}" returned an empty reason`);
+    }
+    if ((result.action === "redact" || result.action === "rewrite") &&
+        !Object.prototype.hasOwnProperty.call(result, "value")) {
+        throw new Error(`Policy "${policy.id}" must return a value for ${result.action}`);
+    }
+}
+function defaultPolicyFailure(input, options) {
+    if (input.tool?.sideEffect === "read" && options.readOnlyPolicyFailure !== "block") {
+        return { action: "audit", risk: "medium" };
+    }
+    return { action: "block", risk: "high" };
+}
+export class RuntimeGuardrailEngine {
+    policies;
+    options;
+    sequence = 0;
+    constructor(policies, options = {}) {
+        this.policies = policies
+            .map((policy, index) => ({ policy, index }))
+            .sort((a, b) => (a.policy.priority ?? 100) - (b.policy.priority ?? 100) || a.index - b.index)
+            .map(({ policy }) => policy);
+        this.options = options;
+    }
+    async evaluate(input) {
+        this.throwIfAborted(input.signal);
+        let value = freezeValue(cloneValue(input.value));
+        const decisions = [];
+        for (const policy of this.policies) {
+            if (!policy.phases.includes(input.phase))
+                continue;
+            this.throwIfAborted(input.signal, decisions);
+            const startedAt = (this.options.now ?? Date.now)();
+            let result;
+            let failure;
+            try {
+                result = await policy.evaluate(Object.freeze({
+                    ...input,
+                    value,
+                }));
+                this.throwIfAborted(input.signal, decisions);
+                if (result)
+                    assertPolicyResult(policy, result);
+            }
+            catch (error) {
+                if (error instanceof GuardrailAbortedError)
+                    throw error;
+                failure = error;
+                result = null;
+            }
+            const latencyMs = Math.max(0, (this.options.now ?? Date.now)() - startedAt);
+            let decision;
+            if (failure) {
+                const fallback = defaultPolicyFailure(input, this.options);
+                decision = {
+                    id: this.createId(),
+                    policyId: policy.id,
+                    ...(policy.version ? { policyVersion: policy.version } : {}),
+                    phase: input.phase,
+                    action: fallback.action,
+                    risk: fallback.risk,
+                    reason: "Policy evaluation failed",
+                    latencyMs,
+                    fallbackUsed: true,
+                };
+            }
+            else if (result) {
+                decision = {
+                    id: this.createId(),
+                    policyId: policy.id,
+                    ...(policy.version ? { policyVersion: policy.version } : {}),
+                    phase: input.phase,
+                    action: result.action,
+                    risk: result.risk,
+                    reason: result.reason.trim(),
+                    latencyMs,
+                    fallbackUsed: result.fallbackUsed ?? false,
+                };
+                if (result.action === "redact" || result.action === "rewrite") {
+                    value = freezeValue(cloneValue(result.value));
+                }
+            }
+            if (!decision)
+                continue;
+            const frozenDecision = Object.freeze(decision);
+            decisions.push(frozenDecision);
+            await this.emitDecision(frozenDecision, input);
+            this.throwIfAborted(input.signal, decisions);
+            if (decision.action === "block" || decision.action === "approval") {
+                return freezeEvaluation(value, decisions, decision.action);
+            }
+        }
+        return freezeEvaluation(value, decisions);
+    }
+    createId() {
+        return this.options.createId?.() ?? `guardrail-${++this.sequence}`;
+    }
+    throwIfAborted(signal, decisions = []) {
+        if (signal?.aborted)
+            throw new GuardrailAbortedError(undefined, decisions);
+    }
+    async emitDecision(decision, input) {
+        try {
+            await this.options.onDecision?.(Object.freeze({
+                decision,
+                context: input.context,
+                ...(input.tool
+                    ? {
+                        tool: Object.freeze({
+                            name: input.tool.name,
+                            callId: input.tool.callId,
+                            sideEffect: input.tool.sideEffect,
+                        }),
+                    }
+                    : {}),
+                ...(input.outputTruncated !== undefined
+                    ? { outputTruncated: input.outputTruncated }
+                    : {}),
+            }));
+        }
+        catch {
+            // Audit sinks are observational and cannot change enforcement.
+        }
+    }
+}
+//# sourceMappingURL=engine.js.map

package/dist/guardrails/engine.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"engine.js","sourceRoot":"","sources":["../../src/guardrails/engine.ts"],"names":[],"mappings":"AAKA,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AASpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAyB;IACpD,OAAO;IACP,OAAO;IACP,OAAO;IACP,QAAQ;IACR,SAAS;IACT,OAAO;IACP,UAAU;CACX,CAAC,CAAC;AAEH,MAAM,WAAW,GAAG,IAAI,GAAG,CAAuB;IAChD,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,UAAU;CACX,CAAC,CAAC;AAEH,SAAS,UAAU,CAAI,KAAQ,EAAE,OAAO,IAAI,OAAO,EAAmB;IACpE,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAa,CAAC;IACjD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,KAAK,GAAc,EAAE,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;QACvB,KAAK,MAAM,IAAI,IAAI,KAAK;YAAE,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7D,OAAO,KAAU,CAAC;IACpB,CAAC;IACD,IAAI,KAAK,YAAY,IAAI;QAAE,OAAO,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAM,CAAC;IACjE,MAAM,KAAK,GAA4B,EAAE,CAAC;IAC1C,IAAI,CAAC,GAAG,CAAC,KAAe,EAAE,KAAK,CAAC,CAAC;IACjC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,KAAK,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvC,CAAC;IACD,OAAO,KAAU,CAAC;AACpB,CAAC;AAED,SAAS,WAAW,CAAI,KAAQ,EAAE,OAAO,IAAI,OAAO,EAAU;IAC5D,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3F,IAAI,CAAC,GAAG,CAAC,KAAe,CAAC,CAAC;IAC1B,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;QAAE,WAAW,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,SAAS,gBAAgB,CACvB,KAAQ,EACR,SAAqC,EACrC,cAAqC;IAErC,MAAM,eAAe,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAC5F,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,KAAK,EAAE,WAAW,CAAC,KAAK,CAAC;QACzB,SAAS,EAAE,eAAe;QAC1B,GAAG,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;AACL,CAAC;AAED,SAAS,kBAAkB,CACzB,MAAiC,EACjC,MAAuC;IAEvC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,8BAA8B,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,4BAA4B,CAAC,CAAC;IACpE,CAAC;IACD,IACE,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;QAC3D,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EACtD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,EAAE,6BAA6B,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAAsC,EACtC,OAAsC;IAEtC,IAAI,KAAK,CAAC,IAAI,EAAE,UAAU,KAAK,MAAM,IAAI,OAAO,CAAC,qBAAqB,KAAK,OAAO,EAAE,CAAC;QACnF,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC7C,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,OAAO,sBAAsB;IAChB,QAAQ,CAA2B;IACnC,OAAO,CAAgC;IAChD,QAAQ,GAAG,CAAC,CAAC;IAErB,YACE,QAA2C,EAC3C,UAAyC,EAAE;QAE3C,IAAI,CAAC,QAAQ,GAAG,QAAQ;aACrB,GAAG,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;aAC3C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;aAC5F,GAAG,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,QAAQ,CACZ,KAAyC;QAEzC,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAClC,IAAI,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QACjD,MAAM,SAAS,GAA+B,EAAE,CAAC;QAEjD,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,SAAS;YACnD,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,MAAM,SAAS,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACnD,IAAI,MAA8C,CAAC;YACnD,IAAI,OAAgB,CAAC;YAErB,IAAI,CAAC;gBACH,MAAM,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;oBAC3C,GAAG,KAAK;oBACR,KAAK;iBACN,CAAC,CAA2C,CAAC;gBAC9C,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;gBAC7C,IAAI,MAAM;oBAAE,kBAAkB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YACjD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,qBAAqB;oBAAE,MAAM,KAAK,CAAC;gBACxD,OAAO,GAAG,KAAK,CAAC;gBAChB,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;YAED,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC;YAC5E,IAAI,QAA8C,CAAC;YACnD,IAAI,OAAO,EAAE,CAAC;gBACZ,MAAM,QAAQ,GAAG,oBAAoB,CAAC,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;gBAC3D,QAAQ,GAAG;oBACT,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;oBACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,QAAQ,CAAC,MAAM;oBACvB,IAAI,EAAE,QAAQ,CAAC,IAAI;oBACnB,MAAM,EAAE,0BAA0B;oBAClC,SAAS;oBACT,YAAY,EAAE,IAAI;iBACnB,CAAC;YACJ,CAAC;iBAAM,IAAI,MAAM,EAAE,CAAC;gBAClB,QAAQ,GAAG;oBACT,EAAE,EAAE,IAAI,CAAC,QAAQ,EAAE;oBACnB,QAAQ,EAAE,MAAM,CAAC,EAAE;oBACnB,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC5D,KAAK,EAAE,KAAK,CAAC,KAAK;oBAClB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;oBAC5B,SAAS;oBACT,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,KAAK;iBAC3C,CAAC;gBACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;oBAC9D,KAAK,GAAG,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,KAAU,CAAC,CAAC,CAAC;gBACrD,CAAC;YACH,CAAC;YAED,IAAI,CAAC,QAAQ;gBAAE,SAAS;YACxB,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC/C,SAAS,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAC/B,MAAM,IAAI,CAAC,YAAY,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;YAC/C,IAAI,CAAC,cAAc,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;YAC7C,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,IAAI,QAAQ,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;gBAClE,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;QAED,OAAO,gBAAgB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAEO,QAAQ;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,IAAI,aAAa,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC;IACrE,CAAC;IAEO,cAAc,CACpB,MAAoB,EACpB,YAAiD,EAAE;QAEnD,IAAI,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,qBAAqB,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC7E,CAAC;IAEO,KAAK,CAAC,YAAY,CACxB,QAAkC,EAClC,KAAsC;QAEtC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC5C,QAAQ;gBACR,OAAO,EAAE,KAAK,CAAC,OAAO;gBACtB,GAAG,CAAC,KAAK,CAAC,IAAI;oBACZ,CAAC,CAAC;wBACE,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;4BAClB,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI;4BACrB,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,MAAM;4BACzB,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,UAAU;yBAClC,CAAC;qBACH;oBACH,CAAC,CAAC,EAAE,CAAC;gBACP,GAAG,CAAC,KAAK,CAAC,eAAe,KAAK,SAAS;oBACrC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,CAAC,eAAe,EAAE;oBAC5C,CAAC,CAAC,EAAE,CAAC;aACR,CAAC,CAAC,CAAC;QACN,CAAC;QAAC,MAAM,CAAC;YACP,+DAA+D;QACjE,CAAC;IACH,CAAC;CACF"}