@princeverma130104/agentguard 1.0.0 → 1.0.2

package/dist/middleware.js

@@ -10,20 +10,20 @@ exports.createRequestMiddleware = createRequestMiddleware;
 exports.createResponseMiddleware = createResponseMiddleware;
 exports.createGuardMiddleware = createGuardMiddleware;
 const guard_1 = require("./guard");
+const sessionIdsByRequest = new WeakMap();
 /**
  * Creates an Express-compatible middleware that:
  * 1. Reads the raw request body
  * 2. Applies AgentGuard anonymization to any string fields
- * 3. Attaches the session ID to the request for downstream deanonymization
+ * 3. Keeps the session ID private for paired response restoration
  */
 function createRequestMiddleware(guard) {
-    return async (req, res, next) => {
+    return async (req, _res, next) => {
         try {
-            if (req.body && typeof req.body === 'object') {
-                const { sanitized, sessionId } = await anonymizeObject(req.body, guard);
-                req.body = sanitized;
-                req.agentGuardSessionId = sessionId;
-                res.agentGuardSessionId = sessionId;
+            if (req.body !== undefined) {
+                const result = await guard.anonymizeObject(req.body);
+                req.body = result.sanitizedValue;
+                sessionIdsByRequest.set(req, result.sessionId);
             }
             next();
         }
@@ -38,7 +38,7 @@ function createRequestMiddleware(guard) {
  */
 function createResponseMiddleware(guard) {
     return async (req, res, next) => {
-        const sessionId = req.agentGuardSessionId;
+        const sessionId = sessionIdsByRequest.get(req);
         if (!sessionId) {
             next();
             return;
@@ -46,9 +46,10 @@ function createResponseMiddleware(guard) {
         if (typeof res.json === 'function') {
             const originalJson = res.json.bind(res);
             res.json = function (body) {
-                deanonymizeObject(body, guard, sessionId)
+                guard.deanonymizeObject(body, sessionId)
                     .then((restored) => originalJson(restored))
-                    .catch(() => originalJson(body));
+                    .catch((err) => next(err))
+                    .finally(() => sessionIdsByRequest.delete(req));
                 return res;
             };
         }
@@ -61,45 +62,9 @@ function createResponseMiddleware(guard) {
  */
 function createGuardMiddleware(options) {
     const guard = new guard_1.AgentGuard(options);
-    return [
+    return Object.assign([
         createRequestMiddleware(guard),
         createResponseMiddleware(guard),
-    ];
-}
-// ─── Helpers ─────────────────────────────────────────────────────────────────
-async function anonymizeObject(obj, guard, sessionId) {
-    let activeSession = sessionId;
-    const sanitized = {};
-    for (const [key, value] of Object.entries(obj)) {
-        if (typeof value === 'string') {
-            const result = await guard.anonymize(value, activeSession);
-            activeSession = result.sessionId;
-            sanitized[key] = result.sanitizedText;
-        }
-        else if (typeof value === 'object' && value !== null) {
-            const nested = await anonymizeObject(value, guard, activeSession);
-            activeSession = nested.sessionId;
-            sanitized[key] = nested.sanitized;
-        }
-        else {
-            sanitized[key] = value;
-        }
-    }
-    return { sanitized, sessionId: activeSession };
-}
-async function deanonymizeObject(obj, guard, sessionId) {
-    const restored = {};
-    for (const [key, value] of Object.entries(obj)) {
-        if (typeof value === 'string') {
-            restored[key] = await guard.deanonymize(value, sessionId);
-        }
-        else if (typeof value === 'object' && value !== null) {
-            restored[key] = await deanonymizeObject(value, guard, sessionId);
-        }
-        else {
-            restored[key] = value;
-        }
-    }
-    return restored;
+    ], { guard, close: () => guard.close() });
 }
 //# sourceMappingURL=middleware.js.map

package/dist/middleware.js.map

@@ -1 +1 @@
-{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAwBH,0DAkBC;AAMD,4DAwBC;AAMD,sDAMC;AAjFD,mCAAmD;AAenD;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAAiB;IACvD,OAAO,KAAK,EACV,GAAiB,EACjB,GAAkB,EAClB,IAAkB,EACH,EAAE;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC7C,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,GAAG,MAAM,eAAe,CAAC,GAAG,CAAC,IAA+B,EAAE,KAAK,CAAC,CAAC;gBACnG,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC;gBACrB,GAAG,CAAC,mBAAmB,GAAG,SAAS,CAAC;gBACpC,GAAG,CAAC,mBAAmB,GAAG,SAAS,CAAC;YACtC,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,KAAiB;IACxD,OAAO,KAAK,EACV,GAAiB,EACjB,GAAkB,EAClB,IAAkB,EACH,EAAE;QACjB,MAAM,SAAS,GAAG,GAAG,CAAC,mBAAmB,CAAC;QAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,GAAG,CAAC,IAAI,GAAG,UAAS,IAAa;gBAC/B,iBAAiB,CAAC,IAA+B,EAAE,KAAK,EAAE,SAAS,CAAC;qBACjE,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;qBAC1C,KAAK,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnC,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,KAAK,GAAG,IAAI,kBAAU,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO;QACL,uBAAuB,CAAC,KAAK,CAAC;QAC9B,wBAAwB,CAAC,KAAK,CAAC;KAChC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAEhF,KAAK,UAAU,eAAe,CAC5B,GAA4B,EAC5B,KAAiB,EACjB,SAAkB;IAElB,IAAI,aAAa,GAAG,SAAS,CAAC;IAC9B,MAAM,SAAS,GAA4B,EAAE,CAAC;IAE9C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;YAC3D,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC;YACjC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,aAAa,CAAC;QACxC,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvD,MAAM,MAAM,GAAG,MAAM,eAAe,CAAC,KAAgC,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;YAC7F,aAAa,GAAG,MAAM,CAAC,SAAS,CAAC;YACjC,SAAS,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC;QACpC,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,aAAc,EAAE,CAAC;AAClD,CAAC;AAED,KAAK,UAAU,iBAAiB,CAC9B,GAA4B,EAC5B,KAAiB,EACjB,SAAiB;IAEjB,MAAM,QAAQ,GAA4B,EAAE,CAAC;IAE7C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QAC5D,CAAC;aAAM,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACvD,QAAQ,CAAC,GAAG,CAAC,GAAG,MAAM,iBAAiB,CAAC,KAAgC,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC;QAC9F,CAAC;aAAM,CAAC;YACN,QAAQ,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"middleware.js","sourceRoot":"","sources":["../src/middleware.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AAgCH,0DAiBC;AAMD,4DAyBC;AAMD,sDAYC;AA/FD,mCAAmD;AAanD,MAAM,mBAAmB,GAAG,IAAI,OAAO,EAAwB,CAAC;AAUhE;;;;;GAKG;AACH,SAAgB,uBAAuB,CAAC,KAAiB;IACvD,OAAO,KAAK,EACV,GAAiB,EACjB,IAAmB,EACnB,IAAkB,EACH,EAAE;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;gBAC3B,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrD,GAAG,CAAC,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC;gBACjC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;YACjD,CAAC;YACD,IAAI,EAAE,CAAC;QACT,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,GAAG,CAAC,CAAC;QACZ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,wBAAwB,CAAC,KAAiB;IACxD,OAAO,KAAK,EACV,GAAiB,EACjB,GAAkB,EAClB,IAAkB,EACH,EAAE;QACjB,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,EAAE,CAAC;YACP,OAAO;QACT,CAAC;QAED,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YACnC,MAAM,YAAY,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxC,GAAG,CAAC,IAAI,GAAG,UAAS,IAAa;gBAC/B,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,SAAS,CAAC;qBACrC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;qBAC1C,KAAK,CAAC,CAAC,GAAY,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;qBAClC,OAAO,CAAC,GAAG,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;gBAClD,OAAO,GAAG,CAAC;YACb,CAAC,CAAC;QACJ,CAAC;QAED,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,SAAgB,qBAAqB,CAAC,OAAsB;IAC1D,MAAM,KAAK,GAAG,IAAI,kBAAU,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,MAAM,CAAC,MAAM,CAClB;QACE,uBAAuB,CAAC,KAAK,CAAC;QAC9B,wBAAwB,CAAC,KAAK,CAAC;KAIhC,EACD,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CACtC,CAAC;AACJ,CAAC"}

package/dist/scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAmC,MAAM,YAAY,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,UAAU,CAAC;IACjB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,sCAAsC;IACtC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,MAAM,CAAC,CAAM,GAC7D,UAAU,CAyCZ;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAQ/E"}
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,UAAU,EAAmC,MAAM,YAAY,CAAC;AAEzE,MAAM,WAAW,cAAc;IAC7B,uDAAuD;IACvD,IAAI,EAAE,UAAU,CAAC;IACjB,6DAA6D;IAC7D,KAAK,EAAE,MAAM,CAAC;IACd,oEAAoE;IACpE,UAAU,EAAE,MAAM,CAAC;IACnB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,UAAU;IACzB,6DAA6D;IAC7D,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,sCAAsC;IACtC,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED;;;;GAIG;AACH,wBAAgB,QAAQ,CACtB,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,MAAM,CAAC,CAAM,GAC7D,UAAU,CAiDZ;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,GAAG,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAQ/E"}

package/dist/scanner.js

@@ -22,12 +22,21 @@ function scanText(text, customPatterns = {}) {
         if (!pattern.global) {
             throw new Error(`Custom ${key} pattern must use the global flag.`);
         }
+        pattern.lastIndex = 0;
         let match;
         while ((match = pattern.exec(text)) !== null) {
+            if (match[0].length === 0) {
+                if (pattern.lastIndex >= text.length)
+                    break;
+                pattern.lastIndex = match.index + 1;
+                continue;
+            }
             const start = match.index;
             // For NAME pattern, capture group 1 contains the name
-            const value = match[1] ?? match[0];
-            const actualStart = match[1] ? text.indexOf(match[1], start) : start;
+            const value = match[1] !== undefined ? match[1] : match[0];
+            if (value.length === 0)
+                continue;
+            const actualStart = match[1] !== undefined ? text.indexOf(match[1], start) : start;
             const end = actualStart + value.length;
             // Skip if this range is already covered by a higher-priority match
             const overlaps = coveredRanges.some(([cs, ce]) => actualStart < ce && end > cs);

package/dist/scanner.js.map

@@ -1 +1 @@
-{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA2BH,4BA4CC;AAKD,kDAQC;AAlFD,yCAAyE;AAoBzE;;;;GAIG;AACH,SAAgB,QAAQ,CACtB,IAAY,EACZ,iBAA4D,EAAE;IAE9D,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,aAAa,GAA4B,EAAE,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,wBAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,2BAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,oCAAoC,CAAC,CAAC;QACrE,CAAC;QACD,IAAI,KAA6B,CAAC;QAElC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,sDAAsD;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;YACnC,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACrE,MAAM,GAAG,GAAG,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;YAEvC,mEAAmE;YACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,CAC3C,CAAC;YACF,IAAI,QAAQ;gBAAE,SAAS;YAEvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,KAAK;gBACL,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAErD,OAAO;QACL,QAAQ;QACR,gBAAgB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"scanner.js","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;AA2BH,4BAoDC;AAKD,kDAQC;AA1FD,yCAAyE;AAoBzE;;;;GAIG;AACH,SAAgB,QAAQ,CACtB,IAAY,EACZ,iBAA4D,EAAE;IAE9D,MAAM,QAAQ,GAAqB,EAAE,CAAC;IACtC,MAAM,aAAa,GAA4B,EAAE,CAAC;IAElD,KAAK,MAAM,GAAG,IAAI,wBAAa,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,cAAc,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,2BAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QACnE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,UAAU,GAAG,oCAAoC,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,IAAI,KAA6B,CAAC;QAElC,OAAO,CAAC,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7C,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,MAAM;oBAAE,MAAM;gBAC5C,OAAO,CAAC,SAAS,GAAG,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC;gBACpC,SAAS;YACX,CAAC;YACD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC;YAC1B,sDAAsD;YACtD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAC3D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAS;YACjC,MAAM,WAAW,GACf,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;YACjE,MAAM,GAAG,GAAG,WAAW,GAAG,KAAK,CAAC,MAAM,CAAC;YAEvC,mEAAmE;YACnE,MAAM,QAAQ,GAAG,aAAa,CAAC,IAAI,CACjC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC,WAAW,GAAG,EAAE,IAAI,GAAG,GAAG,EAAE,CAC3C,CAAC;YACF,IAAI,QAAQ;gBAAE,SAAS;YAEvB,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,GAAG;gBACT,KAAK;gBACL,UAAU,EAAE,WAAW;gBACvB,QAAQ,EAAE,GAAG;aACd,CAAC,CAAC;YACH,aAAa,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QACzC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAErD,OAAO;QACL,QAAQ;QACR,gBAAgB,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;KACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAgB,mBAAmB,CAAC,MAAkB;IACpD,MAAM,GAAG,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC1C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACrC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/vault.d.ts

@@ -1,32 +1,49 @@
 /**
  * @file vault.ts
- * @description Redis-backed ephemeral token vault.
+ * @description Redis-backed TTL-expiring token vault.
  * Manages bidirectional (token ↔ rawValue) session mappings with TTL enforcement.
- * Raw PII is NEVER written to disk — all data lives in Redis in-memory store only.
+ * Redis persistence and encryption are controlled by the Redis deployment.
  */
 export interface VaultOptions {
     /** Redis connection URL. Defaults to redis://localhost:6379 */
     redisUrl?: string;
     /** TTL in seconds for session data. Defaults to 900 (15 minutes). */
     ttlSeconds?: number;
+    /** Maximum distinct values stored per session. Defaults to 10,000. */
+    maxTokensPerSession?: number;
+    /** Optional 32-byte hex key for AES-256-GCM vault encryption. */
+    vaultEncryptionKey?: string;
 }
 export declare class TokenVault {
     private readonly redis;
+    private readonly encryptionKey?;
+    private readonly indexKey?;
     readonly ttl: number;
+    readonly maxTokensPerSession: number;
     constructor(options?: VaultOptions);
     /** Returns the Redis key for the forward vault (token → rawValue) */
     private vaultKey;
     /** Returns the Redis key for the reverse index (rawValue → token) */
     private reverseKey;
+    private counterKey;
+    private encodeSessionId;
     /**
      * Stores a token → rawValue mapping for the given session.
      * Also stores the reverse mapping for deduplication lookups.
      * Refreshes TTL on every write.
      */
     store(sessionId: string, token: string, rawValue: string): Promise<void>;
+    /**
+     * Atomically reuses an existing token or allocates a new per-type token.
+     * Prevents concurrent requests from assigning the same token to different values.
+     */
+    getOrStore(sessionId: string, entityType: string, rawValue: string): Promise<{
+        token: string;
+        created: boolean;
+    }>;
     /**
      * Looks up the existing token for a given rawValue in a session.
-     * Returns undefined if not found (i.e., first occurrence of this value).
+     * Returns null if not found (i.e., first occurrence of this value).
      */
     lookupToken(sessionId: string, rawValue: string): Promise<string | null>;
     /**
@@ -47,5 +64,8 @@ export declare class TokenVault {
      * Gracefully closes the Redis connection.
      */
     close(): Promise<void>;
+    private valueDigest;
+    private encodeValue;
+    private decodeValue;
 }
 //# sourceMappingURL=vault.d.ts.map

package/dist/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;gBAET,OAAO,GAAE,YAAiB;IAUtC,qEAAqE;IACrE,OAAO,CAAC,QAAQ;IAIhB,qEAAqE;IACrE,OAAO,CAAC,UAAU;IAIlB;;;;OAIG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAS9E;;;OAGG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI9E;;;OAGG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAIlE;;;OAGG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAItD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAS9B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;CAG7B"}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAKH,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,qEAAqE;IACrE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sEAAsE;IACtE,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,iEAAiE;IACjE,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAuDD,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAQ;IAC9B,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAS;IACnC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,mBAAmB,EAAE,MAAM,CAAC;gBAEzB,OAAO,GAAE,YAAiB;IA+CtC,qEAAqE;IACrE,OAAO,CAAC,QAAQ;IAIhB,qEAAqE;IACrE,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,UAAU;IAIlB,OAAO,CAAC,eAAe;IAOvB;;;;OAIG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAkB9E;;;OAGG;IACG,UAAU,CACd,SAAS,EAAE,MAAM,EACjB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC;IAyB/C;;;OAGG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAI9E;;;OAGG;IACG,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAUlE;;;OAGG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAQtD;;OAEG;IACG,IAAI,IAAI,OAAO,CAAC,OAAO,CAAC;IAS9B;;OAEG;IACG,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC;IAI5B,OAAO,CAAC,WAAW;IAKnB,OAAO,CAAC,WAAW;IAenB,OAAO,CAAC,WAAW;CA4BpB"}

package/dist/vault.js

@@ -1,33 +1,126 @@
 "use strict";
 /**
  * @file vault.ts
- * @description Redis-backed ephemeral token vault.
+ * @description Redis-backed TTL-expiring token vault.
  * Manages bidirectional (token ↔ rawValue) session mappings with TTL enforcement.
- * Raw PII is NEVER written to disk — all data lives in Redis in-memory store only.
+ * Redis persistence and encryption are controlled by the Redis deployment.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenVault = void 0;
+const crypto_1 = require("crypto");
 const ioredis_1 = __importDefault(require("ioredis"));
+const STORE_SCRIPT = `
+local existingToken = redis.call('HGET', KEYS[2], ARGV[2])
+local existingValue = redis.call('HGET', KEYS[1], ARGV[1])
+if not existingToken and not existingValue and redis.call('HLEN', KEYS[1]) >= tonumber(ARGV[5]) then
+  return redis.error_reply('AGENTGUARD_SESSION_TOKEN_LIMIT')
+end
+
+if existingValue then
+  local mappings = redis.call('HGETALL', KEYS[2])
+  for i = 1, #mappings, 2 do
+    if mappings[i + 1] == ARGV[1] and mappings[i] ~= ARGV[2] then
+      redis.call('HDEL', KEYS[2], mappings[i])
+    end
+  end
+end
+if existingToken and existingToken ~= ARGV[1] then
+  redis.call('HDEL', KEYS[1], existingToken)
+end
+redis.call('HSET', KEYS[1], ARGV[1], ARGV[3])
+redis.call('HSET', KEYS[2], ARGV[2], ARGV[1])
+redis.call('EXPIRE', KEYS[1], ARGV[4])
+redis.call('EXPIRE', KEYS[2], ARGV[4])
+redis.call('EXPIRE', KEYS[3], ARGV[4])
+return 1
+`;
+const GET_OR_STORE_SCRIPT = `
+local existing = redis.call('HGET', KEYS[2], ARGV[2])
+if existing then
+  redis.call('EXPIRE', KEYS[1], ARGV[4])
+  redis.call('EXPIRE', KEYS[2], ARGV[4])
+  redis.call('EXPIRE', KEYS[3], ARGV[4])
+  return { existing, 0 }
+end
+
+if redis.call('HLEN', KEYS[1]) >= tonumber(ARGV[5]) then
+  return redis.error_reply('AGENTGUARD_SESSION_TOKEN_LIMIT')
+end
+
+local sequence = redis.call('HINCRBY', KEYS[3], ARGV[1], 1)
+local token = '[' .. ARGV[1] .. '_' .. sequence .. ']'
+while redis.call('HEXISTS', KEYS[1], token) == 1 do
+  sequence = redis.call('HINCRBY', KEYS[3], ARGV[1], 1)
+  token = '[' .. ARGV[1] .. '_' .. sequence .. ']'
+end
+redis.call('HSET', KEYS[1], token, ARGV[3])
+redis.call('HSET', KEYS[2], ARGV[2], token)
+redis.call('EXPIRE', KEYS[1], ARGV[4])
+redis.call('EXPIRE', KEYS[2], ARGV[4])
+redis.call('EXPIRE', KEYS[3], ARGV[4])
+return { token, 1 }
+`;
 class TokenVault {
     constructor(options = {}) {
-        this.redis = new ioredis_1.default(options.redisUrl || 'redis://localhost:6379', {
+        this.ttl = options.ttlSeconds ?? 900;
+        if (!Number.isSafeInteger(this.ttl) || this.ttl <= 0) {
+            throw new RangeError('ttlSeconds must be a positive safe integer.');
+        }
+        this.maxTokensPerSession = options.maxTokensPerSession ?? 10000;
+        if (!Number.isSafeInteger(this.maxTokensPerSession) || this.maxTokensPerSession <= 0) {
+            throw new RangeError('maxTokensPerSession must be a positive safe integer.');
+        }
+        if (options.vaultEncryptionKey !== undefined &&
+            !/^[a-fA-F0-9]{64}$/.test(options.vaultEncryptionKey)) {
+            throw new TypeError('vaultEncryptionKey must be exactly 64 hexadecimal characters.');
+        }
+        if (options.vaultEncryptionKey) {
+            const masterKey = Buffer.from(options.vaultEncryptionKey, 'hex');
+            this.encryptionKey = (0, crypto_1.createHmac)('sha256', masterKey)
+                .update('agentguard:vault-encryption')
+                .digest();
+            this.indexKey = (0, crypto_1.createHmac)('sha256', masterKey)
+                .update('agentguard:vault-index')
+                .digest();
+        }
+        const redisUrl = options.redisUrl ?? 'redis://localhost:6379';
+        let parsedRedisUrl;
+        try {
+            parsedRedisUrl = new URL(redisUrl);
+        }
+        catch {
+            throw new TypeError('redisUrl must be a valid redis:// or rediss:// URL.');
+        }
+        if ((parsedRedisUrl.protocol !== 'redis:' && parsedRedisUrl.protocol !== 'rediss:') ||
+            !parsedRedisUrl.hostname) {
+            throw new TypeError('redisUrl must be a valid redis:// or rediss:// URL.');
+        }
+        this.redis = new ioredis_1.default(redisUrl, {
             lazyConnect: true,
             maxRetriesPerRequest: 3,
             enableReadyCheck: true,
             retryStrategy: (times) => Math.min(times * 100, 3000),
         });
-        this.ttl = options.ttlSeconds ?? 900;
     }
     /** Returns the Redis key for the forward vault (token → rawValue) */
     vaultKey(sessionId) {
-        return `agentguard:session:${sessionId}:vault`;
+        return `agentguard:session:${this.encodeSessionId(sessionId)}:vault`;
     }
     /** Returns the Redis key for the reverse index (rawValue → token) */
     reverseKey(sessionId) {
-        return `agentguard:session:${sessionId}:reverse`;
+        return `agentguard:session:${this.encodeSessionId(sessionId)}:reverse`;
+    }
+    counterKey(sessionId) {
+        return `agentguard:session:${this.encodeSessionId(sessionId)}:counters`;
+    }
+    encodeSessionId(sessionId) {
+        if (typeof sessionId !== 'string' || sessionId.length === 0 || sessionId.length > 512) {
+            throw new TypeError('sessionId must be a non-empty string of at most 512 characters.');
+        }
+        return Buffer.from(sessionId, 'utf8').toString('base64url');
     }
     /**
      * Stores a token → rawValue mapping for the given session.
@@ -35,33 +128,49 @@ class TokenVault {
      * Refreshes TTL on every write.
      */
     async store(sessionId, token, rawValue) {
-        const pipeline = this.redis.pipeline();
-        pipeline.hset(this.vaultKey(sessionId), token, rawValue);
-        pipeline.hset(this.reverseKey(sessionId), rawValue, token);
-        pipeline.expire(this.vaultKey(sessionId), this.ttl);
-        pipeline.expire(this.reverseKey(sessionId), this.ttl);
-        await pipeline.exec();
+        const result = await this.redis.eval(STORE_SCRIPT, 3, this.vaultKey(sessionId), this.reverseKey(sessionId), this.counterKey(sessionId), token, this.valueDigest(rawValue), this.encodeValue(rawValue, sessionId), String(this.ttl), String(this.maxTokensPerSession));
+        if (result !== 1) {
+            throw new Error('Failed to store the vault mapping in Redis.');
+        }
+    }
+    /**
+     * Atomically reuses an existing token or allocates a new per-type token.
+     * Prevents concurrent requests from assigning the same token to different values.
+     */
+    async getOrStore(sessionId, entityType, rawValue) {
+        if (!/^[A-Z_]+$/.test(entityType)) {
+            throw new TypeError('entityType must contain uppercase letters and underscores only.');
+        }
+        const result = (await this.redis.eval(GET_OR_STORE_SCRIPT, 3, this.vaultKey(sessionId), this.reverseKey(sessionId), this.counterKey(sessionId), entityType, this.valueDigest(rawValue), this.encodeValue(rawValue, sessionId), String(this.ttl), String(this.maxTokensPerSession)));
+        if (!result || typeof result[0] !== 'string') {
+            throw new Error('Failed to atomically store the vault mapping in Redis.');
+        }
+        return { token: result[0], created: Number(result[1]) === 1 };
     }
     /**
      * Looks up the existing token for a given rawValue in a session.
-     * Returns undefined if not found (i.e., first occurrence of this value).
+     * Returns null if not found (i.e., first occurrence of this value).
      */
     async lookupToken(sessionId, rawValue) {
-        return this.redis.hget(this.reverseKey(sessionId), rawValue);
+        return this.redis.hget(this.reverseKey(sessionId), this.valueDigest(rawValue));
     }
     /**
      * Retrieves the full vault map (token → rawValue) for a session.
      * Returns an empty object if the session has expired or doesn't exist.
      */
     async getVault(sessionId) {
-        return this.redis.hgetall(this.vaultKey(sessionId)) ?? {};
+        const stored = await this.redis.hgetall(this.vaultKey(sessionId));
+        return Object.fromEntries(Object.entries(stored).map(([token, value]) => [
+            token,
+            this.decodeValue(value, sessionId),
+        ]));
     }
     /**
      * Explicitly deletes all session data (vault + reverse index).
      * Call this when a session is complete to proactively free memory.
      */
     async destroySession(sessionId) {
-        await this.redis.del(this.vaultKey(sessionId), this.reverseKey(sessionId));
+        await this.redis.del(this.vaultKey(sessionId), this.reverseKey(sessionId), this.counterKey(sessionId));
     }
     /**
      * Returns whether the Redis connection is healthy.
@@ -81,6 +190,50 @@ class TokenVault {
     async close() {
         await this.redis.quit();
     }
+    valueDigest(rawValue) {
+        if (!this.indexKey)
+            return rawValue;
+        return (0, crypto_1.createHmac)('sha256', this.indexKey).update(rawValue).digest('hex');
+    }
+    encodeValue(rawValue, sessionId) {
+        if (!this.encryptionKey)
+            return `ag0:${rawValue}`;
+        const iv = (0, crypto_1.randomBytes)(12);
+        const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', this.encryptionKey, iv);
+        cipher.setAAD(Buffer.from(sessionId, 'utf8'));
+        const encrypted = Buffer.concat([cipher.update(rawValue, 'utf8'), cipher.final()]);
+        return [
+            'ag1',
+            iv.toString('base64url'),
+            cipher.getAuthTag().toString('base64url'),
+            encrypted.toString('base64url'),
+        ].join(':');
+    }
+    decodeValue(storedValue, sessionId) {
+        if (storedValue.startsWith('ag0:'))
+            return storedValue.slice(4);
+        if (!storedValue.startsWith('ag1:'))
+            return storedValue;
+        if (!this.encryptionKey) {
+            throw new Error('Vault data is encrypted; configure vaultEncryptionKey to read it.');
+        }
+        const [, encodedIv, encodedTag, encodedCiphertext] = storedValue.split(':');
+        if (!encodedIv || !encodedTag || encodedCiphertext === undefined) {
+            throw new Error('Vault contains an invalid encrypted value.');
+        }
+        try {
+            const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', this.encryptionKey, Buffer.from(encodedIv, 'base64url'));
+            decipher.setAAD(Buffer.from(sessionId, 'utf8'));
+            decipher.setAuthTag(Buffer.from(encodedTag, 'base64url'));
+            return Buffer.concat([
+                decipher.update(Buffer.from(encodedCiphertext, 'base64url')),
+                decipher.final(),
+            ]).toString('utf8');
+        }
+        catch {
+            throw new Error('Unable to decrypt vault value; verify vaultEncryptionKey.');
+        }
+    }
 }
 exports.TokenVault = TokenVault;
 //# sourceMappingURL=vault.js.map

package/dist/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,sDAA4B;AAS5B,MAAa,UAAU;IAIrB,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,wBAAwB,EAAE;YACnE,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,CAAC;YACvB,gBAAgB,EAAE,IAAI;YACtB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,CAAC;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IACvC,CAAC;IAED,qEAAqE;IAC7D,QAAQ,CAAC,SAAiB;QAChC,OAAO,sBAAsB,SAAS,QAAQ,CAAC;IACjD,CAAC;IAED,qEAAqE;IAC7D,UAAU,CAAC,SAAiB;QAClC,OAAO,sBAAsB,SAAS,UAAU,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,KAAa,EAAE,QAAgB;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3D,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,QAAgB;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,MAAM,KAAK,MAAM,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACF;AAhFD,gCAgFC"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,mCAAmF;AACnF,sDAA4B;AAa5B,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBpB,CAAC;AAEF,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyB3B,CAAC;AAEF,MAAa,UAAU;IAOrB,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,KAAM,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;QAC/E,CAAC;QACD,IACE,OAAO,CAAC,kBAAkB,KAAK,SAAS;YACxC,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,aAAa,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,SAAS,CAAC;iBACjD,MAAM,CAAC,6BAA6B,CAAC;iBACrC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,SAAS,CAAC;iBAC5C,MAAM,CAAC,wBAAwB,CAAC;iBAChC,MAAM,EAAE,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC;QAC9D,IAAI,cAAmB,CAAC;QACxB,IAAI,CAAC;YACH,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAC7E,CAAC;QACD,IACE,CAAC,cAAc,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,KAAK,SAAS,CAAC;YAC/E,CAAC,cAAc,CAAC,QAAQ,EACxB,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAK,CAAC,QAAQ,EAAE;YAC/B,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,CAAC;YACvB,gBAAgB,EAAE,IAAI;YACtB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,QAAQ,CAAC,SAAiB;QAChC,OAAO,sBAAsB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC;IACvE,CAAC;IAED,qEAAqE;IAC7D,UAAU,CAAC,SAAiB;QAClC,OAAO,sBAAsB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC;IACzE,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,OAAO,sBAAsB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC;IAC1E,CAAC;IAEO,eAAe,CAAC,SAAiB;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtF,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,KAAa,EAAE,QAAgB;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC,YAAY,EACZ,CAAC,EACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,KAAK,EACL,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAC1B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAChB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACjC,CAAC;QACF,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,SAAiB,EACjB,UAAkB,EAClB,QAAgB;QAEhB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnC,mBAAmB,EACnB,CAAC,EACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,UAAU,EACV,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAC1B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAChB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACjC,CAA4B,CAAC;QAE9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,QAAgB;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK;YACL,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC;SACnC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,MAAM,KAAK,MAAM,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACpC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,WAAW,CAAC,QAAgB,EAAE,SAAiB;QACrD,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,OAAO,QAAQ,EAAE,CAAC;QAElD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnF,OAAO;YACL,KAAK;YACL,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxB,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;SAChC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,WAAmB,EAAE,SAAiB;QACxD,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,WAAW,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAC/B,aAAa,EACb,IAAI,CAAC,aAAa,EAClB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CACpC,CAAC;YACF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBAC5D,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF;AAxOD,gCAwOC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@princeverma130104/agentguard",
-  "version": "1.0.0",
+  "version": "1.0.2",
   "description": "Privacy & Context Redaction Middleware for AI Agents — detect, tokenise, and restore PII/credentials in real-time without exposing sensitive data to LLMs.",
   "keywords": [
     "ai",
@@ -23,18 +23,22 @@
   "exports": {
     ".": {
       "require": "./dist/index.js",
+      "default": "./dist/index.js",
       "types": "./dist/index.d.ts"
     },
     "./mastra": {
       "require": "./dist/mastra.js",
+      "default": "./dist/mastra.js",
       "types": "./dist/mastra.d.ts"
     },
     "./langchain": {
       "require": "./dist/langchain.js",
+      "default": "./dist/langchain.js",
       "types": "./dist/langchain.d.ts"
     },
     "./middleware": {
       "require": "./dist/middleware.js",
+      "default": "./dist/middleware.js",
       "types": "./dist/middleware.d.ts"
     }
   },