@princeverma130104/agentguard 1.0.1 → 1.0.2

package/dist/vault.js

@@ -1,33 +1,126 @@
 "use strict";
 /**
  * @file vault.ts
- * @description Redis-backed ephemeral token vault.
+ * @description Redis-backed TTL-expiring token vault.
  * Manages bidirectional (token ↔ rawValue) session mappings with TTL enforcement.
- * Raw PII is NEVER written to disk — all data lives in Redis in-memory store only.
+ * Redis persistence and encryption are controlled by the Redis deployment.
  */
 var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.TokenVault = void 0;
+const crypto_1 = require("crypto");
 const ioredis_1 = __importDefault(require("ioredis"));
+const STORE_SCRIPT = `
+local existingToken = redis.call('HGET', KEYS[2], ARGV[2])
+local existingValue = redis.call('HGET', KEYS[1], ARGV[1])
+if not existingToken and not existingValue and redis.call('HLEN', KEYS[1]) >= tonumber(ARGV[5]) then
+  return redis.error_reply('AGENTGUARD_SESSION_TOKEN_LIMIT')
+end
+
+if existingValue then
+  local mappings = redis.call('HGETALL', KEYS[2])
+  for i = 1, #mappings, 2 do
+    if mappings[i + 1] == ARGV[1] and mappings[i] ~= ARGV[2] then
+      redis.call('HDEL', KEYS[2], mappings[i])
+    end
+  end
+end
+if existingToken and existingToken ~= ARGV[1] then
+  redis.call('HDEL', KEYS[1], existingToken)
+end
+redis.call('HSET', KEYS[1], ARGV[1], ARGV[3])
+redis.call('HSET', KEYS[2], ARGV[2], ARGV[1])
+redis.call('EXPIRE', KEYS[1], ARGV[4])
+redis.call('EXPIRE', KEYS[2], ARGV[4])
+redis.call('EXPIRE', KEYS[3], ARGV[4])
+return 1
+`;
+const GET_OR_STORE_SCRIPT = `
+local existing = redis.call('HGET', KEYS[2], ARGV[2])
+if existing then
+  redis.call('EXPIRE', KEYS[1], ARGV[4])
+  redis.call('EXPIRE', KEYS[2], ARGV[4])
+  redis.call('EXPIRE', KEYS[3], ARGV[4])
+  return { existing, 0 }
+end
+
+if redis.call('HLEN', KEYS[1]) >= tonumber(ARGV[5]) then
+  return redis.error_reply('AGENTGUARD_SESSION_TOKEN_LIMIT')
+end
+
+local sequence = redis.call('HINCRBY', KEYS[3], ARGV[1], 1)
+local token = '[' .. ARGV[1] .. '_' .. sequence .. ']'
+while redis.call('HEXISTS', KEYS[1], token) == 1 do
+  sequence = redis.call('HINCRBY', KEYS[3], ARGV[1], 1)
+  token = '[' .. ARGV[1] .. '_' .. sequence .. ']'
+end
+redis.call('HSET', KEYS[1], token, ARGV[3])
+redis.call('HSET', KEYS[2], ARGV[2], token)
+redis.call('EXPIRE', KEYS[1], ARGV[4])
+redis.call('EXPIRE', KEYS[2], ARGV[4])
+redis.call('EXPIRE', KEYS[3], ARGV[4])
+return { token, 1 }
+`;
 class TokenVault {
     constructor(options = {}) {
-        this.redis = new ioredis_1.default(options.redisUrl || 'redis://localhost:6379', {
+        this.ttl = options.ttlSeconds ?? 900;
+        if (!Number.isSafeInteger(this.ttl) || this.ttl <= 0) {
+            throw new RangeError('ttlSeconds must be a positive safe integer.');
+        }
+        this.maxTokensPerSession = options.maxTokensPerSession ?? 10000;
+        if (!Number.isSafeInteger(this.maxTokensPerSession) || this.maxTokensPerSession <= 0) {
+            throw new RangeError('maxTokensPerSession must be a positive safe integer.');
+        }
+        if (options.vaultEncryptionKey !== undefined &&
+            !/^[a-fA-F0-9]{64}$/.test(options.vaultEncryptionKey)) {
+            throw new TypeError('vaultEncryptionKey must be exactly 64 hexadecimal characters.');
+        }
+        if (options.vaultEncryptionKey) {
+            const masterKey = Buffer.from(options.vaultEncryptionKey, 'hex');
+            this.encryptionKey = (0, crypto_1.createHmac)('sha256', masterKey)
+                .update('agentguard:vault-encryption')
+                .digest();
+            this.indexKey = (0, crypto_1.createHmac)('sha256', masterKey)
+                .update('agentguard:vault-index')
+                .digest();
+        }
+        const redisUrl = options.redisUrl ?? 'redis://localhost:6379';
+        let parsedRedisUrl;
+        try {
+            parsedRedisUrl = new URL(redisUrl);
+        }
+        catch {
+            throw new TypeError('redisUrl must be a valid redis:// or rediss:// URL.');
+        }
+        if ((parsedRedisUrl.protocol !== 'redis:' && parsedRedisUrl.protocol !== 'rediss:') ||
+            !parsedRedisUrl.hostname) {
+            throw new TypeError('redisUrl must be a valid redis:// or rediss:// URL.');
+        }
+        this.redis = new ioredis_1.default(redisUrl, {
             lazyConnect: true,
             maxRetriesPerRequest: 3,
             enableReadyCheck: true,
             retryStrategy: (times) => Math.min(times * 100, 3000),
         });
-        this.ttl = options.ttlSeconds ?? 900;
     }
     /** Returns the Redis key for the forward vault (token → rawValue) */
     vaultKey(sessionId) {
-        return `agentguard:session:${sessionId}:vault`;
+        return `agentguard:session:${this.encodeSessionId(sessionId)}:vault`;
     }
     /** Returns the Redis key for the reverse index (rawValue → token) */
     reverseKey(sessionId) {
-        return `agentguard:session:${sessionId}:reverse`;
+        return `agentguard:session:${this.encodeSessionId(sessionId)}:reverse`;
+    }
+    counterKey(sessionId) {
+        return `agentguard:session:${this.encodeSessionId(sessionId)}:counters`;
+    }
+    encodeSessionId(sessionId) {
+        if (typeof sessionId !== 'string' || sessionId.length === 0 || sessionId.length > 512) {
+            throw new TypeError('sessionId must be a non-empty string of at most 512 characters.');
+        }
+        return Buffer.from(sessionId, 'utf8').toString('base64url');
     }
     /**
      * Stores a token → rawValue mapping for the given session.
@@ -35,33 +128,49 @@ class TokenVault {
      * Refreshes TTL on every write.
      */
     async store(sessionId, token, rawValue) {
-        const pipeline = this.redis.pipeline();
-        pipeline.hset(this.vaultKey(sessionId), token, rawValue);
-        pipeline.hset(this.reverseKey(sessionId), rawValue, token);
-        pipeline.expire(this.vaultKey(sessionId), this.ttl);
-        pipeline.expire(this.reverseKey(sessionId), this.ttl);
-        await pipeline.exec();
+        const result = await this.redis.eval(STORE_SCRIPT, 3, this.vaultKey(sessionId), this.reverseKey(sessionId), this.counterKey(sessionId), token, this.valueDigest(rawValue), this.encodeValue(rawValue, sessionId), String(this.ttl), String(this.maxTokensPerSession));
+        if (result !== 1) {
+            throw new Error('Failed to store the vault mapping in Redis.');
+        }
+    }
+    /**
+     * Atomically reuses an existing token or allocates a new per-type token.
+     * Prevents concurrent requests from assigning the same token to different values.
+     */
+    async getOrStore(sessionId, entityType, rawValue) {
+        if (!/^[A-Z_]+$/.test(entityType)) {
+            throw new TypeError('entityType must contain uppercase letters and underscores only.');
+        }
+        const result = (await this.redis.eval(GET_OR_STORE_SCRIPT, 3, this.vaultKey(sessionId), this.reverseKey(sessionId), this.counterKey(sessionId), entityType, this.valueDigest(rawValue), this.encodeValue(rawValue, sessionId), String(this.ttl), String(this.maxTokensPerSession)));
+        if (!result || typeof result[0] !== 'string') {
+            throw new Error('Failed to atomically store the vault mapping in Redis.');
+        }
+        return { token: result[0], created: Number(result[1]) === 1 };
     }
     /**
      * Looks up the existing token for a given rawValue in a session.
-     * Returns undefined if not found (i.e., first occurrence of this value).
+     * Returns null if not found (i.e., first occurrence of this value).
      */
     async lookupToken(sessionId, rawValue) {
-        return this.redis.hget(this.reverseKey(sessionId), rawValue);
+        return this.redis.hget(this.reverseKey(sessionId), this.valueDigest(rawValue));
     }
     /**
      * Retrieves the full vault map (token → rawValue) for a session.
      * Returns an empty object if the session has expired or doesn't exist.
      */
     async getVault(sessionId) {
-        return this.redis.hgetall(this.vaultKey(sessionId)) ?? {};
+        const stored = await this.redis.hgetall(this.vaultKey(sessionId));
+        return Object.fromEntries(Object.entries(stored).map(([token, value]) => [
+            token,
+            this.decodeValue(value, sessionId),
+        ]));
     }
     /**
      * Explicitly deletes all session data (vault + reverse index).
      * Call this when a session is complete to proactively free memory.
      */
     async destroySession(sessionId) {
-        await this.redis.del(this.vaultKey(sessionId), this.reverseKey(sessionId));
+        await this.redis.del(this.vaultKey(sessionId), this.reverseKey(sessionId), this.counterKey(sessionId));
     }
     /**
      * Returns whether the Redis connection is healthy.
@@ -81,6 +190,50 @@ class TokenVault {
     async close() {
         await this.redis.quit();
     }
+    valueDigest(rawValue) {
+        if (!this.indexKey)
+            return rawValue;
+        return (0, crypto_1.createHmac)('sha256', this.indexKey).update(rawValue).digest('hex');
+    }
+    encodeValue(rawValue, sessionId) {
+        if (!this.encryptionKey)
+            return `ag0:${rawValue}`;
+        const iv = (0, crypto_1.randomBytes)(12);
+        const cipher = (0, crypto_1.createCipheriv)('aes-256-gcm', this.encryptionKey, iv);
+        cipher.setAAD(Buffer.from(sessionId, 'utf8'));
+        const encrypted = Buffer.concat([cipher.update(rawValue, 'utf8'), cipher.final()]);
+        return [
+            'ag1',
+            iv.toString('base64url'),
+            cipher.getAuthTag().toString('base64url'),
+            encrypted.toString('base64url'),
+        ].join(':');
+    }
+    decodeValue(storedValue, sessionId) {
+        if (storedValue.startsWith('ag0:'))
+            return storedValue.slice(4);
+        if (!storedValue.startsWith('ag1:'))
+            return storedValue;
+        if (!this.encryptionKey) {
+            throw new Error('Vault data is encrypted; configure vaultEncryptionKey to read it.');
+        }
+        const [, encodedIv, encodedTag, encodedCiphertext] = storedValue.split(':');
+        if (!encodedIv || !encodedTag || encodedCiphertext === undefined) {
+            throw new Error('Vault contains an invalid encrypted value.');
+        }
+        try {
+            const decipher = (0, crypto_1.createDecipheriv)('aes-256-gcm', this.encryptionKey, Buffer.from(encodedIv, 'base64url'));
+            decipher.setAAD(Buffer.from(sessionId, 'utf8'));
+            decipher.setAuthTag(Buffer.from(encodedTag, 'base64url'));
+            return Buffer.concat([
+                decipher.update(Buffer.from(encodedCiphertext, 'base64url')),
+                decipher.final(),
+            ]).toString('utf8');
+        }
+        catch {
+            throw new Error('Unable to decrypt vault value; verify vaultEncryptionKey.');
+        }
+    }
 }
 exports.TokenVault = TokenVault;
 //# sourceMappingURL=vault.js.map

package/dist/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,sDAA4B;AAS5B,MAAa,UAAU;IAIrB,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAK,CAAC,OAAO,CAAC,QAAQ,IAAI,wBAAwB,EAAE;YACnE,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,CAAC;YACvB,gBAAgB,EAAE,IAAI;YACtB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,CAAC;SACtD,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;IACvC,CAAC;IAED,qEAAqE;IAC7D,QAAQ,CAAC,SAAiB;QAChC,OAAO,sBAAsB,SAAS,QAAQ,CAAC;IACjD,CAAC;IAED,qEAAqE;IAC7D,UAAU,CAAC,SAAiB;QAClC,OAAO,sBAAsB,SAAS,UAAU,CAAC;IACnD,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,KAAa,EAAE,QAAgB;QAC5D,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,EAAE,CAAC;QACvC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC;QACzD,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC3D,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACpD,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;QACtD,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,QAAgB;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,MAAM,KAAK,MAAM,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;CACF;AAhFD,gCAgFC"}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;;;;AAEH,mCAAmF;AACnF,sDAA4B;AAa5B,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBpB,CAAC;AAEF,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;CAyB3B,CAAC;AAEF,MAAa,UAAU;IAOrB,YAAY,UAAwB,EAAE;QACpC,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,UAAU,IAAI,GAAG,CAAC;QACrC,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,IAAI,UAAU,CAAC,6CAA6C,CAAC,CAAC;QACtE,CAAC;QACD,IAAI,CAAC,mBAAmB,GAAG,OAAO,CAAC,mBAAmB,IAAI,KAAM,CAAC;QACjE,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,UAAU,CAAC,sDAAsD,CAAC,CAAC;QAC/E,CAAC;QACD,IACE,OAAO,CAAC,kBAAkB,KAAK,SAAS;YACxC,CAAC,mBAAmB,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,EACrD,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,+DAA+D,CAAC,CAAC;QACvF,CAAC;QACD,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;YAC/B,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,aAAa,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,SAAS,CAAC;iBACjD,MAAM,CAAC,6BAA6B,CAAC;iBACrC,MAAM,EAAE,CAAC;YACZ,IAAI,CAAC,QAAQ,GAAG,IAAA,mBAAU,EAAC,QAAQ,EAAE,SAAS,CAAC;iBAC5C,MAAM,CAAC,wBAAwB,CAAC;iBAChC,MAAM,EAAE,CAAC;QACd,CAAC;QAED,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,wBAAwB,CAAC;QAC9D,IAAI,cAAmB,CAAC;QACxB,IAAI,CAAC;YACH,cAAc,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;QACrC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAC7E,CAAC;QACD,IACE,CAAC,cAAc,CAAC,QAAQ,KAAK,QAAQ,IAAI,cAAc,CAAC,QAAQ,KAAK,SAAS,CAAC;YAC/E,CAAC,cAAc,CAAC,QAAQ,EACxB,CAAC;YACD,MAAM,IAAI,SAAS,CAAC,qDAAqD,CAAC,CAAC;QAC7E,CAAC;QAED,IAAI,CAAC,KAAK,GAAG,IAAI,iBAAK,CAAC,QAAQ,EAAE;YAC/B,WAAW,EAAE,IAAI;YACjB,oBAAoB,EAAE,CAAC;YACvB,gBAAgB,EAAE,IAAI;YACtB,aAAa,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,GAAG,GAAG,EAAE,IAAI,CAAC;SACtD,CAAC,CAAC;IACL,CAAC;IAED,qEAAqE;IAC7D,QAAQ,CAAC,SAAiB;QAChC,OAAO,sBAAsB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,QAAQ,CAAC;IACvE,CAAC;IAED,qEAAqE;IAC7D,UAAU,CAAC,SAAiB;QAClC,OAAO,sBAAsB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,UAAU,CAAC;IACzE,CAAC;IAEO,UAAU,CAAC,SAAiB;QAClC,OAAO,sBAAsB,IAAI,CAAC,eAAe,CAAC,SAAS,CAAC,WAAW,CAAC;IAC1E,CAAC;IAEO,eAAe,CAAC,SAAiB;QACvC,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;YACtF,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC9D,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB,EAAE,KAAa,EAAE,QAAgB;QAC5D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAClC,YAAY,EACZ,CAAC,EACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,KAAK,EACL,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAC1B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAChB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACjC,CAAC;QACF,IAAI,MAAM,KAAK,CAAC,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,6CAA6C,CAAC,CAAC;QACjE,CAAC;IACH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CACd,SAAiB,EACjB,UAAkB,EAClB,QAAgB;QAEhB,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CAAC,iEAAiE,CAAC,CAAC;QACzF,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CACnC,mBAAmB,EACnB,CAAC,EACD,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,UAAU,EACV,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,EAC1B,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,EACrC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAChB,MAAM,CAAC,IAAI,CAAC,mBAAmB,CAAC,CACjC,CAA4B,CAAC;QAE9B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC7C,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;IAChE,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,QAAgB;QACnD,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC;IACjF,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,SAAiB;QAC9B,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC,WAAW,CACvB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC;YAC7C,KAAK;YACL,IAAI,CAAC,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC;SACnC,CAAC,CACH,CAAC;IACJ,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,GAAG,CAClB,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EACxB,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAC1B,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAC3B,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,IAAI;QACR,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACvC,OAAO,MAAM,KAAK,MAAM,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,KAAK;QACT,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAEO,WAAW,CAAC,QAAgB;QAClC,IAAI,CAAC,IAAI,CAAC,QAAQ;YAAE,OAAO,QAAQ,CAAC;QACpC,OAAO,IAAA,mBAAU,EAAC,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5E,CAAC;IAEO,WAAW,CAAC,QAAgB,EAAE,SAAiB;QACrD,IAAI,CAAC,IAAI,CAAC,aAAa;YAAE,OAAO,OAAO,QAAQ,EAAE,CAAC;QAElD,MAAM,EAAE,GAAG,IAAA,oBAAW,EAAC,EAAE,CAAC,CAAC;QAC3B,MAAM,MAAM,GAAG,IAAA,uBAAc,EAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC;QACrE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC9C,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACnF,OAAO;YACL,KAAK;YACL,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACxB,MAAM,CAAC,UAAU,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC;YACzC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC;SAChC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACd,CAAC;IAEO,WAAW,CAAC,WAAmB,EAAE,SAAiB;QACxD,IAAI,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAChE,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC;YAAE,OAAO,WAAW,CAAC;QACxD,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC;YACxB,MAAM,IAAI,KAAK,CAAC,mEAAmE,CAAC,CAAC;QACvF,CAAC;QAED,MAAM,CAAC,EAAE,SAAS,EAAE,UAAU,EAAE,iBAAiB,CAAC,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC5E,IAAI,CAAC,SAAS,IAAI,CAAC,UAAU,IAAI,iBAAiB,KAAK,SAAS,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;QAChE,CAAC;QAED,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,IAAA,yBAAgB,EAC/B,aAAa,EACb,IAAI,CAAC,aAAa,EAClB,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CACpC,CAAC;YACF,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;YAChD,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC,MAAM,CAAC;gBACnB,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,iBAAiB,EAAE,WAAW,CAAC,CAAC;gBAC5D,QAAQ,CAAC,KAAK,EAAE;aACjB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACtB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;QAC/E,CAAC;IACH,CAAC;CACF;AAxOD,gCAwOC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@princeverma130104/agentguard",
-  "version": "1.0.1",
+  "version": "1.0.2",
   "description": "Privacy & Context Redaction Middleware for AI Agents — detect, tokenise, and restore PII/credentials in real-time without exposing sensitive data to LLMs.",
   "keywords": [
     "ai",