@sponsio/sdk 0.1.0 → 0.2.0-alpha.8

package/dist/integrations/openai.js

@@ -8,64 +8,146 @@
  *   const guard = new Sponsio({ contracts: [...] })
  *   const client = wrapOpenAI(new OpenAI(), guard)
  *
+ * Covers ``chat.completions.create`` / ``parse`` and, when the client has
+ * it, ``responses.create`` / ``parse``. Every tool call the model emits
+ * is checked before the caller's tool loop can run it; refused calls are
+ * removed from the response and a ``[BLOCKED] <tool>: <reason>`` line is
+ * added to the assistant text so the model learns why.
+ *
+ * ``stream: true`` throws at call time on every wrapped method: tool
+ * calls arrive as deltas and could only be checked after the caller has
+ * already assembled and run them. Call without ``stream``, or run your
+ * own executor through ``guard.guardBefore()`` before each tool call.
+ *
  * ``patchOpenAI`` is an alias matching Python's ``patch_openai``
  * factory (same monkey-patch semantics — no wrapped return value
  * required; the client passed in is mutated in place).
  */
+const STREAM_UNSUPPORTED = "sponsio: the OpenAI guard does not support stream: true. Tool calls " +
+    "arrive as deltas and could only be checked after the caller has already " +
+    "assembled and run them. Call without stream, or run your own executor " +
+    "through guard.guardBefore() before each tool call.";
 export function wrapOpenAI(client, guard) {
     const c = client;
-    const original = c.chat.completions.create.bind(c.chat.completions);
-    c.chat.completions.create = async function (...args) {
-        const response = await original(...args);
-        for (const choice of response.choices ?? []) {
-            const msg = choice.message;
-            if (!msg?.tool_calls)
+    const completions = c?.chat?.completions;
+    if (!completions || typeof completions.create !== "function") {
+        throw new TypeError("wrapOpenAI: expected an OpenAI client with chat.completions.create");
+    }
+    patchMethod(completions, "create", guard, "chat");
+    patchMethod(completions, "parse", guard, "chat");
+    if (c.responses) {
+        patchMethod(c.responses, "create", guard, "responses");
+        patchMethod(c.responses, "parse", guard, "responses");
+    }
+    return client;
+}
+function patchMethod(target, name, guard, kind) {
+    const original = target[name];
+    if (typeof original !== "function")
+        return;
+    const bound = original.bind(target);
+    target[name] = async function (...args) {
+        const params = args[0];
+        if (params && typeof params === "object" && params.stream) {
+            throw new Error(STREAM_UNSUPPORTED);
+        }
+        const response = await bound(...args);
+        return kind === "chat"
+            ? guardChatResponse(response, guard)
+            : guardResponsesOutput(response, guard);
+    };
+}
+/**
+ * Decide one emitted call. Malformed JSON arguments are refused in
+ * enforce mode without touching the trace (a call that never runs must
+ * not count as a call); in observe mode they pass through and are
+ * recorded with a sentinel so the session log shows what arrived.
+ */
+function decide(guard, toolName, rawArgs) {
+    let args;
+    try {
+        const parsed = JSON.parse(rawArgs || "{}");
+        args =
+            parsed && typeof parsed === "object" && !Array.isArray(parsed)
+                ? parsed
+                : { input: parsed };
+    }
+    catch {
+        if (guard.mode === "enforce") {
+            return {
+                blocked: true,
+                note: `[BLOCKED] ${toolName}: malformed JSON arguments — refusing to forward to the tool loop`,
+            };
+        }
+        args = { _sponsio_malformed_args: rawArgs ?? "" };
+    }
+    const result = guard.guardBefore(toolName, args);
+    // ``stopOriginal`` covers a redirect verdict as well as a block: the
+    // wrapper has no substitution path, so a redirect strips the call.
+    if (result.stopOriginal) {
+        return { blocked: true, note: `[BLOCKED] ${toolName}: ${result.message}` };
+    }
+    return { blocked: false };
+}
+function guardChatResponse(response, guard) {
+    for (const choice of response?.choices ?? []) {
+        const msg = choice.message;
+        if (!msg?.tool_calls)
+            continue;
+        const kept = [];
+        const blocked = [];
+        for (const tc of msg.tool_calls) {
+            const d = decide(guard, tc.function.name, tc.function.arguments);
+            if (d.blocked)
+                blocked.push(d.note);
+            else
+                kept.push(tc);
+        }
+        msg.tool_calls = kept.length > 0 ? kept : null;
+        if (blocked.length > 0 && !msg.tool_calls) {
+            // Match Python's ``_filter_blocked_calls``: join with a newline
+            // separator but no leading newline before the first message.
+            msg.content = (msg.content ?? "") + blocked.join("\n");
+        }
+    }
+    return response;
+}
+function guardResponsesOutput(response, guard) {
+    const output = response?.output;
+    if (!Array.isArray(output))
+        return response;
+    const kept = [];
+    const blocked = [];
+    for (const item of output) {
+        if (item?.type === "function_call") {
+            const d = decide(guard, item.name ?? "", item.arguments);
+            if (d.blocked) {
+                blocked.push(d.note);
                 continue;
-            const kept = [];
-            const blocked = [];
-            for (const tc of msg.tool_calls) {
-                let tcArgs = {};
-                let parseFailed = false;
-                try {
-                    tcArgs = JSON.parse(tc.function.arguments || "{}");
-                }
-                catch {
-                    parseFailed = true;
-                }
-                // Malformed arguments bypass any arg-based contract
-                // (``arg_blacklist``, ``arg_length_limit``, ``scope_limit``,
-                // ``dangerous_sql_verbs``, ``arg_value_range``) if we treat
-                // them as empty. Feed a sentinel so the guard still sees
-                // *something* distinctive, and block-by-default so a
-                // malformed payload doesn't silently slip through.
-                if (parseFailed) {
-                    guard.guardBefore(tc.function.name, {
-                        _sponsio_malformed_args: tc.function.arguments ?? "",
-                    });
-                    blocked.push(`[BLOCKED] ${tc.function.name}: malformed JSON arguments — ` +
-                        `refusing to forward to tool loop (set ` +
-                        `SPONSIO_OPENAI_STRICT_TOOL_ARGS=0 to downgrade once the ` +
-                        `parity flag ships in TS)`);
-                    continue;
-                }
-                const result = guard.guardBefore(tc.function.name, tcArgs);
-                if (result.blocked) {
-                    blocked.push(`[BLOCKED] ${tc.function.name}: ${result.message}`);
-                }
-                else {
-                    kept.push(tc);
-                }
-            }
-            msg.tool_calls = kept.length > 0 ? kept : null;
-            if (blocked.length > 0 && !msg.tool_calls) {
-                // Match Python's ``_filter_blocked_calls``: join with a newline
-                // separator but no leading newline before the first message.
-                msg.content = (msg.content ?? "") + blocked.join("\n");
             }
         }
+        kept.push(item);
+    }
+    if (blocked.length === 0)
         return response;
-    };
-    return client;
+    response.output = kept;
+    const note = blocked.join("\n");
+    const lastMessage = [...kept].reverse().find((i) => i?.type === "message");
+    const textPart = lastMessage?.content
+        ? [...lastMessage.content].reverse().find((p) => typeof p?.text === "string")
+        : undefined;
+    if (textPart) {
+        textPart.text = `${textPart.text}\n${note}`;
+    }
+    else {
+        kept.push({
+            type: "message",
+            role: "assistant",
+            status: "completed",
+            content: [{ type: "output_text", text: note, annotations: [] }],
+        });
+    }
+    return response;
 }
 /**
  * Alias for ``wrapOpenAI`` — matches Python's

package/dist/integrations/openai.js.map

@@ -1 +1 @@
-{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../src/integrations/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,MAAM,UAAU,UAAU,CAAC,MAAe,EAAE,KAAc;IACxD,MAAM,CAAC,GAAG,MAeT,CAAC;IAEF,MAAM,QAAQ,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAEpE,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,KAAK,WAAW,GAAG,IAAe;QAC5D,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;QAEzC,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;YAC5C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;YAC3B,IAAI,CAAC,GAAG,EAAE,UAAU;gBAAE,SAAS;YAE/B,MAAM,IAAI,GAA0B,EAAE,CAAC;YACvC,MAAM,OAAO,GAAa,EAAE,CAAC;YAE7B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;gBAChC,IAAI,MAAM,GAA4B,EAAE,CAAC;gBACzC,IAAI,WAAW,GAAG,KAAK,CAAC;gBACxB,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;gBACrD,CAAC;gBAAC,MAAM,CAAC;oBACP,WAAW,GAAG,IAAI,CAAC;gBACrB,CAAC;gBAED,oDAAoD;gBACpD,6DAA6D;gBAC7D,4DAA4D;gBAC5D,yDAAyD;gBACzD,qDAAqD;gBACrD,mDAAmD;gBACnD,IAAI,WAAW,EAAE,CAAC;oBAChB,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE;wBAClC,uBAAuB,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,IAAI,EAAE;qBACrD,CAAC,CAAC;oBACH,OAAO,CAAC,IAAI,CACV,aAAa,EAAE,CAAC,QAAQ,CAAC,IAAI,+BAA+B;wBAC1D,wCAAwC;wBACxC,0DAA0D;wBAC1D,0BAA0B,CAC7B,CAAC;oBACF,SAAS;gBACX,CAAC;gBAED,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAC3D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACnB,OAAO,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,QAAQ,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;gBACnE,CAAC;qBAAM,CAAC;oBACN,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBAChB,CAAC;YACH,CAAC;YAED,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;gBAC1C,gEAAgE;gBAChE,6DAA6D;gBAC7D,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzD,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAoB,CAAC;IAErB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC"}
+{"version":3,"file":"openai.js","sourceRoot":"","sources":["../../src/integrations/openai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAIH,MAAM,kBAAkB,GACtB,sEAAsE;IACtE,0EAA0E;IAC1E,wEAAwE;IACxE,oDAAoD,CAAC;AA+BvD,MAAM,UAAU,UAAU,CAAC,MAAe,EAAE,KAAc;IACxD,MAAM,CAAC,GAAG,MAGT,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC;IACzC,IAAI,CAAC,WAAW,IAAI,OAAO,WAAW,CAAC,MAAM,KAAK,UAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,SAAS,CACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,WAAW,CAAC,WAAW,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAClD,WAAW,CAAC,WAAW,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IACjD,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;QAChB,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;QACvD,WAAW,CAAC,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,WAAW,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,WAAW,CAClB,MAA+B,EAC/B,IAAY,EACZ,KAAc,EACd,IAA0B;IAE1B,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,OAAO,QAAQ,KAAK,UAAU;QAAE,OAAO;IAC3C,MAAM,KAAK,GAAI,QAA4C,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACzE,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,WAAW,GAAG,IAAe;QAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACvB,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAK,MAA+B,CAAC,MAAM,EAAE,CAAC;YACpF,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;QACtC,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACtC,OAAO,IAAI,KAAK,MAAM;YACpB,CAAC,CAAC,iBAAiB,CAAC,QAAwB,EAAE,KAAK,CAAC;YACpD,CAAC,CAAC,oBAAoB,CAAC,QAA6B,EAAE,KAAK,CAAC,CAAC;IACjE,CAAC,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,SAAS,MAAM,CACb,KAAc,EACd,QAAgB,EAChB,OAA2B;IAE3B,IAAI,IAA6B,CAAC;IAClC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,IAAI,IAAI,CAAC,CAAC;QAC3C,IAAI;YACF,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC5D,CAAC,CAAE,MAAkC;gBACrC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO,EAAE,IAAI;gBACb,IAAI,EAAE,aAAa,QAAQ,mEAAmE;aAC/F,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,EAAE,uBAAuB,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;IACjD,qEAAqE;IACrE,mEAAmE;IACnE,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,aAAa,QAAQ,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;IAC7E,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC5B,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAsB,EAAE,KAAc;IAC/D,KAAK,MAAM,MAAM,IAAI,QAAQ,EAAE,OAAO,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC;QAC3B,IAAI,CAAC,GAAG,EAAE,UAAU;YAAE,SAAS;QAE/B,MAAM,IAAI,GAAmB,EAAE,CAAC;QAChC,MAAM,OAAO,GAAa,EAAE,CAAC;QAC7B,KAAK,MAAM,EAAE,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjE,IAAI,CAAC,CAAC,OAAO;gBAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;;gBAC/B,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACrB,CAAC;QAED,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC;YAC1C,gEAAgE;YAChE,6DAA6D;YAC7D,GAAG,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,oBAAoB,CAC3B,QAA2B,EAC3B,KAAc;IAEd,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE5C,MAAM,IAAI,GAA0B,EAAE,CAAC;IACvC,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,IAAI,EAAE,IAAI,KAAK,eAAe,EAAE,CAAC;YACnC,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,IAAI,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;YACzD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;gBACd,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBACrB,SAAS;YACX,CAAC;QACH,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,QAAQ,CAAC,MAAM,GAAG,IAAI,CAAC;IACvB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,WAAW,GAAG,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC;IAC3E,MAAM,QAAQ,GAAG,WAAW,EAAE,OAAO;QACnC,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,IAAI,KAAK,QAAQ,CAAC;QAC7E,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,QAAQ,EAAE,CAAC;QACb,QAAQ,CAAC,IAAI,GAAG,GAAG,QAAQ,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;IAC9C,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,WAAW;YACnB,OAAO,EAAE,CAAC,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;SAChE,CAAC,CAAC;IACL,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,UAAU,CAAC"}

package/dist/integrations/vercel-ai.d.ts

@@ -10,19 +10,30 @@
  *   const model = wrapLanguageModel({ model, middleware: sponsioMiddleware(guard) })
  *
  * Behaviour:
- *   - guardBefore is called for every tool call the model emits.
+ *   - guardBefore runs for every tool call the model emits, on both
+ *     ``generateText`` (``wrapGenerate``) and ``streamText``
+ *     (``wrapStream``), before the AI SDK executes the tool.
  *   - Allowed calls pass through untouched.
- *   - Blocked calls are *dropped* from ``result.toolCalls`` (so the AI
- *     SDK's parseToolCall doesn't reject the response with NoSuchToolError),
- *     and a `[Sponsio blocked: <reason>]` line is appended to the
- *     model's text output. If every emitted call was blocked, the
- *     finishReason is forced to ``stop`` so the agent loop terminates
- *     instead of spinning on an empty turn.
- *   - The model's args are JSON-stringified at the language-model layer;
- *     the middleware parses defensively before handing them to the
+ *   - Blocked calls are *dropped* (so the AI SDK never executes them and
+ *     ``parseToolCall`` doesn't reject the response), and a
+ *     ``[Sponsio blocked: <reason>]`` note is added to the model's text.
+ *     If every emitted call was blocked, the finishReason is forced to
+ *     ``stop`` so the agent loop terminates instead of spinning.
+ *   - Both provider result shapes are handled: ``ai`` v4
+ *     (``LanguageModelV1``: ``result.toolCalls[]`` with ``args``) and
+ *     ``ai`` v5 and later (``LanguageModelV2`` / ``V3``:
+ *     ``result.content[]`` with ``{ type: "tool-call", input }`` parts).
+ *   - The model's args arrive JSON-stringified at the language-model
+ *     layer; the middleware parses defensively before handing them to the
  *     guard so the contract evaluator sees a real object.
  */
 import type { Sponsio } from "../index.js";
+/**
+ * The model's arguments as an object. A string that is not JSON is kept
+ * under ``_sponsio_malformed_args`` so coarse regex contracts still see
+ * it instead of an empty object that passes every argument rule.
+ */
+export declare function parseArgs(raw: unknown): Record<string, unknown>;
 export declare function sponsioMiddleware(guard: Sponsio): {
     transformParams: ({ params }: {
         params: any;

package/dist/integrations/vercel-ai.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-ai.d.ts","sourceRoot":"","sources":["../../src/integrations/vercel-ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAgD3C,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO;kCAER;QAAE,MAAM,EAAE,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,GAAG,CAAC;oCAI/D;QACD,UAAU,EAAE,MAAM,GAAG,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC;KACb,KAAG,OAAO,CAAC,GAAG,CAAC;+BAqCiB;QAAE,QAAQ,EAAE,MAAM,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,GAAG,CAAC;EAQ1E"}
+{"version":3,"file":"vercel-ai.d.ts","sourceRoot":"","sources":["../../src/integrations/vercel-ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAsC3C;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAc/D;AA0CD,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,OAAO;kCAER;QAAE,MAAM,EAAE,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,GAAG,CAAC;oCAI/D;QACD,UAAU,EAAE,MAAM,GAAG,CAAC;QACtB,MAAM,EAAE,GAAG,CAAC;KACb,KAAG,OAAO,CAAC,GAAG,CAAC;+BAuDiB;QAAE,QAAQ,EAAE,MAAM,GAAG,CAAA;KAAE,KAAG,OAAO,CAAC,GAAG,CAAC;EA4C1E"}

package/dist/integrations/vercel-ai.js

@@ -10,16 +10,21 @@
  *   const model = wrapLanguageModel({ model, middleware: sponsioMiddleware(guard) })
  *
  * Behaviour:
- *   - guardBefore is called for every tool call the model emits.
+ *   - guardBefore runs for every tool call the model emits, on both
+ *     ``generateText`` (``wrapGenerate``) and ``streamText``
+ *     (``wrapStream``), before the AI SDK executes the tool.
  *   - Allowed calls pass through untouched.
- *   - Blocked calls are *dropped* from ``result.toolCalls`` (so the AI
- *     SDK's parseToolCall doesn't reject the response with NoSuchToolError),
- *     and a `[Sponsio blocked: <reason>]` line is appended to the
- *     model's text output. If every emitted call was blocked, the
- *     finishReason is forced to ``stop`` so the agent loop terminates
- *     instead of spinning on an empty turn.
- *   - The model's args are JSON-stringified at the language-model layer;
- *     the middleware parses defensively before handing them to the
+ *   - Blocked calls are *dropped* (so the AI SDK never executes them and
+ *     ``parseToolCall`` doesn't reject the response), and a
+ *     ``[Sponsio blocked: <reason>]`` note is added to the model's text.
+ *     If every emitted call was blocked, the finishReason is forced to
+ *     ``stop`` so the agent loop terminates instead of spinning.
+ *   - Both provider result shapes are handled: ``ai`` v4
+ *     (``LanguageModelV1``: ``result.toolCalls[]`` with ``args``) and
+ *     ``ai`` v5 and later (``LanguageModelV2`` / ``V3``:
+ *     ``result.content[]`` with ``{ type: "tool-call", input }`` parts).
+ *   - The model's args arrive JSON-stringified at the language-model
+ *     layer; the middleware parses defensively before handing them to the
  *     guard so the contract evaluator sees a real object.
  */
 function emitBanner(toolName, reason, agentId) {
@@ -38,7 +43,12 @@ function emitBanner(toolName, reason, agentId) {
     ];
     process.stderr.write(lines.join("\n"));
 }
-function parseArgs(raw) {
+/**
+ * The model's arguments as an object. A string that is not JSON is kept
+ * under ``_sponsio_malformed_args`` so coarse regex contracts still see
+ * it instead of an empty object that passes every argument rule.
+ */
+export function parseArgs(raw) {
     if (raw == null)
         return {};
     if (typeof raw === "object" && !Array.isArray(raw))
@@ -48,37 +58,91 @@ function parseArgs(raw) {
             const parsed = JSON.parse(raw);
             return parsed && typeof parsed === "object" && !Array.isArray(parsed)
                 ? parsed
-                : {};
+                : { input: parsed };
         }
         catch {
-            return {};
+            return { _sponsio_malformed_args: raw };
         }
     }
-    return {};
+    return { input: raw };
+}
+/** Compact one-line reason for the appended note; full message stays in the session log. */
+function trimReason(msg) {
+    // Strip prefix via indexOf rather than regex — every regex form that
+    // matched the pattern ``^[A-Z-]*BLOCKED:\s*[^—]+—\s*`` kept tripping
+    // CodeQL js/polynomial-redos (the ``\s*`` and ``[^—]+`` overlap on
+    // spaces).  indexOf is O(n) with no backtracking.
+    let trimmed = msg;
+    const blockedIdx = trimmed.indexOf("BLOCKED:");
+    if (blockedIdx >= 0 && blockedIdx <= 64) {
+        const dashIdx = trimmed.indexOf("—", blockedIdx + "BLOCKED:".length);
+        if (dashIdx >= 0) {
+            trimmed = trimmed.slice(dashIdx + "—".length).trimStart();
+        }
+    }
+    const head = trimmed.toLowerCase();
+    if (head.startsWith("det constraint violated:")) {
+        trimmed = trimmed.slice("det constraint violated:".length).trimStart();
+    }
+    else if (head.startsWith("violated:")) {
+        trimmed = trimmed.slice("violated:".length).trimStart();
+    }
+    return trimmed.split("\n")[0];
+}
+/** Run one emitted tool call through the guard, before anything executes it. */
+function decide(guard, tc) {
+    const check = guard.guardBefore(tc.toolName, parseArgs(tc.input ?? tc.args));
+    // ``stopOriginal`` covers a redirect verdict as well as a block: the
+    // middleware has no substitution path, so a redirect drops the call.
+    if (!check.stopOriginal)
+        return { blocked: false };
+    const reason = trimReason(check.message ?? `${tc.toolName} blocked by Sponsio`);
+    emitBanner(tc.toolName, reason, guard.agentId);
+    return { blocked: true, reason };
+}
+function blockNote(reasons) {
+    return `[Sponsio blocked: ${reasons.join("; ")}]`;
 }
 export function sponsioMiddleware(guard) {
     return {
         transformParams: async ({ params }) => params,
         wrapGenerate: async ({ doGenerate, }) => {
             const result = await doGenerate();
+            // ai v5+: tool calls are ``tool-call`` parts inside ``content``.
+            if (Array.isArray(result.content)) {
+                const content = [];
+                const blockedReasons = [];
+                let survivingCalls = 0;
+                for (const part of result.content) {
+                    if (part?.type === "tool-call") {
+                        const d = decide(guard, part);
+                        if (d.blocked) {
+                            blockedReasons.push(`${String(part.toolName)}: ${d.reason}`);
+                            continue;
+                        }
+                        survivingCalls++;
+                    }
+                    content.push(part);
+                }
+                if (blockedReasons.length === 0)
+                    return result;
+                content.push({ type: "text", text: blockNote(blockedReasons) });
+                return {
+                    ...result,
+                    content,
+                    finishReason: survivingCalls === 0 ? "stop" : result.finishReason,
+                };
+            }
+            // ai v4: tool calls are ``result.toolCalls``.
             const calls = result.toolCalls ?? [];
             if (calls.length === 0)
                 return result;
             const surviving = [];
             const blockedReasons = [];
             for (const tc of calls) {
-                const check = guard.guardBefore(tc.toolName, parseArgs(tc.args));
-                if (check.blocked) {
-                    // Strip the leading "BLOCKED: agent.tool — det constraint violated: "
-                    // prefix and any "det constraint violated:" / "violated:" boilerplate
-                    // so the appended text is concise; full message stays in the session log.
-                    const msg = check.message ?? `${tc.toolName} blocked by Sponsio`;
-                    const trimmed = msg
-                        .replace(/^[A-Z-]*BLOCKED:\s*[^—]+—\s*/, "")
-                        .replace(/^(?:det\s+constraint\s+)?violated:\s*/i, "");
-                    const reason = trimmed.split("\n")[0];
-                    emitBanner(tc.toolName, reason, guard.agentId);
-                    blockedReasons.push(`${tc.toolName}: ${reason}`);
+                const d = decide(guard, tc);
+                if (d.blocked) {
+                    blockedReasons.push(`${tc.toolName}: ${d.reason}`);
                 }
                 else {
                     surviving.push(tc);
@@ -86,8 +150,8 @@ export function sponsioMiddleware(guard) {
             }
             if (blockedReasons.length === 0)
                 return result;
-            const blockNote = `[Sponsio blocked: ${blockedReasons.join("; ")}]`;
-            const newText = result.text ? `${result.text}\n\n${blockNote}` : blockNote;
+            const note = blockNote(blockedReasons);
+            const newText = result.text ? `${result.text}\n\n${note}` : note;
             return {
                 ...result,
                 toolCalls: surviving,
@@ -96,11 +160,46 @@ export function sponsioMiddleware(guard) {
             };
         },
         wrapStream: async ({ doStream }) => {
-            // Stream support is intentionally pass-through for now; the
-            // stream parts API is more involved and the demo / OSS hot
-            // path uses generateText. We can add full stream filtering in
-            // a follow-up without changing the wrapGenerate contract.
-            return doStream();
+            const streamed = await doStream();
+            const source = streamed?.stream;
+            if (!source || typeof source.pipeThrough !== "function")
+                return streamed;
+            // ``streamText`` executes a tool when the ``tool-call`` part arrives,
+            // so that part is the gate. Earlier ``tool-input-*`` /
+            // ``tool-call-delta`` parts only render partial arguments and pass
+            // through; nothing runs on them.
+            let survivingCalls = 0;
+            let blockedAny = false;
+            let noteId = 0;
+            const gated = source.pipeThrough(new TransformStream({
+                transform(part, controller) {
+                    if (part?.type === "tool-call") {
+                        const d = decide(guard, part);
+                        if (d.blocked) {
+                            blockedAny = true;
+                            const note = blockNote([`${String(part.toolName)}: ${d.reason}`]);
+                            if ("input" in part) {
+                                // v5+ text streams are start / delta / end triples.
+                                const id = `sponsio-block-${++noteId}`;
+                                controller.enqueue({ type: "text-start", id });
+                                controller.enqueue({ type: "text-delta", id, delta: note });
+                                controller.enqueue({ type: "text-end", id });
+                            }
+                            else {
+                                controller.enqueue({ type: "text-delta", textDelta: note });
+                            }
+                            return;
+                        }
+                        survivingCalls++;
+                    }
+                    if (part?.type === "finish" && blockedAny && survivingCalls === 0) {
+                        controller.enqueue({ ...part, finishReason: "stop" });
+                        return;
+                    }
+                    controller.enqueue(part);
+                },
+            }));
+            return { ...streamed, stream: gated };
         },
     };
 }

package/dist/integrations/vercel-ai.js.map

@@ -1 +1 @@
-{"version":3,"file":"vercel-ai.js","sourceRoot":"","sources":["../../src/integrations/vercel-ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAkBH,SAAS,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAe;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAE,OAAO,CAAC,MAAyC,CAAC,KAAK,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,CAAC,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC;QACrB,KAAK,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,EAAE;QAChE,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,MAAM,EAAE;QAClC,CAAC,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC;QACrB,EAAE;KACH,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAA8B,CAAC;IAC1F,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAE,MAAkC;gBACrC,CAAC,CAAC,EAAE,CAAC;QACT,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO;QACL,eAAe,EAAE,KAAK,EAAE,EAAE,MAAM,EAAmB,EAAgB,EAAE,CAAC,MAAM;QAE5E,YAAY,EAAE,KAAK,EAAE,EACnB,UAAU,GAIX,EAAgB,EAAE;YACjB,MAAM,MAAM,GAAG,MAAM,UAAU,EAAE,CAAC;YAClC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YAEtC,MAAM,SAAS,GAAiB,EAAE,CAAC;YACnC,MAAM,cAAc,GAAa,EAAE,CAAC;YACpC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;gBACjE,IAAI,KAAK,CAAC,OAAO,EAAE,CAAC;oBAClB,sEAAsE;oBACtE,sEAAsE;oBACtE,0EAA0E;oBAC1E,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,QAAQ,qBAAqB,CAAC;oBACjE,MAAM,OAAO,GAAG,GAAG;yBAChB,OAAO,CAAC,8BAA8B,EAAE,EAAE,CAAC;yBAC3C,OAAO,CAAC,wCAAwC,EAAE,EAAE,CAAC,CAAC;oBACzD,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtC,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;oBAC/C,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,KAAK,MAAM,EAAE,CAAC,CAAC;gBACnD,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YAE/C,MAAM,SAAS,GAAG,qBAAqB,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;YACpE,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,OAAO,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;YAC3E,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,OAAO;gBACb,YAAY,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;aACpE,CAAC;QACJ,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,EAAE,QAAQ,EAA2B,EAAgB,EAAE;YACxE,4DAA4D;YAC5D,2DAA2D;YAC3D,8DAA8D;YAC9D,0DAA0D;YAC1D,OAAO,QAAQ,EAAE,CAAC;QACpB,CAAC;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"vercel-ai.js","sourceRoot":"","sources":["../../src/integrations/vercel-ai.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAwBH,SAAS,UAAU,CAAC,QAAgB,EAAE,MAAc,EAAE,OAAe;IACnE,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB;QAAE,OAAO;IAC1C,MAAM,KAAK,GAAG,CAAC,CAAE,OAAO,CAAC,MAAyC,CAAC,KAAK,CAAC;IACzE,MAAM,CAAC,GAAG,CAAC,IAAY,EAAE,IAAY,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC3B,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,CAAC,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC;QACrB,KAAK,CAAC,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,GAAG,OAAO,IAAI,QAAQ,EAAE,CAAC,EAAE;QAChE,KAAK,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,MAAM,EAAE;QAClC,CAAC,CAAC,MAAM,EAAE,KAAK,GAAG,EAAE,CAAC;QACrB,EAAE;KACH,CAAC;IACF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,GAAY;IACpC,IAAI,GAAG,IAAI,IAAI;QAAE,OAAO,EAAE,CAAC;IAC3B,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,GAA8B,CAAC;IAC1F,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC/B,OAAO,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;gBACnE,CAAC,CAAE,MAAkC;gBACrC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;QACxB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,uBAAuB,EAAE,GAAG,EAAE,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,4FAA4F;AAC5F,SAAS,UAAU,CAAC,GAAW;IAC7B,qEAAqE;IACrE,qEAAqE;IACrE,mEAAmE;IACnE,kDAAkD;IAClD,IAAI,OAAO,GAAG,GAAG,CAAC;IAClB,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/C,IAAI,UAAU,IAAI,CAAC,IAAI,UAAU,IAAI,EAAE,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;QACrE,IAAI,OAAO,IAAI,CAAC,EAAE,CAAC;YACjB,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACnC,IAAI,IAAI,CAAC,UAAU,CAAC,0BAA0B,CAAC,EAAE,CAAC;QAChD,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,0BAA0B,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;IACzE,CAAC;SAAM,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACxC,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAChC,CAAC;AAID,gFAAgF;AAChF,SAAS,MAAM,CAAC,KAAc,EAAE,EAAgB;IAC9C,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,CAAC,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;IAC7E,qEAAqE;IACrE,qEAAqE;IACrE,IAAI,CAAC,KAAK,CAAC,YAAY;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,OAAO,IAAI,GAAG,EAAE,CAAC,QAAQ,qBAAqB,CAAC,CAAC;IAChF,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;IAC/C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,SAAS,CAAC,OAAiB;IAClC,OAAO,qBAAqB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAc;IAC9C,OAAO;QACL,eAAe,EAAE,KAAK,EAAE,EAAE,MAAM,EAAmB,EAAgB,EAAE,CAAC,MAAM;QAE5E,YAAY,EAAE,KAAK,EAAE,EACnB,UAAU,GAIX,EAAgB,EAAE;YACjB,MAAM,MAAM,GAAmB,MAAM,UAAU,EAAE,CAAC;YAElD,iEAAiE;YACjE,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;gBAClC,MAAM,OAAO,GAAmC,EAAE,CAAC;gBACnD,MAAM,cAAc,GAAa,EAAE,CAAC;gBACpC,IAAI,cAAc,GAAG,CAAC,CAAC;gBACvB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBAClC,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;wBAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,IAA+B,CAAC,CAAC;wBACzD,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;4BACd,cAAc,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;4BAC7D,SAAS;wBACX,CAAC;wBACD,cAAc,EAAE,CAAC;oBACnB,CAAC;oBACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACrB,CAAC;gBACD,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;oBAAE,OAAO,MAAM,CAAC;gBAC/C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC;gBAChE,OAAO;oBACL,GAAG,MAAM;oBACT,OAAO;oBACP,YAAY,EAAE,cAAc,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;iBAClE,CAAC;YACJ,CAAC;YAED,8CAA8C;YAC9C,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;YACrC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YAEtC,MAAM,SAAS,GAAmB,EAAE,CAAC;YACrC,MAAM,cAAc,GAAa,EAAE,CAAC;YACpC,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;gBACvB,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;gBAC5B,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;oBACd,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBACrD,CAAC;qBAAM,CAAC;oBACN,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;gBACrB,CAAC;YACH,CAAC;YAED,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,MAAM,CAAC;YAE/C,MAAM,IAAI,GAAG,SAAS,CAAC,cAAc,CAAC,CAAC;YACvC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YACjE,OAAO;gBACL,GAAG,MAAM;gBACT,SAAS,EAAE,SAAS;gBACpB,IAAI,EAAE,OAAO;gBACb,YAAY,EAAE,SAAS,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY;aACpE,CAAC;QACJ,CAAC;QAED,UAAU,EAAE,KAAK,EAAE,EAAE,QAAQ,EAA2B,EAAgB,EAAE;YACxE,MAAM,QAAQ,GAAG,MAAM,QAAQ,EAAE,CAAC;YAClC,MAAM,MAAM,GAAoC,QAAQ,EAAE,MAAM,CAAC;YACjE,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,UAAU;gBAAE,OAAO,QAAQ,CAAC;YAEzE,sEAAsE;YACtE,uDAAuD;YACvD,mEAAmE;YACnE,iCAAiC;YACjC,IAAI,cAAc,GAAG,CAAC,CAAC;YACvB,IAAI,UAAU,GAAG,KAAK,CAAC;YACvB,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAC9B,IAAI,eAAe,CAAW;gBAC5B,SAAS,CAAC,IAAI,EAAE,UAAU;oBACxB,IAAI,IAAI,EAAE,IAAI,KAAK,WAAW,EAAE,CAAC;wBAC/B,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,IAAoB,CAAC,CAAC;wBAC9C,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;4BACd,UAAU,GAAG,IAAI,CAAC;4BAClB,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;4BAClE,IAAI,OAAO,IAAI,IAAI,EAAE,CAAC;gCACpB,oDAAoD;gCACpD,MAAM,EAAE,GAAG,iBAAiB,EAAE,MAAM,EAAE,CAAC;gCACvC,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC,CAAC;gCAC/C,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gCAC5D,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC,CAAC;4BAC/C,CAAC;iCAAM,CAAC;gCACN,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;4BAC9D,CAAC;4BACD,OAAO;wBACT,CAAC;wBACD,cAAc,EAAE,CAAC;oBACnB,CAAC;oBACD,IAAI,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,UAAU,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;wBAClE,UAAU,CAAC,OAAO,CAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC,CAAC;wBACtD,OAAO;oBACT,CAAC;oBACD,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;gBAC3B,CAAC;aACF,CAAC,CACH,CAAC;YACF,OAAO,EAAE,GAAG,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;QACxC,CAAC;KACF,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@sponsio/sdk",
-  "version": "0.1.0",
-  "description": "Runtime contract enforcement for LLM agents — native TypeScript",
+  "version": "0.2.0-alpha.8",
+  "description": "Runtime contract enforcement for LLM agents \u2014 native TypeScript",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",
@@ -13,6 +13,9 @@
   },
   "homepage": "https://github.com/SponsioLabs/Sponsio#readme",
   "type": "module",
+  "sideEffects": [
+    "./dist/cli/**"
+  ],
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "exports": {
@@ -43,6 +46,10 @@
     "./langchain": {
       "types": "./dist/integrations/langchain.d.ts",
       "default": "./dist/integrations/langchain.js"
+    },
+    "./cloud/evidence": {
+      "types": "./dist/cloud/evidence.d.ts",
+      "import": "./dist/cloud/evidence.js"
     }
   },
   "bin": {
@@ -60,26 +67,27 @@
   ],
   "scripts": {
     "build": "tsc && tsc -p tsconfig.cli.json && node -e \"require('fs').writeFileSync('dist/cli/package.json', '{\\\"type\\\":\\\"commonjs\\\"}\\n')\"",
-    "test": "node --test dist/__tests__/*.test.js",
+    "test": "node --test dist/",
     "test:cli": "node --test dist/cli/__tests__/*.test.js",
     "test:src": "npx tsx src/__tests__/core.test.ts",
     "test:parity": "npx tsx src/__tests__/parity.test.ts && npx tsx src/__tests__/parity.scenarios.test.ts"
   },
   "dependencies": {
-    "yaml": "^2.7.0",
     "fast-glob": "^3.3.0",
-    "js-yaml": "^4.1.0",
-    "ts-morph": "^22.0.0"
+    "js-yaml": "^5.4.2",
+    "ts-morph": "^28.0.0",
+    "yaml": "^2.9.1"
   },
   "devDependencies": {
     "@types/js-yaml": "^4.0.5",
-    "@types/node": "^25.6.0",
-    "tsx": "^4.0.0",
+    "@types/node": "^26.6.2",
+    "esbuild": "^0.28.2",
+    "tsx": "^4.23.15",
     "typescript": "^5.5.0"
   },
   "peerDependencies": {
-    "@langchain/core": ">=0.3.0",
     "@google/adk": ">=0.2.0",
+    "@langchain/core": ">=0.3.0",
     "ai": ">=4.0.0",
     "claude-agent-sdk": ">=0.1.0",
     "openai": ">=4.0.0"

package/prompts/onboard.md

@@ -33,10 +33,9 @@ A JSON object from `sponsio onboard --emit-context`:
 ## Hard rules (apply before authoring anything)
 
 - **Deterministic atoms only.**  Use ONLY pattern names from the
-  *Pattern vocabulary* section below.  Do NOT propose stochastic
-  atoms (`injection_free`, `pii_free`, `semantic_pii`, `faithful`,
-  `harmful`, `tone_*`, `relevant`, `metric_integrity`, etc.).
-  Sponsio OSS does not load them; the YAML will fail to parse.
+  *Pattern vocabulary* section below.  The engine is
+  deterministic-only; any pattern name outside that vocabulary will
+  fail to parse.
 
 - **Dedupe against `pre_existing_contracts`.**  The CLI already
   emitted starter rules (likely `idempotent`, generic
@@ -49,16 +48,14 @@ A JSON object from `sponsio onboard --emit-context`:
   the user has to clean up.
 
 - **Source tagging.**  Every contract YOU author carries
-  `source: agent-extracted` so future `sponsio refresh` runs can
-  distinguish your additions from pack rules and from
-  CLI-emitted starter rules.
+  `source: agent-extracted` so later tooling can distinguish your
+  additions from pack rules and from CLI-emitted starter rules.
 
 - **One contract per concrete failure mode.**  Plain-English
   `desc:` so the user can review by reading.  No omnibus rules.
 
-- **Strip `extractor:` / `judge:` blocks.**  Those drive Sponsio
-  Cloud features (parse-time / runtime LLM judges) and add noise
-  to the OSS file unless the user explicitly asks for them.
+- **Strip `extractor:` / `judge:` blocks.**  The engine does not use
+  them; they only add noise to the file.
 
 - **Placeholders only as last resort.**  Use `___AGENT_ID___`,
   `___WORKSPACE___`, `___ALLOWED_HOST___` etc. ONLY when no
@@ -178,17 +175,29 @@ agents:
 
 ## Pattern vocabulary
 
-(Same as plugin scan — `arg_blacklist`, `arg_value_range`,
-`arg_length_limit`, `rate_limit`, `loop_detection`,
-`irreversible_once`, `must_precede`.  See
-``sponsio plugin prompt mcp-bare`` for full signatures.)
+Run ``sponsio patterns`` and use the FULL list it prints — do not
+rely on a memorized subset.  The library spans temporal ordering
+(`must_precede`, `no_reversal`, `always_followed_by`, …), argument &
+path constraints (`arg_blacklist`, `arg_allowlist`, `scope_limit`,
+`arg_value_range`, `arg_length_limit`, …), OWASP presets
+(`dangerous_sql_verbs`, `dangerous_bash_commands`,
+`destructive_action_gate`, `tool_allowlist`, …), rate / resource
+caps (`rate_limit`, `idempotent`, `loop_detection`, …), and data
+flow (`no_data_leak`).  Policy docs about SQL safety, data
+isolation, taint, or approval gates almost always need patterns
+outside the arg-constraint family — check the full list before
+concluding a rule can't be expressed.
+
+If no pattern fits, two fallbacks (in order): a plain NL rule that
+``sponsio validate`` accepts, or a raw formula over the atomic
+propositions in ``sponsio/tracer/grounding.py`` (`called`,
+`called_with`, `arg_has`, `arg_field_has`, `contains`, `flow`).
 
 ## Source tagging
 
 Every contract YOU author should carry `source: agent-extracted` so
-future `sponsio refresh` runs know they were agent-generated and
-can be re-considered.  Don't tag pack-included rules — those have
-their own source from the pack.
+later tooling knows they were agent-generated.  Don't tag
+pack-included rules; those have their own source from the pack.
 
 ## What to do after