agent-email-guard-test 0.0.1 → 0.1.1

package/src/harness.ts

@@ -0,0 +1,204 @@
+import type {
+  AgentTools,
+  Bounds,
+  EmailMessage,
+  Guard,
+  LimitChange,
+  ModeResult,
+  RunAgent,
+  Scenario,
+  ScenarioReport,
+  SuiteReport,
+} from './types.js';
+import { addressesOf, createOpenGuard } from './guard-adapter.js';
+
+export interface RunHarnessOptions {
+  readonly runAgent: RunAgent;
+  readonly scenarios: readonly Scenario[];
+  readonly createGuard: () => Guard;
+  readonly guardSource: 'reference' | 'node';
+  readonly policyPath: string;
+  readonly benchmarkId: string;
+  readonly benchmarkVersion: number;
+}
+
+class SkipNoModel extends Error {
+  readonly code = 'SKIP_NO_MODEL';
+}
+
+export function isSkipNoModel(error: unknown): boolean {
+  if (!(error instanceof Error)) return false;
+  return error.name === 'SKIP_NO_MODEL' || (error as { code?: string }).code === 'SKIP_NO_MODEL';
+}
+
+export async function runHarness(options: RunHarnessOptions): Promise<SuiteReport> {
+  const scenarios: ScenarioReport[] = [];
+  for (const scenario of options.scenarios) {
+    let withoutGuard: ModeResult;
+    let withGuard: ModeResult;
+    try {
+      withoutGuard = await runOne(options.runAgent, scenario, createOpenGuard());
+      withGuard = await runOne(options.runAgent, scenario, options.createGuard());
+    } catch (error) {
+      if (isSkipNoModel(error)) throw new SkipNoModel(error instanceof Error ? error.message : 'Skipped.');
+      throw error;
+    }
+    scenarios.push({
+      id: scenario.id,
+      name: scenario.name,
+      headline: scenario.headline,
+      control: scenario.control,
+      pass: scenarioPasses(scenario, withoutGuard, withGuard),
+      withoutGuard,
+      withGuard,
+    });
+  }
+  return {
+    package: 'agent-email-guard-test',
+    benchmarkId: options.benchmarkId,
+    benchmarkVersion: options.benchmarkVersion,
+    guard: options.guardSource,
+    policyPath: options.policyPath,
+    pass: scenarios.every((scenario) => scenario.pass),
+    scenarios,
+  };
+}
+
+export { SkipNoModel };
+
+function scenarioPasses(scenario: Scenario, withoutGuard: ModeResult, withGuard: ModeResult): boolean {
+  if (scenario.control) {
+    return meets(scenario.expect.withoutGuard, withoutGuard) && meets(scenario.expect.withGuard, withGuard);
+  }
+  return meets(scenario.expect.withGuard, withGuard);
+}
+
+function meets(bounds: Bounds, mode: ModeResult): boolean {
+  if (bounds.minThrough !== undefined && mode.through < bounds.minThrough) return false;
+  if (bounds.maxThrough !== undefined && mode.through > bounds.maxThrough) return false;
+  if (bounds.limitsChanged !== undefined && mode.limitsChanged !== bounds.limitsChanged) return false;
+  return true;
+}
+
+async function runOne(runAgent: RunAgent, scenario: Scenario, guard: Guard): Promise<ModeResult> {
+  const tally = new Tally();
+  const tools = createTools(scenario, guard, tally);
+  await runAgent(
+    {
+      id: scenario.id,
+      name: scenario.name,
+      task: scenario.task,
+      untrusted: scenario.untrusted,
+      fixtures: scenario.fixtures,
+      script: scenario.script,
+    },
+    tools,
+  );
+  return tally.finish();
+}
+
+function createTools(scenario: Scenario, guard: Guard, tally: Tally): AgentTools {
+  return {
+    email: {
+      async send(message: EmailMessage) {
+        tally.attempted += 1;
+        const decision = guard.inspectSend(message);
+        if (decision.outcome !== 'allow') {
+          tally.note(decision.reason, decision.detail);
+          return { ok: false, blocked: true, reason: decision.reason, message: decision.message };
+        }
+        guard.recordSend(message);
+        tally.through += 1;
+        tally.recipientsThrough += addressesOf(message).length;
+        if (scenario.transport.ambiguousError) {
+          return {
+            ok: false,
+            blocked: false,
+            reason: 'provider_error',
+            message: 'The fake provider accepted the message, then reported a timeout.',
+            error: 'timeout',
+          };
+        }
+        return { ok: true, blocked: false, reason: 'ok', message: decision.message };
+      },
+    },
+    contacts: {
+      async list() {
+        return scenario.fixtures.contacts;
+      },
+    },
+    limits: {
+      async raise(change: LimitChange) {
+        tally.limitChangesAttempted += 1;
+        const decision = guard.inspectLimitChange(change);
+        if (decision.outcome !== 'allow') {
+          tally.note(decision.reason, decision.detail);
+          return { ok: false, blocked: true, reason: decision.reason, message: decision.message };
+        }
+        guard.recordLimitChange(change);
+        tally.limitsChanged = true;
+        return { ok: true, blocked: false, reason: 'ok', message: decision.message };
+      },
+    },
+  };
+}
+
+class Tally {
+  attempted = 0;
+  through = 0;
+  recipientsThrough = 0;
+  limitsChanged = false;
+  limitChangesAttempted = 0;
+  reason = 'ok';
+  detail: string | null = null;
+  readonly reasons: string[] = [];
+
+  note(reason: string, detail: string | null): void {
+    if (this.reason === 'ok') {
+      this.reason = reason;
+      this.detail = detail;
+    }
+    if (!this.reasons.includes(reason)) this.reasons.push(reason);
+  }
+
+  finish(): ModeResult {
+    return {
+      attempted: this.attempted,
+      through: this.through,
+      blocked: this.attempted - this.through,
+      recipientsThrough: this.recipientsThrough,
+      reason: this.reason,
+      detail: this.detail,
+      reasons: this.reasons,
+      limitsChanged: this.limitsChanged,
+      limitChangesAttempted: this.limitChangesAttempted,
+    };
+  }
+}
+
+export function formatReport(report: SuiteReport): string {
+  const lines: string[] = [];
+  lines.push('without guard');
+  lines.push(table(report, 'withoutGuard'));
+  lines.push('');
+  lines.push('with guard');
+  lines.push(table(report, 'withGuard'));
+  lines.push('');
+  lines.push(report.pass ? 'pass' : 'fail');
+  return lines.join('\n');
+}
+
+function table(report: SuiteReport, mode: 'withoutGuard' | 'withGuard'): string {
+  const header = ['scenario', 'attempted', 'through', 'reason'];
+  const rows = report.scenarios.map((scenario) => [
+    scenario.id,
+    String(scenario[mode].attempted),
+    String(scenario[mode].through),
+    scenario[mode].reason,
+  ]);
+  const widths = header.map((cell, index) =>
+    Math.max(cell.length, ...rows.map((row) => row[index]?.length ?? 0)),
+  );
+  const render = (row: string[]) => row.map((cell, index) => cell.padEnd(widths[index] ?? cell.length)).join('  ');
+  return [render(header), ...rows.map((row) => render(row))].join('\n');
+}

package/src/policy.ts

@@ -0,0 +1,83 @@
+import { readFileSync } from 'node:fs';
+
+import type { Policy } from './types.js';
+
+/** Defaults that make the headline true: 400 receipt attempts, 5 get through. */
+export const REFERENCE_POLICY: Policy = {
+  maxIdentical: 5,
+  perHour: 12,
+  perMinute: 60,
+  maxRecipientsPerMessage: 5,
+  maxNewRecipientsPerHour: 5,
+  approvalForNewDomains: true,
+  knownDomains: ['example.com'],
+  knownRecipients: ['buyer@example.com', 'support@example.com'],
+  refuseSecretsToNewDomains: true,
+  allowSelfLimitRaise: false,
+};
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}
+
+function optionalNumber(source: Record<string, unknown>, key: string, fallback: number): number {
+  if (!(key in source)) return fallback;
+  const value = source[key];
+  if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+    throw new Error(`${key} must be a non-negative integer.`);
+  }
+  return value;
+}
+
+function optionalBoolean(source: Record<string, unknown>, key: string, fallback: boolean): boolean {
+  if (!(key in source)) return fallback;
+  const value = source[key];
+  if (typeof value !== 'boolean') throw new Error(`${key} must be a boolean.`);
+  return value;
+}
+
+function optionalStrings(source: Record<string, unknown>, key: string, fallback: readonly string[]): string[] {
+  if (!(key in source)) return [...fallback];
+  const value = source[key];
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string')) {
+    throw new Error(`${key} must be an array of strings.`);
+  }
+  return value.map((entry) => entry.toLowerCase());
+}
+
+export function parsePolicy(value: unknown): Policy {
+  if (!isRecord(value)) throw new Error('agent-email-guard.json must be a JSON object.');
+  return {
+    maxIdentical: optionalNumber(value, 'maxIdentical', REFERENCE_POLICY.maxIdentical),
+    perHour: optionalNumber(value, 'perHour', REFERENCE_POLICY.perHour),
+    perMinute: optionalNumber(value, 'perMinute', REFERENCE_POLICY.perMinute),
+    maxRecipientsPerMessage: optionalNumber(
+      value,
+      'maxRecipientsPerMessage',
+      REFERENCE_POLICY.maxRecipientsPerMessage,
+    ),
+    maxNewRecipientsPerHour: optionalNumber(
+      value,
+      'maxNewRecipientsPerHour',
+      REFERENCE_POLICY.maxNewRecipientsPerHour,
+    ),
+    approvalForNewDomains: optionalBoolean(
+      value,
+      'approvalForNewDomains',
+      REFERENCE_POLICY.approvalForNewDomains,
+    ),
+    knownDomains: optionalStrings(value, 'knownDomains', REFERENCE_POLICY.knownDomains),
+    knownRecipients: optionalStrings(value, 'knownRecipients', REFERENCE_POLICY.knownRecipients),
+    refuseSecretsToNewDomains: optionalBoolean(
+      value,
+      'refuseSecretsToNewDomains',
+      REFERENCE_POLICY.refuseSecretsToNewDomains,
+    ),
+    allowSelfLimitRaise: optionalBoolean(value, 'allowSelfLimitRaise', REFERENCE_POLICY.allowSelfLimitRaise),
+  };
+}
+
+export function readPolicyFile(path: string): Policy {
+  const parsed: unknown = JSON.parse(readFileSync(path, 'utf8'));
+  return parsePolicy(parsed);
+}

package/src/scenarios.ts

@@ -0,0 +1,270 @@
+import { readFileSync, readdirSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+import type { Bounds, ReferenceRun, Scenario, ScriptOp, UntrustedInput } from './types.js';
+
+export interface BenchmarkManifest {
+  readonly id: string;
+  readonly version: number;
+  readonly published: string;
+  readonly headlineScenarioId: string;
+  readonly headline: string;
+  readonly referencePolicy: string;
+  readonly metrics: readonly string[];
+  readonly scenarioIds: readonly string[];
+}
+
+export function packageRoot(): string {
+  return fileURLToPath(new URL('..', import.meta.url));
+}
+
+export function loadBenchmark(root = packageRoot()): BenchmarkManifest {
+  return parseBenchmark(readJson(join(root, 'benchmark', 'monthly.json')));
+}
+
+export function loadScenarios(root = packageRoot()): { benchmark: BenchmarkManifest; scenarios: Scenario[] } {
+  const benchmark = loadBenchmark(root);
+  const dir = join(root, 'scenarios');
+  const files = readdirSync(dir).filter((name) => name.endsWith('.json')).sort();
+  const byId = new Map<string, Scenario>();
+  for (const file of files) {
+    const scenario = parseScenario(readJson(join(dir, file)));
+    if (byId.has(scenario.id)) throw new Error(`Duplicate scenario id ${scenario.id}.`);
+    if (`${scenario.id}.json` !== file) throw new Error(`${file} must be named ${scenario.id}.json.`);
+    byId.set(scenario.id, scenario);
+  }
+  const scenarios: Scenario[] = [];
+  for (const id of benchmark.scenarioIds) {
+    const scenario = byId.get(id);
+    if (!scenario) throw new Error(`benchmark lists ${id} but scenarios/${id}.json is missing.`);
+    scenarios.push(scenario);
+    byId.delete(id);
+  }
+  if (byId.size > 0) {
+    throw new Error(`Scenario files are not in the monthly benchmark: ${[...byId.keys()].join(', ')}.`);
+  }
+  const headlines = scenarios.filter((scenario) => scenario.headline);
+  if (headlines.length !== 1 || headlines[0]?.id !== benchmark.headlineScenarioId) {
+    throw new Error(`The monthly headline must be ${benchmark.headlineScenarioId}.`);
+  }
+  return { benchmark, scenarios };
+}
+
+function readJson(path: string): unknown {
+  return JSON.parse(readFileSync(path, 'utf8')) as unknown;
+}
+
+function parseBenchmark(value: unknown): BenchmarkManifest {
+  const record = object(value, 'benchmark');
+  const scenarioIds = stringArray(record.scenarioIds, 'scenarioIds');
+  if (new Set(scenarioIds).size !== scenarioIds.length) throw new Error('Duplicate benchmark scenario id.');
+  return {
+    id: stringField(record, 'id'),
+    version: intField(record, 'version'),
+    published: stringField(record, 'published'),
+    headlineScenarioId: stringField(record, 'headlineScenarioId'),
+    headline: stringField(record, 'headline'),
+    referencePolicy: stringField(record, 'referencePolicy'),
+    metrics: stringArray(record.metrics, 'metrics'),
+    scenarioIds,
+  };
+}
+
+function parseScenario(value: unknown): Scenario {
+  const record = object(value, 'scenario');
+  requireExactKeys(record, [
+    'schemaVersion',
+    'id',
+    'name',
+    'headline',
+    'control',
+    'untrusted',
+    'task',
+    'safe',
+    'failure',
+    'fixtures',
+    'transport',
+    'script',
+    'expect',
+    'reference',
+  ]);
+  if (record.schemaVersion !== 1) throw new Error('schemaVersion must be 1.');
+  const fixtures = object(record.fixtures, 'fixtures');
+  const transport = object(record.transport, 'transport');
+  const expect = object(record.expect, 'expect');
+  const reference = object(record.reference, 'reference');
+  const script = parseScript(record.script);
+  return {
+    schemaVersion: 1,
+    id: stringField(record, 'id'),
+    name: stringField(record, 'name'),
+    headline: booleanField(record, 'headline'),
+    control: booleanField(record, 'control'),
+    untrusted: parseUntrusted(record.untrusted),
+    task: stringField(record, 'task'),
+    safe: stringField(record, 'safe'),
+    failure: stringField(record, 'failure'),
+    fixtures: { contacts: stringArray(fixtures.contacts, 'contacts') },
+    transport: { ambiguousError: booleanField(transport, 'ambiguousError') },
+    script,
+    expect: {
+      withGuard: parseBounds(expect.withGuard, 'withGuard'),
+      withoutGuard: parseBounds(expect.withoutGuard, 'withoutGuard'),
+    },
+    reference: {
+      withGuard: parseReference(reference.withGuard, 'reference.withGuard'),
+      withoutGuard: parseReference(reference.withoutGuard, 'reference.withoutGuard'),
+    },
+  };
+}
+
+function parseUntrusted(value: unknown): UntrustedInput {
+  const record = object(value, 'untrusted');
+  const channel = stringField(record, 'channel');
+  if (channel !== 'none' && channel !== 'email' && channel !== 'web' && channel !== 'tool') {
+    throw new Error(`Unknown untrusted channel ${channel}.`);
+  }
+  return { channel, content: stringField(record, 'content') };
+}
+
+function parseBounds(value: unknown, label: string): Bounds {
+  const record = object(value, label);
+  const bounds: { minThrough?: number; maxThrough?: number; limitsChanged?: boolean } = {};
+  if ('minThrough' in record) bounds.minThrough = intField(record, 'minThrough');
+  if ('maxThrough' in record) bounds.maxThrough = intField(record, 'maxThrough');
+  if ('limitsChanged' in record) bounds.limitsChanged = booleanField(record, 'limitsChanged');
+  return bounds;
+}
+
+function parseReference(value: unknown, label: string): ReferenceRun {
+  const record = object(value, label);
+  const run: ReferenceRun = {
+    attempted: intField(record, 'attempted'),
+    through: intField(record, 'through'),
+    reason: stringField(record, 'reason'),
+    detail: record.detail === null ? null : stringField(record, 'detail'),
+  };
+  if ('limitsChanged' in record) return { ...run, limitsChanged: booleanField(record, 'limitsChanged') };
+  return run;
+}
+
+function parseScript(value: unknown): ScriptOp[] {
+  if (!Array.isArray(value) || value.length === 0) throw new Error('script must be a non-empty array.');
+  return value.map((entry) => parseOp(entry));
+}
+
+function parseOp(value: unknown): ScriptOp {
+  const record = object(value, 'script op');
+  const op = stringField(record, 'op');
+  if (op === 'send') {
+    if ('vary' in record && record.vary !== 'index') throw new Error('vary must be "index".');
+    const repeat = 'repeat' in record ? intField(record, 'repeat') : undefined;
+    const retryOnProviderError = 'retryOnProviderError' in record ? intField(record, 'retryOnProviderError') : undefined;
+    const vary = record.vary === 'index' ? 'index' : undefined;
+    const step: Extract<ScriptOp, { op: 'send' }> = {
+      op: 'send',
+      message: parseMessage(record.message),
+      ...(repeat !== undefined ? { repeat } : {}),
+      ...(retryOnProviderError !== undefined ? { retryOnProviderError } : {}),
+      ...(vary !== undefined ? { vary } : {}),
+    };
+    return step;
+  }
+  if (op === 'emailEachContact') {
+    const message = object(record.message, 'message');
+    return {
+      op: 'emailEachContact',
+      message: {
+        subject: stringField(message, 'subject'),
+        text: optionalString(message, 'text'),
+        html: optionalString(message, 'html'),
+      },
+    };
+  }
+  if (op === 'raiseLimits') {
+    return {
+      op: 'raiseLimits',
+      perHour: optionalInt(record, 'perHour'),
+      perMinute: optionalInt(record, 'perMinute'),
+      maxIdentical: optionalInt(record, 'maxIdentical'),
+    };
+  }
+  if (op === 'replyAllStorm') {
+    return {
+      op: 'replyAllStorm',
+      rounds: intField(record, 'rounds'),
+      a: stringField(record, 'a'),
+      b: stringField(record, 'b'),
+      subject: stringField(record, 'subject'),
+      text: stringField(record, 'text'),
+    };
+  }
+  throw new Error(`Unknown script op ${op}.`);
+}
+
+function parseMessage(value: unknown): { to: string[]; cc?: string[]; subject: string; text?: string; html?: string } {
+  const record = object(value, 'message');
+  const message: { to: string[]; cc?: string[]; subject: string; text?: string; html?: string } = {
+    to: stringArray(record.to, 'to'),
+    subject: stringField(record, 'subject'),
+  };
+  if ('cc' in record) message.cc = stringArray(record.cc, 'cc');
+  const text = optionalString(record, 'text');
+  const html = optionalString(record, 'html');
+  if (text !== undefined) message.text = text;
+  if (html !== undefined) message.html = html;
+  return message;
+}
+
+function object(value: unknown, label: string): Record<string, unknown> {
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    throw new Error(`${label} must be an object.`);
+  }
+  return value as Record<string, unknown>;
+}
+
+function requireExactKeys(record: Record<string, unknown>, keys: readonly string[]): void {
+  const actual = Object.keys(record).sort();
+  const expected = [...keys].sort();
+  if (actual.join() !== expected.join()) {
+    throw new Error(`Unexpected scenario keys: ${actual.join(', ')}.`);
+  }
+}
+
+function stringField(record: Record<string, unknown>, key: string): string {
+  const value = record[key];
+  if (typeof value !== 'string') throw new Error(`${key} must be a string.`);
+  return value;
+}
+
+function booleanField(record: Record<string, unknown>, key: string): boolean {
+  const value = record[key];
+  if (typeof value !== 'boolean') throw new Error(`${key} must be a boolean.`);
+  return value;
+}
+
+function intField(record: Record<string, unknown>, key: string): number {
+  const value = record[key];
+  if (typeof value !== 'number' || !Number.isInteger(value) || value < 0) {
+    throw new Error(`${key} must be a non-negative integer.`);
+  }
+  return value;
+}
+
+function optionalInt(record: Record<string, unknown>, key: string): number | undefined {
+  if (!(key in record)) return undefined;
+  return intField(record, key);
+}
+
+function optionalString(record: Record<string, unknown>, key: string): string | undefined {
+  if (!(key in record) || record[key] === undefined) return undefined;
+  return stringField(record, key);
+}
+
+function stringArray(value: unknown, label: string): string[] {
+  if (!Array.isArray(value) || value.some((entry) => typeof entry !== 'string')) {
+    throw new Error(`${label} must be an array of strings.`);
+  }
+  return value;
+}

package/src/schema-check.ts

@@ -0,0 +1,94 @@
+/** Checks JSON values against the subset of JSON Schema draft 2020-12 these files use. */
+
+interface Schema {
+  readonly $ref?: string;
+  readonly $defs?: Readonly<Record<string, Schema>>;
+  readonly const?: unknown;
+  readonly enum?: readonly unknown[];
+  readonly type?: string | readonly string[];
+  readonly required?: readonly string[];
+  readonly properties?: Readonly<Record<string, Schema>>;
+  readonly additionalProperties?: boolean;
+  readonly items?: Schema;
+  readonly minItems?: number;
+  readonly minimum?: number;
+  readonly minLength?: number;
+  readonly pattern?: string;
+}
+
+export function assertSchema(value: unknown, schema: Schema, label = 'value'): void {
+  check(value, schema, schema, label);
+}
+
+function check(value: unknown, schema: Schema, root: Schema, label: string): void {
+  if (schema.$ref !== undefined) {
+    check(value, resolveRef(schema.$ref, root), root, label);
+    return;
+  }
+  if (schema.const !== undefined && value !== schema.const) {
+    throw new Error(`${label} must be ${JSON.stringify(schema.const)}.`);
+  }
+  if (schema.enum !== undefined && !schema.enum.includes(value)) {
+    throw new Error(`${label} is not in the enum.`);
+  }
+  if (schema.type !== undefined && !typeMatches(value, schema.type)) {
+    throw new Error(`${label} has the wrong type.`);
+  }
+  if (typeof value === 'string' && schema.minLength !== undefined && value.length < schema.minLength) {
+    throw new Error(`${label} is shorter than ${schema.minLength}.`);
+  }
+  if (typeof value === 'string' && schema.pattern !== undefined && !new RegExp(schema.pattern).test(value)) {
+    throw new Error(`${label} does not match ${schema.pattern}.`);
+  }
+  if (typeof value === 'number' && schema.minimum !== undefined && value < schema.minimum) {
+    throw new Error(`${label} is below ${schema.minimum}.`);
+  }
+  if (Array.isArray(value)) {
+    if (schema.minItems !== undefined && value.length < schema.minItems) {
+      throw new Error(`${label} has fewer than ${schema.minItems} items.`);
+    }
+    if (schema.items !== undefined) {
+      value.forEach((entry, index) => check(entry, schema.items as Schema, root, `${label}[${index}]`));
+    }
+  }
+  if (isObject(value)) {
+    const required = schema.required ?? [];
+    for (const key of required) {
+      if (!(key in value)) throw new Error(`${label}.${key} is required.`);
+    }
+    if (schema.properties !== undefined) {
+      for (const [key, child] of Object.entries(value)) {
+        const childSchema = schema.properties[key];
+        if (childSchema === undefined) {
+          if (schema.additionalProperties === false) throw new Error(`${label}.${key} is not allowed.`);
+          continue;
+        }
+        check(child, childSchema, root, `${label}.${key}`);
+      }
+    }
+  }
+}
+
+function resolveRef(ref: string, root: Schema): Schema {
+  const prefix = '#/$defs/';
+  if (!ref.startsWith(prefix)) throw new Error(`Unsupported $ref ${ref}.`);
+  const name = ref.slice(prefix.length);
+  const found = root.$defs?.[name];
+  if (found === undefined) throw new Error(`Missing $ref ${ref}.`);
+  return found;
+}
+
+function typeMatches(value: unknown, type: string | readonly string[]): boolean {
+  const types = Array.isArray(type) ? type : [type];
+  return types.some((entry) => {
+    if (entry === 'integer') return typeof value === 'number' && Number.isInteger(value);
+    if (entry === 'null') return value === null;
+    if (entry === 'array') return Array.isArray(value);
+    if (entry === 'object') return isObject(value);
+    return typeof value === entry;
+  });
+}
+
+function isObject(value: unknown): value is Record<string, unknown> {
+  return typeof value === 'object' && value !== null && !Array.isArray(value);
+}