ai-sdk-openai-guardrails 0.1.0

package/CHANGELOG.md

@@ -0,0 +1,12 @@
+# Changelog
+
+## 0.1.0
+
+First release.
+
+- `guardrailsMiddleware()` runs an OpenAI Guardrails pipeline bundle as AI SDK language model middleware, against any provider.
+- Pre-flight and input stages run in `transformParams`, so a tripwire fails the call before the provider is billed and pre-flight PII redactions reach the provider already masked.
+- Output stage runs in `wrapGenerate` and, for streams, behind a gate with three modes: `buffer`, `chunk`, and `off`.
+- Tool calls and tool results from the AI SDK prompt are converted into the conversation history that `Prompt Injection Detection` and the other history-aware checks read.
+- Checks that fail to execute block the call by default (`onCheckError: 'throw'`).
+- One build supports `ai@6` (provider spec v3) and `ai@7` (spec v4).

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Sokratis Vidros
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,268 @@
+# ai-sdk-openai-guardrails
+
+Run [OpenAI Guardrails](https://github.com/openai/openai-guardrails-js) inside the [Vercel AI SDK](https://ai-sdk.dev), as language model middleware. Works with any AI SDK provider, not just OpenAI.
+
+```ts
+const model = wrapLanguageModel({
+  model: anthropic('claude-sonnet-4-5'),
+  middleware: guardrailsMiddleware({ config, guardrailLlm: new OpenAI() }),
+});
+```
+
+Moderation, jailbreak detection, PII redaction, secret-key leak detection, and prompt-injection detection then run on every `generateText`, `streamText`, and agent step that uses that model.
+
+## Why this package exists
+
+`@openai/guardrails` ships two layers. The first is `GuardrailsOpenAI`, a drop-in replacement for the `openai` client. It cannot work with the AI SDK: AI SDK providers talk to model APIs through their own `fetch` and never take an `openai` client. `GuardrailAgent` is bound to `@openai/agents` for the same reason.
+
+The layer underneath is a model-agnostic runtime that operates on plain text. This package plugs that runtime into the AI SDK middleware lifecycle, and does the work the drop-in client does for OpenAI's own request shapes, which nobody does for the AI SDK:
+
+- Map the bundle's three stages onto `transformParams`, `wrapGenerate`, and `wrapStream`.
+- Apply pre-flight PII redactions back into the prompt, so the provider receives masked text.
+- Convert an AI SDK prompt (tool calls and tool results included) into the conversation history that the history-aware checks read. Without this, `Prompt Injection Detection` has no tool traffic to inspect.
+- Run the output stage against a stream without reordering its parts.
+
+## Install
+
+```bash
+npm install ai-sdk-openai-guardrails @openai/guardrails
+```
+
+`ai` and `@openai/guardrails` are peer dependencies. The package itself has no runtime dependencies.
+
+| Peer | Range |
+|---|---|
+| `ai` | `^6.0.0 \|\| ^7.0.0` |
+| `@openai/guardrails` | `>=0.2.0 <1` |
+
+## Quick start
+
+Create a pipeline bundle with the wizard at [guardrails.openai.com](https://guardrails.openai.com), or write it by hand:
+
+```ts
+import { openai } from '@ai-sdk/openai';
+import { generateText, wrapLanguageModel } from 'ai';
+import OpenAI from 'openai';
+import { GuardrailTripwireError, guardrailsMiddleware } from 'ai-sdk-openai-guardrails';
+
+const model = wrapLanguageModel({
+  model: openai('gpt-5'),
+  middleware: guardrailsMiddleware({
+    config: {
+      version: 1,
+      pre_flight: {
+        version: 1,
+        guardrails: [
+          {
+            name: 'Contains PII',
+            config: {
+              entities: ['US_SSN', 'EMAIL_ADDRESS'],
+              block: false,
+              detect_encoded_pii: true,
+            },
+          },
+        ],
+      },
+      input: {
+        version: 1,
+        guardrails: [
+          { name: 'Moderation', config: { categories: ['hate', 'violence'] } },
+          { name: 'Jailbreak', config: { model: 'gpt-5-mini', confidence_threshold: 0.7 } },
+        ],
+      },
+      output: {
+        version: 1,
+        guardrails: [{ name: 'Secret Keys', config: { threshold: 'balanced' } }],
+      },
+    },
+    guardrailLlm: new OpenAI(),
+  }),
+});
+
+try {
+  const { text } = await generateText({ model, prompt: 'My SSN is 123-45-6789. Help me file.' });
+  console.log(text);
+} catch (error) {
+  if (GuardrailTripwireError.isInstance(error)) {
+    console.error(`Blocked at ${error.stage} by ${error.guardrailNames.join(', ')}`);
+  } else {
+    throw error;
+  }
+}
+```
+
+The model sees `My SSN is <US_SSN>. Help me file.` A tripwire at any stage throws `GuardrailTripwireError`.
+
+`config` also accepts the bundle as a JSON string, so a file read or an environment variable can be passed straight in.
+
+## How the stages map
+
+| Bundle stage | Middleware hook | Runs on | Effect |
+|---|---|---|---|
+| `pre_flight` | `transformParams` | Prompt text | Redactions are applied to the prompt before the provider call. A tripwire fails the call. |
+| `input` | `transformParams` | Prompt text, after redaction | A tripwire fails the call, before the provider is billed. |
+| `output` | `wrapGenerate` / `wrapStream` | Generated text | A tripwire fails the call or errors the stream. |
+
+Unused stages are skipped. They are not instantiated and they cost nothing.
+
+### What counts as prompt text
+
+By default the pre-flight and input stages see the last user message, matching the OpenAI drop-in client. Set `inputScope: 'all-messages'` to cover every user and assistant turn plus all tool output, excluding the system prompt. Tool output is a common injection vector. Use `all-messages` with `Prompt Injection Detection`.
+
+## Streaming
+
+Output guardrails need a block of text before they can run. `stream.mode` chooses how that delay is handled.
+
+| Mode | Behavior | Use when |
+|---|---|---|
+| `buffer` (default) | Holds every part, checks the completed text once, then releases. | No unchecked text may reach the reader. |
+| `chunk` | Checks the text accumulated so far every `chunkChars` characters (default 200) and releases the parts behind each passing check. | You want tokens to arrive as they are generated, and can accept that a late tripwire arrives after some text has already gone out. |
+| `off` | Passes the stream through unchecked. Input stages still run. | Output checks belong somewhere else in your stack. |
+
+```ts
+guardrailsMiddleware({ config, guardrailLlm, stream: { mode: 'chunk', chunkChars: 200 } });
+```
+
+In `chunk` mode each check runs on the whole block accumulated so far, not just the new characters, so an LLM-backed output check is called repeatedly on growing text. Prefer the local checks (`Secret Keys`, `Contains PII`, `Competitors`, `Keyword Filter`) there.
+
+Parts are always released in arrival order, and only once every character of text ahead of them has passed, so a tool call a provider interleaves with text can never overtake that text. A tripwire errors the stream, which cancels the upstream request.
+
+## Cost of each guardrail
+
+Names and configuration come from `@openai/guardrails`, not from this package. The difference that matters for cost is which checks call OpenAI.
+
+| Guardrail | Engine | Calls OpenAI |
+|---|---|---|
+| `Keyword Filter` | regex | no |
+| `Competitors` | regex | no |
+| `Secret Keys` | regex | no |
+| `URL Filter` | regex plus URL parsing | no |
+| `Contains PII` | regex | no |
+| `Moderation` | Moderation API | yes |
+| `Jailbreak` | LLM | yes |
+| `NSFW Text` | LLM | yes |
+| `Off Topic Prompts` | LLM | yes |
+| `Custom Prompt Check` | LLM | yes |
+| `Prompt Injection Detection` | LLM | yes |
+| `Hallucination Detection` | Responses API file search | yes, plus a vector store |
+
+The local checks add no network call and no latency worth measuring. The rest cost one OpenAI call per stage per model call, including when the answering model is Anthropic, Google, or a local one.
+
+`Contains PII` in the JavaScript port is regex-based and needs no Presidio service, unlike the Python original.
+
+## Options
+
+| Option | Default | What it does |
+|---|---|---|
+| `config` | required | Pipeline bundle, as an object or a JSON string. |
+| `guardrailLlm` | required | An `openai` client for the checks that call OpenAI. Typed structurally, so any `openai` major works. |
+| `inputScope` | `'latest-user'` | `'latest-user'` or `'all-messages'`. See above. |
+| `maskInput` | `true` | Apply pre-flight redactions to the prompt. |
+| `stream.mode` | `'buffer'` | `'buffer'`, `'chunk'` or `'off'`. |
+| `stream.chunkChars` | `200` | Characters of new text per check in `chunk` mode. |
+| `onCheckError` | `'throw'` | `'throw'` or `'ignore'`. See below. |
+| `onResults` | none | Called once per stage that ran, tripwire or not. Awaited. |
+| `context` | none | Extra fields merged into the guardrail context, for custom checks. |
+
+### Failing closed
+
+If a check cannot run (the Moderation API is down, or the guardrail model rejects the request), the default is to block the call and throw `GuardrailCheckFailedError`. A pipeline that cannot decide whether content is safe does not pass it through.
+
+`@openai/guardrails` defaults to the opposite: `runGuardrails` swallows the failure and returns `executionFailed: true` with the tripwire clear. Set `onCheckError: 'ignore'` for that behavior, and read `event.results[].executionFailed` in `onResults` to see what happened.
+
+### Observability
+
+```ts
+guardrailsMiddleware({
+  config,
+  guardrailLlm,
+  onResults: ({ stage, text, results, triggered }) => {
+    metrics.increment('guardrails.stage', { stage, triggered: triggered.length });
+    for (const result of results) {
+      if (result.executionFailed) {
+        logger.warn({ guardrail: result.info?.guardrail_name }, 'guardrail could not run');
+      }
+    }
+  },
+});
+```
+
+`onResults` is awaited, so an error thrown there fails the model call.
+
+## Agent loops and tool injection
+
+The middleware runs per model call. In a multi-step agent loop that is once per step.
+
+Tool output is checked on later steps: by step two, the first step's tool results are in the prompt, so an input-stage check sees them. `Prompt Injection Detection` depends on this. The middleware converts the AI SDK prompt into `function_call` and `function_call_output` conversation entries, which is the shape the check matches on.
+
+```ts
+guardrailsMiddleware({
+  config: {
+    version: 1,
+    input: {
+      version: 1,
+      guardrails: [
+        {
+          name: 'Prompt Injection Detection',
+          config: { model: 'gpt-5-mini', confidence_threshold: 0.7 },
+        },
+      ],
+    },
+  },
+  guardrailLlm: new OpenAI(),
+  inputScope: 'all-messages',
+});
+```
+
+The input stage also repeats. A four-step agent run means four input-stage passes. With LLM-backed checks that is four extra OpenAI calls. You can accept that cost, run the expensive checks once at your application boundary with `runGuardrails`, or keep the middleware bundle to the local checks.
+
+## Errors
+
+Both error classes carry a `Symbol.for` marker, so `isInstance` still works when duplicate copies of this package share a dependency tree. `instanceof` does not.
+
+```ts
+import { GuardrailCheckFailedError, GuardrailTripwireError } from 'ai-sdk-openai-guardrails';
+
+if (GuardrailTripwireError.isInstance(error)) {
+  error.stage; // 'pre_flight' | 'input' | 'output'
+  error.guardrailNames; // ['Jailbreak']
+  error.results; // the GuardrailResult objects that fired, with their info payloads
+}
+
+if (GuardrailCheckFailedError.isInstance(error)) {
+  error.stage;
+  error.guardrailName;
+  error.cause; // the underlying failure
+}
+```
+
+## Helpers
+
+Exported for anyone running checks outside the middleware, against `runGuardrails` directly:
+
+```ts
+import {
+  extractContentText,
+  extractPromptText,
+  toGuardrailConversation,
+} from 'ai-sdk-openai-guardrails';
+
+extractPromptText(prompt, 'latest-user'); // string
+extractContentText(result.content); // string
+toGuardrailConversation(prompt); // conversation entries for the history-aware checks
+```
+
+## AI SDK version support
+
+One build serves `ai@6` (provider spec v3) and `ai@7` (spec v4). Prompt text, tool parts, the stream envelope, and the middleware hooks are the same in both specs, so the types are structural instead of imported from a pinned `@ai-sdk/provider`. `src/compat.test.ts` checks assignability both ways and runs the middleware through `ai@6` `wrapLanguageModel` and `generateText`.
+
+## Limitations
+
+- Output checks look at text. Tool call arguments are not checked.
+- Once `chunk` mode has released text it cannot recall it. Only `buffer` mode guarantees that nothing unchecked reaches the reader.
+- Pre-flight redaction rewrites text parts and the system prompt, never tool results: those are JSON the model has to parse, and masking them would corrupt the payload.
+- `Hallucination Detection` needs a vector store you have already populated. This package forwards that config. It does not create a vector store.
+
+## License
+
+MIT

package/dist/index.cjs

@@ -0,0 +1,397 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/index.ts
+var index_exports = {};
+__export(index_exports, {
+  GuardrailCheckFailedError: () => GuardrailCheckFailedError,
+  GuardrailTripwireError: () => GuardrailTripwireError,
+  extractContentText: () => extractContentText,
+  extractPromptText: () => extractPromptText,
+  guardrailsMiddleware: () => guardrailsMiddleware,
+  toGuardrailConversation: () => toGuardrailConversation
+});
+module.exports = __toCommonJS(index_exports);
+
+// src/errors.ts
+var tripwireMarker = /* @__PURE__ */ Symbol.for("ai-sdk-openai-guardrails.tripwire");
+var checkFailedMarker = /* @__PURE__ */ Symbol.for("ai-sdk-openai-guardrails.check-failed");
+function hasMarker(error, marker) {
+  return error instanceof Error && marker in error;
+}
+function namesOf(results) {
+  return results.map((result) => String(result.info?.guardrail_name ?? "unknown"));
+}
+var GuardrailTripwireError = class extends Error {
+  [tripwireMarker] = true;
+  stage;
+  results;
+  constructor(stage, results) {
+    super(`Guardrail tripwire triggered at the ${stage} stage: ${namesOf(results).join(", ")}`);
+    this.name = "GuardrailTripwireError";
+    this.stage = stage;
+    this.results = results;
+  }
+  get guardrailNames() {
+    return namesOf(this.results);
+  }
+  static isInstance(error) {
+    return hasMarker(error, tripwireMarker);
+  }
+};
+var GuardrailCheckFailedError = class extends Error {
+  [checkFailedMarker] = true;
+  stage;
+  guardrailName;
+  constructor(stage, guardrailName, cause) {
+    super(`Guardrail '${guardrailName}' failed to run at the ${stage} stage`, { cause });
+    this.name = "GuardrailCheckFailedError";
+    this.stage = stage;
+    this.guardrailName = guardrailName;
+  }
+  static isInstance(error) {
+    return hasMarker(error, checkFailedMarker);
+  }
+};
+
+// src/pipeline.ts
+var import_guardrails = require("@openai/guardrails");
+var STAGES = ["pre_flight", "input", "output"];
+function createStageRunner(config, onCheckError) {
+  let stagesPromise;
+  function stages() {
+    stagesPromise ??= (async () => {
+      const pipeline = await (0, import_guardrails.loadPipelineBundles)(config);
+      const entries = await Promise.all(
+        STAGES.map(async (stage) => {
+          const bundle = pipeline[stage];
+          const guardrails = bundle?.guardrails?.length ? await (0, import_guardrails.instantiateGuardrails)(bundle) : [];
+          return [stage, guardrails];
+        })
+      );
+      return Object.fromEntries(entries);
+    })();
+    return stagesPromise;
+  }
+  return {
+    async isEmpty(stage) {
+      return (await stages())[stage].length === 0;
+    },
+    async run(stage, text, context) {
+      const guardrails = (await stages())[stage];
+      if (guardrails.length === 0) {
+        return [];
+      }
+      return Promise.all(
+        guardrails.map(async (guardrail) => {
+          const name = guardrail.definition.name;
+          let result;
+          try {
+            result = await guardrail.run(context, text);
+          } catch (error) {
+            if (onCheckError === "throw") {
+              throw new GuardrailCheckFailedError(stage, name, error);
+            }
+            return {
+              tripwireTriggered: false,
+              executionFailed: true,
+              originalException: error instanceof Error ? error : new Error(String(error)),
+              info: { stage_name: stage, guardrail_name: name }
+            };
+          }
+          if (result.executionFailed && onCheckError === "throw") {
+            throw new GuardrailCheckFailedError(stage, name, result.originalException);
+          }
+          return {
+            ...result,
+            info: { stage_name: stage, guardrail_name: name, ...result.info }
+          };
+        })
+      );
+    }
+  };
+}
+
+// src/prompt.ts
+var ZERO_WIDTH = /\u200B|\u200C|\u200D|\u2060|\uFEFF/g;
+function normalize(text) {
+  return text.normalize("NFKC").replace(ZERO_WIDTH, "");
+}
+function joinTextParts(message) {
+  if (message.role === "system") {
+    return message.content;
+  }
+  const chunks = [];
+  for (const part of message.content) {
+    if (part.type === "text" && part.text !== void 0) {
+      chunks.push(part.text);
+    } else if (part.type === "tool-result" && part.output !== void 0) {
+      chunks.push(stringifyToolOutput(part.output));
+    }
+  }
+  return chunks.join("\n");
+}
+function stringifyToolOutput(output) {
+  if ("value" in output) {
+    return typeof output.value === "string" ? output.value : JSON.stringify(output.value);
+  }
+  return JSON.stringify(output);
+}
+function stringifyToolInput(input) {
+  return typeof input === "string" ? input : JSON.stringify(input ?? {});
+}
+function extractPromptText(prompt, scope) {
+  if (scope === "latest-user") {
+    for (let i = prompt.length - 1; i >= 0; i--) {
+      const message = prompt[i];
+      if (message?.role === "user") {
+        return joinTextParts(message);
+      }
+    }
+    return "";
+  }
+  return prompt.filter((message) => message.role !== "system").map(joinTextParts).filter((text) => text.length > 0).join("\n");
+}
+function extractContentText(content) {
+  return content.filter((part) => part.type === "text").map((part) => part.text ?? "").join("");
+}
+function toGuardrailConversation(prompt) {
+  const entries = [];
+  for (const message of prompt) {
+    if (message.role === "system") {
+      entries.push({ role: "system", content: message.content });
+      continue;
+    }
+    for (const part of message.content) {
+      if (part.type === "text") {
+        entries.push({ role: message.role, content: part.text ?? "" });
+      } else if (part.type === "tool-call") {
+        entries.push({
+          type: "function_call",
+          tool_name: part.toolName,
+          arguments: stringifyToolInput(part.input),
+          call_id: part.toolCallId
+        });
+      } else if (part.type === "tool-result" && part.output !== void 0) {
+        entries.push({
+          type: "function_call_output",
+          tool_name: part.toolName,
+          output: stringifyToolOutput(part.output),
+          call_id: part.toolCallId
+        });
+      }
+    }
+  }
+  return entries;
+}
+function buildMask(results, checkedText) {
+  const mappings = [];
+  let checkedTextOverride;
+  for (const result of results) {
+    const detected = result.info?.detected_entities;
+    if (!detected || typeof detected !== "object") {
+      continue;
+    }
+    for (const [entityType, entities] of Object.entries(detected)) {
+      if (!Array.isArray(entities)) {
+        continue;
+      }
+      for (const entity of entities) {
+        mappings.push([normalize(String(entity)), `<${entityType}>`]);
+      }
+    }
+    if (typeof result.info?.checked_text === "string" && checkedTextOverride === void 0) {
+      checkedTextOverride = result.info.checked_text;
+    }
+  }
+  if (mappings.length === 0 && checkedTextOverride === void 0) {
+    return void 0;
+  }
+  mappings.sort((a, b) => b[0].length - a[0].length);
+  return (text) => {
+    const normalized = normalize(text);
+    let masked = normalized;
+    for (const [entity, token] of mappings) {
+      if (entity && masked.includes(entity)) {
+        masked = masked.split(entity).join(token);
+      }
+    }
+    if (masked !== normalized) {
+      return masked;
+    }
+    if (checkedTextOverride !== void 0 && text === checkedText) {
+      return checkedTextOverride;
+    }
+    return text;
+  };
+}
+function maskPrompt(prompt, mask) {
+  const masked = prompt.map((message) => {
+    if (message.role === "system") {
+      return { ...message, content: mask(message.content) };
+    }
+    return {
+      ...message,
+      content: message.content.map(
+        (part) => part.type === "text" && part.text !== void 0 ? { ...part, text: mask(part.text) } : part
+      )
+    };
+  });
+  return masked;
+}
+
+// src/stream.ts
+function createOutputCheckTransform(options) {
+  const { mode, chunkChars, check } = options;
+  const blocks = /* @__PURE__ */ new Map();
+  let pending = [];
+  function unchecked() {
+    let total = 0;
+    for (const block of blocks.values()) {
+      total += block.text.length - block.checked;
+    }
+    return total;
+  }
+  async function checkOpenBlocks() {
+    for (const block of blocks.values()) {
+      if (block.text.length > block.checked) {
+        await check(block.text);
+        block.checked = block.text.length;
+      }
+    }
+  }
+  function flush(controller) {
+    for (const part of pending) {
+      controller.enqueue(part);
+    }
+    pending = [];
+  }
+  return new TransformStream({
+    async transform(part, controller) {
+      pending.push(part);
+      const id = part.id ?? "";
+      switch (part.type) {
+        case "text-start":
+          blocks.set(id, { text: "", checked: 0 });
+          break;
+        case "text-delta": {
+          const block = blocks.get(id) ?? { text: "", checked: 0 };
+          block.text += part.delta ?? "";
+          blocks.set(id, block);
+          break;
+        }
+        default:
+          break;
+      }
+      const boundary = part.type === "text-end" || part.type === "finish";
+      if (boundary || mode === "chunk" && unchecked() >= chunkChars) {
+        await checkOpenBlocks();
+      }
+      if (part.type === "text-end") {
+        blocks.delete(id);
+      }
+      if (unchecked() === 0) {
+        flush(controller);
+      }
+    },
+    async flush(controller) {
+      await checkOpenBlocks();
+      flush(controller);
+    }
+  });
+}
+
+// src/middleware.ts
+var DEFAULT_CHUNK_CHARS = 200;
+function guardrailsMiddleware(options) {
+  const {
+    config,
+    guardrailLlm,
+    context: extraContext,
+    inputScope = "latest-user",
+    maskInput = true,
+    onCheckError = "throw",
+    onResults
+  } = options;
+  const streamMode = options.stream?.mode ?? "buffer";
+  const chunkChars = options.stream?.chunkChars ?? DEFAULT_CHUNK_CHARS;
+  const runner = createStageRunner(config, onCheckError);
+  async function runStage(stage, text, prompt) {
+    if (text.length === 0 || await runner.isEmpty(stage)) {
+      return [];
+    }
+    const conversationHistory = toGuardrailConversation(prompt);
+    const results = await runner.run(stage, text, {
+      ...extraContext,
+      guardrailLlm,
+      conversationHistory,
+      getConversationHistory: () => conversationHistory
+    });
+    const triggered = results.filter((result) => result.tripwireTriggered);
+    await onResults?.({ stage, text, results, triggered });
+    if (triggered.length > 0) {
+      throw new GuardrailTripwireError(stage, triggered);
+    }
+    return results;
+  }
+  const middleware = {
+    specificationVersion: "v4",
+    async transformParams({ params }) {
+      const text = extractPromptText(params.prompt, inputScope);
+      if (text.length === 0) {
+        return params;
+      }
+      const preflight = await runStage("pre_flight", text, params.prompt);
+      const mask = maskInput ? buildMask(preflight, text) : void 0;
+      const prompt = mask ? maskPrompt(params.prompt, mask) : params.prompt;
+      await runStage("input", mask ? extractPromptText(prompt, inputScope) : text, prompt);
+      return prompt === params.prompt ? params : { ...params, prompt };
+    },
+    async wrapGenerate({ doGenerate, params }) {
+      const result = await doGenerate();
+      await runStage("output", extractContentText(result.content), params.prompt);
+      return result;
+    },
+    async wrapStream({ doStream, params }) {
+      const result = await doStream();
+      if (streamMode === "off" || await runner.isEmpty("output")) {
+        return result;
+      }
+      const transform = createOutputCheckTransform({
+        mode: streamMode,
+        chunkChars,
+        check: async (text) => {
+          await runStage("output", text, params.prompt);
+        }
+      });
+      return { ...result, stream: result.stream.pipeThrough(transform) };
+    }
+  };
+  return middleware;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  GuardrailCheckFailedError,
+  GuardrailTripwireError,
+  extractContentText,
+  extractPromptText,
+  guardrailsMiddleware,
+  toGuardrailConversation
+});
+//# sourceMappingURL=index.cjs.map