avantgate 2.1.0 → 2.2.0

package/README.md

@@ -33,32 +33,17 @@ flowchart LR
 
 ---
 
-## 🖥️ GateWall Cockpit — Self-Hosted AI-WAF & Governance Console (`gatewall/`)
+## 🖥️ Optional Visual Cockpit — GateWall (`gatewall`)
 
-While the **AvantGate SDK** provides zero-infrastructure, in-process control inside your application runtime, the included **GateWall Cockpit** (`gatewall/`) provides a full-featured, self-hosted visual control plane, real-time audit inspector, and Human-in-the-Loop approval.
+While the **AvantGate SDK (`avantgate`)** runs **100% headless and in-process** inside your application runtime (zero servers, zero network latency), an optional visual control plane, **GateWall**, is available as a standalone repository for teams requiring a visual dashboard, real-time audit inspector, and Human-in-the-Loop approval interface.
 
 ```mermaid
 flowchart LR
-    Agent[🤖 AvantGate Agent / SDK] -- "POST /api/v1/ingest/events<br/>(Async Telemetry)" --> GateWall["🛡️ GateWall Cockpit<br/>(Next.js + SQLite)"]
-    GateWall -- "SSE /api/v1/realtime" --> Browser["💻 Web Dashboard<br/>(http://localhost:3000)"]
-    Browser -- "POST /api/v1/approvals<br/>(Approve / Reject)" --> GateWall
+    Agent[🤖 AvantGate In-Process Agent] -- "Optional HTTP Telemetry" --> GateWall["🛡️ Standalone GateWall Cockpit<br/>(Dedicated Repository)"]
+    GateWall -- "SSE Real-Time Stream" --> Browser["💻 Web Dashboard<br/>(localhost:3000)"]
 ```
 
-### 🚀 Quickstart: Run GateWall Cockpit
-
-#### Option 1: One-Line Docker Compose (Recommended)
-```bash
-docker compose up -d
-# or: npm run gatewall:docker
-```
-Open **`http://localhost:3000`** in your browser 🎉. Traces and audit sessions are automatically persisted.
-
-#### Option 2: Run with Bun or Node.js
-```bash
-cd gatewall
-bun install   # or npm install
-bun run dev   # or npm run dev
-```
+> 💡 **Standalone Repository:** GateWall Cockpit is maintained independently at `../gatewall`. If your application runs headless, you do **not** need to deploy or run GateWall — all guardrails, PII redactions, and token budgets execute directly within your Node.js process.
 
 ---
 
@@ -71,7 +56,8 @@ bun run dev   # or npm run dev
 | **⚡ Real-Time Streaming (SSE)** | Low-latency Server-Sent Events (`/api/v1/realtime`) updating session trees, metrics, and alerts dynamically without manual page refresh. |
 | **💰 FinOps & Token Tracking** | Automated token cost estimation and USD burn tracking across providers (GPT-4o, Claude 3.5 Sonnet, DeepSeek, etc.). |
 | **🛡️ Loop Shield (Anti-Cycle Guard)** | Early visual detection of recursive agent loops and aberrant repetitive tool execution cycles. |
-| **💾 Zero-External-DB SQLite Storage** | Zero setup overhead: persistent storage uses embedded SQLite (`gatewall/data/gatewall.db`) without requiring PostgreSQL, Redis, or ClickHouse. |
+| **💾 Pluggable Hexagonal Storage** | Zero setup overhead by default with embedded SQLite (`gatewall/data/gatewall.db`), zero-disk in-memory storage for CI tests, and production-ready PostgreSQL/Prisma adapter (`STORAGE_DRIVER=prisma`). |
+| **🔏 Custom Redaction Terms Manager** | Interactive visual manager in the Security Cockpit to register, categorize (Project, Company, Infra), and redact proprietary secrets and NDA keywords in-flight. |
 
 > 💡 **Agent Integration Recipes:** See [GateWall Telemetry Recipe](examples/observability/10-gatewall-telemetry.ts) and [Integration Cookbook](examples/README.md) for complete code recipes using `HttpTelemetryExporter` (`avantgate/agent`), direct HTTP ingestion, and React front-end streaming (`avantgate/client`).
 

package/dist/chunk-Z6QOMLZ2.mjs

@@ -0,0 +1,55 @@
+// src/ui/react/create-view-registry.ts
+import React from "react";
+var createViewRegistry = (registry) => {
+  const CanvasRenderer = ({
+    state,
+    context = {}
+  }) => {
+    if (!state?.content) {
+      return null;
+    }
+    const kind = state.content.kind;
+    const Component = registry[kind];
+    if (!Component) {
+      return null;
+    }
+    return React.createElement(Component, {
+      data: state.content,
+      context,
+      activeIntent: state.activeIntent
+    });
+  };
+  return {
+    registry,
+    CanvasRenderer
+  };
+};
+
+// src/ui/react/sanitize.ts
+var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+var isValidSafeUrl = (rawUrl) => {
+  if (!rawUrl || typeof rawUrl !== "string") {
+    return false;
+  }
+  const trimmed = rawUrl.trim();
+  if (!trimmed) {
+    return false;
+  }
+  if (trimmed.startsWith("#")) {
+    return true;
+  }
+  if (trimmed.startsWith("/") && !trimmed.startsWith("//")) {
+    return true;
+  }
+  try {
+    const parsed = new URL(trimmed);
+    return ALLOWED_PROTOCOLS.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+};
+
+export {
+  createViewRegistry,
+  isValidSafeUrl
+};

package/dist/control-layer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"control-layer.d.ts","sourceRoot":"","sources":["../src/control-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,+BAA+B,EAC/B,eAAe,EAIhB,MAAM,SAAS,CAAC;AAiBjB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,oBAAoB,CAAC,CAAuB;gBAExC,MAAM,EAAE,kBAAkB;IAgBtC,OAAO,CAAC,qBAAqB,CAU3B;IAEF,OAAO,CAAC,kBAAkB,CAaxB;IAEF,OAAO,CAAC,aAAa,CAcnB;IAEF,OAAO,CAAC,mBAAmB,CAezB;IAEF,OAAO,CAAC,yBAAyB,CAe/B;IAEF,OAAO,CAAC,oBAAoB,CAkC1B;IAEF,OAAO,CAAC,wBAAwB,CAW9B;IAEF,OAAO,CAAC,aAAa,CAOnB;IAEF,OAAO,CAAC,aAAa,CAUnB;IAEF,OAAO,CAAC,gBAAgB,CAMtB;IAEF,OAAO,CAAC,iBAAiB,CAsBvB;IAEF,OAAO,CAAC,uBAAuB,CAmB7B;IAEF,OAAO,CAAC,uBAAuB,CA+B7B;IAEF,OAAO,CAAC,cAAc,CAqBpB;IAEF,OAAO,CAAC,eAAe,CAarB;IAEF,OAAO,GAAU,SAAS;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,eAAe,CAAC,CA2B1B;IAGF,iBAAiB,GAAU,CAAC,EAAE,SAAS;QACrC,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAyBvC;IAEF,OAAO,CAAC,wBAAwB,CAO9B;IAEF,OAAO,CAAC,kBAAkB,CAIxB;IAEF,OAAO,CAAC,uBAAuB,CAe7B;IAEF,OAAO,CAAC,wBAAwB,CAqB9B;IAEF,OAAO,CAAC,uBAAuB,CAkB7B;IAEF,OAAO,CAAC,uBAAuB,CAY7B;IAEF,OAAO,CAAC,gCAAgC,CAiBtC;IAEF,OAAO,CAAC,qBAAqB,CAwB3B;IAEF,OAAO,CAAC,mBAAmB,CAazB;IAEF,OAAO,CAAC,gBAAgB,CAQtB;IAEF,wBAAwB,GAAU,CAAC,EACjC,SAAS,+BAA+B,CAAC,CAAC,CAAC,KAC1C,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAwCtC;CACH;AAED,eAAO,MAAM,qBAAqB,GAAI,QAAQ,kBAAkB,KAAG,qBAElE,CAAC;AAEF,eAAO,MAAM,eAAe,WAJkB,kBAAkB,KAAG,qBAIf,CAAC;AACrD,OAAO,EAAE,qBAAqB,IAAI,kBAAkB,EAAE,CAAC"}
+{"version":3,"file":"control-layer.d.ts","sourceRoot":"","sources":["../src/control-layer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,KAAK,EACV,kBAAkB,EAClB,eAAe,EACf,yBAAyB,EACzB,+BAA+B,EAC/B,eAAe,EAIhB,MAAM,SAAS,CAAC;AAiBjB,qBAAa,qBAAqB;IAChC,OAAO,CAAC,MAAM,CAAqB;IACnC,OAAO,CAAC,oBAAoB,CAAC,CAAuB;gBAExC,MAAM,EAAE,kBAAkB;IAgBtC,OAAO,CAAC,qBAAqB,CAU3B;IAEF,OAAO,CAAC,kBAAkB,CAaxB;IAEF,OAAO,CAAC,aAAa,CAcnB;IAEF,OAAO,CAAC,mBAAmB,CAqBzB;IAEF,OAAO,CAAC,yBAAyB,CAiB/B;IAEF,OAAO,CAAC,oBAAoB,CAkC1B;IAEF,OAAO,CAAC,wBAAwB,CAW9B;IAEF,OAAO,CAAC,aAAa,CAOnB;IAEF,OAAO,CAAC,aAAa,CAUnB;IAEF,OAAO,CAAC,gBAAgB,CAMtB;IAEF,OAAO,CAAC,iBAAiB,CAsBvB;IAEF,OAAO,CAAC,uBAAuB,CAmB7B;IAEF,OAAO,CAAC,uBAAuB,CA+B7B;IAEF,OAAO,CAAC,cAAc,CAqBpB;IAEF,OAAO,CAAC,eAAe,CAarB;IAEF,OAAO,GAAU,SAAS;QACxB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,eAAe,CAAC,CA2B1B;IAGF,iBAAiB,GAAU,CAAC,EAAE,SAAS;QACrC,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;QACtB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;KACpC,KAAG,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAyBvC;IAEF,OAAO,CAAC,wBAAwB,CAO9B;IAEF,OAAO,CAAC,kBAAkB,CAIxB;IAEF,OAAO,CAAC,uBAAuB,CAe7B;IAEF,OAAO,CAAC,wBAAwB,CAqB9B;IAEF,OAAO,CAAC,uBAAuB,CAkB7B;IAEF,OAAO,CAAC,uBAAuB,CAY7B;IAEF,OAAO,CAAC,gCAAgC,CAiBtC;IAEF,OAAO,CAAC,qBAAqB,CAwB3B;IAEF,OAAO,CAAC,mBAAmB,CAazB;IAEF,OAAO,CAAC,gBAAgB,CAQtB;IAEF,wBAAwB,GAAU,CAAC,EACjC,SAAS,+BAA+B,CAAC,CAAC,CAAC,KAC1C,OAAO,CAAC,yBAAyB,CAAC,CAAC,CAAC,CAAC,CAwCtC;CACH;AAED,eAAO,MAAM,qBAAqB,GAAI,QAAQ,kBAAkB,KAAG,qBAElE,CAAC;AAEF,eAAO,MAAM,eAAe,WAJkB,kBAAkB,KAAG,qBAIf,CAAC;AACrD,OAAO,EAAE,qBAAqB,IAAI,kBAAkB,EAAE,CAAC"}

package/dist/custom-terms.d.ts

@@ -0,0 +1,8 @@
+import type { CustomRedactionTermDef } from "./types";
+export interface CustomTermsSanitizationResult {
+    text: string;
+    maskedCount: number;
+    matchedTerms: string[];
+}
+export declare const sanitizeCustomTerms: (input: string, terms?: Array<string | CustomRedactionTermDef>) => CustomTermsSanitizationResult;
+//# sourceMappingURL=custom-terms.d.ts.map

package/dist/custom-terms.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"custom-terms.d.ts","sourceRoot":"","sources":["../src/custom-terms.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,sBAAsB,EAAgB,MAAM,SAAS,CAAC;AAEpE,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAsED,eAAO,MAAM,mBAAmB,GAC9B,OAAO,MAAM,EACb,QAAQ,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,KAC7C,6BAeF,CAAC"}

package/dist/index.d.ts

@@ -9,4 +9,5 @@ export * from "./prompts";
 export * from "./providers/http-client";
 export * from "./workflow";
 export * from "./secret-guard";
+export * from "./custom-terms";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,0BAA0B,CAAC;AACzC,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,iBAAiB,CAAC;AAChC,cAAc,WAAW,CAAC;AAC1B,cAAc,yBAAyB,CAAC;AACxC,cAAc,YAAY,CAAC;AAC3B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC"}

package/dist/index.js

@@ -61,6 +61,7 @@ __export(index_exports, {
   isWorkflowAbortSignal: () => isWorkflowAbortSignal,
   resolveModelPrice: () => resolveModelPrice,
   resolveModelPriceAsync: () => resolveModelPriceAsync,
+  sanitizeCustomTerms: () => sanitizeCustomTerms,
   sanitizePII: () => sanitizePII,
   sanitizeSecrets: () => sanitizeSecrets,
   validateUserInput: () => validateUserInput,
@@ -1172,6 +1173,70 @@ var createHttpProviderClient = (config) => {
   return new HttpProviderClient(config);
 };
 
+// src/custom-terms.ts
+var DEFAULT_MASKS = {
+  PROJECT: "[REDACTED_PROJECT]",
+  COMPANY: "[REDACTED_COMPANY]",
+  INFRA: "[REDACTED_INFRA]",
+  CUSTOM: "[REDACTED_CUSTOM]"
+};
+var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var resolveTermDefinition = (entry) => {
+  if (typeof entry === "string") {
+    return {
+      term: entry.trim(),
+      mask: DEFAULT_MASKS.CUSTOM,
+      category: "CUSTOM",
+      caseSensitive: false
+    };
+  }
+  const category = entry.category ?? "CUSTOM";
+  return {
+    term: entry.term.trim(),
+    mask: entry.mask ?? (DEFAULT_MASKS[category] ?? DEFAULT_MASKS.CUSTOM),
+    category,
+    caseSensitive: Boolean(entry.caseSensitive)
+  };
+};
+var buildTermRegex = (def) => {
+  const escaped = escapeRegex(def.term);
+  const leadingBoundary = /^\w/.test(def.term) ? "\\b" : "";
+  const trailingBoundary = /\w$/.test(def.term) ? "\\b" : "";
+  return new RegExp(`${leadingBoundary}${escaped}${trailingBoundary}`, def.caseSensitive ? "g" : "gi");
+};
+var replaceTermsInText = (initialText, definitions) => {
+  let currentText = initialText;
+  let totalMaskedCount = 0;
+  const matchedTermsSet = /* @__PURE__ */ new Set();
+  for (const item of definitions) {
+    const regex = buildTermRegex(item);
+    let matchCount = 0;
+    currentText = currentText.replace(regex, () => {
+      matchCount++;
+      return item.mask;
+    });
+    if (matchCount > 0) {
+      totalMaskedCount += matchCount;
+      matchedTermsSet.add(item.term);
+    }
+  }
+  return {
+    text: currentText,
+    maskedCount: totalMaskedCount,
+    matchedTerms: Array.from(matchedTermsSet)
+  };
+};
+var sanitizeCustomTerms = (input, terms) => {
+  if (!input || !terms || terms.length === 0) {
+    return { text: input, maskedCount: 0, matchedTerms: [] };
+  }
+  const normalized = terms.map(resolveTermDefinition).filter((t) => t.term.length > 0).sort((a, b) => b.term.length - a.term.length);
+  if (normalized.length === 0) {
+    return { text: input, maskedCount: 0, matchedTerms: [] };
+  }
+  return replaceTermsInText(input, normalized);
+};
+
 // src/secret-guard.ts
 var SECRET_PATTERNS = [
   // 1. Clés privées (RSA, OpenSSH, EC, DSA)
@@ -1252,6 +1317,7 @@ var sanitizeSecrets = (input) => {
 var applyOutputGuards = (rawOutput, options) => {
   let currentText = rawOutput;
   let piiCount = 0;
+  let customTermsCount = 0;
   if (options?.maskPII) {
     const piiResult = sanitizePII(currentText);
     currentText = piiResult.text;
@@ -1259,6 +1325,11 @@ var applyOutputGuards = (rawOutput, options) => {
   }
   const secretResult = sanitizeSecrets(currentText);
   currentText = secretResult.text;
+  if (options?.customRedactionTerms && options.customRedactionTerms.length > 0) {
+    const customResult = sanitizeCustomTerms(currentText, options.customRedactionTerms);
+    currentText = customResult.text;
+    customTermsCount = customResult.maskedCount;
+  }
   if (secretResult.hasSecrets && options?.secretLeakAction === "BLOCK") {
     const types = secretResult.detections.map((d) => d.type).join(", ");
     throw new SecretLeakBlockedError(
@@ -1268,9 +1339,10 @@ var applyOutputGuards = (rawOutput, options) => {
   }
   return {
     text: currentText,
-    sanitized: piiCount > 0 || secretResult.hasSecrets,
+    sanitized: piiCount > 0 || secretResult.hasSecrets || customTermsCount > 0,
     secretDetected: secretResult.hasSecrets,
     piiMaskedCount: piiCount,
+    customTermsMaskedCount: customTermsCount,
     detections: secretResult.detections
   };
 };
@@ -1335,21 +1407,27 @@ var AvantGateControlLayer = class {
     if (!guard.valid) {
       throw new Error(`[AvantGate Security Guard] Request blocked: ${guard.blockedReason}`);
     }
+    let processed = userQuery;
+    if (this.config.security?.customRedactionTerms && this.config.security.customRedactionTerms.length > 0) {
+      processed = sanitizeCustomTerms(processed, this.config.security.customRedactionTerms).text;
+    }
     if (this.config.security?.maskPII) {
-      return sanitizePII(userQuery).text;
+      return sanitizePII(processed).text;
     }
-    return userQuery;
+    return processed;
   };
   applyOutputSecurityGuards = (rawOutput) => {
     const isDlpEnabled = this.config.security?.outputDLP ?? this.config.security?.maskPII ?? false;
     const shouldCheckSecrets = this.config.security?.blockSecretLeaks ?? true;
-    if (!isDlpEnabled && !shouldCheckSecrets) {
+    const customTerms = this.config.security?.customRedactionTerms;
+    if (!isDlpEnabled && !shouldCheckSecrets && (!customTerms || customTerms.length === 0)) {
       return rawOutput;
     }
     const guardResult = applyOutputGuards(rawOutput, {
       maskPII: isDlpEnabled,
       blockSecretLeaks: shouldCheckSecrets,
-      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT"
+      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT",
+      customRedactionTerms: customTerms
     });
     return guardResult.text;
   };
@@ -2642,6 +2720,7 @@ var defineWorkflow = (config) => {
   isWorkflowAbortSignal,
   resolveModelPrice,
   resolveModelPriceAsync,
+  sanitizeCustomTerms,
   sanitizePII,
   sanitizeSecrets,
   validateUserInput,

package/dist/index.mjs

@@ -562,6 +562,70 @@ var createHttpProviderClient = (config) => {
   return new HttpProviderClient(config);
 };
 
+// src/custom-terms.ts
+var DEFAULT_MASKS = {
+  PROJECT: "[REDACTED_PROJECT]",
+  COMPANY: "[REDACTED_COMPANY]",
+  INFRA: "[REDACTED_INFRA]",
+  CUSTOM: "[REDACTED_CUSTOM]"
+};
+var escapeRegex = (value) => value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var resolveTermDefinition = (entry) => {
+  if (typeof entry === "string") {
+    return {
+      term: entry.trim(),
+      mask: DEFAULT_MASKS.CUSTOM,
+      category: "CUSTOM",
+      caseSensitive: false
+    };
+  }
+  const category = entry.category ?? "CUSTOM";
+  return {
+    term: entry.term.trim(),
+    mask: entry.mask ?? (DEFAULT_MASKS[category] ?? DEFAULT_MASKS.CUSTOM),
+    category,
+    caseSensitive: Boolean(entry.caseSensitive)
+  };
+};
+var buildTermRegex = (def) => {
+  const escaped = escapeRegex(def.term);
+  const leadingBoundary = /^\w/.test(def.term) ? "\\b" : "";
+  const trailingBoundary = /\w$/.test(def.term) ? "\\b" : "";
+  return new RegExp(`${leadingBoundary}${escaped}${trailingBoundary}`, def.caseSensitive ? "g" : "gi");
+};
+var replaceTermsInText = (initialText, definitions) => {
+  let currentText = initialText;
+  let totalMaskedCount = 0;
+  const matchedTermsSet = /* @__PURE__ */ new Set();
+  for (const item of definitions) {
+    const regex = buildTermRegex(item);
+    let matchCount = 0;
+    currentText = currentText.replace(regex, () => {
+      matchCount++;
+      return item.mask;
+    });
+    if (matchCount > 0) {
+      totalMaskedCount += matchCount;
+      matchedTermsSet.add(item.term);
+    }
+  }
+  return {
+    text: currentText,
+    maskedCount: totalMaskedCount,
+    matchedTerms: Array.from(matchedTermsSet)
+  };
+};
+var sanitizeCustomTerms = (input, terms) => {
+  if (!input || !terms || terms.length === 0) {
+    return { text: input, maskedCount: 0, matchedTerms: [] };
+  }
+  const normalized = terms.map(resolveTermDefinition).filter((t) => t.term.length > 0).sort((a, b) => b.term.length - a.term.length);
+  if (normalized.length === 0) {
+    return { text: input, maskedCount: 0, matchedTerms: [] };
+  }
+  return replaceTermsInText(input, normalized);
+};
+
 // src/secret-guard.ts
 var SECRET_PATTERNS = [
   // 1. Clés privées (RSA, OpenSSH, EC, DSA)
@@ -642,6 +706,7 @@ var sanitizeSecrets = (input) => {
 var applyOutputGuards = (rawOutput, options) => {
   let currentText = rawOutput;
   let piiCount = 0;
+  let customTermsCount = 0;
   if (options?.maskPII) {
     const piiResult = sanitizePII(currentText);
     currentText = piiResult.text;
@@ -649,6 +714,11 @@ var applyOutputGuards = (rawOutput, options) => {
   }
   const secretResult = sanitizeSecrets(currentText);
   currentText = secretResult.text;
+  if (options?.customRedactionTerms && options.customRedactionTerms.length > 0) {
+    const customResult = sanitizeCustomTerms(currentText, options.customRedactionTerms);
+    currentText = customResult.text;
+    customTermsCount = customResult.maskedCount;
+  }
   if (secretResult.hasSecrets && options?.secretLeakAction === "BLOCK") {
     const types = secretResult.detections.map((d) => d.type).join(", ");
     throw new SecretLeakBlockedError(
@@ -658,9 +728,10 @@ var applyOutputGuards = (rawOutput, options) => {
   }
   return {
     text: currentText,
-    sanitized: piiCount > 0 || secretResult.hasSecrets,
+    sanitized: piiCount > 0 || secretResult.hasSecrets || customTermsCount > 0,
     secretDetected: secretResult.hasSecrets,
     piiMaskedCount: piiCount,
+    customTermsMaskedCount: customTermsCount,
     detections: secretResult.detections
   };
 };
@@ -725,21 +796,27 @@ var AvantGateControlLayer = class {
     if (!guard.valid) {
       throw new Error(`[AvantGate Security Guard] Request blocked: ${guard.blockedReason}`);
     }
+    let processed = userQuery;
+    if (this.config.security?.customRedactionTerms && this.config.security.customRedactionTerms.length > 0) {
+      processed = sanitizeCustomTerms(processed, this.config.security.customRedactionTerms).text;
+    }
     if (this.config.security?.maskPII) {
-      return sanitizePII(userQuery).text;
+      return sanitizePII(processed).text;
     }
-    return userQuery;
+    return processed;
   };
   applyOutputSecurityGuards = (rawOutput) => {
     const isDlpEnabled = this.config.security?.outputDLP ?? this.config.security?.maskPII ?? false;
     const shouldCheckSecrets = this.config.security?.blockSecretLeaks ?? true;
-    if (!isDlpEnabled && !shouldCheckSecrets) {
+    const customTerms = this.config.security?.customRedactionTerms;
+    if (!isDlpEnabled && !shouldCheckSecrets && (!customTerms || customTerms.length === 0)) {
       return rawOutput;
     }
     const guardResult = applyOutputGuards(rawOutput, {
       maskPII: isDlpEnabled,
       blockSecretLeaks: shouldCheckSecrets,
-      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT"
+      secretLeakAction: this.config.security?.secretLeakAction ?? "REDACT",
+      customRedactionTerms: customTerms
     });
     return guardResult.text;
   };
@@ -1444,6 +1521,7 @@ export {
   isWorkflowAbortSignal,
   resolveModelPrice,
   resolveModelPriceAsync,
+  sanitizeCustomTerms,
   sanitizePII,
   sanitizeSecrets,
   validateUserInput,

package/dist/secret-guard.d.ts

@@ -1,3 +1,6 @@
+import { CustomRedactionTermDef } from "./types";
+import { sanitizeCustomTerms, CustomTermsSanitizationResult } from "./custom-terms";
+export { sanitizeCustomTerms, CustomTermsSanitizationResult };
 export interface SecretPatternDef {
     type: string;
     regex: RegExp;
@@ -17,12 +20,14 @@ export interface OutputGuardOptions {
     maskPII?: boolean;
     blockSecretLeaks?: boolean;
     secretLeakAction?: "REDACT" | "BLOCK";
+    customRedactionTerms?: Array<string | CustomRedactionTermDef>;
 }
 export interface OutputGuardResult {
     text: string;
     sanitized: boolean;
     secretDetected: boolean;
     piiMaskedCount: number;
+    customTermsMaskedCount: number;
     detections: SecretDetection[];
 }
 export declare const applyOutputGuards: (rawOutput: string, options?: OutputGuardOptions) => OutputGuardResult;

package/dist/secret-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-guard.d.ts","sourceRoot":"","sources":["../src/secret-guard.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAqDD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,qBA4B/C,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,UAAU,kBAAkB,KAC3B,iBA+BF,CAAC"}
+{"version":3,"file":"secret-guard.d.ts","sourceRoot":"","sources":["../src/secret-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0B,sBAAsB,EAAE,MAAM,SAAS,CAAC;AAEzE,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,MAAM,gBAAgB,CAAC;AAEpF,OAAO,EAAE,mBAAmB,EAAE,6BAA6B,EAAE,CAAC;AAE9D,MAAM,WAAW,gBAAgB;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;CACd;AAqDD,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,OAAO,CAAC;IACpB,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,eAAe,GAAI,OAAO,MAAM,KAAG,qBA4B/C,CAAC;AAEF,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACtC,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,OAAO,CAAC;IACnB,cAAc,EAAE,OAAO,CAAC;IACxB,cAAc,EAAE,MAAM,CAAC;IACvB,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,eAAe,EAAE,CAAC;CAC/B;AAED,eAAO,MAAM,iBAAiB,GAC5B,WAAW,MAAM,EACjB,UAAU,kBAAkB,KAC3B,iBAwCF,CAAC"}

package/dist/types.d.ts

@@ -67,6 +67,14 @@ export interface ProviderConfig {
     client?: LLMProviderPort;
     pricing?: ModelPrice;
 }
+export type TermCategory = "PROJECT" | "COMPANY" | "INFRA" | "CUSTOM";
+export interface CustomRedactionTermDef {
+    id?: string;
+    term: string;
+    mask?: string;
+    category?: TermCategory;
+    caseSensitive?: boolean;
+}
 export interface SecurityConfig {
     detectPromptInjection?: boolean;
     maskPII?: boolean;
@@ -74,6 +82,7 @@ export interface SecurityConfig {
     outputDLP?: boolean;
     blockSecretLeaks?: boolean;
     secretLeakAction?: "REDACT" | "BLOCK";
+    customRedactionTerms?: Array<string | CustomRedactionTermDef>;
 }
 export interface RetryConfig {
     maxRetries?: number;

package/dist/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACrF,MAAM,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACrF,wBAAwB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;CACxG;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAExD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAKxF;AAED,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,CAAC;AAC7D,OAAO,EAAE,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;AAC/D,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,EAAE,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;CACvC;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,eAAe,CAAC;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,QAAQ,GAAG,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC;IAC/C,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,QAAQ;IACvB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC1C;AAED,MAAM,WAAW,0BAA0B,CAAC,CAAC;IAC3C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,oBAAoB,GAAG,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,QAAQ,CAAA;KAAE,CAAC,CAAC;IACrF,MAAM,CAAC,CAAC,OAAO,EAAE,oBAAoB,GAAG,cAAc,CAAC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC,CAAC;IACrF,wBAAwB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,0BAA0B,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;CAClF;AAED,MAAM,WAAW,UAAU;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,uBAAuB,EAAE,MAAM,CAAC;IAChC,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC;AAED,MAAM,WAAW,cAAc;IAC7B,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,GAAG,SAAS,CAAC,GAAG,UAAU,GAAG,SAAS,CAAC;CACxG;AAED,qBAAa,kBAAmB,SAAQ,KAAK;gBAC/B,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,mBAAoB,SAAQ,KAAK;gBAChC,OAAO,EAAE,MAAM;CAI5B;AAED,qBAAa,sBAAuB,SAAQ,KAAK;IAC/C,QAAQ,CAAC,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;gBAExD,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CAKxF;AAED,OAAO,EAAE,kBAAkB,IAAI,2BAA2B,EAAE,CAAC;AAC7D,OAAO,EAAE,mBAAmB,IAAI,4BAA4B,EAAE,CAAC;AAC/D,OAAO,EAAE,sBAAsB,IAAI,+BAA+B,EAAE,CAAC;AAErE,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,QAAQ,GAAG,YAAY,GAAG,QAAQ,CAAC;IACjF,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,eAAe,CAAC;IACzB,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,SAAS,GAAG,OAAO,GAAG,QAAQ,CAAC;AAEtE,MAAM,WAAW,sBAAsB;IACrC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,YAAY,CAAC;IACxB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,cAAc;IAC7B,qBAAqB,CAAC,EAAE,OAAO,CAAC;IAChC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B,gBAAgB,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IACtC,oBAAoB,CAAC,EAAE,KAAK,CAAC,MAAM,GAAG,sBAAsB,CAAC,CAAC;CAC/D;AAED,MAAM,WAAW,WAAW;IAC1B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,IAAI,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,GAAG,CAAC,MAAM,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;CAChD;AAED,MAAM,WAAW,qBAAqB;IACpC,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,YAAY,CAAC,EAAE,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,GAAG,eAAe,CAAC;IAC3D,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,CAAC,EAAE,qBAAqB,CAAC;CACjC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,iBAAiB,CAAC,EAAE,cAAc,CAAC;IACnC,YAAY,CAAC,EAAE,WAAW,CAAC;IAC3B,SAAS,CAAC,EAAE,aAAa,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,EAAE,cAAc,CAAC;IAC1B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC3C,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,yBAAyB,CAAC,CAAC;IAC1C,IAAI,EAAE,CAAC,CAAC;IACR,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE;QACN,MAAM,EAAE,MAAM,CAAC;QACf,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;KACf,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,WAAW,+BAA+B,CAAC,CAAC;IAChD,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,eAAe,CAAC;IACnC,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B"}

package/dist/ui/index.d.ts

@@ -1,4 +1,5 @@
 export { createToolEnvelope, type ToolExecutionEnvelope, type ToolMergeStrategy, type UIIntent, type UIIntentAction, } from "./envelope";
 export { createCanvasReducer, isSafeKey, mergeUniqueEntities, updateEntityInPlace, type CanvasContentState, type CanvasState, } from "./reducer";
 export { defineCanvas } from "./define-canvas";
+export { createViewRegistry, type CanvasRendererProps, type CanvasViewComponent, type CanvasViewContext, isValidSafeUrl, } from "./react";
 //# sourceMappingURL=index.d.ts.map

package/dist/ui/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/ui/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAClB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,QAAQ,EACb,KAAK,cAAc,GACpB,MAAM,YAAY,CAAC;AAEpB,OAAO,EACL,mBAAmB,EACnB,SAAS,EACT,mBAAmB,EACnB,mBAAmB,EACnB,KAAK,kBAAkB,EACvB,KAAK,WAAW,GACjB,MAAM,WAAW,CAAC;AAEnB,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE/C,OAAO,EACL,kBAAkB,EAClB,KAAK,mBAAmB,EACxB,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,cAAc,GACf,MAAM,SAAS,CAAC"}

package/dist/ui/index.js

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,6 +17,14 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/ui/index.ts
@@ -22,8 +32,10 @@ var ui_exports = {};
 __export(ui_exports, {
   createCanvasReducer: () => createCanvasReducer,
   createToolEnvelope: () => createToolEnvelope,
+  createViewRegistry: () => createViewRegistry,
   defineCanvas: () => defineCanvas,
   isSafeKey: () => isSafeKey,
+  isValidSafeUrl: () => isValidSafeUrl,
   mergeUniqueEntities: () => mergeUniqueEntities,
   updateEntityInPlace: () => updateEntityInPlace
 });
@@ -159,12 +171,65 @@ var defineCanvas = () => {
     canvasReducer: createCanvasReducer()
   };
 };
+
+// src/ui/react/create-view-registry.ts
+var import_react = __toESM(require("react"));
+var createViewRegistry = (registry) => {
+  const CanvasRenderer = ({
+    state,
+    context = {}
+  }) => {
+    if (!state?.content) {
+      return null;
+    }
+    const kind = state.content.kind;
+    const Component = registry[kind];
+    if (!Component) {
+      return null;
+    }
+    return import_react.default.createElement(Component, {
+      data: state.content,
+      context,
+      activeIntent: state.activeIntent
+    });
+  };
+  return {
+    registry,
+    CanvasRenderer
+  };
+};
+
+// src/ui/react/sanitize.ts
+var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
+var isValidSafeUrl = (rawUrl) => {
+  if (!rawUrl || typeof rawUrl !== "string") {
+    return false;
+  }
+  const trimmed = rawUrl.trim();
+  if (!trimmed) {
+    return false;
+  }
+  if (trimmed.startsWith("#")) {
+    return true;
+  }
+  if (trimmed.startsWith("/") && !trimmed.startsWith("//")) {
+    return true;
+  }
+  try {
+    const parsed = new URL(trimmed);
+    return ALLOWED_PROTOCOLS.has(parsed.protocol);
+  } catch {
+    return false;
+  }
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   createCanvasReducer,
   createToolEnvelope,
+  createViewRegistry,
   defineCanvas,
   isSafeKey,
+  isValidSafeUrl,
   mergeUniqueEntities,
   updateEntityInPlace
 });

package/dist/ui/index.mjs

@@ -1,3 +1,7 @@
+import {
+  createViewRegistry,
+  isValidSafeUrl
+} from "../chunk-Z6QOMLZ2.mjs";
 import "../chunk-Y6FXYEAI.mjs";
 
 // src/ui/envelope.ts
@@ -133,8 +137,10 @@ var defineCanvas = () => {
 export {
   createCanvasReducer,
   createToolEnvelope,
+  createViewRegistry,
   defineCanvas,
   isSafeKey,
+  isValidSafeUrl,
   mergeUniqueEntities,
   updateEntityInPlace
 };

package/dist/ui/react/index.mjs

@@ -1,55 +1,8 @@
+import {
+  createViewRegistry,
+  isValidSafeUrl
+} from "../../chunk-Z6QOMLZ2.mjs";
 import "../../chunk-Y6FXYEAI.mjs";
-
-// src/ui/react/create-view-registry.ts
-import React from "react";
-var createViewRegistry = (registry) => {
-  const CanvasRenderer = ({
-    state,
-    context = {}
-  }) => {
-    if (!state?.content) {
-      return null;
-    }
-    const kind = state.content.kind;
-    const Component = registry[kind];
-    if (!Component) {
-      return null;
-    }
-    return React.createElement(Component, {
-      data: state.content,
-      context,
-      activeIntent: state.activeIntent
-    });
-  };
-  return {
-    registry,
-    CanvasRenderer
-  };
-};
-
-// src/ui/react/sanitize.ts
-var ALLOWED_PROTOCOLS = /* @__PURE__ */ new Set(["http:", "https:"]);
-var isValidSafeUrl = (rawUrl) => {
-  if (!rawUrl || typeof rawUrl !== "string") {
-    return false;
-  }
-  const trimmed = rawUrl.trim();
-  if (!trimmed) {
-    return false;
-  }
-  if (trimmed.startsWith("#")) {
-    return true;
-  }
-  if (trimmed.startsWith("/") && !trimmed.startsWith("//")) {
-    return true;
-  }
-  try {
-    const parsed = new URL(trimmed);
-    return ALLOWED_PROTOCOLS.has(parsed.protocol);
-  } catch {
-    return false;
-  }
-};
 export {
   createViewRegistry,
   isValidSafeUrl

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "avantgate",
-  "version": "2.1.0",
+  "version": "2.2.0",
   "description": "Zero-infrastructure, in-process AI Application Firewall (AI-WAF), privacy control plane & headless UI canvas for TypeScript: real-time prompt guardrails, zero-egress PII redaction, deterministic tool envelopes, anti-IDOR defense, pre-flight token budgets, and multi-model failover.",
   "author": "Gatewall Team",
   "license": "MIT",
@@ -69,16 +69,16 @@
       "import": "./dist/client/index.mjs",
       "require": "./dist/client/index.js"
     },
-    "./ui": {
-      "types": "./dist/ui/index.d.ts",
-      "import": "./dist/ui/index.mjs",
-      "require": "./dist/ui/index.js"
-    },
     "./ui/react": {
       "types": "./dist/ui/react/index.d.ts",
       "import": "./dist/ui/react/index.mjs",
       "require": "./dist/ui/react/index.js"
     },
+    "./ui": {
+      "types": "./dist/ui/index.d.ts",
+      "import": "./dist/ui/index.mjs",
+      "require": "./dist/ui/index.js"
+    },
     "./package.json": "./package.json"
   },
   "peerDependencies": {
@@ -107,12 +107,6 @@
     "test:workflow": "tsx tests/workflow/workflow-saga.test.ts && tsx tests/workflow/workflow-abort.test.ts",
     "test:client": "tsx tests/client/browser-exporter.test.ts && tsx tests/client/use-avantgate-task.test.ts && tsx tests/client/task-runner.test.ts",
     "test:demo": "tsx tests/agent/prospect-ai-demo-scenario.test.ts",
-    "gatewall": "npm --prefix gatewall run dev",
-    "gatewall:dev": "npm --prefix gatewall run dev",
-    "gatewall:build": "npm --prefix gatewall run build",
-    "gatewall:seed": "npm --prefix gatewall run seed:mock",
-    "gatewall:start": "npm --prefix gatewall run start",
-    "gatewall:docker": "docker compose up -d",
     "lint": "tsc --noEmit",
     "prepublishOnly": "npm run build && npm test"
   },
@@ -139,3 +133,4 @@
     "url": "https://github.com/thienban/avantGate/issues"
   }
 }
+