shield360 1.0.0

package/dist/guard/integration.js

@@ -0,0 +1,363 @@
+"use strict";
+/**
+ * Auto-guard integration layer.
+ *
+ * setupAutoGuards wraps LLM provider methods so that guards run on every
+ * call without any changes to existing instrumentation code.
+ *
+ * Call chain after setup:
+ *
+ *   User call
+ *     -> Guard wrapper  (preflight -> may deny/redact)
+ *       -> Instrumentor wrapper  (OTel telemetry)
+ *         -> Original SDK method  (actual API call)
+ *       <- Instrumentor wrapper
+ *     <- Guard wrapper  (postflight -> may redact/warn)
+ *   <- Returns to user
+ *
+ * **Streaming limitation**: postflight guards require a complete response
+ * object with `choices[].message.content` (or equivalent). Streaming
+ * responses yield incremental chunks that extractors cannot fully
+ * reassemble, so postflight guards are silently skipped for streamed
+ * completions. Preflight guards always run.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/guard/_integration.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractOpenAIInput = extractOpenAIInput;
+exports.extractOpenAIOutput = extractOpenAIOutput;
+exports.extractAnthropicInput = extractAnthropicInput;
+exports.extractAnthropicOutput = extractAnthropicOutput;
+exports.extractGenericInput = extractGenericInput;
+exports.extractGenericOutput = extractGenericOutput;
+exports.applyPreflight = applyPreflight;
+exports.applyPostflight = applyPostflight;
+exports.setupAutoGuards = setupAutoGuards;
+const base_1 = require("./base");
+const pipeline_1 = require("./pipeline");
+function extractOpenAIInput(kwargs) {
+    const messages = kwargs.messages || kwargs.input || [];
+    if (typeof messages === 'string')
+        return messages;
+    const parts = [];
+    if (Array.isArray(messages)) {
+        for (const m of messages) {
+            if (typeof m === 'object' && m !== null) {
+                const content = m.content ?? '';
+                if (typeof content === 'string')
+                    parts.push(content);
+            }
+            else if (typeof m === 'string') {
+                parts.push(m);
+            }
+        }
+    }
+    return parts.join(' ');
+}
+function extractOpenAIOutput(response) {
+    try {
+        const choices = response?.choices;
+        if (choices && Array.isArray(choices)) {
+            return choices
+                .map((c) => c?.message?.content || '')
+                .join(' ');
+        }
+        const output = response?.output;
+        if (output && Array.isArray(output)) {
+            const parts = [];
+            for (const item of output) {
+                const content = item?.content;
+                if (Array.isArray(content)) {
+                    for (const block of content) {
+                        const text = block?.text;
+                        if (text)
+                            parts.push(text);
+                    }
+                }
+                else if (typeof content === 'string') {
+                    parts.push(content);
+                }
+            }
+            return parts.join(' ');
+        }
+    }
+    catch {
+        // ignore
+    }
+    return '';
+}
+function extractAnthropicInput(kwargs) {
+    const messages = kwargs.messages || [];
+    const parts = [];
+    if (Array.isArray(messages)) {
+        for (const m of messages) {
+            if (typeof m === 'object' && m !== null) {
+                const content = m.content ?? '';
+                if (typeof content === 'string') {
+                    parts.push(content);
+                }
+                else if (Array.isArray(content)) {
+                    for (const block of content) {
+                        if (typeof block === 'object' && block?.type === 'text') {
+                            parts.push(block.text || '');
+                        }
+                    }
+                }
+            }
+        }
+    }
+    return parts.join(' ');
+}
+function extractAnthropicOutput(response) {
+    try {
+        const content = response?.content;
+        if (Array.isArray(content)) {
+            const parts = [];
+            for (const block of content) {
+                const text = block?.text;
+                if (text)
+                    parts.push(text);
+            }
+            return parts.join(' ');
+        }
+    }
+    catch {
+        // ignore
+    }
+    return '';
+}
+function extractGenericInput(kwargs) {
+    for (const key of ['messages', 'message', 'prompt', 'input', 'text']) {
+        const val = kwargs[key];
+        if (val == null)
+            continue;
+        if (typeof val === 'string')
+            return val;
+        if (Array.isArray(val)) {
+            const parts = [];
+            for (const item of val) {
+                if (typeof item === 'string') {
+                    parts.push(item);
+                }
+                else if (typeof item === 'object' && item !== null) {
+                    parts.push(item.content || '');
+                }
+            }
+            return parts.join(' ');
+        }
+    }
+    return '';
+}
+function extractGenericOutput(response) {
+    try {
+        const choices = response?.choices;
+        if (choices && Array.isArray(choices)) {
+            return choices
+                .map((c) => c?.message?.content || '')
+                .join(' ');
+        }
+    }
+    catch {
+        // ignore
+    }
+    try {
+        const content = response?.content;
+        if (typeof content === 'string')
+            return content;
+        if (Array.isArray(content)) {
+            const parts = [];
+            for (const block of content) {
+                const text = block?.text;
+                if (text)
+                    parts.push(text);
+            }
+            if (parts.length)
+                return parts.join(' ');
+        }
+    }
+    catch {
+        // ignore
+    }
+    try {
+        if (response?.text)
+            return response.text;
+    }
+    catch {
+        // ignore
+    }
+    return '';
+}
+const GUARDED_METHODS = [
+    // OpenAI
+    { npmPackage: 'openai', protoPath: ['OpenAI', 'Chat', 'Completions', 'prototype'], methodName: 'create', extractInput: extractOpenAIInput, extractOutput: extractOpenAIOutput },
+    { npmPackage: 'openai', protoPath: ['OpenAI', 'Responses', 'prototype'], methodName: 'create', extractInput: extractOpenAIInput, extractOutput: extractOpenAIOutput },
+    // Anthropic
+    { npmPackage: '@anthropic-ai/sdk', protoPath: ['Anthropic', 'Messages', 'prototype'], methodName: 'create', extractInput: extractAnthropicInput, extractOutput: extractAnthropicOutput },
+    // Groq
+    { npmPackage: 'groq-sdk', protoPath: ['Groq', 'Chat', 'Completions', 'prototype'], methodName: 'create', extractInput: extractGenericInput, extractOutput: extractGenericOutput },
+    // Mistral
+    { npmPackage: '@mistralai/mistralai', protoPath: ['Mistral', 'chat', 'prototype'], methodName: 'complete', extractInput: extractGenericInput, extractOutput: extractGenericOutput },
+    // Cohere
+    { npmPackage: 'cohere-ai', protoPath: ['CohereClientV2', 'prototype'], methodName: 'chat', extractInput: extractGenericInput, extractOutput: extractGenericOutput },
+    // Together
+    { npmPackage: 'together-ai', protoPath: ['Together', 'Chat', 'Completions', 'prototype'], methodName: 'create', extractInput: extractGenericInput, extractOutput: extractGenericOutput },
+    // Bedrock (AWS)
+    { npmPackage: '@aws-sdk/client-bedrock-runtime', protoPath: ['BedrockRuntimeClient', 'prototype'], methodName: 'send', extractInput: extractGenericInput, extractOutput: extractGenericOutput },
+    // Google Generative AI
+    { npmPackage: '@google/generative-ai', protoPath: ['GenerativeModel', 'prototype'], methodName: 'generateContent', extractInput: extractGenericInput, extractOutput: extractGenericOutput },
+];
+// ---------------------------------------------------------------------------
+// Preflight / Postflight
+// ---------------------------------------------------------------------------
+/**
+ * Redact a prompt or message list one message (and text block) at a time.
+ *
+ * The decision to redact is made on all the input together, but each message
+ * is rewritten on its own: writing the joined text into one message would copy
+ * the system prompt and earlier turns into it, and leave the originals --
+ * secrets included -- untouched.
+ */
+function redactMessages(pipeline, value, phase) {
+    if (typeof value === 'string')
+        return pipeline.redact(value, phase);
+    if (!Array.isArray(value))
+        return value;
+    return value.map((m) => {
+        if (typeof m === 'string')
+            return pipeline.redact(m, phase);
+        if (typeof m !== 'object' || m === null)
+            return m;
+        if (typeof m.content === 'string')
+            return { ...m, content: pipeline.redact(m.content, phase) };
+        if (Array.isArray(m.content)) {
+            return {
+                ...m,
+                content: m.content.map((b) => b && typeof b === 'object' && typeof b.text === 'string'
+                    ? { ...b, text: pipeline.redact(b.text, phase) }
+                    : b),
+            };
+        }
+        return m;
+    });
+}
+/** @internal exported for tests */
+function applyPreflight(pipeline, kwargs, extractInput) {
+    const inputText = extractInput(kwargs);
+    if (!inputText)
+        return kwargs;
+    const result = pipeline.evaluate(inputText, 'preflight');
+    if (result.action === base_1.GuardAction.DENY) {
+        throw new base_1.GuardDeniedError(result);
+    }
+    if (result.action === base_1.GuardAction.REDACT && result.transformedText !== null) {
+        for (const key of ['messages', 'input', 'prompt', 'text']) {
+            if (key in kwargs) {
+                return { ...kwargs, [key]: redactMessages(pipeline, kwargs[key], 'preflight') };
+            }
+        }
+    }
+    return kwargs;
+}
+function redactTextField(pipeline, obj, field) {
+    if (obj && typeof obj[field] === 'string' && obj[field]) {
+        obj[field] = pipeline.redact(obj[field], 'postflight');
+    }
+}
+/**
+ * Each choice and text block is redacted on its own, so none is left holding
+ * the original text or another block's.
+ *
+ * @internal exported for tests
+ */
+function applyPostflight(pipeline, response, extractOutput) {
+    const outputText = extractOutput(response);
+    if (!outputText)
+        return response;
+    const result = pipeline.evaluate(outputText, 'postflight');
+    if (result.action === base_1.GuardAction.DENY) {
+        throw new base_1.GuardDeniedError(result);
+    }
+    if (result.action === base_1.GuardAction.REDACT && result.transformedText !== null) {
+        try {
+            if (Array.isArray(response?.choices) && response.choices.length > 0) {
+                // OpenAI chat completions.
+                for (const choice of response.choices)
+                    redactTextField(pipeline, choice?.message, 'content');
+            }
+            else if (Array.isArray(response?.output) && response.output.length > 0) {
+                // OpenAI Responses API: output items hold text blocks.
+                for (const item of response.output) {
+                    if (Array.isArray(item?.content)) {
+                        for (const block of item.content)
+                            redactTextField(pipeline, block, 'text');
+                    }
+                }
+                if (typeof response.output_text === 'string')
+                    redactTextField(pipeline, response, 'output_text');
+            }
+            else if (Array.isArray(response?.content) && response.content.length > 0) {
+                // Anthropic messages.
+                for (const block of response.content)
+                    redactTextField(pipeline, block, 'text');
+            }
+            else {
+                redactTextField(pipeline, response, 'text');
+            }
+        }
+        catch {
+            // best-effort redaction
+        }
+    }
+    return response;
+}
+// ---------------------------------------------------------------------------
+// Prototype resolver
+// ---------------------------------------------------------------------------
+function resolveProto(moduleExports, protoPath) {
+    let obj = moduleExports;
+    for (const key of protoPath) {
+        if (obj == null)
+            return null;
+        obj = obj[key];
+    }
+    return obj;
+}
+// ---------------------------------------------------------------------------
+// Public entry point
+// ---------------------------------------------------------------------------
+function setupAutoGuards(guards, failOpen = true) {
+    const pipeline = new pipeline_1.Pipeline({ guards, failOpen });
+    try {
+        const Shield360Config = require('../config').default;
+        Shield360Config.guardPipeline = pipeline;
+    }
+    catch {
+        // config not available
+    }
+    let wrappedCount = 0;
+    for (const { npmPackage, protoPath, methodName, extractInput, extractOutput } of GUARDED_METHODS) {
+        try {
+            // eslint-disable-next-line @typescript-eslint/no-var-requires
+            const mod = require(npmPackage);
+            const proto = resolveProto(mod, protoPath);
+            if (!proto || typeof proto[methodName] !== 'function')
+                continue;
+            const original = proto[methodName];
+            proto[methodName] = async function (...args) {
+                let params = args[0] || {};
+                params = applyPreflight(pipeline, params, extractInput);
+                args[0] = params;
+                const response = await original.apply(this, args);
+                return applyPostflight(pipeline, response, extractOutput);
+            };
+            wrappedCount++;
+        }
+        catch {
+            // module not installed, skip silently
+        }
+    }
+    if (wrappedCount > 0) {
+        console.log(`[shield360] Auto-guards: wrapped ${wrappedCount}/${GUARDED_METHODS.length} provider methods`);
+    }
+}
+//# sourceMappingURL=integration.js.map

package/dist/guard/integration.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../src/guard/integration.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;;AAWH,gDAeC;AAED,kDA4BC;AAED,sDAoBC;AAED,wDAeC;AAED,kDAkBC;AAED,oDA+BC;AAoED,wCAuBC;AAcD,0CAuCC;AAmBD,0CAyCC;AA9VD,iCAA8D;AAC9D,yCAAsC;AAQtC,SAAgB,kBAAkB,CAAC,MAA2B;IAC5D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC;IACvD,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAClD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAChC,IAAI,OAAO,OAAO,KAAK,QAAQ;oBAAE,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACvD,CAAC;iBAAM,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAgB,mBAAmB,CAAC,QAAa;IAC/C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;QAClC,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO;iBACX,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;iBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC;QAChC,IAAI,MAAM,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YACpC,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;gBAC1B,MAAM,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC;gBAC9B,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;wBAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC;wBACzB,IAAI,IAAI;4BAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;oBAC7B,CAAC;gBACH,CAAC;qBAAM,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBACvC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,qBAAqB,CAAC,MAA2B;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC;IACvC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxC,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;gBAChC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;oBAChC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;gBACtB,CAAC;qBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;wBAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC;4BACxD,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;wBAC/B,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACzB,CAAC;AAED,SAAgB,sBAAsB,CAAC,QAAa;IAClD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC;gBACzB,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,mBAAmB,CAAC,MAA2B;IAC7D,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;QACrE,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACxB,IAAI,GAAG,IAAI,IAAI;YAAE,SAAS;QAC1B,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACxC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,IAAI,IAAI,GAAG,EAAE,CAAC;gBACvB,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;oBAC7B,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACnB,CAAC;qBAAM,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;oBACrD,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;gBACjC,CAAC;YACH,CAAC;YACD,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAgB,oBAAoB,CAAC,QAAa;IAChD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;QAClC,IAAI,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACtC,OAAO,OAAO;iBACX,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC;iBAC1C,IAAI,CAAC,GAAG,CAAC,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,QAAQ,EAAE,OAAO,CAAC;QAClC,IAAI,OAAO,OAAO,KAAK,QAAQ;YAAE,OAAO,OAAO,CAAC;QAChD,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3B,MAAM,KAAK,GAAa,EAAE,CAAC;YAC3B,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;gBAC5B,MAAM,IAAI,GAAG,KAAK,EAAE,IAAI,CAAC;gBACzB,IAAI,IAAI;oBAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC7B,CAAC;YACD,IAAI,KAAK,CAAC,MAAM;gBAAE,OAAO,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,IAAI,CAAC;QACH,IAAI,QAAQ,EAAE,IAAI;YAAE,OAAO,QAAQ,CAAC,IAAI,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAcD,MAAM,eAAe,GAAoB;IACvC,SAAS;IACT,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE;IAC/K,EAAE,UAAU,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,QAAQ,EAAE,WAAW,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,kBAAkB,EAAE,aAAa,EAAE,mBAAmB,EAAE;IACrK,YAAY;IACZ,EAAE,UAAU,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAC,WAAW,EAAE,UAAU,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,qBAAqB,EAAE,aAAa,EAAE,sBAAsB,EAAE;IACxL,OAAO;IACP,EAAE,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE;IACjL,UAAU;IACV,EAAE,UAAU,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE;IACnL,SAAS;IACT,EAAE,UAAU,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC,gBAAgB,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE;IACnK,WAAW;IACX,EAAE,UAAU,EAAE,aAAa,EAAE,SAAS,EAAE,CAAC,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE;IACxL,gBAAgB;IAChB,EAAE,UAAU,EAAE,iCAAiC,EAAE,SAAS,EAAE,CAAC,sBAAsB,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE;IAC/L,uBAAuB;IACvB,EAAE,UAAU,EAAE,uBAAuB,EAAE,SAAS,EAAE,CAAC,iBAAiB,EAAE,WAAW,CAAC,EAAE,UAAU,EAAE,iBAAiB,EAAE,YAAY,EAAE,mBAAmB,EAAE,aAAa,EAAE,oBAAoB,EAAE;CAC5L,CAAC;AAEF,8EAA8E;AAC9E,yBAAyB;AACzB,8EAA8E;AAE9E;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,QAAkB,EAAE,KAAU,EAAE,KAAa;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACpE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACxC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACrB,IAAI,OAAO,CAAC,KAAK,QAAQ;YAAE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC5D,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,CAAC,CAAC;QAClD,IAAI,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ;YAAE,OAAO,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;QAC/F,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,GAAG,CAAC;gBACJ,OAAO,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAChC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;oBACtD,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE;oBAChD,CAAC,CAAC,CAAC,CACN;aACF,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC,CAAC,CAAC;AACL,CAAC;AAED,mCAAmC;AACnC,SAAgB,cAAc,CAC5B,QAAkB,EAClB,MAA2B,EAC3B,YAAuB;IAEvB,MAAM,SAAS,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACvC,IAAI,CAAC,SAAS;QAAE,OAAO,MAAM,CAAC;IAE9B,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IAEzD,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAW,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,uBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAW,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC5E,KAAK,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;YAC1D,IAAI,GAAG,IAAI,MAAM,EAAE,CAAC;gBAClB,OAAO,EAAE,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,CAAC,EAAE,CAAC;YAClF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,QAAkB,EAAE,GAAQ,EAAE,KAAa;IAClE,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,YAAY,CAAC,CAAC;IACzD,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,SAAgB,eAAe,CAC7B,QAAkB,EAClB,QAAa,EACb,aAAwB;IAExB,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,CAAC,UAAU;QAAE,OAAO,QAAQ,CAAC;IAEjC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC,UAAU,EAAE,YAAY,CAAC,CAAC;IAE3D,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAW,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,IAAI,uBAAgB,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,kBAAW,CAAC,MAAM,IAAI,MAAM,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC5E,IAAI,CAAC;YACH,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACpE,2BAA2B;gBAC3B,KAAK,MAAM,MAAM,IAAI,QAAQ,CAAC,OAAO;oBAAE,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;YAC/F,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzE,uDAAuD;gBACvD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,MAAM,EAAE,CAAC;oBACnC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,EAAE,CAAC;wBACjC,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,OAAO;4BAAE,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;oBAC7E,CAAC;gBACH,CAAC;gBACD,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ;oBAAE,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;YACnG,CAAC;iBAAM,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,QAAQ,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3E,sBAAsB;gBACtB,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,OAAO;oBAAE,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;YACjF,CAAC;iBAAM,CAAC;gBACN,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC9C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,wBAAwB;QAC1B,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAS,YAAY,CAAC,aAAkB,EAAE,SAAmB;IAC3D,IAAI,GAAG,GAAG,aAAa,CAAC;IACxB,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC5B,IAAI,GAAG,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;QAC7B,GAAG,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,SAAgB,eAAe,CAC7B,MAAe,EACf,QAAQ,GAAG,IAAI;IAEf,MAAM,QAAQ,GAAG,IAAI,mBAAQ,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAEpD,IAAI,CAAC;QACH,MAAM,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,OAAO,CAAC;QACrD,eAAe,CAAC,aAAa,GAAG,QAAQ,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,uBAAuB;IACzB,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,IAAI,eAAe,EAAE,CAAC;QACjG,IAAI,CAAC;YACH,8DAA8D;YAC9D,MAAM,GAAG,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;YAChC,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC3C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,CAAC,UAAU,CAAC,KAAK,UAAU;gBAAE,SAAS;YAEhE,MAAM,QAAQ,GAAG,KAAK,CAAC,UAAU,CAAC,CAAC;YACnC,KAAK,CAAC,UAAU,CAAC,GAAG,KAAK,WAAsB,GAAG,IAAW;gBAC3D,IAAI,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAE3B,MAAM,GAAG,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC;gBACxD,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC;gBAEjB,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;gBAElD,OAAO,eAAe,CAAC,QAAQ,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;YAC5D,CAAC,CAAC;YACF,YAAY,EAAE,CAAC;QACjB,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,IAAI,YAAY,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO,CAAC,GAAG,CAAC,oCAAoC,YAAY,IAAI,eAAe,CAAC,MAAM,mBAAmB,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC"}

package/dist/guard/moderation.d.ts

@@ -0,0 +1,18 @@
+/**
+ * Content moderation guard -- profanity & toxicity detection.
+ *
+ * Uses local keyword/regex patterns.
+ *
+ * Patterns must stay in sync with: sdk/python/src/shield360/guard/moderation.py
+ */
+import { Guard, GuardPhase, GuardResult, GuardOptions } from './base';
+export interface ModerationOptions extends GuardOptions {
+    customWords?: string[];
+}
+export declare class Moderation extends Guard {
+    readonly name = "moderation";
+    readonly phases: GuardPhase[];
+    private readonly _profanityRe;
+    constructor(opts?: ModerationOptions);
+    evaluate(text: string): GuardResult;
+}

package/dist/guard/moderation.js

@@ -0,0 +1,61 @@
+"use strict";
+/**
+ * Content moderation guard -- profanity & toxicity detection.
+ *
+ * Uses local keyword/regex patterns.
+ *
+ * Patterns must stay in sync with: sdk/python/src/shield360/guard/moderation.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Moderation = void 0;
+const base_1 = require("./base");
+const BUILTIN_WORDS = [
+    'fuck', 'shit', 'ass', 'bitch', 'damn', 'bastard', 'crap',
+    'dick', 'piss', 'cock', 'cunt', 'slut', 'whore',
+    'nigger', 'nigga', 'faggot', 'retard', 'kike', 'spic',
+];
+const TOXICITY_PATTERNS = [
+    /\b(?:kill\s+yourself|kys|go\s+die|hope\s+you\s+die)\b/i,
+    /\b(?:i(?:'ll| will)\s+(?:kill|hurt|destroy)\s+you)\b/i,
+];
+function buildProfanityPattern(words) {
+    const escaped = words.map((w) => w.replace(/[.*+?^${}()|[\]\\]/g, '\\$&'));
+    return new RegExp('\\b(?:' + escaped.join('|') + ')\\b', 'gi');
+}
+class Moderation extends base_1.Guard {
+    constructor(opts = {}) {
+        super({ action: opts.action ?? 'warn', maxScanLength: opts.maxScanLength });
+        this.name = 'moderation';
+        this.phases = [base_1.GuardPhase.PREFLIGHT, base_1.GuardPhase.POSTFLIGHT];
+        const allWords = [...BUILTIN_WORDS, ...(opts.customWords || [])];
+        this._profanityRe = buildProfanityPattern(allWords);
+    }
+    evaluate(text) {
+        const profanityMatches = text.match(this._profanityRe);
+        const toxicityHits = TOXICITY_PATTERNS.some((pat) => pat.test(text));
+        if (!profanityMatches && !toxicityHits) {
+            return (0, base_1.makeGuardResult)({ guardName: this.name });
+        }
+        const classifications = [];
+        if (profanityMatches)
+            classifications.push('profanity');
+        if (toxicityHits)
+            classifications.push('toxicity');
+        const classification = classifications.join(', ');
+        const score = toxicityHits ? 0.95 : 0.7;
+        let transformedText = null;
+        if (this._action === 'redact') {
+            transformedText = text.replace(this._profanityRe, '[REDACTED:profanity]');
+        }
+        return (0, base_1.makeGuardResult)({
+            action: this._action,
+            score,
+            guardName: this.name,
+            classification,
+            explanation: `Moderation flag: ${classification}`,
+            transformedText,
+        });
+    }
+}
+exports.Moderation = Moderation;
+//# sourceMappingURL=moderation.js.map

package/dist/guard/moderation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"moderation.js","sourceRoot":"","sources":["../../src/guard/moderation.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,iCAAuF;AAEvF,MAAM,aAAa,GAAa;IAC9B,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM;IACzD,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IAC/C,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM;CACtD,CAAC;AAEF,MAAM,iBAAiB,GAAa;IAClC,wDAAwD;IACxD,uDAAuD;CACxD,CAAC;AAEF,SAAS,qBAAqB,CAAC,KAAe;IAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3E,OAAO,IAAI,MAAM,CAAC,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,IAAI,CAAC,CAAC;AACjE,CAAC;AAMD,MAAa,UAAW,SAAQ,YAAK;IAMnC,YAAY,OAA0B,EAAE;QACtC,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QANrE,SAAI,GAAG,YAAY,CAAC;QACpB,WAAM,GAAG,CAAC,iBAAU,CAAC,SAAS,EAAE,iBAAU,CAAC,UAAU,CAAC,CAAC;QAM9D,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,EAAE,GAAG,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC;QACjE,IAAI,CAAC,YAAY,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAC;IACtD,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,gBAAgB,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACvD,MAAM,YAAY,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QAErE,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YACvC,OAAO,IAAA,sBAAe,EAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,eAAe,GAAa,EAAE,CAAC;QACrC,IAAI,gBAAgB;YAAE,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,YAAY;YAAE,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAEnD,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;QAExC,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YAC9B,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,EAAE,sBAAsB,CAAC,CAAC;QAC5E,CAAC;QAED,OAAO,IAAA,sBAAe,EAAC;YACrB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,cAAc;YACd,WAAW,EAAE,oBAAoB,cAAc,EAAE;YACjD,eAAe;SAChB,CAAC,CAAC;IACL,CAAC;CACF;AAzCD,gCAyCC"}

package/dist/guard/pii.d.ts

@@ -0,0 +1,17 @@
+/**
+ * PII guard -- detects and optionally redacts personally identifiable
+ * information, API keys, and secrets using regex patterns.
+ *
+ * Patterns must stay in sync with: sdk/python/src/shield360/guard/pii.py
+ */
+import { Guard, GuardPhase, GuardResult, GuardOptions } from './base';
+export interface PIIOptions extends GuardOptions {
+    customPatterns?: Record<string, string>;
+}
+export declare class PII extends Guard {
+    readonly name = "pii";
+    readonly phases: GuardPhase[];
+    private readonly _allPatterns;
+    constructor(opts?: PIIOptions);
+    evaluate(text: string): GuardResult;
+}

package/dist/guard/pii.js

@@ -0,0 +1,114 @@
+"use strict";
+/**
+ * PII guard -- detects and optionally redacts personally identifiable
+ * information, API keys, and secrets using regex patterns.
+ *
+ * Patterns must stay in sync with: sdk/python/src/shield360/guard/pii.py
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PII = void 0;
+const base_1 = require("./base");
+const findings_1 = require("./findings");
+// ---- API keys / tokens ----
+const PATTERNS = [
+    { label: 'openai-api-key', regex: /sk-(?:proj-)?[A-Za-z0-9_-]{20,}/ },
+    { label: 'anthropic-api-key', regex: /sk-ant-[A-Za-z0-9_-]{20,}/ },
+    { label: 'aws-access-key', regex: /(?<![A-Za-z0-9/+=])AKIA[0-9A-Z]{16}(?![A-Za-z0-9/+=])/ },
+    { label: 'gcp-api-key', regex: /AIza[0-9A-Za-z_-]{35}/ },
+    { label: 'github-token', regex: /(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}/ },
+    { label: 'github-fine-grained', regex: /github_pat_[A-Za-z0-9_]{22,}/ },
+    { label: 'stripe-key', regex: /(?:sk|pk)_(?:live|test)_[A-Za-z0-9]{24,}/ },
+    { label: 'slack-token', regex: /xox[bpoas]-[A-Za-z0-9-]{10,}/ },
+    { label: 'slack-webhook', regex: /https:\/\/hooks\.slack\.com\/services\/T[A-Za-z0-9]+\/B[A-Za-z0-9]+\/[A-Za-z0-9]+/ },
+    { label: 'twilio-api-key', regex: /SK[0-9a-fA-F]{32}/ },
+    { label: 'sendgrid-api-key', regex: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/ },
+    { label: 'mailgun-api-key', regex: /key-[0-9a-zA-Z]{32}/ },
+    { label: 'azure-key', regex: /[0-9a-f]{32}/ },
+    { label: 'heroku-api-key', regex: /[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}/ },
+    // ---- PII ----
+    { label: 'email', regex: /[a-zA-Z0-9_.+-]+@[a-zA-Z0-9-]+\.[a-zA-Z]{2,}/ },
+    { label: 'phone-us', regex: /(?<!\d)(?:\+?1[-.\s]?)?(?:\(?\d{3}\)?[-.\s]?)\d{3}[-.\s]?\d{4}(?!\d)/ },
+    { label: 'ssn', regex: /(?<!\d)\d{3}-\d{2}-\d{4}(?!\d)/ },
+    { label: 'credit-card', regex: /(?<!\d)(?:4\d{3}|5[1-5]\d{2}|3[47]\d{2}|6(?:011|5\d{2}))[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}(?!\d)/ },
+    { label: 'ipv4', regex: /(?<!\d)(?:25[0-5]|2[0-4]\d|[01]?\d\d?)(?:\.(?:25[0-5]|2[0-4]\d|[01]?\d\d?)){3}(?!\d)/ },
+    // ---- Secrets / credentials ----
+    { label: 'bearer-token', regex: /Bearer\s+[A-Za-z0-9_\-.~+/]+=*/i },
+    { label: 'basic-auth', regex: /Basic\s+[A-Za-z0-9+/]+=*/i },
+    { label: 'private-key', regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/ },
+    { label: 'connection-string', regex: /(?:mongodb(?:\+srv)?|postgres(?:ql)?|mysql|redis|amqp):\/\/\S+/ },
+    { label: 'env-secret', regex: /(?:password|secret|token|api_key|apikey)\s*[=:]\s*\S+/i },
+];
+class PII extends base_1.Guard {
+    constructor(opts = {}) {
+        super({ action: opts.action ?? 'redact', maxScanLength: opts.maxScanLength });
+        this.name = 'pii';
+        this.phases = [base_1.GuardPhase.PREFLIGHT, base_1.GuardPhase.POSTFLIGHT];
+        const extra = [];
+        if (opts.customPatterns) {
+            for (const [label, pat] of Object.entries(opts.customPatterns)) {
+                extra.push({ label, regex: new RegExp(pat, 'gi') });
+            }
+        }
+        this._allPatterns = [
+            ...PATTERNS.map(({ label, regex }) => ({
+                label,
+                regex: new RegExp(regex.source, regex.flags.includes('g') ? regex.flags : regex.flags + 'g'),
+            })),
+            ...extra,
+        ];
+    }
+    evaluate(text) {
+        const matches = [];
+        for (const { label, regex } of this._allPatterns) {
+            regex.lastIndex = 0;
+            let m;
+            while ((m = regex.exec(text)) !== null) {
+                matches.push({ label, start: m.index, end: m.index + m[0].length, value: m[0] });
+            }
+        }
+        if (matches.length === 0) {
+            return (0, base_1.makeGuardResult)({ guardName: this.name });
+        }
+        const labels = [...new Set(matches.map((m) => m.label))].sort();
+        const classification = labels.join(', ');
+        const bestScore = Math.min(1.0, matches.length * 0.2 + 0.5);
+        let transformedText = null;
+        if (this._action === base_1.GuardAction.REDACT) {
+            // Patterns can match overlapping spans of the same text. Every span's offsets
+            // refer to the original string, so replacing them one at a time lets an earlier
+            // replacement resize the string out from under a later one -- the later slice
+            // then stops short and leaves the tail of the value in the output. Merge
+            // overlapping spans first so each replacement covers a region no other touches.
+            const ordered = matches
+                .map((match, index) => ({ ...match, index }))
+                .sort((a, b) => a.start - b.start || b.end - a.end || b.index - a.index);
+            const spans = [];
+            for (const { label, start, end } of ordered) {
+                const previous = spans[spans.length - 1];
+                if (previous && start < previous.end) {
+                    previous.end = Math.max(previous.end, end);
+                }
+                else {
+                    spans.push({ label, start, end });
+                }
+            }
+            let resultText = text;
+            for (let i = spans.length - 1; i >= 0; i--) {
+                const { label, start, end } = spans[i];
+                resultText = resultText.slice(0, start) + `[REDACTED:${label}]` + resultText.slice(end);
+            }
+            transformedText = resultText;
+        }
+        return (0, base_1.makeGuardResult)({
+            action: this._action,
+            score: Math.round(bestScore * 100) / 100,
+            guardName: this.name,
+            classification,
+            explanation: `Detected ${matches.length} PII/secret match(es): ${classification}`,
+            transformedText,
+            findings: (0, findings_1.collectFindings)(matches.map((m) => [m.label, m.value])),
+        });
+    }
+}
+exports.PII = PII;
+//# sourceMappingURL=pii.js.map

package/dist/guard/pii.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pii.js","sourceRoot":"","sources":["../../src/guard/pii.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,iCAAoG;AACpG,yCAA6C;AAO7C,8BAA8B;AAC9B,MAAM,QAAQ,GAAmB;IAC/B,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACrE,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAClE,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,uDAAuD,EAAE;IAC3F,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,uBAAuB,EAAE;IACxD,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,2CAA2C,EAAE;IAC7E,EAAE,KAAK,EAAE,qBAAqB,EAAE,KAAK,EAAE,8BAA8B,EAAE;IACvE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,0CAA0C,EAAE;IAC1E,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,8BAA8B,EAAE;IAC/D,EAAE,KAAK,EAAE,eAAe,EAAE,KAAK,EAAE,mFAAmF,EAAE;IACtH,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,mBAAmB,EAAE;IACvD,EAAE,KAAK,EAAE,kBAAkB,EAAE,KAAK,EAAE,0CAA0C,EAAE;IAChF,EAAE,KAAK,EAAE,iBAAiB,EAAE,KAAK,EAAE,qBAAqB,EAAE;IAC1D,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,cAAc,EAAE;IAC7C,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE,8DAA8D,EAAE;IAClG,gBAAgB;IAChB,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,8CAA8C,EAAE;IACzE,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,sEAAsE,EAAE;IACpG,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,gCAAgC,EAAE;IACzD,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,iGAAiG,EAAE;IAClI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,sFAAsF,EAAE;IAChH,kCAAkC;IAClC,EAAE,KAAK,EAAE,cAAc,EAAE,KAAK,EAAE,iCAAiC,EAAE;IACnE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,2BAA2B,EAAE;IAC3D,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,wDAAwD,EAAE;IACzF,EAAE,KAAK,EAAE,mBAAmB,EAAE,KAAK,EAAE,gEAAgE,EAAE;IACvG,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,wDAAwD,EAAE;CACzF,CAAC;AAMF,MAAa,GAAI,SAAQ,YAAK;IAM5B,YAAY,OAAmB,EAAE;QAC/B,KAAK,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,QAAQ,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,CAAC,CAAC;QANvE,SAAI,GAAG,KAAK,CAAC;QACb,WAAM,GAAG,CAAC,iBAAU,CAAC,SAAS,EAAE,iBAAU,CAAC,UAAU,CAAC,CAAC;QAM9D,MAAM,KAAK,GAAmB,EAAE,CAAC;QACjC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,KAAK,MAAM,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC;QACD,IAAI,CAAC,YAAY,GAAG;YAClB,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC,CAAC;gBACrC,KAAK;gBACL,KAAK,EAAE,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,GAAG,GAAG,CAAC;aAC7F,CAAC,CAAC;YACH,GAAG,KAAK;SACT,CAAC;IACJ,CAAC;IAED,QAAQ,CAAC,IAAY;QACnB,MAAM,OAAO,GAAwE,EAAE,CAAC;QAExF,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YACjD,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC;YACpB,IAAI,CAAyB,CAAC;YAC9B,OAAO,CAAC,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACvC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACnF,CAAC;QACH,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,IAAA,sBAAe,EAAC,EAAE,SAAS,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACnD,CAAC;QAED,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAChE,MAAM,cAAc,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,CAAC;QAE5D,IAAI,eAAe,GAAkB,IAAI,CAAC;QAC1C,IAAI,IAAI,CAAC,OAAO,KAAK,kBAAW,CAAC,MAAM,EAAE,CAAC;YACxC,8EAA8E;YAC9E,gFAAgF;YAChF,8EAA8E;YAC9E,yEAAyE;YACzE,gFAAgF;YAChF,MAAM,OAAO,GAAG,OAAO;iBACpB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;iBAC5C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3E,MAAM,KAAK,GAAyD,EAAE,CAAC;YACvE,KAAK,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,IAAI,OAAO,EAAE,CAAC;gBAC5C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;gBACzC,IAAI,QAAQ,IAAI,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,CAAC;oBACrC,QAAQ,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;gBAC7C,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC;gBACpC,CAAC;YACH,CAAC;YACD,IAAI,UAAU,GAAG,IAAI,CAAC;YACtB,KAAK,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvC,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,aAAa,KAAK,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;YAC1F,CAAC;YACD,eAAe,GAAG,UAAU,CAAC;QAC/B,CAAC;QAED,OAAO,IAAA,sBAAe,EAAC;YACrB,MAAM,EAAE,IAAI,CAAC,OAAO;YACpB,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,GAAG,CAAC,GAAG,GAAG;YACxC,SAAS,EAAE,IAAI,CAAC,IAAI;YACpB,cAAc;YACd,WAAW,EAAE,YAAY,OAAO,CAAC,MAAM,0BAA0B,cAAc,EAAE;YACjF,eAAe;YACf,QAAQ,EAAE,IAAA,0BAAe,EAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;SAClE,CAAC,CAAC;IACL,CAAC;CACF;AA/ED,kBA+EC"}

package/dist/guard/pipeline.d.ts

@@ -0,0 +1,26 @@
+/**
+ * Guard Pipeline -- composes multiple guards into an ordered evaluation chain.
+ *
+ * Must stay in sync with: sdk/python/src/shield360/guard/_pipeline.py
+ */
+import { Guard, PipelineResult } from './base';
+export interface PipelineOptions {
+    guards?: Guard[];
+    failOpen?: boolean;
+}
+export declare class Pipeline {
+    private readonly _guards;
+    private readonly _failOpen;
+    constructor(opts?: PipelineOptions);
+    get guards(): Guard[];
+    evaluate(text: string, phase?: string): PipelineResult;
+    /**
+     * Apply every redacting guard to `text` and return the result.
+     *
+     * Used after `evaluate` has already decided a call is redacted, to rewrite
+     * each message on its own. Emits nothing: the decision, and its telemetry,
+     * came from `evaluate`.
+     */
+    redact(text: string, phase?: string): string;
+    private static _emitOtel;
+}