/**
 * LLM Guardrails — pre/post phase enforcement with Poseidon-provable violations.
 *
 * Sprint-563: B1 — LLM Guardrails pre/post + violations Vauban Proof Stack.
 *
 * Guards run before (pre-phase) or after (post-phase) each OODA phase.
 * Pre-guards are BLOCKING — phase.fn does NOT execute if guard trips.
 * Post-guards inspect output — reject phase result if violation detected.
 *
 * Violations produce a Poseidon hash via proofPort → anchorable on L3.
 * CycleEventV011 'guardrail_violated' is emitted with proofHash + timing.
 */
/**
 * Run pre-guards. Returns the first violation, or null if all pass.
 * Pre-guard violations are BLOCKING — the phase does not execute.
 */
export async function runPreGuards(guards, input, ctx) {
    for (const guard of guards) {
        if (guard.timing !== "pre-phase")
            continue;
        const result = await guard.check(input, ctx);
        if (!result.pass) {
            return {
                name: guard.name,
                timing: guard.timing,
                phase: "(pre-phase)",
                reason: result.reason ?? "Guard tripped",
                proofHash: result.proofHash,
            };
        }
    }
    return null;
}
/**
 * Run post-guards. Returns the first violation, or null if all pass.
 * Post-guard violations REJECT the phase output.
 */
export async function runPostGuards(guards, output, ctx) {
    for (const guard of guards) {
        if (guard.timing !== "post-phase")
            continue;
        const result = await guard.check(output, ctx);
        if (!result.pass) {
            return {
                name: guard.name,
                timing: guard.timing,
                phase: "(post-phase)",
                reason: result.reason ?? "Guard tripped",
                proofHash: result.proofHash,
            };
        }
    }
    return null;
}
/**
 * Build a CycleEventV011 'guardrail_violated' event from a violation.
 */
export function guardrailViolationToEvent(violation, runId, cycleIndex) {
    return {
        type: "guardrail_violated",
        runId,
        cycleIndex,
        phase: violation.phase,
        timing: violation.timing,
        proofHash: violation.proofHash ?? "",
        reason: violation.reason,
        ts: Date.now(),
    };
}
// ─── Built-in guardrails ─────────────────────────────────────────────────────
/**
 * PII guard — detects credit card numbers in output.
 * Post-phase only, runs after LLM calls.
 */
export const PII_GUARD = {
    name: "no-pii-in-output",
    timing: "post-phase",
    async check(output) {
        // Luhn-like detection: 13-19 digit sequences (credit card PAN range)
        const ccPattern = /\b[0-9]{13,19}\b/g;
        const matches = output.match(ccPattern);
        if (matches) {
            const hasLuhn = matches.some((m) => {
                let sum = 0;
                let alt = false;
                for (let i = m.length - 1; i >= 0; i--) {
                    let n = parseInt(m[i], 10);
                    if (alt) {
                        n *= 2;
                        if (n > 9)
                            n -= 9;
                    }
                    sum += n;
                    alt = !alt;
                }
                return sum % 10 === 0;
            });
            if (hasLuhn) {
                return {
                    pass: false,
                    reason: "Potential credit card number detected in LLM output",
                };
            }
        }
        return { pass: true };
    },
};
/**
 * Max output length guard — prevents runaway LLM responses.
 * Pre-phase only (applied to input size before LLM call).
 */
export function createMaxInputLengthGuard(maxChars) {
    return {
        name: `max-input-${maxChars}`,
        timing: "pre-phase",
        async check(input) {
            if (input.length > maxChars) {
                return {
                    pass: false,
                    reason: `Input length ${input.length} exceeds maximum ${maxChars} characters`,
                };
            }
            return { pass: true };
        },
    };
}
//# sourceMappingURL=guardrails.js.map