Skip to main content

Class: WunderlandSecurityPipeline

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:53

Wunderland Security Pipeline - Unified security guardrail.

Orchestrates the three-layer security model:

  1. Pre-LLM Classifier: Fast pattern-based input screening
  2. Dual-LLM Auditor: AI-based output verification
  3. Signed Output Verifier: Cryptographic audit trail

Example​

const pipeline = new WunderlandSecurityPipeline({
  enablePreLLM: true,
  enableDualLLMAudit: true,
  enableOutputSigning: true,
  classifierConfig: { riskThreshold: 0.7 },
});

// Use as a guardrail service
orchestrator.registerGuardrail(pipeline);

// Or evaluate directly
const result = await pipeline.evaluateInput(payload);
if (result?.action === 'block') {
  // Handle blocked input
}

Implements​

Constructors​

Constructor​

new WunderlandSecurityPipeline(config?, auditorInvoker?): WunderlandSecurityPipeline

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:77

Parameters​

config?​

Partial<SecurityPipelineConfig> = {}

auditorInvoker?​

(prompt) => Promise<string>

Returns​

WunderlandSecurityPipeline

Properties​

config​

readonly config: GuardrailConfig

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:54

Methods​

evaluateInput()​

evaluateInput(payload): Promise<any>

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:129

Evaluates input through the security pipeline.

Parameters​

payload​

GuardrailInputPayload

Returns​

Promise<any>

evaluateOutput()​

evaluateOutput(payload): Promise<any>

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:195

Evaluates output through the security pipeline.

Parameters​

payload​

GuardrailOutputPayload

Returns​

Promise<any>

getAllSecurityFlags()​

getAllSecurityFlags(): string[]

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:330

Gets all security flags from the current request.

Returns​

string[]

getComponents()​

getComponents(): object

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:585

Gets individual component instances (for advanced usage).

Returns​

object

auditor​

auditor: DualLLMAuditor | null

classifier​

classifier: PreLLMClassifier | null

intentTracker​

intentTracker: IntentChainTracker

verifier​

verifier: SignedOutputVerifier | null

getIntentChain()​

getIntentChain(): readonly IntentChainEntry[]

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:284

Gets the current intent chain.

Returns​

readonly IntentChainEntry[]

getIntentChainSummary()​

getIntentChainSummary(): { duration: number | null; modelsUsed: string[]; securityFlags: string[]; stepCount: number; uniqueActions: string[]; } | null

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:291

Gets a summary of the current intent chain.

Returns​

{ duration: number | null; modelsUsed: string[]; securityFlags: string[]; stepCount: number; uniqueActions: string[]; } | null

getPipelineConfig()​

getPipelineConfig(): SecurityPipelineConfig

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:578

Gets the pipeline configuration.

Returns​

SecurityPipelineConfig

hasSecurityFlags()​

hasSecurityFlags(): boolean

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:323

Checks if the current request has any security flags.

Returns​

boolean

reset()​

reset(): void

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:276

Resets the pipeline state for a new request.

Returns​

void

setSeedId()​

setSeedId(seedId): void

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:122

Sets the current seed ID for output signing.

Parameters​

seedId​

string

Returns​

void

signOutput()​

signOutput(content): SignedAgentOutput | null

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:242

Signs the final output with full intent chain. Call this after the response is complete.

Parameters​

content​

unknown

Returns​

SignedAgentOutput | null

trackAction()​

trackAction(action, inputHash, outputHash, modelUsed, securityFlags?, metadata?): IntentChainEntry

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:302

Manually adds an entry to the intent chain. Useful for tracking custom actions.

Parameters​

action​

string

inputHash​

string

outputHash​

string

modelUsed​

string

securityFlags?​

string[] = []

metadata?​

Record<string, unknown>

Returns​

IntentChainEntry

verifyOutput()​

verifyOutput(signedOutput): boolean

Defined in: .source/wunderland/src/security/WunderlandSecurityPipeline.ts:266

Verifies a previously signed output.

Parameters​

signedOutput​

SignedAgentOutput

Returns​

boolean