Class ParallelGuardrailDispatcher

Evaluate user input through registered guardrails using two-phase execution.

Phase 1 (Sequential — sanitizers): Guardrails with config.canSanitize === true run one-at-a-time in registration order. Each sees (and may modify) the cumulative sanitized input. A BLOCK result short-circuits immediately — Phase 2 never runs.

Phase 2 (Parallel — classifiers): All remaining guardrails run concurrently via Promise.allSettled on the text produced by Phase 1. A Phase 2 SANITIZE is downgraded to FLAG.

Aggregation: worst-wins (BLOCK > FLAG > ALLOW). The singular evaluation field is set to the first BLOCK, else the worst-severity evaluation, else the last evaluation by registration order.

Evaluate one TOOL_CALL_REQUEST chunk with the guardrails that evaluate tool calls (config.evaluateToolCalls), as wrapOutput evaluates the tool-call chunks of a stream: in parallel, a SANITIZE applied as a BLOCK, the first BLOCK in registration order the verdict. Services without the flag are not called.

Wrap a response stream with two-phase guardrail filtering.

Partitions services into four groups (once, up front):

1. Streaming sanitizers (canSanitize && evaluateStreamingChunks)
2. Streaming parallel classifiers (evaluateStreamingChunks && !canSanitize)
3. Final sanitizers (canSanitize && !evaluateStreamingChunks)
4. Final parallel classifiers (the rest with evaluateOutput)

For each TEXT_DELTA chunk: Phase 1 runs streaming sanitizers sequentially (with per-service rate limiting), then Phase 2 runs streaming classifiers in parallel.

For each isFinal chunk: Phase 1 runs final sanitizers sequentially, then Phase 2 runs final classifiers in parallel. All services with evaluateOutput participate in final evaluation.

For each non-final TOOL_CALL_REQUEST chunk: the services whose config sets evaluateToolCalls run in parallel on the chunk as the stream carries it. A SANITIZE is applied as a BLOCK, since a tool call cannot be rewritten; a BLOCK ends the stream with the verdict in place of the chunk. Services without the flag never receive a tool-call chunk. A block that withholds an actionable call (executionMode: 'external'), on its chunk or, in hold mode, on the text before it, names the call ids in the verdict's toolCallIds.

A BLOCK in either phase terminates the stream immediately with an error chunk, or with a final response holding the guard's replacementText.