feat(apollo-wind): shared guardrail definitions layer with a canonical copy table [AL-574]

[andreizdrali-uipath]

AL-574a: shared guardrail definitions layer

AL-574 under epic AL-526. Stacked on #1107 — draft until that merges.

Why

The backend never sends display copy for built-in guardrails (DisplayName/Description/OptionLabels are unset; the friendly name is [JsonIgnore]). So Agents and Flow each hand-maintain their own ~450-line copy table for the same 6 validators — and they've already drifted in 16 strings ("Detection threshold" vs "thresholds", SelfHarm vs "Self-harm", etc.). This ships that table once, plus the parsing it needs.

What

import { parseGuardrailDefinitions, enrichGuardrailDefinitions } from '@uipath/apollo-wind';

const { definitions, invalid } = parseGuardrailDefinitions(await response.json()); // never throws
const enriched = enrichGuardrailDefinitions(definitions, {
  translate: (key, defaultValue) => t(key, { defaultValue }), // your i18n
  hiddenValidators: ['prompt_injection'],
});

<GuardrailBuilder definition={enriched[i]} .../>  // #1107's prop shape, unchanged

Module	Role
definitions-wire.ts	Hand-written API types. No zod.
definitions-parse.ts	zod schemas + parseGuardrailDefinitions. Only zod importer.
definitions-copy.ts	Canonical English + copy-key contract.
definitions-enrich.ts	enrichGuardrailDefinitions → EnrichedGuardrailDefinition extends GuardrailDefinition.

No fetching (mirrors #1107 — zero transport in its diff; each host's transport is irreducibly different). No component changed — GuardrailBuilder already takes definition: GuardrailDefinition; enriched[i] slots in with no cast.

Worth a look

• zod fully sealed out of published types (hosts run different zod majors) — verified grep -rn zod dist/**/*.d.ts is empty for this folder.
• Copy precedence (matches what both products render today): curated wins at definition level for non-BYO, wire wins at parameter level, optionLabels merge. BYO definitions get zero curated copy.
• QA-visible behavior changes: Agents' PII thresholds go from unconstrained to 0–1 step 0.1; prompt_injection's description keeps Agents' wording (drops the "Noma Security" attribution otherwise); 11 more copy strings converge — full list + reasons in __fixtures__/host-copy-baselines.ts.
• Copy keys are guardrail/<validator>/<slot> (/, never . — one host's i18n catalog is flat and splits on ., so a dotted key would silently fall back to English forever).

Testing

351 tests (133 new), 100% lines/functions/statements on all 4 new modules. Golden fixtures instead of snapshots (repo has none; biome reformats file snapshots and fails them). typecheck/lint/build green.

Gaps

• No real tenant API capture for wire-raw-capture.ts — fixtures are hand-derived from the backend C# source instead, cross-checked against GuardrailsControllerTests.cs.
• Barely any CI runs on a non-main-based PR (same as feat(apollo-wind): guardrails component family (validator form + builder screen) #1107).
• Pre-existing, unrelated: forms/validation-converter.ts also leaks a zod type into published types — flagged as a follow-up, not fixed here.

Not in this PR: translating the copy into other locales (stays host-side, by design), any change to #1107's components, host adoption in Agents/Flow (separate tickets).

🤖 Generated with Claude Code

[github-actions]

Dependency License Review

• ✅ 1937 package(s) scanned
• ✅ No license issues found
• ⚠️ 2 package(s) excluded (see details below)

License distribution

License	Packages
MIT	1708
ISC	88
Apache-2.0	55
BSD-3-Clause	27
BSD-2-Clause	23
BlueOak-1.0.0	8
MPL-2.0	4
MIT-0	3
CC0-1.0	3
MIT OR Apache-2.0	2
(MIT OR Apache-2.0)	2
Unlicense	2
LGPL-3.0-or-later	1
Python-2.0	1
CC-BY-4.0	1
(MPL-2.0 OR Apache-2.0)	1
Unknown	1
Artistic-2.0	1
(WTFPL OR MIT)	1
(BSD-2-Clause OR MIT OR Apache-2.0)	1
CC-BY-3.0	1
0BSD	1
(MIT OR CC0-1.0)	1
MIT AND ISC	1

Excluded packages

Package	Version	License	Reason
@img/sharp-libvips-linux-x64	1.3.2	LGPL-3.0-or-later	LGPL pre-built binary, not linked
khroma	2.1.0	Unknown	MIT per GitHub repo, missing license field in package.json