integrate-arcjet-guard-genkit

Integrate Arcjet Guard into a Genkit app

@arcjet/guard's Genkit v1 namespace wraps the agent's existing Arcjet client. It never talks to the Arcjet API itself. Three surfaces, one decision rule:

• An authored tool (ai.defineTool(config, handler)) → guardTool(). After defineTool the object is a ToolAction; generate() calls it as a function. DENY returns a structured ArcjetDenialResult. Do not throw. Do not call interrupt(). Do not throw ToolInterruptError.
• Filesystem / MCP / unwrapped tools → guardMiddleware(). A generate({ use }) middleware whose tool hook is the generate()-wide gate. It denies by returning a completed ToolResponsePart without calling next(). Already-branded tools are skipped when they can be looked up. Requires the generateMiddleware tool hook (Genkit >= 1.33).
• Correlation → genkitContext() reads a field the integrator put on generate({ context }) / the tool handler's { context } (correlationId, then sessionId, then conversationId, then a caller-owned flow / run id). It never mints a new id. It never reads traceId. It never treats interrupt / resumed as correlation.

This namespace is JS genkit() + ai.defineTool + ai.generate. Not Go / Python Genkit. Do not also wrap the same tool with @arcjet/guard/vercel-ai/v7 or @arcjet/guard/claude-managed-agents/v0. Zod is Genkit's, not ours.

Screen user text before generate() — there is no inbound hook. Middleware model is not Guard.

There is no first-class inbound channel, so there is no guardInbound. Put prompt-injection (and other inbound rules) in the application before ai.generate() / chat.send(). The middleware model hook intercepts the model call, not user text. It is not this policy gate.

interrupt() / defineInterrupt / toolApproval are HITL, not a policy gate.

interrupt() / defineInterrupt / @genkit-ai/middleware toolApproval / restartTool / finishReason === "interrupted" is human-in-the-loop. Same trap as Mastra requireApproval, Claude canUseTool, LangGraph interrupt(), OpenAI Agents needsApproval, and Google ADK requireConfirmation. There is no guardApproval. Do not wrap them as Guard.