Framework-agnostic application-layer API security engine.

Rust port of guard-core's detection engine. Work in progress: the CPU-bound detection pipeline is the core, and the first pipeline stage has landed: the rate-limit and dynamic-ban [tower] layer for Axum/tonic-shaped stacks. Handlers, protocols, decorators, and other I/O layers are not yet ported.

Re-exports the detection engine modules:

• [compiler] - regex pattern compilation with LRU caching and ReDoS safety validation
• [detect] - the spec 4.0.2 detection pipeline entry point (detect, [detect::DetectConfig], [detect::DetectVerdict])
• [preprocessor] - unicode NFKC normalization, URL/HTML decoding, null byte removal, whitespace collapsing, and attack-preserving truncation
• [semantic] - token extraction, Shannon entropy, encoding layer detection, attack probability scoring, obfuscation detection, code injection risk analysis, and aggregate threat scoring
• [cloud_provider] - the cloud-provider blocking pipeline stage as a tower::Layer (403 "Cloud provider IP not allowed", region carve-outs, skip-state aware)
• [geo] - the geo country blocking pipeline stage as a tower::Layer (403 "Forbidden", loopback exemption, whitelist-skip only)
• [tower] - the rate-limit and dynamic IP ban pipeline stage as a tower::Layer (429 throttled shape, 403 banned shapes, exempt-IP handling, and the auto-ban feeds)
• [request_limits] - the request size and content-type pipeline stage as a tower::Layer (413 size shape, 415 content-type shape, fail-secure 500 on a junk content-length)
• [headers_auth] - the required-headers and authentication pipeline stage as a tower::Layer (dynamic 400 required-header shapes, fixed 401 authentication shape, route rules with a global verifier fallback)

Usage

use guard_core_rs::preprocessor;
use guard_core_rs::semantic::AttackKeywords;
use guard_core_rs::semantic::AttackStructures;
use guard_core_rs::semantic::{self};

let raw = "<scr\u{200B}ipt>alert(1)</script>";
let clean = preprocessor::preprocess(raw, 10_000, true);

let kw = AttackKeywords::default();
let st = AttackStructures::default();
let result = semantic::analyze(&clean, &kw, &st);
let score = semantic::get_threat_score(&result);

assert!(score > 0.0);