@agentguard-run/spend 0.13.1 → 0.13.2

package/CHANGELOG.md

@@ -1,3 +1,9 @@
+## 0.13.2
+
+- Added thin framework adapters for Vercel AI SDK middleware, Claude Code hooks, Hermes hooks, and OpenRouter OpenAI-compatible clients.
+- Kept all adapter receipts metadata-only: prompts, completions, provider keys, signing keys, and policy details stay in the customer runtime.
+- Added TS and Python parity tests for pre-dispatch enforcement, post-dispatch signed receipts, and data-plane redaction.
+
 ## 0.13.1
 
 - Hardened `builderCode` receipt verification so legacy-hash fallback is unavailable when attribution metadata is present.

package/dist/frameworks/claude-code.d.ts

@@ -0,0 +1,32 @@
+import type { SpendGuard } from '../spend-guard';
+import { type FrameworkAdapterOptions } from './common';
+export interface ClaudeCodeHookInput {
+    session_id?: string;
+    transcript_path?: string;
+    cwd?: string;
+    hook_event_name?: string;
+    tool_name?: string;
+    tool_input?: Record<string, unknown>;
+    tool_response?: Record<string, unknown>;
+}
+export interface ClaudeCodeHookOutput {
+    continue?: boolean;
+    suppressOutput?: boolean;
+    systemMessage?: string;
+    hookSpecificOutput?: {
+        hookEventName: 'PreToolUse' | 'PostToolUse';
+        permissionDecision?: 'allow' | 'deny' | 'ask';
+        permissionDecisionReason?: string;
+        additionalContext?: string;
+    };
+}
+export interface ClaudeCodeHooks {
+    guard: SpendGuard;
+    handlePreToolUse(input: ClaudeCodeHookInput): Promise<ClaudeCodeHookOutput>;
+    handlePostToolUse(input: ClaudeCodeHookInput): Promise<ClaudeCodeHookOutput>;
+    handleHookInput(input: ClaudeCodeHookInput): Promise<ClaudeCodeHookOutput>;
+    settingsSnippet(command: string): Record<string, unknown>;
+}
+export declare function createClaudeCodeHooks(opts: FrameworkAdapterOptions): ClaudeCodeHooks;
+export declare const createAgentGuardClaudeCodeHooks: typeof createClaudeCodeHooks;
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/frameworks/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../src/frameworks/claude-code.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAgG,KAAK,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAEtJ,MAAM,WAAW,mBAAmB;IAClC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACrC,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,kBAAkB,CAAC,EAAE;QACnB,aAAa,EAAE,YAAY,GAAG,aAAa,CAAC;QAC5C,kBAAkB,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;QAC9C,wBAAwB,CAAC,EAAE,MAAM,CAAC;QAClC,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;CACH;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,UAAU,CAAC;IAClB,gBAAgB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC5E,iBAAiB,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC7E,eAAe,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAAC;IAC3E,eAAe,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3D;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,uBAAuB,GAAG,eAAe,CAiBpF;AAED,eAAO,MAAM,+BAA+B,8BAAwB,CAAC"}

package/dist/frameworks/claude-code.js

@@ -0,0 +1,75 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createAgentGuardClaudeCodeHooks = void 0;
+exports.createClaudeCodeHooks = createClaudeCodeHooks;
+const common_1 = require("./common");
+function createClaudeCodeHooks(opts) {
+    const guard = (0, common_1.createFrameworkGuard)({ ...opts, framework: 'claude-code' });
+    return {
+        guard,
+        handlePreToolUse: (input) => handlePreToolUse(guard, opts, input),
+        handlePostToolUse: (input) => handlePostToolUse(guard, input),
+        handleHookInput: async (input) => {
+            if (input.hook_event_name === 'PostToolUse')
+                return handlePostToolUse(guard, input);
+            return handlePreToolUse(guard, opts, input);
+        },
+        settingsSnippet: (command) => ({
+            hooks: {
+                PreToolUse: [{ matcher: '*', hooks: [{ type: 'command', command }] }],
+                PostToolUse: [{ matcher: '*', hooks: [{ type: 'command', command }] }],
+            },
+        }),
+    };
+}
+exports.createAgentGuardClaudeCodeHooks = createClaudeCodeHooks;
+async function handlePreToolUse(guard, opts, input) {
+    const toolName = (0, common_1.stringValue)(input.tool_name) ?? 'unknown_tool';
+    const cleanArgs = (0, common_1.redactDataPlane)(input.tool_input ?? {});
+    try {
+        const gate = await guard.guardToolCall({
+            toolName,
+            toolArgs: (0, common_1.safeRequestShape)(cleanArgs),
+            workflowId: input.session_id,
+            scope: opts.scope,
+        });
+        if (!gate.approved) {
+            return deny('AgentGuard blocked tool call: ' + gate.decision.reasons.join('; '));
+        }
+        if (gate.matchedPattern) {
+            return {
+                hookSpecificOutput: {
+                    hookEventName: 'PreToolUse',
+                    permissionDecision: 'ask',
+                    permissionDecisionReason: 'AgentGuard matched ' + gate.matchedPattern + '. Confirm before tool execution.',
+                },
+            };
+        }
+        return { continue: true, suppressOutput: true };
+    }
+    catch (error) {
+        return deny(error instanceof Error ? error.message : 'AgentGuard hook failed closed');
+    }
+}
+async function handlePostToolUse(guard, input) {
+    await (0, common_1.recordFrameworkReceipt)(guard, 'claude-code', {
+        event: 'PostToolUse',
+        sessionId: input.session_id ?? null,
+        toolName: input.tool_name ?? 'unknown_tool',
+        cwd: input.cwd ?? null,
+        toolInput: (0, common_1.redactDataPlane)(input.tool_input ?? {}),
+        toolResponse: (0, common_1.redactDataPlane)(input.tool_response ?? {}),
+    });
+    return { continue: true, suppressOutput: true };
+}
+function deny(reason) {
+    return {
+        continue: true,
+        hookSpecificOutput: {
+            hookEventName: 'PreToolUse',
+            permissionDecision: 'deny',
+            permissionDecisionReason: reason,
+        },
+    };
+}
+//# sourceMappingURL=claude-code.js.map

package/dist/frameworks/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../src/frameworks/claude-code.ts"],"names":[],"mappings":";;;AAiCA,sDAiBC;AAjDD,qCAAsJ;AAgCtJ,SAAgB,qBAAqB,CAAC,IAA6B;IACjE,MAAM,KAAK,GAAG,IAAA,6BAAoB,EAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IAC1E,OAAO;QACL,KAAK;QACL,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;QACjE,iBAAiB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC;QAC7D,eAAe,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE;YAC/B,IAAI,KAAK,CAAC,eAAe,KAAK,aAAa;gBAAE,OAAO,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;YACpF,OAAO,gBAAgB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC9C,CAAC;QACD,eAAe,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YAC7B,KAAK,EAAE;gBACL,UAAU,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;gBACrE,WAAW,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;aACvE;SACF,CAAC;KACH,CAAC;AACJ,CAAC;AAEY,QAAA,+BAA+B,GAAG,qBAAqB,CAAC;AAErE,KAAK,UAAU,gBAAgB,CAC7B,KAAiB,EACjB,IAA6B,EAC7B,KAA0B;IAE1B,MAAM,QAAQ,GAAG,IAAA,oBAAW,EAAC,KAAK,CAAC,SAAS,CAAC,IAAI,cAAc,CAAC;IAChE,MAAM,SAAS,GAAG,IAAA,wBAAe,EAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;IACrF,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;YACrC,QAAQ;YACR,QAAQ,EAAE,IAAA,yBAAgB,EAAC,SAAS,CAAC;YACrC,UAAU,EAAE,KAAK,CAAC,UAAU;YAC5B,KAAK,EAAE,IAAI,CAAC,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;YACnB,OAAO,IAAI,CAAC,gCAAgC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;QACnF,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,OAAO;gBACL,kBAAkB,EAAE;oBAClB,aAAa,EAAE,YAAY;oBAC3B,kBAAkB,EAAE,KAAK;oBACzB,wBAAwB,EAAE,qBAAqB,GAAG,IAAI,CAAC,cAAc,GAAG,kCAAkC;iBAC3G;aACF,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,+BAA+B,CAAC,CAAC;IACxF,CAAC;AACH,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,KAAiB,EAAE,KAA0B;IAC5E,MAAM,IAAA,+BAAsB,EAAC,KAAK,EAAE,aAAa,EAAE;QACjD,KAAK,EAAE,aAAa;QACpB,SAAS,EAAE,KAAK,CAAC,UAAU,IAAI,IAAI;QACnC,QAAQ,EAAE,KAAK,CAAC,SAAS,IAAI,cAAc;QAC3C,GAAG,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI;QACtB,SAAS,EAAE,IAAA,wBAAe,EAAC,KAAK,CAAC,UAAU,IAAI,EAAE,CAAC;QAClD,YAAY,EAAE,IAAA,wBAAe,EAAC,KAAK,CAAC,aAAa,IAAI,EAAE,CAAC;KACzD,CAAC,CAAC;IACH,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;AAClD,CAAC;AAED,SAAS,IAAI,CAAC,MAAc;IAC1B,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,kBAAkB,EAAE,MAAM;YAC1B,wBAAwB,EAAE,MAAM;SACjC;KACF,CAAC;AACJ,CAAC"}

package/dist/frameworks/common.d.ts

@@ -0,0 +1,51 @@
+import type { CapabilityTier, CallContext, Provider, SignedDecisionLogEntry, SpendDecision, SpendPolicy, SpendScope } from '../types';
+import { SpendGuard, type SpendGuardConfig } from '../spend-guard';
+export interface FrameworkAdapterOptions {
+    policy: SpendPolicy;
+    scope: SpendScope;
+    capabilityClaim?: CapabilityTier;
+    config?: Omit<SpendGuardConfig, 'policy'>;
+    licenseKey?: string;
+    defaultModel?: string;
+    defaultOutputTokens?: number;
+    framework?: string;
+}
+export interface FrameworkPreflight {
+    guard: SpendGuard;
+    call: CallContext;
+    decision: SpendDecision;
+    signed: SignedDecisionLogEntry | null;
+}
+export interface FrameworkCallInput {
+    framework: string;
+    model?: string;
+    provider?: Provider;
+    params?: unknown;
+    requestShape?: Record<string, unknown>;
+    metadata?: Record<string, unknown>;
+    workflowId?: string;
+    subagentId?: string;
+    toolName?: string;
+    outputTokens?: number;
+}
+export declare function createFrameworkGuard(opts: FrameworkAdapterOptions): SpendGuard;
+export declare function safeRequestShape(value: unknown): Record<string, unknown>;
+export declare function redactDataPlane(value: unknown): unknown;
+export declare function estimateInputTokens(guard: SpendGuard, value: unknown): number;
+export declare function outputTokensFromParams(params: unknown, fallback?: number): number;
+export declare function modelFromUnknown(model: unknown, fallback?: string): string;
+export declare function providerFromModel(model: string, provider?: Provider): Provider;
+export declare function buildFrameworkCall(guard: SpendGuard, opts: FrameworkAdapterOptions, input: FrameworkCallInput): CallContext;
+export declare function preflightFrameworkCall(guard: SpendGuard, opts: FrameworkAdapterOptions, input: FrameworkCallInput): Promise<FrameworkPreflight>;
+export declare function settleFrameworkCall(preflight: FrameworkPreflight, result: unknown, partial?: boolean): Promise<void>;
+export declare function recordFrameworkReceipt(guard: SpendGuard, framework: string, receipt: Record<string, unknown>): Promise<{
+    decision: SpendDecision;
+    signed: SignedDecisionLogEntry | null;
+}>;
+export declare function usageFromResult(result: unknown): {
+    inputTokens: number;
+    outputTokens: number;
+} | null;
+export declare function objectRecord(value: unknown): Record<string, unknown> | null;
+export declare function stringValue(value: unknown): string | undefined;
+//# sourceMappingURL=common.d.ts.map

package/dist/frameworks/common.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.d.ts","sourceRoot":"","sources":["../../src/frameworks/common.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,QAAQ,EAAE,sBAAsB,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGtI,OAAO,EAA0B,UAAU,EAAE,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAE3F,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,KAAK,EAAE,UAAU,CAAC;IAClB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,aAAa,CAAC;IACxB,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAC;CACvC;AAED,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAID,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,uBAAuB,GAAG,UAAU,CAM9E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMxE;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAevD;AAED,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,OAAO,GAAG,MAAM,CAG7E;AAED,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,SAAM,GAAG,MAAM,CAS9E;AAED,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,SAAY,GAAG,MAAM,CAQ7E;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAE9E;AAED,wBAAgB,kBAAkB,CAChC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,uBAAuB,EAC7B,KAAK,EAAE,kBAAkB,GACxB,WAAW,CAoBb;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,uBAAuB,EAC7B,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,kBAAkB,CAAC,CAO7B;AAED,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,kBAAkB,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,UAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CASxH;AAED,wBAAsB,sBAAsB,CAC1C,KAAK,EAAE,UAAU,EACjB,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC;IAAE,QAAQ,EAAE,aAAa,CAAC;IAAC,MAAM,EAAE,sBAAsB,GAAG,IAAI,CAAA;CAAE,CAAC,CAO7E;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,OAAO,GAAG;IAAE,WAAW,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAcrG;AAED,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAI3E;AAED,wBAAgB,WAAW,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,GAAG,SAAS,CAE9D"}

package/dist/frameworks/common.js

@@ -0,0 +1,168 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createFrameworkGuard = createFrameworkGuard;
+exports.safeRequestShape = safeRequestShape;
+exports.redactDataPlane = redactDataPlane;
+exports.estimateInputTokens = estimateInputTokens;
+exports.outputTokensFromParams = outputTokensFromParams;
+exports.modelFromUnknown = modelFromUnknown;
+exports.providerFromModel = providerFromModel;
+exports.buildFrameworkCall = buildFrameworkCall;
+exports.preflightFrameworkCall = preflightFrameworkCall;
+exports.settleFrameworkCall = settleFrameworkCall;
+exports.recordFrameworkReceipt = recordFrameworkReceipt;
+exports.usageFromResult = usageFromResult;
+exports.objectRecord = objectRecord;
+exports.stringValue = stringValue;
+const cost_table_1 = require("../cost-table");
+const governance_1 = require("../governance");
+const spend_guard_1 = require("../spend-guard");
+const DATA_PLANE_KEYS = /^(prompt|completion|content|messages|input|output|text|raw)$/i;
+function createFrameworkGuard(opts) {
+    return new spend_guard_1.SpendGuard({
+        policy: opts.policy,
+        ...(opts.config ?? {}),
+        licenseKey: opts.licenseKey ?? opts.config?.licenseKey,
+    });
+}
+function safeRequestShape(value) {
+    const redacted = redactDataPlane(value);
+    if (redacted && typeof redacted === 'object' && !Array.isArray(redacted)) {
+        return (0, governance_1.sanitizeMetadata)(redacted);
+    }
+    return { valueType: typeof value };
+}
+function redactDataPlane(value) {
+    if (value == null)
+        return value;
+    if (Array.isArray(value))
+        return value.map((child) => redactDataPlane(child));
+    if (typeof value !== 'object')
+        return value;
+    const out = {};
+    for (const [key, child] of Object.entries(value)) {
+        if (DATA_PLANE_KEYS.test(key)) {
+            out[key + '_present'] = child != null;
+            out[key + '_type'] = Array.isArray(child) ? 'array' : typeof child;
+            if (Array.isArray(child))
+                out[key + '_items'] = child.length;
+            continue;
+        }
+        out[key] = redactDataPlane(child);
+    }
+    return out;
+}
+function estimateInputTokens(guard, value) {
+    const serialized = typeof value === 'string' ? value : stableJson(value ?? {});
+    return Math.max(1, guard.estimateTokens(serialized));
+}
+function outputTokensFromParams(params, fallback = 512) {
+    const record = objectRecord(params);
+    const value = record?.max_tokens ??
+        record?.maxTokens ??
+        record?.maxOutputTokens ??
+        record?.max_completion_tokens ??
+        record?.maxCompletionTokens;
+    return Number.isSafeInteger(value) && value >= 0 ? value : fallback;
+}
+function modelFromUnknown(model, fallback = 'unknown') {
+    if (typeof model === 'string' && model.trim())
+        return model.trim();
+    const record = objectRecord(model);
+    for (const key of ['modelId', 'model_id', 'id', 'name']) {
+        const value = record?.[key];
+        if (typeof value === 'string' && value.trim())
+            return value.trim();
+    }
+    return fallback;
+}
+function providerFromModel(model, provider) {
+    return provider ?? (0, cost_table_1.inferProvider)(model);
+}
+function buildFrameworkCall(guard, opts, input) {
+    const model = modelFromUnknown(input.model, opts.defaultModel ?? 'unknown');
+    const metadata = (0, governance_1.sanitizeMetadata)(redactDataPlane(input.metadata ?? {}));
+    const requestShape = (0, governance_1.sanitizeMetadata)({
+        framework: input.framework,
+        ...(input.requestShape ?? safeRequestShape(input.params)),
+    });
+    return {
+        provider: providerFromModel(model, input.provider),
+        model,
+        inputTokens: estimateInputTokens(guard, input.params),
+        outputTokens: input.outputTokens ?? outputTokensFromParams(input.params, opts.defaultOutputTokens ?? 512),
+        scope: opts.scope,
+        capabilityClaim: opts.capabilityClaim,
+        workflowId: input.workflowId ?? stringValue(metadata.workflowId) ?? stringValue(metadata.workflow_id),
+        subagentId: input.subagentId ?? stringValue(metadata.subagentId) ?? stringValue(metadata.subagent_id),
+        label: stringValue(metadata.label) ?? input.framework,
+        toolName: input.toolName,
+        requestShape,
+    };
+}
+async function preflightFrameworkCall(guard, opts, input) {
+    const call = buildFrameworkCall(guard, opts, input);
+    const { decision, signed } = await guard.decide(call);
+    if (decision.action === 'block') {
+        throw new spend_guard_1.AgentGuardBlockedError(decision, opts.scope, opts.config?.locale);
+    }
+    return { guard, call, decision, signed };
+}
+async function settleFrameworkCall(preflight, result, partial = false) {
+    const usage = usageFromResult(result);
+    if (!usage)
+        return;
+    await preflight.guard.settleStreamUsage(preflight.decision.decisionId, usage.inputTokens, usage.outputTokens, { partial });
+}
+async function recordFrameworkReceipt(guard, framework, receipt) {
+    return guard.recordOutcomeReceipt({
+        type: 'framework_adapter',
+        framework,
+        totalCostCents: safeInteger(receipt.totalCostCents),
+        ...(0, governance_1.sanitizeMetadata)(redactDataPlane(receipt)),
+    });
+}
+function usageFromResult(result) {
+    const candidates = [
+        objectRecord(result)?.usage,
+        objectRecord(objectRecord(result)?.response)?.usage,
+        objectRecord(objectRecord(result)?.rawResponse)?.usage,
+    ];
+    for (const candidate of candidates) {
+        const usage = objectRecord(candidate);
+        if (!usage)
+            continue;
+        const input = firstInteger(usage.inputTokens, usage.promptTokens, usage.prompt_tokens, usage.input_tokens);
+        const output = firstInteger(usage.outputTokens, usage.completionTokens, usage.completion_tokens, usage.output_tokens);
+        if (input !== null && output !== null)
+            return { inputTokens: input, outputTokens: output };
+    }
+    return null;
+}
+function objectRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function stringValue(value) {
+    return typeof value === 'string' && value.trim() ? value.trim() : undefined;
+}
+function firstInteger(...values) {
+    for (const value of values) {
+        if (Number.isSafeInteger(value) && value >= 0)
+            return value;
+    }
+    return null;
+}
+function safeInteger(value) {
+    return Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function stableJson(value) {
+    try {
+        return JSON.stringify(value);
+    }
+    catch {
+        return String(value);
+    }
+}
+//# sourceMappingURL=common.js.map

package/dist/frameworks/common.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"common.js","sourceRoot":"","sources":["../../src/frameworks/common.ts"],"names":[],"mappings":";;AAsCA,oDAMC;AAED,4CAMC;AAED,0CAeC;AAED,kDAGC;AAED,wDASC;AAED,4CAQC;AAED,8CAEC;AAED,gDAwBC;AAED,wDAWC;AAED,kDASC;AAED,wDAWC;AAED,0CAcC;AAED,oCAIC;AAED,kCAEC;AA3LD,8CAA8C;AAC9C,8CAAiD;AACjD,gDAA2F;AAiC3F,MAAM,eAAe,GAAG,+DAA+D,CAAC;AAExF,SAAgB,oBAAoB,CAAC,IAA6B;IAChE,OAAO,IAAI,wBAAU,CAAC;QACpB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACtB,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,IAAI,CAAC,MAAM,EAAE,UAAU;KACvD,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc;IAC7C,MAAM,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACxC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACzE,OAAO,IAAA,6BAAgB,EAAC,QAAmC,CAAC,CAAC;IAC/D,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,KAAK,EAAE,CAAC;AACrC,CAAC;AAED,SAAgB,eAAe,CAAC,KAAc;IAC5C,IAAI,KAAK,IAAI,IAAI;QAAE,OAAO,KAAK,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC;IAC9E,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;QAC5E,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,GAAG,UAAU,CAAC,GAAG,KAAK,IAAI,IAAI,CAAC;YACtC,GAAG,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC;YACnE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,GAAG,GAAG,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;YAC7D,SAAS;QACX,CAAC;QACD,GAAG,CAAC,GAAG,CAAC,GAAG,eAAe,CAAC,KAAK,CAAC,CAAC;IACpC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAgB,mBAAmB,CAAC,KAAiB,EAAE,KAAc;IACnE,MAAM,UAAU,GAAG,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC,CAAC;AACvD,CAAC;AAED,SAAgB,sBAAsB,CAAC,MAAe,EAAE,QAAQ,GAAG,GAAG;IACpE,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,MAAM,KAAK,GACT,MAAM,EAAE,UAAU;QAClB,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,eAAe;QACvB,MAAM,EAAE,qBAAqB;QAC7B,MAAM,EAAE,mBAAmB,CAAC;IAC9B,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC5F,CAAC;AAED,SAAgB,gBAAgB,CAAC,KAAc,EAAE,QAAQ,GAAG,SAAS;IACnE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;IACnC,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QACxD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;IACrE,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAgB,iBAAiB,CAAC,KAAa,EAAE,QAAmB;IAClE,OAAO,QAAQ,IAAI,IAAA,0BAAa,EAAC,KAAK,CAAC,CAAC;AAC1C,CAAC;AAED,SAAgB,kBAAkB,CAChC,KAAiB,EACjB,IAA6B,EAC7B,KAAyB;IAEzB,MAAM,KAAK,GAAG,gBAAgB,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,YAAY,IAAI,SAAS,CAAC,CAAC;IAC5E,MAAM,QAAQ,GAAG,IAAA,6BAAgB,EAAC,eAAe,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC,CAAC;IACpG,MAAM,YAAY,GAAG,IAAA,6BAAgB,EAAC;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,GAAG,CAAC,KAAK,CAAC,YAAY,IAAI,gBAAgB,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;KAC1D,CAAC,CAAC;IACH,OAAO;QACL,QAAQ,EAAE,iBAAiB,CAAC,KAAK,EAAE,KAAK,CAAC,QAAQ,CAAC;QAClD,KAAK;QACL,WAAW,EAAE,mBAAmB,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC;QACrD,YAAY,EAAE,KAAK,CAAC,YAAY,IAAI,sBAAsB,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,mBAAmB,IAAI,GAAG,CAAC;QACzG,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrG,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,WAAW,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,WAAW,CAAC,QAAQ,CAAC,WAAW,CAAC;QACrG,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,SAAS;QACrD,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,YAAY;KACb,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,KAAiB,EACjB,IAA6B,EAC7B,KAAyB;IAEzB,MAAM,IAAI,GAAG,kBAAkB,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACpD,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACtD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,EAAE,CAAC;QAChC,MAAM,IAAI,oCAAsB,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9E,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AAC3C,CAAC;AAEM,KAAK,UAAU,mBAAmB,CAAC,SAA6B,EAAE,MAAe,EAAE,OAAO,GAAG,KAAK;IACvG,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,KAAK;QAAE,OAAO;IACnB,MAAM,SAAS,CAAC,KAAK,CAAC,iBAAiB,CACrC,SAAS,CAAC,QAAQ,CAAC,UAAU,EAC7B,KAAK,CAAC,WAAW,EACjB,KAAK,CAAC,YAAY,EAClB,EAAE,OAAO,EAAE,CACZ,CAAC;AACJ,CAAC;AAEM,KAAK,UAAU,sBAAsB,CAC1C,KAAiB,EACjB,SAAiB,EACjB,OAAgC;IAEhC,OAAO,KAAK,CAAC,oBAAoB,CAAC;QAChC,IAAI,EAAE,mBAAmB;QACzB,SAAS;QACT,cAAc,EAAE,WAAW,CAAC,OAAO,CAAC,cAAc,CAAC;QACnD,GAAG,IAAA,6BAAgB,EAAC,eAAe,CAAC,OAAO,CAA4B,CAAC;KACzE,CAAC,CAAC;AACL,CAAC;AAED,SAAgB,eAAe,CAAC,MAAe;IAC7C,MAAM,UAAU,GAAG;QACjB,YAAY,CAAC,MAAM,CAAC,EAAE,KAAK;QAC3B,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,EAAE,KAAK;QACnD,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,EAAE,KAAK;KACvD,CAAC;IACF,KAAK,MAAM,SAAS,IAAI,UAAU,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACtC,IAAI,CAAC,KAAK;YAAE,SAAS;QACrB,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,aAAa,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QAC3G,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,gBAAgB,EAAE,KAAK,CAAC,iBAAiB,EAAE,KAAK,CAAC,aAAa,CAAC,CAAC;QACtH,IAAI,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAC7F,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAgB,YAAY,CAAC,KAAc;IACzC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAChE,CAAC,CAAC,KAAgC;QAClC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED,SAAgB,WAAW,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AAC9E,CAAC;AAED,SAAS,YAAY,CAAC,GAAG,MAAiB;IACxC,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,IAAI,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC;YAAE,OAAO,KAAe,CAAC;IACpF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,KAAc;IACjC,OAAO,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAK,KAAgB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;AACH,CAAC"}

package/dist/frameworks/hermes.d.ts

@@ -0,0 +1,34 @@
+import type { SpendGuard } from '../spend-guard';
+import { type FrameworkAdapterOptions } from './common';
+export interface HermesToolEvent {
+    toolName?: string;
+    name?: string;
+    args?: Record<string, unknown>;
+    toolArgs?: Record<string, unknown>;
+    workflowId?: string;
+    sessionId?: string;
+    metadata?: Record<string, unknown>;
+    result?: Record<string, unknown>;
+}
+export interface HermesHookResult {
+    allow: boolean;
+    approved?: boolean;
+    reason?: string;
+    receiptId?: string;
+    editedArgs?: Record<string, unknown>;
+}
+export interface HermesPlugin {
+    name: 'agentguard-spend';
+    guard: SpendGuard;
+    hooks: {
+        'pre-tool-call': (event: HermesToolEvent) => Promise<HermesHookResult>;
+        approval: (event: HermesToolEvent) => Promise<HermesHookResult>;
+        'post-tool-call': (event: HermesToolEvent) => Promise<HermesHookResult>;
+    };
+    preToolCall(event: HermesToolEvent): Promise<HermesHookResult>;
+    approval(event: HermesToolEvent): Promise<HermesHookResult>;
+    postToolCall(event: HermesToolEvent): Promise<HermesHookResult>;
+}
+export declare function createHermesPlugin(opts: FrameworkAdapterOptions): HermesPlugin;
+export declare const agentguardHermesPlugin: typeof createHermesPlugin;
+//# sourceMappingURL=hermes.d.ts.map

package/dist/frameworks/hermes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes.d.ts","sourceRoot":"","sources":["../../src/frameworks/hermes.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAgG,KAAK,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAEtJ,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,kBAAkB,CAAC;IACzB,KAAK,EAAE,UAAU,CAAC;IAClB,KAAK,EAAE;QACL,eAAe,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QACvE,QAAQ,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;QAChE,gBAAgB,EAAE,CAAC,KAAK,EAAE,eAAe,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAC;KACzE,CAAC;IACF,WAAW,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC5D,YAAY,CAAC,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;CACjE;AAED,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,uBAAuB,GAAG,YAAY,CAe9E;AAED,eAAO,MAAM,sBAAsB,2BAAqB,CAAC"}

package/dist/frameworks/hermes.js

@@ -0,0 +1,50 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.agentguardHermesPlugin = void 0;
+exports.createHermesPlugin = createHermesPlugin;
+const common_1 = require("./common");
+function createHermesPlugin(opts) {
+    const guard = (0, common_1.createFrameworkGuard)({ ...opts, framework: 'hermes' });
+    const plugin = {
+        name: 'agentguard-spend',
+        guard,
+        hooks: {
+            'pre-tool-call': (event) => preToolCall(guard, opts, event),
+            approval: (event) => approval(guard, opts, event),
+            'post-tool-call': (event) => postToolCall(guard, event),
+        },
+        preToolCall: (event) => preToolCall(guard, opts, event),
+        approval: (event) => approval(guard, opts, event),
+        postToolCall: (event) => postToolCall(guard, event),
+    };
+    return plugin;
+}
+exports.agentguardHermesPlugin = createHermesPlugin;
+async function preToolCall(guard, opts, event) {
+    const gate = await guard.guardToolCall({
+        toolName: toolName(event),
+        toolArgs: (0, common_1.safeRequestShape)((0, common_1.redactDataPlane)(event.toolArgs ?? event.args ?? {})),
+        workflowId: event.workflowId ?? event.sessionId,
+        scope: opts.scope,
+    });
+    if (!gate.approved)
+        return { allow: false, approved: false, reason: gate.decision.reasons.join('; ') };
+    return { allow: true, approved: true, editedArgs: gate.editedArgs };
+}
+async function approval(guard, opts, event) {
+    return preToolCall(guard, opts, event);
+}
+async function postToolCall(guard, event) {
+    const { decision } = await (0, common_1.recordFrameworkReceipt)(guard, 'hermes', {
+        event: 'post-tool-call',
+        toolName: toolName(event),
+        workflowId: event.workflowId ?? event.sessionId ?? null,
+        metadata: (0, common_1.redactDataPlane)(event.metadata ?? {}),
+        result: (0, common_1.redactDataPlane)(event.result ?? {}),
+    });
+    return { allow: true, approved: true, receiptId: decision.decisionId };
+}
+function toolName(event) {
+    return (0, common_1.stringValue)(event.toolName) ?? (0, common_1.stringValue)(event.name) ?? 'unknown_tool';
+}
+//# sourceMappingURL=hermes.js.map

package/dist/frameworks/hermes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hermes.js","sourceRoot":"","sources":["../../src/frameworks/hermes.ts"],"names":[],"mappings":";;;AAmCA,gDAeC;AAjDD,qCAAsJ;AAkCtJ,SAAgB,kBAAkB,CAAC,IAA6B;IAC9D,MAAM,KAAK,GAAG,IAAA,6BAAoB,EAAC,EAAE,GAAG,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IACrE,MAAM,MAAM,GAAiB;QAC3B,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,KAAK,EAAE;YACL,eAAe,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;YAC3D,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;YACjD,gBAAgB,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;SACxD;QACD,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;QACvD,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC;QACjD,YAAY,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC;KACpD,CAAC;IACF,OAAO,MAAM,CAAC;AAChB,CAAC;AAEY,QAAA,sBAAsB,GAAG,kBAAkB,CAAC;AAEzD,KAAK,UAAU,WAAW,CAAC,KAAiB,EAAE,IAA6B,EAAE,KAAsB;IACjG,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC;QACrC,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;QACzB,QAAQ,EAAE,IAAA,yBAAgB,EAAC,IAAA,wBAAe,EAAC,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;QAC/E,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS;QAC/C,KAAK,EAAE,IAAI,CAAC,KAAK;KAClB,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACvG,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AACtE,CAAC;AAED,KAAK,UAAU,QAAQ,CAAC,KAAiB,EAAE,IAA6B,EAAE,KAAsB;IAC9F,OAAO,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,KAAiB,EAAE,KAAsB;IACnE,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,IAAA,+BAAsB,EAAC,KAAK,EAAE,QAAQ,EAAE;QACjE,KAAK,EAAE,gBAAgB;QACvB,QAAQ,EAAE,QAAQ,CAAC,KAAK,CAAC;QACzB,UAAU,EAAE,KAAK,CAAC,UAAU,IAAI,KAAK,CAAC,SAAS,IAAI,IAAI;QACvD,QAAQ,EAAE,IAAA,wBAAe,EAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC;QAC/C,MAAM,EAAE,IAAA,wBAAe,EAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;KAC5C,CAAC,CAAC;IACH,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC,UAAU,EAAE,CAAC;AACzE,CAAC;AAED,SAAS,QAAQ,CAAC,KAAsB;IACtC,OAAO,IAAA,oBAAW,EAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,IAAA,oBAAW,EAAC,KAAK,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC;AAClF,CAAC"}

package/dist/frameworks/index.d.ts

@@ -0,0 +1,6 @@
+export * from './common';
+export * from './openrouter';
+export * from './vercel-ai';
+export * from './claude-code';
+export * from './hermes';
+//# sourceMappingURL=index.d.ts.map

package/dist/frameworks/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/frameworks/index.ts"],"names":[],"mappings":"AAAA,cAAc,UAAU,CAAC;AACzB,cAAc,cAAc,CAAC;AAC7B,cAAc,aAAa,CAAC;AAC5B,cAAc,eAAe,CAAC;AAC9B,cAAc,UAAU,CAAC"}

package/dist/frameworks/index.js

@@ -0,0 +1,22 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./common"), exports);
+__exportStar(require("./openrouter"), exports);
+__exportStar(require("./vercel-ai"), exports);
+__exportStar(require("./claude-code"), exports);
+__exportStar(require("./hermes"), exports);
+//# sourceMappingURL=index.js.map

package/dist/frameworks/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/frameworks/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,2CAAyB;AACzB,+CAA6B;AAC7B,8CAA4B;AAC5B,gDAA8B;AAC9B,2CAAyB"}

package/dist/frameworks/openrouter.d.ts

@@ -0,0 +1,19 @@
+import { type SpendGuardConfig } from '../spend-guard';
+import type { CapabilityTier, SpendPolicy, SpendScope } from '../types';
+import { type FrameworkAdapterOptions } from './common';
+export interface OpenRouterBindingOptions {
+    policy: SpendPolicy;
+    scope: SpendScope;
+    capabilityClaim?: CapabilityTier;
+    config?: Omit<SpendGuardConfig, 'policy'>;
+    licenseKey?: string;
+    openRouterBaseUrl?: string;
+}
+export declare function withSpendGuardOpenRouter<TClient>(client: TClient, opts: OpenRouterBindingOptions): TClient;
+export declare function withOpenRouterSpendGuard<TClient>(client: TClient, opts: OpenRouterBindingOptions): TClient;
+export interface OpenRouterFetchOptions extends FrameworkAdapterOptions {
+    fetchImpl?: (url: string, init?: Record<string, unknown>) => Promise<unknown>;
+    endpoint?: string;
+}
+export declare function createOpenRouterFetch(opts: OpenRouterFetchOptions): (url: string, init?: Record<string, unknown>) => Promise<unknown>;
+//# sourceMappingURL=openrouter.d.ts.map

package/dist/frameworks/openrouter.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openrouter.d.ts","sourceRoot":"","sources":["../../src/frameworks/openrouter.ts"],"names":[],"mappings":"AAAA,OAAO,EAA6C,KAAK,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAClG,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AACxE,OAAO,EAAqE,KAAK,uBAAuB,EAAE,MAAM,UAAU,CAAC;AAE3H,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,UAAU,CAAC;IAClB,eAAe,CAAC,EAAE,cAAc,CAAC;IACjC,MAAM,CAAC,EAAE,IAAI,CAAC,gBAAgB,EAAE,QAAQ,CAAC,CAAC;IAC1C,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAa1G;AAED,wBAAgB,wBAAwB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,wBAAwB,GAAG,OAAO,CAE1G;AAED,MAAM,WAAW,sBAAuB,SAAQ,uBAAuB;IACrE,SAAS,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,sBAAsB,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC,CA6BrI"}

package/dist/frameworks/openrouter.js

@@ -0,0 +1,85 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.withSpendGuardOpenRouter = withSpendGuardOpenRouter;
+exports.withOpenRouterSpendGuard = withOpenRouterSpendGuard;
+exports.createOpenRouterFetch = createOpenRouterFetch;
+const spend_guard_1 = require("../spend-guard");
+const common_1 = require("./common");
+function withSpendGuardOpenRouter(client, opts) {
+    const config = {
+        ...(opts.config ?? {}),
+        openRouterBaseUrl: opts.openRouterBaseUrl ?? opts.config?.openRouterBaseUrl ?? 'https://openrouter.ai/api/v1',
+        providerRoute: opts.config?.providerRoute ?? 'openrouter',
+    };
+    return (0, spend_guard_1.withSpendGuard)(client, {
+        policy: opts.policy,
+        scope: opts.scope,
+        capabilityClaim: opts.capabilityClaim,
+        licenseKey: opts.licenseKey,
+        config,
+    });
+}
+function withOpenRouterSpendGuard(client, opts) {
+    return withSpendGuardOpenRouter(client, opts);
+}
+function createOpenRouterFetch(opts) {
+    const guard = (0, common_1.createFrameworkGuard)({ ...opts, defaultModel: opts.defaultModel ?? 'openrouter/auto', framework: 'openrouter' });
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    if (!fetchImpl)
+        throw new Error('createOpenRouterFetch: fetch is not available');
+    const endpoint = opts.endpoint ?? 'https://openrouter.ai/api/v1/chat/completions';
+    return async (url, init = {}) => {
+        const target = String(url);
+        if (!target.startsWith(endpoint))
+            return fetchImpl(target, init);
+        const body = parseJsonBody(init.body);
+        const preflight = await (0, common_1.preflightFrameworkCall)(guard, opts, {
+            framework: 'openrouter',
+            model: typeof body.model === 'string' ? body.model : opts.defaultModel ?? 'openrouter/auto',
+            params: body,
+            metadata: metadataRecord(body.metadata),
+            requestShape: {
+                endpoint: '/api/v1/chat/completions',
+                stream: body.stream === true,
+                maxTokens: typeof body.max_tokens === 'number' ? body.max_tokens : undefined,
+                toolCount: Array.isArray(body.tools) ? body.tools.length : 0,
+            },
+        });
+        const nextBody = preflight.decision.action === 'downgrade' && preflight.decision.modelResolved !== preflight.decision.modelRequested
+            ? { ...body, model: preflight.decision.modelResolved }
+            : body;
+        const response = await fetchImpl(target, { ...init, body: JSON.stringify(nextBody) });
+        await (0, common_1.settleFrameworkCall)(preflight, await responseJson(response));
+        return response;
+    };
+}
+function parseJsonBody(body) {
+    if (typeof body === 'string') {
+        try {
+            return JSON.parse(body);
+        }
+        catch {
+            return {};
+        }
+    }
+    if (body && typeof body === 'object' && !Array.isArray(body))
+        return body;
+    return {};
+}
+function metadataRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+}
+async function responseJson(response) {
+    const maybe = response;
+    try {
+        if (typeof maybe.clone === 'function')
+            return await maybe.clone().json?.();
+        if (typeof maybe.json === 'function')
+            return await maybe.json();
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+//# sourceMappingURL=openrouter.js.map

package/dist/frameworks/openrouter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openrouter.js","sourceRoot":"","sources":["../../src/frameworks/openrouter.ts"],"names":[],"mappings":";;AAaA,4DAaC;AAED,4DAEC;AAOD,sDA6BC;AAlED,gDAAkG;AAElG,qCAA2H;AAW3H,SAAgB,wBAAwB,CAAU,MAAe,EAAE,IAA8B;IAC/F,MAAM,MAAM,GAAG;QACb,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;QACtB,iBAAiB,EAAE,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,MAAM,EAAE,iBAAiB,IAAI,8BAA8B;QAC7G,aAAa,EAAE,IAAI,CAAC,MAAM,EAAE,aAAa,IAAI,YAAY;KACtB,CAAC;IACtC,OAAO,IAAA,4BAAc,EAAC,MAAM,EAAE;QAC5B,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,eAAe,EAAE,IAAI,CAAC,eAAe;QACrC,UAAU,EAAE,IAAI,CAAC,UAAU;QAC3B,MAAM;KACwB,CAAY,CAAC;AAC/C,CAAC;AAED,SAAgB,wBAAwB,CAAU,MAAe,EAAE,IAA8B;IAC/F,OAAO,wBAAwB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAOD,SAAgB,qBAAqB,CAAC,IAA4B;IAChE,MAAM,KAAK,GAAG,IAAA,6BAAoB,EAAC,EAAE,GAAG,IAAI,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,IAAI,iBAAiB,EAAE,SAAS,EAAE,YAAY,EAAE,CAAC,CAAC;IAC/H,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAK,UAAuG,CAAC,KAAK,CAAC;IACnJ,IAAI,CAAC,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACjF,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,+CAA+C,CAAC;IAElF,OAAO,KAAK,EAAE,GAAW,EAAE,OAAgC,EAAE,EAAE,EAAE;QAC/D,MAAM,MAAM,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,OAAO,SAAS,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,MAAM,IAAA,+BAAsB,EAAC,KAAK,EAAE,IAAI,EAAE;YAC1D,SAAS,EAAE,YAAY;YACvB,KAAK,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,IAAI,iBAAiB;YAC3F,MAAM,EAAE,IAAI;YACZ,QAAQ,EAAE,cAAc,CAAC,IAAI,CAAC,QAAQ,CAAC;YACvC,YAAY,EAAE;gBACZ,QAAQ,EAAE,0BAA0B;gBACpC,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;gBAC5B,SAAS,EAAE,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gBAC5E,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aAC7D;SACF,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,KAAK,WAAW,IAAI,SAAS,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,QAAQ,CAAC,cAAc;YAClI,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC,aAAa,EAAE;YACtD,CAAC,CAAC,IAAI,CAAC;QACT,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,MAAM,EAAE,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;QACtF,MAAM,IAAA,4BAAmB,EAAC,SAAS,EAAE,MAAM,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACnE,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,IAAa;IAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC;YAAC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,OAAO,EAAE,CAAC;QAAC,CAAC;IAClF,CAAC;IACD,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;QAAE,OAAO,IAA+B,CAAC;IACrG,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,cAAc,CAAC,KAAc;IACpC,OAAO,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAgC,CAAC,CAAC,CAAC,EAAE,CAAC;AAC7G,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,QAAiB;IAC3C,MAAM,KAAK,GAAG,QAA8F,CAAC;IAC7G,IAAI,CAAC;QACH,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,OAAO,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC;QAC3E,IAAI,OAAO,KAAK,CAAC,IAAI,KAAK,UAAU;YAAE,OAAO,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}