@evalguard/openai 1.2.1 → 1.2.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +51 -0
- package/README.md +9 -1
- package/dist/surface.d.ts.map +1 -1
- package/dist/surface.js +36 -5
- package/dist/surface.js.map +1 -1
- package/package.json +3 -2
package/CHANGELOG.md
ADDED
|
@@ -0,0 +1,51 @@
|
|
|
1
|
+
# @evalguard/openai
|
|
2
|
+
|
|
3
|
+
This package wraps the OpenAI SDK and routes every `checkInput` / `scoreOutput`
|
|
4
|
+
call through one shared transport, `@evalguard/wrapper-core`'s
|
|
5
|
+
`fetchWithTimeout`. A defect in that transport is a defect here.
|
|
6
|
+
|
|
7
|
+
## 1.2.2 — unreleased
|
|
8
|
+
|
|
9
|
+
### Security — a redirect defeated the guardrail verdict
|
|
10
|
+
|
|
11
|
+
**Affects every published version up to and including `1.2.1`.**
|
|
12
|
+
|
|
13
|
+
`fetchWithTimeout` called `fetch` with no redirect posture, and WHATWG/undici
|
|
14
|
+
default to `redirect: "follow"` — so an omitted option is not neutral, it is
|
|
15
|
+
the vulnerable setting.
|
|
16
|
+
|
|
17
|
+
A `3xx` served on the API path rewrote the request to a bodyless `GET`
|
|
18
|
+
(`301`/`302`/`303`), which means the prompt or completion you asked EvalGuard
|
|
19
|
+
to screen **was never transmitted**. The redirect target's
|
|
20
|
+
`{"blocked": false}` came back as an authoritative clean verdict on text it had
|
|
21
|
+
never seen, and the wrapper — sitting on the hot path of your request handler —
|
|
22
|
+
allowed it through. On `307`/`308` the body survives instead, so the text under
|
|
23
|
+
inspection is re-POSTed verbatim to whatever host the redirect names.
|
|
24
|
+
|
|
25
|
+
The existing reply validation could not catch it. It checks the *shape* of a
|
|
26
|
+
verdict, and a redirected reply is perfectly well shaped: a well-formed verdict
|
|
27
|
+
about nothing. `assertSecureBaseUrl` validates hop 0 only.
|
|
28
|
+
|
|
29
|
+
**This needs no attacker.** An ordinary infrastructure redirect on the API path
|
|
30
|
+
— an nginx trailing-slash rule, a load balancer, a corporate proxy, a proxy in
|
|
31
|
+
front of a self-hosted deployment — silently converts every guardrail check
|
|
32
|
+
behind it into an ALLOW.
|
|
33
|
+
|
|
34
|
+
Fixed in `@evalguard/wrapper-core@1.3.0`, which sets `redirect: "error"` on
|
|
35
|
+
that transport so the call fails **closed**.
|
|
36
|
+
|
|
37
|
+
### How the fix reaches you
|
|
38
|
+
|
|
39
|
+
**Upgrading `@evalguard/wrapper-core` alone will NOT fix you.** The published
|
|
40
|
+
`@evalguard/openai@1.2.1` declares `"@evalguard/wrapper-core": "1.2.0"` — an **exact
|
|
41
|
+
pin**. It will stay on `wrapper-core@1.2.0` no matter what is published to that
|
|
42
|
+
package. You must upgrade **this** package to `1.2.2`, which depends on
|
|
43
|
+
`^1.3.0`.
|
|
44
|
+
|
|
45
|
+
Full advisory, including the other thirteen affected artifacts:
|
|
46
|
+
`docs/security/advisory-2026-08-10-verdict-redirect-bypass.md` (SEC-051).
|
|
47
|
+
|
|
48
|
+
### Earlier releases
|
|
49
|
+
|
|
50
|
+
Recorded in the monorepo git history and in
|
|
51
|
+
`packages/NPM_PUBLISH_CHECKLIST.md`; this file starts here.
|
package/README.md
CHANGED
|
@@ -158,7 +158,15 @@ const openai = wrapOpenAI(new OpenAI(), {
|
|
|
158
158
|
|
|
159
159
|
If EvalGuard is unreachable (network error, timeout, 5xx) **and** `blockOnViolation` is `true` (the default), the wrapper **throws `EvalGuardViolationError`** (`type: "guardrail_unavailable"`) and does **not** call OpenAI — it fails *closed*, so an EvalGuard outage cannot silently bypass your guardrails.
|
|
160
160
|
|
|
161
|
-
To fail *open* instead (pass the request through to OpenAI on an EvalGuard outage), set `blockOnViolation: false
|
|
161
|
+
To fail *open* instead (pass the request through to OpenAI on an EvalGuard outage), set `blockOnViolation: false`.
|
|
162
|
+
|
|
163
|
+
The legacy process-wide escape hatch still exists, but since 2026-08-03 it requires an explicit acknowledgement string — `=1` no longer opens it:
|
|
164
|
+
|
|
165
|
+
```bash
|
|
166
|
+
EVALGUARD_GUARDRAIL_FAIL_OPEN_LEGACY=i-accept-unchecked-prompts-reaching-the-model
|
|
167
|
+
```
|
|
168
|
+
|
|
169
|
+
Any other value (including `1` and `true`) **fails closed** and prints a one-time rejection notice on stderr. Prefer `blockOnViolation: false` per integration over a process-wide hatch.
|
|
162
170
|
|
|
163
171
|
## Error Handling
|
|
164
172
|
|
package/dist/surface.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAqGA;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAW/C,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,
|
|
1
|
+
{"version":3,"file":"surface.d.ts","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAqGA;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAW/C,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,qBAAqB,EAAE,WAAW,CAAC,MAAM,CA8EpD,CAAC;AAEH,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,EAAE,WAAW,CAAC,MAAM,CAGrD,CAAC;AAEH;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAmBrD;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,GAAG,OAAO,CAGvE;AAED;;;;;;;;;;;;;GAaG;AACH,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAS/C,CAAC;AA+BF;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,GAAG,IAAI,CAwB7E;AAED,gFAAgF;AAChF,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,OAAO,EAAE,GAAG,MAAM,CAM/D"}
|
package/dist/surface.js
CHANGED
|
@@ -140,6 +140,39 @@ export const TRANSPORT_PASSTHROUGH = new Set([
|
|
|
140
140
|
// Both are `private` in openai's .d.ts so TypeScript callers need a cast,
|
|
141
141
|
// but JavaScript callers have no barrier at all.
|
|
142
142
|
//
|
|
143
|
+
// AN ENTRY EARNS ITS PLACE FOR EXACTLY ONE OF TWO REASONS:
|
|
144
|
+
// (a) calling it issues NO HTTP request (it builds/signs/classifies), or
|
|
145
|
+
// (b) it is a function the CUSTOMER passed to the constructor and is handed
|
|
146
|
+
// straight back — exactly one member, `fetch`. That one DOES deliver if
|
|
147
|
+
// called directly; it is an ACCEPTED BOUNDARY, not a "no request" claim,
|
|
148
|
+
// because gating it would firewall traffic that never belonged to this
|
|
149
|
+
// client and it carries no SDK-managed credential.
|
|
150
|
+
//
|
|
151
|
+
// AUDIT 2026-08-09 — FIVE NAMES WERE ON THIS LIST THAT ISSUE REAL REQUESTS,
|
|
152
|
+
// under the very paragraph forbidding it. Measured through the built dist
|
|
153
|
+
// against the real openai@6.44.0, firewall blocking ALL input:
|
|
154
|
+
//
|
|
155
|
+
// chat.completions.create checks=1 leaked=0 BLOCKED
|
|
156
|
+
// post("/chat/completions") checks=1 leaked=0 BLOCKED
|
|
157
|
+
// buildRequest({...}) (control) checks=0 leaked=0 no request
|
|
158
|
+
// requestAPIList(Page,{body}) checks=0 leaked=1 RETURNED
|
|
159
|
+
// getAPIList("/chat/completions",Page,{…}) checks=0 leaked=1 RETURNED
|
|
160
|
+
// retryRequest({method,path,body},0,…) checks=0 leaked=1 RETURNED
|
|
161
|
+
// fetchWithAuth(url,{body},…) checks=0 leaked=1 RETURNED
|
|
162
|
+
// fetchWithTimeout(url,{body},…) checks=0 leaked=1 RETURNED
|
|
163
|
+
//
|
|
164
|
+
// In the SDK: `requestAPIList` calls `this.makeRequest(...)` (client.js:470),
|
|
165
|
+
// `getAPIList` forwards to it and spreads `...opts` AFTER `method:'get'` so a
|
|
166
|
+
// caller-supplied method/body wins, `retryRequest` calls `this.makeRequest`,
|
|
167
|
+
// and `fetchWithAuth` ATTACHES the bearer / admin-key credential before
|
|
168
|
+
// delegating to `fetchWithTimeout`, which performs the actual `fetch`.
|
|
169
|
+
// All five removed; re-measured checks=1 leaked=0.
|
|
170
|
+
//
|
|
171
|
+
// Gating them costs nothing on the hot path: the SDK's own internals call
|
|
172
|
+
// `this.fetchWithTimeout(...)` on the RAW client (the guard binds to the
|
|
173
|
+
// target, never the Proxy), so `chat.completions.create` still shows exactly
|
|
174
|
+
// checks=1 — asserted in openai-passthrough-issues-no-request.test.ts.
|
|
175
|
+
//
|
|
143
176
|
// BEFORE ADDING A NAME HERE: call it against the real SDK with the firewall
|
|
144
177
|
// blocking and confirm firewallChecks stays 0 because no request was issued —
|
|
145
178
|
// not because the guard was skipped. If in doubt, leave it OUT: an
|
|
@@ -155,17 +188,15 @@ export const TRANSPORT_PASSTHROUGH = new Set([
|
|
|
155
188
|
"calculateDefaultRetryTimeoutMillis",
|
|
156
189
|
"defaultIdempotencyKey",
|
|
157
190
|
"defaultQuery",
|
|
191
|
+
// Reason (b) — the customer's OWN fetch, handed straight back. See above:
|
|
192
|
+
// this one DOES deliver if called directly; accepted boundary, not a
|
|
193
|
+
// "no request issued" claim.
|
|
158
194
|
"fetch",
|
|
159
|
-
"fetchWithAuth",
|
|
160
|
-
"fetchWithTimeout",
|
|
161
|
-
"getAPIList",
|
|
162
195
|
"getUserAgent",
|
|
163
196
|
"logger",
|
|
164
197
|
"makeStatusError",
|
|
165
198
|
"prepareOptions",
|
|
166
199
|
"prepareRequest",
|
|
167
|
-
"requestAPIList",
|
|
168
|
-
"retryRequest",
|
|
169
200
|
"shouldRetry",
|
|
170
201
|
"stringifyQuery",
|
|
171
202
|
"validateHeaders",
|
package/dist/surface.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,oEAAoE;AACpE,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,WAAW;AACX,2EAA2E;AAC3E,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,4CAA4C;AAC5C,EAAE;AACF,kFAAkF;AAClF,4BAA4B;AAC5B,0EAA0E;AAC1E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,iDAAiD;AACjD,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,YAAY;AACZ,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,gDAAgD;AAChD,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,kEAAkE;AAClE,mEAAmE;AACnE,uEAAuE;AACvE,gDAAgD;AAChD,8EAA8E;AAC9E,6EAA6E;AAC7E,iDAAiD;AACjD,gFAAgF;AAChF,sEAAsE;AACtE,4EAA4E;AAC5E,yEAAyE;AACzE,+DAA+D;AAC/D,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,wCAAwC;AACxC,oEAAoE;AACpE,8EAA8E;AAC9E,+EAA+E;AAC/E,8DAA8D;AAC9D,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,4DAA4D;AAE5D,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,uEAAuE;AACvE,8DAA8D;AAC9D,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,wEAAwE;AACxE,iBAAiB;AAEjB;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,4EAA4E;IAC5E,wCAAwC;IACxC,UAAU;IACV,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,4EAA4E;IAC5E,4EAA4E;IAC5E,mCAAmC;IACnC,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,oEAAoE;IACpE,6EAA6E;IAC7E,sEAAsE;IACtE,wDAAwD;IACxD,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,0EAA0E;IAC1E,iDAAiD;IACjD,EAAE;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,mEAAmE;IACnE,4EAA4E;IAC5E,mDAAmD;IACnD,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,cAAc;IACd,cAAc;IACd,UAAU;IACV,oCAAoC;IACpC,uBAAuB;IACvB,cAAc;IACd,
|
|
1
|
+
{"version":3,"file":"surface.js","sourceRoot":"","sources":["../src/surface.ts"],"names":[],"mappings":"AAAA,+EAA+E;AAC/E,EAAE;AACF,oEAAoE;AACpE,2EAA2E;AAC3E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,sEAAsE;AACtE,iEAAiE;AACjE,EAAE;AACF,4EAA4E;AAC5E,8EAA8E;AAC9E,WAAW;AACX,2EAA2E;AAC3E,4DAA4D;AAC5D,EAAE;AACF,uEAAuE;AACvE,2EAA2E;AAC3E,4EAA4E;AAC5E,kEAAkE;AAClE,EAAE;AACF,+EAA+E;AAC/E,6EAA6E;AAC7E,wEAAwE;AACxE,gFAAgF;AAChF,8DAA8D;AAC9D,EAAE;AACF,8EAA8E;AAC9E,0EAA0E;AAC1E,6EAA6E;AAC7E,EAAE;AACF,4EAA4E;AAC5E,+EAA+E;AAC/E,+EAA+E;AAC/E,4CAA4C;AAC5C,EAAE;AACF,kFAAkF;AAClF,4BAA4B;AAC5B,0EAA0E;AAC1E,gFAAgF;AAChF,yEAAyE;AACzE,+EAA+E;AAC/E,iDAAiD;AACjD,2EAA2E;AAC3E,8EAA8E;AAC9E,2EAA2E;AAC3E,YAAY;AACZ,EAAE;AACF,wEAAwE;AACxE,6EAA6E;AAC7E,EAAE;AACF,gDAAgD;AAChD,8EAA8E;AAC9E,8EAA8E;AAC9E,2EAA2E;AAC3E,kEAAkE;AAClE,mEAAmE;AACnE,uEAAuE;AACvE,gDAAgD;AAChD,8EAA8E;AAC9E,6EAA6E;AAC7E,iDAAiD;AACjD,gFAAgF;AAChF,sEAAsE;AACtE,4EAA4E;AAC5E,yEAAyE;AACzE,+DAA+D;AAC/D,6EAA6E;AAC7E,8EAA8E;AAC9E,yEAAyE;AACzE,wCAAwC;AACxC,oEAAoE;AACpE,8EAA8E;AAC9E,+EAA+E;AAC/E,8DAA8D;AAC9D,+EAA+E;AAC/E,4EAA4E;AAC5E,EAAE;AACF,4EAA4E;AAC5E,wEAAwE;AACxE,EAAE;AACF,+EAA+E;AAC/E,4EAA4E;AAC5E,8EAA8E;AAC9E,4EAA4E;AAC5E,4DAA4D;AAE5D,OAAO,EACL,kBAAkB,EAClB,qBAAqB,EACrB,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AAEjC,uEAAuE;AACvE,8DAA8D;AAC9D,gFAAgF;AAChF,6EAA6E;AAC7E,gFAAgF;AAChF,wEAAwE;AACxE,iBAAiB;AAEjB;;;;GAIG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,4EAA4E;IAC5E,wCAAwC;IACxC,UAAU;IACV,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,4EAA4E;IAC5E,2EAA2E;IAC3E,uEAAuE;IACvE,aAAa;CACd,CAAC,CAAC;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IAChE,4EAA4E;IAC5E,4EAA4E;IAC5E,mCAAmC;IACnC,EAAE;IACF,2EAA2E;IAC3E,6EAA6E;IAC7E,oEAAoE;IACpE,6EAA6E;IAC7E,sEAAsE;IACtE,wDAAwD;IACxD,6EAA6E;IAC7E,+EAA+E;IAC/E,gFAAgF;IAChF,0EAA0E;IAC1E,iDAAiD;IACjD,EAAE;IACF,2DAA2D;IAC3D,2EAA2E;IAC3E,8EAA8E;IAC9E,8EAA8E;IAC9E,+EAA+E;IAC/E,6EAA6E;IAC7E,yDAAyD;IACzD,EAAE;IACF,4EAA4E;IAC5E,0EAA0E;IAC1E,+DAA+D;IAC/D,EAAE;IACF,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,0EAA0E;IAC1E,EAAE;IACF,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,wEAAwE;IACxE,uEAAuE;IACvE,mDAAmD;IACnD,EAAE;IACF,0EAA0E;IAC1E,yEAAyE;IACzE,6EAA6E;IAC7E,uEAAuE;IACvE,EAAE;IACF,4EAA4E;IAC5E,8EAA8E;IAC9E,mEAAmE;IACnE,4EAA4E;IAC5E,mDAAmD;IACnD,iBAAiB;IACjB,aAAa;IACb,YAAY;IACZ,WAAW;IACX,cAAc;IACd,cAAc;IACd,UAAU;IACV,oCAAoC;IACpC,uBAAuB;IACvB,cAAc;IACd,0EAA0E;IAC1E,qEAAqE;IACrE,6BAA6B;IAC7B,OAAO;IACP,cAAc;IACd,QAAQ;IACR,iBAAiB;IACjB,gBAAgB;IAChB,gBAAgB;IAChB,aAAa;IACb,gBAAgB;IAChB,iBAAiB;CAElB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,CAAC,MAAM,sBAAsB,GAAwB,IAAI,GAAG,CAAC;IACjE,GAAG,qBAAqB;IACxB,GAAG,gBAAgB;CACpB,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IACtD,IAAI,SAAS,IAAK,KAAiC;QAAE,OAAO,IAAI,CAAC;IACjE,KACE,IAAI,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EACxC,KAAK,IAAI,KAAK,KAAK,MAAM,CAAC,SAAS,EACnC,KAAK,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,CAAC,EACpC,CAAC;QACD,MAAM,IAAI,GAAuB,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC;QACzD,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IACE,IAAI,KAAK,aAAa;YACtB,IAAI,CAAC,QAAQ,CAAC,iBAAiB,CAAC;YAChC,IAAI,CAAC,QAAQ,CAAC,uBAAuB,CAAC,EACtC,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY,EAAE,KAAc;IAC5D,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,OAAO;IACP,QAAQ;IACR,cAAc;IACd,OAAO;IACP,OAAO;IACP,MAAM;IACN,SAAS;CACV,CAAC;AAEF,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CAAC,IAAwB;IAC/C,MAAM,MAAM,GAAc,EAAE,CAAC;IAC7B,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;YAAE,SAAS;QACtD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,MAAM,IAAI,GAAI,GAA+B,CAAC,IAAI,CAAC;QACnD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAwB;IAC5D,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO;QACpC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACf,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC,CAAC;IAEF,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,oDAAoD;QACpD,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YACxB,KAAK,MAAM,KAAK,IAAI,kBAAkB,EAAE,CAAC;gBACvC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;gBAC1B,IAAI,KAAK,IAAI,IAAI;oBAAE,SAAS;gBAC5B,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;YAClC,CAAC;QACH,CAAC;QACD,iEAAiE;QACjE,KAAK,MAAM,KAAK,IAAI,qBAAqB,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,iBAAiB,EAAE,CAAC,EAAE,CAAC;YACtF,IAAI,CAAC,KAAK,CAAC,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,cAAc,CAAC,IAAwB;IACrD,KAAK,MAAM,IAAI,IAAI,eAAe,CAAC,IAAI,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,KAAK,CAAC;IACtE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@evalguard/openai",
|
|
3
|
-
"version": "1.2.
|
|
3
|
+
"version": "1.2.2",
|
|
4
4
|
"description": "Drop-in OpenAI SDK wrapper with EvalGuard guardrails, logging & cost tracking",
|
|
5
5
|
"main": "./dist/index.js",
|
|
6
6
|
"exports": {
|
|
@@ -13,6 +13,7 @@
|
|
|
13
13
|
"files": [
|
|
14
14
|
"dist",
|
|
15
15
|
"README.md",
|
|
16
|
+
"CHANGELOG.md",
|
|
16
17
|
"LICENSE"
|
|
17
18
|
],
|
|
18
19
|
"keywords": [
|
|
@@ -47,7 +48,7 @@
|
|
|
47
48
|
"openai": ">=4.0.0"
|
|
48
49
|
},
|
|
49
50
|
"dependencies": {
|
|
50
|
-
"@evalguard/wrapper-core": "1.
|
|
51
|
+
"@evalguard/wrapper-core": "^1.3.0"
|
|
51
52
|
},
|
|
52
53
|
"devDependencies": {
|
|
53
54
|
"@typescript-eslint/eslint-plugin": "^8.61.1",
|