@neuraltrust/trustguard-sdk 0.1.0 → 0.1.4

package/README.md

@@ -1,6 +1,9 @@
 # TrustGuard Node.js SDK
 
-Official Node.js / TypeScript client for the TrustGuard runtime guard API (`POST /v1/guard`). Configure a base URL and an API key, send the payload you want evaluated, and act on the verdict: TrustGuard detects, you enforce.
+[![npm](https://img.shields.io/npm/v/%40neuraltrust%2Ftrustguard-sdk)](https://www.npmjs.com/package/@neuraltrust/trustguard-sdk)
+[Documentation](https://docs.neuraltrust.ai/sdks/trustguard/node) · [Python package](https://pypi.org/project/trustguard-sdk/) · [Go module](https://pkg.go.dev/github.com/NeuralTrust/trustguard-sdk/go) · [GitHub](https://github.com/NeuralTrust/trustguard-sdk)
+
+Official Node.js / TypeScript client for the TrustGuard runtime evaluate API (`POST /v1/evaluate`). Configure a base URL and an API key, send the payload you want evaluated, and act on the verdict: TrustGuard detects, you enforce.
 
 ## Install
 
@@ -20,8 +23,8 @@ const client = new TrustGuard({
   apiKey: process.env.TRUSTGUARD_API_KEY!,
 });
 
-const response = await client.guard({ input: { prompt: "user text to evaluate" } });
-if (response.isFlagged) {
+const response = await client.guard({ payload: { input: "user text to evaluate" } });
+if (response.isBlocked) {
   // block the request
 }
 ```
@@ -30,20 +33,22 @@ if (response.isFlagged) {
 
 ```typescript
 const response = await client.guard({
-  input: { prompt: "user text" },
+  payload: { input: "user text" },
   direction: "output",                // "input" (default) or "output"
+  protocol: "llm",                    // "all" (default), "llm", "mcp", or "a2a"
   sessionId: "conversation-42",       // groups multi-turn traffic
   consumerId: "user-7",               // the end user behind the request
+  attributes: { content_type: "text/plain" }, // routing hints
 });
 ```
 
 ### Attachments
 
-Documents are base64-encoded into `metadata.attachments` for file-aware plugins:
+Documents are base64-encoded into `payload.attachments` for file-aware plugins (or pass a `url` for the server to fetch):
 
 ```typescript
 const response = await client.guard({
-  input: { prompt: "summarize this file" },
+  payload: { input: "summarize this file" },
   attachments: [{ filename: "doc.pdf", contentType: "application/pdf", data: pdfBytes }],
 });
 ```
@@ -52,8 +57,8 @@ const response = await client.guard({
 
 | Field | Meaning |
 |---|---|
-| `isFlagged` | The enforcement signal: block when `true` |
-| `findings` | What every plugin in the policy chain reported (`detectionType`, `confidence`, `ruleName`, `details`) |
+| `status` | Most restrictive verdict: `allow`, `block`, `transform`, `report`, or `""` when omitted. `isBlocked` is `true` when it is `block` |
+| `findings` | Nested findings: `source` / `signal` / `outcome` / `evidence` (observational runs omit `signal`/`outcome`) |
 | `transformedPayload` | The payload as rewritten by in-flight masking, `null` when untouched |
 | `traceId` / `requestId` | Correlation ids for TrustGuard telemetry |
 
@@ -65,7 +70,7 @@ Non-2xx responses throw `TrustGuardAPIError` with `status`, `traceId` and `reque
 import { TrustGuardAPIError } from "@neuraltrust/trustguard-sdk";
 
 try {
-  await client.guard({ input: { prompt: "..." } });
+  await client.guard({ payload: { input: "..." } });
 } catch (err) {
   if (err instanceof TrustGuardAPIError && err.status === 401) {
     // bad API key
@@ -73,6 +78,17 @@ try {
 }
 ```
 
+## Documentation
+
+The full guide is at [docs.neuraltrust.ai](https://docs.neuraltrust.ai/sdks/trustguard/node): setting up the collector
+and its key, guarding input and output, configuration, the attributes
+an evaluation carries, and troubleshooting. The [Evaluate API](https://docs.neuraltrust.ai/trustguard/api/evaluate)
+is the contract every SDK wraps, and [SDKs](https://docs.neuraltrust.ai/sdks/overview) says when to reach
+for TrustGuard and when for TrustGate.
+
+The same client in other languages: [Python](https://pypi.org/project/trustguard-sdk/), [Go](https://pkg.go.dev/github.com/NeuralTrust/trustguard-sdk/go). Source, examples and issues:
+[github.com/NeuralTrust/trustguard-sdk](https://github.com/NeuralTrust/trustguard-sdk).
+
 ## Development
 
 ```bash

package/dist/index.cjs

@@ -40,7 +40,7 @@ var TrustGuardAPIError = class extends Error {
 };
 
 // src/client.ts
-var GUARD_PATH = "/v1/guard";
+var EVALUATE_PATH = "/v1/evaluate";
 var DEFAULT_TIMEOUT_MS = 1e4;
 var TrustGuard = class {
   #baseUrl;
@@ -65,10 +65,10 @@ var TrustGuard = class {
    * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.
    */
   async guard(request) {
-    if (!request.input) {
-      throw new Error("TrustGuard: request input is required");
+    if (!request.payload) {
+      throw new Error("TrustGuard: request payload is required");
     }
-    const response = await this.#fetch(this.#baseUrl + GUARD_PATH, {
+    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${this.#apiKey}`,
@@ -85,44 +85,69 @@ var TrustGuard = class {
   }
 };
 function serializeRequest(request) {
-  const body = { input: request.input };
+  let payload = request.payload;
+  if (request.attachments?.length) {
+    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };
+  }
+  const body = { payload };
   if (request.direction) body.direction = request.direction;
+  if (request.protocol) body.protocol = request.protocol;
   if (request.sessionId) body.session_id = request.sessionId;
   if (request.consumerId) body.consumer_id = request.consumerId;
-  let metadata = request.metadata;
-  if (request.attachments?.length) {
-    metadata = { ...metadata, attachments: request.attachments.map(serializeAttachment) };
-  }
-  if (metadata && Object.keys(metadata).length > 0) body.metadata = metadata;
+  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;
   return body;
 }
 function serializeAttachment(attachment) {
-  const bytes = typeof attachment.data === "string" ? Buffer.from(attachment.data, "utf-8") : Buffer.from(attachment.data);
-  return {
+  const entry = {
     filename: attachment.filename,
-    content_type: attachment.contentType,
-    data: bytes.toString("base64")
+    content_type: attachment.contentType
   };
+  if (attachment.data !== void 0) {
+    const bytes = typeof attachment.data === "string" ? Buffer.from(attachment.data, "utf-8") : Buffer.from(attachment.data);
+    entry.data = bytes.toString("base64");
+  }
+  if (attachment.url !== void 0) entry.url = attachment.url;
+  return entry;
 }
 function deserializeResponse(wire) {
+  const status = wire.status ?? "";
   return {
-    isFlagged: wire.is_flagged ?? false,
+    status,
+    isBlocked: status === "block",
     transformedPayload: wire.transformed_payload ?? null,
-    findings: (wire.findings ?? []).map(
-      (f) => ({
-        detectionType: f.detection_type,
-        confidence: f.confidence,
-        ruleName: f.rule_name,
-        details: f.details
-      })
-    ),
+    findings: (wire.findings ?? []).map(deserializeFinding),
     traceId: wire.trace_id ?? "",
     requestId: wire.request_id ?? ""
   };
 }
+function deserializeFinding(f) {
+  const sourceWire = f.source ?? {};
+  const source = {
+    kind: sourceWire.kind ?? ""
+  };
+  if (sourceWire.plugin !== void 0) source.plugin = sourceWire.plugin;
+  if (sourceWire.detector_id !== void 0) source.detectorId = sourceWire.detector_id;
+  if (sourceWire.detector_name !== void 0) source.detectorName = sourceWire.detector_name;
+  if (sourceWire.policy_id !== void 0) source.policyId = sourceWire.policy_id;
+  if (sourceWire.gate_name !== void 0) source.gateName = sourceWire.gate_name;
+  const finding = { source };
+  if (f.signal?.type) {
+    const signal = { type: f.signal.type };
+    if (f.signal.confidence !== void 0) signal.confidence = f.signal.confidence;
+    finding.signal = signal;
+  }
+  if (f.outcome?.action) {
+    const outcome = { action: f.outcome.action };
+    finding.outcome = outcome;
+  }
+  if (f.evidence && Object.keys(f.evidence).length > 0) {
+    finding.evidence = f.evidence;
+  }
+  return finding;
+}
 function apiError(status, text) {
   const payload = parseJson(text);
-  const message = payload?.error || text.trim() || `HTTP ${status}`;
+  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;
   return new TrustGuardAPIError(status, message, payload?.trace_id ?? "", payload?.request_id ?? "");
 }
 function parseJson(text) {

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["export { TrustGuard } from \"./client.js\";\nexport { TrustGuardAPIError } from \"./errors.js\";\nexport type {\n  Attachment,\n  Direction,\n  Finding,\n  GuardRequest,\n  GuardResponse,\n  TrustGuardOptions,\n} from \"./types.js\";\n","/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type { Attachment, Finding, GuardRequest, GuardResponse, TrustGuardOptions } from \"./types.js\";\n\nconst GUARD_PATH = \"/v1/guard\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFinding {\n  detection_type?: string;\n  confidence?: number;\n  rule_name?: string;\n  details?: unknown;\n}\n\ninterface WireResponse {\n  is_flagged?: boolean;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime guard API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.input) {\n      throw new Error(\"TrustGuard: request input is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + GUARD_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  const body: Record<string, unknown> = { input: request.input };\n  if (request.direction) body.direction = request.direction;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n\n  let metadata = request.metadata;\n  if (request.attachments?.length) {\n    metadata = { ...metadata, attachments: request.attachments.map(serializeAttachment) };\n  }\n  if (metadata && Object.keys(metadata).length > 0) body.metadata = metadata;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const bytes =\n    typeof attachment.data === \"string\" ? Buffer.from(attachment.data, \"utf-8\") : Buffer.from(attachment.data);\n  return {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n    data: bytes.toString(\"base64\"),\n  };\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  return {\n    isFlagged: wire.is_flagged ?? false,\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(\n      (f): Finding => ({\n        detectionType: f.detection_type,\n        confidence: f.confidence,\n        ruleName: f.rule_name,\n        details: f.details,\n      }),\n    ),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACdA,IAAM,aAAa;AACnB,IAAM,qBAAqB;AAkBpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,YAAY;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,QAAM,OAAgC,EAAE,OAAO,QAAQ,MAAM;AAC7D,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AAEnD,MAAI,WAAW,QAAQ;AACvB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,eAAW,EAAE,GAAG,UAAU,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACtF;AACA,MAAI,YAAY,OAAO,KAAK,QAAQ,EAAE,SAAS,EAAG,MAAK,WAAW;AAClE,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QACJ,OAAO,WAAW,SAAS,WAAW,OAAO,KAAK,WAAW,MAAM,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI;AAC3G,SAAO;AAAA,IACL,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,IACzB,MAAM,MAAM,SAAS,QAAQ;AAAA,EAC/B;AACF;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,SAAO;AAAA,IACL,WAAW,KAAK,cAAc;AAAA,IAC9B,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG;AAAA,MAC9B,CAAC,OAAgB;AAAA,QACf,eAAe,EAAE;AAAA,QACjB,YAAY,EAAE;AAAA,QACd,UAAU,EAAE;AAAA,QACZ,SAAS,EAAE;AAAA,MACb;AAAA,IACF;AAAA,IACA,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,KAAK,KAAK,KAAK,QAAQ,MAAM;AAC/D,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["export { TrustGuard } from \"./client.js\";\nexport { TrustGuardAPIError } from \"./errors.js\";\nexport type {\n  Attachment,\n  Direction,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  Protocol,\n  TrustGuardOptions,\n} from \"./types.js\";\n","/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type {\n  Attachment,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  TrustGuardOptions,\n} from \"./types.js\";\n\nconst EVALUATE_PATH = \"/v1/evaluate\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFindingSource {\n  kind?: string;\n  plugin?: string;\n  detector_id?: string;\n  detector_name?: string;\n  policy_id?: string;\n  gate_name?: string;\n}\n\ninterface WireFindingSignal {\n  type?: string;\n  confidence?: number;\n}\n\ninterface WireFindingOutcome {\n  action?: string;\n}\n\ninterface WireFinding {\n  source?: WireFindingSource;\n  signal?: WireFindingSignal;\n  outcome?: WireFindingOutcome;\n  evidence?: Record<string, unknown>;\n}\n\ninterface WireResponse {\n  status?: string;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime evaluate API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.payload) {\n      throw new Error(\"TrustGuard: request payload is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  let payload = request.payload;\n  if (request.attachments?.length) {\n    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };\n  }\n  const body: Record<string, unknown> = { payload };\n  if (request.direction) body.direction = request.direction;\n  if (request.protocol) body.protocol = request.protocol;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const entry: Record<string, string> = {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n  };\n  if (attachment.data !== undefined) {\n    const bytes =\n      typeof attachment.data === \"string\" ? Buffer.from(attachment.data, \"utf-8\") : Buffer.from(attachment.data);\n    entry.data = bytes.toString(\"base64\");\n  }\n  if (attachment.url !== undefined) entry.url = attachment.url;\n  return entry;\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  const status = wire.status ?? \"\";\n  return {\n    status,\n    isBlocked: status === \"block\",\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(deserializeFinding),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction deserializeFinding(f: WireFinding): Finding {\n  const sourceWire = f.source ?? {};\n  const source: FindingSource = {\n    kind: sourceWire.kind ?? \"\",\n  };\n  if (sourceWire.plugin !== undefined) source.plugin = sourceWire.plugin;\n  if (sourceWire.detector_id !== undefined) source.detectorId = sourceWire.detector_id;\n  if (sourceWire.detector_name !== undefined) source.detectorName = sourceWire.detector_name;\n  if (sourceWire.policy_id !== undefined) source.policyId = sourceWire.policy_id;\n  if (sourceWire.gate_name !== undefined) source.gateName = sourceWire.gate_name;\n\n  const finding: Finding = { source };\n  if (f.signal?.type) {\n    const signal: FindingSignal = { type: f.signal.type };\n    if (f.signal.confidence !== undefined) signal.confidence = f.signal.confidence;\n    finding.signal = signal;\n  }\n  if (f.outcome?.action) {\n    const outcome: FindingOutcome = { action: f.outcome.action };\n    finding.outcome = outcome;\n  }\n  if (f.evidence && Object.keys(f.evidence).length > 0) {\n    finding.evidence = f.evidence;\n  }\n  return finding;\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; message?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACLA,IAAM,gBAAgB;AACtB,IAAM,qBAAqB;AAoCpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,eAAe;AAAA,MAChE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,MAAI,UAAU,QAAQ;AACtB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,cAAU,EAAE,GAAG,SAAS,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACpF;AACA,QAAM,OAAgC,EAAE,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,SAAU,MAAK,WAAW,QAAQ;AAC9C,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AACnD,MAAI,QAAQ,cAAc,OAAO,KAAK,QAAQ,UAAU,EAAE,SAAS,EAAG,MAAK,aAAa,QAAQ;AAChG,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QAAgC;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,EAC3B;AACA,MAAI,WAAW,SAAS,QAAW;AACjC,UAAM,QACJ,OAAO,WAAW,SAAS,WAAW,OAAO,KAAK,WAAW,MAAM,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI;AAC3G,UAAM,OAAO,MAAM,SAAS,QAAQ;AAAA,EACtC;AACA,MAAI,WAAW,QAAQ,OAAW,OAAM,MAAM,WAAW;AACzD,SAAO;AACT;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG,IAAI,kBAAkB;AAAA,IACtD,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,mBAAmB,GAAyB;AACnD,QAAM,aAAa,EAAE,UAAU,CAAC;AAChC,QAAM,SAAwB;AAAA,IAC5B,MAAM,WAAW,QAAQ;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,OAAW,QAAO,SAAS,WAAW;AAChE,MAAI,WAAW,gBAAgB,OAAW,QAAO,aAAa,WAAW;AACzE,MAAI,WAAW,kBAAkB,OAAW,QAAO,eAAe,WAAW;AAC7E,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AACrE,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AAErE,QAAM,UAAmB,EAAE,OAAO;AAClC,MAAI,EAAE,QAAQ,MAAM;AAClB,UAAM,SAAwB,EAAE,MAAM,EAAE,OAAO,KAAK;AACpD,QAAI,EAAE,OAAO,eAAe,OAAW,QAAO,aAAa,EAAE,OAAO;AACpE,YAAQ,SAAS;AAAA,EACnB;AACA,MAAI,EAAE,SAAS,QAAQ;AACrB,UAAM,UAA0B,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAC3D,YAAQ,UAAU;AAAA,EACpB;AACA,MAAI,EAAE,YAAY,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,GAAG;AACpD,YAAQ,WAAW,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,SAAS,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM;AACnF,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,47 +1,73 @@
 /** Traffic side being evaluated; rules are scoped per side. Defaults to "input" server-side. */
 type Direction = "input" | "output";
+/** Traffic protocol the policy rules are scoped to. Defaults to "all" server-side. */
+type Protocol = "all" | "llm" | "mcp" | "a2a";
 /** A document evaluated alongside the payload by file-aware plugins. */
 interface Attachment {
     filename: string;
     contentType: string;
-    /** Raw file content; strings are encoded as UTF-8. Base64 encoding happens on the wire. */
-    data: Uint8Array | string;
+    /** Raw file content; strings are encoded as UTF-8, then base64 on the wire. Provide `data` or `url`. */
+    data?: Uint8Array | string;
+    /** URL for the server to fetch instead of inlining `data`. */
+    url?: string;
 }
-/** Payload for a guard evaluation. */
+/** Payload for a guard evaluation (`POST /v1/evaluate`). */
 interface GuardRequest {
-    /** The payload to evaluate. Required. */
-    input: Record<string, unknown>;
+    /** The content to evaluate, e.g. `{ input: "..." }` or provider-shaped fields. Required. */
+    payload: Record<string, unknown>;
     /** Traffic side; the server defaults to "input" when omitted. */
     direction?: Direction;
+    /** Traffic protocol; the server defaults to "all" when omitted. */
+    protocol?: Protocol;
     /** Groups multi-turn traffic; the server synthesises one when omitted. */
     sessionId?: string;
     /** Identifies the end user on whose behalf the request runs. */
     consumerId?: string;
-    /**
-     * Optional routing hints. Server-side key: `content_type` (overrides the
-     * payload content type, default application/json).
-     */
-    metadata?: Record<string, unknown>;
-    /** Documents to evaluate; folded into `metadata.attachments` on the wire. */
+    /** Optional routing hints. Server-side key: `content_type` (overrides the payload content type). */
+    attributes?: Record<string, unknown>;
+    /** Documents to evaluate; folded into `payload.attachments` on the wire. */
     attachments?: Attachment[];
 }
-/** A single plugin's contribution to the guard response. */
-interface Finding {
-    detectionType?: string;
+/** Who produced the finding — a detector or a gate. */
+interface FindingSource {
+    kind: string;
+    plugin?: string;
+    detectorId?: string;
+    detectorName?: string;
+    policyId?: string;
+    gateName?: string;
+}
+/** Detection signal when the finding fired (omitted for observational-only runs). */
+interface FindingSignal {
+    type: string;
     confidence?: number;
-    ruleName?: string;
-    details?: unknown;
+}
+/** Applied execution-rule action when the finding enforced an outcome. */
+interface FindingOutcome {
+    action: string;
+}
+/**
+ * A single finding from the evaluate response.
+ * Observational (below-threshold) runs keep `source` + `evidence` only.
+ */
+interface Finding {
+    source: FindingSource;
+    signal?: FindingSignal;
+    outcome?: FindingOutcome;
+    evidence?: Record<string, unknown>;
 }
 /**
- * Verdict returned by POST /v1/guard. TrustGuard detects; the caller enforces:
- * block when `isFlagged` is true.
+ * Verdict returned by POST /v1/evaluate. TrustGuard detects; the caller enforces:
+ * block when `status` is "block" (`isBlocked` is the convenience signal).
  */
 interface GuardResponse {
-    /** The enforcement signal: true when the policy flagged the payload. */
-    isFlagged: boolean;
+    /** Most restrictive verdict: "allow", "block", "transform", "report", or "" when omitted. */
+    status: string;
+    /** Convenience flag: true when `status === "block"`. */
+    isBlocked: boolean;
     /** The payload as rewritten by in-flight masking, null when untouched. */
     transformedPayload: Record<string, unknown> | null;
-    /** What every plugin in the policy chain reported. */
+    /** What every plugin / gate in the policy chain reported. */
     findings: Finding[];
     /** Correlation ids for TrustGuard telemetry. */
     traceId: string;
@@ -49,7 +75,7 @@ interface GuardResponse {
 }
 /** Configuration for the TrustGuard client. */
 interface TrustGuardOptions {
-    /** Base URL of the TrustGuard deployment, e.g. https://guard.neuraltrust.ai */
+    /** Base URL of the TrustGuard deployment, e.g. https://trustguard.neuraltrust.ai */
     baseUrl: string;
     /** Collector API key, sent as a Bearer token. */
     apiKey: string;
@@ -59,7 +85,7 @@ interface TrustGuardOptions {
     fetch?: typeof fetch;
 }
 
-/** Client for the TrustGuard runtime guard API. */
+/** Client for the TrustGuard runtime evaluate API. */
 declare class TrustGuard {
     #private;
     constructor(options: TrustGuardOptions);
@@ -82,4 +108,4 @@ declare class TrustGuardAPIError extends Error {
     constructor(status: number, message: string, traceId: string, requestId: string);
 }
 
-export { type Attachment, type Direction, type Finding, type GuardRequest, type GuardResponse, TrustGuard, TrustGuardAPIError, type TrustGuardOptions };
+export { type Attachment, type Direction, type Finding, type FindingOutcome, type FindingSignal, type FindingSource, type GuardRequest, type GuardResponse, type Protocol, TrustGuard, TrustGuardAPIError, type TrustGuardOptions };

package/dist/index.d.ts

@@ -1,47 +1,73 @@
 /** Traffic side being evaluated; rules are scoped per side. Defaults to "input" server-side. */
 type Direction = "input" | "output";
+/** Traffic protocol the policy rules are scoped to. Defaults to "all" server-side. */
+type Protocol = "all" | "llm" | "mcp" | "a2a";
 /** A document evaluated alongside the payload by file-aware plugins. */
 interface Attachment {
     filename: string;
     contentType: string;
-    /** Raw file content; strings are encoded as UTF-8. Base64 encoding happens on the wire. */
-    data: Uint8Array | string;
+    /** Raw file content; strings are encoded as UTF-8, then base64 on the wire. Provide `data` or `url`. */
+    data?: Uint8Array | string;
+    /** URL for the server to fetch instead of inlining `data`. */
+    url?: string;
 }
-/** Payload for a guard evaluation. */
+/** Payload for a guard evaluation (`POST /v1/evaluate`). */
 interface GuardRequest {
-    /** The payload to evaluate. Required. */
-    input: Record<string, unknown>;
+    /** The content to evaluate, e.g. `{ input: "..." }` or provider-shaped fields. Required. */
+    payload: Record<string, unknown>;
     /** Traffic side; the server defaults to "input" when omitted. */
     direction?: Direction;
+    /** Traffic protocol; the server defaults to "all" when omitted. */
+    protocol?: Protocol;
     /** Groups multi-turn traffic; the server synthesises one when omitted. */
     sessionId?: string;
     /** Identifies the end user on whose behalf the request runs. */
     consumerId?: string;
-    /**
-     * Optional routing hints. Server-side key: `content_type` (overrides the
-     * payload content type, default application/json).
-     */
-    metadata?: Record<string, unknown>;
-    /** Documents to evaluate; folded into `metadata.attachments` on the wire. */
+    /** Optional routing hints. Server-side key: `content_type` (overrides the payload content type). */
+    attributes?: Record<string, unknown>;
+    /** Documents to evaluate; folded into `payload.attachments` on the wire. */
     attachments?: Attachment[];
 }
-/** A single plugin's contribution to the guard response. */
-interface Finding {
-    detectionType?: string;
+/** Who produced the finding — a detector or a gate. */
+interface FindingSource {
+    kind: string;
+    plugin?: string;
+    detectorId?: string;
+    detectorName?: string;
+    policyId?: string;
+    gateName?: string;
+}
+/** Detection signal when the finding fired (omitted for observational-only runs). */
+interface FindingSignal {
+    type: string;
     confidence?: number;
-    ruleName?: string;
-    details?: unknown;
+}
+/** Applied execution-rule action when the finding enforced an outcome. */
+interface FindingOutcome {
+    action: string;
+}
+/**
+ * A single finding from the evaluate response.
+ * Observational (below-threshold) runs keep `source` + `evidence` only.
+ */
+interface Finding {
+    source: FindingSource;
+    signal?: FindingSignal;
+    outcome?: FindingOutcome;
+    evidence?: Record<string, unknown>;
 }
 /**
- * Verdict returned by POST /v1/guard. TrustGuard detects; the caller enforces:
- * block when `isFlagged` is true.
+ * Verdict returned by POST /v1/evaluate. TrustGuard detects; the caller enforces:
+ * block when `status` is "block" (`isBlocked` is the convenience signal).
  */
 interface GuardResponse {
-    /** The enforcement signal: true when the policy flagged the payload. */
-    isFlagged: boolean;
+    /** Most restrictive verdict: "allow", "block", "transform", "report", or "" when omitted. */
+    status: string;
+    /** Convenience flag: true when `status === "block"`. */
+    isBlocked: boolean;
     /** The payload as rewritten by in-flight masking, null when untouched. */
     transformedPayload: Record<string, unknown> | null;
-    /** What every plugin in the policy chain reported. */
+    /** What every plugin / gate in the policy chain reported. */
     findings: Finding[];
     /** Correlation ids for TrustGuard telemetry. */
     traceId: string;
@@ -49,7 +75,7 @@ interface GuardResponse {
 }
 /** Configuration for the TrustGuard client. */
 interface TrustGuardOptions {
-    /** Base URL of the TrustGuard deployment, e.g. https://guard.neuraltrust.ai */
+    /** Base URL of the TrustGuard deployment, e.g. https://trustguard.neuraltrust.ai */
     baseUrl: string;
     /** Collector API key, sent as a Bearer token. */
     apiKey: string;
@@ -59,7 +85,7 @@ interface TrustGuardOptions {
     fetch?: typeof fetch;
 }
 
-/** Client for the TrustGuard runtime guard API. */
+/** Client for the TrustGuard runtime evaluate API. */
 declare class TrustGuard {
     #private;
     constructor(options: TrustGuardOptions);
@@ -82,4 +108,4 @@ declare class TrustGuardAPIError extends Error {
     constructor(status: number, message: string, traceId: string, requestId: string);
 }
 
-export { type Attachment, type Direction, type Finding, type GuardRequest, type GuardResponse, TrustGuard, TrustGuardAPIError, type TrustGuardOptions };
+export { type Attachment, type Direction, type Finding, type FindingOutcome, type FindingSignal, type FindingSource, type GuardRequest, type GuardResponse, type Protocol, TrustGuard, TrustGuardAPIError, type TrustGuardOptions };

package/dist/index.js

@@ -13,7 +13,7 @@ var TrustGuardAPIError = class extends Error {
 };
 
 // src/client.ts
-var GUARD_PATH = "/v1/guard";
+var EVALUATE_PATH = "/v1/evaluate";
 var DEFAULT_TIMEOUT_MS = 1e4;
 var TrustGuard = class {
   #baseUrl;
@@ -38,10 +38,10 @@ var TrustGuard = class {
    * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.
    */
   async guard(request) {
-    if (!request.input) {
-      throw new Error("TrustGuard: request input is required");
+    if (!request.payload) {
+      throw new Error("TrustGuard: request payload is required");
     }
-    const response = await this.#fetch(this.#baseUrl + GUARD_PATH, {
+    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {
       method: "POST",
       headers: {
         Authorization: `Bearer ${this.#apiKey}`,
@@ -58,44 +58,69 @@ var TrustGuard = class {
   }
 };
 function serializeRequest(request) {
-  const body = { input: request.input };
+  let payload = request.payload;
+  if (request.attachments?.length) {
+    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };
+  }
+  const body = { payload };
   if (request.direction) body.direction = request.direction;
+  if (request.protocol) body.protocol = request.protocol;
   if (request.sessionId) body.session_id = request.sessionId;
   if (request.consumerId) body.consumer_id = request.consumerId;
-  let metadata = request.metadata;
-  if (request.attachments?.length) {
-    metadata = { ...metadata, attachments: request.attachments.map(serializeAttachment) };
-  }
-  if (metadata && Object.keys(metadata).length > 0) body.metadata = metadata;
+  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;
   return body;
 }
 function serializeAttachment(attachment) {
-  const bytes = typeof attachment.data === "string" ? Buffer.from(attachment.data, "utf-8") : Buffer.from(attachment.data);
-  return {
+  const entry = {
     filename: attachment.filename,
-    content_type: attachment.contentType,
-    data: bytes.toString("base64")
+    content_type: attachment.contentType
   };
+  if (attachment.data !== void 0) {
+    const bytes = typeof attachment.data === "string" ? Buffer.from(attachment.data, "utf-8") : Buffer.from(attachment.data);
+    entry.data = bytes.toString("base64");
+  }
+  if (attachment.url !== void 0) entry.url = attachment.url;
+  return entry;
 }
 function deserializeResponse(wire) {
+  const status = wire.status ?? "";
   return {
-    isFlagged: wire.is_flagged ?? false,
+    status,
+    isBlocked: status === "block",
     transformedPayload: wire.transformed_payload ?? null,
-    findings: (wire.findings ?? []).map(
-      (f) => ({
-        detectionType: f.detection_type,
-        confidence: f.confidence,
-        ruleName: f.rule_name,
-        details: f.details
-      })
-    ),
+    findings: (wire.findings ?? []).map(deserializeFinding),
     traceId: wire.trace_id ?? "",
     requestId: wire.request_id ?? ""
   };
 }
+function deserializeFinding(f) {
+  const sourceWire = f.source ?? {};
+  const source = {
+    kind: sourceWire.kind ?? ""
+  };
+  if (sourceWire.plugin !== void 0) source.plugin = sourceWire.plugin;
+  if (sourceWire.detector_id !== void 0) source.detectorId = sourceWire.detector_id;
+  if (sourceWire.detector_name !== void 0) source.detectorName = sourceWire.detector_name;
+  if (sourceWire.policy_id !== void 0) source.policyId = sourceWire.policy_id;
+  if (sourceWire.gate_name !== void 0) source.gateName = sourceWire.gate_name;
+  const finding = { source };
+  if (f.signal?.type) {
+    const signal = { type: f.signal.type };
+    if (f.signal.confidence !== void 0) signal.confidence = f.signal.confidence;
+    finding.signal = signal;
+  }
+  if (f.outcome?.action) {
+    const outcome = { action: f.outcome.action };
+    finding.outcome = outcome;
+  }
+  if (f.evidence && Object.keys(f.evidence).length > 0) {
+    finding.evidence = f.evidence;
+  }
+  return finding;
+}
 function apiError(status, text) {
   const payload = parseJson(text);
-  const message = payload?.error || text.trim() || `HTTP ${status}`;
+  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;
   return new TrustGuardAPIError(status, message, payload?.trace_id ?? "", payload?.request_id ?? "");
 }
 function parseJson(text) {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type { Attachment, Finding, GuardRequest, GuardResponse, TrustGuardOptions } from \"./types.js\";\n\nconst GUARD_PATH = \"/v1/guard\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFinding {\n  detection_type?: string;\n  confidence?: number;\n  rule_name?: string;\n  details?: unknown;\n}\n\ninterface WireResponse {\n  is_flagged?: boolean;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime guard API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.input) {\n      throw new Error(\"TrustGuard: request input is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + GUARD_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  const body: Record<string, unknown> = { input: request.input };\n  if (request.direction) body.direction = request.direction;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n\n  let metadata = request.metadata;\n  if (request.attachments?.length) {\n    metadata = { ...metadata, attachments: request.attachments.map(serializeAttachment) };\n  }\n  if (metadata && Object.keys(metadata).length > 0) body.metadata = metadata;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const bytes =\n    typeof attachment.data === \"string\" ? Buffer.from(attachment.data, \"utf-8\") : Buffer.from(attachment.data);\n  return {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n    data: bytes.toString(\"base64\"),\n  };\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  return {\n    isFlagged: wire.is_flagged ?? false,\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(\n      (f): Finding => ({\n        detectionType: f.detection_type,\n        confidence: f.confidence,\n        ruleName: f.rule_name,\n        details: f.details,\n      }),\n    ),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACdA,IAAM,aAAa;AACnB,IAAM,qBAAqB;AAkBpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,OAAO;AAClB,YAAM,IAAI,MAAM,uCAAuC;AAAA,IACzD;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,YAAY;AAAA,MAC7D,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,QAAM,OAAgC,EAAE,OAAO,QAAQ,MAAM;AAC7D,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AAEnD,MAAI,WAAW,QAAQ;AACvB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,eAAW,EAAE,GAAG,UAAU,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACtF;AACA,MAAI,YAAY,OAAO,KAAK,QAAQ,EAAE,SAAS,EAAG,MAAK,WAAW;AAClE,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QACJ,OAAO,WAAW,SAAS,WAAW,OAAO,KAAK,WAAW,MAAM,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI;AAC3G,SAAO;AAAA,IACL,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,IACzB,MAAM,MAAM,SAAS,QAAQ;AAAA,EAC/B;AACF;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,SAAO;AAAA,IACL,WAAW,KAAK,cAAc;AAAA,IAC9B,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG;AAAA,MAC9B,CAAC,OAAgB;AAAA,QACf,eAAe,EAAE;AAAA,QACjB,YAAY,EAAE;AAAA,QACd,UAAU,EAAE;AAAA,QACZ,SAAS,EAAE;AAAA,MACb;AAAA,IACF;AAAA,IACA,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,KAAK,KAAK,KAAK,QAAQ,MAAM;AAC/D,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type {\n  Attachment,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  TrustGuardOptions,\n} from \"./types.js\";\n\nconst EVALUATE_PATH = \"/v1/evaluate\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFindingSource {\n  kind?: string;\n  plugin?: string;\n  detector_id?: string;\n  detector_name?: string;\n  policy_id?: string;\n  gate_name?: string;\n}\n\ninterface WireFindingSignal {\n  type?: string;\n  confidence?: number;\n}\n\ninterface WireFindingOutcome {\n  action?: string;\n}\n\ninterface WireFinding {\n  source?: WireFindingSource;\n  signal?: WireFindingSignal;\n  outcome?: WireFindingOutcome;\n  evidence?: Record<string, unknown>;\n}\n\ninterface WireResponse {\n  status?: string;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime evaluate API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.payload) {\n      throw new Error(\"TrustGuard: request payload is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  let payload = request.payload;\n  if (request.attachments?.length) {\n    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };\n  }\n  const body: Record<string, unknown> = { payload };\n  if (request.direction) body.direction = request.direction;\n  if (request.protocol) body.protocol = request.protocol;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const entry: Record<string, string> = {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n  };\n  if (attachment.data !== undefined) {\n    const bytes =\n      typeof attachment.data === \"string\" ? Buffer.from(attachment.data, \"utf-8\") : Buffer.from(attachment.data);\n    entry.data = bytes.toString(\"base64\");\n  }\n  if (attachment.url !== undefined) entry.url = attachment.url;\n  return entry;\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  const status = wire.status ?? \"\";\n  return {\n    status,\n    isBlocked: status === \"block\",\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(deserializeFinding),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction deserializeFinding(f: WireFinding): Finding {\n  const sourceWire = f.source ?? {};\n  const source: FindingSource = {\n    kind: sourceWire.kind ?? \"\",\n  };\n  if (sourceWire.plugin !== undefined) source.plugin = sourceWire.plugin;\n  if (sourceWire.detector_id !== undefined) source.detectorId = sourceWire.detector_id;\n  if (sourceWire.detector_name !== undefined) source.detectorName = sourceWire.detector_name;\n  if (sourceWire.policy_id !== undefined) source.policyId = sourceWire.policy_id;\n  if (sourceWire.gate_name !== undefined) source.gateName = sourceWire.gate_name;\n\n  const finding: Finding = { source };\n  if (f.signal?.type) {\n    const signal: FindingSignal = { type: f.signal.type };\n    if (f.signal.confidence !== undefined) signal.confidence = f.signal.confidence;\n    finding.signal = signal;\n  }\n  if (f.outcome?.action) {\n    const outcome: FindingOutcome = { action: f.outcome.action };\n    finding.outcome = outcome;\n  }\n  if (f.evidence && Object.keys(f.evidence).length > 0) {\n    finding.evidence = f.evidence;\n  }\n  return finding;\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; message?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACLA,IAAM,gBAAgB;AACtB,IAAM,qBAAqB;AAoCpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,eAAe;AAAA,MAChE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,MAAI,UAAU,QAAQ;AACtB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,cAAU,EAAE,GAAG,SAAS,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACpF;AACA,QAAM,OAAgC,EAAE,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,SAAU,MAAK,WAAW,QAAQ;AAC9C,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AACnD,MAAI,QAAQ,cAAc,OAAO,KAAK,QAAQ,UAAU,EAAE,SAAS,EAAG,MAAK,aAAa,QAAQ;AAChG,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QAAgC;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,EAC3B;AACA,MAAI,WAAW,SAAS,QAAW;AACjC,UAAM,QACJ,OAAO,WAAW,SAAS,WAAW,OAAO,KAAK,WAAW,MAAM,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI;AAC3G,UAAM,OAAO,MAAM,SAAS,QAAQ;AAAA,EACtC;AACA,MAAI,WAAW,QAAQ,OAAW,OAAM,MAAM,WAAW;AACzD,SAAO;AACT;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG,IAAI,kBAAkB;AAAA,IACtD,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,mBAAmB,GAAyB;AACnD,QAAM,aAAa,EAAE,UAAU,CAAC;AAChC,QAAM,SAAwB;AAAA,IAC5B,MAAM,WAAW,QAAQ;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,OAAW,QAAO,SAAS,WAAW;AAChE,MAAI,WAAW,gBAAgB,OAAW,QAAO,aAAa,WAAW;AACzE,MAAI,WAAW,kBAAkB,OAAW,QAAO,eAAe,WAAW;AAC7E,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AACrE,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AAErE,QAAM,UAAmB,EAAE,OAAO;AAClC,MAAI,EAAE,QAAQ,MAAM;AAClB,UAAM,SAAwB,EAAE,MAAM,EAAE,OAAO,KAAK;AACpD,QAAI,EAAE,OAAO,eAAe,OAAW,QAAO,aAAa,EAAE,OAAO;AACpE,YAAQ,SAAS;AAAA,EACnB;AACA,MAAI,EAAE,SAAS,QAAQ;AACrB,UAAM,UAA0B,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAC3D,YAAQ,UAAU;AAAA,EACpB;AACA,MAAI,EAAE,YAAY,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,GAAG;AACpD,YAAQ,WAAW,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,SAAS,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM;AACnF,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@neuraltrust/trustguard-sdk",
-  "version": "0.1.0",
-  "description": "Official Node.js SDK for the TrustGuard runtime guard API (POST /v1/guard)",
+  "version": "0.1.4",
+  "description": "Official Node.js SDK for the TrustGuard runtime evaluate API (POST /v1/evaluate)",
   "license": "MIT",
   "author": "NeuralTrust",
   "repository": {
@@ -9,6 +9,10 @@
     "url": "git+https://github.com/NeuralTrust/trustguard-sdk.git",
     "directory": "node"
   },
+  "homepage": "https://docs.neuraltrust.ai/sdks/trustguard/node",
+  "bugs": {
+    "url": "https://github.com/NeuralTrust/trustguard-sdk/issues"
+  },
   "keywords": [
     "neuraltrust",
     "trustguard",
@@ -44,6 +48,6 @@
     "@types/node": "^22.10.2",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.9"
   }
 }