@neuraltrust/trustguard-sdk 0.1.3 → 0.1.5

package/dist/ai-sdk/index.js

@@ -0,0 +1,329 @@
+// src/ai-sdk/trustguard.ts
+var TrustGuardBlockedError = class extends Error {
+  phase;
+  response;
+  constructor(phase, response, message) {
+    super(message);
+    this.name = "TrustGuardBlockedError";
+    this.phase = phase;
+    this.response = response;
+  }
+};
+var SOURCE_APPLICATION = "vercel-ai-sdk";
+var DEFAULT_BLOCKED_MESSAGE = "This response was blocked by policy.";
+function trustguard(client, options = {}) {
+  const guard = new Guard(client, options);
+  return {
+    middleware: guard.middleware(),
+    toolApproval: (approval) => guard.approveToolCall(approval.toolCall),
+    tools: (tools) => guard.wrapTools(tools)
+  };
+}
+var Guard = class {
+  #client;
+  #options;
+  constructor(client, options) {
+    this.#client = client;
+    this.#options = options;
+  }
+  middleware() {
+    return {
+      specificationVersion: "v4",
+      transformParams: async ({ params, model }) => this.#guardPrompt(params, model),
+      wrapGenerate: async ({ doGenerate, model }) => {
+        const result = await doGenerate();
+        return { ...result, content: await this.#guardContent(result.content, model) };
+      },
+      wrapStream: async ({ doStream, model }) => {
+        const result = await doStream();
+        const transform = this.#options.stream === "buffer" ? this.#bufferStream(model) : this.#monitorStream(model);
+        return { ...result, stream: result.stream.pipeThrough(transform) };
+      }
+    };
+  }
+  async approveToolCall(call) {
+    let response;
+    try {
+      response = await this.#evaluate("tool-call", {
+        payload: toolsCall(call.toolName, call.input),
+        direction: "input",
+        protocol: "mcp",
+        attributes: { tool: { name: call.toolName } }
+      });
+    } catch (error) {
+      if (this.#failOpen("tool-call", error)) return void 0;
+      return { type: "denied", reason: "TrustGuard could not evaluate this tool call." };
+    }
+    switch (response.status) {
+      case "block":
+        return { type: "denied", reason: reasonFor(response, "Blocked by TrustGuard") };
+      case "ask":
+        return this.#options.toolAsk === "deny" ? { type: "denied", reason: reasonFor(response, "TrustGuard requires approval") } : { type: "user-approval", reason: reasonFor(response, "TrustGuard requires approval") };
+      case "transform":
+        return {
+          type: "denied",
+          reason: reasonFor(response, "Blocked by TrustGuard because the arguments contain data the policy masks")
+        };
+      default:
+        return void 0;
+    }
+  }
+  wrapTools(tools) {
+    const wrapped = {};
+    for (const [name, tool] of Object.entries(tools)) {
+      const execute = tool.execute;
+      if (typeof execute !== "function") {
+        wrapped[name] = tool;
+        continue;
+      }
+      wrapped[name] = {
+        ...tool,
+        execute: (input, executeOptions) => {
+          const output = execute.call(tool, input, executeOptions);
+          return isAsyncIterable(output) ? this.#guardIterableResult(name, output) : Promise.resolve(output).then((value) => this.#guardResult(name, value));
+        }
+      };
+    }
+    return wrapped;
+  }
+  async #guardPrompt(params, model) {
+    const index = lastUserTurn(params.prompt);
+    if (index < 0) return params;
+    const message = params.prompt[index];
+    const text = joinText(message.content);
+    if (!text.trim()) return params;
+    let response;
+    try {
+      response = await this.#evaluate("input", {
+        payload: { input: text },
+        direction: "input",
+        protocol: "llm",
+        attributes: modelAttributes(model)
+      });
+    } catch (error) {
+      if (this.#failOpen("input", error)) return params;
+      throw error;
+    }
+    const status = response.status === "ask" && this.#options.promptAsk !== "allow" ? "block" : response.status;
+    if (status === "block") {
+      throw new TrustGuardBlockedError("input", response, reasonFor(response, "Prompt blocked by TrustGuard"));
+    }
+    if (status !== "transform") return params;
+    const masked = transformedText(response);
+    if (masked === void 0) {
+      throw new TrustGuardBlockedError(
+        "input",
+        response,
+        "Prompt blocked by TrustGuard: the policy masked it but returned no masked text"
+      );
+    }
+    const prompt = [...params.prompt];
+    prompt[index] = { ...message, content: replaceText(message.content, masked) };
+    return { ...params, prompt };
+  }
+  async #guardContent(content, model) {
+    const text = joinText(content);
+    if (!text.trim()) return content;
+    const replacement = await this.#outputReplacement(text, model);
+    return replacement === void 0 ? content : replaceText(content, replacement);
+  }
+  /** The text that must replace a response, or undefined when it can go out as is. Throws when failing closed. */
+  async #outputReplacement(text, model) {
+    let response;
+    try {
+      response = await this.#evaluate("output", {
+        payload: { input: text },
+        direction: "output",
+        protocol: "llm",
+        attributes: modelAttributes(model)
+      });
+    } catch (error) {
+      if (this.#failOpen("output", error)) return void 0;
+      throw error;
+    }
+    if (response.status === "block") return this.#blockedMessage();
+    if (response.status === "transform") return transformedText(response) ?? this.#blockedMessage();
+    return void 0;
+  }
+  #monitorStream(model) {
+    let text = "";
+    const evaluate = async () => {
+      if (!text.trim()) return;
+      try {
+        await this.#evaluate("output", {
+          payload: { input: text },
+          direction: "output",
+          protocol: "llm",
+          attributes: modelAttributes(model)
+        });
+      } catch (error) {
+        this.#options.onError?.({ phase: "output", error });
+      }
+    };
+    return new TransformStream({
+      transform(part, controller) {
+        if (part.type === "text-delta") text += part.delta;
+        controller.enqueue(part);
+      },
+      // The stream does not close until this resolves, so a serverless function stays alive until the evaluation is sent.
+      async flush() {
+        await evaluate();
+      }
+    });
+  }
+  #bufferStream(model) {
+    const open = /* @__PURE__ */ new Map();
+    const release = async (id, end, controller) => {
+      const parts = open.get(id) ?? [];
+      open.delete(id);
+      const text = parts.map((p) => p.type === "text-delta" ? p.delta : "").join("");
+      const replacement = text.trim() ? await this.#outputReplacement(text, model) : void 0;
+      if (replacement === void 0) {
+        for (const p of parts) controller.enqueue(p);
+      } else {
+        for (const p of parts) if (p.type !== "text-delta") controller.enqueue(p);
+        controller.enqueue({ type: "text-delta", id, delta: replacement });
+      }
+      if (end) controller.enqueue(end);
+    };
+    return new TransformStream({
+      async transform(part, controller) {
+        switch (part.type) {
+          case "text-start":
+            open.set(part.id, [part]);
+            return;
+          case "text-delta": {
+            const parts = open.get(part.id);
+            if (parts) parts.push(part);
+            else controller.enqueue(part);
+            return;
+          }
+          case "text-end":
+            if (open.has(part.id)) await release(part.id, part, controller);
+            else controller.enqueue(part);
+            return;
+          default:
+            controller.enqueue(part);
+        }
+      },
+      async flush(controller) {
+        for (const id of [...open.keys()]) await release(id, void 0, controller);
+      }
+    });
+  }
+  async #guardResult(toolName, output) {
+    const text = typeof output === "string" ? output : JSON.stringify(output);
+    if (text === void 0 || !text.trim()) return output;
+    let response;
+    try {
+      response = await this.#evaluate("tool-result", {
+        payload: { input: text },
+        direction: "output",
+        protocol: "mcp",
+        attributes: { tool: { name: toolName } }
+      });
+    } catch (error) {
+      if (this.#failOpen("tool-result", error)) return output;
+      throw error;
+    }
+    if (response.status === "block") {
+      throw new TrustGuardBlockedError(
+        "tool-result",
+        response,
+        reasonFor(response, `TrustGuard withheld the result of ${toolName}`)
+      );
+    }
+    if (response.status !== "transform") return output;
+    const masked = transformedText(response);
+    if (masked === void 0) {
+      throw new TrustGuardBlockedError(
+        "tool-result",
+        response,
+        `TrustGuard withheld the result of ${toolName}: the policy masked it but returned no masked text`
+      );
+    }
+    if (typeof output === "string") return masked;
+    try {
+      return JSON.parse(masked);
+    } catch {
+      return masked;
+    }
+  }
+  async *#guardIterableResult(toolName, output) {
+    let last;
+    let seen = false;
+    for await (const value of output) {
+      last = value;
+      seen = true;
+      yield value;
+    }
+    if (!seen) return;
+    const guarded = await this.#guardResult(toolName, last);
+    if (guarded !== last) yield guarded;
+  }
+  async #evaluate(phase, request) {
+    const response = await this.#client.guard({
+      ...request,
+      sessionId: this.#options.sessionId,
+      consumerId: this.#options.consumerId,
+      attributes: {
+        ...this.#options.attributes,
+        ...request.attributes,
+        source: { application: SOURCE_APPLICATION }
+      }
+    });
+    this.#options.onVerdict?.({ phase, response });
+    return response;
+  }
+  #failOpen(phase, error) {
+    this.#options.onError?.({ phase, error });
+    return this.#options.failMode === "open";
+  }
+  #blockedMessage() {
+    return this.#options.blockedMessage ?? DEFAULT_BLOCKED_MESSAGE;
+  }
+};
+function lastUserTurn(prompt) {
+  const last = prompt.length - 1;
+  return last >= 0 && prompt[last]?.role === "user" ? last : -1;
+}
+function joinText(parts) {
+  return parts.filter((p) => p.type === "text" && typeof p.text === "string").map((p) => p.text).join("\n");
+}
+function replaceText(parts, text) {
+  let placed = false;
+  const out = [];
+  for (const part of parts) {
+    if (part.type !== "text") {
+      out.push(part);
+    } else if (!placed) {
+      out.push({ ...part, text });
+      placed = true;
+    }
+  }
+  return out;
+}
+function transformedText(response) {
+  const input = response.transformedPayload?.input;
+  return typeof input === "string" ? input : void 0;
+}
+function toolsCall(name, input) {
+  const args = input !== null && typeof input === "object" && !Array.isArray(input) ? input : { input };
+  return { jsonrpc: "2.0", id: 1, method: "tools/call", params: { name, arguments: args } };
+}
+function modelAttributes(model) {
+  return { model: { name: model.modelId, provider: model.provider } };
+}
+function reasonFor(response, reason) {
+  const finding = response.findings.find((f) => f.outcome?.action === response.status) ?? response.findings.find((f) => f.outcome);
+  const name = finding?.source.gateName || finding?.source.detectorName || finding?.signal?.type;
+  return name ? `${reason}: ${name}` : reason;
+}
+function isAsyncIterable(value) {
+  return value !== null && typeof value === "object" && Symbol.asyncIterator in value;
+}
+export {
+  TrustGuardBlockedError,
+  trustguard
+};
+//# sourceMappingURL=index.js.map

package/dist/ai-sdk/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../src/ai-sdk/trustguard.ts"],"sourcesContent":["import type {\n  LanguageModelV4,\n  LanguageModelV4CallOptions,\n  LanguageModelV4Content,\n  LanguageModelV4Middleware,\n  LanguageModelV4Prompt,\n  LanguageModelV4StreamPart,\n} from \"@ai-sdk/provider\";\nimport type { ToolApprovalStatus, ToolSet } from \"ai\";\n\nimport type { TrustGuard } from \"../client.js\";\nimport type { GuardRequest, GuardResponse } from \"../types.js\";\n\n/** Where in the agent loop an evaluation ran. */\nexport type GuardPhase = \"input\" | \"output\" | \"tool-call\" | \"tool-result\";\n\n/** Options for {@link trustguard}. Create one instance per request so every evaluation carries the right user. */\nexport interface TrustGuardAISDKOptions {\n  /** The end user the request runs for. Findings are grouped under it and gates match it as `consumer.id`. */\n  consumerId?: string;\n  /** The conversation key. Without it TrustGuard synthesises one per evaluation and turns lose their grouping. */\n  sessionId?: string;\n  /** Extra attributes merged into every evaluation, for gates and rule conditions. */\n  attributes?: Record<string, unknown>;\n  /**\n   * How streamed responses are guarded.\n   * - `\"monitor\"` (default): text streams untouched and is evaluated when the response finishes. Findings are recorded, nothing is enforced.\n   * - `\"buffer\"`: each text block is held until it ends, evaluated, then released, redacted or replaced. Enforces the policy at the cost of streaming.\n   */\n  stream?: \"monitor\" | \"buffer\";\n  /** What an `ask` verdict on the prompt does. The model call has no one to ask, so the default is `\"block\"`. */\n  promptAsk?: \"block\" | \"allow\";\n  /** What an `ask` verdict on a tool call does. The default, `\"user-approval\"`, asks the user through the AI SDK approval flow. */\n  toolAsk?: \"user-approval\" | \"deny\";\n  /** Text that replaces a response the policy blocked. */\n  blockedMessage?: string;\n  /**\n   * What happens when TrustGuard cannot be reached or returns an error.\n   * `\"closed\"` (default) throws on the prompt and the response and denies the tool call. `\"open\"` lets the traffic through.\n   * Monitor-mode stream evaluations never fail the stream.\n   */\n  failMode?: \"closed\" | \"open\";\n  /** Called with every verdict, for logging. */\n  onVerdict?: (event: { phase: GuardPhase; response: GuardResponse }) => void;\n  /** Called with every evaluation error, including the ones `failMode: \"open\"` swallows. */\n  onError?: (event: { phase: GuardPhase; error: unknown }) => void;\n}\n\n/** Thrown when the policy blocks the prompt or the response, and by guarded tools whose result was withheld. */\nexport class TrustGuardBlockedError extends Error {\n  readonly phase: GuardPhase;\n  readonly response: GuardResponse;\n\n  constructor(phase: GuardPhase, response: GuardResponse, message: string) {\n    super(message);\n    this.name = \"TrustGuardBlockedError\";\n    this.phase = phase;\n    this.response = response;\n  }\n}\n\n/** The tool call the approval function receives. Structural, so it matches static and dynamic tool calls alike. */\nexport interface ApprovalToolCall {\n  toolName: string;\n  toolCallId: string;\n  input: unknown;\n}\n\nexport interface TrustGuardAISDK {\n  /** Language model middleware for `wrapLanguageModel`: guards the prompt and the response. */\n  middleware: LanguageModelV4Middleware;\n  /** A `toolApproval` function for `generateText` / `streamText`: guards each tool call before it runs. */\n  toolApproval: (options: { toolCall: ApprovalToolCall }) => Promise<ToolApprovalStatus>;\n  /** Wraps a tool set so every result is evaluated before the model reads it. */\n  tools: <TOOLS extends ToolSet>(tools: TOOLS) => TOOLS;\n}\n\nconst SOURCE_APPLICATION = \"vercel-ai-sdk\";\nconst DEFAULT_BLOCKED_MESSAGE = \"This response was blocked by policy.\";\n\n/**\n * Connects a TrustGuard client to the Vercel AI SDK.\n *\n * ```ts\n * const tg = trustguard(client, { consumerId: user.id, sessionId: chatId });\n * streamText({\n *   model: wrapLanguageModel({ model, middleware: tg.middleware }),\n *   tools: tg.tools(tools),\n *   toolApproval: tg.toolApproval,\n *   messages,\n * });\n * ```\n */\nexport function trustguard(client: TrustGuard, options: TrustGuardAISDKOptions = {}): TrustGuardAISDK {\n  const guard = new Guard(client, options);\n  return {\n    middleware: guard.middleware(),\n    toolApproval: (approval) => guard.approveToolCall(approval.toolCall),\n    tools: (tools) => guard.wrapTools(tools),\n  };\n}\n\nclass Guard {\n  readonly #client: TrustGuard;\n  readonly #options: TrustGuardAISDKOptions;\n\n  constructor(client: TrustGuard, options: TrustGuardAISDKOptions) {\n    this.#client = client;\n    this.#options = options;\n  }\n\n  middleware(): LanguageModelV4Middleware {\n    return {\n      specificationVersion: \"v4\",\n      transformParams: async ({ params, model }) => this.#guardPrompt(params, model),\n      wrapGenerate: async ({ doGenerate, model }) => {\n        const result = await doGenerate();\n        return { ...result, content: await this.#guardContent(result.content, model) };\n      },\n      wrapStream: async ({ doStream, model }) => {\n        const result = await doStream();\n        const transform =\n          this.#options.stream === \"buffer\" ? this.#bufferStream(model) : this.#monitorStream(model);\n        return { ...result, stream: result.stream.pipeThrough(transform) };\n      },\n    };\n  }\n\n  async approveToolCall(call: ApprovalToolCall): Promise<ToolApprovalStatus> {\n    let response: GuardResponse | undefined;\n    try {\n      response = await this.#evaluate(\"tool-call\", {\n        payload: toolsCall(call.toolName, call.input),\n        direction: \"input\",\n        protocol: \"mcp\",\n        attributes: { tool: { name: call.toolName } },\n      });\n    } catch (error) {\n      if (this.#failOpen(\"tool-call\", error)) return undefined;\n      return { type: \"denied\", reason: \"TrustGuard could not evaluate this tool call.\" };\n    }\n\n    switch (response.status) {\n      case \"block\":\n        return { type: \"denied\", reason: reasonFor(response, \"Blocked by TrustGuard\") };\n      case \"ask\":\n        return this.#options.toolAsk === \"deny\"\n          ? { type: \"denied\", reason: reasonFor(response, \"TrustGuard requires approval\") }\n          : { type: \"user-approval\", reason: reasonFor(response, \"TrustGuard requires approval\") };\n      case \"transform\":\n        // Approval cannot rewrite the arguments, and running the call unredacted would leak what the policy masks.\n        return {\n          type: \"denied\",\n          reason: reasonFor(response, \"Blocked by TrustGuard because the arguments contain data the policy masks\"),\n        };\n      default:\n        return undefined;\n    }\n  }\n\n  wrapTools<TOOLS extends ToolSet>(tools: TOOLS): TOOLS {\n    const wrapped: Record<string, unknown> = {};\n    for (const [name, tool] of Object.entries(tools)) {\n      const execute = tool.execute as ((input: unknown, options: unknown) => unknown) | undefined;\n      if (typeof execute !== \"function\") {\n        wrapped[name] = tool;\n        continue;\n      }\n      wrapped[name] = {\n        ...tool,\n        execute: (input: unknown, executeOptions: unknown) => {\n          const output = execute.call(tool, input, executeOptions);\n          return isAsyncIterable(output)\n            ? this.#guardIterableResult(name, output)\n            : Promise.resolve(output).then((value) => this.#guardResult(name, value));\n        },\n      };\n    }\n    return wrapped as TOOLS;\n  }\n\n  async #guardPrompt(params: LanguageModelV4CallOptions, model: LanguageModelV4): Promise<LanguageModelV4CallOptions> {\n    const index = lastUserTurn(params.prompt);\n    if (index < 0) return params;\n    const message = params.prompt[index] as Extract<LanguageModelV4Prompt[number], { role: \"user\" }>;\n    const text = joinText(message.content);\n    if (!text.trim()) return params;\n\n    let response: GuardResponse;\n    try {\n      response = await this.#evaluate(\"input\", {\n        payload: { input: text },\n        direction: \"input\",\n        protocol: \"llm\",\n        attributes: modelAttributes(model),\n      });\n    } catch (error) {\n      if (this.#failOpen(\"input\", error)) return params;\n      throw error;\n    }\n\n    const status = response.status === \"ask\" && this.#options.promptAsk !== \"allow\" ? \"block\" : response.status;\n    if (status === \"block\") {\n      throw new TrustGuardBlockedError(\"input\", response, reasonFor(response, \"Prompt blocked by TrustGuard\"));\n    }\n    if (status !== \"transform\") return params;\n\n    const masked = transformedText(response);\n    if (masked === undefined) {\n      throw new TrustGuardBlockedError(\n        \"input\",\n        response,\n        \"Prompt blocked by TrustGuard: the policy masked it but returned no masked text\",\n      );\n    }\n    const prompt = [...params.prompt];\n    prompt[index] = { ...message, content: replaceText(message.content, masked) };\n    return { ...params, prompt };\n  }\n\n  async #guardContent(content: LanguageModelV4Content[], model: LanguageModelV4): Promise<LanguageModelV4Content[]> {\n    const text = joinText(content);\n    if (!text.trim()) return content;\n\n    const replacement = await this.#outputReplacement(text, model);\n    return replacement === undefined ? content : replaceText(content, replacement);\n  }\n\n  /** The text that must replace a response, or undefined when it can go out as is. Throws when failing closed. */\n  async #outputReplacement(text: string, model: LanguageModelV4): Promise<string | undefined> {\n    let response: GuardResponse;\n    try {\n      response = await this.#evaluate(\"output\", {\n        payload: { input: text },\n        direction: \"output\",\n        protocol: \"llm\",\n        attributes: modelAttributes(model),\n      });\n    } catch (error) {\n      if (this.#failOpen(\"output\", error)) return undefined;\n      throw error;\n    }\n    if (response.status === \"block\") return this.#blockedMessage();\n    if (response.status === \"transform\") return transformedText(response) ?? this.#blockedMessage();\n    return undefined;\n  }\n\n  #monitorStream(model: LanguageModelV4): TransformStream<LanguageModelV4StreamPart, LanguageModelV4StreamPart> {\n    let text = \"\";\n    const evaluate = async () => {\n      if (!text.trim()) return;\n      try {\n        await this.#evaluate(\"output\", {\n          payload: { input: text },\n          direction: \"output\",\n          protocol: \"llm\",\n          attributes: modelAttributes(model),\n        });\n      } catch (error) {\n        this.#options.onError?.({ phase: \"output\", error });\n      }\n    };\n    return new TransformStream({\n      transform(part, controller) {\n        if (part.type === \"text-delta\") text += part.delta;\n        controller.enqueue(part);\n      },\n      // The stream does not close until this resolves, so a serverless function stays alive until the evaluation is sent.\n      async flush() {\n        await evaluate();\n      },\n    });\n  }\n\n  #bufferStream(model: LanguageModelV4): TransformStream<LanguageModelV4StreamPart, LanguageModelV4StreamPart> {\n    const open = new Map<string, LanguageModelV4StreamPart[]>();\n    const release = async (\n      id: string,\n      end: LanguageModelV4StreamPart | undefined,\n      controller: TransformStreamDefaultController<LanguageModelV4StreamPart>,\n    ) => {\n      const parts = open.get(id) ?? [];\n      open.delete(id);\n      const text = parts.map((p) => (p.type === \"text-delta\" ? p.delta : \"\")).join(\"\");\n      const replacement = text.trim() ? await this.#outputReplacement(text, model) : undefined;\n      if (replacement === undefined) {\n        for (const p of parts) controller.enqueue(p);\n      } else {\n        for (const p of parts) if (p.type !== \"text-delta\") controller.enqueue(p);\n        controller.enqueue({ type: \"text-delta\", id, delta: replacement });\n      }\n      if (end) controller.enqueue(end);\n    };\n    return new TransformStream({\n      async transform(part, controller) {\n        switch (part.type) {\n          case \"text-start\":\n            open.set(part.id, [part]);\n            return;\n          case \"text-delta\": {\n            const parts = open.get(part.id);\n            if (parts) parts.push(part);\n            else controller.enqueue(part);\n            return;\n          }\n          case \"text-end\":\n            if (open.has(part.id)) await release(part.id, part, controller);\n            else controller.enqueue(part);\n            return;\n          default:\n            controller.enqueue(part);\n        }\n      },\n      async flush(controller) {\n        // A stream that ends without text-end still goes through the policy before anything is released.\n        for (const id of [...open.keys()]) await release(id, undefined, controller);\n      },\n    });\n  }\n\n  async #guardResult(toolName: string, output: unknown): Promise<unknown> {\n    const text = typeof output === \"string\" ? output : JSON.stringify(output);\n    if (text === undefined || !text.trim()) return output;\n\n    let response: GuardResponse;\n    try {\n      response = await this.#evaluate(\"tool-result\", {\n        payload: { input: text },\n        direction: \"output\",\n        protocol: \"mcp\",\n        attributes: { tool: { name: toolName } },\n      });\n    } catch (error) {\n      if (this.#failOpen(\"tool-result\", error)) return output;\n      throw error;\n    }\n\n    if (response.status === \"block\") {\n      throw new TrustGuardBlockedError(\n        \"tool-result\",\n        response,\n        reasonFor(response, `TrustGuard withheld the result of ${toolName}`),\n      );\n    }\n    if (response.status !== \"transform\") return output;\n\n    const masked = transformedText(response);\n    if (masked === undefined) {\n      throw new TrustGuardBlockedError(\n        \"tool-result\",\n        response,\n        `TrustGuard withheld the result of ${toolName}: the policy masked it but returned no masked text`,\n      );\n    }\n    if (typeof output === \"string\") return masked;\n    try {\n      return JSON.parse(masked) as unknown;\n    } catch {\n      return masked;\n    }\n  }\n\n  async *#guardIterableResult(toolName: string, output: AsyncIterable<unknown>): AsyncGenerator<unknown> {\n    // Preliminary outputs reach the UI only. The last one is what the model reads, so that is the one guarded:\n    // when the policy changes it, the guarded value is yielded after it and becomes the final output.\n    let last: unknown;\n    let seen = false;\n    for await (const value of output) {\n      last = value;\n      seen = true;\n      yield value;\n    }\n    if (!seen) return;\n    const guarded = await this.#guardResult(toolName, last);\n    if (guarded !== last) yield guarded;\n  }\n\n  async #evaluate(phase: GuardPhase, request: GuardRequest): Promise<GuardResponse> {\n    const response = await this.#client.guard({\n      ...request,\n      sessionId: this.#options.sessionId,\n      consumerId: this.#options.consumerId,\n      attributes: {\n        ...this.#options.attributes,\n        ...request.attributes,\n        source: { application: SOURCE_APPLICATION },\n      },\n    });\n    this.#options.onVerdict?.({ phase, response });\n    return response;\n  }\n\n  #failOpen(phase: GuardPhase, error: unknown): boolean {\n    this.#options.onError?.({ phase, error });\n    return this.#options.failMode === \"open\";\n  }\n\n  #blockedMessage(): string {\n    return this.#options.blockedMessage ?? DEFAULT_BLOCKED_MESSAGE;\n  }\n}\n\n/** Index of the user message that starts this model call, or -1 when the call continues a tool loop. */\nfunction lastUserTurn(prompt: LanguageModelV4Prompt): number {\n  const last = prompt.length - 1;\n  return last >= 0 && prompt[last]?.role === \"user\" ? last : -1;\n}\n\ntype TextLike = { type: string; text?: string };\n\nfunction joinText(parts: readonly TextLike[]): string {\n  return parts\n    .filter((p) => p.type === \"text\" && typeof p.text === \"string\")\n    .map((p) => p.text)\n    .join(\"\\n\");\n}\n\n/** Puts `text` in place of the first text part and drops the others, keeping every non-text part where it was. */\nfunction replaceText<T extends TextLike>(parts: readonly T[], text: string): T[] {\n  let placed = false;\n  const out: T[] = [];\n  for (const part of parts) {\n    if (part.type !== \"text\") {\n      out.push(part);\n    } else if (!placed) {\n      out.push({ ...part, text });\n      placed = true;\n    }\n  }\n  return out;\n}\n\nfunction transformedText(response: GuardResponse): string | undefined {\n  const input = response.transformedPayload?.input;\n  return typeof input === \"string\" ? input : undefined;\n}\n\nfunction toolsCall(name: string, input: unknown): Record<string, unknown> {\n  const args = input !== null && typeof input === \"object\" && !Array.isArray(input) ? input : { input };\n  return { jsonrpc: \"2.0\", id: 1, method: \"tools/call\", params: { name, arguments: args } };\n}\n\nfunction modelAttributes(model: LanguageModelV4): Record<string, unknown> {\n  return { model: { name: model.modelId, provider: model.provider } };\n}\n\n/** `reason`, followed by the gate or detector that produced the verdict when the response names one. */\nfunction reasonFor(response: GuardResponse, reason: string): string {\n  const finding =\n    response.findings.find((f) => f.outcome?.action === response.status) ?? response.findings.find((f) => f.outcome);\n  const name = finding?.source.gateName || finding?.source.detectorName || finding?.signal?.type;\n  return name ? `${reason}: ${name}` : reason;\n}\n\nfunction isAsyncIterable(value: unknown): value is AsyncIterable<unknown> {\n  return value !== null && typeof value === \"object\" && Symbol.asyncIterator in value;\n}\n\n"],"mappings":";AAiDO,IAAM,yBAAN,cAAqC,MAAM;AAAA,EACvC;AAAA,EACA;AAAA,EAET,YAAY,OAAmB,UAAyB,SAAiB;AACvE,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,QAAQ;AACb,SAAK,WAAW;AAAA,EAClB;AACF;AAkBA,IAAM,qBAAqB;AAC3B,IAAM,0BAA0B;AAezB,SAAS,WAAW,QAAoB,UAAkC,CAAC,GAAoB;AACpG,QAAM,QAAQ,IAAI,MAAM,QAAQ,OAAO;AACvC,SAAO;AAAA,IACL,YAAY,MAAM,WAAW;AAAA,IAC7B,cAAc,CAAC,aAAa,MAAM,gBAAgB,SAAS,QAAQ;AAAA,IACnE,OAAO,CAAC,UAAU,MAAM,UAAU,KAAK;AAAA,EACzC;AACF;AAEA,IAAM,QAAN,MAAY;AAAA,EACD;AAAA,EACA;AAAA,EAET,YAAY,QAAoB,SAAiC;AAC/D,SAAK,UAAU;AACf,SAAK,WAAW;AAAA,EAClB;AAAA,EAEA,aAAwC;AACtC,WAAO;AAAA,MACL,sBAAsB;AAAA,MACtB,iBAAiB,OAAO,EAAE,QAAQ,MAAM,MAAM,KAAK,aAAa,QAAQ,KAAK;AAAA,MAC7E,cAAc,OAAO,EAAE,YAAY,MAAM,MAAM;AAC7C,cAAM,SAAS,MAAM,WAAW;AAChC,eAAO,EAAE,GAAG,QAAQ,SAAS,MAAM,KAAK,cAAc,OAAO,SAAS,KAAK,EAAE;AAAA,MAC/E;AAAA,MACA,YAAY,OAAO,EAAE,UAAU,MAAM,MAAM;AACzC,cAAM,SAAS,MAAM,SAAS;AAC9B,cAAM,YACJ,KAAK,SAAS,WAAW,WAAW,KAAK,cAAc,KAAK,IAAI,KAAK,eAAe,KAAK;AAC3F,eAAO,EAAE,GAAG,QAAQ,QAAQ,OAAO,OAAO,YAAY,SAAS,EAAE;AAAA,MACnE;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,gBAAgB,MAAqD;AACzE,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,aAAa;AAAA,QAC3C,SAAS,UAAU,KAAK,UAAU,KAAK,KAAK;AAAA,QAC5C,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,EAAE,MAAM,EAAE,MAAM,KAAK,SAAS,EAAE;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,aAAa,KAAK,EAAG,QAAO;AAC/C,aAAO,EAAE,MAAM,UAAU,QAAQ,gDAAgD;AAAA,IACnF;AAEA,YAAQ,SAAS,QAAQ;AAAA,MACvB,KAAK;AACH,eAAO,EAAE,MAAM,UAAU,QAAQ,UAAU,UAAU,uBAAuB,EAAE;AAAA,MAChF,KAAK;AACH,eAAO,KAAK,SAAS,YAAY,SAC7B,EAAE,MAAM,UAAU,QAAQ,UAAU,UAAU,8BAA8B,EAAE,IAC9E,EAAE,MAAM,iBAAiB,QAAQ,UAAU,UAAU,8BAA8B,EAAE;AAAA,MAC3F,KAAK;AAEH,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ,UAAU,UAAU,2EAA2E;AAAA,QACzG;AAAA,MACF;AACE,eAAO;AAAA,IACX;AAAA,EACF;AAAA,EAEA,UAAiC,OAAqB;AACpD,UAAM,UAAmC,CAAC;AAC1C,eAAW,CAAC,MAAM,IAAI,KAAK,OAAO,QAAQ,KAAK,GAAG;AAChD,YAAM,UAAU,KAAK;AACrB,UAAI,OAAO,YAAY,YAAY;AACjC,gBAAQ,IAAI,IAAI;AAChB;AAAA,MACF;AACA,cAAQ,IAAI,IAAI;AAAA,QACd,GAAG;AAAA,QACH,SAAS,CAAC,OAAgB,mBAA4B;AACpD,gBAAM,SAAS,QAAQ,KAAK,MAAM,OAAO,cAAc;AACvD,iBAAO,gBAAgB,MAAM,IACzB,KAAK,qBAAqB,MAAM,MAAM,IACtC,QAAQ,QAAQ,MAAM,EAAE,KAAK,CAAC,UAAU,KAAK,aAAa,MAAM,KAAK,CAAC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,aAAa,QAAoC,OAA6D;AAClH,UAAM,QAAQ,aAAa,OAAO,MAAM;AACxC,QAAI,QAAQ,EAAG,QAAO;AACtB,UAAM,UAAU,OAAO,OAAO,KAAK;AACnC,UAAM,OAAO,SAAS,QAAQ,OAAO;AACrC,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO;AAEzB,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,SAAS;AAAA,QACvC,SAAS,EAAE,OAAO,KAAK;AAAA,QACvB,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,gBAAgB,KAAK;AAAA,MACnC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,SAAS,KAAK,EAAG,QAAO;AAC3C,YAAM;AAAA,IACR;AAEA,UAAM,SAAS,SAAS,WAAW,SAAS,KAAK,SAAS,cAAc,UAAU,UAAU,SAAS;AACrG,QAAI,WAAW,SAAS;AACtB,YAAM,IAAI,uBAAuB,SAAS,UAAU,UAAU,UAAU,8BAA8B,CAAC;AAAA,IACzG;AACA,QAAI,WAAW,YAAa,QAAO;AAEnC,UAAM,SAAS,gBAAgB,QAAQ;AACvC,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,SAAS,CAAC,GAAG,OAAO,MAAM;AAChC,WAAO,KAAK,IAAI,EAAE,GAAG,SAAS,SAAS,YAAY,QAAQ,SAAS,MAAM,EAAE;AAC5E,WAAO,EAAE,GAAG,QAAQ,OAAO;AAAA,EAC7B;AAAA,EAEA,MAAM,cAAc,SAAmC,OAA2D;AAChH,UAAM,OAAO,SAAS,OAAO;AAC7B,QAAI,CAAC,KAAK,KAAK,EAAG,QAAO;AAEzB,UAAM,cAAc,MAAM,KAAK,mBAAmB,MAAM,KAAK;AAC7D,WAAO,gBAAgB,SAAY,UAAU,YAAY,SAAS,WAAW;AAAA,EAC/E;AAAA;AAAA,EAGA,MAAM,mBAAmB,MAAc,OAAqD;AAC1F,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,UAAU;AAAA,QACxC,SAAS,EAAE,OAAO,KAAK;AAAA,QACvB,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,gBAAgB,KAAK;AAAA,MACnC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,UAAU,KAAK,EAAG,QAAO;AAC5C,YAAM;AAAA,IACR;AACA,QAAI,SAAS,WAAW,QAAS,QAAO,KAAK,gBAAgB;AAC7D,QAAI,SAAS,WAAW,YAAa,QAAO,gBAAgB,QAAQ,KAAK,KAAK,gBAAgB;AAC9F,WAAO;AAAA,EACT;AAAA,EAEA,eAAe,OAA+F;AAC5G,QAAI,OAAO;AACX,UAAM,WAAW,YAAY;AAC3B,UAAI,CAAC,KAAK,KAAK,EAAG;AAClB,UAAI;AACF,cAAM,KAAK,UAAU,UAAU;AAAA,UAC7B,SAAS,EAAE,OAAO,KAAK;AAAA,UACvB,WAAW;AAAA,UACX,UAAU;AAAA,UACV,YAAY,gBAAgB,KAAK;AAAA,QACnC,CAAC;AAAA,MACH,SAAS,OAAO;AACd,aAAK,SAAS,UAAU,EAAE,OAAO,UAAU,MAAM,CAAC;AAAA,MACpD;AAAA,IACF;AACA,WAAO,IAAI,gBAAgB;AAAA,MACzB,UAAU,MAAM,YAAY;AAC1B,YAAI,KAAK,SAAS,aAAc,SAAQ,KAAK;AAC7C,mBAAW,QAAQ,IAAI;AAAA,MACzB;AAAA;AAAA,MAEA,MAAM,QAAQ;AACZ,cAAM,SAAS;AAAA,MACjB;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,cAAc,OAA+F;AAC3G,UAAM,OAAO,oBAAI,IAAyC;AAC1D,UAAM,UAAU,OACd,IACA,KACA,eACG;AACH,YAAM,QAAQ,KAAK,IAAI,EAAE,KAAK,CAAC;AAC/B,WAAK,OAAO,EAAE;AACd,YAAM,OAAO,MAAM,IAAI,CAAC,MAAO,EAAE,SAAS,eAAe,EAAE,QAAQ,EAAG,EAAE,KAAK,EAAE;AAC/E,YAAM,cAAc,KAAK,KAAK,IAAI,MAAM,KAAK,mBAAmB,MAAM,KAAK,IAAI;AAC/E,UAAI,gBAAgB,QAAW;AAC7B,mBAAW,KAAK,MAAO,YAAW,QAAQ,CAAC;AAAA,MAC7C,OAAO;AACL,mBAAW,KAAK,MAAO,KAAI,EAAE,SAAS,aAAc,YAAW,QAAQ,CAAC;AACxE,mBAAW,QAAQ,EAAE,MAAM,cAAc,IAAI,OAAO,YAAY,CAAC;AAAA,MACnE;AACA,UAAI,IAAK,YAAW,QAAQ,GAAG;AAAA,IACjC;AACA,WAAO,IAAI,gBAAgB;AAAA,MACzB,MAAM,UAAU,MAAM,YAAY;AAChC,gBAAQ,KAAK,MAAM;AAAA,UACjB,KAAK;AACH,iBAAK,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC;AACxB;AAAA,UACF,KAAK,cAAc;AACjB,kBAAM,QAAQ,KAAK,IAAI,KAAK,EAAE;AAC9B,gBAAI,MAAO,OAAM,KAAK,IAAI;AAAA,gBACrB,YAAW,QAAQ,IAAI;AAC5B;AAAA,UACF;AAAA,UACA,KAAK;AACH,gBAAI,KAAK,IAAI,KAAK,EAAE,EAAG,OAAM,QAAQ,KAAK,IAAI,MAAM,UAAU;AAAA,gBACzD,YAAW,QAAQ,IAAI;AAC5B;AAAA,UACF;AACE,uBAAW,QAAQ,IAAI;AAAA,QAC3B;AAAA,MACF;AAAA,MACA,MAAM,MAAM,YAAY;AAEtB,mBAAW,MAAM,CAAC,GAAG,KAAK,KAAK,CAAC,EAAG,OAAM,QAAQ,IAAI,QAAW,UAAU;AAAA,MAC5E;AAAA,IACF,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,aAAa,UAAkB,QAAmC;AACtE,UAAM,OAAO,OAAO,WAAW,WAAW,SAAS,KAAK,UAAU,MAAM;AACxE,QAAI,SAAS,UAAa,CAAC,KAAK,KAAK,EAAG,QAAO;AAE/C,QAAI;AACJ,QAAI;AACF,iBAAW,MAAM,KAAK,UAAU,eAAe;AAAA,QAC7C,SAAS,EAAE,OAAO,KAAK;AAAA,QACvB,WAAW;AAAA,QACX,UAAU;AAAA,QACV,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE;AAAA,MACzC,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,KAAK,UAAU,eAAe,KAAK,EAAG,QAAO;AACjD,YAAM;AAAA,IACR;AAEA,QAAI,SAAS,WAAW,SAAS;AAC/B,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,UAAU,UAAU,qCAAqC,QAAQ,EAAE;AAAA,MACrE;AAAA,IACF;AACA,QAAI,SAAS,WAAW,YAAa,QAAO;AAE5C,UAAM,SAAS,gBAAgB,QAAQ;AACvC,QAAI,WAAW,QAAW;AACxB,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,QACA,qCAAqC,QAAQ;AAAA,MAC/C;AAAA,IACF;AACA,QAAI,OAAO,WAAW,SAAU,QAAO;AACvC,QAAI;AACF,aAAO,KAAK,MAAM,MAAM;AAAA,IAC1B,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEA,OAAO,qBAAqB,UAAkB,QAAyD;AAGrG,QAAI;AACJ,QAAI,OAAO;AACX,qBAAiB,SAAS,QAAQ;AAChC,aAAO;AACP,aAAO;AACP,YAAM;AAAA,IACR;AACA,QAAI,CAAC,KAAM;AACX,UAAM,UAAU,MAAM,KAAK,aAAa,UAAU,IAAI;AACtD,QAAI,YAAY,KAAM,OAAM;AAAA,EAC9B;AAAA,EAEA,MAAM,UAAU,OAAmB,SAA+C;AAChF,UAAM,WAAW,MAAM,KAAK,QAAQ,MAAM;AAAA,MACxC,GAAG;AAAA,MACH,WAAW,KAAK,SAAS;AAAA,MACzB,YAAY,KAAK,SAAS;AAAA,MAC1B,YAAY;AAAA,QACV,GAAG,KAAK,SAAS;AAAA,QACjB,GAAG,QAAQ;AAAA,QACX,QAAQ,EAAE,aAAa,mBAAmB;AAAA,MAC5C;AAAA,IACF,CAAC;AACD,SAAK,SAAS,YAAY,EAAE,OAAO,SAAS,CAAC;AAC7C,WAAO;AAAA,EACT;AAAA,EAEA,UAAU,OAAmB,OAAyB;AACpD,SAAK,SAAS,UAAU,EAAE,OAAO,MAAM,CAAC;AACxC,WAAO,KAAK,SAAS,aAAa;AAAA,EACpC;AAAA,EAEA,kBAA0B;AACxB,WAAO,KAAK,SAAS,kBAAkB;AAAA,EACzC;AACF;AAGA,SAAS,aAAa,QAAuC;AAC3D,QAAM,OAAO,OAAO,SAAS;AAC7B,SAAO,QAAQ,KAAK,OAAO,IAAI,GAAG,SAAS,SAAS,OAAO;AAC7D;AAIA,SAAS,SAAS,OAAoC;AACpD,SAAO,MACJ,OAAO,CAAC,MAAM,EAAE,SAAS,UAAU,OAAO,EAAE,SAAS,QAAQ,EAC7D,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,KAAK,IAAI;AACd;AAGA,SAAS,YAAgC,OAAqB,MAAmB;AAC/E,MAAI,SAAS;AACb,QAAM,MAAW,CAAC;AAClB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,SAAS,QAAQ;AACxB,UAAI,KAAK,IAAI;AAAA,IACf,WAAW,CAAC,QAAQ;AAClB,UAAI,KAAK,EAAE,GAAG,MAAM,KAAK,CAAC;AAC1B,eAAS;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,UAA6C;AACpE,QAAM,QAAQ,SAAS,oBAAoB;AAC3C,SAAO,OAAO,UAAU,WAAW,QAAQ;AAC7C;AAEA,SAAS,UAAU,MAAc,OAAyC;AACxE,QAAM,OAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,IAAI,QAAQ,EAAE,MAAM;AACpG,SAAO,EAAE,SAAS,OAAO,IAAI,GAAG,QAAQ,cAAc,QAAQ,EAAE,MAAM,WAAW,KAAK,EAAE;AAC1F;AAEA,SAAS,gBAAgB,OAAiD;AACxE,SAAO,EAAE,OAAO,EAAE,MAAM,MAAM,SAAS,UAAU,MAAM,SAAS,EAAE;AACpE;AAGA,SAAS,UAAU,UAAyB,QAAwB;AAClE,QAAM,UACJ,SAAS,SAAS,KAAK,CAAC,MAAM,EAAE,SAAS,WAAW,SAAS,MAAM,KAAK,SAAS,SAAS,KAAK,CAAC,MAAM,EAAE,OAAO;AACjH,QAAM,OAAO,SAAS,OAAO,YAAY,SAAS,OAAO,gBAAgB,SAAS,QAAQ;AAC1F,SAAO,OAAO,GAAG,MAAM,KAAK,IAAI,KAAK;AACvC;AAEA,SAAS,gBAAgB,OAAiD;AACxE,SAAO,UAAU,QAAQ,OAAO,UAAU,YAAY,OAAO,iBAAiB;AAChF;","names":[]}

package/dist/client-ZoD3M6yg.d.cts

@@ -0,0 +1,99 @@
+/** Traffic side being evaluated; rules are scoped per side. Defaults to "input" server-side. */
+type Direction = "input" | "output";
+/** Traffic protocol the policy rules are scoped to. Defaults to "all" server-side. */
+type Protocol = "all" | "llm" | "mcp" | "a2a";
+/** A document evaluated alongside the payload by file-aware plugins. */
+interface Attachment {
+    filename: string;
+    contentType: string;
+    /** Raw file content; strings are encoded as UTF-8, then base64 on the wire. Provide `data` or `url`. */
+    data?: Uint8Array | string;
+    /** URL for the server to fetch instead of inlining `data`. */
+    url?: string;
+}
+/** Payload for a guard evaluation (`POST /v1/evaluate`). */
+interface GuardRequest {
+    /** The content to evaluate, e.g. `{ input: "..." }` or provider-shaped fields. Required. */
+    payload: Record<string, unknown>;
+    /** Traffic side; the server defaults to "input" when omitted. */
+    direction?: Direction;
+    /** Traffic protocol; the server defaults to "all" when omitted. */
+    protocol?: Protocol;
+    /** Groups multi-turn traffic; the server synthesises one when omitted. */
+    sessionId?: string;
+    /** Identifies the end user on whose behalf the request runs. */
+    consumerId?: string;
+    /** Optional routing hints. Server-side key: `content_type` (overrides the payload content type). */
+    attributes?: Record<string, unknown>;
+    /** Documents to evaluate; folded into `payload.attachments` on the wire. */
+    attachments?: Attachment[];
+}
+/** Who produced the finding — a detector or a gate. */
+interface FindingSource {
+    kind: string;
+    plugin?: string;
+    detectorId?: string;
+    detectorName?: string;
+    policyId?: string;
+    gateName?: string;
+}
+/** Detection signal when the finding fired (omitted for observational-only runs). */
+interface FindingSignal {
+    type: string;
+    confidence?: number;
+}
+/** Applied execution-rule action when the finding enforced an outcome. */
+interface FindingOutcome {
+    action: string;
+}
+/**
+ * A single finding from the evaluate response.
+ * Observational (below-threshold) runs keep `source` + `evidence` only.
+ */
+interface Finding {
+    source: FindingSource;
+    signal?: FindingSignal;
+    outcome?: FindingOutcome;
+    evidence?: Record<string, unknown>;
+}
+/**
+ * Verdict returned by POST /v1/evaluate. TrustGuard detects; the caller enforces:
+ * block when `status` is "block" (`isBlocked` is the convenience signal).
+ */
+interface GuardResponse {
+    /** Most restrictive verdict: "allow", "block", "transform", "report", or "" when omitted. */
+    status: string;
+    /** Convenience flag: true when `status === "block"`. */
+    isBlocked: boolean;
+    /** The payload as rewritten by in-flight masking, null when untouched. */
+    transformedPayload: Record<string, unknown> | null;
+    /** What every plugin / gate in the policy chain reported. */
+    findings: Finding[];
+    /** Correlation ids for TrustGuard telemetry. */
+    traceId: string;
+    requestId: string;
+}
+/** Configuration for the TrustGuard client. */
+interface TrustGuardOptions {
+    /** Base URL of the TrustGuard deployment, e.g. https://trustguard.neuraltrust.ai */
+    baseUrl: string;
+    /** Collector API key, sent as a Bearer token. */
+    apiKey: string;
+    /** Per-request timeout in milliseconds. Default 10000. */
+    timeoutMs?: number;
+    /** Custom fetch implementation (proxies, test doubles). Default globalThis.fetch. */
+    fetch?: typeof fetch;
+}
+
+/** Client for the TrustGuard runtime evaluate API. */
+declare class TrustGuard {
+    #private;
+    constructor(options: TrustGuardOptions);
+    /**
+     * Evaluates the request against the policy attached to the API key and
+     * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.
+     */
+    guard(request: GuardRequest): Promise<GuardResponse>;
+}
+
+export { type Attachment as A, type Direction as D, type Finding as F, type GuardResponse as G, type Protocol as P, TrustGuard as T, type FindingOutcome as a, type FindingSignal as b, type FindingSource as c, type GuardRequest as d, type TrustGuardOptions as e };

package/dist/client-ZoD3M6yg.d.ts

@@ -0,0 +1,99 @@
+/** Traffic side being evaluated; rules are scoped per side. Defaults to "input" server-side. */
+type Direction = "input" | "output";
+/** Traffic protocol the policy rules are scoped to. Defaults to "all" server-side. */
+type Protocol = "all" | "llm" | "mcp" | "a2a";
+/** A document evaluated alongside the payload by file-aware plugins. */
+interface Attachment {
+    filename: string;
+    contentType: string;
+    /** Raw file content; strings are encoded as UTF-8, then base64 on the wire. Provide `data` or `url`. */
+    data?: Uint8Array | string;
+    /** URL for the server to fetch instead of inlining `data`. */
+    url?: string;
+}
+/** Payload for a guard evaluation (`POST /v1/evaluate`). */
+interface GuardRequest {
+    /** The content to evaluate, e.g. `{ input: "..." }` or provider-shaped fields. Required. */
+    payload: Record<string, unknown>;
+    /** Traffic side; the server defaults to "input" when omitted. */
+    direction?: Direction;
+    /** Traffic protocol; the server defaults to "all" when omitted. */
+    protocol?: Protocol;
+    /** Groups multi-turn traffic; the server synthesises one when omitted. */
+    sessionId?: string;
+    /** Identifies the end user on whose behalf the request runs. */
+    consumerId?: string;
+    /** Optional routing hints. Server-side key: `content_type` (overrides the payload content type). */
+    attributes?: Record<string, unknown>;
+    /** Documents to evaluate; folded into `payload.attachments` on the wire. */
+    attachments?: Attachment[];
+}
+/** Who produced the finding — a detector or a gate. */
+interface FindingSource {
+    kind: string;
+    plugin?: string;
+    detectorId?: string;
+    detectorName?: string;
+    policyId?: string;
+    gateName?: string;
+}
+/** Detection signal when the finding fired (omitted for observational-only runs). */
+interface FindingSignal {
+    type: string;
+    confidence?: number;
+}
+/** Applied execution-rule action when the finding enforced an outcome. */
+interface FindingOutcome {
+    action: string;
+}
+/**
+ * A single finding from the evaluate response.
+ * Observational (below-threshold) runs keep `source` + `evidence` only.
+ */
+interface Finding {
+    source: FindingSource;
+    signal?: FindingSignal;
+    outcome?: FindingOutcome;
+    evidence?: Record<string, unknown>;
+}
+/**
+ * Verdict returned by POST /v1/evaluate. TrustGuard detects; the caller enforces:
+ * block when `status` is "block" (`isBlocked` is the convenience signal).
+ */
+interface GuardResponse {
+    /** Most restrictive verdict: "allow", "block", "transform", "report", or "" when omitted. */
+    status: string;
+    /** Convenience flag: true when `status === "block"`. */
+    isBlocked: boolean;
+    /** The payload as rewritten by in-flight masking, null when untouched. */
+    transformedPayload: Record<string, unknown> | null;
+    /** What every plugin / gate in the policy chain reported. */
+    findings: Finding[];
+    /** Correlation ids for TrustGuard telemetry. */
+    traceId: string;
+    requestId: string;
+}
+/** Configuration for the TrustGuard client. */
+interface TrustGuardOptions {
+    /** Base URL of the TrustGuard deployment, e.g. https://trustguard.neuraltrust.ai */
+    baseUrl: string;
+    /** Collector API key, sent as a Bearer token. */
+    apiKey: string;
+    /** Per-request timeout in milliseconds. Default 10000. */
+    timeoutMs?: number;
+    /** Custom fetch implementation (proxies, test doubles). Default globalThis.fetch. */
+    fetch?: typeof fetch;
+}
+
+/** Client for the TrustGuard runtime evaluate API. */
+declare class TrustGuard {
+    #private;
+    constructor(options: TrustGuardOptions);
+    /**
+     * Evaluates the request against the policy attached to the API key and
+     * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.
+     */
+    guard(request: GuardRequest): Promise<GuardResponse>;
+}
+
+export { type Attachment as A, type Direction as D, type Finding as F, type GuardResponse as G, type Protocol as P, TrustGuard as T, type FindingOutcome as a, type FindingSignal as b, type FindingSource as c, type GuardRequest as d, type TrustGuardOptions as e };

package/dist/index.cjs

@@ -18,12 +18,12 @@ var __copyProps = (to, from, except, desc) => {
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
-var index_exports = {};
-__export(index_exports, {
+var src_exports = {};
+__export(src_exports, {
   TrustGuard: () => TrustGuard,
   TrustGuardAPIError: () => TrustGuardAPIError
 });
-module.exports = __toCommonJS(index_exports);
+module.exports = __toCommonJS(src_exports);
 
 // src/errors.ts
 var TrustGuardAPIError = class extends Error {
@@ -103,12 +103,19 @@ function serializeAttachment(attachment) {
     content_type: attachment.contentType
   };
   if (attachment.data !== void 0) {
-    const bytes = typeof attachment.data === "string" ? Buffer.from(attachment.data, "utf-8") : Buffer.from(attachment.data);
-    entry.data = bytes.toString("base64");
+    const bytes = typeof attachment.data === "string" ? new TextEncoder().encode(attachment.data) : attachment.data;
+    entry.data = toBase64(bytes);
   }
   if (attachment.url !== void 0) entry.url = attachment.url;
   return entry;
 }
+function toBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(binary);
+}
 function deserializeResponse(wire) {
   const status = wire.status ?? "";
   return {