@neuraltrust/trustguard-sdk 0.1.4 → 0.1.6

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["export { TrustGuard } from \"./client.js\";\nexport { TrustGuardAPIError } from \"./errors.js\";\nexport type {\n  Attachment,\n  Direction,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  Protocol,\n  TrustGuardOptions,\n} from \"./types.js\";\n","/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type {\n  Attachment,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  TrustGuardOptions,\n} from \"./types.js\";\n\nconst EVALUATE_PATH = \"/v1/evaluate\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFindingSource {\n  kind?: string;\n  plugin?: string;\n  detector_id?: string;\n  detector_name?: string;\n  policy_id?: string;\n  gate_name?: string;\n}\n\ninterface WireFindingSignal {\n  type?: string;\n  confidence?: number;\n}\n\ninterface WireFindingOutcome {\n  action?: string;\n}\n\ninterface WireFinding {\n  source?: WireFindingSource;\n  signal?: WireFindingSignal;\n  outcome?: WireFindingOutcome;\n  evidence?: Record<string, unknown>;\n}\n\ninterface WireResponse {\n  status?: string;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime evaluate API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.payload) {\n      throw new Error(\"TrustGuard: request payload is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  let payload = request.payload;\n  if (request.attachments?.length) {\n    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };\n  }\n  const body: Record<string, unknown> = { payload };\n  if (request.direction) body.direction = request.direction;\n  if (request.protocol) body.protocol = request.protocol;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const entry: Record<string, string> = {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n  };\n  if (attachment.data !== undefined) {\n    const bytes =\n      typeof attachment.data === \"string\" ? Buffer.from(attachment.data, \"utf-8\") : Buffer.from(attachment.data);\n    entry.data = bytes.toString(\"base64\");\n  }\n  if (attachment.url !== undefined) entry.url = attachment.url;\n  return entry;\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  const status = wire.status ?? \"\";\n  return {\n    status,\n    isBlocked: status === \"block\",\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(deserializeFinding),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction deserializeFinding(f: WireFinding): Finding {\n  const sourceWire = f.source ?? {};\n  const source: FindingSource = {\n    kind: sourceWire.kind ?? \"\",\n  };\n  if (sourceWire.plugin !== undefined) source.plugin = sourceWire.plugin;\n  if (sourceWire.detector_id !== undefined) source.detectorId = sourceWire.detector_id;\n  if (sourceWire.detector_name !== undefined) source.detectorName = sourceWire.detector_name;\n  if (sourceWire.policy_id !== undefined) source.policyId = sourceWire.policy_id;\n  if (sourceWire.gate_name !== undefined) source.gateName = sourceWire.gate_name;\n\n  const finding: Finding = { source };\n  if (f.signal?.type) {\n    const signal: FindingSignal = { type: f.signal.type };\n    if (f.signal.confidence !== undefined) signal.confidence = f.signal.confidence;\n    finding.signal = signal;\n  }\n  if (f.outcome?.action) {\n    const outcome: FindingOutcome = { action: f.outcome.action };\n    finding.outcome = outcome;\n  }\n  if (f.evidence && Object.keys(f.evidence).length > 0) {\n    finding.evidence = f.evidence;\n  }\n  return finding;\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; message?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACLA,IAAM,gBAAgB;AACtB,IAAM,qBAAqB;AAoCpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,eAAe;AAAA,MAChE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,MAAI,UAAU,QAAQ;AACtB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,cAAU,EAAE,GAAG,SAAS,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACpF;AACA,QAAM,OAAgC,EAAE,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,SAAU,MAAK,WAAW,QAAQ;AAC9C,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AACnD,MAAI,QAAQ,cAAc,OAAO,KAAK,QAAQ,UAAU,EAAE,SAAS,EAAG,MAAK,aAAa,QAAQ;AAChG,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QAAgC;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,EAC3B;AACA,MAAI,WAAW,SAAS,QAAW;AACjC,UAAM,QACJ,OAAO,WAAW,SAAS,WAAW,OAAO,KAAK,WAAW,MAAM,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI;AAC3G,UAAM,OAAO,MAAM,SAAS,QAAQ;AAAA,EACtC;AACA,MAAI,WAAW,QAAQ,OAAW,OAAM,MAAM,WAAW;AACzD,SAAO;AACT;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG,IAAI,kBAAkB;AAAA,IACtD,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,mBAAmB,GAAyB;AACnD,QAAM,aAAa,EAAE,UAAU,CAAC;AAChC,QAAM,SAAwB;AAAA,IAC5B,MAAM,WAAW,QAAQ;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,OAAW,QAAO,SAAS,WAAW;AAChE,MAAI,WAAW,gBAAgB,OAAW,QAAO,aAAa,WAAW;AACzE,MAAI,WAAW,kBAAkB,OAAW,QAAO,eAAe,WAAW;AAC7E,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AACrE,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AAErE,QAAM,UAAmB,EAAE,OAAO;AAClC,MAAI,EAAE,QAAQ,MAAM;AAClB,UAAM,SAAwB,EAAE,MAAM,EAAE,OAAO,KAAK;AACpD,QAAI,EAAE,OAAO,eAAe,OAAW,QAAO,aAAa,EAAE,OAAO;AACpE,YAAQ,SAAS;AAAA,EACnB;AACA,MAAI,EAAE,SAAS,QAAQ;AACrB,UAAM,UAA0B,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAC3D,YAAQ,UAAU;AAAA,EACpB;AACA,MAAI,EAAE,YAAY,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,GAAG;AACpD,YAAQ,WAAW,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,SAAS,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM;AACnF,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/index.ts","../src/errors.ts","../src/client.ts"],"sourcesContent":["export { TrustGuard } from \"./client.js\";\nexport { TrustGuardAPIError } from \"./errors.js\";\nexport type {\n  Attachment,\n  Direction,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  Protocol,\n  TrustGuardOptions,\n} from \"./types.js\";\n","/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type {\n  Attachment,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  TrustGuardOptions,\n} from \"./types.js\";\n\nconst EVALUATE_PATH = \"/v1/evaluate\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFindingSource {\n  kind?: string;\n  plugin?: string;\n  detector_id?: string;\n  detector_name?: string;\n  policy_id?: string;\n  gate_name?: string;\n}\n\ninterface WireFindingSignal {\n  type?: string;\n  confidence?: number;\n}\n\ninterface WireFindingOutcome {\n  action?: string;\n}\n\ninterface WireFinding {\n  source?: WireFindingSource;\n  signal?: WireFindingSignal;\n  outcome?: WireFindingOutcome;\n  evidence?: Record<string, unknown>;\n}\n\ninterface WireResponse {\n  status?: string;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime evaluate API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.payload) {\n      throw new Error(\"TrustGuard: request payload is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  let payload = request.payload;\n  if (request.attachments?.length) {\n    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };\n  }\n  const body: Record<string, unknown> = { payload };\n  if (request.direction) body.direction = request.direction;\n  if (request.protocol) body.protocol = request.protocol;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const entry: Record<string, string> = {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n  };\n  if (attachment.data !== undefined) {\n    const bytes = typeof attachment.data === \"string\" ? new TextEncoder().encode(attachment.data) : attachment.data;\n    entry.data = toBase64(bytes);\n  }\n  if (attachment.url !== undefined) entry.url = attachment.url;\n  return entry;\n}\n\n/** Base64 without Buffer, so the client also runs on edge runtimes. Chunked to stay under the argument limit of fromCharCode. */\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i += 0x8000) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n  }\n  return btoa(binary);\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  const status = wire.status ?? \"\";\n  return {\n    status,\n    isBlocked: status === \"block\",\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(deserializeFinding),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction deserializeFinding(f: WireFinding): Finding {\n  const sourceWire = f.source ?? {};\n  const source: FindingSource = {\n    kind: sourceWire.kind ?? \"\",\n  };\n  if (sourceWire.plugin !== undefined) source.plugin = sourceWire.plugin;\n  if (sourceWire.detector_id !== undefined) source.detectorId = sourceWire.detector_id;\n  if (sourceWire.detector_name !== undefined) source.detectorName = sourceWire.detector_name;\n  if (sourceWire.policy_id !== undefined) source.policyId = sourceWire.policy_id;\n  if (sourceWire.gate_name !== undefined) source.gateName = sourceWire.gate_name;\n\n  const finding: Finding = { source };\n  if (f.signal?.type) {\n    const signal: FindingSignal = { type: f.signal.type };\n    if (f.signal.confidence !== undefined) signal.confidence = f.signal.confidence;\n    finding.signal = signal;\n  }\n  if (f.outcome?.action) {\n    const outcome: FindingOutcome = { action: f.outcome.action };\n    finding.outcome = outcome;\n  }\n  if (f.evidence && Object.keys(f.evidence).length > 0) {\n    finding.evidence = f.evidence;\n  }\n  return finding;\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; message?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACLA,IAAM,gBAAgB;AACtB,IAAM,qBAAqB;AAoCpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,eAAe;AAAA,MAChE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,MAAI,UAAU,QAAQ;AACtB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,cAAU,EAAE,GAAG,SAAS,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACpF;AACA,QAAM,OAAgC,EAAE,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,SAAU,MAAK,WAAW,QAAQ;AAC9C,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AACnD,MAAI,QAAQ,cAAc,OAAO,KAAK,QAAQ,UAAU,EAAE,SAAS,EAAG,MAAK,aAAa,QAAQ;AAChG,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QAAgC;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,EAC3B;AACA,MAAI,WAAW,SAAS,QAAW;AACjC,UAAM,QAAQ,OAAO,WAAW,SAAS,WAAW,IAAI,YAAY,EAAE,OAAO,WAAW,IAAI,IAAI,WAAW;AAC3G,UAAM,OAAO,SAAS,KAAK;AAAA,EAC7B;AACA,MAAI,WAAW,QAAQ,OAAW,OAAM,MAAM,WAAW;AACzD,SAAO;AACT;AAGA,SAAS,SAAS,OAA2B;AAC3C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,OAAQ;AAC7C,cAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;AAAA,EAChE;AACA,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG,IAAI,kBAAkB;AAAA,IACtD,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,mBAAmB,GAAyB;AACnD,QAAM,aAAa,EAAE,UAAU,CAAC;AAChC,QAAM,SAAwB;AAAA,IAC5B,MAAM,WAAW,QAAQ;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,OAAW,QAAO,SAAS,WAAW;AAChE,MAAI,WAAW,gBAAgB,OAAW,QAAO,aAAa,WAAW;AACzE,MAAI,WAAW,kBAAkB,OAAW,QAAO,eAAe,WAAW;AAC7E,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AACrE,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AAErE,QAAM,UAAmB,EAAE,OAAO;AAClC,MAAI,EAAE,QAAQ,MAAM;AAClB,UAAM,SAAwB,EAAE,MAAM,EAAE,OAAO,KAAK;AACpD,QAAI,EAAE,OAAO,eAAe,OAAW,QAAO,aAAa,EAAE,OAAO;AACpE,YAAQ,SAAS;AAAA,EACnB;AACA,MAAI,EAAE,SAAS,QAAQ;AACrB,UAAM,UAA0B,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAC3D,YAAQ,UAAU;AAAA,EACpB;AACA,MAAI,EAAE,YAAY,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,GAAG;AACpD,YAAQ,WAAW,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,SAAS,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM;AACnF,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/dist/index.d.cts

@@ -1,100 +1,4 @@
-/** Traffic side being evaluated; rules are scoped per side. Defaults to "input" server-side. */
-type Direction = "input" | "output";
-/** Traffic protocol the policy rules are scoped to. Defaults to "all" server-side. */
-type Protocol = "all" | "llm" | "mcp" | "a2a";
-/** A document evaluated alongside the payload by file-aware plugins. */
-interface Attachment {
-    filename: string;
-    contentType: string;
-    /** Raw file content; strings are encoded as UTF-8, then base64 on the wire. Provide `data` or `url`. */
-    data?: Uint8Array | string;
-    /** URL for the server to fetch instead of inlining `data`. */
-    url?: string;
-}
-/** Payload for a guard evaluation (`POST /v1/evaluate`). */
-interface GuardRequest {
-    /** The content to evaluate, e.g. `{ input: "..." }` or provider-shaped fields. Required. */
-    payload: Record<string, unknown>;
-    /** Traffic side; the server defaults to "input" when omitted. */
-    direction?: Direction;
-    /** Traffic protocol; the server defaults to "all" when omitted. */
-    protocol?: Protocol;
-    /** Groups multi-turn traffic; the server synthesises one when omitted. */
-    sessionId?: string;
-    /** Identifies the end user on whose behalf the request runs. */
-    consumerId?: string;
-    /** Optional routing hints. Server-side key: `content_type` (overrides the payload content type). */
-    attributes?: Record<string, unknown>;
-    /** Documents to evaluate; folded into `payload.attachments` on the wire. */
-    attachments?: Attachment[];
-}
-/** Who produced the finding — a detector or a gate. */
-interface FindingSource {
-    kind: string;
-    plugin?: string;
-    detectorId?: string;
-    detectorName?: string;
-    policyId?: string;
-    gateName?: string;
-}
-/** Detection signal when the finding fired (omitted for observational-only runs). */
-interface FindingSignal {
-    type: string;
-    confidence?: number;
-}
-/** Applied execution-rule action when the finding enforced an outcome. */
-interface FindingOutcome {
-    action: string;
-}
-/**
- * A single finding from the evaluate response.
- * Observational (below-threshold) runs keep `source` + `evidence` only.
- */
-interface Finding {
-    source: FindingSource;
-    signal?: FindingSignal;
-    outcome?: FindingOutcome;
-    evidence?: Record<string, unknown>;
-}
-/**
- * Verdict returned by POST /v1/evaluate. TrustGuard detects; the caller enforces:
- * block when `status` is "block" (`isBlocked` is the convenience signal).
- */
-interface GuardResponse {
-    /** Most restrictive verdict: "allow", "block", "transform", "report", or "" when omitted. */
-    status: string;
-    /** Convenience flag: true when `status === "block"`. */
-    isBlocked: boolean;
-    /** The payload as rewritten by in-flight masking, null when untouched. */
-    transformedPayload: Record<string, unknown> | null;
-    /** What every plugin / gate in the policy chain reported. */
-    findings: Finding[];
-    /** Correlation ids for TrustGuard telemetry. */
-    traceId: string;
-    requestId: string;
-}
-/** Configuration for the TrustGuard client. */
-interface TrustGuardOptions {
-    /** Base URL of the TrustGuard deployment, e.g. https://trustguard.neuraltrust.ai */
-    baseUrl: string;
-    /** Collector API key, sent as a Bearer token. */
-    apiKey: string;
-    /** Per-request timeout in milliseconds. Default 10000. */
-    timeoutMs?: number;
-    /** Custom fetch implementation (proxies, test doubles). Default globalThis.fetch. */
-    fetch?: typeof fetch;
-}
-
-/** Client for the TrustGuard runtime evaluate API. */
-declare class TrustGuard {
-    #private;
-    constructor(options: TrustGuardOptions);
-    /**
-     * Evaluates the request against the policy attached to the API key and
-     * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.
-     */
-    guard(request: GuardRequest): Promise<GuardResponse>;
-}
+export { A as Attachment, D as Direction, F as Finding, a as FindingOutcome, b as FindingSignal, c as FindingSource, d as GuardRequest, G as GuardResponse, P as Protocol, T as TrustGuard, e as TrustGuardOptions } from './client-ZoD3M6yg.cjs';
 
 /**
  * A non-2xx response from the TrustGuard API, carrying the status code and the
@@ -108,4 +12,4 @@ declare class TrustGuardAPIError extends Error {
     constructor(status: number, message: string, traceId: string, requestId: string);
 }
 
-export { type Attachment, type Direction, type Finding, type FindingOutcome, type FindingSignal, type FindingSource, type GuardRequest, type GuardResponse, type Protocol, TrustGuard, TrustGuardAPIError, type TrustGuardOptions };
+export { TrustGuardAPIError };

package/dist/index.d.ts

@@ -1,100 +1,4 @@
-/** Traffic side being evaluated; rules are scoped per side. Defaults to "input" server-side. */
-type Direction = "input" | "output";
-/** Traffic protocol the policy rules are scoped to. Defaults to "all" server-side. */
-type Protocol = "all" | "llm" | "mcp" | "a2a";
-/** A document evaluated alongside the payload by file-aware plugins. */
-interface Attachment {
-    filename: string;
-    contentType: string;
-    /** Raw file content; strings are encoded as UTF-8, then base64 on the wire. Provide `data` or `url`. */
-    data?: Uint8Array | string;
-    /** URL for the server to fetch instead of inlining `data`. */
-    url?: string;
-}
-/** Payload for a guard evaluation (`POST /v1/evaluate`). */
-interface GuardRequest {
-    /** The content to evaluate, e.g. `{ input: "..." }` or provider-shaped fields. Required. */
-    payload: Record<string, unknown>;
-    /** Traffic side; the server defaults to "input" when omitted. */
-    direction?: Direction;
-    /** Traffic protocol; the server defaults to "all" when omitted. */
-    protocol?: Protocol;
-    /** Groups multi-turn traffic; the server synthesises one when omitted. */
-    sessionId?: string;
-    /** Identifies the end user on whose behalf the request runs. */
-    consumerId?: string;
-    /** Optional routing hints. Server-side key: `content_type` (overrides the payload content type). */
-    attributes?: Record<string, unknown>;
-    /** Documents to evaluate; folded into `payload.attachments` on the wire. */
-    attachments?: Attachment[];
-}
-/** Who produced the finding — a detector or a gate. */
-interface FindingSource {
-    kind: string;
-    plugin?: string;
-    detectorId?: string;
-    detectorName?: string;
-    policyId?: string;
-    gateName?: string;
-}
-/** Detection signal when the finding fired (omitted for observational-only runs). */
-interface FindingSignal {
-    type: string;
-    confidence?: number;
-}
-/** Applied execution-rule action when the finding enforced an outcome. */
-interface FindingOutcome {
-    action: string;
-}
-/**
- * A single finding from the evaluate response.
- * Observational (below-threshold) runs keep `source` + `evidence` only.
- */
-interface Finding {
-    source: FindingSource;
-    signal?: FindingSignal;
-    outcome?: FindingOutcome;
-    evidence?: Record<string, unknown>;
-}
-/**
- * Verdict returned by POST /v1/evaluate. TrustGuard detects; the caller enforces:
- * block when `status` is "block" (`isBlocked` is the convenience signal).
- */
-interface GuardResponse {
-    /** Most restrictive verdict: "allow", "block", "transform", "report", or "" when omitted. */
-    status: string;
-    /** Convenience flag: true when `status === "block"`. */
-    isBlocked: boolean;
-    /** The payload as rewritten by in-flight masking, null when untouched. */
-    transformedPayload: Record<string, unknown> | null;
-    /** What every plugin / gate in the policy chain reported. */
-    findings: Finding[];
-    /** Correlation ids for TrustGuard telemetry. */
-    traceId: string;
-    requestId: string;
-}
-/** Configuration for the TrustGuard client. */
-interface TrustGuardOptions {
-    /** Base URL of the TrustGuard deployment, e.g. https://trustguard.neuraltrust.ai */
-    baseUrl: string;
-    /** Collector API key, sent as a Bearer token. */
-    apiKey: string;
-    /** Per-request timeout in milliseconds. Default 10000. */
-    timeoutMs?: number;
-    /** Custom fetch implementation (proxies, test doubles). Default globalThis.fetch. */
-    fetch?: typeof fetch;
-}
-
-/** Client for the TrustGuard runtime evaluate API. */
-declare class TrustGuard {
-    #private;
-    constructor(options: TrustGuardOptions);
-    /**
-     * Evaluates the request against the policy attached to the API key and
-     * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.
-     */
-    guard(request: GuardRequest): Promise<GuardResponse>;
-}
+export { A as Attachment, D as Direction, F as Finding, a as FindingOutcome, b as FindingSignal, c as FindingSource, d as GuardRequest, G as GuardResponse, P as Protocol, T as TrustGuard, e as TrustGuardOptions } from './client-ZoD3M6yg.js';
 
 /**
  * A non-2xx response from the TrustGuard API, carrying the status code and the
@@ -108,4 +12,4 @@ declare class TrustGuardAPIError extends Error {
     constructor(status: number, message: string, traceId: string, requestId: string);
 }
 
-export { type Attachment, type Direction, type Finding, type FindingOutcome, type FindingSignal, type FindingSource, type GuardRequest, type GuardResponse, type Protocol, TrustGuard, TrustGuardAPIError, type TrustGuardOptions };
+export { TrustGuardAPIError };

package/dist/index.js

@@ -76,12 +76,19 @@ function serializeAttachment(attachment) {
     content_type: attachment.contentType
   };
   if (attachment.data !== void 0) {
-    const bytes = typeof attachment.data === "string" ? Buffer.from(attachment.data, "utf-8") : Buffer.from(attachment.data);
-    entry.data = bytes.toString("base64");
+    const bytes = typeof attachment.data === "string" ? new TextEncoder().encode(attachment.data) : attachment.data;
+    entry.data = toBase64(bytes);
   }
   if (attachment.url !== void 0) entry.url = attachment.url;
   return entry;
 }
+function toBase64(bytes) {
+  let binary = "";
+  for (let i = 0; i < bytes.length; i += 32768) {
+    binary += String.fromCharCode(...bytes.subarray(i, i + 32768));
+  }
+  return btoa(binary);
+}
 function deserializeResponse(wire) {
   const status = wire.status ?? "";
   return {

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type {\n  Attachment,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  TrustGuardOptions,\n} from \"./types.js\";\n\nconst EVALUATE_PATH = \"/v1/evaluate\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFindingSource {\n  kind?: string;\n  plugin?: string;\n  detector_id?: string;\n  detector_name?: string;\n  policy_id?: string;\n  gate_name?: string;\n}\n\ninterface WireFindingSignal {\n  type?: string;\n  confidence?: number;\n}\n\ninterface WireFindingOutcome {\n  action?: string;\n}\n\ninterface WireFinding {\n  source?: WireFindingSource;\n  signal?: WireFindingSignal;\n  outcome?: WireFindingOutcome;\n  evidence?: Record<string, unknown>;\n}\n\ninterface WireResponse {\n  status?: string;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime evaluate API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.payload) {\n      throw new Error(\"TrustGuard: request payload is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  let payload = request.payload;\n  if (request.attachments?.length) {\n    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };\n  }\n  const body: Record<string, unknown> = { payload };\n  if (request.direction) body.direction = request.direction;\n  if (request.protocol) body.protocol = request.protocol;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const entry: Record<string, string> = {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n  };\n  if (attachment.data !== undefined) {\n    const bytes =\n      typeof attachment.data === \"string\" ? Buffer.from(attachment.data, \"utf-8\") : Buffer.from(attachment.data);\n    entry.data = bytes.toString(\"base64\");\n  }\n  if (attachment.url !== undefined) entry.url = attachment.url;\n  return entry;\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  const status = wire.status ?? \"\";\n  return {\n    status,\n    isBlocked: status === \"block\",\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(deserializeFinding),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction deserializeFinding(f: WireFinding): Finding {\n  const sourceWire = f.source ?? {};\n  const source: FindingSource = {\n    kind: sourceWire.kind ?? \"\",\n  };\n  if (sourceWire.plugin !== undefined) source.plugin = sourceWire.plugin;\n  if (sourceWire.detector_id !== undefined) source.detectorId = sourceWire.detector_id;\n  if (sourceWire.detector_name !== undefined) source.detectorName = sourceWire.detector_name;\n  if (sourceWire.policy_id !== undefined) source.policyId = sourceWire.policy_id;\n  if (sourceWire.gate_name !== undefined) source.gateName = sourceWire.gate_name;\n\n  const finding: Finding = { source };\n  if (f.signal?.type) {\n    const signal: FindingSignal = { type: f.signal.type };\n    if (f.signal.confidence !== undefined) signal.confidence = f.signal.confidence;\n    finding.signal = signal;\n  }\n  if (f.outcome?.action) {\n    const outcome: FindingOutcome = { action: f.outcome.action };\n    finding.outcome = outcome;\n  }\n  if (f.evidence && Object.keys(f.evidence).length > 0) {\n    finding.evidence = f.evidence;\n  }\n  return finding;\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; message?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACLA,IAAM,gBAAgB;AACtB,IAAM,qBAAqB;AAoCpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,eAAe;AAAA,MAChE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,MAAI,UAAU,QAAQ;AACtB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,cAAU,EAAE,GAAG,SAAS,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACpF;AACA,QAAM,OAAgC,EAAE,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,SAAU,MAAK,WAAW,QAAQ;AAC9C,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AACnD,MAAI,QAAQ,cAAc,OAAO,KAAK,QAAQ,UAAU,EAAE,SAAS,EAAG,MAAK,aAAa,QAAQ;AAChG,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QAAgC;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,EAC3B;AACA,MAAI,WAAW,SAAS,QAAW;AACjC,UAAM,QACJ,OAAO,WAAW,SAAS,WAAW,OAAO,KAAK,WAAW,MAAM,OAAO,IAAI,OAAO,KAAK,WAAW,IAAI;AAC3G,UAAM,OAAO,MAAM,SAAS,QAAQ;AAAA,EACtC;AACA,MAAI,WAAW,QAAQ,OAAW,OAAM,MAAM,WAAW;AACzD,SAAO;AACT;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG,IAAI,kBAAkB;AAAA,IACtD,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,mBAAmB,GAAyB;AACnD,QAAM,aAAa,EAAE,UAAU,CAAC;AAChC,QAAM,SAAwB;AAAA,IAC5B,MAAM,WAAW,QAAQ;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,OAAW,QAAO,SAAS,WAAW;AAChE,MAAI,WAAW,gBAAgB,OAAW,QAAO,aAAa,WAAW;AACzE,MAAI,WAAW,kBAAkB,OAAW,QAAO,eAAe,WAAW;AAC7E,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AACrE,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AAErE,QAAM,UAAmB,EAAE,OAAO;AAClC,MAAI,EAAE,QAAQ,MAAM;AAClB,UAAM,SAAwB,EAAE,MAAM,EAAE,OAAO,KAAK;AACpD,QAAI,EAAE,OAAO,eAAe,OAAW,QAAO,aAAa,EAAE,OAAO;AACpE,YAAQ,SAAS;AAAA,EACnB;AACA,MAAI,EAAE,SAAS,QAAQ;AACrB,UAAM,UAA0B,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAC3D,YAAQ,UAAU;AAAA,EACpB;AACA,MAAI,EAAE,YAAY,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,GAAG;AACpD,YAAQ,WAAW,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,SAAS,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM;AACnF,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}
+{"version":3,"sources":["../src/errors.ts","../src/client.ts"],"sourcesContent":["/**\n * A non-2xx response from the TrustGuard API, carrying the status code and the\n * correlation ids needed to chase the request in telemetry. Transport-level\n * failures (network errors, timeouts) are thrown as-is instead.\n */\nexport class TrustGuardAPIError extends Error {\n  readonly status: number;\n  readonly traceId: string;\n  readonly requestId: string;\n\n  constructor(status: number, message: string, traceId: string, requestId: string) {\n    super(`TrustGuard API error ${status}: ${message} (trace_id=${traceId}, request_id=${requestId})`);\n    this.name = \"TrustGuardAPIError\";\n    this.status = status;\n    this.traceId = traceId;\n    this.requestId = requestId;\n  }\n}\n","import { TrustGuardAPIError } from \"./errors.js\";\nimport type {\n  Attachment,\n  Finding,\n  FindingOutcome,\n  FindingSignal,\n  FindingSource,\n  GuardRequest,\n  GuardResponse,\n  TrustGuardOptions,\n} from \"./types.js\";\n\nconst EVALUATE_PATH = \"/v1/evaluate\";\nconst DEFAULT_TIMEOUT_MS = 10_000;\n\ninterface WireFindingSource {\n  kind?: string;\n  plugin?: string;\n  detector_id?: string;\n  detector_name?: string;\n  policy_id?: string;\n  gate_name?: string;\n}\n\ninterface WireFindingSignal {\n  type?: string;\n  confidence?: number;\n}\n\ninterface WireFindingOutcome {\n  action?: string;\n}\n\ninterface WireFinding {\n  source?: WireFindingSource;\n  signal?: WireFindingSignal;\n  outcome?: WireFindingOutcome;\n  evidence?: Record<string, unknown>;\n}\n\ninterface WireResponse {\n  status?: string;\n  transformed_payload?: Record<string, unknown> | null;\n  findings?: WireFinding[];\n  trace_id?: string;\n  request_id?: string;\n}\n\n/** Client for the TrustGuard runtime evaluate API. */\nexport class TrustGuard {\n  readonly #baseUrl: string;\n  readonly #apiKey: string;\n  readonly #timeoutMs: number;\n  readonly #fetch: typeof fetch;\n\n  constructor(options: TrustGuardOptions) {\n    const baseUrl = options.baseUrl?.trim().replace(/\\/+$/, \"\");\n    if (!baseUrl) {\n      throw new Error(\"TrustGuard: baseUrl is required\");\n    }\n    if (!options.apiKey?.trim()) {\n      throw new Error(\"TrustGuard: apiKey is required\");\n    }\n    this.#baseUrl = baseUrl;\n    this.#apiKey = options.apiKey;\n    this.#timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;\n    this.#fetch = options.fetch ?? globalThis.fetch;\n  }\n\n  /**\n   * Evaluates the request against the policy attached to the API key and\n   * returns the verdict. Throws TrustGuardAPIError on non-2xx responses.\n   */\n  async guard(request: GuardRequest): Promise<GuardResponse> {\n    if (!request.payload) {\n      throw new Error(\"TrustGuard: request payload is required\");\n    }\n\n    const response = await this.#fetch(this.#baseUrl + EVALUATE_PATH, {\n      method: \"POST\",\n      headers: {\n        Authorization: `Bearer ${this.#apiKey}`,\n        \"Content-Type\": \"application/json\",\n      },\n      body: JSON.stringify(serializeRequest(request)),\n      signal: AbortSignal.timeout(this.#timeoutMs),\n    });\n\n    const text = await response.text();\n    if (!response.ok) {\n      throw apiError(response.status, text);\n    }\n\n    return deserializeResponse(parseJson(text) ?? {});\n  }\n}\n\n/** Maps the camelCase request onto the snake_case wire format, omitting empty optionals (the server rejects unknown top-level fields). */\nfunction serializeRequest(request: GuardRequest): Record<string, unknown> {\n  let payload = request.payload;\n  if (request.attachments?.length) {\n    payload = { ...payload, attachments: request.attachments.map(serializeAttachment) };\n  }\n  const body: Record<string, unknown> = { payload };\n  if (request.direction) body.direction = request.direction;\n  if (request.protocol) body.protocol = request.protocol;\n  if (request.sessionId) body.session_id = request.sessionId;\n  if (request.consumerId) body.consumer_id = request.consumerId;\n  if (request.attributes && Object.keys(request.attributes).length > 0) body.attributes = request.attributes;\n  return body;\n}\n\nfunction serializeAttachment(attachment: Attachment): Record<string, string> {\n  const entry: Record<string, string> = {\n    filename: attachment.filename,\n    content_type: attachment.contentType,\n  };\n  if (attachment.data !== undefined) {\n    const bytes = typeof attachment.data === \"string\" ? new TextEncoder().encode(attachment.data) : attachment.data;\n    entry.data = toBase64(bytes);\n  }\n  if (attachment.url !== undefined) entry.url = attachment.url;\n  return entry;\n}\n\n/** Base64 without Buffer, so the client also runs on edge runtimes. Chunked to stay under the argument limit of fromCharCode. */\nfunction toBase64(bytes: Uint8Array): string {\n  let binary = \"\";\n  for (let i = 0; i < bytes.length; i += 0x8000) {\n    binary += String.fromCharCode(...bytes.subarray(i, i + 0x8000));\n  }\n  return btoa(binary);\n}\n\nfunction deserializeResponse(wire: WireResponse): GuardResponse {\n  const status = wire.status ?? \"\";\n  return {\n    status,\n    isBlocked: status === \"block\",\n    transformedPayload: wire.transformed_payload ?? null,\n    findings: (wire.findings ?? []).map(deserializeFinding),\n    traceId: wire.trace_id ?? \"\",\n    requestId: wire.request_id ?? \"\",\n  };\n}\n\nfunction deserializeFinding(f: WireFinding): Finding {\n  const sourceWire = f.source ?? {};\n  const source: FindingSource = {\n    kind: sourceWire.kind ?? \"\",\n  };\n  if (sourceWire.plugin !== undefined) source.plugin = sourceWire.plugin;\n  if (sourceWire.detector_id !== undefined) source.detectorId = sourceWire.detector_id;\n  if (sourceWire.detector_name !== undefined) source.detectorName = sourceWire.detector_name;\n  if (sourceWire.policy_id !== undefined) source.policyId = sourceWire.policy_id;\n  if (sourceWire.gate_name !== undefined) source.gateName = sourceWire.gate_name;\n\n  const finding: Finding = { source };\n  if (f.signal?.type) {\n    const signal: FindingSignal = { type: f.signal.type };\n    if (f.signal.confidence !== undefined) signal.confidence = f.signal.confidence;\n    finding.signal = signal;\n  }\n  if (f.outcome?.action) {\n    const outcome: FindingOutcome = { action: f.outcome.action };\n    finding.outcome = outcome;\n  }\n  if (f.evidence && Object.keys(f.evidence).length > 0) {\n    finding.evidence = f.evidence;\n  }\n  return finding;\n}\n\nfunction apiError(status: number, text: string): TrustGuardAPIError {\n  const payload = parseJson(text) as { error?: string; message?: string; trace_id?: string; request_id?: string } | undefined;\n  const message = payload?.error || payload?.message || text.trim() || `HTTP ${status}`;\n  return new TrustGuardAPIError(status, message, payload?.trace_id ?? \"\", payload?.request_id ?? \"\");\n}\n\nfunction parseJson(text: string): WireResponse | undefined {\n  try {\n    return JSON.parse(text) as WireResponse;\n  } catch {\n    return undefined;\n  }\n}\n"],"mappings":";AAKO,IAAM,qBAAN,cAAiC,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,QAAgB,SAAiB,SAAiB,WAAmB;AAC/E,UAAM,wBAAwB,MAAM,KAAK,OAAO,cAAc,OAAO,gBAAgB,SAAS,GAAG;AACjG,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,UAAU;AACf,SAAK,YAAY;AAAA,EACnB;AACF;;;ACLA,IAAM,gBAAgB;AACtB,IAAM,qBAAqB;AAoCpB,IAAM,aAAN,MAAiB;AAAA,EACb;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,SAA4B;AACtC,UAAM,UAAU,QAAQ,SAAS,KAAK,EAAE,QAAQ,QAAQ,EAAE;AAC1D,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iCAAiC;AAAA,IACnD;AACA,QAAI,CAAC,QAAQ,QAAQ,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,gCAAgC;AAAA,IAClD;AACA,SAAK,WAAW;AAChB,SAAK,UAAU,QAAQ;AACvB,SAAK,aAAa,QAAQ,aAAa;AACvC,SAAK,SAAS,QAAQ,SAAS,WAAW;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,MAAM,SAA+C;AACzD,QAAI,CAAC,QAAQ,SAAS;AACpB,YAAM,IAAI,MAAM,yCAAyC;AAAA,IAC3D;AAEA,UAAM,WAAW,MAAM,KAAK,OAAO,KAAK,WAAW,eAAe;AAAA,MAChE,QAAQ;AAAA,MACR,SAAS;AAAA,QACP,eAAe,UAAU,KAAK,OAAO;AAAA,QACrC,gBAAgB;AAAA,MAClB;AAAA,MACA,MAAM,KAAK,UAAU,iBAAiB,OAAO,CAAC;AAAA,MAC9C,QAAQ,YAAY,QAAQ,KAAK,UAAU;AAAA,IAC7C,CAAC;AAED,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,SAAS,SAAS,QAAQ,IAAI;AAAA,IACtC;AAEA,WAAO,oBAAoB,UAAU,IAAI,KAAK,CAAC,CAAC;AAAA,EAClD;AACF;AAGA,SAAS,iBAAiB,SAAgD;AACxE,MAAI,UAAU,QAAQ;AACtB,MAAI,QAAQ,aAAa,QAAQ;AAC/B,cAAU,EAAE,GAAG,SAAS,aAAa,QAAQ,YAAY,IAAI,mBAAmB,EAAE;AAAA,EACpF;AACA,QAAM,OAAgC,EAAE,QAAQ;AAChD,MAAI,QAAQ,UAAW,MAAK,YAAY,QAAQ;AAChD,MAAI,QAAQ,SAAU,MAAK,WAAW,QAAQ;AAC9C,MAAI,QAAQ,UAAW,MAAK,aAAa,QAAQ;AACjD,MAAI,QAAQ,WAAY,MAAK,cAAc,QAAQ;AACnD,MAAI,QAAQ,cAAc,OAAO,KAAK,QAAQ,UAAU,EAAE,SAAS,EAAG,MAAK,aAAa,QAAQ;AAChG,SAAO;AACT;AAEA,SAAS,oBAAoB,YAAgD;AAC3E,QAAM,QAAgC;AAAA,IACpC,UAAU,WAAW;AAAA,IACrB,cAAc,WAAW;AAAA,EAC3B;AACA,MAAI,WAAW,SAAS,QAAW;AACjC,UAAM,QAAQ,OAAO,WAAW,SAAS,WAAW,IAAI,YAAY,EAAE,OAAO,WAAW,IAAI,IAAI,WAAW;AAC3G,UAAM,OAAO,SAAS,KAAK;AAAA,EAC7B;AACA,MAAI,WAAW,QAAQ,OAAW,OAAM,MAAM,WAAW;AACzD,SAAO;AACT;AAGA,SAAS,SAAS,OAA2B;AAC3C,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK,OAAQ;AAC7C,cAAU,OAAO,aAAa,GAAG,MAAM,SAAS,GAAG,IAAI,KAAM,CAAC;AAAA,EAChE;AACA,SAAO,KAAK,MAAM;AACpB;AAEA,SAAS,oBAAoB,MAAmC;AAC9D,QAAM,SAAS,KAAK,UAAU;AAC9B,SAAO;AAAA,IACL;AAAA,IACA,WAAW,WAAW;AAAA,IACtB,oBAAoB,KAAK,uBAAuB;AAAA,IAChD,WAAW,KAAK,YAAY,CAAC,GAAG,IAAI,kBAAkB;AAAA,IACtD,SAAS,KAAK,YAAY;AAAA,IAC1B,WAAW,KAAK,cAAc;AAAA,EAChC;AACF;AAEA,SAAS,mBAAmB,GAAyB;AACnD,QAAM,aAAa,EAAE,UAAU,CAAC;AAChC,QAAM,SAAwB;AAAA,IAC5B,MAAM,WAAW,QAAQ;AAAA,EAC3B;AACA,MAAI,WAAW,WAAW,OAAW,QAAO,SAAS,WAAW;AAChE,MAAI,WAAW,gBAAgB,OAAW,QAAO,aAAa,WAAW;AACzE,MAAI,WAAW,kBAAkB,OAAW,QAAO,eAAe,WAAW;AAC7E,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AACrE,MAAI,WAAW,cAAc,OAAW,QAAO,WAAW,WAAW;AAErE,QAAM,UAAmB,EAAE,OAAO;AAClC,MAAI,EAAE,QAAQ,MAAM;AAClB,UAAM,SAAwB,EAAE,MAAM,EAAE,OAAO,KAAK;AACpD,QAAI,EAAE,OAAO,eAAe,OAAW,QAAO,aAAa,EAAE,OAAO;AACpE,YAAQ,SAAS;AAAA,EACnB;AACA,MAAI,EAAE,SAAS,QAAQ;AACrB,UAAM,UAA0B,EAAE,QAAQ,EAAE,QAAQ,OAAO;AAC3D,YAAQ,UAAU;AAAA,EACpB;AACA,MAAI,EAAE,YAAY,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,GAAG;AACpD,YAAQ,WAAW,EAAE;AAAA,EACvB;AACA,SAAO;AACT;AAEA,SAAS,SAAS,QAAgB,MAAkC;AAClE,QAAM,UAAU,UAAU,IAAI;AAC9B,QAAM,UAAU,SAAS,SAAS,SAAS,WAAW,KAAK,KAAK,KAAK,QAAQ,MAAM;AACnF,SAAO,IAAI,mBAAmB,QAAQ,SAAS,SAAS,YAAY,IAAI,SAAS,cAAc,EAAE;AACnG;AAEA,SAAS,UAAU,MAAwC;AACzD,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@neuraltrust/trustguard-sdk",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Official Node.js SDK for the TrustGuard runtime evaluate API (POST /v1/evaluate)",
   "license": "MIT",
   "author": "NeuralTrust",
@@ -18,7 +18,9 @@
     "trustguard",
     "guardrails",
     "llm-security",
-    "ai-firewall"
+    "ai-firewall",
+    "vercel",
+    "ai-sdk"
   ],
   "type": "module",
   "main": "./dist/index.cjs",
@@ -29,6 +31,11 @@
       "types": "./dist/index.d.ts",
       "import": "./dist/index.js",
       "require": "./dist/index.cjs"
+    },
+    "./ai-sdk": {
+      "types": "./dist/ai-sdk/index.d.ts",
+      "import": "./dist/ai-sdk/index.js",
+      "require": "./dist/ai-sdk/index.cjs"
     }
   },
   "files": [
@@ -44,10 +51,25 @@
     "test": "vitest run",
     "prepublishOnly": "npm run lint && npm run test && npm run build"
   },
+  "peerDependencies": {
+    "@ai-sdk/provider": "^4.0.0",
+    "ai": "^7.0.0"
+  },
+  "peerDependenciesMeta": {
+    "@ai-sdk/provider": {
+      "optional": true
+    },
+    "ai": {
+      "optional": true
+    }
+  },
   "devDependencies": {
+    "@ai-sdk/provider": "^4.0.18",
     "@types/node": "^22.10.2",
+    "ai": "^7.0.112",
     "tsup": "^8.3.5",
     "typescript": "^5.7.2",
-    "vitest": "^4.1.9"
+    "vitest": "^4.1.9",
+    "zod": "^4.6.5"
   }
 }