@simplr-ai/express 1.0.0

package/dist/fastify.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts","../src/core.ts","../src/fastify.ts"],"sourcesContent":["/**\n * Thin internal client.\n *\n * This is a ~40-line port of the minimal call path from `@simplr-ai/node`\n * (`apiRequest` + `check` + `edge.ingestLogs`) so that this package builds and\n * tests without an unbuilt workspace dependency or any network access.\n *\n * In production this package pairs with `@simplr-ai/node`; the endpoints, auth\n * header (`X-API-Key`), `{ success, message, content }` envelope unwrapping, and\n * 15s default timeout here are byte-for-byte compatible with that SDK and the\n * Simplr API contract.\n */\nimport type { CheckInput, CheckResult, EdgeLogEntry } from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.simplr.sh\";\n\n/** Thrown when the Simplr API returns a non-2xx response or the request fails. */\nexport class SimplrError extends Error {\n  readonly status: number;\n  readonly body: unknown;\n  constructor(message: string, status: number, body: unknown) {\n    super(message);\n    this.name = \"SimplrError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport interface ClientConfig {\n  apiKey: string;\n  baseUrl?: string;\n  timeoutMs?: number;\n  fetch?: typeof fetch;\n}\n\nexport interface SimplrClient {\n  check(input: CheckInput): Promise<CheckResult>;\n  ingestLogs(deviceId: string, logs: EdgeLogEntry[]): Promise<unknown>;\n}\n\nexport function createClient(config: ClientConfig): SimplrClient {\n  if (!config?.apiKey) throw new Error(\"Simplr: `apiKey` is required\");\n  const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n  const timeoutMs = config.timeoutMs ?? 15000;\n  const fetchImpl = config.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new Error(\n      \"Simplr: no global fetch available — use Node 18+ or pass `fetch` in options\",\n    );\n  }\n\n  async function apiRequest<T>(method: string, path: string, body?: unknown): Promise<T> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const res = await fetchImpl(`${baseUrl}${path}`, {\n        method,\n        headers: { \"Content-Type\": \"application/json\", \"X-API-Key\": config.apiKey },\n        body: body !== undefined ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n      const text = await res.text();\n      let parsed: any;\n      try {\n        parsed = text ? JSON.parse(text) : undefined;\n      } catch {\n        parsed = text;\n      }\n      if (!res.ok) {\n        const message =\n          (parsed && (parsed.message || parsed.error)) || `Simplr API error ${res.status}`;\n        throw new SimplrError(message, res.status, parsed);\n      }\n      return (parsed && typeof parsed === \"object\" && \"content\" in parsed\n        ? parsed.content\n        : parsed) as T;\n    } catch (err) {\n      if (err instanceof SimplrError) throw err;\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new SimplrError(`Request to ${path} timed out after ${timeoutMs}ms`, 0, null);\n      }\n      throw new SimplrError(err instanceof Error ? err.message : \"Network error\", 0, null);\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  return {\n    check: (input) => apiRequest<CheckResult>(\"POST\", \"/v1/check\", input),\n    ingestLogs: (deviceId, logs) =>\n      apiRequest(\"POST\", \"/v1/edge/logs\", { device_id: deviceId, logs }),\n  };\n}\n","/**\n * Framework-agnostic guard engine.\n *\n * `createGuard` returns an object that, given any request-like object, builds a\n * `CheckInput`, calls `/v1/check`, decides whether to block, optionally ships an\n * edge log, and fails open on error. Framework adapters (express/fastify/hono/\n * next) are thin wrappers over this engine.\n */\nimport { createClient, type SimplrClient } from \"./client.js\";\nimport type {\n  BlockThreshold,\n  CheckInput,\n  CheckResult,\n  GuardContext,\n  GuardOptions,\n  GuardOutcome,\n  RiskLevel,\n} from \"./types.js\";\n\nconst RISK_ORDER: Record<RiskLevel, number> = {\n  low: 0,\n  medium: 1,\n  high: 2,\n  critical: 3,\n};\n\nconst DEFAULT_DEVICE_ID = \"simplr-edge-middleware\";\nconst DEFAULT_THRESHOLD: RiskLevel = \"high\";\n\n/** Numeric rank of a risk level. Unknown levels rank as the lowest (0). */\nexport function riskRank(level: RiskLevel | string | undefined): number {\n  return RISK_ORDER[level as RiskLevel] ?? 0;\n}\n\n/** True when `level` is at least `min` in the low<medium<high<critical ordering. */\nexport function riskAtLeast(level: RiskLevel | string | undefined, min: RiskLevel): boolean {\n  return riskRank(level) >= riskRank(min);\n}\n\n/** Read a header from either a plain bag (lowercase keys) or a Headers-like getter. */\nfunction readHeader(headers: unknown, name: string): string | undefined {\n  if (!headers) return undefined;\n  const h = headers as any;\n  if (typeof h.get === \"function\") {\n    const v = h.get(name);\n    return v == null ? undefined : String(v);\n  }\n  // Plain object: try the lowercase key, then a case-insensitive scan.\n  const lower = name.toLowerCase();\n  if (lower in h && h[lower] != null) return String(h[lower]);\n  for (const key of Object.keys(h)) {\n    if (key.toLowerCase() === lower && h[key] != null) return String(h[key]);\n  }\n  return undefined;\n}\n\n/** Best-effort client IP from common header and socket locations. */\nfunction extractIp(req: any): string | undefined {\n  const fwd = readHeader(req?.headers, \"x-forwarded-for\");\n  if (fwd) return fwd.split(\",\")[0]!.trim();\n  const real = readHeader(req?.headers, \"x-real-ip\");\n  if (real) return real;\n  return (\n    req?.ip ||\n    req?.socket?.remoteAddress ||\n    req?.connection?.remoteAddress ||\n    undefined\n  );\n}\n\n/**\n * Default request → CheckInput extractor. Pulls the client IP and user-agent into\n * `device`, and lifts `email`/`phone` from a parsed JSON body when present.\n */\nexport function defaultExtract(req: any): CheckInput {\n  const input: CheckInput = {};\n\n  const device: Record<string, unknown> = {};\n  const ip = extractIp(req);\n  if (ip) device.ip = ip;\n  const ua = readHeader(req?.headers, \"user-agent\");\n  if (ua) device.user_agent = ua;\n  if (Object.keys(device).length > 0) input.device = device;\n\n  const body = req?.body;\n  if (body && typeof body === \"object\") {\n    const b = body as Record<string, unknown>;\n    if (typeof b.email === \"string\") input.email = b.email;\n    if (typeof b.phone === \"string\") input.phone = b.phone;\n  }\n\n  return input;\n}\n\nfunction normalizeBlock(\n  block: GuardOptions[\"block\"],\n): (result: CheckResult) => boolean {\n  if (typeof block === \"function\") return block;\n  const threshold = (block as BlockThreshold | undefined)?.whenRiskAtLeast ?? DEFAULT_THRESHOLD;\n  return (result) => riskAtLeast(result.risk_level, threshold);\n}\n\nexport interface Guard<Req = any> {\n  /** The underlying thin Simplr client (check + edge log ingestion). */\n  readonly client: SimplrClient;\n  /** Run the full engine against a request; never throws when `failOpen`. */\n  run(req: Req): Promise<GuardOutcome>;\n}\n\nexport function createGuard<Req = any>(options: GuardOptions<Req>): Guard<Req> {\n  if (!options?.apiKey) throw new Error(\"createGuard: `apiKey` is required\");\n\n  const client = createClient({\n    apiKey: options.apiKey,\n    baseUrl: options.baseUrl,\n    timeoutMs: options.timeoutMs,\n    fetch: options.fetch,\n  });\n\n  const extract = options.extract ?? defaultExtract;\n  const shouldBlock = normalizeBlock(options.block);\n  const failOpen = options.failOpen ?? true;\n  const ingestLogs = options.ingestLogs ?? false;\n  const deviceId = options.deviceId ?? DEFAULT_DEVICE_ID;\n\n  async function run(req: Req): Promise<GuardOutcome> {\n    const input = await extract(req);\n    let result: CheckResult;\n    try {\n      result = await client.check(input);\n    } catch (error) {\n      if (failOpen) {\n        return { result: null, blocked: false, input, error };\n      }\n      throw error;\n    }\n\n    const blocked = shouldBlock(result);\n    const ctx: GuardContext<Req> = { req, input, blocked };\n\n    if (options.onResult) {\n      try {\n        await options.onResult(result, ctx);\n      } catch {\n        // onResult is observational; never let it break the request.\n      }\n    }\n\n    if (ingestLogs) {\n      try {\n        await client.ingestLogs(deviceId, [\n          {\n            category: \"security\",\n            level: blocked ? \"warn\" : \"info\",\n            message: blocked ? \"simplr guard blocked request\" : \"simplr guard checked request\",\n            risk_level: result.risk_level,\n            risk_score: result.risk_score,\n          },\n        ]);\n      } catch {\n        // Log shipping is best-effort and must never affect the request.\n      }\n    }\n\n    return { result, blocked, input };\n  }\n\n  return { client, run };\n}\n\n/** Standard JSON envelope returned to the client on a blocked request. */\nexport function blockEnvelope(result: CheckResult) {\n  return {\n    error: \"request_blocked\",\n    message: \"This request was blocked by Simplr fraud protection.\",\n    risk_level: result.risk_level,\n    risk_score: result.risk_score,\n  };\n}\n","/**\n * Fastify adapter. A plugin that registers a `preHandler` hook decorating\n * `request.simplr` and short-circuiting blocked requests with a 403.\n *\n * ```ts\n * import Fastify from \"fastify\";\n * import { simplrFastify } from \"@simplr-ai/express/fastify\";\n * const app = Fastify();\n * await app.register(simplrFastify, { apiKey: process.env.SIMPLR_API_KEY! });\n * ```\n */\nimport { blockEnvelope, createGuard } from \"./core.js\";\nimport type { CheckResult, GuardOptions } from \"./types.js\";\n\ntype FastifyInstance = any;\ntype FastifyRequest = any;\ntype FastifyReply = {\n  code(statusCode: number): FastifyReply;\n  send(payload: unknown): unknown;\n};\n\n/**\n * Fastify plugin. Register with `app.register(simplrFastify, options)`.\n * Accepts the standard `(fastify, options, done)` plugin signature.\n */\nexport function simplrFastify(\n  fastify: FastifyInstance,\n  options: GuardOptions,\n  done?: (err?: Error) => void,\n): void {\n  try {\n    const guard = createGuard(options);\n    const failOpen = options.failOpen ?? true;\n\n    // Decorate so TypeScript/Fastify know about `request.simplr`.\n    if (typeof fastify.decorateRequest === \"function\") {\n      fastify.decorateRequest(\"simplr\", null);\n    }\n\n    fastify.addHook(\n      \"preHandler\",\n      async (request: FastifyRequest, reply: FastifyReply) => {\n        try {\n          const outcome = await guard.run(request);\n          request.simplr = outcome.result;\n          if (outcome.blocked && outcome.result) {\n            reply.code(403).send(blockEnvelope(outcome.result));\n            return reply;\n          }\n        } catch (err) {\n          if (failOpen) {\n            request.simplr = null;\n            return;\n          }\n          throw err;\n        }\n      },\n    );\n\n    done?.();\n  } catch (err) {\n    if (done) done(err as Error);\n    else throw err;\n  }\n}\n\n// Mark as a Fastify plugin so `fastify-plugin`-style encapsulation skipping is\n// not required; Fastify reads this property when present.\n(simplrFastify as any)[Symbol.for(\"skip-override\")] = true;\n\n// Consumers can augment `FastifyRequest` with `simplr?: CheckResult | null`\n// themselves; we don't `declare module \"fastify\"` here so the package builds\n// without `fastify` (an optional peer) installed. `CheckResult` is re-exported\n// for that purpose.\nexport type { CheckResult };\n"],"mappings":";AAcA,IAAM,mBAAmB;AAGlB,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EACT,YAAY,SAAiB,QAAgB,MAAe;AAC1D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAcO,SAAS,aAAa,QAAoC;AAC/D,MAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,8BAA8B;AACnE,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,YAAY,OAAO,SAAS,WAAW;AAC7C,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,WAAc,QAAgB,MAAc,MAA4B;AACrF,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAI;AACF,YAAM,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,QAC/C;AAAA,QACA,SAAS,EAAE,gBAAgB,oBAAoB,aAAa,OAAO,OAAO;AAAA,QAC1E,MAAM,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI;AAAA,QAClD,QAAQ,WAAW;AAAA,MACrB,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI;AACJ,UAAI;AACF,iBAAS,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,MACrC,QAAQ;AACN,iBAAS;AAAA,MACX;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,UACH,WAAW,OAAO,WAAW,OAAO,UAAW,oBAAoB,IAAI,MAAM;AAChF,cAAM,IAAI,YAAY,SAAS,IAAI,QAAQ,MAAM;AAAA,MACnD;AACA,aAAQ,UAAU,OAAO,WAAW,YAAY,aAAa,SACzD,OAAO,UACP;AAAA,IACN,SAAS,KAAK;AACZ,UAAI,eAAe,YAAa,OAAM;AACtC,UAAI,eAAe,SAAS,IAAI,SAAS,cAAc;AACrD,cAAM,IAAI,YAAY,cAAc,IAAI,oBAAoB,SAAS,MAAM,GAAG,IAAI;AAAA,MACpF;AACA,YAAM,IAAI,YAAY,eAAe,QAAQ,IAAI,UAAU,iBAAiB,GAAG,IAAI;AAAA,IACrF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,CAAC,UAAU,WAAwB,QAAQ,aAAa,KAAK;AAAA,IACpE,YAAY,CAAC,UAAU,SACrB,WAAW,QAAQ,iBAAiB,EAAE,WAAW,UAAU,KAAK,CAAC;AAAA,EACrE;AACF;;;ACzEA,IAAM,aAAwC;AAAA,EAC5C,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AACZ;AAEA,IAAM,oBAAoB;AAC1B,IAAM,oBAA+B;AAG9B,SAAS,SAAS,OAA+C;AACtE,SAAO,WAAW,KAAkB,KAAK;AAC3C;AAGO,SAAS,YAAY,OAAuC,KAAyB;AAC1F,SAAO,SAAS,KAAK,KAAK,SAAS,GAAG;AACxC;AAGA,SAAS,WAAW,SAAkB,MAAkC;AACtE,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,QAAQ,YAAY;AAC/B,UAAM,IAAI,EAAE,IAAI,IAAI;AACpB,WAAO,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,EACzC;AAEA,QAAM,QAAQ,KAAK,YAAY;AAC/B,MAAI,SAAS,KAAK,EAAE,KAAK,KAAK,KAAM,QAAO,OAAO,EAAE,KAAK,CAAC;AAC1D,aAAW,OAAO,OAAO,KAAK,CAAC,GAAG;AAChC,QAAI,IAAI,YAAY,MAAM,SAAS,EAAE,GAAG,KAAK,KAAM,QAAO,OAAO,EAAE,GAAG,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,KAA8B;AAC/C,QAAM,MAAM,WAAW,KAAK,SAAS,iBAAiB;AACtD,MAAI,IAAK,QAAO,IAAI,MAAM,GAAG,EAAE,CAAC,EAAG,KAAK;AACxC,QAAM,OAAO,WAAW,KAAK,SAAS,WAAW;AACjD,MAAI,KAAM,QAAO;AACjB,SACE,KAAK,MACL,KAAK,QAAQ,iBACb,KAAK,YAAY,iBACjB;AAEJ;AAMO,SAAS,eAAe,KAAsB;AACnD,QAAM,QAAoB,CAAC;AAE3B,QAAM,SAAkC,CAAC;AACzC,QAAM,KAAK,UAAU,GAAG;AACxB,MAAI,GAAI,QAAO,KAAK;AACpB,QAAM,KAAK,WAAW,KAAK,SAAS,YAAY;AAChD,MAAI,GAAI,QAAO,aAAa;AAC5B,MAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,OAAM,SAAS;AAEnD,QAAM,OAAO,KAAK;AAClB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,IAAI;AACV,QAAI,OAAO,EAAE,UAAU,SAAU,OAAM,QAAQ,EAAE;AACjD,QAAI,OAAO,EAAE,UAAU,SAAU,OAAM,QAAQ,EAAE;AAAA,EACnD;AAEA,SAAO;AACT;AAEA,SAAS,eACP,OACkC;AAClC,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,YAAa,OAAsC,mBAAmB;AAC5E,SAAO,CAAC,WAAW,YAAY,OAAO,YAAY,SAAS;AAC7D;AASO,SAAS,YAAuB,SAAwC;AAC7E,MAAI,CAAC,SAAS,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AAEzE,QAAM,SAAS,aAAa;AAAA,IAC1B,QAAQ,QAAQ;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,IACnB,OAAO,QAAQ;AAAA,EACjB,CAAC;AAED,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,cAAc,eAAe,QAAQ,KAAK;AAChD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,IAAI,KAAiC;AAClD,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,MAAM,KAAK;AAAA,IACnC,SAAS,OAAO;AACd,UAAI,UAAU;AACZ,eAAO,EAAE,QAAQ,MAAM,SAAS,OAAO,OAAO,MAAM;AAAA,MACtD;AACA,YAAM;AAAA,IACR;AAEA,UAAM,UAAU,YAAY,MAAM;AAClC,UAAM,MAAyB,EAAE,KAAK,OAAO,QAAQ;AAErD,QAAI,QAAQ,UAAU;AACpB,UAAI;AACF,cAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,YAAY;AACd,UAAI;AACF,cAAM,OAAO,WAAW,UAAU;AAAA,UAChC;AAAA,YACE,UAAU;AAAA,YACV,OAAO,UAAU,SAAS;AAAA,YAC1B,SAAS,UAAU,iCAAiC;AAAA,YACpD,YAAY,OAAO;AAAA,YACnB,YAAY,OAAO;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,EAClC;AAEA,SAAO,EAAE,QAAQ,IAAI;AACvB;AAGO,SAAS,cAAc,QAAqB;AACjD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,IACT,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,EACrB;AACF;;;ACzJO,SAAS,cACd,SACA,SACA,MACM;AACN,MAAI;AACF,UAAM,QAAQ,YAAY,OAAO;AACjC,UAAM,WAAW,QAAQ,YAAY;AAGrC,QAAI,OAAO,QAAQ,oBAAoB,YAAY;AACjD,cAAQ,gBAAgB,UAAU,IAAI;AAAA,IACxC;AAEA,YAAQ;AAAA,MACN;AAAA,MACA,OAAO,SAAyB,UAAwB;AACtD,YAAI;AACF,gBAAM,UAAU,MAAM,MAAM,IAAI,OAAO;AACvC,kBAAQ,SAAS,QAAQ;AACzB,cAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,kBAAM,KAAK,GAAG,EAAE,KAAK,cAAc,QAAQ,MAAM,CAAC;AAClD,mBAAO;AAAA,UACT;AAAA,QACF,SAAS,KAAK;AACZ,cAAI,UAAU;AACZ,oBAAQ,SAAS;AACjB;AAAA,UACF;AACA,gBAAM;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,KAAM,MAAK,GAAY;AAAA,QACtB,OAAM;AAAA,EACb;AACF;AAIC,cAAsB,uBAAO,IAAI,eAAe,CAAC,IAAI;","names":[]}

package/dist/hono.cjs

@@ -0,0 +1,246 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/hono.ts
+var hono_exports = {};
+__export(hono_exports, {
+  getSimplr: () => getSimplr,
+  simplrHono: () => simplrHono
+});
+module.exports = __toCommonJS(hono_exports);
+
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.simplr.sh";
+var SimplrError = class extends Error {
+  status;
+  body;
+  constructor(message, status, body) {
+    super(message);
+    this.name = "SimplrError";
+    this.status = status;
+    this.body = body;
+  }
+};
+function createClient(config) {
+  if (!config?.apiKey) throw new Error("Simplr: `apiKey` is required");
+  const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const timeoutMs = config.timeoutMs ?? 15e3;
+  const fetchImpl = config.fetch ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new Error(
+      "Simplr: no global fetch available \u2014 use Node 18+ or pass `fetch` in options"
+    );
+  }
+  async function apiRequest(method, path, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetchImpl(`${baseUrl}${path}`, {
+        method,
+        headers: { "Content-Type": "application/json", "X-API-Key": config.apiKey },
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+      const text = await res.text();
+      let parsed;
+      try {
+        parsed = text ? JSON.parse(text) : void 0;
+      } catch {
+        parsed = text;
+      }
+      if (!res.ok) {
+        const message = parsed && (parsed.message || parsed.error) || `Simplr API error ${res.status}`;
+        throw new SimplrError(message, res.status, parsed);
+      }
+      return parsed && typeof parsed === "object" && "content" in parsed ? parsed.content : parsed;
+    } catch (err) {
+      if (err instanceof SimplrError) throw err;
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new SimplrError(`Request to ${path} timed out after ${timeoutMs}ms`, 0, null);
+      }
+      throw new SimplrError(err instanceof Error ? err.message : "Network error", 0, null);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return {
+    check: (input) => apiRequest("POST", "/v1/check", input),
+    ingestLogs: (deviceId, logs) => apiRequest("POST", "/v1/edge/logs", { device_id: deviceId, logs })
+  };
+}
+
+// src/core.ts
+var RISK_ORDER = {
+  low: 0,
+  medium: 1,
+  high: 2,
+  critical: 3
+};
+var DEFAULT_DEVICE_ID = "simplr-edge-middleware";
+var DEFAULT_THRESHOLD = "high";
+function riskRank(level) {
+  return RISK_ORDER[level] ?? 0;
+}
+function riskAtLeast(level, min) {
+  return riskRank(level) >= riskRank(min);
+}
+function readHeader(headers, name) {
+  if (!headers) return void 0;
+  const h = headers;
+  if (typeof h.get === "function") {
+    const v = h.get(name);
+    return v == null ? void 0 : String(v);
+  }
+  const lower = name.toLowerCase();
+  if (lower in h && h[lower] != null) return String(h[lower]);
+  for (const key of Object.keys(h)) {
+    if (key.toLowerCase() === lower && h[key] != null) return String(h[key]);
+  }
+  return void 0;
+}
+function extractIp(req) {
+  const fwd = readHeader(req?.headers, "x-forwarded-for");
+  if (fwd) return fwd.split(",")[0].trim();
+  const real = readHeader(req?.headers, "x-real-ip");
+  if (real) return real;
+  return req?.ip || req?.socket?.remoteAddress || req?.connection?.remoteAddress || void 0;
+}
+function defaultExtract(req) {
+  const input = {};
+  const device = {};
+  const ip = extractIp(req);
+  if (ip) device.ip = ip;
+  const ua = readHeader(req?.headers, "user-agent");
+  if (ua) device.user_agent = ua;
+  if (Object.keys(device).length > 0) input.device = device;
+  const body = req?.body;
+  if (body && typeof body === "object") {
+    const b = body;
+    if (typeof b.email === "string") input.email = b.email;
+    if (typeof b.phone === "string") input.phone = b.phone;
+  }
+  return input;
+}
+function normalizeBlock(block) {
+  if (typeof block === "function") return block;
+  const threshold = block?.whenRiskAtLeast ?? DEFAULT_THRESHOLD;
+  return (result) => riskAtLeast(result.risk_level, threshold);
+}
+function createGuard(options) {
+  if (!options?.apiKey) throw new Error("createGuard: `apiKey` is required");
+  const client = createClient({
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl,
+    timeoutMs: options.timeoutMs,
+    fetch: options.fetch
+  });
+  const extract = options.extract ?? defaultExtract;
+  const shouldBlock = normalizeBlock(options.block);
+  const failOpen = options.failOpen ?? true;
+  const ingestLogs = options.ingestLogs ?? false;
+  const deviceId = options.deviceId ?? DEFAULT_DEVICE_ID;
+  async function run(req) {
+    const input = await extract(req);
+    let result;
+    try {
+      result = await client.check(input);
+    } catch (error) {
+      if (failOpen) {
+        return { result: null, blocked: false, input, error };
+      }
+      throw error;
+    }
+    const blocked = shouldBlock(result);
+    const ctx = { req, input, blocked };
+    if (options.onResult) {
+      try {
+        await options.onResult(result, ctx);
+      } catch {
+      }
+    }
+    if (ingestLogs) {
+      try {
+        await client.ingestLogs(deviceId, [
+          {
+            category: "security",
+            level: blocked ? "warn" : "info",
+            message: blocked ? "simplr guard blocked request" : "simplr guard checked request",
+            risk_level: result.risk_level,
+            risk_score: result.risk_score
+          }
+        ]);
+      } catch {
+      }
+    }
+    return { result, blocked, input };
+  }
+  return { client, run };
+}
+function blockEnvelope(result) {
+  return {
+    error: "request_blocked",
+    message: "This request was blocked by Simplr fraud protection.",
+    risk_level: result.risk_level,
+    risk_score: result.risk_score
+  };
+}
+
+// src/hono.ts
+function simplrHono(options) {
+  const guard = createGuard({
+    ...options,
+    // Adapt Hono's header accessor into the shape the default extractor expects.
+    extract: options.extract ?? ((c) => {
+      const headerGet = (name) => c.req.header(name);
+      return defaultHonoExtract({ get: headerGet });
+    })
+  });
+  const failOpen = options.failOpen ?? true;
+  return async function simplrMiddleware(c, next) {
+    try {
+      const outcome = await guard.run(c);
+      c.set("simplr", outcome.result);
+      if (outcome.blocked && outcome.result) {
+        return c.json(blockEnvelope(outcome.result), 403);
+      }
+    } catch (err) {
+      if (!failOpen) throw err;
+      c.set("simplr", null);
+    }
+    await next();
+  };
+}
+function defaultHonoExtract(headers) {
+  const device = {};
+  const fwd = headers.get("x-forwarded-for");
+  const ip = fwd ? fwd.split(",")[0].trim() : headers.get("x-real-ip");
+  if (ip) device.ip = ip;
+  const ua = headers.get("user-agent");
+  if (ua) device.user_agent = ua;
+  return Object.keys(device).length > 0 ? { device } : {};
+}
+function getSimplr(c) {
+  return c.get("simplr") ?? null;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  getSimplr,
+  simplrHono
+});
+//# sourceMappingURL=hono.cjs.map

package/dist/hono.cjs.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/hono.ts","../src/client.ts","../src/core.ts"],"sourcesContent":["/**\n * Hono adapter. Middleware that stores the result via `c.set('simplr', result)`\n * (read it back with `c.get('simplr')`) and returns a 403 JSON response on block.\n *\n * ```ts\n * import { Hono } from \"hono\";\n * import { simplrHono } from \"@simplr-ai/express/hono\";\n * const app = new Hono();\n * app.use(\"*\", simplrHono({ apiKey: process.env.SIMPLR_API_KEY! }));\n * ```\n */\nimport { blockEnvelope, createGuard } from \"./core.js\";\nimport type { CheckResult, GuardOptions } from \"./types.js\";\n\ntype HonoContext = {\n  req: {\n    /** Hono exposes headers via `c.req.header(name)`. */\n    header(name: string): string | undefined;\n    /** Parsed JSON body, if read. The default extractor reads `c.get`-supplied body. */\n    [key: string]: unknown;\n  };\n  set(key: string, value: unknown): void;\n  get(key: string): unknown;\n  json(body: unknown, status?: number): Response;\n};\ntype HonoNext = () => Promise<void>;\n\nexport type HonoMiddleware = (c: HonoContext, next: HonoNext) => Promise<Response | void>;\n\n/**\n * Build Hono middleware. Because Hono request bodies are read asynchronously,\n * the default extractor relies on headers; to also score body email/phone, set\n * a custom `extract` that awaits `await c.req.json()` (and stashes it as needed).\n */\nexport function simplrHono(options: GuardOptions<HonoContext>): HonoMiddleware {\n  const guard = createGuard<HonoContext>({\n    ...options,\n    // Adapt Hono's header accessor into the shape the default extractor expects.\n    extract:\n      options.extract ??\n      ((c) => {\n        const headerGet = (name: string) => c.req.header(name);\n        return defaultHonoExtract({ get: headerGet });\n      }),\n  });\n  const failOpen = options.failOpen ?? true;\n\n  return async function simplrMiddleware(c, next) {\n    try {\n      const outcome = await guard.run(c);\n      c.set(\"simplr\", outcome.result);\n      if (outcome.blocked && outcome.result) {\n        return c.json(blockEnvelope(outcome.result), 403);\n      }\n    } catch (err) {\n      if (!failOpen) throw err;\n      c.set(\"simplr\", null);\n    }\n    await next();\n  };\n}\n\n/** Minimal extractor over a Headers-like getter (IP + user-agent into device). */\nfunction defaultHonoExtract(headers: { get(name: string): string | undefined }) {\n  const device: Record<string, unknown> = {};\n  const fwd = headers.get(\"x-forwarded-for\");\n  const ip = fwd ? fwd.split(\",\")[0]!.trim() : headers.get(\"x-real-ip\");\n  if (ip) device.ip = ip;\n  const ua = headers.get(\"user-agent\");\n  if (ua) device.user_agent = ua;\n  return Object.keys(device).length > 0 ? { device } : {};\n}\n\n/** Helper to read the stored result inside a handler: `getSimplr(c)`. */\nexport function getSimplr(c: HonoContext): CheckResult | null {\n  return (c.get(\"simplr\") as CheckResult | null) ?? null;\n}\n","/**\n * Thin internal client.\n *\n * This is a ~40-line port of the minimal call path from `@simplr-ai/node`\n * (`apiRequest` + `check` + `edge.ingestLogs`) so that this package builds and\n * tests without an unbuilt workspace dependency or any network access.\n *\n * In production this package pairs with `@simplr-ai/node`; the endpoints, auth\n * header (`X-API-Key`), `{ success, message, content }` envelope unwrapping, and\n * 15s default timeout here are byte-for-byte compatible with that SDK and the\n * Simplr API contract.\n */\nimport type { CheckInput, CheckResult, EdgeLogEntry } from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.simplr.sh\";\n\n/** Thrown when the Simplr API returns a non-2xx response or the request fails. */\nexport class SimplrError extends Error {\n  readonly status: number;\n  readonly body: unknown;\n  constructor(message: string, status: number, body: unknown) {\n    super(message);\n    this.name = \"SimplrError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport interface ClientConfig {\n  apiKey: string;\n  baseUrl?: string;\n  timeoutMs?: number;\n  fetch?: typeof fetch;\n}\n\nexport interface SimplrClient {\n  check(input: CheckInput): Promise<CheckResult>;\n  ingestLogs(deviceId: string, logs: EdgeLogEntry[]): Promise<unknown>;\n}\n\nexport function createClient(config: ClientConfig): SimplrClient {\n  if (!config?.apiKey) throw new Error(\"Simplr: `apiKey` is required\");\n  const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n  const timeoutMs = config.timeoutMs ?? 15000;\n  const fetchImpl = config.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new Error(\n      \"Simplr: no global fetch available — use Node 18+ or pass `fetch` in options\",\n    );\n  }\n\n  async function apiRequest<T>(method: string, path: string, body?: unknown): Promise<T> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const res = await fetchImpl(`${baseUrl}${path}`, {\n        method,\n        headers: { \"Content-Type\": \"application/json\", \"X-API-Key\": config.apiKey },\n        body: body !== undefined ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n      const text = await res.text();\n      let parsed: any;\n      try {\n        parsed = text ? JSON.parse(text) : undefined;\n      } catch {\n        parsed = text;\n      }\n      if (!res.ok) {\n        const message =\n          (parsed && (parsed.message || parsed.error)) || `Simplr API error ${res.status}`;\n        throw new SimplrError(message, res.status, parsed);\n      }\n      return (parsed && typeof parsed === \"object\" && \"content\" in parsed\n        ? parsed.content\n        : parsed) as T;\n    } catch (err) {\n      if (err instanceof SimplrError) throw err;\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new SimplrError(`Request to ${path} timed out after ${timeoutMs}ms`, 0, null);\n      }\n      throw new SimplrError(err instanceof Error ? err.message : \"Network error\", 0, null);\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  return {\n    check: (input) => apiRequest<CheckResult>(\"POST\", \"/v1/check\", input),\n    ingestLogs: (deviceId, logs) =>\n      apiRequest(\"POST\", \"/v1/edge/logs\", { device_id: deviceId, logs }),\n  };\n}\n","/**\n * Framework-agnostic guard engine.\n *\n * `createGuard` returns an object that, given any request-like object, builds a\n * `CheckInput`, calls `/v1/check`, decides whether to block, optionally ships an\n * edge log, and fails open on error. Framework adapters (express/fastify/hono/\n * next) are thin wrappers over this engine.\n */\nimport { createClient, type SimplrClient } from \"./client.js\";\nimport type {\n  BlockThreshold,\n  CheckInput,\n  CheckResult,\n  GuardContext,\n  GuardOptions,\n  GuardOutcome,\n  RiskLevel,\n} from \"./types.js\";\n\nconst RISK_ORDER: Record<RiskLevel, number> = {\n  low: 0,\n  medium: 1,\n  high: 2,\n  critical: 3,\n};\n\nconst DEFAULT_DEVICE_ID = \"simplr-edge-middleware\";\nconst DEFAULT_THRESHOLD: RiskLevel = \"high\";\n\n/** Numeric rank of a risk level. Unknown levels rank as the lowest (0). */\nexport function riskRank(level: RiskLevel | string | undefined): number {\n  return RISK_ORDER[level as RiskLevel] ?? 0;\n}\n\n/** True when `level` is at least `min` in the low<medium<high<critical ordering. */\nexport function riskAtLeast(level: RiskLevel | string | undefined, min: RiskLevel): boolean {\n  return riskRank(level) >= riskRank(min);\n}\n\n/** Read a header from either a plain bag (lowercase keys) or a Headers-like getter. */\nfunction readHeader(headers: unknown, name: string): string | undefined {\n  if (!headers) return undefined;\n  const h = headers as any;\n  if (typeof h.get === \"function\") {\n    const v = h.get(name);\n    return v == null ? undefined : String(v);\n  }\n  // Plain object: try the lowercase key, then a case-insensitive scan.\n  const lower = name.toLowerCase();\n  if (lower in h && h[lower] != null) return String(h[lower]);\n  for (const key of Object.keys(h)) {\n    if (key.toLowerCase() === lower && h[key] != null) return String(h[key]);\n  }\n  return undefined;\n}\n\n/** Best-effort client IP from common header and socket locations. */\nfunction extractIp(req: any): string | undefined {\n  const fwd = readHeader(req?.headers, \"x-forwarded-for\");\n  if (fwd) return fwd.split(\",\")[0]!.trim();\n  const real = readHeader(req?.headers, \"x-real-ip\");\n  if (real) return real;\n  return (\n    req?.ip ||\n    req?.socket?.remoteAddress ||\n    req?.connection?.remoteAddress ||\n    undefined\n  );\n}\n\n/**\n * Default request → CheckInput extractor. Pulls the client IP and user-agent into\n * `device`, and lifts `email`/`phone` from a parsed JSON body when present.\n */\nexport function defaultExtract(req: any): CheckInput {\n  const input: CheckInput = {};\n\n  const device: Record<string, unknown> = {};\n  const ip = extractIp(req);\n  if (ip) device.ip = ip;\n  const ua = readHeader(req?.headers, \"user-agent\");\n  if (ua) device.user_agent = ua;\n  if (Object.keys(device).length > 0) input.device = device;\n\n  const body = req?.body;\n  if (body && typeof body === \"object\") {\n    const b = body as Record<string, unknown>;\n    if (typeof b.email === \"string\") input.email = b.email;\n    if (typeof b.phone === \"string\") input.phone = b.phone;\n  }\n\n  return input;\n}\n\nfunction normalizeBlock(\n  block: GuardOptions[\"block\"],\n): (result: CheckResult) => boolean {\n  if (typeof block === \"function\") return block;\n  const threshold = (block as BlockThreshold | undefined)?.whenRiskAtLeast ?? DEFAULT_THRESHOLD;\n  return (result) => riskAtLeast(result.risk_level, threshold);\n}\n\nexport interface Guard<Req = any> {\n  /** The underlying thin Simplr client (check + edge log ingestion). */\n  readonly client: SimplrClient;\n  /** Run the full engine against a request; never throws when `failOpen`. */\n  run(req: Req): Promise<GuardOutcome>;\n}\n\nexport function createGuard<Req = any>(options: GuardOptions<Req>): Guard<Req> {\n  if (!options?.apiKey) throw new Error(\"createGuard: `apiKey` is required\");\n\n  const client = createClient({\n    apiKey: options.apiKey,\n    baseUrl: options.baseUrl,\n    timeoutMs: options.timeoutMs,\n    fetch: options.fetch,\n  });\n\n  const extract = options.extract ?? defaultExtract;\n  const shouldBlock = normalizeBlock(options.block);\n  const failOpen = options.failOpen ?? true;\n  const ingestLogs = options.ingestLogs ?? false;\n  const deviceId = options.deviceId ?? DEFAULT_DEVICE_ID;\n\n  async function run(req: Req): Promise<GuardOutcome> {\n    const input = await extract(req);\n    let result: CheckResult;\n    try {\n      result = await client.check(input);\n    } catch (error) {\n      if (failOpen) {\n        return { result: null, blocked: false, input, error };\n      }\n      throw error;\n    }\n\n    const blocked = shouldBlock(result);\n    const ctx: GuardContext<Req> = { req, input, blocked };\n\n    if (options.onResult) {\n      try {\n        await options.onResult(result, ctx);\n      } catch {\n        // onResult is observational; never let it break the request.\n      }\n    }\n\n    if (ingestLogs) {\n      try {\n        await client.ingestLogs(deviceId, [\n          {\n            category: \"security\",\n            level: blocked ? \"warn\" : \"info\",\n            message: blocked ? \"simplr guard blocked request\" : \"simplr guard checked request\",\n            risk_level: result.risk_level,\n            risk_score: result.risk_score,\n          },\n        ]);\n      } catch {\n        // Log shipping is best-effort and must never affect the request.\n      }\n    }\n\n    return { result, blocked, input };\n  }\n\n  return { client, run };\n}\n\n/** Standard JSON envelope returned to the client on a blocked request. */\nexport function blockEnvelope(result: CheckResult) {\n  return {\n    error: \"request_blocked\",\n    message: \"This request was blocked by Simplr fraud protection.\",\n    risk_level: result.risk_level,\n    risk_score: result.risk_score,\n  };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACcA,IAAM,mBAAmB;AAGlB,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EACT,YAAY,SAAiB,QAAgB,MAAe;AAC1D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAcO,SAAS,aAAa,QAAoC;AAC/D,MAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,8BAA8B;AACnE,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,YAAY,OAAO,SAAS,WAAW;AAC7C,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,WAAc,QAAgB,MAAc,MAA4B;AACrF,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAI;AACF,YAAM,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,QAC/C;AAAA,QACA,SAAS,EAAE,gBAAgB,oBAAoB,aAAa,OAAO,OAAO;AAAA,QAC1E,MAAM,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI;AAAA,QAClD,QAAQ,WAAW;AAAA,MACrB,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI;AACJ,UAAI;AACF,iBAAS,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,MACrC,QAAQ;AACN,iBAAS;AAAA,MACX;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,UACH,WAAW,OAAO,WAAW,OAAO,UAAW,oBAAoB,IAAI,MAAM;AAChF,cAAM,IAAI,YAAY,SAAS,IAAI,QAAQ,MAAM;AAAA,MACnD;AACA,aAAQ,UAAU,OAAO,WAAW,YAAY,aAAa,SACzD,OAAO,UACP;AAAA,IACN,SAAS,KAAK;AACZ,UAAI,eAAe,YAAa,OAAM;AACtC,UAAI,eAAe,SAAS,IAAI,SAAS,cAAc;AACrD,cAAM,IAAI,YAAY,cAAc,IAAI,oBAAoB,SAAS,MAAM,GAAG,IAAI;AAAA,MACpF;AACA,YAAM,IAAI,YAAY,eAAe,QAAQ,IAAI,UAAU,iBAAiB,GAAG,IAAI;AAAA,IACrF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,CAAC,UAAU,WAAwB,QAAQ,aAAa,KAAK;AAAA,IACpE,YAAY,CAAC,UAAU,SACrB,WAAW,QAAQ,iBAAiB,EAAE,WAAW,UAAU,KAAK,CAAC;AAAA,EACrE;AACF;;;ACzEA,IAAM,aAAwC;AAAA,EAC5C,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AACZ;AAEA,IAAM,oBAAoB;AAC1B,IAAM,oBAA+B;AAG9B,SAAS,SAAS,OAA+C;AACtE,SAAO,WAAW,KAAkB,KAAK;AAC3C;AAGO,SAAS,YAAY,OAAuC,KAAyB;AAC1F,SAAO,SAAS,KAAK,KAAK,SAAS,GAAG;AACxC;AAGA,SAAS,WAAW,SAAkB,MAAkC;AACtE,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,QAAQ,YAAY;AAC/B,UAAM,IAAI,EAAE,IAAI,IAAI;AACpB,WAAO,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,EACzC;AAEA,QAAM,QAAQ,KAAK,YAAY;AAC/B,MAAI,SAAS,KAAK,EAAE,KAAK,KAAK,KAAM,QAAO,OAAO,EAAE,KAAK,CAAC;AAC1D,aAAW,OAAO,OAAO,KAAK,CAAC,GAAG;AAChC,QAAI,IAAI,YAAY,MAAM,SAAS,EAAE,GAAG,KAAK,KAAM,QAAO,OAAO,EAAE,GAAG,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,KAA8B;AAC/C,QAAM,MAAM,WAAW,KAAK,SAAS,iBAAiB;AACtD,MAAI,IAAK,QAAO,IAAI,MAAM,GAAG,EAAE,CAAC,EAAG,KAAK;AACxC,QAAM,OAAO,WAAW,KAAK,SAAS,WAAW;AACjD,MAAI,KAAM,QAAO;AACjB,SACE,KAAK,MACL,KAAK,QAAQ,iBACb,KAAK,YAAY,iBACjB;AAEJ;AAMO,SAAS,eAAe,KAAsB;AACnD,QAAM,QAAoB,CAAC;AAE3B,QAAM,SAAkC,CAAC;AACzC,QAAM,KAAK,UAAU,GAAG;AACxB,MAAI,GAAI,QAAO,KAAK;AACpB,QAAM,KAAK,WAAW,KAAK,SAAS,YAAY;AAChD,MAAI,GAAI,QAAO,aAAa;AAC5B,MAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,OAAM,SAAS;AAEnD,QAAM,OAAO,KAAK;AAClB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,IAAI;AACV,QAAI,OAAO,EAAE,UAAU,SAAU,OAAM,QAAQ,EAAE;AACjD,QAAI,OAAO,EAAE,UAAU,SAAU,OAAM,QAAQ,EAAE;AAAA,EACnD;AAEA,SAAO;AACT;AAEA,SAAS,eACP,OACkC;AAClC,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,YAAa,OAAsC,mBAAmB;AAC5E,SAAO,CAAC,WAAW,YAAY,OAAO,YAAY,SAAS;AAC7D;AASO,SAAS,YAAuB,SAAwC;AAC7E,MAAI,CAAC,SAAS,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AAEzE,QAAM,SAAS,aAAa;AAAA,IAC1B,QAAQ,QAAQ;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,IACnB,OAAO,QAAQ;AAAA,EACjB,CAAC;AAED,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,cAAc,eAAe,QAAQ,KAAK;AAChD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,IAAI,KAAiC;AAClD,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,MAAM,KAAK;AAAA,IACnC,SAAS,OAAO;AACd,UAAI,UAAU;AACZ,eAAO,EAAE,QAAQ,MAAM,SAAS,OAAO,OAAO,MAAM;AAAA,MACtD;AACA,YAAM;AAAA,IACR;AAEA,UAAM,UAAU,YAAY,MAAM;AAClC,UAAM,MAAyB,EAAE,KAAK,OAAO,QAAQ;AAErD,QAAI,QAAQ,UAAU;AACpB,UAAI;AACF,cAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,YAAY;AACd,UAAI;AACF,cAAM,OAAO,WAAW,UAAU;AAAA,UAChC;AAAA,YACE,UAAU;AAAA,YACV,OAAO,UAAU,SAAS;AAAA,YAC1B,SAAS,UAAU,iCAAiC;AAAA,YACpD,YAAY,OAAO;AAAA,YACnB,YAAY,OAAO;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,EAClC;AAEA,SAAO,EAAE,QAAQ,IAAI;AACvB;AAGO,SAAS,cAAc,QAAqB;AACjD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,IACT,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,EACrB;AACF;;;AFhJO,SAAS,WAAW,SAAoD;AAC7E,QAAM,QAAQ,YAAyB;AAAA,IACrC,GAAG;AAAA;AAAA,IAEH,SACE,QAAQ,YACP,CAAC,MAAM;AACN,YAAM,YAAY,CAAC,SAAiB,EAAE,IAAI,OAAO,IAAI;AACrD,aAAO,mBAAmB,EAAE,KAAK,UAAU,CAAC;AAAA,IAC9C;AAAA,EACJ,CAAC;AACD,QAAM,WAAW,QAAQ,YAAY;AAErC,SAAO,eAAe,iBAAiB,GAAG,MAAM;AAC9C,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,IAAI,CAAC;AACjC,QAAE,IAAI,UAAU,QAAQ,MAAM;AAC9B,UAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,eAAO,EAAE,KAAK,cAAc,QAAQ,MAAM,GAAG,GAAG;AAAA,MAClD;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,CAAC,SAAU,OAAM;AACrB,QAAE,IAAI,UAAU,IAAI;AAAA,IACtB;AACA,UAAM,KAAK;AAAA,EACb;AACF;AAGA,SAAS,mBAAmB,SAAoD;AAC9E,QAAM,SAAkC,CAAC;AACzC,QAAM,MAAM,QAAQ,IAAI,iBAAiB;AACzC,QAAM,KAAK,MAAM,IAAI,MAAM,GAAG,EAAE,CAAC,EAAG,KAAK,IAAI,QAAQ,IAAI,WAAW;AACpE,MAAI,GAAI,QAAO,KAAK;AACpB,QAAM,KAAK,QAAQ,IAAI,YAAY;AACnC,MAAI,GAAI,QAAO,aAAa;AAC5B,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;AACxD;AAGO,SAAS,UAAU,GAAoC;AAC5D,SAAQ,EAAE,IAAI,QAAQ,KAA4B;AACpD;","names":[]}

package/dist/hono.d.cts

@@ -0,0 +1,25 @@
+import { C as CheckResult, G as GuardOptions } from './types-CmzpR5S4.cjs';
+
+type HonoContext = {
+    req: {
+        /** Hono exposes headers via `c.req.header(name)`. */
+        header(name: string): string | undefined;
+        /** Parsed JSON body, if read. The default extractor reads `c.get`-supplied body. */
+        [key: string]: unknown;
+    };
+    set(key: string, value: unknown): void;
+    get(key: string): unknown;
+    json(body: unknown, status?: number): Response;
+};
+type HonoNext = () => Promise<void>;
+type HonoMiddleware = (c: HonoContext, next: HonoNext) => Promise<Response | void>;
+/**
+ * Build Hono middleware. Because Hono request bodies are read asynchronously,
+ * the default extractor relies on headers; to also score body email/phone, set
+ * a custom `extract` that awaits `await c.req.json()` (and stashes it as needed).
+ */
+declare function simplrHono(options: GuardOptions<HonoContext>): HonoMiddleware;
+/** Helper to read the stored result inside a handler: `getSimplr(c)`. */
+declare function getSimplr(c: HonoContext): CheckResult | null;
+
+export { type HonoMiddleware, getSimplr, simplrHono };

package/dist/hono.d.ts

@@ -0,0 +1,25 @@
+import { C as CheckResult, G as GuardOptions } from './types-CmzpR5S4.js';
+
+type HonoContext = {
+    req: {
+        /** Hono exposes headers via `c.req.header(name)`. */
+        header(name: string): string | undefined;
+        /** Parsed JSON body, if read. The default extractor reads `c.get`-supplied body. */
+        [key: string]: unknown;
+    };
+    set(key: string, value: unknown): void;
+    get(key: string): unknown;
+    json(body: unknown, status?: number): Response;
+};
+type HonoNext = () => Promise<void>;
+type HonoMiddleware = (c: HonoContext, next: HonoNext) => Promise<Response | void>;
+/**
+ * Build Hono middleware. Because Hono request bodies are read asynchronously,
+ * the default extractor relies on headers; to also score body email/phone, set
+ * a custom `extract` that awaits `await c.req.json()` (and stashes it as needed).
+ */
+declare function simplrHono(options: GuardOptions<HonoContext>): HonoMiddleware;
+/** Helper to read the stored result inside a handler: `getSimplr(c)`. */
+declare function getSimplr(c: HonoContext): CheckResult | null;
+
+export { type HonoMiddleware, getSimplr, simplrHono };

package/dist/hono.js

@@ -0,0 +1,218 @@
+// src/client.ts
+var DEFAULT_BASE_URL = "https://api.simplr.sh";
+var SimplrError = class extends Error {
+  status;
+  body;
+  constructor(message, status, body) {
+    super(message);
+    this.name = "SimplrError";
+    this.status = status;
+    this.body = body;
+  }
+};
+function createClient(config) {
+  if (!config?.apiKey) throw new Error("Simplr: `apiKey` is required");
+  const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\/+$/, "");
+  const timeoutMs = config.timeoutMs ?? 15e3;
+  const fetchImpl = config.fetch ?? globalThis.fetch;
+  if (typeof fetchImpl !== "function") {
+    throw new Error(
+      "Simplr: no global fetch available \u2014 use Node 18+ or pass `fetch` in options"
+    );
+  }
+  async function apiRequest(method, path, body) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+      const res = await fetchImpl(`${baseUrl}${path}`, {
+        method,
+        headers: { "Content-Type": "application/json", "X-API-Key": config.apiKey },
+        body: body !== void 0 ? JSON.stringify(body) : void 0,
+        signal: controller.signal
+      });
+      const text = await res.text();
+      let parsed;
+      try {
+        parsed = text ? JSON.parse(text) : void 0;
+      } catch {
+        parsed = text;
+      }
+      if (!res.ok) {
+        const message = parsed && (parsed.message || parsed.error) || `Simplr API error ${res.status}`;
+        throw new SimplrError(message, res.status, parsed);
+      }
+      return parsed && typeof parsed === "object" && "content" in parsed ? parsed.content : parsed;
+    } catch (err) {
+      if (err instanceof SimplrError) throw err;
+      if (err instanceof Error && err.name === "AbortError") {
+        throw new SimplrError(`Request to ${path} timed out after ${timeoutMs}ms`, 0, null);
+      }
+      throw new SimplrError(err instanceof Error ? err.message : "Network error", 0, null);
+    } finally {
+      clearTimeout(timer);
+    }
+  }
+  return {
+    check: (input) => apiRequest("POST", "/v1/check", input),
+    ingestLogs: (deviceId, logs) => apiRequest("POST", "/v1/edge/logs", { device_id: deviceId, logs })
+  };
+}
+
+// src/core.ts
+var RISK_ORDER = {
+  low: 0,
+  medium: 1,
+  high: 2,
+  critical: 3
+};
+var DEFAULT_DEVICE_ID = "simplr-edge-middleware";
+var DEFAULT_THRESHOLD = "high";
+function riskRank(level) {
+  return RISK_ORDER[level] ?? 0;
+}
+function riskAtLeast(level, min) {
+  return riskRank(level) >= riskRank(min);
+}
+function readHeader(headers, name) {
+  if (!headers) return void 0;
+  const h = headers;
+  if (typeof h.get === "function") {
+    const v = h.get(name);
+    return v == null ? void 0 : String(v);
+  }
+  const lower = name.toLowerCase();
+  if (lower in h && h[lower] != null) return String(h[lower]);
+  for (const key of Object.keys(h)) {
+    if (key.toLowerCase() === lower && h[key] != null) return String(h[key]);
+  }
+  return void 0;
+}
+function extractIp(req) {
+  const fwd = readHeader(req?.headers, "x-forwarded-for");
+  if (fwd) return fwd.split(",")[0].trim();
+  const real = readHeader(req?.headers, "x-real-ip");
+  if (real) return real;
+  return req?.ip || req?.socket?.remoteAddress || req?.connection?.remoteAddress || void 0;
+}
+function defaultExtract(req) {
+  const input = {};
+  const device = {};
+  const ip = extractIp(req);
+  if (ip) device.ip = ip;
+  const ua = readHeader(req?.headers, "user-agent");
+  if (ua) device.user_agent = ua;
+  if (Object.keys(device).length > 0) input.device = device;
+  const body = req?.body;
+  if (body && typeof body === "object") {
+    const b = body;
+    if (typeof b.email === "string") input.email = b.email;
+    if (typeof b.phone === "string") input.phone = b.phone;
+  }
+  return input;
+}
+function normalizeBlock(block) {
+  if (typeof block === "function") return block;
+  const threshold = block?.whenRiskAtLeast ?? DEFAULT_THRESHOLD;
+  return (result) => riskAtLeast(result.risk_level, threshold);
+}
+function createGuard(options) {
+  if (!options?.apiKey) throw new Error("createGuard: `apiKey` is required");
+  const client = createClient({
+    apiKey: options.apiKey,
+    baseUrl: options.baseUrl,
+    timeoutMs: options.timeoutMs,
+    fetch: options.fetch
+  });
+  const extract = options.extract ?? defaultExtract;
+  const shouldBlock = normalizeBlock(options.block);
+  const failOpen = options.failOpen ?? true;
+  const ingestLogs = options.ingestLogs ?? false;
+  const deviceId = options.deviceId ?? DEFAULT_DEVICE_ID;
+  async function run(req) {
+    const input = await extract(req);
+    let result;
+    try {
+      result = await client.check(input);
+    } catch (error) {
+      if (failOpen) {
+        return { result: null, blocked: false, input, error };
+      }
+      throw error;
+    }
+    const blocked = shouldBlock(result);
+    const ctx = { req, input, blocked };
+    if (options.onResult) {
+      try {
+        await options.onResult(result, ctx);
+      } catch {
+      }
+    }
+    if (ingestLogs) {
+      try {
+        await client.ingestLogs(deviceId, [
+          {
+            category: "security",
+            level: blocked ? "warn" : "info",
+            message: blocked ? "simplr guard blocked request" : "simplr guard checked request",
+            risk_level: result.risk_level,
+            risk_score: result.risk_score
+          }
+        ]);
+      } catch {
+      }
+    }
+    return { result, blocked, input };
+  }
+  return { client, run };
+}
+function blockEnvelope(result) {
+  return {
+    error: "request_blocked",
+    message: "This request was blocked by Simplr fraud protection.",
+    risk_level: result.risk_level,
+    risk_score: result.risk_score
+  };
+}
+
+// src/hono.ts
+function simplrHono(options) {
+  const guard = createGuard({
+    ...options,
+    // Adapt Hono's header accessor into the shape the default extractor expects.
+    extract: options.extract ?? ((c) => {
+      const headerGet = (name) => c.req.header(name);
+      return defaultHonoExtract({ get: headerGet });
+    })
+  });
+  const failOpen = options.failOpen ?? true;
+  return async function simplrMiddleware(c, next) {
+    try {
+      const outcome = await guard.run(c);
+      c.set("simplr", outcome.result);
+      if (outcome.blocked && outcome.result) {
+        return c.json(blockEnvelope(outcome.result), 403);
+      }
+    } catch (err) {
+      if (!failOpen) throw err;
+      c.set("simplr", null);
+    }
+    await next();
+  };
+}
+function defaultHonoExtract(headers) {
+  const device = {};
+  const fwd = headers.get("x-forwarded-for");
+  const ip = fwd ? fwd.split(",")[0].trim() : headers.get("x-real-ip");
+  if (ip) device.ip = ip;
+  const ua = headers.get("user-agent");
+  if (ua) device.user_agent = ua;
+  return Object.keys(device).length > 0 ? { device } : {};
+}
+function getSimplr(c) {
+  return c.get("simplr") ?? null;
+}
+export {
+  getSimplr,
+  simplrHono
+};
+//# sourceMappingURL=hono.js.map

package/dist/hono.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/client.ts","../src/core.ts","../src/hono.ts"],"sourcesContent":["/**\n * Thin internal client.\n *\n * This is a ~40-line port of the minimal call path from `@simplr-ai/node`\n * (`apiRequest` + `check` + `edge.ingestLogs`) so that this package builds and\n * tests without an unbuilt workspace dependency or any network access.\n *\n * In production this package pairs with `@simplr-ai/node`; the endpoints, auth\n * header (`X-API-Key`), `{ success, message, content }` envelope unwrapping, and\n * 15s default timeout here are byte-for-byte compatible with that SDK and the\n * Simplr API contract.\n */\nimport type { CheckInput, CheckResult, EdgeLogEntry } from \"./types.js\";\n\nconst DEFAULT_BASE_URL = \"https://api.simplr.sh\";\n\n/** Thrown when the Simplr API returns a non-2xx response or the request fails. */\nexport class SimplrError extends Error {\n  readonly status: number;\n  readonly body: unknown;\n  constructor(message: string, status: number, body: unknown) {\n    super(message);\n    this.name = \"SimplrError\";\n    this.status = status;\n    this.body = body;\n  }\n}\n\nexport interface ClientConfig {\n  apiKey: string;\n  baseUrl?: string;\n  timeoutMs?: number;\n  fetch?: typeof fetch;\n}\n\nexport interface SimplrClient {\n  check(input: CheckInput): Promise<CheckResult>;\n  ingestLogs(deviceId: string, logs: EdgeLogEntry[]): Promise<unknown>;\n}\n\nexport function createClient(config: ClientConfig): SimplrClient {\n  if (!config?.apiKey) throw new Error(\"Simplr: `apiKey` is required\");\n  const baseUrl = (config.baseUrl || DEFAULT_BASE_URL).replace(/\\/+$/, \"\");\n  const timeoutMs = config.timeoutMs ?? 15000;\n  const fetchImpl = config.fetch ?? globalThis.fetch;\n  if (typeof fetchImpl !== \"function\") {\n    throw new Error(\n      \"Simplr: no global fetch available — use Node 18+ or pass `fetch` in options\",\n    );\n  }\n\n  async function apiRequest<T>(method: string, path: string, body?: unknown): Promise<T> {\n    const controller = new AbortController();\n    const timer = setTimeout(() => controller.abort(), timeoutMs);\n    try {\n      const res = await fetchImpl(`${baseUrl}${path}`, {\n        method,\n        headers: { \"Content-Type\": \"application/json\", \"X-API-Key\": config.apiKey },\n        body: body !== undefined ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n      const text = await res.text();\n      let parsed: any;\n      try {\n        parsed = text ? JSON.parse(text) : undefined;\n      } catch {\n        parsed = text;\n      }\n      if (!res.ok) {\n        const message =\n          (parsed && (parsed.message || parsed.error)) || `Simplr API error ${res.status}`;\n        throw new SimplrError(message, res.status, parsed);\n      }\n      return (parsed && typeof parsed === \"object\" && \"content\" in parsed\n        ? parsed.content\n        : parsed) as T;\n    } catch (err) {\n      if (err instanceof SimplrError) throw err;\n      if (err instanceof Error && err.name === \"AbortError\") {\n        throw new SimplrError(`Request to ${path} timed out after ${timeoutMs}ms`, 0, null);\n      }\n      throw new SimplrError(err instanceof Error ? err.message : \"Network error\", 0, null);\n    } finally {\n      clearTimeout(timer);\n    }\n  }\n\n  return {\n    check: (input) => apiRequest<CheckResult>(\"POST\", \"/v1/check\", input),\n    ingestLogs: (deviceId, logs) =>\n      apiRequest(\"POST\", \"/v1/edge/logs\", { device_id: deviceId, logs }),\n  };\n}\n","/**\n * Framework-agnostic guard engine.\n *\n * `createGuard` returns an object that, given any request-like object, builds a\n * `CheckInput`, calls `/v1/check`, decides whether to block, optionally ships an\n * edge log, and fails open on error. Framework adapters (express/fastify/hono/\n * next) are thin wrappers over this engine.\n */\nimport { createClient, type SimplrClient } from \"./client.js\";\nimport type {\n  BlockThreshold,\n  CheckInput,\n  CheckResult,\n  GuardContext,\n  GuardOptions,\n  GuardOutcome,\n  RiskLevel,\n} from \"./types.js\";\n\nconst RISK_ORDER: Record<RiskLevel, number> = {\n  low: 0,\n  medium: 1,\n  high: 2,\n  critical: 3,\n};\n\nconst DEFAULT_DEVICE_ID = \"simplr-edge-middleware\";\nconst DEFAULT_THRESHOLD: RiskLevel = \"high\";\n\n/** Numeric rank of a risk level. Unknown levels rank as the lowest (0). */\nexport function riskRank(level: RiskLevel | string | undefined): number {\n  return RISK_ORDER[level as RiskLevel] ?? 0;\n}\n\n/** True when `level` is at least `min` in the low<medium<high<critical ordering. */\nexport function riskAtLeast(level: RiskLevel | string | undefined, min: RiskLevel): boolean {\n  return riskRank(level) >= riskRank(min);\n}\n\n/** Read a header from either a plain bag (lowercase keys) or a Headers-like getter. */\nfunction readHeader(headers: unknown, name: string): string | undefined {\n  if (!headers) return undefined;\n  const h = headers as any;\n  if (typeof h.get === \"function\") {\n    const v = h.get(name);\n    return v == null ? undefined : String(v);\n  }\n  // Plain object: try the lowercase key, then a case-insensitive scan.\n  const lower = name.toLowerCase();\n  if (lower in h && h[lower] != null) return String(h[lower]);\n  for (const key of Object.keys(h)) {\n    if (key.toLowerCase() === lower && h[key] != null) return String(h[key]);\n  }\n  return undefined;\n}\n\n/** Best-effort client IP from common header and socket locations. */\nfunction extractIp(req: any): string | undefined {\n  const fwd = readHeader(req?.headers, \"x-forwarded-for\");\n  if (fwd) return fwd.split(\",\")[0]!.trim();\n  const real = readHeader(req?.headers, \"x-real-ip\");\n  if (real) return real;\n  return (\n    req?.ip ||\n    req?.socket?.remoteAddress ||\n    req?.connection?.remoteAddress ||\n    undefined\n  );\n}\n\n/**\n * Default request → CheckInput extractor. Pulls the client IP and user-agent into\n * `device`, and lifts `email`/`phone` from a parsed JSON body when present.\n */\nexport function defaultExtract(req: any): CheckInput {\n  const input: CheckInput = {};\n\n  const device: Record<string, unknown> = {};\n  const ip = extractIp(req);\n  if (ip) device.ip = ip;\n  const ua = readHeader(req?.headers, \"user-agent\");\n  if (ua) device.user_agent = ua;\n  if (Object.keys(device).length > 0) input.device = device;\n\n  const body = req?.body;\n  if (body && typeof body === \"object\") {\n    const b = body as Record<string, unknown>;\n    if (typeof b.email === \"string\") input.email = b.email;\n    if (typeof b.phone === \"string\") input.phone = b.phone;\n  }\n\n  return input;\n}\n\nfunction normalizeBlock(\n  block: GuardOptions[\"block\"],\n): (result: CheckResult) => boolean {\n  if (typeof block === \"function\") return block;\n  const threshold = (block as BlockThreshold | undefined)?.whenRiskAtLeast ?? DEFAULT_THRESHOLD;\n  return (result) => riskAtLeast(result.risk_level, threshold);\n}\n\nexport interface Guard<Req = any> {\n  /** The underlying thin Simplr client (check + edge log ingestion). */\n  readonly client: SimplrClient;\n  /** Run the full engine against a request; never throws when `failOpen`. */\n  run(req: Req): Promise<GuardOutcome>;\n}\n\nexport function createGuard<Req = any>(options: GuardOptions<Req>): Guard<Req> {\n  if (!options?.apiKey) throw new Error(\"createGuard: `apiKey` is required\");\n\n  const client = createClient({\n    apiKey: options.apiKey,\n    baseUrl: options.baseUrl,\n    timeoutMs: options.timeoutMs,\n    fetch: options.fetch,\n  });\n\n  const extract = options.extract ?? defaultExtract;\n  const shouldBlock = normalizeBlock(options.block);\n  const failOpen = options.failOpen ?? true;\n  const ingestLogs = options.ingestLogs ?? false;\n  const deviceId = options.deviceId ?? DEFAULT_DEVICE_ID;\n\n  async function run(req: Req): Promise<GuardOutcome> {\n    const input = await extract(req);\n    let result: CheckResult;\n    try {\n      result = await client.check(input);\n    } catch (error) {\n      if (failOpen) {\n        return { result: null, blocked: false, input, error };\n      }\n      throw error;\n    }\n\n    const blocked = shouldBlock(result);\n    const ctx: GuardContext<Req> = { req, input, blocked };\n\n    if (options.onResult) {\n      try {\n        await options.onResult(result, ctx);\n      } catch {\n        // onResult is observational; never let it break the request.\n      }\n    }\n\n    if (ingestLogs) {\n      try {\n        await client.ingestLogs(deviceId, [\n          {\n            category: \"security\",\n            level: blocked ? \"warn\" : \"info\",\n            message: blocked ? \"simplr guard blocked request\" : \"simplr guard checked request\",\n            risk_level: result.risk_level,\n            risk_score: result.risk_score,\n          },\n        ]);\n      } catch {\n        // Log shipping is best-effort and must never affect the request.\n      }\n    }\n\n    return { result, blocked, input };\n  }\n\n  return { client, run };\n}\n\n/** Standard JSON envelope returned to the client on a blocked request. */\nexport function blockEnvelope(result: CheckResult) {\n  return {\n    error: \"request_blocked\",\n    message: \"This request was blocked by Simplr fraud protection.\",\n    risk_level: result.risk_level,\n    risk_score: result.risk_score,\n  };\n}\n","/**\n * Hono adapter. Middleware that stores the result via `c.set('simplr', result)`\n * (read it back with `c.get('simplr')`) and returns a 403 JSON response on block.\n *\n * ```ts\n * import { Hono } from \"hono\";\n * import { simplrHono } from \"@simplr-ai/express/hono\";\n * const app = new Hono();\n * app.use(\"*\", simplrHono({ apiKey: process.env.SIMPLR_API_KEY! }));\n * ```\n */\nimport { blockEnvelope, createGuard } from \"./core.js\";\nimport type { CheckResult, GuardOptions } from \"./types.js\";\n\ntype HonoContext = {\n  req: {\n    /** Hono exposes headers via `c.req.header(name)`. */\n    header(name: string): string | undefined;\n    /** Parsed JSON body, if read. The default extractor reads `c.get`-supplied body. */\n    [key: string]: unknown;\n  };\n  set(key: string, value: unknown): void;\n  get(key: string): unknown;\n  json(body: unknown, status?: number): Response;\n};\ntype HonoNext = () => Promise<void>;\n\nexport type HonoMiddleware = (c: HonoContext, next: HonoNext) => Promise<Response | void>;\n\n/**\n * Build Hono middleware. Because Hono request bodies are read asynchronously,\n * the default extractor relies on headers; to also score body email/phone, set\n * a custom `extract` that awaits `await c.req.json()` (and stashes it as needed).\n */\nexport function simplrHono(options: GuardOptions<HonoContext>): HonoMiddleware {\n  const guard = createGuard<HonoContext>({\n    ...options,\n    // Adapt Hono's header accessor into the shape the default extractor expects.\n    extract:\n      options.extract ??\n      ((c) => {\n        const headerGet = (name: string) => c.req.header(name);\n        return defaultHonoExtract({ get: headerGet });\n      }),\n  });\n  const failOpen = options.failOpen ?? true;\n\n  return async function simplrMiddleware(c, next) {\n    try {\n      const outcome = await guard.run(c);\n      c.set(\"simplr\", outcome.result);\n      if (outcome.blocked && outcome.result) {\n        return c.json(blockEnvelope(outcome.result), 403);\n      }\n    } catch (err) {\n      if (!failOpen) throw err;\n      c.set(\"simplr\", null);\n    }\n    await next();\n  };\n}\n\n/** Minimal extractor over a Headers-like getter (IP + user-agent into device). */\nfunction defaultHonoExtract(headers: { get(name: string): string | undefined }) {\n  const device: Record<string, unknown> = {};\n  const fwd = headers.get(\"x-forwarded-for\");\n  const ip = fwd ? fwd.split(\",\")[0]!.trim() : headers.get(\"x-real-ip\");\n  if (ip) device.ip = ip;\n  const ua = headers.get(\"user-agent\");\n  if (ua) device.user_agent = ua;\n  return Object.keys(device).length > 0 ? { device } : {};\n}\n\n/** Helper to read the stored result inside a handler: `getSimplr(c)`. */\nexport function getSimplr(c: HonoContext): CheckResult | null {\n  return (c.get(\"simplr\") as CheckResult | null) ?? null;\n}\n"],"mappings":";AAcA,IAAM,mBAAmB;AAGlB,IAAM,cAAN,cAA0B,MAAM;AAAA,EAC5B;AAAA,EACA;AAAA,EACT,YAAY,SAAiB,QAAgB,MAAe;AAC1D,UAAM,OAAO;AACb,SAAK,OAAO;AACZ,SAAK,SAAS;AACd,SAAK,OAAO;AAAA,EACd;AACF;AAcO,SAAS,aAAa,QAAoC;AAC/D,MAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,8BAA8B;AACnE,QAAM,WAAW,OAAO,WAAW,kBAAkB,QAAQ,QAAQ,EAAE;AACvE,QAAM,YAAY,OAAO,aAAa;AACtC,QAAM,YAAY,OAAO,SAAS,WAAW;AAC7C,MAAI,OAAO,cAAc,YAAY;AACnC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,iBAAe,WAAc,QAAgB,MAAc,MAA4B;AACrF,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,QAAI;AACF,YAAM,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,IAAI,IAAI;AAAA,QAC/C;AAAA,QACA,SAAS,EAAE,gBAAgB,oBAAoB,aAAa,OAAO,OAAO;AAAA,QAC1E,MAAM,SAAS,SAAY,KAAK,UAAU,IAAI,IAAI;AAAA,QAClD,QAAQ,WAAW;AAAA,MACrB,CAAC;AACD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,UAAI;AACJ,UAAI;AACF,iBAAS,OAAO,KAAK,MAAM,IAAI,IAAI;AAAA,MACrC,QAAQ;AACN,iBAAS;AAAA,MACX;AACA,UAAI,CAAC,IAAI,IAAI;AACX,cAAM,UACH,WAAW,OAAO,WAAW,OAAO,UAAW,oBAAoB,IAAI,MAAM;AAChF,cAAM,IAAI,YAAY,SAAS,IAAI,QAAQ,MAAM;AAAA,MACnD;AACA,aAAQ,UAAU,OAAO,WAAW,YAAY,aAAa,SACzD,OAAO,UACP;AAAA,IACN,SAAS,KAAK;AACZ,UAAI,eAAe,YAAa,OAAM;AACtC,UAAI,eAAe,SAAS,IAAI,SAAS,cAAc;AACrD,cAAM,IAAI,YAAY,cAAc,IAAI,oBAAoB,SAAS,MAAM,GAAG,IAAI;AAAA,MACpF;AACA,YAAM,IAAI,YAAY,eAAe,QAAQ,IAAI,UAAU,iBAAiB,GAAG,IAAI;AAAA,IACrF,UAAE;AACA,mBAAa,KAAK;AAAA,IACpB;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,CAAC,UAAU,WAAwB,QAAQ,aAAa,KAAK;AAAA,IACpE,YAAY,CAAC,UAAU,SACrB,WAAW,QAAQ,iBAAiB,EAAE,WAAW,UAAU,KAAK,CAAC;AAAA,EACrE;AACF;;;ACzEA,IAAM,aAAwC;AAAA,EAC5C,KAAK;AAAA,EACL,QAAQ;AAAA,EACR,MAAM;AAAA,EACN,UAAU;AACZ;AAEA,IAAM,oBAAoB;AAC1B,IAAM,oBAA+B;AAG9B,SAAS,SAAS,OAA+C;AACtE,SAAO,WAAW,KAAkB,KAAK;AAC3C;AAGO,SAAS,YAAY,OAAuC,KAAyB;AAC1F,SAAO,SAAS,KAAK,KAAK,SAAS,GAAG;AACxC;AAGA,SAAS,WAAW,SAAkB,MAAkC;AACtE,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,IAAI;AACV,MAAI,OAAO,EAAE,QAAQ,YAAY;AAC/B,UAAM,IAAI,EAAE,IAAI,IAAI;AACpB,WAAO,KAAK,OAAO,SAAY,OAAO,CAAC;AAAA,EACzC;AAEA,QAAM,QAAQ,KAAK,YAAY;AAC/B,MAAI,SAAS,KAAK,EAAE,KAAK,KAAK,KAAM,QAAO,OAAO,EAAE,KAAK,CAAC;AAC1D,aAAW,OAAO,OAAO,KAAK,CAAC,GAAG;AAChC,QAAI,IAAI,YAAY,MAAM,SAAS,EAAE,GAAG,KAAK,KAAM,QAAO,OAAO,EAAE,GAAG,CAAC;AAAA,EACzE;AACA,SAAO;AACT;AAGA,SAAS,UAAU,KAA8B;AAC/C,QAAM,MAAM,WAAW,KAAK,SAAS,iBAAiB;AACtD,MAAI,IAAK,QAAO,IAAI,MAAM,GAAG,EAAE,CAAC,EAAG,KAAK;AACxC,QAAM,OAAO,WAAW,KAAK,SAAS,WAAW;AACjD,MAAI,KAAM,QAAO;AACjB,SACE,KAAK,MACL,KAAK,QAAQ,iBACb,KAAK,YAAY,iBACjB;AAEJ;AAMO,SAAS,eAAe,KAAsB;AACnD,QAAM,QAAoB,CAAC;AAE3B,QAAM,SAAkC,CAAC;AACzC,QAAM,KAAK,UAAU,GAAG;AACxB,MAAI,GAAI,QAAO,KAAK;AACpB,QAAM,KAAK,WAAW,KAAK,SAAS,YAAY;AAChD,MAAI,GAAI,QAAO,aAAa;AAC5B,MAAI,OAAO,KAAK,MAAM,EAAE,SAAS,EAAG,OAAM,SAAS;AAEnD,QAAM,OAAO,KAAK;AAClB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,IAAI;AACV,QAAI,OAAO,EAAE,UAAU,SAAU,OAAM,QAAQ,EAAE;AACjD,QAAI,OAAO,EAAE,UAAU,SAAU,OAAM,QAAQ,EAAE;AAAA,EACnD;AAEA,SAAO;AACT;AAEA,SAAS,eACP,OACkC;AAClC,MAAI,OAAO,UAAU,WAAY,QAAO;AACxC,QAAM,YAAa,OAAsC,mBAAmB;AAC5E,SAAO,CAAC,WAAW,YAAY,OAAO,YAAY,SAAS;AAC7D;AASO,SAAS,YAAuB,SAAwC;AAC7E,MAAI,CAAC,SAAS,OAAQ,OAAM,IAAI,MAAM,mCAAmC;AAEzE,QAAM,SAAS,aAAa;AAAA,IAC1B,QAAQ,QAAQ;AAAA,IAChB,SAAS,QAAQ;AAAA,IACjB,WAAW,QAAQ;AAAA,IACnB,OAAO,QAAQ;AAAA,EACjB,CAAC;AAED,QAAM,UAAU,QAAQ,WAAW;AACnC,QAAM,cAAc,eAAe,QAAQ,KAAK;AAChD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,aAAa,QAAQ,cAAc;AACzC,QAAM,WAAW,QAAQ,YAAY;AAErC,iBAAe,IAAI,KAAiC;AAClD,UAAM,QAAQ,MAAM,QAAQ,GAAG;AAC/B,QAAI;AACJ,QAAI;AACF,eAAS,MAAM,OAAO,MAAM,KAAK;AAAA,IACnC,SAAS,OAAO;AACd,UAAI,UAAU;AACZ,eAAO,EAAE,QAAQ,MAAM,SAAS,OAAO,OAAO,MAAM;AAAA,MACtD;AACA,YAAM;AAAA,IACR;AAEA,UAAM,UAAU,YAAY,MAAM;AAClC,UAAM,MAAyB,EAAE,KAAK,OAAO,QAAQ;AAErD,QAAI,QAAQ,UAAU;AACpB,UAAI;AACF,cAAM,QAAQ,SAAS,QAAQ,GAAG;AAAA,MACpC,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,QAAI,YAAY;AACd,UAAI;AACF,cAAM,OAAO,WAAW,UAAU;AAAA,UAChC;AAAA,YACE,UAAU;AAAA,YACV,OAAO,UAAU,SAAS;AAAA,YAC1B,SAAS,UAAU,iCAAiC;AAAA,YACpD,YAAY,OAAO;AAAA,YACnB,YAAY,OAAO;AAAA,UACrB;AAAA,QACF,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,WAAO,EAAE,QAAQ,SAAS,MAAM;AAAA,EAClC;AAEA,SAAO,EAAE,QAAQ,IAAI;AACvB;AAGO,SAAS,cAAc,QAAqB;AACjD,SAAO;AAAA,IACL,OAAO;AAAA,IACP,SAAS;AAAA,IACT,YAAY,OAAO;AAAA,IACnB,YAAY,OAAO;AAAA,EACrB;AACF;;;AChJO,SAAS,WAAW,SAAoD;AAC7E,QAAM,QAAQ,YAAyB;AAAA,IACrC,GAAG;AAAA;AAAA,IAEH,SACE,QAAQ,YACP,CAAC,MAAM;AACN,YAAM,YAAY,CAAC,SAAiB,EAAE,IAAI,OAAO,IAAI;AACrD,aAAO,mBAAmB,EAAE,KAAK,UAAU,CAAC;AAAA,IAC9C;AAAA,EACJ,CAAC;AACD,QAAM,WAAW,QAAQ,YAAY;AAErC,SAAO,eAAe,iBAAiB,GAAG,MAAM;AAC9C,QAAI;AACF,YAAM,UAAU,MAAM,MAAM,IAAI,CAAC;AACjC,QAAE,IAAI,UAAU,QAAQ,MAAM;AAC9B,UAAI,QAAQ,WAAW,QAAQ,QAAQ;AACrC,eAAO,EAAE,KAAK,cAAc,QAAQ,MAAM,GAAG,GAAG;AAAA,MAClD;AAAA,IACF,SAAS,KAAK;AACZ,UAAI,CAAC,SAAU,OAAM;AACrB,QAAE,IAAI,UAAU,IAAI;AAAA,IACtB;AACA,UAAM,KAAK;AAAA,EACb;AACF;AAGA,SAAS,mBAAmB,SAAoD;AAC9E,QAAM,SAAkC,CAAC;AACzC,QAAM,MAAM,QAAQ,IAAI,iBAAiB;AACzC,QAAM,KAAK,MAAM,IAAI,MAAM,GAAG,EAAE,CAAC,EAAG,KAAK,IAAI,QAAQ,IAAI,WAAW;AACpE,MAAI,GAAI,QAAO,KAAK;AACpB,QAAM,KAAK,QAAQ,IAAI,YAAY;AACnC,MAAI,GAAI,QAAO,aAAa;AAC5B,SAAO,OAAO,KAAK,MAAM,EAAE,SAAS,IAAI,EAAE,OAAO,IAAI,CAAC;AACxD;AAGO,SAAS,UAAU,GAAoC;AAC5D,SAAQ,EAAE,IAAI,QAAQ,KAA4B;AACpD;","names":[]}