@sponsio/sdk 0.1.0 → 0.2.0-alpha.8

package/dist/cloud/client.d.ts

@@ -0,0 +1,76 @@
+/**
+ * Talking to the cloud.
+ *
+ * Port of ``sponsio/cloud/client.py`` narrowed to the two calls an agent
+ * makes at runtime: pull the book it should enforce, and upload what it
+ * did. Everything else in the Python client belongs to the CLI.
+ *
+ * Until this existed the TypeScript SDK enforced correctly and uploaded
+ * nothing, so a customer running a TypeScript agent showed up in the
+ * console with no runs at all: rules could not be rolled out to them and
+ * nothing they did could be seen.
+ */
+export declare class CloudError extends Error {
+    readonly status?: number;
+    constructor(message: string, status?: number);
+}
+/**
+ * ``SPONSIO_API_KEY`` first, then ``~/.sponsio/credentials``. The
+ * environment wins so CI and one-off runs can override a logged-in
+ * machine without touching files.
+ */
+export declare function readApiKey(): string | null;
+/**
+ * ``SPONSIO_PROJECT``, or null.
+ *
+ * Which customer a run belongs to is deployment configuration, not code.
+ * A platform running one agent for forty customers ships one image and
+ * varies the environment; naming the customer in the call would mean an
+ * image per customer.
+ */
+export declare function readProject(): string | null;
+export declare function baseUrl(): string;
+export interface PulledRulebook {
+    yamlText: string;
+    versions?: string;
+    sha?: string;
+    agent?: string;
+    channel?: string;
+}
+export interface CloudClientOptions {
+    apiKey?: string | null;
+    baseUrl?: string;
+    /** Milliseconds. A run must not wait on telemetry. */
+    timeoutMs?: number;
+}
+export declare class CloudClient {
+    readonly apiKey: string | null;
+    readonly base: string;
+    readonly timeoutMs: number;
+    constructor(opts?: CloudClientOptions);
+    /** Whether there is a credential to speak with at all. */
+    get configured(): boolean;
+    private request;
+    private static detail;
+    /**
+     * Fetch a project's rulebook.
+     *
+     * Without ``agent`` this returns every agent merged into one document:
+     * a guard binds by agent id and loads only its own section, so one
+     * request serves a whole repo.
+     */
+    pullRulebook(project?: string | null, opts?: {
+        agent?: string;
+        version?: number;
+    }): Promise<PulledRulebook>;
+    /**
+     * Send a run to the cloud.
+     *
+     * Idempotent on the session key server-side, so a retry after a blip
+     * cannot double a run. Callers on the hot path must not wait on this:
+     * telemetry is outbound-only and best-effort, and losing it must never
+     * change what the agent does.
+     */
+    ingestSession(project: string | null, payload: Record<string, unknown>): Promise<Record<string, unknown>>;
+}
+//# sourceMappingURL=client.d.ts.map

package/dist/cloud/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/cloud/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,qBAAa,UAAW,SAAQ,KAAK;IACnC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK7C;AAED;;;;GAIG;AACH,wBAAgB,UAAU,IAAI,MAAM,GAAG,IAAI,CAkB1C;AAED;;;;;;;GAOG;AACH,wBAAgB,WAAW,IAAI,MAAM,GAAG,IAAI,CAE3C;AAcD,wBAAgB,OAAO,IAAI,MAAM,CAGhC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,sDAAsD;IACtD,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,WAAW;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,IAAI,GAAE,kBAAuB;IAMzC,0DAA0D;IAC1D,IAAI,UAAU,IAAI,OAAO,CAExB;YAEa,OAAO;IA0BrB,OAAO,CAAC,MAAM,CAAC,MAAM;IAerB;;;;;;OAMG;IACG,YAAY,CAChB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,EACvB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9C,OAAO,CAAC,cAAc,CAAC;IAkC1B;;;;;;;OAOG;IACG,aAAa,CACjB,OAAO,EAAE,MAAM,GAAG,IAAI,EACtB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC/B,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAsBpC"}

package/dist/cloud/client.js

@@ -0,0 +1,198 @@
+/**
+ * Talking to the cloud.
+ *
+ * Port of ``sponsio/cloud/client.py`` narrowed to the two calls an agent
+ * makes at runtime: pull the book it should enforce, and upload what it
+ * did. Everything else in the Python client belongs to the CLI.
+ *
+ * Until this existed the TypeScript SDK enforced correctly and uploaded
+ * nothing, so a customer running a TypeScript agent showed up in the
+ * console with no runs at all: rules could not be rolled out to them and
+ * nothing they did could be seen.
+ */
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { readFileSync } from "node:fs";
+const DEFAULT_BASE_URL = "https://app.sponsio.dev";
+const CREDENTIALS_PATH = join(homedir(), ".sponsio", "credentials");
+export class CloudError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = "CloudError";
+        if (status !== undefined)
+            this.status = status;
+    }
+}
+/**
+ * ``SPONSIO_API_KEY`` first, then ``~/.sponsio/credentials``. The
+ * environment wins so CI and one-off runs can override a logged-in
+ * machine without touching files.
+ */
+export function readApiKey() {
+    const env = (process.env.SPONSIO_API_KEY ?? "").trim();
+    if (env)
+        return env;
+    try {
+        for (const line of readFileSync(CREDENTIALS_PATH, "utf8").split("\n")) {
+            const t = line.trim();
+            if (!t || t.startsWith("#"))
+                continue;
+            const eq = t.indexOf("=");
+            if (eq < 0)
+                continue;
+            if (t.slice(0, eq).trim() === "api_key") {
+                const v = t.slice(eq + 1).trim();
+                if (v)
+                    return v;
+            }
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+/**
+ * ``SPONSIO_PROJECT``, or null.
+ *
+ * Which customer a run belongs to is deployment configuration, not code.
+ * A platform running one agent for forty customers ships one image and
+ * varies the environment; naming the customer in the call would mean an
+ * image per customer.
+ */
+export function readProject() {
+    return (process.env.SPONSIO_PROJECT ?? "").trim() || null;
+}
+/**
+ * Strip trailing slashes without a regex.
+ *
+ * ``/\/+$/`` is quadratic on a string that is mostly slashes, and the
+ * base URL comes from the environment on a machine we do not run.
+ */
+function trimSlashes(url) {
+    let end = url.length;
+    while (end > 0 && url.charCodeAt(end - 1) === 47)
+        end--;
+    return url.slice(0, end);
+}
+export function baseUrl() {
+    const explicit = (process.env.SPONSIO_API_URL ?? "").trim();
+    return trimSlashes(explicit || DEFAULT_BASE_URL);
+}
+export class CloudClient {
+    apiKey;
+    base;
+    timeoutMs;
+    constructor(opts = {}) {
+        this.apiKey = opts.apiKey === undefined ? readApiKey() : opts.apiKey;
+        this.base = trimSlashes(opts.baseUrl ?? baseUrl());
+        this.timeoutMs = opts.timeoutMs ?? 10_000;
+    }
+    /** Whether there is a credential to speak with at all. */
+    get configured() {
+        return Boolean(this.apiKey);
+    }
+    async request(method, path, body, contentType) {
+        if (!this.apiKey)
+            throw new CloudError("no API key configured");
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        try {
+            const headers = {
+                Authorization: `Bearer ${this.apiKey}`,
+            };
+            if (contentType)
+                headers["Content-Type"] = contentType;
+            const res = await fetch(this.base + path, {
+                method,
+                headers,
+                ...(body === undefined ? {} : { body }),
+                signal: controller.signal,
+            });
+            return { status: res.status, text: await res.text(), headers: res.headers };
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    static detail(text, fallback) {
+        try {
+            const parsed = JSON.parse(text);
+            const d = parsed.detail;
+            if (typeof d === "string")
+                return d;
+            if (d && typeof d === "object") {
+                const o = d;
+                return o.message ?? o.error ?? fallback;
+            }
+        }
+        catch {
+            /* not JSON; the fallback says what happened */
+        }
+        return fallback;
+    }
+    /**
+     * Fetch a project's rulebook.
+     *
+     * Without ``agent`` this returns every agent merged into one document:
+     * a guard binds by agent id and loads only its own section, so one
+     * request serves a whole repo.
+     */
+    async pullRulebook(project, opts = {}) {
+        const q = [];
+        if (project)
+            q.push(`project=${encodeURIComponent(project)}`);
+        if (opts.agent)
+            q.push(`agent=${encodeURIComponent(opts.agent)}`);
+        if (opts.version !== undefined)
+            q.push(`version=${opts.version}`);
+        const path = "/v1/rulebook" + (q.length ? "?" + q.join("&") : "");
+        const { status, text, headers } = await this.request("GET", path);
+        if (status === 404) {
+            // "Nothing published yet" rather than a failure: the caller may
+            // publish its local yaml instead of giving up.
+            throw new CloudError(CloudClient.detail(text, "no rulebook published"), 404);
+        }
+        if (status !== 200) {
+            throw new CloudError(CloudClient.detail(text, `pull failed (${status})`), status);
+        }
+        const out = { yamlText: text };
+        const v = headers.get("x-rulebook-versions") ?? headers.get("x-rulebook-version");
+        if (v)
+            out.versions = v;
+        const sha = headers.get("x-rulebook-sha");
+        if (sha)
+            out.sha = sha;
+        const agent = headers.get("x-rulebook-agent");
+        if (agent)
+            out.agent = agent;
+        const channel = headers.get("x-rulebook-channel");
+        if (channel)
+            out.channel = channel;
+        return out;
+    }
+    /**
+     * Send a run to the cloud.
+     *
+     * Idempotent on the session key server-side, so a retry after a blip
+     * cannot double a run. Callers on the hot path must not wait on this:
+     * telemetry is outbound-only and best-effort, and losing it must never
+     * change what the agent does.
+     */
+    async ingestSession(project, payload) {
+        const path = "/v1/sessions/ingest" +
+            (project ? `?project=${encodeURIComponent(project)}` : "");
+        const { status, text } = await this.request("POST", path, JSON.stringify(payload), "application/json");
+        if (status !== 200) {
+            throw new CloudError(CloudClient.detail(text, `ingest failed (${status})`), status);
+        }
+        try {
+            return JSON.parse(text);
+        }
+        catch {
+            throw new CloudError("ingest returned a non-JSON body", status);
+        }
+    }
+}
+//# sourceMappingURL=client.js.map

package/dist/cloud/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/cloud/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC,MAAM,gBAAgB,GAAG,yBAAyB,CAAC;AACnD,MAAM,gBAAgB,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC;AAEpE,MAAM,OAAO,UAAW,SAAQ,KAAK;IAC1B,MAAM,CAAU;IACzB,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;QACzB,IAAI,MAAM,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACjD,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,UAAU,UAAU;IACxB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,GAAG;QAAE,OAAO,GAAG,CAAC;IACpB,IAAI,CAAC;QACH,KAAK,MAAM,IAAI,IAAI,YAAY,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACtE,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YACtB,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,SAAS;YACtC,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;YAC1B,IAAI,EAAE,GAAG,CAAC;gBAAE,SAAS;YACrB,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;gBACxC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBACjC,IAAI,CAAC;oBAAE,OAAO,CAAC,CAAC;YAClB,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AAC5D,CAAC;AAED;;;;;GAKG;AACH,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC;IACrB,OAAO,GAAG,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,GAAG,EAAE,CAAC;IACxD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,OAAO;IACrB,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC5D,OAAO,WAAW,CAAC,QAAQ,IAAI,gBAAgB,CAAC,CAAC;AACnD,CAAC;AAiBD,MAAM,OAAO,WAAW;IACb,MAAM,CAAgB;IACtB,IAAI,CAAS;IACb,SAAS,CAAS;IAE3B,YAAY,OAA2B,EAAE;QACvC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC;QACrE,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,EAAE,CAAC,CAAC;QACnD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC5C,CAAC;IAED,0DAA0D;IAC1D,IAAI,UAAU;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,OAAO,CACnB,MAAc,EACd,IAAY,EACZ,IAAa,EACb,WAAoB;QAEpB,IAAI,CAAC,IAAI,CAAC,MAAM;YAAE,MAAM,IAAI,UAAU,CAAC,uBAAuB,CAAC,CAAC;QAChE,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,CAAC;YACH,MAAM,OAAO,GAA2B;gBACtC,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;aACvC,CAAC;YACF,IAAI,WAAW;gBAAE,OAAO,CAAC,cAAc,CAAC,GAAG,WAAW,CAAC;YACvD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE;gBACxC,MAAM;gBACN,OAAO;gBACP,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;gBACvC,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YACH,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC;QAC9E,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAEO,MAAM,CAAC,MAAM,CAAC,IAAY,EAAE,QAAgB;QAClD,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAyB,CAAC;YACxD,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC;YACxB,IAAI,OAAO,CAAC,KAAK,QAAQ;gBAAE,OAAO,CAAC,CAAC;YACpC,IAAI,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC/B,MAAM,CAAC,GAAG,CAAyC,CAAC;gBACpD,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,KAAK,IAAI,QAAQ,CAAC;YAC1C,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,+CAA+C;QACjD,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,YAAY,CAChB,OAAuB,EACvB,OAA6C,EAAE;QAE/C,MAAM,CAAC,GAAa,EAAE,CAAC;QACvB,IAAI,OAAO;YAAE,CAAC,CAAC,IAAI,CAAC,WAAW,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,KAAK;YAAE,CAAC,CAAC,IAAI,CAAC,SAAS,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClE,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,CAAC,CAAC,IAAI,CAAC,WAAW,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,cAAc,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAElE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;QAClE,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,gEAAgE;YAChE,+CAA+C;YAC/C,MAAM,IAAI,UAAU,CAClB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,CAAC,EACjD,GAAG,CACJ,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAClB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,gBAAgB,MAAM,GAAG,CAAC,EACnD,MAAM,CACP,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAmB,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;QAC/C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClF,IAAI,CAAC;YAAE,GAAG,CAAC,QAAQ,GAAG,CAAC,CAAC;QACxB,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QAC1C,IAAI,GAAG;YAAE,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC;QAC9C,IAAI,KAAK;YAAE,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC;QAC7B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAClD,IAAI,OAAO;YAAE,GAAG,CAAC,OAAO,GAAG,OAAO,CAAC;QACnC,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;OAOG;IACH,KAAK,CAAC,aAAa,CACjB,OAAsB,EACtB,OAAgC;QAEhC,MAAM,IAAI,GACR,qBAAqB;YACrB,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAC7D,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,IAAI,CAAC,OAAO,CACzC,MAAM,EACN,IAAI,EACJ,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EACvB,kBAAkB,CACnB,CAAC;QACF,IAAI,MAAM,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAClB,WAAW,CAAC,MAAM,CAAC,IAAI,EAAE,kBAAkB,MAAM,GAAG,CAAC,EACrD,MAAM,CACP,CAAC;QACJ,CAAC;QACD,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAAC,iCAAiC,EAAE,MAAM,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;CACF"}

package/dist/cloud/evidence.d.ts

@@ -0,0 +1,108 @@
+/**
+ * The evidence lane, from TypeScript.
+ *
+ * Rules check what an agent *does*; evidence checks what it *says*. A
+ * model that reports "the three line items total $100" is making a claim
+ * that is either true of the numbers it was given or is not, and no
+ * amount of prompting settles it. This sends the claim to
+ * `/v1/evidence/verify`, which resolves it against the declared inputs
+ * and answers PASS, MISMATCH, or a verdict meaning it could not tell.
+ *
+ * Parity with `sponsio/cloud/evidence.py`: same endpoint, same wire
+ * shape, same verdict vocabulary. One service, one meter — the server
+ * records usage per tenant and cannot see which SDK called it.
+ *
+ * The judgement is entirely server-side. This file normalises inputs,
+ * makes one request, and classifies the answer.
+ *
+ * @module @sponsio/sdk/cloud/evidence
+ */
+/** A verdict the server can return. Anything else is treated as unknown. */
+export type EvidenceVerdict = "PASS" | "MISMATCH" | "NO_EVIDENCE" | "SOURCE_UNAVAILABLE" | "UNDERDETERMINED";
+/** What the server says to do about a verdict. */
+export type EvidenceAction = "release" | "block" | "clarify";
+/**
+ * One input, tagged with where its value came from.
+ *
+ * The tag is not decoration. Each predicate declares which sources it
+ * will accept, and the server refuses a value that arrived from anywhere
+ * else: a total the model made up must not be checked against itself.
+ * `GET /v1/evidence/predicates` lists the allowlist per predicate.
+ */
+export interface TaggedInput {
+    value: unknown;
+    source: string;
+}
+/** Ergonomic forms accepted per input: a tagged object or a `[value, source]` pair. */
+export type InputSpec = TaggedInput | [unknown, string];
+export interface EvidenceResult {
+    predicate: string;
+    verdict: EvidenceVerdict | string;
+    action: EvidenceAction | string;
+    /** The resolved values the verdict was reached from. */
+    values: unknown[];
+    evidenceTs?: number;
+    source?: string;
+    tableVersion?: string;
+    /** The right value, when the server knows it. Never invented. */
+    correction?: unknown;
+    /** What to ask about, on a clarify action. */
+    clarifyOn: unknown[];
+    /** Server-side record of this check, for an audit trail. */
+    attestationId?: string;
+}
+/** The check did not reach a verdict. The caller decides open or closed. */
+export declare class EvidenceError extends Error {
+    readonly status?: number;
+    constructor(message: string, status?: number);
+}
+/** True when this verdict must stop the response. */
+export declare function isBlocking(result: EvidenceResult): boolean;
+/** True when this verdict asks the agent to clarify rather than stop. */
+export declare function needsClarification(result: EvidenceResult): boolean;
+/**
+ * Ergonomic input forms to the wire's tagged shape.
+ *
+ * An untagged input is rejected here rather than sent. The server would
+ * refuse it anyway under the taint rule, and failing locally names the
+ * input that is missing its tag.
+ *
+ * The pair form needs a string source. Without that check a two-element
+ * array of data read as a pair: `{ items: [40, 60] }` became
+ * `value: 40, source: "60"`, and the server then refused source `"60"`
+ * as untrusted, an error naming nothing the caller had written. A list
+ * value takes the explicit form, `[[40, 60], "submitted_output"]`.
+ */
+export declare function normalizeInputs(inputs?: Record<string, InputSpec>): Record<string, TaggedInput>;
+export interface EvidenceClientOptions {
+    /** Defaults to `SPONSIO_API_KEY`. */
+    apiKey?: string;
+    /** Defaults to `SPONSIO_API_URL`, then `https://app.sponsio.dev`. */
+    url?: string;
+    /** Per-request timeout in milliseconds. */
+    timeoutMs?: number;
+}
+export declare class EvidenceClient {
+    readonly url: string;
+    private readonly apiKey;
+    private readonly timeoutMs;
+    constructor(opts?: EvidenceClientOptions);
+    get configured(): boolean;
+    private post;
+    /**
+     * Verify one claim against fresh evidence, server-side.
+     *
+     * Throws `EvidenceError` when the check did not run to a verdict.
+     * Decide open or closed at the call site; closed means treating the
+     * throw as a block.
+     */
+    verify(predicate: string, opts?: {
+        value?: unknown;
+        text?: string;
+        inputs?: Record<string, InputSpec>;
+        sessionId?: string;
+    }): Promise<EvidenceResult>;
+    /** The predicate catalog this key can reach. */
+    predicates(): Promise<Record<string, unknown>[]>;
+}
+//# sourceMappingURL=evidence.d.ts.map

package/dist/cloud/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../src/cloud/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,4EAA4E;AAC5E,MAAM,MAAM,eAAe,GACvB,MAAM,GACN,UAAU,GACV,aAAa,GACb,oBAAoB,GACpB,iBAAiB,CAAC;AAEtB,kDAAkD;AAClD,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,OAAO,GAAG,SAAS,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,uFAAuF;AACvF,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AAExD,MAAM,WAAW,cAAc;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,eAAe,GAAG,MAAM,CAAC;IAClC,MAAM,EAAE,cAAc,GAAG,MAAM,CAAC;IAChC,wDAAwD;IACxD,MAAM,EAAE,OAAO,EAAE,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,iEAAiE;IACjE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,8CAA8C;IAC9C,SAAS,EAAE,OAAO,EAAE,CAAC;IACrB,4DAA4D;IAC5D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,4EAA4E;AAC5E,qBAAa,aAAc,SAAQ,KAAK;IACtC,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;gBACb,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;CAK7C;AAED,qDAAqD;AACrD,wBAAgB,UAAU,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAE1D;AAED,yEAAyE;AACzE,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,cAAc,GAAG,OAAO,CAElE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,eAAe,CAC7B,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,GACjC,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAkB7B;AA0BD,MAAM,WAAW,qBAAqB;IACpC,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,qEAAqE;IACrE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,2CAA2C;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,qBAAa,cAAc;IACzB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAqB;IAC5C,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;gBAEvB,IAAI,GAAE,qBAA0B;IAa5C,IAAI,UAAU,IAAI,OAAO,CAExB;YAEa,IAAI;IAmDlB;;;;;;OAMG;IACG,MAAM,CACV,SAAS,EAAE,MAAM,EACjB,IAAI,GAAE;QACJ,KAAK,CAAC,EAAE,OAAO,CAAC;QAChB,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QACnC,SAAS,CAAC,EAAE,MAAM,CAAC;KACf,GACL,OAAO,CAAC,cAAc,CAAC;IAU1B,gDAAgD;IAC1C,UAAU,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;CAoBvD"}

package/dist/cloud/evidence.js

@@ -0,0 +1,184 @@
+/**
+ * The evidence lane, from TypeScript.
+ *
+ * Rules check what an agent *does*; evidence checks what it *says*. A
+ * model that reports "the three line items total $100" is making a claim
+ * that is either true of the numbers it was given or is not, and no
+ * amount of prompting settles it. This sends the claim to
+ * `/v1/evidence/verify`, which resolves it against the declared inputs
+ * and answers PASS, MISMATCH, or a verdict meaning it could not tell.
+ *
+ * Parity with `sponsio/cloud/evidence.py`: same endpoint, same wire
+ * shape, same verdict vocabulary. One service, one meter — the server
+ * records usage per tenant and cannot see which SDK called it.
+ *
+ * The judgement is entirely server-side. This file normalises inputs,
+ * makes one request, and classifies the answer.
+ *
+ * @module @sponsio/sdk/cloud/evidence
+ */
+/** The check did not reach a verdict. The caller decides open or closed. */
+export class EvidenceError extends Error {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.name = "EvidenceError";
+        this.status = status;
+    }
+}
+/** True when this verdict must stop the response. */
+export function isBlocking(result) {
+    return result.action === "block";
+}
+/** True when this verdict asks the agent to clarify rather than stop. */
+export function needsClarification(result) {
+    return result.action === "clarify";
+}
+/**
+ * Ergonomic input forms to the wire's tagged shape.
+ *
+ * An untagged input is rejected here rather than sent. The server would
+ * refuse it anyway under the taint rule, and failing locally names the
+ * input that is missing its tag.
+ *
+ * The pair form needs a string source. Without that check a two-element
+ * array of data read as a pair: `{ items: [40, 60] }` became
+ * `value: 40, source: "60"`, and the server then refused source `"60"`
+ * as untrusted, an error naming nothing the caller had written. A list
+ * value takes the explicit form, `[[40, 60], "submitted_output"]`.
+ */
+export function normalizeInputs(inputs) {
+    const wire = {};
+    for (const [name, spec] of Object.entries(inputs ?? {})) {
+        if (Array.isArray(spec) && spec.length === 2 && typeof spec[1] === "string") {
+            wire[name] = { value: spec[0], source: spec[1] };
+        }
+        else if (spec && typeof spec === "object" && "source" in spec) {
+            wire[name] = {
+                value: spec.value,
+                source: String(spec.source),
+            };
+        }
+        else {
+            throw new Error(`input '${name}' needs a source tag: pass [value, source] or ` +
+                `{ value, source } — the server rejects untagged inputs (taint rule)`);
+        }
+    }
+    return wire;
+}
+function parseResult(payload) {
+    const evidence = (payload.evidence ?? {});
+    const rawValues = evidence.values;
+    const clarify = payload.clarify_on;
+    return {
+        predicate: String(payload.predicate ?? ""),
+        verdict: String(payload.verdict ?? ""),
+        action: String(payload.action ?? ""),
+        values: Array.isArray(rawValues) ? rawValues : [],
+        ...(typeof evidence.ts === "number" ? { evidenceTs: evidence.ts } : {}),
+        ...(typeof evidence.source === "string" ? { source: evidence.source } : {}),
+        ...(typeof evidence.table_version === "string"
+            ? { tableVersion: evidence.table_version }
+            : {}),
+        ...(payload.correction !== null && payload.correction !== undefined
+            ? { correction: payload.correction }
+            : {}),
+        clarifyOn: Array.isArray(clarify) ? clarify : [],
+        ...(typeof payload.attestation_id === "string"
+            ? { attestationId: payload.attestation_id }
+            : {}),
+    };
+}
+export class EvidenceClient {
+    url;
+    apiKey;
+    timeoutMs;
+    constructor(opts = {}) {
+        this.apiKey = opts.apiKey ?? process.env.SPONSIO_API_KEY ?? undefined;
+        // Trailing slashes stripped without a regex. `/\/+$/` backtracks
+        // polynomially on a string of many slashes, and the URL comes from
+        // an env var, so it is not ours to trust about its own shape.
+        let base = opts.url ?? process.env.SPONSIO_API_URL ?? "https://app.sponsio.dev";
+        let end = base.length;
+        while (end > 0 && base.charCodeAt(end - 1) === 47)
+            end -= 1;
+        this.url = base.slice(0, end);
+        this.timeoutMs = opts.timeoutMs ?? 10_000;
+    }
+    get configured() {
+        return Boolean(this.apiKey);
+    }
+    async post(path, body) {
+        if (!this.apiKey) {
+            throw new EvidenceError("no API key: set SPONSIO_API_KEY or pass apiKey to EvidenceClient");
+        }
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), this.timeoutMs);
+        let response;
+        try {
+            response = await fetch(`${this.url}${path}`, {
+                method: "POST",
+                headers: {
+                    Authorization: `Bearer ${this.apiKey}`,
+                    "Content-Type": "application/json",
+                    "User-Agent": "sponsio-sdk-ts",
+                },
+                body: JSON.stringify(body),
+                signal: controller.signal,
+            });
+        }
+        catch (err) {
+            throw new EvidenceError(`cannot reach ${this.url}: ${err instanceof Error ? err.message : err}`);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+        const text = await response.text();
+        let payload;
+        try {
+            payload = text ? JSON.parse(text) : {};
+        }
+        catch {
+            throw new EvidenceError(`${this.url} answered ${response.status} with non-JSON`, response.status);
+        }
+        if (!response.ok) {
+            const detail = payload?.detail;
+            throw new EvidenceError(typeof detail === "string" ? detail : `verify failed (${response.status})`, response.status);
+        }
+        return payload;
+    }
+    /**
+     * Verify one claim against fresh evidence, server-side.
+     *
+     * Throws `EvidenceError` when the check did not run to a verdict.
+     * Decide open or closed at the call site; closed means treating the
+     * throw as a block.
+     */
+    async verify(predicate, opts = {}) {
+        const body = {
+            predicate,
+            claim: { value: opts.value ?? null, text: opts.text ?? null },
+            inputs: normalizeInputs(opts.inputs),
+        };
+        if (opts.sessionId)
+            body.session_id = opts.sessionId;
+        return parseResult(await this.post("/v1/evidence/verify", body));
+    }
+    /** The predicate catalog this key can reach. */
+    async predicates() {
+        if (!this.apiKey) {
+            throw new EvidenceError("no API key: set SPONSIO_API_KEY or pass apiKey to EvidenceClient");
+        }
+        const response = await fetch(`${this.url}/v1/evidence/predicates`, {
+            headers: {
+                Authorization: `Bearer ${this.apiKey}`,
+                "User-Agent": "sponsio-sdk-ts",
+            },
+        });
+        if (!response.ok) {
+            throw new EvidenceError(`predicates failed (${response.status})`, response.status);
+        }
+        return (await response.json());
+    }
+}
+//# sourceMappingURL=evidence.js.map

package/dist/cloud/evidence.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.js","sourceRoot":"","sources":["../../src/cloud/evidence.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AA8CH,4EAA4E;AAC5E,MAAM,OAAO,aAAc,SAAQ,KAAK;IAC7B,MAAM,CAAU;IACzB,YAAY,OAAe,EAAE,MAAe;QAC1C,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;QAC5B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAED,qDAAqD;AACrD,MAAM,UAAU,UAAU,CAAC,MAAsB;IAC/C,OAAO,MAAM,CAAC,MAAM,KAAK,OAAO,CAAC;AACnC,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,kBAAkB,CAAC,MAAsB;IACvD,OAAO,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAC7B,MAAkC;IAElC,MAAM,IAAI,GAAgC,EAAE,CAAC;IAC7C,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;YAC5E,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnD,CAAC;aAAM,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,QAAQ,IAAI,IAAI,EAAE,CAAC;YAChE,IAAI,CAAC,IAAI,CAAC,GAAG;gBACX,KAAK,EAAG,IAAoB,CAAC,KAAK;gBAClC,MAAM,EAAE,MAAM,CAAE,IAAoB,CAAC,MAAM,CAAC;aAC7C,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,IAAI,KAAK,CACb,UAAU,IAAI,gDAAgD;gBAC5D,qEAAqE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,WAAW,CAAC,OAAgC;IACnD,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,EAAE,CAA4B,CAAC;IACrE,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC;IAClC,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC;IACnC,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,IAAI,EAAE,CAAC;QAC1C,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,OAAO,IAAI,EAAE,CAAC;QACtC,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC;QACpC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;QACjD,GAAG,CAAC,OAAO,QAAQ,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvE,GAAG,CAAC,OAAO,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,OAAO,QAAQ,CAAC,aAAa,KAAK,QAAQ;YAC5C,CAAC,CAAC,EAAE,YAAY,EAAE,QAAQ,CAAC,aAAa,EAAE;YAC1C,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,CAAC,UAAU,KAAK,SAAS;YACjE,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE;YACpC,CAAC,CAAC,EAAE,CAAC;QACP,SAAS,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QAChD,GAAG,CAAC,OAAO,OAAO,CAAC,cAAc,KAAK,QAAQ;YAC5C,CAAC,CAAC,EAAE,aAAa,EAAE,OAAO,CAAC,cAAc,EAAE;YAC3C,CAAC,CAAC,EAAE,CAAC;KACR,CAAC;AACJ,CAAC;AAWD,MAAM,OAAO,cAAc;IAChB,GAAG,CAAS;IACJ,MAAM,CAAqB;IAC3B,SAAS,CAAS;IAEnC,YAAY,OAA8B,EAAE;QAC1C,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,SAAS,CAAC;QACtE,iEAAiE;QACjE,mEAAmE;QACnE,8DAA8D;QAC9D,IAAI,IAAI,GACN,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,yBAAyB,CAAC;QACvE,IAAI,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC;QACtB,OAAO,GAAG,GAAG,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,EAAE;YAAE,GAAG,IAAI,CAAC,CAAC;QAC5D,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC9B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,MAAM,CAAC;IAC5C,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;IAEO,KAAK,CAAC,IAAI,CAChB,IAAY,EACZ,IAAa;QAEb,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CACrB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACnE,IAAI,QAAkB,CAAC;QACvB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,GAAG,IAAI,EAAE,EAAE;gBAC3C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;oBACtC,cAAc,EAAE,kBAAkB;oBAClC,YAAY,EAAE,gBAAgB;iBAC/B;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;gBAC1B,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,aAAa,CACrB,gBAAgB,IAAI,CAAC,GAAG,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CACxE,CAAC;QACJ,CAAC;gBAAS,CAAC;YACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACtB,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,aAAa,CACrB,GAAG,IAAI,CAAC,GAAG,aAAa,QAAQ,CAAC,MAAM,gBAAgB,EACvD,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,MAAM,GAAI,OAAmC,EAAE,MAAM,CAAC;YAC5D,MAAM,IAAI,aAAa,CACrB,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,kBAAkB,QAAQ,CAAC,MAAM,GAAG,EAC1E,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,OAAkC,CAAC;IAC5C,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CACV,SAAiB,EACjB,OAKI,EAAE;QAEN,MAAM,IAAI,GAA4B;YACpC,SAAS;YACT,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;YAC7D,MAAM,EAAE,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;SACrC,CAAC;QACF,IAAI,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC;QACrD,OAAO,WAAW,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,qBAAqB,EAAE,IAAI,CAAC,CAAC,CAAC;IACnE,CAAC;IAED,gDAAgD;IAChD,KAAK,CAAC,UAAU;QACd,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CACrB,kEAAkE,CACnE,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,yBAAyB,EAAE;YACjE,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;gBACtC,YAAY,EAAE,gBAAgB;aAC/B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,aAAa,CACrB,sBAAsB,QAAQ,CAAC,MAAM,GAAG,EACxC,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA8B,CAAC;IAC9D,CAAC;CACF"}

package/dist/cloud/privacy.d.ts

@@ -0,0 +1,67 @@
+/**
+ * What may leave this machine.
+ *
+ * Port of ``sponsio/bridge/privacy.py``. Enforcement already happened
+ * here — the det checks are pure and local — so nothing in this file can
+ * change a verdict. It only narrows what the console is shown, which is
+ * what makes it cheap: the run's shape is all the cloud needs to render
+ * a dashboard, count a finding, or meter usage.
+ */
+export declare const LEVELS: readonly ["full", "shape", "hashed", "metadata", "tool_calls"];
+export type PrivacyLevel = (typeof LEVELS)[number];
+/**
+ * The level in force. The environment beats the argument, deliberately:
+ * the person who decides what may leave a machine is the operator of
+ * that machine, not the author of the agent running on it.
+ */
+export declare function resolve(explicit?: string): PrivacyLevel;
+/**
+ * The structure of an argument set, with every value replaced.
+ *
+ * Lengths survive for strings and lists because "the model passed a
+ * 40 000-character path" is a debugging fact and not content, and it is
+ * the one an oversize-argument rule fires on.
+ */
+export declare function shape(args: unknown): string;
+/**
+ * ``json.dumps`` as Python writes it, which is what the other runtime
+ * hashes and displays.
+ *
+ * ``JSON.stringify`` omits the spaces Python puts after ``,`` and
+ * ``:``. That is invisible in a console and decisive in a digest: the
+ * same arguments hashed to different values on the two sides, so
+ * duplicate and loop detection disagreed about whether two calls were
+ * the same call. ``sortKeys`` additionally makes two calls that differ
+ * only in key order agree, which is what the digest is for.
+ */
+export declare function pyJson(value: unknown, sortKeys?: boolean): string;
+/**
+ * A stable short hash of an argument set. An equality token, not a
+ * signature, which is why twelve hex characters is enough: it is what
+ * lets duplicate and loop detection keep working with no content.
+ */
+export declare function digest(args: unknown): string;
+/** What ``argsPreview`` carries at this level. */
+export declare function preview(args: unknown, level: PrivacyLevel, fullPreview: string): string;
+/**
+ * What a model turn may quote of itself. A response is the most
+ * content-bearing field in the payload, so it goes one level earlier
+ * than arguments do.
+ */
+export declare function say(text: string, level: PrivacyLevel): string;
+/**
+ * Whether a step of this type is recorded at all.
+ *
+ * Only ``tool_calls`` drops whole steps. Every other level keeps the
+ * shape of the run and empties fields; this one keeps the action lane
+ * alone, because that is what the customer asked for by name.
+ */
+export declare function keepsStep(stepType: string, level: PrivacyLevel): boolean;
+/**
+ * A stamp for the run, so a reader knows what they are not seeing.
+ *
+ * A dashboard showing empty arguments has to be able to say whether the
+ * agent passed none or the deployment declined to send them.
+ */
+export declare function describe(level: PrivacyLevel): Record<string, unknown>;
+//# sourceMappingURL=privacy.d.ts.map

package/dist/cloud/privacy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privacy.d.ts","sourceRoot":"","sources":["../../src/cloud/privacy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,eAAO,MAAM,MAAM,gEAAiE,CAAC;AACrF,MAAM,MAAM,YAAY,GAAG,CAAC,OAAO,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC;AASnD;;;;GAIG;AACH,wBAAgB,OAAO,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,YAAY,CAWvD;AA0BD;;;;;;GAMG;AACH,wBAAgB,KAAK,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAS3C;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,MAAM,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,UAAQ,GAAG,MAAM,CAmB/D;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,OAAO,GAAG,MAAM,CAM5C;AAED,kDAAkD;AAClD,wBAAgB,OAAO,CACrB,IAAI,EAAE,OAAO,EACb,KAAK,EAAE,YAAY,EACnB,WAAW,EAAE,MAAM,GAClB,MAAM,CAKR;AAED;;;;GAIG;AACH,wBAAgB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,MAAM,CAE7D;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAExE;AAED;;;;;GAKG;AACH,wBAAgB,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASrE"}