@turingpulse/sdk 1.0.1

package/.github/dependabot.yml

@@ -0,0 +1,38 @@
+version: 2
+updates:
+  - package-ecosystem: "npm"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+      day: "monday"
+    open-pull-requests-limit: 10
+    labels:
+      - "dependencies"
+      - "security"
+    commit-message:
+      prefix: "deps"
+    groups:
+      production-dependencies:
+        dependency-type: "production"
+        patterns:
+          - "*"
+        update-types:
+          - "patch"
+          - "minor"
+
+  - package-ecosystem: "docker"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "docker"
+      - "security"
+
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    labels:
+      - "dependencies"
+      - "github-actions"

package/.github/workflows/ci.yml

@@ -0,0 +1,246 @@
+# CI + Publish for TypeScript SDK
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  release:
+    types: [published]
+
+jobs:
+  build:
+    name: Build and Lint
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        node-version: ['18', '20']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Type check
+        run: npm run lint
+
+      - name: Build
+        run: npm run build
+
+  pre-publish-scan:
+    name: Pre-Publish Security Scan
+    runs-on: ubuntu-latest
+    if: github.event_name == 'release'
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # ── 1. Secret Detection (git history + filesystem) ──────────────
+      - name: Run TruffleHog secret scan
+        run: |
+          echo '.git/' > .trufflehog-exclude
+          docker run --rm -v "$PWD:/pwd" trufflesecurity/trufflehog:latest \
+            filesystem /pwd --exclude-paths=/pwd/.trufflehog-exclude --json > trufflehog-report.json 2>&1
+          SECRETS_FOUND=$(grep -c '"SourceMetadata"' trufflehog-report.json 2>/dev/null || echo "0")
+          if [ "$SECRETS_FOUND" -gt 0 ]; then
+            echo "::error::TruffleHog found ${SECRETS_FOUND} potential secrets — publish blocked"
+            cat trufflehog-report.json
+            exit 1
+          fi
+          echo "TruffleHog: no secrets detected"
+
+      # ── 2. Sensitive Pattern Scan (source code) ─────────────────────
+      - name: Scan source code for hardcoded secrets and sensitive patterns
+        run: |
+          PATTERNS=(
+            'AKIA[0-9A-Z]{16}'                       # AWS Access Key ID
+            'AIza[0-9A-Za-z\-_]{35}'                 # Google API Key
+            'sk-[a-zA-Z0-9]{20,}'                    # OpenAI / Stripe secret key
+            'ghp_[a-zA-Z0-9]{36}'                    # GitHub PAT
+            'glpat-[a-zA-Z0-9\-]{20,}'               # GitLab PAT
+            'xox[bpors]-[a-zA-Z0-9\-]+'              # Slack token
+            'eyJ[a-zA-Z0-9_-]*\.eyJ[a-zA-Z0-9_-]*'  # JWT token
+            'password\s*=\s*["\x27][^"\x27]{8,}'     # Hardcoded passwords
+            'mongodb(\+srv)?://[^\s]+'                # MongoDB URIs
+            'redis://[^\s]+'                          # Redis URIs
+          )
+          FOUND=0
+          for pattern in "${PATTERNS[@]}"; do
+            MATCHES=$(grep -rEn "$pattern" src/ packages/ --include="*.ts" --include="*.js" 2>/dev/null || true)
+            if [ -n "$MATCHES" ]; then
+              echo "::error::Sensitive pattern found: $pattern"
+              echo "$MATCHES"
+              FOUND=$((FOUND + 1))
+            fi
+          done
+          if [ "$FOUND" -gt 0 ]; then
+            echo "::error::Found $FOUND sensitive patterns in source — publish blocked"
+            exit 1
+          fi
+          echo "Source scan: no hardcoded secrets found"
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Set up Python (for Semgrep)
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies
+        run: npm install
+
+      # ── 3. SAST — Semgrep (TypeScript rules) ───────────────────────
+      - name: Run Semgrep SAST scan
+        run: |
+          pip install semgrep
+          semgrep --config=auto --config=p/typescript \
+            --severity ERROR \
+            --json --output=semgrep-report.json \
+            src/ packages/ 2>&1 || true
+          python3 -c '
+          import json, sys
+          try:
+              data = json.load(open("semgrep-report.json"))
+              errors = [r for r in data.get("results", []) if r.get("extra", {}).get("severity") == "ERROR"]
+              if errors:
+                  for e in errors:
+                      msg = e.get("extra", {}).get("message", "")[:120]
+                      print("  " + e["path"] + ":" + str(e["start"]["line"]) + " - " + e["check_id"] + ": " + msg)
+                  sys.exit(1)
+          except Exception as e:
+              print("Semgrep parse warning: " + str(e))
+          ' || { echo "::error::Semgrep found ERROR-level issues — publish blocked"; exit 1; }
+          echo "Semgrep SAST: no error-level issues"
+
+      # ── 4. Dependency CVE Audit (HARD GATE) ─────────────────────────
+      - name: Run npm audit (hard gate on high/critical)
+        run: |
+          npm audit --json > npm-audit-report.json 2>&1 || true
+          VULNS=$(node -e "
+            const r = require('./npm-audit-report.json');
+            const meta = r.metadata?.vulnerabilities || {};
+            const high = (meta.high || 0) + (meta.critical || 0);
+            console.log(high);
+          " 2>/dev/null || echo "0")
+          if [ "$VULNS" -gt 0 ]; then
+            echo "::error::npm audit found ${VULNS} high/critical vulnerabilities — publish blocked"
+            npm audit --audit-level=high || true
+            exit 1
+          fi
+          echo "npm audit: no high/critical vulnerabilities"
+
+      # ── 5. License Compliance ───────────────────────────────────────
+      - name: Check dependency licenses
+        run: |
+          npx license-checker --json --out licenses.json
+          npx license-checker --summary
+          BLOCKED=$(npx license-checker --failOn \
+            'GPL-2.0;GPL-3.0;AGPL-1.0;AGPL-3.0;SSPL-1.0;LGPL-2.0;LGPL-2.1;LGPL-3.0;GPL-2.0-only;GPL-3.0-only;AGPL-3.0-only' \
+            2>&1 || true)
+          if echo "$BLOCKED" | grep -q "Found restricted license"; then
+            echo "::error::Copyleft-licensed dependencies found — publish blocked for enterprise safety"
+            echo "$BLOCKED"
+            exit 1
+          fi
+          echo "License check: all dependencies have permissive licenses"
+
+      # ── 6. Publish Payload Deep Inspection ──────────────────────────
+      - name: Inspect npm pack contents for sensitive data
+        run: |
+          npm pack --dry-run 2>&1 | tee pack-listing.txt
+          echo "--- Checking file listing ---"
+          SENSITIVE_FILES=$(grep -iE \
+            '\.env|\.pem|\.key|\.p12|\.pfx|\.jks|credentials|secret|service.account|\.sqlite|\.db$' \
+            pack-listing.txt || true)
+          if [ -n "$SENSITIVE_FILES" ]; then
+            echo "::error::Sensitive files in publish payload — publish blocked:"
+            echo "$SENSITIVE_FILES"
+            exit 1
+          fi
+          echo "--- Packing and scanning content ---"
+          TARBALL=$(npm pack 2>/dev/null)
+          EXTRACT_DIR=$(mktemp -d)
+          tar xzf "$TARBALL" -C "$EXTRACT_DIR"
+          CONTENT_SECRETS=$(grep -rEn \
+            'AKIA[0-9A-Z]{16}|sk-[a-zA-Z0-9]{20,}|password\s*=\s*["\x27][^"\x27]{8,}|BEGIN (RSA |EC |DSA )?PRIVATE KEY' \
+            "$EXTRACT_DIR" --include="*.js" --include="*.ts" --include="*.json" 2>/dev/null || true)
+          if [ -n "$CONTENT_SECRETS" ]; then
+            echo "::error::Secrets found inside packed artifact content — publish blocked:"
+            echo "$CONTENT_SECRETS"
+            exit 1
+          fi
+          rm -rf "$EXTRACT_DIR" "$TARBALL"
+          echo "Payload inspection: clean"
+
+      # ── 7. SBOM Generation ─────────────────────────────────────────
+      - name: Generate SBOM (CycloneDX)
+        run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json --output-format JSON
+
+      - name: Upload security reports
+        uses: actions/upload-artifact@v4
+        if: always()
+        with:
+          name: security-reports
+          path: |
+            trufflehog-report.json
+            semgrep-report.json
+            npm-audit-report.json
+            licenses.json
+            sbom.json
+          retention-days: 90
+
+      - name: Attach SBOM to release
+        if: success()
+        run: gh release upload "${{ github.ref_name }}" sbom.json --clobber
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+  publish:
+    name: Publish to npm
+    runs-on: ubuntu-latest
+    needs: [build, pre-publish-scan]
+    if: github.event_name == 'release'
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+          registry-url: 'https://registry.npmjs.org'
+
+      - name: Install and build
+        run: npm install && npm run build
+
+      - name: Publish core package
+        run: npm publish --access public
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
+
+      - name: Publish satellite packages
+        run: |
+          for pkg_dir in packages/*/; do
+            if [ -f "${pkg_dir}package.json" ]; then
+              PKG_NAME=$(node -e "console.log(require('./${pkg_dir}package.json').name)")
+              echo "Publishing ${PKG_NAME} from ${pkg_dir}..."
+              (cd "$pkg_dir" && npm publish --access public) || echo "WARN: ${PKG_NAME} publish failed"
+            fi
+          done
+        env:
+          NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

package/.github/workflows/framework-compat.yml

@@ -0,0 +1,169 @@
+# Framework Compatibility Matrix
+# Tests the SDK against multiple versions of every supported LLM framework.
+# Results are published as workflow summary + auto-update README badges/table.
+name: Framework Compatibility
+
+on:
+  schedule:
+    - cron: '0 6 * * *'  # Daily 6am UTC
+  workflow_dispatch:
+  push:
+    branches: [main]
+    paths:
+      - 'src/fingerprint.ts'
+      - 'src/llmDetector.ts'
+      - 'tests/compat/**'
+      - '.github/workflows/framework-compat.yml'
+  pull_request:
+    branches: [main]
+    paths:
+      - 'src/fingerprint.ts'
+      - 'src/llmDetector.ts'
+      - 'tests/compat/**'
+
+jobs:
+  compat-test:
+    name: "${{ matrix.framework }} ${{ matrix.version }} (node ${{ matrix.node-version }})"
+    runs-on: ubuntu-latest
+    strategy:
+      fail-fast: false
+      matrix:
+        node-version: ['18', '20', '22']
+        include:
+          # OpenAI
+          - { framework: openai, package: openai, version: '4.0.0', test-file: openai, node-version: '18' }
+          - { framework: openai, package: openai, version: '4.0.0', test-file: openai, node-version: '20' }
+          - { framework: openai, package: openai, version: latest, test-file: openai, node-version: '18' }
+          - { framework: openai, package: openai, version: latest, test-file: openai, node-version: '20' }
+          - { framework: openai, package: openai, version: latest, test-file: openai, node-version: '22' }
+          # Anthropic
+          - { framework: anthropic, package: '@anthropic-ai/sdk', version: '0.20.0', test-file: anthropic, node-version: '18' }
+          - { framework: anthropic, package: '@anthropic-ai/sdk', version: '0.20.0', test-file: anthropic, node-version: '20' }
+          - { framework: anthropic, package: '@anthropic-ai/sdk', version: latest, test-file: anthropic, node-version: '18' }
+          - { framework: anthropic, package: '@anthropic-ai/sdk', version: latest, test-file: anthropic, node-version: '20' }
+          - { framework: anthropic, package: '@anthropic-ai/sdk', version: latest, test-file: anthropic, node-version: '22' }
+          # Google GenAI
+          - { framework: google-genai, package: '@google/generative-ai', version: '0.7.0', test-file: google-genai, node-version: '18' }
+          - { framework: google-genai, package: '@google/generative-ai', version: '0.7.0', test-file: google-genai, node-version: '20' }
+          - { framework: google-genai, package: '@google/generative-ai', version: latest, test-file: google-genai, node-version: '18' }
+          - { framework: google-genai, package: '@google/generative-ai', version: latest, test-file: google-genai, node-version: '20' }
+          - { framework: google-genai, package: '@google/generative-ai', version: latest, test-file: google-genai, node-version: '22' }
+          # LangChain
+          - { framework: langchain, package: '@langchain/core', version: '0.1.0', test-file: langchain, node-version: '18' }
+          - { framework: langchain, package: '@langchain/core', version: '0.1.0', test-file: langchain, node-version: '20' }
+          - { framework: langchain, package: '@langchain/core', version: latest, test-file: langchain, node-version: '18' }
+          - { framework: langchain, package: '@langchain/core', version: latest, test-file: langchain, node-version: '20' }
+          - { framework: langchain, package: '@langchain/core', version: latest, test-file: langchain, node-version: '22' }
+          # LangChain-OpenAI
+          - { framework: langchain-openai, package: '@langchain/openai', version: '0.0.14', test-file: langchain-openai, node-version: '18' }
+          - { framework: langchain-openai, package: '@langchain/openai', version: '0.0.14', test-file: langchain-openai, node-version: '20' }
+          - { framework: langchain-openai, package: '@langchain/openai', version: latest, test-file: langchain-openai, node-version: '18' }
+          - { framework: langchain-openai, package: '@langchain/openai', version: latest, test-file: langchain-openai, node-version: '20' }
+          - { framework: langchain-openai, package: '@langchain/openai', version: latest, test-file: langchain-openai, node-version: '22' }
+          # Vercel AI SDK
+          - { framework: vercel-ai, package: ai, version: '3.0.0', test-file: vercel-ai, node-version: '18' }
+          - { framework: vercel-ai, package: ai, version: '3.0.0', test-file: vercel-ai, node-version: '20' }
+          - { framework: vercel-ai, package: ai, version: latest, test-file: vercel-ai, node-version: '18' }
+          - { framework: vercel-ai, package: ai, version: latest, test-file: vercel-ai, node-version: '20' }
+          - { framework: vercel-ai, package: ai, version: latest, test-file: vercel-ai, node-version: '22' }
+          # Cohere
+          - { framework: cohere, package: cohere-ai, version: '7.0.0', test-file: cohere, node-version: '18' }
+          - { framework: cohere, package: cohere-ai, version: '7.0.0', test-file: cohere, node-version: '20' }
+          - { framework: cohere, package: cohere-ai, version: latest, test-file: cohere, node-version: '18' }
+          - { framework: cohere, package: cohere-ai, version: latest, test-file: cohere, node-version: '20' }
+          - { framework: cohere, package: cohere-ai, version: latest, test-file: cohere, node-version: '22' }
+          # Mistral
+          - { framework: mistral, package: '@mistralai/mistralai', version: '0.1.0', test-file: mistral, node-version: '18' }
+          - { framework: mistral, package: '@mistralai/mistralai', version: '0.1.0', test-file: mistral, node-version: '20' }
+          - { framework: mistral, package: '@mistralai/mistralai', version: latest, test-file: mistral, node-version: '18' }
+          - { framework: mistral, package: '@mistralai/mistralai', version: latest, test-file: mistral, node-version: '20' }
+          - { framework: mistral, package: '@mistralai/mistralai', version: latest, test-file: mistral, node-version: '22' }
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@v4
+        with:
+          node-version: ${{ matrix.node-version }}
+
+      - name: Install SDK
+        run: npm install
+
+      - name: Install framework
+        run: |
+          if [ "${{ matrix.version }}" = "latest" ]; then
+            npm install "${{ matrix.package }}"
+          else
+            npm install "${{ matrix.package }}@${{ matrix.version }}"
+          fi
+
+      - name: Get installed version
+        id: fwver
+        run: |
+          VER=$(npm list "${{ matrix.package }}" --depth=0 --json 2>/dev/null | node -e "const d=require('fs').readFileSync('/dev/stdin','utf8');const j=JSON.parse(d);const deps={...j.dependencies,...j.devDependencies};const pkg='${{ matrix.package }}';console.log(deps[pkg]?.version||'unknown')")
+          echo "installed_version=$VER" >> "$GITHUB_OUTPUT"
+
+      - name: Run compat tests
+        id: test
+        run: |
+          npx vitest run tests/compat/${{ matrix.test-file }}.test.ts --reporter=verbose 2>&1 | tee test-output.txt
+          echo "exit_code=${PIPESTATUS[0]}" >> "$GITHUB_OUTPUT"
+
+      - name: Write result
+        if: always()
+        run: |
+          mkdir -p results
+          cat > results/${{ matrix.framework }}-${{ matrix.version }}-node${{ matrix.node-version }}.json <<RESEOF
+          {
+            "framework": "${{ matrix.framework }}",
+            "package": "${{ matrix.package }}",
+            "requested_version": "${{ matrix.version }}",
+            "installed_version": "${{ steps.fwver.outputs.installed_version }}",
+            "node_version": "${{ matrix.node-version }}",
+            "passed": ${{ steps.test.outcome == 'success' }}
+          }
+          RESEOF
+
+      - name: Upload result
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: compat-${{ matrix.framework }}-${{ matrix.version }}-node${{ matrix.node-version }}
+          path: results/
+          retention-days: 7
+
+  update-readme:
+    name: Update README
+    needs: [compat-test]
+    if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
+    runs-on: ubuntu-latest
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all results
+        uses: actions/download-artifact@v4
+        with:
+          pattern: compat-*
+          path: all-results/
+          merge-multiple: true
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Generate README sections
+        run: node scripts/update-readme-compat.mjs all-results/ README.md
+
+      - name: Commit if changed
+        run: |
+          git diff --quiet README.md || {
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add README.md
+            git commit -m "docs: update framework compatibility matrix [skip ci]"
+            git push
+          }