@voightxyz/anthropic 0.1.0-beta.2 → 0.1.0

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 All notable changes to this project will be documented in this file.
 
+## [0.1.0] — 2026-05-16
+
+First stable release. Consolidates beta.1 and beta.2.
+
+### Capabilities
+
+- `wrapAnthropic(client, options)` — two-layer Proxy (`client → messages → create`). Everything outside `messages.create` passes through untouched.
+- Non-streaming Messages capture: text extracted from `content[].text` blocks, tool calls flattened from `content[].tool_use` blocks (input JSON-stringified to the same `arguments: string` shape `@voightxyz/openai` produces — dashboards render both providers identically).
+- Streaming Messages capture: state machine over the typed event sequence (`message_start` / `content_block_start` / `content_block_delta` / `content_block_stop` / `message_delta` / `message_stop`). Per-index aggregator concatenates text deltas (`text_delta.text`) and tool-use deltas (`input_json_delta.partial_json`). Initial usage from `message_start` carries `input_tokens` + cache fields; final `output_tokens` lands on `message_delta`.
+- Path-A token breakdown: `cache_read_input_tokens` → `metadata.tokens.cache_read`, `cache_creation_input_tokens` → `metadata.tokens.cache_creation`. Both emitted only when strictly positive. `input` + `output` + `total` always present. The backend Anthropic pricing engine applies the 0.10× cache_read and 1.25× cache_creation multipliers automatically.
+- First tool call's name mirrored into top-level `toolExecuted` so the audit-log DETAIL column renders meaningfully for LLM events (same shape used for hook events).
+- `sessionId` emission: each wrapper instance resolves a UUID v4 once (or accepts an explicit override) and stamps it on `metadata.sessionId` for every event. Dashboards group events sharing a sessionId into a single trace timeline.
+- Three-level privacy redaction (`minimal` / `standard` / `full`) over prompts, response text, and tool arguments via a 12-pattern catalogue. Function-call names always survive as tags.
+- Fire-and-forget HTTP ingest to `https://api.voight.xyz/v1/events`. Never throws, never blocks the caller.
+- API key + agent identity resolution: `voightApiKey` option → `VOIGHT_KEY` env → `null`. `agent` option → `VOIGHT_AGENT` env → `HOSTNAME` env → `'unknown-agent'`.
+- Non-fatal failure modes: `enabled: false` and missing API key both return the original client untouched.
+
+### Tests
+
+- 65 unit tests across privacy, identity, ingest, messages, and wrap surfaces. All green.
+- End-to-end smoke verified against real Anthropic + real Voight backend: text, streaming text, tool use (both transports), `cache_read` on cached prompts.
+
 ## [0.1.0-beta.2] — 2026-05-16
 
 ### Added

package/README.md

@@ -1,15 +1,13 @@
 # @voightxyz/anthropic
 
-> **Beta.** API may change before the 0.1.0 stable release.
+Voight observability for the Anthropic SDK. Wrap your Anthropic client and capture every Messages call — prompts, tokens, cache reads, cache creations, tool use, costs, latency, errors — surfaced live in the [Voight dashboard](https://voight.xyz).
 
-Voight observability for the Anthropic SDK. Wrap your Anthropic client and capture every Messages call — prompts, tokens, costs, cache reads, tool use, latency, errors — surfaced live in the [Voight dashboard](https://voight.xyz).
-
-Same author and same backend as [`@voightxyz/openai`](https://www.npmjs.com/package/@voightxyz/openai). Drop in whichever provider your app uses — the events land side-by-side in your Voight dashboard.
+Same backend and dashboard as [`@voightxyz/openai`](https://www.npmjs.com/package/@voightxyz/openai). Drop in whichever provider your app uses; events from both land side-by-side under the same agent.
 
 ## Install
 
 ```bash
-npm install @anthropic-ai/sdk @voightxyz/anthropic@beta
+npm install @anthropic-ai/sdk @voightxyz/anthropic
 ```
 
 ## Quick start
@@ -24,7 +22,7 @@ const client = wrapAnthropic(new Anthropic(), {
 })
 
 const response = await client.messages.create({
-  model: 'claude-3-5-sonnet-latest',
+  model: 'claude-haiku-4-5',
   max_tokens: 1024,
   messages: [{ role: 'user', content: 'Hello' }],
 })
@@ -32,22 +30,53 @@ const response = await client.messages.create({
 
 That's it — every call is captured automatically. Visit your [Voight dashboard](https://voight.xyz) to see them in real time.
 
-## Status
-
-Beta scaffold — the public `wrapAnthropic` entrypoint is a pass-through today. The Messages instrument lands in the next release. Track:
+## What's captured
 
-| Signal | Status |
+| Signal | Where it lands |
 |---|---|
-| Public `wrapAnthropic` surface | ✅ scaffolded |
-| `messages.create` non-streaming | 🟡 next release |
-| `messages.create` streaming (event-based) | 🟡 next release |
-| Token counts (input, output, cache_read, cache_creation) | 🟡 next release |
-| Tool use capture | 🟡 next release |
-| 3-level privacy redaction (minimal / standard / full) | 🟡 next release |
-| Embeddings | ⏳ 0.2.0 |
-| Vertex / Bedrock clients | ⏳ 0.2.0 |
-
-See [CHANGELOG.md](./CHANGELOG.md).
+| Model id (with version suffix) | `model` |
+| Prompt messages | `input.messages` |
+| Response text (aggregated from `content[].text` blocks) | `metadata.responseText` |
+| Token counts (input / output / total) | `metadata.tokens` |
+| Cache reads (`cache_read_input_tokens`) | `metadata.tokens.cache_read` |
+| Cache creations (`cache_creation_input_tokens`) | `metadata.tokens.cache_creation` |
+| Tool use (full array) | `metadata.toolCalls` + `toolExecuted` |
+| Streaming flag | `metadata.streaming` |
+| Trace grouping (auto UUID or explicit) | `metadata.sessionId` |
+| Stop reason | `metadata.finishReason` |
+| Latency (ms) | `durationMs` |
+| Errors (re-thrown to the caller) | `errorMessage` + `outcome: 'failed'` |
+
+## Supported endpoints
+
+- `client.messages.create` — Messages API (non-streaming + streaming, tool use, cache breakpoints)
+
+The wrapper passes everything else through untouched. Bedrock and Vertex clients are on the [0.2.0 roadmap](./CHANGELOG.md).
+
+## Options
+
+| Option | Type | Default | Purpose |
+| --- | --- | --- | --- |
+| `voightApiKey` | string | `process.env.VOIGHT_KEY` | Your Voight key from the dashboard |
+| `agent` | string | `process.env.VOIGHT_AGENT` → `HOSTNAME` → `'unknown-agent'` | Stable identifier surfaced in the dashboard |
+| `apiBase` | string | `https://api.voight.xyz` | Override for self-hosted deployments |
+| `privacy` | `'minimal' \| 'standard' \| 'full'` | `'standard'` | Capture aggressiveness |
+| `sessionId` | string | auto UUID v4 | Trace grouping. Stable across calls of one wrapper instance |
+| `enabled` | boolean | `true` | Kill switch — returns the original client untouched |
+
+## Privacy
+
+Three levels apply to prompts, response text, and tool-call arguments. The function name in `toolExecuted` always survives as a tag (not user content).
+
+| Level | Prompts | Response text | Tool arguments | Tokens / timing / model |
+| --- | --- | --- | --- | --- |
+| `minimal` | dropped | dropped | dropped | kept |
+| `standard` (default) | scrubbed | scrubbed | scrubbed | kept |
+| `full` | verbatim | verbatim | verbatim | kept |
+
+Standard scrubs 12 patterns: PEM private keys, JWTs, Anthropic / OpenAI / Stripe live / GitHub / AWS / Slack / Voight API keys, emails, E.164 phones, and Luhn-validated credit cards.
+
+See [CHANGELOG.md](./CHANGELOG.md) for release notes.
 
 ## License
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@voightxyz/anthropic",
-  "version": "0.1.0-beta.2",
+  "version": "0.1.0",
   "description": "Voight observability for the Anthropic SDK. Wrap your Anthropic client and capture every Messages call — prompts, tokens, costs, cache reads, tool use, latency, errors — surfaced live in the Voight dashboard.",
   "keywords": [
     "anthropic",
@@ -60,7 +60,6 @@
     "node": ">=18"
   },
   "publishConfig": {
-    "access": "public",
-    "tag": "beta"
+    "access": "public"
   }
 }