ai-stream-auditor 1.0.2 → 1.0.3

package/CHANGELOG.md

@@ -4,6 +4,22 @@ All notable changes follow [Keep a Changelog](https://keepachangelog.com/en/1.1.
 
 ## [Unreleased]
 
+## [1.0.3] - 2026-10-21
+
+### Added
+
+- Exercise credential-free truncated and complete `MessageStream` and
+  `BetaMessageStream` lifecycles from the official Anthropic TypeScript SDK,
+  including partial text and tool-input EOF, on the SDK's supported Node
+  runtimes while preserving a dependency-free Node 18 core check.
+- Verify both official SDK stream helpers preserve a transport failure as the
+  cause of the `AnthropicError` from `done()` when it occurs between iterator
+  reads and that the auditor records the failure as `transport_error` rather
+  than a successful completion.
+- Ship and execute a runnable Anthropic Messages lifecycle example.
+- Include the security, contribution, and conduct policies in the package
+  tarball.
+
 ## [1.0.2] - 2026-10-10
 
 ### Added

package/CODE_OF_CONDUCT.md

@@ -0,0 +1,17 @@
+# Contributor Covenant Code of Conduct
+
+## Our pledge
+
+We pledge to make participation in this project a harassment-free experience for everyone, regardless of age, body size, disability, ethnicity, sex characteristics, gender identity and expression, experience level, education, socioeconomic status, nationality, personal appearance, race, caste, color, religion, or sexual identity and orientation.
+
+## Our standards
+
+Positive behavior includes empathy, respectful feedback, accepting responsibility, and focusing on what benefits the community. Unacceptable behavior includes harassment, sexualized conduct, insults, threats, trolling, or publishing another person's private information.
+
+## Enforcement
+
+Report unacceptable behavior privately through the security contact or repository owner's public contact details. Maintainers may remove, edit, or reject contributions and may temporarily or permanently ban contributors for behavior they deem inappropriate.
+
+## Attribution
+
+Adapted from the Contributor Covenant, version 2.1: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html

package/CONTRIBUTING.md

@@ -0,0 +1,10 @@
+# Contributing
+
+1. Open an issue for new dialects or public API changes.
+2. Create a focused branch from the current default branch.
+3. Run `npm ci` and `npm run check` on Node.js 18 or newer.
+4. Base protocol behavior on current primary provider documentation and link it in the change.
+5. Add valid fixtures plus truncation, reordering, duplication, and error mutations.
+6. Update the README and changelog for behavioral changes.
+
+Never submit real prompts, generated private content, API keys, request headers, or customer event logs. Contributions must be original or appropriately licensed and are distributed under the MIT license.

package/README.md

@@ -15,6 +15,7 @@ The package's checks are based on the providers' documented event flows and moti
 - [OpenAI streaming Responses guide](https://developers.openai.com/api/docs/guides/streaming-responses)
 - [OpenAI Node issue #2046: mid-stream errors silently swallowed during iteration](https://github.com/openai/openai-node/issues/2046)
 - [Anthropic streaming Messages documentation](https://platform.claude.com/docs/en/build-with-claude/streaming)
+- [Anthropic TypeScript SDK issue #1264: `done()` resolves after EOF without `message_stop`](https://github.com/anthropics/anthropic-sdk-typescript/issues/1264)
 - [AxonHub issue #2092: synthetic end marker hides incomplete Responses stream](https://github.com/looplj/axonhub/issues/2092)
 
 This project is independent and is not an official OpenAI or Anthropic package.
@@ -55,6 +56,23 @@ for await (const event of stream) auditor.push(event);
 const report = auditor.finish();
 ```
 
+The integration suite feeds credential-free synthetic streams through the
+official Anthropic TypeScript SDK and then through this auditor. It covers both
+`MessageStream` and `BetaMessageStream`, with EOF after `message_start`, during
+partial text, and during partial tool input. Every truncated case is reported
+as `transport_closed` even when the SDK's `done()` promise resolves, while a
+stream containing `message_stop` remains successful. This guards the exact
+EOF boundary and EOF cases from the suggested regression matrix described in
+[Anthropic SDK issue #1264](https://github.com/anthropics/anthropic-sdk-typescript/issues/1264).
+
+The same integration boundary covers a transport failure between iterator
+reads, where current SDK helpers can report iterator completion while
+`done()` rejects with an `AnthropicError` whose cause is the original error.
+For both helpers the suite verifies the cause is preserved and the auditor
+reports `outcome: 'error'` with
+`finishCause: 'transport_error'`, matching
+[Anthropic SDK issue #1247](https://github.com/anthropics/anthropic-sdk-typescript/issues/1247).
+
 ## The three questions in every report
 
 ```ts
@@ -228,9 +246,10 @@ See [SECURITY.md](SECURITY.md) for vulnerability reporting.
 
 ## Runnable example and related tool
 
-[`examples/audit-openai.mjs`](examples/audit-openai.mjs) feeds a minimal valid
-OpenAI Responses lifecycle through the auditor. It is executed by
-`npm run check` and ships in the npm tarball.
+[`examples/audit-openai.mjs`](examples/audit-openai.mjs) and
+[`examples/audit-anthropic.mjs`](examples/audit-anthropic.mjs) feed minimal
+valid provider lifecycles through the auditor. Both are executed by
+`npm run check` and ship in the npm tarball.
 
 Use [`async-iterator-watchdog`](https://www.npmjs.com/package/async-iterator-watchdog)
 when you also need active first-progress, idle, or total deadlines around the
@@ -239,10 +258,21 @@ lifecycle and outcome.
 
 ## Development
 
+Node.js 20 or newer runs the complete suite, including the dev-only official
+Anthropic SDK integration:
+
 ```sh
-npm ci
+npm ci --ignore-scripts
 npm run check
-node examples/audit-openai.mjs
+```
+
+Node.js 18 remains supported by the package runtime. Because the current
+Anthropic SDK dev dependency requires Node.js 20 or newer, use the
+dependency-free core and package-surface check on Node.js 18:
+
+```sh
+npm ci --omit=dev --ignore-scripts
+npm run check:core
 ```
 
 ## License

package/SECURITY.md

@@ -0,0 +1,13 @@
+# Security policy
+
+## Supported versions
+
+Security fixes are provided for the latest major version.
+
+## Reporting
+
+Do not open a public issue for an undisclosed vulnerability. Use GitHub private vulnerability reporting. If unavailable, contact the maintainer through the address on the public GitHub profile with the affected version, reproduction, impact, and mitigation. Expect acknowledgement within seven days.
+
+## Scope
+
+This package processes caller-supplied JavaScript objects without executing provider content. It does not parse transports or enforce output safety. Reports intentionally omit raw payloads, but lifecycle keys and error/status metadata can still be sensitive; callers are responsible for log access and retention controls.

package/examples/audit-anthropic.mjs

@@ -0,0 +1,20 @@
+import { createStreamAuditor } from 'ai-stream-auditor';
+
+const events = [
+  { type: 'message_start', message: { stop_reason: null } },
+  { type: 'content_block_start', index: 0, content_block: { type: 'text', text: '' } },
+  { type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: 'hello' } },
+  { type: 'content_block_stop', index: 0 },
+  { type: 'message_delta', delta: { stop_reason: 'end_turn' } },
+  { type: 'message_stop' },
+];
+
+const auditor = createStreamAuditor('anthropic-messages');
+for (const event of events) auditor.push(event);
+
+const report = auditor.finish();
+console.log(JSON.stringify({
+  protocolComplete: report.protocolComplete,
+  successful: report.successful,
+  outcome: report.outcome,
+}));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-stream-auditor",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Audit decoded OpenAI Responses and Anthropic Messages event lifecycles for silent or malformed stream endings.",
   "keywords": [
     "ai",
@@ -37,7 +37,10 @@
     "examples",
     "README.md",
     "LICENSE",
-    "CHANGELOG.md"
+    "CHANGELOG.md",
+    "CODE_OF_CONDUCT.md",
+    "CONTRIBUTING.md",
+    "SECURITY.md"
   ],
   "engines": {
     "node": ">=18"
@@ -45,11 +48,18 @@
   "sideEffects": false,
   "scripts": {
     "lint": "node scripts/lint.mjs",
-    "test": "node --test",
+    "test": "npm run test:core && npm run test:integration",
+    "test:core": "node --test test/audit.test.js test/regressions.test.js",
+    "test:integration": "node --test test/anthropic-sdk.integration.test.js",
     "test:coverage": "node --experimental-test-coverage --test",
-    "check": "npm run lint && npm run test:coverage && node examples/audit-openai.mjs && npm pack --dry-run"
+    "test:coverage:core": "node --experimental-test-coverage --test test/audit.test.js test/regressions.test.js",
+    "check:core": "npm run lint && npm run test:coverage:core && node examples/audit-openai.mjs && node examples/audit-anthropic.mjs && npm pack --dry-run",
+    "check": "npm run lint && npm run test:coverage && node examples/audit-openai.mjs && node examples/audit-anthropic.mjs && npm pack --dry-run"
   },
   "publishConfig": {
     "access": "public"
+  },
+  "devDependencies": {
+    "@anthropic-ai/sdk": "0.135.0"
   }
 }