shield360 1.1.0 → 1.2.1

package/dist/guard/report.js

@@ -5,7 +5,8 @@
  * When `init` is given a Shield360 URL and API key (or SHIELD360_URL /
  * SHIELD360_API_KEY), every guard decision other than allow is sent to
  * `/api/guard/events`: which guard, what it did, the kind of data found, in
- * which app, on which host. Never the text that was checked.
+ * which app (its service name, as its telemetry reports it), on which host.
+ * Never the text that was checked.
  *
  * With each report go the values found, masked, and fingerprinted with the
  * organisation's key (fetched from `/api/guard/config`), so a reviewer can see
@@ -19,6 +20,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.EVENT_NAME = void 0;
+exports.postGuardEvents = postGuardEvents;
 exports.configureGuardReports = configureGuardReports;
 exports.reportGuardDecision = reportGuardDecision;
 exports.flushGuardReports = flushGuardReports;
@@ -26,6 +28,7 @@ exports.resetGuardReports = resetGuardReports;
 const crypto_1 = require("crypto");
 const os_1 = require("os");
 const findings_1 = require("./findings");
+const heartbeat_1 = require("./heartbeat");
 exports.EVENT_NAME = 'shield360.guard.decision';
 const BATCH = 100;
 const FLUSH_MS = 2000;
@@ -41,6 +44,7 @@ class Reporter {
         this.sending = Promise.resolve();
         /** Settles once the fingerprint key has been fetched (or could not be). */
         this.keyReady = Promise.resolve();
+        this.beat = null;
         this.timer = setInterval(() => void this.flush(), FLUSH_MS);
         // Never keep a process alive just to report.
         this.timer.unref?.();
@@ -62,33 +66,73 @@ class Reporter {
         return this.sending;
     }
     async post(batch) {
-        const body = JSON.stringify({ resource: this.resource, events: batch });
-        for (let attempt = 0; attempt < ATTEMPTS; attempt++) {
+        await postGuardEvents(this.endpoint, this.apiKey, { resource: this.resource, events: batch }, { label: 'guard report' });
+    }
+    /** Sends a heartbeat now and then about every five minutes (heartbeat.ts). Never throws. */
+    startHeartbeat(guards, sdkVersion) {
+        const send = () => {
             try {
-                const res = await fetch(this.endpoint, {
-                    method: 'POST',
-                    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${this.apiKey}` },
-                    body,
-                });
-                if (res.ok)
-                    return;
-                if ([400, 401, 403, 413].includes(res.status)) {
-                    console.warn(`Shield360 rejected guard reports: HTTP ${res.status}`);
-                    return;
-                }
+                this.add({ name: heartbeat_1.HEARTBEAT_EVENT_NAME, time: new Date().toISOString(), attrs: (0, heartbeat_1.heartbeatAttrs)(guards, this.applicationName, sdkVersion) });
+                void this.flush().catch(() => undefined);
             }
             catch {
-                // retried below
+                // a heartbeat is never worth an error in the app
             }
-            await new Promise((r) => setTimeout(r, 500 * (attempt + 1)));
-        }
-        console.warn(`Could not deliver ${batch.length} guard report(s) to Shield360`);
+            this.beat = setTimeout(send, (0, heartbeat_1.nextDelay)());
+            this.beat.unref?.();
+        };
+        send();
     }
     close() {
         clearInterval(this.timer);
+        if (this.beat)
+            clearTimeout(this.beat);
+        this.beat = null;
         return this.flush();
     }
 }
+/**
+ * Posts one batch to `/api/guard/events`: the transport guard reports, the
+ * heartbeat and runtime-protection (RASP) events share. Retries a few times,
+ * gives up on a refusal, and never throws. Resolves to whether it was accepted.
+ */
+async function postGuardEvents(endpoint, apiKey, payload, options = {}) {
+    const label = options.label ?? 'guard report';
+    const attempts = options.attempts ?? ATTEMPTS;
+    const delay = options.retryDelayMs ?? 500;
+    const send = options.fetchImpl ?? globalThis.fetch;
+    if (typeof send !== 'function')
+        return false;
+    let body;
+    try {
+        body = JSON.stringify(payload);
+    }
+    catch {
+        return false;
+    }
+    for (let attempt = 0; attempt < attempts; attempt++) {
+        try {
+            const res = await send(endpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${apiKey}` },
+                body,
+            });
+            if (res.ok)
+                return true;
+            if ([400, 401, 403, 413].includes(res.status)) {
+                console.warn(`Shield360 rejected ${label}s: HTTP ${res.status}`);
+                return false;
+            }
+        }
+        catch {
+            // retried below
+        }
+        if (attempt + 1 < attempts)
+            await new Promise((r) => setTimeout(r, delay * (attempt + 1)));
+    }
+    console.warn(`Could not deliver ${payload.events.length} ${label}(s) to Shield360`);
+    return false;
+}
 /** Findings go out fingerprinted if the key has arrived since they were made. */
 function serialise(event) {
     const { findings, ...rest } = event;
@@ -122,6 +166,8 @@ function configureGuardReports(opts) {
         'user.name': user,
         'deployment.environment': opts.environment,
         'service.version': opts.sdkVersion || '',
+        // The app, by the service name its telemetry uses (security per app).
+        'service.name': opts.applicationName,
     })) {
         if (v)
             resource[k] = v;
@@ -130,6 +176,8 @@ function configureGuardReports(opts) {
     const base = opts.url.replace(/\/+$/, '');
     reporter = new Reporter(`${base}/api/guard/events`, opts.apiKey, resource, opts.applicationName);
     reporter.keyReady = fetchFingerprintKey(base, opts.apiKey);
+    if (opts.guards?.length && (0, heartbeat_1.heartbeatEnabled)(opts.heartbeat))
+        reporter.startHeartbeat(opts.guards, opts.sdkVersion || '');
     return true;
 }
 /** The organisation's fingerprint key; without it findings are masked only. */
@@ -162,6 +210,7 @@ function reportGuardDecision(guardName, action, classification, phase, findings
         attrs: {
             'shield360.guard.event_id': (0, crypto_1.randomUUID)().replace(/-/g, ''),
             'shield360.guard.client': reporter.applicationName,
+            'shield360.guard.app': reporter.applicationName,
             'shield360.guard.action': action,
             'shield360.guard.target': phase,
             'shield360.guard.kinds': kinds,

package/dist/guard/report.js.map

@@ -1 +1 @@
-{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/guard/report.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;GAiBG;;;AA+FH,sDA4BC;AAeD,kDA2BC;AAGD,8CAEC;AAGD,8CAGC;AA9KD,mCAAoC;AACpC,2BAAwC;AACxC,yCAAyE;AAE5D,QAAA,UAAU,GAAG,0BAA0B,CAAC;AACrD,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAInB,MAAM,QAAQ;IAOZ,YACmB,QAAgB,EAChB,MAAc,EACd,QAAgC,EACxC,eAAuB;QAHf,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAwB;QACxC,oBAAe,GAAf,eAAe,CAAQ;QAVjB,UAAK,GAAoB,EAAE,CAAC;QAErC,YAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QACnD,2EAA2E;QAC3E,aAAQ,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAQ1C,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,6CAA6C;QAC7C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,KAAoB;QACtB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,gEAAgE;IAChE,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAsB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;YACpD,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE;oBACrC,MAAM,EAAE,MAAM;oBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE,EAAE;oBACvF,IAAI;iBACL,CAAC,CAAC;gBACH,IAAI,GAAG,CAAC,EAAE;oBAAE,OAAO;gBACnB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;oBAC9C,OAAO,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;oBACrE,OAAO;gBACT,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,gBAAgB;YAClB,CAAC;YACD,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/D,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,qBAAqB,KAAK,CAAC,MAAM,+BAA+B,CAAC,CAAC;IACjF,CAAC;IAED,KAAK;QACH,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAoB;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,0BAAe,CAAC,CAAC;IAC3C,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE;YACL,GAAG,IAAI,CAAC,KAAK;YACb,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAChD,8BAA8B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACzF;KACF,CAAC;AACJ,CAAC;AAED,IAAI,QAAQ,GAAoB,IAAI,CAAC;AAErC,oFAAoF;AACpF,SAAgB,qBAAqB,CAAC,IAMrC;IACC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,aAAQ,GAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAClC,WAAW,EAAE,IAAA,aAAQ,GAAE;QACvB,WAAW,EAAE,IAAI;QACjB,wBAAwB,EAAE,IAAI,CAAC,WAAW;QAC1C,iBAAiB,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;KACzC,CAAC,EAAE,CAAC;QACH,IAAI,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,QAAQ,GAAG,IAAI,QAAQ,CAAC,GAAG,IAAI,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACjG,QAAQ,CAAC,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAc;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;QAChE,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc;YAAE,IAAA,4BAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7G,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,mBAAmB,CACjC,SAAiB,EACjB,MAAc,EACd,cAAsB,EACtB,KAAa,EACb,WAAsB,EAAE;IAExB,IAAI,CAAC,QAAQ,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;SACjC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,QAAQ,CAAC,GAAG,CAAC;QACX,IAAI,EAAE,kBAAU;QAChB,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,KAAK,EAAE;YACL,0BAA0B,EAAE,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1D,wBAAwB,EAAE,QAAQ,CAAC,eAAe;YAClD,wBAAwB,EAAE,MAAM;YAChC,wBAAwB,EAAE,KAAK;YAC/B,uBAAuB,EAAE,KAAK;YAC9B,sBAAsB,EAAE,SAAS;SAClC;QACD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAgB,iBAAiB;IAC/B,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AACzD,CAAC;AAED,kCAAkC;AAC3B,KAAK,UAAU,iBAAiB;IACrC,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxB,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}
+{"version":3,"file":"report.js","sourceRoot":"","sources":["../../src/guard/report.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AA8FH,0CAoCC;AAoBD,sDAmCC;AAeD,kDA4BC;AAGD,8CAEC;AAGD,8CAGC;AA7OD,mCAAoC;AACpC,2BAAwC;AAExC,yCAAyE;AACzE,2CAAgG;AAEnF,QAAA,UAAU,GAAG,0BAA0B,CAAC;AACrD,MAAM,KAAK,GAAG,GAAG,CAAC;AAClB,MAAM,QAAQ,GAAG,IAAI,CAAC;AACtB,MAAM,UAAU,GAAG,IAAI,CAAC;AACxB,MAAM,QAAQ,GAAG,CAAC,CAAC;AAInB,MAAM,QAAQ;IAOZ,YACmB,QAAgB,EAChB,MAAc,EACd,QAAgC,EACxC,eAAuB;QAHf,aAAQ,GAAR,QAAQ,CAAQ;QAChB,WAAM,GAAN,MAAM,CAAQ;QACd,aAAQ,GAAR,QAAQ,CAAwB;QACxC,oBAAe,GAAf,eAAe,CAAQ;QAVjB,UAAK,GAAoB,EAAE,CAAC;QAErC,YAAO,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QACnD,2EAA2E;QAC3E,aAAQ,GAAkB,OAAO,CAAC,OAAO,EAAE,CAAC;QAkCpC,SAAI,GAAyC,IAAI,CAAC;QA1BxD,IAAI,CAAC,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,KAAK,IAAI,CAAC,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;QAC5D,6CAA6C;QAC7C,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC;IACvB,CAAC;IAED,GAAG,CAAC,KAAoB;QACtB,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,UAAU,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YAC3E,OAAO;QACT,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACzB,CAAC;IAED,gEAAgE;IAChE,KAAK;QACH,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC1C,MAAM,IAAI,CAAC,QAAQ,CAAC;YACpB,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM;gBAAE,MAAM,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC;QACxF,CAAC,CAAC,CAAC;QACH,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAEO,KAAK,CAAC,IAAI,CAAC,KAAsB;QACvC,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,CAAC,CAAC;IAC3H,CAAC;IAID,4FAA4F;IAC5F,cAAc,CAAC,MAAwB,EAAE,UAAkB;QACzD,MAAM,IAAI,GAAG,GAAG,EAAE;YAChB,IAAI,CAAC;gBACH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,gCAAoB,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,KAAK,EAAE,IAAA,0BAAc,EAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,UAAU,CAAC,EAAE,CAAC,CAAC;gBAC1I,KAAK,IAAI,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC3C,CAAC;YAAC,MAAM,CAAC;gBACP,iDAAiD;YACnD,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC,IAAI,EAAE,IAAA,qBAAS,GAAE,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,CAAC;QACtB,CAAC,CAAC;QACF,IAAI,EAAE,CAAC;IACT,CAAC;IAED,KAAK;QACH,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC1B,IAAI,IAAI,CAAC,IAAI;YAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;IACtB,CAAC;CACF;AAWD;;;;GAIG;AACI,KAAK,UAAU,eAAe,CACnC,QAAgB,EAChB,MAAc,EACd,OAAgE,EAChE,UAAuC,EAAE;IAEzC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,cAAc,CAAC;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,IAAI,GAAG,CAAC;IAC1C,MAAM,IAAI,GAAG,OAAO,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IACnD,IAAI,OAAO,IAAI,KAAK,UAAU;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,GAAG,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC;QACpD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,QAAQ,EAAE;gBAC/B,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE;gBAClF,IAAI;aACL,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,EAAE;gBAAE,OAAO,IAAI,CAAC;YACxB,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC9C,OAAO,CAAC,IAAI,CAAC,sBAAsB,KAAK,WAAW,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;gBACjE,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB;QAClB,CAAC;QACD,IAAI,OAAO,GAAG,CAAC,GAAG,QAAQ;YAAE,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7F,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,qBAAqB,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,KAAK,kBAAkB,CAAC,CAAC;IACpF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,iFAAiF;AACjF,SAAS,SAAS,CAAC,KAAoB;IACrC,MAAM,EAAE,QAAQ,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,MAAM;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,0BAAe,CAAC,CAAC;IAC3C,OAAO;QACL,GAAG,IAAI;QACP,KAAK,EAAE;YACL,GAAG,IAAI,CAAC,KAAK;YACb,0BAA0B,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;YAChD,8BAA8B,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;SACzF;KACF,CAAC;AACJ,CAAC;AAED,IAAI,QAAQ,GAAoB,IAAI,CAAC;AAErC,oFAAoF;AACpF,SAAgB,qBAAqB,CAAC,IAUrC;IACC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC5C,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,GAAG,IAAA,aAAQ,GAAE,CAAC,QAAQ,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;IACD,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC;QAClC,WAAW,EAAE,IAAA,aAAQ,GAAE;QACvB,WAAW,EAAE,IAAI;QACjB,wBAAwB,EAAE,IAAI,CAAC,WAAW;QAC1C,iBAAiB,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE;QACxC,sEAAsE;QACtE,cAAc,EAAE,IAAI,CAAC,eAAe;KACrC,CAAC,EAAE,CAAC;QACH,IAAI,CAAC;YAAE,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;IACD,KAAK,QAAQ,EAAE,KAAK,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1C,QAAQ,GAAG,IAAI,QAAQ,CAAC,GAAG,IAAI,mBAAmB,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,CAAC,eAAe,CAAC,CAAC;IACjG,QAAQ,CAAC,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,IAAI,IAAI,CAAC,MAAM,EAAE,MAAM,IAAI,IAAA,4BAAgB,EAAC,IAAI,CAAC,SAAS,CAAC;QAAE,QAAQ,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;IACzH,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,mBAAmB,CAAC,IAAY,EAAE,MAAc;IAC7D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,mBAAmB,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACxG,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO;QACpB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAiC,CAAC;QAChE,IAAI,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,IAAI,IAAI,CAAC,cAAc;YAAE,IAAA,4BAAiB,EAAC,IAAI,CAAC,cAAc,CAAC,CAAC;IAC7G,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,yEAAyE;AACzE,SAAgB,mBAAmB,CACjC,SAAiB,EACjB,MAAc,EACd,cAAsB,EACtB,KAAa,EACb,WAAsB,EAAE;IAExB,IAAI,CAAC,QAAQ,IAAI,MAAM,KAAK,OAAO;QAAE,OAAO;IAC5C,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;SACjC,KAAK,CAAC,GAAG,CAAC;SACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC;SACf,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,QAAQ,CAAC,GAAG,CAAC;QACX,IAAI,EAAE,kBAAU;QAChB,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QAC9B,KAAK,EAAE;YACL,0BAA0B,EAAE,IAAA,mBAAU,GAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;YAC1D,wBAAwB,EAAE,QAAQ,CAAC,eAAe;YAClD,qBAAqB,EAAE,QAAQ,CAAC,eAAe;YAC/C,wBAAwB,EAAE,MAAM;YAChC,wBAAwB,EAAE,KAAK;YAC/B,uBAAuB,EAAE,KAAK;YAC9B,sBAAsB,EAAE,SAAS;SAClC;QACD,QAAQ,EAAE,IAAI;KACf,CAAC,CAAC;AACL,CAAC;AAED,oEAAoE;AACpE,SAAgB,iBAAiB;IAC/B,OAAO,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;AACzD,CAAC;AAED,kCAAkC;AAC3B,KAAK,UAAU,iBAAiB;IACrC,MAAM,QAAQ,EAAE,KAAK,EAAE,CAAC;IACxB,QAAQ,GAAG,IAAI,CAAC;AAClB,CAAC"}

package/dist/index.d.ts

@@ -5,6 +5,7 @@ import { usingAttributes, injectAdditionalAttributes, setAgentVersion, resetAgen
 import { runEval, runEvalBatch, fetchEvalTypes } from './evals';
 import { logScore } from './score';
 import { TracedSpan, startTrace, trace as traceManual } from './manual-trace';
+import { captureConsole, captureStdio, pinoStream, releaseConsole, releaseStdio, winstonTransport } from './otel/log-bridges';
 import { PII } from './guard/pii';
 import { PromptInjection } from './guard/prompt-injection';
 import { Moderation } from './guard/moderation';
@@ -13,6 +14,12 @@ import { TopicRestriction } from './guard/topic-restriction';
 import { Schema } from './guard/schema';
 import { Custom } from './guard/custom';
 import { Pipeline } from './guard/pipeline';
+import { budgets, configureBudgets, BudgetClient, BudgetExceededError } from './budgets';
+import { setCustomer, withCustomer, getCustomer, CustomerSpanProcessor } from './customer';
+import { aiSecurity, configureAiSecurity, AiSecurityBlockedError } from './ai-security';
+import { feedback, getCurrentSpanId, getCurrentTraceId } from './feedback';
+import { disableRasp, enableRasp } from './rasp';
+import { createLogger } from './otel/app-logs';
 import { Guard, GuardAction, GuardPhase, GuardError, GuardDeniedError, GuardTimeoutError, GuardConfigError, PipelineResult } from './guard/base';
 declare class Shield360 extends BaseShield360 {
     static resource: ReturnType<typeof resourceFromAttributes>;
@@ -54,8 +61,72 @@ declare class Shield360 extends BaseShield360 {
     static resetAgentVersion: typeof resetAgentVersion;
     static withAgentVersion: typeof runWithAgentVersion;
     static getAgentVersion: typeof getCurrentAgentVersion;
+    /**
+     * Send what one of your users thought of an AI response (thumbs 1/-1 or
+     * stars 1-5) against its trace. Server side, with the environment's API
+     * key. Resolves to whether it was accepted; never throws.
+     */
+    static feedback: typeof feedback;
+    /** The active span's trace id, to keep with a response so a later rating can name it. */
+    static getCurrentTraceId: typeof getCurrentTraceId;
+    static getCurrentSpanId: typeof getCurrentSpanId;
     static startTrace: typeof startTrace;
     static trace: typeof traceManual;
+    /** SHIELD: a logger for application logs; a no-op unless captureLogs is on. */
+    static logger: typeof createLogger;
+    /** SHIELD: bridges from pino, winston and console to application logs (no-ops unless captureLogs is on). */
+    static pinoStream: typeof pinoStream;
+    static winstonTransport: typeof winstonTransport;
+    static captureConsole: typeof captureConsole;
+    static releaseConsole: typeof releaseConsole;
+    static captureStdio: typeof captureStdio;
+    static releaseStdio: typeof releaseStdio;
+    /** Feature flags: `Shield360.flags.getFlag(key, context, default)` and `isEnabled(key, context)`. */
+    static flags: import("./flags").FlagsClient;
+    /** Budget check: Shield360.budgets.check({ model, estimatedCostUsd }) never throws; see ./budgets. */
+    static budgets: {
+        check: (options?: import("./budgets").BudgetCheckOptions) => Promise<import("./budgets").BudgetCheckResult>;
+        configure: typeof configureBudgets;
+        reset: () => void;
+    };
+    static BudgetExceededError: typeof BudgetExceededError;
+    /**
+     * Cost per end customer. setCustomer({ tenantId, userId? }) sets a process-wide
+     * default (null clears it); withCustomer(customer, fn) scopes one to fn and its
+     * async work, winning over the default; getCustomer() returns the one in effect.
+     * Invalid ids are dropped silently. The SDK never hashes: Shield360 stores user
+     * ids only as a keyed hash, and tenant ids as given unless the organisation opts
+     * to hash them. See ./customer.
+     */
+    static setCustomer: typeof setCustomer;
+    /** SHIELD: the runtime kill switch for RASP (env SHIELD360_RASP=off and the signed config's killSwitch win over it). */
+    static disableRasp: typeof disableRasp;
+    static enableRasp: typeof enableRasp;
+    static withCustomer: typeof withCustomer;
+    static getCustomer: typeof getCustomer;
+    /** AI security pack: Shield360.aiSecurity.scanContext(), scanOutput(), defineTool(), ... See ./ai-security. */
+    static aiSecurity: {
+        configure: typeof configureAiSecurity;
+        policy: typeof import("./ai-security").currentPolicy;
+        scanContext: typeof import("./ai-security").scanContext;
+        checkPrompt: typeof import("./ai-security").checkPrompt;
+        scanOutput: typeof import("./ai-security").scanOutput;
+        streamScanner: typeof import("./ai-security").streamScanner;
+        withCanary: typeof import("./ai-security").withCanary;
+        tagContext: typeof import("./ai-security").tagContext;
+        defineTool: typeof import("./ai-security").defineTool;
+        authorizeTool: typeof import("./ai-security").authorizeTool;
+        checkLimits: typeof import("./ai-security").checkLimits;
+        recordUsage: typeof import("./ai-security").recordUsage;
+        syncLimitsNow: typeof import("./ai-security").syncLimitsNow;
+        checkMcpTools: typeof import("./ai-security").checkMcpTools;
+        checkRetrieval: typeof import("./ai-security").checkRetrieval;
+        withEndUser: <T>(user: import("./ai-security").EndUserInput | null, fn: () => T) => T;
+        setEndUser: typeof import("./ai-security").setEndUser;
+        flush: typeof import("./ai-security").flushAiSecurity;
+        BlockedError: typeof AiSecurityBlockedError;
+    };
+    static AiSecurityBlockedError: typeof AiSecurityBlockedError;
     static init(options?: Shield360Options): void;
 }
 declare const shield360: typeof Shield360 & {
@@ -65,9 +136,26 @@ declare const shield360: typeof Shield360 & {
 export default shield360;
 export { Shield360, usingAttributes, injectAdditionalAttributes, logScore };
 export { TracedSpan, startTrace, traceManual as trace };
+export { budgets, BudgetClient, BudgetExceededError };
+export type { BudgetCheckOptions, BudgetCheckResult, BudgetAction, BudgetClientOptions } from './budgets';
+export { createLogger } from './otel/app-logs';
+export type { Shield360Logger, LogLevel } from './otel/app-logs';
+export { FlagsClient, flags } from './flags';
+export type { FlagsOptions, FlagDetail, FlagDefinition, EvaluationContext, Evaluation, FlagValue, PromptRef, PromptFlagOptions, PromptFlagResult, Segment } from './flags';
+export { setCustomer, withCustomer, getCustomer, CustomerSpanProcessor };
+export type { Customer, CustomerInput } from './customer';
+export { aiSecurity, AiSecurityBlockedError };
+export type { AiSecurityPolicy, AiSecurityPolicyInput, AiSecurityEvent, EndUserInput } from './ai-security';
+export type { AiSecurityInitOptions } from './types';
 export type { Shield360Options } from './types';
 export type { LogScoreOptions } from './score';
+export { feedback, getCurrentTraceId, getCurrentSpanId } from './feedback';
+export type { FeedbackOptions, FeedbackScale } from './feedback';
 export { protectTool, authorizeWithShield360, protectReadiness, ProtectDeniedError, ProtectReadinessError, ProtectError } from './protect';
 export type { ProtectMode, ProtectConfig, ProtectReadiness, ProtectToolOptions, AuthorizeTarget, AuthorizeAnswer } from './protect';
+export { agentVerifier, AGENT_HEADER, MemoryReplayStore } from './agents';
+export type { AgentVerifier, AgentVerifierOptions, AgentCheck, AgentCheckOptions, AgentCheckInput, AgentPolicy, ReplayStore } from './agents';
+export { raspExpress, raspExpressErrorHandler, raspFastify, raspKoa, raspHttp, withRasp, recordRequestBody, recordModelOutput, recordToolArguments, runInRaspScope, disableRasp, enableRasp, raspActive, isRaspBlocked, RaspBlockedError, Shield360RaspBlocked, } from './rasp';
+export type { RaspOptions, RaspMode, AttackType as RaspAttackType, ConfigPublicKey } from './rasp';
 export { PII, PromptInjection, Moderation, SensitiveTopic, TopicRestriction, Schema, Custom, Pipeline, Guard, GuardAction, GuardPhase, GuardError, GuardDeniedError, GuardTimeoutError, GuardConfigError, PipelineResult, };
 export type { GuardResult } from './guard/base';

package/dist/index.js

@@ -3,7 +3,8 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
     return (mod && mod.__esModule) ? mod : { "default": mod };
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.PipelineResult = exports.GuardConfigError = exports.GuardTimeoutError = exports.GuardDeniedError = exports.GuardError = exports.GuardPhase = exports.GuardAction = exports.Guard = exports.Pipeline = exports.Custom = exports.Schema = exports.TopicRestriction = exports.SensitiveTopic = exports.Moderation = exports.PromptInjection = exports.PII = exports.ProtectError = exports.ProtectReadinessError = exports.ProtectDeniedError = exports.protectReadiness = exports.authorizeWithShield360 = exports.protectTool = exports.trace = exports.startTrace = exports.TracedSpan = exports.logScore = exports.injectAdditionalAttributes = exports.usingAttributes = exports.Shield360 = void 0;
+exports.Moderation = exports.PromptInjection = exports.PII = exports.Shield360RaspBlocked = exports.RaspBlockedError = exports.isRaspBlocked = exports.raspActive = exports.enableRasp = exports.disableRasp = exports.runInRaspScope = exports.recordToolArguments = exports.recordModelOutput = exports.recordRequestBody = exports.withRasp = exports.raspHttp = exports.raspKoa = exports.raspFastify = exports.raspExpressErrorHandler = exports.raspExpress = exports.MemoryReplayStore = exports.AGENT_HEADER = exports.agentVerifier = exports.ProtectError = exports.ProtectReadinessError = exports.ProtectDeniedError = exports.protectReadiness = exports.authorizeWithShield360 = exports.protectTool = exports.getCurrentSpanId = exports.getCurrentTraceId = exports.feedback = exports.AiSecurityBlockedError = exports.aiSecurity = exports.CustomerSpanProcessor = exports.getCustomer = exports.withCustomer = exports.setCustomer = exports.flags = exports.FlagsClient = exports.createLogger = exports.BudgetExceededError = exports.BudgetClient = exports.budgets = exports.trace = exports.startTrace = exports.TracedSpan = exports.logScore = exports.injectAdditionalAttributes = exports.usingAttributes = exports.Shield360 = void 0;
+exports.PipelineResult = exports.GuardConfigError = exports.GuardTimeoutError = exports.GuardDeniedError = exports.GuardError = exports.GuardPhase = exports.GuardAction = exports.Guard = exports.Pipeline = exports.Custom = exports.Schema = exports.TopicRestriction = exports.SensitiveTopic = void 0;
 const resources_1 = require("@opentelemetry/resources");
 const semantic_conventions_1 = require("@opentelemetry/semantic-conventions");
 const api_1 = require("@opentelemetry/api");
@@ -24,6 +25,12 @@ Object.defineProperty(exports, "TracedSpan", { enumerable: true, get: function (
 Object.defineProperty(exports, "startTrace", { enumerable: true, get: function () { return manual_trace_1.startTrace; } });
 Object.defineProperty(exports, "trace", { enumerable: true, get: function () { return manual_trace_1.trace; } });
 const metrics_1 = __importDefault(require("./otel/metrics"));
+// SHIELD: host and process metrics (opt-in).
+const system_metrics_1 = require("./otel/system-metrics");
+// SHIELD: logger bridges (pino, winston, console) to application logs.
+const log_bridges_1 = require("./otel/log-bridges");
+// SHIELD: winston and pino bridged without code changes when application logs are on.
+const log_auto_1 = require("./otel/log-auto");
 const gpu_1 = __importDefault(require("./instrumentation/gpu"));
 const semantic_convention_1 = __importDefault(require("./semantic-convention"));
 const utils_1 = require("./otel/utils");
@@ -48,8 +55,33 @@ Object.defineProperty(exports, "Custom", { enumerable: true, get: function () {
 const pipeline_1 = require("./guard/pipeline");
 Object.defineProperty(exports, "Pipeline", { enumerable: true, get: function () { return pipeline_1.Pipeline; } });
 const destination_1 = require("./destination");
+// Budget check: app budgets enforced through the SDK.
+const budgets_1 = require("./budgets");
+Object.defineProperty(exports, "budgets", { enumerable: true, get: function () { return budgets_1.budgets; } });
+Object.defineProperty(exports, "BudgetClient", { enumerable: true, get: function () { return budgets_1.BudgetClient; } });
+Object.defineProperty(exports, "BudgetExceededError", { enumerable: true, get: function () { return budgets_1.BudgetExceededError; } });
+const auto_1 = require("./budgets/auto");
+// Feature flags: fetched rules, evaluated locally.
+const client_1 = require("./flags/client");
+// Cost per end customer: tag AI calls with the builder's own customer.
+const customer_1 = require("./customer");
+Object.defineProperty(exports, "setCustomer", { enumerable: true, get: function () { return customer_1.setCustomer; } });
+Object.defineProperty(exports, "withCustomer", { enumerable: true, get: function () { return customer_1.withCustomer; } });
+Object.defineProperty(exports, "getCustomer", { enumerable: true, get: function () { return customer_1.getCustomer; } });
+Object.defineProperty(exports, "CustomerSpanProcessor", { enumerable: true, get: function () { return customer_1.CustomerSpanProcessor; } });
+// AI security pack: checks on the app's own AI traffic, kept apart from tracing.
+const ai_security_1 = require("./ai-security");
+Object.defineProperty(exports, "aiSecurity", { enumerable: true, get: function () { return ai_security_1.aiSecurity; } });
+Object.defineProperty(exports, "AiSecurityBlockedError", { enumerable: true, get: function () { return ai_security_1.AiSecurityBlockedError; } });
+const hooks_1 = require("./ai-security/hooks");
 const code_location_1 = require("./otel/code-location");
 const build_info_1 = require("./otel/build-info");
+const feedback_1 = require("./feedback");
+// SHIELD: runtime protection (RASP), opt-in.
+const rasp_1 = require("./rasp");
+const zero_code_1 = require("./zero-code");
+// SHIELD: application logs, opt-in.
+const app_logs_1 = require("./otel/app-logs");
 const base_2 = require("./guard/base");
 Object.defineProperty(exports, "Guard", { enumerable: true, get: function () { return base_2.Guard; } });
 Object.defineProperty(exports, "GuardAction", { enumerable: true, get: function () { return base_2.GuardAction; } });
@@ -117,6 +149,12 @@ function resolveOptions(options) {
         tracer: o.tracer,
         otlpEndpoint,
         otlpHeaders,
+        consoleFallback: (0, destination_1.consoleFallbackAllowed)({
+            otlpEndpoint,
+            shield360Url,
+            shield360ApiKey,
+            captureStdio: (0, app_logs_1.resolveCaptureLogs)(o.captureLogs) && (o.captureStdio ?? (0, utils_1.parseBoolEnv)('SHIELD360_CAPTURE_STDIO') ?? false),
+        }),
         disableBatch,
         captureMessageContent,
         disabledInstrumentors: o.disabledInstrumentors,
@@ -130,21 +168,36 @@ function resolveOptions(options) {
         shield360Url,
         guards: o.guards,
         guardFailOpen: o.guardFailOpen ?? true,
+        guardHeartbeat: o.guardHeartbeat,
         protect: (0, mode_1.resolveProtect)(o.protect),
         collectGpuStats,
         captureCodeLocation: (0, code_location_1.resolveCaptureCodeLocation)(o.captureCodeLocation),
         codeRoot: o.codeRoot,
         serviceVersion: o.serviceVersion,
+        captureLogs: (0, app_logs_1.resolveCaptureLogs)(o.captureLogs),
+        captureStdio: o.captureStdio ?? (0, utils_1.parseBoolEnv)('SHIELD360_CAPTURE_STDIO') ?? false,
+        logLevel: (0, app_logs_1.resolveLogLevel)(o.logLevel),
+        collectSystemMetrics: (0, system_metrics_1.resolveCollectSystemMetrics)(o.collectSystemMetrics),
     };
 }
 class Shield360 extends base_1.default {
     static init(options) {
+        // SHIELD: shield360/register already started Shield360 from the environment: a second init() is a no-op.
+        if ((0, zero_code_1.zeroCodeStarted)())
+            return (0, zero_code_1.noteSkippedInit)();
         try {
             api_1.diag.setLogger(new api_1.DiagConsoleLogger(), api_1.DiagLogLevel.WARN);
             const resolved = resolveOptions(options);
             this.options = resolved;
+            // SHIELD: half a Shield360 destination sends nothing; say so once rather than print every record.
+            if (!resolved.otlpEndpoint && Boolean(resolved.shield360Url?.trim()) !== Boolean(resolved.shield360ApiKey?.trim())) {
+                console.warn(`Shield360: ${resolved.shield360Url?.trim() ? 'SHIELD360_API_KEY' : 'SHIELD360_URL'} is not set, so telemetry and application logs are not sent.`);
+            }
+            const buildAttributes = (0, build_info_1.resolveBuildAttributes)({ serviceVersion: resolved.serviceVersion });
+            // User feedback names the application and release it was given for.
+            (0, feedback_1.configureFeedback)({ app: resolved.applicationName, release: buildAttributes[build_info_1.ATTR_SERVICE_VERSION] });
             this.resource = (0, resources_1.resourceFromAttributes)({
-                ...(0, build_info_1.resolveBuildAttributes)({ serviceVersion: resolved.serviceVersion }),
+                ...buildAttributes,
                 [semantic_conventions_1.ATTR_SERVICE_NAME]: resolved.applicationName,
                 [semantic_convention_1.default.ATTR_DEPLOYMENT_ENVIRONMENT]: resolved.environment,
                 [semantic_conventions_1.ATTR_TELEMETRY_SDK_NAME]: constant_1.SDK_NAME,
@@ -157,12 +210,45 @@ class Shield360 extends base_1.default {
             if (!resolved.disableEvents) {
                 events_1.default.setup(setupBase);
             }
+            // SHIELD: application logs share the events LoggerProvider, so they go
+            // to the same destination as traces. Nothing is sent unless asked for.
+            // With them on, console output, winston and pino are bridged too, as
+            // the Python SDK attaches its handler to the root logger.
+            if (resolved.captureLogs) {
+                (0, app_logs_1.enableAppLogs)(events_1.default.ensureProvider(setupBase), resolved.logLevel, {
+                    captureCodeLocation: resolved.captureCodeLocation,
+                    codeRoot: resolved.codeRoot,
+                });
+                if (resolved.captureStdio) {
+                    // console, pino and winston write to stdout and stderr too: one record per line, not two.
+                    (0, log_bridges_1.releaseConsole)();
+                    (0, log_bridges_1.captureStdio)();
+                }
+                else {
+                    (0, log_bridges_1.captureConsole)();
+                    (0, log_auto_1.enableLogBridges)();
+                }
+            }
+            else {
+                (0, app_logs_1.disableAppLogs)();
+                (0, log_bridges_1.releaseConsole)();
+                (0, log_bridges_1.releaseStdio)();
+            }
             if (!resolved.disableMetrics) {
                 const exportIntervalMillis = Number(process.env.OTEL_EXPORTER_OTLP_METRICS_EXPORT_INTERVAL ?? 60000) || 60000;
                 const meter = metrics_1.default.setup({
                     ...setupBase,
                     exportIntervalMillis,
                 });
+                // SHIELD: host and process metrics for the Infrastructure view, when asked for.
+                if (resolved.collectSystemMetrics && meter) {
+                    try {
+                        (0, system_metrics_1.setupSystemMetrics)(meter);
+                    }
+                    catch (e) {
+                        api_1.diag.error(`Shield360 system metrics setup failed: ${e}`);
+                    }
+                }
                 // GPU metrics: only register gauges when a supported GPU is detected
                 // (mirrors Python shield360.init collect_gpu_stats path).
                 if (resolved.collectGpuStats && meter) {
@@ -179,7 +265,46 @@ class Shield360 extends base_1.default {
             }
             config_1.default.shield360ApiKey = resolved.shield360ApiKey;
             config_1.default.shield360Url = resolved.shield360Url;
+            // Budget check: the automatic pre-call check, when asked for.
+            const budgetCheck = options?.budgetCheck ?? ((0, utils_1.parseBoolEnv)('SHIELD360_BUDGET_CHECK') || false);
+            if (budgetCheck) {
+                const client = (0, budgets_1.configureBudgets)({
+                    app: resolved.applicationName,
+                    ...(typeof budgetCheck === 'object' && budgetCheck.failClosed !== undefined ? { failClosed: budgetCheck.failClosed } : {}),
+                });
+                (0, auto_1.setupAutoBudgetCheck)({ client, onWarn: (r) => console.warn(`[shield360] ${r.reason}`) });
+            }
+            else {
+                (0, budgets_1.configureBudgets)({ app: resolved.applicationName });
+            }
+            // AI security pack: on when asked for; monitors by default.
+            const ai = options?.aiSecurity ?? ((0, utils_1.parseBoolEnv)('SHIELD360_AI_SECURITY') || false);
+            if (ai) {
+                const o = typeof ai === 'object' ? ai : {};
+                (0, ai_security_1.configureAiSecurity)({
+                    url: resolved.shield360Url,
+                    apiKey: resolved.shield360ApiKey,
+                    app: resolved.applicationName,
+                    environment: resolved.environment,
+                    policy: o.policy,
+                    configPublicKey: o.configPublicKey,
+                    allowUnpinnedConfig: o.allowUnpinnedConfig,
+                    configCacheFile: o.configCacheFile,
+                    recordAllowed: o.recordAllowed,
+                });
+                if (o.autoInstrument !== false)
+                    (0, hooks_1.setupAiSecurity)();
+            }
             helpers_1.default.fetchPricingInfo(resolved.pricingJson).then((info) => { config_1.default.pricingInfo = info; }, () => { config_1.default.pricingInfo = {}; });
+            // SHIELD: runtime protection (RASP): off unless options.rasp or SHIELD360_RASP turns it on.
+            (0, rasp_1.initRasp)(options?.rasp, {
+                applicationName: resolved.applicationName,
+                environment: resolved.environment,
+                url: resolved.shield360Url,
+                apiKey: resolved.shield360ApiKey,
+                sdkVersion: constant_1.SDK_VERSION,
+                otlpEndpoint: resolved.otlpEndpoint,
+            });
             if (resolved.guards && resolved.guards.length > 0) {
                 (0, integration_1.setupAutoGuards)(resolved.guards, resolved.guardFailOpen, resolved.protect);
                 // With a Shield360 URL and API key, what the guards stop is also
@@ -189,6 +314,9 @@ class Shield360 extends base_1.default {
                     apiKey: resolved.shield360ApiKey,
                     applicationName: resolved.applicationName,
                     environment: resolved.environment,
+                    sdkVersion: constant_1.SDK_VERSION,
+                    guards: resolved.guards,
+                    heartbeat: resolved.guardHeartbeat,
                 });
             }
             else if (resolved.protect.mode === 'enforced' && resolved.protect.required.length) {
@@ -247,12 +375,62 @@ Shield360.setAgentVersion = helpers_2.setAgentVersion;
 Shield360.resetAgentVersion = helpers_2.resetAgentVersion;
 Shield360.withAgentVersion = helpers_2.runWithAgentVersion;
 Shield360.getAgentVersion = helpers_2.getCurrentAgentVersion;
+/**
+ * Send what one of your users thought of an AI response (thumbs 1/-1 or
+ * stars 1-5) against its trace. Server side, with the environment's API
+ * key. Resolves to whether it was accepted; never throws.
+ */
+Shield360.feedback = feedback_1.feedback;
+/** The active span's trace id, to keep with a response so a later rating can name it. */
+Shield360.getCurrentTraceId = feedback_1.getCurrentTraceId;
+Shield360.getCurrentSpanId = feedback_1.getCurrentSpanId;
 Shield360.startTrace = manual_trace_1.startTrace;
 Shield360.trace = manual_trace_1.trace;
+/** SHIELD: a logger for application logs; a no-op unless captureLogs is on. */
+Shield360.logger = app_logs_1.createLogger;
+/** SHIELD: bridges from pino, winston and console to application logs (no-ops unless captureLogs is on). */
+Shield360.pinoStream = log_bridges_1.pinoStream;
+Shield360.winstonTransport = log_bridges_1.winstonTransport;
+Shield360.captureConsole = log_bridges_1.captureConsole;
+Shield360.releaseConsole = log_bridges_1.releaseConsole;
+Shield360.captureStdio = log_bridges_1.captureStdio;
+Shield360.releaseStdio = log_bridges_1.releaseStdio;
+/** Feature flags: `Shield360.flags.getFlag(key, context, default)` and `isEnabled(key, context)`. */
+Shield360.flags = client_1.flags;
+/** Budget check: Shield360.budgets.check({ model, estimatedCostUsd }) never throws; see ./budgets. */
+Shield360.budgets = budgets_1.budgets;
+Shield360.BudgetExceededError = budgets_1.BudgetExceededError;
+/**
+ * Cost per end customer. setCustomer({ tenantId, userId? }) sets a process-wide
+ * default (null clears it); withCustomer(customer, fn) scopes one to fn and its
+ * async work, winning over the default; getCustomer() returns the one in effect.
+ * Invalid ids are dropped silently. The SDK never hashes: Shield360 stores user
+ * ids only as a keyed hash, and tenant ids as given unless the organisation opts
+ * to hash them. See ./customer.
+ */
+Shield360.setCustomer = customer_1.setCustomer;
+/** SHIELD: the runtime kill switch for RASP (env SHIELD360_RASP=off and the signed config's killSwitch win over it). */
+Shield360.disableRasp = rasp_1.disableRasp;
+Shield360.enableRasp = rasp_1.enableRasp;
+Shield360.withCustomer = customer_1.withCustomer;
+Shield360.getCustomer = customer_1.getCustomer;
+/** AI security pack: Shield360.aiSecurity.scanContext(), scanOutput(), defineTool(), ... See ./ai-security. */
+Shield360.aiSecurity = ai_security_1.aiSecurity;
+Shield360.AiSecurityBlockedError = ai_security_1.AiSecurityBlockedError;
 const shield360 = Shield360;
 shield360.usingAttributes = helpers_2.usingAttributes;
 shield360.injectAdditionalAttributes = helpers_2.injectAdditionalAttributes;
 exports.default = shield360;
+var app_logs_2 = require("./otel/app-logs");
+Object.defineProperty(exports, "createLogger", { enumerable: true, get: function () { return app_logs_2.createLogger; } });
+// Feature flags.
+var flags_1 = require("./flags");
+Object.defineProperty(exports, "FlagsClient", { enumerable: true, get: function () { return flags_1.FlagsClient; } });
+Object.defineProperty(exports, "flags", { enumerable: true, get: function () { return flags_1.flags; } });
+var feedback_2 = require("./feedback");
+Object.defineProperty(exports, "feedback", { enumerable: true, get: function () { return feedback_2.feedback; } });
+Object.defineProperty(exports, "getCurrentTraceId", { enumerable: true, get: function () { return feedback_2.getCurrentTraceId; } });
+Object.defineProperty(exports, "getCurrentSpanId", { enumerable: true, get: function () { return feedback_2.getCurrentSpanId; } });
 // Shield Protect re-exports: enforcement APIs, apart from the tracing ones above.
 var protect_1 = require("./protect");
 Object.defineProperty(exports, "protectTool", { enumerable: true, get: function () { return protect_1.protectTool; } });
@@ -261,4 +439,27 @@ Object.defineProperty(exports, "protectReadiness", { enumerable: true, get: func
 Object.defineProperty(exports, "ProtectDeniedError", { enumerable: true, get: function () { return protect_1.ProtectDeniedError; } });
 Object.defineProperty(exports, "ProtectReadinessError", { enumerable: true, get: function () { return protect_1.ProtectReadinessError; } });
 Object.defineProperty(exports, "ProtectError", { enumerable: true, get: function () { return protect_1.ProtectError; } });
+// Agent passports: verify the agents that call this service (also at 'shield360/agents').
+var agents_1 = require("./agents");
+Object.defineProperty(exports, "agentVerifier", { enumerable: true, get: function () { return agents_1.agentVerifier; } });
+Object.defineProperty(exports, "AGENT_HEADER", { enumerable: true, get: function () { return agents_1.AGENT_HEADER; } });
+Object.defineProperty(exports, "MemoryReplayStore", { enumerable: true, get: function () { return agents_1.MemoryReplayStore; } });
+// SHIELD: runtime protection (RASP): middleware, the block error, the model-output hook point.
+var rasp_2 = require("./rasp");
+Object.defineProperty(exports, "raspExpress", { enumerable: true, get: function () { return rasp_2.raspExpress; } });
+Object.defineProperty(exports, "raspExpressErrorHandler", { enumerable: true, get: function () { return rasp_2.raspExpressErrorHandler; } });
+Object.defineProperty(exports, "raspFastify", { enumerable: true, get: function () { return rasp_2.raspFastify; } });
+Object.defineProperty(exports, "raspKoa", { enumerable: true, get: function () { return rasp_2.raspKoa; } });
+Object.defineProperty(exports, "raspHttp", { enumerable: true, get: function () { return rasp_2.raspHttp; } });
+Object.defineProperty(exports, "withRasp", { enumerable: true, get: function () { return rasp_2.withRasp; } });
+Object.defineProperty(exports, "recordRequestBody", { enumerable: true, get: function () { return rasp_2.recordRequestBody; } });
+Object.defineProperty(exports, "recordModelOutput", { enumerable: true, get: function () { return rasp_2.recordModelOutput; } });
+Object.defineProperty(exports, "recordToolArguments", { enumerable: true, get: function () { return rasp_2.recordToolArguments; } });
+Object.defineProperty(exports, "runInRaspScope", { enumerable: true, get: function () { return rasp_2.runInRaspScope; } });
+Object.defineProperty(exports, "disableRasp", { enumerable: true, get: function () { return rasp_2.disableRasp; } });
+Object.defineProperty(exports, "enableRasp", { enumerable: true, get: function () { return rasp_2.enableRasp; } });
+Object.defineProperty(exports, "raspActive", { enumerable: true, get: function () { return rasp_2.raspActive; } });
+Object.defineProperty(exports, "isRaspBlocked", { enumerable: true, get: function () { return rasp_2.isRaspBlocked; } });
+Object.defineProperty(exports, "RaspBlockedError", { enumerable: true, get: function () { return rasp_2.RaspBlockedError; } });
+Object.defineProperty(exports, "Shield360RaspBlocked", { enumerable: true, get: function () { return rasp_2.Shield360RaspBlocked; } });
 //# sourceMappingURL=index.js.map