dreadnode 2.0.32__tar.gz → 2.0.33__tar.gz

{dreadnode-2.0.32 → dreadnode-2.0.33}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: dreadnode
-Version: 2.0.32
+Version: 2.0.33
 Summary: Dreadnode SDK
 Project-URL: Homepage, https://dreadnode.io
 Project-URL: Documentation, https://docs.dreadnode.io

{dreadnode-2.0.32 → dreadnode-2.0.33}/dreadnode/airt/__init__.py

@@ -101,6 +101,12 @@ from dreadnode.airt.salami_slicing import salami_slicing_attack
 from dreadnode.airt.self_persuasion import self_persuasion_attack
 from dreadnode.airt.siren import siren_attack
 from dreadnode.airt.tap import tap_attack
+from dreadnode.airt.targets import (
+    TargetAuth,
+    TargetSpec,
+    build_target,
+    nova_sonic_target,
+)
 from dreadnode.airt.templatefuzz import templatefuzz_attack
 from dreadnode.airt.tmap_trajectory import tmap_trajectory_attack
 from dreadnode.airt.trojail import trojail_attack
@@ -108,6 +114,8 @@ from dreadnode.airt.watermark_removal import watermark_removal_attack
 
 __all__ = [
     "Assessment",
+    "TargetAuth",
+    "TargetSpec",
     "adversarial_reasoning_attack",
     "advpromptier_attack",
     "alignment_faking_attack",
@@ -117,6 +125,7 @@ __all__ = [
     "autodan_turbo_attack",
     "autoredteamer_attack",
     "beast_attack",
+    "build_target",
     "cot_jailbreak_attack",
     "crescendo_attack",
     "deep_inception_attack",
@@ -136,6 +145,7 @@ __all__ = [
     "multimodal_attack",
     "nes_attack",
     "nexus_attack",
+    "nova_sonic_target",
     "pair_attack",
     "persona_hijack_attack",
     "prompt_attack",

{dreadnode-2.0.32 → dreadnode-2.0.33}/dreadnode/airt/message_parts.py

@@ -46,6 +46,18 @@ def _mime_for_extension(ext: str | None, default: str) -> str:
     return _MIME_BY_EXT.get(ext.lower().lstrip("."), default)
 
 
+# Legacy/alias MIME types that browsers handle poorly, mapped to the standard.
+_MIME_ALIASES = {
+    "audio/x-wav": "audio/wav",
+    "audio/wave": "audio/wav",
+    "audio/x-pn-wav": "audio/wav",
+}
+
+
+def _normalize_mime(mime: str | None) -> str | None:
+    return _MIME_ALIASES.get(mime, mime) if mime else mime
+
+
 def text_part(
     text: str,
     *,
@@ -106,9 +118,14 @@ def _media_part(
 ) -> dict[str, t.Any]:
     """Build a media message part, storing bytes as a content-addressed artifact."""
     meta = _store_bytes_as_artifact(span, data, filename=filename)
+    # Prefer the caller's canonical media_type over log_artifact's guessed MIME:
+    # Python's mimetypes maps `.wav` to the legacy `audio/x-wav`, which some
+    # browsers refuse to play in an <audio> element. `_normalize_mime` maps such
+    # aliases back to the standard type.
+    resolved_mime = _normalize_mime(media_type or (meta.get("mime_type") if meta else None))
     source: dict[str, t.Any] = {
         "ref": "artifact",
-        "media_type": (meta.get("mime_type") if meta else None) or media_type,
+        "media_type": resolved_mime,
         "byte_size": (meta.get("size") if meta else None) or len(data),
         "filename": (meta.get("name") if meta else None) or filename,
     }
@@ -226,12 +243,75 @@ def response_to_parts(
     content-addressed artifacts; text is inlined.
     """
     from dreadnode.core.types import Audio, Image, Video
+    from dreadnode.generators.message import (
+        ContentAudioInput,
+        ContentImageUrl,
+        ContentText,
+        ContentVideoUrl,
+    )
 
     parts: list[dict[str, t.Any]] = []
 
     def _walk(value: t.Any) -> None:
         if value is None:
             return
+        # SDK message content-part types (media-out responses: image/audio/video
+        # generated by the target land here). Extract the real bytes/text instead
+        # of stringifying the part's repr.
+        if isinstance(value, ContentText):
+            if value.text:
+                parts.append(text_part(value.text))
+            return
+        if isinstance(value, ContentImageUrl):
+            url = value.image_url.url
+            mime = "image/png"
+            if url.startswith("data:") and ";" in url:
+                mime = url[5:].split(";", 1)[0] or mime
+            parts.append(
+                _media_part(
+                    span,
+                    value.to_bytes(),
+                    kind="image",
+                    media_type=mime,
+                    filename="response_image.png",
+                    transform=None,
+                    variant="output",
+                    caption=None,
+                )
+            )
+            return
+        if isinstance(value, ContentAudioInput):
+            fmt = getattr(value.input_audio, "format", "wav") or "wav"
+            parts.append(
+                _media_part(
+                    span,
+                    value.to_bytes(),
+                    kind="audio",
+                    media_type=_mime_for_extension(fmt, "audio/wav"),
+                    filename=f"response_audio.{fmt}",
+                    transform=None,
+                    variant="output",
+                    caption=None,
+                )
+            )
+            return
+        if isinstance(value, ContentVideoUrl):
+            import base64 as _b64
+
+            data = _b64.b64decode(value.file.file_data.split(",", 1)[-1])
+            parts.append(
+                _media_part(
+                    span,
+                    data,
+                    kind="video",
+                    media_type=value.file.mimetype or "video/mp4",
+                    filename=value.file.filename or "response_video.mp4",
+                    transform=None,
+                    variant="output",
+                    caption=None,
+                )
+            )
+            return
         if isinstance(value, str):
             if value:
                 parts.append(text_part(value))

{dreadnode-2.0.32 → dreadnode-2.0.33}/dreadnode/airt/multimodal.py

@@ -6,12 +6,14 @@ Probes multimodal models (vision, audio) with transformed inputs.
 
 from __future__ import annotations
 
+import contextlib
 import typing as t
 
 from dreadnode.core.transforms import Transform
 from dreadnode.generators.message import (
     ContentAudioInput,
     ContentImageUrl,
+    ContentText,
     ContentVideoUrl,
     Message,
 )
@@ -206,11 +208,122 @@ def _log_multimodal_parts(
         logger.debug("Failed to log multimodal message parts", exc_info=True)
 
 
+def _extract_response_modalities(response: t.Any) -> dict[str, t.Any]:
+    """Decode a target response into per-modality scorable values.
+
+    Returns a dict keyed by modality (``"text"``/``"image"``/``"audio"``/``"video"``).
+    Text is a single concatenated string; media modalities are decoded into native
+    SDK media objects (``Image``/``Audio``/``Video``) so a modality-specific scorer
+    receives the type it expects. A str response yields ``{"text": <str>}`` — the
+    exact value the single-scorer path scored before, keeping text-out behaviour
+    (and every other attack that never emits media) unchanged.
+    """
+    from dreadnode.core.types import Audio, Image, Video
+
+    out: dict[str, t.Any] = {}
+    texts: list[str] = []
+
+    def _walk(value: t.Any) -> None:
+        if value is None:
+            return
+        if isinstance(value, str):
+            if value:
+                texts.append(value)
+        elif isinstance(value, ContentText):
+            if value.text:
+                texts.append(value.text)
+        elif isinstance(value, ContentImageUrl):
+            with contextlib.suppress(Exception):
+                out["image"] = Image(value.to_bytes())
+        elif isinstance(value, ContentAudioInput):
+            fmt = getattr(value.input_audio, "format", "wav") or "wav"
+            with contextlib.suppress(Exception):
+                out["audio"] = Audio(value.to_bytes(), format=fmt)
+        elif isinstance(value, ContentVideoUrl):
+            with contextlib.suppress(Exception):
+                import base64
+
+                data = base64.b64decode(value.file.file_data.split(",", 1)[-1])
+                ext = (value.file.mimetype or "video/mp4").split("/")[-1]
+                out["video"] = Video(data, format=ext)
+        elif isinstance(value, Image):
+            out["image"] = value
+        elif isinstance(value, Audio):
+            out["audio"] = value
+        elif isinstance(value, Video):
+            out["video"] = value
+        elif isinstance(value, (list, tuple)):
+            for item in value:
+                _walk(item)
+        elif isinstance(value, dict):
+            for key in ("content", "content_parts", "parts", "text"):
+                if key in value:
+                    _walk(value[key])
+                    break
+        else:
+            content = getattr(value, "content_parts", None) or getattr(value, "content", None)
+            if content is not None and not isinstance(content, str):
+                _walk(content)
+
+    _walk(response)
+    if texts:
+        out["text"] = "\n".join(texts)
+    return out
+
+
+async def _score_multimodal_response(
+    response: t.Any,
+    *,
+    text_scorer: Scorer[t.Any],
+    response_scorers: dict[str, Scorer[t.Any]] | None,
+) -> tuple[float, dict[str, float], str | None]:
+    """Score each response modality and aggregate the trial score by MAX.
+
+    Red-teaming aggregation is worst-case: if *any* output modality bypasses
+    safety, the attack succeeded, so the objective score is the maximum across
+    modalities. Per-modality scores are returned for display, and the winning
+    (max) modality's rationale is surfaced as the judge reasoning.
+
+    Backward compatible: with no ``response_scorers`` and a plain text (str)
+    response, this scores exactly the same string with ``text_scorer`` as the
+    prior single-``scorer.score(response)`` path did — text-out attacks and
+    non-multimodal attacks are unaffected. Media modalities with no configured
+    scorer are simply skipped (they can't be judged without a media scorer).
+    """
+    scorers: dict[str, Scorer[t.Any]] = dict(response_scorers or {})
+    scorers.setdefault("text", text_scorer)
+
+    modalities = _extract_response_modalities(response)
+    per_modality: dict[str, float] = {}
+    reasons: dict[str, str] = {}
+    for modality, value in modalities.items():
+        scorer = scorers.get(modality)
+        if scorer is None:
+            continue
+        metric = await scorer.score(value)
+        per_modality[modality] = float(metric.value)
+        reason = (getattr(metric, "attributes", None) or {}).get("reason")
+        if reason:
+            reasons[modality] = str(reason)
+
+    if not per_modality:
+        # Nothing decoded (or no applicable scorer) — score the raw response so a
+        # degenerate/unknown output shape still yields a metric.
+        metric = await text_scorer.score(response)
+        reason = (getattr(metric, "attributes", None) or {}).get("reason")
+        value = float(metric.value)
+        return value, {"text": value}, (str(reason) if reason else None)
+
+    winning = max(per_modality, key=per_modality.__getitem__)
+    return per_modality[winning], per_modality, reasons.get(winning)
+
+
 def multimodal_attack(
     goal: str,
     target: Task[..., str],
     scorer: Scorer[str],
     *,
+    response_scorers: dict[str, Scorer[t.Any]] | None = None,
     image: Image | None = None,
     audio: Audio | None = None,
     video: Video | None = None,
@@ -235,7 +348,17 @@ def multimodal_attack(
     Args:
         goal: The text prompt to send to the model (consistent with goat_attack/tap_attack API).
         target: Task that takes a Message and returns a string response.
-        scorer: Scorer to evaluate target responses (e.g., jailbreak success).
+        scorer: Scorer to evaluate the target's *text* response (e.g., jailbreak
+            success). Also used as the default text scorer for multimodal output.
+        response_scorers: Optional per-modality scorers for multimodal *output*,
+            keyed by ``"text"``/``"image"``/``"audio"``/``"video"``. When a target
+            emits more than one modality (e.g. text + a generated image), each part
+            is scored by its modality's scorer and the trial's objective score is
+            the MAX across them — worst-case aggregation, since any single modality
+            bypassing safety counts as a successful jailbreak. Per-modality scores
+            are recorded on the trial span for display. Media modalities without a
+            configured scorer are skipped. Omit this for text-out targets — behaviour
+            is then identical to scoring the text response with ``scorer``.
         image: Optional image to include.
         audio: Optional audio to include.
         video: Optional video to include.
@@ -298,12 +421,70 @@ def multimodal_attack(
             applied,
         ) = await _apply_transforms(goal, image, audio, video, fitted_transforms)
 
-        # Build message and call target
+        # Build message
         message = _build_message(
             transformed_goal, transformed_image, transformed_audio, transformed_video
         )
-        span = await target.run(message)
-        response = span.output
+
+        # Record the candidate ("attacker prompt") + trace Input as the transformed
+        # goal *text* BEFORE calling the target. If the target then fails (e.g. a
+        # provider error, so the response is empty), the finding still shows the
+        # real prompt instead of the sampler's {"iteration": N} search state.
+        # The Study logs `str(sample.input)` as `transformed_prompt`, so a dict
+        # input would render as `{'iteration': 0, 'image': Image(...)}`; the
+        # transformed media is carried losslessly in the message parts, so the
+        # text is all we log here.
+        trial = current_trial.get()
+        if trial is not None:
+            trial.candidate = transformed_goal
+            # The trial span's "candidate" input was logged at TrialStart with the
+            # sampler's raw search state; replace it with the goal text.
+            from dreadnode.tracing.span import current_task_span as _cts
+
+            _trial_span = _cts.get()
+            if _trial_span is not None:
+                with contextlib.suppress(Exception):
+                    _trial_span._inputs = [
+                        r for r in _trial_span._inputs if getattr(r, "name", None) != "candidate"
+                    ]
+                    _trial_span.log_input("candidate", transformed_goal)
+
+        # Call the target. If it errors (auth failure, unreachable model, rate limit,
+        # ...), record the error text as the response so the finding shows *why* it
+        # failed instead of an opaque "(no response)", then re-raise so the trial is
+        # still classified as an error (not a refusal).
+        try:
+            span = await target.run(message)
+            response = span.output
+        except Exception as target_exc:
+            error_text = f"[target error] {type(target_exc).__name__}: {str(target_exc)[:500]}"
+            with contextlib.suppress(Exception):
+                _log_multimodal_parts(
+                    original_goal=goal,
+                    transformed_goal=transformed_goal,
+                    original_image=image,
+                    transformed_image=transformed_image,
+                    original_audio=audio,
+                    transformed_audio=transformed_audio,
+                    original_video=video,
+                    transformed_video=transformed_video,
+                    applied_transforms=applied,
+                    response=error_text,
+                )
+            if trial is not None:
+                with contextlib.suppress(Exception):
+                    trial.evaluation_result = EvalResult(
+                        samples=[Sample(input=transformed_goal, output=error_text, index=iteration)]
+                    )
+            from dreadnode.tracing.span import current_task_span as _err_span_ctx
+
+            _err_span = _err_span_ctx.get()
+            if _err_span is not None:
+                from dreadnode.tracing.constants import AIRT_ATTRIBUTE_JUDGE_REASONING
+
+                with contextlib.suppress(Exception):
+                    _err_span.set_attribute(AIRT_ATTRIBUTE_JUDGE_REASONING, error_text)
+            raise
 
         # Persist the multimodal message parts (input + output) as content-addressed
         # artifacts on the trial span, so findings can render each part in the UI.
@@ -320,18 +501,7 @@ def multimodal_attack(
             response=response,
         )
 
-        # Store sample in trial for tracking (include multimodal content for display)
-        trial = current_trial.get()
         if trial is not None:
-            # The candidate ("attacker prompt") AND the transformed prompt are the
-            # transformed goal *text* — not the sampler's {"iteration": n} params
-            # or a dict carrying the raw Image object. The Study logs
-            # `str(sample.input)` as `transformed_prompt`, so a dict input would
-            # render as `{'iteration': 0, 'image': Image(256x768x3 ...)}` in the
-            # UI. The transformed media is carried losslessly in the message
-            # parts (see `_log_multimodal_parts`), so the text is all we log here.
-            trial.candidate = transformed_goal
-
             sample = Sample(
                 input=transformed_goal,
                 output=response,
@@ -339,9 +509,35 @@ def multimodal_attack(
             )
             trial.evaluation_result = EvalResult(samples=[sample])
 
-        # Score the response
-        score_result = await scorer.score(response)
-        return {OBJECTIVE_SCORE_KEY: score_result.value}
+        # Score the response. For multimodal *output* (e.g. text + a generated
+        # image), each modality is scored by its own scorer and the objective is
+        # the MAX — any modality bypassing safety = a successful jailbreak. For a
+        # plain text response this reduces to scoring the text with `scorer`, so
+        # text-out attacks are unaffected. The winning modality's rationale is
+        # persisted so findings show *why* it scored ("Judge Reasoning"); the
+        # per-modality breakdown is recorded for display.
+        agg_score, modality_scores, reason = await _score_multimodal_response(
+            response, text_scorer=scorer, response_scorers=response_scorers
+        )
+        from dreadnode.tracing.span import current_task_span
+
+        trial_span = current_task_span.get()
+        if trial_span is not None:
+            if reason:
+                from dreadnode.tracing.constants import AIRT_ATTRIBUTE_JUDGE_REASONING
+
+                with contextlib.suppress(Exception):
+                    trial_span.set_attribute(AIRT_ATTRIBUTE_JUDGE_REASONING, str(reason))
+            if len(modality_scores) > 1:
+                import json
+
+                from dreadnode.tracing.constants import AIRT_ATTRIBUTE_MODALITY_SCORES
+
+                with contextlib.suppress(Exception):
+                    trial_span.set_attribute(
+                        AIRT_ATTRIBUTE_MODALITY_SCORES, json.dumps(modality_scores)
+                    )
+        return {OBJECTIVE_SCORE_KEY: agg_score}
 
     attack: Study[dict[str, t.Any]] = Study(
         name=name,

dreadnode-2.0.33/dreadnode/airt/targets/__init__.py

@@ -0,0 +1,39 @@
+"""Universal custom targets for AI red teaming.
+
+A red-teaming *target* is any system you can send a message to and read a response
+from. This package turns a declarative :class:`TargetSpec` into a dreadnode ``@task``
+target that plugs straight into ``multimodal_attack`` / the attack studies —
+regardless of where the model is deployed (AWS, Azure ML/AI Foundry, Google Vertex,
+a self-hosted endpoint) or how it authenticates.
+
+Two transports:
+
+- ``http`` — request/response endpoints. Fully declarative: an endpoint, an auth scheme
+  (:class:`TargetAuth`), a JSON request template placing ``{prompt}`` / ``{image_b64}`` /
+  ``{audio_b64}`` / ``{video_b64}``, and a JSONPath to the response text. Covers Azure
+  ML / AI Foundry, Vertex ``predict``, SageMaker sync-invoke, OpenAI-compatible, etc.
+
+- ``streaming`` — realtime / speech-to-speech protocols with a bespoke handshake. The
+  spec *selects* a protocol adapter; ``nova_sonic`` (Amazon Bedrock bidirectional S2S)
+  ships in :mod:`dreadnode.airt.targets.streaming`.
+
+Module layout: :mod:`spec` (models) · :mod:`message` (payload conversion) ·
+:mod:`auth` (auth strategies) · :mod:`http` (HTTP transport) · :mod:`streaming`
+(streaming adapters) · :mod:`factory` (:func:`build_target` dispatcher).
+
+Credentials are always read from environment variables / platform secrets — never
+inlined into the spec.
+"""
+
+from dreadnode.airt.targets.factory import build_target
+from dreadnode.airt.targets.spec import AuthType, TargetAuth, TargetSpec, Transport
+from dreadnode.airt.targets.streaming import nova_sonic_target
+
+__all__ = [
+    "AuthType",
+    "TargetAuth",
+    "TargetSpec",
+    "Transport",
+    "build_target",
+    "nova_sonic_target",
+]

dreadnode-2.0.33/dreadnode/airt/targets/auth.py

@@ -0,0 +1,74 @@
+"""HTTP authentication strategies.
+
+Each auth mode reads its credential/identity from the environment or the platform's
+credential chain — never from the spec. Provider SDKs (boto3, azure-identity,
+google-auth) are imported dynamically so they stay off the SDK's hard-dependency set.
+"""
+
+import importlib
+import os
+
+from dreadnode.airt.targets.spec import TargetSpec
+
+
+def apply_auth(
+    spec: TargetSpec, headers: dict[str, str], url: str, content: bytes
+) -> dict[str, str]:
+    """Return the request headers with the spec's auth applied.
+
+    For ``aws_sigv4`` the returned dict is the fully signed header set (which depends on
+    ``url`` and ``content``); every other mode just adds an authorization header.
+    """
+    auth = spec.auth
+    headers = dict(headers)
+    if auth.type == "api_key":
+        headers[auth.header] = auth.value_prefix + os.environ.get(auth.env_var, "")
+    elif auth.type == "bearer":
+        headers["Authorization"] = "Bearer " + os.environ.get(auth.env_var, "")
+    elif auth.type == "azure_ad":
+        headers["Authorization"] = "Bearer " + azure_ad_token(auth.scope)
+    elif auth.type == "gcp":
+        headers["Authorization"] = "Bearer " + gcp_token(auth.scope)
+    elif auth.type == "aws_sigv4":
+        headers = sign_sigv4(url, content, headers, auth.region, auth.service)
+    return headers
+
+
+def sign_sigv4(
+    url: str, body: bytes, headers: dict[str, str], region: str, service: str
+) -> dict[str, str]:
+    """Sign a POST with AWS SigV4 using the default credential chain (env/profile/role)."""
+    boto3 = importlib.import_module("boto3")
+    sigv4_auth = importlib.import_module("botocore.auth").SigV4Auth
+    aws_request = importlib.import_module("botocore.awsrequest").AWSRequest
+
+    creds = boto3.Session().get_credentials()
+    if creds is None:
+        raise RuntimeError("aws_sigv4 auth requires AWS credentials (env vars, profile, or role)")
+    req = aws_request(method="POST", url=url, data=body, headers=headers)
+    sigv4_auth(creds.get_frozen_credentials(), service, region).add_auth(req)
+    return dict(req.headers)
+
+
+def azure_ad_token(scope: str) -> str:
+    """Acquire an Entra token via DefaultAzureCredential (managed identity, workload
+    identity, env creds, or ``az login`` — in that precedence)."""
+    default_azure_credential = importlib.import_module("azure.identity").DefaultAzureCredential
+
+    return default_azure_credential().get_token(scope).token
+
+
+def gcp_token(scope: str) -> str:
+    """Acquire a token via Google Application Default Credentials (service account,
+    workload identity, or ``gcloud`` login)."""
+    google_auth = importlib.import_module("google.auth")
+    request_cls = importlib.import_module("google.auth.transport.requests").Request
+
+    scopes = (
+        [scope]
+        if scope and scope.startswith("http")
+        else ["https://www.googleapis.com/auth/cloud-platform"]
+    )
+    creds, _ = google_auth.default(scopes=scopes)
+    creds.refresh(request_cls())
+    return creds.token

dreadnode-2.0.33/dreadnode/airt/targets/factory.py

@@ -0,0 +1,39 @@
+"""Dispatcher: turn a declarative :class:`TargetSpec` into a runnable ``@task``."""
+
+import typing as t
+
+from dreadnode.airt.targets.http import http_target
+from dreadnode.airt.targets.spec import TargetSpec
+from dreadnode.airt.targets.streaming.nova_sonic import nova_sonic_target
+from dreadnode.core.task import Task
+
+
+def build_target(spec: TargetSpec) -> Task[..., t.Any]:
+    """Build a dreadnode ``@task`` target from a :class:`TargetSpec`.
+
+    Example (HTTP, Azure AI Foundry)::
+
+        target = build_target(TargetSpec(
+            endpoint="https://my.westus.inference.ml.azure.com/score",
+            auth=TargetAuth(type="api_key", header="Authorization", value_prefix="Bearer ",
+                            env_var="AZURE_FOUNDRY_KEY"),
+            request_template='{"input_data": {"input_string": ["{prompt}"]}}',
+            response_text_path="$.output",
+        ))
+
+    Example (streaming, Amazon Nova Sonic S2S)::
+
+        target = build_target(TargetSpec(
+            transport="streaming", protocol="nova_sonic", endpoint="us-east-1",
+            options={"voice": "matthew"},
+        ))
+    """
+    if spec.transport == "http":
+        return http_target(spec)
+    if spec.transport == "streaming":
+        if spec.protocol == "nova_sonic":
+            return nova_sonic_target(
+                region=spec.endpoint or "us-east-1", name=spec.name, **spec.options
+            )
+        raise ValueError(f"Unknown streaming protocol: {spec.protocol!r}")
+    raise ValueError(f"Unknown transport: {spec.transport!r}")

dreadnode-2.0.33/dreadnode/airt/targets/http.py

@@ -0,0 +1,45 @@
+"""HTTP request/response transport: declarative body template + JSONPath response."""
+
+import json
+
+import httpx
+
+from dreadnode.airt.targets.auth import apply_auth
+from dreadnode.airt.targets.message import extract_parts, extract_response_text
+from dreadnode.airt.targets.spec import TargetSpec
+from dreadnode.core.task import Task, task
+from dreadnode.generators.message import Message
+
+
+def _render_body(template: str, parts: dict[str, str]) -> dict:
+    body_str = template
+    for key, value in parts.items():
+        token = "{" + key + "}"
+        # JSON-escape the (untrusted) prompt; base64 is already safe.
+        replacement = json.dumps(value)[1:-1] if key == "prompt" else value
+        body_str = body_str.replace(token, replacement)
+    return json.loads(body_str)
+
+
+async def http_call(message: Message, spec: TargetSpec) -> str:
+    """Serialize the message, POST it to the endpoint with auth, and extract the reply.
+
+    Kept free of the ``@task`` wrapper so the request/response logic is unit testable
+    without the tracing/storage a Task invocation requires.
+    """
+    body = _render_body(spec.request_template, extract_parts(message))
+    content = json.dumps(body).encode("utf-8")
+    headers = apply_auth(spec, {"Content-Type": "application/json"}, spec.endpoint, content)
+
+    async with httpx.AsyncClient(timeout=spec.timeout_s) as client:
+        resp = await client.post(spec.endpoint, content=content, headers=headers)
+        resp.raise_for_status()
+        data = resp.json()
+    return extract_response_text(data, spec.response_text_path)
+
+
+def http_target(spec: TargetSpec) -> Task[..., str]:
+    async def target(message: Message) -> str:
+        return await http_call(message, spec)
+
+    return task(target, name=spec.name)