# Changelog

All notable changes to `@axiorank/sdk` are documented here.

## 0.17.0

Agent Runs: sessions, metadata, sub-agents, and AI Gateway stitching.

- `sessionId` on `ToolCallParams`, on the client constructor (a default for
  every call), and as a `trace()` option. A session groups multiple traces into
  one conversation on the Agent Runs page.
- `metadata` on `ToolCallParams` and as a `trace()` option: a small tag map
  (at most 16 keys, 2KB serialized) surfaced on the run timeline. Values are
  redacted at write by the gateway; handle-level metadata merges under per-call
  metadata.
- `trace().headers()` returns the `X-AxioRank-Trace-Id` / `Session-Id` (and,
  on a child handle, `Parent-Step-Index`) headers. Set them as default headers
  on an OpenAI-compatible client pointed at the AxioRank AI Gateway and its
  LLM turns stitch into the same run as your tool calls.
- `trace().child()` creates a sub-agent view of the run: same trace id,
  session, and step numbering, with every call nested under the spawning step
  (`parentStepIndex`, also settable per call).

## 0.16.0

- Cross-agent (A2A) taint lineage: a `result`-phase call now returns a signed
  `taintHandle` on `ToolCallResult`. Pass it as `taintHandle` on the receiving
  agent's `reportResult` / `inspectResult` when a result came from another agent,
  and the gateway re-seeds that run's taint from it, so a value laundered through
  a second agent is still caught at the next sink.

## 0.14.0

- `--share` on the bundled CLI: `npx @axiorank/sdk demo --share` and
  `npx @axiorank/sdk scan <file> --share` publish that result as a public,
  read-only scorecard and print the link. Opt-in, so nothing is shared without
  the flag.

## 0.13.0

- `redact` enforcement transform: a held call can be released with sensitive
  spans masked instead of denied outright (the resolution order is deny, then
  hold, then redact, then allow). The result types now carry the redacted
  payload so your code can forward the masked version.

## 0.12.0

- `npx @axiorank/sdk redteam`: run AxioRank's hosted attack corpus against your
  own workspace's live posture from the CLI (needs `AXIORANK_KEY` with the
  `policies:read` scope). `--min <score>` exits non-zero below a threshold, so
  you can gate CI on your governance posture.

## 0.11.0

- Model-I/O guardrails: `inspectPrompt()` and `inspectCompletion()` (plus the
  framework chat guards) screen an LLM's prompt and response for prompt
  injection and secret or PII leakage, so you can gate model input and output,
  not just tool calls.

## 0.10.0

- Zero-key local inspection: `inspect()` and `inspectText()` score a tool call
  or text payload locally with no API key and no network call, backed by the
  same detector engine the gateway uses. The bundled CLI gains
  `npx @axiorank/sdk demo` and `npx @axiorank/sdk scan <file>` for a verdict in
  one line.

## 0.9.0

- `intent` on `toolCall` / `enforce` (and a `trace`): pass a short
  natural-language intent so the gateway's flow judge has context when it
  adjudicates a held call.

## 0.8.0

- Google Gemini adapter (`@axiorank/sdk/gemini`): `guardFunctionCall` /
  `guardFunctionHandlers` guard the function-calling dispatch loop you run
  with `@google/genai`, returning ready-to-send `functionResponse` parts.
  Structural (never imports the Google SDK).
- `costUsd` on `ToolCallParams`: attribute spend (USD) to a call so a
  `cost_usd` budget policy can cap an agent once it is over budget.

## 0.7.0

- More framework adapters (optional subpath exports): `@axiorank/sdk/langgraph`
  (`guardTool` / `guardTools` for LangGraph.js) and `@axiorank/sdk/llamaindex`
  (`guardTool` / `guardTools` for LlamaIndex.TS), each scoring a tool's arguments
  before it runs.

## 0.6.1

- Wording refresh only, no code changes: package description and README aligned
  with the Zero-Trust positioning, and the README integrations table now lists
  the Anthropic Messages API adapter that shipped in 0.6.0.

## 0.6.0

- Anthropic Messages API adapter (`@axiorank/sdk/anthropic`): `guardToolUse` /
  `guardToolHandlers` score a model's `tool_use` block through AxioRank and return
  a ready-to-send `tool_result` (with `is_error` on a deny so the model can
  re-plan, or throw with `onDeny: "throw"`). Built for the app-driven Anthropic
  tool loop rather than a framework hook, and reuses the shared guard core (IFC
  result-reporting + onDeny parity). Version realigned with the Python SDK.

## 0.4.0

- Information-flow control (IFC): the guard wrappers now automatically report an
  untrusted tool's RESULT back to the gateway (`reportResult`, phase="result") so
  it can be taint-tracked, but only when the workspace enforces IFC (signaled by
  `ifc` on the verdict) - zero new user code, no wasted calls otherwise. Added
  `AxioRank.reportResult` and `trace.reportResult`; `ToolCallResult.ifc`.

## 0.3.0

- More framework adapters (optional subpath exports):
  - `@axiorank/sdk/langchain` - `guardTool` / `guardTools` for LangChain.js, which
    also covers LangGraph.js. Enforcement wraps the tool and scores before it
    runs (a LangChain callback handler can't reliably block - handler errors are
    processed on an async queue and the tool runs regardless).
  - `@axiorank/sdk/mastra` - `guardTool` / `guardTools` for Mastra tools.
- Real framework tool types now satisfy the adapter signatures without a cast
  (dropped the structural index signatures from the `*/vercel` and
  `*/openai-agents` shims).

## 0.2.0

- Framework adapters, shipped as optional subpath exports (the framework is an
  optional peer dependency, so a plain `@axiorank/sdk` install stays light):
  - `@axiorank/sdk/vercel` - `guardTools` / `guardTool` wrap a Vercel AI SDK
    tools object so every tool call is scored before it runs.
  - `@axiorank/sdk/openai-agents` - `guardExecute` / `guardToolConfig` guard the
    handler you hand to the OpenAI Agents SDK `tool(...)`.
- A blocked call throws `AxioRankDeniedError` by default, or returns a
  model-readable refusal with `{ onDeny: "return" }`. Pass `axio.trace()` to
  correlate a whole agent run into one kill-chain trace.

## 0.1.0 – 0.1.1

Initial releases: the `AxioRank` client (`toolCall` / `enforce`), `trace()`
correlation, short-lived token & federated OIDC auth, `verifyCard` /
`enforceCard`, inbound `verifyRequest` / `axioGuard`, and webhook signature
verification.