import { SpecoraClient } from '@specora/sdk';

const client = new SpecoraClient({
  baseUrl: process.env.SPECORA_API_URL,
  apiKey: process.env.SPECORA_API_KEY,
  // vendorId and tenantId intentionally omitted.
});

const response = await client.proxyExecute({
  provider: 'openai',        // any of: openai, anthropic, gemini, deepseek, qwen, ollama, vllm
  model: 'gpt-4',
  messages: [{ role: 'user', content: 'Hello' }],
});

const client = new SpecoraClient({
  baseUrl: process.env.SPECORA_API_URL,
  apiKey: process.env.SPECORA_API_KEY,
  vendorId: process.env.SPECORA_VENDOR_ID,  // UUID; required in Model B
  tenantId: process.env.SPECORA_TENANT_ID,  // UUID; required in Model B
});

// Policy check, budget validation, and separate execution recording
// endpoints are Model B only. Model A uses `proxyExecute` as the single
// entry point (budget enforcement at the Model A layer is tracked as a
// follow-up).
const policy = await client.checkPolicy({
  subject: { type: 'pr_run', id: 'run-123' },
});

if (policy.decision === 'block') {
  console.log('Blocked by policy:', policy.severity);
  return;
}

// Execute your AI operation...

// Record the execution
await client.recordExecution({
  provider: 'openai',
  model: 'gpt-4',
  costMicros: 5000, // $0.005
  inputTokens: 1000,
  outputTokens: 500,
  success: true,
});

// Call 1: summarize (might use a fast/cheap model)
const auth1 = await client.preAuthorize({
  provider: 'anthropic',
  model: 'claude-sonnet-4-20250514',
  estimatedTokens: 2000,
  estimatedCostMicros: 500,
  routingHints: {
    agentName: 'pr-review-pipeline',
    purpose: 'summarize',
  },
});

// Call 2: security review (might use a premium model)
const auth2 = await client.preAuthorize({
  provider: 'anthropic',
  model: 'claude-sonnet-4-20250514',
  estimatedTokens: 4000,
  estimatedCostMicros: 2000,
  routingHints: {
    agentName: 'pr-review-pipeline',
    purpose: 'security-review',
  },
});

// The server may override provider/model based on admin assignments
console.log(auth1.selectedProvider); // e.g., 'deepseek' (cheaper for summaries)
console.log(auth2.selectedProvider); // e.g., 'anthropic' (premium for security)

import { SpecoraClient, GovernanceRouter } from '@specora/sdk';
import Anthropic from '@anthropic-ai/sdk';

const specora = new SpecoraClient({ /* ... */ });
const governed = new GovernanceRouter(specora, new Anthropic());

// Routing hints are forwarded to preAuthorize() automatically
const response = await governed.messages.create({
  model: 'claude-sonnet-4-20250514',
  max_tokens: 1024,
  messages: [{ role: 'user', content: 'Review this code for safety issues' }],
  routingHints: {
    purpose: 'safety-rewriter',
    agentName: 'code-safety-agent',
  },
});

// Org admin assigns "safety-rewriter" workflow to Ollama via dashboard,
// or create a PURPOSE_ROUTING governance policy

const response = await governed.messages.create({
  model: 'claude-sonnet-4-20250514',  // default model (overridden by assignment)
  max_tokens: 1024,
  messages: [{ role: 'user', content: 'Rewrite for safety' }],
  routingHints: { agentName: 'safety-rewriter' },
});
// If the admin assigned Ollama to this workflow, Specora routes there instead

// Get global preferences
const prefs = await client.getPreferences();
console.log(prefs.preferences); // [{slot: 1, providerName: 'anthropic', modelName: 'claude-sonnet-4', ...}]

// Get codegen-specific preferences
const codegenPrefs = await client.getPreferences('codegen');

// Resolve the best model for a specific workflow + capability
const resolved = await client.resolvePreference({
  capabilities: ['code_generation'],
  workflowType: 'codegen',
});

if (resolved.providerName) {
  console.log(`Using: ${resolved.providerName}/${resolved.modelName}`);
  console.log(`Source: ${resolved.source}, fallback: ${resolved.fallbackUsed}`);
}

const client = new SpecoraClient({
  // Required
  baseUrl: 'https://api.specora.ai',
  apiKey: 'sk_...',
  vendorId: 'vendor-uuid',
  tenantId: 'tenant-uuid',

  // Optional
  failOpen: false,    // Default: false (fail-closed)
  timeout: 30000,     // Request timeout in ms
  retries: 2,         // Retry attempts
});

const client = new SpecoraClient({
  // ...
  failOpen: true, // Errors result in allowed decisions
});

const result = await client.checkPolicy({
  subject: { type: 'pr_run', id: 'run-123' },
  inputs: { /* optional context */ },
});

// result.decision: 'allow' | 'block' | 'warn'
// result.severity: 'low' | 'medium' | 'high' | 'critical'
// result.invariants: Array<{ id, status, reason }>
// result.override: { eligible, requiredJustification, expiresMaxSeconds }

const budget = await client.validateBudget();

// budget.budgetRemaining: number (USD)
// budget.budgetTotal: number (USD)
// budget.usagePercent: number (0-100)
// budget.forecastBreach: boolean
// budget.enforcementState: 'normal' | 'throttled' | 'blocked'

const result = await client.recordExecution({
  provider: 'openai',
  model: 'gpt-4',
  costMicros: 5000, // 1/1,000,000 USD
  inputTokens: 1000,
  outputTokens: 500,
  durationMs: 1500,
  success: true,
  externalRunId: 'your-id', // optional
  metadata: { /* custom data */ }, // optional
});

// result.executionId: string
// result.budgetRemainingMicros: number
// result.usagePercent: number
// result.enforcementState: string

const result = await client.validateAssumptions({
  runId: 'run-123',
  assumptions: [
    { id: 'a1', description: 'No breaking changes', impactLevel: 'high' },
  ],
});

// result.severity: 'low' | 'medium' | 'high' | 'critical'
// result.verificationRequired: boolean
// result.mergeEligible: boolean
// result.violations: Array<{ assumptionId, reason }>
// result.recommendations: string[]

const evidence = await client.generateEvidenceBundle({
  runId: 'run-123',
  artifactTypes: ['confidence_report', 'trace'],
  includeProvenance: true,
});

// evidence.bundleId: string
// evidence.bundleHash: string (sha256:...)
// evidence.storagePath: string

const risk = await client.getRiskScore();

// risk.riskPercentile: number (0-100)
// risk.driftRisk: number
// risk.overrideFrequencyRisk: number
// risk.anomalyStatus: 'normal' | 'elevated' | 'critical'

import { verifyWebhookSignature, parseWebhookPayload } from '@specora/sdk';

app.post('/webhook', express.raw({ type: 'application/json' }), (req, res) => {
  const isValid = verifyWebhookSignature(
    req.body.toString(),
    req.headers['x-specora-signature'],
    req.headers['x-specora-timestamp'],
    process.env.WEBHOOK_SECRET,
  );

  if (!isValid) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const payload = parseWebhookPayload(req.body.toString());

  switch (payload.eventType) {
    case 'platform.budget_breach':
      // Handle budget breach
      break;
    case 'platform.invariant_failed':
      // Handle policy violation
      break;
    // ... other event types
  }

  res.status(200).json({ received: true });
});

import {
  SpecoraClient,
  FailClosedError,
  BudgetExceededError,
  AuthenticationError,
  ValidationError,
} from '@specora/sdk';

try {
  await client.checkPolicy({ ... });
} catch (error) {
  if (error instanceof FailClosedError) {
    // Network/server error in fail-closed mode
    console.log('Defaulting to blocked:', error.decision);
  } else if (error instanceof BudgetExceededError) {
    // Budget exceeded
    console.log('Budget exceeded:', error.usagePercent);
  } else if (error instanceof AuthenticationError) {
    // Invalid API key
  } else if (error instanceof ValidationError) {
    // Invalid request parameters
  }
}

// OK - production
new SpecoraClient({ baseUrl: 'https://api.specora.ai', ... });

// OK - local development
new SpecoraClient({ baseUrl: 'http://localhost:8765', ... });
new SpecoraClient({ baseUrl: 'http://127.0.0.1:8765', ... });

// THROWS ValidationError - plaintext HTTP to remote host
new SpecoraClient({ baseUrl: 'http://api.specora.ai', ... });

import { WebhookEventCache, handleWebhook } from '@specora/sdk';

const cache = new WebhookEventCache(); // in-memory LRU, 10k entries, 5-min TTL

app.post('/webhook', (req, res) => {
  const event = handleWebhook(body, signature, timestamp, secret, cache);
  if (!event) return res.status(401).end(); // invalid or replayed
  // process event...
});

const client = new SpecoraClient({
  // ...
  strictMode: true, // requires preAuthorize() before proxyExecute()
});