All of the above — and this package — are ESM-only ("type": "module"). Your consuming project needs "type": "module" in package.json and "module"/"moduleResolution" set to "node16" (or "nodenext"/"bundler") in tsconfig.json. In a default CommonJS TypeScript project the quickstarts do not type-check (TS1479, plus a TS2345 #private mismatch on the peer SDK); load them with a dynamic import() instead.

What's here

Module	Exports
`guardrail-client`	`GuardrailClient` — HTTP client for firewall-check / trace-log / score-output. `checkInput` fails CLOSED (throws once retries/circuit give up) so the calling wrapper can honour `blockOnViolation`; `logTrace` / `scoreOutput` fail open. Corrected 2026-07-29 — this row previously said "all fail-open", which stopped being true on 2026-05-28.
`message-text`	`collapseMessageText()`, `collapsePromptText()` — canonical message→scannable-text collapse for the framework wrappers. Scans every role (tool results and retrieved documents included) and never truncates.
`cost`	`estimateCostDetailed()` / `isModelPriced()` / `estimateCost()`. A hand-curated OpenAI / Anthropic / Gemini table plus `pricing-catalog.generated.ts` — 2,200+ model ids generated from `packages/core/src/cost/model-pricing.ts` + the LiteLLM overlay by `scripts/gen-wrapper-pricing.mjs`. An unpriced model reports `costUsd: null` / `priced: false`, never an invented number. Corrected 2026-07-30 — `estimateCost("gpt-5", …)` and `estimateCost("totally-unknown-model", …)` both silently returned the same blended `0.0105`.
`trace-id`	`newTraceId()`, `injectTraceHeader()`, `isValidTraceId()` — per-request UUID for log correlation
`byok`	`resolveApiKey()` — supports `string \| () => string \| Promise<string>`
`idempotency`	`resolveIdempotencyKey()` — auto-generated, literal, or function-supplied
`retry`	`withRetry()` — exponential backoff + per-base-URL circuit breaker
`eval-on-response`	`runPostResponseEval()` — post-completion output scoring
`types`	`EvalGuardConfig`, `EvalGuardViolationError`, `EvalGuardOutputViolationError`, etc.

Why a separate package

The v1.0 wrappers (@evalguard/openai, @evalguard/anthropic) each shipped inline copies of GuardrailClient and cost.ts. That worked for two providers but didn't scale — adding Gemini meant a third copy, and adding features (BYOK, idempotency, retry+circuit-breaker, eval-on-response) meant 3× the surface area to keep in sync.

This package consolidates the shared foundation. Wrappers import from it via workspace dep during development and npm dep once published.