Struct ShieldClient 

pub struct ShieldClient { /* private fields */ }

Async HTTP client for highflame-shield.

Cheap to clone — all clones share the underlying connection pool and token cache via Arc.

Service key flow

Keys starting with hf_sk are automatically exchanged for a short-lived RS256 JWT via POST <token_url>. The JWT is cached and auto-refreshed 60 s before expiry. Concurrent callers share a single tokio::sync::Mutex; only one exchange is ever in-flight at a time.

Direct JWT flow

Any other api_key value is sent directly as Authorization: Bearer <key>, useful when you already hold a short-lived token.

Implementations

impl ShieldClient

pub fn new(options: ShieldClientOptions) -> Self

Create a new ShieldClient.

pub async fn account_id(&self) -> String

Account ID from the last token exchange, or the constructor override. Empty when using the direct-JWT flow or before the first exchange.

pub async fn project_id(&self) -> String

Project ID from the last token exchange, or the constructor override. Empty when using the direct-JWT flow or before the first exchange.

pub async fn get_auth_headers(&self) -> Result<HeaderMap, ShieldError>

Return auth headers, exchanging or refreshing the JWT as needed.

The tokio::sync::Mutex on the token cache is held across the await in [exchange_token] so that:

• Only one exchange is ever in-flight at a time.
• Concurrent callers that see an expired token block behind the mutex; once the first completes, the rest find a fresh token on the fast-path check and return immediately without re-exchanging.

Exposed publicly so callers can forward Shield credentials to their own HTTP clients (e.g. a reverse proxy).

pub async fn guard( &self, request: &ShieldRequest, ) -> Result<ShieldResponse, ShieldError>

Evaluate content against guard policies.

POST /v1/guard — full detect + Cedar evaluate.

pub async fn guard_prompt( &self, content: &str, mode: Option<&str>, session_id: Option<&str>, ) -> Result<ShieldResponse, ShieldError>

Shorthand: evaluate a user prompt.

Equivalent to [guard] with content_type: "prompt" and action: "process_prompt".

pub async fn guard_tool_call( &self, tool_name: &str, arguments: Option<HashMap<String, Value>>, mode: Option<&str>, session_id: Option<&str>, ) -> Result<ShieldResponse, ShieldError>

Shorthand: evaluate a tool call.

Equivalent to [guard] with content_type: "tool_call" and action: "call_tool".

pub async fn stream( &self, request: &ShieldRequest, ) -> Result<impl Stream<Item = Result<ShieldStreamEvent, ShieldError>>, ShieldError>

Evaluate content with SSE streaming.

POST /v1/guard/stream — returns a Stream of ShieldStreamEvents. The first Err in the stream terminates it.

pub async fn health(&self) -> Result<HealthResponse, ShieldError>

Get detailed service health.

GET /v1/health — returns detector statuses and evaluator state.

pub async fn list_detectors(&self) -> Result<ListDetectorsResponse, ShieldError>

List available detectors.

GET /v1/detectors — returns detector names, tiers, and health.

Trait Implementations

impl Clone for ShieldClient

fn clone(&self) -> ShieldClient

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.