> ## Documentation Index
> Fetch the complete documentation index at: https://docs.frostwolf.app/llms.txt
> Use this file to discover all available pages before exploring further.

# Language notes

> Where the TypeScript and Python SDKs differ, and why.

The two SDKs are the same product in two languages. They expose the same surface, return the same fields with the same meaning, and share defaults. Where they differ, the language demands it.

## Naming

`camelCase` in TypeScript and `snake_case` in Python. Nothing else differs.

| Concept | TypeScript | Python |
| - | - | - |
| Client | `new FrostWolfClient({ apiKey })` | `FrostWolfClient(api_key=...)` |
| Blocked check | `fw.guard.isBlocked(input)` | `fw.guard.is_blocked(input)` |
| Assert allowed | `fw.guard.assertAllowed(input)` | `fw.guard.assert_allowed(input)` |
| Validate tools | `fw.guard.validateToolCalls(calls, opts)` | `fw.guard.validate_tool_calls(calls, opts)` |
| Master | `fw.guard.protect(input, opts)` | `fw.guard.protect(input, opts)` |

## Async and sync

The TypeScript API is `async`, and a Cloak vault may return promises. The Python API is synchronous, as its transport is, and a vault is synchronous too. A decorated Python coroutine function gets an async wrapper, and the blocking detection call runs on a worker thread so it does not stall the event loop.

## Cryptography

Tokens and hashes are keyed HMAC-SHA-256 in both SDKs and produce **identical strings** for the same key, context, and value. TypeScript carries its own implementation so the SDK stays portable across Node, Workers, Deno, Bun, and browsers. It needs a secure random source only when it must generate a key: Node 19 or newer, or pass `guard.cloak.key`. Python uses the standard library.

Neither SDK encrypts vaulted values. Encryption at rest belongs to a vault that persists.

## Offsets

The control plane counts in UTF-16 code units, which is what a JavaScript string index is. TypeScript uses offsets as they are. Python indexes by code point, so it translates at the parse boundary. Entity offsets in Python are Python string positions, and a range that falls inside a surrogate pair is rejected rather than cut.

## Options

TypeScript passes plain objects. Python passes small frozen dataclasses (`CloakOptions`, `ProtectOptions`, `MaskStrategy`, and so on). Strategies given by name are strings in both.

## Transport

TypeScript takes a `fetch` override. Python takes a `transport` callable. Both default to the platform's standard HTTP.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.