@axlsdk/axl 0.20.1 → 0.21.1

package/dist/index.d.cts

@@ -2127,6 +2127,8 @@ type OpenAICompatibleOptions = {
     /** API key or a per-request resolver (expiring tokens). See {@link ApiKeySource}. */
     apiKey?: ApiKeySource;
     baseUrl?: string;
+    /** Permit a non-loopback HTTP endpoint for this provider instance. */
+    dangerouslyAllowInsecureHttp?: boolean;
     /** Override the profile's auth header shape (e.g. Azure Entra bearer tokens). */
     authHeader?: AuthHeader;
     rateLimit?: RateLimitConfig;
@@ -2223,6 +2225,49 @@ type OpenAIModelResponse = {
     usage?: OpenAIUsage;
 };
 
+/**
+ * MCP (Model Context Protocol) types for tool discovery and execution.
+ */
+/** A tool definition discovered from an MCP server. */
+type McpToolDefinition = {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+};
+/** Configuration for connecting to an MCP server. */
+type McpServerConfig = {
+    name: string;
+    /** Command to spawn for stdio transport (e.g. "npx -y @modelcontextprotocol/server-fs") */
+    command?: string;
+    /** Arguments for the command */
+    args?: string[];
+    /** HTTP/SSE endpoint URI for HTTP transport */
+    uri?: string;
+    /** Allow this MCP server to use non-loopback HTTP. Prefer HTTPS. */
+    dangerouslyAllowInsecureHttp?: boolean;
+    /** Environment variables to pass to the spawned process */
+    env?: Record<string, string>;
+};
+/** Result from calling an MCP tool. */
+type McpToolResult = {
+    content: Array<{
+        type: 'text';
+        text: string;
+    } | {
+        type: 'image';
+        data: string;
+        mimeType: string;
+    }>;
+    isError?: boolean;
+};
+/** A connected MCP server with its discovered tools. */
+type McpServer = {
+    name: string;
+    tools: McpToolDefinition[];
+    callTool(toolName: string, args: unknown): Promise<McpToolResult>;
+    close(): Promise<void>;
+};
+
 /** A pending human decision awaiting resolution. */
 type PendingDecision = {
     executionId: string;
@@ -2470,6 +2515,11 @@ type ProviderConfig = {
      *  the common case. See {@link ApiKeySource}. */
     apiKey?: ApiKeySource;
     baseUrl?: string;
+    /**
+     * Allow a non-loopback HTTP endpoint for this provider. HTTP can expose
+     * prompts and credentials in transit; prefer HTTPS whenever possible.
+     */
+    dangerouslyAllowInsecureHttp?: boolean;
     /** OpenAI-compatible presets only: override the profile auth header shape. */
     authHeader?: AuthHeader;
     /**
@@ -2482,13 +2532,6 @@ type ProviderConfig = {
      */
     rateLimit?: RateLimitConfig;
 };
-/** MCP server configuration */
-type McpServerConfig$1 = {
-    name: string;
-    command?: string;
-    uri?: string;
-    env?: Record<string, string>;
-};
 /** Trace configuration */
 type TraceConfig = {
     enabled?: boolean;
@@ -2600,7 +2643,7 @@ type AxlConfig = {
     defaultProvider?: string;
     defaultModel?: string;
     mcp?: {
-        servers?: McpServerConfig$1[];
+        servers?: McpServerConfig[];
     };
     state?: StateConfig;
     trace?: TraceConfig;
@@ -2693,47 +2736,6 @@ declare class ProviderRegistry {
     clearFactories(): void;
 }
 
-/**
- * MCP (Model Context Protocol) types for tool discovery and execution.
- */
-/** A tool definition discovered from an MCP server. */
-type McpToolDefinition = {
-    name: string;
-    description: string;
-    inputSchema: unknown;
-};
-/** Configuration for connecting to an MCP server. */
-type McpServerConfig = {
-    name: string;
-    /** Command to spawn for stdio transport (e.g. "npx -y @modelcontextprotocol/server-fs") */
-    command?: string;
-    /** Arguments for the command */
-    args?: string[];
-    /** HTTP/SSE endpoint URI for HTTP transport */
-    uri?: string;
-    /** Environment variables to pass to the spawned process */
-    env?: Record<string, string>;
-};
-/** Result from calling an MCP tool. */
-type McpToolResult = {
-    content: Array<{
-        type: 'text';
-        text: string;
-    } | {
-        type: 'image';
-        data: string;
-        mimeType: string;
-    }>;
-    isError?: boolean;
-};
-/** A connected MCP server with its discovered tools. */
-type McpServer = {
-    name: string;
-    tools: McpToolDefinition[];
-    callTool(toolName: string, args: unknown): Promise<McpToolResult>;
-    close(): Promise<void>;
-};
-
 /**
  * Manages connections to multiple MCP servers.
  * Discovers tools, filters by agent config, and routes tool calls.
@@ -4434,7 +4436,14 @@ declare function registerConditions(conditions: string[]): Promise<void>;
  *    attempt-N text never leaks into attempt-N+1).
  *  - `ask_end` clears the per-ask accumulator (memory hygiene).
  *
- * Example (browser, consuming Studio's WS firehose):
+ * SECURITY: "browser-safe" here means this module has no Node runtime
+ * dependency. It does not redact or authorize the raw `AxlEvent` source.
+ * Prompts, system messages, tool data, and traces should remain on the trusted
+ * backend; public applications should relay an output-only DTO produced from a
+ * server-side curated view. Use this helper only when the browser is authorized
+ * to receive the underlying event stream.
+ *
+ * Example (trusted operator browser, consuming an authorized Studio WS firehose):
  *
  * ```ts
  * import { stringStreamFromEvents } from '@axlsdk/axl';
@@ -4813,6 +4822,7 @@ declare class OpenAIProvider extends OpenAICompatibleProvider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     protected computeCost(model: string, usage: ProviderResponse['usage'], _reportedCost: number | undefined, context?: DirectOpenAIPricingContext): number | undefined;
@@ -4835,6 +4845,7 @@ declare class OpenAIResponsesProvider implements Provider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     /** Resolve the API key for one request (supports an expiring-token callback). */
@@ -4885,6 +4896,7 @@ declare class AnthropicProvider implements Provider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     /** Resolve the API key for one request (supports an expiring-token callback). */
@@ -4956,6 +4968,7 @@ declare class GeminiProvider implements Provider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     /** Resolve the API key for one request (supports an expiring-token callback). */
@@ -5509,6 +5522,7 @@ declare class OpenAIEmbedder implements Embedder {
         apiKey?: string;
         model?: string;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         dimensions?: number;
     });
     embed(texts: string[], signal?: AbortSignal): Promise<EmbedResult>;

package/dist/index.d.ts

@@ -2127,6 +2127,8 @@ type OpenAICompatibleOptions = {
     /** API key or a per-request resolver (expiring tokens). See {@link ApiKeySource}. */
     apiKey?: ApiKeySource;
     baseUrl?: string;
+    /** Permit a non-loopback HTTP endpoint for this provider instance. */
+    dangerouslyAllowInsecureHttp?: boolean;
     /** Override the profile's auth header shape (e.g. Azure Entra bearer tokens). */
     authHeader?: AuthHeader;
     rateLimit?: RateLimitConfig;
@@ -2223,6 +2225,49 @@ type OpenAIModelResponse = {
     usage?: OpenAIUsage;
 };
 
+/**
+ * MCP (Model Context Protocol) types for tool discovery and execution.
+ */
+/** A tool definition discovered from an MCP server. */
+type McpToolDefinition = {
+    name: string;
+    description: string;
+    inputSchema: unknown;
+};
+/** Configuration for connecting to an MCP server. */
+type McpServerConfig = {
+    name: string;
+    /** Command to spawn for stdio transport (e.g. "npx -y @modelcontextprotocol/server-fs") */
+    command?: string;
+    /** Arguments for the command */
+    args?: string[];
+    /** HTTP/SSE endpoint URI for HTTP transport */
+    uri?: string;
+    /** Allow this MCP server to use non-loopback HTTP. Prefer HTTPS. */
+    dangerouslyAllowInsecureHttp?: boolean;
+    /** Environment variables to pass to the spawned process */
+    env?: Record<string, string>;
+};
+/** Result from calling an MCP tool. */
+type McpToolResult = {
+    content: Array<{
+        type: 'text';
+        text: string;
+    } | {
+        type: 'image';
+        data: string;
+        mimeType: string;
+    }>;
+    isError?: boolean;
+};
+/** A connected MCP server with its discovered tools. */
+type McpServer = {
+    name: string;
+    tools: McpToolDefinition[];
+    callTool(toolName: string, args: unknown): Promise<McpToolResult>;
+    close(): Promise<void>;
+};
+
 /** A pending human decision awaiting resolution. */
 type PendingDecision = {
     executionId: string;
@@ -2470,6 +2515,11 @@ type ProviderConfig = {
      *  the common case. See {@link ApiKeySource}. */
     apiKey?: ApiKeySource;
     baseUrl?: string;
+    /**
+     * Allow a non-loopback HTTP endpoint for this provider. HTTP can expose
+     * prompts and credentials in transit; prefer HTTPS whenever possible.
+     */
+    dangerouslyAllowInsecureHttp?: boolean;
     /** OpenAI-compatible presets only: override the profile auth header shape. */
     authHeader?: AuthHeader;
     /**
@@ -2482,13 +2532,6 @@ type ProviderConfig = {
      */
     rateLimit?: RateLimitConfig;
 };
-/** MCP server configuration */
-type McpServerConfig$1 = {
-    name: string;
-    command?: string;
-    uri?: string;
-    env?: Record<string, string>;
-};
 /** Trace configuration */
 type TraceConfig = {
     enabled?: boolean;
@@ -2600,7 +2643,7 @@ type AxlConfig = {
     defaultProvider?: string;
     defaultModel?: string;
     mcp?: {
-        servers?: McpServerConfig$1[];
+        servers?: McpServerConfig[];
     };
     state?: StateConfig;
     trace?: TraceConfig;
@@ -2693,47 +2736,6 @@ declare class ProviderRegistry {
     clearFactories(): void;
 }
 
-/**
- * MCP (Model Context Protocol) types for tool discovery and execution.
- */
-/** A tool definition discovered from an MCP server. */
-type McpToolDefinition = {
-    name: string;
-    description: string;
-    inputSchema: unknown;
-};
-/** Configuration for connecting to an MCP server. */
-type McpServerConfig = {
-    name: string;
-    /** Command to spawn for stdio transport (e.g. "npx -y @modelcontextprotocol/server-fs") */
-    command?: string;
-    /** Arguments for the command */
-    args?: string[];
-    /** HTTP/SSE endpoint URI for HTTP transport */
-    uri?: string;
-    /** Environment variables to pass to the spawned process */
-    env?: Record<string, string>;
-};
-/** Result from calling an MCP tool. */
-type McpToolResult = {
-    content: Array<{
-        type: 'text';
-        text: string;
-    } | {
-        type: 'image';
-        data: string;
-        mimeType: string;
-    }>;
-    isError?: boolean;
-};
-/** A connected MCP server with its discovered tools. */
-type McpServer = {
-    name: string;
-    tools: McpToolDefinition[];
-    callTool(toolName: string, args: unknown): Promise<McpToolResult>;
-    close(): Promise<void>;
-};
-
 /**
  * Manages connections to multiple MCP servers.
  * Discovers tools, filters by agent config, and routes tool calls.
@@ -4434,7 +4436,14 @@ declare function registerConditions(conditions: string[]): Promise<void>;
  *    attempt-N text never leaks into attempt-N+1).
  *  - `ask_end` clears the per-ask accumulator (memory hygiene).
  *
- * Example (browser, consuming Studio's WS firehose):
+ * SECURITY: "browser-safe" here means this module has no Node runtime
+ * dependency. It does not redact or authorize the raw `AxlEvent` source.
+ * Prompts, system messages, tool data, and traces should remain on the trusted
+ * backend; public applications should relay an output-only DTO produced from a
+ * server-side curated view. Use this helper only when the browser is authorized
+ * to receive the underlying event stream.
+ *
+ * Example (trusted operator browser, consuming an authorized Studio WS firehose):
  *
  * ```ts
  * import { stringStreamFromEvents } from '@axlsdk/axl';
@@ -4813,6 +4822,7 @@ declare class OpenAIProvider extends OpenAICompatibleProvider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     protected computeCost(model: string, usage: ProviderResponse['usage'], _reportedCost: number | undefined, context?: DirectOpenAIPricingContext): number | undefined;
@@ -4835,6 +4845,7 @@ declare class OpenAIResponsesProvider implements Provider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     /** Resolve the API key for one request (supports an expiring-token callback). */
@@ -4885,6 +4896,7 @@ declare class AnthropicProvider implements Provider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     /** Resolve the API key for one request (supports an expiring-token callback). */
@@ -4956,6 +4968,7 @@ declare class GeminiProvider implements Provider {
     constructor(options?: {
         apiKey?: ApiKeySource;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         rateLimit?: RateLimitConfig;
     });
     /** Resolve the API key for one request (supports an expiring-token callback). */
@@ -5509,6 +5522,7 @@ declare class OpenAIEmbedder implements Embedder {
         apiKey?: string;
         model?: string;
         baseUrl?: string;
+        dangerouslyAllowInsecureHttp?: boolean;
         dimensions?: number;
     });
     embed(texts: string[], signal?: AbortSignal): Promise<EmbedResult>;