@declaw/sdk 1.0.3 → 1.0.4

package/CHANGELOG.md

@@ -5,6 +5,21 @@ All notable changes to the Declaw TypeScript / JavaScript SDK are documented in
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.0.4]
+
+### Changed
+
+- `InjectionAction` — dropped the `"sanitize"` value. The server
+  never implemented request-body sanitization for detected injections
+  (the classifier returns a whole-request verdict, not span offsets),
+  so the value was accepted client-side but silently behaved like
+  `log_only` at the edge proxy. Valid values are now `"block"` and
+  `"log_only"`. Default action changes from `"sanitize"` to
+  `"log_only"` so existing enforcement behaviour is preserved.
+  Callers passing `action: "sanitize"` will now raise at construction
+  time; migrate to `"log_only"` (same behaviour) or `"block"`
+  (hard-reject on detection).
+
 ## [1.0.3]
 
 ### Added

package/dist/index.cjs

@@ -506,7 +506,6 @@ var InjectionSensitivity = /* @__PURE__ */ ((InjectionSensitivity2) => {
 })(InjectionSensitivity || {});
 var InjectionAction = /* @__PURE__ */ ((InjectionAction2) => {
   InjectionAction2["Block"] = "block";
-  InjectionAction2["Sanitize"] = "sanitize";
   InjectionAction2["LogOnly"] = "log_only";
   return InjectionAction2;
 })(InjectionAction || {});
@@ -516,7 +515,7 @@ function createInjectionDefenseConfig(opts) {
   const config = {
     enabled: opts?.enabled ?? false,
     sensitivity: opts?.sensitivity ?? "medium" /* Medium */,
-    action: opts?.action ?? "sanitize" /* Sanitize */,
+    action: opts?.action ?? "log_only" /* LogOnly */,
     threshold: opts?.threshold ?? 0.8,
     domains: opts?.domains
   };
@@ -541,7 +540,7 @@ function parseInjectionDefenseConfig(data) {
   return {
     enabled: data.enabled ?? false,
     sensitivity: data.sensitivity ?? "medium" /* Medium */,
-    action: data.action ?? "sanitize" /* Sanitize */,
+    action: data.action ?? "log_only" /* LogOnly */,
     threshold: data.threshold ?? 0.8,
     domains: data.domains
   };