@declaw/sdk 1.2.0 → 1.2.2

package/dist/index.d.cts

@@ -165,6 +165,22 @@ declare enum InjectionAction {
     Block = "block",
     LogOnly = "log_only"
 }
+/**
+ * Tier-2 Gemma LLM-judge config. Layered on top of the Tier-1 classifier: the
+ * judge adjudicates the classifier's flags with session context, removing false
+ * positives and catching indirect (cross-domain / multi-turn) injection.
+ * Omitted → classifier only.
+ */
+interface InjectionJudgeConfig {
+    enabled: boolean;
+    /** Run the judge on every egress, not just classifier flags (costlier). */
+    always?: boolean;
+    /**
+     * Natural-language description of what this agent may do; the judge uses it to
+     * tell task-aligned requests from injection-induced deviations.
+     */
+    policy?: string;
+}
 /** Configuration for injection defense. */
 interface InjectionDefenseConfig {
     enabled: boolean;
@@ -174,6 +190,15 @@ interface InjectionDefenseConfig {
     threshold: number;
     /** Optional domain allowlist; when undefined, applies to all domains. */
     domains?: string[];
+    /** Optional Tier-2 LLM judge. */
+    judge?: InjectionJudgeConfig;
+    /**
+     * Selects a predefined detection posture for the sandbox.
+     * Valid values: "strict", "balanced", "permissive", "agentic-tool",
+     * "data-egress-sensitive". Omit or set to undefined to use the server default.
+     * Serialized to JSON key "injection_mode".
+     */
+    injectionMode?: string;
 }
 /**
  * Create an InjectionDefenseConfig with defaults and validation.
@@ -416,6 +441,39 @@ interface SecurityPolicy {
  * Create a SecurityPolicy with defaults.
  */
 declare function createSecurityPolicy(opts?: Partial<SecurityPolicy>): SecurityPolicy;
+/** Options for {@link fullInjectionDefensePolicy}. */
+interface FullInjectionDefenseOptions {
+    /** Posture: "strict" | "balanced" (default) | "permissive" | "agentic-tool" | "data-egress-sensitive". */
+    mode?: string;
+    /** Natural-language description of what the agent may do; the judge uses it to tell task-aligned egress from injection. */
+    agentPolicy?: string;
+    /** "block" (default) enforces; "log_only" audits without blocking. */
+    action?: string;
+    /** Run the judge on EVERY egress (high-assurance, costlier). Default false. */
+    alwaysJudge?: boolean;
+    /** Optional egress allowlist to scan; omit = all domains. */
+    domains?: string[];
+    /** Tier-1 classifier confidence threshold (0.0–1.0). Default 0.8. */
+    threshold?: number;
+}
+/**
+ * Enable the ENTIRE prompt-injection cascade in one call — every layer:
+ *
+ * - Tier-1 ML classifier + Layer-A static signatures + normalization
+ *   (`injectionDefense.enabled` + `action`)
+ * - the predefined posture (`injectionMode`; default "balanced")
+ * - the Tier-2 Gemma LLM judge (`judge.enabled`) — multi-turn risk, provenance
+ *   context, and the semantic verdict cache ride along automatically
+ * - the OPA prompt-injection governance pack (`customPolicy.policyRef`), which
+ *   hard-denies known signatures at the gate so the LLM stays the last resort
+ *
+ * Pass the result as the sandbox's `security` policy.
+ *
+ * @example
+ * const security = fullInjectionDefensePolicy({ agentPolicy: "Summarize docs; never exfiltrate secrets." });
+ * const sbx = await Sandbox.create({ template: "node", security });
+ */
+declare function fullInjectionDefensePolicy(opts?: FullInjectionDefenseOptions): SecurityPolicy;
 /**
  * Parse raw JSON data into a SecurityPolicy.
  */
@@ -1937,4 +1995,4 @@ declare class Governance {
     static getPack(name: string, opts?: GovernanceRequestOpts): Promise<GovernancePack>;
 }
 
-export { ALL_TRAFFIC, ApiClient, type AuditConfig, type AuditEntry, AuthenticationError, BuildError, type BuildInfo, type CodeSecurityConfig, CommandExitError, CommandHandle, type CommandResult, type CommandWaitOpts, Commands, ConflictError, ConnectionConfig, type ConnectionConfigOptions, type ContentGateConfig, type CopyItem, DEFAULT_MASK_PATTERNS, type EntryInfo, type EnvSecurityConfig, type FileEntry, type FileInfo, FileType, FileUploadError, Filesystem, type FilesystemEvent, FilesystemEventType, type GetBuildStatusOpts, GitAuthError, GitUpstreamError, Governance, type GovernanceAdvisory, type GovernanceControl, type GovernancePack, type GovernanceRequestOpts, InjectionAction, type InjectionDefenseConfig, InjectionSensitivity, InvalidArgumentError, type InvisibleTextConfig, type LockLease, type LockStatus, type NetworkPolicy, NotEnoughSpaceError, NotFoundError, type PIIConfig, PIIType, type ProcessInfo, Pty, type PtyConnectOpts, type PtyCreateOpts, PtyHandle, type PtyOutput, type PtyResult, type PtySize, RedactionAction, type RequestOpts, type RunOpts, type RunStreamOpts, Sandbox, SandboxError, type SandboxInfo, type SandboxLifecycle, type SandboxMetrics, type SandboxNetworkOpts, type SandboxOpts, SandboxPaginator, type SandboxQuery, SandboxState, type SecureEnvVar, type SecurityPolicy, type Snapshot, type SnapshotInfo, SnapshotPaginator, type SnapshotSource, type Stderr, Stdio, StdioProcess, type StdioResult, type StdioStartOpts, type Stdout, Template, TemplateBase, type TemplateBuildOpts, type TemplateBuildStatus, TemplateError, TimeoutError, type ToxicityConfig, TransformDirection, type TransformationRule, type VolumeAttachMode, type VolumeAttachment, type VolumeCreateOpts, VolumeFiles, type VolumeInfo, VolumeLocks, type VolumeRemoveOpts, type VolumeRequestOpts, type VolumeWriteOpts, Volumes, WatchHandle, type WriteEntry, type WriteInfo, applyTransformation, codeSecurityConfigToJSON, contentGateConfigToJSON, createAuditConfig, createCodeSecurityConfig, createContentGateConfig, createEnvSecurityConfig, createInjectionDefenseConfig, createInvisibleTextConfig, createNetworkPolicy, createPIIConfig, createSecurityPolicy, createToxicityConfig, createTransformationRule, domainMatches, getSharedClient, invisibleTextConfigToJSON, isSensitive, networkPolicyToOpts, parseAuditConfig, parseAuditEntry, parseBuildInfo, parseCodeSecurityConfig, parseCommandResult, parseContentGateConfig, parseEntryInfo, parseEnvSecurityConfig, parseFileEntry, parseFileInfo, parseFilesystemEvent, parseGovernancePack, parseInjectionDefenseConfig, parseInvisibleTextConfig, parseLockLease, parseLockStatus, parseNetworkPolicy, parsePIIConfig, parseProcessInfo, parseSandboxInfo, parseSandboxLifecycle, parseSandboxMetrics, parseSecurityPolicy, parseSnapshot, parseSnapshotInfo, parseTemplateBuildStatus, parseToxicityConfig, parseVolumeInfo, parseWriteInfo, requiresTlsInterception, resetSharedClients, securityPolicyToJSON, toxicityConfigToJSON, validateNetworkEntry, volumeAttachmentToJSON };
+export { ALL_TRAFFIC, ApiClient, type AuditConfig, type AuditEntry, AuthenticationError, BuildError, type BuildInfo, type CodeSecurityConfig, CommandExitError, CommandHandle, type CommandResult, type CommandWaitOpts, Commands, ConflictError, ConnectionConfig, type ConnectionConfigOptions, type ContentGateConfig, type CopyItem, DEFAULT_MASK_PATTERNS, type EntryInfo, type EnvSecurityConfig, type FileEntry, type FileInfo, FileType, FileUploadError, Filesystem, type FilesystemEvent, FilesystemEventType, type FullInjectionDefenseOptions, type GetBuildStatusOpts, GitAuthError, GitUpstreamError, Governance, type GovernanceAdvisory, type GovernanceControl, type GovernancePack, type GovernanceRequestOpts, InjectionAction, type InjectionDefenseConfig, type InjectionJudgeConfig, InjectionSensitivity, InvalidArgumentError, type InvisibleTextConfig, type LockLease, type LockStatus, type NetworkPolicy, NotEnoughSpaceError, NotFoundError, type PIIConfig, PIIType, type ProcessInfo, Pty, type PtyConnectOpts, type PtyCreateOpts, PtyHandle, type PtyOutput, type PtyResult, type PtySize, RedactionAction, type RequestOpts, type RunOpts, type RunStreamOpts, Sandbox, SandboxError, type SandboxInfo, type SandboxLifecycle, type SandboxMetrics, type SandboxNetworkOpts, type SandboxOpts, SandboxPaginator, type SandboxQuery, SandboxState, type SecureEnvVar, type SecurityPolicy, type Snapshot, type SnapshotInfo, SnapshotPaginator, type SnapshotSource, type Stderr, Stdio, StdioProcess, type StdioResult, type StdioStartOpts, type Stdout, Template, TemplateBase, type TemplateBuildOpts, type TemplateBuildStatus, TemplateError, TimeoutError, type ToxicityConfig, TransformDirection, type TransformationRule, type VolumeAttachMode, type VolumeAttachment, type VolumeCreateOpts, VolumeFiles, type VolumeInfo, VolumeLocks, type VolumeRemoveOpts, type VolumeRequestOpts, type VolumeWriteOpts, Volumes, WatchHandle, type WriteEntry, type WriteInfo, applyTransformation, codeSecurityConfigToJSON, contentGateConfigToJSON, createAuditConfig, createCodeSecurityConfig, createContentGateConfig, createEnvSecurityConfig, createInjectionDefenseConfig, createInvisibleTextConfig, createNetworkPolicy, createPIIConfig, createSecurityPolicy, createToxicityConfig, createTransformationRule, domainMatches, fullInjectionDefensePolicy, getSharedClient, invisibleTextConfigToJSON, isSensitive, networkPolicyToOpts, parseAuditConfig, parseAuditEntry, parseBuildInfo, parseCodeSecurityConfig, parseCommandResult, parseContentGateConfig, parseEntryInfo, parseEnvSecurityConfig, parseFileEntry, parseFileInfo, parseFilesystemEvent, parseGovernancePack, parseInjectionDefenseConfig, parseInvisibleTextConfig, parseLockLease, parseLockStatus, parseNetworkPolicy, parsePIIConfig, parseProcessInfo, parseSandboxInfo, parseSandboxLifecycle, parseSandboxMetrics, parseSecurityPolicy, parseSnapshot, parseSnapshotInfo, parseTemplateBuildStatus, parseToxicityConfig, parseVolumeInfo, parseWriteInfo, requiresTlsInterception, resetSharedClients, securityPolicyToJSON, toxicityConfigToJSON, validateNetworkEntry, volumeAttachmentToJSON };

package/dist/index.d.ts

@@ -165,6 +165,22 @@ declare enum InjectionAction {
     Block = "block",
     LogOnly = "log_only"
 }
+/**
+ * Tier-2 Gemma LLM-judge config. Layered on top of the Tier-1 classifier: the
+ * judge adjudicates the classifier's flags with session context, removing false
+ * positives and catching indirect (cross-domain / multi-turn) injection.
+ * Omitted → classifier only.
+ */
+interface InjectionJudgeConfig {
+    enabled: boolean;
+    /** Run the judge on every egress, not just classifier flags (costlier). */
+    always?: boolean;
+    /**
+     * Natural-language description of what this agent may do; the judge uses it to
+     * tell task-aligned requests from injection-induced deviations.
+     */
+    policy?: string;
+}
 /** Configuration for injection defense. */
 interface InjectionDefenseConfig {
     enabled: boolean;
@@ -174,6 +190,15 @@ interface InjectionDefenseConfig {
     threshold: number;
     /** Optional domain allowlist; when undefined, applies to all domains. */
     domains?: string[];
+    /** Optional Tier-2 LLM judge. */
+    judge?: InjectionJudgeConfig;
+    /**
+     * Selects a predefined detection posture for the sandbox.
+     * Valid values: "strict", "balanced", "permissive", "agentic-tool",
+     * "data-egress-sensitive". Omit or set to undefined to use the server default.
+     * Serialized to JSON key "injection_mode".
+     */
+    injectionMode?: string;
 }
 /**
  * Create an InjectionDefenseConfig with defaults and validation.
@@ -416,6 +441,39 @@ interface SecurityPolicy {
  * Create a SecurityPolicy with defaults.
  */
 declare function createSecurityPolicy(opts?: Partial<SecurityPolicy>): SecurityPolicy;
+/** Options for {@link fullInjectionDefensePolicy}. */
+interface FullInjectionDefenseOptions {
+    /** Posture: "strict" | "balanced" (default) | "permissive" | "agentic-tool" | "data-egress-sensitive". */
+    mode?: string;
+    /** Natural-language description of what the agent may do; the judge uses it to tell task-aligned egress from injection. */
+    agentPolicy?: string;
+    /** "block" (default) enforces; "log_only" audits without blocking. */
+    action?: string;
+    /** Run the judge on EVERY egress (high-assurance, costlier). Default false. */
+    alwaysJudge?: boolean;
+    /** Optional egress allowlist to scan; omit = all domains. */
+    domains?: string[];
+    /** Tier-1 classifier confidence threshold (0.0–1.0). Default 0.8. */
+    threshold?: number;
+}
+/**
+ * Enable the ENTIRE prompt-injection cascade in one call — every layer:
+ *
+ * - Tier-1 ML classifier + Layer-A static signatures + normalization
+ *   (`injectionDefense.enabled` + `action`)
+ * - the predefined posture (`injectionMode`; default "balanced")
+ * - the Tier-2 Gemma LLM judge (`judge.enabled`) — multi-turn risk, provenance
+ *   context, and the semantic verdict cache ride along automatically
+ * - the OPA prompt-injection governance pack (`customPolicy.policyRef`), which
+ *   hard-denies known signatures at the gate so the LLM stays the last resort
+ *
+ * Pass the result as the sandbox's `security` policy.
+ *
+ * @example
+ * const security = fullInjectionDefensePolicy({ agentPolicy: "Summarize docs; never exfiltrate secrets." });
+ * const sbx = await Sandbox.create({ template: "node", security });
+ */
+declare function fullInjectionDefensePolicy(opts?: FullInjectionDefenseOptions): SecurityPolicy;
 /**
  * Parse raw JSON data into a SecurityPolicy.
  */
@@ -1937,4 +1995,4 @@ declare class Governance {
     static getPack(name: string, opts?: GovernanceRequestOpts): Promise<GovernancePack>;
 }
 
-export { ALL_TRAFFIC, ApiClient, type AuditConfig, type AuditEntry, AuthenticationError, BuildError, type BuildInfo, type CodeSecurityConfig, CommandExitError, CommandHandle, type CommandResult, type CommandWaitOpts, Commands, ConflictError, ConnectionConfig, type ConnectionConfigOptions, type ContentGateConfig, type CopyItem, DEFAULT_MASK_PATTERNS, type EntryInfo, type EnvSecurityConfig, type FileEntry, type FileInfo, FileType, FileUploadError, Filesystem, type FilesystemEvent, FilesystemEventType, type GetBuildStatusOpts, GitAuthError, GitUpstreamError, Governance, type GovernanceAdvisory, type GovernanceControl, type GovernancePack, type GovernanceRequestOpts, InjectionAction, type InjectionDefenseConfig, InjectionSensitivity, InvalidArgumentError, type InvisibleTextConfig, type LockLease, type LockStatus, type NetworkPolicy, NotEnoughSpaceError, NotFoundError, type PIIConfig, PIIType, type ProcessInfo, Pty, type PtyConnectOpts, type PtyCreateOpts, PtyHandle, type PtyOutput, type PtyResult, type PtySize, RedactionAction, type RequestOpts, type RunOpts, type RunStreamOpts, Sandbox, SandboxError, type SandboxInfo, type SandboxLifecycle, type SandboxMetrics, type SandboxNetworkOpts, type SandboxOpts, SandboxPaginator, type SandboxQuery, SandboxState, type SecureEnvVar, type SecurityPolicy, type Snapshot, type SnapshotInfo, SnapshotPaginator, type SnapshotSource, type Stderr, Stdio, StdioProcess, type StdioResult, type StdioStartOpts, type Stdout, Template, TemplateBase, type TemplateBuildOpts, type TemplateBuildStatus, TemplateError, TimeoutError, type ToxicityConfig, TransformDirection, type TransformationRule, type VolumeAttachMode, type VolumeAttachment, type VolumeCreateOpts, VolumeFiles, type VolumeInfo, VolumeLocks, type VolumeRemoveOpts, type VolumeRequestOpts, type VolumeWriteOpts, Volumes, WatchHandle, type WriteEntry, type WriteInfo, applyTransformation, codeSecurityConfigToJSON, contentGateConfigToJSON, createAuditConfig, createCodeSecurityConfig, createContentGateConfig, createEnvSecurityConfig, createInjectionDefenseConfig, createInvisibleTextConfig, createNetworkPolicy, createPIIConfig, createSecurityPolicy, createToxicityConfig, createTransformationRule, domainMatches, getSharedClient, invisibleTextConfigToJSON, isSensitive, networkPolicyToOpts, parseAuditConfig, parseAuditEntry, parseBuildInfo, parseCodeSecurityConfig, parseCommandResult, parseContentGateConfig, parseEntryInfo, parseEnvSecurityConfig, parseFileEntry, parseFileInfo, parseFilesystemEvent, parseGovernancePack, parseInjectionDefenseConfig, parseInvisibleTextConfig, parseLockLease, parseLockStatus, parseNetworkPolicy, parsePIIConfig, parseProcessInfo, parseSandboxInfo, parseSandboxLifecycle, parseSandboxMetrics, parseSecurityPolicy, parseSnapshot, parseSnapshotInfo, parseTemplateBuildStatus, parseToxicityConfig, parseVolumeInfo, parseWriteInfo, requiresTlsInterception, resetSharedClients, securityPolicyToJSON, toxicityConfigToJSON, validateNetworkEntry, volumeAttachmentToJSON };
+export { ALL_TRAFFIC, ApiClient, type AuditConfig, type AuditEntry, AuthenticationError, BuildError, type BuildInfo, type CodeSecurityConfig, CommandExitError, CommandHandle, type CommandResult, type CommandWaitOpts, Commands, ConflictError, ConnectionConfig, type ConnectionConfigOptions, type ContentGateConfig, type CopyItem, DEFAULT_MASK_PATTERNS, type EntryInfo, type EnvSecurityConfig, type FileEntry, type FileInfo, FileType, FileUploadError, Filesystem, type FilesystemEvent, FilesystemEventType, type FullInjectionDefenseOptions, type GetBuildStatusOpts, GitAuthError, GitUpstreamError, Governance, type GovernanceAdvisory, type GovernanceControl, type GovernancePack, type GovernanceRequestOpts, InjectionAction, type InjectionDefenseConfig, type InjectionJudgeConfig, InjectionSensitivity, InvalidArgumentError, type InvisibleTextConfig, type LockLease, type LockStatus, type NetworkPolicy, NotEnoughSpaceError, NotFoundError, type PIIConfig, PIIType, type ProcessInfo, Pty, type PtyConnectOpts, type PtyCreateOpts, PtyHandle, type PtyOutput, type PtyResult, type PtySize, RedactionAction, type RequestOpts, type RunOpts, type RunStreamOpts, Sandbox, SandboxError, type SandboxInfo, type SandboxLifecycle, type SandboxMetrics, type SandboxNetworkOpts, type SandboxOpts, SandboxPaginator, type SandboxQuery, SandboxState, type SecureEnvVar, type SecurityPolicy, type Snapshot, type SnapshotInfo, SnapshotPaginator, type SnapshotSource, type Stderr, Stdio, StdioProcess, type StdioResult, type StdioStartOpts, type Stdout, Template, TemplateBase, type TemplateBuildOpts, type TemplateBuildStatus, TemplateError, TimeoutError, type ToxicityConfig, TransformDirection, type TransformationRule, type VolumeAttachMode, type VolumeAttachment, type VolumeCreateOpts, VolumeFiles, type VolumeInfo, VolumeLocks, type VolumeRemoveOpts, type VolumeRequestOpts, type VolumeWriteOpts, Volumes, WatchHandle, type WriteEntry, type WriteInfo, applyTransformation, codeSecurityConfigToJSON, contentGateConfigToJSON, createAuditConfig, createCodeSecurityConfig, createContentGateConfig, createEnvSecurityConfig, createInjectionDefenseConfig, createInvisibleTextConfig, createNetworkPolicy, createPIIConfig, createSecurityPolicy, createToxicityConfig, createTransformationRule, domainMatches, fullInjectionDefensePolicy, getSharedClient, invisibleTextConfigToJSON, isSensitive, networkPolicyToOpts, parseAuditConfig, parseAuditEntry, parseBuildInfo, parseCodeSecurityConfig, parseCommandResult, parseContentGateConfig, parseEntryInfo, parseEnvSecurityConfig, parseFileEntry, parseFileInfo, parseFilesystemEvent, parseGovernancePack, parseInjectionDefenseConfig, parseInvisibleTextConfig, parseLockLease, parseLockStatus, parseNetworkPolicy, parsePIIConfig, parseProcessInfo, parseSandboxInfo, parseSandboxLifecycle, parseSandboxMetrics, parseSecurityPolicy, parseSnapshot, parseSnapshotInfo, parseTemplateBuildStatus, parseToxicityConfig, parseVolumeInfo, parseWriteInfo, requiresTlsInterception, resetSharedClients, securityPolicyToJSON, toxicityConfigToJSON, validateNetworkEntry, volumeAttachmentToJSON };

package/dist/index.js

@@ -123,6 +123,8 @@ var CommandExitError = class extends SandboxError {
 
 // src/api/client.ts
 var _dispatcherPromise;
+var _resolvedDispatcher;
+var _dispatcherResolved = false;
 function getDispatcher() {
   if (_dispatcherPromise) return _dispatcherPromise;
   _dispatcherPromise = (async () => {
@@ -135,7 +137,7 @@ function getDispatcher() {
       }
       const undici = await import("undici");
       const connOverride = parseInt(process.env.DECLAW_SDK_CONNECTIONS || "", 10);
-      const connections = Number.isFinite(connOverride) && connOverride > 0 ? connOverride : 64;
+      const connections = Number.isFinite(connOverride) && connOverride > 0 ? connOverride : 512;
       const streamsOverride = parseInt(process.env.DECLAW_SDK_MAX_CONCURRENT_STREAMS || "", 10);
       const maxConcurrentStreams = Number.isFinite(streamsOverride) && streamsOverride > 0 ? streamsOverride : 1e3;
       return new undici.Agent({
@@ -147,7 +149,12 @@ function getDispatcher() {
         maxConcurrentStreams,
         keepAliveTimeout: 3e4,
         keepAliveMaxTimeout: 6e4,
-        pipelining: 1,
+        // NOTE: do NOT set `pipelining` here. undici applies it to H2 sessions
+        // too, where `pipelining: 1` caps each connection to ONE in-flight
+        // stream — silently defeating the H2 multiplexing that allowH2 enables.
+        // Omitted, H2 sessions default to unlimited concurrent streams (capped
+        // by maxConcurrentStreams) and H1.1 fallback defaults to 1 (safe, no
+        // head-of-line risk on non-idempotent POSTs).
         allowH2: true,
         connect: { keepAlive: true, keepAliveInitialDelay: 5e3 }
       });
@@ -155,8 +162,13 @@ function getDispatcher() {
       return void 0;
     }
   })();
+  void _dispatcherPromise.then((d) => {
+    _resolvedDispatcher = d;
+    _dispatcherResolved = true;
+  });
   return _dispatcherPromise;
 }
+void getDispatcher();
 var STATUS_ERROR_MAP = {
   400: InvalidArgumentError,
   401: AuthenticationError,
@@ -176,7 +188,7 @@ var ApiClient = class {
   constructor(config, opts) {
     this.config = config ?? new ConnectionConfig();
     this.maxRetries = opts?.maxRetries ?? 3;
-    this.retryDelay = opts?.retryDelay ?? 0.5;
+    this.retryDelay = opts?.retryDelay ?? 0.1;
     this.abortController = new AbortController();
   }
   /** Send a GET request and return parsed JSON. */
@@ -270,7 +282,7 @@ var ApiClient = class {
           signals.push(AbortSignal.timeout(timeoutMs));
         }
         const signal = signals.length === 1 ? signals[0] : AbortSignal.any(signals);
-        const dispatcher = await getDispatcher();
+        const dispatcher = _dispatcherResolved ? _resolvedDispatcher : await getDispatcher();
         const fetchOpts = {
           method,
           headers,
@@ -496,7 +508,9 @@ function createInjectionDefenseConfig(opts) {
     sensitivity: opts?.sensitivity ?? "medium" /* Medium */,
     action: opts?.action ?? "log_only" /* LogOnly */,
     threshold: opts?.threshold ?? 0.8,
-    domains: opts?.domains
+    domains: opts?.domains,
+    judge: opts?.judge,
+    injectionMode: opts?.injectionMode
   };
   if (!VALID_SENSITIVITIES.has(config.sensitivity)) {
     throw new InvalidArgumentError(
@@ -521,7 +535,9 @@ function parseInjectionDefenseConfig(data) {
     sensitivity: data.sensitivity ?? "medium" /* Medium */,
     action: data.action ?? "log_only" /* LogOnly */,
     threshold: data.threshold ?? 0.8,
-    domains: data.domains
+    domains: data.domains,
+    judge: data.judge ? { enabled: data.judge.enabled ?? false, always: data.judge.always, policy: data.judge.policy } : void 0,
+    injectionMode: data.injection_mode ?? data.injectionMode
   };
 }
 
@@ -824,6 +840,15 @@ function invisibleTextConfigToJSON(config) {
 }
 
 // src/security/customPolicy.ts
+function createCustomPolicyConfig(opts) {
+  return {
+    enabled: opts?.enabled ?? false,
+    inlineRego: opts?.inlineRego,
+    inlineModules: opts?.inlineModules,
+    policyRef: opts?.policyRef,
+    defaultDeny: opts?.defaultDeny ?? false
+  };
+}
 function parseCustomPolicyConfig(data) {
   return {
     enabled: data.enabled ?? false,
@@ -882,6 +907,23 @@ function createSecurityPolicy(opts) {
     customPolicy: opts?.customPolicy
   };
 }
+function fullInjectionDefensePolicy(opts) {
+  return createSecurityPolicy({
+    injectionDefense: createInjectionDefenseConfig({
+      enabled: true,
+      action: opts?.action ?? "block",
+      threshold: opts?.threshold ?? 0.8,
+      domains: opts?.domains,
+      injectionMode: opts?.mode ?? "balanced",
+      judge: { enabled: true, always: opts?.alwaysJudge ?? false, policy: opts?.agentPolicy ?? "" }
+    }),
+    customPolicy: createCustomPolicyConfig({
+      enabled: true,
+      policyRef: "prompt-injection@v2",
+      defaultDeny: false
+    })
+  });
+}
 function parseSecurityPolicy(data) {
   const injDef = data.injection_defense ?? data.injectionDefense;
   const auditData = data.audit;
@@ -921,6 +963,15 @@ function securityPolicyToJSON(policy) {
   if (injDefConfig.domains !== void 0) {
     injDef.domains = injDefConfig.domains;
   }
+  if (injDefConfig.injectionMode !== void 0) {
+    injDef.injection_mode = injDefConfig.injectionMode;
+  }
+  if (injDefConfig.judge !== void 0) {
+    const j = { enabled: injDefConfig.judge.enabled };
+    if (injDefConfig.judge.always) j.always = true;
+    if (injDefConfig.judge.policy) j.policy = injDefConfig.judge.policy;
+    injDef.judge = j;
+  }
   const auditConfig = typeof policy.audit === "boolean" ? createAuditConfig({ enabled: policy.audit }) : policy.audit;
   const audit = {
     enabled: auditConfig.enabled
@@ -3403,6 +3454,7 @@ export {
   createToxicityConfig,
   createTransformationRule,
   domainMatches,
+  fullInjectionDefensePolicy,
   getSharedClient,
   invisibleTextConfigToJSON,
   isSensitive,