@declaw/sdk 1.2.1 → 1.2.2

package/CHANGELOG.md

@@ -5,6 +5,17 @@ All notable changes to the Declaw TypeScript / JavaScript SDK are documented in
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [1.2.2]
+
+_Higher default connection ceiling._
+
+### Performance
+
+- Raised the default connection-pool ceiling from 64 to 512 so a
+  high-concurrency workload from a single client process is no longer queued
+  behind the connection cap. Still overridable via `DECLAW_SDK_CONNECTIONS`.
+  No public API change.
+
 ## [1.2.1]
 
 _HTTP/2 burst performance._

package/dist/index.cjs

@@ -87,6 +87,7 @@ __export(index_exports, {
   createToxicityConfig: () => createToxicityConfig,
   createTransformationRule: () => createTransformationRule,
   domainMatches: () => domainMatches,
+  fullInjectionDefensePolicy: () => fullInjectionDefensePolicy,
   getSharedClient: () => getSharedClient,
   invisibleTextConfigToJSON: () => invisibleTextConfigToJSON,
   isSensitive: () => isSensitive,
@@ -268,7 +269,7 @@ function getDispatcher() {
       }
       const undici = await import("undici");
       const connOverride = parseInt(process.env.DECLAW_SDK_CONNECTIONS || "", 10);
-      const connections = Number.isFinite(connOverride) && connOverride > 0 ? connOverride : 64;
+      const connections = Number.isFinite(connOverride) && connOverride > 0 ? connOverride : 512;
       const streamsOverride = parseInt(process.env.DECLAW_SDK_MAX_CONCURRENT_STREAMS || "", 10);
       const maxConcurrentStreams = Number.isFinite(streamsOverride) && streamsOverride > 0 ? streamsOverride : 1e3;
       return new undici.Agent({
@@ -285,9 +286,7 @@ function getDispatcher() {
         // stream — silently defeating the H2 multiplexing that allowH2 enables.
         // Omitted, H2 sessions default to unlimited concurrent streams (capped
         // by maxConcurrentStreams) and H1.1 fallback defaults to 1 (safe, no
-        // head-of-line risk on non-idempotent POSTs). This is the single
-        // biggest burst-latency lever: with pipelining:1 a 100-concurrent burst
-        // queued ~36 requests behind the `connections` cap.
+        // head-of-line risk on non-idempotent POSTs).
         allowH2: true,
         connect: { keepAlive: true, keepAliveInitialDelay: 5e3 }
       });
@@ -641,7 +640,9 @@ function createInjectionDefenseConfig(opts) {
     sensitivity: opts?.sensitivity ?? "medium" /* Medium */,
     action: opts?.action ?? "log_only" /* LogOnly */,
     threshold: opts?.threshold ?? 0.8,
-    domains: opts?.domains
+    domains: opts?.domains,
+    judge: opts?.judge,
+    injectionMode: opts?.injectionMode
   };
   if (!VALID_SENSITIVITIES.has(config.sensitivity)) {
     throw new InvalidArgumentError(
@@ -666,7 +667,9 @@ function parseInjectionDefenseConfig(data) {
     sensitivity: data.sensitivity ?? "medium" /* Medium */,
     action: data.action ?? "log_only" /* LogOnly */,
     threshold: data.threshold ?? 0.8,
-    domains: data.domains
+    domains: data.domains,
+    judge: data.judge ? { enabled: data.judge.enabled ?? false, always: data.judge.always, policy: data.judge.policy } : void 0,
+    injectionMode: data.injection_mode ?? data.injectionMode
   };
 }
 
@@ -969,6 +972,15 @@ function invisibleTextConfigToJSON(config) {
 }
 
 // src/security/customPolicy.ts
+function createCustomPolicyConfig(opts) {
+  return {
+    enabled: opts?.enabled ?? false,
+    inlineRego: opts?.inlineRego,
+    inlineModules: opts?.inlineModules,
+    policyRef: opts?.policyRef,
+    defaultDeny: opts?.defaultDeny ?? false
+  };
+}
 function parseCustomPolicyConfig(data) {
   return {
     enabled: data.enabled ?? false,
@@ -1027,6 +1039,23 @@ function createSecurityPolicy(opts) {
     customPolicy: opts?.customPolicy
   };
 }
+function fullInjectionDefensePolicy(opts) {
+  return createSecurityPolicy({
+    injectionDefense: createInjectionDefenseConfig({
+      enabled: true,
+      action: opts?.action ?? "block",
+      threshold: opts?.threshold ?? 0.8,
+      domains: opts?.domains,
+      injectionMode: opts?.mode ?? "balanced",
+      judge: { enabled: true, always: opts?.alwaysJudge ?? false, policy: opts?.agentPolicy ?? "" }
+    }),
+    customPolicy: createCustomPolicyConfig({
+      enabled: true,
+      policyRef: "prompt-injection@v2",
+      defaultDeny: false
+    })
+  });
+}
 function parseSecurityPolicy(data) {
   const injDef = data.injection_defense ?? data.injectionDefense;
   const auditData = data.audit;
@@ -1066,6 +1095,15 @@ function securityPolicyToJSON(policy) {
   if (injDefConfig.domains !== void 0) {
     injDef.domains = injDefConfig.domains;
   }
+  if (injDefConfig.injectionMode !== void 0) {
+    injDef.injection_mode = injDefConfig.injectionMode;
+  }
+  if (injDefConfig.judge !== void 0) {
+    const j = { enabled: injDefConfig.judge.enabled };
+    if (injDefConfig.judge.always) j.always = true;
+    if (injDefConfig.judge.policy) j.policy = injDefConfig.judge.policy;
+    injDef.judge = j;
+  }
   const auditConfig = typeof policy.audit === "boolean" ? createAuditConfig({ enabled: policy.audit }) : policy.audit;
   const audit = {
     enabled: auditConfig.enabled
@@ -3549,6 +3587,7 @@ var Governance = class {
   createToxicityConfig,
   createTransformationRule,
   domainMatches,
+  fullInjectionDefensePolicy,
   getSharedClient,
   invisibleTextConfigToJSON,
   isSensitive,