@signalvaultio/node 0.5.0 → 0.5.1

package/dist/index.d.ts

@@ -2,7 +2,7 @@ import type OpenAI from 'openai';
 import { ToolsAPI } from './tools';
 export type { ToolRecordOptions, ToolsAPI } from './tools';
 /** Kept in sync with package.json by a unit test. */
-export declare const SDK_VERSION = "0.5.0";
+export declare const SDK_VERSION = "0.5.1";
 /**
  * Normalizes the base URL and refuses plaintext HTTP to anything but the local
  * machine. The API key and full prompts travel in every request, so an

package/dist/index.js

@@ -5,7 +5,7 @@ exports.normalizeBaseUrl = normalizeBaseUrl;
 const crypto_1 = require("crypto");
 const tools_1 = require("./tools");
 /** Kept in sync with package.json by a unit test. */
-exports.SDK_VERSION = '0.5.0';
+exports.SDK_VERSION = '0.5.1';
 const DEFAULT_BASE_URL = 'https://api.signalvault.io';
 const LOCAL_HOSTS = new Set(['localhost', '127.0.0.1', '::1', '[::1]']);
 /** Longest Retry-After the SDK will wait out before retrying a background event once. */
@@ -38,25 +38,67 @@ function assertNodeEnvironment() {
  * `http://` URL would expose both before the server could redirect to HTTPS.
  */
 function normalizeBaseUrl(raw) {
+    // Errors never quote `raw`: it may contain credentials.
     let url;
     try {
         url = new URL(raw);
     }
     catch {
-        throw new Error(`[SignalVault] baseUrl is not a valid URL: ${raw}`);
+        throw new Error('[SignalVault] baseUrl is not a valid URL.');
+    }
+    if (url.username || url.password) {
+        throw new Error('[SignalVault] baseUrl must not contain credentials (user:password@). Pass the key as apiKey.');
     }
     if (url.protocol === 'http:' && !LOCAL_HOSTS.has(url.hostname)) {
         throw new Error('[SignalVault] baseUrl must use https:// (plain http:// is only allowed for localhost). ' +
             'Your API key and prompts would otherwise be sent unencrypted.');
     }
     if (url.search || url.hash) {
-        throw new Error(`[SignalVault] baseUrl must not contain a query or fragment: ${raw}`);
+        throw new Error('[SignalVault] baseUrl must not contain a query or fragment.');
     }
     if (url.protocol !== 'https:' && url.protocol !== 'http:') {
         throw new Error(`[SignalVault] baseUrl must be an https:// URL, got ${url.protocol}`);
     }
     return raw.replace(/\/+$/, '');
 }
+/**
+ * Strips surrounding whitespace and refuses keys that can't go in a header.
+ * A key read from a file or a secret often ends in a newline. Sent as is,
+ * every request fails before it leaves the process, so with failMode 'open'
+ * every call would go through unchecked. Errors never include the key.
+ */
+function normalizeApiKey(raw) {
+    if (typeof raw !== 'string') {
+        throw new TypeError(`[SignalVault] apiKey must be a string, got ${raw === null ? 'null' : typeof raw}.`);
+    }
+    const key = raw.trim();
+    if (!key) {
+        throw new Error('[SignalVault] apiKey is empty.');
+    }
+    if (/[^\x21-\x7e]/.test(key)) {
+        throw new Error('[SignalVault] apiKey contains whitespace, control or non-ASCII characters. Check how the key is loaded.');
+    }
+    return key;
+}
+/**
+ * One line describing an error and its causes, for debug output. Never
+ * includes `secret`, and never throws.
+ */
+function describeError(error, secret) {
+    const parts = [];
+    let current = error;
+    for (let depth = 0; current !== undefined && current !== null && depth < 5; depth++) {
+        try {
+            parts.push(current instanceof Error ? `${current.name}: ${current.message}` : String(current));
+            current = current instanceof Error ? current.cause : undefined;
+        }
+        catch {
+            parts.push('<unprintable error>');
+            break;
+        }
+    }
+    return parts.join(' <- ').split(secret).join('[redacted]');
+}
 /** Thrown when a guardrail rule blocks the request. */
 class SignalVaultBlockedError extends Error {
     constructor(requestId, violations, dashboardUrl) {
@@ -236,7 +278,7 @@ class SignalVaultClient {
         if (config.failMode !== undefined && config.failMode !== 'open' && config.failMode !== 'closed') {
             throw new Error("[SignalVault] failMode must be 'open' or 'closed'.");
         }
-        this.svApiKey = config.apiKey;
+        this.svApiKey = normalizeApiKey(config.apiKey);
         this.svBaseUrl = normalizeBaseUrl(config.baseUrl || DEFAULT_BASE_URL);
         this.svEnvironment = config.environment || 'production';
         this.debugMode = config.debug || false;
@@ -282,8 +324,9 @@ class SignalVaultClient {
     track(promise) {
         const tracked = promise
             .catch((err) => {
-            if (this.debugMode)
-                console.error('[SignalVault] Background event failed:', err);
+            if (this.debugMode) {
+                console.error('[SignalVault] Background event failed:', describeError(err, this.svApiKey));
+            }
         })
             .finally(() => this.pending.delete(tracked));
         this.pending.add(tracked);
@@ -699,8 +742,9 @@ class SignalVaultClient {
             }
         }
         catch (error) {
-            if (this.debugMode)
-                console.error('[SignalVault] Event send failed:', error);
+            if (this.debugMode) {
+                console.error('[SignalVault] Event send failed:', describeError(error, this.svApiKey));
+            }
             if (!isTimeout(error))
                 retryDelayMs = 250 + Math.random() * 500;
         }
@@ -712,8 +756,9 @@ class SignalVaultClient {
                     return result;
             }
             catch (error) {
-                if (this.debugMode)
-                    console.error('[SignalVault] Event retry failed:', error);
+                if (this.debugMode) {
+                    console.error('[SignalVault] Event retry failed:', describeError(error, this.svApiKey));
+                }
             }
         }
         this.logUndelivered(result);
@@ -734,8 +779,9 @@ class SignalVaultClient {
         }
         catch (error) {
             const timedOut = isTimeout(error);
-            if (this.debugMode)
-                console.error('[SignalVault] Pre-flight failed:', error);
+            if (this.debugMode) {
+                console.error('[SignalVault] Pre-flight failed:', describeError(error, this.svApiKey));
+            }
             return this.unavailable(requestId, timedOut ? 'timeout' : 'network', timedOut
                 ? `SignalVault pre-flight check timed out after ${this.preflightTimeout}ms`
                 : 'SignalVault API is unreachable');

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@signalvaultio/node",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "SignalVault SDK - AI audit logs and guardrails for safe production AI",
   "type": "commonjs",
   "main": "./dist/index.js",