@twin3-ai/agent-id 0.3.50 → 0.3.52

package/browser-sdk.js

@@ -16,7 +16,7 @@
   // browser script and shipped in the package byte-for-byte, so it can
   // neither read the package at runtime nor go through a build step:
   // the version is written once here and CI refuses a mismatch.
-  var SDK_VERSION = "0.3.50";
+  var SDK_VERSION = "0.3.52";
   var w = window;
   var d = document;
   var s = d.currentScript || {};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twin3-ai/agent-id",
-  "version": "0.3.50",
+  "version": "0.3.52",
   "description": "Domain-bound AgentX portable alias, AEO evidence, and website-Agent integration SDK.",
   "license": "UNLICENSED",
   "private": false,

package/site-agent.js

@@ -249,27 +249,45 @@ function createSiteAgentClient(options = {}) {
   const maxAttempts = Math.max(1, Math.min(5, Number(options.maxAttempts || 3)));
   const retryBaseMs = Math.max(0, Number(options.retryBaseMs == null ? 250 : options.retryBaseMs));
   const sleep = options.sleep || defaultSleep;
+  const timeoutMs = Math.max(1, Number(options.timeoutMs == null ? 60000 : options.timeoutMs));
+  const callerSignal = options.signal;
   if (typeof fetcher !== "function") {
     throw siteAgentError("FETCH_UNAVAILABLE", "A fetch implementation is required to call the Site Agent API.");
   }
 
-  async function fetchWithRetry(url, request) {
+  function isRedirect(res) {
+    return Boolean(res) && (res.type === "opaqueredirect" || (res.status >= 300 && res.status < 400));
+  }
+
+  async function fetchWithRetry(url, request, signal) {
     let lastError;
     for (let attempt = 1; attempt <= maxAttempts; attempt += 1) {
       try {
-        const res = await fetcher(url, request);
+        const res = await fetcher(url, { ...request, redirect: "manual", signal });
+        if (isRedirect(res)) {
+          throw siteAgentError(
+            "SITE_AGENT_REDIRECT_REFUSED",
+            `xAgent ID answered with a redirect (HTTP ${res.status}); credentials are never re-sent to another location.`
+          );
+        }
         const retryableStateConflict = res && res.status === 409 && res.headers
           && typeof res.headers.get === "function"
           && res.headers.get("x-agent-id-retryable") === "state-conflict";
         const retryable = res && (res.status === 429 || res.status >= 500 || retryableStateConflict);
         if (!retryable || attempt >= maxAttempts) return res;
         if (typeof res.text === "function") await res.text();
-        await sleep(retryDelayMs(res, attempt, retryBaseMs));
+        await sleep(retryDelayMs(res, attempt, retryBaseMs), signal);
       } catch (err) {
+        if (err && err.code === "SITE_AGENT_REDIRECT_REFUSED") throw err;
+        if (signal.aborted) break;
         lastError = err;
         if (attempt >= maxAttempts) break;
-        await sleep(Math.min(30000, retryBaseMs * (2 ** Math.max(0, attempt - 1))));
+        await sleep(Math.min(30000, retryBaseMs * (2 ** Math.max(0, attempt - 1))), signal);
       }
+      if (signal.aborted) break;
+    }
+    if (signal.aborted) {
+      throw siteAgentError("SITE_AGENT_TIMEOUT", `Site Agent request did not finish within ${timeoutMs} ms`);
     }
     throw siteAgentError(
       "SITE_AGENT_NETWORK_FAILED",
@@ -277,6 +295,30 @@ function createSiteAgentClient(options = {}) {
     );
   }
 
+  async function requestJson(url, request) {
+    const controller = new AbortController();
+    const abort = () => controller.abort();
+    const timer = setTimeout(abort, timeoutMs);
+    if (callerSignal) {
+      if (callerSignal.aborted) abort();
+      else callerSignal.addEventListener("abort", abort, { once: true });
+    }
+    try {
+      const res = await fetchWithRetry(url, request, controller.signal);
+      try {
+        return { res, data: await readJsonResponse(res) };
+      } catch (err) {
+        if (controller.signal.aborted) {
+          throw siteAgentError("SITE_AGENT_TIMEOUT", `Site Agent request did not finish within ${timeoutMs} ms`);
+        }
+        throw err;
+      }
+    } finally {
+      clearTimeout(timer);
+      if (callerSignal) callerSignal.removeEventListener("abort", abort);
+    }
+  }
+
   async function call(action, payload = {}) {
     const key = payload.agent_key || payload.agentKey || agentKey;
     if (!key) {
@@ -291,14 +333,13 @@ function createSiteAgentClient(options = {}) {
       action
     };
     delete body.agentKey;
-    const res = await fetchWithRetry(endpoint + SITE_AGENT_KEY_POLICY.privateEndpoint, {
+    const { res, data } = await requestJson(endpoint + SITE_AGENT_KEY_POLICY.privateEndpoint, {
       method: "POST",
       // Authorization is the canonical credential channel; the body field
       // stays for compatibility with servers that predate header auth.
       headers: { "content-type": "application/json", authorization: `Bearer ${key}` },
       body: JSON.stringify(body)
     });
-    const data = await readJsonResponse(res);
     if (!res.ok || data.ok === false) {
       const error = siteAgentError(
         data.code || "SITE_AGENT_CALL_FAILED",
@@ -313,12 +354,11 @@ function createSiteAgentClient(options = {}) {
   }
 
   async function publicPost(path, payload = {}) {
-    const res = await fetchWithRetry(endpoint + path, {
+    const { res, data } = await requestJson(endpoint + path, {
       method: "POST",
       headers: { "content-type": "application/json" },
       body: JSON.stringify(payload || {})
     });
-    const data = await readJsonResponse(res);
     if (!res.ok || data.ok === false) {
       const error = siteAgentError(
         data.code || "AGENT_ID_PUBLIC_CALL_FAILED",
@@ -353,8 +393,7 @@ function createSiteAgentClient(options = {}) {
       },
       ...(method === "POST" ? { body: JSON.stringify(body) } : {})
     };
-    const res = await fetchWithRetry(endpoint + "/api/site_agents/permissions" + suffix, request);
-    const data = await readJsonResponse(res);
+    const { res, data } = await requestJson(endpoint + "/api/site_agents/permissions" + suffix, request);
     if (!res.ok || data.ok === false) {
       const error = siteAgentError(
         data.error || "SITE_AGENT_PERMISSION_FAILED",

package/telemetry-collector.js

@@ -28,6 +28,39 @@ function bytes(value) { return Buffer.byteLength(JSON.stringify(value), "utf8");
 function emptyState() {
   return { schema: "agentx-telemetry-buffer-v1", events: [], dead_letters: [], retry_at: 0, attempts: 0, last_flush_at: 0, last_error: null };
 }
+function journalPathFor(statePath) { return `${path.resolve(statePath)}.journal`; }
+function applyJournal(state, journalPath, maxFileBytes, maxDeadLetters) {
+  let text;
+  try {
+    if (fs.statSync(journalPath).size > maxFileBytes) throw new Error("collector_state_too_large");
+    text = fs.readFileSync(journalPath, "utf8");
+  } catch (error) {
+    if (error.code === "ENOENT") return 0;
+    throw error;
+  }
+  const known = new Set(state.events.map((event) => event.event_id));
+  let applied = 0;
+  for (const line of text.split("\n")) {
+    if (!line) continue;
+    let entry;
+    try { entry = JSON.parse(line); } catch (_error) { break; }
+    if (entry.add && !known.has(entry.add.event_id)) {
+      state.events.push(entry.add);
+      known.add(entry.add.event_id);
+    }
+    if (Array.isArray(entry.drop) && entry.drop.length) {
+      const dropped = new Set(entry.drop);
+      state.events = state.events.filter((event) => !dropped.has(event.event_id));
+      for (const id of dropped) known.delete(id);
+    }
+    if (Array.isArray(entry.dead) && entry.dead.length) {
+      state.dead_letters.push(...entry.dead);
+      state.dead_letters = state.dead_letters.slice(-maxDeadLetters);
+    }
+    applied += 1;
+  }
+  return applied;
+}
 function loadState(statePath, maxFileBytes) {
   try {
     if (fs.statSync(statePath).size > maxFileBytes) throw new Error("collector_state_too_large");
@@ -47,6 +80,7 @@ function writeState(statePath, state) {
     fs.renameSync(temporary, target);
     fs.chmodSync(target, 0o600);
   } finally { try { fs.rmSync(temporary, { force: true }); } catch (_error) {} }
+  fs.rmSync(journalPathFor(statePath), { force: true });
 }
 function createTelemetryCollector({
   client,
@@ -68,25 +102,70 @@ function createTelemetryCollector({
   maxBatchBytes = Math.max(512, Number(maxBatchBytes) || 256 * 1024);
   maxBatchEvents = Math.max(1, Math.min(250, Number(maxBatchEvents) || 250));
   maxDeadLetters = Math.max(1, Math.min(100, Number(maxDeadLetters) || 100));
+  const journalPath = journalPathFor(statePath);
   const state = loadState(statePath, maxBytes + 1024 * 1024);
-  function persist() { writeState(statePath, state); }
-  function prune(timestamp = now()) {
+  const replayed = applyJournal(state, journalPath, 2 * maxBytes + 1024 * 1024, maxDeadLetters);
+  const eventSizes = new WeakMap();
+  let journalBytes = 0;
+  let snapshotBytes = 0;
+  function eventBytes(event) {
+    let size = eventSizes.get(event);
+    if (size === undefined) { size = bytes(event); eventSizes.set(event, size); }
+    return size;
+  }
+  function bufferBytes(events = state.events) {
+    let total = 2 + Math.max(0, events.length - 1);
+    for (const event of events) total += eventBytes(event);
+    return total;
+  }
+  function knownIds() {
+    const ids = new Set(state.events.map((event) => event.event_id));
+    for (const item of state.dead_letters) ids.add(item.event_id);
+    return ids;
+  }
+  let ids = knownIds();
+  function persist() {
+    writeState(statePath, state);
+    snapshotBytes = bufferBytes();
+    journalBytes = 0;
+    ids = knownIds();
+  }
+  function journal(entry) {
+    const line = JSON.stringify(entry) + "\n";
+    fs.mkdirSync(path.dirname(journalPath), { recursive: true, mode: 0o700 });
+    fs.appendFileSync(journalPath, line, { mode: 0o600 });
+    journalBytes += Buffer.byteLength(line, "utf8");
+    if (journalBytes > Math.max(1024 * 1024, snapshotBytes)) persist();
+  }
+  function evict(timestamp) {
     const cutoff = timestamp - maxAgeMs;
     const removed = [];
     state.events = state.events.filter((event) => {
       if (Number(event.ingestion_time) < cutoff) { removed.push({ ...event, dead_letter_reason: "expired_buffer_event" }); return false; }
       return true;
     });
-    while (state.events.length > maxEvents || bytes(state.events) > maxBytes) removed.push({ ...state.events.shift(), dead_letter_reason: "buffer_limit_pruned" });
-    state.dead_letters.push(...removed.map((event) => ({ event_id: event.event_id, source: event.source, dead_letter_reason: event.dead_letter_reason, failed_at: timestamp })));
+    let total = bufferBytes();
+    while (state.events.length > maxEvents || total > maxBytes) {
+      const event = state.events.shift();
+      total -= eventBytes(event) + (state.events.length ? 1 : 0);
+      removed.push({ ...event, dead_letter_reason: "buffer_limit_pruned" });
+    }
+    const dead = removed.map((event) => ({ event_id: event.event_id, source: event.source, dead_letter_reason: event.dead_letter_reason, failed_at: timestamp }));
+    state.dead_letters.push(...dead);
     state.dead_letters = state.dead_letters.slice(-maxDeadLetters);
-    persist();
+    for (const item of dead) ids.add(item.event_id);
+    return dead;
+  }
+  function prune(timestamp = now()) {
+    const removed = evict(timestamp);
+    if (removed.length) persist();
     return { removed: removed.length, event_count: state.events.length };
   }
+  if (replayed) persist();
   async function record(event) {
     const timestamp = now();
     const eventId = String(event && (event.event_id || event.id) || crypto.randomUUID());
-    if (state.events.some((item) => item.event_id === eventId) || state.dead_letters.some((item) => item.event_id === eventId)) return { recorded: false, duplicate: true, event_id: eventId };
+    if (ids.has(eventId)) return { recorded: false, duplicate: true, event_id: eventId };
     const cleaned = redact(event || {});
     const normalized = {
       ...cleaned,
@@ -100,7 +179,9 @@ function createTelemetryCollector({
     };
     if (normalized.user_agent && !normalized.verified_bot_identity) normalized.identity_confidence = "user_agent_only_spoofable";
     state.events.push(normalized);
-    prune(timestamp);
+    ids.add(eventId);
+    const dead = evict(timestamp);
+    journal({ add: normalized, drop: dead.map((item) => item.event_id), dead });
     return { recorded: true, event_id: eventId };
   }
   function nextBatch(timestamp) {
@@ -155,7 +236,7 @@ function createTelemetryCollector({
   }
   async function status() {
     prune(now());
-    return { schema: "agentx-telemetry-status-v1", event_count: state.events.length, dead_letter_count: state.dead_letters.length, bytes: bytes(state.events), retry_at: state.retry_at, last_flush_at: state.last_flush_at, last_error: state.last_error };
+    return { schema: "agentx-telemetry-status-v1", event_count: state.events.length, dead_letter_count: state.dead_letters.length, bytes: bufferBytes(), retry_at: state.retry_at, last_flush_at: state.last_flush_at, last_error: state.last_error };
   }
   return Object.freeze({ record, flush, status, prune });
 }