agentid-sdk 0.1.18 → 0.1.19

package/README.md

@@ -1,65 +1,197 @@
-# 🛡️ AgentID: Enterprise AI Governance & PII Shield
+# agentid-sdk (Node.js / TypeScript)
 
-AgentID je inteligentní brána (gateway) pro vaše LLM aplikace. Monitoruje náklady, filtruje PII (osobní údaje) v reálném čase a zajišťuje soulad s GDPR.
+[![npm version](https://img.shields.io/npm/v/agentid-sdk.svg)](https://www.npmjs.com/package/agentid-sdk)
+[![Node](https://img.shields.io/node/v/agentid-sdk.svg)](https://www.npmjs.com/package/agentid-sdk)
+[![Node >=18](https://img.shields.io/badge/node-%3E%3D18-339933.svg)](https://nodejs.org/)
+[![License: MIT](https://img.shields.io/badge/license-MIT-blue.svg)](LICENSE)
 
-## 🚀 Rychlý start (60 sekund)
+## 1. Introduction
 
-### 1. Instalace
+`agentid-sdk` is the official Node.js/TypeScript SDK for AgentID, an AI security and compliance System of Record. It allows you to gate LLM traffic through guard checks, enforce policy before execution, and capture durable telemetry for audit and governance workflows.
 
-```bash
-# Pro Python projekty
-pip install agentid-sdk
+## 2. Installation
 
-# Pro JavaScript/TypeScript projekty
+```bash
 npm install agentid-sdk
 ```
 
-### 2. Integrace (Python)
+## 3. Prerequisites
+
+1. Create an account at `https://app.getagentid.com`.
+2. Create an AI system and copy:
+   - `AGENTID_API_KEY` (for example `sk_live_...`)
+   - `AGENTID_SYSTEM_ID` (UUID)
+3. If using OpenAI/LangChain, set:
+   - `OPENAI_API_KEY`
+
+```bash
+export AGENTID_API_KEY="sk_live_..."
+export AGENTID_SYSTEM_ID="00000000-0000-0000-0000-000000000000"
+export OPENAI_API_KEY="sk-proj-..."
+```
 
-Stačí zabalit vašeho stávajícího OpenAI klienta.
+## 4. Quickstart
 
-```python
-from openai import OpenAI
-from agentid import AgentID
+```ts
+import { AgentID } from "agentid-sdk";
 
-client = OpenAI(api_key="your_openai_key")
-agent = AgentID(api_key="ag_prod_...")
+const agent = new AgentID(); // auto-loads AGENTID_API_KEY
+const systemId = process.env.AGENTID_SYSTEM_ID!;
 
-# Automaticky filtruje PII a loguje metriky
-response = agent.wrap_openai(client, system_id="sys_...").chat.completions.create(
-    model="gpt-4",
-    messages=[{"role": "user", "content": "Můj email je jan.novak@firma.cz"}]
-)
+const verdict = await agent.guard({
+  system_id: systemId,
+  input: "Summarize this ticket in one sentence.",
+  model: "gpt-4o-mini",
+  user_id: "quickstart-user",
+});
+if (!verdict.allowed) throw new Error(`Blocked: ${verdict.reason}`);
+
+await agent.log({
+  system_id: systemId,
+  event_id: verdict.client_event_id,
+  model: "gpt-4o-mini",
+  input: "Summarize this ticket in one sentence.",
+  output: "Summary generated.",
+  metadata: { agent_role: "support-assistant" },
+});
 ```
 
-### 3. Integrace (Node.js)
+## 5. Core Integrations
+
+### OpenAI Wrapper
+
+```bash
+npm install agentid-sdk openai
+```
 
 ```ts
-import { AgentID } from "agentid-sdk";
 import OpenAI from "openai";
+import { AgentID } from "agentid-sdk";
 
-const openai = new OpenAI();
 const agent = new AgentID({
-  apiKey: "ag_prod_...",
-  strictMode: false, // default (fail-open on timeout/unreachable AgentID API)
-  guardTimeoutMs: 6000, // optional: timeout for AgentID /guard call in ms
-  // strictMode: true, // fail-closed for high-risk workloads
+  piiMasking: true,
+});
+
+const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY! });
+const secured = agent.wrapOpenAI(openai, {
+  system_id: process.env.AGENTID_SYSTEM_ID!,
+  user_id: "customer-123",
+});
+
+const response = await secured.chat.completions.create({
+  model: "gpt-4o-mini",
+  messages: [{ role: "user", content: "What is the capital of the Czech Republic?" }],
+});
+
+console.log(response.choices[0]?.message?.content ?? "");
+```
+
+### LangChain Integration
+
+```bash
+npm install agentid-sdk openai @langchain/core @langchain/openai
+```
+
+```ts
+import { AgentID } from "agentid-sdk";
+import { AgentIDCallbackHandler } from "agentid-sdk/langchain";
+import { ChatOpenAI } from "@langchain/openai";
+import { ChatPromptTemplate } from "@langchain/core/prompts";
+import { StringOutputParser } from "@langchain/core/output_parsers";
+
+const agent = new AgentID();
+const handler = new AgentIDCallbackHandler(agent, {
+  system_id: process.env.AGENTID_SYSTEM_ID!,
 });
 
-const proxiedOpenAI = agent.wrapOpenAI(openai, {
-  system_id: "sys_...",
-  user_id: "system-auto-summary", // optional service/user identity
+const prompt = ChatPromptTemplate.fromTemplate("Answer in one sentence: {question}");
+const model = new ChatOpenAI({
+  apiKey: process.env.OPENAI_API_KEY!,
+  model: "gpt-4o-mini",
 });
+const chain = prompt.pipe(model).pipe(new StringOutputParser());
+
+const result = await chain.invoke(
+  { question: "What is the capital of the Czech Republic?" },
+  { callbacks: [handler] }
+);
+console.log(result);
 ```
 
-## 🔒 Klíčové vlastnosti
+### Raw Ingest API (Telemetry Only)
+
+```ts
+import { AgentID } from "agentid-sdk";
+
+const agent = new AgentID();
+
+await agent.log({
+  system_id: process.env.AGENTID_SYSTEM_ID!,
+  event_type: "complete",
+  severity: "info",
+  model: "gpt-4o-mini",
+  input: "Raw telemetry prompt",
+  output: '{"ok": true}',
+  metadata: { agent_role: "batch-worker", channel: "manual_ingest" },
+});
+```
+
+## 6. Advanced Configuration
+
+### Custom identity / role metadata
+
+```ts
+await agent.guard({
+  system_id: process.env.AGENTID_SYSTEM_ID!,
+  input: "Process user request",
+  user_id: "service:billing-agent",
+  model: "gpt-4o-mini",
+});
+
+await agent.log({
+  system_id: process.env.AGENTID_SYSTEM_ID!,
+  model: "gpt-4o-mini",
+  input: "Process user request",
+  output: "Done",
+  metadata: { agent_role: "billing-agent", environment: "prod" },
+});
+```
+
+### Strict mode and timeout tuning
+
+```ts
+const agent = new AgentID({
+  strictMode: true,      // fail-closed on guard connectivity/timeouts
+  guardTimeoutMs: 10000, // default guard timeout is 10000ms
+});
+```
+
+### Error handling behavior
+
+- `guard()` returns a verdict (`allowed`, `reason`); handle deny paths explicitly.
+- `wrapOpenAI()` throws `Error("AgentID: Security Blocked (...)")` when blocked.
+- Default mode is fail-open for connectivity/timeouts (`timeout_fallback`, `guard_unreachable`, `system_failure_fail_open`).
+- If `strictMode` is not explicitly set in SDK code, runtime behavior follows the system configuration from AgentID (`strict_security_mode` / `failure_mode`).
+- Set `strictMode: true` to fail-closed (`network_error_strict_mode` / `server_error`) in high-sensitivity environments.
+- Ingest retries transient failures (5xx/429) and logs warnings if persistence fails.
+
+## 7. Security & Compliance
+
+- Optional local PII masking and local policy enforcement before model dispatch.
+- Prompt-injection scanning in the SDK request path.
+- Guard checks run pre-execution; ingest telemetry captures prompt/output lifecycle.
+- Safe for server and serverless runtimes (including async completion flows).
+- Supports compliance and forensics workflows with durable event records.
+
+## 8. Support
+
+- Dashboard: `https://app.getagentid.com`
+- Repository: `https://github.com/ondrejsukac-rgb/agentid/tree/main/js-sdk`
+- Issues: `https://github.com/ondrejsukac-rgb/agentid/issues`
 
-- PII Scrubbing: Automatická redakce e-mailů, rodných čísel a hesel před odesláním do cloudu.
-- Crypto-Shredding: Možnost nenávratně smazat citlivá data z logů na žádost uživatele (GDPR).
-- Fail-Safe architektura: Inteligentní přepínání mezi bezpečností a dostupností (Fail-Open/Closed).
-- Strict mode: při timeoutu Guard API můžeš vynutit fail-closed (`strictMode: true`).
+## 9. Publishing Notes (NPM)
 
-## Guard transformed input
+NPM automatically renders `README.md` from the package root during `npm publish`.
 
-If `/guard` returns `transformed_input`, the OpenAI and LangChain wrappers automatically
-forward that transformed value to the downstream LLM call.
+- File location: next to `package.json` in `js-sdk/`.
+- No additional NPM config is required for README rendering.

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions } from './langchain-BykeB2WB.mjs';
+export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions } from './langchain-DJDqqpbT.mjs';
 import '@langchain/core/callbacks/base';
 
 type PIIMapping = Record<string, string>;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions } from './langchain-BykeB2WB.js';
+export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions } from './langchain-DJDqqpbT.js';
 import '@langchain/core/callbacks/base';
 
 type PIIMapping = Record<string, string>;

package/dist/index.js

@@ -84,7 +84,7 @@ var OpenAIAdapter = class {
 
 // src/sdk-version.ts
 var FALLBACK_SDK_VERSION = "js-0.0.0-dev";
-var AGENTID_SDK_VERSION_HEADER = "js-0.1.18".trim().length > 0 ? "js-0.1.18" : FALLBACK_SDK_VERSION;
+var AGENTID_SDK_VERSION_HEADER = "js-0.1.19".trim().length > 0 ? "js-0.1.19" : FALLBACK_SDK_VERSION;
 
 // src/pii-national-identifiers.ts
 var MAX_CANDIDATES_PER_RULE = 256;
@@ -1115,12 +1115,14 @@ var PIIManager = class {
 };
 
 // src/local-security-enforcer.ts
-var DEFAULT_STRICT_CONFIG = {
+var DEFAULT_FAIL_OPEN_CONFIG = {
   shadow_mode: false,
-  block_pii_leakage: true,
-  block_db_access: true,
-  block_code_execution: true,
-  block_toxicity: true
+  strict_security_mode: false,
+  failure_mode: "fail_open",
+  block_pii_leakage: false,
+  block_db_access: false,
+  block_code_execution: false,
+  block_toxicity: false
 };
 var SQL_DATABASE_ACCESS_PATTERN = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b[\s\S]+?\b(FROM|INTO|TABLE|DATABASE|VIEW|INDEX)\b/i;
 var PYTHON_GENERAL_RCE_PATTERN = /(import\s+(os|sys|subprocess)|from\s+(os|sys|subprocess)\s+import|exec\s*\(|eval\s*\(|__import__)/i;
@@ -1243,13 +1245,28 @@ function readOptionalBooleanField(body, key, fallback) {
   }
   throw new Error(`Invalid config field: ${key}`);
 }
+function readOptionalFailureModeField(body, fallback) {
+  const value = body.failure_mode;
+  if (value === "fail_open" || value === "fail_close") {
+    return value;
+  }
+  return fallback;
+}
 function normalizeCapabilityConfig(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Invalid config payload");
   }
   const body = payload;
+  const strictSecurityMode = readOptionalBooleanField(body, "strict_security_mode", false);
+  const failureMode = readOptionalFailureModeField(
+    body,
+    strictSecurityMode ? "fail_close" : "fail_open"
+  );
+  const effectiveStrictMode = strictSecurityMode || failureMode === "fail_close";
   return {
     shadow_mode: readOptionalBooleanField(body, "shadow_mode", false),
+    strict_security_mode: effectiveStrictMode,
+    failure_mode: effectiveStrictMode ? "fail_close" : "fail_open",
     block_pii_leakage: readBooleanField(body, "block_pii_leakage", "block_pii"),
     block_db_access: readBooleanField(body, "block_db_access", "block_db"),
     block_code_execution: readBooleanField(
@@ -1353,7 +1370,7 @@ async function fetchCapabilityConfigWithTimeout(params) {
 function getCachedCapabilityConfig(params) {
   const key = getCacheKey(params.apiKey, params.baseUrl);
   const entry = getGlobalCache().get(key);
-  return entry?.config ?? DEFAULT_STRICT_CONFIG;
+  return entry?.config ?? DEFAULT_FAIL_OPEN_CONFIG;
 }
 async function ensureCapabilityConfig(params) {
   const ttlMs = params.ttlMs ?? CONFIG_TTL_MS;
@@ -1382,14 +1399,15 @@ async function ensureCapabilityConfig(params) {
     return resolved;
   }).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
-    console.warn("AgentID Config unreachable. Defaulting to STRICT MODE.", message);
+    const fallbackConfig = existing?.config ?? DEFAULT_FAIL_OPEN_CONFIG;
+    console.warn("AgentID Config unreachable. Defaulting to FAIL-OPEN MODE.", message);
     cache.set(key, {
-      config: DEFAULT_STRICT_CONFIG,
+      config: fallbackConfig,
       expiresAt: Date.now() + ttlMs,
       promise: null
     });
     enforceCacheBound(cache);
-    return DEFAULT_STRICT_CONFIG;
+    return fallbackConfig;
   }).finally(() => {
     const latest = cache.get(key);
     if (!latest) {
@@ -1405,7 +1423,7 @@ async function ensureCapabilityConfig(params) {
     }
   });
   cache.set(key, {
-    config: existing?.config ?? DEFAULT_STRICT_CONFIG,
+    config: existing?.config ?? DEFAULT_FAIL_OPEN_CONFIG,
     expiresAt: existing?.expiresAt ?? 0,
     promise: pending
   });
@@ -1878,6 +1896,15 @@ function normalizeGuardTimeoutMs(value) {
   }
   return rounded;
 }
+function resolveConfiguredApiKey(value) {
+  const explicit = typeof value === "string" ? value.trim() : "";
+  const fromEnv = globalThis.process?.env?.AGENTID_API_KEY ?? "";
+  const resolved = explicit || fromEnv.trim();
+  if (!resolved) {
+    throw new Error("AgentID API key missing. Pass apiKey or set AGENTID_API_KEY.");
+  }
+  return resolved;
+}
 function isInfrastructureGuardReason(reason) {
   if (!reason) return false;
   return reason === "system_failure" || reason === "system_failure_db_unavailable" || reason === "logging_failed" || reason === "server_error" || reason === "guard_unreachable" || reason === "api_key_pepper_missing" || reason === "encryption_key_missing";
@@ -1995,10 +2022,10 @@ function createCompletionChunkCollector() {
   };
 }
 var AgentID = class {
-  constructor(config) {
+  constructor(config = {}) {
     this.injectionScanner = getInjectionScanner();
     this.recentGuardVerdicts = /* @__PURE__ */ new Map();
-    this.apiKey = config.apiKey.trim();
+    this.apiKey = resolveConfiguredApiKey(config.apiKey);
     this.baseUrl = normalizeBaseUrl3(config.baseUrl ?? "https://app.getagentid.com/api/v1");
     this.piiMasking = Boolean(config.piiMasking);
     this.checkInjection = config.checkInjection !== false;
@@ -2089,6 +2116,13 @@ var AgentID = class {
       baseUrl: this.baseUrl
     });
   }
+  async resolveEffectiveStrictMode(options) {
+    if (this.strictMode) {
+      return true;
+    }
+    const config = await this.getCapabilityConfig(false, options);
+    return config.strict_security_mode || config.failure_mode === "fail_close";
+  }
   async prepareInputForDispatch(params, options) {
     const effectiveApiKey = this.resolveApiKey(options?.apiKey);
     if (this.checkInjection && !params.skipInjectionScan && params.input) {
@@ -2227,6 +2261,9 @@ var AgentID = class {
    */
   async guard(params, options) {
     const effectiveApiKey = this.resolveApiKey(options?.apiKey);
+    const effectiveStrictMode = await this.resolveEffectiveStrictMode({
+      apiKey: effectiveApiKey
+    });
     const payload = {
       ...params,
       client_capabilities: params.client_capabilities ?? this.buildClientCapabilities()
@@ -2265,7 +2302,7 @@ var AgentID = class {
               await waitForRetry(attempt);
               continue;
             }
-            if (this.strictMode) {
+            if (effectiveStrictMode) {
               console.warn(
                 `[AgentID] Guard API infrastructure failure in strict mode (${verdict.reason ?? `http_${res.status}`}). Blocking request.`
               );
@@ -2312,13 +2349,13 @@ var AgentID = class {
             guardParams: params,
             apiKey: effectiveApiKey
           });
-          if (this.strictMode) {
+          if (effectiveStrictMode) {
             return { allowed: false, reason: "network_error_strict_mode" };
           }
           return { allowed: true, reason: "timeout_fallback" };
         }
         console.warn(
-          this.strictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
+          effectiveStrictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
           error
         );
         this.logGuardFallback({
@@ -2327,7 +2364,7 @@ var AgentID = class {
           guardParams: params,
           apiKey: effectiveApiKey
         });
-        if (this.strictMode) {
+        if (effectiveStrictMode) {
           return { allowed: false, reason: "network_error_strict_mode" };
         }
         return { allowed: true, reason: "guard_unreachable" };
@@ -2336,22 +2373,22 @@ var AgentID = class {
       }
     }
     if (lastAbort) {
-      if (this.strictMode) {
+      if (effectiveStrictMode) {
         return { allowed: false, reason: "network_error_strict_mode" };
       }
       return { allowed: true, reason: "timeout_fallback" };
     }
     if (typeof lastStatusCode === "number" && lastStatusCode >= 500) {
-      if (this.strictMode) {
+      if (effectiveStrictMode) {
         return { allowed: false, reason: "server_error" };
       }
       return { allowed: true, reason: "system_failure_fail_open" };
     }
     console.warn(
-      this.strictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
+      effectiveStrictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
       lastError
     );
-    if (this.strictMode) {
+    if (effectiveStrictMode) {
       return { allowed: false, reason: "network_error_strict_mode" };
     }
     return { allowed: true, reason: "guard_unreachable" };

package/dist/index.mjs

@@ -46,7 +46,7 @@ var OpenAIAdapter = class {
 
 // src/sdk-version.ts
 var FALLBACK_SDK_VERSION = "js-0.0.0-dev";
-var AGENTID_SDK_VERSION_HEADER = "js-0.1.18".trim().length > 0 ? "js-0.1.18" : FALLBACK_SDK_VERSION;
+var AGENTID_SDK_VERSION_HEADER = "js-0.1.19".trim().length > 0 ? "js-0.1.19" : FALLBACK_SDK_VERSION;
 
 // src/pii-national-identifiers.ts
 var MAX_CANDIDATES_PER_RULE = 256;
@@ -1077,12 +1077,14 @@ var PIIManager = class {
 };
 
 // src/local-security-enforcer.ts
-var DEFAULT_STRICT_CONFIG = {
+var DEFAULT_FAIL_OPEN_CONFIG = {
   shadow_mode: false,
-  block_pii_leakage: true,
-  block_db_access: true,
-  block_code_execution: true,
-  block_toxicity: true
+  strict_security_mode: false,
+  failure_mode: "fail_open",
+  block_pii_leakage: false,
+  block_db_access: false,
+  block_code_execution: false,
+  block_toxicity: false
 };
 var SQL_DATABASE_ACCESS_PATTERN = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b[\s\S]+?\b(FROM|INTO|TABLE|DATABASE|VIEW|INDEX)\b/i;
 var PYTHON_GENERAL_RCE_PATTERN = /(import\s+(os|sys|subprocess)|from\s+(os|sys|subprocess)\s+import|exec\s*\(|eval\s*\(|__import__)/i;
@@ -1205,13 +1207,28 @@ function readOptionalBooleanField(body, key, fallback) {
   }
   throw new Error(`Invalid config field: ${key}`);
 }
+function readOptionalFailureModeField(body, fallback) {
+  const value = body.failure_mode;
+  if (value === "fail_open" || value === "fail_close") {
+    return value;
+  }
+  return fallback;
+}
 function normalizeCapabilityConfig(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Invalid config payload");
   }
   const body = payload;
+  const strictSecurityMode = readOptionalBooleanField(body, "strict_security_mode", false);
+  const failureMode = readOptionalFailureModeField(
+    body,
+    strictSecurityMode ? "fail_close" : "fail_open"
+  );
+  const effectiveStrictMode = strictSecurityMode || failureMode === "fail_close";
   return {
     shadow_mode: readOptionalBooleanField(body, "shadow_mode", false),
+    strict_security_mode: effectiveStrictMode,
+    failure_mode: effectiveStrictMode ? "fail_close" : "fail_open",
     block_pii_leakage: readBooleanField(body, "block_pii_leakage", "block_pii"),
     block_db_access: readBooleanField(body, "block_db_access", "block_db"),
     block_code_execution: readBooleanField(
@@ -1315,7 +1332,7 @@ async function fetchCapabilityConfigWithTimeout(params) {
 function getCachedCapabilityConfig(params) {
   const key = getCacheKey(params.apiKey, params.baseUrl);
   const entry = getGlobalCache().get(key);
-  return entry?.config ?? DEFAULT_STRICT_CONFIG;
+  return entry?.config ?? DEFAULT_FAIL_OPEN_CONFIG;
 }
 async function ensureCapabilityConfig(params) {
   const ttlMs = params.ttlMs ?? CONFIG_TTL_MS;
@@ -1344,14 +1361,15 @@ async function ensureCapabilityConfig(params) {
     return resolved;
   }).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
-    console.warn("AgentID Config unreachable. Defaulting to STRICT MODE.", message);
+    const fallbackConfig = existing?.config ?? DEFAULT_FAIL_OPEN_CONFIG;
+    console.warn("AgentID Config unreachable. Defaulting to FAIL-OPEN MODE.", message);
     cache.set(key, {
-      config: DEFAULT_STRICT_CONFIG,
+      config: fallbackConfig,
       expiresAt: Date.now() + ttlMs,
       promise: null
     });
     enforceCacheBound(cache);
-    return DEFAULT_STRICT_CONFIG;
+    return fallbackConfig;
   }).finally(() => {
     const latest = cache.get(key);
     if (!latest) {
@@ -1367,7 +1385,7 @@ async function ensureCapabilityConfig(params) {
     }
   });
   cache.set(key, {
-    config: existing?.config ?? DEFAULT_STRICT_CONFIG,
+    config: existing?.config ?? DEFAULT_FAIL_OPEN_CONFIG,
     expiresAt: existing?.expiresAt ?? 0,
     promise: pending
   });
@@ -1840,6 +1858,15 @@ function normalizeGuardTimeoutMs(value) {
   }
   return rounded;
 }
+function resolveConfiguredApiKey(value) {
+  const explicit = typeof value === "string" ? value.trim() : "";
+  const fromEnv = globalThis.process?.env?.AGENTID_API_KEY ?? "";
+  const resolved = explicit || fromEnv.trim();
+  if (!resolved) {
+    throw new Error("AgentID API key missing. Pass apiKey or set AGENTID_API_KEY.");
+  }
+  return resolved;
+}
 function isInfrastructureGuardReason(reason) {
   if (!reason) return false;
   return reason === "system_failure" || reason === "system_failure_db_unavailable" || reason === "logging_failed" || reason === "server_error" || reason === "guard_unreachable" || reason === "api_key_pepper_missing" || reason === "encryption_key_missing";
@@ -1957,10 +1984,10 @@ function createCompletionChunkCollector() {
   };
 }
 var AgentID = class {
-  constructor(config) {
+  constructor(config = {}) {
     this.injectionScanner = getInjectionScanner();
     this.recentGuardVerdicts = /* @__PURE__ */ new Map();
-    this.apiKey = config.apiKey.trim();
+    this.apiKey = resolveConfiguredApiKey(config.apiKey);
     this.baseUrl = normalizeBaseUrl3(config.baseUrl ?? "https://app.getagentid.com/api/v1");
     this.piiMasking = Boolean(config.piiMasking);
     this.checkInjection = config.checkInjection !== false;
@@ -2051,6 +2078,13 @@ var AgentID = class {
       baseUrl: this.baseUrl
     });
   }
+  async resolveEffectiveStrictMode(options) {
+    if (this.strictMode) {
+      return true;
+    }
+    const config = await this.getCapabilityConfig(false, options);
+    return config.strict_security_mode || config.failure_mode === "fail_close";
+  }
   async prepareInputForDispatch(params, options) {
     const effectiveApiKey = this.resolveApiKey(options?.apiKey);
     if (this.checkInjection && !params.skipInjectionScan && params.input) {
@@ -2189,6 +2223,9 @@ var AgentID = class {
    */
   async guard(params, options) {
     const effectiveApiKey = this.resolveApiKey(options?.apiKey);
+    const effectiveStrictMode = await this.resolveEffectiveStrictMode({
+      apiKey: effectiveApiKey
+    });
     const payload = {
       ...params,
       client_capabilities: params.client_capabilities ?? this.buildClientCapabilities()
@@ -2227,7 +2264,7 @@ var AgentID = class {
               await waitForRetry(attempt);
               continue;
             }
-            if (this.strictMode) {
+            if (effectiveStrictMode) {
               console.warn(
                 `[AgentID] Guard API infrastructure failure in strict mode (${verdict.reason ?? `http_${res.status}`}). Blocking request.`
               );
@@ -2274,13 +2311,13 @@ var AgentID = class {
             guardParams: params,
             apiKey: effectiveApiKey
           });
-          if (this.strictMode) {
+          if (effectiveStrictMode) {
             return { allowed: false, reason: "network_error_strict_mode" };
           }
           return { allowed: true, reason: "timeout_fallback" };
         }
         console.warn(
-          this.strictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
+          effectiveStrictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
           error
         );
         this.logGuardFallback({
@@ -2289,7 +2326,7 @@ var AgentID = class {
           guardParams: params,
           apiKey: effectiveApiKey
         });
-        if (this.strictMode) {
+        if (effectiveStrictMode) {
           return { allowed: false, reason: "network_error_strict_mode" };
         }
         return { allowed: true, reason: "guard_unreachable" };
@@ -2298,22 +2335,22 @@ var AgentID = class {
       }
     }
     if (lastAbort) {
-      if (this.strictMode) {
+      if (effectiveStrictMode) {
         return { allowed: false, reason: "network_error_strict_mode" };
       }
       return { allowed: true, reason: "timeout_fallback" };
     }
     if (typeof lastStatusCode === "number" && lastStatusCode >= 500) {
-      if (this.strictMode) {
+      if (effectiveStrictMode) {
         return { allowed: false, reason: "server_error" };
       }
       return { allowed: true, reason: "system_failure_fail_open" };
     }
     console.warn(
-      this.strictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
+      effectiveStrictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
       lastError
     );
-    if (this.strictMode) {
+    if (effectiveStrictMode) {
       return { allowed: false, reason: "network_error_strict_mode" };
     }
     return { allowed: true, reason: "guard_unreachable" };

package/dist/{langchain-BykeB2WB.d.mts → langchain-DJDqqpbT.d.mts}

@@ -2,6 +2,8 @@ import { BaseCallbackHandler } from '@langchain/core/callbacks/base';
 
 type CapabilityConfig = {
     shadow_mode: boolean;
+    strict_security_mode: boolean;
+    failure_mode: "fail_open" | "fail_close";
     block_pii_leakage: boolean;
     block_db_access: boolean;
     block_code_execution: boolean;
@@ -58,7 +60,7 @@ interface LogParams {
     };
 }
 type AgentIDConfig = {
-    apiKey: string;
+    apiKey?: string;
     baseUrl?: string;
     piiMasking?: boolean;
     checkInjection?: boolean;
@@ -85,7 +87,7 @@ declare class AgentID {
     private localEnforcer;
     private injectionScanner;
     private recentGuardVerdicts;
-    constructor(config: AgentIDConfig);
+    constructor(config?: AgentIDConfig);
     private buildClientCapabilities;
     private resolveApiKey;
     private resolveClientEventId;
@@ -94,6 +96,7 @@ declare class AgentID {
     private cacheGuardVerdict;
     getCapabilityConfig(force?: boolean, options?: RequestOptions): Promise<CapabilityConfig>;
     private getCachedCapabilityConfig;
+    private resolveEffectiveStrictMode;
     prepareInputForDispatch(params: {
         input: string;
         systemId: string;

package/dist/{langchain-BykeB2WB.d.ts → langchain-DJDqqpbT.d.ts}

@@ -2,6 +2,8 @@ import { BaseCallbackHandler } from '@langchain/core/callbacks/base';
 
 type CapabilityConfig = {
     shadow_mode: boolean;
+    strict_security_mode: boolean;
+    failure_mode: "fail_open" | "fail_close";
     block_pii_leakage: boolean;
     block_db_access: boolean;
     block_code_execution: boolean;
@@ -58,7 +60,7 @@ interface LogParams {
     };
 }
 type AgentIDConfig = {
-    apiKey: string;
+    apiKey?: string;
     baseUrl?: string;
     piiMasking?: boolean;
     checkInjection?: boolean;
@@ -85,7 +87,7 @@ declare class AgentID {
     private localEnforcer;
     private injectionScanner;
     private recentGuardVerdicts;
-    constructor(config: AgentIDConfig);
+    constructor(config?: AgentIDConfig);
     private buildClientCapabilities;
     private resolveApiKey;
     private resolveClientEventId;
@@ -94,6 +96,7 @@ declare class AgentID {
     private cacheGuardVerdict;
     getCapabilityConfig(force?: boolean, options?: RequestOptions): Promise<CapabilityConfig>;
     private getCachedCapabilityConfig;
+    private resolveEffectiveStrictMode;
     prepareInputForDispatch(params: {
         input: string;
         systemId: string;

package/dist/langchain.d.mts

@@ -1,2 +1,2 @@
 import '@langchain/core/callbacks/base';
-export { a as AgentIDCallbackHandler } from './langchain-BykeB2WB.mjs';
+export { a as AgentIDCallbackHandler } from './langchain-DJDqqpbT.mjs';

package/dist/langchain.d.ts

@@ -1,2 +1,2 @@
 import '@langchain/core/callbacks/base';
-export { a as AgentIDCallbackHandler } from './langchain-BykeB2WB.js';
+export { a as AgentIDCallbackHandler } from './langchain-DJDqqpbT.js';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentid-sdk",
-  "version": "0.1.18",
+  "version": "0.1.19",
   "description": "AgentID JavaScript/TypeScript SDK for guard, ingest, tracing, and analytics.",
   "license": "MIT",
   "homepage": "https://agentid.ai",