agentid-sdk 0.1.18 → 0.1.20

package/dist/index.d.mts

@@ -1,4 +1,4 @@
-export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions } from './langchain-BykeB2WB.mjs';
+export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions, S as SecurityBlockError } from './langchain-BipmisU1.mjs';
 import '@langchain/core/callbacks/base';
 
 type PIIMapping = Record<string, string>;

package/dist/index.d.ts

@@ -1,4 +1,4 @@
-export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions } from './langchain-BykeB2WB.js';
+export { A as AgentID, a as AgentIDCallbackHandler, G as GuardParams, b as GuardResponse, L as LogParams, P as PreparedInput, R as RequestOptions, S as SecurityBlockError } from './langchain-BipmisU1.js';
 import '@langchain/core/callbacks/base';
 
 type PIIMapping = Record<string, string>;

package/dist/index.js

@@ -35,6 +35,7 @@ __export(index_exports, {
   InjectionScanner: () => InjectionScanner,
   OpenAIAdapter: () => OpenAIAdapter,
   PIIManager: () => PIIManager,
+  SecurityBlockError: () => SecurityBlockError,
   getInjectionScanner: () => getInjectionScanner,
   scanWithRegex: () => scanWithRegex
 });
@@ -84,7 +85,7 @@ var OpenAIAdapter = class {
 
 // src/sdk-version.ts
 var FALLBACK_SDK_VERSION = "js-0.0.0-dev";
-var AGENTID_SDK_VERSION_HEADER = "js-0.1.18".trim().length > 0 ? "js-0.1.18" : FALLBACK_SDK_VERSION;
+var AGENTID_SDK_VERSION_HEADER = "js-0.1.20".trim().length > 0 ? "js-0.1.20" : FALLBACK_SDK_VERSION;
 
 // src/pii-national-identifiers.ts
 var MAX_CANDIDATES_PER_RULE = 256;
@@ -1115,12 +1116,14 @@ var PIIManager = class {
 };
 
 // src/local-security-enforcer.ts
-var DEFAULT_STRICT_CONFIG = {
+var DEFAULT_FAIL_OPEN_CONFIG = {
   shadow_mode: false,
-  block_pii_leakage: true,
-  block_db_access: true,
-  block_code_execution: true,
-  block_toxicity: true
+  strict_security_mode: false,
+  failure_mode: "fail_open",
+  block_pii_leakage: false,
+  block_db_access: false,
+  block_code_execution: false,
+  block_toxicity: false
 };
 var SQL_DATABASE_ACCESS_PATTERN = /\b(SELECT|INSERT|UPDATE|DELETE|DROP|UNION|ALTER)\b[\s\S]+?\b(FROM|INTO|TABLE|DATABASE|VIEW|INDEX)\b/i;
 var PYTHON_GENERAL_RCE_PATTERN = /(import\s+(os|sys|subprocess)|from\s+(os|sys|subprocess)\s+import|exec\s*\(|eval\s*\(|__import__)/i;
@@ -1243,13 +1246,28 @@ function readOptionalBooleanField(body, key, fallback) {
   }
   throw new Error(`Invalid config field: ${key}`);
 }
+function readOptionalFailureModeField(body, fallback) {
+  const value = body.failure_mode;
+  if (value === "fail_open" || value === "fail_close") {
+    return value;
+  }
+  return fallback;
+}
 function normalizeCapabilityConfig(payload) {
   if (!payload || typeof payload !== "object") {
     throw new Error("Invalid config payload");
   }
   const body = payload;
+  const strictSecurityMode = readOptionalBooleanField(body, "strict_security_mode", false);
+  const failureMode = readOptionalFailureModeField(
+    body,
+    strictSecurityMode ? "fail_close" : "fail_open"
+  );
+  const effectiveStrictMode = strictSecurityMode || failureMode === "fail_close";
   return {
     shadow_mode: readOptionalBooleanField(body, "shadow_mode", false),
+    strict_security_mode: effectiveStrictMode,
+    failure_mode: effectiveStrictMode ? "fail_close" : "fail_open",
     block_pii_leakage: readBooleanField(body, "block_pii_leakage", "block_pii"),
     block_db_access: readBooleanField(body, "block_db_access", "block_db"),
     block_code_execution: readBooleanField(
@@ -1353,7 +1371,7 @@ async function fetchCapabilityConfigWithTimeout(params) {
 function getCachedCapabilityConfig(params) {
   const key = getCacheKey(params.apiKey, params.baseUrl);
   const entry = getGlobalCache().get(key);
-  return entry?.config ?? DEFAULT_STRICT_CONFIG;
+  return entry?.config ?? DEFAULT_FAIL_OPEN_CONFIG;
 }
 async function ensureCapabilityConfig(params) {
   const ttlMs = params.ttlMs ?? CONFIG_TTL_MS;
@@ -1382,14 +1400,15 @@ async function ensureCapabilityConfig(params) {
     return resolved;
   }).catch((error) => {
     const message = error instanceof Error ? error.message : String(error);
-    console.warn("AgentID Config unreachable. Defaulting to STRICT MODE.", message);
+    const fallbackConfig = existing?.config ?? DEFAULT_FAIL_OPEN_CONFIG;
+    console.warn("AgentID Config unreachable. Defaulting to FAIL-OPEN MODE.", message);
     cache.set(key, {
-      config: DEFAULT_STRICT_CONFIG,
+      config: fallbackConfig,
       expiresAt: Date.now() + ttlMs,
       promise: null
     });
     enforceCacheBound(cache);
-    return DEFAULT_STRICT_CONFIG;
+    return fallbackConfig;
   }).finally(() => {
     const latest = cache.get(key);
     if (!latest) {
@@ -1405,7 +1424,7 @@ async function ensureCapabilityConfig(params) {
     }
   });
   cache.set(key, {
-    config: existing?.config ?? DEFAULT_STRICT_CONFIG,
+    config: existing?.config ?? DEFAULT_FAIL_OPEN_CONFIG,
     expiresAt: existing?.expiresAt ?? 0,
     promise: pending
   });
@@ -1809,6 +1828,9 @@ function getInjectionScanner() {
 var DEFAULT_GUARD_TIMEOUT_MS = 1e4;
 var MIN_GUARD_TIMEOUT_MS = 500;
 var MAX_GUARD_TIMEOUT_MS = 15e3;
+var DEFAULT_INGEST_TIMEOUT_MS = 1e4;
+var MIN_INGEST_TIMEOUT_MS = 500;
+var MAX_INGEST_TIMEOUT_MS = 15e3;
 var GUARD_MAX_ATTEMPTS = 3;
 var GUARD_RETRY_DELAYS_MS = [250, 500];
 var INGEST_MAX_ATTEMPTS = 3;
@@ -1878,6 +1900,28 @@ function normalizeGuardTimeoutMs(value) {
   }
   return rounded;
 }
+function normalizeIngestTimeoutMs(value) {
+  if (!Number.isFinite(value)) {
+    return DEFAULT_INGEST_TIMEOUT_MS;
+  }
+  const rounded = Math.trunc(value);
+  if (rounded < MIN_INGEST_TIMEOUT_MS) {
+    return MIN_INGEST_TIMEOUT_MS;
+  }
+  if (rounded > MAX_INGEST_TIMEOUT_MS) {
+    return MAX_INGEST_TIMEOUT_MS;
+  }
+  return rounded;
+}
+function resolveConfiguredApiKey(value) {
+  const explicit = typeof value === "string" ? value.trim() : "";
+  const fromEnv = globalThis.process?.env?.AGENTID_API_KEY ?? "";
+  const resolved = explicit || fromEnv.trim();
+  if (!resolved) {
+    throw new Error("AgentID API key missing. Pass apiKey or set AGENTID_API_KEY.");
+  }
+  return resolved;
+}
 function isInfrastructureGuardReason(reason) {
   if (!reason) return false;
   return reason === "system_failure" || reason === "system_failure_db_unavailable" || reason === "logging_failed" || reason === "server_error" || reason === "guard_unreachable" || reason === "api_key_pepper_missing" || reason === "encryption_key_missing";
@@ -1994,11 +2038,18 @@ function createCompletionChunkCollector() {
     result
   };
 }
+var SecurityBlockError = class extends Error {
+  constructor(reason = "guard_denied") {
+    super(`AgentID: Security Blocked (${reason})`);
+    this.name = "SecurityBlockError";
+    this.reason = reason;
+  }
+};
 var AgentID = class {
-  constructor(config) {
+  constructor(config = {}) {
     this.injectionScanner = getInjectionScanner();
     this.recentGuardVerdicts = /* @__PURE__ */ new Map();
-    this.apiKey = config.apiKey.trim();
+    this.apiKey = resolveConfiguredApiKey(config.apiKey);
     this.baseUrl = normalizeBaseUrl3(config.baseUrl ?? "https://app.getagentid.com/api/v1");
     this.piiMasking = Boolean(config.piiMasking);
     this.checkInjection = config.checkInjection !== false;
@@ -2006,6 +2057,7 @@ var AgentID = class {
     this.storePii = config.storePii === true;
     this.strictMode = config.strictMode === true;
     this.guardTimeoutMs = normalizeGuardTimeoutMs(config.guardTimeoutMs);
+    this.ingestTimeoutMs = normalizeIngestTimeoutMs(config.ingestTimeoutMs);
     this.pii = new PIIManager();
     this.localEnforcer = new LocalSecurityEnforcer(this.pii);
     void this.getCapabilityConfig();
@@ -2089,6 +2141,13 @@ var AgentID = class {
       baseUrl: this.baseUrl
     });
   }
+  async resolveEffectiveStrictMode(options) {
+    if (this.strictMode) {
+      return true;
+    }
+    const config = await this.getCapabilityConfig(false, options);
+    return config.strict_security_mode || config.failure_mode === "fail_close";
+  }
   async prepareInputForDispatch(params, options) {
     const effectiveApiKey = this.resolveApiKey(options?.apiKey);
     if (this.checkInjection && !params.skipInjectionScan && params.input) {
@@ -2227,6 +2286,9 @@ var AgentID = class {
    */
   async guard(params, options) {
     const effectiveApiKey = this.resolveApiKey(options?.apiKey);
+    const effectiveStrictMode = await this.resolveEffectiveStrictMode({
+      apiKey: effectiveApiKey
+    });
     const payload = {
       ...params,
       client_capabilities: params.client_capabilities ?? this.buildClientCapabilities()
@@ -2265,7 +2327,7 @@ var AgentID = class {
               await waitForRetry(attempt);
               continue;
             }
-            if (this.strictMode) {
+            if (effectiveStrictMode) {
               console.warn(
                 `[AgentID] Guard API infrastructure failure in strict mode (${verdict.reason ?? `http_${res.status}`}). Blocking request.`
               );
@@ -2312,13 +2374,13 @@ var AgentID = class {
             guardParams: params,
             apiKey: effectiveApiKey
           });
-          if (this.strictMode) {
+          if (effectiveStrictMode) {
             return { allowed: false, reason: "network_error_strict_mode" };
           }
           return { allowed: true, reason: "timeout_fallback" };
         }
         console.warn(
-          this.strictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
+          effectiveStrictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
           error
         );
         this.logGuardFallback({
@@ -2327,7 +2389,7 @@ var AgentID = class {
           guardParams: params,
           apiKey: effectiveApiKey
         });
-        if (this.strictMode) {
+        if (effectiveStrictMode) {
           return { allowed: false, reason: "network_error_strict_mode" };
         }
         return { allowed: true, reason: "guard_unreachable" };
@@ -2336,22 +2398,22 @@ var AgentID = class {
       }
     }
     if (lastAbort) {
-      if (this.strictMode) {
+      if (effectiveStrictMode) {
         return { allowed: false, reason: "network_error_strict_mode" };
       }
       return { allowed: true, reason: "timeout_fallback" };
     }
     if (typeof lastStatusCode === "number" && lastStatusCode >= 500) {
-      if (this.strictMode) {
+      if (effectiveStrictMode) {
         return { allowed: false, reason: "server_error" };
       }
       return { allowed: true, reason: "system_failure_fail_open" };
     }
     console.warn(
-      this.strictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
+      effectiveStrictMode ? "[AgentID] Guard check failed (Strict mode active):" : "[AgentID] Guard check failed (Fail-Open active):",
       lastError
     );
-    if (this.strictMode) {
+    if (effectiveStrictMode) {
       return { allowed: false, reason: "network_error_strict_mode" };
     }
     return { allowed: true, reason: "guard_unreachable" };
@@ -2377,6 +2439,8 @@ var AgentID = class {
       client_capabilities: params.client_capabilities ?? this.buildClientCapabilities()
     };
     for (let attempt = 0; attempt < INGEST_MAX_ATTEMPTS; attempt += 1) {
+      const controller = new AbortController();
+      const timeoutId = setTimeout(() => controller.abort(), this.ingestTimeoutMs);
       try {
         const response = await fetch(`${this.baseUrl}/ingest`, {
           method: "POST",
@@ -2386,7 +2450,8 @@ var AgentID = class {
             "x-agentid-api-key": effectiveApiKey,
             "X-AgentID-SDK-Version": AGENTID_SDK_VERSION_HEADER
           },
-          body: JSON.stringify(payload)
+          body: JSON.stringify(payload),
+          signal: controller.signal
         });
         const responseBody = await safeReadJson2(response);
         if (response.ok) {
@@ -2402,12 +2467,17 @@ var AgentID = class {
           continue;
         }
         return { ok: false, status: response.status, reason };
-      } catch {
+      } catch (error) {
+        const isAbortError2 = Boolean(
+          error && typeof error === "object" && error.name === "AbortError"
+        );
         if (attempt < INGEST_MAX_ATTEMPTS - 1) {
           await waitForIngestRetry(attempt);
           continue;
         }
-        return { ok: false, status: null, reason: "network_error" };
+        return { ok: false, status: null, reason: isAbortError2 ? "timeout" : "network_error" };
+      } finally {
+        clearTimeout(timeoutId);
       }
     }
     return { ok: false, status: null, reason: "unknown_ingest_failure" };
@@ -2624,9 +2694,7 @@ var AgentID = class {
                   client_capabilities: this.buildClientCapabilities("openai", false)
                 }, requestOptions);
                 if (!verdict.allowed) {
-                  throw new Error(
-                    `AgentID: Security Blocked (${verdict.reason ?? "guard_denied"})`
-                  );
+                  throw new SecurityBlockError(verdict.reason ?? "guard_denied");
                 }
                 const canonicalClientEventId = typeof verdict.client_event_id === "string" && isUuidLike(verdict.client_event_id) ? verdict.client_event_id : clientEventId;
                 const guardEventId = typeof verdict.guard_event_id === "string" && verdict.guard_event_id.length > 0 ? verdict.guard_event_id : null;
@@ -3043,7 +3111,7 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       client_capabilities: this.getLangchainCapabilities()
     }, this.requestOptions);
     if (!verdict.allowed) {
-      throw new Error(`AgentID: Security Blocked (${verdict.reason ?? "guard_denied"})`);
+      throw new SecurityBlockError(verdict.reason ?? "guard_denied");
     }
     const canonicalClientEventId = isUuidLike2(verdict.client_event_id) ? verdict.client_event_id.trim() : requestedClientEventId;
     const guardEventId = typeof verdict.guard_event_id === "string" && verdict.guard_event_id.length > 0 ? verdict.guard_event_id : void 0;
@@ -3094,7 +3162,7 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
       client_capabilities: this.getLangchainCapabilities()
     }, this.requestOptions);
     if (!verdict.allowed) {
-      throw new Error(`AgentID: Security Blocked (${verdict.reason ?? "guard_denied"})`);
+      throw new SecurityBlockError(verdict.reason ?? "guard_denied");
     }
     const canonicalClientEventId = isUuidLike2(verdict.client_event_id) ? verdict.client_event_id.trim() : requestedClientEventId;
     const guardEventId = typeof verdict.guard_event_id === "string" && verdict.guard_event_id.length > 0 ? verdict.guard_event_id : void 0;
@@ -3189,6 +3257,7 @@ var AgentIDCallbackHandler = class extends import_base.BaseCallbackHandler {
   InjectionScanner,
   OpenAIAdapter,
   PIIManager,
+  SecurityBlockError,
   getInjectionScanner,
   scanWithRegex
 });