cognia-sdk 0.1.3 → 0.1.4

package/dist/cjs/client.js

@@ -74,24 +74,59 @@ class Cognia {
         this.f = o.fetch ?? fetch;
         this.onError = o.onError;
     }
+    /** Every string that reaches the host through an error or a reason has the bearer removed first (independent E2E F28). */
+    scrub(v, token) {
+        if (!token || token.length < 8)
+            return v;
+        const re = new RegExp(token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g");
+        const walk = (x) => {
+            if (typeof x === "string")
+                return x.replace(re, "[redacted]");
+            if (Array.isArray(x))
+                return x.map(walk);
+            if (x && typeof x === "object") {
+                const o = {};
+                for (const [k, val] of Object.entries(x))
+                    o[k] = walk(val);
+                return o;
+            }
+            return x;
+        };
+        return walk(v);
+    }
     async call(method, path, body, timeoutMs) {
         const ac = new AbortController();
-        const t = timeoutMs ? setTimeout(() => ac.abort(), timeoutMs) : null;
+        let timedOut = false;
+        const t = timeoutMs ? setTimeout(() => { timedOut = true; ac.abort(); }, timeoutMs) : null;
+        let token = null;
         try {
-            // delegated auth: the provider is asked on EVERY request; its answer is used once and never stored on the client
-            const token = this.tokenProvider ? await this.tokenProvider() : this.key;
+            // delegated auth: the provider is asked on EVERY request, INSIDE the same deadline as the request itself (independent
+            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client
+            const deadline = new Promise((_, reject) => { if (timeoutMs)
+                setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
+            token = this.tokenProvider ? await (timeoutMs ? Promise.race([Promise.resolve(this.tokenProvider()), deadline]) : this.tokenProvider()) : this.key;
             if (!token)
                 throw new CogniaError(`Cognia ${method} ${path} → no credential`, 0, null);
-            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.3" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
+            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.4" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
             let j = null;
             try {
                 j = await r.json();
             }
             catch { /* no body */ }
             if (!r.ok)
-                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, j);
+                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, this.scrub(j, token));
             return j;
         }
+        catch (e) {
+            // whatever the transport or the provider threw: the bearer never travels inside the error. A fresh error is built
+            // (a DOMException's message is read-only), keeping the name, status and a scrubbed body.
+            const src = e instanceof Error ? e : new Error(String(e));
+            const msg = token ? this.scrub(src.message, token) : src.message;
+            const out = src instanceof CogniaError ? new CogniaError(msg, src.status, token ? this.scrub(src.body, token) : src.body) : Object.assign(new Error(msg), { name: src.name });
+            if (timedOut)
+                out.name = "AbortError";
+            throw out;
+        }
         finally {
             if (t)
                 clearTimeout(t);

package/dist/esm/client.d.ts

@@ -40,6 +40,8 @@ export declare class Cognia {
     private readonly f;
     private readonly onError;
     constructor(o: CogniaOptions);
+    /** Every string that reaches the host through an error or a reason has the bearer removed first (independent E2E F28). */
+    private scrub;
     private call;
     /**
      * The Memories and Skills this identity may use for `task`, or an explicit ABSTAIN. Never throws: on a timeout or a

package/dist/esm/client.js

@@ -69,24 +69,59 @@ export class Cognia {
         this.f = o.fetch ?? fetch;
         this.onError = o.onError;
     }
+    /** Every string that reaches the host through an error or a reason has the bearer removed first (independent E2E F28). */
+    scrub(v, token) {
+        if (!token || token.length < 8)
+            return v;
+        const re = new RegExp(token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g");
+        const walk = (x) => {
+            if (typeof x === "string")
+                return x.replace(re, "[redacted]");
+            if (Array.isArray(x))
+                return x.map(walk);
+            if (x && typeof x === "object") {
+                const o = {};
+                for (const [k, val] of Object.entries(x))
+                    o[k] = walk(val);
+                return o;
+            }
+            return x;
+        };
+        return walk(v);
+    }
     async call(method, path, body, timeoutMs) {
         const ac = new AbortController();
-        const t = timeoutMs ? setTimeout(() => ac.abort(), timeoutMs) : null;
+        let timedOut = false;
+        const t = timeoutMs ? setTimeout(() => { timedOut = true; ac.abort(); }, timeoutMs) : null;
+        let token = null;
         try {
-            // delegated auth: the provider is asked on EVERY request; its answer is used once and never stored on the client
-            const token = this.tokenProvider ? await this.tokenProvider() : this.key;
+            // delegated auth: the provider is asked on EVERY request, INSIDE the same deadline as the request itself (independent
+            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client
+            const deadline = new Promise((_, reject) => { if (timeoutMs)
+                setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
+            token = this.tokenProvider ? await (timeoutMs ? Promise.race([Promise.resolve(this.tokenProvider()), deadline]) : this.tokenProvider()) : this.key;
             if (!token)
                 throw new CogniaError(`Cognia ${method} ${path} → no credential`, 0, null);
-            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.3" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
+            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.4" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
             let j = null;
             try {
                 j = await r.json();
             }
             catch { /* no body */ }
             if (!r.ok)
-                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, j);
+                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, this.scrub(j, token));
             return j;
         }
+        catch (e) {
+            // whatever the transport or the provider threw: the bearer never travels inside the error. A fresh error is built
+            // (a DOMException's message is read-only), keeping the name, status and a scrubbed body.
+            const src = e instanceof Error ? e : new Error(String(e));
+            const msg = token ? this.scrub(src.message, token) : src.message;
+            const out = src instanceof CogniaError ? new CogniaError(msg, src.status, token ? this.scrub(src.body, token) : src.body) : Object.assign(new Error(msg), { name: src.name });
+            if (timedOut)
+                out.name = "AbortError";
+            throw out;
+        }
         finally {
             if (t)
                 clearTimeout(t);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognia-sdk",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Cognia for your model calls: one line gives any agent the Memories and Skills it may use, with provenance and honest receipts. Fails open.",
   "license": "MIT",
   "author": "Cognia",