cognia-sdk 0.1.3 → 0.1.5

package/dist/cjs/client.js

@@ -74,24 +74,85 @@ class Cognia {
         this.f = o.fetch ?? fetch;
         this.onError = o.onError;
     }
+    /** Every string that reaches the host through an error or a reason has the bearer removed first (independent E2E F28). */
+    scrub(v, token) {
+        if (!token || token.length < 8)
+            return v;
+        const re = new RegExp(token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g");
+        const walk = (x) => {
+            if (typeof x === "string")
+                return x.replace(re, "[redacted]");
+            if (Array.isArray(x))
+                return x.map(walk);
+            if (x && typeof x === "object") {
+                const o = {};
+                for (const [k, val] of Object.entries(x))
+                    o[k] = walk(val);
+                return o;
+            }
+            return x;
+        };
+        return walk(v);
+    }
     async call(method, path, body, timeoutMs) {
         const ac = new AbortController();
-        const t = timeoutMs ? setTimeout(() => ac.abort(), timeoutMs) : null;
+        let timedOut = false;
+        const t = timeoutMs ? setTimeout(() => { timedOut = true; ac.abort(); }, timeoutMs) : null;
+        let token = null;
         try {
-            // delegated auth: the provider is asked on EVERY request; its answer is used once and never stored on the client
-            const token = this.tokenProvider ? await this.tokenProvider() : this.key;
+            // delegated auth: the provider is asked on EVERY request, INSIDE the same deadline as the request itself (independent
+            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client.
+            // The deadline exists only while a provider is pending and is always observed (F30: an unobserved rejection in the
+            // apiKey path crashed the host process). A provider failure is reported WITHOUT its message (F28: the SDK cannot
+            // scrub a bearer it never received) — the host owns that error and can log it itself.
+            if (this.tokenProvider) {
+                let dt = null;
+                const provider = new Promise((resolve, reject) => { try {
+                    resolve(this.tokenProvider());
+                }
+                catch (e) {
+                    reject(e);
+                } });
+                const deadline = new Promise((_, reject) => { if (timeoutMs)
+                    dt = setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
+                deadline.catch(() => undefined); // never an unhandled rejection
+                try {
+                    token = await (timeoutMs ? Promise.race([provider, deadline]) : provider);
+                }
+                catch (e) {
+                    if (e?.name === "AbortError")
+                        throw e;
+                    throw new CogniaError(`Cognia ${method} ${path} → token provider failed`, 0, null);
+                }
+                finally {
+                    if (dt)
+                        clearTimeout(dt);
+                }
+            }
+            else
+                token = this.key;
             if (!token)
                 throw new CogniaError(`Cognia ${method} ${path} → no credential`, 0, null);
-            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.3" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
+            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.5" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
             let j = null;
             try {
                 j = await r.json();
             }
             catch { /* no body */ }
             if (!r.ok)
-                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, j);
+                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, this.scrub(j, token));
             return j;
         }
+        catch (e) {
+            // whatever the transport or the provider threw: the bearer never travels inside the error. A fresh error is built
+            // (a DOMException's message is read-only), keeping the name, status and a scrubbed body.
+            const src = e instanceof Error ? e : new Error(String(e));
+            const msg = token ? this.scrub(src.message, token) : src.message;
+            const out = src instanceof CogniaError ? new CogniaError(msg, src.status, token ? this.scrub(src.body, token) : src.body) : Object.assign(new Error(msg), { name: src.name });
+            if (timedOut)
+                out.name = "AbortError";
+            throw out;
+        }
         finally {
             if (t)
                 clearTimeout(t);

package/dist/esm/client.d.ts

@@ -40,6 +40,8 @@ export declare class Cognia {
     private readonly f;
     private readonly onError;
     constructor(o: CogniaOptions);
+    /** Every string that reaches the host through an error or a reason has the bearer removed first (independent E2E F28). */
+    private scrub;
     private call;
     /**
      * The Memories and Skills this identity may use for `task`, or an explicit ABSTAIN. Never throws: on a timeout or a

package/dist/esm/client.js

@@ -69,24 +69,85 @@ export class Cognia {
         this.f = o.fetch ?? fetch;
         this.onError = o.onError;
     }
+    /** Every string that reaches the host through an error or a reason has the bearer removed first (independent E2E F28). */
+    scrub(v, token) {
+        if (!token || token.length < 8)
+            return v;
+        const re = new RegExp(token.replace(/[.*+?^${}()|[\]\\]/g, "\\$&"), "g");
+        const walk = (x) => {
+            if (typeof x === "string")
+                return x.replace(re, "[redacted]");
+            if (Array.isArray(x))
+                return x.map(walk);
+            if (x && typeof x === "object") {
+                const o = {};
+                for (const [k, val] of Object.entries(x))
+                    o[k] = walk(val);
+                return o;
+            }
+            return x;
+        };
+        return walk(v);
+    }
     async call(method, path, body, timeoutMs) {
         const ac = new AbortController();
-        const t = timeoutMs ? setTimeout(() => ac.abort(), timeoutMs) : null;
+        let timedOut = false;
+        const t = timeoutMs ? setTimeout(() => { timedOut = true; ac.abort(); }, timeoutMs) : null;
+        let token = null;
         try {
-            // delegated auth: the provider is asked on EVERY request; its answer is used once and never stored on the client
-            const token = this.tokenProvider ? await this.tokenProvider() : this.key;
+            // delegated auth: the provider is asked on EVERY request, INSIDE the same deadline as the request itself (independent
+            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client.
+            // The deadline exists only while a provider is pending and is always observed (F30: an unobserved rejection in the
+            // apiKey path crashed the host process). A provider failure is reported WITHOUT its message (F28: the SDK cannot
+            // scrub a bearer it never received) — the host owns that error and can log it itself.
+            if (this.tokenProvider) {
+                let dt = null;
+                const provider = new Promise((resolve, reject) => { try {
+                    resolve(this.tokenProvider());
+                }
+                catch (e) {
+                    reject(e);
+                } });
+                const deadline = new Promise((_, reject) => { if (timeoutMs)
+                    dt = setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
+                deadline.catch(() => undefined); // never an unhandled rejection
+                try {
+                    token = await (timeoutMs ? Promise.race([provider, deadline]) : provider);
+                }
+                catch (e) {
+                    if (e?.name === "AbortError")
+                        throw e;
+                    throw new CogniaError(`Cognia ${method} ${path} → token provider failed`, 0, null);
+                }
+                finally {
+                    if (dt)
+                        clearTimeout(dt);
+                }
+            }
+            else
+                token = this.key;
             if (!token)
                 throw new CogniaError(`Cognia ${method} ${path} → no credential`, 0, null);
-            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.3" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
+            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.5" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
             let j = null;
             try {
                 j = await r.json();
             }
             catch { /* no body */ }
             if (!r.ok)
-                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, j);
+                throw new CogniaError(`Cognia ${method} ${path} → ${r.status}`, r.status, this.scrub(j, token));
             return j;
         }
+        catch (e) {
+            // whatever the transport or the provider threw: the bearer never travels inside the error. A fresh error is built
+            // (a DOMException's message is read-only), keeping the name, status and a scrubbed body.
+            const src = e instanceof Error ? e : new Error(String(e));
+            const msg = token ? this.scrub(src.message, token) : src.message;
+            const out = src instanceof CogniaError ? new CogniaError(msg, src.status, token ? this.scrub(src.body, token) : src.body) : Object.assign(new Error(msg), { name: src.name });
+            if (timedOut)
+                out.name = "AbortError";
+            throw out;
+        }
         finally {
             if (t)
                 clearTimeout(t);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognia-sdk",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Cognia for your model calls: one line gives any agent the Memories and Skills it may use, with provenance and honest receipts. Fails open.",
   "license": "MIT",
   "author": "Cognia",