cognia-sdk 0.1.4 → 0.1.6

package/dist/cjs/client.js

@@ -101,13 +101,40 @@ class Cognia {
         let token = null;
         try {
             // delegated auth: the provider is asked on EVERY request, INSIDE the same deadline as the request itself (independent
-            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client
-            const deadline = new Promise((_, reject) => { if (timeoutMs)
-                setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
-            token = this.tokenProvider ? await (timeoutMs ? Promise.race([Promise.resolve(this.tokenProvider()), deadline]) : this.tokenProvider()) : this.key;
+            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client.
+            // The deadline exists only while a provider is pending and is always observed (F30: an unobserved rejection in the
+            // apiKey path crashed the host process). A provider failure is reported WITHOUT its message (F28: the SDK cannot
+            // scrub a bearer it never received) — the host owns that error and can log it itself.
+            if (this.tokenProvider) {
+                let dt = null;
+                const provider = new Promise((resolve, reject) => { try {
+                    resolve(this.tokenProvider());
+                }
+                catch (e) {
+                    reject(e);
+                } });
+                const deadline = new Promise((_, reject) => { if (timeoutMs)
+                    dt = setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
+                deadline.catch(() => undefined); // never an unhandled rejection
+                try {
+                    token = await (timeoutMs ? Promise.race([provider, deadline]) : provider);
+                }
+                catch (e) {
+                    // never the provider's own object or message (it may carry the bearer): a fresh error either way
+                    if (e?.name === "AbortError")
+                        throw Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" });
+                    throw new CogniaError(`Cognia ${method} ${path} → token provider failed`, 0, null);
+                }
+                finally {
+                    if (dt)
+                        clearTimeout(dt);
+                }
+            }
+            else
+                token = this.key;
             if (!token)
                 throw new CogniaError(`Cognia ${method} ${path} → no credential`, 0, null);
-            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.4" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
+            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.6" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
             let j = null;
             try {
                 j = await r.json();

package/dist/esm/client.js

@@ -96,13 +96,40 @@ export class Cognia {
         let token = null;
         try {
             // delegated auth: the provider is asked on EVERY request, INSIDE the same deadline as the request itself (independent
-            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client
-            const deadline = new Promise((_, reject) => { if (timeoutMs)
-                setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
-            token = this.tokenProvider ? await (timeoutMs ? Promise.race([Promise.resolve(this.tokenProvider()), deadline]) : this.tokenProvider()) : this.key;
+            // E2E F27: a pending provider used to block the host model), and its answer is used once, never stored on the client.
+            // The deadline exists only while a provider is pending and is always observed (F30: an unobserved rejection in the
+            // apiKey path crashed the host process). A provider failure is reported WITHOUT its message (F28: the SDK cannot
+            // scrub a bearer it never received) — the host owns that error and can log it itself.
+            if (this.tokenProvider) {
+                let dt = null;
+                const provider = new Promise((resolve, reject) => { try {
+                    resolve(this.tokenProvider());
+                }
+                catch (e) {
+                    reject(e);
+                } });
+                const deadline = new Promise((_, reject) => { if (timeoutMs)
+                    dt = setTimeout(() => reject(Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" })), timeoutMs); });
+                deadline.catch(() => undefined); // never an unhandled rejection
+                try {
+                    token = await (timeoutMs ? Promise.race([provider, deadline]) : provider);
+                }
+                catch (e) {
+                    // never the provider's own object or message (it may carry the bearer): a fresh error either way
+                    if (e?.name === "AbortError")
+                        throw Object.assign(new Error("tokenProvider timed out"), { name: "AbortError" });
+                    throw new CogniaError(`Cognia ${method} ${path} → token provider failed`, 0, null);
+                }
+                finally {
+                    if (dt)
+                        clearTimeout(dt);
+                }
+            }
+            else
+                token = this.key;
             if (!token)
                 throw new CogniaError(`Cognia ${method} ${path} → no credential`, 0, null);
-            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.4" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
+            const r = await this.f(this.baseUrl + path, { method, headers: { authorization: `Bearer ${token}`, "content-type": "application/json", "user-agent": "cognia-sdk/0.1.6" }, body: body === undefined ? undefined : JSON.stringify(body), signal: ac.signal });
             let j = null;
             try {
                 j = await r.json();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cognia-sdk",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Cognia for your model calls: one line gives any agent the Memories and Skills it may use, with provenance and honest receipts. Fails open.",
   "license": "MIT",
   "author": "Cognia",