What changed in Node SDK 1.2.0

Node SDK 1.2.0 · October 6, 2026

Shadow mode now never blocks a call because of a plan or test limit. There are no breaking API changes: no option, export or result field was removed. Two kinds of shadow calls that 1.1.0 blocked now run, which is what shadow mode promises.

Changed

• A shadow call past your monthly test limit runs. The server answers it as a would-deny (decision: 'deny', reason: 'test_limit_reached', mode: 'shadow') and records it. It counts only toward the safety ceiling. 1.2.0 runs the call: result.allowed and result.wouldDeny are true, result.testLimitReached is true, onTestLimit(result) is called, and a “test limit reached (shadow)” warning is logged. In enforce, the call is still blocked with 429 test_limit_reached. 1.1.0 blocks these shadow calls, so upgrade to get the shadow behaviour.
• New wording for the billing warning. When a live key is refused for billing, the log now says “Ordainer refused this live key because of a billing problem on your account.”, then what the SDK did with the call (unchanged), then how to fix it in the console’s Billing page. What the SDK does with the call still follows billingLapse.

Added

• 429 safety_limit_reached lets the call run, in every failMode. Past a safety ceiling of 10 times your monthly test limit, the server answers shadow calls with 429 safety_limit_reached until the start of next month (UTC). That’s an error, not a decision: nothing is counted or recorded. 1.2.0 runs the call: result.allowed: true and the new field result.safetyLimited: true (failOpen and rejected stay false), with result.error.limitScope: 'org_safety', result.resetsAt and result.retryAfterSec. It logs a warning (throttled like the others) and calls the new hook onSafetyLimit(result). New export: SAFETY_LIMIT_CODE. 1.1.0 blocks these calls.
• A clear log line when the base URL’s host doesn’t resolve. On ENOTFOUND or EAI_AGAIN, the first failure for each host logs one error-level line naming the host and telling you to set ORDAINER_BASE_URL. It isn’t held back by the warning throttle. failMode still applies (default open). New field: result.error.dnsCode. logger may now have an optional error(msg).

Types

DecideResult.safetyLimited, error.limitScope: 'org_safety', error.dnsCode, OrdainerOptions.onSafetyLimit, the optional logger.error, and SAFETY_LIMIT_CODE.

How to upgrade

Install the latest version from npm:

npm install ordainer@1.2.4

npm replaces your current version in package.json. You need Node 20 or later. No code changes are required.

Check these after you upgrade:

• Shadow mode at the test limit. If anything relied on 1.1.0 blocking shadow calls past the test limit, those calls now run, logged as would-denies. To stop calls at the limit, use enforce.
• Log filters and alerts. If you match the billing warning’s text, update the match to the new wording. If you route logger.error, the new base URL line goes there.
• failMode: 'closed'. It doesn’t block a 429 safety_limit_reached: those calls run.

Coming from 1.1.0 or earlier? The full history, including the 1.1.0 changes (retries defaults to 1, sticky deny and the billingLapse setting), is in the package’s CHANGELOG.md, which ships inside the SDK.