@armoriq/sdk-dev 0.0.1

package/dist/client.js

@@ -0,0 +1,858 @@
+"use strict";
+/**
+ * ArmorIQ SDK Client - Main entry point for SDK usage.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ArmorIQClient = void 0;
+const axios_1 = __importDefault(require("axios"));
+const crypto = __importStar(require("crypto"));
+const models_1 = require("./models");
+const exceptions_1 = require("./exceptions");
+/**
+ * Main client for ArmorIQ SDK.
+ *
+ * Provides high-level APIs for:
+ * - Plan capture and canonicalization
+ * - Intent token management
+ * - MCP action invocation
+ * - Agent delegation
+ */
+class ArmorIQClient {
+    // Production endpoints (default) - ArmorIQ platform
+    static DEFAULT_IAP_ENDPOINT = 'https://iap.armoriq.io';
+    static DEFAULT_PROXY_ENDPOINT = 'https://cloud-run-proxy.armoriq.io';
+    static DEFAULT_BACKEND_ENDPOINT = 'https://staging-api.armoriq.io';
+    // ArmorClaw standalone product endpoints
+    static ARMORCLAW_IAP_ENDPOINT = 'https://iap.armorclaw.io';
+    static ARMORCLAW_PROXY_ENDPOINT = 'https://proxy.armorclaw.io';
+    static ARMORCLAW_BACKEND_ENDPOINT = 'https://api.armorclaw.io';
+    // Local development endpoints - ArmorIQ platform
+    static LOCAL_IAP_ENDPOINT = 'http://127.0.0.1:8000';
+    static LOCAL_PROXY_ENDPOINT = 'http://127.0.0.1:3001';
+    static LOCAL_BACKEND_ENDPOINT = 'http://127.0.0.1:3000';
+    // Local development endpoints - ArmorClaw standalone
+    static LOCAL_ARMORCLAW_IAP_ENDPOINT = 'http://127.0.0.1:8080';
+    static LOCAL_ARMORCLAW_PROXY_ENDPOINT = 'http://127.0.0.1:3001';
+    static LOCAL_ARMORCLAW_BACKEND_ENDPOINT = 'http://127.0.0.1:8081';
+    iapEndpoint;
+    defaultProxyEndpoint;
+    backendEndpoint;
+    proxyEndpoints;
+    userId;
+    agentId;
+    contextId;
+    apiKey;
+    timeout;
+    maxRetries;
+    verifySsl;
+    httpClient;
+    tokenCache;
+    metadataCache;
+    constructor(options = {}) {
+        // Determine if using production based on environment
+        const envMode = process.env.ARMORIQ_ENV?.toLowerCase() || 'production';
+        const useProd = (options.useProduction ?? true) && envMode === 'production';
+        // Resolve API key early to determine product routing
+        const resolvedApiKey = options.apiKey || process.env.ARMORIQ_API_KEY || '';
+        const isArmorClaw = resolvedApiKey.startsWith('ak_claw_');
+        // Route endpoints based on API key prefix (Stripe pattern)
+        // ak_claw_ → ArmorClaw standalone, ak_live_ → ArmorIQ platform, ak_test_ → sandbox
+        this.iapEndpoint =
+            options.iapEndpoint ||
+                process.env.IAP_ENDPOINT ||
+                (isArmorClaw
+                    ? (useProd ? ArmorIQClient.ARMORCLAW_IAP_ENDPOINT : ArmorIQClient.LOCAL_ARMORCLAW_IAP_ENDPOINT)
+                    : (useProd ? ArmorIQClient.DEFAULT_IAP_ENDPOINT : ArmorIQClient.LOCAL_IAP_ENDPOINT));
+        this.defaultProxyEndpoint =
+            options.proxyEndpoint ||
+                process.env.PROXY_ENDPOINT ||
+                (isArmorClaw
+                    ? (useProd ? ArmorIQClient.ARMORCLAW_PROXY_ENDPOINT : ArmorIQClient.LOCAL_ARMORCLAW_PROXY_ENDPOINT)
+                    : (useProd ? ArmorIQClient.DEFAULT_PROXY_ENDPOINT : ArmorIQClient.LOCAL_PROXY_ENDPOINT));
+        this.backendEndpoint =
+            options.backendEndpoint ||
+                process.env.BACKEND_ENDPOINT ||
+                (isArmorClaw
+                    ? (useProd ? ArmorIQClient.ARMORCLAW_BACKEND_ENDPOINT : ArmorIQClient.LOCAL_ARMORCLAW_BACKEND_ENDPOINT)
+                    : (useProd ? ArmorIQClient.DEFAULT_BACKEND_ENDPOINT : ArmorIQClient.LOCAL_BACKEND_ENDPOINT));
+        // Load user/agent identifiers
+        this.userId = options.userId || process.env.USER_ID || '';
+        this.agentId = options.agentId || process.env.AGENT_ID || '';
+        this.contextId = options.contextId || process.env.CONTEXT_ID || 'default';
+        this.apiKey = options.apiKey || process.env.ARMORIQ_API_KEY || '';
+        // Validate required config
+        if (!this.apiKey) {
+            throw new exceptions_1.ConfigurationException('API key is required for Customer SDK. ' +
+                'Set ARMORIQ_API_KEY environment variable or pass apiKey parameter. ' +
+                'Get your API key from https://platform.armoriq.ai/dashboard/api-keys');
+        }
+        // Validate API key format
+        if (!this.apiKey.startsWith('ak_live_') && !this.apiKey.startsWith('ak_test_') && !this.apiKey.startsWith('ak_claw_')) {
+            throw new exceptions_1.ConfigurationException("Invalid API key format. API keys must start with 'ak_live_', 'ak_claw_', or 'ak_test_'. " +
+                'Get your API key from https://platform.armoriq.ai/dashboard/api-keys');
+        }
+        if (!this.userId) {
+            throw new exceptions_1.ConfigurationException('userId is required (set USER_ID env var)');
+        }
+        if (!this.agentId) {
+            throw new exceptions_1.ConfigurationException('agentId is required (set AGENT_ID env var)');
+        }
+        this.proxyEndpoints = options.proxyEndpoints || {};
+        this.timeout = options.timeout || 30000;
+        this.maxRetries = options.maxRetries || 3;
+        this.verifySsl = options.verifySsl ?? true;
+        // Initialize HTTP client
+        const headers = {
+            'User-Agent': `ArmorIQ-SDK-TS/0.2.6 (agent=${this.agentId})`,
+        };
+        if (this.apiKey) {
+            headers['Authorization'] = `Bearer ${this.apiKey}`;
+        }
+        this.httpClient = axios_1.default.create({
+            timeout: this.timeout,
+            headers,
+            validateStatus: () => true, // Handle all status codes manually
+        });
+        this.tokenCache = new Map();
+        this.metadataCache = new Map();
+        console.log(`ArmorIQ SDK initialized: mode=${useProd ? 'production' : 'development'}, ` +
+            `user=${this.userId}, agent=${this.agentId}, ` +
+            `iap=${this.iapEndpoint}, proxy=${this.defaultProxyEndpoint}, ` +
+            `backend=${this.backendEndpoint}, ` +
+            `api_key=${'***' + this.apiKey.slice(-8)}`);
+        // Validate API key on initialization
+        this.validateApiKey();
+    }
+    /**
+     * Get the default proxy endpoint URL.
+     */
+    get proxyEndpoint() {
+        return this.defaultProxyEndpoint;
+    }
+    /**
+     * Validate API key with the proxy server.
+     */
+    async validateApiKey() {
+        try {
+            const response = await this.httpClient.get(`${this.proxyEndpoint}/health`, {
+                headers: { 'X-API-Key': this.apiKey },
+                timeout: 5000,
+            });
+            if (response.status === 401) {
+                throw new exceptions_1.ConfigurationException('Invalid API key. Please check your API key at https://platform.armoriq.ai/dashboard/api-keys');
+            }
+            else if (response.status >= 400) {
+                console.warn(`API key validation returned status ${response.status}, but continuing...`);
+            }
+            else {
+                console.log('✅ API key validated successfully');
+            }
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.ConfigurationException) {
+                throw error;
+            }
+            if (error.code === 'ECONNREFUSED' || error.code === 'ETIMEDOUT') {
+                console.warn(`Could not connect to proxy at ${this.proxyEndpoint} for API key validation`);
+            }
+            else {
+                console.warn(`API key validation check failed: ${error.message}, but continuing...`);
+            }
+        }
+    }
+    /**
+     * Capture an execution plan structure.
+     */
+    capturePlan(llm, prompt, plan, metadata) {
+        console.log(`Capturing plan: llm=${llm}, prompt=${prompt.slice(0, 50)}...`);
+        if (!plan) {
+            throw new Error('Plan structure is required. ' +
+                'You must provide an explicit plan with the MCP and actions you want to execute.\n\n' +
+                'Example:\n' +
+                '  const plan = client.capturePlan(\n' +
+                "    'gpt-4',\n" +
+                "    'Your task description',\n" +
+                '    {\n' +
+                "      goal: 'Your task description',\n" +
+                '      steps: [\n' +
+                '        {\n' +
+                "          action: 'your_tool_name',\n" +
+                "          mcp: 'your-mcp-name',\n" +
+                "          params: { param1: 'value1' }\n" +
+                '        }\n' +
+                '      ]\n' +
+                '    }\n' +
+                '  );\n\n' +
+                'Note: Use the MCP name and tool names from your onboarded MCPs on the ArmorIQ platform.');
+        }
+        if (!plan.steps) {
+            throw new Error("Plan must contain 'steps' key");
+        }
+        const capture = {
+            plan,
+            llm,
+            prompt,
+            metadata: metadata || {},
+        };
+        console.log(`Plan captured with ${plan.steps?.length || 0} steps`);
+        return capture;
+    }
+    /**
+     * Request a signed intent token from IAP for the given plan.
+     */
+    async getIntentToken(planCapture, policy, validitySeconds = 60.0) {
+        console.log(`Requesting intent token for plan with ${planCapture.plan.steps?.length || 0} steps`);
+        const payload = {
+            user_id: this.userId,
+            agent_id: this.agentId,
+            context_id: this.contextId,
+            plan: planCapture.plan,
+            policy,
+            expires_in: validitySeconds,
+        };
+        try {
+            const response = await this.httpClient.post(`${this.backendEndpoint}/iap/sdk/token`, payload, {
+                headers: { 'X-API-Key': this.apiKey },
+                timeout: 30000,
+            });
+            if (response.status >= 400) {
+                throw new exceptions_1.InvalidTokenException(`Token issuance failed: ${response.data?.message || response.statusText}`);
+            }
+            const data = response.data;
+            if (!data.success) {
+                throw new exceptions_1.InvalidTokenException(`Token issuance failed: ${data.message || 'Unknown error'}`);
+            }
+            const tokenData = data.token || {};
+            const rawToken = {
+                plan: planCapture.plan,
+                plan_id: data.plan_id,
+                token: tokenData,
+                plan_hash: data.plan_hash,
+                merkle_root: data.merkle_root,
+                intent_reference: data.intent_reference,
+                composite_identity: data.composite_identity || '',
+                step_proofs: data.step_proofs || [],
+            };
+            const token = {
+                tokenId: data.intent_reference || 'unknown',
+                planHash: data.plan_hash || '',
+                planId: data.plan_id,
+                signature: typeof tokenData === 'object' ? tokenData.signature || '' : '',
+                issuedAt: Date.now() / 1000,
+                expiresAt: Date.now() / 1000 + validitySeconds,
+                policy: policy || {},
+                compositeIdentity: data.composite_identity || '',
+                clientInfo: data.client_info,
+                policyValidation: data.policy_validation,
+                stepProofs: data.step_proofs || [],
+                totalSteps: planCapture.plan.steps?.length || 0,
+                rawToken,
+                jwtToken: data.jwt_token,
+                policySnapshot: data.policy_snapshot,
+            };
+            console.log(`Intent token issued: id=${token.tokenId}, plan_hash=${token.planHash.slice(0, 16)}..., ` +
+                `expires=${models_1.IntentToken.timeUntilExpiry(token).toFixed(1)}s, stepProofs=${token.stepProofs?.length || 0}`);
+            return token;
+        }
+        catch (error) {
+            const responseData = error?.response?.data;
+            const deniedTools = responseData?.policy_validation?.denied_tools;
+            const deniedReasons = responseData?.policy_validation?.denied_reasons;
+            if (error?.response?.status === 403 || (Array.isArray(deniedTools) && deniedTools.length > 0)) {
+                const reason = (Array.isArray(deniedReasons) && deniedReasons.length > 0
+                    ? deniedReasons.join('; ')
+                    : responseData?.message) || 'Blocked by policy';
+                throw new exceptions_1.PolicyBlockedException(`Policy blocked intent token issuance: ${reason}`, responseData?.policy_validation?.default_enforcement_action, reason, responseData?.policy_validation);
+            }
+            if (error instanceof exceptions_1.InvalidTokenException) {
+                throw error;
+            }
+            const message = responseData?.message ||
+                (typeof responseData === 'string' ? responseData : undefined) ||
+                error.message;
+            throw new exceptions_1.InvalidTokenException(`Failed to get intent token: ${message}`);
+        }
+    }
+    /**
+     * Invoke an MCP action through the ArmorIQ proxy with token verification.
+     */
+    async invoke(mcp, action, intentToken, params, merkleProof, userEmail) {
+        console.log(`Invoking MCP action: mcp=${mcp}, action=${action}`);
+        // Check token expiry
+        if (models_1.IntentToken.isExpired(intentToken)) {
+            throw new exceptions_1.TokenExpiredException(`Intent token expired ${Math.abs(models_1.IntentToken.timeUntilExpiry(intentToken)).toFixed(1)}s ago`, intentToken.tokenId, intentToken.expiresAt);
+        }
+        // Get proxy endpoint for this MCP
+        const proxyUrl = this.proxyEndpoints[mcp] ||
+            process.env[`${mcp.toUpperCase()}_PROXY_URL`] ||
+            this.defaultProxyEndpoint;
+        // Build IAM context
+        const iamContext = {};
+        if (intentToken.policyValidation) {
+            iamContext.allowed_tools = intentToken.policyValidation.allowed_tools || [];
+        }
+        if (userEmail) {
+            iamContext.email = userEmail;
+            iamContext.user_email = userEmail;
+        }
+        if (intentToken.rawToken) {
+            iamContext.user_id = intentToken.rawToken.user_id || this.userId;
+            iamContext.agent_id = intentToken.rawToken.agent_id || this.agentId;
+        }
+        // Prepare invocation payload (clean tool params only — proxy handles IAM injection)
+        const invokeParams = { ...(params || {}) };
+        const payload = {
+            mcp,
+            action,
+            tool: action,
+            params: invokeParams,
+            arguments: invokeParams,
+            intent_token: intentToken.rawToken,
+            merkle_proof: merkleProof,
+            plan: intentToken.rawToken?.plan,
+            _iam_context: iamContext,
+            ...(userEmail ? { user_email: userEmail } : {}),
+            ...(intentToken.policySnapshot ? { policy_snapshot: intentToken.policySnapshot } : {}),
+        };
+        // Prepare headers
+        const headers = {
+            Accept: 'application/json, text/event-stream',
+            'Content-Type': 'application/json',
+            'Cache-Control': 'no-cache, no-store, must-revalidate',
+            'X-Request-ID': `sdk-${Date.now()}`,
+        };
+        if (this.apiKey) {
+            headers['X-API-Key'] = this.apiKey;
+        }
+        // Send CSRG token structure
+        if (intentToken.rawToken && typeof intentToken.rawToken === 'object') {
+            payload.token = intentToken.rawToken.token || {};
+            payload.csrg_token = intentToken.rawToken.token || {};
+        }
+        // Find step index for this action
+        const plan = intentToken.rawToken?.plan || {};
+        const steps = plan.steps || [];
+        let stepIndex = null;
+        for (let idx = 0; idx < steps.length; idx++) {
+            if (typeof steps[idx] === 'object' && steps[idx].action === action) {
+                stepIndex = idx;
+                break;
+            }
+        }
+        if (stepIndex === null) {
+            const actions = steps.map((s) => (typeof s === 'object' ? s.action : 'unknown'));
+            throw new exceptions_1.IntentMismatchException(`Action '${action}' not found in the original plan. ` +
+                `Plan contains actions: ${JSON.stringify(actions)}. ` +
+                'You can only invoke actions that were included in the plan when you called capturePlan().');
+        }
+        // Use Merkle proof from CSRG-IAP
+        if (!merkleProof) {
+            if (intentToken.stepProofs && intentToken.stepProofs.length > stepIndex) {
+                merkleProof = intentToken.stepProofs[stepIndex];
+                console.log(`Using Merkle proof from CSRG-IAP for step ${stepIndex}`);
+            }
+            else {
+                console.warn(`No Merkle proof available for step ${stepIndex}. ` +
+                    `step_proofs length: ${intentToken.stepProofs?.length || 0}`);
+            }
+        }
+        // Add CSRG proof to headers
+        if (merkleProof) {
+            headers['X-CSRG-Proof'] = JSON.stringify(merkleProof);
+        }
+        const csrgPath = `/steps/[${stepIndex}]/action`;
+        headers['X-CSRG-Path'] = csrgPath;
+        // Calculate value digest
+        const stepObj = steps[stepIndex] || {};
+        const leafValue = typeof stepObj === 'object' ? stepObj.action || action : action;
+        const valueStr = JSON.stringify(leafValue);
+        const valueDigest = crypto.createHash('sha256').update(valueStr, 'utf8').digest('hex');
+        headers['X-CSRG-Value-Digest'] = valueDigest;
+        // Call proxy
+        try {
+            const startTime = Date.now();
+            const response = await this.httpClient.post(`${proxyUrl}/invoke`, payload, { headers });
+            const executionTime = (Date.now() - startTime) / 1000;
+            const responseData = response.data;
+            // Check for enforcement responses (hold/block) BEFORE generic error handling
+            if (responseData?.enforcement) {
+                const enforcement = responseData.enforcement;
+                const enrichedError = new Error(responseData.message || `Enforcement: ${enforcement.action}`);
+                enrichedError.response = { status: response.status, data: responseData };
+                enrichedError.name = enforcement.action === 'block' ? 'PolicyBlockedException' : 'PolicyHoldException';
+                throw enrichedError;
+            }
+            if (response.status >= 400) {
+                const enrichedError = new Error(`HTTP ${response.status}: ${response.statusText}`);
+                enrichedError.response = { status: response.status, data: responseData };
+                throw enrichedError;
+            }
+            const contentType = response.headers['content-type'] || '';
+            let data;
+            // Handle SSE format
+            if (contentType.includes('text/event-stream') && typeof responseData === 'string') {
+                const lines = responseData.split('\n');
+                for (const line of lines) {
+                    if (line.startsWith('data: ')) {
+                        try {
+                            data = JSON.parse(line.slice(6));
+                            break;
+                        }
+                        catch (e) {
+                            continue;
+                        }
+                    }
+                }
+                if (!data) {
+                    throw new exceptions_1.MCPInvocationException('No data in SSE response', mcp, action);
+                }
+            }
+            else {
+                data = responseData;
+            }
+            // Check for JSON-RPC error
+            if (data.error && !data.enforcement) {
+                const errorMsg = data.error.message || 'Unknown error';
+                const errorCode = data.error.code || -1;
+                const errorData = data.error.data || '';
+                throw new exceptions_1.MCPInvocationException(`MCP tool error (${errorCode}): ${errorMsg} - ${errorData}`, mcp, action);
+            }
+            const resultData = data.result || data;
+            const hasToolError = Boolean(resultData?.isError) ||
+                Boolean(resultData?.error) ||
+                Boolean(resultData?.is_error);
+            const result = {
+                mcp,
+                action,
+                result: resultData,
+                status: hasToolError ? 'error' : 'success',
+                executionTime,
+                verified: true,
+                metadata: {
+                    hasToolError,
+                },
+            };
+            console.log(`MCP invocation ${hasToolError ? 'returned error payload' : 'succeeded'}: ${action} in ${executionTime.toFixed(2)}s`);
+            return result;
+        }
+        catch (error) {
+            if (error instanceof exceptions_1.MCPInvocationException) {
+                throw error;
+            }
+            // Re-throw enforcement errors so invokeWithPolicy() can catch them
+            if (error.name === 'PolicyBlockedException' || error.name === 'PolicyHoldException') {
+                throw error;
+            }
+            const statusCode = error.response?.status;
+            const errorDetail = error.response?.data || error.message;
+            // Check if the 403 response is actually an enforcement response
+            if (statusCode === 403 && errorDetail?.enforcement) {
+                const enrichedError = new Error(errorDetail.message || 'Enforcement action');
+                enrichedError.response = error.response;
+                enrichedError.name = errorDetail.enforcement.action === 'block' ? 'PolicyBlockedException' : 'PolicyHoldException';
+                throw enrichedError;
+            }
+            if (statusCode === 401 || statusCode === 403) {
+                throw new exceptions_1.InvalidTokenException(`Token verification failed: ${errorDetail}`);
+            }
+            else if (statusCode === 409) {
+                throw new exceptions_1.IntentMismatchException(`Action not in plan: ${errorDetail}`, action, intentToken.planHash);
+            }
+            else {
+                throw new exceptions_1.MCPInvocationException(`MCP invocation failed: ${errorDetail}`, mcp, action, statusCode);
+            }
+        }
+    }
+    /**
+     * Delegate authority to another agent using CSRG token delegation.
+     */
+    async delegate(intentToken, delegatePublicKey, validitySeconds = 3600, allowedActions, targetAgent, subtask) {
+        console.log(`Creating delegation for token_id=${intentToken.tokenId}, ` +
+            `delegate_key=${delegatePublicKey.slice(0, 16)}..., validity=${validitySeconds}s`);
+        let tokenToDelegate = intentToken.rawToken;
+        if (typeof tokenToDelegate === 'object' && 'token' in tokenToDelegate) {
+            tokenToDelegate = tokenToDelegate.token;
+        }
+        const payload = {
+            token: tokenToDelegate,
+            delegate_public_key: delegatePublicKey,
+            validity_seconds: validitySeconds,
+        };
+        if (allowedActions) {
+            payload.allowed_actions = allowedActions;
+        }
+        if (targetAgent) {
+            payload.target_agent = targetAgent;
+        }
+        if (subtask) {
+            payload.subtask = subtask;
+        }
+        try {
+            const response = await this.httpClient.post(`${this.iapEndpoint}/delegation/create`, payload, {
+                timeout: 10000,
+            });
+            if (response.status >= 400) {
+                throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+            }
+            const data = response.data;
+            const delegatedTokenData = data.delegation || data.delegated_token || data.new_token;
+            if (!delegatedTokenData) {
+                throw new exceptions_1.DelegationException(`Delegation response missing 'delegation' key. Got keys: ${Object.keys(data).join(', ')}`, undefined, data.delegation_id);
+            }
+            const delegatedToken = {
+                tokenId: delegatedTokenData.token_id || '',
+                planHash: delegatedTokenData.plan_hash || intentToken.planHash,
+                planId: delegatedTokenData.plan_id,
+                signature: delegatedTokenData.signature || '',
+                issuedAt: delegatedTokenData.issued_at || Date.now() / 1000,
+                expiresAt: delegatedTokenData.expires_at || 0,
+                policy: delegatedTokenData.policy || {},
+                compositeIdentity: delegatedTokenData.composite_identity || '',
+                clientInfo: delegatedTokenData.client_info,
+                policyValidation: delegatedTokenData.policy_validation,
+                stepProofs: delegatedTokenData.step_proofs || [],
+                totalSteps: delegatedTokenData.total_steps || 0,
+                rawToken: { token: delegatedTokenData },
+            };
+            const result = {
+                delegationId: data.delegation_id || delegatedToken.tokenId,
+                delegatedToken,
+                delegatePublicKey,
+                targetAgent,
+                expiresAt: delegatedToken.expiresAt,
+                trustDelta: data.trust_delta || {},
+                status: 'delegated',
+                metadata: data.metadata || {},
+            };
+            console.log(`Delegation successful: delegation_id=${result.delegationId}`);
+            return result;
+        }
+        catch (error) {
+            const statusCode = error.response?.status;
+            const errorDetail = error.response?.data || error.message;
+            throw new exceptions_1.DelegationException(`Delegation failed: ${errorDetail}`, targetAgent, undefined, statusCode);
+        }
+    }
+    /**
+     * Verify an intent token with IAP.
+     */
+    async verifyToken(intentToken) {
+        try {
+            if (models_1.IntentToken.isExpired(intentToken)) {
+                console.warn(`Token ${intentToken.tokenId} has expired`);
+                return false;
+            }
+            if (!intentToken.signature || !intentToken.planHash) {
+                console.warn(`Token ${intentToken.tokenId} missing required fields`);
+                return false;
+            }
+            console.log(`Token ${intentToken.tokenId} is valid (expires in ${models_1.IntentToken.timeUntilExpiry(intentToken).toFixed(1)}s)`);
+            return true;
+        }
+        catch (error) {
+            console.error(`Token verification failed: ${error.message}`);
+            return false;
+        }
+    }
+    // ─── Semantic Metadata & Policy Context ──────────────────────────
+    /**
+     * Fetch and cache semantic tool metadata for an MCP server.
+     */
+    async fetchToolMetadata(mcpName) {
+        const cached = this.metadataCache.get(mcpName);
+        if (cached)
+            return cached;
+        try {
+            const response = await this.httpClient.get(`${this.backendEndpoint}/mcp/tool-metadata/${encodeURIComponent(mcpName)}`, { headers: { 'X-API-Key': this.apiKey } });
+            if (response.status >= 400) {
+                console.warn(`Failed to fetch tool metadata for ${mcpName}: ${response.status}`);
+                return { mcpId: '', name: mcpName, toolMetadata: {}, roleMapping: {} };
+            }
+            const metadata = response.data?.data || {
+                mcpId: '',
+                name: mcpName,
+                toolMetadata: {},
+                roleMapping: {},
+            };
+            this.metadataCache.set(mcpName, metadata);
+            return metadata;
+        }
+        catch (error) {
+            console.warn(`Could not fetch tool metadata for ${mcpName}: ${error.message}`);
+            return { mcpId: '', name: mcpName, toolMetadata: {}, roleMapping: {} };
+        }
+    }
+    /**
+     * Eagerly load metadata for an MCP so subsequent invoke() calls are fast.
+     */
+    async loadMcp(mcpName) {
+        await this.fetchToolMetadata(mcpName);
+    }
+    /**
+     * List all MCPs registered for this org (resolved via API key).
+     */
+    async listMcps() {
+        const response = await this.httpClient.get(`${this.backendEndpoint}/mcp/my-servers`, { headers: { 'X-API-Key': this.apiKey } });
+        if (response.status >= 400) {
+            throw new exceptions_1.MCPInvocationException(`listMcps failed: ${response.status} ${JSON.stringify(response.data)}`);
+        }
+        return response.data?.data || [];
+    }
+    /**
+     * Get full OpenAI-compatible tool schemas for a named MCP.
+     */
+    async getMcpToolSchemas(mcpName) {
+        const response = await this.httpClient.get(`${this.backendEndpoint}/mcp/tools/${encodeURIComponent(mcpName)}`, { headers: { 'X-API-Key': this.apiKey } });
+        if (response.status >= 400) {
+            throw new exceptions_1.MCPInvocationException(`getMcpToolSchemas(${mcpName}) failed: ${response.status} ${JSON.stringify(response.data)}`);
+        }
+        return response.data?.data?.tools || [];
+    }
+    /**
+     * Enrich policy context from semantic metadata for a tool invocation.
+     */
+    async enrichPolicyContext(mcpName, toolName, params) {
+        const metadata = await this.fetchToolMetadata(mcpName);
+        const toolMeta = metadata.toolMetadata?.[toolName];
+        if (!toolMeta || !toolMeta.isFinancial) {
+            return { is_financial: false };
+        }
+        let amount;
+        if (toolMeta.amountFields) {
+            for (const field of toolMeta.amountFields) {
+                if (params[field] != null) {
+                    const raw = Number(params[field]);
+                    amount = toolMeta.amountUnit === 'cents' ? raw / 100 : raw;
+                    break;
+                }
+            }
+        }
+        return {
+            is_financial: true,
+            transaction_type: toolMeta.transactionType || toolName,
+            amount,
+            recipient_id: toolMeta.recipientField ? params[toolMeta.recipientField] : undefined,
+        };
+    }
+    /**
+     * Resolve an org role to a domain-specific role for an MCP.
+     */
+    async resolveRole(mcpName, orgRole) {
+        const metadata = await this.fetchToolMetadata(mcpName);
+        return metadata.roleMapping?.[orgRole] || orgRole;
+    }
+    // ─── Delegation Automation ──────────────────────────────────────
+    /**
+     * Resolve the user's role and limit from the backend for delegation.
+     */
+    async resolveUserRole(userEmail) {
+        try {
+            const response = await this.httpClient.get(`${this.backendEndpoint}/delegation/my-role`, {
+                params: {},
+                headers: { 'X-API-Key': this.apiKey, 'X-User-Email': userEmail },
+                timeout: 5000,
+            });
+            if (response.status < 400 && response.data?.role) {
+                return {
+                    role: response.data.role,
+                    limit: response.data.limit ?? 0,
+                };
+            }
+        }
+        catch (e) {
+            // Fallback below
+        }
+        return { role: 'agent_user', limit: 0 };
+    }
+    /**
+     * Create a delegation request on the backend.
+     */
+    async createDelegationRequest(params) {
+        const response = await this.httpClient.post(`${this.backendEndpoint}/delegation/request`, params, { headers: { 'X-API-Key': this.apiKey, 'X-User-Email': params.requesterEmail } });
+        if (response.status >= 400) {
+            throw new exceptions_1.DelegationException(`Failed to create delegation request: ${response.data?.message || response.statusText}`);
+        }
+        return response.data;
+    }
+    /**
+     * Check if a delegation request has been approved.
+     */
+    async checkApprovedDelegation(userEmail, tool, amount) {
+        const response = await this.httpClient.get(`${this.backendEndpoint}/delegation/check-approved`, {
+            params: { tool, amount },
+            headers: { 'X-API-Key': this.apiKey, 'X-User-Email': userEmail },
+        });
+        if (response.status >= 400 || !response.data?.approved) {
+            return null;
+        }
+        return response.data;
+    }
+    /**
+     * Mark a delegation as executed.
+     */
+    async markDelegationExecuted(userEmail, delegationId) {
+        await this.httpClient.post(`${this.backendEndpoint}/delegation/mark-executed`, { delegationId }, { headers: { 'X-API-Key': this.apiKey, 'X-User-Email': userEmail } });
+    }
+    /**
+     * Mark an intent plan as completed after all tools have been executed.
+     */
+    async completePlan(planId) {
+        await this.updatePlanStatus(planId, 'completed');
+    }
+    /**
+     * Update an intent plan's status.
+     * Valid statuses: 'active', 'completed', 'failed', 'expired'
+     */
+    async updatePlanStatus(planId, status) {
+        try {
+            await this.httpClient.post(`${this.backendEndpoint}/iap/plans/${planId}/status`, { status }, { headers: { 'X-API-Key': this.apiKey } });
+            console.log(`Plan ${planId} status updated to ${status}`);
+        }
+        catch (error) {
+            console.warn(`Failed to update plan ${planId} status: ${error.message}`);
+        }
+    }
+    /**
+     * Enhanced invoke with automatic policy context enrichment and delegation handling.
+     */
+    async invokeWithPolicy(mcp, action, intentToken, params, options) {
+        // Enrich with policy context from semantic metadata
+        const policyContext = await this.enrichPolicyContext(mcp, action, params || {});
+        const enrichedParams = {
+            ...(params || {}),
+            _policy_context: policyContext,
+        };
+        try {
+            return await this.invoke(mcp, action, intentToken, enrichedParams, undefined, options?.userEmail);
+        }
+        catch (error) {
+            // Detect structured enforcement responses
+            const responseData = error.response?.data;
+            if (!responseData?.enforcement)
+                throw error;
+            const enforcement = responseData.enforcement;
+            if (enforcement.action === 'block') {
+                throw new exceptions_1.PolicyBlockedException(responseData.message || 'Action blocked by policy', enforcement.action, enforcement.reason, enforcement.metadata);
+            }
+            if (enforcement.action === 'hold' && enforcement.requiresApproval) {
+                const holdInfo = {
+                    reason: enforcement.reason,
+                    amount: enforcement.metadata?.amount,
+                    approvalThreshold: enforcement.metadata?.approvalThreshold,
+                    tool: action,
+                    mcp,
+                };
+                options?.onHold?.(holdInfo);
+                if (!options?.waitForApproval || !options?.userEmail) {
+                    throw new exceptions_1.PolicyHoldException(responseData.message || 'Action held for approval', responseData.delegation_context, enforcement.metadata);
+                }
+                // Auto-create delegation request
+                const delegationCtx = responseData.delegation_context || {};
+                // Resolve requester role/limit: use options, or auto-resolve from backend
+                let requesterRole = options.requesterRole || 'agent_user';
+                let requesterLimit = options.requesterLimit ?? 0;
+                if (!options.requesterRole) {
+                    try {
+                        const resolved = await this.resolveUserRole(options.userEmail);
+                        requesterRole = resolved.role;
+                        requesterLimit = resolved.limit;
+                    }
+                    catch (_e) {
+                        // Use defaults
+                    }
+                }
+                let delegationResult;
+                try {
+                    delegationResult = await this.createDelegationRequest({
+                        tool: action,
+                        action: 'execute',
+                        arguments: params || {},
+                        amount: policyContext.amount ?? 0,
+                        requesterEmail: options.userEmail,
+                        requesterRole,
+                        requesterLimit,
+                        domain: delegationCtx.domain || mcp,
+                        targetUrl: delegationCtx.targetUrl,
+                        planId: delegationCtx.planId || intentToken.planId,
+                        intentReference: delegationCtx.intentReference || intentToken.tokenId,
+                        merkleRoot: delegationCtx.merkleRoot || intentToken.planHash,
+                        reason: enforcement.reason,
+                    });
+                }
+                catch (delegationError) {
+                    console.error(`Failed to create delegation request: ${delegationError.message}`);
+                    throw new exceptions_1.PolicyHoldException(responseData.message || 'Action held for approval (delegation request failed)', responseData.delegation_context, { ...enforcement.metadata, delegationError: delegationError.message });
+                }
+                holdInfo.delegationId = delegationResult.delegationId;
+                options?.onHold?.(holdInfo);
+                // Poll for approval
+                const timeout = options.delegationTimeoutMs || 30 * 60 * 1000;
+                const startTime = Date.now();
+                let pollInterval = 3000;
+                while (Date.now() - startTime < timeout) {
+                    await new Promise((resolve) => setTimeout(resolve, pollInterval));
+                    pollInterval = Math.min(pollInterval * 1.5, 15000);
+                    const approved = await this.checkApprovedDelegation(options.userEmail, action, policyContext.amount || 0);
+                    if (approved) {
+                        // Retry with delegation context
+                        const retryParams = {
+                            ...enrichedParams,
+                            _delegation_id: approved.delegationId,
+                            _approvals: 999,
+                        };
+                        const result = await this.invoke(mcp, action, intentToken, retryParams, undefined, options.userEmail);
+                        await this.markDelegationExecuted(options.userEmail, approved.delegationId);
+                        return result;
+                    }
+                }
+                throw new exceptions_1.DelegationException(`Delegation approval timed out after ${timeout / 1000}s`, undefined, delegationResult.delegationId);
+            }
+            throw error;
+        }
+    }
+    /**
+     * Close HTTP client and cleanup resources.
+     */
+    close() {
+        // Axios doesn't require explicit cleanup
+        console.log('ArmorIQ SDK client closed');
+    }
+}
+exports.ArmorIQClient = ArmorIQClient;
+//# sourceMappingURL=client.js.map