@armoriq/sdk-dev 0.2.15 → 0.3.1

package/dist/cli/commands/status.js

@@ -0,0 +1,103 @@
+"use strict";
+/**
+ * armoriq status / logs — local-only commands that read the cached state
+ * and CLI log file. Mirrors armoriq_sdk/cli.py:cmd_status / cmd_logs.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cmdStatus = cmdStatus;
+exports.cmdLogs = cmdLogs;
+const fs = __importStar(require("fs"));
+const util_1 = require("../util");
+const state_1 = require("../state");
+function cmdStatus() {
+    const state = (0, state_1.loadState)();
+    if (!state || Object.keys(state).length === 0) {
+        (0, util_1.out)('No local registration state found. Run `armoriq register` first.');
+        return 1;
+    }
+    (0, util_1.out)(`Agent: ${state.agent_id ?? 'unknown'}`);
+    (0, util_1.out)(`User: ${state.user_id ?? 'unknown'}`);
+    (0, util_1.out)(`Environment: ${state.environment ?? 'unknown'}`);
+    (0, util_1.out)(`Registered at: ${state.registered_at ?? 'unknown'}`);
+    (0, util_1.out)(`Proxy endpoint: ${state.proxy_endpoint ?? 'unknown'}`);
+    const mcpServers = state.mcp_servers ?? [];
+    (0, util_1.out)(`MCP servers: ${mcpServers.length > 0 ? mcpServers.join(', ') : '(none)'}`);
+    return 0;
+}
+function cmdLogs(args) {
+    if (!fs.existsSync(state_1.LOG_FILE)) {
+        (0, util_1.out)('No CLI logs found yet.');
+        return 0;
+    }
+    const tailFile = (offset) => {
+        const stat = fs.statSync(state_1.LOG_FILE);
+        if (stat.size <= offset)
+            return offset;
+        const fd = fs.openSync(state_1.LOG_FILE, 'r');
+        const buf = Buffer.alloc(stat.size - offset);
+        fs.readSync(fd, buf, 0, buf.length, offset);
+        fs.closeSync(fd);
+        for (const line of buf.toString('utf-8').split('\n')) {
+            const trimmed = line.trim();
+            if (!trimmed)
+                continue;
+            try {
+                const event = JSON.parse(trimmed);
+                (0, util_1.out)(`[${event.timestamp ?? ''}] ${event.event ?? ''}: ${JSON.stringify(event.details ?? {})}`);
+            }
+            catch {
+                (0, util_1.out)(trimmed);
+            }
+        }
+        return stat.size;
+    };
+    let offset = tailFile(0);
+    if (!args.follow)
+        return 0;
+    // Simple poll loop for --follow; ctrl-C exits.
+    const interval = setInterval(() => {
+        offset = tailFile(offset);
+    }, 1000);
+    // Return a never-resolving promise via process exit hook isn't useful here;
+    // the user expects --follow to block. Keep the process alive until SIGINT.
+    process.on('SIGINT', () => {
+        clearInterval(interval);
+        process.exit(0);
+    });
+    // Block forever — this function is the entrypoint of the command.
+    return 0;
+}
+//# sourceMappingURL=status.js.map

package/dist/cli/commands/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAMH,8BAcC;AAED,0BAsCC;AA1DD,uCAAyB;AACzB,kCAA8B;AAC9B,oCAA+C;AAE/C,SAAgB,SAAS;IACvB,MAAM,KAAK,GAAG,IAAA,iBAAS,GAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,IAAA,UAAG,EAAC,kEAAkE,CAAC,CAAC;QACxE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAA,UAAG,EAAC,UAAU,KAAK,CAAC,QAAQ,IAAI,SAAS,EAAE,CAAC,CAAC;IAC7C,IAAA,UAAG,EAAC,SAAS,KAAK,CAAC,OAAO,IAAI,SAAS,EAAE,CAAC,CAAC;IAC3C,IAAA,UAAG,EAAC,gBAAgB,KAAK,CAAC,WAAW,IAAI,SAAS,EAAE,CAAC,CAAC;IACtD,IAAA,UAAG,EAAC,kBAAkB,KAAK,CAAC,aAAa,IAAI,SAAS,EAAE,CAAC,CAAC;IAC1D,IAAA,UAAG,EAAC,mBAAmB,KAAK,CAAC,cAAc,IAAI,SAAS,EAAE,CAAC,CAAC;IAC5D,MAAM,UAAU,GAAG,KAAK,CAAC,WAAW,IAAI,EAAE,CAAC;IAC3C,IAAA,UAAG,EAAC,gBAAgB,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;IAChF,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,OAAO,CAAC,IAA0B;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAQ,CAAC,EAAE,CAAC;QAC7B,IAAA,UAAG,EAAC,wBAAwB,CAAC,CAAC;QAC9B,OAAO,CAAC,CAAC;IACX,CAAC;IACD,MAAM,QAAQ,GAAG,CAAC,MAAc,EAAU,EAAE;QAC1C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAQ,CAAC,CAAC;QACnC,IAAI,IAAI,CAAC,IAAI,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;QACvC,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,gBAAQ,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,MAAM,CAAC,CAAC;QAC7C,EAAE,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC5C,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO;gBAAE,SAAS;YACvB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAClC,IAAA,UAAG,EAAC,IAAI,KAAK,CAAC,SAAS,IAAI,EAAE,KAAK,KAAK,CAAC,KAAK,IAAI,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC;YACjG,CAAC;YAAC,MAAM,CAAC;gBACP,IAAA,UAAG,EAAC,OAAO,CAAC,CAAC;YACf,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC,CAAC;IACF,IAAI,MAAM,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;IACzB,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,CAAC,CAAC;IAC3B,+CAA+C;IAC/C,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE;QAChC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5B,CAAC,EAAE,IAAI,CAAC,CAAC;IACT,4EAA4E;IAC5E,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE;QACxB,aAAa,CAAC,QAAQ,CAAC,CAAC;QACxB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IACH,kEAAkE;IAClE,OAAO,CAAC,CAAC;AACX,CAAC"}

package/dist/cli/index.d.ts

@@ -0,0 +1,15 @@
+#!/usr/bin/env node
+/**
+ * armoriq — TypeScript CLI for the ArmorIQ SDK.
+ *
+ * Mirrors the PY CLI command surface from armoriq_sdk/cli.py and cli_auth.py.
+ * Supports: login, logout, whoami, orgs, switch-org, status, logs, keys.
+ *
+ * Note: `init`, `validate`, and `register` (which need MCP JSON-RPC discovery)
+ * are not yet implemented in TS — direct users to the PY CLI for those flows
+ * (or stay tuned for follow-up parity work).
+ */
+type Argv = string[];
+declare function run(argv: Argv): Promise<number>;
+export { run as runCli };
+//# sourceMappingURL=index.d.ts.map

package/dist/cli/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG;AA8BH,KAAK,IAAI,GAAG,MAAM,EAAE,CAAC;AAcrB,iBAAe,GAAG,CAAC,IAAI,EAAE,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CA2E9C;AAgBD,OAAO,EAAE,GAAG,IAAI,MAAM,EAAE,CAAC"}

package/dist/cli/index.js

@@ -0,0 +1,141 @@
+#!/usr/bin/env node
+"use strict";
+/**
+ * armoriq — TypeScript CLI for the ArmorIQ SDK.
+ *
+ * Mirrors the PY CLI command surface from armoriq_sdk/cli.py and cli_auth.py.
+ * Supports: login, logout, whoami, orgs, switch-org, status, logs, keys.
+ *
+ * Note: `init`, `validate`, and `register` (which need MCP JSON-RPC discovery)
+ * are not yet implemented in TS — direct users to the PY CLI for those flows
+ * (or stay tuned for follow-up parity work).
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runCli = run;
+const util_1 = require("./util");
+const HELP = `
+armoriq — ArmorIQ SDK CLI
+
+Usage: armoriq <command> [options]
+
+Commands:
+  login [--org <name>]       OAuth device-code login flow
+  logout                     Remove cached credentials
+  whoami                     Show the currently logged-in account
+
+  orgs                       List organizations you belong to
+  switch-org <name-or-id>    Switch the active org and rotate API key
+                             [--key-name <name>]
+
+  keys list                  List API keys for this account
+  keys revoke <id>           Revoke a single API key
+  keys prune [--yes]         Revoke expired / unused (>90d) keys
+
+  status                     Show local CLI state (agent, env, MCPs)
+  logs [--follow]            Tail the CLI log file
+
+  help                       Show this help
+
+Use \`armoriq help <command>\` for command-specific options.
+`;
+function parseFlag(args, name, hasValue = true) {
+    for (let i = 0; i < args.length; i++) {
+        if (args[i] === `--${name}`) {
+            if (!hasValue)
+                return true;
+            const v = args[i + 1];
+            args.splice(i, 2);
+            return v;
+        }
+    }
+    return undefined;
+}
+async function run(argv) {
+    const [command, ...rest] = argv;
+    if (!command || command === 'help' || command === '--help' || command === '-h') {
+        (0, util_1.out)(HELP);
+        return 0;
+    }
+    switch (command) {
+        case 'login': {
+            const { cmdLogin } = await import('./commands/auth.js');
+            const org = parseFlag(rest, 'org');
+            const backend = parseFlag(rest, 'backend');
+            return cmdLogin({ org, backend });
+        }
+        case 'logout': {
+            const { cmdLogout } = await import('./commands/auth.js');
+            return cmdLogout();
+        }
+        case 'whoami': {
+            const { cmdWhoami } = await import('./commands/auth.js');
+            return cmdWhoami();
+        }
+        case 'orgs': {
+            const { cmdOrgs } = await import('./commands/orgs.js');
+            return cmdOrgs();
+        }
+        case 'switch-org': {
+            const { cmdSwitchOrg } = await import('./commands/orgs.js');
+            const keyName = parseFlag(rest, 'key-name');
+            const target = rest.find((a) => !a.startsWith('--'));
+            if (!target)
+                throw new util_1.CLIError('Usage: armoriq switch-org <name-or-id>');
+            return cmdSwitchOrg({ org: target, keyName });
+        }
+        case 'keys': {
+            const sub = rest[0];
+            const { cmdKeysList, cmdKeysRevoke, cmdKeysPrune } = await import('./commands/keys.js');
+            if (sub === 'list')
+                return cmdKeysList();
+            if (sub === 'revoke') {
+                const id = rest[1];
+                if (!id)
+                    throw new util_1.CLIError('Usage: armoriq keys revoke <id>');
+                return cmdKeysRevoke({ id });
+            }
+            if (sub === 'prune') {
+                const yes = Boolean(parseFlag(rest, 'yes', false));
+                return cmdKeysPrune({ yes });
+            }
+            (0, util_1.out)('Usage: armoriq keys list | revoke <id> | prune [--yes]');
+            return 1;
+        }
+        case 'status': {
+            const { cmdStatus } = await import('./commands/status.js');
+            return cmdStatus();
+        }
+        case 'logs': {
+            const { cmdLogs } = await import('./commands/status.js');
+            const follow = Boolean(parseFlag(rest, 'follow', false));
+            return cmdLogs({ follow });
+        }
+        case 'init':
+        case 'validate':
+        case 'register': {
+            (0, util_1.out)(`'armoriq ${command}' is not yet implemented in the TypeScript CLI.\n` +
+                'Use the Python CLI for now (`pip install armoriq-sdk` then `armoriq ' +
+                command +
+                '`), or follow this issue: https://github.com/armoriq/armoriq-sdk-customer-ts/issues/40');
+            return 1;
+        }
+        default:
+            (0, util_1.out)(`Unknown command: ${command}`);
+            (0, util_1.out)(HELP);
+            return 1;
+    }
+}
+if (require.main === module) {
+    const argv = process.argv.slice(2);
+    run(argv)
+        .then((code) => process.exit(code))
+        .catch((err) => {
+        if (err instanceof util_1.CLIError) {
+            (0, util_1.out)(`  ${util_1.CROSS} ${err.message}`);
+            process.exit(1);
+        }
+        (0, util_1.out)(`  ${util_1.CROSS} Unexpected error: ${err.message}`);
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=index.js.map

package/dist/cli/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/cli/index.ts"],"names":[],"mappings":";;AACA;;;;;;;;;GASG;;AAuIa,qBAAM;AArItB,iCAA8C;AAE9C,MAAM,IAAI,GAAG;;;;;;;;;;;;;;;;;;;;;;;;CAwBZ,CAAC;AAIF,SAAS,SAAS,CAAC,IAAU,EAAE,IAAY,EAAE,WAAoB,IAAI;IACnE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,EAAE,CAAC;YAC5B,IAAI,CAAC,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC3B,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YACtB,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YAClB,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,GAAG,CAAC,IAAU;IAC3B,MAAM,CAAC,OAAO,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAEhC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC/E,IAAA,UAAG,EAAC,IAAI,CAAC,CAAC;QACV,OAAO,CAAC,CAAC;IACX,CAAC;IAED,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACxD,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,EAAE,KAAK,CAAuB,CAAC;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,SAAS,CAAuB,CAAC;YACjE,OAAO,QAAQ,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACpC,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACzD,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACzD,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACvD,OAAO,OAAO,EAAE,CAAC;QACnB,CAAC;QACD,KAAK,YAAY,CAAC,CAAC,CAAC;YAClB,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YAC5D,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,EAAE,UAAU,CAAuB,CAAC;YAClE,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACrD,IAAI,CAAC,MAAM;gBAAE,MAAM,IAAI,eAAQ,CAAC,wCAAwC,CAAC,CAAC;YAC1E,OAAO,YAAY,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACpB,MAAM,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;YACxF,IAAI,GAAG,KAAK,MAAM;gBAAE,OAAO,WAAW,EAAE,CAAC;YACzC,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACrB,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACnB,IAAI,CAAC,EAAE;oBAAE,MAAM,IAAI,eAAQ,CAAC,iCAAiC,CAAC,CAAC;gBAC/D,OAAO,aAAa,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,IAAI,GAAG,KAAK,OAAO,EAAE,CAAC;gBACpB,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;gBACnD,OAAO,YAAY,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;YAC/B,CAAC;YACD,IAAA,UAAG,EAAC,wDAAwD,CAAC,CAAC;YAC9D,OAAO,CAAC,CAAC;QACX,CAAC;QACD,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YAC3D,OAAO,SAAS,EAAE,CAAC;QACrB,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,sBAAsB,CAAC,CAAC;YACzD,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACzD,OAAO,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7B,CAAC;QACD,KAAK,MAAM,CAAC;QACZ,KAAK,UAAU,CAAC;QAChB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,IAAA,UAAG,EACD,YAAY,OAAO,mDAAmD;gBACpE,sEAAsE;gBACtE,OAAO;gBACP,wFAAwF,CAC3F,CAAC;YACF,OAAO,CAAC,CAAC;QACX,CAAC;QACD;YACE,IAAA,UAAG,EAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;YACnC,IAAA,UAAG,EAAC,IAAI,CAAC,CAAC;YACV,OAAO,CAAC,CAAC;IACb,CAAC;AACH,CAAC;AAED,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;IAC5B,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACnC,GAAG,CAAC,IAAI,CAAC;SACN,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAClC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE;QACb,IAAI,GAAG,YAAY,eAAQ,EAAE,CAAC;YAC5B,IAAA,UAAG,EAAC,KAAK,YAAK,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACjC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAA,UAAG,EAAC,KAAK,YAAK,sBAAuB,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/cli/state.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Local CLI state ($HOME/.armoriq/{state,cli.log}.{json,jsonl}).
+ * Mirrors the layout used by armoriq_sdk/cli.py so PY and TS CLIs share the same files.
+ */
+export declare const ARMORIQ_DIR: string;
+export declare const STATE_FILE: string;
+export declare const LOG_FILE: string;
+export type CliState = {
+    registered_at?: string;
+    config_path?: string;
+    agent_id?: string;
+    user_id?: string;
+    environment?: string;
+    proxy_endpoint?: string;
+    mcp_servers?: string[];
+    [k: string]: unknown;
+};
+export declare function loadState(): CliState;
+export declare function saveState(state: CliState): void;
+export declare function clearState(): boolean;
+export declare function appendLog(event: string, details?: Record<string, unknown>): void;
+//# sourceMappingURL=state.d.ts.map

package/dist/cli/state.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.d.ts","sourceRoot":"","sources":["../../src/cli/state.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,eAAO,MAAM,WAAW,QAAsC,CAAC;AAC/D,eAAO,MAAM,UAAU,QAAuC,CAAC;AAC/D,eAAO,MAAM,QAAQ,QAAoC,CAAC;AAE1D,MAAM,MAAM,QAAQ,GAAG;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;CACtB,CAAC;AAEF,wBAAgB,SAAS,IAAI,QAAQ,CAOpC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,QAAQ,GAAG,IAAI,CAG/C;AAED,wBAAgB,UAAU,IAAI,OAAO,CAUpC;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GAAG,IAAI,CAYpF"}

package/dist/cli/state.js

@@ -0,0 +1,91 @@
+"use strict";
+/**
+ * Local CLI state ($HOME/.armoriq/{state,cli.log}.{json,jsonl}).
+ * Mirrors the layout used by armoriq_sdk/cli.py so PY and TS CLIs share the same files.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.LOG_FILE = exports.STATE_FILE = exports.ARMORIQ_DIR = void 0;
+exports.loadState = loadState;
+exports.saveState = saveState;
+exports.clearState = clearState;
+exports.appendLog = appendLog;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+exports.ARMORIQ_DIR = path.join(os.homedir(), '.armoriq');
+exports.STATE_FILE = path.join(exports.ARMORIQ_DIR, 'state.json');
+exports.LOG_FILE = path.join(exports.ARMORIQ_DIR, 'cli.log');
+function loadState() {
+    try {
+        if (!fs.existsSync(exports.STATE_FILE))
+            return {};
+        return JSON.parse(fs.readFileSync(exports.STATE_FILE, 'utf-8'));
+    }
+    catch {
+        return {};
+    }
+}
+function saveState(state) {
+    fs.mkdirSync(exports.ARMORIQ_DIR, { recursive: true });
+    fs.writeFileSync(exports.STATE_FILE, JSON.stringify(state, null, 2) + '\n', { mode: 0o600 });
+}
+function clearState() {
+    try {
+        if (fs.existsSync(exports.STATE_FILE)) {
+            fs.unlinkSync(exports.STATE_FILE);
+            return true;
+        }
+        return false;
+    }
+    catch {
+        return false;
+    }
+}
+function appendLog(event, details = {}) {
+    try {
+        fs.mkdirSync(exports.ARMORIQ_DIR, { recursive: true });
+        const entry = JSON.stringify({
+            timestamp: new Date().toISOString(),
+            event,
+            details,
+        });
+        fs.appendFileSync(exports.LOG_FILE, entry + '\n');
+    }
+    catch {
+        // best-effort; never throw on log write
+    }
+}
+//# sourceMappingURL=state.js.map

package/dist/cli/state.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"state.js","sourceRoot":"","sources":["../../src/cli/state.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBH,8BAOC;AAED,8BAGC;AAED,gCAUC;AAED,8BAYC;AAzDD,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAEhB,QAAA,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;AAClD,QAAA,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAW,EAAE,YAAY,CAAC,CAAC;AAClD,QAAA,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,mBAAW,EAAE,SAAS,CAAC,CAAC;AAa1D,SAAgB,SAAS;IACvB,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,kBAAU,CAAC;YAAE,OAAO,EAAE,CAAC;QAC1C,OAAO,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,kBAAU,EAAE,OAAO,CAAC,CAAa,CAAC;IACtE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAgB,SAAS,CAAC,KAAe;IACvC,EAAE,CAAC,SAAS,CAAC,mBAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,EAAE,CAAC,aAAa,CAAC,kBAAU,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,SAAgB,UAAU;IACxB,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,kBAAU,CAAC,EAAE,CAAC;YAC9B,EAAE,CAAC,UAAU,CAAC,kBAAU,CAAC,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAgB,SAAS,CAAC,KAAa,EAAE,UAAmC,EAAE;IAC5E,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,mBAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC;YAC3B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,KAAK;YACL,OAAO;SACR,CAAC,CAAC;QACH,EAAE,CAAC,cAAc,CAAC,gBAAQ,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,wCAAwC;IAC1C,CAAC;AACH,CAAC"}

package/dist/cli/util.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Shared CLI utilities: console formatting, prompts, env-driven endpoint
+ * resolution, and the "require credentials" guard.
+ */
+import { Credentials } from '../credentials';
+export declare const CHECK = "\u001B[32m\u2714\u001B[0m";
+export declare const CROSS = "\u001B[31m\u2718\u001B[0m";
+export declare const WARN = "\u001B[33m!\u001B[0m";
+export declare class CLIError extends Error {
+    constructor(message: string);
+}
+export declare function out(message?: string): void;
+export declare function maskSecret(secret: string): string;
+export declare function prompt(question: string, defaultValue?: string): Promise<string>;
+export declare function promptYesNo(question: string, defaultValue?: boolean): Promise<boolean>;
+export declare function backendBase(): string;
+export declare function proxyBase(): string;
+export declare function requireCredentials(): Credentials;
+//# sourceMappingURL=util.d.ts.map

package/dist/cli/util.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.d.ts","sourceRoot":"","sources":["../../src/cli/util.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAGH,OAAO,EAAuC,WAAW,EAAE,MAAM,gBAAgB,CAAC;AAGlF,eAAO,MAAM,KAAK,8BAAqB,CAAC;AACxC,eAAO,MAAM,KAAK,8BAAqB,CAAC;AACxC,eAAO,MAAM,IAAI,yBAAqB,CAAC;AAEvC,qBAAa,QAAS,SAAQ,KAAK;gBACrB,OAAO,EAAE,MAAM;CAI5B;AAED,wBAAgB,GAAG,CAAC,OAAO,GAAE,MAAW,GAAG,IAAI,CAE9C;AAED,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAIjD;AAED,wBAAsB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CASrF;AAED,wBAAsB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,GAAE,OAAe,GAAG,OAAO,CAAC,OAAO,CAAC,CAKnG;AAED,wBAAgB,WAAW,IAAI,MAAM,CAIpC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED,wBAAgB,kBAAkB,IAAI,WAAW,CAQhD"}

package/dist/cli/util.js

@@ -0,0 +1,107 @@
+"use strict";
+/**
+ * Shared CLI utilities: console formatting, prompts, env-driven endpoint
+ * resolution, and the "require credentials" guard.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.CLIError = exports.WARN = exports.CROSS = exports.CHECK = void 0;
+exports.out = out;
+exports.maskSecret = maskSecret;
+exports.prompt = prompt;
+exports.promptYesNo = promptYesNo;
+exports.backendBase = backendBase;
+exports.proxyBase = proxyBase;
+exports.requireCredentials = requireCredentials;
+const readline = __importStar(require("readline"));
+const credentials_1 = require("../credentials");
+const _build_env_1 = require("../_build_env");
+exports.CHECK = '\x1b[32m✔\x1b[0m';
+exports.CROSS = '\x1b[31m✘\x1b[0m';
+exports.WARN = '\x1b[33m!\x1b[0m';
+class CLIError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'CLIError';
+    }
+}
+exports.CLIError = CLIError;
+function out(message = '') {
+    process.stdout.write(message + '\n');
+}
+function maskSecret(secret) {
+    if (!secret)
+        return '';
+    if (secret.length <= 16)
+        return secret;
+    return secret.slice(0, 16) + '...';
+}
+async function prompt(question, defaultValue) {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const suffix = defaultValue ? ` [${defaultValue}]` : '';
+    return new Promise((resolve) => {
+        rl.question(`${question}${suffix}: `, (answer) => {
+            rl.close();
+            resolve(answer.trim() || defaultValue || '');
+        });
+    });
+}
+async function promptYesNo(question, defaultValue = false) {
+    const hint = defaultValue ? 'Y/n' : 'y/N';
+    const answer = (await prompt(`${question} [${hint}]`)).toLowerCase();
+    if (!answer)
+        return defaultValue;
+    return answer === 'y' || answer === 'yes';
+}
+function backendBase() {
+    const explicit = process.env.BACKEND_ENDPOINT || process.env.ARMORIQ_BACKEND_URL;
+    if (explicit)
+        return explicit.replace(/\/+$/, '');
+    return (0, _build_env_1.resolveEndpoint)('backend').replace(/\/+$/, '');
+}
+function proxyBase() {
+    const explicit = process.env.PROXY_ENDPOINT;
+    if (explicit)
+        return explicit.replace(/\/+$/, '');
+    return (0, _build_env_1.resolveEndpoint)('proxy').replace(/\/+$/, '');
+}
+function requireCredentials() {
+    const creds = (0, credentials_1.loadCredentials)();
+    if (!creds) {
+        throw new CLIError(`Not logged in (${(0, credentials_1.getCredentialsPath)()} missing). Run \`armoriq login\` first.`);
+    }
+    return creds;
+}
+//# sourceMappingURL=util.js.map

package/dist/cli/util.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"util.js","sourceRoot":"","sources":["../../src/cli/util.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAiBH,kBAEC;AAED,gCAIC;AAED,wBASC;AAED,kCAKC;AAED,kCAIC;AAED,8BAIC;AAED,gDAQC;AA/DD,mDAAqC;AACrC,gDAAkF;AAClF,8CAAgD;AAEnC,QAAA,KAAK,GAAG,kBAAkB,CAAC;AAC3B,QAAA,KAAK,GAAG,kBAAkB,CAAC;AAC3B,QAAA,IAAI,GAAG,kBAAkB,CAAC;AAEvC,MAAa,QAAS,SAAQ,KAAK;IACjC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;IACzB,CAAC;CACF;AALD,4BAKC;AAED,SAAgB,GAAG,CAAC,UAAkB,EAAE;IACtC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;AACvC,CAAC;AAED,SAAgB,UAAU,CAAC,MAAc;IACvC,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IACvB,IAAI,MAAM,CAAC,MAAM,IAAI,EAAE;QAAE,OAAO,MAAM,CAAC;IACvC,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC;AACrC,CAAC;AAEM,KAAK,UAAU,MAAM,CAAC,QAAgB,EAAE,YAAqB;IAClE,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,YAAY,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IACxD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,GAAG,MAAM,IAAI,EAAE,CAAC,MAAM,EAAE,EAAE;YAC/C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,YAAY,IAAI,EAAE,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAEM,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,eAAwB,KAAK;IAC/E,MAAM,IAAI,GAAG,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1C,MAAM,MAAM,GAAG,CAAC,MAAM,MAAM,CAAC,GAAG,QAAQ,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,IAAI,CAAC,MAAM;QAAE,OAAO,YAAY,CAAC;IACjC,OAAO,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK,CAAC;AAC5C,CAAC;AAED,SAAgB,WAAW;IACzB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC;IACjF,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAA,4BAAe,EAAC,SAAS,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,SAAS;IACvB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;IAC5C,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAClD,OAAO,IAAA,4BAAe,EAAC,OAAO,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,SAAgB,kBAAkB;IAChC,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,QAAQ,CAChB,kBAAkB,IAAA,gCAAkB,GAAE,yCAAyC,CAChF,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC"}

package/dist/client.d.ts

@@ -1,7 +1,8 @@
 /**
  * ArmorIQ SDK Client - Main entry point for SDK usage.
  */
-import { IntentToken, PlanCapture, MCPInvocationResult, DelegationResult, SDKConfig, MCPSemanticMetadata, InvokeOptions, DelegationRequestParams, DelegationRequestResult, ApprovedDelegation } from './models';
+import axios from 'axios';
+import { IntentToken, PlanCapture, MCPInvocationResult, DelegationResult, SDKConfig, MCPSemanticMetadata, InvokeOptions, DelegationRequestParams, DelegationRequestResult, ApprovedDelegation, McpCredential, McpCredentialMap } from './models';
 export declare class ArmorIQClient {
     private static readonly DEFAULT_IAP_ENDPOINT;
     private static readonly DEFAULT_PROXY_ENDPOINT;
@@ -21,10 +22,20 @@ export declare class ArmorIQClient {
     private contextId;
     private apiKey;
     private timeout;
+    private maxRetries;
     private verifySsl;
     private httpClient;
     private tokenCache;
     private metadataCache;
+    private mcpCredentials;
+    private bootstrapCache;
+    private userCache;
+    private userContextTtlSeconds;
+    /**
+     * When set by ArmorIQUserScope, all enforcement / token minting calls
+     * are tagged with this email. Read by session and report paths.
+     */
+    userEmailOverride?: string;
     constructor(options?: Partial<SDKConfig> & {
         apiKey?: string;
         useProduction?: boolean;
@@ -33,6 +44,47 @@ export declare class ArmorIQClient {
      * Get the default proxy endpoint URL.
      */
     get proxyEndpoint(): string;
+    /**
+     * Internal accessor for ArmorIQSession and other in-package consumers.
+     * Not part of the public API.
+     * @internal
+     */
+    _sessionInternals(): {
+        apiKey: string;
+        backendEndpoint: string;
+        defaultProxyEndpoint: string;
+        httpClient: axios.AxiosInstance;
+        userId: string;
+    };
+    /**
+     * Start a session bound to this client. Mirrors PY ArmorIQClient.start_session.
+     */
+    startSession(opts?: import('./session').SessionOptions): import('./session').ArmorIQSession;
+    bootstrap(): Promise<Record<string, any>>;
+    refreshBootstrap(): Promise<Record<string, any>>;
+    resolveUser(userEmail: string): Promise<Record<string, any>>;
+    invalidateUser(userEmail: string): void;
+    forUser(userEmail: string): ArmorIQUserScope;
+    /**
+     * Construct an ArmorIQClient from an armoriq.yaml file. Mirrors PY
+     * ArmorIQClient.from_config — reads YAML, expands $VAR / ${VAR} env refs,
+     * builds the SDKConfig, and returns a ready client.
+     */
+    static fromConfig(filePath?: string): ArmorIQClient;
+    static resolveMcpCredentials(fromOptions?: McpCredentialMap): McpCredentialMap;
+    private getMcpCredential;
+    static encodeMcpAuthHeader(cred: McpCredential): string;
+    private shouldRetry;
+    /**
+     * POST with exponential backoff. Reuses the same Idempotency-Key
+     * across retries so the backend can dedupe on its side.
+     * @internal
+     */
+    _retryPost(url: string, body: unknown, options?: {
+        headers?: Record<string, string>;
+        timeout?: number;
+        idempotencyKey?: string;
+    }): Promise<import('axios').AxiosResponse>;
     /**
      * Validate API key with the proxy server.
      */
@@ -99,6 +151,9 @@ export declare class ArmorIQClient {
     checkApprovedDelegation(userEmail: string, tool: string, amount: number): Promise<ApprovedDelegation | null>;
     /**
      * Mark a delegation as executed.
+     *
+     * Idempotent on the backend (delegationId-keyed), so a stable
+     * Idempotency-Key derived from the delegation_id is safe to retry.
      */
     markDelegationExecuted(userEmail: string, delegationId: string): Promise<void>;
     /**
@@ -107,6 +162,9 @@ export declare class ArmorIQClient {
     completePlan(planId: string): Promise<void>;
     /**
      * Update an intent plan's status.
+     *
+     * Status transitions are idempotent — retrying with the same
+     * `planId:status` key is safe.
      * Valid statuses: 'active', 'completed', 'failed', 'expired'
      */
     updatePlanStatus(planId: string, status: string): Promise<void>;
@@ -119,4 +177,18 @@ export declare class ArmorIQClient {
      */
     close(): void;
 }
+/**
+ * User-scoped helper returned by ArmorIQClient.forUser(email).
+ *
+ * Mirrors armoriq_sdk/client.py:ArmorIQUserScope. Tags all token-minting
+ * and enforcement calls with the bound email so multi-user agents route
+ * per-request policies correctly.
+ */
+export declare class ArmorIQUserScope {
+    private client;
+    readonly userEmail: string;
+    constructor(client: ArmorIQClient, userEmail: string);
+    startSession(opts?: import('./session').SessionOptions): import('./session').ArmorIQSession;
+    resolve(): Promise<Record<string, any>>;
+}
 //# sourceMappingURL=client.d.ts.map