@armoriq/sdk-dev 0.3.10 → 0.4.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli/commands/auth.d.ts.map +1 -1
- package/dist/cli/commands/auth.js +13 -3
- package/dist/cli/commands/auth.js.map +1 -1
- package/dist/client.d.ts +24 -1
- package/dist/client.d.ts.map +1 -1
- package/dist/client.js +137 -66
- package/dist/client.js.map +1 -1
- package/dist/crypto_verify.d.ts +4 -0
- package/dist/crypto_verify.d.ts.map +1 -0
- package/dist/crypto_verify.js +135 -0
- package/dist/crypto_verify.js.map +1 -0
- package/dist/index.d.ts +2 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +4 -2
- package/dist/index.js.map +1 -1
- package/dist/plan_builder.d.ts +3 -2
- package/dist/plan_builder.d.ts.map +1 -1
- package/dist/plan_builder.js +5 -3
- package/dist/plan_builder.js.map +1 -1
- package/dist/session.d.ts.map +1 -1
- package/dist/session.js +29 -15
- package/dist/session.js.map +1 -1
- package/dist/token_usage.d.ts +22 -0
- package/dist/token_usage.d.ts.map +1 -0
- package/dist/token_usage.js +71 -0
- package/dist/token_usage.js.map +1 -0
- package/package.json +1 -1
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;
|
|
1
|
+
{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAmOH,wBAAsB,QAAQ,CAAC,IAAI,EAAE;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,OAAO,CAAC,MAAM,CAAC,CA+HlB;AAED,wBAAgB,SAAS,IAAI,MAAM,CAOlC;AAED,wBAAgB,SAAS,IAAI,MAAM,CAkBlC"}
|
|
@@ -47,6 +47,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
47
47
|
exports.cmdLogin = cmdLogin;
|
|
48
48
|
exports.cmdLogout = cmdLogout;
|
|
49
49
|
exports.cmdWhoami = cmdWhoami;
|
|
50
|
+
const crypto = __importStar(require("crypto"));
|
|
50
51
|
const http = __importStar(require("http"));
|
|
51
52
|
const net = __importStar(require("net"));
|
|
52
53
|
const url_1 = require("url");
|
|
@@ -188,7 +189,7 @@ function findFreePort() {
|
|
|
188
189
|
});
|
|
189
190
|
});
|
|
190
191
|
}
|
|
191
|
-
function startCallbackServer(port, product) {
|
|
192
|
+
function startCallbackServer(port, expectedState, product) {
|
|
192
193
|
let resolveResult;
|
|
193
194
|
const once = new Promise((resolve) => {
|
|
194
195
|
resolveResult = resolve;
|
|
@@ -197,6 +198,14 @@ function startCallbackServer(port, product) {
|
|
|
197
198
|
const url = new url_1.URL(req.url ?? '/', `http://localhost:${port}`);
|
|
198
199
|
if (url.pathname === '/callback') {
|
|
199
200
|
const params = Object.fromEntries(url.searchParams.entries());
|
|
201
|
+
// Reject any callback that doesn't carry the state nonce we generated.
|
|
202
|
+
// Without this, any local process or web page could hit the loopback
|
|
203
|
+
// port with ?key=<attacker> during the login window (key fixation).
|
|
204
|
+
if (!params.state || params.state !== expectedState) {
|
|
205
|
+
res.writeHead(400, { 'Content-Type': 'text/plain; charset=utf-8' });
|
|
206
|
+
res.end('Invalid or missing state parameter.');
|
|
207
|
+
return;
|
|
208
|
+
}
|
|
200
209
|
const callbackProduct = params.product || product;
|
|
201
210
|
res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
|
|
202
211
|
res.end(renderSuccessHtml({
|
|
@@ -255,8 +264,9 @@ async function cmdLogin(args) {
|
|
|
255
264
|
(0, util_1.out)(' \x1b[1m\x1b[36m┃ ArmorIQ Login\x1b[0m');
|
|
256
265
|
(0, util_1.out)('');
|
|
257
266
|
const port = await findFreePort();
|
|
258
|
-
const
|
|
259
|
-
const
|
|
267
|
+
const state = crypto.randomBytes(16).toString('hex');
|
|
268
|
+
const callbackUrl = `http://localhost:${port}/callback?state=${state}`;
|
|
269
|
+
const { server, once: callbackOnce } = startCallbackServer(port, state, product);
|
|
260
270
|
let dc;
|
|
261
271
|
try {
|
|
262
272
|
const r = await axios_1.default.post(`${backend}/auth/device/code`, { callback_url: callbackUrl }, { timeout: 10000 });
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
|
|
1
|
+
{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../../src/cli/commands/auth.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAmOH,4BAoIC;AAED,8BAOC;AAED,8BAkBC;AAlYD,+CAAiC;AACjC,2CAA6B;AAC7B,yCAA2B;AAC3B,6BAA0B;AAC1B,iDAAqC;AACrC,kDAA0B;AAC1B,mDAM2B;AAC3B,kCAAyE;AAEzE,MAAM,cAAc,GAA2B;IAC7C,WAAW,EAAE,aAAa;IAC1B,UAAU,EAAE,YAAY;IACxB,YAAY,EAAE,cAAc;IAC5B,SAAS,EAAE,WAAW;IACtB,QAAQ,EAAE,kBAAkB;IAC5B,GAAG,EAAE,aAAa;CACnB,CAAC;AAEF,SAAS,UAAU,CAAC,CAAS;IAC3B,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CACjC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAClF,CAAC;AACJ,CAAC;AAED,SAAS,iBAAiB,CAAC,IAA0D;IACnF,MAAM,UAAU,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAC7D,MAAM,YAAY,GAAG,cAAc,CAAC,UAAU,CAAC,IAAI,IAAI,CAAC;IACxD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK;QAC1B,CAAC,CAAC,sBAAsB,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ;QACtD,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,WAAW,GAAG,YAAY;QAC9B,CAAC,CAAC,kCAAkC,UAAU,CAAC,YAAY,CAAC,QAAQ;QACpE,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO;;;;;sEAK6D,kBAAkB,CACtF,kTAAkT,CACnT;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;MA2EK,SAAS;MACT,WAAW;;;;;WAKN,IAAI;;;;;;;;eAQA,CAAC;AAChB,CAAC;AAED,SAAS,YAAY;IACnB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,EAAE,CAAC;QAClC,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACrC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC;gBACvB,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,yBAAyB,CAAC,CAAC,CAAC;YAC/C,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AASD,SAAS,mBAAmB,CAC1B,IAAY,EACZ,aAAqB,EACrB,OAAgB;IAEhB,IAAI,aAA0C,CAAC;IAC/C,MAAM,IAAI,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;QACnD,aAAa,GAAG,OAAO,CAAC;IAC1B,CAAC,CAAC,CAAC;IACH,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QAC5C,MAAM,GAAG,GAAG,IAAI,SAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;QAChE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;YACjC,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC,CAAC;YAC9D,uEAAuE;YACvE,qEAAqE;YACrE,oEAAoE;YACpE,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,KAAK,KAAK,aAAa,EAAE,CAAC;gBACpD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC;gBAC/C,OAAO;YACT,CAAC;YACD,MAAM,eAAe,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC;YAClD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;YACnE,GAAG,CAAC,GAAG,CACL,iBAAiB,CAAC;gBAChB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,eAAe;gBACxB,KAAK,EAAE,MAAM,CAAC,MAAM;aACrB,CAAC,CACH,CAAC;YACF,MAAM,MAAM,GAAmB;gBAC7B,OAAO,EAAE,MAAM,CAAC,GAAG;gBACnB,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,OAAO,EAAE,MAAM,CAAC,OAAO;gBACvB,MAAM,EAAE,MAAM,CAAC,MAAM;aACtB,CAAC;YACF,IAAI,MAAM,CAAC,OAAO;gBAAE,aAAa,CAAC,MAAM,CAAC,CAAC;QAC5C,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YACnB,GAAG,CAAC,GAAG,EAAE,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IACjC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,GAAG,GACP,OAAO,CAAC,QAAQ,KAAK,QAAQ;QAC3B,CAAC,CAAC,SAAS,GAAG,GAAG;QACjB,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;YAC5B,CAAC,CAAC,aAAa,GAAG,GAAG;YACrB,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC;IAC5B,IAAA,oBAAI,EAAC,GAAG,EAAE,GAAG,EAAE;QACb,iBAAiB;IACnB,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AAC/C,CAAC;AAEM,KAAK,UAAU,QAAQ,CAAC,IAK9B;IACC,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,IAAI,IAAA,kBAAW,GAAE,CAAC,CAAC,OAAO,CACxF,MAAM,EACN,EAAE,CACH,CAAC;IACF,MAAM,YAAY,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAE3E,2EAA2E;IAC3E,4EAA4E;IAC5E,yBAAyB;IACzB,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,YAAY,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,IAAA,6BAAe,GAAE,CAAC;QACnC,IAAI,QAAQ,EAAE,CAAC;YACb,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;YACR,IAAA,UAAG,EACD,KAAK,YAAK,gCAAgC,QAAQ,CAAC,KAAK,IAAI,SAAS,iBAAiB,QAAQ,CAAC,KAAK,IAAI,SAAS,GAAG,CACrH,CAAC;YACF,IAAA,UAAG,EACD,gJAAgJ,CACjJ,CAAC;YACF,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;YACR,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IAED,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;IACR,IAAA,UAAG,EAAC,yCAAyC,CAAC,CAAC;IAC/C,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;IAER,MAAM,IAAI,GAAG,MAAM,YAAY,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IACrD,MAAM,WAAW,GAAG,oBAAoB,IAAI,mBAAmB,KAAK,EAAE,CAAC;IACvE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,mBAAmB,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;IAEjF,IAAI,EAAO,CAAC;IACZ,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,MAAM,eAAK,CAAC,IAAI,CAAC,GAAG,OAAO,mBAAmB,EAAE,EAAE,YAAY,EAAE,WAAW,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7G,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,IAAA,UAAG,EAAC,KAAK,YAAK,mCAAoC,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QACzE,OAAO,CAAC,CAAC;IACX,CAAC;IAED,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,yBAAyB,EAAE,GAAG,EAAE,CAAC;IACjE,MAAM,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,EAAE,CAAC,UAAU,IAAI,GAAG,CAAC,IAAI,GAAG,CAAC;IAEtD,MAAM,GAAG,GAAG,yBAAyB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;IAChE,IAAI,UAAU,GACZ,GAAG,yBAAyB,GAAG,GAAG,YAAY,kBAAkB,CAAC,WAAW,CAAC,EAAE,CAAC;IAClF,IAAI,YAAY;QAAE,UAAU,IAAI,QAAQ,kBAAkB,CAAC,YAAY,CAAC,EAAE,CAAC;IAC3E,IAAI,OAAO;QAAE,UAAU,IAAI,YAAY,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;IAErE,IAAA,UAAG,EAAC,wBAAwB,CAAC,CAAC;IAC9B,WAAW,CAAC,UAAU,CAAC,CAAC;IACxB,IAAA,UAAG,EAAC,uCAAuC,CAAC,CAAC;IAC7C,IAAA,UAAG,EAAC,sBAAsB,UAAU,WAAW,CAAC,CAAC;IACjD,IAAA,UAAG,EAAC,+CAA+C,SAAS,WAAW,CAAC,CAAC;IACzE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,GAAG,IAAI,CAAC;IAC/C,IAAI,MAAkC,CAAC;IACvC,IAAI,OAA2B,CAAC;IAEhC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACxC,wDAAwD;QACxD,MAAM,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC;YACrC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAU,CAAC;YAC7D,KAAK,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAU,CAAC;SAC/D,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,iBAAiB,CAAC;QACrC,IAAI,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;YAC7C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;YACpB,MAAM;QACR,CAAC;QACD,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,MAAM,eAAK,CAAC,IAAI,CACzB,GAAG,OAAO,oBAAoB,EAC9B,EAAE,UAAU,EAAE,WAAW,EAAE,EAC3B,EAAE,OAAO,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,EAAE,CAC/C,CAAC;YACF,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;YAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC;YACvB,IAAI,GAAG,KAAK,uBAAuB,IAAI,GAAG,KAAK,WAAW;gBAAE,SAAS;YACrE,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,GAAG,IAAI,CAAC,iBAAiB,IAAI,GAAG,CAAC;gBACxC,MAAM;YACR,CAAC;YACD,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,GAAG;oBACP,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,KAAK,EAAE,IAAI,CAAC,KAAK;oBACjB,OAAO,EAAE,IAAI,CAAC,OAAO;oBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;iBACpB,CAAC;gBACF,MAAM;YACR,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,6BAA6B;QAC/B,CAAC;IACH,CAAC;IAED,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAC/B,IAAA,UAAG,EAAC,IAAI,YAAK,EAAE,CAAC,CAAC;QACjB,IAAA,UAAG,EAAC,KAAK,YAAK,IAAI,OAAO,IAAI,iEAAiE,EAAE,CAAC,CAAC;QAClG,OAAO,CAAC,CAAC;IACX,CAAC;IAED,IAAA,6BAAe,EAAC;QACd,MAAM,EAAE,MAAM,CAAC,OAAO;QACtB,KAAK,EAAE,MAAM,CAAC,KAAK,IAAI,EAAE;QACzB,MAAM,EAAE,MAAM,CAAC,OAAO,IAAI,EAAE;QAC5B,KAAK,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC1B,OAAO,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KAClC,CAAC,CAAC;IACH,IAAA,UAAG,EAAC,IAAI,YAAK,EAAE,CAAC,CAAC;IACjB,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;IACR,IAAA,UAAG,EACD,KAAK,YAAK,wBAAwB,MAAM,CAAC,KAAK,IAAI,SAAS,iBAAiB,MAAM,CAAC,MAAM,IAAI,SAAS,GAAG,CAC1G,CAAC;IACF,IAAA,UAAG,EAAC,KAAK,YAAK,qBAAqB,IAAA,gCAAkB,GAAE,EAAE,CAAC,CAAC;IAC3D,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;IACR,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,SAAS;IACvB,IAAI,IAAA,8BAAgB,GAAE,EAAE,CAAC;QACvB,IAAA,UAAG,EAAC,KAAK,YAAK,6BAA6B,IAAA,gCAAkB,GAAE,EAAE,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,IAAA,UAAG,EAAC,4DAA4D,CAAC,CAAC;IACpE,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,SAAgB,SAAS;IACvB,MAAM,KAAK,GAAG,IAAA,6BAAe,GAAE,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,IAAA,UAAG,EAAC,qEAAqE,CAAC,CAAC;QAC3E,OAAO,CAAC,CAAC;IACX,CAAC;IACD,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;IACR,IAAA,UAAG,EAAC,+CAA+C,CAAC,CAAC;IACrD,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;IACR,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC;IAC/F,IAAA,UAAG,EAAC,sBAAsB,KAAK,CAAC,KAAK,IAAI,SAAS,SAAS,CAAC,CAAC;IAC7D,IAAA,UAAG,EAAC,sBAAsB,UAAU,SAAS,CAAC,CAAC;IAC/C,IAAA,UAAG,EAAC,sBAAsB,KAAK,CAAC,MAAM,IAAI,KAAK,SAAS,CAAC,CAAC;IAC1D,IAAA,UAAG,EAAC,sBAAsB,KAAK,CAAC,KAAK,IAAI,KAAK,SAAS,CAAC,CAAC;IACzD,IAAA,UAAG,EAAC,sBAAsB,KAAK,CAAC,OAAO,IAAI,KAAK,SAAS,CAAC,CAAC;IAC3D,IAAA,UAAG,EAAC,sBAAsB,IAAA,gCAAkB,GAAE,SAAS,CAAC,CAAC;IACzD,IAAA,UAAG,EAAC,EAAE,CAAC,CAAC;IACR,OAAO,CAAC,CAAC;AACX,CAAC"}
|
package/dist/client.d.ts
CHANGED
|
@@ -3,6 +3,7 @@
|
|
|
3
3
|
*/
|
|
4
4
|
import axios from 'axios';
|
|
5
5
|
import { IntentToken, PlanCapture, MCPInvocationResult, DelegationResult, SDKConfig, MCPSemanticMetadata, InvokeOptions, DelegationRequestParams, DelegationRequestResult, ApprovedDelegation, McpCredential, McpCredentialMap, PapRefineRequest, PapRefineResult } from './models';
|
|
6
|
+
import { RecordTokenUsagePayload } from './token_usage';
|
|
6
7
|
/**
|
|
7
8
|
* Lightweight error used by the PAP refine() path when fail-closed mode
|
|
8
9
|
* is active and the gateway is unreachable or returned an error.
|
|
@@ -81,6 +82,25 @@ export declare class ArmorIQClient {
|
|
|
81
82
|
refreshBootstrap(): Promise<Record<string, any>>;
|
|
82
83
|
resolveUser(userEmail: string): Promise<Record<string, any>>;
|
|
83
84
|
invalidateUser(userEmail: string): void;
|
|
85
|
+
recordTokenUsage(payload: RecordTokenUsagePayload): Promise<{
|
|
86
|
+
ok: boolean;
|
|
87
|
+
status?: number;
|
|
88
|
+
recorded?: number;
|
|
89
|
+
reason?: string;
|
|
90
|
+
}>;
|
|
91
|
+
/**
|
|
92
|
+
* Convenience: parse a JSONL transcript and post its token usage in one call.
|
|
93
|
+
* Use from a tool's session-end hook. Returns the parsed entry count.
|
|
94
|
+
*/
|
|
95
|
+
captureTranscriptTokens(opts: {
|
|
96
|
+
transcriptPath: string;
|
|
97
|
+
product: string;
|
|
98
|
+
sessionId: string;
|
|
99
|
+
}): Promise<{
|
|
100
|
+
ok: boolean;
|
|
101
|
+
recorded: number;
|
|
102
|
+
reason?: string;
|
|
103
|
+
}>;
|
|
84
104
|
forUser(userEmail: string): ArmorIQUserScope;
|
|
85
105
|
/**
|
|
86
106
|
* Construct an ArmorIQClient from an armoriq.yaml file. Mirrors PY
|
|
@@ -190,7 +210,10 @@ export declare class ArmorIQClient {
|
|
|
190
210
|
delegatedToken: IntentToken;
|
|
191
211
|
}>;
|
|
192
212
|
/**
|
|
193
|
-
* Verify an intent token
|
|
213
|
+
* Verify an intent token: checks expiry AND cryptographically verifies the
|
|
214
|
+
* Ed25519 signature over the canonical signed payload (which binds planHash).
|
|
215
|
+
* Any tampering with the signed fields - including planHash - makes this
|
|
216
|
+
* return false. Fails closed on missing material or any error.
|
|
194
217
|
*/
|
|
195
218
|
verifyToken(intentToken: IntentToken): Promise<boolean>;
|
|
196
219
|
/**
|
package/dist/client.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAwB,MAAM,OAAO,CAAC;
|
|
1
|
+
{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAwB,MAAM,OAAO,CAAC;AAI7C,OAAO,EACL,WAAW,EACX,WAAW,EACX,mBAAmB,EACnB,gBAAgB,EAChB,SAAS,EACT,mBAAmB,EAEnB,aAAa,EACb,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAElB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,eAAe,EAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,uBAAuB,EAA4B,MAAM,eAAe,CAAC;AAYlF;;;GAGG;AACH,qBAAa,YAAa,SAAQ,KAAK;gBACzB,OAAO,EAAE,MAAM;CAI5B;AAkBD,qBAAa,aAAa;IAExB,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,CAA4B;IACxE,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAA8B;IAC5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAA4B;IAQ5E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,sBAAsB,CAAqC;IACnF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,CAAuC;IACvF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,CAAsC;IAMxF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,4BAA4B,CAA2B;IAC/E,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,8BAA8B,CAA2B;IACjF,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,gCAAgC,CAA2B;IAEnF,OAAO,CAAC,WAAW,CAAS;IAC5B,OAAO,CAAC,oBAAoB,CAAS;IACrC,OAAO,CAAC,eAAe,CAAS;IAChC,OAAO,CAAC,cAAc,CAAyB;IAC/C,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAU;IAC3B,OAAO,CAAC,UAAU,CAAgB;IAClC,OAAO,CAAC,UAAU,CAA2B;IAC7C,OAAO,CAAC,aAAa,CAAmC;IACxD,OAAO,CAAC,cAAc,CAAmB;IACzC,OAAO,CAAC,cAAc,CAAoC;IAC1D,OAAO,CAAC,SAAS,CAA4E;IAC7F,OAAO,CAAC,qBAAqB,CAAe;IAC5C;;;OAGG;IACI,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAElC;;;;OAIG;IACI,aAAa,CAAC,EAAE,MAAM,CAAC;IAC9B,wEAAwE;IACjE,WAAW,EAAE,MAAM,GAAG,QAAQ,CAAY;gBAErC,OAAO,GAAE,OAAO,CAAC,SAAS,CAAC,GAAG;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,CAAC,EAAE,OAAO,CAAA;KAAO;IA2J3F;;OAEG;IACH,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED;;;;OAIG;IACH,iBAAiB;;;;;;;;IAWjB,WAAW,CAAC,OAAO,EAAE,MAAM;IAI3B;;OAEG;IACH,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,WAAW,EAAE,cAAc,GAAG,OAAO,WAAW,EAAE,cAAc;IAarF,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAgBzC,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAQhD,WAAW,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAuBlE,cAAc,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAUjC,gBAAgB,CACpB,OAAO,EAAE,uBAAuB,GAC/B,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAuBhF;;;OAGG;IACG,uBAAuB,CAAC,IAAI,EAAE;QAClC,cAAc,EAAE,MAAM,CAAC;QACvB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;KACnB,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAW/D,OAAO,CAAC,SAAS,EAAE,MAAM,GAAG,gBAAgB;IAW5C;;;;OAIG;IACH,MAAM,CAAC,UAAU,CAAC,QAAQ,GAAE,MAAuB,GAAG,aAAa;IAgCnE,MAAM,CAAC,qBAAqB,CAAC,WAAW,CAAC,EAAE,gBAAgB,GAAG,gBAAgB;IAqD9E,OAAO,CAAC,gBAAgB;IAMxB,MAAM,CAAC,mBAAmB,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM;IAWvD,OAAO,CAAC,WAAW;IAKnB;;;;OAIG;IACG,UAAU,CACd,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,OAAO,EACb,OAAO,GAAE;QACP,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,MAAM,CAAC;KACpB,GACL,OAAO,CAAC,OAAO,OAAO,EAAE,aAAa,CAAC;IAwCzC;;OAEG;YACW,cAAc;IA4B5B;;OAEG;IACH,WAAW,CACT,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC7B,WAAW;IAyCd;;;;;;;;;;;OAWG;IACG,MAAM,CAAC,GAAG,EAAE,gBAAgB,GAAG,OAAO,CAAC,eAAe,CAAC;IAqD7D;;OAEG;IACG,cAAc,CAClB,WAAW,EAAE,WAAW,EACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,eAAe,GAAE,MAAa,GAC7B,OAAO,CAAC,WAAW,CAAC;IA0GvB;;OAEG;IACG,MAAM,CACV,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,EACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,WAAW,CAAC,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,EACxC,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,mBAAmB,CAAC;IAiR/B;;OAEG;IACG,QAAQ,CACZ,WAAW,EAAE,WAAW,EACxB,iBAAiB,EAAE,MAAM,EACzB,eAAe,GAAE,MAAa,EAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,EACzB,WAAW,CAAC,EAAE,MAAM,EACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,GAC5B,OAAO,CAAC,gBAAgB,CAAC;IAiG5B;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,WAAW,EACxB,MAAM,EAAE,MAAM,EACd,IAAI,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACtE,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IA2B3E;;;;OAIG;IACG,QAAQ,CACZ,WAAW,EAAE,WAAW,EACxB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAChC,MAAM,CAAC,EAAE,MAAM,EACf,IAAI,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,eAAe,CAAC,EAAE,MAAM,CAAA;KAAE,GACnD,OAAO,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,GAAG,CAAA;KAAE,CAAC;IAwB3C;;;;;;OAMG;IACG,eAAe,CACnB,WAAW,EAAE,WAAW,EACxB,IAAI,EAAE;QACJ,iBAAiB,EAAE,MAAM,CAAC;QAC1B,WAAW,EAAE,MAAM,CAAC;QACpB,eAAe,CAAC,EAAE,MAAM,CAAC;QACzB,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACjC,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;QACxB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B,GACA,OAAO,CAAC;QACT,OAAO,EAAE,MAAM,CAAC;QAChB,KAAK,EAAE,GAAG,CAAC;QACX,cAAc,EAAE,GAAG,EAAE,CAAC;QACtB,WAAW,EAAE,MAAM,CAAC;QACpB;;;;WAIG;QACH,cAAc,EAAE,WAAW,CAAC;KAC7B,CAAC;IAyDF;;;;;OAKG;IACG,WAAW,CAAC,WAAW,EAAE,WAAW,GAAG,OAAO,CAAC,OAAO,CAAC;IAoC7D;;OAEG;IACG,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IA6BtE;;OAEG;IACG,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAI7C;;OAEG;IACG,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAY9E;;OAEG;IACG,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAaxD;;OAEG;YACW,mBAAmB;IA+BjC;;OAEG;IACG,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAOpE;;OAEG;YACW,eAAe;IA4B7B;;OAEG;IACG,uBAAuB,CAAC,MAAM,EAAE,uBAAuB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAuBhG;;OAEG;IACG,uBAAuB,CAC3B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM,GACb,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;IAgBrC;;;;;OAKG;IACG,sBAAsB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAWpF;;OAEG;IACG,YAAY,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAIjD;;;;;;OAMG;IACG,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAgBrE;;OAEG;IACG,gBAAgB,CACpB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,WAAW,EACxB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC5B,OAAO,CAAC,EAAE,aAAa,GACtB,OAAO,CAAC,mBAAmB,CAAC;IAoJ/B;;OAEG;IACH,KAAK,IAAI,IAAI;CAId;AAED;;;;;;GAMG;AACH,qBAAa,gBAAgB;IAGzB,OAAO,CAAC,MAAM;IAFhB,SAAgB,SAAS,EAAE,MAAM,CAAC;gBAExB,MAAM,EAAE,aAAa,EAC7B,SAAS,EAAE,MAAM;IAKnB,YAAY,CAAC,IAAI,CAAC,EAAE,OAAO,WAAW,EAAE,cAAc,GAAG,OAAO,WAAW,EAAE,cAAc;IAUrF,OAAO,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CAG9C"}
|
package/dist/client.js
CHANGED
|
@@ -42,7 +42,10 @@ Object.defineProperty(exports, "__esModule", { value: true });
|
|
|
42
42
|
exports.ArmorIQUserScope = exports.ArmorIQClient = exports.ArmorIQError = void 0;
|
|
43
43
|
const axios_1 = __importDefault(require("axios"));
|
|
44
44
|
const crypto = __importStar(require("crypto"));
|
|
45
|
+
const https = __importStar(require("https"));
|
|
46
|
+
const crypto_verify_1 = require("./crypto_verify");
|
|
45
47
|
const models_1 = require("./models");
|
|
48
|
+
const token_usage_1 = require("./token_usage");
|
|
46
49
|
const exceptions_1 = require("./exceptions");
|
|
47
50
|
/**
|
|
48
51
|
* Lightweight error used by the PAP refine() path when fail-closed mode
|
|
@@ -142,19 +145,25 @@ class ArmorIQClient {
|
|
|
142
145
|
options.iapEndpoint ||
|
|
143
146
|
process.env.IAP_ENDPOINT ||
|
|
144
147
|
(isArmorClaw
|
|
145
|
-
?
|
|
148
|
+
? isLocal
|
|
149
|
+
? ArmorIQClient.LOCAL_ARMORCLAW_IAP_ENDPOINT
|
|
150
|
+
: ArmorIQClient.ARMORCLAW_IAP_ENDPOINT
|
|
146
151
|
: (0, _build_env_1.resolveEndpoint)('iap'));
|
|
147
152
|
this.defaultProxyEndpoint =
|
|
148
153
|
options.proxyEndpoint ||
|
|
149
154
|
process.env.PROXY_ENDPOINT ||
|
|
150
155
|
(isArmorClaw
|
|
151
|
-
?
|
|
156
|
+
? isLocal
|
|
157
|
+
? ArmorIQClient.LOCAL_ARMORCLAW_PROXY_ENDPOINT
|
|
158
|
+
: ArmorIQClient.ARMORCLAW_PROXY_ENDPOINT
|
|
152
159
|
: (0, _build_env_1.resolveEndpoint)('proxy'));
|
|
153
160
|
this.backendEndpoint =
|
|
154
161
|
options.backendEndpoint ||
|
|
155
162
|
process.env.BACKEND_ENDPOINT ||
|
|
156
163
|
(isArmorClaw
|
|
157
|
-
?
|
|
164
|
+
? isLocal
|
|
165
|
+
? ArmorIQClient.LOCAL_ARMORCLAW_BACKEND_ENDPOINT
|
|
166
|
+
: ArmorIQClient.ARMORCLAW_BACKEND_ENDPOINT
|
|
158
167
|
: (0, _build_env_1.resolveEndpoint)('backend'));
|
|
159
168
|
// Load user/agent identifiers
|
|
160
169
|
this.userId = options.userId || process.env.USER_ID || '';
|
|
@@ -192,7 +201,9 @@ class ArmorIQClient {
|
|
|
192
201
|
'Get your API key from https://dev.armoriq.ai');
|
|
193
202
|
}
|
|
194
203
|
// Validate API key format
|
|
195
|
-
if (!this.apiKey.startsWith('ak_live_') &&
|
|
204
|
+
if (!this.apiKey.startsWith('ak_live_') &&
|
|
205
|
+
!this.apiKey.startsWith('ak_test_') &&
|
|
206
|
+
!this.apiKey.startsWith('ak_claw_')) {
|
|
196
207
|
throw new exceptions_1.ConfigurationException("Invalid API key format. API keys must start with 'ak_live_', 'ak_claw_', or 'ak_test_'. " +
|
|
197
208
|
'Get your API key from https://platform.armoriq.ai/dashboard/api-keys');
|
|
198
209
|
}
|
|
@@ -217,6 +228,8 @@ class ArmorIQClient {
|
|
|
217
228
|
timeout: this.timeout,
|
|
218
229
|
headers,
|
|
219
230
|
validateStatus: () => true, // Handle all status codes manually
|
|
231
|
+
// Honor verifySsl: only relaxes TLS verification when explicitly disabled.
|
|
232
|
+
httpsAgent: new https.Agent({ rejectUnauthorized: this.verifySsl }),
|
|
220
233
|
});
|
|
221
234
|
this.tokenCache = new Map();
|
|
222
235
|
this.metadataCache = new Map();
|
|
@@ -225,8 +238,7 @@ class ArmorIQClient {
|
|
|
225
238
|
console.log(`ArmorIQ SDK initialized: mode=${mode}, ` +
|
|
226
239
|
`user=${this.userId}, agent=${this.agentId}, ` +
|
|
227
240
|
`iap=${this.iapEndpoint}, proxy=${this.defaultProxyEndpoint}, ` +
|
|
228
|
-
`backend=${this.backendEndpoint}
|
|
229
|
-
`api_key=${'***' + this.apiKey.slice(-8)}`);
|
|
241
|
+
`backend=${this.backendEndpoint}`);
|
|
230
242
|
// Validate API key on initialization.
|
|
231
243
|
//
|
|
232
244
|
// For ArmorClaw keys (`ak_claw_*`) the proxy is OPTIONAL — local-tool
|
|
@@ -317,6 +329,46 @@ class ArmorIQClient {
|
|
|
317
329
|
invalidateUser(userEmail) {
|
|
318
330
|
this.userCache.delete(userEmail.trim().toLowerCase());
|
|
319
331
|
}
|
|
332
|
+
// ─── Token usage ─────────────────────────────────────────────────
|
|
333
|
+
// Single cross-tool path for reporting per-session LLM token usage to the
|
|
334
|
+
// dashboard. The backend upserts by (org, product, session, model), so
|
|
335
|
+
// re-posting a session's running totals is idempotent. Best-effort: never
|
|
336
|
+
// throws — returns { ok } so callers can fire-and-forget at session end.
|
|
337
|
+
async recordTokenUsage(payload) {
|
|
338
|
+
const entries = Array.isArray(payload.entries) ? payload.entries : [];
|
|
339
|
+
if (!entries.length)
|
|
340
|
+
return { ok: true, recorded: 0 };
|
|
341
|
+
try {
|
|
342
|
+
const response = await this._retryPost(`${this.backendEndpoint}/dashboard/token-usage`, {
|
|
343
|
+
product: payload.product,
|
|
344
|
+
sessionId: payload.sessionId,
|
|
345
|
+
entries,
|
|
346
|
+
}, { headers: { 'X-API-Key': this.apiKey } });
|
|
347
|
+
return {
|
|
348
|
+
ok: response.status < 400,
|
|
349
|
+
status: response.status,
|
|
350
|
+
recorded: response.data?.recorded,
|
|
351
|
+
};
|
|
352
|
+
}
|
|
353
|
+
catch (e) {
|
|
354
|
+
return { ok: false, reason: String(e?.message ?? e) };
|
|
355
|
+
}
|
|
356
|
+
}
|
|
357
|
+
/**
|
|
358
|
+
* Convenience: parse a JSONL transcript and post its token usage in one call.
|
|
359
|
+
* Use from a tool's session-end hook. Returns the parsed entry count.
|
|
360
|
+
*/
|
|
361
|
+
async captureTranscriptTokens(opts) {
|
|
362
|
+
const entries = (0, token_usage_1.summarizeTranscriptUsage)(opts.transcriptPath);
|
|
363
|
+
if (!entries.length)
|
|
364
|
+
return { ok: true, recorded: 0 };
|
|
365
|
+
const res = await this.recordTokenUsage({
|
|
366
|
+
product: opts.product,
|
|
367
|
+
sessionId: opts.sessionId,
|
|
368
|
+
entries,
|
|
369
|
+
});
|
|
370
|
+
return { ok: res.ok, recorded: entries.length, reason: res.reason };
|
|
371
|
+
}
|
|
320
372
|
forUser(userEmail) {
|
|
321
373
|
return new ArmorIQUserScope(this, userEmail);
|
|
322
374
|
}
|
|
@@ -335,7 +387,8 @@ class ArmorIQClient {
|
|
|
335
387
|
// Lazy require to avoid making js-yaml a hard dependency for callers
|
|
336
388
|
// that never use the YAML loader.
|
|
337
389
|
// eslint-disable-next-line @typescript-eslint/no-var-requires
|
|
338
|
-
const
|
|
390
|
+
const cfgModule = require('./config');
|
|
391
|
+
const { loadArmorIQConfig, resolveEnvReferences } = cfgModule;
|
|
339
392
|
const cfg = resolveEnvReferences(loadArmorIQConfig(filePath));
|
|
340
393
|
const proxyEndpoints = {};
|
|
341
394
|
const mcpCredentials = {};
|
|
@@ -395,7 +448,9 @@ class ArmorIQClient {
|
|
|
395
448
|
const apiKey = process.env[`ARMORIQ_MCP_${safe}_API_KEY`];
|
|
396
449
|
const headerName = process.env[`ARMORIQ_MCP_${safe}_HEADER_NAME`];
|
|
397
450
|
if (apiKey)
|
|
398
|
-
cred = headerName
|
|
451
|
+
cred = headerName
|
|
452
|
+
? { authType: 'api_key', apiKey, headerName }
|
|
453
|
+
: { authType: 'api_key', apiKey };
|
|
399
454
|
}
|
|
400
455
|
else if (authType === 'basic') {
|
|
401
456
|
const username = process.env[`ARMORIQ_MCP_${safe}_USERNAME`];
|
|
@@ -463,7 +518,10 @@ class ArmorIQClient {
|
|
|
463
518
|
// axios throws on network errors when validateStatus doesn't catch them;
|
|
464
519
|
// ECONNREFUSED / ETIMEDOUT / socket-hangup all surface as Error here.
|
|
465
520
|
const code = e?.code;
|
|
466
|
-
if (code === 'ECONNREFUSED' ||
|
|
521
|
+
if (code === 'ECONNREFUSED' ||
|
|
522
|
+
code === 'ETIMEDOUT' ||
|
|
523
|
+
code === 'ECONNRESET' ||
|
|
524
|
+
!e?.response) {
|
|
467
525
|
lastErr = e;
|
|
468
526
|
}
|
|
469
527
|
else {
|
|
@@ -488,8 +546,8 @@ class ArmorIQClient {
|
|
|
488
546
|
headers: { 'X-API-Key': this.apiKey },
|
|
489
547
|
timeout: 5000,
|
|
490
548
|
});
|
|
491
|
-
if (response.status === 401) {
|
|
492
|
-
throw new exceptions_1.ConfigurationException('Invalid API key. Please check your API key at https://platform.armoriq.ai/dashboard/api-keys');
|
|
549
|
+
if (response.status === 401 || response.status === 403) {
|
|
550
|
+
throw new exceptions_1.ConfigurationException('Invalid or revoked API key. Please check your API key at https://platform.armoriq.ai/dashboard/api-keys');
|
|
493
551
|
}
|
|
494
552
|
else if (response.status >= 400) {
|
|
495
553
|
console.warn(`API key validation returned status ${response.status}, but continuing...`);
|
|
@@ -566,18 +624,8 @@ class ArmorIQClient {
|
|
|
566
624
|
tool_calls: req.toolCalls,
|
|
567
625
|
authority_snapshot: req.authoritySnapshot,
|
|
568
626
|
};
|
|
569
|
-
|
|
570
|
-
|
|
571
|
-
console.warn(`[armoriq] pap refine() unreachable (${msg}); fail-open — accepting plan`);
|
|
572
|
-
return {
|
|
573
|
-
decision: 'accepted',
|
|
574
|
-
intentId: null,
|
|
575
|
-
violations: [],
|
|
576
|
-
offendingInterfaces: [],
|
|
577
|
-
predicateFails: [],
|
|
578
|
-
meta: { fail_open: true, error: msg },
|
|
579
|
-
};
|
|
580
|
-
};
|
|
627
|
+
// PAP refine always fails CLOSED: a transport error, non-2xx, or malformed
|
|
628
|
+
// response raises - it never silently accepts a plan.
|
|
581
629
|
let response;
|
|
582
630
|
try {
|
|
583
631
|
response = await this.httpClient.post(`${this.backendEndpoint}/iap/sdk/preflight`, payload, {
|
|
@@ -586,36 +634,21 @@ class ArmorIQClient {
|
|
|
586
634
|
'X-API-Key': this.apiKey,
|
|
587
635
|
},
|
|
588
636
|
timeout: 30000,
|
|
589
|
-
// Accept any status so we can branch on it explicitly below.
|
|
590
|
-
// Default axios behavior throws on 4xx/5xx — that lumps network
|
|
591
|
-
// outages and HTTP errors together, which the caller can't
|
|
592
|
-
// distinguish without inspecting the error shape.
|
|
593
637
|
validateStatus: () => true,
|
|
594
638
|
});
|
|
595
639
|
}
|
|
596
640
|
catch (err) {
|
|
597
641
|
const msg = err instanceof Error ? err.message : String(err);
|
|
598
|
-
if (failMode === 'open')
|
|
599
|
-
return buildOpenFallback(msg);
|
|
600
642
|
throw new ArmorIQError(`pap refine() transport error (fail-closed): ${msg}`);
|
|
601
643
|
}
|
|
602
644
|
const status = response?.status ?? 0;
|
|
603
645
|
const data = response?.data;
|
|
604
646
|
if (status < 200 || status >= 300) {
|
|
605
|
-
const detail = (data && (data.detail || data.message || data.error)) ||
|
|
606
|
-
|
|
607
|
-
const msg = `HTTP ${status}: ${detail}`;
|
|
608
|
-
if (failMode === 'open' && status >= 500) {
|
|
609
|
-
// Only treat 5xx as fail-open material; 4xx is the caller's fault
|
|
610
|
-
// and silently accepting it would mask real client errors.
|
|
611
|
-
return buildOpenFallback(msg);
|
|
612
|
-
}
|
|
613
|
-
throw new ArmorIQError(`pap refine() failed (fail-closed): ${msg}`);
|
|
647
|
+
const detail = (data && (data.detail || data.message || data.error)) || `HTTP ${status}`;
|
|
648
|
+
throw new ArmorIQError(`pap refine() failed (fail-closed): HTTP ${status}: ${detail}`);
|
|
614
649
|
}
|
|
615
650
|
if (!data || typeof data !== 'object' || !data.decision) {
|
|
616
651
|
const msg = `malformed response from pap-gateway: ${JSON.stringify(data).slice(0, 200)}`;
|
|
617
|
-
if (failMode === 'open')
|
|
618
|
-
return buildOpenFallback(msg);
|
|
619
652
|
throw new ArmorIQError(`pap refine() got malformed response (fail-closed): ${msg}`);
|
|
620
653
|
}
|
|
621
654
|
return {
|
|
@@ -671,8 +704,11 @@ class ArmorIQClient {
|
|
|
671
704
|
planHash: data.plan_hash || '',
|
|
672
705
|
planId: data.plan_id,
|
|
673
706
|
signature: typeof tokenData === 'object' ? tokenData.signature || '' : '',
|
|
674
|
-
|
|
675
|
-
|
|
707
|
+
// Prefer the server-signed timestamps so expiry doesn't depend on the
|
|
708
|
+
// client's clock at mint time (falls back to local only if absent).
|
|
709
|
+
issuedAt: (typeof tokenData === 'object' && tokenData.issued_at) || Date.now() / 1000,
|
|
710
|
+
expiresAt: (typeof tokenData === 'object' && tokenData.expires_at) ||
|
|
711
|
+
Date.now() / 1000 + validitySeconds,
|
|
676
712
|
policy: policy || {},
|
|
677
713
|
compositeIdentity: data.composite_identity || '',
|
|
678
714
|
clientInfo: data.client_info,
|
|
@@ -691,7 +727,8 @@ class ArmorIQClient {
|
|
|
691
727
|
const responseData = error?.response?.data;
|
|
692
728
|
const deniedTools = responseData?.policy_validation?.denied_tools;
|
|
693
729
|
const deniedReasons = responseData?.policy_validation?.denied_reasons;
|
|
694
|
-
if (error?.response?.status === 403 ||
|
|
730
|
+
if (error?.response?.status === 403 ||
|
|
731
|
+
(Array.isArray(deniedTools) && deniedTools.length > 0)) {
|
|
695
732
|
const reason = (Array.isArray(deniedReasons) && deniedReasons.length > 0
|
|
696
733
|
? deniedReasons.join('; ')
|
|
697
734
|
: responseData?.message) || 'Blocked by policy';
|
|
@@ -785,24 +822,29 @@ class ArmorIQClient {
|
|
|
785
822
|
`Plan contains actions: ${JSON.stringify(actions)}. ` +
|
|
786
823
|
'You can only invoke actions that were included in the plan when you called capturePlan().');
|
|
787
824
|
}
|
|
788
|
-
// Use Merkle proof from CSRG-IAP
|
|
825
|
+
// Use Merkle proof from CSRG-IAP. Fail closed: refuse to invoke without an
|
|
826
|
+
// inclusion proof rather than sending an unproven request and relying on the
|
|
827
|
+
// proxy to reject it.
|
|
789
828
|
if (!merkleProof) {
|
|
790
829
|
if (intentToken.stepProofs && intentToken.stepProofs.length > stepIndex) {
|
|
791
830
|
merkleProof = intentToken.stepProofs[stepIndex];
|
|
792
831
|
console.log(`Using Merkle proof from CSRG-IAP for step ${stepIndex}`);
|
|
793
832
|
}
|
|
794
833
|
else {
|
|
795
|
-
|
|
796
|
-
`step_proofs length: ${intentToken.stepProofs?.length || 0}`
|
|
834
|
+
throw new exceptions_1.MCPInvocationException(`No CSRG Merkle proof available for step ${stepIndex} ` +
|
|
835
|
+
`(step_proofs length: ${intentToken.stepProofs?.length || 0}). ` +
|
|
836
|
+
`Refusing to invoke without an inclusion proof (fail-closed).`);
|
|
797
837
|
}
|
|
798
838
|
}
|
|
799
|
-
|
|
800
|
-
if (merkleProof) {
|
|
801
|
-
headers['X-CSRG-Proof'] = JSON.stringify(merkleProof);
|
|
802
|
-
}
|
|
839
|
+
headers['X-CSRG-Proof'] = JSON.stringify(merkleProof);
|
|
803
840
|
const csrgPath = `/steps/[${stepIndex}]/action`;
|
|
804
841
|
headers['X-CSRG-Path'] = csrgPath;
|
|
805
|
-
//
|
|
842
|
+
// Value digest is the hash of the value AT the declared path
|
|
843
|
+
// (/steps/[i]/action) — i.e. the action, matching the CSRG leaf the proxy
|
|
844
|
+
// verifies the inclusion proof against. NOTE (#92): this binds the action
|
|
845
|
+
// but NOT the call params; binding params requires the CSRG-IAP Merkle leaf
|
|
846
|
+
// granularity to include args and the proxy to verify it — a cross-component
|
|
847
|
+
// change, not a safe SDK-only edit.
|
|
806
848
|
const stepObj = steps[stepIndex] || {};
|
|
807
849
|
const leafValue = typeof stepObj === 'object' ? stepObj.action || action : action;
|
|
808
850
|
const valueStr = JSON.stringify(leafValue);
|
|
@@ -840,7 +882,8 @@ class ArmorIQClient {
|
|
|
840
882
|
const enforcement = responseData.enforcement;
|
|
841
883
|
const enrichedError = new Error(responseData.message || `Enforcement: ${enforcement.action}`);
|
|
842
884
|
enrichedError.response = { status: response.status, data: responseData };
|
|
843
|
-
enrichedError.name =
|
|
885
|
+
enrichedError.name =
|
|
886
|
+
enforcement.action === 'block' ? 'PolicyBlockedException' : 'PolicyHoldException';
|
|
844
887
|
throw enrichedError;
|
|
845
888
|
}
|
|
846
889
|
if (response.status >= 400) {
|
|
@@ -879,9 +922,7 @@ class ArmorIQClient {
|
|
|
879
922
|
throw new exceptions_1.MCPInvocationException(`MCP tool error (${errorCode}): ${errorMsg} - ${errorData}`, mcp, action);
|
|
880
923
|
}
|
|
881
924
|
const resultData = data.result || data;
|
|
882
|
-
const hasToolError = Boolean(resultData?.isError) ||
|
|
883
|
-
Boolean(resultData?.error) ||
|
|
884
|
-
Boolean(resultData?.is_error);
|
|
925
|
+
const hasToolError = Boolean(resultData?.isError) || Boolean(resultData?.error) || Boolean(resultData?.is_error);
|
|
885
926
|
const result = {
|
|
886
927
|
mcp,
|
|
887
928
|
action,
|
|
@@ -910,7 +951,10 @@ class ArmorIQClient {
|
|
|
910
951
|
if (statusCode === 403 && errorDetail?.enforcement) {
|
|
911
952
|
const enrichedError = new Error(errorDetail.message || 'Enforcement action');
|
|
912
953
|
enrichedError.response = error.response;
|
|
913
|
-
enrichedError.name =
|
|
954
|
+
enrichedError.name =
|
|
955
|
+
errorDetail.enforcement.action === 'block'
|
|
956
|
+
? 'PolicyBlockedException'
|
|
957
|
+
: 'PolicyHoldException';
|
|
914
958
|
throw enrichedError;
|
|
915
959
|
}
|
|
916
960
|
if (statusCode === 401 || statusCode === 403) {
|
|
@@ -948,10 +992,11 @@ class ArmorIQClient {
|
|
|
948
992
|
if (subtask) {
|
|
949
993
|
payload.subtask = subtask;
|
|
950
994
|
}
|
|
995
|
+
// NOTE: delegate() is legacy. Prefer delegateSubtree() for subtree-bounded
|
|
996
|
+
// delegation. The /delegation/create route was removed; the live delegation
|
|
997
|
+
// endpoint is /iap/trust/delegate on the backend.
|
|
951
998
|
try {
|
|
952
|
-
const response = await this.httpClient.post(`${this.
|
|
953
|
-
timeout: 10000,
|
|
954
|
-
});
|
|
999
|
+
const response = await this.httpClient.post(`${this.backendEndpoint}/iap/trust/delegate`, payload, { timeout: 10000 });
|
|
955
1000
|
if (response.status >= 400) {
|
|
956
1001
|
throw new Error(`HTTP ${response.status}: ${response.statusText}`);
|
|
957
1002
|
}
|
|
@@ -1107,7 +1152,10 @@ class ArmorIQClient {
|
|
|
1107
1152
|
}
|
|
1108
1153
|
}
|
|
1109
1154
|
/**
|
|
1110
|
-
* Verify an intent token
|
|
1155
|
+
* Verify an intent token: checks expiry AND cryptographically verifies the
|
|
1156
|
+
* Ed25519 signature over the canonical signed payload (which binds planHash).
|
|
1157
|
+
* Any tampering with the signed fields - including planHash - makes this
|
|
1158
|
+
* return false. Fails closed on missing material or any error.
|
|
1111
1159
|
*/
|
|
1112
1160
|
async verifyToken(intentToken) {
|
|
1113
1161
|
try {
|
|
@@ -1115,11 +1163,21 @@ class ArmorIQClient {
|
|
|
1115
1163
|
console.warn(`Token ${intentToken.tokenId} has expired`);
|
|
1116
1164
|
return false;
|
|
1117
1165
|
}
|
|
1118
|
-
|
|
1119
|
-
|
|
1166
|
+
const tokenData = (intentToken.rawToken && intentToken.rawToken.token) || {};
|
|
1167
|
+
const signedPlanHash = tokenData.plan_hash;
|
|
1168
|
+
if (!tokenData.public_key || !tokenData.signature || !signedPlanHash) {
|
|
1169
|
+
console.warn(`Token ${intentToken.tokenId} missing signature material; cannot verify`);
|
|
1170
|
+
return false;
|
|
1171
|
+
}
|
|
1172
|
+
if (!(0, crypto_verify_1.verifyIntentTokenSignature)(intentToken.rawToken)) {
|
|
1173
|
+
console.warn(`Token ${intentToken.tokenId} signature verification FAILED`);
|
|
1174
|
+
return false;
|
|
1175
|
+
}
|
|
1176
|
+
// The planHash the caller relies on must be the one that was signed.
|
|
1177
|
+
if (intentToken.planHash && intentToken.planHash !== signedPlanHash) {
|
|
1178
|
+
console.warn(`Token ${intentToken.tokenId} planHash does not match signed payload`);
|
|
1120
1179
|
return false;
|
|
1121
1180
|
}
|
|
1122
|
-
console.log(`Token ${intentToken.tokenId} is valid (expires in ${models_1.IntentToken.timeUntilExpiry(intentToken).toFixed(1)}s)`);
|
|
1123
1181
|
return true;
|
|
1124
1182
|
}
|
|
1125
1183
|
catch (error) {
|
|
@@ -1165,7 +1223,9 @@ class ArmorIQClient {
|
|
|
1165
1223
|
* List all MCPs registered for this org (resolved via API key).
|
|
1166
1224
|
*/
|
|
1167
1225
|
async listMcps() {
|
|
1168
|
-
const response = await this.httpClient.get(`${this.backendEndpoint}/mcp/my-servers`, {
|
|
1226
|
+
const response = await this.httpClient.get(`${this.backendEndpoint}/mcp/my-servers`, {
|
|
1227
|
+
headers: { 'X-API-Key': this.apiKey },
|
|
1228
|
+
});
|
|
1169
1229
|
if (response.status >= 400) {
|
|
1170
1230
|
throw new exceptions_1.MCPInvocationException(`listMcps failed: ${response.status} ${JSON.stringify(response.data)}`);
|
|
1171
1231
|
}
|
|
@@ -1231,10 +1291,15 @@ class ArmorIQClient {
|
|
|
1231
1291
|
limit: response.data.limit ?? 0,
|
|
1232
1292
|
};
|
|
1233
1293
|
}
|
|
1294
|
+
console.warn(`resolveUserRole: backend returned ${response.status}; ` +
|
|
1295
|
+
`defaulting to least-privileged role (agent_user, limit 0).`);
|
|
1234
1296
|
}
|
|
1235
1297
|
catch (e) {
|
|
1236
|
-
|
|
1298
|
+
console.warn(`resolveUserRole failed (${e.message}); ` +
|
|
1299
|
+
`defaulting to least-privileged role (agent_user, limit 0).`);
|
|
1237
1300
|
}
|
|
1301
|
+
// Fail closed: least-privileged role + zero limit. The backend is the
|
|
1302
|
+
// authority on delegation; never assume elevated role on resolution failure.
|
|
1238
1303
|
return { role: 'agent_user', limit: 0 };
|
|
1239
1304
|
}
|
|
1240
1305
|
/**
|
|
@@ -1242,7 +1307,13 @@ class ArmorIQClient {
|
|
|
1242
1307
|
*/
|
|
1243
1308
|
async createDelegationRequest(params) {
|
|
1244
1309
|
const idempotencyKey = `deleg-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
|
|
1245
|
-
const response = await this.httpClient.post(`${this.backendEndpoint}/delegation/request`, params, {
|
|
1310
|
+
const response = await this.httpClient.post(`${this.backendEndpoint}/delegation/request`, params, {
|
|
1311
|
+
headers: {
|
|
1312
|
+
'X-API-Key': this.apiKey,
|
|
1313
|
+
'X-User-Email': params.requesterEmail,
|
|
1314
|
+
'Idempotency-Key': idempotencyKey,
|
|
1315
|
+
},
|
|
1316
|
+
});
|
|
1246
1317
|
if (response.status >= 400) {
|
|
1247
1318
|
throw new exceptions_1.DelegationException(`Failed to create delegation request: ${response.data?.message || response.statusText}`);
|
|
1248
1319
|
}
|