@auctra/sdk 0.2.0 → 0.2.1

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# Changelog
+
+## 0.2.1
+
+- Add complete response types for agents, delegations, action requests, policies, audit events, and API keys.
+- Add `getDelegation`, `createPolicy`, and `listApiKeys`.
+- Honor `Retry-After`, preserve caller cancellation, and validate client options.
+- Correct the REST example to use the API's snake_case contract.
+- Add package-level integration tests and npm provenance metadata.
+- Ship tested ESM and CommonJS entry points.
+
+## 0.2.0
+
+- Add bounded retries, request deadlines, idempotent evaluation, and structured API errors.

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Auctra
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -16,6 +16,8 @@ Evaluate every agent action against delegated authority and org policies before
 npm install @auctra/sdk
 ```
 
+Both ESM (`import`) and CommonJS (`require`) entry points are included.
+
 ## Quick start
 
 ```typescript
@@ -60,7 +62,9 @@ if (decision.decision === "allowed") {
 | `evaluateAction(input, options)`            | Idempotently check authority before an agent acts |
 | `listAgents()`                              | List registered agents                            |
 | `createAgent(input)`                        | Register a new agent                              |
+| `getAgent(id)`                              | Get one registered agent                          |
 | `listDelegations()`                         | List authority delegations                        |
+| `getDelegation(id)`                         | Get one authority delegation                      |
 | `createDelegation(input)`                   | Grant bounded authority                           |
 | `revokeDelegation(id)`                      | Revoke a delegation                               |
 | `listActionRequests()`                      | List recent evaluations                           |
@@ -68,7 +72,9 @@ if (decision.decision === "allowed") {
 | `rejectActionRequest(id, approverUserId)`   | Reject as an accountable reviewer                 |
 | `escalateActionRequest(id, approverUserId)` | Escalate as an accountable reviewer               |
 | `listPolicies()`                            | List org policies                                 |
+| `createPolicy(input)`                       | Create an org policy                              |
 | `listAuditEvents()`                         | List audit ledger events                          |
+| `listApiKeys()`                             | List API key metadata                             |
 
 ## REST API (curl)
 
@@ -78,8 +84,8 @@ curl -X POST https://console.auctra.tech/v1/action-requests/evaluate \
   -H "Idempotency-Key: $(uuidgen)" \
   -H "Content-Type: application/json" \
   -d '{
-    "agentId": "your-agent-uuid",
-    "actionType": "send_payment",
+    "agent_id": "your-agent-uuid",
+    "action_type": "send_payment",
     "payload": { "amount": 100, "currency": "USD" }
   }'
 ```

package/dist/cjs/index.js

@@ -0,0 +1,201 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auctra = exports.AuctraApiError = exports.AUCTRA_SDK_VERSION = void 0;
+exports.AUCTRA_SDK_VERSION = "0.2.1";
+class AuctraApiError extends Error {
+    status;
+    code;
+    details;
+    requestId;
+    constructor(message, options) {
+        super(message);
+        this.name = "AuctraApiError";
+        this.status = options.status;
+        this.code = options.code;
+        this.details = options.details;
+        this.requestId = options.requestId;
+    }
+}
+exports.AuctraApiError = AuctraApiError;
+function retryDelay(response, attempt) {
+    const retryAfter = response?.headers.get("retry-after");
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds))
+            return Math.min(30_000, Math.max(0, seconds * 1_000));
+        const dateDelay = Date.parse(retryAfter) - Date.now();
+        if (Number.isFinite(dateDelay))
+            return Math.min(30_000, Math.max(0, dateDelay));
+    }
+    return Math.min(5_000, 150 * 2 ** attempt);
+}
+function wait(ms, signal) {
+    if (signal?.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timeout);
+            reject(signal.reason);
+        }, { once: true });
+    });
+}
+class Auctra {
+    apiKey;
+    baseUrl;
+    timeoutMs;
+    maxRetries;
+    fetchImpl;
+    constructor(options) {
+        if (!options.apiKey.trim())
+            throw new Error("apiKey is required");
+        if (options.timeoutMs !== undefined && options.timeoutMs <= 0) {
+            throw new Error("timeoutMs must be greater than zero");
+        }
+        if (options.maxRetries !== undefined &&
+            (!Number.isInteger(options.maxRetries) || options.maxRetries < 0)) {
+            throw new Error("maxRetries must be a non-negative integer");
+        }
+        this.apiKey = options.apiKey;
+        this.baseUrl = (options.baseUrl ?? "https://console.auctra.tech").replace(/\/$/, "");
+        this.timeoutMs = options.timeoutMs ?? 10_000;
+        this.maxRetries = options.maxRetries ?? 2;
+        this.fetchImpl = options.fetch ?? globalThis.fetch;
+        if (!this.fetchImpl)
+            throw new Error("A fetch implementation is required");
+    }
+    async request(method, path, body, options = {}) {
+        const retryableRequest = method === "GET" || Boolean(options.idempotencyKey);
+        let lastError;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt += 1) {
+            if (options.signal?.aborted)
+                throw options.signal.reason;
+            const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
+            const signal = options.signal
+                ? AbortSignal.any([options.signal, timeoutSignal])
+                : timeoutSignal;
+            let response;
+            try {
+                response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                    method,
+                    signal,
+                    headers: {
+                        ...(body !== undefined ? { "content-type": "application/json" } : {}),
+                        ...(options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}),
+                        authorization: `Bearer ${this.apiKey}`,
+                        "x-auctra-sdk-version": exports.AUCTRA_SDK_VERSION,
+                    },
+                    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+                });
+                const data = (await response.json().catch(() => ({})));
+                if (response.ok)
+                    return data;
+                if (retryableRequest &&
+                    (response.status === 429 || response.status >= 500) &&
+                    attempt < this.maxRetries) {
+                    await wait(retryDelay(response, attempt), options.signal);
+                    continue;
+                }
+                throw new AuctraApiError(typeof data.error === "string" ? data.error : `Auctra API error (${response.status})`, {
+                    status: response.status,
+                    code: typeof data.code === "string" ? data.code : undefined,
+                    details: data.details,
+                    requestId: response.headers.get("x-request-id") ?? undefined,
+                });
+            }
+            catch (error) {
+                lastError = error;
+                if (options.signal?.aborted)
+                    throw options.signal.reason;
+                if (error instanceof AuctraApiError || !retryableRequest || attempt >= this.maxRetries) {
+                    throw error;
+                }
+                await wait(retryDelay(response, attempt), options.signal);
+            }
+        }
+        throw lastError;
+    }
+    async evaluateAction(input, options = {}) {
+        const idempotencyKey = options.idempotencyKey ?? crypto.randomUUID();
+        return this.request("POST", "/v1/action-requests/evaluate", { agent_id: input.agentId, action_type: input.actionType, payload: input.payload ?? {} }, { ...options, idempotencyKey });
+    }
+    async listAgents() {
+        return this.request("GET", "/v1/agents");
+    }
+    async getAgent(agentId) {
+        return this.request("GET", `/v1/agents/${encodeURIComponent(agentId)}`);
+    }
+    async createAgent(input) {
+        return this.request("POST", "/v1/agents", {
+            name: input.name,
+            model_provider: input.modelProvider,
+            model_name: input.modelName,
+            description: input.description,
+            environment: input.environment,
+            authority_level: input.authorityLevel,
+            sponsor_user_id: input.sponsorUserId,
+        });
+    }
+    async listDelegations() {
+        return this.request("GET", "/v1/delegations");
+    }
+    async getDelegation(delegationId) {
+        return this.request("GET", `/v1/delegations/${encodeURIComponent(delegationId)}`);
+    }
+    async createDelegation(input) {
+        return this.request("POST", "/v1/delegations", {
+            agent_id: input.agentId,
+            action_types: input.actionTypes,
+            valid_until: input.validUntil,
+            max_amount: input.maxAmount,
+            max_count: input.maxCount,
+            environment: input.environment,
+            currency: input.currency,
+            delegator_user_id: input.delegatorUserId,
+        });
+    }
+    async revokeDelegation(delegationId) {
+        return this.request("POST", `/v1/delegations/${encodeURIComponent(delegationId)}/revoke`, {});
+    }
+    async listActionRequests() {
+        return this.request("GET", "/v1/action-requests");
+    }
+    async approveActionRequest(actionRequestId, approverUserId, reason) {
+        return this.resolveActionRequest(actionRequestId, "approve", approverUserId, reason);
+    }
+    async rejectActionRequest(actionRequestId, approverUserId, reason) {
+        return this.resolveActionRequest(actionRequestId, "reject", approverUserId, reason);
+    }
+    async escalateActionRequest(actionRequestId, approverUserId, reason) {
+        return this.resolveActionRequest(actionRequestId, "escalate", approverUserId, reason);
+    }
+    async resolveActionRequest(actionRequestId, action, approverUserId, reason) {
+        return this.request("POST", `/v1/action-requests/${encodeURIComponent(actionRequestId)}/${action}`, { reason, approver_user_id: approverUserId });
+    }
+    async listPolicies() {
+        return this.request("GET", "/v1/policies");
+    }
+    async createPolicy(input) {
+        return this.request("POST", "/v1/policies", {
+            name: input.name,
+            description: input.description,
+            policy_type: input.policyType,
+            status: input.status,
+            priority: input.priority,
+            action_type: input.actionType,
+            amount_greater_than: input.amountGreaterThan,
+            resource_sensitivity: input.resourceSensitivity,
+            external_recipient: input.externalRecipient,
+            environment: input.environment,
+            decision: input.decision,
+            approver_role: input.approverRole,
+        });
+    }
+    async listAuditEvents() {
+        return this.request("GET", "/v1/audit-events");
+    }
+    async listApiKeys() {
+        return this.request("GET", "/v1/api-keys");
+    }
+}
+exports.Auctra = Auctra;

package/dist/cjs/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "commonjs"
+}

package/dist/esm/index.d.ts

@@ -0,0 +1,234 @@
+export declare const AUCTRA_SDK_VERSION = "0.2.1";
+export type AgentEnvironment = "dev" | "staging" | "production";
+export type AuthorityLevel = "low" | "medium" | "high" | "critical";
+export type Decision = "allowed" | "blocked" | "require_approval";
+export type PolicyType = "spending" | "data_access" | "communication" | "approval";
+export type EvaluateActionInput = {
+    agentId: string;
+    actionType: string;
+    payload?: Record<string, unknown>;
+};
+export type EvaluateActionResponse = {
+    decision: Decision;
+    risk_score: number;
+    reason: string;
+    delegation_id: string | null;
+    delegator: string | null;
+    sponsor: string;
+    matched_policies: string[];
+    action_request_id: string;
+};
+export type RequestOptions = {
+    idempotencyKey?: string;
+    signal?: AbortSignal;
+};
+export type AuctraClientOptions = {
+    apiKey: string;
+    baseUrl?: string;
+    timeoutMs?: number;
+    maxRetries?: number;
+    fetch?: typeof fetch;
+};
+export type Agent = {
+    id: string;
+    identity_id: string;
+    name: string;
+    description: string | null;
+    model_provider: "openai" | "anthropic" | "gemini" | "local";
+    model_name: string;
+    environment: AgentEnvironment;
+    authority_level: AuthorityLevel;
+    status: "active" | "suspended" | "restricted" | "compromised";
+    trust_rating: number;
+    sponsor: {
+        id: string;
+        full_name: string;
+        email: string;
+    };
+    created_at: string;
+};
+export type CreateAgentInput = {
+    name: string;
+    modelProvider: Agent["model_provider"];
+    modelName: string;
+    description?: string;
+    environment?: AgentEnvironment;
+    authorityLevel?: AuthorityLevel;
+    sponsorUserId?: string;
+};
+export type Delegation = {
+    id: string;
+    agent: {
+        id: string;
+        name: string;
+    };
+    delegator: {
+        id: string;
+        full_name: string;
+        email: string;
+    };
+    scope: {
+        action_types: string[];
+    };
+    limits: {
+        max_amount?: number;
+        max_count?: number;
+        currency?: string;
+        environment?: AgentEnvironment;
+    };
+    valid_from: string;
+    valid_until: string;
+    status: "active" | "revoked" | "expired";
+    is_active: boolean;
+    created_at: string;
+};
+export type CreateDelegationInput = {
+    agentId: string;
+    actionTypes: string[];
+    validUntil: string;
+    maxAmount?: number;
+    maxCount?: number;
+    environment?: AgentEnvironment;
+    currency?: string;
+    delegatorUserId?: string;
+};
+export type ActionRequest = {
+    id: string;
+    agent_name: string;
+    action_type: string;
+    action_summary: string;
+    payload: Record<string, unknown>;
+    decision: string;
+    decision_reason: string | null;
+    risk_score: number;
+    delegation_id: string | null;
+    policy_ids: string[];
+    pending_approval_id: string | null;
+    created_at: string;
+    decided_at: string | null;
+};
+export type Policy = {
+    id: string;
+    name: string;
+    description: string | null;
+    policy_type: PolicyType;
+    status: "active" | "draft" | "archived";
+    priority: number;
+    conditions: Record<string, unknown>;
+    actions: Record<string, unknown>;
+    created_at: string;
+};
+export type CreatePolicyInput = {
+    name: string;
+    description?: string;
+    policyType: PolicyType;
+    status?: "active" | "draft";
+    priority?: number;
+    actionType?: string;
+    amountGreaterThan?: number;
+    resourceSensitivity?: "public" | "internal" | "confidential" | "pii";
+    externalRecipient?: boolean;
+    environment?: AgentEnvironment;
+    decision: "block" | "require_approval";
+    approverRole?: "owner" | "admin" | "reviewer";
+};
+export type AuditEvent = {
+    id: string;
+    event_type: string;
+    event_summary: string;
+    decision: string | null;
+    decision_reason: string | null;
+    authority_valid_at_action: boolean | null;
+    actor_name: string;
+    approver_name: string | null;
+    policy_applied: string | null;
+    delegation_id: string | null;
+    hash: string | null;
+    previous_hash: string | null;
+    created_at: string;
+};
+export type ApiKeySummary = {
+    id: string;
+    name: string;
+    key_prefix: string;
+    environment: "development" | "production";
+    permissions: string[];
+    status: "active" | "revoked";
+    last_used_at: string | null;
+    created_at: string;
+};
+export declare class AuctraApiError extends Error {
+    readonly status: number;
+    readonly code?: string;
+    readonly details?: unknown;
+    readonly requestId?: string;
+    constructor(message: string, options: {
+        status: number;
+        code?: string;
+        details?: unknown;
+        requestId?: string;
+    });
+}
+export declare class Auctra {
+    private readonly apiKey;
+    private readonly baseUrl;
+    private readonly timeoutMs;
+    private readonly maxRetries;
+    private readonly fetchImpl;
+    constructor(options: AuctraClientOptions);
+    private request;
+    evaluateAction(input: EvaluateActionInput, options?: RequestOptions): Promise<EvaluateActionResponse>;
+    listAgents(): Promise<{
+        agents: Agent[];
+    }>;
+    getAgent(agentId: string): Promise<{
+        agent: Agent;
+    }>;
+    createAgent(input: CreateAgentInput): Promise<{
+        agent: Agent;
+    }>;
+    listDelegations(): Promise<{
+        delegations: Delegation[];
+    }>;
+    getDelegation(delegationId: string): Promise<{
+        delegation: Delegation;
+    }>;
+    createDelegation(input: CreateDelegationInput): Promise<{
+        delegation: Delegation;
+    }>;
+    revokeDelegation(delegationId: string): Promise<{
+        ok: true;
+    }>;
+    listActionRequests(): Promise<{
+        action_requests: ActionRequest[];
+    }>;
+    approveActionRequest(actionRequestId: string, approverUserId: string, reason?: string): Promise<{
+        ok: true;
+        decision: string;
+        reason: string;
+    }>;
+    rejectActionRequest(actionRequestId: string, approverUserId: string, reason?: string): Promise<{
+        ok: true;
+        decision: string;
+        reason: string;
+    }>;
+    escalateActionRequest(actionRequestId: string, approverUserId: string, reason?: string): Promise<{
+        ok: true;
+        decision: string;
+        reason: string;
+    }>;
+    private resolveActionRequest;
+    listPolicies(): Promise<{
+        policies: Policy[];
+    }>;
+    createPolicy(input: CreatePolicyInput): Promise<{
+        policy: Pick<Policy, "id" | "name" | "status" | "created_at">;
+    }>;
+    listAuditEvents(): Promise<{
+        audit_events: AuditEvent[];
+    }>;
+    listApiKeys(): Promise<{
+        api_keys: ApiKeySummary[];
+    }>;
+}
+//# sourceMappingURL=index.d.ts.map

package/dist/esm/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/index.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,kBAAkB,UAAU,CAAC;AAE1C,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;AAChE,MAAM,MAAM,cAAc,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AACpE,MAAM,MAAM,QAAQ,GAAG,SAAS,GAAG,SAAS,GAAG,kBAAkB,CAAC;AAClE,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,aAAa,GAAG,eAAe,GAAG,UAAU,CAAC;AAEnF,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,QAAQ,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,WAAW,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,QAAQ,GAAG,WAAW,GAAG,QAAQ,GAAG,OAAO,CAAC;IAC5D,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,gBAAgB,CAAC;IAC9B,eAAe,EAAE,cAAc,CAAC;IAChC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,aAAa,CAAC;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC;IACvC,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAClC,MAAM,EAAE;QACN,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,gBAAgB,CAAC;KAChC,CAAC;IACF,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,qBAAqB,GAAG;IAClC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,MAAM,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,WAAW,EAAE,UAAU,CAAC;IACxB,MAAM,EAAE,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,UAAU,CAAC;IACvB,MAAM,CAAC,EAAE,QAAQ,GAAG,OAAO,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,mBAAmB,CAAC,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,GAAG,KAAK,CAAC;IACrE,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,QAAQ,EAAE,OAAO,GAAG,kBAAkB,CAAC;IACvC,YAAY,CAAC,EAAE,OAAO,GAAG,OAAO,GAAG,UAAU,CAAC;CAC/C,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,yBAAyB,EAAE,OAAO,GAAG,IAAI,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,aAAa,GAAG,YAAY,CAAC;IAC1C,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;gBAG1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;CASpF;AA4BD,qBAAa,MAAM;IACjB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAS;IACpC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAe;gBAE7B,OAAO,EAAE,mBAAmB;YAmB1B,OAAO;IAgEf,cAAc,CAClB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,sBAAsB,CAAC;IAU5B,UAAU,IAAI,OAAO,CAAC;QAAE,MAAM,EAAE,KAAK,EAAE,CAAA;KAAE,CAAC;IAI1C,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;IAIpD,WAAW,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC;QAAE,KAAK,EAAE,KAAK,CAAA;KAAE,CAAC;IAY/D,eAAe,IAAI,OAAO,CAAC;QAAE,WAAW,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAIzD,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAC;IAIxE,gBAAgB,CAAC,KAAK,EAAE,qBAAqB,GAAG,OAAO,CAAC;QAAE,UAAU,EAAE,UAAU,CAAA;KAAE,CAAC;IAanF,gBAAgB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,IAAI,CAAA;KAAE,CAAC;IAI7D,kBAAkB,IAAI,OAAO,CAAC;QAAE,eAAe,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAInE,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;YAiB1E,IAAI;kBAAY,MAAM;gBAAU,MAAM;;IAbjD,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;YAazE,IAAI;kBAAY,MAAM;gBAAU,MAAM;;IATjD,qBAAqB,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;YAS3E,IAAI;kBAAY,MAAM;gBAAU,MAAM;;YALzC,oBAAoB;IAa5B,YAAY,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAI/C,YAAY,CAChB,KAAK,EAAE,iBAAiB,GACvB,OAAO,CAAC;QAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,MAAM,GAAG,QAAQ,GAAG,YAAY,CAAC,CAAA;KAAE,CAAC;IAiBvE,eAAe,IAAI,OAAO,CAAC;QAAE,YAAY,EAAE,UAAU,EAAE,CAAA;KAAE,CAAC;IAI1D,WAAW,IAAI,OAAO,CAAC;QAAE,QAAQ,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;CAG5D"}

package/dist/{index.js → esm/index.js}

@@ -1,3 +1,4 @@
+export const AUCTRA_SDK_VERSION = "0.2.1";
 export class AuctraApiError extends Error {
     status;
     code;
@@ -12,6 +13,29 @@ export class AuctraApiError extends Error {
         this.requestId = options.requestId;
     }
 }
+function retryDelay(response, attempt) {
+    const retryAfter = response?.headers.get("retry-after");
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds))
+            return Math.min(30_000, Math.max(0, seconds * 1_000));
+        const dateDelay = Date.parse(retryAfter) - Date.now();
+        if (Number.isFinite(dateDelay))
+            return Math.min(30_000, Math.max(0, dateDelay));
+    }
+    return Math.min(5_000, 150 * 2 ** attempt);
+}
+function wait(ms, signal) {
+    if (signal?.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timeout);
+            reject(signal.reason);
+        }, { once: true });
+    });
+}
 export class Auctra {
     apiKey;
     baseUrl;
@@ -19,6 +43,15 @@ export class Auctra {
     maxRetries;
     fetchImpl;
     constructor(options) {
+        if (!options.apiKey.trim())
+            throw new Error("apiKey is required");
+        if (options.timeoutMs !== undefined && options.timeoutMs <= 0) {
+            throw new Error("timeoutMs must be greater than zero");
+        }
+        if (options.maxRetries !== undefined &&
+            (!Number.isInteger(options.maxRetries) || options.maxRetries < 0)) {
+            throw new Error("maxRetries must be a non-negative integer");
+        }
         this.apiKey = options.apiKey;
         this.baseUrl = (options.baseUrl ?? "https://console.auctra.tech").replace(/\/$/, "");
         this.timeoutMs = options.timeoutMs ?? 10_000;
@@ -31,28 +64,32 @@ export class Auctra {
         const retryableRequest = method === "GET" || Boolean(options.idempotencyKey);
         let lastError;
         for (let attempt = 0; attempt <= this.maxRetries; attempt += 1) {
+            if (options.signal?.aborted)
+                throw options.signal.reason;
             const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
             const signal = options.signal
                 ? AbortSignal.any([options.signal, timeoutSignal])
                 : timeoutSignal;
+            let response;
             try {
-                const response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                response = await this.fetchImpl(`${this.baseUrl}${path}`, {
                     method,
                     signal,
                     headers: {
-                        ...(body ? { "content-type": "application/json" } : {}),
+                        ...(body !== undefined ? { "content-type": "application/json" } : {}),
                         ...(options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}),
                         authorization: `Bearer ${this.apiKey}`,
-                        "x-auctra-sdk-version": "0.2",
+                        "x-auctra-sdk-version": AUCTRA_SDK_VERSION,
                     },
-                    ...(body ? { body: JSON.stringify(body) } : {}),
+                    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
                 });
                 const data = (await response.json().catch(() => ({})));
                 if (response.ok)
                     return data;
-                const retryableResponse = response.status === 429 || response.status >= 500;
-                if (retryableRequest && retryableResponse && attempt < this.maxRetries) {
-                    await new Promise((resolve) => setTimeout(resolve, 150 * 2 ** attempt));
+                if (retryableRequest &&
+                    (response.status === 429 || response.status >= 500) &&
+                    attempt < this.maxRetries) {
+                    await wait(retryDelay(response, attempt), options.signal);
                     continue;
                 }
                 throw new AuctraApiError(typeof data.error === "string" ? data.error : `Auctra API error (${response.status})`, {
@@ -64,27 +101,25 @@ export class Auctra {
             }
             catch (error) {
                 lastError = error;
+                if (options.signal?.aborted)
+                    throw options.signal.reason;
                 if (error instanceof AuctraApiError || !retryableRequest || attempt >= this.maxRetries) {
                     throw error;
                 }
-                await new Promise((resolve) => setTimeout(resolve, 150 * 2 ** attempt));
+                await wait(retryDelay(response, attempt), options.signal);
             }
         }
         throw lastError;
     }
     async evaluateAction(input, options = {}) {
         const idempotencyKey = options.idempotencyKey ?? crypto.randomUUID();
-        return this.request("POST", "/v1/action-requests/evaluate", {
-            agent_id: input.agentId,
-            action_type: input.actionType,
-            payload: input.payload ?? {},
-        }, { ...options, idempotencyKey });
+        return this.request("POST", "/v1/action-requests/evaluate", { agent_id: input.agentId, action_type: input.actionType, payload: input.payload ?? {} }, { ...options, idempotencyKey });
     }
     async listAgents() {
         return this.request("GET", "/v1/agents");
     }
     async getAgent(agentId) {
-        return this.request("GET", `/v1/agents/${agentId}`);
+        return this.request("GET", `/v1/agents/${encodeURIComponent(agentId)}`);
     }
     async createAgent(input) {
         return this.request("POST", "/v1/agents", {
@@ -100,44 +135,62 @@ export class Auctra {
     async listDelegations() {
         return this.request("GET", "/v1/delegations");
     }
+    async getDelegation(delegationId) {
+        return this.request("GET", `/v1/delegations/${encodeURIComponent(delegationId)}`);
+    }
     async createDelegation(input) {
         return this.request("POST", "/v1/delegations", {
             agent_id: input.agentId,
             action_types: input.actionTypes,
             valid_until: input.validUntil,
             max_amount: input.maxAmount,
+            max_count: input.maxCount,
+            environment: input.environment,
             currency: input.currency,
             delegator_user_id: input.delegatorUserId,
         });
     }
     async revokeDelegation(delegationId) {
-        return this.request("POST", `/v1/delegations/${delegationId}/revoke`, {});
+        return this.request("POST", `/v1/delegations/${encodeURIComponent(delegationId)}/revoke`, {});
     }
     async listActionRequests() {
         return this.request("GET", "/v1/action-requests");
     }
     async approveActionRequest(actionRequestId, approverUserId, reason) {
-        return this.request("POST", `/v1/action-requests/${actionRequestId}/approve`, {
-            reason,
-            approver_user_id: approverUserId,
-        });
+        return this.resolveActionRequest(actionRequestId, "approve", approverUserId, reason);
     }
     async rejectActionRequest(actionRequestId, approverUserId, reason) {
-        return this.request("POST", `/v1/action-requests/${actionRequestId}/reject`, {
-            reason,
-            approver_user_id: approverUserId,
-        });
+        return this.resolveActionRequest(actionRequestId, "reject", approverUserId, reason);
     }
     async escalateActionRequest(actionRequestId, approverUserId, reason) {
-        return this.request("POST", `/v1/action-requests/${actionRequestId}/escalate`, {
-            reason,
-            approver_user_id: approverUserId,
-        });
+        return this.resolveActionRequest(actionRequestId, "escalate", approverUserId, reason);
+    }
+    async resolveActionRequest(actionRequestId, action, approverUserId, reason) {
+        return this.request("POST", `/v1/action-requests/${encodeURIComponent(actionRequestId)}/${action}`, { reason, approver_user_id: approverUserId });
     }
     async listPolicies() {
         return this.request("GET", "/v1/policies");
     }
+    async createPolicy(input) {
+        return this.request("POST", "/v1/policies", {
+            name: input.name,
+            description: input.description,
+            policy_type: input.policyType,
+            status: input.status,
+            priority: input.priority,
+            action_type: input.actionType,
+            amount_greater_than: input.amountGreaterThan,
+            resource_sensitivity: input.resourceSensitivity,
+            external_recipient: input.externalRecipient,
+            environment: input.environment,
+            decision: input.decision,
+            approver_role: input.approverRole,
+        });
+    }
     async listAuditEvents() {
         return this.request("GET", "/v1/audit-events");
     }
+    async listApiKeys() {
+        return this.request("GET", "/v1/api-keys");
+    }
 }

package/package.json

@@ -1,27 +1,37 @@
 {
   "name": "@auctra/sdk",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Authority delegation SDK for AI agents — evaluate agent actions against delegated authority and org policies",
   "homepage": "https://auctra.tech/docs",
   "bugs": {
     "url": "https://github.com/Matik103/auctra/issues"
   },
   "type": "module",
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
+  "sideEffects": false,
+  "main": "./dist/cjs/index.js",
+  "module": "./dist/esm/index.js",
+  "types": "./dist/esm/index.d.ts",
   "exports": {
     ".": {
-      "types": "./dist/index.d.ts",
-      "import": "./dist/index.js"
+      "types": "./dist/esm/index.d.ts",
+      "import": "./dist/esm/index.js",
+      "require": "./dist/cjs/index.js"
     }
   },
   "files": [
     "dist",
-    "README.md"
+    "src",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE"
   ],
   "scripts": {
-    "build": "tsc",
-    "prepublishOnly": "npm run build"
+    "clean": "node -e \"require('node:fs').rmSync('dist',{recursive:true,force:true})\"",
+    "build": "npm run clean && tsc -p tsconfig.json && tsc -p tsconfig.cjs.json && node scripts/finalize-build.mjs",
+    "test": "npm run build && node --test test/*.test.mjs",
+    "check": "npm run test && npm pack --dry-run",
+    "publish:local": "npm publish --access public --provenance=false",
+    "prepublishOnly": "npm run check"
   },
   "repository": {
     "type": "git",

package/src/index.ts

@@ -0,0 +1,414 @@
+export const AUCTRA_SDK_VERSION = "0.2.1";
+
+export type AgentEnvironment = "dev" | "staging" | "production";
+export type AuthorityLevel = "low" | "medium" | "high" | "critical";
+export type Decision = "allowed" | "blocked" | "require_approval";
+export type PolicyType = "spending" | "data_access" | "communication" | "approval";
+
+export type EvaluateActionInput = {
+  agentId: string;
+  actionType: string;
+  payload?: Record<string, unknown>;
+};
+
+export type EvaluateActionResponse = {
+  decision: Decision;
+  risk_score: number;
+  reason: string;
+  delegation_id: string | null;
+  delegator: string | null;
+  sponsor: string;
+  matched_policies: string[];
+  action_request_id: string;
+};
+
+export type RequestOptions = {
+  idempotencyKey?: string;
+  signal?: AbortSignal;
+};
+
+export type AuctraClientOptions = {
+  apiKey: string;
+  baseUrl?: string;
+  timeoutMs?: number;
+  maxRetries?: number;
+  fetch?: typeof fetch;
+};
+
+export type Agent = {
+  id: string;
+  identity_id: string;
+  name: string;
+  description: string | null;
+  model_provider: "openai" | "anthropic" | "gemini" | "local";
+  model_name: string;
+  environment: AgentEnvironment;
+  authority_level: AuthorityLevel;
+  status: "active" | "suspended" | "restricted" | "compromised";
+  trust_rating: number;
+  sponsor: { id: string; full_name: string; email: string };
+  created_at: string;
+};
+
+export type CreateAgentInput = {
+  name: string;
+  modelProvider: Agent["model_provider"];
+  modelName: string;
+  description?: string;
+  environment?: AgentEnvironment;
+  authorityLevel?: AuthorityLevel;
+  sponsorUserId?: string;
+};
+
+export type Delegation = {
+  id: string;
+  agent: { id: string; name: string };
+  delegator: { id: string; full_name: string; email: string };
+  scope: { action_types: string[] };
+  limits: {
+    max_amount?: number;
+    max_count?: number;
+    currency?: string;
+    environment?: AgentEnvironment;
+  };
+  valid_from: string;
+  valid_until: string;
+  status: "active" | "revoked" | "expired";
+  is_active: boolean;
+  created_at: string;
+};
+
+export type CreateDelegationInput = {
+  agentId: string;
+  actionTypes: string[];
+  validUntil: string;
+  maxAmount?: number;
+  maxCount?: number;
+  environment?: AgentEnvironment;
+  currency?: string;
+  delegatorUserId?: string;
+};
+
+export type ActionRequest = {
+  id: string;
+  agent_name: string;
+  action_type: string;
+  action_summary: string;
+  payload: Record<string, unknown>;
+  decision: string;
+  decision_reason: string | null;
+  risk_score: number;
+  delegation_id: string | null;
+  policy_ids: string[];
+  pending_approval_id: string | null;
+  created_at: string;
+  decided_at: string | null;
+};
+
+export type Policy = {
+  id: string;
+  name: string;
+  description: string | null;
+  policy_type: PolicyType;
+  status: "active" | "draft" | "archived";
+  priority: number;
+  conditions: Record<string, unknown>;
+  actions: Record<string, unknown>;
+  created_at: string;
+};
+
+export type CreatePolicyInput = {
+  name: string;
+  description?: string;
+  policyType: PolicyType;
+  status?: "active" | "draft";
+  priority?: number;
+  actionType?: string;
+  amountGreaterThan?: number;
+  resourceSensitivity?: "public" | "internal" | "confidential" | "pii";
+  externalRecipient?: boolean;
+  environment?: AgentEnvironment;
+  decision: "block" | "require_approval";
+  approverRole?: "owner" | "admin" | "reviewer";
+};
+
+export type AuditEvent = {
+  id: string;
+  event_type: string;
+  event_summary: string;
+  decision: string | null;
+  decision_reason: string | null;
+  authority_valid_at_action: boolean | null;
+  actor_name: string;
+  approver_name: string | null;
+  policy_applied: string | null;
+  delegation_id: string | null;
+  hash: string | null;
+  previous_hash: string | null;
+  created_at: string;
+};
+
+export type ApiKeySummary = {
+  id: string;
+  name: string;
+  key_prefix: string;
+  environment: "development" | "production";
+  permissions: string[];
+  status: "active" | "revoked";
+  last_used_at: string | null;
+  created_at: string;
+};
+
+export class AuctraApiError extends Error {
+  readonly status: number;
+  readonly code?: string;
+  readonly details?: unknown;
+  readonly requestId?: string;
+
+  constructor(
+    message: string,
+    options: { status: number; code?: string; details?: unknown; requestId?: string },
+  ) {
+    super(message);
+    this.name = "AuctraApiError";
+    this.status = options.status;
+    this.code = options.code;
+    this.details = options.details;
+    this.requestId = options.requestId;
+  }
+}
+
+function retryDelay(response: Response | undefined, attempt: number) {
+  const retryAfter = response?.headers.get("retry-after");
+  if (retryAfter) {
+    const seconds = Number(retryAfter);
+    if (Number.isFinite(seconds)) return Math.min(30_000, Math.max(0, seconds * 1_000));
+    const dateDelay = Date.parse(retryAfter) - Date.now();
+    if (Number.isFinite(dateDelay)) return Math.min(30_000, Math.max(0, dateDelay));
+  }
+  return Math.min(5_000, 150 * 2 ** attempt);
+}
+
+function wait(ms: number, signal?: AbortSignal) {
+  if (signal?.aborted) return Promise.reject(signal.reason);
+  return new Promise<void>((resolve, reject) => {
+    const timeout = setTimeout(resolve, ms);
+    signal?.addEventListener(
+      "abort",
+      () => {
+        clearTimeout(timeout);
+        reject(signal.reason);
+      },
+      { once: true },
+    );
+  });
+}
+
+export class Auctra {
+  private readonly apiKey: string;
+  private readonly baseUrl: string;
+  private readonly timeoutMs: number;
+  private readonly maxRetries: number;
+  private readonly fetchImpl: typeof fetch;
+
+  constructor(options: AuctraClientOptions) {
+    if (!options.apiKey.trim()) throw new Error("apiKey is required");
+    if (options.timeoutMs !== undefined && options.timeoutMs <= 0) {
+      throw new Error("timeoutMs must be greater than zero");
+    }
+    if (
+      options.maxRetries !== undefined &&
+      (!Number.isInteger(options.maxRetries) || options.maxRetries < 0)
+    ) {
+      throw new Error("maxRetries must be a non-negative integer");
+    }
+    this.apiKey = options.apiKey;
+    this.baseUrl = (options.baseUrl ?? "https://console.auctra.tech").replace(/\/$/, "");
+    this.timeoutMs = options.timeoutMs ?? 10_000;
+    this.maxRetries = options.maxRetries ?? 2;
+    this.fetchImpl = options.fetch ?? globalThis.fetch;
+    if (!this.fetchImpl) throw new Error("A fetch implementation is required");
+  }
+
+  private async request<T>(
+    method: string,
+    path: string,
+    body?: unknown,
+    options: RequestOptions = {},
+  ): Promise<T> {
+    const retryableRequest = method === "GET" || Boolean(options.idempotencyKey);
+    let lastError: unknown;
+
+    for (let attempt = 0; attempt <= this.maxRetries; attempt += 1) {
+      if (options.signal?.aborted) throw options.signal.reason;
+      const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
+      const signal = options.signal
+        ? AbortSignal.any([options.signal, timeoutSignal])
+        : timeoutSignal;
+      let response: Response | undefined;
+
+      try {
+        response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+          method,
+          signal,
+          headers: {
+            ...(body !== undefined ? { "content-type": "application/json" } : {}),
+            ...(options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}),
+            authorization: `Bearer ${this.apiKey}`,
+            "x-auctra-sdk-version": AUCTRA_SDK_VERSION,
+          },
+          ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+        });
+
+        const data = (await response.json().catch(() => ({}))) as Record<string, unknown>;
+        if (response.ok) return data as T;
+
+        if (
+          retryableRequest &&
+          (response.status === 429 || response.status >= 500) &&
+          attempt < this.maxRetries
+        ) {
+          await wait(retryDelay(response, attempt), options.signal);
+          continue;
+        }
+
+        throw new AuctraApiError(
+          typeof data.error === "string" ? data.error : `Auctra API error (${response.status})`,
+          {
+            status: response.status,
+            code: typeof data.code === "string" ? data.code : undefined,
+            details: data.details,
+            requestId: response.headers.get("x-request-id") ?? undefined,
+          },
+        );
+      } catch (error) {
+        lastError = error;
+        if (options.signal?.aborted) throw options.signal.reason;
+        if (error instanceof AuctraApiError || !retryableRequest || attempt >= this.maxRetries) {
+          throw error;
+        }
+        await wait(retryDelay(response, attempt), options.signal);
+      }
+    }
+
+    throw lastError;
+  }
+
+  async evaluateAction(
+    input: EvaluateActionInput,
+    options: RequestOptions = {},
+  ): Promise<EvaluateActionResponse> {
+    const idempotencyKey = options.idempotencyKey ?? crypto.randomUUID();
+    return this.request(
+      "POST",
+      "/v1/action-requests/evaluate",
+      { agent_id: input.agentId, action_type: input.actionType, payload: input.payload ?? {} },
+      { ...options, idempotencyKey },
+    );
+  }
+
+  async listAgents(): Promise<{ agents: Agent[] }> {
+    return this.request("GET", "/v1/agents");
+  }
+
+  async getAgent(agentId: string): Promise<{ agent: Agent }> {
+    return this.request("GET", `/v1/agents/${encodeURIComponent(agentId)}`);
+  }
+
+  async createAgent(input: CreateAgentInput): Promise<{ agent: Agent }> {
+    return this.request("POST", "/v1/agents", {
+      name: input.name,
+      model_provider: input.modelProvider,
+      model_name: input.modelName,
+      description: input.description,
+      environment: input.environment,
+      authority_level: input.authorityLevel,
+      sponsor_user_id: input.sponsorUserId,
+    });
+  }
+
+  async listDelegations(): Promise<{ delegations: Delegation[] }> {
+    return this.request("GET", "/v1/delegations");
+  }
+
+  async getDelegation(delegationId: string): Promise<{ delegation: Delegation }> {
+    return this.request("GET", `/v1/delegations/${encodeURIComponent(delegationId)}`);
+  }
+
+  async createDelegation(input: CreateDelegationInput): Promise<{ delegation: Delegation }> {
+    return this.request("POST", "/v1/delegations", {
+      agent_id: input.agentId,
+      action_types: input.actionTypes,
+      valid_until: input.validUntil,
+      max_amount: input.maxAmount,
+      max_count: input.maxCount,
+      environment: input.environment,
+      currency: input.currency,
+      delegator_user_id: input.delegatorUserId,
+    });
+  }
+
+  async revokeDelegation(delegationId: string): Promise<{ ok: true }> {
+    return this.request("POST", `/v1/delegations/${encodeURIComponent(delegationId)}/revoke`, {});
+  }
+
+  async listActionRequests(): Promise<{ action_requests: ActionRequest[] }> {
+    return this.request("GET", "/v1/action-requests");
+  }
+
+  async approveActionRequest(actionRequestId: string, approverUserId: string, reason?: string) {
+    return this.resolveActionRequest(actionRequestId, "approve", approverUserId, reason);
+  }
+
+  async rejectActionRequest(actionRequestId: string, approverUserId: string, reason?: string) {
+    return this.resolveActionRequest(actionRequestId, "reject", approverUserId, reason);
+  }
+
+  async escalateActionRequest(actionRequestId: string, approverUserId: string, reason?: string) {
+    return this.resolveActionRequest(actionRequestId, "escalate", approverUserId, reason);
+  }
+
+  private async resolveActionRequest(
+    actionRequestId: string,
+    action: "approve" | "reject" | "escalate",
+    approverUserId: string,
+    reason?: string,
+  ): Promise<{ ok: true; decision: string; reason: string }> {
+    return this.request(
+      "POST",
+      `/v1/action-requests/${encodeURIComponent(actionRequestId)}/${action}`,
+      { reason, approver_user_id: approverUserId },
+    );
+  }
+
+  async listPolicies(): Promise<{ policies: Policy[] }> {
+    return this.request("GET", "/v1/policies");
+  }
+
+  async createPolicy(
+    input: CreatePolicyInput,
+  ): Promise<{ policy: Pick<Policy, "id" | "name" | "status" | "created_at"> }> {
+    return this.request("POST", "/v1/policies", {
+      name: input.name,
+      description: input.description,
+      policy_type: input.policyType,
+      status: input.status,
+      priority: input.priority,
+      action_type: input.actionType,
+      amount_greater_than: input.amountGreaterThan,
+      resource_sensitivity: input.resourceSensitivity,
+      external_recipient: input.externalRecipient,
+      environment: input.environment,
+      decision: input.decision,
+      approver_role: input.approverRole,
+    });
+  }
+
+  async listAuditEvents(): Promise<{ audit_events: AuditEvent[] }> {
+    return this.request("GET", "/v1/audit-events");
+  }
+
+  async listApiKeys(): Promise<{ api_keys: ApiKeySummary[] }> {
+    return this.request("GET", "/v1/api-keys");
+  }
+}

package/dist/index.d.ts

@@ -1,129 +0,0 @@
-export type EvaluateActionInput = {
-    agentId: string;
-    actionType: string;
-    payload?: Record<string, unknown>;
-};
-export type EvaluateActionResponse = {
-    decision: "allowed" | "blocked" | "require_approval";
-    risk_score: number;
-    reason: string;
-    delegation_id: string | null;
-    delegator: string | null;
-    sponsor: string;
-    matched_policies: string[];
-    action_request_id: string;
-};
-export type AuctraClientOptions = {
-    apiKey: string;
-    baseUrl?: string;
-    timeoutMs?: number;
-    maxRetries?: number;
-    fetch?: typeof fetch;
-};
-export type Agent = {
-    id: string;
-    identity_id: string;
-    name: string;
-    description: string | null;
-    model_provider: string;
-    model_name: string;
-    environment: "dev" | "staging" | "production";
-    authority_level: "low" | "medium" | "high" | "critical";
-    status: "active" | "suspended" | "restricted" | "compromised";
-    trust_rating: number;
-    sponsor: {
-        id: string;
-        full_name: string;
-        email: string;
-    };
-    created_at: string;
-};
-export type Delegation = {
-    id: string;
-    agent: {
-        id: string;
-        name: string;
-    };
-    delegator: {
-        id: string;
-        full_name: string;
-        email: string;
-    };
-    scope: {
-        action_types: string[];
-    };
-    limits: {
-        max_amount?: number;
-        currency?: string;
-    };
-    valid_from: string;
-    valid_until: string;
-    status: "active" | "revoked" | "expired";
-    is_active: boolean;
-    created_at: string;
-};
-export declare class AuctraApiError extends Error {
-    readonly status: number;
-    readonly code?: string;
-    readonly details?: unknown;
-    readonly requestId?: string;
-    constructor(message: string, options: {
-        status: number;
-        code?: string;
-        details?: unknown;
-        requestId?: string;
-    });
-}
-export declare class Auctra {
-    private apiKey;
-    private baseUrl;
-    private timeoutMs;
-    private maxRetries;
-    private fetchImpl;
-    constructor(options: AuctraClientOptions);
-    private request;
-    evaluateAction(input: EvaluateActionInput, options?: {
-        idempotencyKey?: string;
-        signal?: AbortSignal;
-    }): Promise<EvaluateActionResponse>;
-    listAgents(): Promise<{
-        agents: Agent[];
-    }>;
-    getAgent(agentId: string): Promise<{
-        agent: Agent;
-    }>;
-    createAgent(input: {
-        name: string;
-        modelProvider: string;
-        modelName: string;
-        description?: string;
-        environment?: string;
-        authorityLevel?: string;
-        sponsorUserId?: string;
-    }): Promise<unknown>;
-    listDelegations(): Promise<{
-        delegations: Delegation[];
-    }>;
-    createDelegation(input: {
-        agentId: string;
-        actionTypes: string[];
-        validUntil: string;
-        maxAmount?: number;
-        currency?: string;
-        delegatorUserId?: string;
-    }): Promise<unknown>;
-    revokeDelegation(delegationId: string): Promise<unknown>;
-    listActionRequests(): Promise<{
-        action_requests: unknown[];
-    }>;
-    approveActionRequest(actionRequestId: string, approverUserId: string, reason?: string): Promise<unknown>;
-    rejectActionRequest(actionRequestId: string, approverUserId: string, reason?: string): Promise<unknown>;
-    escalateActionRequest(actionRequestId: string, approverUserId: string, reason?: string): Promise<unknown>;
-    listPolicies(): Promise<{
-        policies: unknown[];
-    }>;
-    listAuditEvents(): Promise<{
-        audit_events: unknown[];
-    }>;
-}
-//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACnC,CAAC;AAEF,MAAM,MAAM,sBAAsB,GAAG;IACnC,QAAQ,EAAE,SAAS,GAAG,SAAS,GAAG,kBAAkB,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iBAAiB,EAAE,MAAM,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,mBAAmB,GAAG;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,OAAO,KAAK,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,KAAK,GAAG;IAClB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,KAAK,GAAG,SAAS,GAAG,YAAY,CAAC;IAC9C,eAAe,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;IACxD,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,YAAY,GAAG,aAAa,CAAC;IAC9D,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC1D,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACpC,SAAS,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;IAC5D,KAAK,EAAE;QAAE,YAAY,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAClC,MAAM,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnD,UAAU,EAAE,MAAM,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;IACzC,SAAS,EAAE,OAAO,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,qBAAa,cAAe,SAAQ,KAAK;IACvC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;gBAG1B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,CAAC,EAAE,OAAO,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE;CASpF;AAED,qBAAa,MAAM;IACjB,OAAO,CAAC,MAAM,CAAS;IACvB,OAAO,CAAC,OAAO,CAAS;IACxB,OAAO,CAAC,SAAS,CAAS;IAC1B,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,SAAS,CAAe;gBAEpB,OAAO,EAAE,mBAAmB;YAS1B,OAAO;IA0Df,cAAc,CAClB,KAAK,EAAE,mBAAmB,EAC1B,OAAO,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAC9D,OAAO,CAAC,sBAAsB,CAAC;IAc5B,UAAU;gBACgB,KAAK,EAAE;;IAGjC,QAAQ,CAAC,OAAO,EAAE,MAAM;eACC,KAAK;;IAG9B,WAAW,CAAC,KAAK,EAAE;QACvB,IAAI,EAAE,MAAM,CAAC;QACb,aAAa,EAAE,MAAM,CAAC;QACtB,SAAS,EAAE,MAAM,CAAC;QAClB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,aAAa,CAAC,EAAE,MAAM,CAAC;KACxB;IAYK,eAAe;qBACgB,UAAU,EAAE;;IAG3C,gBAAgB,CAAC,KAAK,EAAE;QAC5B,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,MAAM,EAAE,CAAC;QACtB,UAAU,EAAE,MAAM,CAAC;QACnB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,eAAe,CAAC,EAAE,MAAM,CAAC;KAC1B;IAWK,gBAAgB,CAAC,YAAY,EAAE,MAAM;IAIrC,kBAAkB;yBACiB,OAAO,EAAE;;IAG5C,oBAAoB,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAOrF,mBAAmB,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAOpF,qBAAqB,CAAC,eAAe,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM;IAOtF,YAAY;kBACgB,OAAO,EAAE;;IAGrC,eAAe;sBACiB,OAAO,EAAE;;CAEhD"}