@auctra/sdk 0.6.0 → 0.6.2

package/CHANGELOG.md

@@ -1,5 +1,21 @@
 # Changelog
 
+## 0.6.2
+
+**Fix — production default base URL**
+
+- Default `baseUrl` is now `https://app.auctra.tech` (API + console are colocated there).
+- Published `0.6.1` incorrectly defaulted to `https://console.auctra.tech` (NXDOMAIN).
+- Export `DEFAULT_BASE_URL` so staging/local overrides stay explicit: `new Auctra({ apiKey, baseUrl })`.
+
+## 0.6.1
+
+**Stage 1.0 — SDK + Runtime convergence packaging**
+
+- Modularize the client under `authority` / `action` / `evidence` modules (same public API as 0.6.0).
+- Align with Stage 1.0 cloud surface: authorities, `action.evaluate` / `action.execute`, evidence verify.
+- No public API break from 0.6.0.
+
 ## 0.6.0
 
 **Breaking — Authority Protocol public API (clean break, no legacy aliases)**

package/README.md

@@ -6,11 +6,11 @@ Official TypeScript SDK for [Auctra](https://auctra.tech) — **Authority Protoc
 
 | Resource                   | URL                                                           |
 | -------------------------- | ------------------------------------------------------------- |
-| **Console**                | https://console.auctra.tech                                   |
-| **Sign up (free Builder)** | https://console.auctra.tech/auth/signup                       |
+| **Console**                | https://app.auctra.tech                                   |
+| **Sign up (free Developer)** | https://app.auctra.tech/auth/signup                       |
 | **Docs**                   | https://auctra.tech/docs                                      |
-| **OpenAPI 3.1**            | https://console.auctra.tech/v1/openapi.json                   |
-| **API base URL**           | `https://console.auctra.tech` (default — no `baseUrl` needed) |
+| **OpenAPI 3.1**            | https://app.auctra.tech/v1/openapi.json                   |
+| **API base URL**           | `https://app.auctra.tech` (`DEFAULT_BASE_URL` — override with `baseUrl`) |
 
 ## Install
 
@@ -41,6 +41,7 @@ import { Auctra } from "@auctra/sdk";
 
 const auctra = new Auctra({
   apiKey: process.env.AUCTRA_API_KEY!,
+  // baseUrl defaults to https://app.auctra.tech — set for staging/local only
   timeoutMs: 10_000,
   maxRetries: 2,
 });

package/dist/cjs/action.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/artifacts.js

@@ -0,0 +1,110 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuctraApiError = void 0;
+exports.retryDelay = retryDelay;
+exports.wait = wait;
+exports.verifyMandateArtifact = verifyMandateArtifact;
+exports.verifyDecisionArtifact = verifyDecisionArtifact;
+/** @auctra/sdk — Authority Protocol client (Stage 1.0 modular layout). */
+const node_crypto_1 = require("node:crypto");
+class AuctraApiError extends Error {
+    status;
+    code;
+    details;
+    requestId;
+    constructor(message, options) {
+        super(message);
+        this.name = "AuctraApiError";
+        this.status = options.status;
+        this.code = options.code;
+        this.details = options.details;
+        this.requestId = options.requestId;
+    }
+}
+exports.AuctraApiError = AuctraApiError;
+function retryDelay(response, attempt) {
+    const retryAfter = response?.headers.get("retry-after");
+    if (retryAfter) {
+        const seconds = Number(retryAfter);
+        if (Number.isFinite(seconds))
+            return Math.min(30_000, Math.max(0, seconds * 1_000));
+        const dateDelay = Date.parse(retryAfter) - Date.now();
+        if (Number.isFinite(dateDelay))
+            return Math.min(30_000, Math.max(0, dateDelay));
+    }
+    return Math.min(5_000, 150 * 2 ** attempt);
+}
+function wait(ms, signal) {
+    if (signal?.aborted)
+        return Promise.reject(signal.reason);
+    return new Promise((resolve, reject) => {
+        const timeout = setTimeout(resolve, ms);
+        signal?.addEventListener("abort", () => {
+            clearTimeout(timeout);
+            reject(signal.reason);
+        }, { once: true });
+    });
+}
+function canonicalizeJson(value) {
+    if (Array.isArray(value))
+        return value.map(canonicalizeJson);
+    if (value && typeof value === "object" && !(value instanceof Date)) {
+        return Object.fromEntries(Object.entries(value)
+            .filter(([, child]) => child !== undefined)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => [key, canonicalizeJson(child)]));
+    }
+    if (value instanceof Date)
+        return value.toISOString();
+    return value;
+}
+function hashJson(value) {
+    return (0, node_crypto_1.createHash)("sha256")
+        .update(JSON.stringify(canonicalizeJson(value)))
+        .digest("hex");
+}
+function verifyEd25519(input) {
+    if (!input.publicKeyPem)
+        return false;
+    if (input.signature.alg !== "Ed25519")
+        return false;
+    return (0, node_crypto_1.verify)(null, Buffer.from(JSON.stringify(canonicalizeJson(input.payload))), typeof input.publicKeyPem === "string"
+        ? (0, node_crypto_1.createPublicKey)(input.publicKeyPem)
+        : input.publicKeyPem, Buffer.from(input.signature.value, "base64url"));
+}
+function verifyMandateArtifact(input) {
+    const expectedHash = hashJson(input.payload);
+    if (input.evidence.format !== "auctra-mandate.v0.1") {
+        return { valid: false, hashValid: false, signatureValid: false };
+    }
+    if (!input.evidence.signed) {
+        const hashValid = input.evidence.payload_hash === expectedHash;
+        return { valid: hashValid, hashValid, signatureValid: false };
+    }
+    const hashValid = input.evidence.payload_hash === expectedHash;
+    const signatureValid = hashValid &&
+        verifyEd25519({
+            payload: input.payload,
+            signature: input.evidence.signature,
+            publicKeyPem: input.publicKeyPem,
+        });
+    return { valid: hashValid && signatureValid, hashValid, signatureValid };
+}
+function verifyDecisionArtifact(input) {
+    const expectedHash = hashJson(input.payload);
+    if (input.evidence.format !== "auctra-evidence.v0.1") {
+        return { valid: false, hashValid: false, signatureValid: false };
+    }
+    if (!input.evidence.signed) {
+        const hashValid = input.evidence.payload_hash === expectedHash;
+        return { valid: hashValid, hashValid, signatureValid: false };
+    }
+    const hashValid = input.evidence.payload_hash === expectedHash;
+    const signatureValid = hashValid &&
+        verifyEd25519({
+            payload: input.payload,
+            signature: input.evidence.signature,
+            publicKeyPem: input.publicKeyPem,
+        });
+    return { valid: hashValid && signatureValid, hashValid, signatureValid };
+}

package/dist/cjs/authority.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/cjs/client.js

@@ -0,0 +1,355 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.Auctra = void 0;
+/** @auctra/sdk — Authority Protocol client (Stage 1.0 modular layout). */
+const artifacts_js_1 = require("./artifacts.js");
+const types_js_1 = require("./types.js");
+class Auctra {
+    apiKey;
+    baseUrl;
+    timeoutMs;
+    maxRetries;
+    fetchImpl;
+    constructor(options) {
+        if (!options.apiKey.trim())
+            throw new Error("apiKey is required");
+        if (options.timeoutMs !== undefined && options.timeoutMs <= 0) {
+            throw new Error("timeoutMs must be greater than zero");
+        }
+        if (options.maxRetries !== undefined &&
+            (!Number.isInteger(options.maxRetries) || options.maxRetries < 0)) {
+            throw new Error("maxRetries must be a non-negative integer");
+        }
+        this.apiKey = options.apiKey;
+        this.baseUrl = (options.baseUrl ?? types_js_1.DEFAULT_BASE_URL).replace(/\/$/, "");
+        this.timeoutMs = options.timeoutMs ?? 10_000;
+        this.maxRetries = options.maxRetries ?? 2;
+        this.fetchImpl = options.fetch ?? globalThis.fetch;
+        if (!this.fetchImpl)
+            throw new Error("A fetch implementation is required");
+    }
+    async request(method, path, body, options = {}) {
+        const retryableRequest = method === "GET" || Boolean(options.idempotencyKey);
+        let lastError;
+        for (let attempt = 0; attempt <= this.maxRetries; attempt += 1) {
+            if (options.signal?.aborted)
+                throw options.signal.reason;
+            const timeoutSignal = AbortSignal.timeout(this.timeoutMs);
+            const signal = options.signal
+                ? AbortSignal.any([options.signal, timeoutSignal])
+                : timeoutSignal;
+            let response;
+            try {
+                response = await this.fetchImpl(`${this.baseUrl}${path}`, {
+                    method,
+                    signal,
+                    headers: {
+                        ...(body !== undefined ? { "content-type": "application/json" } : {}),
+                        ...(options.idempotencyKey ? { "idempotency-key": options.idempotencyKey } : {}),
+                        authorization: `Bearer ${this.apiKey}`,
+                        "x-auctra-sdk-version": types_js_1.AUCTRA_SDK_VERSION,
+                    },
+                    ...(body !== undefined ? { body: JSON.stringify(body) } : {}),
+                });
+                const data = (await response.json().catch(() => ({})));
+                if (response.ok)
+                    return data;
+                if (retryableRequest &&
+                    (response.status === 429 || response.status >= 500) &&
+                    attempt < this.maxRetries) {
+                    await (0, artifacts_js_1.wait)((0, artifacts_js_1.retryDelay)(response, attempt), options.signal);
+                    continue;
+                }
+                throw new artifacts_js_1.AuctraApiError(typeof data.error === "string" ? data.error : `Auctra API error (${response.status})`, {
+                    status: response.status,
+                    code: typeof data.code === "string" ? data.code : undefined,
+                    details: data.details,
+                    requestId: response.headers.get("x-request-id") ?? undefined,
+                });
+            }
+            catch (error) {
+                lastError = error;
+                if (options.signal?.aborted)
+                    throw options.signal.reason;
+                if (error instanceof artifacts_js_1.AuctraApiError || !retryableRequest || attempt >= this.maxRetries) {
+                    throw error;
+                }
+                await (0, artifacts_js_1.wait)((0, artifacts_js_1.retryDelay)(response, attempt), options.signal);
+            }
+        }
+        throw lastError;
+    }
+    async executeOrEvaluateAction(input, options, mode) {
+        const idempotencyKey = mode === "execute" ? (options.idempotencyKey ?? crypto.randomUUID()) : options.idempotencyKey;
+        const path = mode === "execute" ? "/v1/actions/execute" : "/v1/actions/evaluate";
+        return this.request("POST", path, {
+            agent_id: input.agentId,
+            action_type: input.actionType,
+            payload: input.payload ?? {},
+            claimed_intent_id: input.claimedIntentId,
+            intent_anchor_token: input.intentAnchorToken,
+            parent_action_id: input.parentActionId,
+            dry_run: mode === "evaluate",
+            actor: input.actor
+                ? {
+                    id: input.actor.id,
+                    type: input.actor.type,
+                    name: input.actor.name,
+                }
+                : undefined,
+            action: input.action
+                ? {
+                    target: input.action.target,
+                    description: input.action.description,
+                    risk_level: input.action.riskLevel,
+                    metadata: input.action.metadata,
+                }
+                : undefined,
+        }, mode === "execute" ? { ...options, idempotencyKey } : options);
+    }
+    async issueAuthorityRequest(input) {
+        const response = await this.request("POST", "/v1/authorities", {
+            agent_id: input.subject,
+            action_types: input.capabilities,
+            valid_until: input.expiresAt,
+            max_amount: input.constraints?.maxAmount,
+            max_count: input.constraints?.maxCount,
+            environment: input.constraints?.environment,
+            currency: input.constraints?.currency,
+            delegator_user_id: input.delegatorUserId ?? input.issuer,
+            parent_authority_id: input.parentAuthorityId,
+            max_delegation_depth: input.delegation?.maxDepth,
+            max_actions_per_window: input.maxActionsPerWindow
+                ? {
+                    count: input.maxActionsPerWindow.count,
+                    window_seconds: input.maxActionsPerWindow.windowSeconds,
+                    action_type: input.maxActionsPerWindow.actionType,
+                }
+                : undefined,
+            max_amount_per_window: input.maxAmountPerWindow
+                ? {
+                    amount: input.maxAmountPerWindow.amount,
+                    window_seconds: input.maxAmountPerWindow.windowSeconds,
+                }
+                : undefined,
+        });
+        const authorityId = response.authority_id ?? response.delegation.id;
+        const authority = response.authority ?? {
+            id: authorityId,
+            protocol_version: "0.1",
+            status: response.delegation.status,
+            payload_hash: "",
+            signed: false,
+            parent_authority_id: input.parentAuthorityId ?? null,
+            capabilities: input.capabilities,
+        };
+        return {
+            authority,
+            authority_id: authorityId,
+            delegation: response.delegation,
+        };
+    }
+    /**
+     * Authority Protocol — issue, verify, delegate (subset), revoke.
+     * There is no legacy createDelegation() surface.
+     */
+    get authority() {
+        return {
+            issue: (input) => this.issueAuthorityRequest(input),
+            verify: (payload, artifact) => this.request("POST", "/v1/authorities/verify", { payload, artifact }),
+            delegate: (input) => this.issueAuthorityRequest({
+                ...input,
+                parentAuthorityId: input.parent,
+            }),
+            revoke: (authorityId) => this.request("POST", `/v1/authorities/${encodeURIComponent(authorityId)}/revoke`, {}),
+        };
+    }
+    /**
+     * Action Protocol — evaluate (dry-run) vs execute (enforce + evidence).
+     * There is no legacy evaluateAction() surface.
+     */
+    get action() {
+        return {
+            evaluate: (input, options = {}) => this.executeOrEvaluateAction(input, options, "evaluate"),
+            execute: (input, options = {}) => this.executeOrEvaluateAction(input, options, "execute"),
+        };
+    }
+    get evidence() {
+        return {
+            verify: (payload, evidence) => this.request("POST", "/v1/evidence/verify", { payload, evidence }),
+        };
+    }
+    async verifyMandate(payload, evidence) {
+        return this.request("POST", "/v1/mandates/verify", { payload, evidence });
+    }
+    async listIntents() {
+        return this.request("GET", "/v1/intents");
+    }
+    async createIntent(input) {
+        return this.request("POST", "/v1/intents", {
+            title: input.title,
+            description: input.description,
+            intent_type: input.intentType,
+            risk_level: input.riskLevel,
+            max_risk_level: input.maxRiskLevel,
+            expires_at: input.expiresAt,
+            allowed_action_types: input.allowedActionTypes,
+            target_pattern: input.targetPattern,
+            resource_allowlist: input.resourceAllowlist,
+        });
+    }
+    async getIntent(intentId) {
+        return this.request("GET", `/v1/intents/${encodeURIComponent(intentId)}`);
+    }
+    async updateIntentStatus(intentId, status) {
+        return this.updateIntent(intentId, { status });
+    }
+    async updateIntent(intentId, input) {
+        return this.request("PATCH", `/v1/intents/${encodeURIComponent(intentId)}`, {
+            status: input.status,
+            title: input.title,
+            description: input.description,
+            intent_type: input.intentType,
+            risk_level: input.riskLevel,
+            max_risk_level: input.maxRiskLevel,
+            expires_at: input.expiresAt,
+        });
+    }
+    async getAuthorityGraph() {
+        return this.request("GET", "/v1/authority/graph");
+    }
+    async createAuthorityEdge(input) {
+        return this.request("POST", "/v1/authority/edges", {
+            from_actor_id: input.fromActorId,
+            from_actor_type: input.fromActorType,
+            to_actor_id: input.toActorId,
+            to_actor_type: input.toActorType,
+            authority_scope: input.authorityScope,
+            conditions: input.conditions,
+            max_risk_level: input.maxRiskLevel,
+            expires_at: input.expiresAt,
+        });
+    }
+    async getActionEvaluation(actionRequestId) {
+        return this.request("GET", `/v1/action-requests/${encodeURIComponent(actionRequestId)}/evaluation`);
+    }
+    async getRootIntentChain(actionRequestId) {
+        return this.request("GET", `/v1/action-requests/${encodeURIComponent(actionRequestId)}/root-intent`);
+    }
+    async listAgents() {
+        return this.request("GET", "/v1/agents");
+    }
+    async getAgent(agentId) {
+        return this.request("GET", `/v1/agents/${encodeURIComponent(agentId)}`);
+    }
+    async createAgent(input) {
+        return this.request("POST", "/v1/agents", {
+            name: input.name,
+            model_provider: input.modelProvider,
+            model_name: input.modelName,
+            description: input.description,
+            environment: input.environment,
+            authority_level: input.authorityLevel,
+            sponsor_user_id: input.sponsorUserId,
+        });
+    }
+    async updateAgentStatus(agentId, input) {
+        return this.request("PATCH", `/v1/agents/${encodeURIComponent(agentId)}`, {
+            status: input.status,
+            reason: input.reason,
+            revoke_delegations: input.revokeDelegations,
+            restore_delegations: input.restoreDelegations,
+        });
+    }
+    async deleteAgent(agentId) {
+        return this.request("DELETE", `/v1/agents/${encodeURIComponent(agentId)}`);
+    }
+    async listAuthorities() {
+        return this.request("GET", "/v1/authorities");
+    }
+    async getAuthority(authorityId) {
+        return this.request("GET", `/v1/authorities/${encodeURIComponent(authorityId)}`);
+    }
+    async listActionRequests() {
+        return this.request("GET", "/v1/action-requests");
+    }
+    async approveActionRequest(actionRequestId, approverUserId, reason) {
+        return this.resolveActionRequest(actionRequestId, "approve", approverUserId, reason);
+    }
+    async rejectActionRequest(actionRequestId, approverUserId, reason) {
+        return this.resolveActionRequest(actionRequestId, "reject", approverUserId, reason);
+    }
+    async escalateActionRequest(actionRequestId, approverUserId, reason) {
+        return this.resolveActionRequest(actionRequestId, "escalate", approverUserId, reason);
+    }
+    async resolveActionRequest(actionRequestId, action, approverUserId, reason) {
+        return this.request("POST", `/v1/action-requests/${encodeURIComponent(actionRequestId)}/${action}`, { reason, approver_user_id: approverUserId });
+    }
+    async listPolicies() {
+        return this.request("GET", "/v1/policies");
+    }
+    async createPolicy(input) {
+        return this.request("POST", "/v1/policies", {
+            name: input.name,
+            description: input.description,
+            policy_type: input.policyType,
+            status: input.status,
+            priority: input.priority,
+            action_type: input.actionType,
+            amount_greater_than: input.amountGreaterThan,
+            resource_sensitivity: input.resourceSensitivity,
+            external_recipient: input.externalRecipient,
+            environment: input.environment,
+            decision: input.decision,
+            approver_role: input.approverRole,
+            max_actions_per_window: input.maxActionsPerWindow
+                ? {
+                    count: input.maxActionsPerWindow.count,
+                    window_seconds: input.maxActionsPerWindow.windowSeconds,
+                    action_type: input.maxActionsPerWindow.actionType,
+                }
+                : undefined,
+            max_amount_per_window: input.maxAmountPerWindow
+                ? {
+                    amount: input.maxAmountPerWindow.amount,
+                    window_seconds: input.maxAmountPerWindow.windowSeconds,
+                }
+                : undefined,
+        });
+    }
+    async simulatePolicy(policyId, input = {}) {
+        return this.request("POST", `/v1/policies/${encodeURIComponent(policyId)}/simulate`, input);
+    }
+    async publishPolicy(policyId, input = {}) {
+        return this.request("POST", `/v1/policies/${encodeURIComponent(policyId)}/publish`, input);
+    }
+    async listActionTypes() {
+        return this.listCustomActionTypes();
+    }
+    async listCustomActionTypes() {
+        return this.request("GET", "/v1/action-types");
+    }
+    async createCustomActionType(input) {
+        return this.request("POST", "/v1/action-types", {
+            id: input.id,
+            label: input.label,
+            description: input.description,
+            category: input.category,
+            policy_type: input.policyType,
+            payload_schema: input.payloadSchema ?? {},
+        });
+    }
+    async listAuditEvents() {
+        return this.request("GET", "/v1/audit-events");
+    }
+    async getAuditEvent(auditEventId) {
+        return this.request("GET", `/v1/audit-events/${encodeURIComponent(auditEventId)}`);
+    }
+    async verifyAuditChain() {
+        return this.request("GET", "/v1/audit-events/verify");
+    }
+    async listApiKeys() {
+        return this.request("GET", "/v1/api-keys");
+    }
+}
+exports.Auctra = Auctra;

package/dist/cjs/evidence.js

@@ -0,0 +1,6 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.verifyMandateArtifact = exports.verifyDecisionArtifact = void 0;
+var artifacts_js_1 = require("./artifacts.js");
+Object.defineProperty(exports, "verifyDecisionArtifact", { enumerable: true, get: function () { return artifacts_js_1.verifyDecisionArtifact; } });
+Object.defineProperty(exports, "verifyMandateArtifact", { enumerable: true, get: function () { return artifacts_js_1.verifyMandateArtifact; } });