@crustdev/armordesk 1.0.1 → 1.0.3

package/dist/cli.mjs

@@ -1,17 +1,40 @@
 import {
   ArmorDeskClient,
+  clearStoredConfig,
   generateClaudeDesktopConfig,
-  generateCursorConfig
-} from "./chunk-TVWUJ3XJ.mjs";
+  generateCursorConfig,
+  getConfigPath,
+  loadStoredConfig,
+  saveStoredConfig
+} from "./chunk-IKQRJ7XB.mjs";
 
 // src/cli.ts
+import { exec } from "child_process";
+function tryOpenBrowser(url) {
+  try {
+    const cmd = process.platform === "darwin" ? `open "${url}"` : process.platform === "win32" ? `start "" "${url}"` : `xdg-open "${url}" 2>/dev/null`;
+    exec(cmd, () => {
+    });
+  } catch {
+  }
+}
 var HELP_TEXT = `
   \u{1F6E1}\uFE0F  ArmorDesk CLI: Enterprise AI Agent Control Plane & MCP Gateway
 
   Usage:
     armordesk <command> [options]
 
-  Commands:
+  Account & Authentication:
+    login [--email <email>]     Authenticate with armordesk.crusts.dev
+    whoami                      Display active authenticated account & role
+    logout                      Clear local session credentials
+
+  MCP Gateway & Diagnostics:
+    mcp [check|status]          Verify if MCP Gateway is connected & reachable
+    mcp claude                  Output Claude Desktop MCP configuration JSON
+    mcp cursor                  Output Cursor IDE MCP configuration JSON
+
+  Security & Governance:
     status                      Check operational status of ArmorDesk Control Plane
     tenants                     List active corporate tenants & spend policies
     traces                      Inspect recent audited security & policy traces
@@ -20,12 +43,13 @@ var HELP_TEXT = `
     reject <delegation_id>      Reject an action held in escrow
     receipts                    List digital execution receipts with proofs
     verify <receipt_id>         Cryptographically verify a receipt (Plan Hash & Merkle Root)
-    mcp [claude|cursor]         Show MCP Gateway config for Claude Desktop or Cursor
     scenario <1-5>              Run an adversarial FinOps crew simulation
     ctf "<prompt>"              Test prompt injection attack against CTF Gauntlet
     voice [executive|security]  Generate voice briefing telemetry via ElevenLabs
 
   Options:
+    --email <email>             Account email for login (default: rustaman@crusts.dev)
+    --password <pass>           Account password for login
     --url <url>                 ArmorDesk Control Plane URL (default: https://armordesk.crusts.dev)
     --tenant <id>               Tenant ID (default: acme-corp)
     --key <key>                 ArmorIQ API Key
@@ -66,6 +90,125 @@ async function runCLI(args = process.argv.slice(2)) {
   });
   try {
     switch (command) {
+      case "login": {
+        const explicitEmail = flags["email"] || (positional[1] && positional[1].includes("@") ? positional[1] : null);
+        if (explicitEmail) {
+          const password = flags["password"] || "admin";
+          const tenant = flags["tenant"] || "acme-corp";
+          console.log(`
+\u{1F510} Authenticating directly with ArmorDesk at ${client.baseUrl}...`);
+          const loginRes = await client.login(explicitEmail, password, tenant);
+          console.log("------------------------------------------------------------");
+          console.log(`\u2705 Logged in successfully as ${loginRes.user.name}!`);
+          console.log(`   Email:        ${loginRes.user.email}`);
+          console.log(`   Role:         ${loginRes.user.role.toUpperCase()}`);
+          console.log(`   Title:        ${loginRes.user.title}`);
+          console.log(`   Tenant:       ${loginRes.tenant.name} (${loginRes.tenant.id})`);
+          console.log(`   Bank Balance: $${loginRes.tenant.balance.toLocaleString()} ${loginRes.tenant.currency}`);
+          console.log(`   Scope:        ${loginRes.user.scopeSummary}`);
+          console.log(`
+\u{1F4C1} Session saved to: ${getConfigPath()}`);
+          console.log("All armordesk commands will now execute under this identity.\n");
+          break;
+        }
+        console.log(`
+\u{1F510} Initiating ArmorDesk Browser Authorization...`);
+        const codeRes = await client.requestDeviceCode();
+        console.log("------------------------------------------------------------");
+        console.log(`  1. Please visit the authorization URL in your browser:`);
+        console.log(`     \u{1F449}  \x1B[36m\x1B[1m${codeRes.verification_uri_complete}\x1B[0m`);
+        console.log(`
+  2. Confirm your one-time device code:`);
+        console.log(`     \u{1F511}  \x1B[32m\x1B[1m${codeRes.user_code}\x1B[0m`);
+        console.log("------------------------------------------------------------");
+        console.log(`Waiting for browser authorization... (Press Ctrl+C to abort)`);
+        tryOpenBrowser(codeRes.verification_uri_complete);
+        let approved = false;
+        const intervalMs = (codeRes.interval || 2) * 1e3;
+        const maxPolls = 450;
+        let polls = 0;
+        while (!approved && polls < maxPolls) {
+          await new Promise((r) => setTimeout(r, intervalMs));
+          polls++;
+          try {
+            const pollRes = await client.pollDeviceCode(codeRes.device_code);
+            if (pollRes.status === "APPROVED" && pollRes.token && pollRes.user) {
+              approved = true;
+              saveStoredConfig({
+                baseUrl: client.baseUrl,
+                token: pollRes.token,
+                user: {
+                  id: pollRes.user.id,
+                  name: pollRes.user.name,
+                  email: pollRes.user.email,
+                  role: pollRes.user.role,
+                  title: pollRes.user.role === "manager" ? "Corporate Officer" : "FinOps Member",
+                  avatar: pollRes.user.name.split(" ").map((n) => n[0]).join("").slice(0, 2).toUpperCase() || "CU",
+                  tenant_id: pollRes.user.tenant_id,
+                  scopeSummary: pollRes.user.role === "manager" ? "Full Treasury & Wire Transfer Approval Authority" : "Restricted View-Only Scope"
+                },
+                tenant: pollRes.tenant,
+                apiKey: client.apiKey,
+                updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+              });
+              console.log("\n------------------------------------------------------------");
+              console.log(`\u2705 Authorization Approved by Browser!`);
+              console.log(`   User:         ${pollRes.user.name} (${pollRes.user.email})`);
+              console.log(`   Role:         ${pollRes.user.role.toUpperCase()}`);
+              console.log(`   Tenant:       ${pollRes.tenant?.name || pollRes.user.tenant_id}`);
+              console.log(`
+\u{1F4C1} Session saved to: ${getConfigPath()}`);
+              console.log("All armordesk commands will now execute under this identity.\n");
+              break;
+            } else if (pollRes.status === "DENIED") {
+              console.error("\n\u274C Authorization request was declined in browser.");
+              process.exit(1);
+            } else if (pollRes.status === "EXPIRED") {
+              console.error("\n\u231B Device code has expired. Please run 'armordesk login' again.");
+              process.exit(1);
+            } else {
+              process.stdout.write(".");
+            }
+          } catch (err) {
+          }
+        }
+        if (!approved) {
+          console.error("\n\u231B Authorization timed out. Please try logging in again.");
+          process.exit(1);
+        }
+        break;
+      }
+      case "whoami": {
+        const cfg = loadStoredConfig();
+        if (!cfg.user) {
+          console.log("\n\u26A0\uFE0F  Not currently logged in.");
+          console.log("Run 'armordesk login --email <your_email>' to authenticate.\n");
+        } else {
+          console.log("\n\u{1F464} ArmorDesk Active Identity");
+          console.log("------------------------------------------------------------");
+          console.log(`User:         ${cfg.user.name} (${cfg.user.email})`);
+          console.log(`Role:         ${cfg.user.role.toUpperCase()} \xB7 ${cfg.user.title}`);
+          console.log(`Tenant:       ${cfg.tenant?.name || "Corporate"} (${cfg.user.tenant_id})`);
+          if (cfg.tenant) {
+            console.log(`Treasury:     $${cfg.tenant.balance.toLocaleString()} ${cfg.tenant.currency}`);
+            console.log(`Spend Limit:  $${cfg.tenant.spend_limit.toLocaleString()} USD`);
+          }
+          console.log(`Scope:        ${cfg.user.scopeSummary}`);
+          console.log(`Endpoint:     ${cfg.baseUrl || client.baseUrl}`);
+          console.log(`Config file:  ${getConfigPath()}
+`);
+        }
+        break;
+      }
+      case "logout": {
+        const cleared = clearStoredConfig();
+        if (cleared) {
+          console.log("\n\u{1F44B} Logged out successfully. Local session cleared.\n");
+        } else {
+          console.log("\nNo active session found to logout.\n");
+        }
+        break;
+      }
       case "status":
       case "info": {
         const st = await client.status();
@@ -208,26 +351,38 @@ async function runCLI(args = process.argv.slice(2)) {
         break;
       }
       case "mcp": {
-        const sub = positional[1] || "info";
+        const sub = positional[1] || "check";
         if (sub === "claude") {
           console.log(JSON.stringify(generateClaudeDesktopConfig({ gatewayUrl: `${client.baseUrl}/api/mcp/gateway` }), null, 2));
         } else if (sub === "cursor") {
           console.log(JSON.stringify(generateCursorConfig({ gatewayUrl: `${client.baseUrl}/api/mcp/gateway` }), null, 2));
         } else {
-          const cfg = await client.getMCPConfig();
+          console.log(`
+\u{1F50D} Probing ArmorDesk Governed MCP Gateway at ${client.baseUrl}...`);
+          const diag = await client.checkMCP();
           if (flags["json"]) {
-            console.log(JSON.stringify(cfg, null, 2));
+            console.log(JSON.stringify(diag, null, 2));
           } else {
-            console.log("\n\u{1F50C} ArmorDesk Governed MCP Gateway");
-            console.log("-----------------------------------------");
-            console.log(`Gateway URL:      ${cfg.gateway_url}`);
-            console.log(`SSE URL:          ${cfg.sse_url}`);
-            console.log(`Protocol Version: ${cfg.protocol_version}`);
-            console.log(`Governed Tools:   ${cfg.governed_tools.length} sandboxed tools`);
-            cfg.governed_tools.forEach((t) => {
-              console.log(`  \u2022 ${t.name.padEnd(24)} [${t.tier}] (${t.governing_agent})`);
+            console.log("------------------------------------------------------------");
+            console.log(`Connection:       ${diag.connected ? "\u{1F7E2} ONLINE & CONNECTED" : "\u{1F534} DISCONNECTED"}`);
+            console.log(`Gateway Ping:     ${diag.ping.status} (${diag.latencyMs}ms roundtrip)`);
+            console.log(`Gateway URL:      ${diag.config.gateway_url}`);
+            console.log(`SSE URL:          ${diag.config.sse_url}`);
+            console.log(`Protocol Version: ${diag.ping.protocol}`);
+            console.log(`Governance:       ${diag.ping.governance}`);
+            console.log(`Sandboxes Active: ${diag.ping.active_sandboxes.join(", ")}`);
+            console.log(`Connected Agents: ${diag.config.connected_agents.length} fleet agents`);
+            diag.config.connected_agents.forEach((ag) => {
+              console.log(`  \u2022 ${ag.name.padEnd(28)} [${ag.status}] (Sandbox: ${ag.assigned_sandbox})`);
+            });
+            console.log(`
+Governed Tools:   ${diag.config.governed_tools.length} policed tools`);
+            diag.config.governed_tools.forEach((t) => {
+              const desc = (t.description || "").slice(0, 55);
+              console.log(`  \u2022 ${t.name.padEnd(24)} ${desc}...`);
             });
-            console.log("\nTip: Run 'armordesk mcp claude' or 'armordesk mcp cursor' to get snippet configurations.\n");
+            console.log("\nVerdict:          \u2705 MCP GATEWAY IS FULLY CONNECTED & GOVERNED");
+            console.log("Tip: Run 'armordesk mcp claude' or 'armordesk mcp cursor' to get MCP client configs.\n");
           }
         }
         break;

package/dist/client.d.ts

@@ -1,11 +1,12 @@
-import type { ArmorDeskClientOptions, ArmorDeskStatus, TenantInfo, TraceItem, ApprovalItem, ReceiptItem, VerifyProofRequest, VerifyProofResponse, MCPGatewayConfig, MCPCallResponse, ScenarioRunResponse, CTFSubmitResponse, VoiceBriefingResponse } from "./types.js";
+import type { ArmorDeskClientOptions, ArmorDeskStatus, TenantInfo, TraceItem, ApprovalItem, ReceiptItem, VerifyProofRequest, VerifyProofResponse, MCPGatewayConfig, MCPCallResponse, ScenarioRunResponse, CTFSubmitResponse, VoiceBriefingResponse, LoginResponse, MCPStatusResponse, DeviceCodeResponse, DevicePollResponse } from "./types.js";
 import { canonicalJson, generatePlanHash, buildMerkleTree, verifyMerkleRoot, verifyProof } from "./crypto.js";
 export declare class ArmorDeskClient {
-    readonly baseUrl: string;
-    readonly apiKey?: string;
-    readonly tenantId: string;
-    readonly userName: string;
-    readonly userRole: string;
+    baseUrl: string;
+    apiKey?: string;
+    tenantId: string;
+    userName: string;
+    userRole: string;
+    token?: string;
     private readonly _fetch;
     readonly crypto: {
         canonicalJson: typeof canonicalJson;
@@ -16,6 +17,31 @@ export declare class ArmorDeskClient {
     };
     constructor(options?: ArmorDeskClientOptions);
     private request;
+    /**
+     * Authenticate with an ArmorDesk account and persist credentials
+     */
+    login(email: string, password?: string, tenantId?: string): Promise<LoginResponse>;
+    /**
+     * Request OAuth 2.0 Device Code for terminal/browser authentication (RFC 8628)
+     */
+    requestDeviceCode(): Promise<DeviceCodeResponse>;
+    /**
+     * Poll OAuth 2.0 Device Code until authorized by user in browser
+     */
+    pollDeviceCode(deviceCode: string): Promise<DevicePollResponse>;
+    /**
+     * Check live status and ping telemetry of Governed MCP Gateway
+     */
+    getMCPStatus(): Promise<MCPStatusResponse>;
+    /**
+     * Comprehensive MCP diagnostic: measures latency, pings gateway, and tests tool readiness
+     */
+    checkMCP(tenantId?: string): Promise<{
+        connected: boolean;
+        latencyMs: number;
+        ping: MCPStatusResponse;
+        config: MCPGatewayConfig;
+    }>;
     /**
      * Health and runtime operational telemetry
      */

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,SAAS,EACT,YAAY,EAEZ,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAEhB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACtB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACZ,MAAM,aAAa,CAAC;AAErB,qBAAa,eAAe;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC,SAAgB,MAAM;;;;;;MAMpB;gBAEU,OAAO,GAAE,sBAA2B;YAmBlC,OAAO;IAoCrB;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC;IAIxC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIzC;;OAEG;IACG,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAKxD;;OAEG;IACG,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAK9D;;OAEG;IACG,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,SAAS,GAAG,QAAQ,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAa3F;;OAEG;IACG,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5D;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIzD;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAO1E;;OAEG;IACG,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKhE;;OAEG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,GAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KAClB,GACL,OAAO,CAAC,eAAe,CAAC;IAsB3B;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUtF;;OAEG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC;IAW7B;;OAEG;IACG,gBAAgB,CACpB,YAAY,GAAE,UAAU,GAAG,WAAyB,EACpD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;CASlC"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,sBAAsB,EACtB,eAAe,EACf,UAAU,EACV,SAAS,EACT,YAAY,EAEZ,WAAW,EACX,kBAAkB,EAClB,mBAAmB,EACnB,gBAAgB,EAEhB,eAAe,EACf,mBAAmB,EACnB,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,iBAAiB,EACjB,kBAAkB,EAClB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,EACL,aAAa,EACb,gBAAgB,EAChB,eAAe,EACf,gBAAgB,EAChB,WAAW,EACZ,MAAM,aAAa,CAAC;AAGrB,qBAAa,eAAe;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAe;IAEtC,SAAgB,MAAM;;;;;;MAMpB;gBAEU,OAAO,GAAE,sBAA2B;YAwBlC,OAAO;IAsCrB;;OAEG;IACG,KAAK,CACT,KAAK,EAAE,MAAM,EACb,QAAQ,GAAE,MAAgB,EAC1B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,aAAa,CAAC;IAiCzB;;OAEG;IACG,iBAAiB,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAMtD;;OAEG;IACG,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOrE;;OAEG;IACG,YAAY,IAAI,OAAO,CAAC,iBAAiB,CAAC;IAMhD;;OAEG;IACG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;QACzC,SAAS,EAAE,OAAO,CAAC;QACnB,SAAS,EAAE,MAAM,CAAC;QAClB,IAAI,EAAE,iBAAiB,CAAC;QACxB,MAAM,EAAE,gBAAgB,CAAC;KAC1B,CAAC;IAgBF;;OAEG;IACG,MAAM,IAAI,OAAO,CAAC,eAAe,CAAC;IAIxC;;OAEG;IACG,UAAU,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;IAIzC;;OAEG;IACG,SAAS,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC;IAKxD;;OAEG;IACG,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,EAAE,CAAC;IAK9D;;OAEG;IACG,eAAe,CACnB,YAAY,EAAE,MAAM,EACpB,MAAM,EAAE,SAAS,GAAG,QAAQ,EAC5B,KAAK,CAAC,EAAE,MAAM,GACb,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;IAa3F;;OAEG;IACG,WAAW,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IAK5D;;OAEG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC;IAIzD;;OAEG;IACG,WAAW,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAO1E;;OAEG;IACG,YAAY,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAKhE;;OAEG;IACG,WAAW,CACf,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACzB,OAAO,GAAE;QACP,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;QAClB,YAAY,CAAC,EAAE,MAAM,CAAC;KAClB,GACL,OAAO,CAAC,eAAe,CAAC;IAsB3B;;OAEG;IACG,WAAW,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUtF;;OAEG;IACG,SAAS,CACb,MAAM,EAAE,MAAM,EACd,YAAY,CAAC,EAAE,MAAM,EACrB,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,iBAAiB,CAAC;IAW7B;;OAEG;IACG,gBAAgB,CACpB,YAAY,GAAE,UAAU,GAAG,WAAyB,EACpD,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,qBAAqB,CAAC;CASlC"}

package/dist/config.d.ts

@@ -0,0 +1,7 @@
+import type { StoredConfig } from "./types.js";
+export declare function getConfigDir(): string;
+export declare function getConfigPath(): string;
+export declare function loadStoredConfig(): StoredConfig;
+export declare function saveStoredConfig(config: StoredConfig): void;
+export declare function clearStoredConfig(): boolean;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,wBAAgB,YAAY,IAAI,MAAM,CAErC;AAED,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAED,wBAAgB,gBAAgB,IAAI,YAAY,CAW/C;AAED,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,IAAI,CAc3D;AAED,wBAAgB,iBAAiB,IAAI,OAAO,CAW3C"}

package/dist/index.d.ts

@@ -1,5 +1,6 @@
 export * from "./types.js";
 export * from "./crypto.js";
+export * from "./config.js";
 export * from "./client.js";
 export * from "./mcp.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}

package/dist/index.js

@@ -23,10 +23,15 @@ __export(index_exports, {
   ArmorDeskClient: () => ArmorDeskClient,
   buildMerkleTree: () => buildMerkleTree,
   canonicalJson: () => canonicalJson,
+  clearStoredConfig: () => clearStoredConfig,
   generateClaudeDesktopConfig: () => generateClaudeDesktopConfig,
   generateCursorConfig: () => generateCursorConfig,
   generatePlanHash: () => generatePlanHash,
+  getConfigDir: () => getConfigDir,
+  getConfigPath: () => getConfigPath,
   hashSha256: () => hashSha256,
+  loadStoredConfig: () => loadStoredConfig,
+  saveStoredConfig: () => saveStoredConfig,
   verifyMerkleRoot: () => verifyMerkleRoot,
   verifyProof: () => verifyProof
 });
@@ -101,6 +106,54 @@ function verifyProof(request) {
   };
 }
 
+// src/config.ts
+var import_node_fs = require("fs");
+var import_node_os = require("os");
+var import_node_path = require("path");
+function getConfigDir() {
+  return (0, import_node_path.join)((0, import_node_os.homedir)(), ".armordesk");
+}
+function getConfigPath() {
+  return (0, import_node_path.join)(getConfigDir(), "config.json");
+}
+function loadStoredConfig() {
+  try {
+    const configPath = getConfigPath();
+    if ((0, import_node_fs.existsSync)(configPath)) {
+      const raw = (0, import_node_fs.readFileSync)(configPath, "utf8");
+      return JSON.parse(raw);
+    }
+  } catch {
+  }
+  return {};
+}
+function saveStoredConfig(config) {
+  try {
+    const dir = getConfigDir();
+    if (!(0, import_node_fs.existsSync)(dir)) {
+      (0, import_node_fs.mkdirSync)(dir, { recursive: true, mode: 448 });
+    }
+    const configPath = getConfigPath();
+    (0, import_node_fs.writeFileSync)(configPath, JSON.stringify(config, null, 2), {
+      encoding: "utf8",
+      mode: 384
+    });
+  } catch (err) {
+    console.warn(`[ArmorDesk] Could not write config to ${getConfigPath()}: ${err.message}`);
+  }
+}
+function clearStoredConfig() {
+  try {
+    const configPath = getConfigPath();
+    if ((0, import_node_fs.existsSync)(configPath)) {
+      (0, import_node_fs.unlinkSync)(configPath);
+      return true;
+    }
+  } catch {
+  }
+  return false;
+}
+
 // src/client.ts
 var ArmorDeskClient = class {
   baseUrl;
@@ -108,6 +161,7 @@ var ArmorDeskClient = class {
   tenantId;
   userName;
   userRole;
+  token;
   _fetch;
   crypto = {
     canonicalJson,
@@ -117,11 +171,13 @@ var ArmorDeskClient = class {
     verifyProof
   };
   constructor(options = {}) {
-    this.baseUrl = (options.baseUrl || typeof process !== "undefined" && process.env?.ARMORDESK_URL || "https://armordesk.crusts.dev").replace(/\/$/, "");
-    this.apiKey = options.apiKey || (typeof process !== "undefined" ? process.env?.ARMORIQ_API_KEY || process.env?.ARMORIQ_PRO_API_KEY : void 0);
-    this.tenantId = options.tenantId || "acme-corp";
-    this.userName = options.userName || "Sarah Chen";
-    this.userRole = options.userRole || "manager";
+    const stored = typeof process !== "undefined" ? loadStoredConfig() : {};
+    this.baseUrl = (options.baseUrl || typeof process !== "undefined" && process.env?.ARMORDESK_URL || stored.baseUrl || "https://armordesk.crusts.dev").replace(/\/$/, "");
+    this.apiKey = options.apiKey || (typeof process !== "undefined" ? process.env?.ARMORIQ_API_KEY || process.env?.ARMORIQ_PRO_API_KEY : void 0) || stored.apiKey;
+    this.token = stored.token;
+    this.tenantId = options.tenantId || stored.tenant?.id || "acme-corp";
+    this.userName = options.userName || stored.user?.name || "Sarah Chen";
+    this.userRole = options.userRole || stored.user?.role || "manager";
     this._fetch = options.fetch || globalThis.fetch.bind(globalThis);
   }
   async request(endpoint, options = {}) {
@@ -131,7 +187,9 @@ var ArmorDeskClient = class {
       "X-ArmorIQ-Tenant": this.tenantId,
       ...options.headers
     };
-    if (this.apiKey) {
+    if (this.token) {
+      headers["Authorization"] = `Bearer ${this.token}`;
+    } else if (this.apiKey) {
       headers["Authorization"] = `Bearer ${this.apiKey}`;
       headers["X-ArmorIQ-API-Key"] = this.apiKey;
     }
@@ -151,6 +209,79 @@ var ArmorDeskClient = class {
     }
     return res.json();
   }
+  /**
+   * Authenticate with an ArmorDesk account and persist credentials
+   */
+  async login(email, password = "admin", tenantId) {
+    const res = await this.request("/api/auth/login", {
+      method: "POST",
+      body: JSON.stringify({
+        email,
+        password,
+        tenant_id: tenantId || this.tenantId
+      })
+    });
+    if (res.user && res.token) {
+      this.token = res.token;
+      this.userName = res.user.name;
+      this.userRole = res.user.role;
+      if (res.tenant?.id) {
+        this.tenantId = res.tenant.id;
+      }
+      if (typeof process !== "undefined") {
+        saveStoredConfig({
+          baseUrl: this.baseUrl,
+          token: res.token,
+          user: res.user,
+          tenant: res.tenant,
+          apiKey: this.apiKey,
+          updatedAt: (/* @__PURE__ */ new Date()).toISOString()
+        });
+      }
+    }
+    return res;
+  }
+  /**
+   * Request OAuth 2.0 Device Code for terminal/browser authentication (RFC 8628)
+   */
+  async requestDeviceCode() {
+    return this.request("/api/auth/device/code", {
+      method: "POST"
+    });
+  }
+  /**
+   * Poll OAuth 2.0 Device Code until authorized by user in browser
+   */
+  async pollDeviceCode(deviceCode) {
+    return this.request("/api/auth/device/poll", {
+      method: "POST",
+      body: JSON.stringify({ device_code: deviceCode })
+    });
+  }
+  /**
+   * Check live status and ping telemetry of Governed MCP Gateway
+   */
+  async getMCPStatus() {
+    return this.request("/api/mcp/ping", {
+      method: "POST"
+    });
+  }
+  /**
+   * Comprehensive MCP diagnostic: measures latency, pings gateway, and tests tool readiness
+   */
+  async checkMCP(tenantId) {
+    const start = Date.now();
+    const ping = await this.getMCPStatus();
+    const latencyMs = Date.now() - start;
+    const config = await this.getMCPConfig(tenantId || this.tenantId);
+    const connected = ping.status === "CONNECTED" && config.governed_tools.length > 0;
+    return {
+      connected,
+      latencyMs,
+      ping,
+      config
+    };
+  }
   /**
    * Health and runtime operational telemetry
    */
@@ -322,10 +453,15 @@ function generateCursorConfig(options = {}) {
   ArmorDeskClient,
   buildMerkleTree,
   canonicalJson,
+  clearStoredConfig,
   generateClaudeDesktopConfig,
   generateCursorConfig,
   generatePlanHash,
+  getConfigDir,
+  getConfigPath,
   hashSha256,
+  loadStoredConfig,
+  saveStoredConfig,
   verifyMerkleRoot,
   verifyProof
 });

package/dist/index.mjs

@@ -2,21 +2,31 @@ import {
   ArmorDeskClient,
   buildMerkleTree,
   canonicalJson,
+  clearStoredConfig,
   generateClaudeDesktopConfig,
   generateCursorConfig,
   generatePlanHash,
+  getConfigDir,
+  getConfigPath,
   hashSha256,
+  loadStoredConfig,
+  saveStoredConfig,
   verifyMerkleRoot,
   verifyProof
-} from "./chunk-TVWUJ3XJ.mjs";
+} from "./chunk-IKQRJ7XB.mjs";
 export {
   ArmorDeskClient,
   buildMerkleTree,
   canonicalJson,
+  clearStoredConfig,
   generateClaudeDesktopConfig,
   generateCursorConfig,
   generatePlanHash,
+  getConfigDir,
+  getConfigPath,
   hashSha256,
+  loadStoredConfig,
+  saveStoredConfig,
   verifyMerkleRoot,
   verifyProof
 };

package/dist/types.d.ts

@@ -1,6 +1,86 @@
 /**
  * TypeScript Type Definitions for ArmorDesk SDK
  */
+export interface StoredConfig {
+    baseUrl?: string;
+    token?: string;
+    user?: {
+        id: string;
+        name: string;
+        email: string;
+        role: string;
+        title: string;
+        avatar: string;
+        tenant_id: string;
+        scopeSummary: string;
+    };
+    tenant?: {
+        id: string;
+        name: string;
+        spend_limit: number;
+        balance: number;
+        currency: string;
+    };
+    apiKey?: string;
+    updatedAt?: string;
+}
+export interface LoginResponse {
+    status: string;
+    token: string;
+    user: {
+        id: string;
+        name: string;
+        email: string;
+        role: string;
+        title: string;
+        avatar: string;
+        tenant_id: string;
+        scopeSummary: string;
+    };
+    tenant: {
+        id: string;
+        name: string;
+        spend_limit: number;
+        balance: number;
+        currency: string;
+    };
+}
+export interface DeviceCodeResponse {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    verification_uri_complete: string;
+    expires_in: number;
+    interval: number;
+}
+export interface DevicePollResponse {
+    status: "PENDING" | "APPROVED" | "DENIED" | "EXPIRED" | string;
+    token?: string;
+    user?: {
+        id: string;
+        name: string;
+        email: string;
+        role: string;
+        tenant_id: string;
+    };
+    tenant?: {
+        id: string;
+        name: string;
+        spend_limit: number;
+        balance: number;
+        currency: string;
+    };
+}
+export interface MCPStatusResponse {
+    status: string;
+    gateway: string;
+    version: string;
+    protocol: string;
+    governance: string;
+    latency_ms: number;
+    active_sandboxes: string[];
+    timestamp: string;
+}
 export interface ArmorDeskClientOptions {
     /**
      * Base URL of ArmorDesk Control Plane instance