@indemn/cli 1.0.0

package/src/sdk/agents.ts

@@ -0,0 +1,47 @@
+import type { IndemnClient } from './client.js';
+import type { Agent, CreateAgentInput, UpdateAgentInput } from './types.js';
+
+export class AgentsSDK {
+  constructor(private client: IndemnClient) {}
+
+  async listAgents(): Promise<Agent[]> {
+    return this.client.copilotGet<Agent[]>(
+      '/organization/:org_id/ai-studio/v2/bots',
+    );
+  }
+
+  async getAgent(id: string): Promise<Agent> {
+    const result = await this.client.copilotGet<Agent | Agent[]>(
+      `/organization/:org_id/ai-studio/v2/bots/${id}`,
+    );
+    // v2 endpoint returns array even for single bot
+    return Array.isArray(result) ? result[0] : result;
+  }
+
+  async createAgent(input: CreateAgentInput): Promise<Agent> {
+    return this.client.copilotPost<Agent>(
+      '/organization/:org_id/ai-studio/bots',
+      { name: input.name, channels: input.channels || ['WEB'] },
+    );
+  }
+
+  async updateAgent(id: string, input: UpdateAgentInput): Promise<Agent> {
+    return this.client.copilotPut<Agent>(
+      `/organization/:org_id/ai-studio/bots/${id}`,
+      input,
+    );
+  }
+
+  async deleteAgent(id: string): Promise<void> {
+    await this.client.copilotDelete(
+      `/organization/:org_id/ai-studio/bots/${id}`,
+    );
+  }
+
+  async cloneAgent(id: string): Promise<Agent> {
+    return this.client.copilotPost<Agent>(
+      '/organization/:org_id/ai-studio/v2/bots/clone',
+      { source_id_bot: id },
+    );
+  }
+}

package/src/sdk/auth.ts

@@ -0,0 +1,132 @@
+import { initializeApp, getApp } from 'firebase/app';
+import { getAuth, signInWithEmailAndPassword } from 'firebase/auth';
+import { IndemnClient } from './client.js';
+import type { Environment, EnvironmentHosts } from './types.js';
+
+// Firebase client configs per environment — public configuration (not secrets),
+// bundled the same way the Copilot Dashboard bundles them via envsubst
+const FIREBASE_CONFIGS: Record<Environment, Record<string, string>> = {
+  dev: {
+    apiKey: 'AIzaSyB8bA3w8oaMbyMxYA7lyQy_OvrPcPfW7x8',
+    authDomain: 'agent-449107.firebaseapp.com',
+    projectId: 'gmail-agent-449107',
+    storageBucket: 'gmail-agent-449107.firebasestorage.app',
+    messagingSenderId: '1066107427076',
+    appId: '1:1066107427076:web:f57925047f40a6a76a5851',
+  },
+  production: {
+    apiKey: 'AIzaSyBkj3ny3Gm7DapoeiTi3wt_9eG8hnlqqyc',
+    authDomain: 'prod-gemini-470505.firebaseapp.com',
+    projectId: 'prod-gemini-470505',
+    storageBucket: 'prod-gemini-470505.firebasestorage.app',
+    messagingSenderId: '334963688118',
+    appId: '1:334963688118:web:21670b3a97547d4b231c17',
+  },
+};
+
+export async function login(email: string, password: string, env: Environment = 'dev', opts?: {
+  mfaCodePrompt?: () => Promise<string>;
+}): Promise<{
+  apiKey: string;
+  orgId: string;
+  userId: string;
+  environment: Environment;
+}> {
+  // Step 1: Firebase client SDK auth (environment-specific config, separate app per env)
+  const firebaseConfig = FIREBASE_CONFIGS[env];
+  const appName = `indemn-cli-${env}`;
+  let app;
+  try { app = getApp(appName); } catch { app = initializeApp(firebaseConfig, appName); }
+  const auth = getAuth(app);
+  const userCredential = await signInWithEmailAndPassword(auth, email, password);
+  const idToken = await userCredential.user.getIdToken();
+
+  // Step 2: Exchange Firebase ID token for Copilot Server JWT
+  const client = new IndemnClient({ environment: env });
+  const signinResponse = await client.copilotPostUnauth<{
+    success: boolean;
+    requiresMfa: boolean;
+    mfaSessionId?: string;
+    mfaEmail?: string;
+    token?: string;
+    user?: { _id: string; email: string };
+  }>('/auth/firebase/signin', { idToken });
+
+  let jwt: string;
+  let userId: string;
+
+  if (signinResponse.requiresMfa) {
+    // MFA required — prompt for code and verify
+    if (!opts?.mfaCodePrompt) {
+      throw new Error('MFA is required but no code prompt handler was provided.');
+    }
+    const code = await opts.mfaCodePrompt();
+    const mfaResponse = await client.copilotPostUnauth<{
+      success: boolean;
+      token: string;
+      user: { _id: string; email: string };
+    }>('/auth/firebase/mfa/verify', {
+      sessionId: signinResponse.mfaSessionId,
+      code,
+    });
+    jwt = mfaResponse.token.replace(/^JWT\s+/i, '');
+    userId = mfaResponse.user._id;
+  } else {
+    // No MFA — direct JWT
+    jwt = signinResponse.token!.replace(/^JWT\s+/i, '');
+    userId = signinResponse.user!._id;
+  }
+
+  // Step 3: Generate persistent API key using the JWT
+  const apiKeyResponse = await client.copilotPostUnauth<{
+    _id: string;
+    key: string;
+    name: string;
+    org_id: string;
+  }>('/auth/api-keys', { name: `indemn-cli-${Date.now()}` }, {
+    'Authorization': `jwt ${jwt}`,
+  });
+
+  if (!apiKeyResponse.org_id) {
+    throw new Error('Login succeeded but no organization found. Contact your admin to be added to an organization.');
+  }
+
+  const config = {
+    api_key: apiKeyResponse.key,
+    org_id: apiKeyResponse.org_id,
+    user_id: userId,
+    environment: env,
+  };
+
+  // Step 4: Save to config file
+  IndemnClient.saveConfig(config);
+
+  return {
+    apiKey: config.api_key,
+    orgId: config.org_id,
+    userId: config.user_id,
+    environment: env,
+  };
+}
+
+export function logout(): void {
+  IndemnClient.clearConfig();
+}
+
+export function whoami(): {
+  apiKey: string;
+  orgId: string;
+  userId: string;
+  environment: Environment;
+  hosts: EnvironmentHosts;
+} | null {
+  const config = IndemnClient.loadConfig();
+  if (!config || !config.api_key) return null;
+  return {
+    apiKey: config.api_key.substring(0, 12) + '...',
+    orgId: config.org_id,
+    userId: config.user_id,
+    environment: config.environment,
+    hosts: config.hosts[config.environment],
+  };
+}

package/src/sdk/chat.ts

@@ -0,0 +1,133 @@
+import { io, Socket } from 'socket.io-client';
+import { EventEmitter } from 'events';
+import type { ChatMessage, SessionRequest, UserMessage } from './types.js';
+
+export class ChatSession extends EventEmitter {
+  private socket: Socket | null = null;
+  private sessionId: string | null = null;
+  private userId: string;
+  private botType: string;
+  private middlewareUrl: string;
+  private connected = false;
+  private streamBuffers: Map<string, string> = new Map();
+
+  constructor(botType: string, middlewareUrl: string, sessionId?: string) {
+    super();
+    this.botType = botType;
+    this.middlewareUrl = middlewareUrl;
+    this.userId = `cli-user-${Date.now()}`;
+    this.sessionId = sessionId || null;
+  }
+
+  async connect(): Promise<string> {
+    return new Promise<string>((resolve, reject) => {
+      const timeout = setTimeout(() => {
+        reject(new Error('Connection timed out after 10s'));
+        this.disconnect();
+      }, 10000);
+
+      this.socket = io(this.middlewareUrl, {
+        transports: ['websocket'],
+        reconnection: true,
+        reconnectionAttempts: 3,
+      });
+
+      // Handle stream_bot_uttered events before session_confirm (greeting streams first)
+      this.socket.on('stream_bot_uttered', (data: ChatMessage) => {
+        this.handleStreamMessage(data);
+      });
+
+      this.socket.on('connect', () => {
+        const request: SessionRequest = {
+          session_id: this.sessionId,
+          bot_type: this.botType,
+          user_id: this.userId,
+          customData: {},
+        };
+        this.socket!.emit('session_request', request);
+      });
+
+      this.socket.on('session_confirm', (data: { session_id: string }) => {
+        clearTimeout(timeout);
+        this.sessionId = data.session_id;
+        this.connected = true;
+        this.emit('connected', this.sessionId);
+        resolve(this.sessionId);
+      });
+
+      this.socket.on('bot_uttered', (data: ChatMessage) => {
+        if (data.text) {
+          this.emit('message', data.text);
+        }
+      });
+
+      this.socket.on('connect_error', (err: Error) => {
+        clearTimeout(timeout);
+        reject(new Error(`Connection failed: ${err.message}`));
+      });
+
+      this.socket.on('disconnect', (reason: string) => {
+        this.connected = false;
+        this.emit('disconnected', reason);
+      });
+    });
+  }
+
+  private handleStreamMessage(data: ChatMessage): void {
+    if (!data.streamId) return;
+
+    const streamId = data.streamId;
+
+    if (data.isFirstChunk) {
+      this.streamBuffers.set(streamId, '');
+    }
+
+    if (data.text) {
+      const current = this.streamBuffers.get(streamId) || '';
+      this.streamBuffers.set(streamId, current + data.text);
+    }
+
+    this.emit('stream', data);
+
+    if (data.streamFinished) {
+      const fullText = this.streamBuffers.get(streamId) || '';
+      this.streamBuffers.delete(streamId);
+      if (fullText) {
+        this.emit('message', fullText);
+      }
+    }
+  }
+
+  send(message: string): void {
+    if (!this.socket || !this.connected || !this.sessionId) {
+      throw new Error('Not connected. Call connect() first.');
+    }
+
+    const payload: UserMessage = {
+      message,
+      messageType: 'text',
+      bot_type: this.botType,
+      user_id: this.userId,
+      session_id: this.sessionId,
+      is_user_message_sent: true,
+    };
+
+    this.socket.emit('user_uttered', payload);
+  }
+
+  disconnect(): void {
+    if (this.socket) {
+      if (this.sessionId) {
+        this.socket.emit('session_closed', { session_id: this.sessionId });
+      }
+      this.socket.disconnect();
+      this.socket = null;
+    }
+    this.connected = false;
+    this.sessionId = null;
+  }
+
+  getSessionId(): string | null {
+    return this.sessionId;
+  }
+}

package/src/sdk/client.ts

@@ -0,0 +1,238 @@
+import Conf from 'conf';
+import type { ApiResponse, Environment, EnvironmentHosts, IndemnConfig } from './types.js';
+
+const DEFAULT_HOSTS: Record<Environment, EnvironmentHosts> = {
+  dev: {
+    copilot: 'https://devcopilot.indemn.ai/api',
+    evaluations: 'https://devevaluations.indemn.ai',
+    middleware: 'https://devproxy.indemn.ai',
+  },
+  production: {
+    copilot: 'https://copilot.indemn.ai/api',
+    evaluations: 'https://evaluations.indemn.ai',
+    middleware: 'https://proxy.indemn.ai',
+  },
+};
+
+export class IndemnClient {
+  private apiKey: string;
+  private orgId: string;
+  private environment: Environment;
+  private hosts: EnvironmentHosts;
+
+  constructor(opts?: { apiKey?: string; orgId?: string; environment?: Environment }) {
+    // Priority: explicit opts > env vars > config file
+    const config = IndemnClient.loadConfig();
+
+    this.apiKey = opts?.apiKey || process.env.INDEMN_API_KEY || config?.api_key || '';
+    this.orgId = opts?.orgId || process.env.INDEMN_ORG_ID || config?.org_id || '';
+    this.environment = opts?.environment || (process.env.INDEMN_ENV as Environment) || config?.environment || 'dev';
+    const defaultHosts = DEFAULT_HOSTS[this.environment];
+    const configHosts = config?.hosts?.[this.environment];
+    this.hosts = {
+      copilot: process.env.INDEMN_COPILOT_URL || configHosts?.copilot || defaultHosts.copilot,
+      evaluations: process.env.INDEMN_EVALS_URL || configHosts?.evaluations || defaultHosts.evaluations,
+      middleware: process.env.INDEMN_MIDDLEWARE_URL || configHosts?.middleware || defaultHosts.middleware,
+    };
+  }
+
+  static getConfigStore(): Conf<IndemnConfig> {
+    return new Conf<IndemnConfig>({
+      projectName: 'indemn',
+      configName: 'config',
+      cwd: `${process.env.HOME}/.indemn`,
+    });
+  }
+
+  static loadConfig(): IndemnConfig | null {
+    try {
+      const store = IndemnClient.getConfigStore();
+      const apiKey = store.get('api_key');
+      if (!apiKey) return null;
+      return {
+        api_key: apiKey,
+        org_id: store.get('org_id', ''),
+        user_id: store.get('user_id', ''),
+        environment: store.get('environment', 'dev'),
+        hosts: store.get('hosts', DEFAULT_HOSTS),
+      };
+    } catch {
+      return null;
+    }
+  }
+
+  static saveConfig(config: Partial<IndemnConfig>): void {
+    const store = IndemnClient.getConfigStore();
+    for (const [key, value] of Object.entries(config)) {
+      store.set(key as keyof IndemnConfig, value);
+    }
+  }
+
+  static clearConfig(): void {
+    const store = IndemnClient.getConfigStore();
+    store.clear();
+  }
+
+  getEnvironment(): Environment { return this.environment; }
+  getOrgId(): string { return this.orgId; }
+  getApiKey(): string { return this.apiKey; }
+  getHosts(): EnvironmentHosts { return this.hosts; }
+
+  private ensureAuth(): void {
+    if (!this.apiKey) {
+      throw new Error('Not authenticated. Run `indemn login` first.');
+    }
+  }
+
+  private buildCopilotUrl(path: string): string {
+    // Inject org_id into path templates
+    const resolvedPath = path.replace(':org_id', this.orgId);
+    return `${this.hosts.copilot}${resolvedPath}`;
+  }
+
+  private buildEvalsUrl(path: string): string {
+    return `${this.hosts.evaluations}${path}`;
+  }
+
+  // Copilot Server requests (with /api/ prefix and org_id injection)
+  async copilotGet<T = unknown>(path: string, query?: Record<string, string>): Promise<T> {
+    this.ensureAuth();
+    const url = new URL(this.buildCopilotUrl(path));
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== undefined && v !== null) url.searchParams.set(k, v);
+      }
+    }
+    const res = await fetch(url.toString(), {
+      headers: {
+        'Authorization': `Bearer ${this.apiKey}`,
+        'Content-Type': 'application/json',
+      },
+    });
+    return this.handleCopilotResponse<T>(res);
+  }
+
+  async copilotPost<T = unknown>(path: string, body?: unknown): Promise<T> {
+    this.ensureAuth();
+    const res = await fetch(this.buildCopilotUrl(path), {
+      method: 'POST',
+      headers: {
+        'Authorization': `Bearer ${this.apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    return this.handleCopilotResponse<T>(res);
+  }
+
+  async copilotPut<T = unknown>(path: string, body?: unknown): Promise<T> {
+    this.ensureAuth();
+    const res = await fetch(this.buildCopilotUrl(path), {
+      method: 'PUT',
+      headers: {
+        'Authorization': `Bearer ${this.apiKey}`,
+        'Content-Type': 'application/json',
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    return this.handleCopilotResponse<T>(res);
+  }
+
+  async copilotDelete<T = unknown>(path: string): Promise<T> {
+    this.ensureAuth();
+    const res = await fetch(this.buildCopilotUrl(path), {
+      method: 'DELETE',
+      headers: {
+        'Authorization': `Bearer ${this.apiKey}`,
+        'Content-Type': 'application/json',
+      },
+    });
+    return this.handleCopilotResponse<T>(res);
+  }
+
+  // Evaluations Service requests (no /api/ prefix, no org_id, no auth in Phase 1)
+  async evalsGet<T = unknown>(path: string, query?: Record<string, string>): Promise<T> {
+    const url = new URL(this.buildEvalsUrl(path));
+    if (query) {
+      for (const [k, v] of Object.entries(query)) {
+        if (v !== undefined && v !== null) url.searchParams.set(k, v);
+      }
+    }
+    const res = await fetch(url.toString(), {
+      headers: { 'Content-Type': 'application/json' },
+    });
+    return this.handleEvalsResponse<T>(res);
+  }
+
+  async evalsPost<T = unknown>(path: string, body?: unknown): Promise<T> {
+    const res = await fetch(this.buildEvalsUrl(path), {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json' },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    return this.handleEvalsResponse<T>(res);
+  }
+
+  async evalsPut<T = unknown>(path: string, body?: unknown): Promise<T> {
+    const res = await fetch(this.buildEvalsUrl(path), {
+      method: 'PUT',
+      headers: { 'Content-Type': 'application/json' },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    return this.handleEvalsResponse<T>(res);
+  }
+
+  async evalsDelete<T = unknown>(path: string): Promise<T> {
+    const res = await fetch(this.buildEvalsUrl(path), {
+      method: 'DELETE',
+      headers: { 'Content-Type': 'application/json' },
+    });
+    return this.handleEvalsResponse<T>(res);
+  }
+
+  // Unauthenticated Copilot Server requests (for login flow)
+  async copilotPostUnauth<T = unknown>(path: string, body?: unknown, headers?: Record<string, string>): Promise<T> {
+    const res = await fetch(`${this.hosts.copilot}${path}`, {
+      method: 'POST',
+      headers: {
+        'Content-Type': 'application/json',
+        ...headers,
+      },
+      body: body ? JSON.stringify(body) : undefined,
+    });
+    return this.handleCopilotResponse<T>(res);
+  }
+
+  private async handleCopilotResponse<T>(res: Response): Promise<T> {
+    if (res.status === 401) {
+      throw new Error('Authentication failed. Run `indemn login` to re-authenticate.');
+    }
+    if (res.status === 403) {
+      throw new Error('Access denied. You may not have permission for this operation.');
+    }
+    if (res.status === 404) {
+      throw new Error('Resource not found.');
+    }
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(`API error (${res.status}): ${text}`);
+    }
+    const json = await res.json() as ApiResponse<T>;
+    // Copilot Server wraps responses in { success, data }
+    if (json.success !== undefined) {
+      if (!json.success) {
+        throw new Error(json.msg || 'API request failed');
+      }
+      return (json.data !== undefined ? json.data : json) as T;
+    }
+    return json as T;
+  }
+
+  private async handleEvalsResponse<T>(res: Response): Promise<T> {
+    if (!res.ok) {
+      const text = await res.text();
+      throw new Error(`Evaluations API error (${res.status}): ${text}`);
+    }
+    return res.json() as Promise<T>;
+  }
+}

package/src/sdk/config.ts

@@ -0,0 +1,28 @@
+import type { IndemnClient } from './client.js';
+import type { BotConfiguration, SetConfigInput } from './types.js';
+
+export class ConfigSDK {
+  constructor(private client: IndemnClient) {}
+
+  async getConfig(agentId: string): Promise<BotConfiguration> {
+    return this.client.copilotGet<BotConfiguration>(
+      `/organization/:org_id/ai-studio/bots/${agentId}/configurations`,
+    );
+  }
+
+  async setConfig(agentId: string, data: SetConfigInput): Promise<BotConfiguration> {
+    return this.client.copilotPut<BotConfiguration>(
+      `/organization/:org_id/ai-studio/bots/${agentId}/configurations`,
+      data,
+    );
+  }
+
+  async getPrompt(agentId: string): Promise<string | undefined> {
+    const config = await this.getConfig(agentId);
+    return config.ai_config?.system_prompt;
+  }
+
+  async setPrompt(agentId: string, prompt: string): Promise<BotConfiguration> {
+    return this.setConfig(agentId, { system_prompt: prompt });
+  }
+}

package/src/sdk/eval.ts

@@ -0,0 +1,57 @@
+import type { IndemnClient } from './client.js';
+import type {
+  EvaluationTriggerInput,
+  EvaluationTriggerResponse,
+  EvaluationRun,
+  EvaluationResult,
+  BotContext,
+} from './types.js';
+
+export class EvalSDK {
+  constructor(private client: IndemnClient) {}
+
+  async triggerEvaluation(input: EvaluationTriggerInput): Promise<EvaluationTriggerResponse> {
+    return this.client.evalsPost<EvaluationTriggerResponse>('/api/v1/evaluations', input);
+  }
+
+  async listRuns(agentId?: string): Promise<EvaluationRun[]> {
+    const query = agentId ? { agent_id: agentId } : undefined;
+    return this.client.evalsGet<EvaluationRun[]>('/api/v1/runs', query);
+  }
+
+  async getRunStatus(runId: string): Promise<EvaluationRun> {
+    return this.client.evalsGet<EvaluationRun>(`/api/v1/runs/${runId}`);
+  }
+
+  async getRunResults(runId: string): Promise<EvaluationResult[]> {
+    return this.client.evalsGet<EvaluationResult[]>(`/api/v1/runs/${runId}/results`);
+  }
+
+  async getBotContext(botId: string): Promise<BotContext> {
+    return this.client.evalsGet<BotContext>(`/api/v1/bots/${botId}/context`);
+  }
+
+  async pollRunUntilComplete(
+    runId: string,
+    intervalMs = 5000,
+    timeoutMs = 300000,
+  ): Promise<EvaluationRun> {
+    const startTime = Date.now();
+
+    while (true) {
+      const run = await this.getRunStatus(runId);
+
+      if (run.status === 'completed' || run.status === 'failed') {
+        return run;
+      }
+
+      if (Date.now() - startTime >= timeoutMs) {
+        throw new Error(
+          `Evaluation run ${runId} did not complete within ${timeoutMs / 1000}s (last status: ${run.status})`,
+        );
+      }
+
+      await new Promise((resolve) => setTimeout(resolve, intervalMs));
+    }
+  }
+}