@indemn/cli 1.7.7 → 1.7.9

package/src/sdk/access.ts

@@ -0,0 +1,143 @@
+import { IndemnClient } from './client.js';
+
+/**
+ * What the signed-in person may do, as copilot-server reports it
+ * (GET /auth/me/access). Display information only: copilot-server and
+ * darwin-service still decide every request. The CLI uses it to hide MCP
+ * tools the person can't use anywhere and to explain refusals by role.
+ * Unknown access (older server, offline) hides nothing.
+ */
+export interface AccessProject {
+  project_id: string;
+  name: string | null;
+  role: string;
+  capabilities: string[];
+}
+
+export interface AccessOrg {
+  org_id: string;
+  org_name: string;
+  role: string | null;
+  is_org_admin: boolean;
+  capabilities: string[];
+  projects: AccessProject[];
+}
+
+export interface Access {
+  user: { id: string; email: string; name: string | null };
+  is_indemn_staff: boolean;
+  capabilities: string[];
+  orgs: AccessOrg[];
+  fetched_at?: string;
+}
+
+type Scope = 'user' | 'org' | 'project';
+
+/** MCP tools whose use depends on a role, staff email or org setting (copilot config/cliCapabilities.js). */
+export const TOOL_REQUIRES: Readonly<Record<string, { scope: Scope; capability: string }>> = Object.freeze({
+  create_sandbox_org: { scope: 'user', capability: 'org:sandbox_create' },
+  set_org_admin_settings: { scope: 'user', capability: 'org:admin_settings' },
+  get_conversation: { scope: 'project', capability: 'conversations:read' },
+  chat_with_agent: { scope: 'project', capability: 'conversations:read' },
+  mark_conversation_test: { scope: 'project', capability: 'conversations:mark_test' },
+  list_tickets: { scope: 'org', capability: 'tickets' },
+  get_ticket: { scope: 'org', capability: 'tickets' },
+  create_ticket: { scope: 'org', capability: 'tickets' },
+  update_ticket: { scope: 'org', capability: 'tickets' },
+  archive_ticket: { scope: 'org', capability: 'tickets' },
+  list_ticket_rules: { scope: 'org', capability: 'tickets' },
+  save_ticket_rule: { scope: 'org', capability: 'tickets' },
+  delete_ticket_rule: { scope: 'org', capability: 'tickets' },
+});
+
+let memo: Access | null = null;
+
+/** The last known access: this process's, else the one saved with the login (config credential only). */
+export function currentAccess(client?: IndemnClient): Access | null {
+  if (memo) return memo;
+  // A host session (INDEMN_TOKEN) may be a different identity than the saved login; don't use its access.
+  const source = (client ?? new IndemnClient()).getCredential()?.source;
+  return source === 'config' ? IndemnClient.loadConfig()?.access ?? null : null;
+}
+
+/** Defend against a malformed payload: every array field defaults to empty, bad orgs are dropped. */
+function normalize(raw: Access): Pick<Access, 'capabilities' | 'orgs'> {
+  const strings = (v: unknown): string[] => (Array.isArray(v) ? v.filter((x): x is string => typeof x === 'string') : []);
+  const orgs = (Array.isArray(raw.orgs) ? raw.orgs : [])
+    .filter((o): o is AccessOrg => Boolean(o) && typeof o.org_id === 'string')
+    .map((o) => ({
+      ...o,
+      capabilities: strings(o.capabilities),
+      projects: (Array.isArray(o.projects) ? o.projects : [])
+        .filter((pr): pr is AccessProject => Boolean(pr) && typeof pr.project_id === 'string')
+        .map((pr) => ({ ...pr, capabilities: strings(pr.capabilities) })),
+    }));
+  return { capabilities: strings(raw.capabilities), orgs };
+}
+
+/** Forget the in-process copy (tests, logout). */
+export function resetAccess(): void {
+  memo = null;
+}
+
+/**
+ * Ask copilot again. Saved with the login only when the credential is the saved
+ * login; a host's session (INDEMN_TOKEN) never writes to this machine's config.
+ * Returns null when it can't be read (older server, offline): callers then hide nothing.
+ */
+export async function refreshAccess(client: IndemnClient): Promise<Access | null> {
+  try {
+    const raw = await client.copilotGet<Access>('/auth/me/access');
+    if (!raw || !Array.isArray(raw.orgs)) return null;
+    const stamped: Access = { ...raw, ...normalize(raw), fetched_at: new Date().toISOString() };
+    memo = stamped;
+    if (client.getCredential()?.source === 'config') IndemnClient.saveConfig({ access: stamped });
+    return stamped;
+  } catch {
+    return null;
+  }
+}
+
+function orgsInView(access: Access, onlyOrgId?: string): AccessOrg[] {
+  return onlyOrgId ? access.orgs.filter((o) => o.org_id === onlyOrgId) : access.orgs;
+}
+
+/** True unless access is known and says the tool can't be used in any org/project in view. */
+export function usableSomewhere(tool: string, access: Access | null, onlyOrgId?: string): boolean {
+  const rule = TOOL_REQUIRES[tool];
+  if (!rule || !access) return true;
+  if (rule.scope === 'user') return access.capabilities.includes(rule.capability);
+  const orgs = orgsInView(access, onlyOrgId);
+  if (rule.scope === 'org') return orgs.some((o) => o.capabilities.includes(rule.capability));
+  return orgs.some((o) => o.projects.some((p) => p.capabilities.includes(rule.capability)));
+}
+
+/** The person's role in an org, for messages ("agent in Acme"). */
+export function roleIn(access: Access | null, orgId: string | undefined): string | null {
+  if (!access || !orgId) return null;
+  const org = access.orgs.find((o) => o.org_id === orgId);
+  if (!org) return null;
+  return `${org.role ?? 'member'} in ${org.org_name}`;
+}
+
+/**
+ * For org-scoped requirements: why this org can't be used, or null. Project-scoped
+ * requirements are decided by the server (the project comes from the agent).
+ */
+export function orgDenial(tool: string, access: Access | null, orgId: string | undefined): string | null {
+  const rule = TOOL_REQUIRES[tool];
+  if (!rule || !access || rule.scope === 'project') return null;
+  if (rule.scope === 'user') {
+    if (access.capabilities.includes(rule.capability)) return null;
+    return rule.capability === 'org:sandbox_create'
+      ? 'Only the Indemn support account can create sandbox organizations.'
+      : 'This is for Indemn staff only.';
+  }
+  if (!orgId) return null;
+  const org = access.orgs.find((o) => o.org_id === orgId);
+  if (!org) return null; // not in the list: let the server answer
+  if (org.capabilities.includes(rule.capability)) return null;
+  return rule.capability === 'tickets'
+    ? `Tickets are not turned on for ${org.org_name}.`
+    : `Your role (${org.role ?? 'member'} in ${org.org_name}) does not allow this.`;
+}

package/src/sdk/auth.ts

@@ -3,6 +3,8 @@ import { getAuth, signInWithEmailAndPassword } from '@firebase/auth';
 import { DEFAULT_HOSTS, IndemnClient } from './client.js';
 import { exchangeIdToken, toStoredSession } from './session.js';
 import type { Credential } from './credentials.js';
+import { browserSignIn, type BrowserLoginOptions } from './browser-login.js';
+import { refreshAccess, resetAccess } from './access.js';
 import type { Environment, EnvironmentHosts, OrgSummary } from './types.js';
 
 // Firebase client configs per environment — public configuration (not secrets),
@@ -62,7 +64,21 @@ export async function login(email: string, password: string, env: Environment =
     idToken,
     opts?.mfaCodePrompt,
   );
+  return saveLogin(env, { ...session, email: session.email ?? email });
+}
+
+/**
+ * Log in through the browser: the dashboard's sign-in (with the emailed code when
+ * the account uses it) approves this computer, and the CLI gets its own 24-hour
+ * session. Same storage and same rules as the password login.
+ */
+export async function loginWithBrowser(env: Environment = 'dev', opts?: BrowserLoginOptions): Promise<LoginResult> {
+  const session = await browserSignIn(env, opts);
+  return saveLogin(env, session);
+}
 
+/** Keep a fresh copilot session with the person's orgs, replacing any earlier login. */
+async function saveLogin(env: Environment, session: { token: string; userId: string; email?: string }): Promise<LoginResult> {
   // Which orgs this person belongs to, asked with the new session itself.
   const authed = new IndemnClient({ environment: env, token: session.token });
   const res = await authed.copilotGet<{ userOrganizations?: Array<{ _id: string; name: string }> }>('/organization');
@@ -73,13 +89,17 @@ export async function login(email: string, password: string, env: Environment =
   IndemnClient.saveConfig({
     environment: env,
     user_id: session.userId,
-    email: session.email ?? email,
+    email: session.email,
     session: stored,
     orgs,
     hosts: DEFAULT_HOSTS,
   });
 
-  return { userId: session.userId, email: session.email ?? email, environment: env, orgs, expiresAt: stored.expires_at };
+  // What the person may do, kept with the login (best effort: an older server has no such endpoint).
+  resetAccess();
+  await refreshAccess(new IndemnClient({ environment: env }));
+
+  return { userId: session.userId, email: session.email ?? '', environment: env, orgs, expiresAt: stored.expires_at };
 }
 
 /** Revoke the session on the server, then forget it locally. */
@@ -96,6 +116,7 @@ export async function logout(): Promise<{ revoked: boolean }> {
     }
   }
   IndemnClient.clearConfig();
+  resetAccess();
   return { revoked };
 }
 

package/src/sdk/browser-login.ts

@@ -0,0 +1,193 @@
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+import { createServer, type Server } from 'node:http';
+import { spawn } from 'node:child_process';
+import type { AddressInfo } from 'node:net';
+import { IndemnClient } from './client.js';
+import { CliError, indemnHost } from '../core/runtime.js';
+import type { Environment } from './types.js';
+
+/**
+ * `indemn login` through the browser (OAuth-style loopback + PKCE):
+ * 1. listen on 127.0.0.1 (random port) and open the dashboard's /cli-login page
+ *    with a random `state` and the SHA-256 challenge of a secret verifier;
+ * 2. the person signs in there (with the emailed code if their account uses it)
+ *    and approves; the browser comes back to 127.0.0.1 with a one-time code;
+ * 3. the CLI trades code + verifier for its own 24-hour session.
+ * No token ever travels in a URL, and the verifier never leaves this process.
+ */
+
+export const LOGIN_TIMEOUT_MS = 5 * 60_000;
+
+export interface Pkce {
+  verifier: string;
+  challenge: string;
+  state: string;
+}
+
+export function createPkce(): Pkce {
+  const verifier = randomBytes(32).toString('base64url');
+  const challenge = createHash('sha256').update(verifier).digest('base64url');
+  const state = randomBytes(32).toString('base64url');
+  return { verifier, challenge, state };
+}
+
+function sameSecret(a: string, b: string): boolean {
+  const x = Buffer.from(a);
+  const y = Buffer.from(b);
+  return x.length === y.length && timingSafeEqual(x, y);
+}
+
+/** The dashboard that serves /cli-login: INDEMN_DASHBOARD_URL, else the copilot host without `/api`. */
+export function dashboardUrl(copilotHost: string): string {
+  const explicit = process.env.INDEMN_DASHBOARD_URL;
+  if (explicit) return indemnHost(explicit, 'INDEMN_DASHBOARD_URL').replace(/\/+$/, '');
+  return copilotHost.replace(/\/+$/, '').replace(/\/api$/, '');
+}
+
+export function approveUrl(dashboard: string, port: number, pkce: Pkce): string {
+  const query = new URLSearchParams({ port: String(port), state: pkce.state, challenge: pkce.challenge });
+  return `${dashboard}/#/cli-login?${query.toString()}`;
+}
+
+export type CallbackResult = { code: string } | { error: string };
+
+export interface Loopback {
+  port: number;
+  /** First callback whose `state` matches; others are refused and ignored. */
+  result: Promise<CallbackResult>;
+  close: () => void;
+}
+
+const PAGE = (title: string, body: string) =>
+  `<!doctype html><html><head><meta charset="utf-8"><title>${title}</title></head>` +
+  `<body style="font-family:system-ui,sans-serif;max-width:32rem;margin:4rem auto;padding:0 1rem">` +
+  `<h1 style="font-size:1.1rem">${title}</h1><p>${body}</p></body></html>`;
+
+/** Listen on 127.0.0.1 only, for one `GET /callback` carrying our `state`. */
+export async function startLoopback(state: string, timeoutMs: number = LOGIN_TIMEOUT_MS): Promise<Loopback> {
+  let settle!: (r: CallbackResult) => void;
+  let fail!: (e: Error) => void;
+  const result = new Promise<CallbackResult>((resolve, reject) => {
+    settle = resolve;
+    fail = reject;
+  });
+
+  let done = false;
+  const server: Server = createServer((req, res) => {
+    res.setHeader('Cache-Control', 'no-store');
+    res.setHeader('Content-Type', 'text/html; charset=utf-8');
+    // The page has no subresources and echoes nothing; these just harden it.
+    res.setHeader('Referrer-Policy', 'no-referrer');
+    res.setHeader('X-Content-Type-Options', 'nosniff');
+    res.setHeader('Content-Security-Policy', "default-src 'none'; style-src 'unsafe-inline'");
+    // A raw socket can send a target that URL() rejects; never let that crash login.
+    let url: URL;
+    try {
+      url = new URL(req.url ?? '/', 'http://127.0.0.1');
+    } catch {
+      res.writeHead(400).end(PAGE('Bad request', 'Nothing to see here.'));
+      return;
+    }
+    // DNS-rebinding defence: only our own loopback Host is served.
+    const host = (req.headers.host ?? '').toLowerCase();
+    if (host && !/^(127\.0\.0\.1|localhost)(:\d+)?$/.test(host)) {
+      res.writeHead(400).end(PAGE('Bad request', 'Nothing to see here.'));
+      return;
+    }
+    if (req.method !== 'GET' || url.pathname !== '/callback' || done) {
+      res.writeHead(404).end(PAGE('Not found', 'Nothing to see here.'));
+      return;
+    }
+    const got = url.searchParams.get('state') ?? '';
+    if (!sameSecret(got, state)) {
+      res.writeHead(400).end(PAGE('Sign-in link mismatch', 'This sign-in did not come from your terminal. Run <code>indemn login</code> again.'));
+      return;
+    }
+    const code = url.searchParams.get('code');
+    const error = url.searchParams.get('error');
+    done = true;
+    if (code) {
+      res.writeHead(200).end(PAGE('Signed in to the Indemn CLI', 'You can close this tab and return to your terminal.'));
+      settle({ code });
+    } else {
+      res.writeHead(200).end(PAGE('Sign-in cancelled', 'The CLI was not signed in. You can close this tab.'));
+      settle({ error: error || 'access_denied' });
+    }
+  });
+
+  await new Promise<void>((resolve, reject) => {
+    server.once('error', reject);
+    server.listen(0, '127.0.0.1', () => resolve());
+  });
+  const { port } = server.address() as AddressInfo;
+
+  const timer = setTimeout(() => {
+    if (!done) {
+      done = true;
+      fail(new CliError('Timed out waiting for the browser (5 minutes). Run `indemn login` again.'));
+    }
+  }, timeoutMs);
+  timer.unref();
+
+  const close = () => {
+    clearTimeout(timer);
+    server.closeAllConnections?.();
+    server.close();
+  };
+  result.then(close, close);
+  return { port, result, close };
+}
+
+/** Open a URL in the default browser without a shell. Resolves false if nothing could be started. */
+export function openBrowser(url: string): Promise<boolean> {
+  const [cmd, args] =
+    process.platform === 'darwin' ? ['open', [url]]
+      : process.platform === 'win32' ? ['rundll32', ['url.dll,FileProtocolHandler', url]]
+        : ['xdg-open', [url]];
+  return new Promise((resolve) => {
+    try {
+      const child = spawn(cmd, args as string[], { stdio: 'ignore', detached: true });
+      child.once('error', () => resolve(false));
+      child.once('spawn', () => {
+        child.unref();
+        resolve(true);
+      });
+    } catch {
+      resolve(false);
+    }
+  });
+}
+
+export interface BrowserLoginOptions {
+  /** Opens the approve page; defaults to the system browser. */
+  open?: (url: string) => Promise<boolean>;
+  /** Told the URL (always), so it can be opened by hand. */
+  showUrl?: (url: string, opened: boolean) => void;
+  timeoutMs?: number;
+}
+
+/** Run the browser flow; returns the copilot session (without the "JWT " prefix). */
+export async function browserSignIn(env: Environment, opts: BrowserLoginOptions = {}): Promise<{ token: string; userId: string; email?: string }> {
+  const client = new IndemnClient({ environment: env });
+  const pkce = createPkce();
+  const loop = await startLoopback(pkce.state, opts.timeoutMs);
+  try {
+    const url = approveUrl(dashboardUrl(client.getHosts().copilot), loop.port, pkce);
+    const opened = await (opts.open ?? openBrowser)(url);
+    opts.showUrl?.(url, opened);
+
+    const outcome = await loop.result;
+    if ('error' in outcome) throw new CliError('Sign-in was cancelled in the browser.');
+
+    let res: { token: string; user: { _id: string; email?: string } };
+    try {
+      res = await client.copilotPostUnauth('/auth/cli/token', { code: outcome.code, code_verifier: pkce.verifier });
+    } catch {
+      throw new CliError('The sign-in code was not accepted (it may have expired). Run `indemn login` again.');
+    }
+    if (!res?.token || !res.user?._id) throw new CliError('Sign-in returned no session. Run `indemn login` again.');
+    return { token: res.token.replace(/^JWT\s+/i, ''), userId: String(res.user._id), email: res.user.email };
+  } finally {
+    loop.close();
+  }
+}

package/src/sdk/campaigns.ts

@@ -1,7 +1,7 @@
 import type { IndemnClient } from './client.js';
 import { CliError, EXIT } from '../core/runtime.js';
 
-/** Paths of the campaigns service the CLI may read. Everything else, and every write, is refused. */
+/** Paths of the campaigns service the CLI may read. Everything else is refused. */
 const READABLE = [
   /^\/campaigns$/,
   /^\/campaigns\/[\w-]+$/,
@@ -11,12 +11,44 @@ const READABLE = [
   /^\/templates\/[\w-]+\/versions$/,
   /^\/template-skills$/,
   /^\/template-skills\/[\w-]+$/,
+  /^\/books$/,
+  /^\/books\/[\w-]+$/,
 ];
 
+type WriteMethod = 'POST' | 'PUT' | 'PATCH';
+/** What the CLI may change: campaigns and their drafts (touchpoints live there), publish and status, templates
+ *  (each change a new version), template skills and books. Never sending or resolving anything, book runs,
+ *  uploads, test ticks or enrollments, and no deletes: those act on real customers or cannot be undone. */
+const WRITABLE: Array<[WriteMethod, RegExp]> = [
+  ['POST', /^\/campaigns$/],
+  ['PUT', /^\/campaigns\/[\w-]+\/draft$/],
+  ['POST', /^\/campaigns\/[\w-]+\/(publish|status)$/],
+  ['POST', /^\/templates$/],
+  ['POST', /^\/templates\/[\w-]+\/versions$/],
+  ['POST', /^\/template-skills$/],
+  ['PUT', /^\/template-skills\/[\w-]+$/],
+  ['POST', /^\/books$/],
+  ['PATCH', /^\/books\/[\w-]+\/source$/],
+  ['PUT', /^\/books\/[\w-]+\/(field-map|identity-keys|display)$/],
+];
+
+export type CampaignStatus = 'draft' | 'running' | 'paused' | 'archived';
+/** A touchpoint in a campaign's draft, found by its key. */
+export type Touchpoint = { key: string } & Record<string, unknown>;
+type Draft = { audience?: unknown; touchpoints?: Touchpoint[]; escalation_policy?: unknown; channel_policy?: unknown };
+type Envelope = { total?: number; items?: Array<Record<string, unknown>> };
+// A template version is whole: a change starts from the latest version's content.
+const TEMPLATE_CONTENT = ['subject', 'body', 'html', 'uses_variables', 'selection_tags', 'skills', 'batch_row'];
+const given = <T extends object>(o: T) => Object.fromEntries(Object.entries(o).filter(([, v]) => v !== undefined)) as Partial<T>;
+type Variable = { key: string; required?: boolean; example?: unknown };
+// Templates declare the variables they read as {key, required, example}; given as keys, a key the template already
+// declares keeps its entry.
+const declare = (keys: string[] | undefined, current: Variable[] = []) => keys?.map((key) => current.find((v) => v.key === key) ?? { key });
+
 /**
- * Campaigns, READ-ONLY by design, through copilot's proxy to the campaigns
- * service. The CLI never publishes a campaign, sends a communication or
- * triggers a book sync; those act on real customers.
+ * Campaigns through copilot's proxy to the campaigns service: reads, and
+ * writes to configuration only (WRITABLE). The CLI never sends a
+ * communication, runs a book sync or deletes; those act on real customers.
  */
 export class CampaignsSDK {
   constructor(private client: IndemnClient) {}
@@ -26,6 +58,11 @@ export class CampaignsSDK {
     return this.client.copilotGet<T>(`/organization/:org_id/campaigns-service${path}`, query);
   }
 
+  private async write<T>(method: WriteMethod, path: string, body: unknown): Promise<T> {
+    if (!WRITABLE.some(([m, r]) => m === method && r.test(path))) throw new CliError(`Campaigns ${method} ${path} is not allowed from the CLI.`, EXIT.NEEDS_INPUT);
+    return this.client.copilotRequestRaw<T>(method, `/organization/:org_id/campaigns-service${path}`, body);
+  }
+
   list(filter: { status?: string; solutionId?: string; limit?: number; skip?: number } = {}): Promise<{ total?: number; items?: unknown[] }> {
     const q: Record<string, string> = { limit: String(Math.min(filter.limit ?? 50, 500)), skip: String(filter.skip ?? 0) };
     if (filter.status) q.status = filter.status;
@@ -57,4 +94,88 @@ export class CampaignsSDK {
   templateSkills(solutionId?: string): Promise<unknown> {
     return this.read('/template-skills', solutionId ? { solution_id: solutionId } : undefined);
   }
+
+  templateSkill(id: string): Promise<{ name?: string; instructions?: string }> {
+    return this.read(`/template-skills/${id}`);
+  }
+
+  books(filter: { solutionId?: string; limit?: number } = {}): Promise<Envelope> {
+    const q: Record<string, string> = { limit: String(Math.min(filter.limit ?? 50, 200)) };  // the service allows 200
+    if (filter.solutionId) q.solution_id = filter.solutionId;
+    return this.read('/books', q);
+  }
+
+  book(id: string): Promise<{ name?: string }> {
+    return this.read(`/books/${id}`);
+  }
+
+  createCampaign(input: { solution_id: string; book_id: string; name: string; campaign_type: string; entry?: string; closes?: string }): Promise<{ id: string }> {
+    return this.write('POST', '/campaigns', given(input));
+  }
+
+  /** Change parts of the draft; the rest of it (its touchpoints among it) stays as it is. */
+  async updateDraft(id: string, parts: Omit<Draft, 'touchpoints'>): Promise<Draft> {
+    const { draft } = await this.read<{ draft?: Draft }>(`/campaigns/${id}`);
+    return this.write('PUT', `/campaigns/${id}/draft`, { ...draft, ...given(parts) });
+  }
+
+  /** Add a touchpoint, or change the one with its key (only the fields given). A new one drafts unless told to
+   *  send; a template given without a version is pinned to its latest. */
+  async setTouchpoint(id: string, touchpoint: Touchpoint): Promise<Draft> {
+    const { draft } = await this.read<{ draft?: Draft }>(`/campaigns/${id}`);
+    const current = draft?.touchpoints ?? [];
+    const existing = current.find((t) => t.key === touchpoint.key);
+    const tp: Touchpoint = { ...(existing ?? { terminal_action: 'draft' }), ...given(touchpoint), key: touchpoint.key };
+    if (typeof touchpoint.template_id === 'string' && touchpoint.template_version_n === undefined) {
+      tp.template_version_n = Number((await this.latestTemplateVersion(touchpoint.template_id))?.version_n ?? 1);
+    }
+    const touchpoints = existing ? current.map((t) => (t.key === tp.key ? tp : t)) : [...current, tp];
+    return this.write('PUT', `/campaigns/${id}/draft`, { ...draft, touchpoints });
+  }
+
+  publish(id: string, changeSummary?: string): Promise<unknown> {
+    return this.write('POST', `/campaigns/${id}/publish`, { change_summary: changeSummary ?? '' });
+  }
+
+  setStatus(id: string, status: CampaignStatus): Promise<unknown> {
+    return this.write('POST', `/campaigns/${id}/status`, { status });
+  }
+
+  createTemplate(input: Record<string, unknown> & { uses_variables?: string[] }): Promise<unknown> {
+    return this.write('POST', '/templates', given({ ...input, uses_variables: declare(input.uses_variables) }));
+  }
+
+  private async latestTemplateVersion(id: string): Promise<Record<string, unknown> | undefined> {
+    return (await this.read<Envelope>(`/templates/${id}/versions`)).items?.[0];  // newest first
+  }
+
+  /** A new version of the template: its latest one with the changes given. */
+  async updateTemplate(id: string, changes: Record<string, unknown> & { uses_variables?: string[] }): Promise<unknown> {
+    const latest = (await this.latestTemplateVersion(id)) ?? {};
+    const kept = Object.fromEntries(TEMPLATE_CONTENT.filter((k) => k in latest).map((k) => [k, latest[k]]));
+    return this.write('POST', `/templates/${id}/versions`, { ...kept, ...given({ ...changes, uses_variables: declare(changes.uses_variables, latest.uses_variables as Variable[]) }) });
+  }
+
+  createTemplateSkill(input: { solution_id?: string; key: string; name: string; instructions: string }): Promise<unknown> {
+    return this.write('POST', '/template-skills', input);
+  }
+
+  async updateTemplateSkill(id: string, changes: { name?: string; instructions?: string }): Promise<unknown> {
+    const skill = await this.templateSkill(id);
+    return this.write('PUT', `/template-skills/${id}`, { name: skill.name, instructions: skill.instructions, ...given(changes) });
+  }
+
+  createBook(input: { solution_id: string; name: string; schema_id?: string; source?: unknown }): Promise<{ id: string }> {
+    return this.write('POST', '/books', given(input));
+  }
+
+  /** Change the parts of a book that are given, each its own call in the service. Keys are the book's schema
+   *  keys; identity keys change only while the book has no records. */
+  async updateBook(id: string, changes: { source?: unknown; field_map?: unknown[]; identity_keys?: string[]; display?: unknown }): Promise<unknown> {
+    if (changes.source !== undefined) await this.write('PATCH', `/books/${id}/source`, { source: changes.source });
+    if (changes.field_map !== undefined) await this.write('PUT', `/books/${id}/field-map`, { field_map: changes.field_map });
+    if (changes.identity_keys !== undefined) await this.write('PUT', `/books/${id}/identity-keys`, { identity_keys: changes.identity_keys });
+    if (changes.display !== undefined) await this.write('PUT', `/books/${id}/display`, { display: changes.display });
+    return this.book(id);
+  }
 }

package/src/sdk/client.ts

@@ -1,8 +1,9 @@
 import Conf from 'conf';
 import { chmodSync } from 'node:fs';
+import { dirname } from 'node:path';
 import type { ApiResponse, Environment, EnvironmentHosts, IndemnConfig, OrgSummary } from './types.js';
 import { CliError, cliVersion, indemnHost, isDebug, SessionExpiredError } from '../core/runtime.js';
-import { copilotAuthHeader, darwinAuthHeader, resolveCredential, type Credential } from './credentials.js';
+import { copilotAuthHeader, darwinAuthHeader, evaluationsAuthHeader, resolveCredential, type Credential } from './credentials.js';
 import { tokenExpiry } from './session.js';
 import { findLinkFile, resolveOrg, type LinkFile, type ResolvedOrg } from '../core/org-resolver.js';
 import { emitOrgResolved, getAskers, getOrgFlag, scopedOrg } from '../core/scope.js';
@@ -71,6 +72,8 @@ export class IndemnClient {
   private environment: Environment;
   private hosts: EnvironmentHosts;
   private resolvedOrg?: Promise<OrgContext>;
+  /** The org `resolvedOrg` settled on, readable without waiting or asking. */
+  private settledOrgId?: string;
   private linkCache?: LinkFile | null;
   private membershipCache?: OrgSummary[];
 
@@ -126,6 +129,7 @@ export class IndemnClient {
         orgs: store.get('orgs'),
         api_key: apiKey,
         hosts: store.get('hosts', DEFAULT_HOSTS),
+        access: store.get('access'),
       };
     } catch {
       return null;
@@ -138,9 +142,10 @@ export class IndemnClient {
       if (value === undefined) store.delete(key as keyof IndemnConfig);
       else store.set(key as keyof IndemnConfig, value);
     }
-    // Restrict config file to owner-only (contains credentials)
+    // Restrict the config file and its folder to owner-only (they hold the session)
     try {
       chmodSync(store.path, 0o600);
+      chmodSync(dirname(store.path), 0o700);
     } catch {
       // Non-fatal — Windows doesn't support Unix permissions
     }
@@ -246,6 +251,7 @@ export class IndemnClient {
     if (explicit || opts.cache === false) return run();
     if (!this.resolvedOrg) {
       this.resolvedOrg = run().then((org) => {
+        this.settledOrgId = org.id;
         emitOrgResolved({ id: org.id, name: org.name, source: org.source, environment: this.environment });
         return org;
       });
@@ -322,6 +328,12 @@ export class IndemnClient {
     }
     if (backend === 'copilot' && opts.auth !== false) {
       headers['Authorization'] = await this.authHeader();
+    } else if (backend === 'evaluations' && opts.auth !== false && this.getCredential()) {
+      // Without any credential the request goes out bare, as before; the service then answers 401.
+      headers['Authorization'] = evaluationsAuthHeader(await this.freshCredential());
+      // Only an org already in effect: the service resolves the user's orgs itself, so never ask or look one up here.
+      const org = scopedOrg() ?? this.settledOrgId;
+      if (org) headers['X-Organization-Id'] = org;
     }
 
     const attempts = method === 'GET' ? RETRY_DELAYS_MS.length + 1 : 1;
@@ -429,7 +441,7 @@ export class IndemnClient {
     return res.json() as Promise<T>;
   }
 
-  // Evaluations Service requests (no /api/ prefix, no org_id, no auth)
+  // Evaluations Service requests (no /api/ prefix, no org_id in the path; the credential goes as Bearer, see send())
   async evalsGet<T = unknown>(path: string, query?: Record<string, string>): Promise<T> {
     const res = await this.send('evaluations', 'GET', this.withQuery(this.buildEvalsUrl(path), query));
     return this.handleEvalsResponse<T>(res);
@@ -490,6 +502,16 @@ export class IndemnClient {
   }
 
   private async handleEvalsResponse<T>(res: Response): Promise<T> {
+    if (res.status === 401 || res.status === 403) {
+      // Keep the service's reason. 401: no valid credential (log in again). 403: signed in but not allowed.
+      const text = await res.text().catch(() => '');
+      let detail: unknown = text;
+      try { detail = (JSON.parse(text) as { detail?: unknown }).detail ?? text; } catch { /* plain text */ }
+      const reason = (typeof detail === 'string' ? detail : JSON.stringify(detail)).trim();
+      const shown = reason && !reason.startsWith('<') ? ` (${reason.slice(0, 200)})` : '';
+      if (res.status === 401) throw new SessionExpiredError(this.loginAgain(`The evaluations service refused the request${shown}.`));
+      throw new CliError(`The evaluations service denied access${shown}.`);
+    }
     if (!res.ok) {
       const text = await res.text();
       throw new Error(`Evaluations API error (${res.status}): ${text}`);

package/src/sdk/credentials.ts

@@ -51,3 +51,8 @@ export function darwinAuthHeader(c: Credential): string {
   }
   return `Bearer ${c.token}`;
 }
+
+/** The evaluations service takes the session or an API key, both as Bearer; it checks a key and pins it to the key's org. */
+export function evaluationsAuthHeader(c: Credential): string {
+  return `Bearer ${c.kind === 'token' ? c.token : c.key}`;
+}

package/src/sdk/eval.ts

@@ -33,9 +33,9 @@ export class EvalSDK {
   }
 
   /**
-   * The evaluations service checks nothing about orgs. Before acting on an
-   * agent, confirm through copilot (which refuses other orgs' agents) that it
-   * belongs to the org this command acts on.
+   * The evaluations service now enforces org scope itself; this check is defense
+   * in depth. Before acting on an agent, confirm through copilot (which refuses
+   * other orgs' agents) that it belongs to the org this command acts on.
    */
   async assertAgentInOrg(agentId: string): Promise<void> {
     const { AgentsSDK } = await import('./agents.js');