@vorim/sdk 2.3.0 → 3.0.0

package/dist/index.cjs

@@ -160,6 +160,68 @@ var VorimSDK = class {
   async deleteApiKey(keyId) {
     return this.delete(`/api-keys/${keyId}`);
   }
+  // ─── Ephemeral Agents ──────────────────────────────────────────────
+  /**
+   * Register an ephemeral agent with W3C did:key identity.
+   * The agent auto-expires after the specified TTL.
+   */
+  async registerEphemeral(input) {
+    return this.post("/agents/ephemeral", input);
+  }
+  // ─── Credential Delegation ──────────────────────────────────────────
+  /**
+   * Register an OAuth provider for credential delegation.
+   */
+  async registerProvider(input) {
+    return this.post("/credentials/providers", input);
+  }
+  /**
+   * List registered OAuth providers.
+   */
+  async listProviders() {
+    return this.get("/credentials/providers");
+  }
+  /**
+   * Store an OAuth connection (user's authorized tokens).
+   */
+  async storeConnection(input) {
+    return this.post("/credentials/connections", input);
+  }
+  /**
+   * List OAuth connections.
+   */
+  async listConnections() {
+    return this.get("/credentials/connections");
+  }
+  /**
+   * Delegate a credential to an agent.
+   * The agent will be able to request short-lived access tokens
+   * for the delegated scopes without ever seeing the refresh token.
+   */
+  async delegateCredential(input) {
+    return this.post("/credentials/delegations", input);
+  }
+  /**
+   * List credential delegations for the organisation or a specific agent.
+   */
+  async listDelegations(agentId) {
+    const params = agentId ? `?agent_id=${agentId}` : "";
+    return this.get(`/credentials/delegations${params}`);
+  }
+  /**
+   * Revoke a credential delegation (cascades to delegation chains).
+   */
+  async revokeDelegation(delegationId) {
+    return this.delete(`/credentials/delegations/${delegationId}`);
+  }
+  /**
+   * Request a short-lived access token for an agent.
+   * The agent must have an active credential delegation.
+   * The refresh token is never exposed — the platform proxies the request.
+   */
+  async requestToken(input) {
+    return this.post("/credentials/token", input);
+  }
   // ─── Signing ──────────────────────────────────────────────────────
   /**
    * Sign a payload with an Ed25519 private key (client-side).

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — TypeScript\n// Thin client wrapping the Vorim AI REST API\n// ============================================================================\n\nimport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, PermissionScope, PermissionCheckResult,\n} from './types.js';\n\nexport interface VorimConfig {\n  apiKey: string;\n  baseUrl?: string;\n  timeout?: number;\n}\n\nexport class VorimSDK {\n  private apiKey: string;\n  private baseUrl: string;\n  private timeout: number;\n\n  constructor(config: VorimConfig) {\n    this.apiKey = config.apiKey;\n    this.baseUrl = (config.baseUrl || 'https://api.vorim.ai').replace(/\\/$/, '') + '/v1';\n    this.timeout = config.timeout || 10000;\n  }\n\n  // ─── Health Check ────────────────────────────────────────────────\n\n  /**\n   * Ping the Vorim API to verify connectivity and API key validity.\n   * Returns { status, timestamp } on success, throws VorimError on failure.\n   */\n  async ping(): Promise<{ status: string; timestamp: string }> {\n    const response = await fetch(`${this.baseUrl.replace('/v1', '')}/health`, {\n      headers: { 'User-Agent': 'vorim-sdk/2.1.0' },\n      signal: AbortSignal.timeout(this.timeout),\n    });\n    if (!response.ok) throw new VorimError(response.status, 'UNREACHABLE', 'Vorim API is not reachable');\n    return response.json() as Promise<{ status: string; timestamp: string }>;\n  }\n\n  // ─── Agent Identity ────────────────────────────────────────────────\n\n  /**\n   * Register a new agent with Vorim AI.\n   * Returns the agent identity and a private key (shown once).\n   */\n  async register(input: AgentRegistrationInput): Promise<AgentRegistrationResult> {\n    return this.post('/agents', input);\n  }\n\n  /**\n   * Verify an agent's identity via the public Trust API.\n   */\n  async verify(agentId: string): Promise<TrustRecord> {\n    return this.get(`/trust/verify/${agentId}`);\n  }\n\n  /**\n   * Get agent details.\n   */\n  async getAgent(agentId: string): Promise<Agent> {\n    return this.get(`/agents/${agentId}`);\n  }\n\n  /**\n   * List all agents in the organisation.\n   */\n  async listAgents(params?: { page?: number; per_page?: number; status?: string }): Promise<{ agents: Agent[]; meta: any }> {\n    const qs = new URLSearchParams(params as any).toString();\n    return this.get(`/agents${qs ? '?' + qs : ''}`);\n  }\n\n  /**\n   * Update an agent's metadata.\n   */\n  async updateAgent(agentId: string, updates: Partial<Pick<Agent, 'name' | 'description' | 'status' | 'capabilities'>>): Promise<Agent> {\n    return this.patch(`/agents/${agentId}`, updates);\n  }\n\n  /**\n   * Revoke an agent (permanent deactivation).\n   */\n  async revoke(agentId: string): Promise<void> {\n    await this.delete(`/agents/${agentId}`);\n  }\n\n  // ─── Permissions ──────────────────────────────────────────────────\n\n  /**\n   * Check if an agent has a specific permission scope.\n   * Target: < 5ms response via Redis cache.\n   */\n  async check(agentId: string, scope: PermissionScope): Promise<PermissionCheckResult> {\n    return this.post(`/agents/${agentId}/permissions/verify`, { scope });\n  }\n\n  /**\n   * Grant a permission scope to an agent.\n   */\n  async grant(agentId: string, scope: PermissionScope, options?: {\n    valid_until?: string;\n    rate_limit?: { max: number; window: string };\n  }): Promise<any> {\n    return this.post(`/agents/${agentId}/permissions`, { scope, ...options });\n  }\n\n  /**\n   * List all active permissions for an agent.\n   */\n  async listPermissions(agentId: string): Promise<any[]> {\n    return this.get(`/agents/${agentId}/permissions`);\n  }\n\n  /**\n   * Revoke a specific permission scope from an agent.\n   */\n  async revokePermission(agentId: string, scope: PermissionScope): Promise<any> {\n    return this.delete(`/agents/${agentId}/permissions/${scope}`);\n  }\n\n  // ─── Audit ────────────────────────────────────────────────────────\n\n  /**\n   * Emit an audit event for an agent action.\n   */\n  async emit(event: AuditEventInput): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events: [event] });\n  }\n\n  /**\n   * Emit a batch of audit events (up to 1,000).\n   */\n  async emitBatch(events: AuditEventInput[]): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events });\n  }\n\n  /**\n   * Export a signed audit bundle for a date range.\n   */\n  async exportAudit(from: string, to: string, format: string = 'json'): Promise<any> {\n    return this.post('/audit/export', { from, to, format });\n  }\n\n  // ─── API Keys ──────────────────────────────────────────────────────\n\n  /**\n   * List all API keys for the organisation.\n   */\n  async listApiKeys(): Promise<any[]> {\n    return this.get('/api-keys');\n  }\n\n  /**\n   * Create a new API key.\n   */\n  async createApiKey(name: string, options?: { scopes?: string[]; expires_at?: string }): Promise<any> {\n    return this.post('/api-keys', { name, ...options });\n  }\n\n  /**\n   * Revoke an API key.\n   */\n  async deleteApiKey(keyId: string): Promise<{ revoked: boolean }> {\n    return this.delete(`/api-keys/${keyId}`);\n  }\n\n  // ─── Signing ──────────────────────────────────────────────────────\n\n  /**\n   * Sign a payload with an Ed25519 private key (client-side).\n   * Uses the Web Crypto API or Node.js crypto.\n   */\n  async sign(payload: string, privateKeyPem: string): Promise<string> {\n    if (typeof globalThis.crypto?.subtle !== 'undefined') {\n      // Web Crypto API\n      const keyData = this.pemToArrayBuffer(privateKeyPem);\n      const key = await globalThis.crypto.subtle.importKey(\n        'pkcs8', keyData, { name: 'Ed25519' }, false, ['sign']\n      );\n      const signature = await globalThis.crypto.subtle.sign(\n        'Ed25519', key, new TextEncoder().encode(payload)\n      );\n      return `ed25519:${this.arrayBufferToBase64(signature)}`;\n    } else {\n      // Node.js crypto fallback\n      const crypto = await import('node:crypto');\n      const sign = crypto.sign(null, Buffer.from(payload), privateKeyPem);\n      return `ed25519:${sign.toString('base64')}`;\n    }\n  }\n\n  // ─── HTTP Client ──────────────────────────────────────────────────\n\n  private async get(path: string): Promise<any> {\n    return this.request('GET', path);\n  }\n\n  private async post(path: string, body: any): Promise<any> {\n    return this.request('POST', path, body);\n  }\n\n  private async patch(path: string, body: any): Promise<any> {\n    return this.request('PATCH', path, body);\n  }\n\n  private async delete(path: string): Promise<any> {\n    return this.request('DELETE', path);\n  }\n\n  private async request(method: string, path: string, body?: any): Promise<any> {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), this.timeout);\n\n    try {\n      const response = await fetch(`${this.baseUrl}${path}`, {\n        method,\n        headers: {\n          'Authorization': `Bearer ${this.apiKey}`,\n          'Content-Type': 'application/json',\n          'User-Agent': 'vorim-sdk/2.0.0',\n        },\n        body: body ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        const errBody = await response.json().catch(() => ({})) as Record<string, any>;\n        throw new VorimError(\n          response.status,\n          errBody.error?.code || 'UNKNOWN_ERROR',\n          errBody.error?.message || `HTTP ${response.status}`,\n          errBody.error?.details\n        );\n      }\n\n      const json = await response.json() as Record<string, any>;\n      return json.data;\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  private pemToArrayBuffer(pem: string): ArrayBuffer {\n    const b64 = pem.replace(/-----[^-]+-----/g, '').replace(/\\s/g, '');\n    const binary = atob(b64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes.buffer;\n  }\n\n  private arrayBufferToBase64(buffer: ArrayBuffer): string {\n    const bytes = new Uint8Array(buffer);\n    let binary = '';\n    for (const byte of bytes) {\n      binary += String.fromCharCode(byte);\n    }\n    return btoa(binary);\n  }\n}\n\nexport class VorimError extends Error {\n  constructor(\n    public status: number,\n    public code: string,\n    message: string,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VorimError';\n  }\n}\n\n// ─── Convenience export ──────────────────────────────────────────────\n\nexport default function createVorim(config: VorimConfig): VorimSDK {\n  return new VorimSDK(config);\n}\n\n// Re-export types for consumers\nexport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, AuditEventType, AuditResult,\n  PermissionScope, PermissionCheckResult, AgentStatus,\n} from './types.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBO,IAAM,WAAN,MAAe;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAAqB;AAC/B,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,WAAW,wBAAwB,QAAQ,OAAO,EAAE,IAAI;AAC/E,SAAK,UAAU,OAAO,WAAW;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAuD;AAC3D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,CAAC,WAAW;AAAA,MACxE,SAAS,EAAE,cAAc,kBAAkB;AAAA,MAC3C,QAAQ,YAAY,QAAQ,KAAK,OAAO;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,WAAW,SAAS,QAAQ,eAAe,4BAA4B;AACnG,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,OAAiE;AAC9E,WAAO,KAAK,KAAK,WAAW,KAAK;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAuC;AAClD,WAAO,KAAK,IAAI,iBAAiB,OAAO,EAAE;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,SAAiC;AAC9C,WAAO,KAAK,IAAI,WAAW,OAAO,EAAE;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAAyG;AACxH,UAAM,KAAK,IAAI,gBAAgB,MAAa,EAAE,SAAS;AACvD,WAAO,KAAK,IAAI,UAAU,KAAK,MAAM,KAAK,EAAE,EAAE;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,SAAiB,SAAmG;AACpI,WAAO,KAAK,MAAM,WAAW,OAAO,IAAI,OAAO;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAgC;AAC3C,UAAM,KAAK,OAAO,WAAW,OAAO,EAAE;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAM,SAAiB,OAAwD;AACnF,WAAO,KAAK,KAAK,WAAW,OAAO,uBAAuB,EAAE,MAAM,CAAC;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,SAAiB,OAAwB,SAGpC;AACf,WAAO,KAAK,KAAK,WAAW,OAAO,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,SAAiC;AACrD,WAAO,KAAK,IAAI,WAAW,OAAO,cAAc;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,SAAiB,OAAsC;AAC5E,WAAO,KAAK,OAAO,WAAW,OAAO,gBAAgB,KAAK,EAAE;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,OAAuD;AAChE,WAAO,KAAK,KAAK,iBAAiB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA0D;AACxE,WAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,MAAc,IAAY,SAAiB,QAAsB;AACjF,WAAO,KAAK,KAAK,iBAAiB,EAAE,MAAM,IAAI,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAA8B;AAClC,WAAO,KAAK,IAAI,WAAW;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,MAAc,SAAoE;AACnG,WAAO,KAAK,KAAK,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,OAA8C;AAC/D,WAAO,KAAK,OAAO,aAAa,KAAK,EAAE;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAK,SAAiB,eAAwC;AAClE,QAAI,OAAO,WAAW,QAAQ,WAAW,aAAa;AAEpD,YAAM,UAAU,KAAK,iBAAiB,aAAa;AACnD,YAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,QACzC;AAAA,QAAS;AAAA,QAAS,EAAE,MAAM,UAAU;AAAA,QAAG;AAAA,QAAO,CAAC,MAAM;AAAA,MACvD;AACA,YAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,QAC/C;AAAA,QAAW;AAAA,QAAK,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,MAClD;AACA,aAAO,WAAW,KAAK,oBAAoB,SAAS,CAAC;AAAA,IACvD,OAAO;AAEL,YAAM,SAAS,MAAM,OAAO,QAAa;AACzC,YAAM,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,OAAO,GAAG,aAAa;AAClE,aAAO,WAAW,KAAK,SAAS,QAAQ,CAAC;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,IAAI,MAA4B;AAC5C,WAAO,KAAK,QAAQ,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAc,KAAK,MAAc,MAAyB;AACxD,WAAO,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAAA,EACxC;AAAA,EAEA,MAAc,MAAM,MAAc,MAAyB;AACzD,WAAO,KAAK,QAAQ,SAAS,MAAM,IAAI;AAAA,EACzC;AAAA,EAEA,MAAc,OAAO,MAA4B;AAC/C,WAAO,KAAK,QAAQ,UAAU,IAAI;AAAA,EACpC;AAAA,EAEA,MAAc,QAAQ,QAAgB,MAAc,MAA0B;AAC5E,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,OAAO;AAEnE,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI,IAAI;AAAA,QACrD;AAAA,QACA,SAAS;AAAA,UACP,iBAAiB,UAAU,KAAK,MAAM;AAAA,UACtC,gBAAgB;AAAA,UAChB,cAAc;AAAA,QAChB;AAAA,QACA,MAAM,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACpC,QAAQ,WAAW;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACtD,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT,QAAQ,OAAO,QAAQ;AAAA,UACvB,QAAQ,OAAO,WAAW,QAAQ,SAAS,MAAM;AAAA,UACjD,QAAQ,OAAO;AAAA,QACjB;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,KAAK;AAAA,IACd,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAAA,EAEQ,iBAAiB,KAA0B;AACjD,UAAM,MAAM,IAAI,QAAQ,oBAAoB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACjE,UAAM,SAAS,KAAK,GAAG;AACvB,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,oBAAoB,QAA6B;AACvD,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,QAAI,SAAS;AACb,eAAW,QAAQ,OAAO;AACxB,gBAAU,OAAO,aAAa,IAAI;AAAA,IACpC;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAEO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACS,QACA,MACP,SACO,SACP;AACA,UAAM,OAAO;AALN;AACA;AAEA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAIe,SAAR,YAA6B,QAA+B;AACjE,SAAO,IAAI,SAAS,MAAM;AAC5B;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — TypeScript\n// Thin client wrapping the Vorim AI REST API\n// ============================================================================\n\nimport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, PermissionScope, PermissionCheckResult,\n} from './types.js';\n\nexport interface VorimConfig {\n  apiKey: string;\n  baseUrl?: string;\n  timeout?: number;\n}\n\nexport class VorimSDK {\n  private apiKey: string;\n  private baseUrl: string;\n  private timeout: number;\n\n  constructor(config: VorimConfig) {\n    this.apiKey = config.apiKey;\n    this.baseUrl = (config.baseUrl || 'https://api.vorim.ai').replace(/\\/$/, '') + '/v1';\n    this.timeout = config.timeout || 10000;\n  }\n\n  // ─── Health Check ────────────────────────────────────────────────\n\n  /**\n   * Ping the Vorim API to verify connectivity and API key validity.\n   * Returns { status, timestamp } on success, throws VorimError on failure.\n   */\n  async ping(): Promise<{ status: string; timestamp: string }> {\n    const response = await fetch(`${this.baseUrl.replace('/v1', '')}/health`, {\n      headers: { 'User-Agent': 'vorim-sdk/2.1.0' },\n      signal: AbortSignal.timeout(this.timeout),\n    });\n    if (!response.ok) throw new VorimError(response.status, 'UNREACHABLE', 'Vorim API is not reachable');\n    return response.json() as Promise<{ status: string; timestamp: string }>;\n  }\n\n  // ─── Agent Identity ────────────────────────────────────────────────\n\n  /**\n   * Register a new agent with Vorim AI.\n   * Returns the agent identity and a private key (shown once).\n   */\n  async register(input: AgentRegistrationInput): Promise<AgentRegistrationResult> {\n    return this.post('/agents', input);\n  }\n\n  /**\n   * Verify an agent's identity via the public Trust API.\n   */\n  async verify(agentId: string): Promise<TrustRecord> {\n    return this.get(`/trust/verify/${agentId}`);\n  }\n\n  /**\n   * Get agent details.\n   */\n  async getAgent(agentId: string): Promise<Agent> {\n    return this.get(`/agents/${agentId}`);\n  }\n\n  /**\n   * List all agents in the organisation.\n   */\n  async listAgents(params?: { page?: number; per_page?: number; status?: string }): Promise<{ agents: Agent[]; meta: any }> {\n    const qs = new URLSearchParams(params as any).toString();\n    return this.get(`/agents${qs ? '?' + qs : ''}`);\n  }\n\n  /**\n   * Update an agent's metadata.\n   */\n  async updateAgent(agentId: string, updates: Partial<Pick<Agent, 'name' | 'description' | 'status' | 'capabilities'>>): Promise<Agent> {\n    return this.patch(`/agents/${agentId}`, updates);\n  }\n\n  /**\n   * Revoke an agent (permanent deactivation).\n   */\n  async revoke(agentId: string): Promise<void> {\n    await this.delete(`/agents/${agentId}`);\n  }\n\n  // ─── Permissions ──────────────────────────────────────────────────\n\n  /**\n   * Check if an agent has a specific permission scope.\n   * Target: < 5ms response via Redis cache.\n   */\n  async check(agentId: string, scope: PermissionScope): Promise<PermissionCheckResult> {\n    return this.post(`/agents/${agentId}/permissions/verify`, { scope });\n  }\n\n  /**\n   * Grant a permission scope to an agent.\n   */\n  async grant(agentId: string, scope: PermissionScope, options?: {\n    valid_until?: string;\n    rate_limit?: { max: number; window: string };\n  }): Promise<any> {\n    return this.post(`/agents/${agentId}/permissions`, { scope, ...options });\n  }\n\n  /**\n   * List all active permissions for an agent.\n   */\n  async listPermissions(agentId: string): Promise<any[]> {\n    return this.get(`/agents/${agentId}/permissions`);\n  }\n\n  /**\n   * Revoke a specific permission scope from an agent.\n   */\n  async revokePermission(agentId: string, scope: PermissionScope): Promise<any> {\n    return this.delete(`/agents/${agentId}/permissions/${scope}`);\n  }\n\n  // ─── Audit ────────────────────────────────────────────────────────\n\n  /**\n   * Emit an audit event for an agent action.\n   */\n  async emit(event: AuditEventInput): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events: [event] });\n  }\n\n  /**\n   * Emit a batch of audit events (up to 1,000).\n   */\n  async emitBatch(events: AuditEventInput[]): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events });\n  }\n\n  /**\n   * Export a signed audit bundle for a date range.\n   */\n  async exportAudit(from: string, to: string, format: string = 'json'): Promise<any> {\n    return this.post('/audit/export', { from, to, format });\n  }\n\n  // ─── API Keys ──────────────────────────────────────────────────────\n\n  /**\n   * List all API keys for the organisation.\n   */\n  async listApiKeys(): Promise<any[]> {\n    return this.get('/api-keys');\n  }\n\n  /**\n   * Create a new API key.\n   */\n  async createApiKey(name: string, options?: { scopes?: string[]; expires_at?: string }): Promise<any> {\n    return this.post('/api-keys', { name, ...options });\n  }\n\n  /**\n   * Revoke an API key.\n   */\n  async deleteApiKey(keyId: string): Promise<{ revoked: boolean }> {\n    return this.delete(`/api-keys/${keyId}`);\n  }\n\n  // ─── Ephemeral Agents ──────────────────────────────────────────────\n\n  /**\n   * Register an ephemeral agent with W3C did:key identity.\n   * The agent auto-expires after the specified TTL.\n   */\n  async registerEphemeral(input: {\n    capabilities: string[];\n    scopes: string[];\n    ttl_seconds?: number;\n  }): Promise<any> {\n    return this.post('/agents/ephemeral', input);\n  }\n\n  // ─── Credential Delegation ──────────────────────────────────────────\n\n  /**\n   * Register an OAuth provider for credential delegation.\n   */\n  async registerProvider(input: {\n    provider_key: string;\n    display_name?: string;\n    client_id: string;\n    client_secret: string;\n    auth_url: string;\n    token_url: string;\n    revoke_url?: string;\n    scopes_available?: string[];\n  }): Promise<any> {\n    return this.post('/credentials/providers', input);\n  }\n\n  /**\n   * List registered OAuth providers.\n   */\n  async listProviders(): Promise<any[]> {\n    return this.get('/credentials/providers');\n  }\n\n  /**\n   * Store an OAuth connection (user's authorized tokens).\n   */\n  async storeConnection(input: {\n    provider_id: string;\n    refresh_token: string;\n    scopes_granted: string[];\n    external_account_id?: string;\n  }): Promise<any> {\n    return this.post('/credentials/connections', input);\n  }\n\n  /**\n   * List OAuth connections.\n   */\n  async listConnections(): Promise<any[]> {\n    return this.get('/credentials/connections');\n  }\n\n  /**\n   * Delegate a credential to an agent.\n   * The agent will be able to request short-lived access tokens\n   * for the delegated scopes without ever seeing the refresh token.\n   */\n  async delegateCredential(input: {\n    connection_id: string;\n    agent_id: string;\n    scopes_delegated: string[];\n    max_requests_per_hr?: number;\n    valid_until?: string;\n  }): Promise<any> {\n    return this.post('/credentials/delegations', input);\n  }\n\n  /**\n   * List credential delegations for the organisation or a specific agent.\n   */\n  async listDelegations(agentId?: string): Promise<any[]> {\n    const params = agentId ? `?agent_id=${agentId}` : '';\n    return this.get(`/credentials/delegations${params}`);\n  }\n\n  /**\n   * Revoke a credential delegation (cascades to delegation chains).\n   */\n  async revokeDelegation(delegationId: string): Promise<{ revoked: boolean }> {\n    return this.delete(`/credentials/delegations/${delegationId}`);\n  }\n\n  /**\n   * Request a short-lived access token for an agent.\n   * The agent must have an active credential delegation.\n   * The refresh token is never exposed — the platform proxies the request.\n   */\n  async requestToken(input: {\n    agent_id: string;\n    scope: string;\n    provider_id?: string;\n  }): Promise<{\n    access_token: string;\n    token_type: string;\n    expires_in: number;\n    scope: string;\n    delegation_id: string;\n  }> {\n    return this.post('/credentials/token', input);\n  }\n\n  // ─── Signing ──────────────────────────────────────────────────────\n\n  /**\n   * Sign a payload with an Ed25519 private key (client-side).\n   * Uses the Web Crypto API or Node.js crypto.\n   */\n  async sign(payload: string, privateKeyPem: string): Promise<string> {\n    if (typeof globalThis.crypto?.subtle !== 'undefined') {\n      // Web Crypto API\n      const keyData = this.pemToArrayBuffer(privateKeyPem);\n      const key = await globalThis.crypto.subtle.importKey(\n        'pkcs8', keyData, { name: 'Ed25519' }, false, ['sign']\n      );\n      const signature = await globalThis.crypto.subtle.sign(\n        'Ed25519', key, new TextEncoder().encode(payload)\n      );\n      return `ed25519:${this.arrayBufferToBase64(signature)}`;\n    } else {\n      // Node.js crypto fallback\n      const crypto = await import('node:crypto');\n      const sign = crypto.sign(null, Buffer.from(payload), privateKeyPem);\n      return `ed25519:${sign.toString('base64')}`;\n    }\n  }\n\n  // ─── HTTP Client ──────────────────────────────────────────────────\n\n  private async get(path: string): Promise<any> {\n    return this.request('GET', path);\n  }\n\n  private async post(path: string, body: any): Promise<any> {\n    return this.request('POST', path, body);\n  }\n\n  private async patch(path: string, body: any): Promise<any> {\n    return this.request('PATCH', path, body);\n  }\n\n  private async delete(path: string): Promise<any> {\n    return this.request('DELETE', path);\n  }\n\n  private async request(method: string, path: string, body?: any): Promise<any> {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), this.timeout);\n\n    try {\n      const response = await fetch(`${this.baseUrl}${path}`, {\n        method,\n        headers: {\n          'Authorization': `Bearer ${this.apiKey}`,\n          'Content-Type': 'application/json',\n          'User-Agent': 'vorim-sdk/2.0.0',\n        },\n        body: body ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        const errBody = await response.json().catch(() => ({})) as Record<string, any>;\n        throw new VorimError(\n          response.status,\n          errBody.error?.code || 'UNKNOWN_ERROR',\n          errBody.error?.message || `HTTP ${response.status}`,\n          errBody.error?.details\n        );\n      }\n\n      const json = await response.json() as Record<string, any>;\n      return json.data;\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  private pemToArrayBuffer(pem: string): ArrayBuffer {\n    const b64 = pem.replace(/-----[^-]+-----/g, '').replace(/\\s/g, '');\n    const binary = atob(b64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes.buffer;\n  }\n\n  private arrayBufferToBase64(buffer: ArrayBuffer): string {\n    const bytes = new Uint8Array(buffer);\n    let binary = '';\n    for (const byte of bytes) {\n      binary += String.fromCharCode(byte);\n    }\n    return btoa(binary);\n  }\n}\n\nexport class VorimError extends Error {\n  constructor(\n    public status: number,\n    public code: string,\n    message: string,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VorimError';\n  }\n}\n\n// ─── Convenience export ──────────────────────────────────────────────\n\nexport default function createVorim(config: VorimConfig): VorimSDK {\n  return new VorimSDK(config);\n}\n\n// Re-export types for consumers\nexport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, AuditEventType, AuditResult,\n  PermissionScope, PermissionCheckResult, AgentStatus,\n} from './types.js';\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAgBO,IAAM,WAAN,MAAe;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAAqB;AAC/B,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,WAAW,wBAAwB,QAAQ,OAAO,EAAE,IAAI;AAC/E,SAAK,UAAU,OAAO,WAAW;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAuD;AAC3D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,CAAC,WAAW;AAAA,MACxE,SAAS,EAAE,cAAc,kBAAkB;AAAA,MAC3C,QAAQ,YAAY,QAAQ,KAAK,OAAO;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,WAAW,SAAS,QAAQ,eAAe,4BAA4B;AACnG,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,OAAiE;AAC9E,WAAO,KAAK,KAAK,WAAW,KAAK;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAuC;AAClD,WAAO,KAAK,IAAI,iBAAiB,OAAO,EAAE;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,SAAiC;AAC9C,WAAO,KAAK,IAAI,WAAW,OAAO,EAAE;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAAyG;AACxH,UAAM,KAAK,IAAI,gBAAgB,MAAa,EAAE,SAAS;AACvD,WAAO,KAAK,IAAI,UAAU,KAAK,MAAM,KAAK,EAAE,EAAE;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,SAAiB,SAAmG;AACpI,WAAO,KAAK,MAAM,WAAW,OAAO,IAAI,OAAO;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAgC;AAC3C,UAAM,KAAK,OAAO,WAAW,OAAO,EAAE;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAM,SAAiB,OAAwD;AACnF,WAAO,KAAK,KAAK,WAAW,OAAO,uBAAuB,EAAE,MAAM,CAAC;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,SAAiB,OAAwB,SAGpC;AACf,WAAO,KAAK,KAAK,WAAW,OAAO,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,SAAiC;AACrD,WAAO,KAAK,IAAI,WAAW,OAAO,cAAc;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,SAAiB,OAAsC;AAC5E,WAAO,KAAK,OAAO,WAAW,OAAO,gBAAgB,KAAK,EAAE;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,OAAuD;AAChE,WAAO,KAAK,KAAK,iBAAiB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA0D;AACxE,WAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,MAAc,IAAY,SAAiB,QAAsB;AACjF,WAAO,KAAK,KAAK,iBAAiB,EAAE,MAAM,IAAI,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAA8B;AAClC,WAAO,KAAK,IAAI,WAAW;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,MAAc,SAAoE;AACnG,WAAO,KAAK,KAAK,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,OAA8C;AAC/D,WAAO,KAAK,OAAO,aAAa,KAAK,EAAE;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAkB,OAIP;AACf,WAAO,KAAK,KAAK,qBAAqB,KAAK;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBAAiB,OASN;AACf,WAAO,KAAK,KAAK,0BAA0B,KAAK;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgC;AACpC,WAAO,KAAK,IAAI,wBAAwB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,OAKL;AACf,WAAO,KAAK,KAAK,4BAA4B,KAAK;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkC;AACtC,WAAO,KAAK,IAAI,0BAA0B;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBAAmB,OAMR;AACf,WAAO,KAAK,KAAK,4BAA4B,KAAK;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,SAAkC;AACtD,UAAM,SAAS,UAAU,aAAa,OAAO,KAAK;AAClD,WAAO,KAAK,IAAI,2BAA2B,MAAM,EAAE;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqD;AAC1E,WAAO,KAAK,OAAO,4BAA4B,YAAY,EAAE;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,OAUhB;AACD,WAAO,KAAK,KAAK,sBAAsB,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAK,SAAiB,eAAwC;AAClE,QAAI,OAAO,WAAW,QAAQ,WAAW,aAAa;AAEpD,YAAM,UAAU,KAAK,iBAAiB,aAAa;AACnD,YAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,QACzC;AAAA,QAAS;AAAA,QAAS,EAAE,MAAM,UAAU;AAAA,QAAG;AAAA,QAAO,CAAC,MAAM;AAAA,MACvD;AACA,YAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,QAC/C;AAAA,QAAW;AAAA,QAAK,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,MAClD;AACA,aAAO,WAAW,KAAK,oBAAoB,SAAS,CAAC;AAAA,IACvD,OAAO;AAEL,YAAM,SAAS,MAAM,OAAO,QAAa;AACzC,YAAM,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,OAAO,GAAG,aAAa;AAClE,aAAO,WAAW,KAAK,SAAS,QAAQ,CAAC;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,IAAI,MAA4B;AAC5C,WAAO,KAAK,QAAQ,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAc,KAAK,MAAc,MAAyB;AACxD,WAAO,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAAA,EACxC;AAAA,EAEA,MAAc,MAAM,MAAc,MAAyB;AACzD,WAAO,KAAK,QAAQ,SAAS,MAAM,IAAI;AAAA,EACzC;AAAA,EAEA,MAAc,OAAO,MAA4B;AAC/C,WAAO,KAAK,QAAQ,UAAU,IAAI;AAAA,EACpC;AAAA,EAEA,MAAc,QAAQ,QAAgB,MAAc,MAA0B;AAC5E,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,OAAO;AAEnE,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI,IAAI;AAAA,QACrD;AAAA,QACA,SAAS;AAAA,UACP,iBAAiB,UAAU,KAAK,MAAM;AAAA,UACtC,gBAAgB;AAAA,UAChB,cAAc;AAAA,QAChB;AAAA,QACA,MAAM,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACpC,QAAQ,WAAW;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACtD,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT,QAAQ,OAAO,QAAQ;AAAA,UACvB,QAAQ,OAAO,WAAW,QAAQ,SAAS,MAAM;AAAA,UACjD,QAAQ,OAAO;AAAA,QACjB;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,KAAK;AAAA,IACd,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAAA,EAEQ,iBAAiB,KAA0B;AACjD,UAAM,MAAM,IAAI,QAAQ,oBAAoB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACjE,UAAM,SAAS,KAAK,GAAG;AACvB,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,oBAAoB,QAA6B;AACvD,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,QAAI,SAAS;AACb,eAAW,QAAQ,OAAO;AACxB,gBAAU,OAAO,aAAa,IAAI;AAAA,IACpC;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAEO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACS,QACA,MACP,SACO,SACP;AACA,UAAM,OAAO;AALN;AACA;AAEA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAIe,SAAR,YAA6B,QAA+B;AACjE,SAAO,IAAI,SAAS,MAAM;AAC5B;","names":[]}

package/dist/index.d.cts

@@ -174,6 +174,83 @@ declare class VorimSDK {
     deleteApiKey(keyId: string): Promise<{
         revoked: boolean;
     }>;
+    /**
+     * Register an ephemeral agent with W3C did:key identity.
+     * The agent auto-expires after the specified TTL.
+     */
+    registerEphemeral(input: {
+        capabilities: string[];
+        scopes: string[];
+        ttl_seconds?: number;
+    }): Promise<any>;
+    /**
+     * Register an OAuth provider for credential delegation.
+     */
+    registerProvider(input: {
+        provider_key: string;
+        display_name?: string;
+        client_id: string;
+        client_secret: string;
+        auth_url: string;
+        token_url: string;
+        revoke_url?: string;
+        scopes_available?: string[];
+    }): Promise<any>;
+    /**
+     * List registered OAuth providers.
+     */
+    listProviders(): Promise<any[]>;
+    /**
+     * Store an OAuth connection (user's authorized tokens).
+     */
+    storeConnection(input: {
+        provider_id: string;
+        refresh_token: string;
+        scopes_granted: string[];
+        external_account_id?: string;
+    }): Promise<any>;
+    /**
+     * List OAuth connections.
+     */
+    listConnections(): Promise<any[]>;
+    /**
+     * Delegate a credential to an agent.
+     * The agent will be able to request short-lived access tokens
+     * for the delegated scopes without ever seeing the refresh token.
+     */
+    delegateCredential(input: {
+        connection_id: string;
+        agent_id: string;
+        scopes_delegated: string[];
+        max_requests_per_hr?: number;
+        valid_until?: string;
+    }): Promise<any>;
+    /**
+     * List credential delegations for the organisation or a specific agent.
+     */
+    listDelegations(agentId?: string): Promise<any[]>;
+    /**
+     * Revoke a credential delegation (cascades to delegation chains).
+     */
+    revokeDelegation(delegationId: string): Promise<{
+        revoked: boolean;
+    }>;
+    /**
+     * Request a short-lived access token for an agent.
+     * The agent must have an active credential delegation.
+     * The refresh token is never exposed — the platform proxies the request.
+     */
+    requestToken(input: {
+        agent_id: string;
+        scope: string;
+        provider_id?: string;
+    }): Promise<{
+        access_token: string;
+        token_type: string;
+        expires_in: number;
+        scope: string;
+        delegation_id: string;
+    }>;
     /**
      * Sign a payload with an Ed25519 private key (client-side).
      * Uses the Web Crypto API or Node.js crypto.

package/dist/index.d.ts

@@ -174,6 +174,83 @@ declare class VorimSDK {
     deleteApiKey(keyId: string): Promise<{
         revoked: boolean;
     }>;
+    /**
+     * Register an ephemeral agent with W3C did:key identity.
+     * The agent auto-expires after the specified TTL.
+     */
+    registerEphemeral(input: {
+        capabilities: string[];
+        scopes: string[];
+        ttl_seconds?: number;
+    }): Promise<any>;
+    /**
+     * Register an OAuth provider for credential delegation.
+     */
+    registerProvider(input: {
+        provider_key: string;
+        display_name?: string;
+        client_id: string;
+        client_secret: string;
+        auth_url: string;
+        token_url: string;
+        revoke_url?: string;
+        scopes_available?: string[];
+    }): Promise<any>;
+    /**
+     * List registered OAuth providers.
+     */
+    listProviders(): Promise<any[]>;
+    /**
+     * Store an OAuth connection (user's authorized tokens).
+     */
+    storeConnection(input: {
+        provider_id: string;
+        refresh_token: string;
+        scopes_granted: string[];
+        external_account_id?: string;
+    }): Promise<any>;
+    /**
+     * List OAuth connections.
+     */
+    listConnections(): Promise<any[]>;
+    /**
+     * Delegate a credential to an agent.
+     * The agent will be able to request short-lived access tokens
+     * for the delegated scopes without ever seeing the refresh token.
+     */
+    delegateCredential(input: {
+        connection_id: string;
+        agent_id: string;
+        scopes_delegated: string[];
+        max_requests_per_hr?: number;
+        valid_until?: string;
+    }): Promise<any>;
+    /**
+     * List credential delegations for the organisation or a specific agent.
+     */
+    listDelegations(agentId?: string): Promise<any[]>;
+    /**
+     * Revoke a credential delegation (cascades to delegation chains).
+     */
+    revokeDelegation(delegationId: string): Promise<{
+        revoked: boolean;
+    }>;
+    /**
+     * Request a short-lived access token for an agent.
+     * The agent must have an active credential delegation.
+     * The refresh token is never exposed — the platform proxies the request.
+     */
+    requestToken(input: {
+        agent_id: string;
+        scope: string;
+        provider_id?: string;
+    }): Promise<{
+        access_token: string;
+        token_type: string;
+        expires_in: number;
+        scope: string;
+        delegation_id: string;
+    }>;
     /**
      * Sign a payload with an Ed25519 private key (client-side).
      * Uses the Web Crypto API or Node.js crypto.

package/dist/index.js

@@ -124,6 +124,68 @@ var VorimSDK = class {
   async deleteApiKey(keyId) {
     return this.delete(`/api-keys/${keyId}`);
   }
+  // ─── Ephemeral Agents ──────────────────────────────────────────────
+  /**
+   * Register an ephemeral agent with W3C did:key identity.
+   * The agent auto-expires after the specified TTL.
+   */
+  async registerEphemeral(input) {
+    return this.post("/agents/ephemeral", input);
+  }
+  // ─── Credential Delegation ──────────────────────────────────────────
+  /**
+   * Register an OAuth provider for credential delegation.
+   */
+  async registerProvider(input) {
+    return this.post("/credentials/providers", input);
+  }
+  /**
+   * List registered OAuth providers.
+   */
+  async listProviders() {
+    return this.get("/credentials/providers");
+  }
+  /**
+   * Store an OAuth connection (user's authorized tokens).
+   */
+  async storeConnection(input) {
+    return this.post("/credentials/connections", input);
+  }
+  /**
+   * List OAuth connections.
+   */
+  async listConnections() {
+    return this.get("/credentials/connections");
+  }
+  /**
+   * Delegate a credential to an agent.
+   * The agent will be able to request short-lived access tokens
+   * for the delegated scopes without ever seeing the refresh token.
+   */
+  async delegateCredential(input) {
+    return this.post("/credentials/delegations", input);
+  }
+  /**
+   * List credential delegations for the organisation or a specific agent.
+   */
+  async listDelegations(agentId) {
+    const params = agentId ? `?agent_id=${agentId}` : "";
+    return this.get(`/credentials/delegations${params}`);
+  }
+  /**
+   * Revoke a credential delegation (cascades to delegation chains).
+   */
+  async revokeDelegation(delegationId) {
+    return this.delete(`/credentials/delegations/${delegationId}`);
+  }
+  /**
+   * Request a short-lived access token for an agent.
+   * The agent must have an active credential delegation.
+   * The refresh token is never exposed — the platform proxies the request.
+   */
+  async requestToken(input) {
+    return this.post("/credentials/token", input);
+  }
   // ─── Signing ──────────────────────────────────────────────────────
   /**
    * Sign a payload with an Ed25519 private key (client-side).

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — TypeScript\n// Thin client wrapping the Vorim AI REST API\n// ============================================================================\n\nimport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, PermissionScope, PermissionCheckResult,\n} from './types.js';\n\nexport interface VorimConfig {\n  apiKey: string;\n  baseUrl?: string;\n  timeout?: number;\n}\n\nexport class VorimSDK {\n  private apiKey: string;\n  private baseUrl: string;\n  private timeout: number;\n\n  constructor(config: VorimConfig) {\n    this.apiKey = config.apiKey;\n    this.baseUrl = (config.baseUrl || 'https://api.vorim.ai').replace(/\\/$/, '') + '/v1';\n    this.timeout = config.timeout || 10000;\n  }\n\n  // ─── Health Check ────────────────────────────────────────────────\n\n  /**\n   * Ping the Vorim API to verify connectivity and API key validity.\n   * Returns { status, timestamp } on success, throws VorimError on failure.\n   */\n  async ping(): Promise<{ status: string; timestamp: string }> {\n    const response = await fetch(`${this.baseUrl.replace('/v1', '')}/health`, {\n      headers: { 'User-Agent': 'vorim-sdk/2.1.0' },\n      signal: AbortSignal.timeout(this.timeout),\n    });\n    if (!response.ok) throw new VorimError(response.status, 'UNREACHABLE', 'Vorim API is not reachable');\n    return response.json() as Promise<{ status: string; timestamp: string }>;\n  }\n\n  // ─── Agent Identity ────────────────────────────────────────────────\n\n  /**\n   * Register a new agent with Vorim AI.\n   * Returns the agent identity and a private key (shown once).\n   */\n  async register(input: AgentRegistrationInput): Promise<AgentRegistrationResult> {\n    return this.post('/agents', input);\n  }\n\n  /**\n   * Verify an agent's identity via the public Trust API.\n   */\n  async verify(agentId: string): Promise<TrustRecord> {\n    return this.get(`/trust/verify/${agentId}`);\n  }\n\n  /**\n   * Get agent details.\n   */\n  async getAgent(agentId: string): Promise<Agent> {\n    return this.get(`/agents/${agentId}`);\n  }\n\n  /**\n   * List all agents in the organisation.\n   */\n  async listAgents(params?: { page?: number; per_page?: number; status?: string }): Promise<{ agents: Agent[]; meta: any }> {\n    const qs = new URLSearchParams(params as any).toString();\n    return this.get(`/agents${qs ? '?' + qs : ''}`);\n  }\n\n  /**\n   * Update an agent's metadata.\n   */\n  async updateAgent(agentId: string, updates: Partial<Pick<Agent, 'name' | 'description' | 'status' | 'capabilities'>>): Promise<Agent> {\n    return this.patch(`/agents/${agentId}`, updates);\n  }\n\n  /**\n   * Revoke an agent (permanent deactivation).\n   */\n  async revoke(agentId: string): Promise<void> {\n    await this.delete(`/agents/${agentId}`);\n  }\n\n  // ─── Permissions ──────────────────────────────────────────────────\n\n  /**\n   * Check if an agent has a specific permission scope.\n   * Target: < 5ms response via Redis cache.\n   */\n  async check(agentId: string, scope: PermissionScope): Promise<PermissionCheckResult> {\n    return this.post(`/agents/${agentId}/permissions/verify`, { scope });\n  }\n\n  /**\n   * Grant a permission scope to an agent.\n   */\n  async grant(agentId: string, scope: PermissionScope, options?: {\n    valid_until?: string;\n    rate_limit?: { max: number; window: string };\n  }): Promise<any> {\n    return this.post(`/agents/${agentId}/permissions`, { scope, ...options });\n  }\n\n  /**\n   * List all active permissions for an agent.\n   */\n  async listPermissions(agentId: string): Promise<any[]> {\n    return this.get(`/agents/${agentId}/permissions`);\n  }\n\n  /**\n   * Revoke a specific permission scope from an agent.\n   */\n  async revokePermission(agentId: string, scope: PermissionScope): Promise<any> {\n    return this.delete(`/agents/${agentId}/permissions/${scope}`);\n  }\n\n  // ─── Audit ────────────────────────────────────────────────────────\n\n  /**\n   * Emit an audit event for an agent action.\n   */\n  async emit(event: AuditEventInput): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events: [event] });\n  }\n\n  /**\n   * Emit a batch of audit events (up to 1,000).\n   */\n  async emitBatch(events: AuditEventInput[]): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events });\n  }\n\n  /**\n   * Export a signed audit bundle for a date range.\n   */\n  async exportAudit(from: string, to: string, format: string = 'json'): Promise<any> {\n    return this.post('/audit/export', { from, to, format });\n  }\n\n  // ─── API Keys ──────────────────────────────────────────────────────\n\n  /**\n   * List all API keys for the organisation.\n   */\n  async listApiKeys(): Promise<any[]> {\n    return this.get('/api-keys');\n  }\n\n  /**\n   * Create a new API key.\n   */\n  async createApiKey(name: string, options?: { scopes?: string[]; expires_at?: string }): Promise<any> {\n    return this.post('/api-keys', { name, ...options });\n  }\n\n  /**\n   * Revoke an API key.\n   */\n  async deleteApiKey(keyId: string): Promise<{ revoked: boolean }> {\n    return this.delete(`/api-keys/${keyId}`);\n  }\n\n  // ─── Signing ──────────────────────────────────────────────────────\n\n  /**\n   * Sign a payload with an Ed25519 private key (client-side).\n   * Uses the Web Crypto API or Node.js crypto.\n   */\n  async sign(payload: string, privateKeyPem: string): Promise<string> {\n    if (typeof globalThis.crypto?.subtle !== 'undefined') {\n      // Web Crypto API\n      const keyData = this.pemToArrayBuffer(privateKeyPem);\n      const key = await globalThis.crypto.subtle.importKey(\n        'pkcs8', keyData, { name: 'Ed25519' }, false, ['sign']\n      );\n      const signature = await globalThis.crypto.subtle.sign(\n        'Ed25519', key, new TextEncoder().encode(payload)\n      );\n      return `ed25519:${this.arrayBufferToBase64(signature)}`;\n    } else {\n      // Node.js crypto fallback\n      const crypto = await import('node:crypto');\n      const sign = crypto.sign(null, Buffer.from(payload), privateKeyPem);\n      return `ed25519:${sign.toString('base64')}`;\n    }\n  }\n\n  // ─── HTTP Client ──────────────────────────────────────────────────\n\n  private async get(path: string): Promise<any> {\n    return this.request('GET', path);\n  }\n\n  private async post(path: string, body: any): Promise<any> {\n    return this.request('POST', path, body);\n  }\n\n  private async patch(path: string, body: any): Promise<any> {\n    return this.request('PATCH', path, body);\n  }\n\n  private async delete(path: string): Promise<any> {\n    return this.request('DELETE', path);\n  }\n\n  private async request(method: string, path: string, body?: any): Promise<any> {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), this.timeout);\n\n    try {\n      const response = await fetch(`${this.baseUrl}${path}`, {\n        method,\n        headers: {\n          'Authorization': `Bearer ${this.apiKey}`,\n          'Content-Type': 'application/json',\n          'User-Agent': 'vorim-sdk/2.0.0',\n        },\n        body: body ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        const errBody = await response.json().catch(() => ({})) as Record<string, any>;\n        throw new VorimError(\n          response.status,\n          errBody.error?.code || 'UNKNOWN_ERROR',\n          errBody.error?.message || `HTTP ${response.status}`,\n          errBody.error?.details\n        );\n      }\n\n      const json = await response.json() as Record<string, any>;\n      return json.data;\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  private pemToArrayBuffer(pem: string): ArrayBuffer {\n    const b64 = pem.replace(/-----[^-]+-----/g, '').replace(/\\s/g, '');\n    const binary = atob(b64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes.buffer;\n  }\n\n  private arrayBufferToBase64(buffer: ArrayBuffer): string {\n    const bytes = new Uint8Array(buffer);\n    let binary = '';\n    for (const byte of bytes) {\n      binary += String.fromCharCode(byte);\n    }\n    return btoa(binary);\n  }\n}\n\nexport class VorimError extends Error {\n  constructor(\n    public status: number,\n    public code: string,\n    message: string,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VorimError';\n  }\n}\n\n// ─── Convenience export ──────────────────────────────────────────────\n\nexport default function createVorim(config: VorimConfig): VorimSDK {\n  return new VorimSDK(config);\n}\n\n// Re-export types for consumers\nexport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, AuditEventType, AuditResult,\n  PermissionScope, PermissionCheckResult, AgentStatus,\n} from './types.js';\n"],"mappings":";AAgBO,IAAM,WAAN,MAAe;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAAqB;AAC/B,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,WAAW,wBAAwB,QAAQ,OAAO,EAAE,IAAI;AAC/E,SAAK,UAAU,OAAO,WAAW;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAuD;AAC3D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,CAAC,WAAW;AAAA,MACxE,SAAS,EAAE,cAAc,kBAAkB;AAAA,MAC3C,QAAQ,YAAY,QAAQ,KAAK,OAAO;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,WAAW,SAAS,QAAQ,eAAe,4BAA4B;AACnG,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,OAAiE;AAC9E,WAAO,KAAK,KAAK,WAAW,KAAK;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAuC;AAClD,WAAO,KAAK,IAAI,iBAAiB,OAAO,EAAE;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,SAAiC;AAC9C,WAAO,KAAK,IAAI,WAAW,OAAO,EAAE;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAAyG;AACxH,UAAM,KAAK,IAAI,gBAAgB,MAAa,EAAE,SAAS;AACvD,WAAO,KAAK,IAAI,UAAU,KAAK,MAAM,KAAK,EAAE,EAAE;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,SAAiB,SAAmG;AACpI,WAAO,KAAK,MAAM,WAAW,OAAO,IAAI,OAAO;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAgC;AAC3C,UAAM,KAAK,OAAO,WAAW,OAAO,EAAE;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAM,SAAiB,OAAwD;AACnF,WAAO,KAAK,KAAK,WAAW,OAAO,uBAAuB,EAAE,MAAM,CAAC;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,SAAiB,OAAwB,SAGpC;AACf,WAAO,KAAK,KAAK,WAAW,OAAO,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,SAAiC;AACrD,WAAO,KAAK,IAAI,WAAW,OAAO,cAAc;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,SAAiB,OAAsC;AAC5E,WAAO,KAAK,OAAO,WAAW,OAAO,gBAAgB,KAAK,EAAE;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,OAAuD;AAChE,WAAO,KAAK,KAAK,iBAAiB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA0D;AACxE,WAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,MAAc,IAAY,SAAiB,QAAsB;AACjF,WAAO,KAAK,KAAK,iBAAiB,EAAE,MAAM,IAAI,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAA8B;AAClC,WAAO,KAAK,IAAI,WAAW;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,MAAc,SAAoE;AACnG,WAAO,KAAK,KAAK,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,OAA8C;AAC/D,WAAO,KAAK,OAAO,aAAa,KAAK,EAAE;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAK,SAAiB,eAAwC;AAClE,QAAI,OAAO,WAAW,QAAQ,WAAW,aAAa;AAEpD,YAAM,UAAU,KAAK,iBAAiB,aAAa;AACnD,YAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,QACzC;AAAA,QAAS;AAAA,QAAS,EAAE,MAAM,UAAU;AAAA,QAAG;AAAA,QAAO,CAAC,MAAM;AAAA,MACvD;AACA,YAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,QAC/C;AAAA,QAAW;AAAA,QAAK,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,MAClD;AACA,aAAO,WAAW,KAAK,oBAAoB,SAAS,CAAC;AAAA,IACvD,OAAO;AAEL,YAAM,SAAS,MAAM,OAAO,QAAa;AACzC,YAAM,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,OAAO,GAAG,aAAa;AAClE,aAAO,WAAW,KAAK,SAAS,QAAQ,CAAC;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,IAAI,MAA4B;AAC5C,WAAO,KAAK,QAAQ,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAc,KAAK,MAAc,MAAyB;AACxD,WAAO,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAAA,EACxC;AAAA,EAEA,MAAc,MAAM,MAAc,MAAyB;AACzD,WAAO,KAAK,QAAQ,SAAS,MAAM,IAAI;AAAA,EACzC;AAAA,EAEA,MAAc,OAAO,MAA4B;AAC/C,WAAO,KAAK,QAAQ,UAAU,IAAI;AAAA,EACpC;AAAA,EAEA,MAAc,QAAQ,QAAgB,MAAc,MAA0B;AAC5E,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,OAAO;AAEnE,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI,IAAI;AAAA,QACrD;AAAA,QACA,SAAS;AAAA,UACP,iBAAiB,UAAU,KAAK,MAAM;AAAA,UACtC,gBAAgB;AAAA,UAChB,cAAc;AAAA,QAChB;AAAA,QACA,MAAM,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACpC,QAAQ,WAAW;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACtD,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT,QAAQ,OAAO,QAAQ;AAAA,UACvB,QAAQ,OAAO,WAAW,QAAQ,SAAS,MAAM;AAAA,UACjD,QAAQ,OAAO;AAAA,QACjB;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,KAAK;AAAA,IACd,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAAA,EAEQ,iBAAiB,KAA0B;AACjD,UAAM,MAAM,IAAI,QAAQ,oBAAoB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACjE,UAAM,SAAS,KAAK,GAAG;AACvB,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,oBAAoB,QAA6B;AACvD,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,QAAI,SAAS;AACb,eAAW,QAAQ,OAAO;AACxB,gBAAU,OAAO,aAAa,IAAI;AAAA,IACpC;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAEO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACS,QACA,MACP,SACO,SACP;AACA,UAAM,OAAO;AALN;AACA;AAEA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAIe,SAAR,YAA6B,QAA+B;AACjE,SAAO,IAAI,SAAS,MAAM;AAC5B;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// ============================================================================\n// VORIM SDK — TypeScript\n// Thin client wrapping the Vorim AI REST API\n// ============================================================================\n\nimport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, PermissionScope, PermissionCheckResult,\n} from './types.js';\n\nexport interface VorimConfig {\n  apiKey: string;\n  baseUrl?: string;\n  timeout?: number;\n}\n\nexport class VorimSDK {\n  private apiKey: string;\n  private baseUrl: string;\n  private timeout: number;\n\n  constructor(config: VorimConfig) {\n    this.apiKey = config.apiKey;\n    this.baseUrl = (config.baseUrl || 'https://api.vorim.ai').replace(/\\/$/, '') + '/v1';\n    this.timeout = config.timeout || 10000;\n  }\n\n  // ─── Health Check ────────────────────────────────────────────────\n\n  /**\n   * Ping the Vorim API to verify connectivity and API key validity.\n   * Returns { status, timestamp } on success, throws VorimError on failure.\n   */\n  async ping(): Promise<{ status: string; timestamp: string }> {\n    const response = await fetch(`${this.baseUrl.replace('/v1', '')}/health`, {\n      headers: { 'User-Agent': 'vorim-sdk/2.1.0' },\n      signal: AbortSignal.timeout(this.timeout),\n    });\n    if (!response.ok) throw new VorimError(response.status, 'UNREACHABLE', 'Vorim API is not reachable');\n    return response.json() as Promise<{ status: string; timestamp: string }>;\n  }\n\n  // ─── Agent Identity ────────────────────────────────────────────────\n\n  /**\n   * Register a new agent with Vorim AI.\n   * Returns the agent identity and a private key (shown once).\n   */\n  async register(input: AgentRegistrationInput): Promise<AgentRegistrationResult> {\n    return this.post('/agents', input);\n  }\n\n  /**\n   * Verify an agent's identity via the public Trust API.\n   */\n  async verify(agentId: string): Promise<TrustRecord> {\n    return this.get(`/trust/verify/${agentId}`);\n  }\n\n  /**\n   * Get agent details.\n   */\n  async getAgent(agentId: string): Promise<Agent> {\n    return this.get(`/agents/${agentId}`);\n  }\n\n  /**\n   * List all agents in the organisation.\n   */\n  async listAgents(params?: { page?: number; per_page?: number; status?: string }): Promise<{ agents: Agent[]; meta: any }> {\n    const qs = new URLSearchParams(params as any).toString();\n    return this.get(`/agents${qs ? '?' + qs : ''}`);\n  }\n\n  /**\n   * Update an agent's metadata.\n   */\n  async updateAgent(agentId: string, updates: Partial<Pick<Agent, 'name' | 'description' | 'status' | 'capabilities'>>): Promise<Agent> {\n    return this.patch(`/agents/${agentId}`, updates);\n  }\n\n  /**\n   * Revoke an agent (permanent deactivation).\n   */\n  async revoke(agentId: string): Promise<void> {\n    await this.delete(`/agents/${agentId}`);\n  }\n\n  // ─── Permissions ──────────────────────────────────────────────────\n\n  /**\n   * Check if an agent has a specific permission scope.\n   * Target: < 5ms response via Redis cache.\n   */\n  async check(agentId: string, scope: PermissionScope): Promise<PermissionCheckResult> {\n    return this.post(`/agents/${agentId}/permissions/verify`, { scope });\n  }\n\n  /**\n   * Grant a permission scope to an agent.\n   */\n  async grant(agentId: string, scope: PermissionScope, options?: {\n    valid_until?: string;\n    rate_limit?: { max: number; window: string };\n  }): Promise<any> {\n    return this.post(`/agents/${agentId}/permissions`, { scope, ...options });\n  }\n\n  /**\n   * List all active permissions for an agent.\n   */\n  async listPermissions(agentId: string): Promise<any[]> {\n    return this.get(`/agents/${agentId}/permissions`);\n  }\n\n  /**\n   * Revoke a specific permission scope from an agent.\n   */\n  async revokePermission(agentId: string, scope: PermissionScope): Promise<any> {\n    return this.delete(`/agents/${agentId}/permissions/${scope}`);\n  }\n\n  // ─── Audit ────────────────────────────────────────────────────────\n\n  /**\n   * Emit an audit event for an agent action.\n   */\n  async emit(event: AuditEventInput): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events: [event] });\n  }\n\n  /**\n   * Emit a batch of audit events (up to 1,000).\n   */\n  async emitBatch(events: AuditEventInput[]): Promise<{ ingested: number }> {\n    return this.post('/audit/events', { events });\n  }\n\n  /**\n   * Export a signed audit bundle for a date range.\n   */\n  async exportAudit(from: string, to: string, format: string = 'json'): Promise<any> {\n    return this.post('/audit/export', { from, to, format });\n  }\n\n  // ─── API Keys ──────────────────────────────────────────────────────\n\n  /**\n   * List all API keys for the organisation.\n   */\n  async listApiKeys(): Promise<any[]> {\n    return this.get('/api-keys');\n  }\n\n  /**\n   * Create a new API key.\n   */\n  async createApiKey(name: string, options?: { scopes?: string[]; expires_at?: string }): Promise<any> {\n    return this.post('/api-keys', { name, ...options });\n  }\n\n  /**\n   * Revoke an API key.\n   */\n  async deleteApiKey(keyId: string): Promise<{ revoked: boolean }> {\n    return this.delete(`/api-keys/${keyId}`);\n  }\n\n  // ─── Ephemeral Agents ──────────────────────────────────────────────\n\n  /**\n   * Register an ephemeral agent with W3C did:key identity.\n   * The agent auto-expires after the specified TTL.\n   */\n  async registerEphemeral(input: {\n    capabilities: string[];\n    scopes: string[];\n    ttl_seconds?: number;\n  }): Promise<any> {\n    return this.post('/agents/ephemeral', input);\n  }\n\n  // ─── Credential Delegation ──────────────────────────────────────────\n\n  /**\n   * Register an OAuth provider for credential delegation.\n   */\n  async registerProvider(input: {\n    provider_key: string;\n    display_name?: string;\n    client_id: string;\n    client_secret: string;\n    auth_url: string;\n    token_url: string;\n    revoke_url?: string;\n    scopes_available?: string[];\n  }): Promise<any> {\n    return this.post('/credentials/providers', input);\n  }\n\n  /**\n   * List registered OAuth providers.\n   */\n  async listProviders(): Promise<any[]> {\n    return this.get('/credentials/providers');\n  }\n\n  /**\n   * Store an OAuth connection (user's authorized tokens).\n   */\n  async storeConnection(input: {\n    provider_id: string;\n    refresh_token: string;\n    scopes_granted: string[];\n    external_account_id?: string;\n  }): Promise<any> {\n    return this.post('/credentials/connections', input);\n  }\n\n  /**\n   * List OAuth connections.\n   */\n  async listConnections(): Promise<any[]> {\n    return this.get('/credentials/connections');\n  }\n\n  /**\n   * Delegate a credential to an agent.\n   * The agent will be able to request short-lived access tokens\n   * for the delegated scopes without ever seeing the refresh token.\n   */\n  async delegateCredential(input: {\n    connection_id: string;\n    agent_id: string;\n    scopes_delegated: string[];\n    max_requests_per_hr?: number;\n    valid_until?: string;\n  }): Promise<any> {\n    return this.post('/credentials/delegations', input);\n  }\n\n  /**\n   * List credential delegations for the organisation or a specific agent.\n   */\n  async listDelegations(agentId?: string): Promise<any[]> {\n    const params = agentId ? `?agent_id=${agentId}` : '';\n    return this.get(`/credentials/delegations${params}`);\n  }\n\n  /**\n   * Revoke a credential delegation (cascades to delegation chains).\n   */\n  async revokeDelegation(delegationId: string): Promise<{ revoked: boolean }> {\n    return this.delete(`/credentials/delegations/${delegationId}`);\n  }\n\n  /**\n   * Request a short-lived access token for an agent.\n   * The agent must have an active credential delegation.\n   * The refresh token is never exposed — the platform proxies the request.\n   */\n  async requestToken(input: {\n    agent_id: string;\n    scope: string;\n    provider_id?: string;\n  }): Promise<{\n    access_token: string;\n    token_type: string;\n    expires_in: number;\n    scope: string;\n    delegation_id: string;\n  }> {\n    return this.post('/credentials/token', input);\n  }\n\n  // ─── Signing ──────────────────────────────────────────────────────\n\n  /**\n   * Sign a payload with an Ed25519 private key (client-side).\n   * Uses the Web Crypto API or Node.js crypto.\n   */\n  async sign(payload: string, privateKeyPem: string): Promise<string> {\n    if (typeof globalThis.crypto?.subtle !== 'undefined') {\n      // Web Crypto API\n      const keyData = this.pemToArrayBuffer(privateKeyPem);\n      const key = await globalThis.crypto.subtle.importKey(\n        'pkcs8', keyData, { name: 'Ed25519' }, false, ['sign']\n      );\n      const signature = await globalThis.crypto.subtle.sign(\n        'Ed25519', key, new TextEncoder().encode(payload)\n      );\n      return `ed25519:${this.arrayBufferToBase64(signature)}`;\n    } else {\n      // Node.js crypto fallback\n      const crypto = await import('node:crypto');\n      const sign = crypto.sign(null, Buffer.from(payload), privateKeyPem);\n      return `ed25519:${sign.toString('base64')}`;\n    }\n  }\n\n  // ─── HTTP Client ──────────────────────────────────────────────────\n\n  private async get(path: string): Promise<any> {\n    return this.request('GET', path);\n  }\n\n  private async post(path: string, body: any): Promise<any> {\n    return this.request('POST', path, body);\n  }\n\n  private async patch(path: string, body: any): Promise<any> {\n    return this.request('PATCH', path, body);\n  }\n\n  private async delete(path: string): Promise<any> {\n    return this.request('DELETE', path);\n  }\n\n  private async request(method: string, path: string, body?: any): Promise<any> {\n    const controller = new AbortController();\n    const timeoutId = setTimeout(() => controller.abort(), this.timeout);\n\n    try {\n      const response = await fetch(`${this.baseUrl}${path}`, {\n        method,\n        headers: {\n          'Authorization': `Bearer ${this.apiKey}`,\n          'Content-Type': 'application/json',\n          'User-Agent': 'vorim-sdk/2.0.0',\n        },\n        body: body ? JSON.stringify(body) : undefined,\n        signal: controller.signal,\n      });\n\n      if (!response.ok) {\n        const errBody = await response.json().catch(() => ({})) as Record<string, any>;\n        throw new VorimError(\n          response.status,\n          errBody.error?.code || 'UNKNOWN_ERROR',\n          errBody.error?.message || `HTTP ${response.status}`,\n          errBody.error?.details\n        );\n      }\n\n      const json = await response.json() as Record<string, any>;\n      return json.data;\n    } finally {\n      clearTimeout(timeoutId);\n    }\n  }\n\n  private pemToArrayBuffer(pem: string): ArrayBuffer {\n    const b64 = pem.replace(/-----[^-]+-----/g, '').replace(/\\s/g, '');\n    const binary = atob(b64);\n    const bytes = new Uint8Array(binary.length);\n    for (let i = 0; i < binary.length; i++) {\n      bytes[i] = binary.charCodeAt(i);\n    }\n    return bytes.buffer;\n  }\n\n  private arrayBufferToBase64(buffer: ArrayBuffer): string {\n    const bytes = new Uint8Array(buffer);\n    let binary = '';\n    for (const byte of bytes) {\n      binary += String.fromCharCode(byte);\n    }\n    return btoa(binary);\n  }\n}\n\nexport class VorimError extends Error {\n  constructor(\n    public status: number,\n    public code: string,\n    message: string,\n    public details?: Record<string, unknown>\n  ) {\n    super(message);\n    this.name = 'VorimError';\n  }\n}\n\n// ─── Convenience export ──────────────────────────────────────────────\n\nexport default function createVorim(config: VorimConfig): VorimSDK {\n  return new VorimSDK(config);\n}\n\n// Re-export types for consumers\nexport type {\n  Agent, AgentRegistrationInput, AgentRegistrationResult,\n  TrustRecord, AuditEventInput, AuditEventType, AuditResult,\n  PermissionScope, PermissionCheckResult, AgentStatus,\n} from './types.js';\n"],"mappings":";AAgBO,IAAM,WAAN,MAAe;AAAA,EACZ;AAAA,EACA;AAAA,EACA;AAAA,EAER,YAAY,QAAqB;AAC/B,SAAK,SAAS,OAAO;AACrB,SAAK,WAAW,OAAO,WAAW,wBAAwB,QAAQ,OAAO,EAAE,IAAI;AAC/E,SAAK,UAAU,OAAO,WAAW;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,OAAuD;AAC3D,UAAM,WAAW,MAAM,MAAM,GAAG,KAAK,QAAQ,QAAQ,OAAO,EAAE,CAAC,WAAW;AAAA,MACxE,SAAS,EAAE,cAAc,kBAAkB;AAAA,MAC3C,QAAQ,YAAY,QAAQ,KAAK,OAAO;AAAA,IAC1C,CAAC;AACD,QAAI,CAAC,SAAS,GAAI,OAAM,IAAI,WAAW,SAAS,QAAQ,eAAe,4BAA4B;AACnG,WAAO,SAAS,KAAK;AAAA,EACvB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,SAAS,OAAiE;AAC9E,WAAO,KAAK,KAAK,WAAW,KAAK;AAAA,EACnC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAuC;AAClD,WAAO,KAAK,IAAI,iBAAiB,OAAO,EAAE;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,SAAS,SAAiC;AAC9C,WAAO,KAAK,IAAI,WAAW,OAAO,EAAE;AAAA,EACtC;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,WAAW,QAAyG;AACxH,UAAM,KAAK,IAAI,gBAAgB,MAAa,EAAE,SAAS;AACvD,WAAO,KAAK,IAAI,UAAU,KAAK,MAAM,KAAK,EAAE,EAAE;AAAA,EAChD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,SAAiB,SAAmG;AACpI,WAAO,KAAK,MAAM,WAAW,OAAO,IAAI,OAAO;AAAA,EACjD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,OAAO,SAAgC;AAC3C,UAAM,KAAK,OAAO,WAAW,OAAO,EAAE;AAAA,EACxC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,MAAM,SAAiB,OAAwD;AACnF,WAAO,KAAK,KAAK,WAAW,OAAO,uBAAuB,EAAE,MAAM,CAAC;AAAA,EACrE;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,MAAM,SAAiB,OAAwB,SAGpC;AACf,WAAO,KAAK,KAAK,WAAW,OAAO,gBAAgB,EAAE,OAAO,GAAG,QAAQ,CAAC;AAAA,EAC1E;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,SAAiC;AACrD,WAAO,KAAK,IAAI,WAAW,OAAO,cAAc;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,SAAiB,OAAsC;AAC5E,WAAO,KAAK,OAAO,WAAW,OAAO,gBAAgB,KAAK,EAAE;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,KAAK,OAAuD;AAChE,WAAO,KAAK,KAAK,iBAAiB,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;AAAA,EACvD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,UAAU,QAA0D;AACxE,WAAO,KAAK,KAAK,iBAAiB,EAAE,OAAO,CAAC;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,YAAY,MAAc,IAAY,SAAiB,QAAsB;AACjF,WAAO,KAAK,KAAK,iBAAiB,EAAE,MAAM,IAAI,OAAO,CAAC;AAAA,EACxD;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,cAA8B;AAClC,WAAO,KAAK,IAAI,WAAW;AAAA,EAC7B;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,MAAc,SAAoE;AACnG,WAAO,KAAK,KAAK,aAAa,EAAE,MAAM,GAAG,QAAQ,CAAC;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,aAAa,OAA8C;AAC/D,WAAO,KAAK,OAAO,aAAa,KAAK,EAAE;AAAA,EACzC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,kBAAkB,OAIP;AACf,WAAO,KAAK,KAAK,qBAAqB,KAAK;AAAA,EAC7C;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,iBAAiB,OASN;AACf,WAAO,KAAK,KAAK,0BAA0B,KAAK;AAAA,EAClD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgC;AACpC,WAAO,KAAK,IAAI,wBAAwB;AAAA,EAC1C;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,OAKL;AACf,WAAO,KAAK,KAAK,4BAA4B,KAAK;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,kBAAkC;AACtC,WAAO,KAAK,IAAI,0BAA0B;AAAA,EAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,mBAAmB,OAMR;AACf,WAAO,KAAK,KAAK,4BAA4B,KAAK;AAAA,EACpD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,gBAAgB,SAAkC;AACtD,UAAM,SAAS,UAAU,aAAa,OAAO,KAAK;AAClD,WAAO,KAAK,IAAI,2BAA2B,MAAM,EAAE;AAAA,EACrD;AAAA;AAAA;AAAA;AAAA,EAKA,MAAM,iBAAiB,cAAqD;AAC1E,WAAO,KAAK,OAAO,4BAA4B,YAAY,EAAE;AAAA,EAC/D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,aAAa,OAUhB;AACD,WAAO,KAAK,KAAK,sBAAsB,KAAK;AAAA,EAC9C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,KAAK,SAAiB,eAAwC;AAClE,QAAI,OAAO,WAAW,QAAQ,WAAW,aAAa;AAEpD,YAAM,UAAU,KAAK,iBAAiB,aAAa;AACnD,YAAM,MAAM,MAAM,WAAW,OAAO,OAAO;AAAA,QACzC;AAAA,QAAS;AAAA,QAAS,EAAE,MAAM,UAAU;AAAA,QAAG;AAAA,QAAO,CAAC,MAAM;AAAA,MACvD;AACA,YAAM,YAAY,MAAM,WAAW,OAAO,OAAO;AAAA,QAC/C;AAAA,QAAW;AAAA,QAAK,IAAI,YAAY,EAAE,OAAO,OAAO;AAAA,MAClD;AACA,aAAO,WAAW,KAAK,oBAAoB,SAAS,CAAC;AAAA,IACvD,OAAO;AAEL,YAAM,SAAS,MAAM,OAAO,QAAa;AACzC,YAAM,OAAO,OAAO,KAAK,MAAM,OAAO,KAAK,OAAO,GAAG,aAAa;AAClE,aAAO,WAAW,KAAK,SAAS,QAAQ,CAAC;AAAA,IAC3C;AAAA,EACF;AAAA;AAAA,EAIA,MAAc,IAAI,MAA4B;AAC5C,WAAO,KAAK,QAAQ,OAAO,IAAI;AAAA,EACjC;AAAA,EAEA,MAAc,KAAK,MAAc,MAAyB;AACxD,WAAO,KAAK,QAAQ,QAAQ,MAAM,IAAI;AAAA,EACxC;AAAA,EAEA,MAAc,MAAM,MAAc,MAAyB;AACzD,WAAO,KAAK,QAAQ,SAAS,MAAM,IAAI;AAAA,EACzC;AAAA,EAEA,MAAc,OAAO,MAA4B;AAC/C,WAAO,KAAK,QAAQ,UAAU,IAAI;AAAA,EACpC;AAAA,EAEA,MAAc,QAAQ,QAAgB,MAAc,MAA0B;AAC5E,UAAM,aAAa,IAAI,gBAAgB;AACvC,UAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,KAAK,OAAO;AAEnE,QAAI;AACF,YAAM,WAAW,MAAM,MAAM,GAAG,KAAK,OAAO,GAAG,IAAI,IAAI;AAAA,QACrD;AAAA,QACA,SAAS;AAAA,UACP,iBAAiB,UAAU,KAAK,MAAM;AAAA,UACtC,gBAAgB;AAAA,UAChB,cAAc;AAAA,QAChB;AAAA,QACA,MAAM,OAAO,KAAK,UAAU,IAAI,IAAI;AAAA,QACpC,QAAQ,WAAW;AAAA,MACrB,CAAC;AAED,UAAI,CAAC,SAAS,IAAI;AAChB,cAAM,UAAU,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACtD,cAAM,IAAI;AAAA,UACR,SAAS;AAAA,UACT,QAAQ,OAAO,QAAQ;AAAA,UACvB,QAAQ,OAAO,WAAW,QAAQ,SAAS,MAAM;AAAA,UACjD,QAAQ,OAAO;AAAA,QACjB;AAAA,MACF;AAEA,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,aAAO,KAAK;AAAA,IACd,UAAE;AACA,mBAAa,SAAS;AAAA,IACxB;AAAA,EACF;AAAA,EAEQ,iBAAiB,KAA0B;AACjD,UAAM,MAAM,IAAI,QAAQ,oBAAoB,EAAE,EAAE,QAAQ,OAAO,EAAE;AACjE,UAAM,SAAS,KAAK,GAAG;AACvB,UAAM,QAAQ,IAAI,WAAW,OAAO,MAAM;AAC1C,aAAS,IAAI,GAAG,IAAI,OAAO,QAAQ,KAAK;AACtC,YAAM,CAAC,IAAI,OAAO,WAAW,CAAC;AAAA,IAChC;AACA,WAAO,MAAM;AAAA,EACf;AAAA,EAEQ,oBAAoB,QAA6B;AACvD,UAAM,QAAQ,IAAI,WAAW,MAAM;AACnC,QAAI,SAAS;AACb,eAAW,QAAQ,OAAO;AACxB,gBAAU,OAAO,aAAa,IAAI;AAAA,IACpC;AACA,WAAO,KAAK,MAAM;AAAA,EACpB;AACF;AAEO,IAAM,aAAN,cAAyB,MAAM;AAAA,EACpC,YACS,QACA,MACP,SACO,SACP;AACA,UAAM,OAAO;AALN;AACA;AAEA;AAGP,SAAK,OAAO;AAAA,EACd;AACF;AAIe,SAAR,YAA6B,QAA+B;AACjE,SAAO,IAAI,SAAS,MAAM;AAC5B;","names":[]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vorim/sdk",
-  "version": "2.3.0",
+  "version": "3.0.0",
   "description": "Official TypeScript SDK for Vorim AI — AI Agent Identity, Permissions & Audit",
   "type": "module",
   "main": "dist/index.cjs",