@phyi/sdk

TypeScript SDK for the Phylax API. Package verification, policy evaluation, attestations, and plan aware quota handling.

@phyi/sdk is the canonical JavaScript and TypeScript client for the Phylax API. It exists so any Node application, whether that is your build pipeline, your registry tooling, or your own security gate, can verify what your software depends on without hand rolling auth, retries, redaction, and response shapes. The SDK is consumed by the Phylax CLI, MCP server, VS Code extension, Chrome extension, and GitHub Action.

Install

npm install @phyi/sdk

Usage

import { PhylaxSdk } from '@phyi/sdk'

const phylax = new PhylaxSdk({
  apiToken: process.env.PHYLAX_API_TOKEN,
  maxRetries: 3,
  timeoutMs: 30_000,
})

// Verify one package before you install it.
const result = await phylax.artifacts.verify('pkg:npm/[email protected]')

if (!result.success) {
  console.error(`${result.code}: ${result.error}`)
} else if (result.data.verdict === 'BLOCK') {
  console.error(`Blocked: ${result.data.artifact}`)
  process.exit(1)
}

// Verify a whole dependency tree in one call.
const batch = await phylax.artifacts.verifyMany([
  'pkg:npm/[email protected]',
  'pkg:pypi/[email protected]',
])

// Evaluate against your organization policy.
const decision = await phylax.policies.evaluate({
  artifact: 'pkg:npm/[email protected]',
  policy: 'prod-runtime-policy',
})

const entitlements = await phylax.quota.entitlements()

if (entitlements.success) {
  const check = phylax.quota.checkAccess('policies.evaluate', entitlements.data)

  if (!check.allowed) {
    console.error(check.reasons.join('; '))
  }
}

import { verifySignature } from '@phyi/sdk'

const result = verifySignature({
  rawBody,
  signature: req.headers['x-phylax-signature'],
  timestamp: req.headers['x-phylax-timestamp'],
  secret: process.env.PHYLAX_WEBHOOK_SECRET,
})

if (!result.valid) {
  return res.writeHead(401).end(result.reason)
}

Development

npm install
npm run typecheck
npm test
npm run build

Documentation map

| Guide | Description | | --- | --- | | API reference | Every resource and method | | Plans and quota | Permissions, plan tiers, quota costs | | Errors and retries | Error codes, retry policy, backoff | | Webhooks | Signature verification and replay protection |

License

MIT