@ujexdev/client

TypeScript client for the Ujex control plane. The stable first-run surface is Postbox + Approvals + Audit + Memory; secondary namespaces remain available for advanced deployments.

Install

npm install @ujexdev/client firebase

Mint an agent

On https://app.ujex.dev/settings → Create agent. Save the returned agentId and deviceKey — the key is shown once.

Use

import {UjexClient} from '@ujexdev/client';

const ap = new UjexClient({
  firebase: {
    apiKey: 'AIzaSy...',
    authDomain: 'axy-ujex.firebaseapp.com',
    projectId: 'axy-ujex',
    appId: '1:...:web:...',
  },
  agentId: process.env.AP_AGENT_ID!,
  deviceKey: process.env.AP_DEVICE_KEY!,
});

await ap.connect();

// send email, optionally gated by human approval
await ap.postbox.send({
  to: ['[email protected]'],
  subject: 'hi',
  body: '...',
  sessionId: 'sess_run_20260618_001',
  requireHuman: true,
});

// ask a human for approval
const {id} = await ap.mobile.ask({prompt: 'Transfer $50?', ttlSec: 300});

// write and search durable Memory
await ap.memory.write({
  name: 'vendor-acme',
  type: 'project',
  content: 'Acme prefers invoices on Friday.',
  sessionId: 'sess_run_20260618_001',
});
const {hits} = await ap.memory.search({
  query: 'invoice preference',
  k: 5,
  sessionId: 'sess_run_20260618_001',
});

// secondary: dynamic DNS + HTTPS
await ap.gateway.updateIp({fqdn: 'mynode.duckdns.org', ip: '203.0.113.4'});
await ap.gateway.issue({fqdn: 'mynode.duckdns.org', staging: true});
const {certPem, keyPem} = await ap.gateway.getCert({fqdn: 'mynode.duckdns.org'});

// KMS-backed secrets
await ap.secrets.store({agentId: 'me', name: 'openai_key', value: 'sk-...'});
const {value} = await ap.secrets.get({name: 'openai_key', sessionId: 'sess_run_20260618_001'});

Subsystems

| Namespace | What it does | |-----------|--------------| | postbox | Agent email — inbound webhooks, outbound relay, approval-gated sends, prompt-injection risk signals | | mobile | Ask a human, receive a decision, and audit the result | | memory | Primary Markdown-first Memory surface: list/read/write/append/delete/search/index | | recall | Legacy episodic + factual aliases kept for compatibility | | gateway | Advanced compatibility surface: DuckDNS updates + Let's Encrypt certs (DNS-01) | | artifacts | Signed URLs, grants, TTL reaping | | scheduler | Cron jobs with HMAC-signed webhooks | | secrets | Cloud KMS envelope encryption |

Generate one stable sessionId per agent run and pass it to every outbound send, tool invocation, secret read, and memory operation. Ujex uses it for prompt-injection poisoning, exfiltration checks, approval binding, and budget preflight.

Rotating keys

Device keys are hashed; the plaintext is only shown at mint time. Rotate via rotateDeviceKey (human-only) from the dashboard.