@x12i/credorix-client

The Credorix SDK for token leases, request brokering, local auth injection, a single safe retry after a 401, and Memorix connector-framework ports (createGovernedCredentialProvider / createGovernedHttpPort).

Semver policy (connector capabilities)

• Additive methods and non-breaking field additions: minor
• Adding, removing, or renaming CredentialCapability kinds: major
• Docs-only pins (@x12i/credorix-docs) are not a substitute for this runtime package

Classic lease / broker client

import { createCredorixClient } from "@x12i/credorix-client";

const credorix = createCredorixClient({
  serviceUrl: "http://credorix:9202",
  callerId: "service:risk-worker",
  callerToken: process.env.CREDORIX_CALLER_TOKEN!,
});

const response = await credorix.fetch("https://api.example.com/data", {
  method: "POST",
  authRef: "vendor-api",
  body: { query: "example" },
});

Worker env helpers

Workers that read CREDORIX_BASE_URL / CREDORIX_CALLER_ID / CREDORIX_CALLER_TOKEN can use the env-wired helpers (also re-exported from @x12i/credorix):

import {
  createWorkerCredorixClient,
  leaseForAuthRef,
  fetchSanitizedProfile,
  loadEnvFile,
} from "@x12i/credorix-client";

loadEnvFile(); // optional: walk up from cwd for nearest .env

const client = createWorkerCredorixClient();
const lease = await leaseForAuthRef("vendor-api");
const profile = await fetchSanitizedProfile("vendor-api");

// Simulation: set CREDORIX_USE_STUBS=true and inject fetch (no bundled simulator)
const sim = createWorkerCredorixClient(
  { CREDORIX_USE_STUBS: "true" },
  { fetchImplementation: mySimulatedFetch },
);

Also: transport-lease wrappers, isCredorixConfigured, material extractors (bearerAccessToken, apiKeyValue, basicParts), and baseUrlFromProfile.

Connector host ports (CRX-CF / memorix-connector/1)

Replace Memorix local stubs with Credorix ports — connectors receive purpose-bound capabilities, never unbounded secret bags:

import {
  createGovernedCredentialProvider,
  createGovernedHttpPort,
} from "@x12i/credorix-client";

const credentials = createGovernedCredentialProvider({
  serviceUrl: "http://credorix:9202",
  callerId: "service:memorix-host",
  callerToken: process.env.CREDORIX_CALLER_TOKEN!,
});

const delegation = await credentials.mintDelegation({
  organizationId: "org-1",
  sourceId: "src-jira",
  connectorId: "jira-cloud",
  connectorVersion: "1.0.0",
  authRef: "jira-api",
  purposes: ["provider-http"],
  allowedOrigins: ["https://api.atlassian.com"],
  correlation: { runId: "run-1", invocationId: "inv-1" },
});

const capability = await credentials.resolve(delegation.delegationId, {
  purpose: "provider-http",
});

const http = createGovernedHttpPort({
  serviceUrl: "http://credorix:9202",
  callerId: "service:memorix-host",
  callerToken: process.env.CREDORIX_CALLER_TOKEN!,
  delegationId: delegation.delegationId,
});

if (capability.kind === "brokered-fetch") {
  const result = await http.fetch({
    url: "https://api.atlassian.com/ex/jira/…",
    method: "GET",
  });
}

await credentials.invalidate(delegation.delegationId, "run_canceled");