MOSS Partner SDK for TypeScript

Official TypeScript SDK for the MOSS Partner API. Manage customers, configure governance, and monitor compliance.

⚠️ Authorization Required

This SDK is restricted to authorized MOSS partners only. You must have:

• A valid MOSS Partner Agreement
• An active partner API key (prt_xxx)

To become a partner, visit https://mosscomputing.com/partners

Installation

npm install moss-partner-sdk

Quick Start

import { MossPartner } from 'moss-partner-sdk';

const moss = new MossPartner({
  apiKey: process.env.MOSS_PARTNER_KEY, // prt_xxx
});

// Create a customer
const customer = await moss.customers.create({
  externalId: 'acme_123',
  name: 'Acme Corp',
  email: '[email protected]',
  governance: {
    jurisdictions: ['EU', 'US'],
    frameworks: ['eu_ai_act', 'nist_ai_rmf'],
  },
});

console.log(customer.sandboxToken); // Give this to your customer

Features

• ✅ Type-safe - Full TypeScript types for all API operations
• ✅ Async-first - Modern async/await API
• ✅ Zero-config - Sensible defaults, works out of the box
• ✅ Fail-safe - Automatic retries with exponential backoff
• ✅ Observable - Built-in logging and metrics hooks
• ✅ Testable - Test mode for unit testing

API Reference

Configuration

const moss = new MossPartner({
  apiKey: 'prt_xxx',              // Required: Partner API key
  baseUrl: 'https://api.mosscomputing.com', // Optional: API base URL
  timeout: 30000,                 // Optional: Request timeout (ms)
  retries: 3,                     // Optional: Number of retries
  logger: console,                // Optional: Custom logger
  testMode: false,                // Optional: Enable test mode
});

Customer Management

Create Customer

const customer = await moss.customers.create({
  externalId: 'acme_123',
  name: 'Acme Corp',
  email: '[email protected]',
  governance: {
    jurisdictions: ['EU', 'US'],
    frameworks: ['eu_ai_act', 'nist_ai_rmf'],
  },
});

List Customers

const result = await moss.customers.list({
  status: 'production_active',
  limit: 100,
});

for (const customer of result.data) {
  console.log(`${customer.name}: ${customer.compliance.score}`);
}

Get Customer

const customer = await moss.customers.get('cust_aaa');

Update Customer

await moss.customers.update('cust_aaa', {
  limits: { agents: 50 },
});

Promote to Production

const promoted = await moss.customers.promote('cust_aaa', {
  attestation: {
    kycCompleted: true,
    termsAccepted: true,
    complianceReviewed: true,
    attestedBy: '[email protected]',
  },
  billing: {
    tier: 'platform',
    billingEmail: '[email protected]',
  },
});

console.log(promoted.productionToken);

Suspend Customer

await moss.customers.suspend('cust_aaa', {
  reason: 'payment_failed',
  gracePeriodHours: 72,
});

Reactivate Customer

await moss.customers.reactivate('cust_aaa', {
  resolution: {
    issueResolved: true,
    resolutionType: 'payment_received',
  },
});

Session Tokens (M3)

Create short-lived session tokens for temporary customer delegation:

const session = await moss.customers.createSession('cust_aaa', {
  purpose: 'Dashboard access',
  ttlSeconds: 300, // 5 minutes (max 900)
});

console.log(session.sessionToken);
console.log(session.expiresAt);

Revoke a session:

await moss.customers.revokeSession('cust_aaa', 'sess_token_xxx');

Token Introspection (M3)

Validate tokens using RFC 7662:

const result = await moss.introspectToken({ token: 'cust_xxx' });

if (result.active) {
  console.log(`Token valid for: ${result.sub}`);
  console.log(`Expires: ${new Date(result.exp * 1000)}`);
} else {
  console.log('Token inactive or invalid');
}

Compliance Reports (M3)

Generate ML-DSA-44 signed compliance reports:

const report = await moss.customers.complianceReport('cust_aaa', {
  format: 'pdf',
  frameworks: ['eu_ai_act'],
});

console.log(report.downloadUrl);  // Signed download URL
console.log(report.signature);    // ML-DSA-44 signature
console.log(report.keyId);        // Signing key ID

Webhooks

Create Webhook

const webhook = await moss.webhooks.create({
  url: 'https://yourcompany.com/webhooks/moss',
  events: ['customer.*', 'agent.anomaly_detected', 'policy.violation'],
  secret: 'whsec_xxx', // Optional, auto-generated if not provided
});

List Webhooks

const webhooks = await moss.webhooks.list();

Verify Webhook Signature

// Express example
app.post('/webhooks/moss', (req, res) => {
  const signature = req.headers['x-moss-signature'];
  const timestamp = req.headers['x-moss-timestamp'];
  const body = JSON.stringify(req.body);

  if (!moss.webhooks.verify(body, signature, timestamp, WEBHOOK_SECRET)) {
    return res.status(401).json({ error: 'Invalid signature' });
  }

  const event = req.body;

  // Handle event based on type
  if (event.type === 'customer.compliance_changed') {
    console.log(`Customer ${event.customerId} score: ${event.data.current.score}`);
  }

  res.json({ received: true });
});

Analytics

Get Analytics

const analytics = await moss.analytics.get({
  period: '2026-07',
  granularity: 'daily',
});

console.log(`Total customers: ${analytics.customers.total}`);
console.log(`Average compliance: ${analytics.compliance.averageScore}`);
console.log(`MRR: $${analytics.billing.currentMrr}`);

Stream Real-Time Events

const stream = moss.analytics.stream();

stream.on('signature', (event) => {
  console.log(`Signature from ${event.agentId}`);
});

stream.on('violation', (event) => {
  console.log(`Policy violation: ${event.data.policyId}`);
});

stream.on('anomaly', (event) => {
  console.log(`Anomaly detected: ${event.data.type}`);
});

// Clean up when done
stream.close();

Error Handling

import { MossAPIError, MossNetworkError } from 'moss-partner-sdk';

try {
  const customer = await moss.customers.get('cust_xxx');
} catch (error) {
  if (error instanceof MossAPIError) {
    console.error(`API Error ${error.statusCode}: ${error.message}`);
    console.error(`Code: ${error.code}`);
    console.error(`Details:`, error.details);
  } else if (error instanceof MossNetworkError) {
    console.error('Network error:', error.message);
  } else {
    throw error;
  }
}

Test Mode

Use test mode for unit testing without making real API calls:

const moss = new MossPartner({
  apiKey: 'test_key',
  testMode: true,
});

// All operations return mock data
const customer = await moss.customers.create({...});
// Returns mock customer, no API call made

Logging

Provide a custom logger for debugging:

const moss = new MossPartner({
  apiKey: process.env.MOSS_PARTNER_KEY,
  logger: {
    debug: (msg, meta) => console.debug(msg, meta),
    info: (msg, meta) => console.info(msg, meta),
    warn: (msg, meta) => console.warn(msg, meta),
    error: (msg, meta) => console.error(msg, meta),
  },
});

TypeScript Support

The SDK is written in TypeScript and provides full type definitions:

import type { Customer, Webhook, AnalyticsResponse } from 'moss-partner-sdk';

const customer: Customer = await moss.customers.get('cust_xxx');
const webhooks: Webhook[] = await moss.webhooks.list();
const analytics: AnalyticsResponse = await moss.analytics.get({ period: '2026-07' });

License

MIT

Support

• Documentation: https://docs.mosscomputing.com
• GitHub Issues: https://github.com/mosscomputing/moss-partner-sdk-ts/issues
• Email: [email protected]