@getstackrun/sdk 0.2.0 → 0.3.0

package/README.md

@@ -16,16 +16,30 @@ Requires Node.js 18 or newer. Works in Deno, Bun, and browsers via native `fetch
 
 ## Quick start
 
+Sign in once on your machine — the SDK reads credentials from `~/.stack/credentials.json` automatically:
+
+```bash
+npx -y @getstackrun/cli auth login
+```
+
 ```ts
 import { Stack } from '@getstackrun/sdk';
 
-const stack = new Stack({ apiKey: process.env.STACK_API_KEY! });
+// No constructor args — reads ~/.stack/credentials.json (OAuth refresh token).
+// Falls back to STACK_API_KEY env var or constructor { apiKey } for CI.
+const stack = new Stack();
 
-// 1. Register an agent
+// 1. Register an agent (one-time)
 const agent = await stack.agents.register({ name: 'support-bot' });
 
-// 2. Issue a short-lived scoped passport
-const passport = await stack.passports.issue({
+// 2. In your agent runtime, switch to per-agent keypair mode
+const agentStack = new Stack({ agent_id: agent.id });
+// First run: generates an Ed25519 keypair locally + enrolls the public
+// half via /v1/agents/<id>/enroll. Persisted at ~/.stack/agents/<id>.json
+// (mode 0600). Every subsequent call signs a fresh 60-second JWT.
+
+// 3. Issue a short-lived scoped passport
+const passport = await agentStack.passports.issue({
   agent_id: agent.id,
   intent: {
     summary: 'Answer one customer ticket',
@@ -35,8 +49,8 @@ const passport = await stack.passports.issue({
   ttl_seconds: 900,
 });
 
-// 3. Every outbound call routes through the proxy
-await stack.proxy.request({
+// 4. Every outbound call routes through the proxy
+await agentStack.proxy.request({
   service: 'slack',
   method: 'POST',
   url: 'https://slack.com/api/chat.postMessage',
@@ -44,10 +58,20 @@ await stack.proxy.request({
   passport_token: passport.token,
 });
 
-// 4. Revoke when done (or let the passport expire)
-await stack.passports.revoke(passport.jti, 'mission complete');
+// 5. Revoke when done (or let the passport expire)
+await agentStack.passports.revoke(passport.jti, 'mission complete');
 ```
 
+## Authentication
+
+Three sources, resolved in priority order:
+
+1. **Explicit `apiKey`** on the constructor or `STACK_API_KEY` env var (legacy `sk_live_*` path, preserved for CI)
+2. **`agent_id`** option (Phase 2) — every request signed with the agent's local keypair
+3. **`~/.stack/credentials.json`** — OAuth refresh token written by `stack-cli auth login`
+
+See [/docs/security/stack-auth](https://getstack.run/docs/security/stack-auth) for the full auth model and [/docs/security/agent-keys](https://getstack.run/docs/security/agent-keys) for the per-agent keypair story.
+
 ## Offline passport verification
 
 Downstream services that only need cryptographic validity (no revocation awareness) can verify a passport using the public JWKS — no network round-trip to STACK per request.

package/dist/agent-auth.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Token provider for the HttpClient. Returns a fresh agent JWT per call.
+ * On first run (no stored key), runs the enrollment flow using the
+ * supplied bearerProvider for OAuth fallback authentication.
+ */
+export declare function createAgentTokenProvider(args: {
+    agentId: string;
+    baseUrl: string;
+    bearerProvider: () => Promise<string>;
+}): () => Promise<string>;
+//# sourceMappingURL=agent-auth.d.ts.map

package/dist/agent-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-auth.d.ts","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AA8JA;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAWxB"}

package/dist/agent-auth.js

@@ -0,0 +1,154 @@
+// Phase 2 — agent-keypair runtime auth.
+//
+// When `new Stack({ agent_id })` is constructed, the SDK enters
+// agent-runtime mode: every API call is signed with a fresh 60-second
+// EdDSA JWT minted on demand from the agent's local privkey.
+//
+// First run flow:
+//   1. Try to read ~/.stack/agents/<agent_id>.json (privkey JWK).
+//   2. If missing, kick off the enrollment dance using the developer's
+//      OAuth credentials (the ones written by `stack-cli auth login`):
+//         a. POST /v1/agents/<id>/enrollment-challenge
+//         b. Generate Ed25519 keypair locally
+//         c. Sign the challenge bytes with the new privkey
+//         d. POST /v1/agents/<id>/enroll with the public_key JWK +
+//            signed_challenge
+//      Persist the privkey to disk (mode 0600) and proceed.
+//
+// Subsequent runs hit step 1 only — no enrollment, no browser, no
+// developer interaction.
+//
+// Threat model: the privkey lives on disk just like an OAuth refresh
+// token. Phase 3 (passkey-rooted) closes the laptop-decryption gap.
+// Until then, file-on-disk + chmod 600 is the same posture as `aws cli`.
+import { generateKeyPair, exportJWK, importJWK, SignJWT } from 'jose';
+import { sign as cryptoSign } from 'node:crypto';
+const AGENT_KEY_DIR = '.stack/agents';
+const AGENT_JWT_TTL = 60;
+const AGENT_JWT_AUDIENCE = 'stack:agent';
+const AGENT_JWT_ISSUER = 'stack-sdk';
+async function keyPath(agentId) {
+    const { homedir } = await import('node:os');
+    const { join } = await import('node:path');
+    return join(homedir(), AGENT_KEY_DIR, `${agentId}.json`);
+}
+async function readStoredKey(agentId) {
+    try {
+        const { readFile } = await import('node:fs/promises');
+        const path = await keyPath(agentId);
+        const raw = await readFile(path, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeStoredKey(key) {
+    const { writeFile, mkdir, chmod } = await import('node:fs/promises');
+    const { join, dirname } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const path = join(homedir(), AGENT_KEY_DIR, `${key.agent_id}.json`);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(key, null, 2), 'utf8');
+    try {
+        await chmod(path, 0o600);
+    }
+    catch {
+        /* Windows / unsupported FS */
+    }
+}
+/**
+ * Run the enrollment dance for `agentId`. Authenticated calls to
+ * `/enrollment-challenge` and `/enroll` reuse the developer's OAuth
+ * credentials via the bearer-token resolver passed in.
+ */
+async function enroll(args) {
+    const bearer = await args.bearerProvider();
+    // Step 1: request challenge.
+    const challengeRes = await fetch(`${args.baseUrl}/v1/agents/${args.agentId}/enrollment-challenge`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${bearer}`,
+            'Content-Type': 'application/json',
+        },
+    });
+    if (!challengeRes.ok) {
+        const errBody = await challengeRes.json().catch(() => ({}));
+        throw new Error(`enrollment-challenge failed: ${errBody.error?.message ?? challengeRes.statusText}`);
+    }
+    const { challenge_id, challenge } = (await challengeRes.json());
+    // Step 2: generate keypair locally.
+    const { publicKey, privateKey } = await generateKeyPair('EdDSA', { crv: 'Ed25519', extractable: true });
+    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = await exportJWK(privateKey);
+    // Step 3: sign the challenge bytes with the privkey.
+    // Node's `sign(null, ...)` is the Ed25519 entry-point; matches what
+    // the API's `crypto.verify(null, ...)` consumes.
+    const { createPrivateKey } = await import('node:crypto');
+    const privateKeyObject = createPrivateKey({ key: privateJwk, format: 'jwk' });
+    const signatureBytes = cryptoSign(null, Buffer.from(challenge, 'utf8'), privateKeyObject);
+    const signed_challenge = signatureBytes.toString('base64url');
+    // Step 4: POST /enroll.
+    const enrollRes = await fetch(`${args.baseUrl}/v1/agents/${args.agentId}/enroll`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${bearer}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            public_key: { kty: publicJwk.kty, crv: publicJwk.crv, x: publicJwk.x },
+            challenge_id,
+            signed_challenge,
+        }),
+    });
+    if (!enrollRes.ok) {
+        const errBody = await enrollRes.json().catch(() => ({}));
+        throw new Error(`enroll failed: ${errBody.error?.message ?? enrollRes.statusText}`);
+    }
+    const { enrolled_at } = (await enrollRes.json());
+    const stored = {
+        agent_id: args.agentId,
+        publicKey: publicJwk,
+        privateKey: privateJwk,
+        enrolled_at: new Date(enrolled_at).getTime() / 1000,
+    };
+    await writeStoredKey(stored);
+    return stored;
+}
+/**
+ * Mint a fresh agent JWT (60s TTL) signed with the agent's privkey.
+ * One JWT per request — no caching. Cheap (≈1ms EdDSA sign) and the
+ * jti uniqueness ensures the API's replay-cache stays effective.
+ */
+async function signAgentJwt(stored, agentId) {
+    const key = await importJWK(stored.privateKey, 'EdDSA');
+    const now = Math.floor(Date.now() / 1000);
+    return new SignJWT({})
+        .setProtectedHeader({ alg: 'EdDSA' })
+        .setIssuer(AGENT_JWT_ISSUER)
+        .setSubject(agentId)
+        .setAudience(AGENT_JWT_AUDIENCE)
+        .setIssuedAt(now)
+        .setNotBefore(now)
+        .setExpirationTime(now + AGENT_JWT_TTL)
+        .setJti(`aj_${now}_${Math.random().toString(36).slice(2, 12)}`)
+        .sign(key);
+}
+/**
+ * Token provider for the HttpClient. Returns a fresh agent JWT per call.
+ * On first run (no stored key), runs the enrollment flow using the
+ * supplied bearerProvider for OAuth fallback authentication.
+ */
+export function createAgentTokenProvider(args) {
+    let cached = null;
+    return async () => {
+        if (!cached) {
+            cached = await readStoredKey(args.agentId);
+        }
+        if (!cached) {
+            cached = await enroll({ agentId: args.agentId, baseUrl: args.baseUrl, bearerProvider: args.bearerProvider });
+        }
+        return signAgentJwt(cached, args.agentId);
+    };
+}
+//# sourceMappingURL=agent-auth.js.map

package/dist/agent-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-auth.js","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,6DAA6D;AAC7D,EAAE;AACF,kBAAkB;AAClB,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,uDAAuD;AACvD,8CAA8C;AAC9C,2DAA2D;AAC3D,mEAAmE;AACnE,8BAA8B;AAC9B,4DAA4D;AAC5D,EAAE;AACF,kEAAkE;AAClE,yBAAyB;AACzB,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAChF,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,MAAM,aAAa,CAAC;AAEjD,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,kBAAkB,GAAG,aAAa,CAAC;AACzC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AASrC,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAc;IAC1C,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,QAAQ,OAAO,CAAC,CAAC;IACpE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,MAAM,CAAC,IAIrB;IACC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IAE3C,6BAA6B;IAC7B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,OAAO,uBAAuB,EAAE;QACjG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAqC,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAgD,CAAC;IAE/G,oCAAoC;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAE/C,qDAAqD;IACrD,oEAAoE;IACpE,iDAAiD;IACjD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,UAAgE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpI,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE9D,wBAAwB;IACxB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,OAAO,SAAS,EAAE;QAChF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE;YACtE,YAAY;YACZ,gBAAgB;SACjB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAqC,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE5E,MAAM,MAAM,GAAc;QACxB,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI;KACpD,CAAC;IACF,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,MAAiB,EAAE,OAAe;IAC5D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,gBAAgB,CAAC;SAC3B,UAAU,CAAC,OAAO,CAAC;SACnB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,WAAW,CAAC,GAAG,CAAC;SAChB,YAAY,CAAC,GAAG,CAAC;SACjB,iBAAiB,CAAC,GAAG,GAAG,aAAa,CAAC;SACtC,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/client.d.ts

@@ -1,11 +1,28 @@
 export interface ClientOptions {
-    apiKey: string;
+    /**
+     * Long-lived `sk_live_*` operator/member key. When omitted, the SDK
+     * falls back to (a) the `STACK_API_KEY` env var, (b) a refresh token
+     * stored at `~/.stack/credentials.json` (written by `stack-cli auth
+     * login`), exchanged on demand for a 5-minute access token.
+     */
+    apiKey?: string;
     baseUrl?: string;
+    /**
+     * Phase 2 — agent-runtime mode. When set, every request is signed with
+     * a fresh 60-second EdDSA JWT minted from the agent's local privkey
+     * (~/.stack/agents/<agent_id>.json, mode 0600). On first run, the SDK
+     * generates the keypair locally and enrolls the public half via
+     * /v1/agents/:id/enroll using the developer's OAuth credentials —
+     * the privkey never crosses the network or terminal.
+     */
+    agent_id?: string;
 }
 export declare class HttpClient {
-    private readonly apiKey;
+    private readonly explicitApiKey;
     private readonly baseUrl;
-    constructor(options: ClientOptions);
+    private cachedAccessToken;
+    private readonly agentTokenProvider;
+    constructor(options?: ClientOptions);
     get<T>(path: string, query?: Record<string, string | undefined>): Promise<T>;
     post<T>(path: string, body?: unknown, options?: {
         headers?: Record<string, string>;
@@ -18,6 +35,27 @@ export declare class HttpClient {
     }): Promise<T>;
     delete<T>(path: string): Promise<T>;
     private buildUrl;
+    /**
+     * Resolve the bearer token to attach to a request. Three sources, in
+     * priority order:
+     *   1. Explicit `apiKey` on the constructor or STACK_API_KEY env var
+     *      (legacy `sk_live_*`, preserved for CI).
+     *   2. Cached OAuth access token (5-minute TTL; refresh-rotates).
+     *   3. Refresh token in `~/.stack/credentials.json` (written by the
+     *      CLI's `auth login`) — exchanged for a fresh access token.
+     *
+     * Throws `StackError('NOT_AUTHENTICATED', ...)` when none of the
+     * three resolve.
+     */
+    private resolveBearer;
+    /**
+     * Static-bearer resolution: explicit apiKey → STACK_API_KEY env →
+     * ~/.stack/credentials.json refresh-token exchange. Does NOT mint
+     * agent JWTs — that's `resolveBearer()`'s job. Exposed separately so
+     * the agent-token provider can use this same path for the one-time
+     * enrollment dance (which itself needs a static bearer to authenticate).
+     */
+    private resolveStaticBearer;
     private request;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,EAAE,aAAa;IAK5B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK5E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKjG,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKlG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKhG,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKzC,OAAO,CAAC,QAAQ;YAUF,OAAO;CAiCtB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAAqD;IAC9E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiC;gBAExD,OAAO,GAAE,aAAkB;IAkBjC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK5E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKjG,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKlG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKhG,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKzC,OAAO,CAAC,QAAQ;IAUhB;;;;;;;;;;;OAWG;YACW,aAAa;IAU3B;;;;;;OAMG;YACW,mBAAmB;YAoBnB,OAAO;CAkCtB"}

package/dist/client.js

@@ -1,10 +1,26 @@
 import { StackError } from './errors.js';
+import { createAgentTokenProvider } from './agent-auth.js';
 export class HttpClient {
-    apiKey;
+    explicitApiKey;
     baseUrl;
-    constructor(options) {
-        this.apiKey = options.apiKey;
-        this.baseUrl = (options.baseUrl ?? 'https://api.getstack.run').replace(/\/$/, '');
+    cachedAccessToken = null;
+    agentTokenProvider;
+    constructor(options = {}) {
+        this.explicitApiKey = options.apiKey ?? process.env['STACK_API_KEY'] ?? undefined;
+        this.baseUrl = (options.baseUrl ?? process.env['STACK_API_URL'] ?? 'https://api.getstack.run').replace(/\/$/, '');
+        this.agentTokenProvider = options.agent_id
+            ? createAgentTokenProvider({
+                agentId: options.agent_id,
+                baseUrl: this.baseUrl,
+                // Bearer for the enrollment dance only — once enrolled the
+                // agent JWTs sign requests directly. Reuse the OAuth refresh
+                // path so the developer doesn't need to ship a separate key
+                // to their agent runtime; if neither STACK_API_KEY nor
+                // ~/.stack/credentials.json is present, enrollment will fail
+                // with a clear error.
+                bearerProvider: () => this.resolveStaticBearer(),
+            })
+            : null;
     }
     async get(path, query) {
         const url = this.buildUrl(path, query);
@@ -36,9 +52,57 @@ export class HttpClient {
         }
         return url.toString();
     }
+    /**
+     * Resolve the bearer token to attach to a request. Three sources, in
+     * priority order:
+     *   1. Explicit `apiKey` on the constructor or STACK_API_KEY env var
+     *      (legacy `sk_live_*`, preserved for CI).
+     *   2. Cached OAuth access token (5-minute TTL; refresh-rotates).
+     *   3. Refresh token in `~/.stack/credentials.json` (written by the
+     *      CLI's `auth login`) — exchanged for a fresh access token.
+     *
+     * Throws `StackError('NOT_AUTHENTICATED', ...)` when none of the
+     * three resolve.
+     */
+    async resolveBearer() {
+        // Phase 2 — agent-runtime mode short-circuits everything. Mint a
+        // fresh agent JWT per request; enrollment happens inside the
+        // provider on first call.
+        if (this.agentTokenProvider) {
+            return this.agentTokenProvider();
+        }
+        return this.resolveStaticBearer();
+    }
+    /**
+     * Static-bearer resolution: explicit apiKey → STACK_API_KEY env →
+     * ~/.stack/credentials.json refresh-token exchange. Does NOT mint
+     * agent JWTs — that's `resolveBearer()`'s job. Exposed separately so
+     * the agent-token provider can use this same path for the one-time
+     * enrollment dance (which itself needs a static bearer to authenticate).
+     */
+    async resolveStaticBearer() {
+        if (this.explicitApiKey)
+            return this.explicitApiKey;
+        // Browser / non-Node runtimes: refresh-from-file is not possible.
+        // Fall through to the same NOT_AUTHENTICATED error.
+        const isNode = typeof process !== 'undefined' && process.versions?.node;
+        if (!isNode)
+            throw notAuthenticated();
+        const now = Math.floor(Date.now() / 1000);
+        if (this.cachedAccessToken && this.cachedAccessToken.expiresAt - 30 > now) {
+            // Re-use the cached access token unless within 30s of expiry.
+            return this.cachedAccessToken.token;
+        }
+        const fresh = await refreshAccessTokenFromFile(this.baseUrl);
+        if (!fresh)
+            throw notAuthenticated();
+        this.cachedAccessToken = { token: fresh.access_token, expiresAt: now + (fresh.expires_in ?? 300) };
+        return fresh.access_token;
+    }
     async request(method, url, body, extraHeaders) {
+        const bearer = await this.resolveBearer();
         const headers = {
-            'Authorization': `Bearer ${this.apiKey}`,
+            'Authorization': `Bearer ${bearer}`,
             'Accept': 'application/json',
             ...(extraHeaders ?? {}),
         };
@@ -67,4 +131,60 @@ export class HttpClient {
         return res.json();
     }
 }
+function notAuthenticated() {
+    return new StackError('No STACK credentials found. Set STACK_API_KEY, pass { apiKey } to new Stack(), or run `stack-cli auth login`.', 'NOT_AUTHENTICATED', 401, {});
+}
+/**
+ * Read `~/.stack/credentials.json` (written by the CLI), exchange the
+ * stored refresh token for a fresh access token, write the rotated
+ * refresh back to the file. Returns null when the file is missing or
+ * the refresh has been revoked.
+ *
+ * Lazy-loaded Node-only path. The browser bundle skips this entirely
+ * via the isNode check in resolveBearer.
+ */
+async function refreshAccessTokenFromFile(baseUrl) {
+    // Lazy `node:` imports so the browser bundle never tries to resolve them.
+    const { readFile, writeFile, mkdir } = await import('node:fs/promises');
+    const { join } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const credsPath = join(homedir(), '.stack', 'credentials.json');
+    let raw;
+    try {
+        raw = await readFile(credsPath, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let creds;
+    try {
+        creds = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    const res = await fetch(`${baseUrl}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: creds.refresh_token,
+            client_id: creds.client_id,
+        }),
+    });
+    if (!res.ok)
+        return null;
+    const data = (await res.json());
+    // Persist the rotated refresh — failure to write means next run pays
+    // the round-trip again, but the in-memory access token is still good.
+    try {
+        await mkdir(join(homedir(), '.stack'), { recursive: true });
+        const next = { ...creds, refresh_token: data.refresh_token, issued_at: Math.floor(Date.now() / 1000), refresh_expires_at: Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60 };
+        await writeFile(credsPath, JSON.stringify(next, null, 2), 'utf8');
+    }
+    catch {
+        /* non-fatal */
+    }
+    return { access_token: data.access_token, expires_in: data.expires_in };
+}
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,OAAO,UAAU;IACJ,MAAM,CAAS;IACf,OAAO,CAAS;IAEjC,YAAY,OAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAA0C;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAA0C;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,GAAW,EAAE,IAAc,EAAE,YAAqC;QACzG,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;YACxC,QAAQ,EAAE,kBAAkB;YAC5B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;SACxB,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,SAAS,GAAsE,EAAE,CAAC;YACtF,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC;YAChF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAsB3D,MAAM,OAAO,UAAU;IACJ,cAAc,CAAqB;IACnC,OAAO,CAAS;IACzB,iBAAiB,GAAgD,IAAI,CAAC;IAC7D,kBAAkB,CAAiC;IAEpE,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;QAClF,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,QAAQ;YACxC,CAAC,CAAC,wBAAwB,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,2DAA2D;gBAC3D,6DAA6D;gBAC7D,4DAA4D;gBAC5D,uDAAuD;gBACvD,6DAA6D;gBAC7D,sBAAsB;gBACtB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE;aACjD,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAA0C;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAA0C;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,aAAa;QACzB,iEAAiE;QACjE,6DAA6D;QAC7D,0BAA0B;QAC1B,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;OAMG;IACK,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAEpD,kEAAkE;QAClE,oDAAoD;QACpD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAEtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;YAC1E,8DAA8D;YAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,CAAC,KAAK;YAAE,MAAM,gBAAgB,EAAE,CAAC;QACrC,IAAI,CAAC,iBAAiB,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC;QACnG,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,GAAW,EAAE,IAAc,EAAE,YAAqC;QACzG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,MAAM,EAAE;YACnC,QAAQ,EAAE,kBAAkB;YAC5B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;SACxB,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,SAAS,GAAsE,EAAE,CAAC;YACtF,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC;YAChF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;CACF;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,UAAU,CACnB,+GAA+G,EAC/G,mBAAmB,EACnB,GAAG,EACH,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,0BAA0B,CACvC,OAAe;IAEf,0EAA0E;IAC1E,MAAM,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACxE,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAEhE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,KAA2F,CAAC;IAChG,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAiB,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwE,CAAC;IAEvG,qEAAqE;IACrE,sEAAsE;IACtE,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,IAAI,GAAG,EAAE,GAAG,KAAK,EAAE,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,EAAE,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,EAAE,CAAC;QAC9K,MAAM,SAAS,CAAC,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC1E,CAAC"}

package/dist/index.d.ts

@@ -31,7 +31,7 @@ export declare class Stack {
     readonly scan: ScanService;
     readonly audit: AuditService;
     readonly detectorConfig: DetectorConfigService;
-    constructor(options: ClientOptions);
+    constructor(options?: ClientOptions);
 }
 export type { ClientOptions } from './client.js';
 export * from './types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;gBAEnC,OAAO,EAAE,aAAa;CAkBnC;AAGD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAK5B,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;gBAEnC,OAAO,GAAE,aAAkB;CAkBxC;AAGD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAK5B,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -31,7 +31,7 @@ export class Stack {
     scan;
     audit;
     detectorConfig;
-    constructor(options) {
+    constructor(options = {}) {
         this.client = new HttpClient(options);
         this.agents = new AgentService(this.client);
         this.passports = new PassportService(this.client);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,OAAO,KAAK;IACC,MAAM,CAAa;IAE3B,MAAM,CAAe;IACrB,SAAS,CAAkB;IAC3B,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,QAAQ,CAAiB;IACzB,MAAM,CAAe;IACrB,QAAQ,CAAkB;IAC1B,IAAI,CAAc;IAClB,eAAe,CAAwB;IACvC,aAAa,CAAsB;IACnC,cAAc,CAAuB;IACrC,KAAK,CAAe;IACpB,IAAI,CAAc;IAClB,KAAK,CAAe;IACpB,cAAc,CAAwB;IAE/C,YAAY,OAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAID,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAE5B,wEAAwE;AACxE,uEAAuE;AACvE,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,OAAO,KAAK;IACC,MAAM,CAAa;IAE3B,MAAM,CAAe;IACrB,SAAS,CAAkB;IAC3B,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,QAAQ,CAAiB;IACzB,MAAM,CAAe;IACrB,QAAQ,CAAkB;IAC1B,IAAI,CAAc;IAClB,eAAe,CAAwB;IACvC,aAAa,CAAsB;IACnC,cAAc,CAAuB;IACrC,KAAK,CAAe;IACpB,IAAI,CAAc;IAClB,KAAK,CAAe;IACpB,cAAc,CAAwB;IAE/C,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAID,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAE5B,wEAAwE;AACxE,uEAAuE;AACvE,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstackrun/sdk",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Official JavaScript/TypeScript SDK for STACK — runtime security layer for AI agents",
   "type": "module",
   "exports": {