@getstackrun/sdk 0.2.0 → 0.4.0

package/README.md

@@ -16,16 +16,30 @@ Requires Node.js 18 or newer. Works in Deno, Bun, and browsers via native `fetch
 
 ## Quick start
 
+Sign in once on your machine — the SDK reads credentials from `~/.stack/credentials.json` automatically:
+
+```bash
+npx -y @getstackrun/cli auth login
+```
+
 ```ts
 import { Stack } from '@getstackrun/sdk';
 
-const stack = new Stack({ apiKey: process.env.STACK_API_KEY! });
+// No constructor args — reads ~/.stack/credentials.json (OAuth refresh token).
+// Falls back to STACK_API_KEY env var or constructor { apiKey } for CI.
+const stack = new Stack();
 
-// 1. Register an agent
+// 1. Register an agent (one-time)
 const agent = await stack.agents.register({ name: 'support-bot' });
 
-// 2. Issue a short-lived scoped passport
-const passport = await stack.passports.issue({
+// 2. In your agent runtime, switch to per-agent keypair mode
+const agentStack = new Stack({ agent_id: agent.id });
+// First run: generates an Ed25519 keypair locally + enrolls the public
+// half via /v1/agents/<id>/enroll. Persisted at ~/.stack/agents/<id>.json
+// (mode 0600). Every subsequent call signs a fresh 60-second JWT.
+
+// 3. Issue a short-lived scoped passport
+const passport = await agentStack.passports.issue({
   agent_id: agent.id,
   intent: {
     summary: 'Answer one customer ticket',
@@ -35,8 +49,8 @@ const passport = await stack.passports.issue({
   ttl_seconds: 900,
 });
 
-// 3. Every outbound call routes through the proxy
-await stack.proxy.request({
+// 4. Every outbound call routes through the proxy
+await agentStack.proxy.request({
   service: 'slack',
   method: 'POST',
   url: 'https://slack.com/api/chat.postMessage',
@@ -44,10 +58,20 @@ await stack.proxy.request({
   passport_token: passport.token,
 });
 
-// 4. Revoke when done (or let the passport expire)
-await stack.passports.revoke(passport.jti, 'mission complete');
+// 5. Revoke when done (or let the passport expire)
+await agentStack.passports.revoke(passport.jti, 'mission complete');
 ```
 
+## Authentication
+
+Three sources, resolved in priority order:
+
+1. **Explicit `apiKey`** on the constructor or `STACK_API_KEY` env var (legacy `sk_live_*` path, preserved for CI)
+2. **`agent_id`** option (Phase 2) — every request signed with the agent's local keypair
+3. **`~/.stack/credentials.json`** — OAuth refresh token written by `stack-cli auth login`
+
+See [/docs/security/stack-auth](https://getstack.run/docs/security/stack-auth) for the full auth model and [/docs/security/agent-keys](https://getstack.run/docs/security/agent-keys) for the per-agent keypair story.
+
 ## Offline passport verification
 
 Downstream services that only need cryptographic validity (no revocation awareness) can verify a passport using the public JWKS — no network round-trip to STACK per request.

package/dist/agent-auth.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Token provider for the HttpClient. Returns a fresh agent JWT per call.
+ * On first run (no stored key), runs the enrollment flow using the
+ * supplied bearerProvider for OAuth fallback authentication.
+ */
+export declare function createAgentTokenProvider(args: {
+    agentId: string;
+    baseUrl: string;
+    bearerProvider: () => Promise<string>;
+}): () => Promise<string>;
+//# sourceMappingURL=agent-auth.d.ts.map

package/dist/agent-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-auth.d.ts","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AAyTA;;;;GAIG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,cAAc,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;CACvC,GAAG,MAAM,OAAO,CAAC,MAAM,CAAC,CAWxB"}

package/dist/agent-auth.js

@@ -0,0 +1,303 @@
+// Phase 2 — agent-keypair runtime auth.
+//
+// When `new Stack({ agent_id })` is constructed, the SDK enters
+// agent-runtime mode: every API call is signed with a fresh 60-second
+// EdDSA JWT minted on demand from the agent's local privkey.
+//
+// First run flow:
+//   1. Try to read ~/.stack/agents/<agent_id>.json (privkey JWK).
+//   2. If missing, kick off the enrollment dance using the developer's
+//      OAuth credentials (the ones written by `stack-cli auth login`):
+//         a. POST /v1/agents/<id>/enrollment-challenge
+//         b. Generate Ed25519 keypair locally
+//         c. Sign the challenge bytes with the new privkey
+//         d. POST /v1/agents/<id>/enroll with the public_key JWK +
+//            signed_challenge
+//      Persist the privkey to disk (mode 0600) and proceed.
+//
+// Subsequent runs hit step 1 only — no enrollment, no browser, no
+// developer interaction.
+//
+// Threat model: the privkey lives on disk just like an OAuth refresh
+// token. Phase 3 (passkey-rooted) closes the laptop-decryption gap.
+// Until then, file-on-disk + chmod 600 is the same posture as `aws cli`.
+import { generateKeyPair, exportJWK, importJWK, SignJWT } from 'jose';
+import { sign as cryptoSign, randomBytes } from 'node:crypto';
+import { shouldRunBrowserBootstrap } from './browser-bootstrap.js';
+const AGENT_KEY_DIR = '.stack/agents';
+const AGENT_JWT_TTL = 60;
+const AGENT_JWT_AUDIENCE = 'stack:agent';
+const AGENT_JWT_ISSUER = 'stack-sdk';
+/**
+ * Dashboard origin to which the SDK opens the browser for the
+ * approval screen. Mirrors the operator-visible website. Override via
+ * STACK_DASHBOARD_URL for self-hosted or test environments.
+ */
+function dashboardUrl(apiBaseUrl) {
+    if (process.env['STACK_DASHBOARD_URL'])
+        return process.env['STACK_DASHBOARD_URL'];
+    // Dev shortcut: api on localhost ⇒ dashboard on :3100.
+    if (/^https?:\/\/(127\.0\.0\.1|localhost)/.test(apiBaseUrl)) {
+        return 'http://localhost:3100';
+    }
+    return 'https://getstack.run';
+}
+const ENROLLMENT_AUTH_TIMEOUT_MS = 5 * 60 * 1000; // matches ticket TTL
+async function keyPath(agentId) {
+    const { homedir } = await import('node:os');
+    const { join } = await import('node:path');
+    return join(homedir(), AGENT_KEY_DIR, `${agentId}.json`);
+}
+async function readStoredKey(agentId) {
+    try {
+        const { readFile } = await import('node:fs/promises');
+        const path = await keyPath(agentId);
+        const raw = await readFile(path, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+async function writeStoredKey(key) {
+    const { writeFile, mkdir, chmod } = await import('node:fs/promises');
+    const { join, dirname } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const path = join(homedir(), AGENT_KEY_DIR, `${key.agent_id}.json`);
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(key, null, 2), 'utf8');
+    try {
+        await chmod(path, 0o600);
+    }
+    catch {
+        /* Windows / unsupported FS */
+    }
+}
+/**
+ * Spawn a one-shot loopback HTTP server on a random free port, open
+ * the dashboard /sdk-bootstrap page in the user's browser, and resolve
+ * with the enrollment ticket once the user approves (or reject on
+ * deny / timeout). Used as the interactive-mode bearer provider in
+ * place of the silent OAuth path.
+ *
+ * The ticket itself is a JWT bound to (operator, member, agent_id,
+ * machine_label). Single-use: burned by the API on /enroll success.
+ */
+async function ticketViaBrowserApproval(args) {
+    const { createServer } = await import('node:http');
+    const { hostname } = await import('node:os');
+    const open = (await import('node:child_process')).spawn;
+    const state = randomBytes(16).toString('base64url');
+    const machine = hostname().slice(0, 80);
+    const proc = `${process.argv0 ?? 'node'} ${process.argv[1]?.split(/[/\\]/).pop() ?? ''}`.slice(0, 80);
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        const settle = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            try {
+                server.close();
+            }
+            catch { /* */ }
+            clearTimeout(timeout);
+            fn();
+        };
+        const server = createServer((req, res) => {
+            try {
+                const url = new URL(req.url ?? '/', 'http://127.0.0.1');
+                if (url.pathname !== '/cb') {
+                    res.writeHead(404);
+                    res.end();
+                    return;
+                }
+                const error = url.searchParams.get('error');
+                const ticket = url.searchParams.get('ticket');
+                const callbackState = url.searchParams.get('state');
+                if (callbackState !== state) {
+                    res.writeHead(400, { 'Content-Type': 'text/html' });
+                    res.end('<html><body style="font-family:system-ui;padding:40px"><h1>State mismatch</h1></body></html>');
+                    settle(() => reject(new Error('enrollment callback state mismatch')));
+                    return;
+                }
+                if (error) {
+                    res.writeHead(403, { 'Content-Type': 'text/html' });
+                    res.end('<html><body style="font-family:system-ui;padding:40px"><h1>Enrollment denied</h1><p>You can close this tab.</p></body></html>');
+                    settle(() => reject(new Error(`enrollment ${error}`)));
+                    return;
+                }
+                if (!ticket) {
+                    res.writeHead(400, { 'Content-Type': 'text/html' });
+                    res.end('<html><body style="font-family:system-ui;padding:40px"><h1>Missing ticket</h1></body></html>');
+                    settle(() => reject(new Error('enrollment callback missing ticket')));
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end('<html><body style="font-family:system-ui;padding:40px;text-align:center"><h1>Approved</h1><p>You can close this tab and return to your terminal.</p></body></html>');
+                settle(() => resolve(ticket));
+            }
+            catch (e) {
+                settle(() => reject(e instanceof Error ? e : new Error(String(e))));
+            }
+        });
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            const port = typeof addr === 'object' && addr ? addr.port : 0;
+            if (!port) {
+                settle(() => reject(new Error('failed to bind loopback port for enrollment callback')));
+                return;
+            }
+            const callback = `http://127.0.0.1:${port}/cb`;
+            const dash = dashboardUrl(args.apiBaseUrl);
+            const url = `${dash}/sdk-bootstrap?` + new URLSearchParams({
+                agent_id: args.agentId,
+                callback,
+                state,
+                machine,
+                process: proc,
+            }).toString();
+            process.stderr.write('\n  STACK SDK agent enrollment\n');
+            process.stderr.write('  ──────────────────────────\n\n');
+            process.stderr.write(`  Approve in your browser: ${url}\n\n`);
+            try {
+                const opener = process.platform === 'win32'
+                    ? open('cmd', ['/c', 'start', '', url], { detached: true, stdio: 'ignore' })
+                    : process.platform === 'darwin'
+                        ? open('open', [url], { detached: true, stdio: 'ignore' })
+                        : open('xdg-open', [url], { detached: true, stdio: 'ignore' });
+                opener.unref?.();
+            }
+            catch {
+                /* best-effort */
+            }
+        });
+        const timeout = setTimeout(() => {
+            settle(() => reject(new Error('enrollment approval timed out (5 min). Re-run to try again.')));
+        }, ENROLLMENT_AUTH_TIMEOUT_MS);
+    });
+}
+/**
+ * Run the enrollment dance for `agentId`.
+ *
+ * Two paths converge on the same /enrollment-challenge + /enroll calls:
+ *
+ *   - **Interactive (TTY + not CI):** open the dashboard /sdk-bootstrap
+ *     page so the operator explicitly approves enrollment of THIS agent
+ *     on THIS machine. The dashboard mints a single-use enrollment
+ *     ticket which the SDK uses as the Bearer.
+ *
+ *   - **Headless / CI:** fall through to the developer's OAuth bearer
+ *     (or sk_live_* via STACK_API_KEY). No browser, no human-in-the-
+ *     loop — convenience for CI runners. Same enrollment endpoints.
+ *
+ * Either way, the privkey is generated locally and never crosses the
+ * network. The ticket only authenticates the enrollment dance itself.
+ */
+async function enroll(args) {
+    let bearer;
+    if (shouldRunBrowserBootstrap()) {
+        try {
+            bearer = await ticketViaBrowserApproval({ agentId: args.agentId, apiBaseUrl: args.baseUrl });
+        }
+        catch (e) {
+            // Fall back to OAuth-bearer-silent mode — useful when the user
+            // explicitly approved but the localhost bind failed (firewall),
+            // or when the dashboard rejected because, say, the cookie
+            // session expired and they bailed out. Surface the original
+            // error so the user knows what happened.
+            throw new Error(`Browser approval for SDK agent enrollment failed (${e.message}). ` +
+                `Either fix the issue and re-run, or run in CI mode with STACK_API_KEY set ` +
+                `to use the silent enrollment path.`);
+        }
+    }
+    else {
+        bearer = await args.bearerProvider();
+    }
+    // Step 1: request challenge.
+    const challengeRes = await fetch(`${args.baseUrl}/v1/agents/${args.agentId}/enrollment-challenge`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${bearer}`,
+            'Content-Type': 'application/json',
+        },
+    });
+    if (!challengeRes.ok) {
+        const errBody = await challengeRes.json().catch(() => ({}));
+        throw new Error(`enrollment-challenge failed: ${errBody.error?.message ?? challengeRes.statusText}`);
+    }
+    const { challenge_id, challenge } = (await challengeRes.json());
+    // Step 2: generate keypair locally.
+    const { publicKey, privateKey } = await generateKeyPair('EdDSA', { crv: 'Ed25519', extractable: true });
+    const publicJwk = await exportJWK(publicKey);
+    const privateJwk = await exportJWK(privateKey);
+    // Step 3: sign the challenge bytes with the privkey.
+    // Node's `sign(null, ...)` is the Ed25519 entry-point; matches what
+    // the API's `crypto.verify(null, ...)` consumes.
+    const { createPrivateKey } = await import('node:crypto');
+    const privateKeyObject = createPrivateKey({ key: privateJwk, format: 'jwk' });
+    const signatureBytes = cryptoSign(null, Buffer.from(challenge, 'utf8'), privateKeyObject);
+    const signed_challenge = signatureBytes.toString('base64url');
+    // Step 4: POST /enroll.
+    const enrollRes = await fetch(`${args.baseUrl}/v1/agents/${args.agentId}/enroll`, {
+        method: 'POST',
+        headers: {
+            Authorization: `Bearer ${bearer}`,
+            'Content-Type': 'application/json',
+        },
+        body: JSON.stringify({
+            public_key: { kty: publicJwk.kty, crv: publicJwk.crv, x: publicJwk.x },
+            challenge_id,
+            signed_challenge,
+        }),
+    });
+    if (!enrollRes.ok) {
+        const errBody = await enrollRes.json().catch(() => ({}));
+        throw new Error(`enroll failed: ${errBody.error?.message ?? enrollRes.statusText}`);
+    }
+    const { enrolled_at } = (await enrollRes.json());
+    const stored = {
+        agent_id: args.agentId,
+        publicKey: publicJwk,
+        privateKey: privateJwk,
+        enrolled_at: new Date(enrolled_at).getTime() / 1000,
+    };
+    await writeStoredKey(stored);
+    return stored;
+}
+/**
+ * Mint a fresh agent JWT (60s TTL) signed with the agent's privkey.
+ * One JWT per request — no caching. Cheap (≈1ms EdDSA sign) and the
+ * jti uniqueness ensures the API's replay-cache stays effective.
+ */
+async function signAgentJwt(stored, agentId) {
+    const key = await importJWK(stored.privateKey, 'EdDSA');
+    const now = Math.floor(Date.now() / 1000);
+    return new SignJWT({})
+        .setProtectedHeader({ alg: 'EdDSA' })
+        .setIssuer(AGENT_JWT_ISSUER)
+        .setSubject(agentId)
+        .setAudience(AGENT_JWT_AUDIENCE)
+        .setIssuedAt(now)
+        .setNotBefore(now)
+        .setExpirationTime(now + AGENT_JWT_TTL)
+        .setJti(`aj_${now}_${Math.random().toString(36).slice(2, 12)}`)
+        .sign(key);
+}
+/**
+ * Token provider for the HttpClient. Returns a fresh agent JWT per call.
+ * On first run (no stored key), runs the enrollment flow using the
+ * supplied bearerProvider for OAuth fallback authentication.
+ */
+export function createAgentTokenProvider(args) {
+    let cached = null;
+    return async () => {
+        if (!cached) {
+            cached = await readStoredKey(args.agentId);
+        }
+        if (!cached) {
+            cached = await enroll({ agentId: args.agentId, baseUrl: args.baseUrl, bearerProvider: args.bearerProvider });
+        }
+        return signAgentJwt(cached, args.agentId);
+    };
+}
+//# sourceMappingURL=agent-auth.js.map

package/dist/agent-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-auth.js","sourceRoot":"","sources":["../src/agent-auth.ts"],"names":[],"mappings":"AAAA,wCAAwC;AACxC,EAAE;AACF,gEAAgE;AAChE,sEAAsE;AACtE,6DAA6D;AAC7D,EAAE;AACF,kBAAkB;AAClB,kEAAkE;AAClE,uEAAuE;AACvE,uEAAuE;AACvE,uDAAuD;AACvD,8CAA8C;AAC9C,2DAA2D;AAC3D,mEAAmE;AACnE,8BAA8B;AAC9B,4DAA4D;AAC5D,EAAE;AACF,kEAAkE;AAClE,yBAAyB;AACzB,EAAE;AACF,qEAAqE;AACrE,oEAAoE;AACpE,yEAAyE;AAEzE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAY,MAAM,MAAM,CAAC;AAChF,OAAO,EAAE,IAAI,IAAI,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC9D,OAAO,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAEnE,MAAM,aAAa,GAAG,eAAe,CAAC;AACtC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,kBAAkB,GAAG,aAAa,CAAC;AACzC,MAAM,gBAAgB,GAAG,WAAW,CAAC;AAErC;;;;GAIG;AACH,SAAS,YAAY,CAAC,UAAkB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC,CAAC;IAClF,uDAAuD;IACvD,IAAI,sCAAsC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5D,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,OAAO,sBAAsB,CAAC;AAChC,CAAC;AAED,MAAM,0BAA0B,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,qBAAqB;AASvE,KAAK,UAAU,OAAO,CAAC,OAAe;IACpC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,OAAO,OAAO,CAAC,CAAC;AAC3D,CAAC;AAED,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;QACpC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,GAAc;IAC1C,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,GAAG,GAAG,CAAC,QAAQ,OAAO,CAAC,CAAC;IACpE,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,8BAA8B;IAChC,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,wBAAwB,CAAC,IAGvC;IACC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,IAAI,GAAG,CAAC,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,KAAK,CAAC;IAExD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,KAAK,IAAI,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAEtG,OAAO,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC7C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,EAAc,EAAE,EAAE;YAChC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,CAAC;gBAAC,MAAM,CAAC,KAAK,EAAE,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC;YACvC,YAAY,CAAC,OAAO,CAAC,CAAC;YACtB,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBACxD,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,EAAE,CAAC;oBAC3B,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;oBACnB,GAAG,CAAC,GAAG,EAAE,CAAC;oBACV,OAAO;gBACT,CAAC;gBACD,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBAC9C,MAAM,aAAa,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBACpD,IAAI,aAAa,KAAK,KAAK,EAAE,CAAC;oBAC5B,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;oBACxG,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBACD,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,+HAA+H,CAAC,CAAC;oBACzI,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,cAAc,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC;oBACvD,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,MAAM,EAAE,CAAC;oBACZ,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,8FAA8F,CAAC,CAAC;oBACxG,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,CAAC,CAAC,CAAC,CAAC;oBACtE,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,oKAAoK,CAAC,CAAC;gBAC9K,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACtE,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,sDAAsD,CAAC,CAAC,CAAC,CAAC;gBACxF,OAAO;YACT,CAAC;YACD,MAAM,QAAQ,GAAG,oBAAoB,IAAI,KAAK,CAAC;YAC/C,MAAM,IAAI,GAAG,YAAY,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3C,MAAM,GAAG,GAAG,GAAG,IAAI,iBAAiB,GAAG,IAAI,eAAe,CAAC;gBACzD,QAAQ,EAAE,IAAI,CAAC,OAAO;gBACtB,QAAQ;gBACR,KAAK;gBACL,OAAO;gBACP,OAAO,EAAE,IAAI;aACd,CAAC,CAAC,QAAQ,EAAE,CAAC;YAEd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;YACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8BAA8B,GAAG,MAAM,CAAC,CAAC;YAE9D,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO;oBACzC,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;oBAC5E,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,QAAQ;wBAC7B,CAAC,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;wBAC1D,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACnE,MAAM,CAAC,KAAK,EAAE,EAAE,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,CAAC,CAAC;QACjG,CAAC,EAAE,0BAA0B,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,KAAK,UAAU,MAAM,CAAC,IAIrB;IACC,IAAI,MAAc,CAAC;IACnB,IAAI,yBAAyB,EAAE,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,wBAAwB,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,+DAA+D;YAC/D,gEAAgE;YAChE,0DAA0D;YAC1D,4DAA4D;YAC5D,yCAAyC;YACzC,MAAM,IAAI,KAAK,CACb,qDAAsD,CAAW,CAAC,OAAO,KAAK;gBAC5E,4EAA4E;gBAC5E,oCAAoC,CACvC,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;IACvC,CAAC;IAED,6BAA6B;IAC7B,MAAM,YAAY,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,OAAO,uBAAuB,EAAE;QACjG,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAqC,CAAC;QAChG,MAAM,IAAI,KAAK,CAAC,gCAAgC,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,YAAY,CAAC,IAAI,EAAE,CAAgD,CAAC;IAE/G,oCAAoC;IACpC,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,MAAM,SAAS,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;IAC7C,MAAM,UAAU,GAAG,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IAE/C,qDAAqD;IACrD,oEAAoE;IACpE,iDAAiD;IACjD,MAAM,EAAE,gBAAgB,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IACzD,MAAM,gBAAgB,GAAG,gBAAgB,CAAC,EAAE,GAAG,EAAE,UAAgE,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;IACpI,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC1F,MAAM,gBAAgB,GAAG,cAAc,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAE9D,wBAAwB;IACxB,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,cAAc,IAAI,CAAC,OAAO,SAAS,EAAE;QAChF,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,MAAM,EAAE;YACjC,cAAc,EAAE,kBAAkB;SACnC;QACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,UAAU,EAAE,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,EAAE,SAAS,CAAC,GAAG,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC,EAAE;YACtE,YAAY;YACZ,gBAAgB;SACjB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,CAAC;QAClB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAqC,CAAC;QAC7F,MAAM,IAAI,KAAK,CAAC,kBAAkB,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC;IACtF,CAAC;IACD,MAAM,EAAE,WAAW,EAAE,GAAG,CAAC,MAAM,SAAS,CAAC,IAAI,EAAE,CAA4B,CAAC;IAE5E,MAAM,MAAM,GAAc;QACxB,QAAQ,EAAE,IAAI,CAAC,OAAO;QACtB,SAAS,EAAE,SAAS;QACpB,UAAU,EAAE,UAAU;QACtB,WAAW,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI;KACpD,CAAC;IACF,MAAM,cAAc,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,YAAY,CAAC,MAAiB,EAAE,OAAe;IAC5D,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;IAC1C,OAAO,IAAI,OAAO,CAAC,EAAE,CAAC;SACnB,kBAAkB,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;SACpC,SAAS,CAAC,gBAAgB,CAAC;SAC3B,UAAU,CAAC,OAAO,CAAC;SACnB,WAAW,CAAC,kBAAkB,CAAC;SAC/B,WAAW,CAAC,GAAG,CAAC;SAChB,YAAY,CAAC,GAAG,CAAC;SACjB,iBAAiB,CAAC,GAAG,GAAG,aAAa,CAAC;SACtC,MAAM,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;SAC9D,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAIxC;IACC,IAAI,MAAM,GAAqB,IAAI,CAAC;IACpC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7C,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,GAAG,MAAM,MAAM,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC;QAC/G,CAAC;QACD,OAAO,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5C,CAAC,CAAC;AACJ,CAAC"}

package/dist/browser-bootstrap.d.ts

@@ -0,0 +1,18 @@
+export interface BootstrapResult {
+    access_token: string;
+    expires_in: number;
+    refresh_token: string;
+    client_id: string;
+}
+/**
+ * Decide whether to spawn the browser. Conservative — opt-in by
+ * environment, not opt-out.
+ */
+export declare function shouldRunBrowserBootstrap(): boolean;
+/**
+ * Run the full OAuth Authorization-Code + PKCE flow: DCR a client,
+ * mint a PKCE pair, spawn a localhost server, open the browser, wait
+ * for the callback, exchange the code for tokens, persist + return.
+ */
+export declare function browserBootstrap(baseUrl: string): Promise<BootstrapResult>;
+//# sourceMappingURL=browser-bootstrap.d.ts.map

package/dist/browser-bootstrap.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-bootstrap.d.ts","sourceRoot":"","sources":["../src/browser-bootstrap.ts"],"names":[],"mappings":"AAyBA,MAAM,WAAW,eAAe;IAC9B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,wBAAgB,yBAAyB,IAAI,OAAO,CAMnD;AAED;;;;GAIG;AACH,wBAAsB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAkHhF"}

package/dist/browser-bootstrap.js

@@ -0,0 +1,237 @@
+// Phase 1 SDK first-run bootstrap (Authorization Code + PKCE with
+// localhost callback).
+//
+// When `new Stack()` is instantiated and there's no apiKey, no
+// STACK_API_KEY env, AND no ~/.stack/credentials.json — instead of
+// throwing NOT_AUTHENTICATED, the SDK can spawn the user's browser
+// and run the full OAuth dance itself. End state: credentials.json
+// is written, the access token is returned, the SDK is usable.
+//
+// Triggered ONLY when:
+//   1. The current process has a TTY (developer at a terminal); AND
+//   2. STACK_AUTH_INTERACTIVE is not 'false' (explicit opt-out for
+//      headless dev environments that look like a TTY).
+//
+// In production agent runtimes (Lambda, Vercel, K8s, etc.) there's
+// no TTY — the SDK falls through to the existing NOT_AUTHENTICATED
+// error and the operator must set STACK_API_KEY (or use agent_id
+// mode with credentials seeded another way). The browser-spawn path
+// is strictly a developer convenience.
+import { writeCredentialsFile, credentialsFilePath } from './credentials-file.js';
+const DEFAULT_AUTH_TIMEOUT_MS = 5 * 60 * 1000; // 5 minutes — matches the auth-code TTL
+/**
+ * Decide whether to spawn the browser. Conservative — opt-in by
+ * environment, not opt-out.
+ */
+export function shouldRunBrowserBootstrap() {
+    if (typeof process === 'undefined')
+        return false;
+    if (!process.stdout?.isTTY)
+        return false;
+    if (process.env['STACK_AUTH_INTERACTIVE'] === 'false')
+        return false;
+    if (process.env['CI'])
+        return false; // belt-and-braces — no spawn in CI
+    return true;
+}
+/**
+ * Run the full OAuth Authorization-Code + PKCE flow: DCR a client,
+ * mint a PKCE pair, spawn a localhost server, open the browser, wait
+ * for the callback, exchange the code for tokens, persist + return.
+ */
+export async function browserBootstrap(baseUrl) {
+    const { createHash, randomBytes } = await import('node:crypto');
+    const url = baseUrl.replace(/\/$/, '');
+    // 1. DCR a public PKCE client. One per machine — keeps the per-client
+    //    audit trail clean and avoids a shared client_id across the SDK
+    //    user base.
+    const dcr = await fetch(`${url}/oauth/register`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_name: hostFingerprint(),
+            redirect_uris: [`http://127.0.0.1`], // placeholder; the real one is added per-flow with the chosen port
+            grant_types: ['authorization_code', 'refresh_token'],
+            software_id: 'getstackrun.sdk-ts.bootstrap',
+        }),
+    });
+    if (!dcr.ok) {
+        throw new Error(`STACK SDK: client registration failed (${dcr.status}). Try setting STACK_API_KEY or running \`stack-cli auth login\`.`);
+    }
+    const { client_id } = (await dcr.json());
+    // 2. PKCE pair.
+    const verifier = randomBytes(32).toString('base64url');
+    const challenge = createHash('sha256').update(verifier).digest('base64url');
+    const state = randomBytes(16).toString('base64url');
+    // 3. Spawn the localhost callback server FIRST (so we can claim the port
+    //    before the browser opens), then open the browser to /oauth/authorize.
+    const { server, port, codePromise } = await spawnCallbackServer(state);
+    // 4. Re-register the client with the actual loopback URI now that we
+    //    know the port. (DCR is open, the second register supersedes the
+    //    first for redirect_uri matching.)
+    const reRegister = await fetch(`${url}/oauth/register`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_name: hostFingerprint(),
+            redirect_uris: [`http://127.0.0.1:${port}/callback`],
+            grant_types: ['authorization_code', 'refresh_token'],
+            software_id: 'getstackrun.sdk-ts.bootstrap',
+        }),
+    });
+    if (!reRegister.ok) {
+        server.close();
+        throw new Error(`STACK SDK: client re-registration with loopback URI failed (${reRegister.status}).`);
+    }
+    const { client_id: scopedClientId } = (await reRegister.json());
+    const authorizeUrl = `${url}/oauth/authorize?` + new URLSearchParams({
+        response_type: 'code',
+        client_id: scopedClientId,
+        redirect_uri: `http://127.0.0.1:${port}/callback`,
+        scope: 'passports:read passports:write agents:read agents:write services:read services:connect credentials:read proxy:read proxy:write audit:read',
+        resource: 'https://api.getstack.run',
+        code_challenge: challenge,
+        code_challenge_method: 'S256',
+        state,
+    }).toString();
+    process.stderr.write(`\n  STACK SDK first-run sign-in\n`);
+    process.stderr.write(`  ──────────────────────────\n\n`);
+    process.stderr.write(`  Opening your browser to approve.\n`);
+    process.stderr.write(`  If it doesn't open, paste this URL:\n\n  ${authorizeUrl}\n\n`);
+    await openBrowser(authorizeUrl);
+    // 5. Wait for the callback to deliver the code.
+    let code;
+    try {
+        code = await codePromise;
+    }
+    catch (err) {
+        server.close();
+        throw err;
+    }
+    server.close();
+    // 6. Exchange the code for tokens.
+    const tok = await fetch(`${url}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'authorization_code',
+            code,
+            redirect_uri: `http://127.0.0.1:${port}/callback`,
+            client_id: scopedClientId,
+            code_verifier: verifier,
+        }),
+    });
+    if (!tok.ok) {
+        const data = await tok.json().catch(() => ({}));
+        throw new Error(`STACK SDK: token exchange failed (${tok.status}) ${JSON.stringify(data)}`);
+    }
+    const { access_token, refresh_token, expires_in } = (await tok.json());
+    // 7. Persist for subsequent runs. Same file the CLI writes.
+    const stored = {
+        client_id: scopedClientId,
+        refresh_token,
+        issued_at: Math.floor(Date.now() / 1000),
+        refresh_expires_at: Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60,
+        scope: 'passports:read passports:write agents:read agents:write services:read services:connect credentials:read proxy:read proxy:write audit:read',
+    };
+    await writeCredentialsFile(stored);
+    process.stderr.write(`  Signed in. Credentials saved to ${await credentialsFilePath()}\n\n`);
+    void client_id; // keep linter happy — initial DCR is superseded
+    return { access_token, refresh_token, expires_in, client_id: scopedClientId };
+}
+// ─── Helpers ──────────────────────────────────────────────────────────
+function hostFingerprint() {
+    // Best-effort label so the operator can recognize the client in their
+    // dashboard (when we ship the per-client list view). Falls through to
+    // a generic name in environments where os.hostname is locked down.
+    try {
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const os = require('node:os');
+        const host = os.hostname?.() ?? 'sdk-host';
+        return `STACK SDK on ${host.slice(0, 40)}`;
+    }
+    catch {
+        return 'STACK SDK';
+    }
+}
+async function openBrowser(url) {
+    const { spawn } = await import('node:child_process');
+    try {
+        if (process.platform === 'darwin') {
+            spawn('open', [url], { stdio: 'ignore', detached: true }).unref();
+        }
+        else if (process.platform === 'win32') {
+            spawn('cmd', ['/c', 'start', '', url], { stdio: 'ignore', detached: true }).unref();
+        }
+        else {
+            spawn('xdg-open', [url], { stdio: 'ignore', detached: true }).unref();
+        }
+    }
+    catch {
+        /* best-effort — the URL is also printed */
+    }
+}
+async function spawnCallbackServer(expectedState) {
+    const { createServer } = await import('node:http');
+    return new Promise((resolve, reject) => {
+        const server = createServer((req, res) => {
+            try {
+                const parsed = new URL(req.url ?? '/', 'http://127.0.0.1');
+                if (parsed.pathname !== '/callback') {
+                    res.writeHead(404, { 'Content-Type': 'text/plain' });
+                    res.end('Not found');
+                    return;
+                }
+                const code = parsed.searchParams.get('code');
+                const state = parsed.searchParams.get('state');
+                const error = parsed.searchParams.get('error');
+                if (error) {
+                    res.writeHead(400, { 'Content-Type': 'text/html' });
+                    res.end(`<html><body style="font-family:system-ui;padding:40px"><h1>Sign-in failed</h1><p>${escape(error)}</p><p>You can close this tab.</p></body></html>`);
+                    rejectCb(new Error(`OAuth authorize returned error: ${error}`));
+                    return;
+                }
+                if (!code || state !== expectedState) {
+                    res.writeHead(400, { 'Content-Type': 'text/html' });
+                    res.end(`<html><body style="font-family:system-ui;padding:40px"><h1>Invalid callback</h1><p>State mismatch or missing code.</p></body></html>`);
+                    rejectCb(new Error('Invalid callback: state mismatch or missing code'));
+                    return;
+                }
+                res.writeHead(200, { 'Content-Type': 'text/html' });
+                res.end(`<html><body style="font-family:system-ui;padding:40px;text-align:center"><h1>Signed in</h1><p>You can close this tab and return to your terminal.</p></body></html>`);
+                resolveCb(code);
+            }
+            catch (err) {
+                res.writeHead(500, { 'Content-Type': 'text/plain' });
+                res.end('Internal error');
+                rejectCb(err);
+            }
+        });
+        let resolveCb;
+        let rejectCb;
+        const codePromise = new Promise((res, rej) => {
+            resolveCb = res;
+            rejectCb = rej;
+        });
+        // Bind to a random free port.
+        server.listen(0, '127.0.0.1', () => {
+            const addr = server.address();
+            if (typeof addr === 'object' && addr && typeof addr.port === 'number') {
+                // Auth-code + browser flow gets DEFAULT_AUTH_TIMEOUT_MS to complete.
+                const timer = setTimeout(() => {
+                    rejectCb(new Error('Sign-in timed out (5 min). Re-run to try again.'));
+                }, DEFAULT_AUTH_TIMEOUT_MS);
+                codePromise.finally(() => clearTimeout(timer));
+                resolve({ server, port: addr.port, codePromise });
+            }
+            else {
+                reject(new Error('Failed to bind localhost callback server'));
+            }
+        });
+        server.on('error', reject);
+    });
+}
+function escape(s) {
+    return s.replace(/[&<>"']/g, (c) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' })[c] ?? c);
+}
+//# sourceMappingURL=browser-bootstrap.js.map

package/dist/browser-bootstrap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-bootstrap.js","sourceRoot":"","sources":["../src/browser-bootstrap.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,uBAAuB;AACvB,EAAE;AACF,+DAA+D;AAC/D,mEAAmE;AACnE,mEAAmE;AACnE,mEAAmE;AACnE,+DAA+D;AAC/D,EAAE;AACF,uBAAuB;AACvB,oEAAoE;AACpE,mEAAmE;AACnE,wDAAwD;AACxD,EAAE;AACF,mEAAmE;AACnE,mEAAmE;AACnE,iEAAiE;AACjE,oEAAoE;AACpE,uCAAuC;AAGvC,OAAO,EAAE,oBAAoB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAElF,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,wCAAwC;AASvF;;;GAGG;AACH,MAAM,UAAU,yBAAyB;IACvC,IAAI,OAAO,OAAO,KAAK,WAAW;QAAE,OAAO,KAAK,CAAC;IACjD,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,KAAK;QAAE,OAAO,KAAK,CAAC;IACzC,IAAI,OAAO,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,OAAO;QAAE,OAAO,KAAK,CAAC;IACpE,IAAI,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC,CAAC,mCAAmC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAAe;IACpD,MAAM,EAAE,UAAU,EAAE,WAAW,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAEvC,sEAAsE;IACtE,oEAAoE;IACpE,gBAAgB;IAChB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,iBAAiB,EAAE;QAC/C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,eAAe,EAAE;YAC9B,aAAa,EAAE,CAAC,kBAAkB,CAAC,EAAE,mEAAmE;YACxG,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,WAAW,EAAE,8BAA8B;SAC5C,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CAAC,0CAA0C,GAAG,CAAC,MAAM,mEAAmE,CAAC,CAAC;IAC3I,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0B,CAAC;IAElE,gBAAgB;IAChB,MAAM,QAAQ,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;IAC5E,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IAEpD,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,MAAM,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAEvE,qEAAqE;IACrE,qEAAqE;IACrE,uCAAuC;IACvC,MAAM,UAAU,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,iBAAiB,EAAE;QACtD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,eAAe,EAAE;YAC9B,aAAa,EAAE,CAAC,oBAAoB,IAAI,WAAW,CAAC;YACpD,WAAW,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACpD,WAAW,EAAE,8BAA8B;SAC5C,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,+DAA+D,UAAU,CAAC,MAAM,IAAI,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,MAAM,UAAU,CAAC,IAAI,EAAE,CAA0B,CAAC;IAEzF,MAAM,YAAY,GAAG,GAAG,GAAG,mBAAmB,GAAG,IAAI,eAAe,CAAC;QACnE,aAAa,EAAE,MAAM;QACrB,SAAS,EAAE,cAAc;QACzB,YAAY,EAAE,oBAAoB,IAAI,WAAW;QACjD,KAAK,EAAE,2IAA2I;QAClJ,QAAQ,EAAE,0BAA0B;QACpC,cAAc,EAAE,SAAS;QACzB,qBAAqB,EAAE,MAAM;QAC7B,KAAK;KACN,CAAC,CAAC,QAAQ,EAAE,CAAC;IAEd,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;IAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACzD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,8CAA8C,YAAY,MAAM,CAAC,CAAC;IAEvF,MAAM,WAAW,CAAC,YAAY,CAAC,CAAC;IAEhC,gDAAgD;IAChD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,WAAW,CAAC;IAC3B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,CAAC;IACZ,CAAC;IACD,MAAM,CAAC,KAAK,EAAE,CAAC;IAEf,mCAAmC;IACnC,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,cAAc,EAAE;QAC5C,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,oBAAoB;YAChC,IAAI;YACJ,YAAY,EAAE,oBAAoB,IAAI,WAAW;YACjD,SAAS,EAAE,cAAc;YACzB,aAAa,EAAE,QAAQ;SACxB,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,qCAAqC,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAKpE,CAAC;IAEF,4DAA4D;IAC5D,MAAM,MAAM,GAAsB;QAChC,SAAS,EAAE,cAAc;QACzB,aAAa;QACb,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACxC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;QACrE,KAAK,EAAE,2IAA2I;KACnJ,CAAC;IACF,MAAM,oBAAoB,CAAC,MAAM,CAAC,CAAC;IACnC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,qCAAqC,MAAM,mBAAmB,EAAE,MAAM,CAAC,CAAC;IAE7F,KAAK,SAAS,CAAC,CAAC,gDAAgD;IAChE,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,cAAc,EAAE,CAAC;AAChF,CAAC;AAED,yEAAyE;AAEzE,SAAS,eAAe;IACtB,sEAAsE;IACtE,sEAAsE;IACtE,mEAAmE;IACnE,IAAI,CAAC;QACH,iEAAiE;QACjE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAI,EAAE,CAAC,QAAQ,EAAE,EAAyB,IAAI,UAAU,CAAC;QACnE,OAAO,gBAAgB,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IAC7C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,WAAW,CAAC;IACrB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,WAAW,CAAC,GAAW;IACpC,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IACrD,IAAI,CAAC;QACH,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAClC,KAAK,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACpE,CAAC;aAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YACxC,KAAK,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC;QACxE,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;AACH,CAAC;AAQD,KAAK,UAAU,mBAAmB,CAAC,aAAqB;IACtD,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACnD,OAAO,IAAI,OAAO,CAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACtD,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACvC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,kBAAkB,CAAC,CAAC;gBAC3D,IAAI,MAAM,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;oBACpC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;oBACrD,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;oBACrB,OAAO;gBACT,CAAC;gBACD,MAAM,IAAI,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,oFAAoF,MAAM,CAAC,KAAK,CAAC,kDAAkD,CAAC,CAAC;oBAC7J,QAAQ,CAAC,IAAI,KAAK,CAAC,mCAAmC,KAAK,EAAE,CAAC,CAAC,CAAC;oBAChE,OAAO;gBACT,CAAC;gBACD,IAAI,CAAC,IAAI,IAAI,KAAK,KAAK,aAAa,EAAE,CAAC;oBACrC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;oBACpD,GAAG,CAAC,GAAG,CAAC,sIAAsI,CAAC,CAAC;oBAChJ,QAAQ,CAAC,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC,CAAC;oBACxE,OAAO;gBACT,CAAC;gBACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,WAAW,EAAE,CAAC,CAAC;gBACpD,GAAG,CAAC,GAAG,CAAC,qKAAqK,CAAC,CAAC;gBAC/K,SAAS,CAAC,IAAI,CAAC,CAAC;YAClB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC,CAAC;gBACrD,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;gBAC1B,QAAQ,CAAC,GAAY,CAAC,CAAC;YACzB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,IAAI,SAAiC,CAAC;QACtC,IAAI,QAA8B,CAAC;QACnC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAS,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACnD,SAAS,GAAG,GAAG,CAAC;YAChB,QAAQ,GAAG,GAAG,CAAC;QACjB,CAAC,CAAC,CAAC;QAEH,8BAA8B;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE;YACjC,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,EAAE,CAAC;YAC9B,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACtE,qEAAqE;gBACrE,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC5B,QAAQ,CAAC,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC,CAAC;gBACzE,CAAC,EAAE,uBAAuB,CAAC,CAAC;gBAC5B,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC;gBAC/C,OAAO,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,IAAI,KAAK,CAAC,0CAA0C,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,OAAO,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzH,CAAC"}

package/dist/client.d.ts

@@ -1,11 +1,28 @@
 export interface ClientOptions {
-    apiKey: string;
+    /**
+     * Long-lived `sk_live_*` operator/member key. When omitted, the SDK
+     * falls back to (a) the `STACK_API_KEY` env var, (b) a refresh token
+     * stored at `~/.stack/credentials.json` (written by `stack-cli auth
+     * login`), exchanged on demand for a 5-minute access token.
+     */
+    apiKey?: string;
     baseUrl?: string;
+    /**
+     * Phase 2 — agent-runtime mode. When set, every request is signed with
+     * a fresh 60-second EdDSA JWT minted from the agent's local privkey
+     * (~/.stack/agents/<agent_id>.json, mode 0600). On first run, the SDK
+     * generates the keypair locally and enrolls the public half via
+     * /v1/agents/:id/enroll using the developer's OAuth credentials —
+     * the privkey never crosses the network or terminal.
+     */
+    agent_id?: string;
 }
 export declare class HttpClient {
-    private readonly apiKey;
+    private readonly explicitApiKey;
     private readonly baseUrl;
-    constructor(options: ClientOptions);
+    private cachedAccessToken;
+    private readonly agentTokenProvider;
+    constructor(options?: ClientOptions);
     get<T>(path: string, query?: Record<string, string | undefined>): Promise<T>;
     post<T>(path: string, body?: unknown, options?: {
         headers?: Record<string, string>;
@@ -18,6 +35,28 @@ export declare class HttpClient {
     }): Promise<T>;
     delete<T>(path: string): Promise<T>;
     private buildUrl;
+    /**
+     * Resolve the bearer token to attach to a request. Three sources, in
+     * priority order:
+     *   1. Explicit `apiKey` on the constructor or STACK_API_KEY env var
+     *      (legacy `sk_live_*`, preserved for CI).
+     *   2. Cached OAuth access token (5-minute TTL; refresh-rotates).
+     *   3. Refresh token in `~/.stack/credentials.json` (written by the
+     *      CLI's `auth login`) — exchanged for a fresh access token.
+     *
+     * Throws `StackError('NOT_AUTHENTICATED', ...)` when none of the
+     * three resolve.
+     */
+    private resolveBearer;
+    /**
+     * Static-bearer resolution: explicit apiKey → STACK_API_KEY env →
+     * ~/.stack/credentials.json refresh-token exchange → first-run
+     * browser-spawn bootstrap (interactive only). Does NOT mint agent
+     * JWTs — that's `resolveBearer()`'s job. Exposed separately so the
+     * agent-token provider can use this same path for the one-time
+     * enrollment dance (which itself needs a static bearer to authenticate).
+     */
+    private resolveStaticBearer;
     private request;
 }
 //# sourceMappingURL=client.d.ts.map

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;gBAErB,OAAO,EAAE,aAAa;IAK5B,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK5E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKjG,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKlG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKhG,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKzC,OAAO,CAAC,QAAQ;YAUF,OAAO;CAiCtB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,aAAa;IAC5B;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;;;OAOG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,UAAU;IACrB,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAS;IACjC,OAAO,CAAC,iBAAiB,CAAqD;IAC9E,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAiC;gBAExD,OAAO,GAAE,aAAkB;IAkBjC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAK5E,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKjG,KAAK,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKlG,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAAG,OAAO,CAAC,CAAC,CAAC;IAKhG,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC;IAKzC,OAAO,CAAC,QAAQ;IAUhB;;;;;;;;;;;OAWG;YACW,aAAa;IAU3B;;;;;;;OAOG;YACW,mBAAmB;YAgCnB,OAAO;CAkCtB"}

package/dist/client.js

@@ -1,10 +1,28 @@
 import { StackError } from './errors.js';
+import { createAgentTokenProvider } from './agent-auth.js';
+import { readCredentialsFile, writeCredentialsFile } from './credentials-file.js';
+import { browserBootstrap, shouldRunBrowserBootstrap } from './browser-bootstrap.js';
 export class HttpClient {
-    apiKey;
+    explicitApiKey;
     baseUrl;
-    constructor(options) {
-        this.apiKey = options.apiKey;
-        this.baseUrl = (options.baseUrl ?? 'https://api.getstack.run').replace(/\/$/, '');
+    cachedAccessToken = null;
+    agentTokenProvider;
+    constructor(options = {}) {
+        this.explicitApiKey = options.apiKey ?? process.env['STACK_API_KEY'] ?? undefined;
+        this.baseUrl = (options.baseUrl ?? process.env['STACK_API_URL'] ?? 'https://api.getstack.run').replace(/\/$/, '');
+        this.agentTokenProvider = options.agent_id
+            ? createAgentTokenProvider({
+                agentId: options.agent_id,
+                baseUrl: this.baseUrl,
+                // Bearer for the enrollment dance only — once enrolled the
+                // agent JWTs sign requests directly. Reuse the OAuth refresh
+                // path so the developer doesn't need to ship a separate key
+                // to their agent runtime; if neither STACK_API_KEY nor
+                // ~/.stack/credentials.json is present, enrollment will fail
+                // with a clear error.
+                bearerProvider: () => this.resolveStaticBearer(),
+            })
+            : null;
     }
     async get(path, query) {
         const url = this.buildUrl(path, query);
@@ -36,9 +54,67 @@ export class HttpClient {
         }
         return url.toString();
     }
+    /**
+     * Resolve the bearer token to attach to a request. Three sources, in
+     * priority order:
+     *   1. Explicit `apiKey` on the constructor or STACK_API_KEY env var
+     *      (legacy `sk_live_*`, preserved for CI).
+     *   2. Cached OAuth access token (5-minute TTL; refresh-rotates).
+     *   3. Refresh token in `~/.stack/credentials.json` (written by the
+     *      CLI's `auth login`) — exchanged for a fresh access token.
+     *
+     * Throws `StackError('NOT_AUTHENTICATED', ...)` when none of the
+     * three resolve.
+     */
+    async resolveBearer() {
+        // Phase 2 — agent-runtime mode short-circuits everything. Mint a
+        // fresh agent JWT per request; enrollment happens inside the
+        // provider on first call.
+        if (this.agentTokenProvider) {
+            return this.agentTokenProvider();
+        }
+        return this.resolveStaticBearer();
+    }
+    /**
+     * Static-bearer resolution: explicit apiKey → STACK_API_KEY env →
+     * ~/.stack/credentials.json refresh-token exchange → first-run
+     * browser-spawn bootstrap (interactive only). Does NOT mint agent
+     * JWTs — that's `resolveBearer()`'s job. Exposed separately so the
+     * agent-token provider can use this same path for the one-time
+     * enrollment dance (which itself needs a static bearer to authenticate).
+     */
+    async resolveStaticBearer() {
+        if (this.explicitApiKey)
+            return this.explicitApiKey;
+        // Browser / non-Node runtimes: refresh-from-file is not possible.
+        // Fall through to the same NOT_AUTHENTICATED error.
+        const isNode = typeof process !== 'undefined' && process.versions?.node;
+        if (!isNode)
+            throw notAuthenticated();
+        const now = Math.floor(Date.now() / 1000);
+        if (this.cachedAccessToken && this.cachedAccessToken.expiresAt - 30 > now) {
+            // Re-use the cached access token unless within 30s of expiry.
+            return this.cachedAccessToken.token;
+        }
+        const fresh = await refreshAccessTokenFromFile(this.baseUrl);
+        if (fresh) {
+            this.cachedAccessToken = { token: fresh.access_token, expiresAt: now + (fresh.expires_in ?? 300) };
+            return fresh.access_token;
+        }
+        // Last resort: spawn the browser. Gated by TTY + opt-out env so
+        // production agent runtimes (no TTY) don't accidentally try to open
+        // a browser.
+        if (shouldRunBrowserBootstrap()) {
+            const result = await browserBootstrap(this.baseUrl);
+            this.cachedAccessToken = { token: result.access_token, expiresAt: now + result.expires_in };
+            return result.access_token;
+        }
+        throw notAuthenticated();
+    }
     async request(method, url, body, extraHeaders) {
+        const bearer = await this.resolveBearer();
         const headers = {
-            'Authorization': `Bearer ${this.apiKey}`,
+            'Authorization': `Bearer ${bearer}`,
             'Accept': 'application/json',
             ...(extraHeaders ?? {}),
         };
@@ -67,4 +143,48 @@ export class HttpClient {
         return res.json();
     }
 }
+function notAuthenticated() {
+    return new StackError('No STACK credentials found. Set STACK_API_KEY, pass { apiKey } to new Stack(), or run `stack-cli auth login`.', 'NOT_AUTHENTICATED', 401, {});
+}
+/**
+ * Read `~/.stack/credentials.json` (written by the CLI or by the SDK's
+ * own browser-bootstrap), exchange the stored refresh token for a fresh
+ * access token, write the rotated refresh back to the file. Returns
+ * null when the file is missing or the refresh has been revoked.
+ *
+ * Lazy-loaded Node-only path. The browser bundle skips this entirely
+ * via the isNode check in resolveBearer.
+ */
+async function refreshAccessTokenFromFile(baseUrl) {
+    const creds = await readCredentialsFile();
+    if (!creds)
+        return null;
+    const res = await fetch(`${baseUrl}/oauth/token`, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+        body: new URLSearchParams({
+            grant_type: 'refresh_token',
+            refresh_token: creds.refresh_token,
+            client_id: creds.client_id,
+        }),
+    });
+    if (!res.ok)
+        return null;
+    const data = (await res.json());
+    // Persist the rotated refresh — failure to write means next run pays
+    // the round-trip again, but the in-memory access token is still good.
+    const next = {
+        ...creds,
+        refresh_token: data.refresh_token,
+        issued_at: Math.floor(Date.now() / 1000),
+        refresh_expires_at: Math.floor(Date.now() / 1000) + 30 * 24 * 60 * 60,
+    };
+    try {
+        await writeCredentialsFile(next);
+    }
+    catch {
+        /* non-fatal */
+    }
+    return { access_token: data.access_token, expires_in: data.expires_in };
+}
 //# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAOzC,MAAM,OAAO,UAAU;IACJ,MAAM,CAAS;IACf,OAAO,CAAS;IAEjC,YAAY,OAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACpF,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAA0C;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAA0C;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,GAAW,EAAE,IAAc,EAAE,YAAqC;QACzG,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,IAAI,CAAC,MAAM,EAAE;YACxC,QAAQ,EAAE,kBAAkB;YAC5B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;SACxB,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,SAAS,GAAsE,EAAE,CAAC;YACtF,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC;YAChF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;CACF"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,mBAAmB,EAAE,oBAAoB,EAA0B,MAAM,uBAAuB,CAAC;AAC1G,OAAO,EAAE,gBAAgB,EAAE,yBAAyB,EAAE,MAAM,wBAAwB,CAAC;AAsBrF,MAAM,OAAO,UAAU;IACJ,cAAc,CAAqB;IACnC,OAAO,CAAS;IACzB,iBAAiB,GAAgD,IAAI,CAAC;IAC7D,kBAAkB,CAAiC;IAEpE,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,cAAc,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,SAAS,CAAC;QAClF,IAAI,CAAC,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,0BAA0B,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAClH,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,QAAQ;YACxC,CAAC,CAAC,wBAAwB,CAAC;gBACvB,OAAO,EAAE,OAAO,CAAC,QAAQ;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,2DAA2D;gBAC3D,6DAA6D;gBAC7D,4DAA4D;gBAC5D,uDAAuD;gBACvD,6DAA6D;gBAC7D,sBAAsB;gBACtB,cAAc,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,EAAE;aACjD,CAAC;YACJ,CAAC,CAAC,IAAI,CAAC;IACX,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,KAA0C;QACnE,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACvC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,IAAI,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACxF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9D,CAAC;IAED,KAAK,CAAC,KAAK,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACzF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAED,KAAK,CAAC,GAAG,CAAI,IAAY,EAAE,IAAc,EAAE,OAA8C;QACvF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,KAAK,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,CAAC;IAED,KAAK,CAAC,MAAM,CAAI,IAAY;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC,OAAO,CAAI,QAAQ,EAAE,GAAG,CAAC,CAAC;IACxC,CAAC;IAEO,QAAQ,CAAC,IAAY,EAAE,KAA0C;QACvE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,IAAI,KAAK,KAAK,SAAS;oBAAE,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;QACD,OAAO,GAAG,CAAC,QAAQ,EAAE,CAAC;IACxB,CAAC;IAED;;;;;;;;;;;OAWG;IACK,KAAK,CAAC,aAAa;QACzB,iEAAiE;QACjE,6DAA6D;QAC7D,0BAA0B;QAC1B,IAAI,IAAI,CAAC,kBAAkB,EAAE,CAAC;YAC5B,OAAO,IAAI,CAAC,kBAAkB,EAAE,CAAC;QACnC,CAAC;QACD,OAAO,IAAI,CAAC,mBAAmB,EAAE,CAAC;IACpC,CAAC;IAED;;;;;;;OAOG;IACK,KAAK,CAAC,mBAAmB;QAC/B,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO,IAAI,CAAC,cAAc,CAAC;QAEpD,kEAAkE;QAClE,oDAAoD;QACpD,MAAM,MAAM,GAAG,OAAO,OAAO,KAAK,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC;QACxE,IAAI,CAAC,MAAM;YAAE,MAAM,gBAAgB,EAAE,CAAC;QAEtC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,IAAI,IAAI,CAAC,iBAAiB,IAAI,IAAI,CAAC,iBAAiB,CAAC,SAAS,GAAG,EAAE,GAAG,GAAG,EAAE,CAAC;YAC1E,8DAA8D;YAC9D,OAAO,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;QACtC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,CAAC;YACV,IAAI,CAAC,iBAAiB,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC,KAAK,CAAC,UAAU,IAAI,GAAG,CAAC,EAAE,CAAC;YACnG,OAAO,KAAK,CAAC,YAAY,CAAC;QAC5B,CAAC;QAED,gEAAgE;QAChE,oEAAoE;QACpE,aAAa;QACb,IAAI,yBAAyB,EAAE,EAAE,CAAC;YAChC,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACpD,IAAI,CAAC,iBAAiB,GAAG,EAAE,KAAK,EAAE,MAAM,CAAC,YAAY,EAAE,SAAS,EAAE,GAAG,GAAG,MAAM,CAAC,UAAU,EAAE,CAAC;YAC5F,OAAO,MAAM,CAAC,YAAY,CAAC;QAC7B,CAAC;QAED,MAAM,gBAAgB,EAAE,CAAC;IAC3B,CAAC;IAEO,KAAK,CAAC,OAAO,CAAI,MAAc,EAAE,GAAW,EAAE,IAAc,EAAE,YAAqC;QACzG,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC1C,MAAM,OAAO,GAA2B;YACtC,eAAe,EAAE,UAAU,MAAM,EAAE;YACnC,QAAQ,EAAE,kBAAkB;YAC5B,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC;SACxB,CAAC;QAEF,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,OAAO,CAAC,cAAc,CAAC,GAAG,kBAAkB,CAAC;QAC/C,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAC3B,MAAM;YACN,OAAO;YACP,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;SAC5D,CAAC,CAAC;QAEH,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,SAAS,GAAsE,EAAE,CAAC;YACtF,IAAI,CAAC;gBACH,SAAS,GAAG,MAAM,GAAG,CAAC,IAAI,EAAsB,CAAC;YACnD,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;YAED,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,IAAI,SAAS,CAAC,OAAO,IAAI,GAAG,CAAC,UAAU,CAAC;YAChF,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,EAAE,IAAI,IAAI,QAAQ,GAAG,CAAC,MAAM,EAAE,CAAC;YAC3D,MAAM,IAAI,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;QAC7D,CAAC;QAED,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;YAAE,OAAO,SAAc,CAAC;QAC9C,OAAO,GAAG,CAAC,IAAI,EAAgB,CAAC;IAClC,CAAC;CACF;AAED,SAAS,gBAAgB;IACvB,OAAO,IAAI,UAAU,CACnB,+GAA+G,EAC/G,mBAAmB,EACnB,GAAG,EACH,EAAE,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,0BAA0B,CACvC,OAAe;IAEf,MAAM,KAAK,GAAG,MAAM,mBAAmB,EAAE,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IAExB,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,cAAc,EAAE;QAChD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,UAAU,EAAE,eAAe;YAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B,CAAC;KACH,CAAC,CAAC;IACH,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAwE,CAAC;IAEvG,qEAAqE;IACrE,sEAAsE;IACtE,MAAM,IAAI,GAAsB;QAC9B,GAAG,KAAK;QACR,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC;QACxC,kBAAkB,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE;KACtE,CAAC;IACF,IAAI,CAAC;QACH,MAAM,oBAAoB,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;AAC1E,CAAC"}

package/dist/credentials-file.d.ts

@@ -0,0 +1,12 @@
+export interface StoredCredentials {
+    client_id: string;
+    refresh_token: string;
+    issued_at: number;
+    refresh_expires_at: number;
+    operator_email?: string;
+    scope: string;
+}
+export declare function credentialsFilePath(): Promise<string>;
+export declare function readCredentialsFile(): Promise<StoredCredentials | null>;
+export declare function writeCredentialsFile(creds: StoredCredentials): Promise<void>;
+//# sourceMappingURL=credentials-file.d.ts.map

package/dist/credentials-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-file.d.ts","sourceRoot":"","sources":["../src/credentials-file.ts"],"names":[],"mappings":"AAOA,MAAM,WAAW,iBAAiB;IAChC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,MAAM,CAAC,CAI3D;AAED,wBAAsB,mBAAmB,IAAI,OAAO,CAAC,iBAAiB,GAAG,IAAI,CAAC,CAS7E;AAED,wBAAsB,oBAAoB,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAYlF"}

package/dist/credentials-file.js

@@ -0,0 +1,37 @@
+// Shared read/write helpers for ~/.stack/credentials.json.
+//
+// Same file the CLI's `auth login` writes; same file the SDK's
+// browser-bootstrap writes. Read by client.ts on every static-bearer
+// resolve. Centralized here so the on-disk shape stays consistent
+// across all three writers.
+export async function credentialsFilePath() {
+    const { homedir } = await import('node:os');
+    const { join } = await import('node:path');
+    return join(homedir(), '.stack', 'credentials.json');
+}
+export async function readCredentialsFile() {
+    try {
+        const { readFile } = await import('node:fs/promises');
+        const path = await credentialsFilePath();
+        const raw = await readFile(path, 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+export async function writeCredentialsFile(creds) {
+    const { mkdir, writeFile, chmod } = await import('node:fs/promises');
+    const { join, dirname } = await import('node:path');
+    const { homedir } = await import('node:os');
+    const path = join(homedir(), '.stack', 'credentials.json');
+    await mkdir(dirname(path), { recursive: true });
+    await writeFile(path, JSON.stringify(creds, null, 2), 'utf8');
+    try {
+        await chmod(path, 0o600);
+    }
+    catch {
+        /* Windows / unsupported FS — default ACL on %USERPROFILE%\.stack is user-scoped */
+    }
+}
+//# sourceMappingURL=credentials-file.js.map

package/dist/credentials-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-file.js","sourceRoot":"","sources":["../src/credentials-file.ts"],"names":[],"mappings":"AAAA,2DAA2D;AAC3D,EAAE;AACF,+DAA+D;AAC/D,qEAAqE;AACrE,kEAAkE;AAClE,4BAA4B;AAW5B,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,EAAE,IAAI,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IAC3C,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AACvD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB;IACvC,IAAI,CAAC;QACH,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACtD,MAAM,IAAI,GAAG,MAAM,mBAAmB,EAAE,CAAC;QACzC,MAAM,GAAG,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAsB,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,KAAwB;IACjE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACrE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;IACpD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,mFAAmF;IACrF,CAAC;AACH,CAAC"}

package/dist/index.d.ts

@@ -31,7 +31,7 @@ export declare class Stack {
     readonly scan: ScanService;
     readonly audit: AuditService;
     readonly detectorConfig: DetectorConfigService;
-    constructor(options: ClientOptions);
+    constructor(options?: ClientOptions);
 }
 export type { ClientOptions } from './client.js';
 export * from './types.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;gBAEnC,OAAO,EAAE,aAAa;CAkBnC;AAGD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAK5B,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAc,KAAK,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,qBAAa,KAAK;IAChB,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAa;IAEpC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,eAAe,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,WAAW,EAAE,iBAAiB,CAAC;IACxC,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;IAClC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,eAAe,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,eAAe,EAAE,qBAAqB,CAAC;IAChD,QAAQ,CAAC,aAAa,EAAE,mBAAmB,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,oBAAoB,CAAC;IAC9C,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,YAAY,CAAC;IAC7B,QAAQ,CAAC,cAAc,EAAE,qBAAqB,CAAC;gBAEnC,OAAO,GAAE,aAAkB;CAkBxC;AAGD,YAAY,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACjD,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAK5B,OAAO,EACL,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,oBAAoB,GAC1B,MAAM,qBAAqB,CAAC"}

package/dist/index.js

@@ -31,7 +31,7 @@ export class Stack {
     scan;
     audit;
     detectorConfig;
-    constructor(options) {
+    constructor(options = {}) {
         this.client = new HttpClient(options);
         this.agents = new AgentService(this.client);
         this.passports = new PassportService(this.client);

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,OAAO,KAAK;IACC,MAAM,CAAa;IAE3B,MAAM,CAAe;IACrB,SAAS,CAAkB;IAC3B,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,QAAQ,CAAiB;IACzB,MAAM,CAAe;IACrB,QAAQ,CAAkB;IAC1B,IAAI,CAAc;IAClB,eAAe,CAAwB;IACvC,aAAa,CAAsB;IACnC,cAAc,CAAuB;IACrC,KAAK,CAAe;IACpB,IAAI,CAAc;IAClB,KAAK,CAAe;IACpB,cAAc,CAAwB;IAE/C,YAAY,OAAsB;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAID,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAE5B,wEAAwE;AACxE,uEAAuE;AACvE,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAsB,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,qBAAqB,EAAE,MAAM,gCAAgC,CAAC;AACvE,OAAO,EAAE,mBAAmB,EAAE,MAAM,6BAA6B,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AACnD,OAAO,EAAE,qBAAqB,EAAE,MAAM,+BAA+B,CAAC;AAEtE,MAAM,OAAO,KAAK;IACC,MAAM,CAAa;IAE3B,MAAM,CAAe;IACrB,SAAS,CAAkB;IAC3B,QAAQ,CAAiB;IACzB,WAAW,CAAoB;IAC/B,QAAQ,CAAiB;IACzB,MAAM,CAAe;IACrB,QAAQ,CAAkB;IAC1B,IAAI,CAAc;IAClB,eAAe,CAAwB;IACvC,aAAa,CAAsB;IACnC,cAAc,CAAuB;IACrC,KAAK,CAAe;IACpB,IAAI,CAAc;IAClB,KAAK,CAAe;IACpB,cAAc,CAAwB;IAE/C,YAAY,UAAyB,EAAE;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,UAAU,CAAC,OAAO,CAAC,CAAC;QACtC,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,SAAS,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,GAAG,IAAI,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACtD,IAAI,CAAC,QAAQ,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAChD,IAAI,CAAC,MAAM,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,CAAC,QAAQ,GAAG,IAAI,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,eAAe,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC9D,IAAI,CAAC,aAAa,GAAG,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC1D,IAAI,CAAC,cAAc,GAAG,IAAI,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5D,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,IAAI,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,KAAK,GAAG,IAAI,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,qBAAqB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/D,CAAC;CACF;AAID,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAE5B,wEAAwE;AACxE,uEAAuE;AACvE,uCAAuC;AACvC,OAAO,EACL,qBAAqB,GAGtB,MAAM,qBAAqB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@getstackrun/sdk",
-  "version": "0.2.0",
+  "version": "0.4.0",
   "description": "Official JavaScript/TypeScript SDK for STACK — runtime security layer for AI agents",
   "type": "module",
   "exports": {