@sekuire/sdk 0.1.11 → 0.1.12

package/dist/beacon.d.ts

@@ -35,6 +35,8 @@ export interface BeaconStatus {
     deploymentUrl?: string;
     lastHeartbeat?: Date;
     failedHeartbeats: number;
+    /** True if bootstrap failed and agent is running without Sekuire features */
+    degradedMode: boolean;
 }
 export interface BootstrapResponse {
     installation_id: string;
@@ -51,9 +53,13 @@ export declare class Beacon {
     private refreshToken;
     private lastHeartbeat;
     private failedHeartbeats;
+    private degradedMode;
     constructor(config: BeaconConfig);
     /**
      * Start the beacon - registers with Sekuire and begins heartbeat loop
+     *
+     * If bootstrap fails, the agent continues running in degraded mode
+     * without Sekuire features. This prevents auth failures from crashing agents.
      */
     start(): Promise<void>;
     /**
@@ -64,6 +70,21 @@ export declare class Beacon {
      * Get current beacon status
      */
     getStatus(): BeaconStatus;
+    /**
+     * Bootstrap with retry and exponential backoff
+     *
+     * Returns true if bootstrap succeeded, false if all retries exhausted.
+     * Does NOT throw - allows agent to continue in degraded mode.
+     */
+    private bootstrapWithRetry;
+    private sleep;
+    /**
+     * Attempt recovery bootstrap using API key when install token fails
+     *
+     * Recovery bootstrap allows re-issuing runtime credentials without
+     * needing a new install token from the dashboard.
+     */
+    private tryRecoveryBootstrap;
     /**
      * Bootstrap registration with Sekuire
      *

package/dist/index.d.ts

@@ -40,6 +40,8 @@ interface BeaconStatus {
     deploymentUrl?: string;
     lastHeartbeat?: Date;
     failedHeartbeats: number;
+    /** True if bootstrap failed and agent is running without Sekuire features */
+    degradedMode: boolean;
 }
 interface BootstrapResponse {
     installation_id: string;
@@ -56,9 +58,13 @@ declare class Beacon {
     private refreshToken;
     private lastHeartbeat;
     private failedHeartbeats;
+    private degradedMode;
     constructor(config: BeaconConfig);
     /**
      * Start the beacon - registers with Sekuire and begins heartbeat loop
+     *
+     * If bootstrap fails, the agent continues running in degraded mode
+     * without Sekuire features. This prevents auth failures from crashing agents.
      */
     start(): Promise<void>;
     /**
@@ -69,6 +75,21 @@ declare class Beacon {
      * Get current beacon status
      */
     getStatus(): BeaconStatus;
+    /**
+     * Bootstrap with retry and exponential backoff
+     *
+     * Returns true if bootstrap succeeded, false if all retries exhausted.
+     * Does NOT throw - allows agent to continue in degraded mode.
+     */
+    private bootstrapWithRetry;
+    private sleep;
+    /**
+     * Attempt recovery bootstrap using API key when install token fails
+     *
+     * Recovery bootstrap allows re-issuing runtime credentials without
+     * needing a new install token from the dashboard.
+     */
+    private tryRecoveryBootstrap;
     /**
      * Bootstrap registration with Sekuire
      *
@@ -2593,13 +2614,14 @@ interface TaskContext {
 type TaskHandler = (ctx: TaskContext, input: Record<string, unknown>) => Promise<unknown>;
 interface WorkerConfig {
     apiBaseUrl: string;
-    token: string;
-    agentId?: string;
-    apiKey?: string;
+    agentId: string;
+    installToken?: string;
+    runtimeToken?: string;
     heartbeatIntervalMs?: number;
     reconnectDelayMs?: number;
     maxReconnectDelayMs?: number;
     deploymentUrl?: string;
+    capabilities?: string[];
 }
 declare class TaskWorker {
     private eventSource;
@@ -2610,6 +2632,9 @@ declare class TaskWorker {
     private isConnected;
     private isPaused;
     private installationId;
+    private runtimeToken;
+    private refreshToken;
+    private expiresAt;
     private onCommandCallback?;
     constructor(config: WorkerConfig);
     /**
@@ -2640,9 +2665,9 @@ declare class TaskWorker {
      */
     private handleCommand;
     /**
-     * Get API key from config or environment
+     * Get runtime token for API calls
      */
-    private getApiKey;
+    private getToken;
     /**
      * Connect to SSE stream
      */
@@ -2660,13 +2685,18 @@ declare class TaskWorker {
      */
     private completeTask;
     /**
-     * Register this agent installation with Sekuire
+     * Register this agent installation with Sekuire using install_token
+     * Returns runtime_token for subsequent API calls
      */
     private bootstrap;
     /**
-     * Start heartbeat loop
+     * Start heartbeat/lease renewal loop
      */
     private startHeartbeat;
+    /**
+     * Refresh the runtime token using the refresh token
+     */
+    private refreshRuntimeToken;
 }
 declare function createWorker(config: WorkerConfig): TaskWorker;
 
@@ -2787,24 +2817,24 @@ interface AgentSkill {
 /** A2A message with role and parts */
 interface A2AMessage {
     /** Message role: "user" or "agent" */
-    role: "user" | "agent";
+    role: 'user' | 'agent';
     /** Message content parts */
     parts: A2AMessagePart[];
 }
 /** Message part content */
 type A2AMessagePart = {
-    type: "text";
+    type: 'text';
     text: string;
 } | {
-    type: "file";
+    type: 'file';
     uri: string;
     mimeType?: string;
 } | {
-    type: "data";
+    type: 'data';
     data: unknown;
 };
 /** A2A task states */
-type A2ATaskState = "pending" | "working" | "input-required" | "completed" | "failed" | "cancelled";
+type A2ATaskState = 'pending' | 'working' | 'input-required' | 'completed' | 'failed' | 'cancelled';
 /** A2A task status with timestamp */
 interface A2ATaskStatus {
     state: A2ATaskState;
@@ -2856,14 +2886,14 @@ interface A2ARouteResponse {
 }
 /** JSON-RPC 2.0 Request */
 interface JsonRpcRequest {
-    jsonrpc: "2.0";
+    jsonrpc: '2.0';
     method: string;
     id: string | number;
     params?: unknown;
 }
 /** JSON-RPC 2.0 Response */
 interface JsonRpcResponse<T = unknown> {
-    jsonrpc: "2.0";
+    jsonrpc: '2.0';
     id: string | number;
     result?: T;
     error?: JsonRpcError;

package/dist/index.esm.js

@@ -94,6 +94,7 @@ class Beacon {
         this.refreshToken = null;
         this.lastHeartbeat = null;
         this.failedHeartbeats = 0;
+        this.degradedMode = false;
         const resolvedApiKey = config.apiKey || this.getApiKey() || '';
         const resolvedInstallToken = config.installToken || this.getInstallToken();
         this.config = {
@@ -109,6 +110,9 @@ class Beacon {
     }
     /**
      * Start the beacon - registers with Sekuire and begins heartbeat loop
+     *
+     * If bootstrap fails, the agent continues running in degraded mode
+     * without Sekuire features. This prevents auth failures from crashing agents.
      */
     async start() {
         if (this.intervalId) {
@@ -121,16 +125,16 @@ class Beacon {
             console.log(`[Beacon] Deployment URL: ${deploymentUrl}`);
         }
         // Bootstrap registration (exchanges install token for runtime credentials)
-        try {
-            await this.bootstrap(deploymentUrl);
-            console.log(`[Beacon] Bootstrap successful, installation ID: ${this.installationId}`);
-        }
-        catch (error) {
-            console.error('[Beacon] Bootstrap failed:', error);
+        // On failure, continue in degraded mode - don't crash the agent
+        const bootstrapped = await this.bootstrapWithRetry(deploymentUrl);
+        if (!bootstrapped) {
+            this.degradedMode = true;
+            console.warn('[Beacon] Running in degraded mode - Sekuire features disabled');
+            console.warn('[Beacon] To re-enable: generate a new install token from the dashboard');
             this.notifyStatusChange();
-            // Cannot continue without bootstrap - runtime token required for heartbeats
-            throw error;
+            return;
         }
+        console.log(`[Beacon] Bootstrap successful, installation ID: ${this.installationId}`);
         // Start heartbeat loop
         const intervalMs = this.config.heartbeatIntervalSeconds * 1000;
         this.intervalId = setInterval(() => {
@@ -157,14 +161,106 @@ class Beacon {
      */
     getStatus() {
         return {
-            isRunning: this.intervalId !== null,
+            isRunning: this.intervalId !== null || this.degradedMode,
             installationId: this.installationId || undefined,
             runtimeToken: this.runtimeToken ? '***' + this.runtimeToken.slice(-4) : undefined,
             deploymentUrl: this.config.deploymentUrl || detectDeploymentUrl(),
             lastHeartbeat: this.lastHeartbeat || undefined,
             failedHeartbeats: this.failedHeartbeats,
+            degradedMode: this.degradedMode,
         };
     }
+    /**
+     * Bootstrap with retry and exponential backoff
+     *
+     * Returns true if bootstrap succeeded, false if all retries exhausted.
+     * Does NOT throw - allows agent to continue in degraded mode.
+     */
+    async bootstrapWithRetry(deploymentUrl, maxRetries = 3, initialDelayMs = 1000) {
+        let delay = initialDelayMs;
+        for (let attempt = 1; attempt <= maxRetries; attempt++) {
+            try {
+                await this.bootstrap(deploymentUrl);
+                return true;
+            }
+            catch (error) {
+                const isLastAttempt = attempt === maxRetries;
+                const errorMsg = error instanceof Error ? error.message : String(error);
+                // Check if error is permanent (expired/invalid token) vs transient (network)
+                const isPermanentError = errorMsg.includes('401') ||
+                    errorMsg.includes('expired') ||
+                    errorMsg.includes('invalid') ||
+                    errorMsg.includes('not found');
+                if (isPermanentError) {
+                    console.error(`[Beacon] Bootstrap failed (permanent error): ${errorMsg}`);
+                    // Try recovery bootstrap if we have API key
+                    if (this.config.apiKey && this.config.workspaceId) {
+                        console.log('[Beacon] Attempting recovery bootstrap with API key...');
+                        const recovered = await this.tryRecoveryBootstrap(deploymentUrl);
+                        if (recovered) {
+                            return true;
+                        }
+                    }
+                    console.error('[Beacon] Install token expired or invalid - generate a new one from the dashboard');
+                    return false;
+                }
+                if (isLastAttempt) {
+                    console.error(`[Beacon] Bootstrap failed after ${maxRetries} attempts: ${errorMsg}`);
+                    return false;
+                }
+                console.warn(`[Beacon] Bootstrap attempt ${attempt}/${maxRetries} failed: ${errorMsg}`);
+                console.warn(`[Beacon] Retrying in ${delay}ms...`);
+                await this.sleep(delay);
+                delay *= 2; // Exponential backoff
+            }
+        }
+        return false;
+    }
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+    /**
+     * Attempt recovery bootstrap using API key when install token fails
+     *
+     * Recovery bootstrap allows re-issuing runtime credentials without
+     * needing a new install token from the dashboard.
+     */
+    async tryRecoveryBootstrap(deploymentUrl) {
+        if (!this.config.apiKey || !this.config.workspaceId) {
+            return false;
+        }
+        try {
+            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/recovery`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-API-Key': this.config.apiKey,
+                },
+                body: JSON.stringify({
+                    agent_id: this.config.agentId,
+                    workspace_id: this.config.workspaceId,
+                    upstream_url: deploymentUrl,
+                    capabilities: this.config.capabilities ?? [],
+                    heartbeat_interval_seconds: this.config.heartbeatIntervalSeconds,
+                }),
+            });
+            if (!response.ok) {
+                const body = await response.text();
+                console.error(`[Beacon] Recovery bootstrap failed: ${response.status} - ${body}`);
+                return false;
+            }
+            const data = await response.json();
+            this.installationId = data.installation_id;
+            this.runtimeToken = data.runtime_token;
+            this.refreshToken = data.refresh_token;
+            console.log(`[Beacon] Recovery bootstrap successful, installation ID: ${this.installationId}`);
+            return true;
+        }
+        catch (error) {
+            console.error('[Beacon] Recovery bootstrap error:', error);
+            return false;
+        }
+    }
     /**
      * Bootstrap registration with Sekuire
      *
@@ -223,7 +319,7 @@ class Beacon {
                 }),
             });
             if (response.status === 401) {
-                // Token expired - try to refresh
+                // Token expired - try to refresh using refresh token
                 console.warn('[Beacon] Runtime token expired, attempting refresh...');
                 await this.refreshRuntimeToken();
                 // Retry heartbeat after refresh
@@ -233,6 +329,12 @@ class Beacon {
                 const body = await response.text();
                 throw new Error(`Heartbeat failed: ${response.status} - ${body}`);
             }
+            // Check if server auto-refreshed our token (sliding expiration)
+            const data = await response.json();
+            if (data.refreshed_token) {
+                this.runtimeToken = data.refreshed_token.runtime_token;
+                console.log(`[Beacon] Token auto-refreshed by server (version ${data.refreshed_token.token_version})`);
+            }
             this.lastHeartbeat = new Date();
             this.failedHeartbeats = 0;
             if (prevFailed > 0) {
@@ -16054,13 +16156,21 @@ class TaskWorker {
         this.isConnected = false;
         this.isPaused = false;
         this.installationId = null;
+        this.runtimeToken = null;
+        this.refreshToken = null;
+        this.expiresAt = null;
+        if (!config.installToken && !config.runtimeToken) {
+            throw new Error("WorkerConfig requires either installToken or runtimeToken");
+        }
         this.config = {
             heartbeatIntervalMs: 10000, // 10 seconds
             reconnectDelayMs: 1000, // 1 second initial
             maxReconnectDelayMs: 30000, // 30 seconds max
+            capabilities: [],
             ...config,
         };
         this.reconnectDelay = this.config.reconnectDelayMs;
+        this.runtimeToken = config.runtimeToken || null;
     }
     /**
      * Register a handler for a specific capability
@@ -16138,10 +16248,13 @@ class TaskWorker {
         }
     }
     /**
-     * Get API key from config or environment
+     * Get runtime token for API calls
      */
-    getApiKey() {
-        return this.config.apiKey || (typeof process !== 'undefined' ? process.env.SEKUIRE_API_KEY : undefined);
+    getToken() {
+        if (!this.runtimeToken) {
+            throw new Error("No runtime token available - call bootstrap first");
+        }
+        return this.runtimeToken;
     }
     /**
      * Connect to SSE stream
@@ -16151,8 +16264,7 @@ class TaskWorker {
         console.log(`[Worker] Connecting to SSE stream: ${url}`);
         this.eventSource = new EventSource$1(url, {
             headers: {
-                Authorization: `Bearer ${this.config.token}`,
-                ...(this.getApiKey() && { "X-API-Key": this.getApiKey() }),
+                Authorization: `Bearer ${this.getToken()}`,
             },
         });
         this.eventSource.onopen = () => {
@@ -16244,8 +16356,7 @@ class TaskWorker {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    Authorization: `Bearer ${this.config.token}`,
-                    ...(this.getApiKey() && { "X-API-Key": this.getApiKey() }),
+                    Authorization: `Bearer ${this.getToken()}`,
                 },
                 body: JSON.stringify({ status, output, error }),
             });
@@ -16255,57 +16366,84 @@ class TaskWorker {
         }
     }
     /**
-     * Register this agent installation with Sekuire
+     * Register this agent installation with Sekuire using install_token
+     * Returns runtime_token for subsequent API calls
      */
     async bootstrap() {
-        const apiKey = this.getApiKey();
-        if (!apiKey || !this.config.agentId) {
+        // If we already have a runtime token, skip bootstrap
+        if (this.runtimeToken) {
+            console.log("[Worker] Using provided runtime token, skipping bootstrap");
             return;
         }
+        if (!this.config.installToken) {
+            throw new Error("No install token provided for bootstrap");
+        }
         const deploymentUrl = this.config.deploymentUrl || detectDeploymentUrl();
         try {
             const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/bootstrap`, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    "X-API-Key": apiKey,
                 },
                 body: JSON.stringify({
-                    agent_id: this.config.agentId,
+                    install_token: this.config.installToken,
                     upstream_url: deploymentUrl,
+                    capabilities: this.config.capabilities || [],
+                    heartbeat_interval_seconds: Math.floor((this.config.heartbeatIntervalMs || 10000) / 1000),
                 }),
             });
-            if (response.ok) {
-                const data = await response.json();
-                this.installationId = data.installation_id;
-                console.log(`[Worker] Registered installation: ${this.installationId}`);
+            if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`Bootstrap failed: ${response.status} - ${errorText}`);
             }
+            const data = await response.json();
+            this.installationId = data.installation_id;
+            this.runtimeToken = data.runtime_token;
+            this.refreshToken = data.refresh_token;
+            this.expiresAt = data.expires_at
+                ? new Date(data.expires_at).getTime()
+                : null;
+            console.log(`[Worker] Bootstrapped installation: ${this.installationId}`);
         }
         catch (e) {
-            console.warn("[Worker] Bootstrap registration failed:", e);
+            console.error("[Worker] Bootstrap registration failed:", e);
+            throw e;
         }
     }
     /**
-     * Start heartbeat loop
+     * Start heartbeat/lease renewal loop
      */
     startHeartbeat() {
         this.heartbeatInterval = setInterval(async () => {
+            if (!this.installationId) {
+                return;
+            }
             try {
                 const deploymentUrl = this.config.deploymentUrl || detectDeploymentUrl();
-                const response = await fetch(`${this.config.apiBaseUrl}/api/v1/agents/heartbeat`, {
+                const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/lease`, {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/json",
-                        Authorization: `Bearer ${this.config.token}`,
-                        ...(this.getApiKey() && { "X-API-Key": this.getApiKey() }),
+                        Authorization: `Bearer ${this.getToken()}`,
                     },
                     body: JSON.stringify({
-                        agent_id: this.config.agentId,
-                        status: this.isPaused ? "paused" : "idle",
-                        public_url: deploymentUrl,
-                        load: 0.0,
+                        status: this.isPaused ? "stopped" : "running",
+                        upstream_url: deploymentUrl,
+                        heartbeat_interval_seconds: Math.floor((this.config.heartbeatIntervalMs || 10000) / 1000),
                     }),
                 });
+                if (response.status === 401) {
+                    console.warn("[Worker] Runtime token expired, attempting refresh...");
+                    try {
+                        await this.refreshRuntimeToken();
+                        return; // Will retry on next interval
+                    }
+                    catch {
+                        console.error("[Worker] Token refresh failed, stopping worker");
+                        await this.stop();
+                        return;
+                    }
+                }
                 if (response.ok) {
                     const data = await response.json();
                     if (data.command) {
@@ -16314,10 +16452,34 @@ class TaskWorker {
                 }
             }
             catch (e) {
-                console.warn("[Worker] Heartbeat failed:", e);
+                console.warn("[Worker] Heartbeat/lease failed:", e);
             }
         }, this.config.heartbeatIntervalMs);
     }
+    /**
+     * Refresh the runtime token using the refresh token
+     */
+    async refreshRuntimeToken() {
+        if (!this.installationId || !this.refreshToken) {
+            throw new Error("Cannot refresh token - missing installation ID or refresh token");
+        }
+        const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/refresh`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                refresh_token: this.refreshToken,
+            }),
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Token refresh failed: ${response.status} - ${body}`);
+        }
+        const data = await response.json();
+        this.runtimeToken = data.runtime_token;
+        console.log("[Worker] Runtime token refreshed successfully");
+    }
 }
 // ============================================================================
 // Convenience Export

package/dist/index.js

@@ -118,6 +118,7 @@ class Beacon {
         this.refreshToken = null;
         this.lastHeartbeat = null;
         this.failedHeartbeats = 0;
+        this.degradedMode = false;
         const resolvedApiKey = config.apiKey || this.getApiKey() || '';
         const resolvedInstallToken = config.installToken || this.getInstallToken();
         this.config = {
@@ -133,6 +134,9 @@ class Beacon {
     }
     /**
      * Start the beacon - registers with Sekuire and begins heartbeat loop
+     *
+     * If bootstrap fails, the agent continues running in degraded mode
+     * without Sekuire features. This prevents auth failures from crashing agents.
      */
     async start() {
         if (this.intervalId) {
@@ -145,16 +149,16 @@ class Beacon {
             console.log(`[Beacon] Deployment URL: ${deploymentUrl}`);
         }
         // Bootstrap registration (exchanges install token for runtime credentials)
-        try {
-            await this.bootstrap(deploymentUrl);
-            console.log(`[Beacon] Bootstrap successful, installation ID: ${this.installationId}`);
-        }
-        catch (error) {
-            console.error('[Beacon] Bootstrap failed:', error);
+        // On failure, continue in degraded mode - don't crash the agent
+        const bootstrapped = await this.bootstrapWithRetry(deploymentUrl);
+        if (!bootstrapped) {
+            this.degradedMode = true;
+            console.warn('[Beacon] Running in degraded mode - Sekuire features disabled');
+            console.warn('[Beacon] To re-enable: generate a new install token from the dashboard');
             this.notifyStatusChange();
-            // Cannot continue without bootstrap - runtime token required for heartbeats
-            throw error;
+            return;
         }
+        console.log(`[Beacon] Bootstrap successful, installation ID: ${this.installationId}`);
         // Start heartbeat loop
         const intervalMs = this.config.heartbeatIntervalSeconds * 1000;
         this.intervalId = setInterval(() => {
@@ -181,14 +185,106 @@ class Beacon {
      */
     getStatus() {
         return {
-            isRunning: this.intervalId !== null,
+            isRunning: this.intervalId !== null || this.degradedMode,
             installationId: this.installationId || undefined,
             runtimeToken: this.runtimeToken ? '***' + this.runtimeToken.slice(-4) : undefined,
             deploymentUrl: this.config.deploymentUrl || detectDeploymentUrl(),
             lastHeartbeat: this.lastHeartbeat || undefined,
             failedHeartbeats: this.failedHeartbeats,
+            degradedMode: this.degradedMode,
         };
     }
+    /**
+     * Bootstrap with retry and exponential backoff
+     *
+     * Returns true if bootstrap succeeded, false if all retries exhausted.
+     * Does NOT throw - allows agent to continue in degraded mode.
+     */
+    async bootstrapWithRetry(deploymentUrl, maxRetries = 3, initialDelayMs = 1000) {
+        let delay = initialDelayMs;
+        for (let attempt = 1; attempt <= maxRetries; attempt++) {
+            try {
+                await this.bootstrap(deploymentUrl);
+                return true;
+            }
+            catch (error) {
+                const isLastAttempt = attempt === maxRetries;
+                const errorMsg = error instanceof Error ? error.message : String(error);
+                // Check if error is permanent (expired/invalid token) vs transient (network)
+                const isPermanentError = errorMsg.includes('401') ||
+                    errorMsg.includes('expired') ||
+                    errorMsg.includes('invalid') ||
+                    errorMsg.includes('not found');
+                if (isPermanentError) {
+                    console.error(`[Beacon] Bootstrap failed (permanent error): ${errorMsg}`);
+                    // Try recovery bootstrap if we have API key
+                    if (this.config.apiKey && this.config.workspaceId) {
+                        console.log('[Beacon] Attempting recovery bootstrap with API key...');
+                        const recovered = await this.tryRecoveryBootstrap(deploymentUrl);
+                        if (recovered) {
+                            return true;
+                        }
+                    }
+                    console.error('[Beacon] Install token expired or invalid - generate a new one from the dashboard');
+                    return false;
+                }
+                if (isLastAttempt) {
+                    console.error(`[Beacon] Bootstrap failed after ${maxRetries} attempts: ${errorMsg}`);
+                    return false;
+                }
+                console.warn(`[Beacon] Bootstrap attempt ${attempt}/${maxRetries} failed: ${errorMsg}`);
+                console.warn(`[Beacon] Retrying in ${delay}ms...`);
+                await this.sleep(delay);
+                delay *= 2; // Exponential backoff
+            }
+        }
+        return false;
+    }
+    sleep(ms) {
+        return new Promise(resolve => setTimeout(resolve, ms));
+    }
+    /**
+     * Attempt recovery bootstrap using API key when install token fails
+     *
+     * Recovery bootstrap allows re-issuing runtime credentials without
+     * needing a new install token from the dashboard.
+     */
+    async tryRecoveryBootstrap(deploymentUrl) {
+        if (!this.config.apiKey || !this.config.workspaceId) {
+            return false;
+        }
+        try {
+            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/recovery`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'X-API-Key': this.config.apiKey,
+                },
+                body: JSON.stringify({
+                    agent_id: this.config.agentId,
+                    workspace_id: this.config.workspaceId,
+                    upstream_url: deploymentUrl,
+                    capabilities: this.config.capabilities ?? [],
+                    heartbeat_interval_seconds: this.config.heartbeatIntervalSeconds,
+                }),
+            });
+            if (!response.ok) {
+                const body = await response.text();
+                console.error(`[Beacon] Recovery bootstrap failed: ${response.status} - ${body}`);
+                return false;
+            }
+            const data = await response.json();
+            this.installationId = data.installation_id;
+            this.runtimeToken = data.runtime_token;
+            this.refreshToken = data.refresh_token;
+            console.log(`[Beacon] Recovery bootstrap successful, installation ID: ${this.installationId}`);
+            return true;
+        }
+        catch (error) {
+            console.error('[Beacon] Recovery bootstrap error:', error);
+            return false;
+        }
+    }
     /**
      * Bootstrap registration with Sekuire
      *
@@ -247,7 +343,7 @@ class Beacon {
                 }),
             });
             if (response.status === 401) {
-                // Token expired - try to refresh
+                // Token expired - try to refresh using refresh token
                 console.warn('[Beacon] Runtime token expired, attempting refresh...');
                 await this.refreshRuntimeToken();
                 // Retry heartbeat after refresh
@@ -257,6 +353,12 @@ class Beacon {
                 const body = await response.text();
                 throw new Error(`Heartbeat failed: ${response.status} - ${body}`);
             }
+            // Check if server auto-refreshed our token (sliding expiration)
+            const data = await response.json();
+            if (data.refreshed_token) {
+                this.runtimeToken = data.refreshed_token.runtime_token;
+                console.log(`[Beacon] Token auto-refreshed by server (version ${data.refreshed_token.token_version})`);
+            }
             this.lastHeartbeat = new Date();
             this.failedHeartbeats = 0;
             if (prevFailed > 0) {
@@ -16078,13 +16180,21 @@ class TaskWorker {
         this.isConnected = false;
         this.isPaused = false;
         this.installationId = null;
+        this.runtimeToken = null;
+        this.refreshToken = null;
+        this.expiresAt = null;
+        if (!config.installToken && !config.runtimeToken) {
+            throw new Error("WorkerConfig requires either installToken or runtimeToken");
+        }
         this.config = {
             heartbeatIntervalMs: 10000, // 10 seconds
             reconnectDelayMs: 1000, // 1 second initial
             maxReconnectDelayMs: 30000, // 30 seconds max
+            capabilities: [],
             ...config,
         };
         this.reconnectDelay = this.config.reconnectDelayMs;
+        this.runtimeToken = config.runtimeToken || null;
     }
     /**
      * Register a handler for a specific capability
@@ -16162,10 +16272,13 @@ class TaskWorker {
         }
     }
     /**
-     * Get API key from config or environment
+     * Get runtime token for API calls
      */
-    getApiKey() {
-        return this.config.apiKey || (typeof process !== 'undefined' ? process.env.SEKUIRE_API_KEY : undefined);
+    getToken() {
+        if (!this.runtimeToken) {
+            throw new Error("No runtime token available - call bootstrap first");
+        }
+        return this.runtimeToken;
     }
     /**
      * Connect to SSE stream
@@ -16175,8 +16288,7 @@ class TaskWorker {
         console.log(`[Worker] Connecting to SSE stream: ${url}`);
         this.eventSource = new EventSource$1(url, {
             headers: {
-                Authorization: `Bearer ${this.config.token}`,
-                ...(this.getApiKey() && { "X-API-Key": this.getApiKey() }),
+                Authorization: `Bearer ${this.getToken()}`,
             },
         });
         this.eventSource.onopen = () => {
@@ -16268,8 +16380,7 @@ class TaskWorker {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    Authorization: `Bearer ${this.config.token}`,
-                    ...(this.getApiKey() && { "X-API-Key": this.getApiKey() }),
+                    Authorization: `Bearer ${this.getToken()}`,
                 },
                 body: JSON.stringify({ status, output, error }),
             });
@@ -16279,57 +16390,84 @@ class TaskWorker {
         }
     }
     /**
-     * Register this agent installation with Sekuire
+     * Register this agent installation with Sekuire using install_token
+     * Returns runtime_token for subsequent API calls
      */
     async bootstrap() {
-        const apiKey = this.getApiKey();
-        if (!apiKey || !this.config.agentId) {
+        // If we already have a runtime token, skip bootstrap
+        if (this.runtimeToken) {
+            console.log("[Worker] Using provided runtime token, skipping bootstrap");
             return;
         }
+        if (!this.config.installToken) {
+            throw new Error("No install token provided for bootstrap");
+        }
         const deploymentUrl = this.config.deploymentUrl || detectDeploymentUrl();
         try {
             const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/bootstrap`, {
                 method: "POST",
                 headers: {
                     "Content-Type": "application/json",
-                    "X-API-Key": apiKey,
                 },
                 body: JSON.stringify({
-                    agent_id: this.config.agentId,
+                    install_token: this.config.installToken,
                     upstream_url: deploymentUrl,
+                    capabilities: this.config.capabilities || [],
+                    heartbeat_interval_seconds: Math.floor((this.config.heartbeatIntervalMs || 10000) / 1000),
                 }),
             });
-            if (response.ok) {
-                const data = await response.json();
-                this.installationId = data.installation_id;
-                console.log(`[Worker] Registered installation: ${this.installationId}`);
+            if (!response.ok) {
+                const errorText = await response.text();
+                throw new Error(`Bootstrap failed: ${response.status} - ${errorText}`);
             }
+            const data = await response.json();
+            this.installationId = data.installation_id;
+            this.runtimeToken = data.runtime_token;
+            this.refreshToken = data.refresh_token;
+            this.expiresAt = data.expires_at
+                ? new Date(data.expires_at).getTime()
+                : null;
+            console.log(`[Worker] Bootstrapped installation: ${this.installationId}`);
         }
         catch (e) {
-            console.warn("[Worker] Bootstrap registration failed:", e);
+            console.error("[Worker] Bootstrap registration failed:", e);
+            throw e;
         }
     }
     /**
-     * Start heartbeat loop
+     * Start heartbeat/lease renewal loop
      */
     startHeartbeat() {
         this.heartbeatInterval = setInterval(async () => {
+            if (!this.installationId) {
+                return;
+            }
             try {
                 const deploymentUrl = this.config.deploymentUrl || detectDeploymentUrl();
-                const response = await fetch(`${this.config.apiBaseUrl}/api/v1/agents/heartbeat`, {
+                const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/lease`, {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/json",
-                        Authorization: `Bearer ${this.config.token}`,
-                        ...(this.getApiKey() && { "X-API-Key": this.getApiKey() }),
+                        Authorization: `Bearer ${this.getToken()}`,
                     },
                     body: JSON.stringify({
-                        agent_id: this.config.agentId,
-                        status: this.isPaused ? "paused" : "idle",
-                        public_url: deploymentUrl,
-                        load: 0.0,
+                        status: this.isPaused ? "stopped" : "running",
+                        upstream_url: deploymentUrl,
+                        heartbeat_interval_seconds: Math.floor((this.config.heartbeatIntervalMs || 10000) / 1000),
                     }),
                 });
+                if (response.status === 401) {
+                    console.warn("[Worker] Runtime token expired, attempting refresh...");
+                    try {
+                        await this.refreshRuntimeToken();
+                        return; // Will retry on next interval
+                    }
+                    catch {
+                        console.error("[Worker] Token refresh failed, stopping worker");
+                        await this.stop();
+                        return;
+                    }
+                }
                 if (response.ok) {
                     const data = await response.json();
                     if (data.command) {
@@ -16338,10 +16476,34 @@ class TaskWorker {
                 }
             }
             catch (e) {
-                console.warn("[Worker] Heartbeat failed:", e);
+                console.warn("[Worker] Heartbeat/lease failed:", e);
             }
         }, this.config.heartbeatIntervalMs);
     }
+    /**
+     * Refresh the runtime token using the refresh token
+     */
+    async refreshRuntimeToken() {
+        if (!this.installationId || !this.refreshToken) {
+            throw new Error("Cannot refresh token - missing installation ID or refresh token");
+        }
+        const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/refresh`, {
+            method: "POST",
+            headers: {
+                "Content-Type": "application/json",
+            },
+            body: JSON.stringify({
+                refresh_token: this.refreshToken,
+            }),
+        });
+        if (!response.ok) {
+            const body = await response.text();
+            throw new Error(`Token refresh failed: ${response.status} - ${body}`);
+        }
+        const data = await response.json();
+        this.runtimeToken = data.runtime_token;
+        console.log("[Worker] Runtime token refreshed successfully");
+    }
 }
 // ============================================================================
 // Convenience Export

package/dist/memory/index.d.ts

@@ -38,4 +38,4 @@ export interface MemoryFactoryConfig {
     instance?: MemoryStorage;
 }
 export declare function createMemoryStorage(config: MemoryFactoryConfig): MemoryStorage;
-export { registerStorage, hasStorage, listStorageTypes, getStorageInfo, };
+export { registerStorage, hasStorage, listStorageTypes, getStorageInfo };

package/dist/types/a2a-types.d.ts

@@ -73,24 +73,24 @@ export interface AgentSkill {
 /** A2A message with role and parts */
 export interface A2AMessage {
     /** Message role: "user" or "agent" */
-    role: "user" | "agent";
+    role: 'user' | 'agent';
     /** Message content parts */
     parts: A2AMessagePart[];
 }
 /** Message part content */
 export type A2AMessagePart = {
-    type: "text";
+    type: 'text';
     text: string;
 } | {
-    type: "file";
+    type: 'file';
     uri: string;
     mimeType?: string;
 } | {
-    type: "data";
+    type: 'data';
     data: unknown;
 };
 /** A2A task states */
-export type A2ATaskState = "pending" | "working" | "input-required" | "completed" | "failed" | "cancelled";
+export type A2ATaskState = 'pending' | 'working' | 'input-required' | 'completed' | 'failed' | 'cancelled';
 /** A2A task status with timestamp */
 export interface A2ATaskStatus {
     state: A2ATaskState;
@@ -142,14 +142,14 @@ export interface A2ARouteResponse {
 }
 /** JSON-RPC 2.0 Request */
 export interface JsonRpcRequest {
-    jsonrpc: "2.0";
+    jsonrpc: '2.0';
     method: string;
     id: string | number;
     params?: unknown;
 }
 /** JSON-RPC 2.0 Response */
 export interface JsonRpcResponse<T = unknown> {
-    jsonrpc: "2.0";
+    jsonrpc: '2.0';
     id: string | number;
     result?: T;
     error?: JsonRpcError;

package/dist/worker.d.ts

@@ -26,13 +26,14 @@ export interface TaskContext {
 export type TaskHandler = (ctx: TaskContext, input: Record<string, unknown>) => Promise<unknown>;
 export interface WorkerConfig {
     apiBaseUrl: string;
-    token: string;
-    agentId?: string;
-    apiKey?: string;
+    agentId: string;
+    installToken?: string;
+    runtimeToken?: string;
     heartbeatIntervalMs?: number;
     reconnectDelayMs?: number;
     maxReconnectDelayMs?: number;
     deploymentUrl?: string;
+    capabilities?: string[];
 }
 export declare class TaskWorker {
     private eventSource;
@@ -43,6 +44,9 @@ export declare class TaskWorker {
     private isConnected;
     private isPaused;
     private installationId;
+    private runtimeToken;
+    private refreshToken;
+    private expiresAt;
     private onCommandCallback?;
     constructor(config: WorkerConfig);
     /**
@@ -73,9 +77,9 @@ export declare class TaskWorker {
      */
     private handleCommand;
     /**
-     * Get API key from config or environment
+     * Get runtime token for API calls
      */
-    private getApiKey;
+    private getToken;
     /**
      * Connect to SSE stream
      */
@@ -93,12 +97,17 @@ export declare class TaskWorker {
      */
     private completeTask;
     /**
-     * Register this agent installation with Sekuire
+     * Register this agent installation with Sekuire using install_token
+     * Returns runtime_token for subsequent API calls
      */
     private bootstrap;
     /**
-     * Start heartbeat loop
+     * Start heartbeat/lease renewal loop
      */
     private startHeartbeat;
+    /**
+     * Refresh the runtime token using the refresh token
+     */
+    private refreshRuntimeToken;
 }
 export declare function createWorker(config: WorkerConfig): TaskWorker;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sekuire/sdk",
-  "version": "0.1.11",
+  "version": "0.1.12",
   "description": "Sekuire Identity Protocol SDK for TypeScript/JavaScript",
   "type": "module",
   "main": "dist/index.js",