@sekuire/sdk 0.1.13 → 0.1.15

package/dist/index.esm.js

@@ -95,23 +95,48 @@ class Beacon {
         this.lastHeartbeat = null;
         this.failedHeartbeats = 0;
         this.degradedMode = false;
-        const resolvedApiKey = config.apiKey || this.getApiKey() || '';
-        const resolvedInstallToken = config.installToken || this.getInstallToken();
+        this.recoveredFromEnv = false;
+        this.expiresAt = null;
+        const storeSnapshot = config.credentialsStore?.getAll() || {};
+        const resolvedApiKey = config.apiKey || this.getEnvVar('SEKUIRE_API_KEY') || '';
+        const resolvedInstallToken = config.installToken || this.getEnvVar('SEKUIRE_INSTALL_TOKEN');
+        const resolvedInstallationId = config.installationId || storeSnapshot.installationId || this.getEnvVar('SEKUIRE_INSTALLATION_ID');
+        const resolvedRefreshToken = config.refreshToken || storeSnapshot.refreshToken || this.getEnvVar('SEKUIRE_REFRESH_TOKEN');
+        const resolvedRuntimeToken = config.runtimeToken || storeSnapshot.runtimeToken || this.getEnvVar('SEKUIRE_RUNTIME_TOKEN');
         this.config = {
             ...config,
             heartbeatIntervalSeconds: config.heartbeatIntervalSeconds ?? 60,
             apiKey: resolvedApiKey,
             installToken: resolvedInstallToken,
+            installationId: resolvedInstallationId,
+            refreshToken: resolvedRefreshToken,
+            runtimeToken: resolvedRuntimeToken,
             capabilities: config.capabilities ?? [],
         };
-        if (!this.config.installToken && !this.config.apiKey) {
-            console.warn('[Beacon] No install token or API key provided. Set SEKUIRE_INSTALL_TOKEN or SEKUIRE_API_KEY.');
+        this.credentialsStore = config.credentialsStore;
+        if (this.credentialsStore) {
+            this.credentialsStore.update({
+                installationId: resolvedInstallationId,
+                refreshToken: resolvedRefreshToken,
+                runtimeToken: resolvedRuntimeToken,
+            });
+        }
+        const hasRecoveryCredentials = resolvedInstallationId && resolvedRefreshToken;
+        if (!this.config.installToken && !this.config.apiKey && !hasRecoveryCredentials) {
+            console.warn('[Beacon] No credentials provided. Set one of:');
+            console.warn('[Beacon]   - SEKUIRE_INSTALL_TOKEN (for initial bootstrap)');
+            console.warn('[Beacon]   - SEKUIRE_INSTALLATION_ID + SEKUIRE_REFRESH_TOKEN (for recovery)');
         }
     }
     /**
      * Start the beacon - registers with Sekuire and begins heartbeat loop
      *
-     * If bootstrap fails, the agent continues running in degraded mode
+     * Authentication priority:
+     * 1. If SEKUIRE_INSTALLATION_ID + SEKUIRE_REFRESH_TOKEN are set, recover credentials
+     * 2. If SEKUIRE_RUNTIME_TOKEN is also set and valid, use it directly
+     * 3. Fall back to SEKUIRE_INSTALL_TOKEN for fresh bootstrap
+     *
+     * If all authentication methods fail, the agent continues running in degraded mode
      * without Sekuire features. This prevents auth failures from crashing agents.
      */
     async start() {
@@ -124,10 +149,21 @@ class Beacon {
         if (deploymentUrl) {
             console.log(`[Beacon] Deployment URL: ${deploymentUrl}`);
         }
-        // Bootstrap registration (exchanges install token for runtime credentials)
-        // On failure, continue in degraded mode - don't crash the agent
-        const bootstrapped = await this.bootstrapWithRetry(deploymentUrl);
-        if (!bootstrapped) {
+        let authenticated = false;
+        // Priority 1: Try credential recovery from env vars
+        if (this.config.installationId && this.config.refreshToken) {
+            console.log('[Beacon] Found recovery credentials in environment');
+            authenticated = await this.tryCredentialRecovery();
+            if (authenticated) {
+                this.recoveredFromEnv = true;
+                console.log('[Beacon] Successfully recovered credentials from environment');
+            }
+        }
+        // Priority 2: Fall back to fresh bootstrap with install token
+        if (!authenticated) {
+            authenticated = await this.bootstrapWithRetry(deploymentUrl);
+        }
+        if (!authenticated) {
             this.degradedMode = true;
             console.warn('[Beacon] Running in degraded mode - Sekuire features disabled');
             console.warn('[Beacon] To re-enable: generate a new install token from the dashboard');
@@ -135,6 +171,9 @@ class Beacon {
             return;
         }
         console.log(`[Beacon] Bootstrap successful, installation ID: ${this.installationId}`);
+        if (this.recoveredFromEnv) {
+            console.log('[Beacon] Credentials recovered via refresh token (no install token consumed)');
+        }
         // Start heartbeat loop
         const intervalMs = this.config.heartbeatIntervalSeconds * 1000;
         this.intervalId = setInterval(() => {
@@ -162,12 +201,13 @@ class Beacon {
     getStatus() {
         return {
             isRunning: this.intervalId !== null || this.degradedMode,
-            installationId: this.installationId || undefined,
-            runtimeToken: this.runtimeToken ? '***' + this.runtimeToken.slice(-4) : undefined,
+            installationId: this.getInstallationId() || undefined,
+            runtimeToken: this.getRuntimeToken() ? '***' + this.getRuntimeToken().slice(-4) : undefined,
             deploymentUrl: this.config.deploymentUrl || detectDeploymentUrl(),
             lastHeartbeat: this.lastHeartbeat || undefined,
             failedHeartbeats: this.failedHeartbeats,
             degradedMode: this.degradedMode,
+            recoveredFromEnv: this.recoveredFromEnv,
         };
     }
     /**
@@ -179,14 +219,140 @@ class Beacon {
      * @returns Runtime credentials or null if not bootstrapped
      */
     getRuntimeCredentials() {
-        if (!this.installationId || !this.runtimeToken) {
+        const installationId = this.getInstallationId();
+        const runtimeToken = this.getRuntimeToken();
+        if (!installationId || !runtimeToken) {
             return null;
         }
         return {
-            installationId: this.installationId,
-            runtimeToken: this.runtimeToken,
+            installationId,
+            runtimeToken,
         };
     }
+    /**
+     * Get full installation credentials for persistence.
+     *
+     * Use this after successful bootstrap to extract credentials that can be
+     * saved as environment variables or secrets for future container restarts.
+     * These credentials allow recovery without consuming a new install token.
+     *
+     * Example usage:
+     * ```ts
+     * const creds = beacon.getInstallationCredentials();
+     * if (creds) {
+     *   // Save to your secrets manager (AWS Secrets Manager, K8s Secret, etc.)
+     *   // SEKUIRE_INSTALLATION_ID = creds.installationId
+     *   // SEKUIRE_REFRESH_TOKEN = creds.refreshToken
+     *   // SEKUIRE_RUNTIME_TOKEN = creds.runtimeToken (optional, has expiry)
+     * }
+     * ```
+     *
+     * @returns Full installation credentials or null if not bootstrapped
+     */
+    getInstallationCredentials() {
+        const installationId = this.getInstallationId();
+        const runtimeToken = this.getRuntimeToken();
+        const refreshToken = this.getRefreshToken();
+        if (!installationId || !runtimeToken || !refreshToken) {
+            return null;
+        }
+        return {
+            installationId,
+            runtimeToken,
+            refreshToken,
+            expiresAt: this.expiresAt || undefined,
+        };
+    }
+    /**
+     * Try to recover credentials using installation ID and refresh token from env.
+     *
+     * This allows agents to survive container restarts without needing a new
+     * install token, which is especially important for ephemeral compute
+     * environments like Cloud Run, Kubernetes, or serverless functions.
+     *
+     * @returns true if recovery succeeded, false otherwise
+     */
+    async tryCredentialRecovery() {
+        const installationId = this.getInstallationId() || this.config.installationId;
+        const refreshToken = this.getRefreshToken() || this.config.refreshToken;
+        const existingRuntimeToken = this.getRuntimeToken() || this.config.runtimeToken;
+        if (!installationId || !refreshToken) {
+            return false;
+        }
+        // If we have an existing runtime token, try to use it first
+        if (existingRuntimeToken) {
+            console.log('[Beacon] Found existing runtime token, validating...');
+            const isValid = await this.validateRuntimeToken(installationId, existingRuntimeToken);
+            if (isValid) {
+                this.installationId = installationId;
+                this.runtimeToken = existingRuntimeToken;
+                this.refreshToken = refreshToken;
+                this.credentialsStore?.update({
+                    installationId,
+                    runtimeToken: existingRuntimeToken,
+                    refreshToken,
+                });
+                console.log('[Beacon] Existing runtime token is valid');
+                return true;
+            }
+            console.log('[Beacon] Existing runtime token is invalid or expired, refreshing...');
+        }
+        // Refresh to get a new runtime token
+        try {
+            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${installationId}/refresh`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                },
+                body: JSON.stringify({
+                    refresh_token: refreshToken,
+                }),
+            });
+            if (!response.ok) {
+                const body = await response.text();
+                console.error(`[Beacon] Credential recovery failed: ${response.status} - ${body}`);
+                return false;
+            }
+            const data = await response.json();
+            this.installationId = installationId;
+            this.runtimeToken = data.runtime_token;
+            this.refreshToken = refreshToken; // Refresh token is stable
+            this.expiresAt = data.expires_at || null;
+            this.credentialsStore?.update({
+                installationId,
+                runtimeToken: data.runtime_token,
+                refreshToken,
+                expiresAt: data.expires_at,
+            });
+            console.log('[Beacon] Credentials recovered via refresh token');
+            return true;
+        }
+        catch (error) {
+            console.error('[Beacon] Credential recovery error:', error);
+            return false;
+        }
+    }
+    /**
+     * Validate a runtime token by making a lightweight API call.
+     */
+    async validateRuntimeToken(installationId, token) {
+        try {
+            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${installationId}/lease`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    'Authorization': `Bearer ${token}`,
+                },
+                body: JSON.stringify({
+                    status: 'running',
+                }),
+            });
+            return response.ok;
+        }
+        catch {
+            return false;
+        }
+    }
     /**
      * Bootstrap with retry and exponential backoff
      *
@@ -309,6 +475,13 @@ class Beacon {
         this.installationId = data.installation_id;
         this.runtimeToken = data.runtime_token;
         this.refreshToken = data.refresh_token;
+        this.expiresAt = data.expires_at || null;
+        this.credentialsStore?.update({
+            installationId: data.installation_id,
+            runtimeToken: data.runtime_token,
+            refreshToken: data.refresh_token,
+            expiresAt: data.expires_at,
+        });
     }
     /**
      * Send heartbeat (lease renewal) to Sekuire
@@ -316,18 +489,20 @@ class Beacon {
      * Uses the installation-based lease endpoint with runtime token authentication.
      */
     async heartbeat() {
-        if (!this.installationId || !this.runtimeToken) {
+        const installationId = this.getInstallationId();
+        const runtimeToken = this.getRuntimeToken();
+        if (!installationId || !runtimeToken) {
             console.warn('[Beacon] Cannot send heartbeat - not bootstrapped');
             return;
         }
         const deploymentUrl = this.config.deploymentUrl || detectDeploymentUrl();
         const prevFailed = this.failedHeartbeats;
         try {
-            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/lease`, {
+            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${installationId}/lease`, {
                 method: 'POST',
                 headers: {
                     'Content-Type': 'application/json',
-                    'Authorization': `Bearer ${this.runtimeToken}`,
+                    'Authorization': `Bearer ${runtimeToken}`,
                 },
                 body: JSON.stringify({
                     status: 'running',
@@ -350,6 +525,7 @@ class Beacon {
             const data = await response.json();
             if (data.refreshed_token) {
                 this.runtimeToken = data.refreshed_token.runtime_token;
+                this.credentialsStore?.setRuntimeToken(data.refreshed_token.runtime_token, data.refreshed_token.expires_at);
                 console.log(`[Beacon] Token auto-refreshed by server (version ${data.refreshed_token.token_version})`);
             }
             this.lastHeartbeat = new Date();
@@ -368,16 +544,18 @@ class Beacon {
      * Refresh the runtime token using the refresh token
      */
     async refreshRuntimeToken() {
-        if (!this.installationId || !this.refreshToken) {
+        const installationId = this.getInstallationId();
+        const refreshToken = this.getRefreshToken();
+        if (!installationId || !refreshToken) {
             throw new Error('Cannot refresh token - missing installation ID or refresh token');
         }
-        const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/refresh`, {
+        const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${installationId}/refresh`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
             },
             body: JSON.stringify({
-                refresh_token: this.refreshToken,
+                refresh_token: refreshToken,
             }),
         });
         if (!response.ok) {
@@ -386,6 +564,7 @@ class Beacon {
         }
         const data = await response.json();
         this.runtimeToken = data.runtime_token;
+        this.credentialsStore?.setRuntimeToken(data.runtime_token, data.expires_at);
         console.log('[Beacon] Runtime token refreshed successfully');
     }
     /**
@@ -397,22 +576,37 @@ class Beacon {
         }
     }
     /**
-     * Get API key from environment
+     * Get environment variable value (works in Node.js and browser)
      */
-    getApiKey() {
+    getEnvVar(name) {
         if (typeof process !== 'undefined' && process.env) {
-            return process.env.SEKUIRE_API_KEY;
+            return process.env[name];
         }
         return undefined;
     }
-    /**
-     * Get install token from environment
-     */
-    getInstallToken() {
-        if (typeof process !== 'undefined' && process.env) {
-            return process.env.SEKUIRE_INSTALL_TOKEN;
+    getInstallationId() {
+        const storeValue = this.credentialsStore?.getInstallationId();
+        if (storeValue) {
+            this.installationId = storeValue;
+            return storeValue;
         }
-        return undefined;
+        return this.installationId;
+    }
+    getRuntimeToken() {
+        const storeValue = this.credentialsStore?.getRuntimeToken();
+        if (storeValue) {
+            this.runtimeToken = storeValue;
+            return storeValue;
+        }
+        return this.runtimeToken;
+    }
+    getRefreshToken() {
+        const storeValue = this.credentialsStore?.getRefreshToken();
+        if (storeValue) {
+            this.refreshToken = storeValue;
+            return storeValue;
+        }
+        return this.refreshToken;
     }
 }
 // ============================================================================
@@ -904,6 +1098,66 @@ class SekuireLogger {
     }
 }
 
+class RuntimeCredentialsStore {
+    constructor(initial) {
+        if (initial) {
+            this.update(initial);
+        }
+    }
+    update(partial) {
+        if (partial.installationId) {
+            this.installationId = partial.installationId;
+        }
+        if (partial.runtimeToken) {
+            this.runtimeToken = partial.runtimeToken;
+        }
+        if (partial.refreshToken) {
+            this.refreshToken = partial.refreshToken;
+        }
+        if (partial.expiresAt !== undefined) {
+            this.expiresAt = partial.expiresAt;
+        }
+    }
+    setRuntimeToken(runtimeToken, expiresAt) {
+        this.runtimeToken = runtimeToken;
+        if (expiresAt !== undefined) {
+            this.expiresAt = expiresAt;
+        }
+    }
+    setInstallationId(installationId) {
+        this.installationId = installationId;
+    }
+    setRefreshToken(refreshToken) {
+        this.refreshToken = refreshToken;
+    }
+    getInstallationId() {
+        return this.installationId;
+    }
+    getRuntimeToken() {
+        return this.runtimeToken;
+    }
+    getRefreshToken() {
+        return this.refreshToken;
+    }
+    getExpiresAt() {
+        return this.expiresAt;
+    }
+    getAll() {
+        return {
+            installationId: this.installationId,
+            runtimeToken: this.runtimeToken,
+            refreshToken: this.refreshToken,
+            expiresAt: this.expiresAt,
+        };
+    }
+    hasRecoveryCredentials() {
+        return !!(this.installationId && this.refreshToken);
+    }
+    hasRuntimeToken() {
+        return !!this.runtimeToken;
+    }
+}
+
 function getDefaultExportFromCjs (x) {
 	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
 }
@@ -1426,8 +1680,16 @@ class TaskWorker {
         this.runtimeToken = null;
         this.refreshToken = null;
         this.expiresAt = null;
-        if (!config.installToken && !config.runtimeToken) {
-            throw new Error("WorkerConfig requires either installToken or runtimeToken");
+        this.recoveredFromEnv = false;
+        const storeSnapshot = config.credentialsStore?.getAll() || {};
+        const resolvedInstallationId = config.installationId || storeSnapshot.installationId || this.getEnvVar('SEKUIRE_INSTALLATION_ID');
+        const resolvedRefreshToken = config.refreshToken || storeSnapshot.refreshToken || this.getEnvVar('SEKUIRE_REFRESH_TOKEN');
+        const resolvedRuntimeToken = config.runtimeToken || storeSnapshot.runtimeToken || this.getEnvVar('SEKUIRE_RUNTIME_TOKEN');
+        const resolvedInstallToken = config.installToken || this.getEnvVar('SEKUIRE_INSTALL_TOKEN');
+        const hasRecoveryCredentials = resolvedInstallationId && resolvedRefreshToken;
+        if (!resolvedInstallToken && !resolvedRuntimeToken && !hasRecoveryCredentials) {
+            throw new Error("WorkerConfig requires one of: " +
+                "installToken, runtimeToken, or (installationId + refreshToken)");
         }
         this.config = {
             heartbeatIntervalMs: 10000, // 10 seconds
@@ -1435,9 +1697,30 @@ class TaskWorker {
             maxReconnectDelayMs: 30000, // 30 seconds max
             capabilities: [],
             ...config,
+            installToken: resolvedInstallToken,
+            runtimeToken: resolvedRuntimeToken,
+            installationId: resolvedInstallationId,
+            refreshToken: resolvedRefreshToken,
         };
+        this.credentialsStore = config.credentialsStore;
+        this.tokenProvider = config.tokenProvider;
         this.reconnectDelay = this.config.reconnectDelayMs;
-        this.runtimeToken = config.runtimeToken || null;
+        this.runtimeToken = resolvedRuntimeToken || null;
+        this.installationId = resolvedInstallationId || null;
+        this.refreshToken = resolvedRefreshToken || null;
+        if (this.credentialsStore) {
+            this.credentialsStore.update({
+                installationId: resolvedInstallationId,
+                refreshToken: resolvedRefreshToken,
+                runtimeToken: resolvedRuntimeToken,
+            });
+        }
+    }
+    getEnvVar(name) {
+        if (typeof process !== 'undefined' && process.env) {
+            return process.env[name];
+        }
+        return undefined;
     }
     /**
      * Register a handler for a specific capability
@@ -1449,13 +1732,88 @@ class TaskWorker {
     }
     /**
      * Start the worker (connects to SSE stream and starts heartbeat)
+     *
+     * Authentication priority:
+     * 1. If runtimeToken is provided, use it directly
+     * 2. If installationId + refreshToken are set, recover credentials
+     * 3. Fall back to installToken for fresh bootstrap
      */
     async start() {
         console.log("[Worker] Starting task worker...");
-        await this.bootstrap();
+        let authenticated = false;
+        // Priority 1: Already have runtime token
+        const tokenFromProvider = this.tokenProvider?.();
+        const tokenFromStore = this.credentialsStore?.getRuntimeToken();
+        if (tokenFromProvider || tokenFromStore || this.runtimeToken) {
+            if (tokenFromProvider) {
+                this.runtimeToken = tokenFromProvider;
+            }
+            else if (tokenFromStore) {
+                this.runtimeToken = tokenFromStore;
+            }
+            console.log("[Worker] Using provided runtime token");
+            authenticated = true;
+        }
+        // Priority 2: Try credential recovery from env vars
+        if (!authenticated && this.config.installationId && this.config.refreshToken) {
+            console.log("[Worker] Attempting credential recovery from environment...");
+            authenticated = await this.tryCredentialRecovery();
+            if (authenticated) {
+                this.recoveredFromEnv = true;
+                console.log("[Worker] Successfully recovered credentials from environment");
+            }
+        }
+        // Priority 3: Fall back to fresh bootstrap
+        if (!authenticated) {
+            await this.bootstrap();
+            authenticated = true;
+        }
         this.connect();
         this.startHeartbeat();
     }
+    /**
+     * Try to recover credentials using installation ID and refresh token.
+     */
+    async tryCredentialRecovery() {
+        const installationId = this.getInstallationId() || this.config.installationId;
+        const refreshToken = this.getRefreshToken() || this.config.refreshToken;
+        if (!installationId || !refreshToken) {
+            return false;
+        }
+        try {
+            const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${installationId}/refresh`, {
+                method: "POST",
+                headers: {
+                    "Content-Type": "application/json",
+                },
+                body: JSON.stringify({
+                    refresh_token: refreshToken,
+                }),
+            });
+            if (!response.ok) {
+                const body = await response.text();
+                console.error(`[Worker] Credential recovery failed: ${response.status} - ${body}`);
+                return false;
+            }
+            const data = await response.json();
+            this.installationId = installationId;
+            this.runtimeToken = data.runtime_token;
+            this.refreshToken = refreshToken;
+            this.expiresAt = data.expires_at ? new Date(data.expires_at).getTime() : null;
+            this.credentialsStore?.update({
+                installationId,
+                runtimeToken: data.runtime_token,
+                refreshToken,
+                expiresAt: data.expires_at,
+            });
+            console.log(`[Worker] Credentials recovered for installation: ${installationId}`);
+            return true;
+        }
+        catch (error) {
+            console.error("[Worker] Credential recovery error:", error);
+            return false;
+        }
+    }
     /**
      * Stop the worker gracefully
      */
@@ -1518,6 +1876,16 @@ class TaskWorker {
      * Get runtime token for API calls
      */
     getToken() {
+        const tokenFromProvider = this.tokenProvider?.();
+        if (tokenFromProvider) {
+            this.runtimeToken = tokenFromProvider;
+            return tokenFromProvider;
+        }
+        const tokenFromStore = this.credentialsStore?.getRuntimeToken();
+        if (tokenFromStore) {
+            this.runtimeToken = tokenFromStore;
+            return tokenFromStore;
+        }
         if (!this.runtimeToken) {
             throw new Error("No runtime token available - call bootstrap first");
         }
@@ -1578,23 +1946,23 @@ class TaskWorker {
     async handleTask(task) {
         // Kill Switch: Block task execution if paused
         if (this.isPaused) {
-            console.log(`[Worker] Task ${task.task_id} rejected - agent is paused`);
-            await this.completeTask(task.task_id, "failed", null, { message: "Agent has been paused by administrator." });
+            console.log(`[Worker] Task ${task.id} rejected - agent is paused`);
+            await this.completeTask(task.id, "failed", null, { message: "Agent has been paused by administrator." });
             return;
         }
-        console.log(`[Worker] Received task: ${task.task_id}`);
+        console.log(`[Worker] Received task: ${task.id}`);
         // Find handler by capability or tool
-        const capability = task.capability || task.tool || "default";
+        const capability = task.target_capability || task.target_tool || "default";
         const handler = this.handlers.get(capability) || this.handlers.get("default");
         if (!handler) {
             console.warn(`[Worker] No handler for capability: ${capability}`);
-            await this.completeTask(task.task_id, "failed", null, {
+            await this.completeTask(task.id, "failed", null, {
                 error: `No handler registered for capability: ${capability}`,
             });
             return;
         }
         const ctx = {
-            taskId: task.task_id,
+            taskId: task.id,
             workspaceId: task.workspace_id,
             requesterId: task.requester_agent_id,
             parentTaskId: task.parent_task_id,
@@ -1604,12 +1972,12 @@ class TaskWorker {
         try {
             console.log(`[Worker] Executing handler for: ${capability}`);
             const result = await handler(ctx, task.input);
-            await this.completeTask(task.task_id, "completed", result, null);
-            console.log(`[Worker] Task ${task.task_id} completed successfully`);
+            await this.completeTask(task.id, "completed", result, null);
+            console.log(`[Worker] Task ${task.id} completed successfully`);
         }
         catch (error) {
-            console.error(`[Worker] Task ${task.task_id} failed:`, error);
-            await this.completeTask(task.task_id, "failed", null, {
+            console.error(`[Worker] Task ${task.id} failed:`, error);
+            await this.completeTask(task.id, "failed", null, {
                 error: error instanceof Error ? error.message : String(error),
             });
         }
@@ -1670,6 +2038,12 @@ class TaskWorker {
             this.expiresAt = data.expires_at
                 ? new Date(data.expires_at).getTime()
                 : null;
+            this.credentialsStore?.update({
+                installationId: data.installation_id,
+                runtimeToken: data.runtime_token,
+                refreshToken: data.refresh_token,
+                expiresAt: data.expires_at,
+            });
             console.log(`[Worker] Bootstrapped installation: ${this.installationId}`);
         }
         catch (e) {
@@ -1682,12 +2056,13 @@ class TaskWorker {
      */
     startHeartbeat() {
         this.heartbeatInterval = setInterval(async () => {
-            if (!this.installationId) {
+            const installationId = this.getInstallationId();
+            if (!installationId) {
                 return;
             }
             try {
                 const deploymentUrl = this.config.deploymentUrl || detectDeploymentUrl();
-                const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/lease`, {
+                const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${installationId}/lease`, {
                     method: "POST",
                     headers: {
                         "Content-Type": "application/json",
@@ -1713,6 +2088,15 @@ class TaskWorker {
                 }
                 if (response.ok) {
                     const data = await response.json();
+                    // Handle server-side token auto-refresh (sliding expiration)
+                    if (data.refreshed_token) {
+                        this.runtimeToken = data.refreshed_token.runtime_token;
+                        if (data.refreshed_token.expires_at) {
+                            this.expiresAt = new Date(data.refreshed_token.expires_at).getTime();
+                        }
+                        this.credentialsStore?.setRuntimeToken(data.refreshed_token.runtime_token, data.refreshed_token.expires_at);
+                        console.log(`[Worker] Token auto-refreshed by server (version ${data.refreshed_token.token_version})`);
+                    }
                     if (data.command) {
                         this.handleCommand(data.command);
                     }
@@ -1727,16 +2111,18 @@ class TaskWorker {
      * Refresh the runtime token using the refresh token
      */
     async refreshRuntimeToken() {
-        if (!this.installationId || !this.refreshToken) {
+        const installationId = this.getInstallationId();
+        const refreshToken = this.getRefreshToken();
+        if (!installationId || !refreshToken) {
             throw new Error("Cannot refresh token - missing installation ID or refresh token");
         }
-        const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${this.installationId}/refresh`, {
+        const response = await fetch(`${this.config.apiBaseUrl}/api/v1/installations/${installationId}/refresh`, {
             method: "POST",
             headers: {
                 "Content-Type": "application/json",
             },
             body: JSON.stringify({
-                refresh_token: this.refreshToken,
+                refresh_token: refreshToken,
             }),
         });
         if (!response.ok) {
@@ -1745,8 +2131,25 @@ class TaskWorker {
         }
         const data = await response.json();
         this.runtimeToken = data.runtime_token;
+        this.credentialsStore?.setRuntimeToken(data.runtime_token, data.expires_at);
         console.log("[Worker] Runtime token refreshed successfully");
     }
+    getInstallationId() {
+        const storeValue = this.credentialsStore?.getInstallationId();
+        if (storeValue) {
+            this.installationId = storeValue;
+            return storeValue;
+        }
+        return this.installationId;
+    }
+    getRefreshToken() {
+        const storeValue = this.credentialsStore?.getRefreshToken();
+        if (storeValue) {
+            this.refreshToken = storeValue;
+            return storeValue;
+        }
+        return this.refreshToken;
+    }
 }
 // ============================================================================
 // Convenience Export
@@ -1769,10 +2172,16 @@ class SekuireSDK {
         }
         const apiKey = config.apiKey || process.env.SEKUIRE_API_KEY;
         const installToken = config.installToken || process.env.SEKUIRE_INSTALL_TOKEN;
+        const installationId = config.installationId || process.env.SEKUIRE_INSTALLATION_ID;
+        const refreshToken = config.refreshToken || process.env.SEKUIRE_REFRESH_TOKEN;
+        const runtimeToken = config.runtimeToken || process.env.SEKUIRE_RUNTIME_TOKEN;
         this.config = {
             privateKey: config.privateKey,
             apiKey,
             installToken,
+            installationId,
+            refreshToken,
+            runtimeToken,
             agentId: config.agentId,
             agentName: config.agentName ?? "Unknown",
             apiUrl: (config.apiUrl ?? DEFAULT_API_URL).replace(/\/$/, ""),
@@ -1783,6 +2192,11 @@ class SekuireSDK {
             loggingEnabled: config.loggingEnabled !== false,
             capabilities: config.capabilities ?? [],
         };
+        this.credentialsStore = new RuntimeCredentialsStore({
+            installationId: this.config.installationId,
+            refreshToken: this.config.refreshToken,
+            runtimeToken: this.config.runtimeToken,
+        });
         this.identity = new AgentIdentity(this.config.agentName, this.config.agentId, this.config.privateKey);
         const loggerConfig = {
             sekuireId: this.config.agentId,
@@ -1806,6 +2220,10 @@ class SekuireSDK {
             workspaceId: this.config.workspaceId || undefined,
             heartbeatIntervalSeconds: this.config.heartbeatIntervalSeconds,
             capabilities: this.config.capabilities,
+            installationId: this.config.installationId,
+            refreshToken: this.config.refreshToken,
+            runtimeToken: this.config.runtimeToken,
+            credentialsStore: this.credentialsStore,
         });
     }
     /**
@@ -1813,7 +2231,10 @@ class SekuireSDK {
      *
      * Required env vars:
      *   SEKUIRE_AGENT_ID - The agent's sekuire_id
-     *   SEKUIRE_INSTALL_TOKEN - Install token from dashboard (required for heartbeat)
+     *
+     * Authentication (one of the following):
+     *   SEKUIRE_INSTALL_TOKEN - Install token from dashboard (for initial bootstrap)
+     *   SEKUIRE_INSTALLATION_ID + SEKUIRE_REFRESH_TOKEN - For credential recovery
      *
      * Optional env vars:
      *   SEKUIRE_API_KEY - API key for authentication (X-API-Key header)
@@ -1822,6 +2243,7 @@ class SekuireSDK {
      *   SEKUIRE_API_URL - API base URL (default: https://api.sekuire.ai)
      *   SEKUIRE_WORKSPACE_ID - Workspace ID for policy enforcement
      *   SEKUIRE_ENVIRONMENT - Environment name (default: production)
+     *   SEKUIRE_RUNTIME_TOKEN - Pre-existing runtime token (skips refresh if valid)
      */
     static fromEnv(options) {
         const agentId = process.env.SEKUIRE_AGENT_ID;
@@ -1832,6 +2254,9 @@ class SekuireSDK {
             privateKey: process.env.SEKUIRE_PRIVATE_KEY,
             apiKey: process.env.SEKUIRE_API_KEY,
             installToken: process.env.SEKUIRE_INSTALL_TOKEN,
+            installationId: process.env.SEKUIRE_INSTALLATION_ID,
+            refreshToken: process.env.SEKUIRE_REFRESH_TOKEN,
+            runtimeToken: process.env.SEKUIRE_RUNTIME_TOKEN,
             agentId,
             agentName: process.env.SEKUIRE_AGENT_NAME,
             apiUrl: process.env.SEKUIRE_API_URL ?? DEFAULT_API_URL,
@@ -1844,22 +2269,27 @@ class SekuireSDK {
     /**
      * Start the SDK.
      *
-     * - Bootstraps with Sekuire using the install token
+     * - Bootstraps with Sekuire using install token or recovery credentials
      * - Starts auto-heartbeat loop if enabled
      *
-     * Requires SEKUIRE_INSTALL_TOKEN to be set (from dashboard or CLI).
+     * Authentication (one of):
+     * - SEKUIRE_INSTALL_TOKEN for initial bootstrap
+     * - SEKUIRE_INSTALLATION_ID + SEKUIRE_REFRESH_TOKEN for recovery
      */
     async start() {
         if (this.isRunning) {
             return;
         }
         this.isRunning = true;
-        if (this.config.autoHeartbeat && this.config.installToken) {
+        const hasInstallToken = !!this.config.installToken;
+        const hasRecoveryCredentials = !!(this.config.installationId && this.config.refreshToken);
+        if (this.config.autoHeartbeat && (hasInstallToken || hasRecoveryCredentials)) {
             await this.beacon.start();
         }
-        else if (this.config.autoHeartbeat && !this.config.installToken) {
-            console.warn("[SekuireSDK] Auto-heartbeat enabled but no install token provided. " +
-                "Set SEKUIRE_INSTALL_TOKEN or generate one from the dashboard.");
+        else if (this.config.autoHeartbeat && !hasInstallToken && !hasRecoveryCredentials) {
+            console.warn("[SekuireSDK] Auto-heartbeat enabled but no credentials provided. Set one of:" +
+                "\n  - SEKUIRE_INSTALL_TOKEN (for initial bootstrap)" +
+                "\n  - SEKUIRE_INSTALLATION_ID + SEKUIRE_REFRESH_TOKEN (for recovery)");
         }
     }
     /**
@@ -1934,6 +2364,41 @@ class SekuireSDK {
     getRuntimeCredentials() {
         return this.beacon.getRuntimeCredentials();
     }
+    /**
+     * Get full installation credentials for persistence.
+     *
+     * Use this after successful SDK start to extract credentials that can be
+     * saved as environment variables or secrets for future container restarts.
+     * These credentials allow recovery without consuming a new install token.
+     *
+     * Recommended workflow for ephemeral compute (Cloud Run, K8s, etc.):
+     * 1. First deploy: use SEKUIRE_INSTALL_TOKEN for initial bootstrap
+     * 2. After start: call getInstallationCredentials() to extract creds
+     * 3. Save to secrets manager (AWS Secrets Manager, K8s Secret, etc.)
+     * 4. Update deployment with:
+     *    - SEKUIRE_INSTALLATION_ID
+     *    - SEKUIRE_REFRESH_TOKEN
+     *    - (optionally) SEKUIRE_RUNTIME_TOKEN
+     * 5. Future restarts: SDK auto-recovers using refresh token
+     *
+     * @example
+     * ```ts
+     * const sdk = SekuireSDK.fromEnv();
+     * await sdk.start();
+     *
+     * const creds = sdk.getInstallationCredentials();
+     * if (creds) {
+     *   console.log('Save these to your secrets manager:');
+     *   console.log(`SEKUIRE_INSTALLATION_ID=${creds.installationId}`);
+     *   console.log(`SEKUIRE_REFRESH_TOKEN=${creds.refreshToken}`);
+     * }
+     * ```
+     *
+     * @returns Full installation credentials or null if not bootstrapped
+     */
+    getInstallationCredentials() {
+        return this.beacon.getInstallationCredentials();
+    }
     /**
      * Create a TaskWorker that shares credentials with this SDK instance.
      *
@@ -1941,6 +2406,9 @@ class SekuireSDK {
      * the runtime credentials from the SDK's beacon. The SDK must be started
      * before calling this method.
      *
+     * The Worker receives full credentials (installationId, runtimeToken, refreshToken)
+     * so it can independently refresh tokens when they expire.
+     *
      * @param options Optional worker configuration overrides
      * @returns TaskWorker instance ready to be started
      * @throws Error if SDK hasn't been started or bootstrap failed
@@ -1958,7 +2426,7 @@ class SekuireSDK {
      * ```
      */
     createTaskWorker(options) {
-        const credentials = this.getRuntimeCredentials();
+        const credentials = this.getInstallationCredentials();
         if (!credentials) {
             throw new Error("SDK must be started before creating a TaskWorker. " +
                 "Call sdk.start() first and ensure bootstrap succeeded.");
@@ -1967,6 +2435,10 @@ class SekuireSDK {
             apiBaseUrl: this.config.apiUrl,
             agentId: this.config.agentId,
             runtimeToken: credentials.runtimeToken,
+            installationId: credentials.installationId,
+            refreshToken: credentials.refreshToken,
+            credentialsStore: this.credentialsStore,
+            tokenProvider: () => this.credentialsStore.getRuntimeToken(),
             deploymentUrl: detectDeploymentUrl(),
             capabilities: options?.capabilities ?? this.config.capabilities,
             heartbeatIntervalMs: options?.heartbeatIntervalMs,
@@ -16703,7 +17175,7 @@ class A2AClient {
                                 const event = JSON.parse(data);
                                 yield event;
                                 // Stop on terminal states
-                                if (["completed", "failed", "cancelled"].includes(event.status)) {
+                                if (["completed", "failed", "canceled"].includes(event.status)) {
                                     return;
                                 }
                             }
@@ -16883,7 +17355,7 @@ class A2AServer {
             task = {
                 id: taskId,
                 contextId: undefined,
-                status: "pending",
+                status: "submitted",
                 history: [],
                 artifacts: [],
                 createdAt: new Date(),
@@ -16996,7 +17468,7 @@ class A2AServer {
         const self = this;
         return (async function* () {
             yield self.createUpdateEvent(task);
-            if (["completed", "failed", "cancelled"].includes(task.status)) {
+            if (["completed", "failed", "canceled"].includes(task.status)) {
                 return;
             }
             const queue = [];
@@ -17014,7 +17486,7 @@ class A2AServer {
                     while (queue.length > 0) {
                         const event = queue.shift();
                         yield event;
-                        if (["completed", "failed", "cancelled"].includes(event.status)) {
+                        if (["completed", "failed", "canceled"].includes(event.status)) {
                             return;
                         }
                     }
@@ -17051,7 +17523,7 @@ class A2AServer {
             task = {
                 id: taskId,
                 contextId: params.contextId,
-                status: "pending",
+                status: "submitted",
                 history: [],
                 artifacts: [],
                 createdAt: new Date(),
@@ -17120,10 +17592,10 @@ class A2AServer {
         if (!task) {
             return this.error(request.id, -32001, "Task not found");
         }
-        if (["completed", "failed", "cancelled"].includes(task.status)) {
+        if (["completed", "failed", "canceled"].includes(task.status)) {
             return this.error(request.id, -32001, "Task already completed");
         }
-        task.status = "cancelled";
+        task.status = "canceled";
         task.updatedAt = new Date();
         this.notifySubscribers(task.id);
         return this.success(request.id, this.taskToResponse(task));
@@ -17312,7 +17784,7 @@ class A2ATaskDelegator {
         try {
             for await (const event of this.client.subscribe(taskId)) {
                 yield event;
-                if (["completed", "failed", "cancelled"].includes(event.status)) {
+                if (["completed", "failed", "canceled"].includes(event.status)) {
                     finalTask = await this.client.getTask(taskId);
                     break;
                 }
@@ -17376,7 +17848,7 @@ class A2ATaskDelegator {
                 if (onProgress) {
                     onProgress(event);
                 }
-                if (["completed", "failed", "cancelled"].includes(event.status)) {
+                if (["completed", "failed", "canceled"].includes(event.status)) {
                     return this.client.getTask(taskId);
                 }
                 if (Date.now() > deadline) {
@@ -17407,7 +17879,7 @@ class A2ATaskDelegator {
                     artifacts: task.artifacts,
                 });
             }
-            if (["completed", "failed", "cancelled"].includes(task.status.state)) {
+            if (["completed", "failed", "canceled"].includes(task.status.state)) {
                 return task;
             }
             await this.sleep(this.config.pollInterval);
@@ -17422,4 +17894,4 @@ function createDelegator(config) {
     return new A2ATaskDelegator(config);
 }
 
-export { A2AClient, A2AError, A2AServer, A2ATaskDelegator, SekuireAgent as Agent, AgentIdentity, AnthropicProvider, BaseMemoryStorage, Beacon, CONVEX_FUNCTIONS_TEMPLATE, CONVEX_SCHEMA_TEMPLATE, CloudflareD1Storage, CloudflareKVStorage, ComplianceError, ComplianceMonitor, ContentPolicyError, ConvexStorage, CryptoError, DEFAULT_API_URL, DynamoDBStorage, FileAccessError, GoogleProvider, InMemoryStorage, NetworkComplianceError, NetworkError, OllamaProvider, OpenAIProvider, PolicyClient, PolicyEnforcer, PolicyViolationError, PostgresStorage, ProtocolError, RedisStorage, SQLiteStorage, SekuireAgent$1 as SekuireAgent, SekuireAgentBuilder, SekuireClient, SekuireCrypto, SekuireError, SekuireLogger, SekuireRegistryClient, SekuireSDK, SekuireServer, SekuireSpanExporter, TaskWorker, ToolPatternParser, ToolRegistry, ToolUsageError, TursoStorage, UpstashStorage, builtInTools, calculateSekuireId, createAgent, createBeacon, createDefaultToolRegistry, createDelegationTool, createDelegator, createDiscoveryTool, createLLMProvider, createMemoryStorage, createRegistryClient, createSekuireClient, createSekuireExpressMiddleware, createSekuireFastifyPlugin, createWorker, detectDeploymentUrl, generateKeyPair, getAgent, getAgentConfig, getAgents, getTools$1 as getLegacyTools, getStorageInfo, getSystemPrompt, getTools, getTracer, hasStorage, initTelemetry, listStorageTypes, llm, loadConfig, loadSystemPrompt, loadTools, registerStorage, shutdownTelemetry, tool, tools };
+export { A2AClient, A2AError, A2AServer, A2ATaskDelegator, SekuireAgent as Agent, AgentIdentity, AnthropicProvider, BaseMemoryStorage, Beacon, CONVEX_FUNCTIONS_TEMPLATE, CONVEX_SCHEMA_TEMPLATE, CloudflareD1Storage, CloudflareKVStorage, ComplianceError, ComplianceMonitor, ContentPolicyError, ConvexStorage, CryptoError, DEFAULT_API_URL, DynamoDBStorage, FileAccessError, GoogleProvider, InMemoryStorage, NetworkComplianceError, NetworkError, OllamaProvider, OpenAIProvider, PolicyClient, PolicyEnforcer, PolicyViolationError, PostgresStorage, ProtocolError, RedisStorage, RuntimeCredentialsStore, SQLiteStorage, SekuireAgent$1 as SekuireAgent, SekuireAgentBuilder, SekuireClient, SekuireCrypto, SekuireError, SekuireLogger, SekuireRegistryClient, SekuireSDK, SekuireServer, SekuireSpanExporter, TaskWorker, ToolPatternParser, ToolRegistry, ToolUsageError, TursoStorage, UpstashStorage, builtInTools, calculateSekuireId, createAgent, createBeacon, createDefaultToolRegistry, createDelegationTool, createDelegator, createDiscoveryTool, createLLMProvider, createMemoryStorage, createRegistryClient, createSekuireClient, createSekuireExpressMiddleware, createSekuireFastifyPlugin, createWorker, detectDeploymentUrl, generateKeyPair, getAgent, getAgentConfig, getAgents, getTools$1 as getLegacyTools, getStorageInfo, getSystemPrompt, getTools, getTracer, hasStorage, initTelemetry, listStorageTypes, llm, loadConfig, loadSystemPrompt, loadTools, registerStorage, shutdownTelemetry, tool, tools };