@thyn-ai/sqai 0.1.4 → 0.1.5

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,12 +17,21 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
   ContractIndex: () => ContractIndex,
+  LoginError: () => LoginError,
   ResultStore: () => ResultStore,
   RuntimeProvisioner: () => RuntimeProvisioner,
   SQAI: () => SQAI,
@@ -31,15 +42,19 @@ __export(index_exports, {
   currentPlatformKey: () => currentPlatformKey,
   invocationHash: () => invocationHash,
   isReadOnlyEligible: () => isReadOnlyEligible,
+  login: () => login,
+  logout: () => logout,
   lookupCapability: () => lookupCapability,
+  readCachedApiKey: () => readCachedApiKey,
   runtimeCacheDir: () => runtimeCacheDir,
+  sqaiHome: () => sqaiHome,
   validateComputation: () => validateComputation
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/sqai.ts
-var import_node_crypto6 = require("crypto");
-var import_node_os2 = require("os");
+var import_node_crypto7 = require("crypto");
+var import_node_os3 = require("os");
 var import_algenta_sdk3 = require("algenta-sdk");
 
 // src/contract-data.json
@@ -354,22 +369,180 @@ var ResultStore = class {
 };
 
 // src/runtime/provision.ts
-var import_node_os = require("os");
-var import_node_path2 = require("path");
-var import_node_fs2 = require("fs");
-var import_node_crypto5 = require("crypto");
+var import_node_os2 = require("os");
+var import_node_path3 = require("path");
+var import_node_fs3 = require("fs");
+var import_node_crypto6 = require("crypto");
 var import_node_stream = require("stream");
 var import_promises = require("stream/promises");
 var import_algenta_sdk2 = require("algenta-sdk");
 
-// src/runtime/bundle.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto4 = require("crypto");
+// src/runtime/auth.ts
+var import_node_crypto3 = require("crypto");
 var import_node_fs = require("fs");
+var import_node_os = require("os");
 var import_node_path = require("path");
+var CLIENT_ID = "sqai-cli";
+var SCOPE = "sqai";
+var PRODUCT = "sqai";
+var DEFAULT_PLAN = "sqai_developer";
+var DEFAULT_ACCOUNTS_URL = "https://accounts.thyn.ai";
+var DEFAULT_API_URL = "https://api.sqai.com";
+var LoginError = class extends Error {
+};
+function sqaiHome() {
+  return process.env.SQAI_HOME ?? (0, import_node_path.join)((0, import_node_os.homedir)(), ".sqai");
+}
+var p = (name) => (0, import_node_path.join)(sqaiHome(), name);
+var apiKeyPath = () => p("api_key");
+var tokenPath = () => p("token");
+var deviceIdPath = () => p("device_id");
+var accountsUrl = () => (process.env.SQAI_ACCOUNTS_URL ?? DEFAULT_ACCOUNTS_URL).replace(/\/$/, "");
+var apiUrl = () => (process.env.SQAI_API_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
+function readSecret(path) {
+  try {
+    const v = (0, import_node_fs.readFileSync)(path, "utf8").trim();
+    return v || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readCachedApiKey() {
+  return process.env.SQAI_API_KEY ?? process.env.ALGENTA_API_KEY ?? readSecret(apiKeyPath());
+}
+function cache(path, value) {
+  (0, import_node_fs.mkdirSync)(sqaiHome(), { recursive: true });
+  (0, import_node_fs.writeFileSync)(path, value.trim() + "\n", "utf8");
+  try {
+    (0, import_node_fs.chmodSync)(path, 384);
+  } catch {
+  }
+}
+function deviceId() {
+  const existing = readSecret(deviceIdPath());
+  if (existing) return existing;
+  const value = (0, import_node_crypto3.createHash)("sha256").update(`${(0, import_node_os.hostname)()}:${Date.now()}:${Math.random()}`).digest("hex");
+  cache(deviceIdPath(), value);
+  return value;
+}
+async function request(method, url, opts = {}) {
+  const headers = { Accept: "application/json", "User-Agent": "sqai-cli" };
+  if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+  if (opts.bearer) headers["Authorization"] = `Bearer ${opts.bearer}`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+    });
+  } catch (e) {
+    throw new LoginError(`${method} ${url}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  let json = {};
+  try {
+    json = await res.json();
+  } catch {
+    json = {};
+  }
+  return { status: res.status, json };
+}
+async function deviceAuthorize(accounts, openBrowser, maxWaitMs = 3e5) {
+  const { json: start } = await request("POST", `${accounts}/oauth/device/code`, {
+    body: { client_id: CLIENT_ID, scope: SCOPE }
+  });
+  const deviceCode = start.device_code;
+  const userCode = start.user_code;
+  const verify = start.verification_uri_complete || start.verification_uri;
+  const interval = Number(start.interval ?? 5);
+  if (!deviceCode || !userCode || !verify) throw new LoginError("accounts device-code response missing fields");
+  process.stdout.write(`
+  Open ${verify}
+  and enter code:  ${userCode}
+
+`);
+  if (openBrowser) await tryOpenBrowser(verify);
+  const deadline = Date.now() + maxWaitMs;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval * 1e3));
+    const { status, json: tok } = await request("POST", `${accounts}/oauth/device/token`, {
+      body: {
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }
+    });
+    const access = tok.access_token;
+    if (access) return access;
+    const error = tok.error;
+    if (error === "authorization_pending" || error === "slow_down" || status === 400 || status === 428) continue;
+    throw new LoginError(`device authorization failed: ${error ?? `HTTP ${status}`}`);
+  }
+  throw new LoginError("timed out waiting for device authorization");
+}
+async function tryOpenBrowser(url) {
+  try {
+    const { spawn: spawn2 } = await import("child_process");
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    spawn2(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" }).unref();
+  } catch {
+  }
+}
+async function createApiKey(api, accessToken, plan) {
+  const { status, json } = await request("POST", `${api}/v1/products/${PRODUCT}/onboard`, {
+    bearer: accessToken,
+    body: { name: CLIENT_ID, product: PRODUCT, plan }
+  });
+  const key = json.raw_key || json.key || json.api_key;
+  if (status >= 400 || !key) {
+    const detail = json.error && typeof json.error === "object" ? json.error.message : void 0;
+    throw new LoginError(`could not create API key (HTTP ${status})${detail ? `: ${detail}` : ""}`);
+  }
+  return key;
+}
+async function login(opts = {}) {
+  const plan = opts.plan ?? DEFAULT_PLAN;
+  const accounts = accountsUrl();
+  const api = apiUrl();
+  let token = opts.accessToken ?? process.env.SQAI_TOKEN;
+  if (token) {
+    process.stdout.write("using supplied token (headless)\n");
+  } else {
+    process.stdout.write(`authenticating via ${accounts} \u2026
+`);
+    token = await deviceAuthorize(accounts, opts.openBrowser ?? true);
+  }
+  cache(tokenPath(), token);
+  process.stdout.write("creating your free SQAI Developer API key \u2026\n");
+  const apiKey = await createApiKey(api, token, plan);
+  cache(apiKeyPath(), apiKey);
+  deviceId();
+  process.stdout.write(
+    "\n  \u2713 sqai login complete \u2014 the local runtime will provision a device-bound offline license on first use.\n  SQAI runs fully on your machine; no data leaves it.\n\n"
+  );
+  return {
+    device_id: deviceId(),
+    plan,
+    api_key_prefix: apiKey.includes("_") ? `${apiKey.split("_", 1)[0]}_\u2026` : `${apiKey.slice(0, 6)}\u2026`
+  };
+}
+function logout() {
+  for (const path of [tokenPath(), apiKeyPath()]) {
+    try {
+      (0, import_node_fs.rmSync)(path);
+    } catch {
+    }
+  }
+}
+
+// src/runtime/bundle.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto5 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
 
 // src/runtime/trust.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var RELEASE_1_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7m4G1dEMi5FppLa5hu9N
 4pUyoGELPaN5X7bO+9Qktgbv21+c8I4sQCufKouZEVNMNluKNrWcQ5dSwOuVxxS9
@@ -468,11 +641,11 @@ function keyValidNow(key, nowMs) {
 }
 function signatureVerifies(manifestBytes, signature, publicKeyPem) {
   try {
-    const key = (0, import_node_crypto3.createPublicKey)(publicKeyPem);
+    const key = (0, import_node_crypto4.createPublicKey)(publicKeyPem);
     if (key.asymmetricKeyType !== "rsa") {
       return false;
     }
-    return (0, import_node_crypto3.verify)("sha256", manifestBytes, key, signature);
+    return (0, import_node_crypto4.verify)("sha256", manifestBytes, key, signature);
   } catch {
     return false;
   }
@@ -652,7 +825,7 @@ async function hashTarMember(tarball, member, cap) {
     const child = (0, import_node_child_process.spawn)("tar", ["-xOf", tarball, "--", member], {
       stdio: ["ignore", "pipe", "pipe"]
     });
-    const digest = (0, import_node_crypto4.createHash)("sha256");
+    const digest = (0, import_node_crypto5.createHash)("sha256");
     let total = 0;
     let overflow = false;
     child.stdout.on("data", (chunk) => {
@@ -686,7 +859,7 @@ async function hashTarMember(tarball, member, cap) {
   });
 }
 async function extractTarball(tarball, destinationDir) {
-  await import_node_fs.promises.mkdir(destinationDir, { recursive: true });
+  await import_node_fs2.promises.mkdir(destinationDir, { recursive: true });
   await new Promise((resolve, reject) => {
     const child = (0, import_node_child_process.spawn)("tar", ["-xf", tarball, "-C", destinationDir], {
       stdio: ["ignore", "ignore", "pipe"]
@@ -712,8 +885,8 @@ async function extractTarball(tarball, destinationDir) {
 }
 function sha256File(path) {
   return new Promise((resolve, reject) => {
-    const digest = (0, import_node_crypto4.createHash)("sha256");
-    const stream = (0, import_node_fs.createReadStream)(path);
+    const digest = (0, import_node_crypto5.createHash)("sha256");
+    const stream = (0, import_node_fs2.createReadStream)(path);
     stream.on("data", (chunk) => digest.update(chunk));
     stream.on("error", reject);
     stream.on("end", () => resolve(digest.digest("hex")));
@@ -722,7 +895,7 @@ function sha256File(path) {
 function digestsEqual(actualHex, expectedHex) {
   const actual = Buffer.from(actualHex.toLowerCase(), "utf-8");
   const expected = Buffer.from(expectedHex.toLowerCase(), "utf-8");
-  return actual.length === expected.length && (0, import_node_crypto4.timingSafeEqual)(actual, expected);
+  return actual.length === expected.length && (0, import_node_crypto5.timingSafeEqual)(actual, expected);
 }
 function parseVerifiedManifest(manifestBytes) {
   let manifest;
@@ -872,7 +1045,7 @@ async function verifyBundleTarball(tarball, expectations) {
   return manifest;
 }
 async function listFilesRecursively(root, relative = "") {
-  const entries = await import_node_fs.promises.readdir((0, import_node_path.join)(root, relative), { withFileTypes: true });
+  const entries = await import_node_fs2.promises.readdir((0, import_node_path2.join)(root, relative), { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const relPath = relative === "" ? entry.name : `${relative}/${entry.name}`;
@@ -896,21 +1069,21 @@ async function listFilesRecursively(root, relative = "") {
   return files;
 }
 async function verifyInstalledBundleDir(installDir, expectations) {
-  const manifestPath = (0, import_node_path.join)(installDir, MANIFEST_NAME);
-  const signaturePath = (0, import_node_path.join)(installDir, MANIFEST_SIG_NAME);
+  const manifestPath = (0, import_node_path2.join)(installDir, MANIFEST_NAME);
+  const signaturePath = (0, import_node_path2.join)(installDir, MANIFEST_SIG_NAME);
   let manifestBytes;
   let signature;
   try {
-    const manifestStat = await import_node_fs.promises.lstat(manifestPath);
-    const signatureStat = await import_node_fs.promises.lstat(signaturePath);
+    const manifestStat = await import_node_fs2.promises.lstat(manifestPath);
+    const signatureStat = await import_node_fs2.promises.lstat(signaturePath);
     if (!manifestStat.isFile() || !signatureStat.isFile() || manifestStat.size > MAX_MANIFEST_BYTES || signatureStat.size > MAX_SIG_BYTES) {
       throw new BundleVerificationError(
         "member_unreadable",
         "installed bundle manifest/signature is not a capped regular file"
       );
     }
-    manifestBytes = await import_node_fs.promises.readFile(manifestPath);
-    signature = await import_node_fs.promises.readFile(signaturePath);
+    manifestBytes = await import_node_fs2.promises.readFile(manifestPath);
+    signature = await import_node_fs2.promises.readFile(signaturePath);
   } catch (error) {
     if (error instanceof BundleVerificationError) {
       throw error;
@@ -937,8 +1110,8 @@ async function verifyInstalledBundleDir(installDir, expectations) {
         `installed file not listed in signed manifest: '${relPath}'`
       );
     }
-    const absolute = (0, import_node_path.join)(installDir, relPath);
-    const stat = await import_node_fs.promises.lstat(absolute);
+    const absolute = (0, import_node_path2.join)(installDir, relPath);
+    const stat = await import_node_fs2.promises.lstat(absolute);
     if (stat.nlink > 1) {
       throw new BundleVerificationError(
         "unsafe_member",
@@ -994,28 +1167,28 @@ var LOCK_FRESH_MS = 10 * 60 * 1e3;
 var LOCK_WAIT_TIMEOUT_MS = 90 * 1e3;
 var LOCK_POLL_INTERVAL_MS = 1e3;
 function currentPlatformKey() {
-  const os = (0, import_node_os.platform)();
-  const arch = (0, import_node_os.arch)();
+  const os = (0, import_node_os2.platform)();
+  const arch = (0, import_node_os2.arch)();
   const osName = os === "darwin" ? "darwin" : os === "linux" ? "linux" : os;
   return `${osName}-${arch}`;
 }
 function cacheDirFor(brand) {
-  const os = (0, import_node_os.platform)();
+  const os = (0, import_node_os2.platform)();
   if (os === "darwin") {
-    return (0, import_node_path2.join)((0, import_node_os.homedir)(), "Library", "Caches", brand, "runtime");
+    return (0, import_node_path3.join)((0, import_node_os2.homedir)(), "Library", "Caches", brand, "runtime");
   }
   if (os === "win32") {
-    const localAppData = process.env.LOCALAPPDATA ?? (0, import_node_path2.join)((0, import_node_os.homedir)(), "AppData", "Local");
-    return (0, import_node_path2.join)(localAppData, brand, "runtime");
+    const localAppData = process.env.LOCALAPPDATA ?? (0, import_node_path3.join)((0, import_node_os2.homedir)(), "AppData", "Local");
+    return (0, import_node_path3.join)(localAppData, brand, "runtime");
   }
-  const xdgCache = process.env.XDG_CACHE_HOME ?? (0, import_node_path2.join)((0, import_node_os.homedir)(), ".cache");
-  return (0, import_node_path2.join)(xdgCache, brand.toLowerCase(), "runtime");
+  const xdgCache = process.env.XDG_CACHE_HOME ?? (0, import_node_path3.join)((0, import_node_os2.homedir)(), ".cache");
+  return (0, import_node_path3.join)(xdgCache, brand.toLowerCase(), "runtime");
 }
 function runtimeCacheDir() {
   const current = cacheDirFor("SQAI");
-  if (!(0, import_node_fs2.existsSync)(current)) {
+  if (!(0, import_node_fs3.existsSync)(current)) {
     const legacy = cacheDirFor("Algenta");
-    if (legacy !== current && (0, import_node_fs2.existsSync)(legacy)) {
+    if (legacy !== current && (0, import_node_fs3.existsSync)(legacy)) {
       return legacy;
     }
   }
@@ -1034,12 +1207,12 @@ async function defaultDownloadBundle(url, destination) {
   }
   await (0, import_promises.pipeline)(
     import_node_stream.Readable.fromWeb(response.body),
-    (0, import_node_fs2.createWriteStream)(destination)
+    (0, import_node_fs3.createWriteStream)(destination)
   );
 }
 async function removeQuietly(path) {
   try {
-    await import_node_fs2.promises.rm(path, { recursive: true, force: true });
+    await import_node_fs3.promises.rm(path, { recursive: true, force: true });
   } catch {
   }
 }
@@ -1164,7 +1337,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   localCacheKey(modules, platformKey) {
     const canonical = modules.join(",");
     const version = this.options.contract.runtime_bundle.version;
-    return (0, import_node_crypto5.createHash)("sha256").update(`${canonical}|${platformKey}|${version}`).digest("hex").slice(0, 20);
+    return (0, import_node_crypto6.createHash)("sha256").update(`${canonical}|${platformKey}|${version}`).digest("hex").slice(0, 20);
   }
   /**
    * Deterministic per-filter daemon endpoint so a filtered runtime never collides
@@ -1173,7 +1346,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   filterEndpoint(cacheKey) {
     const seed = parseInt(cacheKey.slice(0, 6), 16) || 0;
     const port = 50100 + seed % 800;
-    return { sock: (0, import_node_path2.join)(this.cacheDir(), `${cacheKey}.sock`), tcp: `127.0.0.1:${port}` };
+    return { sock: (0, import_node_path3.join)(this.cacheDir(), `${cacheKey}.sock`), tcp: `127.0.0.1:${port}` };
   }
   static DAEMON_ENDPOINT_ENV = [
     "ALGENTA_DAEMON_SOCK",
@@ -1190,7 +1363,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
     process.env.ALGENTA_DAEMON_SOCK = endpoint.sock;
     process.env.ALGENTA_DAEMON_TCP = endpoint.tcp;
     process.env.ALGENTA_MOJO_SOCK = `${endpoint.sock}.worker`;
-    process.env.ALGENTA_RUNTIME_DIR = (0, import_node_path2.join)(installDir, ".runtime");
+    process.env.ALGENTA_RUNTIME_DIR = (0, import_node_path3.join)(installDir, ".runtime");
     return saved;
   }
   restoreEnv(saved) {
@@ -1305,9 +1478,9 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   }
   /** Verify an existing install if present; returns null when absent/invalid. */
   async verifiedInstallOrNull(platformKey, version, removeOnFailure, installKey = version) {
-    const installDir = (0, import_node_path2.join)(this.cacheDir(), installKey);
+    const installDir = (0, import_node_path3.join)(this.cacheDir(), installKey);
     try {
-      await import_node_fs2.promises.access((0, import_node_path2.join)(installDir, MANIFEST_NAME));
+      await import_node_fs3.promises.access((0, import_node_path3.join)(installDir, MANIFEST_NAME));
     } catch {
       return null;
     }
@@ -1327,7 +1500,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   async acquireLock(lockPath) {
     const payload = JSON.stringify({ pid: process.pid, created_at: (/* @__PURE__ */ new Date()).toISOString() });
     try {
-      const handle = await import_node_fs2.promises.open(lockPath, "wx");
+      const handle = await import_node_fs3.promises.open(lockPath, "wx");
       try {
         await handle.writeFile(payload, "utf-8");
       } finally {
@@ -1341,7 +1514,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   async lockIsStale(lockPath) {
     const freshMs = this.options.lockFreshMs ?? LOCK_FRESH_MS;
     try {
-      const raw = await import_node_fs2.promises.readFile(lockPath, "utf-8");
+      const raw = await import_node_fs3.promises.readFile(lockPath, "utf-8");
       const parsed = JSON.parse(raw);
       const createdAt = typeof parsed.created_at === "string" ? Date.parse(parsed.created_at) : NaN;
       if (!Number.isFinite(createdAt)) {
@@ -1359,12 +1532,12 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   /** Serialize installers on `<cacheDir>/<installKey>.lock`; returns the verified install. */
   async ensureInstalled(platformKey, version, platformBundle, installKey = version) {
     const cacheDir = this.cacheDir();
-    await import_node_fs2.promises.mkdir(cacheDir, { recursive: true });
+    await import_node_fs3.promises.mkdir(cacheDir, { recursive: true });
     const existing = await this.verifiedInstallOrNull(platformKey, version, true, installKey);
     if (existing) {
       return existing;
     }
-    const lockPath = (0, import_node_path2.join)(cacheDir, `${installKey}.lock`);
+    const lockPath = (0, import_node_path3.join)(cacheDir, `${installKey}.lock`);
     const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? LOCK_WAIT_TIMEOUT_MS;
     const pollIntervalMs = this.options.lockPollIntervalMs ?? LOCK_POLL_INTERVAL_MS;
     const deadline = Date.now() + waitTimeoutMs;
@@ -1409,10 +1582,10 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   /** Holder-of-the-lock path: download → verify → extract → atomic rename. */
   async downloadVerifyExtract(platformKey, version, platformBundle, installKey = version) {
     const cacheDir = this.cacheDir();
-    const token = (0, import_node_crypto5.randomBytes)(6).toString("hex");
-    const tarballPath = (0, import_node_path2.join)(cacheDir, `tmp-${token}.tgz`);
-    const extractDir = (0, import_node_path2.join)(cacheDir, `tmp-${token}`);
-    const installDir = (0, import_node_path2.join)(cacheDir, installKey);
+    const token = (0, import_node_crypto6.randomBytes)(6).toString("hex");
+    const tarballPath = (0, import_node_path3.join)(cacheDir, `tmp-${token}.tgz`);
+    const extractDir = (0, import_node_path3.join)(cacheDir, `tmp-${token}`);
+    const installDir = (0, import_node_path3.join)(cacheDir, installKey);
     const url = resolveBundleUrl(platformBundle.url, version, platformKey);
     try {
       const download = this.options.downloadBundle ?? defaultDownloadBundle;
@@ -1457,7 +1630,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
         throw this.wrapVerificationError(error, platformKey, version);
       }
       try {
-        await import_node_fs2.promises.rename(extractDir, installDir);
+        await import_node_fs3.promises.rename(extractDir, installDir);
       } catch (error) {
         const raced = await this.verifiedInstallOrNull(platformKey, version, false, installKey);
         if (raced) {
@@ -1487,10 +1660,16 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
       throw this.wrapVerificationError(error, platformKey, version);
     }
     const daemonCommand = [
-      (0, import_node_path2.join)(installed.installDir, ...entryRelative.split("/")),
+      (0, import_node_path3.join)(installed.installDir, ...entryRelative.split("/")),
       "start",
       "--foreground"
     ];
+    if (!process.env.ALGENTA_API_KEY && !process.env.DE_API_KEY) {
+      const key = await readCachedApiKey();
+      if (key) {
+        process.env.ALGENTA_API_KEY = key;
+      }
+    }
     const managed = this.newRuntime(
       endpoint ? { autoStart: true, daemonCommand, tcpAddress: endpoint.tcp } : { autoStart: true, daemonCommand }
     );
@@ -1524,8 +1703,8 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
       }
     }
     try {
-      await import_node_fs2.promises.writeFile(
-        (0, import_node_path2.join)(this.cacheDir(), "state.json"),
+      await import_node_fs3.promises.writeFile(
+        (0, import_node_path3.join)(this.cacheDir(), "state.json"),
         JSON.stringify(
           { pid: null, version, started_at: (/* @__PURE__ */ new Date()).toISOString() },
           null,
@@ -1894,7 +2073,7 @@ var SQAI = class {
   async compute(spec) {
     const resolvedBindings = await this.resolveBindings(spec.bindings ?? []);
     const validated = validateComputation(spec, this.contractIndex, this.policy, resolvedBindings);
-    const requestId = `sqai_${(0, import_node_crypto6.randomBytes)(8).toString("hex")}`;
+    const requestId = `sqai_${(0, import_node_crypto7.randomBytes)(8).toString("hex")}`;
     const target = await this.dispatchTarget();
     const outcome = await dispatchComputation(
       target,
@@ -1937,7 +2116,7 @@ var SQAI = class {
         runtime_bundle_version: bundle.version || "unmanaged",
         runtime_bundle_sha256: platformBundle?.sha256 ?? "unmanaged",
         platform: currentPlatformKey(),
-        architecture: (0, import_node_os2.arch)(),
+        architecture: (0, import_node_os3.arch)(),
         kernel_build: outcome.engine_used,
         precision_mode: "float64",
         thread_count: 1,
@@ -2091,6 +2270,7 @@ function mapSource(registration) {
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ContractIndex,
+  LoginError,
   ResultStore,
   RuntimeProvisioner,
   SQAI,
@@ -2101,8 +2281,12 @@ function mapSource(registration) {
   currentPlatformKey,
   invocationHash,
   isReadOnlyEligible,
+  login,
+  logout,
   lookupCapability,
+  readCachedApiKey,
   runtimeCacheDir,
+  sqaiHome,
   validateComputation
 });
 //# sourceMappingURL=index.cjs.map