@thyn-ai/sqai 0.1.4 → 0.1.5

package/dist/index.d.cts

@@ -575,6 +575,36 @@ declare class ResultStore {
     private evictOldestForTenant;
 }
 
+/**
+ * `sqai login` — device onboarding for the SQAI runtime (JS/TS side; mirrors the Python sqai._login).
+ *
+ * Authenticates via the shared accounts portal (OAuth 2.0 device grant, RFC 8628), resolves-or-creates
+ * the caller's org on the free `sqai_developer` tier, and mints a control-plane API key. The key is
+ * cached under ~/.sqai and handed to the local runtime daemon (as ALGENTA_API_KEY), which exchanges it
+ * once for a platform-signed, device-bound offline license — then everything runs locally, no query-time
+ * network. Same device tech telys/algenta use; only the product literals differ.
+ *
+ * Free forever on 1 machine. Paid tiers (sqai_pro / sqai_team) add devices/seats/commercial use via the
+ * accounts billing portal — never a cloud service. Login is licensing-only; no data leaves the machine.
+ */
+declare class LoginError extends Error {
+}
+declare function sqaiHome(): string;
+/** Resolve the SQAI API key for the runtime: $SQAI_API_KEY / $ALGENTA_API_KEY, else the cached key. */
+declare function readCachedApiKey(): Promise<string | undefined>;
+interface LoginResult {
+    device_id: string;
+    plan: string;
+    api_key_prefix: string;
+}
+declare function login(opts?: {
+    plan?: string;
+    accessToken?: string;
+    openBrowser?: boolean;
+}): Promise<LoginResult>;
+/** Remove cached token + API key (keeps the device identity so a re-login rebinds the same device). */
+declare function logout(): void;
+
 /** Computation-plane validation: dynamic, against the embedded capability
  * contract. The zod wire schema (in @thyn-ai/sqai-ai-sdk) only transports values;
  * everything here authorizes them. SQAI computes nothing — a validated
@@ -601,4 +631,4 @@ interface ValidatedComputation {
 declare function lookupCapability(index: ContractIndex, module: string, functionName: string): CapabilityEntry;
 declare function validateComputation(spec: ComputationSpec, index: ContractIndex, policy: SqaiPolicy | undefined, resolvedBindings: ResolvedBindingValue[]): ValidatedComputation;
 
-export { type AlgentaWireValue, type AskOutcome, type BindingProvenance, type CapabilityContract, type CapabilityEntry, type CapabilityMatch, type ColumnExtract, type ComputationBinding, type ComputationSpec, type ComputeResult, ContractIndex, type DeterminismEnvelope, type InvocationIdentity, type QueryFilterCondition, type QueryFilterSpec, type QuerySpec, type ResolvedBindingValue, ResultStore, type ResultStoreConfig, RuntimeProvisioner, type RuntimeStatus, SQAI, SQAI_ERROR_CODES, type SqaiConfig, SqaiError, type SqaiErrorSource, type SqaiIntent, type SqaiOutcome, type SqaiPolicy, type SqaiResultRecord, type SqaiSource, type SqaiValue, type ValidatedComputation, computationHash, createSQAI, currentPlatformKey, invocationHash, isReadOnlyEligible, lookupCapability, runtimeCacheDir, validateComputation };
+export { type AlgentaWireValue, type AskOutcome, type BindingProvenance, type CapabilityContract, type CapabilityEntry, type CapabilityMatch, type ColumnExtract, type ComputationBinding, type ComputationSpec, type ComputeResult, ContractIndex, type DeterminismEnvelope, type InvocationIdentity, LoginError, type LoginResult, type QueryFilterCondition, type QueryFilterSpec, type QuerySpec, type ResolvedBindingValue, ResultStore, type ResultStoreConfig, RuntimeProvisioner, type RuntimeStatus, SQAI, SQAI_ERROR_CODES, type SqaiConfig, SqaiError, type SqaiErrorSource, type SqaiIntent, type SqaiOutcome, type SqaiPolicy, type SqaiResultRecord, type SqaiSource, type SqaiValue, type ValidatedComputation, computationHash, createSQAI, currentPlatformKey, invocationHash, isReadOnlyEligible, login, logout, lookupCapability, readCachedApiKey, runtimeCacheDir, sqaiHome, validateComputation };

package/dist/index.d.ts

@@ -575,6 +575,36 @@ declare class ResultStore {
     private evictOldestForTenant;
 }
 
+/**
+ * `sqai login` — device onboarding for the SQAI runtime (JS/TS side; mirrors the Python sqai._login).
+ *
+ * Authenticates via the shared accounts portal (OAuth 2.0 device grant, RFC 8628), resolves-or-creates
+ * the caller's org on the free `sqai_developer` tier, and mints a control-plane API key. The key is
+ * cached under ~/.sqai and handed to the local runtime daemon (as ALGENTA_API_KEY), which exchanges it
+ * once for a platform-signed, device-bound offline license — then everything runs locally, no query-time
+ * network. Same device tech telys/algenta use; only the product literals differ.
+ *
+ * Free forever on 1 machine. Paid tiers (sqai_pro / sqai_team) add devices/seats/commercial use via the
+ * accounts billing portal — never a cloud service. Login is licensing-only; no data leaves the machine.
+ */
+declare class LoginError extends Error {
+}
+declare function sqaiHome(): string;
+/** Resolve the SQAI API key for the runtime: $SQAI_API_KEY / $ALGENTA_API_KEY, else the cached key. */
+declare function readCachedApiKey(): Promise<string | undefined>;
+interface LoginResult {
+    device_id: string;
+    plan: string;
+    api_key_prefix: string;
+}
+declare function login(opts?: {
+    plan?: string;
+    accessToken?: string;
+    openBrowser?: boolean;
+}): Promise<LoginResult>;
+/** Remove cached token + API key (keeps the device identity so a re-login rebinds the same device). */
+declare function logout(): void;
+
 /** Computation-plane validation: dynamic, against the embedded capability
  * contract. The zod wire schema (in @thyn-ai/sqai-ai-sdk) only transports values;
  * everything here authorizes them. SQAI computes nothing — a validated
@@ -601,4 +631,4 @@ interface ValidatedComputation {
 declare function lookupCapability(index: ContractIndex, module: string, functionName: string): CapabilityEntry;
 declare function validateComputation(spec: ComputationSpec, index: ContractIndex, policy: SqaiPolicy | undefined, resolvedBindings: ResolvedBindingValue[]): ValidatedComputation;
 
-export { type AlgentaWireValue, type AskOutcome, type BindingProvenance, type CapabilityContract, type CapabilityEntry, type CapabilityMatch, type ColumnExtract, type ComputationBinding, type ComputationSpec, type ComputeResult, ContractIndex, type DeterminismEnvelope, type InvocationIdentity, type QueryFilterCondition, type QueryFilterSpec, type QuerySpec, type ResolvedBindingValue, ResultStore, type ResultStoreConfig, RuntimeProvisioner, type RuntimeStatus, SQAI, SQAI_ERROR_CODES, type SqaiConfig, SqaiError, type SqaiErrorSource, type SqaiIntent, type SqaiOutcome, type SqaiPolicy, type SqaiResultRecord, type SqaiSource, type SqaiValue, type ValidatedComputation, computationHash, createSQAI, currentPlatformKey, invocationHash, isReadOnlyEligible, lookupCapability, runtimeCacheDir, validateComputation };
+export { type AlgentaWireValue, type AskOutcome, type BindingProvenance, type CapabilityContract, type CapabilityEntry, type CapabilityMatch, type ColumnExtract, type ComputationBinding, type ComputationSpec, type ComputeResult, ContractIndex, type DeterminismEnvelope, type InvocationIdentity, LoginError, type LoginResult, type QueryFilterCondition, type QueryFilterSpec, type QuerySpec, type ResolvedBindingValue, ResultStore, type ResultStoreConfig, RuntimeProvisioner, type RuntimeStatus, SQAI, SQAI_ERROR_CODES, type SqaiConfig, SqaiError, type SqaiErrorSource, type SqaiIntent, type SqaiOutcome, type SqaiPolicy, type SqaiResultRecord, type SqaiSource, type SqaiValue, type ValidatedComputation, computationHash, createSQAI, currentPlatformKey, invocationHash, isReadOnlyEligible, login, logout, lookupCapability, readCachedApiKey, runtimeCacheDir, sqaiHome, validateComputation };

package/dist/index.js

@@ -315,22 +315,180 @@ var ResultStore = class {
 };
 
 // src/runtime/provision.ts
-import { homedir, platform as osPlatform, arch as osArch } from "os";
-import { join as join2 } from "path";
-import { createWriteStream, existsSync, promises as fs2 } from "fs";
-import { createHash as createHash3, randomBytes as randomBytes2 } from "crypto";
+import { homedir as homedir2, platform as osPlatform, arch as osArch } from "os";
+import { join as join3 } from "path";
+import { createWriteStream, existsSync as existsSync2, promises as fs2 } from "fs";
+import { createHash as createHash4, randomBytes as randomBytes2 } from "crypto";
 import { Readable } from "stream";
 import { pipeline } from "stream/promises";
 import { MojoRuntime } from "algenta-sdk";
 
+// src/runtime/auth.ts
+import { createHash as createHash2, createPrivateKey, createPublicKey, generateKeyPairSync } from "crypto";
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, existsSync, rmSync } from "fs";
+import { homedir, hostname } from "os";
+import { join } from "path";
+var CLIENT_ID = "sqai-cli";
+var SCOPE = "sqai";
+var PRODUCT = "sqai";
+var DEFAULT_PLAN = "sqai_developer";
+var DEFAULT_ACCOUNTS_URL = "https://accounts.thyn.ai";
+var DEFAULT_API_URL = "https://api.sqai.com";
+var LoginError = class extends Error {
+};
+function sqaiHome() {
+  return process.env.SQAI_HOME ?? join(homedir(), ".sqai");
+}
+var p = (name) => join(sqaiHome(), name);
+var apiKeyPath = () => p("api_key");
+var tokenPath = () => p("token");
+var deviceIdPath = () => p("device_id");
+var accountsUrl = () => (process.env.SQAI_ACCOUNTS_URL ?? DEFAULT_ACCOUNTS_URL).replace(/\/$/, "");
+var apiUrl = () => (process.env.SQAI_API_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
+function readSecret(path) {
+  try {
+    const v = readFileSync(path, "utf8").trim();
+    return v || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readCachedApiKey() {
+  return process.env.SQAI_API_KEY ?? process.env.ALGENTA_API_KEY ?? readSecret(apiKeyPath());
+}
+function cache(path, value) {
+  mkdirSync(sqaiHome(), { recursive: true });
+  writeFileSync(path, value.trim() + "\n", "utf8");
+  try {
+    chmodSync(path, 384);
+  } catch {
+  }
+}
+function deviceId() {
+  const existing = readSecret(deviceIdPath());
+  if (existing) return existing;
+  const value = createHash2("sha256").update(`${hostname()}:${Date.now()}:${Math.random()}`).digest("hex");
+  cache(deviceIdPath(), value);
+  return value;
+}
+async function request(method, url, opts = {}) {
+  const headers = { Accept: "application/json", "User-Agent": "sqai-cli" };
+  if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+  if (opts.bearer) headers["Authorization"] = `Bearer ${opts.bearer}`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+    });
+  } catch (e) {
+    throw new LoginError(`${method} ${url}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  let json = {};
+  try {
+    json = await res.json();
+  } catch {
+    json = {};
+  }
+  return { status: res.status, json };
+}
+async function deviceAuthorize(accounts, openBrowser, maxWaitMs = 3e5) {
+  const { json: start } = await request("POST", `${accounts}/oauth/device/code`, {
+    body: { client_id: CLIENT_ID, scope: SCOPE }
+  });
+  const deviceCode = start.device_code;
+  const userCode = start.user_code;
+  const verify = start.verification_uri_complete || start.verification_uri;
+  const interval = Number(start.interval ?? 5);
+  if (!deviceCode || !userCode || !verify) throw new LoginError("accounts device-code response missing fields");
+  process.stdout.write(`
+  Open ${verify}
+  and enter code:  ${userCode}
+
+`);
+  if (openBrowser) await tryOpenBrowser(verify);
+  const deadline = Date.now() + maxWaitMs;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval * 1e3));
+    const { status, json: tok } = await request("POST", `${accounts}/oauth/device/token`, {
+      body: {
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }
+    });
+    const access = tok.access_token;
+    if (access) return access;
+    const error = tok.error;
+    if (error === "authorization_pending" || error === "slow_down" || status === 400 || status === 428) continue;
+    throw new LoginError(`device authorization failed: ${error ?? `HTTP ${status}`}`);
+  }
+  throw new LoginError("timed out waiting for device authorization");
+}
+async function tryOpenBrowser(url) {
+  try {
+    const { spawn: spawn2 } = await import("child_process");
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    spawn2(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" }).unref();
+  } catch {
+  }
+}
+async function createApiKey(api, accessToken, plan) {
+  const { status, json } = await request("POST", `${api}/v1/products/${PRODUCT}/onboard`, {
+    bearer: accessToken,
+    body: { name: CLIENT_ID, product: PRODUCT, plan }
+  });
+  const key = json.raw_key || json.key || json.api_key;
+  if (status >= 400 || !key) {
+    const detail = json.error && typeof json.error === "object" ? json.error.message : void 0;
+    throw new LoginError(`could not create API key (HTTP ${status})${detail ? `: ${detail}` : ""}`);
+  }
+  return key;
+}
+async function login(opts = {}) {
+  const plan = opts.plan ?? DEFAULT_PLAN;
+  const accounts = accountsUrl();
+  const api = apiUrl();
+  let token = opts.accessToken ?? process.env.SQAI_TOKEN;
+  if (token) {
+    process.stdout.write("using supplied token (headless)\n");
+  } else {
+    process.stdout.write(`authenticating via ${accounts} \u2026
+`);
+    token = await deviceAuthorize(accounts, opts.openBrowser ?? true);
+  }
+  cache(tokenPath(), token);
+  process.stdout.write("creating your free SQAI Developer API key \u2026\n");
+  const apiKey = await createApiKey(api, token, plan);
+  cache(apiKeyPath(), apiKey);
+  deviceId();
+  process.stdout.write(
+    "\n  \u2713 sqai login complete \u2014 the local runtime will provision a device-bound offline license on first use.\n  SQAI runs fully on your machine; no data leaves it.\n\n"
+  );
+  return {
+    device_id: deviceId(),
+    plan,
+    api_key_prefix: apiKey.includes("_") ? `${apiKey.split("_", 1)[0]}_\u2026` : `${apiKey.slice(0, 6)}\u2026`
+  };
+}
+function logout() {
+  for (const path of [tokenPath(), apiKeyPath()]) {
+    try {
+      rmSync(path);
+    } catch {
+    }
+  }
+}
+
 // src/runtime/bundle.ts
 import { spawn } from "child_process";
-import { createHash as createHash2, timingSafeEqual } from "crypto";
+import { createHash as createHash3, timingSafeEqual } from "crypto";
 import { createReadStream, promises as fs } from "fs";
-import { join } from "path";
+import { join as join2 } from "path";
 
 // src/runtime/trust.ts
-import { createPublicKey, verify as cryptoVerify } from "crypto";
+import { createPublicKey as createPublicKey2, verify as cryptoVerify } from "crypto";
 var RELEASE_1_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7m4G1dEMi5FppLa5hu9N
 4pUyoGELPaN5X7bO+9Qktgbv21+c8I4sQCufKouZEVNMNluKNrWcQ5dSwOuVxxS9
@@ -429,7 +587,7 @@ function keyValidNow(key, nowMs) {
 }
 function signatureVerifies(manifestBytes, signature, publicKeyPem) {
   try {
-    const key = createPublicKey(publicKeyPem);
+    const key = createPublicKey2(publicKeyPem);
     if (key.asymmetricKeyType !== "rsa") {
       return false;
     }
@@ -613,7 +771,7 @@ async function hashTarMember(tarball, member, cap) {
     const child = spawn("tar", ["-xOf", tarball, "--", member], {
       stdio: ["ignore", "pipe", "pipe"]
     });
-    const digest = createHash2("sha256");
+    const digest = createHash3("sha256");
     let total = 0;
     let overflow = false;
     child.stdout.on("data", (chunk) => {
@@ -673,7 +831,7 @@ async function extractTarball(tarball, destinationDir) {
 }
 function sha256File(path) {
   return new Promise((resolve, reject) => {
-    const digest = createHash2("sha256");
+    const digest = createHash3("sha256");
     const stream = createReadStream(path);
     stream.on("data", (chunk) => digest.update(chunk));
     stream.on("error", reject);
@@ -833,7 +991,7 @@ async function verifyBundleTarball(tarball, expectations) {
   return manifest;
 }
 async function listFilesRecursively(root, relative = "") {
-  const entries = await fs.readdir(join(root, relative), { withFileTypes: true });
+  const entries = await fs.readdir(join2(root, relative), { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const relPath = relative === "" ? entry.name : `${relative}/${entry.name}`;
@@ -857,8 +1015,8 @@ async function listFilesRecursively(root, relative = "") {
   return files;
 }
 async function verifyInstalledBundleDir(installDir, expectations) {
-  const manifestPath = join(installDir, MANIFEST_NAME);
-  const signaturePath = join(installDir, MANIFEST_SIG_NAME);
+  const manifestPath = join2(installDir, MANIFEST_NAME);
+  const signaturePath = join2(installDir, MANIFEST_SIG_NAME);
   let manifestBytes;
   let signature;
   try {
@@ -898,7 +1056,7 @@ async function verifyInstalledBundleDir(installDir, expectations) {
         `installed file not listed in signed manifest: '${relPath}'`
       );
     }
-    const absolute = join(installDir, relPath);
+    const absolute = join2(installDir, relPath);
     const stat = await fs.lstat(absolute);
     if (stat.nlink > 1) {
       throw new BundleVerificationError(
@@ -963,20 +1121,20 @@ function currentPlatformKey() {
 function cacheDirFor(brand) {
   const os = osPlatform();
   if (os === "darwin") {
-    return join2(homedir(), "Library", "Caches", brand, "runtime");
+    return join3(homedir2(), "Library", "Caches", brand, "runtime");
   }
   if (os === "win32") {
-    const localAppData = process.env.LOCALAPPDATA ?? join2(homedir(), "AppData", "Local");
-    return join2(localAppData, brand, "runtime");
+    const localAppData = process.env.LOCALAPPDATA ?? join3(homedir2(), "AppData", "Local");
+    return join3(localAppData, brand, "runtime");
   }
-  const xdgCache = process.env.XDG_CACHE_HOME ?? join2(homedir(), ".cache");
-  return join2(xdgCache, brand.toLowerCase(), "runtime");
+  const xdgCache = process.env.XDG_CACHE_HOME ?? join3(homedir2(), ".cache");
+  return join3(xdgCache, brand.toLowerCase(), "runtime");
 }
 function runtimeCacheDir() {
   const current = cacheDirFor("SQAI");
-  if (!existsSync(current)) {
+  if (!existsSync2(current)) {
     const legacy = cacheDirFor("Algenta");
-    if (legacy !== current && existsSync(legacy)) {
+    if (legacy !== current && existsSync2(legacy)) {
       return legacy;
     }
   }
@@ -1125,7 +1283,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   localCacheKey(modules, platformKey) {
     const canonical = modules.join(",");
     const version = this.options.contract.runtime_bundle.version;
-    return createHash3("sha256").update(`${canonical}|${platformKey}|${version}`).digest("hex").slice(0, 20);
+    return createHash4("sha256").update(`${canonical}|${platformKey}|${version}`).digest("hex").slice(0, 20);
   }
   /**
    * Deterministic per-filter daemon endpoint so a filtered runtime never collides
@@ -1134,7 +1292,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   filterEndpoint(cacheKey) {
     const seed = parseInt(cacheKey.slice(0, 6), 16) || 0;
     const port = 50100 + seed % 800;
-    return { sock: join2(this.cacheDir(), `${cacheKey}.sock`), tcp: `127.0.0.1:${port}` };
+    return { sock: join3(this.cacheDir(), `${cacheKey}.sock`), tcp: `127.0.0.1:${port}` };
   }
   static DAEMON_ENDPOINT_ENV = [
     "ALGENTA_DAEMON_SOCK",
@@ -1151,7 +1309,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
     process.env.ALGENTA_DAEMON_SOCK = endpoint.sock;
     process.env.ALGENTA_DAEMON_TCP = endpoint.tcp;
     process.env.ALGENTA_MOJO_SOCK = `${endpoint.sock}.worker`;
-    process.env.ALGENTA_RUNTIME_DIR = join2(installDir, ".runtime");
+    process.env.ALGENTA_RUNTIME_DIR = join3(installDir, ".runtime");
     return saved;
   }
   restoreEnv(saved) {
@@ -1266,9 +1424,9 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   }
   /** Verify an existing install if present; returns null when absent/invalid. */
   async verifiedInstallOrNull(platformKey, version, removeOnFailure, installKey = version) {
-    const installDir = join2(this.cacheDir(), installKey);
+    const installDir = join3(this.cacheDir(), installKey);
     try {
-      await fs2.access(join2(installDir, MANIFEST_NAME));
+      await fs2.access(join3(installDir, MANIFEST_NAME));
     } catch {
       return null;
     }
@@ -1325,7 +1483,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
     if (existing) {
       return existing;
     }
-    const lockPath = join2(cacheDir, `${installKey}.lock`);
+    const lockPath = join3(cacheDir, `${installKey}.lock`);
     const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? LOCK_WAIT_TIMEOUT_MS;
     const pollIntervalMs = this.options.lockPollIntervalMs ?? LOCK_POLL_INTERVAL_MS;
     const deadline = Date.now() + waitTimeoutMs;
@@ -1371,9 +1529,9 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   async downloadVerifyExtract(platformKey, version, platformBundle, installKey = version) {
     const cacheDir = this.cacheDir();
     const token = randomBytes2(6).toString("hex");
-    const tarballPath = join2(cacheDir, `tmp-${token}.tgz`);
-    const extractDir = join2(cacheDir, `tmp-${token}`);
-    const installDir = join2(cacheDir, installKey);
+    const tarballPath = join3(cacheDir, `tmp-${token}.tgz`);
+    const extractDir = join3(cacheDir, `tmp-${token}`);
+    const installDir = join3(cacheDir, installKey);
     const url = resolveBundleUrl(platformBundle.url, version, platformKey);
     try {
       const download = this.options.downloadBundle ?? defaultDownloadBundle;
@@ -1448,10 +1606,16 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
       throw this.wrapVerificationError(error, platformKey, version);
     }
     const daemonCommand = [
-      join2(installed.installDir, ...entryRelative.split("/")),
+      join3(installed.installDir, ...entryRelative.split("/")),
       "start",
       "--foreground"
     ];
+    if (!process.env.ALGENTA_API_KEY && !process.env.DE_API_KEY) {
+      const key = await readCachedApiKey();
+      if (key) {
+        process.env.ALGENTA_API_KEY = key;
+      }
+    }
     const managed = this.newRuntime(
       endpoint ? { autoStart: true, daemonCommand, tcpAddress: endpoint.tcp } : { autoStart: true, daemonCommand }
     );
@@ -1486,7 +1650,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
     }
     try {
       await fs2.writeFile(
-        join2(this.cacheDir(), "state.json"),
+        join3(this.cacheDir(), "state.json"),
         JSON.stringify(
           { pid: null, version, started_at: (/* @__PURE__ */ new Date()).toISOString() },
           null,
@@ -2051,6 +2215,7 @@ function mapSource(registration) {
 }
 export {
   ContractIndex,
+  LoginError,
   ResultStore,
   RuntimeProvisioner,
   SQAI,
@@ -2061,8 +2226,12 @@ export {
   currentPlatformKey,
   invocationHash,
   isReadOnlyEligible,
+  login,
+  logout,
   lookupCapability,
+  readCachedApiKey,
   runtimeCacheDir,
+  sqaiHome,
   validateComputation
 };
 //# sourceMappingURL=index.js.map