@thyn-ai/sqai 0.1.4 → 0.1.6

package/dist/index.cjs

@@ -1,7 +1,9 @@
 "use strict";
+var __create = Object.create;
 var __defProp = Object.defineProperty;
 var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
 var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
 var __hasOwnProp = Object.prototype.hasOwnProperty;
 var __export = (target, all) => {
   for (var name in all)
@@ -15,15 +17,26 @@ var __copyProps = (to, from, except, desc) => {
   }
   return to;
 };
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
 var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
 
 // src/index.ts
 var index_exports = {};
 __export(index_exports, {
   ContractIndex: () => ContractIndex,
+  LoginError: () => LoginError,
   ResultStore: () => ResultStore,
   RuntimeProvisioner: () => RuntimeProvisioner,
   SQAI: () => SQAI,
+  SQAI_CONNECTOR_TYPES: () => SQAI_CONNECTOR_TYPES,
+  SQAI_CONNECTOR_TYPE_ALIASES: () => SQAI_CONNECTOR_TYPE_ALIASES,
   SQAI_ERROR_CODES: () => SQAI_ERROR_CODES,
   SqaiError: () => SqaiError,
   computationHash: () => computationHash,
@@ -31,15 +44,19 @@ __export(index_exports, {
   currentPlatformKey: () => currentPlatformKey,
   invocationHash: () => invocationHash,
   isReadOnlyEligible: () => isReadOnlyEligible,
+  login: () => login,
+  logout: () => logout,
   lookupCapability: () => lookupCapability,
+  readCachedApiKey: () => readCachedApiKey,
   runtimeCacheDir: () => runtimeCacheDir,
+  sqaiHome: () => sqaiHome,
   validateComputation: () => validateComputation
 });
 module.exports = __toCommonJS(index_exports);
 
 // src/sqai.ts
-var import_node_crypto6 = require("crypto");
-var import_node_os2 = require("os");
+var import_node_crypto7 = require("crypto");
+var import_node_os3 = require("os");
 var import_algenta_sdk3 = require("algenta-sdk");
 
 // src/contract-data.json
@@ -151,13 +168,13 @@ var SQAI_ERROR_CODES = [
   "contract_mismatch",
   "invalid_intent"
 ];
-var RETRYABLE_ALGENTA_CODES = /* @__PURE__ */ new Set([
+var RETRYABLE_ENGINE_CODES = /* @__PURE__ */ new Set([
   "network_error",
   "timeout",
   "rate_limited",
   "service_unavailable"
 ]);
-function fromAlgentaError(error) {
+function fromEngineError(error) {
   if (error instanceof SqaiError) {
     return error;
   }
@@ -167,7 +184,7 @@ function fromAlgentaError(error) {
   const details = errorLike.details && typeof errorLike.details === "object" ? errorLike.details : {};
   return new SqaiError(code, message, {
     source: "engine",
-    retryable: RETRYABLE_ALGENTA_CODES.has(code),
+    retryable: RETRYABLE_ENGINE_CODES.has(code),
     details
   });
 }
@@ -176,12 +193,14 @@ function fromAlgentaError(error) {
 var DEFAULT_BUILD_SERVICE_URL = "https://sqai-buildservice.fly.dev";
 function readEnv(env = process.env) {
   const apiKey = (env.SQAI_API_KEY ?? "").trim() || void 0;
-  const engineUrl = (env.SQAI_ENGINE_URL ?? "").trim() || void 0;
+  const deploymentUrl = (env.SQAI_DEPLOYMENT_URL ?? "").trim() || void 0;
+  const legacyEngineUrl = (env.SQAI_ENGINE_URL ?? "").trim() || void 0;
+  const engineUrl = deploymentUrl ?? legacyEngineUrl;
   const autoInstall = (env.SQAI_RUNTIME_AUTO_INSTALL ?? "").trim() !== "0";
   const modulesRaw = (env.SQAI_RUNTIME_MODULES ?? "").split(",").map((m) => m.trim()).filter((m) => m.length > 0);
   const runtimeModules = modulesRaw.length > 0 ? modulesRaw : void 0;
   const buildServiceUrl = (env.SQAI_BUILD_SERVICE_URL ?? "").trim() || DEFAULT_BUILD_SERVICE_URL;
-  return { apiKey, engineUrl, autoInstall, runtimeModules, buildServiceUrl };
+  return { apiKey, engineUrl, deploymentUrl, autoInstall, runtimeModules, buildServiceUrl };
 }
 function inferMode(explicit, resolved) {
   if (explicit) {
@@ -190,9 +209,6 @@ function inferMode(explicit, resolved) {
   if (resolved.engineUrl) {
     return "self_hosted";
   }
-  if (resolved.apiKey) {
-    return "api";
-  }
   return "local";
 }
 
@@ -354,22 +370,180 @@ var ResultStore = class {
 };
 
 // src/runtime/provision.ts
-var import_node_os = require("os");
-var import_node_path2 = require("path");
-var import_node_fs2 = require("fs");
-var import_node_crypto5 = require("crypto");
+var import_node_os2 = require("os");
+var import_node_path3 = require("path");
+var import_node_fs3 = require("fs");
+var import_node_crypto6 = require("crypto");
 var import_node_stream = require("stream");
 var import_promises = require("stream/promises");
 var import_algenta_sdk2 = require("algenta-sdk");
 
-// src/runtime/bundle.ts
-var import_node_child_process = require("child_process");
-var import_node_crypto4 = require("crypto");
+// src/runtime/auth.ts
+var import_node_crypto3 = require("crypto");
 var import_node_fs = require("fs");
+var import_node_os = require("os");
 var import_node_path = require("path");
+var CLIENT_ID = "sqai-cli";
+var SCOPE = "sqai";
+var PRODUCT = "sqai";
+var DEFAULT_PLAN = "sqai_developer";
+var DEFAULT_ACCOUNTS_URL = "https://accounts.thyn.ai";
+var DEFAULT_API_URL = "https://api.sqai.com";
+var LoginError = class extends Error {
+};
+function sqaiHome() {
+  return process.env.SQAI_HOME ?? (0, import_node_path.join)((0, import_node_os.homedir)(), ".sqai");
+}
+var p = (name) => (0, import_node_path.join)(sqaiHome(), name);
+var apiKeyPath = () => p("api_key");
+var tokenPath = () => p("token");
+var deviceIdPath = () => p("device_id");
+var accountsUrl = () => (process.env.SQAI_ACCOUNTS_URL ?? DEFAULT_ACCOUNTS_URL).replace(/\/$/, "");
+var apiUrl = () => (process.env.SQAI_API_URL ?? DEFAULT_API_URL).replace(/\/$/, "");
+function readSecret(path) {
+  try {
+    const v = (0, import_node_fs.readFileSync)(path, "utf8").trim();
+    return v || void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function readCachedApiKey() {
+  return process.env.SQAI_API_KEY ?? process.env.ALGENTA_API_KEY ?? readSecret(apiKeyPath());
+}
+function cache(path, value) {
+  (0, import_node_fs.mkdirSync)(sqaiHome(), { recursive: true });
+  (0, import_node_fs.writeFileSync)(path, value.trim() + "\n", "utf8");
+  try {
+    (0, import_node_fs.chmodSync)(path, 384);
+  } catch {
+  }
+}
+function deviceId() {
+  const existing = readSecret(deviceIdPath());
+  if (existing) return existing;
+  const value = (0, import_node_crypto3.createHash)("sha256").update(`${(0, import_node_os.hostname)()}:${Date.now()}:${Math.random()}`).digest("hex");
+  cache(deviceIdPath(), value);
+  return value;
+}
+async function request(method, url, opts = {}) {
+  const headers = { Accept: "application/json", "User-Agent": "sqai-cli" };
+  if (opts.body !== void 0) headers["Content-Type"] = "application/json";
+  if (opts.bearer) headers["Authorization"] = `Bearer ${opts.bearer}`;
+  let res;
+  try {
+    res = await fetch(url, {
+      method,
+      headers,
+      body: opts.body !== void 0 ? JSON.stringify(opts.body) : void 0
+    });
+  } catch (e) {
+    throw new LoginError(`${method} ${url}: ${e instanceof Error ? e.message : String(e)}`);
+  }
+  let json = {};
+  try {
+    json = await res.json();
+  } catch {
+    json = {};
+  }
+  return { status: res.status, json };
+}
+async function deviceAuthorize(accounts, openBrowser, maxWaitMs = 3e5) {
+  const { json: start } = await request("POST", `${accounts}/oauth/device/code`, {
+    body: { client_id: CLIENT_ID, scope: SCOPE }
+  });
+  const deviceCode = start.device_code;
+  const userCode = start.user_code;
+  const verify = start.verification_uri_complete || start.verification_uri;
+  const interval = Number(start.interval ?? 5);
+  if (!deviceCode || !userCode || !verify) throw new LoginError("accounts device-code response missing fields");
+  process.stdout.write(`
+  Open ${verify}
+  and enter code:  ${userCode}
+
+`);
+  if (openBrowser) await tryOpenBrowser(verify);
+  const deadline = Date.now() + maxWaitMs;
+  while (Date.now() < deadline) {
+    await new Promise((r) => setTimeout(r, interval * 1e3));
+    const { status, json: tok } = await request("POST", `${accounts}/oauth/device/token`, {
+      body: {
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: "urn:ietf:params:oauth:grant-type:device_code"
+      }
+    });
+    const access = tok.access_token;
+    if (access) return access;
+    const error = tok.error;
+    if (error === "authorization_pending" || error === "slow_down" || status === 400 || status === 428) continue;
+    throw new LoginError(`device authorization failed: ${error ?? `HTTP ${status}`}`);
+  }
+  throw new LoginError("timed out waiting for device authorization");
+}
+async function tryOpenBrowser(url) {
+  try {
+    const { spawn: spawn2 } = await import("child_process");
+    const cmd = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open";
+    spawn2(cmd, [url], { stdio: "ignore", detached: true, shell: process.platform === "win32" }).unref();
+  } catch {
+  }
+}
+async function createApiKey(api, accessToken, plan) {
+  const { status, json } = await request("POST", `${api}/v1/products/${PRODUCT}/onboard`, {
+    bearer: accessToken,
+    body: { name: CLIENT_ID, product: PRODUCT, plan }
+  });
+  const key = json.raw_key || json.key || json.api_key;
+  if (status >= 400 || !key) {
+    const detail = json.error && typeof json.error === "object" ? json.error.message : void 0;
+    throw new LoginError(`could not create API key (HTTP ${status})${detail ? `: ${detail}` : ""}`);
+  }
+  return key;
+}
+async function login(opts = {}) {
+  const plan = opts.plan ?? DEFAULT_PLAN;
+  const accounts = accountsUrl();
+  const api = apiUrl();
+  let token = opts.accessToken ?? process.env.SQAI_TOKEN;
+  if (token) {
+    process.stdout.write("using supplied token (headless)\n");
+  } else {
+    process.stdout.write(`authenticating via ${accounts} \u2026
+`);
+    token = await deviceAuthorize(accounts, opts.openBrowser ?? true);
+  }
+  cache(tokenPath(), token);
+  process.stdout.write("creating your free SQAI Developer API key \u2026\n");
+  const apiKey = await createApiKey(api, token, plan);
+  cache(apiKeyPath(), apiKey);
+  deviceId();
+  process.stdout.write(
+    "\n  \u2713 sqai login complete \u2014 the local runtime will provision a device-bound offline license on first use.\n  SQAI runs fully on your machine; no data leaves it.\n\n"
+  );
+  return {
+    device_id: deviceId(),
+    plan,
+    api_key_prefix: apiKey.includes("_") ? `${apiKey.split("_", 1)[0]}_\u2026` : `${apiKey.slice(0, 6)}\u2026`
+  };
+}
+function logout() {
+  for (const path of [tokenPath(), apiKeyPath()]) {
+    try {
+      (0, import_node_fs.rmSync)(path);
+    } catch {
+    }
+  }
+}
+
+// src/runtime/bundle.ts
+var import_node_child_process = require("child_process");
+var import_node_crypto5 = require("crypto");
+var import_node_fs2 = require("fs");
+var import_node_path2 = require("path");
 
 // src/runtime/trust.ts
-var import_node_crypto3 = require("crypto");
+var import_node_crypto4 = require("crypto");
 var RELEASE_1_PUBLIC_KEY_PEM = `-----BEGIN PUBLIC KEY-----
 MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA7m4G1dEMi5FppLa5hu9N
 4pUyoGELPaN5X7bO+9Qktgbv21+c8I4sQCufKouZEVNMNluKNrWcQ5dSwOuVxxS9
@@ -468,11 +642,11 @@ function keyValidNow(key, nowMs) {
 }
 function signatureVerifies(manifestBytes, signature, publicKeyPem) {
   try {
-    const key = (0, import_node_crypto3.createPublicKey)(publicKeyPem);
+    const key = (0, import_node_crypto4.createPublicKey)(publicKeyPem);
     if (key.asymmetricKeyType !== "rsa") {
       return false;
     }
-    return (0, import_node_crypto3.verify)("sha256", manifestBytes, key, signature);
+    return (0, import_node_crypto4.verify)("sha256", manifestBytes, key, signature);
   } catch {
     return false;
   }
@@ -652,7 +826,7 @@ async function hashTarMember(tarball, member, cap) {
     const child = (0, import_node_child_process.spawn)("tar", ["-xOf", tarball, "--", member], {
       stdio: ["ignore", "pipe", "pipe"]
     });
-    const digest = (0, import_node_crypto4.createHash)("sha256");
+    const digest = (0, import_node_crypto5.createHash)("sha256");
     let total = 0;
     let overflow = false;
     child.stdout.on("data", (chunk) => {
@@ -686,7 +860,7 @@ async function hashTarMember(tarball, member, cap) {
   });
 }
 async function extractTarball(tarball, destinationDir) {
-  await import_node_fs.promises.mkdir(destinationDir, { recursive: true });
+  await import_node_fs2.promises.mkdir(destinationDir, { recursive: true });
   await new Promise((resolve, reject) => {
     const child = (0, import_node_child_process.spawn)("tar", ["-xf", tarball, "-C", destinationDir], {
       stdio: ["ignore", "ignore", "pipe"]
@@ -712,8 +886,8 @@ async function extractTarball(tarball, destinationDir) {
 }
 function sha256File(path) {
   return new Promise((resolve, reject) => {
-    const digest = (0, import_node_crypto4.createHash)("sha256");
-    const stream = (0, import_node_fs.createReadStream)(path);
+    const digest = (0, import_node_crypto5.createHash)("sha256");
+    const stream = (0, import_node_fs2.createReadStream)(path);
     stream.on("data", (chunk) => digest.update(chunk));
     stream.on("error", reject);
     stream.on("end", () => resolve(digest.digest("hex")));
@@ -722,7 +896,10 @@ function sha256File(path) {
 function digestsEqual(actualHex, expectedHex) {
   const actual = Buffer.from(actualHex.toLowerCase(), "utf-8");
   const expected = Buffer.from(expectedHex.toLowerCase(), "utf-8");
-  return actual.length === expected.length && (0, import_node_crypto4.timingSafeEqual)(actual, expected);
+  return actual.length === expected.length && (0, import_node_crypto5.timingSafeEqual)(actual, expected);
+}
+function isGeneratedBytecodeCache(path) {
+  return path.split("/").includes("__pycache__") && path.endsWith(".pyc") && isSafeRelativePath(path);
 }
 function parseVerifiedManifest(manifestBytes) {
   let manifest;
@@ -872,7 +1049,7 @@ async function verifyBundleTarball(tarball, expectations) {
   return manifest;
 }
 async function listFilesRecursively(root, relative = "") {
-  const entries = await import_node_fs.promises.readdir((0, import_node_path.join)(root, relative), { withFileTypes: true });
+  const entries = await import_node_fs2.promises.readdir((0, import_node_path2.join)(root, relative), { withFileTypes: true });
   const files = [];
   for (const entry of entries) {
     const relPath = relative === "" ? entry.name : `${relative}/${entry.name}`;
@@ -896,21 +1073,21 @@ async function listFilesRecursively(root, relative = "") {
   return files;
 }
 async function verifyInstalledBundleDir(installDir, expectations) {
-  const manifestPath = (0, import_node_path.join)(installDir, MANIFEST_NAME);
-  const signaturePath = (0, import_node_path.join)(installDir, MANIFEST_SIG_NAME);
+  const manifestPath = (0, import_node_path2.join)(installDir, MANIFEST_NAME);
+  const signaturePath = (0, import_node_path2.join)(installDir, MANIFEST_SIG_NAME);
   let manifestBytes;
   let signature;
   try {
-    const manifestStat = await import_node_fs.promises.lstat(manifestPath);
-    const signatureStat = await import_node_fs.promises.lstat(signaturePath);
+    const manifestStat = await import_node_fs2.promises.lstat(manifestPath);
+    const signatureStat = await import_node_fs2.promises.lstat(signaturePath);
     if (!manifestStat.isFile() || !signatureStat.isFile() || manifestStat.size > MAX_MANIFEST_BYTES || signatureStat.size > MAX_SIG_BYTES) {
       throw new BundleVerificationError(
         "member_unreadable",
         "installed bundle manifest/signature is not a capped regular file"
       );
     }
-    manifestBytes = await import_node_fs.promises.readFile(manifestPath);
-    signature = await import_node_fs.promises.readFile(signaturePath);
+    manifestBytes = await import_node_fs2.promises.readFile(manifestPath);
+    signature = await import_node_fs2.promises.readFile(signaturePath);
   } catch (error) {
     if (error instanceof BundleVerificationError) {
       throw error;
@@ -932,13 +1109,16 @@ async function verifyInstalledBundleDir(installDir, expectations) {
     }
     const entry = byPath.get(relPath);
     if (entry === void 0) {
+      if (isGeneratedBytecodeCache(relPath)) {
+        continue;
+      }
       throw new BundleVerificationError(
         "unlisted_member",
         `installed file not listed in signed manifest: '${relPath}'`
       );
     }
-    const absolute = (0, import_node_path.join)(installDir, relPath);
-    const stat = await import_node_fs.promises.lstat(absolute);
+    const absolute = (0, import_node_path2.join)(installDir, relPath);
+    const stat = await import_node_fs2.promises.lstat(absolute);
     if (stat.nlink > 1) {
       throw new BundleVerificationError(
         "unsafe_member",
@@ -994,28 +1174,28 @@ var LOCK_FRESH_MS = 10 * 60 * 1e3;
 var LOCK_WAIT_TIMEOUT_MS = 90 * 1e3;
 var LOCK_POLL_INTERVAL_MS = 1e3;
 function currentPlatformKey() {
-  const os = (0, import_node_os.platform)();
-  const arch = (0, import_node_os.arch)();
+  const os = (0, import_node_os2.platform)();
+  const arch = (0, import_node_os2.arch)();
   const osName = os === "darwin" ? "darwin" : os === "linux" ? "linux" : os;
   return `${osName}-${arch}`;
 }
 function cacheDirFor(brand) {
-  const os = (0, import_node_os.platform)();
+  const os = (0, import_node_os2.platform)();
   if (os === "darwin") {
-    return (0, import_node_path2.join)((0, import_node_os.homedir)(), "Library", "Caches", brand, "runtime");
+    return (0, import_node_path3.join)((0, import_node_os2.homedir)(), "Library", "Caches", brand, "runtime");
   }
   if (os === "win32") {
-    const localAppData = process.env.LOCALAPPDATA ?? (0, import_node_path2.join)((0, import_node_os.homedir)(), "AppData", "Local");
-    return (0, import_node_path2.join)(localAppData, brand, "runtime");
+    const localAppData = process.env.LOCALAPPDATA ?? (0, import_node_path3.join)((0, import_node_os2.homedir)(), "AppData", "Local");
+    return (0, import_node_path3.join)(localAppData, brand, "runtime");
   }
-  const xdgCache = process.env.XDG_CACHE_HOME ?? (0, import_node_path2.join)((0, import_node_os.homedir)(), ".cache");
-  return (0, import_node_path2.join)(xdgCache, brand.toLowerCase(), "runtime");
+  const xdgCache = process.env.XDG_CACHE_HOME ?? (0, import_node_path3.join)((0, import_node_os2.homedir)(), ".cache");
+  return (0, import_node_path3.join)(xdgCache, brand.toLowerCase(), "runtime");
 }
 function runtimeCacheDir() {
   const current = cacheDirFor("SQAI");
-  if (!(0, import_node_fs2.existsSync)(current)) {
+  if (!(0, import_node_fs3.existsSync)(current)) {
     const legacy = cacheDirFor("Algenta");
-    if (legacy !== current && (0, import_node_fs2.existsSync)(legacy)) {
+    if (legacy !== current && (0, import_node_fs3.existsSync)(legacy)) {
       return legacy;
     }
   }
@@ -1034,12 +1214,12 @@ async function defaultDownloadBundle(url, destination) {
   }
   await (0, import_promises.pipeline)(
     import_node_stream.Readable.fromWeb(response.body),
-    (0, import_node_fs2.createWriteStream)(destination)
+    (0, import_node_fs3.createWriteStream)(destination)
   );
 }
 async function removeQuietly(path) {
   try {
-    await import_node_fs2.promises.rm(path, { recursive: true, force: true });
+    await import_node_fs3.promises.rm(path, { recursive: true, force: true });
   } catch {
   }
 }
@@ -1100,6 +1280,21 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
     }
     return new import_algenta_sdk2.MojoRuntime(config ?? {});
   }
+  async ensureLocalLoginKey() {
+    if (this.options.runtimeFactory || process.env.ALGENTA_API_KEY || process.env.DE_API_KEY) {
+      return;
+    }
+    const key = await readCachedApiKey();
+    if (key) {
+      process.env.ALGENTA_API_KEY = key;
+      return;
+    }
+    throw new SqaiError(
+      "login_required",
+      "Local compute requires a free SQAI device login. Run `sqai login` once, or set SQAI_API_KEY in this process.",
+      { details: { reason: "login_key_missing" } }
+    );
+  }
   cacheDir() {
     return this.options.cacheDir ?? runtimeCacheDir();
   }
@@ -1164,7 +1359,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   localCacheKey(modules, platformKey) {
     const canonical = modules.join(",");
     const version = this.options.contract.runtime_bundle.version;
-    return (0, import_node_crypto5.createHash)("sha256").update(`${canonical}|${platformKey}|${version}`).digest("hex").slice(0, 20);
+    return (0, import_node_crypto6.createHash)("sha256").update(`${canonical}|${platformKey}|${version}`).digest("hex").slice(0, 20);
   }
   /**
    * Deterministic per-filter daemon endpoint so a filtered runtime never collides
@@ -1173,7 +1368,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   filterEndpoint(cacheKey) {
     const seed = parseInt(cacheKey.slice(0, 6), 16) || 0;
     const port = 50100 + seed % 800;
-    return { sock: (0, import_node_path2.join)(this.cacheDir(), `${cacheKey}.sock`), tcp: `127.0.0.1:${port}` };
+    return { sock: (0, import_node_path3.join)(this.cacheDir(), `${cacheKey}.sock`), tcp: `127.0.0.1:${port}` };
   }
   static DAEMON_ENDPOINT_ENV = [
     "ALGENTA_DAEMON_SOCK",
@@ -1190,7 +1385,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
     process.env.ALGENTA_DAEMON_SOCK = endpoint.sock;
     process.env.ALGENTA_DAEMON_TCP = endpoint.tcp;
     process.env.ALGENTA_MOJO_SOCK = `${endpoint.sock}.worker`;
-    process.env.ALGENTA_RUNTIME_DIR = (0, import_node_path2.join)(installDir, ".runtime");
+    process.env.ALGENTA_RUNTIME_DIR = (0, import_node_path3.join)(installDir, ".runtime");
     return saved;
   }
   restoreEnv(saved) {
@@ -1205,6 +1400,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   async doEnsure() {
     const platformKey = currentPlatformKey();
     const filter = this.filterModules();
+    await this.ensureLocalLoginKey();
     const probeEndpoint = filter ? this.filterEndpoint(this.localCacheKey(filter, platformKey)) : void 0;
     const runtime = this.newRuntime(probeEndpoint ? { tcpAddress: probeEndpoint.tcp } : void 0);
     try {
@@ -1232,7 +1428,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
         const supported = Object.keys(bundle.platforms);
         throw new SqaiError(
           "unsupported_platform",
-          supported.length === 0 ? "No managed runtime bundle is published yet for any platform. Start a local Algenta runtime daemon, or set SQAI_ENGINE_URL / SQAI_API_KEY to use a hosted engine." : `No managed runtime bundle is published for '${platformKey}'.`,
+          supported.length === 0 ? "No managed runtime bundle is published yet for any platform. Run `sqai login`, or set SQAI_DEPLOYMENT_URL / SQAI_API_KEY for a managed SQAI deployment." : `No managed runtime bundle is published for '${platformKey}'.`,
           { details: { platform: platformKey, supported } }
         );
       }
@@ -1305,9 +1501,9 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   }
   /** Verify an existing install if present; returns null when absent/invalid. */
   async verifiedInstallOrNull(platformKey, version, removeOnFailure, installKey = version) {
-    const installDir = (0, import_node_path2.join)(this.cacheDir(), installKey);
+    const installDir = (0, import_node_path3.join)(this.cacheDir(), installKey);
     try {
-      await import_node_fs2.promises.access((0, import_node_path2.join)(installDir, MANIFEST_NAME));
+      await import_node_fs3.promises.access((0, import_node_path3.join)(installDir, MANIFEST_NAME));
     } catch {
       return null;
     }
@@ -1327,7 +1523,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   async acquireLock(lockPath) {
     const payload = JSON.stringify({ pid: process.pid, created_at: (/* @__PURE__ */ new Date()).toISOString() });
     try {
-      const handle = await import_node_fs2.promises.open(lockPath, "wx");
+      const handle = await import_node_fs3.promises.open(lockPath, "wx");
       try {
         await handle.writeFile(payload, "utf-8");
       } finally {
@@ -1340,12 +1536,22 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   }
   async lockIsStale(lockPath) {
     const freshMs = this.options.lockFreshMs ?? LOCK_FRESH_MS;
+    const ageFromMtime = async () => {
+      try {
+        const stat = await import_node_fs3.promises.stat(lockPath);
+        return Date.now() - stat.mtimeMs;
+      } catch (error) {
+        const code = error.code;
+        return code === "ENOENT" ? null : Number.POSITIVE_INFINITY;
+      }
+    };
     try {
-      const raw = await import_node_fs2.promises.readFile(lockPath, "utf-8");
+      const raw = await import_node_fs3.promises.readFile(lockPath, "utf-8");
       const parsed = JSON.parse(raw);
       const createdAt = typeof parsed.created_at === "string" ? Date.parse(parsed.created_at) : NaN;
       if (!Number.isFinite(createdAt)) {
-        return true;
+        const age = await ageFromMtime();
+        return age !== null && age >= freshMs;
       }
       return Date.now() - createdAt >= freshMs;
     } catch (error) {
@@ -1353,18 +1559,19 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
       if (code === "ENOENT") {
         return false;
       }
-      return true;
+      const age = await ageFromMtime();
+      return age !== null && age >= freshMs;
     }
   }
   /** Serialize installers on `<cacheDir>/<installKey>.lock`; returns the verified install. */
   async ensureInstalled(platformKey, version, platformBundle, installKey = version) {
     const cacheDir = this.cacheDir();
-    await import_node_fs2.promises.mkdir(cacheDir, { recursive: true });
+    await import_node_fs3.promises.mkdir(cacheDir, { recursive: true });
     const existing = await this.verifiedInstallOrNull(platformKey, version, true, installKey);
     if (existing) {
       return existing;
     }
-    const lockPath = (0, import_node_path2.join)(cacheDir, `${installKey}.lock`);
+    const lockPath = (0, import_node_path3.join)(cacheDir, `${installKey}.lock`);
     const waitTimeoutMs = this.options.lockWaitTimeoutMs ?? LOCK_WAIT_TIMEOUT_MS;
     const pollIntervalMs = this.options.lockPollIntervalMs ?? LOCK_POLL_INTERVAL_MS;
     const deadline = Date.now() + waitTimeoutMs;
@@ -1409,10 +1616,10 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
   /** Holder-of-the-lock path: download → verify → extract → atomic rename. */
   async downloadVerifyExtract(platformKey, version, platformBundle, installKey = version) {
     const cacheDir = this.cacheDir();
-    const token = (0, import_node_crypto5.randomBytes)(6).toString("hex");
-    const tarballPath = (0, import_node_path2.join)(cacheDir, `tmp-${token}.tgz`);
-    const extractDir = (0, import_node_path2.join)(cacheDir, `tmp-${token}`);
-    const installDir = (0, import_node_path2.join)(cacheDir, installKey);
+    const token = (0, import_node_crypto6.randomBytes)(6).toString("hex");
+    const tarballPath = (0, import_node_path3.join)(cacheDir, `tmp-${token}.tgz`);
+    const extractDir = (0, import_node_path3.join)(cacheDir, `tmp-${token}`);
+    const installDir = (0, import_node_path3.join)(cacheDir, installKey);
     const url = resolveBundleUrl(platformBundle.url, version, platformKey);
     try {
       const download = this.options.downloadBundle ?? defaultDownloadBundle;
@@ -1457,7 +1664,7 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
         throw this.wrapVerificationError(error, platformKey, version);
       }
       try {
-        await import_node_fs2.promises.rename(extractDir, installDir);
+        await import_node_fs3.promises.rename(extractDir, installDir);
       } catch (error) {
         const raced = await this.verifiedInstallOrNull(platformKey, version, false, installKey);
         if (raced) {
@@ -1487,10 +1694,11 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
       throw this.wrapVerificationError(error, platformKey, version);
     }
     const daemonCommand = [
-      (0, import_node_path2.join)(installed.installDir, ...entryRelative.split("/")),
+      (0, import_node_path3.join)(installed.installDir, ...entryRelative.split("/")),
       "start",
       "--foreground"
     ];
+    await this.ensureLocalLoginKey();
     const managed = this.newRuntime(
       endpoint ? { autoStart: true, daemonCommand, tcpAddress: endpoint.tcp } : { autoStart: true, daemonCommand }
     );
@@ -1524,8 +1732,8 @@ var RuntimeProvisioner = class _RuntimeProvisioner {
       }
     }
     try {
-      await import_node_fs2.promises.writeFile(
-        (0, import_node_path2.join)(this.cacheDir(), "state.json"),
+      await import_node_fs3.promises.writeFile(
+        (0, import_node_path3.join)(this.cacheDir(), "state.json"),
         JSON.stringify(
           { pid: null, version, started_at: (/* @__PURE__ */ new Date()).toISOString() },
           null,
@@ -1559,7 +1767,7 @@ async function dispatchComputation(target, entry, argsVector, seed, requestId, t
         request_id: response.request_id ?? requestId
       };
     } catch (error) {
-      throw fromAlgentaError(error);
+      throw fromEngineError(error);
     }
   }
   return dispatchHttp(target, module2, functionName, args, requestId);
@@ -1596,7 +1804,7 @@ async function dispatchHttp(target, module2, functionName, args, requestId) {
   } catch (error) {
     throw new SqaiError(
       "compute_runtime_unavailable",
-      `The hosted compute endpoint is unreachable: ${error.message}. Check SQAI_ENGINE_URL / SQAI_API_KEY.`,
+      `The SQAI deployment endpoint is unreachable: ${error.message}. Check SQAI_DEPLOYMENT_URL / SQAI_API_KEY.`,
       { retryable: true }
     );
   }
@@ -1779,7 +1987,7 @@ var SQAI = class {
     const env = readEnv();
     this.mode = inferMode(config.mode, env);
     this.apiKey = config.apiKey ?? env.apiKey;
-    this.engineUrl = config.engineUrl ?? env.engineUrl;
+    this.engineUrl = config.deploymentUrl ?? config.engineUrl ?? env.engineUrl;
     this.tenantId = config.tenantId ?? null;
     this.policy = config.policy;
     this.configuredTarget = config.computeTarget;
@@ -1807,7 +2015,7 @@ var SQAI = class {
     this.algentaRuntime = this.rawRuntime;
   }
   // ── Query plane ────────────────────────────────────────────────────────────
-  async connect(source, options = {}) {
+  async connect(source = null, options = {}) {
     try {
       const registration = await this.algentaRuntime.connect(source, options);
       const mapped = mapSource(registration);
@@ -1826,7 +2034,84 @@ var SQAI = class {
       this.sources.set(mapped.name, mapped);
       return mapped;
     } catch (error) {
-      throw error instanceof SqaiError ? error : fromAlgentaError(error);
+      throw error instanceof SqaiError ? error : fromEngineError(error);
+    }
+  }
+  async createConnector(request2) {
+    const createConnector = this.algentaRuntime.createConnector;
+    if (typeof createConnector !== "function") {
+      throw unsupportedSubstrateOperation("createConnector");
+    }
+    try {
+      return await createConnector.call(this.algentaRuntime, request2);
+    } catch (error) {
+      throw fromEngineError(error);
+    }
+  }
+  async listConnectors(options = {}) {
+    const listConnectors = this.algentaRuntime.listConnectors;
+    if (typeof listConnectors !== "function") {
+      throw unsupportedSubstrateOperation("listConnectors");
+    }
+    try {
+      return await listConnectors.call(this.algentaRuntime, options);
+    } catch (error) {
+      throw fromEngineError(error);
+    }
+  }
+  async getConnector(connectorId) {
+    const getConnector = this.algentaRuntime.getConnector;
+    if (typeof getConnector !== "function") {
+      throw unsupportedSubstrateOperation("getConnector");
+    }
+    try {
+      return await getConnector.call(this.algentaRuntime, connectorId);
+    } catch (error) {
+      throw fromEngineError(error);
+    }
+  }
+  async updateConnector(connectorId, request2) {
+    const updateConnector = this.algentaRuntime.updateConnector;
+    if (typeof updateConnector !== "function") {
+      throw unsupportedSubstrateOperation("updateConnector");
+    }
+    try {
+      return await updateConnector.call(this.algentaRuntime, connectorId, request2);
+    } catch (error) {
+      throw fromEngineError(error);
+    }
+  }
+  async testConnector(connectorIdOrConnector) {
+    const testConnector = this.algentaRuntime.testConnector;
+    if (typeof testConnector !== "function") {
+      throw unsupportedSubstrateOperation("testConnector");
+    }
+    try {
+      return await testConnector.call(this.algentaRuntime, connectorIdOrConnector);
+    } catch (error) {
+      throw fromEngineError(error);
+    }
+  }
+  async browseConnector(connectorIdOrConnector) {
+    const browseConnector = this.algentaRuntime.browseConnector;
+    if (typeof browseConnector !== "function") {
+      throw unsupportedSubstrateOperation("browseConnector");
+    }
+    try {
+      return await browseConnector.call(this.algentaRuntime, connectorIdOrConnector);
+    } catch (error) {
+      throw fromEngineError(error);
+    }
+  }
+  async deleteConnector(connectorId) {
+    const deleteConnector = this.algentaRuntime.deleteConnector;
+    if (typeof deleteConnector !== "function") {
+      throw unsupportedSubstrateOperation("deleteConnector");
+    }
+    try {
+      await deleteConnector.call(this.algentaRuntime, connectorId);
+    } catch (error) {
+      throw fromEngineError(error);
     }
   }
   listSources() {
@@ -1837,28 +2122,28 @@ var SQAI = class {
     try {
       return await this.algentaRuntime.resolve(spec);
     } catch (error) {
-      throw fromAlgentaError(error);
+      throw fromEngineError(error);
     }
   }
   async query(plan) {
     try {
       return await this.algentaRuntime.query(plan);
     } catch (error) {
-      throw fromAlgentaError(error);
+      throw fromEngineError(error);
     }
   }
   async queryWithMetadata(plan) {
     try {
       return await this.algentaRuntime.queryWithMetadata(plan);
     } catch (error) {
-      throw fromAlgentaError(error);
+      throw fromEngineError(error);
     }
   }
   async verify(plan) {
     try {
       return await this.algentaRuntime.verify(plan);
     } catch (error) {
-      throw fromAlgentaError(error);
+      throw fromEngineError(error);
     }
   }
   async ask(spec) {
@@ -1880,21 +2165,21 @@ var SQAI = class {
     if (typeof this.algentaRuntime.extractColumns !== "function") {
       throw new SqaiError(
         "unsupported_operation",
-        "The installed algenta-sdk build does not provide extractColumns; upgrade the substrate.",
-        { details: { required: "algenta-sdk extractColumns" } }
+        "The installed SQAI package does not provide extractColumns; upgrade SQAI.",
+        { details: { required: "sqai.extractColumns" } }
       );
     }
     try {
       return await this.algentaRuntime.extractColumns(sourceName, columns, options);
     } catch (error) {
-      throw fromAlgentaError(error);
+      throw fromEngineError(error);
     }
   }
   // ── Computation plane ──────────────────────────────────────────────────────
   async compute(spec) {
     const resolvedBindings = await this.resolveBindings(spec.bindings ?? []);
     const validated = validateComputation(spec, this.contractIndex, this.policy, resolvedBindings);
-    const requestId = `sqai_${(0, import_node_crypto6.randomBytes)(8).toString("hex")}`;
+    const requestId = `sqai_${(0, import_node_crypto7.randomBytes)(8).toString("hex")}`;
     const target = await this.dispatchTarget();
     const outcome = await dispatchComputation(
       target,
@@ -1937,7 +2222,7 @@ var SQAI = class {
         runtime_bundle_version: bundle.version || "unmanaged",
         runtime_bundle_sha256: platformBundle?.sha256 ?? "unmanaged",
         platform: currentPlatformKey(),
-        architecture: (0, import_node_os2.arch)(),
+        architecture: (0, import_node_os3.arch)(),
         kernel_build: outcome.engine_used,
         precision_mode: "float64",
         thread_count: 1,
@@ -2017,7 +2302,7 @@ var SQAI = class {
           "API mode requires SQAI_API_KEY for the computation plane."
         );
       }
-      return { kind: "http", baseUrl: "https://api.algenta.ai", apiKey: this.apiKey };
+      return { kind: "http", baseUrl: "https://api.sqai.com", apiKey: this.apiKey };
     }
     const runtime = await this.provisioner.ensure();
     return { kind: "local", runtime };
@@ -2075,6 +2360,13 @@ var SQAI = class {
 function createSQAI(config = {}) {
   return new SQAI(config);
 }
+function unsupportedSubstrateOperation(operation) {
+  return new SqaiError(
+    "unsupported_operation",
+    `The installed SQAI package does not provide ${operation}; upgrade SQAI.`,
+    { details: { required: `sqai.${operation}` } }
+  );
+}
 function mapSource(registration) {
   const record = registration;
   return {
@@ -2088,12 +2380,61 @@ function mapSource(registration) {
     status: String(registration.status ?? "ready")
   };
 }
+
+// src/types.ts
+var SQAI_CONNECTOR_TYPES = [
+  "s3",
+  "gcs",
+  "azure",
+  "clickhouse",
+  "bigquery",
+  "snowflake",
+  "redshift",
+  "postgres",
+  "postgresql",
+  "sqlite",
+  "mysql",
+  "mssql",
+  "oracle",
+  "neo4j",
+  "redis",
+  "elastic",
+  "elasticsearch",
+  "rest",
+  "rest_api",
+  "file",
+  "file_upload",
+  "github_repo",
+  "gitlab_repo",
+  "bitbucket_repo",
+  "local_repo",
+  "repo_archive"
+];
+var SQAI_CONNECTOR_TYPE_ALIASES = {
+  postgresql: "postgres",
+  click_house: "clickhouse",
+  redis_cache: "redis",
+  elastic: "elasticsearch",
+  rest_api: "rest",
+  file_upload: "file",
+  github: "github_repo",
+  github_repository: "github_repo",
+  gitlab: "gitlab_repo",
+  gitlab_repository: "gitlab_repo",
+  bitbucket: "bitbucket_repo",
+  bitbucket_repository: "bitbucket_repo",
+  local_repository: "local_repo",
+  archive_repository: "repo_archive"
+};
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   ContractIndex,
+  LoginError,
   ResultStore,
   RuntimeProvisioner,
   SQAI,
+  SQAI_CONNECTOR_TYPES,
+  SQAI_CONNECTOR_TYPE_ALIASES,
   SQAI_ERROR_CODES,
   SqaiError,
   computationHash,
@@ -2101,8 +2442,11 @@ function mapSource(registration) {
   currentPlatformKey,
   invocationHash,
   isReadOnlyEligible,
+  login,
+  logout,
   lookupCapability,
+  readCachedApiKey,
   runtimeCacheDir,
+  sqaiHome,
   validateComputation
 });
-//# sourceMappingURL=index.cjs.map