lua-cli 3.26.0 → 3.28.0

package/dist/api-exports.js

@@ -16,6 +16,8 @@ var __export = (target, all) => {
 
 // ../shared-types/dist/index.mjs
 import { z } from "zod";
+import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 function isPersonaTextObject(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
   const obj = value;
@@ -384,7 +386,88 @@ function normalizeLuaJobExecutionTimeoutSeconds(timeout) {
   }
   return Math.min(Math.max(timeout, LUA_JOB_MIN_TIMEOUT_SECONDS), LUA_JOB_MAX_TIMEOUT_SECONDS);
 }
-var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
+function triggerUrlEnvKey(triggerKey) {
+  const upper = triggerKey.trim().replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+  return `${TEMPLATE_TRIGGER_URL_ENV_PREFIX}${upper}`;
+}
+function parsePrincipalContext(value) {
+  const parsed = PrincipalContextSchema.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function isTypedApiKeyPrincipal(context) {
+  return context?.subject.subjectType === "apiKey" && context.credential.type === "apiKey" && !context.compatibility;
+}
+function typedApiKeyPrincipalId(context) {
+  if (!context || !isTypedApiKeyPrincipal(context) || !context.subject.subjectId || context.credential.id !== context.subject.subjectId || context.actor?.actorType !== "apiKey" || context.actor.actorId !== context.subject.subjectId || context.owner?.type !== "user" || !context.owner.id) {
+    return void 0;
+  }
+  return context.subject.subjectId;
+}
+function parseLuaClientHeader(value) {
+  if (typeof value !== "string" || value.length > 64) return void 0;
+  const match = CLIENT_HEADER_PATTERN.exec(value.trim());
+  if (!match) return void 0;
+  const app = LUA_CLIENT_APPS.find((candidate) => candidate === match[1]);
+  if (!app) return void 0;
+  const wireVersion = match[2];
+  if (wireVersion === "unversioned") return {
+    app,
+    version: "unknown",
+    attribution: "unknown"
+  };
+  const semver = SEMVER_PATTERN.exec(wireVersion);
+  if (semver) return {
+    app,
+    version: semver[1],
+    attribution: "known"
+  };
+  if (app === "web" && WEB_RELEASE_PATTERN.test(wireVersion)) {
+    return {
+      app,
+      version: wireVersion.toLowerCase(),
+      attribution: "known"
+    };
+  }
+  return void 0;
+}
+function serializeLuaClientHeader(client) {
+  if (!client) return void 0;
+  return `${client.app}/${client.version === "unknown" ? "unversioned" : client.version}`;
+}
+function formatLuaClientHeader(app, version) {
+  if (typeof version !== "string") return `${app}/unversioned`;
+  const normalized = version.trim();
+  if (SEMVER_PATTERN.test(normalized)) return `${app}/${normalized}`;
+  if (app === "web" && WEB_RELEASE_PATTERN.test(normalized)) return `${app}/${normalized.toLowerCase()}`;
+  return `${app}/unversioned`;
+}
+function luaClientMetricLabels(client) {
+  const canonical = parseLuaClientHeader(serializeLuaClientHeader(client));
+  return {
+    client_family: canonical?.app ?? "unknown",
+    client_version: canonical?.version ?? "unknown",
+    client_attribution: canonical?.attribution ?? "unknown"
+  };
+}
+function parseEffectiveAuthorization(value) {
+  const parsed = EffectiveAuthorizationSchema.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function parseResourcePage(value) {
+  const parsed = ResourcePageSchema.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function capabilitiesFor(profiles, profileId) {
+  if (!profileId) return [];
+  return profiles[profileId] ?? [];
+}
+function isKnownProfile(profiles, profileId) {
+  return profileId !== void 0 && Object.prototype.hasOwnProperty.call(profiles, profileId);
+}
+function hasCapability(profiles, profileId, required) {
+  return capabilitiesFor(profiles, profileId).includes(required);
+}
+var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, PrincipalContextSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1049,6 +1132,201 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(resolveLuaJobTimeoutSeconds, "resolveLuaJobTimeoutSeconds");
     __name(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
     __name2(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
+    TEMPLATE_TRIGGER_URL_ENV_PREFIX = "LUA_TRIGGER_URL__";
+    __name(triggerUrlEnvKey, "triggerUrlEnvKey");
+    __name2(triggerUrlEnvKey, "triggerUrlEnvKey");
+    SUBJECT_TYPES = [
+      "user",
+      "apiKey",
+      "service",
+      "endUser",
+      "staff"
+    ];
+    SubjectTypeSchema = z2.enum(SUBJECT_TYPES);
+    CREDENTIAL_TYPES = [
+      "firstPartySession",
+      "apiKey",
+      "deviceCredential",
+      "endUserSession",
+      "staffAssertion",
+      "serviceCredential",
+      "legacyInternalToken"
+    ];
+    CredentialTypeSchema = z2.enum(CREDENTIAL_TYPES);
+    PrincipalContextSchema = z2.object({
+      version: z2.literal(1),
+      subject: z2.object({
+        subjectType: SubjectTypeSchema,
+        subjectId: z2.string().min(1).max(256)
+      }).strict(),
+      actor: z2.object({
+        actorType: SubjectTypeSchema,
+        actorId: z2.string().min(1).max(256)
+      }).strict().optional(),
+      credential: z2.object({
+        type: CredentialTypeSchema,
+        id: z2.string().min(1).max(256).optional(),
+        issuedAt: z2.number().int().nonnegative().optional(),
+        expiresAt: z2.number().int().nonnegative().optional()
+      }).strict(),
+      owner: z2.object({
+        type: z2.enum([
+          "user",
+          "org",
+          "service"
+        ]),
+        id: z2.string().min(1).max(256)
+      }).strict().optional(),
+      compatibility: z2.object({
+        mode: z2.literal("legacy-owner-delegation")
+      }).strict().optional()
+    }).strict();
+    __name(parsePrincipalContext, "parsePrincipalContext");
+    __name2(parsePrincipalContext, "parsePrincipalContext");
+    __name(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
+    __name2(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
+    __name(typedApiKeyPrincipalId, "typedApiKeyPrincipalId");
+    __name2(typedApiKeyPrincipalId, "typedApiKeyPrincipalId");
+    LUA_CLIENT_HEADER = "X-Lua-Client";
+    LUA_CLIENT_APPS = [
+      "desktop",
+      "web",
+      "cli",
+      "mobile",
+      "claude-plugin",
+      "codex-plugin",
+      "cursor-plugin",
+      "platform-mcp"
+    ];
+    SEMVER_PATTERN = /^(\d{1,3}\.\d{1,3}\.\d{1,3})(?:-[0-9A-Za-z.-]{1,16})?(?:\+[0-9A-Za-z.-]{1,16})?$/;
+    WEB_RELEASE_PATTERN = /^[0-9a-f]{12}$/i;
+    CLIENT_HEADER_PATTERN = /^([^/]+)\/(.+)$/;
+    __name(parseLuaClientHeader, "parseLuaClientHeader");
+    __name2(parseLuaClientHeader, "parseLuaClientHeader");
+    __name(serializeLuaClientHeader, "serializeLuaClientHeader");
+    __name2(serializeLuaClientHeader, "serializeLuaClientHeader");
+    __name(formatLuaClientHeader, "formatLuaClientHeader");
+    __name2(formatLuaClientHeader, "formatLuaClientHeader");
+    __name(luaClientMetricLabels, "luaClientMetricLabels");
+    __name2(luaClientMetricLabels, "luaClientMetricLabels");
+    AUTHZ_PROJECTION_VERSION = 1;
+    ProjectedScopeSchema = z3.string().min(1).max(128);
+    DisplayRoleSchema = z3.object({
+      role: z3.string().min(1).max(128),
+      boundTo: z3.enum([
+        "org",
+        "agent",
+        "platform"
+      ]),
+      resourceId: z3.string().min(1).max(256)
+    }).passthrough();
+    AuthorizationPrincipalSchema = z3.object({
+      subjectType: SubjectTypeSchema,
+      subjectId: z3.string().min(1).max(256)
+    }).passthrough();
+    CredentialContextSchema = z3.object({
+      type: CredentialTypeSchema,
+      id: z3.string().min(1).max(256).optional(),
+      owner: z3.object({
+        type: z3.enum([
+          "user",
+          "org",
+          "service"
+        ]),
+        id: z3.string().min(1).max(256)
+      }).passthrough().optional(),
+      compatibility: z3.object({
+        mode: z3.literal("legacy-owner-delegation")
+      }).passthrough().optional()
+    }).passthrough();
+    ProjectionAnomalySchema = z3.enum([
+      "grant-without-membership",
+      "live-grant-on-inactive-membership"
+    ]);
+    ProjectedOrgSchema = z3.object({
+      orgId: z3.string().min(1).max(256),
+      name: z3.string().optional(),
+      archived: z3.boolean(),
+      /** Key into `capabilityProfiles`. */
+      capabilityProfile: z3.string().min(1).max(64),
+      displayRoles: z3.array(DisplayRoleSchema),
+      /** Product data — notifications, ordering, labels. NEVER an authorization input. */
+      membership: z3.object({
+        rostered: z3.boolean(),
+        active: z3.boolean()
+      }).passthrough(),
+      discoveredVia: z3.enum([
+        "org-grant",
+        "agent-grant-only"
+      ]).describe("For user and staff principals, grant provenance: org-grant means a stored org grant produced the row. For owner-ceiling API keys, effective provenance: org-grant means the credential-owner intersection has org-level capability; agent-grant-only means the intersection reaches only an exact agent inside the org."),
+      anomalies: z3.array(ProjectionAnomalySchema).optional()
+    }).passthrough();
+    ProjectedResourceSchema = z3.object({
+      resourceType: z3.literal("agent"),
+      resourceId: z3.string().min(1).max(256),
+      kind: z3.enum([
+        "agent",
+        "space"
+      ]),
+      /** `null` for an org-less platform agent. */
+      orgId: z3.string().min(1).max(256).nullable(),
+      name: z3.string().optional(),
+      visibility: z3.enum([
+        "private",
+        "public",
+        "platform"
+      ]),
+      capabilityProfile: z3.string().min(1).max(64),
+      displayRoles: z3.array(DisplayRoleSchema),
+      discoveredVia: z3.enum([
+        "org-cascade",
+        "agent-grant",
+        "owner-override",
+        "platform-allowlist"
+      ]),
+      /** Product data only. A roster row confers nothing. */
+      rostered: z3.boolean()
+    }).passthrough();
+    CapabilityProfilesSchema = z3.record(z3.string().min(1).max(64), z3.array(ProjectedScopeSchema));
+    RoleCatalogSchema = z3.record(z3.string().min(1).max(128), z3.object({
+      label: z3.string()
+    }).passthrough());
+    EffectiveAuthorizationSchema = z3.object({
+      version: z3.literal(AUTHZ_PROJECTION_VERSION),
+      generatedAt: z3.string().min(1),
+      authorizationPrincipal: AuthorizationPrincipalSchema,
+      credentialContext: CredentialContextSchema.optional(),
+      orgs: z3.array(ProjectedOrgSchema),
+      /**
+       * Present only when the caller holds platform grants. This is what replaces a
+       * client-side staff check: staff-ness is a scope on a resource, not an email
+       * suffix and not a boolean that would read `false` on an ordinary session.
+       */
+      platform: z3.object({
+        capabilityProfile: z3.string().min(1).max(64)
+      }).passthrough().optional(),
+      capabilityProfiles: CapabilityProfilesSchema,
+      roleCatalog: RoleCatalogSchema.optional()
+    }).passthrough();
+    ResourcePageSchema = z3.object({
+      version: z3.literal(AUTHZ_PROJECTION_VERSION),
+      generatedAt: z3.string().min(1),
+      orgId: z3.string().min(1).max(256),
+      resources: z3.array(ProjectedResourceSchema),
+      capabilityProfiles: CapabilityProfilesSchema,
+      /** `null` = last page. Opaque; do not construct one. */
+      nextCursor: z3.string().nullable().describe("Opaque continuation. A non-null value may accompany a short or empty resource page when the server reaches its per-request scan cap; clients must continue until null.")
+    }).passthrough();
+    __name(parseEffectiveAuthorization, "parseEffectiveAuthorization");
+    __name2(parseEffectiveAuthorization, "parseEffectiveAuthorization");
+    __name(parseResourcePage, "parseResourcePage");
+    __name2(parseResourcePage, "parseResourcePage");
+    __name(capabilitiesFor, "capabilitiesFor");
+    __name2(capabilitiesFor, "capabilitiesFor");
+    __name(isKnownProfile, "isKnownProfile");
+    __name2(isKnownProfile, "isKnownProfile");
+    __name(hasCapability, "hasCapability");
+    __name2(hasCapability, "hasCapability");
   }
 });
 
@@ -1070,7 +1348,7 @@ var init_baskets = __esm({
 // src/config/constants.ts
 import { join } from "path";
 import { homedir } from "os";
-var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE;
+var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, FIREBASE_WEB_API_KEY, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE;
 var init_constants = __esm({
   "src/config/constants.ts"() {
     "use strict";
@@ -1086,6 +1364,7 @@ var init_constants = __esm({
       CDN: "https://cdn.heylua.ai"
     };
     CREDENTIALS_FILE = join(CLI_CONFIG_DIR, "credentials");
+    FIREBASE_WEB_API_KEY = process.env.LUA_FIREBASE_WEB_API_KEY || "AIzaSyAGI0AxOz6UmtJgwFIA_UNTuYUEgQRRGhw";
     SANDBOX_STORAGE_FILE = join(CLI_CONFIG_DIR, "sandbox.json");
     AUTH_STORAGE_FILE = join(CLI_CONFIG_DIR, "auth.json");
   }
@@ -1134,13 +1413,105 @@ var init_auth_error = __esm({
   }
 });
 
+// src/utils/package-root.ts
+import { readFileSync, existsSync } from "fs";
+import { fileURLToPath, pathToFileURL } from "url";
+import { dirname, join as join2 } from "path";
+function locate() {
+  if (cachedRoot && cachedPkg) return {
+    root: cachedRoot,
+    pkg: cachedPkg
+  };
+  let dir = dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const candidate = join2(dir, "package.json");
+    if (existsSync(candidate)) {
+      try {
+        const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+        if (parsed?.name === "lua-cli") {
+          cachedRoot = dir;
+          cachedPkg = parsed;
+          return {
+            root: dir,
+            pkg: parsed
+          };
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("Could not locate lua-cli package root from " + fileURLToPath(import.meta.url));
+}
+function getCliVersion() {
+  try {
+    return locate().pkg.version;
+  } catch {
+    return "0.0.0";
+  }
+}
+var cachedRoot, cachedPkg;
+var init_package_root = __esm({
+  "src/utils/package-root.ts"() {
+    "use strict";
+    cachedRoot = null;
+    cachedPkg = null;
+    __name(locate, "locate");
+    __name(getCliVersion, "getCliVersion");
+  }
+});
+
+// src/utils/lua-fetch.ts
+function luaClientHeaderValue() {
+  return formatLuaClientHeader("cli", getCliVersion());
+}
+function headerRecord(headers) {
+  if (!headers) return {};
+  if (headers instanceof Headers) return Object.fromEntries(headers.entries());
+  if (Array.isArray(headers)) return Object.fromEntries(headers);
+  const record = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "string") record[name] = value;
+  }
+  return record;
+}
+function luaFetch(input, init = {}) {
+  const headers = headerRecord(init.headers);
+  for (const name of Object.keys(headers)) {
+    if (name.toLowerCase() === LUA_CLIENT_HEADER.toLowerCase()) delete headers[name];
+  }
+  headers[LUA_CLIENT_HEADER] = luaClientHeaderValue();
+  return fetch(input, {
+    ...init,
+    headers
+  });
+}
+var init_lua_fetch = __esm({
+  "src/utils/lua-fetch.ts"() {
+    "use strict";
+    init_dist();
+    init_package_root();
+    __name(luaClientHeaderValue, "luaClientHeaderValue");
+    __name(headerRecord, "headerRecord");
+    __name(luaFetch, "luaFetch");
+  }
+});
+
 // src/api/http.client.ts
 import { randomUUID } from "crypto";
+function parseRetryAfter(raw) {
+  if (!raw) return void 0;
+  const seconds = Number.parseInt(raw, 10);
+  return Number.isFinite(seconds) && seconds > 0 ? seconds : void 0;
+}
 var HttpClient;
 var init_http_client = __esm({
   "src/api/http.client.ts"() {
     "use strict";
     init_auth_error();
+    init_lua_fetch();
     HttpClient = class {
       static {
         __name(this, "HttpClient");
@@ -1164,7 +1535,7 @@ var init_http_client = __esm({
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), 3e4);
         try {
-          const response = await fetch(url, {
+          const response = await luaFetch(url, {
             ...options,
             signal: controller.signal,
             headers: {
@@ -1203,6 +1574,7 @@ Check that your API key has access to this agent/organization.`);
                 message: errorData.message || `HTTP ${response.status}: ${response.statusText}`,
                 statusCode: response.status,
                 error: errorData.error,
+                retryAfterSeconds: parseRetryAfter(response.headers.get("retry-after")),
                 ...errorData
               }
             };
@@ -1301,7 +1673,8 @@ Check that your API key has access to this agent/organization.`);
             throw error;
           }
           if (attempt < maxRetries) {
-            const backoff = this.calculateBackoff(attempt);
+            const serverDelay = Number(lastResult?.error?.retryAfterSeconds ?? 0) * 1e3;
+            const backoff = Math.max(this.calculateBackoff(attempt), serverDelay);
             await new Promise((resolve) => setTimeout(resolve, backoff));
           }
         }
@@ -1336,6 +1709,19 @@ Check that your API key has access to this agent/organization.`);
         });
       }
       /**
+      * Performs one HTTP POST attempt.
+      *
+      * Use this only when a successful response contains a one-time secret that
+      * cannot be recovered after an ambiguous network or server failure.
+      */
+      async httpPostOnce(url, data, headers) {
+        return this.retryableRequest(this.baseUrl + url, {
+          method: "POST",
+          body: data ? JSON.stringify(data) : void 0,
+          headers
+        }, 0);
+      }
+      /**
       * Performs an HTTP PUT request
       * @param url - The relative URL path to request (will be appended to baseUrl)
       * @param data - Optional request body data (will be JSON stringified)
@@ -1379,6 +1765,7 @@ Check that your API key has access to this agent/organization.`);
         });
       }
     };
+    __name(parseRetryAfter, "parseRetryAfter");
   }
 });
 
@@ -1392,13 +1779,13 @@ var init_auth_api_service = __esm({
 
 // src/services/auth.ts
 import "dotenv/config";
-import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "fs";
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, unlinkSync } from "fs";
 function getToken() {
   if (process.env.LUA_API_KEY) {
     return process.env.LUA_API_KEY;
   }
   try {
-    const token = readFileSync(CREDENTIALS_FILE, "utf8").trim();
+    const token = readFileSync2(CREDENTIALS_FILE, "utf8").trim();
     if (token) return token;
   } catch {
   }
@@ -2490,13 +2877,6 @@ var init_version_check = __esm({
   }
 });
 
-// src/utils/package-root.ts
-var init_package_root = __esm({
-  "src/utils/package-root.ts"() {
-    "use strict";
-  }
-});
-
 // src/services/analytics.ts
 import { PostHog } from "posthog-node";
 var init_analytics = __esm({
@@ -4244,8 +4624,7 @@ var init_user_data_api_service = __esm({
       * @throws Error if the message sending fails or the request is unsuccessful
       */
       async sendMessage(messages) {
-        const user = await this.getAdminUser();
-        const response = await this.httpPost(`/admin/agents/${this.agentId}/conversations/${user.uid}`, {
+        const response = await this.httpPost(`/admin/agents/${this.agentId}/conversations/me`, {
           messages
         }, {
           Authorization: `Bearer ${this.apiKey}`
@@ -4256,20 +4635,6 @@ var init_user_data_api_service = __esm({
         return response.data;
       }
       /**
-      * Gets the admin user for the specific agent
-      * @returns Promise resolving to the admin user data
-      * @throws Error if the admin user cannot be retrieved or the request is unsuccessful
-      */
-      async getAdminUser() {
-        const response = await this.httpGet(`/admin`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
-        if (!response.success) {
-          throw new Error(response.error?.message || "Failed to get admin user");
-        }
-        return response.data;
-      }
-      /**
       * Gets the chat history for the current user and agent
       * @returns Promise resolving to an array of chat messages
       * @throws Error if the chat history cannot be retrieved or the request is unsuccessful
@@ -5486,6 +5851,7 @@ var CdnApi;
 var init_cdn_api_service = __esm({
   "src/api/cdn.api.service.ts"() {
     "use strict";
+    init_lua_fetch();
     CdnApi = class {
       static {
         __name(this, "CdnApi");
@@ -5504,7 +5870,7 @@ var init_cdn_api_service = __esm({
       async upload(file) {
         const formData = new FormData();
         formData.append("file", file, file.name);
-        const response = await fetch(`${this.baseUrl}/upload`, {
+        const response = await luaFetch(`${this.baseUrl}/upload`, {
           method: "POST",
           headers: {
             Authorization: `Bearer ${this.apiKey}`
@@ -5522,7 +5888,7 @@ var init_cdn_api_service = __esm({
       * Fetches a file from the CDN by its ID
       */
       async get(fileId) {
-        const response = await fetch(`${this.baseUrl}/${fileId}`);
+        const response = await luaFetch(`${this.baseUrl}/${fileId}`);
         if (!response.ok) {
           throw new Error(`File not found: ${response.status}`);
         }
@@ -6484,6 +6850,7 @@ var LuaWebhook = class {
   querySchema;
   headerSchema;
   bodySchema;
+  secret;
   executeFunction;
   /**
   * Creates a new LuaWebhook instance.
@@ -6505,9 +6872,17 @@ var LuaWebhook = class {
     this.querySchema = config.querySchema;
     this.headerSchema = config.headerSchema;
     this.bodySchema = config.bodySchema;
+    this.secret = config.secret;
     this.executeFunction = config.execute;
   }
   /**
+  * Gets the webhook's signing key, if one is configured.
+  * Never print this — it is the shared secret callers sign with.
+  */
+  getSecret() {
+    return this.secret;
+  }
+  /**
   * Gets the webhook name.
   */
   getName() {
@@ -6584,12 +6959,16 @@ var LuaTrigger = class {
   verify;
   filter;
   transform;
+  tool;
   constructor(config) {
     if (!config.name || !config.name.trim()) {
       throw new Error("LuaTrigger requires a non-empty `name` (used as the server-side identifier).");
     }
-    if (!config.verify && !config.filter && !config.transform) {
-      throw new Error("LuaTrigger requires at least one of verify, filter, or transform.");
+    if (!config.verify && !config.filter && !config.transform && !config.tool) {
+      throw new Error("LuaTrigger requires at least one of verify, filter, transform, or tool.");
+    }
+    if (config.tool && (!config.tool.name || !config.tool.name.trim())) {
+      throw new Error("LuaTrigger `tool` requires a non-empty `name` (the bare authored tool name).");
     }
     this.name = config.name;
     this.description = config.description;
@@ -6598,6 +6977,7 @@ var LuaTrigger = class {
     this.verify = config.verify;
     this.filter = config.filter;
     this.transform = config.transform;
+    this.tool = config.tool;
   }
   getName() {
     return this.name;