lua-cli 3.27.0 → 3.29.0

package/dist/api-exports.js

@@ -16,6 +16,8 @@ var __export = (target, all) => {
 
 // ../shared-types/dist/index.mjs
 import { z } from "zod";
+import { z as z2 } from "zod";
+import { z as z3 } from "zod";
 function isPersonaTextObject(value) {
   if (value === null || typeof value !== "object" || Array.isArray(value)) return false;
   const obj = value;
@@ -384,7 +386,99 @@ function normalizeLuaJobExecutionTimeoutSeconds(timeout) {
   }
   return Math.min(Math.max(timeout, LUA_JOB_MIN_TIMEOUT_SECONDS), LUA_JOB_MAX_TIMEOUT_SECONDS);
 }
-var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS;
+function triggerUrlEnvKey(triggerKey) {
+  const upper = triggerKey.trim().replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
+  return `${TEMPLATE_TRIGGER_URL_ENV_PREFIX}${upper}`;
+}
+function deviceCredentialScopes(operations) {
+  return [
+    ...new Set(operations.map((operation) => DEVICE_SCOPE_BY_OPERATION[operation]))
+  ];
+}
+function parsePrincipalContext(value) {
+  const parsed = PrincipalContextSchema.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function isDeviceCredentialPrincipal(context) {
+  return context?.credential.type === "deviceCredential";
+}
+function hasDeviceCredentialType(value) {
+  return DeviceCredentialClaimSchema.safeParse(value).success;
+}
+function isTypedApiKeyPrincipal(context) {
+  return context?.subject.subjectType === "apiKey" && context.credential.type === "apiKey" && !context.compatibility;
+}
+function typedApiKeyPrincipalId(context) {
+  if (!context || !isTypedApiKeyPrincipal(context) || !context.subject.subjectId || context.credential.id !== context.subject.subjectId || context.actor?.actorType !== "apiKey" || context.actor.actorId !== context.subject.subjectId || context.owner?.type !== "user" || !context.owner.id) {
+    return void 0;
+  }
+  return context.subject.subjectId;
+}
+function parseLuaClientHeader(value) {
+  if (typeof value !== "string" || value.length > 64) return void 0;
+  const match = CLIENT_HEADER_PATTERN.exec(value.trim());
+  if (!match) return void 0;
+  const app = LUA_CLIENT_APPS.find((candidate) => candidate === match[1]);
+  if (!app) return void 0;
+  const wireVersion = match[2];
+  if (wireVersion === "unversioned") return {
+    app,
+    version: "unknown",
+    attribution: "unknown"
+  };
+  const semver = SEMVER_PATTERN.exec(wireVersion);
+  if (semver) return {
+    app,
+    version: semver[1],
+    attribution: "known"
+  };
+  if (app === "web" && WEB_RELEASE_PATTERN.test(wireVersion)) {
+    return {
+      app,
+      version: wireVersion.toLowerCase(),
+      attribution: "known"
+    };
+  }
+  return void 0;
+}
+function serializeLuaClientHeader(client) {
+  if (!client) return void 0;
+  return `${client.app}/${client.version === "unknown" ? "unversioned" : client.version}`;
+}
+function formatLuaClientHeader(app, version) {
+  if (typeof version !== "string") return `${app}/unversioned`;
+  const normalized = version.trim();
+  if (SEMVER_PATTERN.test(normalized)) return `${app}/${normalized}`;
+  if (app === "web" && WEB_RELEASE_PATTERN.test(normalized)) return `${app}/${normalized.toLowerCase()}`;
+  return `${app}/unversioned`;
+}
+function luaClientMetricLabels(client) {
+  const canonical = parseLuaClientHeader(serializeLuaClientHeader(client));
+  return {
+    client_family: canonical?.app ?? "unknown",
+    client_version: canonical?.version ?? "unknown",
+    client_attribution: canonical?.attribution ?? "unknown"
+  };
+}
+function parseEffectiveAuthorization(value) {
+  const parsed = EffectiveAuthorizationSchema.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function parseResourcePage(value) {
+  const parsed = ResourcePageSchema.safeParse(value);
+  return parsed.success ? parsed.data : void 0;
+}
+function capabilitiesFor(profiles, profileId) {
+  if (!profileId) return [];
+  return profiles[profileId] ?? [];
+}
+function isKnownProfile(profiles, profileId) {
+  return profileId !== void 0 && Object.prototype.hasOwnProperty.call(profiles, profileId);
+}
+function hasCapability(profiles, profileId, required) {
+  return capabilitiesFor(profiles, profileId).includes(required);
+}
+var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1049,6 +1143,307 @@ This text is who you are for this person. As you learn them, their name, their w
     __name2(resolveLuaJobTimeoutSeconds, "resolveLuaJobTimeoutSeconds");
     __name(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
     __name2(normalizeLuaJobExecutionTimeoutSeconds, "normalizeLuaJobExecutionTimeoutSeconds");
+    TEMPLATE_TRIGGER_URL_ENV_PREFIX = "LUA_TRIGGER_URL__";
+    __name(triggerUrlEnvKey, "triggerUrlEnvKey");
+    __name2(triggerUrlEnvKey, "triggerUrlEnvKey");
+    SUBJECT_TYPES = [
+      "user",
+      "apiKey",
+      "service",
+      "endUser",
+      "staff"
+    ];
+    SubjectTypeSchema = z2.enum(SUBJECT_TYPES);
+    CREDENTIAL_TYPES = [
+      "firstPartySession",
+      "apiKey",
+      "deviceCredential",
+      "endUserSession",
+      "staffAssertion",
+      "serviceCredential",
+      "legacyInternalToken"
+    ];
+    CredentialTypeSchema = z2.enum(CREDENTIAL_TYPES);
+    DEVICE_OPERATIONS = [
+      "commands",
+      "triggers",
+      "assets.upload"
+    ];
+    DeviceOperationSchema = z2.enum(DEVICE_OPERATIONS);
+    DEVICE_SCOPE_BY_OPERATION = {
+      commands: "automations:write",
+      triggers: "automations:write",
+      "assets.upload": "files:write"
+    };
+    __name(deviceCredentialScopes, "deviceCredentialScopes");
+    __name2(deviceCredentialScopes, "deviceCredentialScopes");
+    DeviceBindingSchema = z2.object({
+      agentId: z2.string().min(1).max(256),
+      deviceName: z2.string().min(1).max(256),
+      operations: z2.array(DeviceOperationSchema).min(1).max(DEVICE_OPERATIONS.length)
+    }).strict().superRefine((binding, context) => {
+      if (new Set(binding.operations).size !== binding.operations.length) {
+        context.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: [
+            "operations"
+          ],
+          message: "Device operations must be unique"
+        });
+      }
+    });
+    IdSchema = z2.string().min(1).max(256);
+    PrincipalDescriptorSchema = z2.object({
+      subjectType: SubjectTypeSchema,
+      subjectId: IdSchema
+    }).strict();
+    ActorDescriptorSchema = z2.object({
+      actorType: SubjectTypeSchema,
+      actorId: IdSchema
+    }).strict();
+    PrincipalOwnerSchema = z2.object({
+      type: z2.enum([
+        "user",
+        "org",
+        "service"
+      ]),
+      id: IdSchema
+    }).strict();
+    CredentialLifecycleSchema = {
+      id: IdSchema.optional(),
+      issuedAt: z2.number().int().nonnegative().optional(),
+      expiresAt: z2.number().int().nonnegative().optional()
+    };
+    GeneralCredentialDescriptorSchema = z2.object({
+      type: z2.enum([
+        "firstPartySession",
+        "apiKey",
+        "endUserSession",
+        "staffAssertion",
+        "serviceCredential",
+        "legacyInternalToken"
+      ]),
+      ...CredentialLifecycleSchema
+    }).strict();
+    DeviceCredentialDescriptorSchema = z2.object({
+      type: z2.literal("deviceCredential"),
+      id: IdSchema,
+      issuedAt: z2.number().int().nonnegative().optional(),
+      expiresAt: z2.number().int().nonnegative().optional(),
+      secretVersion: z2.number().int().positive(),
+      device: DeviceBindingSchema
+    }).strict();
+    GeneralPrincipalContextSchema = z2.object({
+      version: z2.literal(1),
+      subject: PrincipalDescriptorSchema,
+      actor: ActorDescriptorSchema.optional(),
+      credential: GeneralCredentialDescriptorSchema,
+      owner: PrincipalOwnerSchema.optional(),
+      compatibility: z2.object({
+        mode: z2.literal("legacy-owner-delegation")
+      }).strict().optional()
+    }).strict();
+    DeviceCredentialPrincipalContextSchema = z2.object({
+      version: z2.literal(1),
+      subject: z2.object({
+        subjectType: z2.literal("apiKey"),
+        subjectId: IdSchema
+      }).strict(),
+      actor: z2.object({
+        actorType: z2.literal("apiKey"),
+        actorId: IdSchema
+      }).strict(),
+      credential: DeviceCredentialDescriptorSchema,
+      owner: z2.object({
+        type: z2.literal("user"),
+        id: IdSchema
+      }).strict()
+    }).strict().superRefine((context, refinement) => {
+      const credentialId = context.credential.id;
+      if (context.subject.subjectId !== credentialId) {
+        refinement.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: [
+            "subject",
+            "subjectId"
+          ],
+          message: "Device credential subject must match its credential id"
+        });
+      }
+      if (context.actor.actorId !== credentialId) {
+        refinement.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: [
+            "actor",
+            "actorId"
+          ],
+          message: "Device credential actor must match its credential id"
+        });
+      }
+    });
+    RawPrincipalContextSchema = z2.union([
+      DeviceCredentialPrincipalContextSchema,
+      GeneralPrincipalContextSchema
+    ]);
+    PrincipalContextSchema = z2.custom((value) => RawPrincipalContextSchema.safeParse(value).success, "Invalid principal context");
+    __name(parsePrincipalContext, "parsePrincipalContext");
+    __name2(parsePrincipalContext, "parsePrincipalContext");
+    __name(isDeviceCredentialPrincipal, "isDeviceCredentialPrincipal");
+    __name2(isDeviceCredentialPrincipal, "isDeviceCredentialPrincipal");
+    DeviceCredentialClaimSchema = z2.object({
+      credential: z2.object({
+        type: z2.literal("deviceCredential")
+      }).passthrough()
+    }).passthrough();
+    __name(hasDeviceCredentialType, "hasDeviceCredentialType");
+    __name2(hasDeviceCredentialType, "hasDeviceCredentialType");
+    __name(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
+    __name2(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
+    __name(typedApiKeyPrincipalId, "typedApiKeyPrincipalId");
+    __name2(typedApiKeyPrincipalId, "typedApiKeyPrincipalId");
+    LUA_CLIENT_HEADER = "X-Lua-Client";
+    LUA_CLIENT_APPS = [
+      "desktop",
+      "web",
+      "cli",
+      "mobile",
+      "claude-plugin",
+      "codex-plugin",
+      "cursor-plugin",
+      "platform-mcp",
+      "device-node",
+      "device-python",
+      "device-micropython"
+    ];
+    SEMVER_PATTERN = /^(\d{1,3}\.\d{1,3}\.\d{1,3})(?:-[0-9A-Za-z.-]{1,16})?(?:\+[0-9A-Za-z.-]{1,16})?$/;
+    WEB_RELEASE_PATTERN = /^[0-9a-f]{12}$/i;
+    CLIENT_HEADER_PATTERN = /^([^/]+)\/(.+)$/;
+    __name(parseLuaClientHeader, "parseLuaClientHeader");
+    __name2(parseLuaClientHeader, "parseLuaClientHeader");
+    __name(serializeLuaClientHeader, "serializeLuaClientHeader");
+    __name2(serializeLuaClientHeader, "serializeLuaClientHeader");
+    __name(formatLuaClientHeader, "formatLuaClientHeader");
+    __name2(formatLuaClientHeader, "formatLuaClientHeader");
+    __name(luaClientMetricLabels, "luaClientMetricLabels");
+    __name2(luaClientMetricLabels, "luaClientMetricLabels");
+    AUTHZ_PROJECTION_VERSION = 1;
+    ProjectedScopeSchema = z3.string().min(1).max(128);
+    DisplayRoleSchema = z3.object({
+      role: z3.string().min(1).max(128),
+      boundTo: z3.enum([
+        "org",
+        "agent",
+        "platform"
+      ]),
+      resourceId: z3.string().min(1).max(256)
+    }).passthrough();
+    AuthorizationPrincipalSchema = z3.object({
+      subjectType: SubjectTypeSchema,
+      subjectId: z3.string().min(1).max(256)
+    }).passthrough();
+    CredentialContextSchema = z3.object({
+      type: CredentialTypeSchema,
+      id: z3.string().min(1).max(256).optional(),
+      owner: z3.object({
+        type: z3.enum([
+          "user",
+          "org",
+          "service"
+        ]),
+        id: z3.string().min(1).max(256)
+      }).passthrough().optional(),
+      compatibility: z3.object({
+        mode: z3.literal("legacy-owner-delegation")
+      }).passthrough().optional()
+    }).passthrough();
+    ProjectionAnomalySchema = z3.enum([
+      "grant-without-membership",
+      "live-grant-on-inactive-membership"
+    ]);
+    ProjectedOrgSchema = z3.object({
+      orgId: z3.string().min(1).max(256),
+      name: z3.string().optional(),
+      archived: z3.boolean(),
+      /** Key into `capabilityProfiles`. */
+      capabilityProfile: z3.string().min(1).max(64),
+      displayRoles: z3.array(DisplayRoleSchema),
+      /** Product data — notifications, ordering, labels. NEVER an authorization input. */
+      membership: z3.object({
+        rostered: z3.boolean(),
+        active: z3.boolean()
+      }).passthrough(),
+      discoveredVia: z3.enum([
+        "org-grant",
+        "agent-grant-only"
+      ]).describe("For user and staff principals, grant provenance: org-grant means a stored org grant produced the row. For owner-ceiling API keys, effective provenance: org-grant means the credential-owner intersection has org-level capability; agent-grant-only means the intersection reaches only an exact agent inside the org."),
+      anomalies: z3.array(ProjectionAnomalySchema).optional()
+    }).passthrough();
+    ProjectedResourceSchema = z3.object({
+      resourceType: z3.literal("agent"),
+      resourceId: z3.string().min(1).max(256),
+      kind: z3.enum([
+        "agent",
+        "space"
+      ]),
+      /** `null` for an org-less platform agent. */
+      orgId: z3.string().min(1).max(256).nullable(),
+      name: z3.string().optional(),
+      visibility: z3.enum([
+        "private",
+        "public",
+        "platform"
+      ]),
+      capabilityProfile: z3.string().min(1).max(64),
+      displayRoles: z3.array(DisplayRoleSchema),
+      discoveredVia: z3.enum([
+        "org-cascade",
+        "agent-grant",
+        "owner-override",
+        "platform-allowlist"
+      ]),
+      /** Product data only. A roster row confers nothing. */
+      rostered: z3.boolean()
+    }).passthrough();
+    CapabilityProfilesSchema = z3.record(z3.string().min(1).max(64), z3.array(ProjectedScopeSchema));
+    RoleCatalogSchema = z3.record(z3.string().min(1).max(128), z3.object({
+      label: z3.string()
+    }).passthrough());
+    EffectiveAuthorizationSchema = z3.object({
+      version: z3.literal(AUTHZ_PROJECTION_VERSION),
+      generatedAt: z3.string().min(1),
+      authorizationPrincipal: AuthorizationPrincipalSchema,
+      credentialContext: CredentialContextSchema.optional(),
+      orgs: z3.array(ProjectedOrgSchema),
+      /**
+       * Present only when the caller holds platform grants. This is what replaces a
+       * client-side staff check: staff-ness is a scope on a resource, not an email
+       * suffix and not a boolean that would read `false` on an ordinary session.
+       */
+      platform: z3.object({
+        capabilityProfile: z3.string().min(1).max(64)
+      }).passthrough().optional(),
+      capabilityProfiles: CapabilityProfilesSchema,
+      roleCatalog: RoleCatalogSchema.optional()
+    }).passthrough();
+    ResourcePageSchema = z3.object({
+      version: z3.literal(AUTHZ_PROJECTION_VERSION),
+      generatedAt: z3.string().min(1),
+      orgId: z3.string().min(1).max(256),
+      resources: z3.array(ProjectedResourceSchema),
+      capabilityProfiles: CapabilityProfilesSchema,
+      /** `null` = last page. Opaque; do not construct one. */
+      nextCursor: z3.string().nullable().describe("Opaque continuation. A non-null value may accompany a short or empty resource page when the server reaches its per-request scan cap; clients must continue until null.")
+    }).passthrough();
+    __name(parseEffectiveAuthorization, "parseEffectiveAuthorization");
+    __name2(parseEffectiveAuthorization, "parseEffectiveAuthorization");
+    __name(parseResourcePage, "parseResourcePage");
+    __name2(parseResourcePage, "parseResourcePage");
+    __name(capabilitiesFor, "capabilitiesFor");
+    __name2(capabilitiesFor, "capabilitiesFor");
+    __name(isKnownProfile, "isKnownProfile");
+    __name2(isKnownProfile, "isKnownProfile");
+    __name(hasCapability, "hasCapability");
+    __name2(hasCapability, "hasCapability");
   }
 });
 
@@ -1070,7 +1465,7 @@ var init_baskets = __esm({
 // src/config/constants.ts
 import { join } from "path";
 import { homedir } from "os";
-var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE;
+var CLI_CONFIG_DIR, VERSION_CHECK_FILE, TELEMETRY_FILE, CLI_CACHE_FILE, BASE_URLS, CREDENTIALS_FILE, FIREBASE_WEB_API_KEY, SANDBOX_STORAGE_FILE, AUTH_STORAGE_FILE;
 var init_constants = __esm({
   "src/config/constants.ts"() {
     "use strict";
@@ -1086,6 +1481,7 @@ var init_constants = __esm({
       CDN: "https://cdn.heylua.ai"
     };
     CREDENTIALS_FILE = join(CLI_CONFIG_DIR, "credentials");
+    FIREBASE_WEB_API_KEY = process.env.LUA_FIREBASE_WEB_API_KEY || "AIzaSyAGI0AxOz6UmtJgwFIA_UNTuYUEgQRRGhw";
     SANDBOX_STORAGE_FILE = join(CLI_CONFIG_DIR, "sandbox.json");
     AUTH_STORAGE_FILE = join(CLI_CONFIG_DIR, "auth.json");
   }
@@ -1134,24 +1530,465 @@ var init_auth_error = __esm({
   }
 });
 
+// src/utils/package-root.ts
+import { readFileSync, existsSync } from "fs";
+import { fileURLToPath, pathToFileURL } from "url";
+import { dirname, join as join2 } from "path";
+function locate() {
+  if (cachedRoot && cachedPkg) return {
+    root: cachedRoot,
+    pkg: cachedPkg
+  };
+  let dir = dirname(fileURLToPath(import.meta.url));
+  while (true) {
+    const candidate = join2(dir, "package.json");
+    if (existsSync(candidate)) {
+      try {
+        const parsed = JSON.parse(readFileSync(candidate, "utf8"));
+        if (parsed?.name === "lua-cli") {
+          cachedRoot = dir;
+          cachedPkg = parsed;
+          return {
+            root: dir,
+            pkg: parsed
+          };
+        }
+      } catch {
+      }
+    }
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error("Could not locate lua-cli package root from " + fileURLToPath(import.meta.url));
+}
+function getCliVersion() {
+  try {
+    return locate().pkg.version;
+  } catch {
+    return "0.0.0";
+  }
+}
+var cachedRoot, cachedPkg;
+var init_package_root = __esm({
+  "src/utils/package-root.ts"() {
+    "use strict";
+    cachedRoot = null;
+    cachedPkg = null;
+    __name(locate, "locate");
+    __name(getCliVersion, "getCliVersion");
+  }
+});
+
+// src/utils/lua-fetch.ts
+function luaClientHeaderValue() {
+  return formatLuaClientHeader("cli", getCliVersion());
+}
+function headerRecord(headers) {
+  if (!headers) return {};
+  if (headers instanceof Headers) return Object.fromEntries(headers.entries());
+  if (Array.isArray(headers)) return Object.fromEntries(headers);
+  const record = {};
+  for (const [name, value] of Object.entries(headers)) {
+    if (typeof value === "string") record[name] = value;
+  }
+  return record;
+}
+function luaFetch(input, init = {}) {
+  const headers = headerRecord(init.headers);
+  for (const name of Object.keys(headers)) {
+    if (name.toLowerCase() === LUA_CLIENT_HEADER.toLowerCase()) delete headers[name];
+  }
+  headers[LUA_CLIENT_HEADER] = luaClientHeaderValue();
+  return fetch(input, {
+    ...init,
+    headers
+  });
+}
+var init_lua_fetch = __esm({
+  "src/utils/lua-fetch.ts"() {
+    "use strict";
+    init_dist();
+    init_package_root();
+    __name(luaClientHeaderValue, "luaClientHeaderValue");
+    __name(headerRecord, "headerRecord");
+    __name(luaFetch, "luaFetch");
+  }
+});
+
+// src/services/firebase-session.ts
+function requireFirebaseWebApiKey() {
+  if (!FIREBASE_WEB_API_KEY) {
+    throw new Error("Firebase sign-in is not configured for this CLI build.");
+  }
+  return FIREBASE_WEB_API_KEY;
+}
+function parseFirebaseSession(json, now = Date.now()) {
+  const idToken = json.idToken ?? json.id_token;
+  const refreshToken = json.refreshToken ?? json.refresh_token;
+  const expiresIn = Number(json.expiresIn ?? json.expires_in);
+  const uid = json.localId ?? json.user_id;
+  if (typeof idToken !== "string" || idToken.length === 0 || typeof refreshToken !== "string" || refreshToken.length === 0 || typeof uid !== "string" || uid.length === 0 || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Sign-in failed because Firebase returned an invalid session.");
+  }
+  return {
+    idToken,
+    refreshToken,
+    expiresAt: now + expiresIn * 1e3,
+    uid
+  };
+}
+async function parseFirebaseError(response) {
+  try {
+    const body = await response.json();
+    const message = body.error?.message;
+    return typeof message === "string" && message ? message.split(":")[0].trim() : response.statusText;
+  } catch {
+    return response.statusText;
+  }
+}
+async function fetchFirebase(url, init, timeoutMessage) {
+  const controller = new AbortController();
+  let timeoutId;
+  const timeout = new Promise((_resolve, reject) => {
+    timeoutId = setTimeout(() => {
+      reject(new Error(timeoutMessage));
+      controller.abort();
+    }, FIREBASE_REQUEST_TIMEOUT_MS);
+  });
+  try {
+    return await Promise.race([
+      fetch(url, {
+        ...init,
+        signal: controller.signal
+      }),
+      timeout
+    ]);
+  } finally {
+    if (timeoutId !== void 0) clearTimeout(timeoutId);
+  }
+}
+async function refreshFirebaseSession(session) {
+  const key = requireFirebaseWebApiKey();
+  const response = await fetchFirebase(`${FIREBASE_REFRESH_URL}?key=${encodeURIComponent(key)}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: session.refreshToken
+    }).toString()
+  }, "Firebase session refresh timed out after 15 seconds.");
+  if (!response.ok) {
+    throw new Error(`Firebase session refresh failed: ${await parseFirebaseError(response)}`);
+  }
+  const refreshed = parseFirebaseSession(await response.json());
+  if (refreshed.uid !== session.uid) throw new Error("Firebase session refresh returned a different identity.");
+  return refreshed;
+}
+var FIREBASE_REFRESH_URL, FIREBASE_REQUEST_TIMEOUT_MS;
+var init_firebase_session = __esm({
+  "src/services/firebase-session.ts"() {
+    "use strict";
+    init_constants();
+    FIREBASE_REFRESH_URL = "https://securetoken.googleapis.com/v1/token";
+    FIREBASE_REQUEST_TIMEOUT_MS = 15e3;
+    __name(requireFirebaseWebApiKey, "requireFirebaseWebApiKey");
+    __name(parseFirebaseSession, "parseFirebaseSession");
+    __name(parseFirebaseError, "parseFirebaseError");
+    __name(fetchFirebase, "fetchFirebase");
+    __name(refreshFirebaseSession, "refreshFirebaseSession");
+  }
+});
+
+// src/services/firebase-session-store.ts
+import { createHash, randomUUID } from "crypto";
+import { mkdir, open, readFile, rename, unlink } from "fs/promises";
+import { join as join3 } from "path";
+import { z as z4 } from "zod";
+function environmentKey(environment) {
+  return createHash("sha256").update(`${environment.apiUrl}
+${environment.authUrl}
+${environment.firebaseWebApiKey}`).digest("hex").slice(0, 16);
+}
+function isMissing(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+var storedFirebaseSessionSchema, currentFirebaseSessionEnvironment, wait, FirebaseSessionStore;
+var init_firebase_session_store = __esm({
+  "src/services/firebase-session-store.ts"() {
+    "use strict";
+    init_constants();
+    storedFirebaseSessionSchema = z4.object({
+      version: z4.literal(1),
+      kind: z4.literal("firebase-session"),
+      generation: z4.string().min(1),
+      refreshToken: z4.string().min(1),
+      firebaseUid: z4.string().min(1),
+      apiUrl: z4.string().url(),
+      authUrl: z4.string().url(),
+      firebaseWebApiKey: z4.string().min(1)
+    });
+    currentFirebaseSessionEnvironment = /* @__PURE__ */ __name(() => ({
+      apiUrl: BASE_URLS.API,
+      authUrl: BASE_URLS.AUTH,
+      firebaseWebApiKey: FIREBASE_WEB_API_KEY
+    }), "currentFirebaseSessionEnvironment");
+    __name(environmentKey, "environmentKey");
+    __name(isMissing, "isMissing");
+    wait = /* @__PURE__ */ __name((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)), "wait");
+    FirebaseSessionStore = class {
+      static {
+        __name(this, "FirebaseSessionStore");
+      }
+      environment;
+      directory;
+      constructor(root = CLI_CONFIG_DIR, environment = currentFirebaseSessionEnvironment()) {
+        this.environment = environment;
+        this.directory = join3(root, "sessions");
+      }
+      path() {
+        return join3(this.directory, `${environmentKey(this.environment)}.json`);
+      }
+      async read() {
+        let raw;
+        try {
+          raw = await readFile(this.path(), "utf8");
+        } catch (error) {
+          if (isMissing(error)) return null;
+          throw error;
+        }
+        let decoded;
+        try {
+          decoded = JSON.parse(raw);
+        } catch {
+          throw new Error("The stored Lua CLI session is invalid. Run `lua auth configure` again.");
+        }
+        const parsed = storedFirebaseSessionSchema.safeParse(decoded);
+        if (!parsed.success) throw new Error("The stored Lua CLI session is invalid. Run `lua auth configure` again.");
+        if (parsed.data.apiUrl !== this.environment.apiUrl || parsed.data.authUrl !== this.environment.authUrl || parsed.data.firebaseWebApiKey !== this.environment.firebaseWebApiKey) {
+          throw new Error("The stored Lua CLI session belongs to a different environment.");
+        }
+        return parsed.data;
+      }
+      async replace(session) {
+        storedFirebaseSessionSchema.parse(session);
+        if (session.apiUrl !== this.environment.apiUrl || session.authUrl !== this.environment.authUrl || session.firebaseWebApiKey !== this.environment.firebaseWebApiKey) {
+          throw new Error("Cannot store a Lua CLI session for a different environment.");
+        }
+        await this.withLock(async () => this.write(session));
+      }
+      async update(operation) {
+        return this.withLock(async () => {
+          const next = await operation(await this.read());
+          if (next) await this.write(next);
+          else await this.remove();
+          return next;
+        });
+      }
+      async clearIfGeneration(generation) {
+        let cleared = false;
+        await this.update(async (current) => {
+          if (!current || current.generation !== generation) return current;
+          cleared = true;
+          return null;
+        });
+        return cleared;
+      }
+      async write(session) {
+        await mkdir(this.directory, {
+          recursive: true,
+          mode: 448
+        });
+        const temporaryPath = join3(this.directory, `.${environmentKey(this.environment)}.${randomUUID()}.tmp`);
+        const handle = await open(temporaryPath, "wx", 384);
+        try {
+          await handle.writeFile(`${JSON.stringify(session)}
+`, "utf8");
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+        await rename(temporaryPath, this.path());
+      }
+      async remove() {
+        try {
+          await unlink(this.path());
+        } catch (error) {
+          if (!isMissing(error)) throw error;
+        }
+      }
+      async withLock(operation) {
+        await mkdir(this.directory, {
+          recursive: true,
+          mode: 448
+        });
+        const lockPath = `${this.path()}.lock`;
+        const lockOwner = randomUUID();
+        const deadline = Date.now() + 2e4;
+        while (true) {
+          try {
+            const handle = await open(lockPath, "wx", 384);
+            try {
+              await handle.writeFile(lockOwner, "utf8");
+              await handle.sync();
+            } finally {
+              await handle.close();
+            }
+            break;
+          } catch (error) {
+            const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+            if (code !== "EEXIST") throw error;
+            if (Date.now() >= deadline) {
+              throw new Error("Timed out waiting for another Lua CLI process to finish updating the session.");
+            }
+            await wait(50);
+          }
+        }
+        try {
+          return await operation();
+        } finally {
+          try {
+            if (await readFile(lockPath, "utf8") === lockOwner) await unlink(lockPath);
+          } catch (error) {
+            if (!isMissing(error)) throw error;
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/services/request-credential.ts
+import "dotenv/config";
+import { readFileSync as readFileSync2, unlinkSync } from "fs";
+function loadStoredApiKey() {
+  try {
+    return readFileSync2(CREDENTIALS_FILE, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function isRequestCredential(value) {
+  return typeof value !== "string";
+}
+async function bearerFor(credential) {
+  return isRequestCredential(credential) ? credential.bearer() : credential;
+}
+async function resolveRequestCredential() {
+  if (process.env.LUA_API_KEY) return new StaticRequestCredential(process.env.LUA_API_KEY, "environment");
+  const store = new FirebaseSessionStore();
+  const session = await store.read();
+  if (session) return new FirebaseRequestCredential(store, session);
+  const storedApiKey = loadStoredApiKey();
+  if (storedApiKey) return new StaticRequestCredential(storedApiKey, "stored");
+  throw new AuthenticationError("No Lua CLI authentication found. Run `lua auth configure` or set LUA_API_KEY.", "invalid_credentials", void 0, true);
+}
+var StaticRequestCredential, FirebaseRequestCredential;
+var init_request_credential = __esm({
+  "src/services/request-credential.ts"() {
+    "use strict";
+    init_constants();
+    init_auth_error();
+    init_lua_fetch();
+    init_firebase_session();
+    init_firebase_session_store();
+    __name(loadStoredApiKey, "loadStoredApiKey");
+    __name(isRequestCredential, "isRequestCredential");
+    __name(bearerFor, "bearerFor");
+    StaticRequestCredential = class StaticRequestCredential2 {
+      static {
+        __name(this, "StaticRequestCredential");
+      }
+      apiKey;
+      descriptor;
+      constructor(apiKey, source) {
+        this.apiKey = apiKey;
+        this.descriptor = {
+          kind: "api-key",
+          source
+        };
+      }
+      async bearer() {
+        return this.apiKey;
+      }
+    };
+    FirebaseRequestCredential = class FirebaseRequestCredential2 {
+      static {
+        __name(this, "FirebaseRequestCredential");
+      }
+      store;
+      descriptor;
+      liveSession;
+      refresh;
+      constructor(store, stored) {
+        this.store = store;
+        this.descriptor = {
+          kind: "first-party-session",
+          source: "stored",
+          uid: stored.firebaseUid
+        };
+      }
+      async bearer() {
+        if (this.liveSession && this.liveSession.expiresAt - Date.now() > 6e4) return this.liveSession.idToken;
+        if (!this.refresh) this.refresh = this.refreshBearer().finally(() => this.refresh = void 0);
+        return this.refresh;
+      }
+      async refreshBearer() {
+        let live;
+        await this.store.update(async (stored) => {
+          if (!stored) {
+            throw new AuthenticationError("Your Lua CLI session has expired. Run `lua auth configure`.", "invalid_credentials");
+          }
+          live = await refreshFirebaseSession({
+            idToken: "",
+            refreshToken: stored.refreshToken,
+            expiresAt: 0,
+            uid: stored.firebaseUid
+          });
+          return {
+            ...stored,
+            refreshToken: live.refreshToken,
+            firebaseUid: live.uid
+          };
+        });
+        if (!live) throw new Error("Firebase session refresh did not return a session.");
+        this.liveSession = live;
+        return live.idToken;
+      }
+    };
+    __name(resolveRequestCredential, "resolveRequestCredential");
+  }
+});
+
 // src/api/http.client.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
+function parseRetryAfter(raw) {
+  if (!raw) return void 0;
+  const seconds = Number.parseInt(raw, 10);
+  return Number.isFinite(seconds) && seconds > 0 ? seconds : void 0;
+}
 var HttpClient;
 var init_http_client = __esm({
   "src/api/http.client.ts"() {
     "use strict";
     init_auth_error();
+    init_lua_fetch();
+    init_request_credential();
     HttpClient = class {
       static {
         __name(this, "HttpClient");
       }
       baseUrl;
+      requestCredential;
       /**
       * Creates an instance of HttpClient
       * @param baseUrl - The base URL for all API requests
       */
-      constructor(baseUrl) {
+      constructor(baseUrl, requestCredential) {
         this.baseUrl = baseUrl;
+        this.requestCredential = requestCredential;
       }
       /**
       * Makes an HTTP request with standardized error handling
@@ -1164,12 +2001,16 @@ var init_http_client = __esm({
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), 3e4);
         try {
-          const response = await fetch(url, {
+          const authorization = this.requestCredential ? `Bearer ${await bearerFor(this.requestCredential)}` : void 0;
+          const response = await luaFetch(url, {
             ...options,
             signal: controller.signal,
             headers: {
               "Content-Type": "application/json",
-              ...options.headers
+              ...options.headers,
+              ...authorization ? {
+                Authorization: authorization
+              } : {}
             }
           });
           clearTimeout(timeoutId);
@@ -1188,14 +2029,14 @@ var init_http_client = __esm({
               const isExplicitCredential = !!serverMessage && /(invalid|expired|missing|no)\s+(api[\s_-]?key|token|credential)/i.test(serverMessage);
               const isBareAuthRejection = !serverMessage || /^unauthorized$/i.test(serverMessage);
               if (isExplicitCredential || isBareAuthRejection) {
-                throw new AuthenticationError("Authentication failed. Your API key may be invalid or expired.", "invalid_credentials", serverMessage);
+                throw new AuthenticationError("Authentication failed. Your Lua credential may be invalid or expired.", "invalid_credentials", serverMessage);
               }
               throw new AuthenticationError(`Authentication failed: ${serverMessage}`, "unknown", serverMessage);
             }
             if (response.status === 403) {
               const detail = errorData.message || "You do not have permission to access this resource.";
               throw new Error(`Access denied (403): ${detail}
-Check that your API key has access to this agent/organization.`);
+Check that your Lua login has access to this agent or organization.`);
             }
             return {
               success: false,
@@ -1203,6 +2044,7 @@ Check that your API key has access to this agent/organization.`);
                 message: errorData.message || `HTTP ${response.status}: ${response.statusText}`,
                 statusCode: response.status,
                 error: errorData.error,
+                retryAfterSeconds: parseRetryAfter(response.headers.get("retry-after")),
                 ...errorData
               }
             };
@@ -1279,7 +2121,7 @@ Check that your API key has access to this agent/organization.`);
         if (options.method === "POST") {
           const headers = options.headers || {};
           if (!headers["X-Idempotency-Key"]) {
-            headers["X-Idempotency-Key"] = randomUUID();
+            headers["X-Idempotency-Key"] = randomUUID2();
             options = {
               ...options,
               headers: {
@@ -1301,7 +2143,8 @@ Check that your API key has access to this agent/organization.`);
             throw error;
           }
           if (attempt < maxRetries) {
-            const backoff = this.calculateBackoff(attempt);
+            const serverDelay = Number(lastResult?.error?.retryAfterSeconds ?? 0) * 1e3;
+            const backoff = Math.max(this.calculateBackoff(attempt), serverDelay);
             await new Promise((resolve) => setTimeout(resolve, backoff));
           }
         }
@@ -1336,6 +2179,19 @@ Check that your API key has access to this agent/organization.`);
         });
       }
       /**
+      * Performs one HTTP POST attempt.
+      *
+      * Use this only when a successful response contains a one-time secret that
+      * cannot be recovered after an ambiguous network or server failure.
+      */
+      async httpPostOnce(url, data, headers) {
+        return this.retryableRequest(this.baseUrl + url, {
+          method: "POST",
+          body: data ? JSON.stringify(data) : void 0,
+          headers
+        }, 0);
+      }
+      /**
       * Performs an HTTP PUT request
       * @param url - The relative URL path to request (will be appended to baseUrl)
       * @param data - Optional request body data (will be JSON stringified)
@@ -1379,6 +2235,7 @@ Check that your API key has access to this agent/organization.`);
         });
       }
     };
+    __name(parseRetryAfter, "parseRetryAfter");
   }
 });
 
@@ -1392,25 +2249,12 @@ var init_auth_api_service = __esm({
 
 // src/services/auth.ts
 import "dotenv/config";
-import { readFileSync, writeFileSync, mkdirSync, unlinkSync } from "fs";
-function getToken() {
-  if (process.env.LUA_API_KEY) {
-    return process.env.LUA_API_KEY;
-  }
-  try {
-    const token = readFileSync(CREDENTIALS_FILE, "utf8").trim();
-    if (token) return token;
-  } catch {
-  }
-  throw new AuthenticationError('No API key found.\n\n  Authenticate using one of these methods:\n\n    \u279C  lua auth configure\n    \u279C  export LUA_API_KEY="your-api-key-here"\n    \u279C  Add LUA_API_KEY=... to a .env file\n\n  \u{1F511} Get your API key at https://admin.heylua.ai', "invalid_credentials", void 0, true);
-}
 var init_auth = __esm({
   "src/services/auth.ts"() {
     "use strict";
     init_auth_api_service();
     init_constants();
     init_auth_error();
-    __name(getToken, "getToken");
   }
 });
 
@@ -1482,17 +2326,15 @@ var init_skills_api_service = __esm({
       static {
         __name(this, "SkillApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of SkillApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -1501,9 +2343,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async getSkills() {
-        return this.httpGet(`/developer/skills/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/skills/${this.agentId}`, {});
       }
       /**
       * Creates a new skill for the agent
@@ -1512,9 +2352,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill creation fails or validation errors occur
       */
       async createSkill(skillData) {
-        return this.httpPost(`/developer/skills/${this.agentId}`, skillData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/skills/${this.agentId}`, skillData, {});
       }
       /**
       * Pushes a new version of a skill to production
@@ -1524,9 +2362,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the push operation fails
       */
       async pushSkill(skillId, versionData) {
-        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version`, versionData, {});
       }
       /**
       * Pushes a new development/sandbox version of a skill for testing
@@ -1536,9 +2372,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the push operation fails
       */
       async pushDevSkill(skillId, versionData) {
-        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version/sandbox`, versionData, {});
       }
       /**
       * Updates an existing development/sandbox version of a skill
@@ -1549,9 +2383,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill or version is not found or the update fails
       */
       async updateDevSkill(skillId, sandboxVersionId, versionData) {
-        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/sandbox/${sandboxVersionId}`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/sandbox/${sandboxVersionId}`, versionData, {});
       }
       /**
       * Retrieves all versions of a specific skill
@@ -1560,9 +2392,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the request fails
       */
       async getSkillVersions(skillId) {
-        return this.httpGet(`/developer/skills/${this.agentId}/${skillId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/skills/${this.agentId}/${skillId}/versions`, {});
       }
       /**
       * Publishes a specific version of a skill to production
@@ -1572,9 +2402,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill or version is not found or the publish operation fails
       */
       async publishSkillVersion(skillId, version) {
-        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/${version}/publish`, void 0, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/${version}/publish`, void 0, {});
       }
       /**
       * Deletes a skill and all its versions, or deactivates it if it has versions
@@ -1585,9 +2413,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the delete operation fails
       */
       async deleteSkill(skillId) {
-        return this.httpDelete(`/developer/skills/${this.agentId}/${skillId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/skills/${this.agentId}/${skillId}`, {});
       }
       /**
       * Attach TS source + workspace archive to a skill version. Powers
@@ -1595,9 +2421,7 @@ var init_skills_api_service = __esm({
       * source without waiting for the next UI-driven build.
       */
       async attachSkillSource(skillId, version, body) {
-        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/${encodeURIComponent(version)}/source`, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/${encodeURIComponent(version)}/source`, body, {});
       }
     };
   }
@@ -2490,20 +3314,13 @@ var init_version_check = __esm({
   }
 });
 
-// src/utils/package-root.ts
-var init_package_root = __esm({
-  "src/utils/package-root.ts"() {
-    "use strict";
-  }
-});
-
 // src/services/analytics.ts
 import { PostHog } from "posthog-node";
 var init_analytics = __esm({
   "src/services/analytics.ts"() {
     "use strict";
     init_constants();
-    init_auth();
+    init_request_credential();
     init_files();
   }
 });
@@ -2537,13 +3354,14 @@ var init_cli = __esm({
 });
 
 // src/utils/command-utils.ts
-function requireAuth() {
-  return getToken();
+async function requireAuth() {
+  return resolveRequestCredential();
 }
 var init_command_utils = __esm({
   "src/utils/command-utils.ts"() {
     "use strict";
     init_auth();
+    init_request_credential();
     init_files();
     init_cli();
     __name(requireAuth, "requireAuth");
@@ -3026,17 +3844,15 @@ var init_products_api_service = __esm({
       static {
         __name(this, "ProductApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of ProductApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       async get(pageOrOptions, limitArg) {
@@ -3057,9 +3873,7 @@ var init_products_api_service = __esm({
         if (filter) {
           queryParams.append("filter", JSON.stringify(filter));
         }
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/products?${queryParams.toString()}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/products?${queryParams.toString()}`, {});
         if (response.success) {
           return new ProductPaginationInstance(this, response);
         }
@@ -3072,9 +3886,7 @@ var init_products_api_service = __esm({
       * @throws Error if the product is not found or the request fails
       */
       async getById(productId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/${productId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/${productId}`, {});
         if (response.success && response.data) {
           return new ProductInstance(this, response.data);
         }
@@ -3087,9 +3899,7 @@ var init_products_api_service = __esm({
       * @throws Error if the product creation fails or validation errors occur
       */
       async create(productData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/products`, productData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/products`, productData, {});
         if (response.success && response.data) {
           return new ProductInstance(this, response.data.product);
         }
@@ -3106,9 +3916,7 @@ var init_products_api_service = __esm({
         const response = await this.httpPut(`/developer/agents/${this.agentId}/products`, {
           ...productData,
           id: productId
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3121,9 +3929,7 @@ var init_products_api_service = __esm({
       * @throws Error if the product is not found or the deletion fails
       */
       async delete(productId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/products/${productId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/products/${productId}`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3137,9 +3943,7 @@ var init_products_api_service = __esm({
       * @throws Error if the search fails or the API request is unsuccessful
       */
       async search(searchQuery, limit = 5) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/search?searchQuery=${encodeURIComponent(searchQuery)}&limit=${limit}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/search?searchQuery=${encodeURIComponent(searchQuery)}&limit=${limit}`, {});
         if (response.success) {
           return new ProductSearchInstance(this, response);
         }
@@ -3624,17 +4428,15 @@ var init_order_api_service = __esm({
       static {
         __name(this, "OrderApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of OrderApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -3644,9 +4446,7 @@ var init_order_api_service = __esm({
       * @throws Error if the basket is not found or the order creation fails
       */
       async create(orderData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/order`, orderData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/order`, orderData, {});
         if (response.success && response.data) {
           return new OrderInstance(this, response.data);
         }
@@ -3660,9 +4460,7 @@ var init_order_api_service = __esm({
       * @throws Error if the order is not found or the status update fails
       */
       async updateStatus(status, orderId) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}/${status}`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}/${status}`, {}, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3676,9 +4474,7 @@ var init_order_api_service = __esm({
       * @throws Error if the order is not found or the data update fails
       */
       async updateData(data, orderId) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}`, data, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}`, data, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3692,9 +4488,7 @@ var init_order_api_service = __esm({
       */
       async get(status) {
         const statusParam = status ? `?status=${status}` : "";
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/user${statusParam}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/user${statusParam}`, {});
         if (response.success && response.data) {
           return response.data.map((order) => new OrderInstance(this, order));
         }
@@ -3707,9 +4501,7 @@ var init_order_api_service = __esm({
       * @throws Error if the order is not found or the request fails
       */
       async getById(orderId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/${orderId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/${orderId}`, {});
         if (response.success && response.data) {
           return new OrderInstance(this, response.data);
         }
@@ -3732,17 +4524,17 @@ var init_basket_api_service = __esm({
       static {
         __name(this, "BasketApi");
       }
-      apiKey;
+      credential;
       agentId;
       /**
       * Creates an instance of BasketApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
+        this.credential = credential;
         this.agentId = agentId;
       }
       /**
@@ -3752,9 +4544,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket creation fails or the API request is unsuccessful
       */
       async create(basketData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket`, basketData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket`, basketData, {});
         if (response.success && response.data) {
           return new BasketInstance(this, response.data);
         }
@@ -3768,9 +4558,7 @@ var init_basket_api_service = __esm({
       */
       async get(status) {
         const statusParam = status ? `?status=${status}` : "";
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/user${statusParam}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/user${statusParam}`, {});
         if (response.success && response.data) {
           return response.data.map((basket) => new BasketInstance(this, basket));
         }
@@ -3783,9 +4571,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the request fails
       */
       async getById(basketId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/${basketId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/${basketId}`, {});
         if (response.success && response.data) {
           return new BasketInstance(this, response.data);
         }
@@ -3799,9 +4585,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the item cannot be added
       */
       async addItem(basketId, itemData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket/${basketId}/item`, itemData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket/${basketId}/item`, itemData, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3815,9 +4599,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket or item is not found or the removal fails
       */
       async removeItem(basketId, itemId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/item/${itemId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/item/${itemId}`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3830,9 +4612,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the clear operation fails
       */
       async clear(basketId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/clear`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/clear`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3846,9 +4626,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the status update fails
       */
       async updateStatus(basketId, status) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/${status}`, void 0, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/${status}`, void 0, {});
         if (response.success) {
           return status;
         }
@@ -3862,9 +4640,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the metadata update fails
       */
       async updateMetadata(basketId, metadata) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/metadata`, metadata, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/metadata`, metadata, {});
         if (response.success) {
           return metadata;
         }
@@ -3881,11 +4657,9 @@ var init_basket_api_service = __esm({
         const response = await this.httpPost(`/developer/agents/${this.agentId}/order`, {
           basketId,
           data
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
-          const orderApi = new OrderApi(this.baseUrl, this.apiKey, this.agentId);
+          const orderApi = new OrderApi(this.baseUrl, this.credential, this.agentId);
           return new OrderInstance(orderApi, response.data);
         }
         throw new Error(response.error?.message || "Failed to create order");
@@ -4124,18 +4898,18 @@ var init_user_data_api_service = __esm({
       static {
         __name(this, "UserDataApi");
       }
-      apiKey;
+      credential;
       agentId;
       targetUserId;
       /**
       * Creates an instance of UserDataApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId, targetUserId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId, targetUserId) {
+        super(baseUrl, credential);
+        this.credential = credential;
         this.agentId = agentId;
         this.targetUserId = targetUserId;
       }
@@ -4162,15 +4936,13 @@ var init_user_data_api_service = __esm({
         if (userId) {
           url += `/user/${encodeURIComponent(userId)}`;
         }
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to get user data");
         }
         const profile = response.data?._luaProfile;
         const { _luaProfile, ...data } = response.data || {};
-        const scopedApi = userId ? new _UserDataApi(this.baseUrl, this.apiKey, this.agentId, userId) : this;
+        const scopedApi = userId ? new _UserDataApi(this.baseUrl, this.credential, this.agentId, userId) : this;
         return new UserDataInstance(scopedApi, data, profile);
       }
       /**
@@ -4204,9 +4976,7 @@ var init_user_data_api_service = __esm({
       * @throws Error if the update fails or the request is unsuccessful
       */
       async update(data) {
-        const response = await this.httpPut(this.dataPath, data, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(this.dataPath, data, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to update user data");
         }
@@ -4214,9 +4984,7 @@ var init_user_data_api_service = __esm({
         return cleanData;
       }
       async patch(mutation) {
-        const response = await this.httpPatch(this.dataPath, mutation, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPatch(this.dataPath, mutation, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to patch user data");
         }
@@ -4229,9 +4997,7 @@ var init_user_data_api_service = __esm({
       * @throws Error if the clear operation fails or the request is unsuccessful
       */
       async clear() {
-        const response = await this.httpDelete(this.dataPath, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(this.dataPath, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to clear user data");
         }
@@ -4244,32 +5010,15 @@ var init_user_data_api_service = __esm({
       * @throws Error if the message sending fails or the request is unsuccessful
       */
       async sendMessage(messages) {
-        const user = await this.getAdminUser();
-        const response = await this.httpPost(`/admin/agents/${this.agentId}/conversations/${user.uid}`, {
+        const response = await this.httpPost(`/admin/agents/${this.agentId}/conversations/me`, {
           messages
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to send message");
         }
         return response.data;
       }
       /**
-      * Gets the admin user for the specific agent
-      * @returns Promise resolving to the admin user data
-      * @throws Error if the admin user cannot be retrieved or the request is unsuccessful
-      */
-      async getAdminUser() {
-        const response = await this.httpGet(`/admin`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
-        if (!response.success) {
-          throw new Error(response.error?.message || "Failed to get admin user");
-        }
-        return response.data;
-      }
-      /**
       * Gets the chat history for the current user and agent
       * @returns Promise resolving to an array of chat messages
       * @throws Error if the chat history cannot be retrieved or the request is unsuccessful
@@ -4281,9 +5030,7 @@ var init_user_data_api_service = __esm({
       * ```
       */
       async getChatHistory() {
-        const response = await this.httpGet(`/chat/history/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/chat/history/${this.agentId}`, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to get chat history");
         }
@@ -4509,17 +5256,15 @@ var init_custom_data_api_service = __esm({
       static {
         __name(this, "CustomDataApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of CustomDataApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -4529,9 +5274,7 @@ var init_custom_data_api_service = __esm({
       * @returns Promise resolving to the collections listing
       */
       async collections() {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4559,9 +5302,7 @@ var init_custom_data_api_service = __esm({
           data,
           searchText: options.searchText,
           index: options.index
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
           return new DataEntryInstance(this, response.data, collectionName);
         }
@@ -4582,9 +5323,7 @@ var init_custom_data_api_service = __esm({
           const encodedFilter = encodeURIComponent(JSON.stringify(filter));
           url += `&filter=${encodedFilter}`;
         }
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4598,9 +5337,7 @@ var init_custom_data_api_service = __esm({
       * @throws Error if the entry is not found or the API request is unsuccessful
       */
       async getEntry(collectionName, entryId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {});
         if (response.success && response.data) {
           return new DataEntryInstance(this, response.data, collectionName);
         }
@@ -4624,18 +5361,14 @@ var init_custom_data_api_service = __esm({
           data,
           searchText: options.searchText,
           index: options.index
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
           return response.data;
         }
         throw new Error(response.error?.message || "Failed to update custom data entry");
       }
       async patch(collectionName, entryId, mutation) {
-        const response = await this.httpPatch(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, mutation, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPatch(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, mutation, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4652,9 +5385,7 @@ var init_custom_data_api_service = __esm({
       */
       async search(collectionName, searchText, limit = 10, scoreThreshold = 0.6) {
         const url = `/developer/agents/${this.agentId}/custom-data/${collectionName}/search?searchText=${encodeURIComponent(searchText)}&limit=${limit}&scoreThreshold=${scoreThreshold}`;
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success && response.data) {
           return response.data.data.map((entry) => new DataEntryInstance(this, entry, collectionName));
         }
@@ -4668,9 +5399,7 @@ var init_custom_data_api_service = __esm({
       * @throws Error if the entry is not found or the deletion fails
       */
       async delete(collectionName, entryId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4690,17 +5419,15 @@ var init_webhook_api_service = __esm({
       static {
         __name(this, "WebhookApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of WebhookApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -4709,9 +5436,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async getWebhooks() {
-        return this.httpGet(`/developer/webhooks/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/webhooks/${this.agentId}`, {});
       }
       /**
       * Creates a new webhook for the agent
@@ -4720,14 +5445,10 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook creation fails or validation errors occur
       */
       async createWebhook(webhookData) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}`, webhookData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}`, webhookData, {});
       }
       async updateWebhook(webhookId, data) {
-        return this.httpPatch(`/developer/webhooks/${this.agentId}/${webhookId}`, data, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPatch(`/developer/webhooks/${this.agentId}/${webhookId}`, data, {});
       }
       /**
       * Pushes a new version of a webhook to production
@@ -4737,9 +5458,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the push operation fails
       */
       async pushWebhook(webhookId, versionData) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version`, versionData, {});
       }
       /**
       * Pushes a new development/sandbox version of a webhook for testing
@@ -4749,9 +5468,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the push operation fails
       */
       async pushDevWebhook(webhookId, versionData) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox`, versionData, {});
       }
       /**
       * Updates an existing development/sandbox version of a webhook
@@ -4762,9 +5479,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook or version is not found or the update fails
       */
       async updateDevWebhook(webhookId, sandboxVersionId, versionData) {
-        return this.httpPut(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox/${sandboxVersionId}`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox/${sandboxVersionId}`, versionData, {});
       }
       /**
       * Retrieves all versions of a specific webhook
@@ -4773,9 +5488,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the request fails
       */
       async getWebhookVersions(webhookId) {
-        return this.httpGet(`/developer/webhooks/${this.agentId}/${webhookId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/webhooks/${this.agentId}/${webhookId}/versions`, {});
       }
       /**
       * Publishes a specific version of a webhook to production
@@ -4785,9 +5498,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook or version is not found or the publish operation fails
       */
       async publishWebhookVersion(webhookId, version) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/${version}/publish`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/${version}/publish`, {}, {});
       }
       /**
       * Activates a webhook (enables it to receive requests)
@@ -4796,9 +5507,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the operation fails
       */
       async activateWebhook(webhookId) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/activate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/activate`, {}, {});
       }
       /**
       * Deactivates a webhook (stops it from receiving requests)
@@ -4807,9 +5516,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the operation fails
       */
       async deactivateWebhook(webhookId) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/deactivate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/deactivate`, {}, {});
       }
       /**
       * Deletes a webhook and all its versions, or deactivates it if it has versions
@@ -4820,9 +5527,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the delete operation fails
       */
       async deleteWebhook(webhookId) {
-        return this.httpDelete(`/developer/webhooks/${this.agentId}/${webhookId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/webhooks/${this.agentId}/${webhookId}`, {});
       }
     };
   }
@@ -4855,7 +5560,7 @@ var init_job_instance = __esm({
         this.activeVersion = jobData.activeVersion;
         this.metadata = jobData.metadata || {};
         if (jobData.userId && jobData.agentId) {
-          this.userApi = new UserDataApi(BASE_URLS.API, jobApi.apiKey, jobApi.agentId);
+          this.userApi = new UserDataApi(BASE_URLS.API, jobApi.credential, jobApi.agentId);
         }
       }
       /**
@@ -5009,17 +5714,17 @@ var init_job_api_service = __esm({
       static {
         __name(this, "JobApi");
       }
-      apiKey;
       agentId;
+      credential;
       /**
       * Creates an instance of JobApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
+        this.credential = credential;
         this.agentId = agentId;
       }
       /**
@@ -5033,9 +5738,7 @@ var init_job_api_service = __esm({
           queryParams.append("includeDynamic", "true");
         }
         const url = `/developer/jobs/${this.agentId}?${queryParams.toString()}`;
-        return this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(url, {});
       }
       /**
       * Retrieves all jobs for the agent as JobInstance array
@@ -5058,9 +5761,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the request fails
       */
       async getJob(jobId) {
-        const response = await this.httpGet(`/developer/jobs/${this.agentId}/${jobId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/jobs/${this.agentId}/${jobId}`, {});
         if (response.success && response.data) {
           return new JobInstance(this, response.data);
         }
@@ -5077,9 +5778,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job creation fails or validation errors occur
       */
       async createJob(jobData) {
-        return this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {});
       }
       /**
       * Creates a new job for the agent and returns a JobInstance.
@@ -5092,9 +5791,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job creation fails or validation errors occur
       */
       async createJobInstance(jobData) {
-        const response = await this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {});
         if (response.success && response.data) {
           return new JobInstance(this, response.data);
         }
@@ -5108,9 +5805,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the push operation fails
       */
       async pushJob(jobId, versionData) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version`, versionData, {});
       }
       /**
       * Pushes a new development/sandbox version of a job for testing
@@ -5120,9 +5815,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the push operation fails
       */
       async pushDevJob(jobId, versionData) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox`, versionData, {});
       }
       /**
       * Updates an existing development/sandbox version of a job
@@ -5133,9 +5826,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job or version is not found or the update fails
       */
       async updateDevJob(jobId, sandboxVersionId, versionData) {
-        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox/${sandboxVersionId}`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox/${sandboxVersionId}`, versionData, {});
       }
       /**
       * Retrieves all versions of a specific job
@@ -5144,9 +5835,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the request fails
       */
       async getJobVersions(jobId) {
-        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/versions`, {});
       }
       /**
       * Publishes a specific version of a job to production
@@ -5156,9 +5845,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job or version is not found or the publish operation fails
       */
       async publishJobVersion(jobId, version) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/${version}/publish`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/${version}/publish`, {}, {});
       }
       /**
       * Deletes a job and all its versions, or deactivates it if it has versions
@@ -5169,9 +5856,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the delete operation fails
       */
       async deleteJob(jobId) {
-        return this.httpDelete(`/developer/jobs/${this.agentId}/${jobId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/jobs/${this.agentId}/${jobId}`, {});
       }
       /**
       * Activates a job (enables it to run on schedule)
@@ -5180,9 +5865,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the operation fails
       */
       async activateJob(jobId) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/activate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/activate`, {}, {});
       }
       /**
       * Deactivates a job (disables it from running)
@@ -5191,9 +5874,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the operation fails
       */
       async deactivateJob(jobId) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/deactivate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/deactivate`, {}, {});
       }
       /**
       * Manually triggers a job execution (ignores schedule)
@@ -5206,9 +5887,7 @@ var init_job_api_service = __esm({
         const body = versionId ? {
           versionId
         } : {};
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/trigger`, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/trigger`, body, {});
       }
       /**
       * Retrieves execution history for a job
@@ -5218,9 +5897,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the request fails
       */
       async getJobExecutions(jobId, limit = 50) {
-        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/executions?limit=${limit}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/executions?limit=${limit}`, {});
       }
       /**
       * Updates the metadata of a job
@@ -5230,9 +5907,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the metadata update fails
       */
       async updateMetadata(jobId, metadata) {
-        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/metadata`, metadata, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/metadata`, metadata, {});
       }
     };
   }
@@ -5249,15 +5924,12 @@ var init_ai_api_service = __esm({
       static {
         __name(this, "AiApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       async generate(body) {
-        return this.httpPost(`/developer/ai/${this.agentId}/generate`, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/ai/${this.agentId}/generate`, body, {});
       }
       /**
       * Handles the simplified-vs-full-options branching for `AI.generate`.
@@ -5294,15 +5966,12 @@ var init_integrations_api_service = __esm({
       static {
         __name(this, "IntegrationsApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       async passthrough(integrationType, request) {
-        return this.httpPost(`/developer/unifiedto/connections/${encodeURIComponent(this.agentId)}/passthrough/${encodeURIComponent(integrationType)}`, request, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/unifiedto/connections/${encodeURIComponent(this.agentId)}/passthrough/${encodeURIComponent(integrationType)}`, request, {});
       }
       /**
       * Sandbox-facing wrapper: returns the raw provider envelope
@@ -5331,9 +6000,8 @@ var init_agents_api_service = __esm({
       static {
         __name(this, "AgentsApiService");
       }
-      apiKey;
-      constructor(baseUrl, apiKey) {
-        super(baseUrl), this.apiKey = apiKey;
+      constructor(baseUrl, credential) {
+        super(baseUrl, credential);
       }
       async invoke(targetAgentId, body) {
         const channel = body.channel ?? "agent-invocation";
@@ -5342,9 +6010,7 @@ var init_agents_api_service = __esm({
         });
         if (body.identifier) query.set("identifier", body.identifier);
         const chatBody = this.toChatGenerateBody(body);
-        return this.httpPost(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {});
       }
       /**
       * Sandbox overload: mirrors the `AI.generate` pattern where the simplified
@@ -5405,17 +6071,15 @@ var init_whatsapp_templates_api_service = __esm({
       static {
         __name(this, "WhatsAppTemplatesApiService");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of WhatsAppTemplatesApiService
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -5432,9 +6096,7 @@ var init_whatsapp_templates_api_service = __esm({
         if (search) {
           url += `&search=${encodeURIComponent(search)}`;
         }
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success) {
           return response.data;
         }
@@ -5448,9 +6110,7 @@ var init_whatsapp_templates_api_service = __esm({
       */
       async get(channelId, templateId) {
         const url = `/admin/agents/${this.agentId}/channels/${channelId}/whatsapp-templates/${templateId}`;
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success) {
           return response.data;
         }
@@ -5469,9 +6129,7 @@ var init_whatsapp_templates_api_service = __esm({
           phone_numbers: data.phoneNumbers,
           values: data.values
         };
-        const response = await this.httpPost(url, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(url, body, {});
         if (response.success) {
           return response.data;
         }
@@ -5486,15 +6144,17 @@ var CdnApi;
 var init_cdn_api_service = __esm({
   "src/api/cdn.api.service.ts"() {
     "use strict";
+    init_lua_fetch();
+    init_request_credential();
     CdnApi = class {
       static {
         __name(this, "CdnApi");
       }
       baseUrl;
-      apiKey;
-      constructor(baseUrl, apiKey) {
+      credential;
+      constructor(baseUrl, credential) {
         this.baseUrl = baseUrl;
-        this.apiKey = apiKey;
+        this.credential = credential;
       }
       /**
       * Uploads a file to the CDN
@@ -5504,10 +6164,10 @@ var init_cdn_api_service = __esm({
       async upload(file) {
         const formData = new FormData();
         formData.append("file", file, file.name);
-        const response = await fetch(`${this.baseUrl}/upload`, {
+        const response = await luaFetch(`${this.baseUrl}/upload`, {
           method: "POST",
           headers: {
-            Authorization: `Bearer ${this.apiKey}`
+            Authorization: `Bearer ${await bearerFor(this.credential)}`
           },
           body: formData
         });
@@ -5522,7 +6182,7 @@ var init_cdn_api_service = __esm({
       * Fetches a file from the CDN by its ID
       */
       async get(fileId) {
-        const response = await fetch(`${this.baseUrl}/${fileId}`);
+        const response = await luaFetch(`${this.baseUrl}/${fileId}`);
         if (!response.ok) {
           throw new Error(`File not found: ${response.status}`);
         }
@@ -5551,17 +6211,15 @@ var init_developer_api_service = __esm({
       static {
         __name(this, "DeveloperApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of DeveloperApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -5571,9 +6229,7 @@ var init_developer_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async getEnvironmentVariables() {
-        return this.httpGet(`/developer/agents/${this.agentId}/env`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/env`, {});
       }
       /**
       * Updates all environment variables for the agent in production
@@ -5583,9 +6239,7 @@ var init_developer_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async updateEnvironmentVariables(envData) {
-        return this.httpPost(`/developer/agents/${this.agentId}/env`, envData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/env`, envData, {});
       }
       /**
       * Deletes a specific environment variable by key
@@ -5594,27 +6248,21 @@ var init_developer_api_service = __esm({
       * @throws Error if the API request fails, the agent is not found, or the key doesn't exist
       */
       async deleteEnvironmentVariable(key) {
-        return this.httpDelete(`/developer/agents/${this.agentId}/env/${key}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/agents/${this.agentId}/env/${key}`, {});
       }
       /**
       * Retrieves all MCP server configurations for the agent
       * @returns Promise resolving to an ApiResponse containing MCP server configurations
       */
       async getMCPServers() {
-        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers`, {});
       }
       /**
       * Retrieves only active MCP server configurations for the agent
       * @returns Promise resolving to an ApiResponse containing active MCP server configurations
       */
       async getActiveMCPServers() {
-        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/active`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/active`, {});
       }
       /**
       * Gets a single MCP server by ID
@@ -5622,9 +6270,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the MCP server
       */
       async getMCPServer(mcpServerId) {
-        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {});
       }
       /**
       * Creates a new MCP server
@@ -5632,9 +6278,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the created MCP server
       */
       async createMCPServer(mcpServerData) {
-        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers`, mcpServerData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers`, mcpServerData, {});
       }
       /**
       * Updates an existing MCP server
@@ -5643,9 +6287,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the updated MCP server
       */
       async updateMCPServer(mcpServerId, mcpServerData) {
-        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, mcpServerData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, mcpServerData, {});
       }
       /**
       * Deletes an MCP server
@@ -5653,9 +6295,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with confirmation
       */
       async deleteMCPServer(mcpServerId) {
-        return this.httpDelete(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {});
       }
       /**
       * Activates an MCP server
@@ -5663,9 +6303,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the activated MCP server
       */
       async activateMCPServer(mcpServerId) {
-        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/activate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/activate`, {}, {});
       }
       /**
       * Deactivates an MCP server
@@ -5673,9 +6311,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the deactivated MCP server
       */
       async deactivateMCPServer(mcpServerId) {
-        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/deactivate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/deactivate`, {}, {});
       }
       /**
       * Creates or updates an MCP server by name (upsert)
@@ -5683,9 +6319,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the created/updated MCP server
       */
       async upsertMCPServer(mcpServerData) {
-        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers/upsert`, mcpServerData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers/upsert`, mcpServerData, {});
       }
       /**
       * Gets a user profile by email address
@@ -5695,9 +6329,7 @@ var init_developer_api_service = __esm({
       async getUserProfileByEmail(email, agentId) {
         const path3 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
         const scopedPath = agentId ? `${path3}?agentId=${encodeURIComponent(agentId)}` : path3;
-        return this.httpGet(scopedPath, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(scopedPath, {});
       }
       /**
       * Gets a user profile by phone number
@@ -5708,9 +6340,7 @@ var init_developer_api_service = __esm({
         const normalizedPhone = phone.replace(/^\+/, "");
         const path3 = `/developer/user/profile/phone/${normalizedPhone}`;
         const scopedPath = agentId ? `${path3}?agentId=${encodeURIComponent(agentId)}` : path3;
-        return this.httpGet(scopedPath, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(scopedPath, {});
       }
     };
   }
@@ -5726,42 +6356,28 @@ var init_voice_api_service = __esm({
       static {
         __name(this, "VoiceApi");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       async getVoices() {
-        return this.httpGet(`/developer/voice-agents/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/voice-agents/${this.agentId}`, {});
       }
       async createVoice(voiceData) {
-        return this.httpPost(`/developer/voice-agents/${this.agentId}`, voiceData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice-agents/${this.agentId}`, voiceData, {});
       }
       async pushVoice(voiceId, versionData) {
-        return this.httpPost(`/developer/voice-agents/${this.agentId}/${voiceId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice-agents/${this.agentId}/${voiceId}/version`, versionData, {});
       }
       async getVoiceVersions(voiceId) {
-        return this.httpGet(`/developer/voice-agents/${this.agentId}/${voiceId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/voice-agents/${this.agentId}/${voiceId}/versions`, {});
       }
       async publishVoiceVersion(voiceId, version) {
-        return this.httpPut(`/developer/voice-agents/${this.agentId}/${voiceId}/${version}/publish`, void 0, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/voice-agents/${this.agentId}/${voiceId}/${version}/publish`, void 0, {});
       }
       async deleteVoice(voiceId) {
-        return this.httpDelete(`/developer/voice-agents/${this.agentId}/${voiceId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/voice-agents/${this.agentId}/${voiceId}`, {});
       }
       /**
       * Place an outbound voice call. Wraps `POST /developer/voice-agents/:agentId/dispatch`
@@ -5769,9 +6385,7 @@ var init_voice_api_service = __esm({
       * forwarded to the lua-livekit worker which allocates the room and dials.
       */
       async dispatch(input) {
-        return this.httpPost(`/developer/voice-agents/${this.agentId}/dispatch`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice-agents/${this.agentId}/dispatch`, input, {});
       }
       /**
       * Create a voice room + client access token for a custom frontend
@@ -5780,9 +6394,7 @@ var init_voice_api_service = __esm({
       * user. Wraps `POST /developer/voice/:agentId/session`.
       */
       async createSession(input = {}) {
-        return this.httpPost(`/developer/voice/${this.agentId}/session`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice/${this.agentId}/session`, input, {});
       }
       /**
       * Sandbox helper: throws on non-success and returns the unwrapped output.
@@ -5826,34 +6438,25 @@ var init_channels_send_api_service = __esm({
       static {
         __name(this, "ChannelsSendApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       /** POST /developer/agents/:agentId/channels/send */
       async send(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/send`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/send`, input, {});
       }
       /** POST /developer/agents/:agentId/channels/whatsapp/template */
       async sendWhatsAppTemplate(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/template`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/template`, input, {});
       }
       /** POST /developer/agents/:agentId/channels/whatsapp/reaction */
       async sendWhatsAppReaction(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/reaction`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/reaction`, input, {});
       }
       /** POST /developer/agents/:agentId/channels/email/send */
       async sendEmail(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/email/send`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/email/send`, input, {});
       }
       /**
       * Sandbox helper: throws on non-success, returns unwrapped output.
@@ -5916,16 +6519,13 @@ var init_inbox_push_api_service = __esm({
       static {
         __name(this, "InboxPushApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       /** POST /developer/agents/:agentId/inbox/push */
       async push(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/inbox/push`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/inbox/push`, input, {});
       }
     };
   }
@@ -5941,18 +6541,15 @@ var init_directory_api_service = __esm({
       static {
         __name(this, "DirectoryApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       /** POST /developer/agents/:agentId/directory/resolve */
       async resolve(name) {
         return this.httpPost(`/developer/agents/${this.agentId}/directory/resolve`, {
           name
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
       }
       /** Sandbox helper: throws on non-success, returns unwrapped result. */
       async resolveForSandbox(name) {
@@ -5983,71 +6580,47 @@ var init_device_api_service = __esm({
       static {
         __name(this, "DeviceApi");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       async getDevices() {
-        return this.httpGet(`/developer/devices/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/devices/${this.agentId}`, {});
       }
       async createDevice(deviceData) {
-        return this.httpPost(`/developer/devices/${this.agentId}`, deviceData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}`, deviceData, {});
       }
       async pushDevice(deviceId, versionData) {
-        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version`, versionData, {});
       }
       async pushDevDevice(deviceId, versionData) {
-        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version/sandbox`, versionData, {});
       }
       async getDeviceVersions(deviceId) {
-        return this.httpGet(`/developer/devices/${this.agentId}/${deviceId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/devices/${this.agentId}/${deviceId}/versions`, {});
       }
       async publishDeviceVersion(deviceId, version) {
-        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/${version}/publish`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/${version}/publish`, {}, {});
       }
       async deleteDevice(deviceId) {
-        return this.httpDelete(`/developer/devices/${this.agentId}/${deviceId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/devices/${this.agentId}/${deviceId}`, {});
       }
       async sendCommand(deviceName, command, payload, timeout) {
         return this.httpPost(`/developer/devices/${this.agentId}/${deviceName}/command`, {
           command,
           payload,
           timeout: timeout || 3e4
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
       }
       async getDeviceStatus(deviceName) {
-        return this.httpGet(`/developer/devices/${this.agentId}/${deviceName}/status`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/devices/${this.agentId}/${deviceName}/status`, {});
       }
       async enableDevice(deviceName) {
-        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/enable`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/enable`, {}, {});
       }
       async disableDevice(deviceName) {
-        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/disable`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/disable`, {}, {});
       }
     };
   }
@@ -6484,6 +7057,7 @@ var LuaWebhook = class {
   querySchema;
   headerSchema;
   bodySchema;
+  secret;
   executeFunction;
   /**
   * Creates a new LuaWebhook instance.
@@ -6505,9 +7079,17 @@ var LuaWebhook = class {
     this.querySchema = config.querySchema;
     this.headerSchema = config.headerSchema;
     this.bodySchema = config.bodySchema;
+    this.secret = config.secret;
     this.executeFunction = config.execute;
   }
   /**
+  * Gets the webhook's signing key, if one is configured.
+  * Never print this — it is the shared secret callers sign with.
+  */
+  getSecret() {
+    return this.secret;
+  }
+  /**
   * Gets the webhook name.
   */
   getName() {
@@ -6584,12 +7166,16 @@ var LuaTrigger = class {
   verify;
   filter;
   transform;
+  tool;
   constructor(config) {
     if (!config.name || !config.name.trim()) {
       throw new Error("LuaTrigger requires a non-empty `name` (used as the server-side identifier).");
     }
-    if (!config.verify && !config.filter && !config.transform) {
-      throw new Error("LuaTrigger requires at least one of verify, filter, or transform.");
+    if (!config.verify && !config.filter && !config.transform && !config.tool) {
+      throw new Error("LuaTrigger requires at least one of verify, filter, transform, or tool.");
+    }
+    if (config.tool && (!config.tool.name || !config.tool.name.trim())) {
+      throw new Error("LuaTrigger `tool` requires a non-empty `name` (the bare authored tool name).");
     }
     this.name = config.name;
     this.description = config.description;
@@ -6598,6 +7184,7 @@ var LuaTrigger = class {
     this.verify = config.verify;
     this.filter = config.filter;
     this.transform = config.transform;
+    this.tool = config.tool;
   }
   getName() {
     return this.name;