lua-cli 3.28.0 → 3.29.0

package/dist/api-exports.js

@@ -390,10 +390,21 @@ function triggerUrlEnvKey(triggerKey) {
   const upper = triggerKey.trim().replace(/[^A-Za-z0-9]+/g, "_").replace(/^_+|_+$/g, "").toUpperCase();
   return `${TEMPLATE_TRIGGER_URL_ENV_PREFIX}${upper}`;
 }
+function deviceCredentialScopes(operations) {
+  return [
+    ...new Set(operations.map((operation) => DEVICE_SCOPE_BY_OPERATION[operation]))
+  ];
+}
 function parsePrincipalContext(value) {
   const parsed = PrincipalContextSchema.safeParse(value);
   return parsed.success ? parsed.data : void 0;
 }
+function isDeviceCredentialPrincipal(context) {
+  return context?.credential.type === "deviceCredential";
+}
+function hasDeviceCredentialType(value) {
+  return DeviceCredentialClaimSchema.safeParse(value).success;
+}
 function isTypedApiKeyPrincipal(context) {
   return context?.subject.subjectType === "apiKey" && context.credential.type === "apiKey" && !context.compatibility;
 }
@@ -467,7 +478,7 @@ function isKnownProfile(profiles, profileId) {
 function hasCapability(profiles, profileId, required) {
   return capabilitiesFor(profiles, profileId).includes(required);
 }
-var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, PrincipalContextSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema;
+var __defProp2, __name2, CHANNEL_SEND_CHANNELS, REVIEWABLE_ACTION_EXECUTE_TOOL_ALLOWLIST, REVIEWABLE_MCP_SEND_TOOL_SUFFIX, MCP_TOOL_READ_VERB_RE, MCP_DRAFT_CREATE_VERBS, NON_INTERACTIVE_CHANNELS, RICH_PARTS_MESSAGE_ID_PREFIX, SCREENSHOT_MESSAGE_ID_PREFIX, BROWSER_COMMANDS, BROWSER_COMMAND_NAMES, DESKTOP_FILE_COMMANDS, DESKTOP_FILE_COMMAND_SET, REASONING_EFFORT_VALUES, IMPLICIT_MODEL_SELECTION_SOURCES, AGENT_NAME_TOKEN, DEFAULT_PERSONA_GUIDE, PERSONAL_SPACE_STARTING_PERSONA, VoiceNameSchema, PluginProviderSchema, RealtimeProviderSchema, PluginClassSchema, ModelDescriptorSchema, InferenceModelSchema, PluginModelSchema, RealtimeModelSchema, LuaVoiceModelSchema, TurnDetectionSchema, InterruptionSchema, BuiltinAudioClipSchema, AudioConfigSchema, BackgroundAudioEntrySchema, BackgroundAudioSchema, LuaVoiceConfigInnerSchema, LuaVoiceConfigSchema, LuaVoiceRefSchema, LUA_JOB_DEFAULT_TIMEOUT_SECONDS, LUA_JOB_MIN_TIMEOUT_SECONDS, LUA_JOB_MAX_TIMEOUT_SECONDS, TEMPLATE_TRIGGER_URL_ENV_PREFIX, SUBJECT_TYPES, SubjectTypeSchema, CREDENTIAL_TYPES, CredentialTypeSchema, DEVICE_OPERATIONS, DeviceOperationSchema, DEVICE_SCOPE_BY_OPERATION, DeviceBindingSchema, IdSchema, PrincipalDescriptorSchema, ActorDescriptorSchema, PrincipalOwnerSchema, CredentialLifecycleSchema, GeneralCredentialDescriptorSchema, DeviceCredentialDescriptorSchema, GeneralPrincipalContextSchema, DeviceCredentialPrincipalContextSchema, RawPrincipalContextSchema, PrincipalContextSchema, DeviceCredentialClaimSchema, LUA_CLIENT_HEADER, LUA_CLIENT_APPS, SEMVER_PATTERN, WEB_RELEASE_PATTERN, CLIENT_HEADER_PATTERN, AUTHZ_PROJECTION_VERSION, ProjectedScopeSchema, DisplayRoleSchema, AuthorizationPrincipalSchema, CredentialContextSchema, ProjectionAnomalySchema, ProjectedOrgSchema, ProjectedResourceSchema, CapabilityProfilesSchema, RoleCatalogSchema, EffectiveAuthorizationSchema, ResourcePageSchema;
 var init_dist = __esm({
   "../shared-types/dist/index.mjs"() {
     "use strict";
@@ -1153,36 +1164,139 @@ This text is who you are for this person. As you learn them, their name, their w
       "legacyInternalToken"
     ];
     CredentialTypeSchema = z2.enum(CREDENTIAL_TYPES);
-    PrincipalContextSchema = z2.object({
+    DEVICE_OPERATIONS = [
+      "commands",
+      "triggers",
+      "assets.upload"
+    ];
+    DeviceOperationSchema = z2.enum(DEVICE_OPERATIONS);
+    DEVICE_SCOPE_BY_OPERATION = {
+      commands: "automations:write",
+      triggers: "automations:write",
+      "assets.upload": "files:write"
+    };
+    __name(deviceCredentialScopes, "deviceCredentialScopes");
+    __name2(deviceCredentialScopes, "deviceCredentialScopes");
+    DeviceBindingSchema = z2.object({
+      agentId: z2.string().min(1).max(256),
+      deviceName: z2.string().min(1).max(256),
+      operations: z2.array(DeviceOperationSchema).min(1).max(DEVICE_OPERATIONS.length)
+    }).strict().superRefine((binding, context) => {
+      if (new Set(binding.operations).size !== binding.operations.length) {
+        context.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: [
+            "operations"
+          ],
+          message: "Device operations must be unique"
+        });
+      }
+    });
+    IdSchema = z2.string().min(1).max(256);
+    PrincipalDescriptorSchema = z2.object({
+      subjectType: SubjectTypeSchema,
+      subjectId: IdSchema
+    }).strict();
+    ActorDescriptorSchema = z2.object({
+      actorType: SubjectTypeSchema,
+      actorId: IdSchema
+    }).strict();
+    PrincipalOwnerSchema = z2.object({
+      type: z2.enum([
+        "user",
+        "org",
+        "service"
+      ]),
+      id: IdSchema
+    }).strict();
+    CredentialLifecycleSchema = {
+      id: IdSchema.optional(),
+      issuedAt: z2.number().int().nonnegative().optional(),
+      expiresAt: z2.number().int().nonnegative().optional()
+    };
+    GeneralCredentialDescriptorSchema = z2.object({
+      type: z2.enum([
+        "firstPartySession",
+        "apiKey",
+        "endUserSession",
+        "staffAssertion",
+        "serviceCredential",
+        "legacyInternalToken"
+      ]),
+      ...CredentialLifecycleSchema
+    }).strict();
+    DeviceCredentialDescriptorSchema = z2.object({
+      type: z2.literal("deviceCredential"),
+      id: IdSchema,
+      issuedAt: z2.number().int().nonnegative().optional(),
+      expiresAt: z2.number().int().nonnegative().optional(),
+      secretVersion: z2.number().int().positive(),
+      device: DeviceBindingSchema
+    }).strict();
+    GeneralPrincipalContextSchema = z2.object({
+      version: z2.literal(1),
+      subject: PrincipalDescriptorSchema,
+      actor: ActorDescriptorSchema.optional(),
+      credential: GeneralCredentialDescriptorSchema,
+      owner: PrincipalOwnerSchema.optional(),
+      compatibility: z2.object({
+        mode: z2.literal("legacy-owner-delegation")
+      }).strict().optional()
+    }).strict();
+    DeviceCredentialPrincipalContextSchema = z2.object({
       version: z2.literal(1),
       subject: z2.object({
-        subjectType: SubjectTypeSchema,
-        subjectId: z2.string().min(1).max(256)
+        subjectType: z2.literal("apiKey"),
+        subjectId: IdSchema
       }).strict(),
       actor: z2.object({
-        actorType: SubjectTypeSchema,
-        actorId: z2.string().min(1).max(256)
-      }).strict().optional(),
-      credential: z2.object({
-        type: CredentialTypeSchema,
-        id: z2.string().min(1).max(256).optional(),
-        issuedAt: z2.number().int().nonnegative().optional(),
-        expiresAt: z2.number().int().nonnegative().optional()
+        actorType: z2.literal("apiKey"),
+        actorId: IdSchema
       }).strict(),
+      credential: DeviceCredentialDescriptorSchema,
       owner: z2.object({
-        type: z2.enum([
-          "user",
-          "org",
-          "service"
-        ]),
-        id: z2.string().min(1).max(256)
-      }).strict().optional(),
-      compatibility: z2.object({
-        mode: z2.literal("legacy-owner-delegation")
-      }).strict().optional()
-    }).strict();
+        type: z2.literal("user"),
+        id: IdSchema
+      }).strict()
+    }).strict().superRefine((context, refinement) => {
+      const credentialId = context.credential.id;
+      if (context.subject.subjectId !== credentialId) {
+        refinement.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: [
+            "subject",
+            "subjectId"
+          ],
+          message: "Device credential subject must match its credential id"
+        });
+      }
+      if (context.actor.actorId !== credentialId) {
+        refinement.addIssue({
+          code: z2.ZodIssueCode.custom,
+          path: [
+            "actor",
+            "actorId"
+          ],
+          message: "Device credential actor must match its credential id"
+        });
+      }
+    });
+    RawPrincipalContextSchema = z2.union([
+      DeviceCredentialPrincipalContextSchema,
+      GeneralPrincipalContextSchema
+    ]);
+    PrincipalContextSchema = z2.custom((value) => RawPrincipalContextSchema.safeParse(value).success, "Invalid principal context");
     __name(parsePrincipalContext, "parsePrincipalContext");
     __name2(parsePrincipalContext, "parsePrincipalContext");
+    __name(isDeviceCredentialPrincipal, "isDeviceCredentialPrincipal");
+    __name2(isDeviceCredentialPrincipal, "isDeviceCredentialPrincipal");
+    DeviceCredentialClaimSchema = z2.object({
+      credential: z2.object({
+        type: z2.literal("deviceCredential")
+      }).passthrough()
+    }).passthrough();
+    __name(hasDeviceCredentialType, "hasDeviceCredentialType");
+    __name2(hasDeviceCredentialType, "hasDeviceCredentialType");
     __name(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
     __name2(isTypedApiKeyPrincipal, "isTypedApiKeyPrincipal");
     __name(typedApiKeyPrincipalId, "typedApiKeyPrincipalId");
@@ -1196,7 +1310,10 @@ This text is who you are for this person. As you learn them, their name, their w
       "claude-plugin",
       "codex-plugin",
       "cursor-plugin",
-      "platform-mcp"
+      "platform-mcp",
+      "device-node",
+      "device-python",
+      "device-micropython"
     ];
     SEMVER_PATTERN = /^(\d{1,3}\.\d{1,3}\.\d{1,3})(?:-[0-9A-Za-z.-]{1,16})?(?:\+[0-9A-Za-z.-]{1,16})?$/;
     WEB_RELEASE_PATTERN = /^[0-9a-f]{12}$/i;
@@ -1499,8 +1616,354 @@ var init_lua_fetch = __esm({
   }
 });
 
+// src/services/firebase-session.ts
+function requireFirebaseWebApiKey() {
+  if (!FIREBASE_WEB_API_KEY) {
+    throw new Error("Firebase sign-in is not configured for this CLI build.");
+  }
+  return FIREBASE_WEB_API_KEY;
+}
+function parseFirebaseSession(json, now = Date.now()) {
+  const idToken = json.idToken ?? json.id_token;
+  const refreshToken = json.refreshToken ?? json.refresh_token;
+  const expiresIn = Number(json.expiresIn ?? json.expires_in);
+  const uid = json.localId ?? json.user_id;
+  if (typeof idToken !== "string" || idToken.length === 0 || typeof refreshToken !== "string" || refreshToken.length === 0 || typeof uid !== "string" || uid.length === 0 || !Number.isFinite(expiresIn) || expiresIn <= 0) {
+    throw new Error("Sign-in failed because Firebase returned an invalid session.");
+  }
+  return {
+    idToken,
+    refreshToken,
+    expiresAt: now + expiresIn * 1e3,
+    uid
+  };
+}
+async function parseFirebaseError(response) {
+  try {
+    const body = await response.json();
+    const message = body.error?.message;
+    return typeof message === "string" && message ? message.split(":")[0].trim() : response.statusText;
+  } catch {
+    return response.statusText;
+  }
+}
+async function fetchFirebase(url, init, timeoutMessage) {
+  const controller = new AbortController();
+  let timeoutId;
+  const timeout = new Promise((_resolve, reject) => {
+    timeoutId = setTimeout(() => {
+      reject(new Error(timeoutMessage));
+      controller.abort();
+    }, FIREBASE_REQUEST_TIMEOUT_MS);
+  });
+  try {
+    return await Promise.race([
+      fetch(url, {
+        ...init,
+        signal: controller.signal
+      }),
+      timeout
+    ]);
+  } finally {
+    if (timeoutId !== void 0) clearTimeout(timeoutId);
+  }
+}
+async function refreshFirebaseSession(session) {
+  const key = requireFirebaseWebApiKey();
+  const response = await fetchFirebase(`${FIREBASE_REFRESH_URL}?key=${encodeURIComponent(key)}`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/x-www-form-urlencoded"
+    },
+    body: new URLSearchParams({
+      grant_type: "refresh_token",
+      refresh_token: session.refreshToken
+    }).toString()
+  }, "Firebase session refresh timed out after 15 seconds.");
+  if (!response.ok) {
+    throw new Error(`Firebase session refresh failed: ${await parseFirebaseError(response)}`);
+  }
+  const refreshed = parseFirebaseSession(await response.json());
+  if (refreshed.uid !== session.uid) throw new Error("Firebase session refresh returned a different identity.");
+  return refreshed;
+}
+var FIREBASE_REFRESH_URL, FIREBASE_REQUEST_TIMEOUT_MS;
+var init_firebase_session = __esm({
+  "src/services/firebase-session.ts"() {
+    "use strict";
+    init_constants();
+    FIREBASE_REFRESH_URL = "https://securetoken.googleapis.com/v1/token";
+    FIREBASE_REQUEST_TIMEOUT_MS = 15e3;
+    __name(requireFirebaseWebApiKey, "requireFirebaseWebApiKey");
+    __name(parseFirebaseSession, "parseFirebaseSession");
+    __name(parseFirebaseError, "parseFirebaseError");
+    __name(fetchFirebase, "fetchFirebase");
+    __name(refreshFirebaseSession, "refreshFirebaseSession");
+  }
+});
+
+// src/services/firebase-session-store.ts
+import { createHash, randomUUID } from "crypto";
+import { mkdir, open, readFile, rename, unlink } from "fs/promises";
+import { join as join3 } from "path";
+import { z as z4 } from "zod";
+function environmentKey(environment) {
+  return createHash("sha256").update(`${environment.apiUrl}
+${environment.authUrl}
+${environment.firebaseWebApiKey}`).digest("hex").slice(0, 16);
+}
+function isMissing(error) {
+  return typeof error === "object" && error !== null && "code" in error && error.code === "ENOENT";
+}
+var storedFirebaseSessionSchema, currentFirebaseSessionEnvironment, wait, FirebaseSessionStore;
+var init_firebase_session_store = __esm({
+  "src/services/firebase-session-store.ts"() {
+    "use strict";
+    init_constants();
+    storedFirebaseSessionSchema = z4.object({
+      version: z4.literal(1),
+      kind: z4.literal("firebase-session"),
+      generation: z4.string().min(1),
+      refreshToken: z4.string().min(1),
+      firebaseUid: z4.string().min(1),
+      apiUrl: z4.string().url(),
+      authUrl: z4.string().url(),
+      firebaseWebApiKey: z4.string().min(1)
+    });
+    currentFirebaseSessionEnvironment = /* @__PURE__ */ __name(() => ({
+      apiUrl: BASE_URLS.API,
+      authUrl: BASE_URLS.AUTH,
+      firebaseWebApiKey: FIREBASE_WEB_API_KEY
+    }), "currentFirebaseSessionEnvironment");
+    __name(environmentKey, "environmentKey");
+    __name(isMissing, "isMissing");
+    wait = /* @__PURE__ */ __name((milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)), "wait");
+    FirebaseSessionStore = class {
+      static {
+        __name(this, "FirebaseSessionStore");
+      }
+      environment;
+      directory;
+      constructor(root = CLI_CONFIG_DIR, environment = currentFirebaseSessionEnvironment()) {
+        this.environment = environment;
+        this.directory = join3(root, "sessions");
+      }
+      path() {
+        return join3(this.directory, `${environmentKey(this.environment)}.json`);
+      }
+      async read() {
+        let raw;
+        try {
+          raw = await readFile(this.path(), "utf8");
+        } catch (error) {
+          if (isMissing(error)) return null;
+          throw error;
+        }
+        let decoded;
+        try {
+          decoded = JSON.parse(raw);
+        } catch {
+          throw new Error("The stored Lua CLI session is invalid. Run `lua auth configure` again.");
+        }
+        const parsed = storedFirebaseSessionSchema.safeParse(decoded);
+        if (!parsed.success) throw new Error("The stored Lua CLI session is invalid. Run `lua auth configure` again.");
+        if (parsed.data.apiUrl !== this.environment.apiUrl || parsed.data.authUrl !== this.environment.authUrl || parsed.data.firebaseWebApiKey !== this.environment.firebaseWebApiKey) {
+          throw new Error("The stored Lua CLI session belongs to a different environment.");
+        }
+        return parsed.data;
+      }
+      async replace(session) {
+        storedFirebaseSessionSchema.parse(session);
+        if (session.apiUrl !== this.environment.apiUrl || session.authUrl !== this.environment.authUrl || session.firebaseWebApiKey !== this.environment.firebaseWebApiKey) {
+          throw new Error("Cannot store a Lua CLI session for a different environment.");
+        }
+        await this.withLock(async () => this.write(session));
+      }
+      async update(operation) {
+        return this.withLock(async () => {
+          const next = await operation(await this.read());
+          if (next) await this.write(next);
+          else await this.remove();
+          return next;
+        });
+      }
+      async clearIfGeneration(generation) {
+        let cleared = false;
+        await this.update(async (current) => {
+          if (!current || current.generation !== generation) return current;
+          cleared = true;
+          return null;
+        });
+        return cleared;
+      }
+      async write(session) {
+        await mkdir(this.directory, {
+          recursive: true,
+          mode: 448
+        });
+        const temporaryPath = join3(this.directory, `.${environmentKey(this.environment)}.${randomUUID()}.tmp`);
+        const handle = await open(temporaryPath, "wx", 384);
+        try {
+          await handle.writeFile(`${JSON.stringify(session)}
+`, "utf8");
+          await handle.sync();
+        } finally {
+          await handle.close();
+        }
+        await rename(temporaryPath, this.path());
+      }
+      async remove() {
+        try {
+          await unlink(this.path());
+        } catch (error) {
+          if (!isMissing(error)) throw error;
+        }
+      }
+      async withLock(operation) {
+        await mkdir(this.directory, {
+          recursive: true,
+          mode: 448
+        });
+        const lockPath = `${this.path()}.lock`;
+        const lockOwner = randomUUID();
+        const deadline = Date.now() + 2e4;
+        while (true) {
+          try {
+            const handle = await open(lockPath, "wx", 384);
+            try {
+              await handle.writeFile(lockOwner, "utf8");
+              await handle.sync();
+            } finally {
+              await handle.close();
+            }
+            break;
+          } catch (error) {
+            const code = typeof error === "object" && error !== null && "code" in error ? error.code : void 0;
+            if (code !== "EEXIST") throw error;
+            if (Date.now() >= deadline) {
+              throw new Error("Timed out waiting for another Lua CLI process to finish updating the session.");
+            }
+            await wait(50);
+          }
+        }
+        try {
+          return await operation();
+        } finally {
+          try {
+            if (await readFile(lockPath, "utf8") === lockOwner) await unlink(lockPath);
+          } catch (error) {
+            if (!isMissing(error)) throw error;
+          }
+        }
+      }
+    };
+  }
+});
+
+// src/services/request-credential.ts
+import "dotenv/config";
+import { readFileSync as readFileSync2, unlinkSync } from "fs";
+function loadStoredApiKey() {
+  try {
+    return readFileSync2(CREDENTIALS_FILE, "utf8").trim() || null;
+  } catch {
+    return null;
+  }
+}
+function isRequestCredential(value) {
+  return typeof value !== "string";
+}
+async function bearerFor(credential) {
+  return isRequestCredential(credential) ? credential.bearer() : credential;
+}
+async function resolveRequestCredential() {
+  if (process.env.LUA_API_KEY) return new StaticRequestCredential(process.env.LUA_API_KEY, "environment");
+  const store = new FirebaseSessionStore();
+  const session = await store.read();
+  if (session) return new FirebaseRequestCredential(store, session);
+  const storedApiKey = loadStoredApiKey();
+  if (storedApiKey) return new StaticRequestCredential(storedApiKey, "stored");
+  throw new AuthenticationError("No Lua CLI authentication found. Run `lua auth configure` or set LUA_API_KEY.", "invalid_credentials", void 0, true);
+}
+var StaticRequestCredential, FirebaseRequestCredential;
+var init_request_credential = __esm({
+  "src/services/request-credential.ts"() {
+    "use strict";
+    init_constants();
+    init_auth_error();
+    init_lua_fetch();
+    init_firebase_session();
+    init_firebase_session_store();
+    __name(loadStoredApiKey, "loadStoredApiKey");
+    __name(isRequestCredential, "isRequestCredential");
+    __name(bearerFor, "bearerFor");
+    StaticRequestCredential = class StaticRequestCredential2 {
+      static {
+        __name(this, "StaticRequestCredential");
+      }
+      apiKey;
+      descriptor;
+      constructor(apiKey, source) {
+        this.apiKey = apiKey;
+        this.descriptor = {
+          kind: "api-key",
+          source
+        };
+      }
+      async bearer() {
+        return this.apiKey;
+      }
+    };
+    FirebaseRequestCredential = class FirebaseRequestCredential2 {
+      static {
+        __name(this, "FirebaseRequestCredential");
+      }
+      store;
+      descriptor;
+      liveSession;
+      refresh;
+      constructor(store, stored) {
+        this.store = store;
+        this.descriptor = {
+          kind: "first-party-session",
+          source: "stored",
+          uid: stored.firebaseUid
+        };
+      }
+      async bearer() {
+        if (this.liveSession && this.liveSession.expiresAt - Date.now() > 6e4) return this.liveSession.idToken;
+        if (!this.refresh) this.refresh = this.refreshBearer().finally(() => this.refresh = void 0);
+        return this.refresh;
+      }
+      async refreshBearer() {
+        let live;
+        await this.store.update(async (stored) => {
+          if (!stored) {
+            throw new AuthenticationError("Your Lua CLI session has expired. Run `lua auth configure`.", "invalid_credentials");
+          }
+          live = await refreshFirebaseSession({
+            idToken: "",
+            refreshToken: stored.refreshToken,
+            expiresAt: 0,
+            uid: stored.firebaseUid
+          });
+          return {
+            ...stored,
+            refreshToken: live.refreshToken,
+            firebaseUid: live.uid
+          };
+        });
+        if (!live) throw new Error("Firebase session refresh did not return a session.");
+        this.liveSession = live;
+        return live.idToken;
+      }
+    };
+    __name(resolveRequestCredential, "resolveRequestCredential");
+  }
+});
+
 // src/api/http.client.ts
-import { randomUUID } from "crypto";
+import { randomUUID as randomUUID2 } from "crypto";
 function parseRetryAfter(raw) {
   if (!raw) return void 0;
   const seconds = Number.parseInt(raw, 10);
@@ -1512,17 +1975,20 @@ var init_http_client = __esm({
     "use strict";
     init_auth_error();
     init_lua_fetch();
+    init_request_credential();
     HttpClient = class {
       static {
         __name(this, "HttpClient");
       }
       baseUrl;
+      requestCredential;
       /**
       * Creates an instance of HttpClient
       * @param baseUrl - The base URL for all API requests
       */
-      constructor(baseUrl) {
+      constructor(baseUrl, requestCredential) {
         this.baseUrl = baseUrl;
+        this.requestCredential = requestCredential;
       }
       /**
       * Makes an HTTP request with standardized error handling
@@ -1535,12 +2001,16 @@ var init_http_client = __esm({
         const controller = new AbortController();
         const timeoutId = setTimeout(() => controller.abort(), 3e4);
         try {
+          const authorization = this.requestCredential ? `Bearer ${await bearerFor(this.requestCredential)}` : void 0;
           const response = await luaFetch(url, {
             ...options,
             signal: controller.signal,
             headers: {
               "Content-Type": "application/json",
-              ...options.headers
+              ...options.headers,
+              ...authorization ? {
+                Authorization: authorization
+              } : {}
             }
           });
           clearTimeout(timeoutId);
@@ -1559,14 +2029,14 @@ var init_http_client = __esm({
               const isExplicitCredential = !!serverMessage && /(invalid|expired|missing|no)\s+(api[\s_-]?key|token|credential)/i.test(serverMessage);
               const isBareAuthRejection = !serverMessage || /^unauthorized$/i.test(serverMessage);
               if (isExplicitCredential || isBareAuthRejection) {
-                throw new AuthenticationError("Authentication failed. Your API key may be invalid or expired.", "invalid_credentials", serverMessage);
+                throw new AuthenticationError("Authentication failed. Your Lua credential may be invalid or expired.", "invalid_credentials", serverMessage);
               }
               throw new AuthenticationError(`Authentication failed: ${serverMessage}`, "unknown", serverMessage);
             }
             if (response.status === 403) {
               const detail = errorData.message || "You do not have permission to access this resource.";
               throw new Error(`Access denied (403): ${detail}
-Check that your API key has access to this agent/organization.`);
+Check that your Lua login has access to this agent or organization.`);
             }
             return {
               success: false,
@@ -1651,7 +2121,7 @@ Check that your API key has access to this agent/organization.`);
         if (options.method === "POST") {
           const headers = options.headers || {};
           if (!headers["X-Idempotency-Key"]) {
-            headers["X-Idempotency-Key"] = randomUUID();
+            headers["X-Idempotency-Key"] = randomUUID2();
             options = {
               ...options,
               headers: {
@@ -1779,25 +2249,12 @@ var init_auth_api_service = __esm({
 
 // src/services/auth.ts
 import "dotenv/config";
-import { readFileSync as readFileSync2, writeFileSync, mkdirSync, unlinkSync } from "fs";
-function getToken() {
-  if (process.env.LUA_API_KEY) {
-    return process.env.LUA_API_KEY;
-  }
-  try {
-    const token = readFileSync2(CREDENTIALS_FILE, "utf8").trim();
-    if (token) return token;
-  } catch {
-  }
-  throw new AuthenticationError('No API key found.\n\n  Authenticate using one of these methods:\n\n    \u279C  lua auth configure\n    \u279C  export LUA_API_KEY="your-api-key-here"\n    \u279C  Add LUA_API_KEY=... to a .env file\n\n  \u{1F511} Get your API key at https://admin.heylua.ai', "invalid_credentials", void 0, true);
-}
 var init_auth = __esm({
   "src/services/auth.ts"() {
     "use strict";
     init_auth_api_service();
     init_constants();
     init_auth_error();
-    __name(getToken, "getToken");
   }
 });
 
@@ -1869,17 +2326,15 @@ var init_skills_api_service = __esm({
       static {
         __name(this, "SkillApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of SkillApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -1888,9 +2343,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async getSkills() {
-        return this.httpGet(`/developer/skills/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/skills/${this.agentId}`, {});
       }
       /**
       * Creates a new skill for the agent
@@ -1899,9 +2352,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill creation fails or validation errors occur
       */
       async createSkill(skillData) {
-        return this.httpPost(`/developer/skills/${this.agentId}`, skillData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/skills/${this.agentId}`, skillData, {});
       }
       /**
       * Pushes a new version of a skill to production
@@ -1911,9 +2362,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the push operation fails
       */
       async pushSkill(skillId, versionData) {
-        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version`, versionData, {});
       }
       /**
       * Pushes a new development/sandbox version of a skill for testing
@@ -1923,9 +2372,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the push operation fails
       */
       async pushDevSkill(skillId, versionData) {
-        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/skills/${this.agentId}/${skillId}/version/sandbox`, versionData, {});
       }
       /**
       * Updates an existing development/sandbox version of a skill
@@ -1936,9 +2383,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill or version is not found or the update fails
       */
       async updateDevSkill(skillId, sandboxVersionId, versionData) {
-        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/sandbox/${sandboxVersionId}`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/sandbox/${sandboxVersionId}`, versionData, {});
       }
       /**
       * Retrieves all versions of a specific skill
@@ -1947,9 +2392,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the request fails
       */
       async getSkillVersions(skillId) {
-        return this.httpGet(`/developer/skills/${this.agentId}/${skillId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/skills/${this.agentId}/${skillId}/versions`, {});
       }
       /**
       * Publishes a specific version of a skill to production
@@ -1959,9 +2402,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill or version is not found or the publish operation fails
       */
       async publishSkillVersion(skillId, version) {
-        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/${version}/publish`, void 0, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/${version}/publish`, void 0, {});
       }
       /**
       * Deletes a skill and all its versions, or deactivates it if it has versions
@@ -1972,9 +2413,7 @@ var init_skills_api_service = __esm({
       * @throws Error if the skill is not found or the delete operation fails
       */
       async deleteSkill(skillId) {
-        return this.httpDelete(`/developer/skills/${this.agentId}/${skillId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/skills/${this.agentId}/${skillId}`, {});
       }
       /**
       * Attach TS source + workspace archive to a skill version. Powers
@@ -1982,9 +2421,7 @@ var init_skills_api_service = __esm({
       * source without waiting for the next UI-driven build.
       */
       async attachSkillSource(skillId, version, body) {
-        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/${encodeURIComponent(version)}/source`, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/skills/${this.agentId}/${skillId}/version/${encodeURIComponent(version)}/source`, body, {});
       }
     };
   }
@@ -2883,7 +3320,7 @@ var init_analytics = __esm({
   "src/services/analytics.ts"() {
     "use strict";
     init_constants();
-    init_auth();
+    init_request_credential();
     init_files();
   }
 });
@@ -2917,13 +3354,14 @@ var init_cli = __esm({
 });
 
 // src/utils/command-utils.ts
-function requireAuth() {
-  return getToken();
+async function requireAuth() {
+  return resolveRequestCredential();
 }
 var init_command_utils = __esm({
   "src/utils/command-utils.ts"() {
     "use strict";
     init_auth();
+    init_request_credential();
     init_files();
     init_cli();
     __name(requireAuth, "requireAuth");
@@ -3406,17 +3844,15 @@ var init_products_api_service = __esm({
       static {
         __name(this, "ProductApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of ProductApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       async get(pageOrOptions, limitArg) {
@@ -3437,9 +3873,7 @@ var init_products_api_service = __esm({
         if (filter) {
           queryParams.append("filter", JSON.stringify(filter));
         }
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/products?${queryParams.toString()}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/products?${queryParams.toString()}`, {});
         if (response.success) {
           return new ProductPaginationInstance(this, response);
         }
@@ -3452,9 +3886,7 @@ var init_products_api_service = __esm({
       * @throws Error if the product is not found or the request fails
       */
       async getById(productId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/${productId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/${productId}`, {});
         if (response.success && response.data) {
           return new ProductInstance(this, response.data);
         }
@@ -3467,9 +3899,7 @@ var init_products_api_service = __esm({
       * @throws Error if the product creation fails or validation errors occur
       */
       async create(productData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/products`, productData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/products`, productData, {});
         if (response.success && response.data) {
           return new ProductInstance(this, response.data.product);
         }
@@ -3486,9 +3916,7 @@ var init_products_api_service = __esm({
         const response = await this.httpPut(`/developer/agents/${this.agentId}/products`, {
           ...productData,
           id: productId
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3501,9 +3929,7 @@ var init_products_api_service = __esm({
       * @throws Error if the product is not found or the deletion fails
       */
       async delete(productId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/products/${productId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/products/${productId}`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -3517,9 +3943,7 @@ var init_products_api_service = __esm({
       * @throws Error if the search fails or the API request is unsuccessful
       */
       async search(searchQuery, limit = 5) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/search?searchQuery=${encodeURIComponent(searchQuery)}&limit=${limit}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/products/search?searchQuery=${encodeURIComponent(searchQuery)}&limit=${limit}`, {});
         if (response.success) {
           return new ProductSearchInstance(this, response);
         }
@@ -4004,17 +4428,15 @@ var init_order_api_service = __esm({
       static {
         __name(this, "OrderApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of OrderApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -4024,9 +4446,7 @@ var init_order_api_service = __esm({
       * @throws Error if the basket is not found or the order creation fails
       */
       async create(orderData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/order`, orderData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/order`, orderData, {});
         if (response.success && response.data) {
           return new OrderInstance(this, response.data);
         }
@@ -4040,9 +4460,7 @@ var init_order_api_service = __esm({
       * @throws Error if the order is not found or the status update fails
       */
       async updateStatus(status, orderId) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}/${status}`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}/${status}`, {}, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4056,9 +4474,7 @@ var init_order_api_service = __esm({
       * @throws Error if the order is not found or the data update fails
       */
       async updateData(data, orderId) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}`, data, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/order/${orderId}`, data, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4072,9 +4488,7 @@ var init_order_api_service = __esm({
       */
       async get(status) {
         const statusParam = status ? `?status=${status}` : "";
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/user${statusParam}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/user${statusParam}`, {});
         if (response.success && response.data) {
           return response.data.map((order) => new OrderInstance(this, order));
         }
@@ -4087,9 +4501,7 @@ var init_order_api_service = __esm({
       * @throws Error if the order is not found or the request fails
       */
       async getById(orderId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/${orderId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/order/${orderId}`, {});
         if (response.success && response.data) {
           return new OrderInstance(this, response.data);
         }
@@ -4112,17 +4524,17 @@ var init_basket_api_service = __esm({
       static {
         __name(this, "BasketApi");
       }
-      apiKey;
+      credential;
       agentId;
       /**
       * Creates an instance of BasketApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
+        this.credential = credential;
         this.agentId = agentId;
       }
       /**
@@ -4132,9 +4544,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket creation fails or the API request is unsuccessful
       */
       async create(basketData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket`, basketData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket`, basketData, {});
         if (response.success && response.data) {
           return new BasketInstance(this, response.data);
         }
@@ -4148,9 +4558,7 @@ var init_basket_api_service = __esm({
       */
       async get(status) {
         const statusParam = status ? `?status=${status}` : "";
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/user${statusParam}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/user${statusParam}`, {});
         if (response.success && response.data) {
           return response.data.map((basket) => new BasketInstance(this, basket));
         }
@@ -4163,9 +4571,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the request fails
       */
       async getById(basketId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/${basketId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/basket/${basketId}`, {});
         if (response.success && response.data) {
           return new BasketInstance(this, response.data);
         }
@@ -4179,9 +4585,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the item cannot be added
       */
       async addItem(basketId, itemData) {
-        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket/${basketId}/item`, itemData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/agents/${this.agentId}/basket/${basketId}/item`, itemData, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4195,9 +4599,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket or item is not found or the removal fails
       */
       async removeItem(basketId, itemId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/item/${itemId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/item/${itemId}`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4210,9 +4612,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the clear operation fails
       */
       async clear(basketId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/clear`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/basket/${basketId}/clear`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4226,9 +4626,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the status update fails
       */
       async updateStatus(basketId, status) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/${status}`, void 0, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/${status}`, void 0, {});
         if (response.success) {
           return status;
         }
@@ -4242,9 +4640,7 @@ var init_basket_api_service = __esm({
       * @throws Error if the basket is not found or the metadata update fails
       */
       async updateMetadata(basketId, metadata) {
-        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/metadata`, metadata, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(`/developer/agents/${this.agentId}/basket/${basketId}/metadata`, metadata, {});
         if (response.success) {
           return metadata;
         }
@@ -4261,11 +4657,9 @@ var init_basket_api_service = __esm({
         const response = await this.httpPost(`/developer/agents/${this.agentId}/order`, {
           basketId,
           data
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
-          const orderApi = new OrderApi(this.baseUrl, this.apiKey, this.agentId);
+          const orderApi = new OrderApi(this.baseUrl, this.credential, this.agentId);
           return new OrderInstance(orderApi, response.data);
         }
         throw new Error(response.error?.message || "Failed to create order");
@@ -4504,18 +4898,18 @@ var init_user_data_api_service = __esm({
       static {
         __name(this, "UserDataApi");
       }
-      apiKey;
+      credential;
       agentId;
       targetUserId;
       /**
       * Creates an instance of UserDataApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId, targetUserId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId, targetUserId) {
+        super(baseUrl, credential);
+        this.credential = credential;
         this.agentId = agentId;
         this.targetUserId = targetUserId;
       }
@@ -4542,15 +4936,13 @@ var init_user_data_api_service = __esm({
         if (userId) {
           url += `/user/${encodeURIComponent(userId)}`;
         }
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to get user data");
         }
         const profile = response.data?._luaProfile;
         const { _luaProfile, ...data } = response.data || {};
-        const scopedApi = userId ? new _UserDataApi(this.baseUrl, this.apiKey, this.agentId, userId) : this;
+        const scopedApi = userId ? new _UserDataApi(this.baseUrl, this.credential, this.agentId, userId) : this;
         return new UserDataInstance(scopedApi, data, profile);
       }
       /**
@@ -4584,9 +4976,7 @@ var init_user_data_api_service = __esm({
       * @throws Error if the update fails or the request is unsuccessful
       */
       async update(data) {
-        const response = await this.httpPut(this.dataPath, data, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPut(this.dataPath, data, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to update user data");
         }
@@ -4594,9 +4984,7 @@ var init_user_data_api_service = __esm({
         return cleanData;
       }
       async patch(mutation) {
-        const response = await this.httpPatch(this.dataPath, mutation, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPatch(this.dataPath, mutation, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to patch user data");
         }
@@ -4609,9 +4997,7 @@ var init_user_data_api_service = __esm({
       * @throws Error if the clear operation fails or the request is unsuccessful
       */
       async clear() {
-        const response = await this.httpDelete(this.dataPath, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(this.dataPath, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to clear user data");
         }
@@ -4626,9 +5012,7 @@ var init_user_data_api_service = __esm({
       async sendMessage(messages) {
         const response = await this.httpPost(`/admin/agents/${this.agentId}/conversations/me`, {
           messages
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to send message");
         }
@@ -4646,9 +5030,7 @@ var init_user_data_api_service = __esm({
       * ```
       */
       async getChatHistory() {
-        const response = await this.httpGet(`/chat/history/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/chat/history/${this.agentId}`, {});
         if (!response.success) {
           throw new Error(response.error?.message || "Failed to get chat history");
         }
@@ -4874,17 +5256,15 @@ var init_custom_data_api_service = __esm({
       static {
         __name(this, "CustomDataApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of CustomDataApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -4894,9 +5274,7 @@ var init_custom_data_api_service = __esm({
       * @returns Promise resolving to the collections listing
       */
       async collections() {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4924,9 +5302,7 @@ var init_custom_data_api_service = __esm({
           data,
           searchText: options.searchText,
           index: options.index
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
           return new DataEntryInstance(this, response.data, collectionName);
         }
@@ -4947,9 +5323,7 @@ var init_custom_data_api_service = __esm({
           const encodedFilter = encodeURIComponent(JSON.stringify(filter));
           url += `&filter=${encodedFilter}`;
         }
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -4963,9 +5337,7 @@ var init_custom_data_api_service = __esm({
       * @throws Error if the entry is not found or the API request is unsuccessful
       */
       async getEntry(collectionName, entryId) {
-        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {});
         if (response.success && response.data) {
           return new DataEntryInstance(this, response.data, collectionName);
         }
@@ -4989,18 +5361,14 @@ var init_custom_data_api_service = __esm({
           data,
           searchText: options.searchText,
           index: options.index
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
         if (response.success && response.data) {
           return response.data;
         }
         throw new Error(response.error?.message || "Failed to update custom data entry");
       }
       async patch(collectionName, entryId, mutation) {
-        const response = await this.httpPatch(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, mutation, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPatch(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, mutation, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -5017,9 +5385,7 @@ var init_custom_data_api_service = __esm({
       */
       async search(collectionName, searchText, limit = 10, scoreThreshold = 0.6) {
         const url = `/developer/agents/${this.agentId}/custom-data/${collectionName}/search?searchText=${encodeURIComponent(searchText)}&limit=${limit}&scoreThreshold=${scoreThreshold}`;
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success && response.data) {
           return response.data.data.map((entry) => new DataEntryInstance(this, entry, collectionName));
         }
@@ -5033,9 +5399,7 @@ var init_custom_data_api_service = __esm({
       * @throws Error if the entry is not found or the deletion fails
       */
       async delete(collectionName, entryId) {
-        const response = await this.httpDelete(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpDelete(`/developer/agents/${this.agentId}/custom-data/${collectionName}/${entryId}`, {});
         if (response.success && response.data) {
           return response.data;
         }
@@ -5055,17 +5419,15 @@ var init_webhook_api_service = __esm({
       static {
         __name(this, "WebhookApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of WebhookApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -5074,9 +5436,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async getWebhooks() {
-        return this.httpGet(`/developer/webhooks/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/webhooks/${this.agentId}`, {});
       }
       /**
       * Creates a new webhook for the agent
@@ -5085,14 +5445,10 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook creation fails or validation errors occur
       */
       async createWebhook(webhookData) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}`, webhookData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}`, webhookData, {});
       }
       async updateWebhook(webhookId, data) {
-        return this.httpPatch(`/developer/webhooks/${this.agentId}/${webhookId}`, data, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPatch(`/developer/webhooks/${this.agentId}/${webhookId}`, data, {});
       }
       /**
       * Pushes a new version of a webhook to production
@@ -5102,9 +5458,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the push operation fails
       */
       async pushWebhook(webhookId, versionData) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version`, versionData, {});
       }
       /**
       * Pushes a new development/sandbox version of a webhook for testing
@@ -5114,9 +5468,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the push operation fails
       */
       async pushDevWebhook(webhookId, versionData) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox`, versionData, {});
       }
       /**
       * Updates an existing development/sandbox version of a webhook
@@ -5127,9 +5479,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook or version is not found or the update fails
       */
       async updateDevWebhook(webhookId, sandboxVersionId, versionData) {
-        return this.httpPut(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox/${sandboxVersionId}`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/webhooks/${this.agentId}/${webhookId}/version/sandbox/${sandboxVersionId}`, versionData, {});
       }
       /**
       * Retrieves all versions of a specific webhook
@@ -5138,9 +5488,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the request fails
       */
       async getWebhookVersions(webhookId) {
-        return this.httpGet(`/developer/webhooks/${this.agentId}/${webhookId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/webhooks/${this.agentId}/${webhookId}/versions`, {});
       }
       /**
       * Publishes a specific version of a webhook to production
@@ -5150,9 +5498,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook or version is not found or the publish operation fails
       */
       async publishWebhookVersion(webhookId, version) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/${version}/publish`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/${version}/publish`, {}, {});
       }
       /**
       * Activates a webhook (enables it to receive requests)
@@ -5161,9 +5507,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the operation fails
       */
       async activateWebhook(webhookId) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/activate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/activate`, {}, {});
       }
       /**
       * Deactivates a webhook (stops it from receiving requests)
@@ -5172,9 +5516,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the operation fails
       */
       async deactivateWebhook(webhookId) {
-        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/deactivate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/webhooks/${this.agentId}/${webhookId}/deactivate`, {}, {});
       }
       /**
       * Deletes a webhook and all its versions, or deactivates it if it has versions
@@ -5185,9 +5527,7 @@ var init_webhook_api_service = __esm({
       * @throws Error if the webhook is not found or the delete operation fails
       */
       async deleteWebhook(webhookId) {
-        return this.httpDelete(`/developer/webhooks/${this.agentId}/${webhookId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/webhooks/${this.agentId}/${webhookId}`, {});
       }
     };
   }
@@ -5220,7 +5560,7 @@ var init_job_instance = __esm({
         this.activeVersion = jobData.activeVersion;
         this.metadata = jobData.metadata || {};
         if (jobData.userId && jobData.agentId) {
-          this.userApi = new UserDataApi(BASE_URLS.API, jobApi.apiKey, jobApi.agentId);
+          this.userApi = new UserDataApi(BASE_URLS.API, jobApi.credential, jobApi.agentId);
         }
       }
       /**
@@ -5374,17 +5714,17 @@ var init_job_api_service = __esm({
       static {
         __name(this, "JobApi");
       }
-      apiKey;
       agentId;
+      credential;
       /**
       * Creates an instance of JobApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
+        this.credential = credential;
         this.agentId = agentId;
       }
       /**
@@ -5398,9 +5738,7 @@ var init_job_api_service = __esm({
           queryParams.append("includeDynamic", "true");
         }
         const url = `/developer/jobs/${this.agentId}?${queryParams.toString()}`;
-        return this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(url, {});
       }
       /**
       * Retrieves all jobs for the agent as JobInstance array
@@ -5423,9 +5761,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the request fails
       */
       async getJob(jobId) {
-        const response = await this.httpGet(`/developer/jobs/${this.agentId}/${jobId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(`/developer/jobs/${this.agentId}/${jobId}`, {});
         if (response.success && response.data) {
           return new JobInstance(this, response.data);
         }
@@ -5442,9 +5778,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job creation fails or validation errors occur
       */
       async createJob(jobData) {
-        return this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {});
       }
       /**
       * Creates a new job for the agent and returns a JobInstance.
@@ -5457,9 +5791,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job creation fails or validation errors occur
       */
       async createJobInstance(jobData) {
-        const response = await this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(`/developer/jobs/${this.agentId}`, jobData, {});
         if (response.success && response.data) {
           return new JobInstance(this, response.data);
         }
@@ -5473,9 +5805,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the push operation fails
       */
       async pushJob(jobId, versionData) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version`, versionData, {});
       }
       /**
       * Pushes a new development/sandbox version of a job for testing
@@ -5485,9 +5815,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the push operation fails
       */
       async pushDevJob(jobId, versionData) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox`, versionData, {});
       }
       /**
       * Updates an existing development/sandbox version of a job
@@ -5498,9 +5826,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job or version is not found or the update fails
       */
       async updateDevJob(jobId, sandboxVersionId, versionData) {
-        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox/${sandboxVersionId}`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/version/sandbox/${sandboxVersionId}`, versionData, {});
       }
       /**
       * Retrieves all versions of a specific job
@@ -5509,9 +5835,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the request fails
       */
       async getJobVersions(jobId) {
-        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/versions`, {});
       }
       /**
       * Publishes a specific version of a job to production
@@ -5521,9 +5845,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job or version is not found or the publish operation fails
       */
       async publishJobVersion(jobId, version) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/${version}/publish`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/${version}/publish`, {}, {});
       }
       /**
       * Deletes a job and all its versions, or deactivates it if it has versions
@@ -5534,9 +5856,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the delete operation fails
       */
       async deleteJob(jobId) {
-        return this.httpDelete(`/developer/jobs/${this.agentId}/${jobId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/jobs/${this.agentId}/${jobId}`, {});
       }
       /**
       * Activates a job (enables it to run on schedule)
@@ -5545,9 +5865,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the operation fails
       */
       async activateJob(jobId) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/activate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/activate`, {}, {});
       }
       /**
       * Deactivates a job (disables it from running)
@@ -5556,9 +5874,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the operation fails
       */
       async deactivateJob(jobId) {
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/deactivate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/deactivate`, {}, {});
       }
       /**
       * Manually triggers a job execution (ignores schedule)
@@ -5571,9 +5887,7 @@ var init_job_api_service = __esm({
         const body = versionId ? {
           versionId
         } : {};
-        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/trigger`, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/jobs/${this.agentId}/${jobId}/trigger`, body, {});
       }
       /**
       * Retrieves execution history for a job
@@ -5583,9 +5897,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the request fails
       */
       async getJobExecutions(jobId, limit = 50) {
-        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/executions?limit=${limit}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/jobs/${this.agentId}/${jobId}/executions?limit=${limit}`, {});
       }
       /**
       * Updates the metadata of a job
@@ -5595,9 +5907,7 @@ var init_job_api_service = __esm({
       * @throws Error if the job is not found or the metadata update fails
       */
       async updateMetadata(jobId, metadata) {
-        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/metadata`, metadata, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/jobs/${this.agentId}/${jobId}/metadata`, metadata, {});
       }
     };
   }
@@ -5614,15 +5924,12 @@ var init_ai_api_service = __esm({
       static {
         __name(this, "AiApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       async generate(body) {
-        return this.httpPost(`/developer/ai/${this.agentId}/generate`, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/ai/${this.agentId}/generate`, body, {});
       }
       /**
       * Handles the simplified-vs-full-options branching for `AI.generate`.
@@ -5659,15 +5966,12 @@ var init_integrations_api_service = __esm({
       static {
         __name(this, "IntegrationsApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       async passthrough(integrationType, request) {
-        return this.httpPost(`/developer/unifiedto/connections/${encodeURIComponent(this.agentId)}/passthrough/${encodeURIComponent(integrationType)}`, request, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/unifiedto/connections/${encodeURIComponent(this.agentId)}/passthrough/${encodeURIComponent(integrationType)}`, request, {});
       }
       /**
       * Sandbox-facing wrapper: returns the raw provider envelope
@@ -5696,9 +6000,8 @@ var init_agents_api_service = __esm({
       static {
         __name(this, "AgentsApiService");
       }
-      apiKey;
-      constructor(baseUrl, apiKey) {
-        super(baseUrl), this.apiKey = apiKey;
+      constructor(baseUrl, credential) {
+        super(baseUrl, credential);
       }
       async invoke(targetAgentId, body) {
         const channel = body.channel ?? "agent-invocation";
@@ -5707,9 +6010,7 @@ var init_agents_api_service = __esm({
         });
         if (body.identifier) query.set("identifier", body.identifier);
         const chatBody = this.toChatGenerateBody(body);
-        return this.httpPost(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/chat/generate/${targetAgentId}?${query.toString()}`, chatBody, {});
       }
       /**
       * Sandbox overload: mirrors the `AI.generate` pattern where the simplified
@@ -5770,17 +6071,15 @@ var init_whatsapp_templates_api_service = __esm({
       static {
         __name(this, "WhatsAppTemplatesApiService");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of WhatsAppTemplatesApiService
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -5797,9 +6096,7 @@ var init_whatsapp_templates_api_service = __esm({
         if (search) {
           url += `&search=${encodeURIComponent(search)}`;
         }
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success) {
           return response.data;
         }
@@ -5813,9 +6110,7 @@ var init_whatsapp_templates_api_service = __esm({
       */
       async get(channelId, templateId) {
         const url = `/admin/agents/${this.agentId}/channels/${channelId}/whatsapp-templates/${templateId}`;
-        const response = await this.httpGet(url, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpGet(url, {});
         if (response.success) {
           return response.data;
         }
@@ -5834,9 +6129,7 @@ var init_whatsapp_templates_api_service = __esm({
           phone_numbers: data.phoneNumbers,
           values: data.values
         };
-        const response = await this.httpPost(url, body, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        const response = await this.httpPost(url, body, {});
         if (response.success) {
           return response.data;
         }
@@ -5852,15 +6145,16 @@ var init_cdn_api_service = __esm({
   "src/api/cdn.api.service.ts"() {
     "use strict";
     init_lua_fetch();
+    init_request_credential();
     CdnApi = class {
       static {
         __name(this, "CdnApi");
       }
       baseUrl;
-      apiKey;
-      constructor(baseUrl, apiKey) {
+      credential;
+      constructor(baseUrl, credential) {
         this.baseUrl = baseUrl;
-        this.apiKey = apiKey;
+        this.credential = credential;
       }
       /**
       * Uploads a file to the CDN
@@ -5873,7 +6167,7 @@ var init_cdn_api_service = __esm({
         const response = await luaFetch(`${this.baseUrl}/upload`, {
           method: "POST",
           headers: {
-            Authorization: `Bearer ${this.apiKey}`
+            Authorization: `Bearer ${await bearerFor(this.credential)}`
           },
           body: formData
         });
@@ -5917,17 +6211,15 @@ var init_developer_api_service = __esm({
       static {
         __name(this, "DeveloperApi");
       }
-      apiKey;
       agentId;
       /**
       * Creates an instance of DeveloperApi
       * @param baseUrl - The base URL for the API
-      * @param apiKey - The API key for authentication
+      * @param credential - The API key for authentication
       * @param agentId - The unique identifier of the agent
       */
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       /**
@@ -5937,9 +6229,7 @@ var init_developer_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async getEnvironmentVariables() {
-        return this.httpGet(`/developer/agents/${this.agentId}/env`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/env`, {});
       }
       /**
       * Updates all environment variables for the agent in production
@@ -5949,9 +6239,7 @@ var init_developer_api_service = __esm({
       * @throws Error if the API request fails or the agent is not found
       */
       async updateEnvironmentVariables(envData) {
-        return this.httpPost(`/developer/agents/${this.agentId}/env`, envData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/env`, envData, {});
       }
       /**
       * Deletes a specific environment variable by key
@@ -5960,27 +6248,21 @@ var init_developer_api_service = __esm({
       * @throws Error if the API request fails, the agent is not found, or the key doesn't exist
       */
       async deleteEnvironmentVariable(key) {
-        return this.httpDelete(`/developer/agents/${this.agentId}/env/${key}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/agents/${this.agentId}/env/${key}`, {});
       }
       /**
       * Retrieves all MCP server configurations for the agent
       * @returns Promise resolving to an ApiResponse containing MCP server configurations
       */
       async getMCPServers() {
-        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers`, {});
       }
       /**
       * Retrieves only active MCP server configurations for the agent
       * @returns Promise resolving to an ApiResponse containing active MCP server configurations
       */
       async getActiveMCPServers() {
-        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/active`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/active`, {});
       }
       /**
       * Gets a single MCP server by ID
@@ -5988,9 +6270,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the MCP server
       */
       async getMCPServer(mcpServerId) {
-        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {});
       }
       /**
       * Creates a new MCP server
@@ -5998,9 +6278,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the created MCP server
       */
       async createMCPServer(mcpServerData) {
-        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers`, mcpServerData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers`, mcpServerData, {});
       }
       /**
       * Updates an existing MCP server
@@ -6009,9 +6287,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the updated MCP server
       */
       async updateMCPServer(mcpServerId, mcpServerData) {
-        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, mcpServerData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, mcpServerData, {});
       }
       /**
       * Deletes an MCP server
@@ -6019,9 +6295,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with confirmation
       */
       async deleteMCPServer(mcpServerId) {
-        return this.httpDelete(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}`, {});
       }
       /**
       * Activates an MCP server
@@ -6029,9 +6303,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the activated MCP server
       */
       async activateMCPServer(mcpServerId) {
-        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/activate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/activate`, {}, {});
       }
       /**
       * Deactivates an MCP server
@@ -6039,9 +6311,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the deactivated MCP server
       */
       async deactivateMCPServer(mcpServerId) {
-        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/deactivate`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/agents/${this.agentId}/mcp-servers/${mcpServerId}/deactivate`, {}, {});
       }
       /**
       * Creates or updates an MCP server by name (upsert)
@@ -6049,9 +6319,7 @@ var init_developer_api_service = __esm({
       * @returns Promise resolving to an ApiResponse with the created/updated MCP server
       */
       async upsertMCPServer(mcpServerData) {
-        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers/upsert`, mcpServerData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/mcp-servers/upsert`, mcpServerData, {});
       }
       /**
       * Gets a user profile by email address
@@ -6061,9 +6329,7 @@ var init_developer_api_service = __esm({
       async getUserProfileByEmail(email, agentId) {
         const path3 = `/developer/user/profile/email/${encodeURIComponent(email)}`;
         const scopedPath = agentId ? `${path3}?agentId=${encodeURIComponent(agentId)}` : path3;
-        return this.httpGet(scopedPath, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(scopedPath, {});
       }
       /**
       * Gets a user profile by phone number
@@ -6074,9 +6340,7 @@ var init_developer_api_service = __esm({
         const normalizedPhone = phone.replace(/^\+/, "");
         const path3 = `/developer/user/profile/phone/${normalizedPhone}`;
         const scopedPath = agentId ? `${path3}?agentId=${encodeURIComponent(agentId)}` : path3;
-        return this.httpGet(scopedPath, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(scopedPath, {});
       }
     };
   }
@@ -6092,42 +6356,28 @@ var init_voice_api_service = __esm({
       static {
         __name(this, "VoiceApi");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       async getVoices() {
-        return this.httpGet(`/developer/voice-agents/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/voice-agents/${this.agentId}`, {});
       }
       async createVoice(voiceData) {
-        return this.httpPost(`/developer/voice-agents/${this.agentId}`, voiceData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice-agents/${this.agentId}`, voiceData, {});
       }
       async pushVoice(voiceId, versionData) {
-        return this.httpPost(`/developer/voice-agents/${this.agentId}/${voiceId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice-agents/${this.agentId}/${voiceId}/version`, versionData, {});
       }
       async getVoiceVersions(voiceId) {
-        return this.httpGet(`/developer/voice-agents/${this.agentId}/${voiceId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/voice-agents/${this.agentId}/${voiceId}/versions`, {});
       }
       async publishVoiceVersion(voiceId, version) {
-        return this.httpPut(`/developer/voice-agents/${this.agentId}/${voiceId}/${version}/publish`, void 0, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPut(`/developer/voice-agents/${this.agentId}/${voiceId}/${version}/publish`, void 0, {});
       }
       async deleteVoice(voiceId) {
-        return this.httpDelete(`/developer/voice-agents/${this.agentId}/${voiceId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/voice-agents/${this.agentId}/${voiceId}`, {});
       }
       /**
       * Place an outbound voice call. Wraps `POST /developer/voice-agents/:agentId/dispatch`
@@ -6135,9 +6385,7 @@ var init_voice_api_service = __esm({
       * forwarded to the lua-livekit worker which allocates the room and dials.
       */
       async dispatch(input) {
-        return this.httpPost(`/developer/voice-agents/${this.agentId}/dispatch`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice-agents/${this.agentId}/dispatch`, input, {});
       }
       /**
       * Create a voice room + client access token for a custom frontend
@@ -6146,9 +6394,7 @@ var init_voice_api_service = __esm({
       * user. Wraps `POST /developer/voice/:agentId/session`.
       */
       async createSession(input = {}) {
-        return this.httpPost(`/developer/voice/${this.agentId}/session`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/voice/${this.agentId}/session`, input, {});
       }
       /**
       * Sandbox helper: throws on non-success and returns the unwrapped output.
@@ -6192,34 +6438,25 @@ var init_channels_send_api_service = __esm({
       static {
         __name(this, "ChannelsSendApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       /** POST /developer/agents/:agentId/channels/send */
       async send(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/send`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/send`, input, {});
       }
       /** POST /developer/agents/:agentId/channels/whatsapp/template */
       async sendWhatsAppTemplate(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/template`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/template`, input, {});
       }
       /** POST /developer/agents/:agentId/channels/whatsapp/reaction */
       async sendWhatsAppReaction(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/reaction`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/whatsapp/reaction`, input, {});
       }
       /** POST /developer/agents/:agentId/channels/email/send */
       async sendEmail(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/channels/email/send`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/channels/email/send`, input, {});
       }
       /**
       * Sandbox helper: throws on non-success, returns unwrapped output.
@@ -6282,16 +6519,13 @@ var init_inbox_push_api_service = __esm({
       static {
         __name(this, "InboxPushApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       /** POST /developer/agents/:agentId/inbox/push */
       async push(input) {
-        return this.httpPost(`/developer/agents/${this.agentId}/inbox/push`, input, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/agents/${this.agentId}/inbox/push`, input, {});
       }
     };
   }
@@ -6307,18 +6541,15 @@ var init_directory_api_service = __esm({
       static {
         __name(this, "DirectoryApiService");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl), this.apiKey = apiKey, this.agentId = agentId;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential), this.agentId = agentId;
       }
       /** POST /developer/agents/:agentId/directory/resolve */
       async resolve(name) {
         return this.httpPost(`/developer/agents/${this.agentId}/directory/resolve`, {
           name
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
       }
       /** Sandbox helper: throws on non-success, returns unwrapped result. */
       async resolveForSandbox(name) {
@@ -6349,71 +6580,47 @@ var init_device_api_service = __esm({
       static {
         __name(this, "DeviceApi");
       }
-      apiKey;
       agentId;
-      constructor(baseUrl, apiKey, agentId) {
-        super(baseUrl);
-        this.apiKey = apiKey;
+      constructor(baseUrl, credential, agentId) {
+        super(baseUrl, credential);
         this.agentId = agentId;
       }
       async getDevices() {
-        return this.httpGet(`/developer/devices/${this.agentId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/devices/${this.agentId}`, {});
       }
       async createDevice(deviceData) {
-        return this.httpPost(`/developer/devices/${this.agentId}`, deviceData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}`, deviceData, {});
       }
       async pushDevice(deviceId, versionData) {
-        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version`, versionData, {});
       }
       async pushDevDevice(deviceId, versionData) {
-        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version/sandbox`, versionData, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/version/sandbox`, versionData, {});
       }
       async getDeviceVersions(deviceId) {
-        return this.httpGet(`/developer/devices/${this.agentId}/${deviceId}/versions`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/devices/${this.agentId}/${deviceId}/versions`, {});
       }
       async publishDeviceVersion(deviceId, version) {
-        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/${version}/publish`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPost(`/developer/devices/${this.agentId}/${deviceId}/${version}/publish`, {}, {});
       }
       async deleteDevice(deviceId) {
-        return this.httpDelete(`/developer/devices/${this.agentId}/${deviceId}`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpDelete(`/developer/devices/${this.agentId}/${deviceId}`, {});
       }
       async sendCommand(deviceName, command, payload, timeout) {
         return this.httpPost(`/developer/devices/${this.agentId}/${deviceName}/command`, {
           command,
           payload,
           timeout: timeout || 3e4
-        }, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        }, {});
       }
       async getDeviceStatus(deviceName) {
-        return this.httpGet(`/developer/devices/${this.agentId}/${deviceName}/status`, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpGet(`/developer/devices/${this.agentId}/${deviceName}/status`, {});
       }
       async enableDevice(deviceName) {
-        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/enable`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/enable`, {}, {});
       }
       async disableDevice(deviceName) {
-        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/disable`, {}, {
-          Authorization: `Bearer ${this.apiKey}`
-        });
+        return this.httpPatch(`/developer/devices/${this.agentId}/${deviceName}/disable`, {}, {});
       }
     };
   }