lua-cli 3.28.0 → 3.29.1

package/README.md

@@ -44,7 +44,7 @@ lua --version
 
 ## Authentication
 
-lua-cli authenticates using your API key. Get yours at [admin.heylua.ai](https://admin.heylua.ai).
+lua-cli authenticates with a scoped personal credential or an existing API key. New email login limits the credential to the organization, agents, and role you select. Existing scoped and non-dotted legacy keys remain supported when you supply them directly.
 
 The key is resolved from the following sources in priority order:
 
@@ -60,21 +60,31 @@ The key is resolved from the following sources in priority order:
 lua auth configure
 ```
 
-Prompts you to choose between entering an API key directly or authenticating via email OTP. Credentials are saved to `~/.lua-cli/credentials`.
+Choose **Email** to confirm an OTP. Select one organization, one or more agents, and an assignable role. Builder is the default role. The CLI stores the scoped credential in `~/.lua-cli/credentials` with mode `0600` on POSIX systems.
+
+Choose **API Key** to validate and save an existing scoped or legacy key unchanged. The CLI does not rotate or revoke the supplied key.
 
 ```bash
 # Non-interactive variants:
-lua auth configure --api-key "lk_your_api_key_here"
-lua auth configure --email user@example.com            # Step 1: sends OTP
-lua auth configure --email user@example.com --otp 123456  # Step 2: verifies OTP
+lua auth configure --api-key "your-api-key"
+lua auth configure --email user@example.com
+lua auth configure \
+  --email user@example.com \
+  --otp 123456 \
+  --org-id org_123 \
+  --agent-id agent_123 \
+  --role builder \
+  --name "deployment laptop"
 ```
 
+Repeat `--agent-id` to bind the credential to more than one agent. For a new local login, prefer the interactive command and keep the email, OTP, and secret out of AI conversations.
+
 ### Option B — Environment variable (CI/CD, Docker, servers)
 
 Set `LUA_API_KEY` in your environment. This takes priority over all other sources and requires no file on disk — ideal for headless servers, VMs, and containers.
 
 ```bash
-export LUA_API_KEY="lk_your_api_key_here"
+export LUA_API_KEY="your-api-key"
 lua push all --force --auto-deploy
 ```
 
@@ -83,7 +93,7 @@ lua push all --force --auto-deploy
 Create a `.env` file in your project root:
 
 ```bash
-echo 'LUA_API_KEY=lk_your_api_key_here' >> .env
+echo 'LUA_API_KEY=your-api-key' >> .env
 ```
 
 lua-cli automatically loads `.env` on startup. Add `.env` to your `.gitignore` to avoid committing credentials.
@@ -138,7 +148,7 @@ lua auth logout --force  # No prompt
 lua auth configure
 ```
 
-Enter your API key when prompted (get one at [admin.heylua.ai](https://admin.heylua.ai)). For CI/CD or server environments, set `LUA_API_KEY` as an environment variable instead — see [Authentication](#authentication) above.
+Choose **Email** and select the organization, agents, and role for the new scoped credential. If you already have a working key, choose **API Key** to keep using it unchanged. For CI or server environments, set `LUA_API_KEY` from a secret manager. See [Authentication](#authentication).
 
 ### 2. Initialize Project
 

package/dist/api-exports.d.ts

@@ -1777,11 +1777,12 @@ declare type HeadersResolverFunction = () => Record<string, string>;
  */
 declare abstract class HttpClient {
     protected baseUrl: string;
+    private readonly requestCredential?;
     /**
      * Creates an instance of HttpClient
      * @param baseUrl - The base URL for all API requests
      */
-    constructor(baseUrl: string);
+    constructor(baseUrl: string, requestCredential?: RequestCredentialInput | undefined);
     /**
      * Makes an HTTP request with standardized error handling
      * @param url - The full URL to request
@@ -1839,6 +1840,7 @@ declare abstract class HttpClient {
      * cannot be recovered after an ambiguous network or server failure.
      */
     protected httpPostOnce<T>(url: string, data?: any, headers?: Record<string, string>): Promise<ApiResponse<T>>;
+    protected httpPostCoreDrainRetry<T>(url: string, data?: any, headers?: Record<string, string>): Promise<ApiResponse<T>>;
     /**
      * Performs an HTTP PUT request
      * @param url - The relative URL path to request (will be appended to baseUrl)
@@ -2078,15 +2080,15 @@ declare interface Job {
  * Handles all job-related API calls
  */
 declare class JobApi extends HttpClient {
-    apiKey: string;
     agentId: string;
+    readonly credential: RequestCredentialInput;
     /**
      * Creates an instance of JobApi
      * @param baseUrl - The base URL for the API
-     * @param apiKey - The API key for authentication
+     * @param credential - The API key for authentication
      * @param agentId - The unique identifier of the agent
      */
-    constructor(baseUrl: string, apiKey: string, agentId: string);
+    constructor(baseUrl: string, credential: RequestCredentialInput, agentId: string);
     /**
      * Retrieves all jobs for the agent
      * @returns Promise resolving to an ApiResponse containing an array of jobs with their versions
@@ -4635,15 +4637,14 @@ declare interface OrderAPI {
 }
 
 declare class OrderApi extends HttpClient implements OrderAPI {
-    private apiKey;
     private agentId;
     /**
      * Creates an instance of OrderApi
      * @param baseUrl - The base URL for the API
-     * @param apiKey - The API key for authentication
+     * @param credential - The API key for authentication
      * @param agentId - The unique identifier of the agent
      */
-    constructor(baseUrl: string, apiKey: string, agentId: string);
+    constructor(baseUrl: string, credential: RequestCredentialInput, agentId: string);
     /**
      * Creates a new order from a basket
      * @param orderData - The order creation request data containing basketId and additional order information
@@ -5463,6 +5464,22 @@ declare const REASONING_EFFORT_VALUES: readonly ["off", "minimal", "low", "mediu
 
 declare type ReasoningEffort = (typeof REASONING_EFFORT_VALUES)[number];
 
+declare interface RequestCredential {
+    readonly descriptor: RequestCredentialDescriptor;
+    bearer(): Promise<string>;
+}
+
+declare type RequestCredentialDescriptor = {
+    kind: 'api-key';
+    source: 'environment' | 'stored';
+} | {
+    kind: 'first-party-session';
+    source: 'stored';
+    uid: string;
+};
+
+declare type RequestCredentialInput = string | RequestCredential;
+
 /**
  * Additive field on primitive publish responses. When the agent is under
  * versioning the server performs a scoped promote and returns the newly