@run402/sdk 4.121.0 → 4.122.1

package/dist/stale-project-key.d.ts

@@ -0,0 +1,14 @@
+import type { ProjectKeys } from "./credentials.js";
+import type { Client } from "./kernel.js";
+/** The cached keys for `projectId`, or null when none are cached or this process saw the service key refused. */
+export declare function usableProjectKeys(client: Client, projectId: string): Promise<ProjectKeys | null>;
+/** The command that drops a stale entry from this machine's project-key cache. */
+export declare function deleteCachedProjectKeysCommand(projectId: string): string;
+/**
+ * Run `call` with the cached keys; when the gateway refuses the cached key at
+ * authentication, run it once more as the caller's principal (`call(null)`).
+ * When the principal is refused too (no wallet or session), throw the
+ * original refusal with the stale cache entry named.
+ */
+export declare function withPrincipalFallback<T>(client: Client, projectId: string, keys: ProjectKeys | null, call: (keys: ProjectKeys | null) => Promise<T>): Promise<T>;
+//# sourceMappingURL=stale-project-key.d.ts.map

package/dist/stale-project-key.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-project-key.d.ts","sourceRoot":"","sources":["../src/stale-project-key.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAqC1C,iHAAiH;AACjH,wBAAsB,iBAAiB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,CAItG;AAMD,kFAAkF;AAClF,wBAAgB,8BAA8B,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAExE;AAyBD;;;;;GAKG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAC3C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,WAAW,GAAG,IAAI,EACxB,IAAI,EAAE,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,GAC7C,OAAO,CAAC,CAAC,CAAC,CAaZ"}

package/dist/stale-project-key.js

@@ -0,0 +1,88 @@
+import { isRun402Error, Unauthorized } from "./errors.js";
+/**
+ * A locally cached project key the gateway refused at authentication.
+ *
+ * The project database routes (SQL, schema, project REST) accept either a
+ * service key or the caller's own principal, and the gateway picks the chain by
+ * the credential's shape, so it cannot fall back on its own: a cached key that
+ * expired or was revoked fails every call even when the caller's wallet or
+ * sign-in session would be authorized. These helpers make that fallback on the
+ * client.
+ *
+ * The codes below come only from the credential check that runs before any
+ * route handler (revoked or expired, an unknown secret, an unverifiable legacy
+ * key), so the refused request had no effect and repeating it as the
+ * principal is safe for reads and writes alike.
+ */
+const STALE_PROJECT_KEY_CODES = new Set(["CREDENTIAL_REVOKED", "CREDENTIAL_MISSING", "INVALID_AUTH"]);
+/**
+ * Keys this credentials provider has seen refused, per project, so later calls
+ * in the same process go straight to the principal. Keyed by the key value, so
+ * re-importing a fresh key makes it usable again.
+ */
+const refusedKeys = new WeakMap();
+function refusedFor(client) {
+    const owner = client.credentials;
+    let map = refusedKeys.get(owner);
+    if (!map) {
+        map = new Map();
+        refusedKeys.set(owner, map);
+    }
+    return map;
+}
+/** The cached keys for `projectId`, or null when none are cached or this process saw the service key refused. */
+export async function usableProjectKeys(client, projectId) {
+    const keys = await client.getProjectCredentials(projectId);
+    if (!keys)
+        return null;
+    return refusedFor(client).get(projectId) === keys.service_key ? null : keys;
+}
+function isStaleKeyRefusal(err) {
+    return isRun402Error(err) && err.status === 401 && STALE_PROJECT_KEY_CODES.has(err.code ?? "");
+}
+/** The command that drops a stale entry from this machine's project-key cache. */
+export function deleteCachedProjectKeysCommand(projectId) {
+    return `run402 credentials project-keys delete --project ${projectId}`;
+}
+/** The gateway's refusal, with the stale local cache entry named as the first next action. */
+function staleKeyError(err, projectId) {
+    const body = err.body && typeof err.body === "object" && !Array.isArray(err.body)
+        ? err.body
+        : {};
+    const remove = {
+        type: "run_cli_command",
+        command: deleteCachedProjectKeysCommand(projectId),
+        why: "This machine's cached project key was refused. Delete the stale cache entry so the call goes as your wallet or sign-in session, or re-key with `run402 credentials issue --kind service --name <name> --import`.",
+    };
+    const existing = Array.isArray(body.next_actions) ? body.next_actions : [];
+    return new Unauthorized(err.message, err.status, {
+        ...body,
+        hint: "The locally cached project key was refused (expired, revoked or unknown), and no wallet or sign-in session could make the call instead.",
+        next_actions: [remove, ...existing],
+    }, err.context);
+}
+/**
+ * Run `call` with the cached keys; when the gateway refuses the cached key at
+ * authentication, run it once more as the caller's principal (`call(null)`).
+ * When the principal is refused too (no wallet or session), throw the
+ * original refusal with the stale cache entry named.
+ */
+export async function withPrincipalFallback(client, projectId, keys, call) {
+    try {
+        return await call(keys);
+    }
+    catch (err) {
+        if (!keys || !isStaleKeyRefusal(err))
+            throw err;
+        refusedFor(client).set(projectId, keys.service_key);
+        try {
+            return await call(null);
+        }
+        catch (retryErr) {
+            if (isRun402Error(retryErr) && retryErr.status === 401)
+                throw staleKeyError(err, projectId);
+            throw retryErr;
+        }
+    }
+}
+//# sourceMappingURL=stale-project-key.js.map

package/dist/stale-project-key.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"stale-project-key.js","sourceRoot":"","sources":["../src/stale-project-key.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,aAAa,EAAE,YAAY,EAAqC,MAAM,aAAa,CAAC;AAE7F;;;;;;;;;;;;;;GAcG;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,oBAAoB,EAAE,oBAAoB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEtG;;;;GAIG;AACH,MAAM,WAAW,GAAG,IAAI,OAAO,EAA+B,CAAC;AAE/D,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAG,MAAM,CAAC,WAAqB,CAAC;IAC3C,IAAI,GAAG,GAAG,WAAW,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC;QAChB,WAAW,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAC9B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iHAAiH;AACjH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,SAAiB;IACvE,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC9E,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAY;IACrC,OAAO,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,uBAAuB,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,8BAA8B,CAAC,SAAiB;IAC9D,OAAO,oDAAoD,SAAS,EAAE,CAAC;AACzE,CAAC;AAED,8FAA8F;AAC9F,SAAS,aAAa,CAAC,GAAgB,EAAE,SAAiB;IACxD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAC/E,CAAC,CAAE,GAAG,CAAC,IAAgC;QACvC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,MAAM,GAAe;QACzB,IAAI,EAAE,iBAAiB;QACvB,OAAO,EAAE,8BAA8B,CAAC,SAAS,CAAC;QAClD,GAAG,EAAE,kNAAkN;KACxN,CAAC;IACF,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC,CAAE,IAAI,CAAC,YAA6B,CAAC,CAAC,CAAC,EAAE,CAAC;IAC7F,OAAO,IAAI,YAAY,CACrB,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,MAAM,EACV;QACE,GAAG,IAAI;QACP,IAAI,EAAE,yIAAyI;QAC/I,YAAY,EAAE,CAAC,MAAM,EAAE,GAAG,QAAQ,CAAC;KACpC,EACD,GAAG,CAAC,OAAO,CACZ,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,MAAc,EACd,SAAiB,EACjB,IAAwB,EACxB,IAA8C;IAE9C,IAAI,CAAC;QACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,IAAI,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC;QAChD,UAAU,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,WAAW,CAAC,CAAC;QACpD,IAAI,CAAC;YACH,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC;QAAC,OAAO,QAAQ,EAAE,CAAC;YAClB,IAAI,aAAa,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG;gBAAE,MAAM,aAAa,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAC5F,MAAM,QAAQ,CAAC;QACjB,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/type-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"type-contract.d.ts","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AAoNA,OAAO,EAAE,CAAC"}
+{"version":3,"file":"type-contract.d.ts","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AAiOA,OAAO,EAAE,CAAC"}

package/dist/type-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"type-contract.js","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AAuHA,MAAM,sBAAsB,GAAuB,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;AACrG,MAAM,qBAAqB,GAAuB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACtE,KAAK,sBAAsB,CAAC;AAC5B,KAAK,qBAAqB,CAAC;AAC3B,KAAM,IAAuC,CAAC;AAG9C,MAAM,uBAAuB,GAAwB,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/E,MAAM,sBAAsB,GAAwB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC3E,MAAM,4BAA4B,GAAqC,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAClH,KAAK,uBAAuB,CAAC;AAC7B,KAAK,sBAAsB,CAAC;AAC5B,KAAK,4BAA4B,CAAC;AAClC,KAAM,IAAwC,CAAC;AAG/C,MAAM,oBAAoB,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjE,MAAM,mBAAmB,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChE,MAAM,0BAA0B,GAAqC,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/G,KAAK,oBAAoB,CAAC;AAC1B,KAAK,mBAAmB,CAAC;AACzB,KAAK,0BAA0B,CAAC;AAChC,KAAM,IAAqC,CAAC;AAG5C,MAAM,wBAAwB,GAAyB;IACrD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;CACtE,CAAC;AACF,MAAM,uBAAuB,GAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC3E,MAAM,mBAAmB,GAAwB;IAC/C,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;CAChD,CAAC;AACF,KAAK,wBAAwB,CAAC;AAC9B,KAAK,uBAAuB,CAAC;AAC7B,KAAK,mBAAmB,CAAC;AACzB,KAAM,IAA2C,CAAC;AAClD,KAAM,IAA8C,CAAC;AACrD,KAAM,IAAgD,CAAC;AAgBvD,MAAM,yBAAyB,GAA4B,gBAAgB,CAAC;AAC5E,MAAM,oCAAoC,GAA4B,oBAAoB,CAAC;AAC3F,MAAM,mCAAmC,GAA4B,mBAAmB,CAAC;AACzF,MAAM,wCAAwC,GAA4B,wBAAwB,CAAC;AACnG,MAAM,uCAAuC,GAA4B,8BAA8B,CAAC;AACxG,MAAM,mBAAmB,GAAuB,sBAAsB,CAAC;AACvE,MAAM,gCAAgC,GAA0C,oBAAoB,CAAC;AACrG,MAAM,4CAA4C,GAA0C,8BAA8B,CAAC;AAC3H,MAAM,iCAAiC,GAAqC,6BAA6B,CAAC;AAC1G,MAAM,uCAAuC,GAAoC,wBAAwB,CAAC;AAC1G,MAAM,sCAAsC,GAAoC,8BAA8B,CAAC;AAC/G,MAAM,mCAAmC,GAAoC,oBAAoB,CAAC;AAClG,MAAM,2BAA2B,GAA+B,uBAAuB,CAAC;AACxF,yFAAyF;AACzF,MAAM,yCAAyC,GAA0C,6BAA6B,CAAC;AACvH,mFAAmF;AACnF,MAAM,mCAAmC,GAAoC,uBAAuB,CAAC;AACrG,4DAA4D;AAC5D,MAAM,4BAA4B,GAAwB;IACxD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;CACjD,CAAC;AAEF,KAAM,IAA0C,CAAC;AACjD,KAAM,IAAsC,CAAC;AAC7C,KAAK,yBAAyB,CAAC;AAC/B,KAAK,oCAAoC,CAAC;AAC1C,KAAK,mCAAmC,CAAC;AACzC,KAAK,wCAAwC,CAAC;AAC9C,KAAK,uCAAuC,CAAC;AAC7C,KAAK,mBAAmB,CAAC;AACzB,KAAK,gCAAgC,CAAC;AACtC,KAAK,4CAA4C,CAAC;AAClD,KAAK,iCAAiC,CAAC;AACvC,KAAK,uCAAuC,CAAC;AAC7C,KAAK,sCAAsC,CAAC;AAC5C,KAAK,mCAAmC,CAAC;AACzC,KAAK,2BAA2B,CAAC"}
+{"version":3,"file":"type-contract.js","sourceRoot":"","sources":["../src/type-contract.ts"],"names":[],"mappings":"AAoIA,MAAM,sBAAsB,GAAuB,EAAE,SAAS,EAAE,EAAE,eAAe,EAAE,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;AACrG,MAAM,qBAAqB,GAAuB,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACtE,KAAK,sBAAsB,CAAC;AAC5B,KAAK,qBAAqB,CAAC;AAC3B,KAAM,IAAuC,CAAC;AAG9C,MAAM,uBAAuB,GAAwB,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAC/E,MAAM,sBAAsB,GAAwB,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC3E,MAAM,4BAA4B,GAAqC,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,OAAO,EAAE,CAAC;AAClH,KAAK,uBAAuB,CAAC;AAC7B,KAAK,sBAAsB,CAAC;AAC5B,KAAK,4BAA4B,CAAC;AAClC,KAAM,IAAwC,CAAC;AAG/C,MAAM,oBAAoB,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AACjE,MAAM,mBAAmB,GAAqB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAChE,MAAM,0BAA0B,GAAqC,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAC/G,KAAK,oBAAoB,CAAC;AAC1B,KAAK,mBAAmB,CAAC;AACzB,KAAK,0BAA0B,CAAC;AAChC,KAAM,IAAqC,CAAC;AAG5C,MAAM,wBAAwB,GAAyB;IACrD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,EAAE,EAAE;CACtE,CAAC;AACF,MAAM,uBAAuB,GAAyB,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC3E,MAAM,mBAAmB,GAAwB;IAC/C,YAAY,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,EAAE;CAChD,CAAC;AACF,KAAK,wBAAwB,CAAC;AAC9B,KAAK,uBAAuB,CAAC;AAC7B,KAAK,mBAAmB,CAAC;AACzB,KAAM,IAA2C,CAAC;AAClD,KAAM,IAA8C,CAAC;AACrD,KAAM,IAAgD,CAAC;AAgBvD,MAAM,yBAAyB,GAA4B,gBAAgB,CAAC;AAC5E,MAAM,oCAAoC,GAA4B,oBAAoB,CAAC;AAC3F,MAAM,mCAAmC,GAA4B,mBAAmB,CAAC;AACzF,MAAM,wCAAwC,GAA4B,wBAAwB,CAAC;AACnG,MAAM,uCAAuC,GAA4B,8BAA8B,CAAC;AACxG,MAAM,mBAAmB,GAAuB,sBAAsB,CAAC;AACvE,MAAM,gCAAgC,GAA0C,oBAAoB,CAAC;AACrG,MAAM,4CAA4C,GAA0C,8BAA8B,CAAC;AAC3H,MAAM,iCAAiC,GAAqC,6BAA6B,CAAC;AAC1G,MAAM,uCAAuC,GAAoC,wBAAwB,CAAC;AAC1G,MAAM,sCAAsC,GAAoC,8BAA8B,CAAC;AAC/G,MAAM,mCAAmC,GAAoC,oBAAoB,CAAC;AAClG,MAAM,2BAA2B,GAA+B,uBAAuB,CAAC;AACxF,yFAAyF;AACzF,MAAM,yCAAyC,GAA0C,6BAA6B,CAAC;AACvH,mFAAmF;AACnF,MAAM,mCAAmC,GAAoC,uBAAuB,CAAC;AACrG,4DAA4D;AAC5D,MAAM,4BAA4B,GAAwB;IACxD,IAAI,EAAE,UAAU;IAChB,OAAO,EAAE,EAAE,SAAS,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE;CACjD,CAAC;AAEF,KAAM,IAA0C,CAAC;AACjD,KAAM,IAAsC,CAAC;AAC7C,KAAK,yBAAyB,CAAC;AAC/B,KAAK,oCAAoC,CAAC;AAC1C,KAAK,mCAAmC,CAAC;AACzC,KAAK,wCAAwC,CAAC;AAC9C,KAAK,uCAAuC,CAAC;AAC7C,KAAK,mBAAmB,CAAC;AACzB,KAAK,gCAAgC,CAAC;AACtC,KAAK,4CAA4C,CAAC;AAClD,KAAK,iCAAiC,CAAC;AACvC,KAAK,uCAAuC,CAAC;AAC7C,KAAK,sCAAsC,CAAC;AAC5C,KAAK,mCAAmC,CAAC;AACzC,KAAK,2BAA2B,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@run402/sdk",
-  "version": "4.121.0",
+  "version": "4.122.1",
   "description": "Typed TypeScript client for the Run402 API. Kernel shared by the run402-mcp server, the run402 CLI, and user-deployed run402 functions.",
   "type": "module",
   "main": "dist/index.js",