@run402/sdk 4.93.2 → 4.95.0

package/dist/namespaces/vouchers.js

@@ -1,9 +1,8 @@
 /**
- * `vouchers` namespace — redeem a promo code for platform credit.
+ * `vouchers` namespace — redeem a promo code into the organization's allowance.
  *
- * A promo code credits your organization with run402 prepaid credit. That
- * credit spends like any other prepaid balance: a tier purchase settles from
- * it with no on-chain payment.
+ * A promo code adds to your organization's allowance, which spends like any
+ * other allowance: a tier purchase settles from it with no on-chain payment.
  *
  * Two properties make this safe to call from anywhere in an agent's lifecycle:
  *
@@ -11,7 +10,7 @@
  *   call a brand-new wallet makes (the organization is provisioned on demand),
  *   or long after `run402 init`. There is no init-before-redeem requirement.
  * - **Retrying is safe.** A repeat by the same organization returns the ORIGINAL
- *   result with `already_redeemed: true` and never credits twice, so a call that
+ *   result with `already_redeemed: true` and never adds twice, so a call that
  *   times out client-side can simply be re-issued.
  *
  * This namespace is deliberately thin and semantically blind: it forwards an

package/dist/namespaces/vouchers.js.map

@@ -1 +1 @@
-{"version":3,"file":"vouchers.js","sourceRoot":"","sources":["../../src/namespaces/vouchers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAuCxD,MAAM,OAAO,QAAQ;IAIU;IAH7B,+BAA+B;IACtB,UAAU,CAAiD;IAEpE,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,0BAA0B,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"vouchers.js","sourceRoot":"","sources":["../../src/namespaces/vouchers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAGH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAuCxD,MAAM,OAAO,QAAQ;IAIU;IAH7B,+BAA+B;IACtB,UAAU,CAAiD;IAEpE,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,KAAK,CAAC,MAAM,CAAC,IAAY;QACvB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,wBAAwB,CAAC,CAAC;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,0BAA0B,EAAE;YAC1E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE;YACd,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/namespaces/wallets.d.ts

@@ -1,12 +1,17 @@
 /**
- * `wallets` namespace — server-side wallet display label.
+ * `wallets` namespace — the agent's local wallet and its server-side label.
+ *
+ * `status`, `create`, and `export` touch the local wallet file (`wallet.json`)
+ * through optional provider methods; sandbox providers that don't implement
+ * them report `{configured: false}` or throw a descriptive error. `faucet`
+ * requests testnet USDC into the wallet and works in any environment.
  *
  * The label is the cross-machine / WEB-visible human name for a wallet (e.g.
  * "kychon"), stored server-side keyed by the wallet address and authenticated
- * by the wallet's allowance signature. It is display metadata only — never key
+ * by the wallet's SIWX signature. It is display metadata only — never key
  * material, no custody.
  *
- * Both methods are intentionally BEST-EFFORT: they swallow errors (including a
+ * Both label methods are intentionally BEST-EFFORT: they swallow errors (including a
  * not-yet-deployed endpoint / 404 / offline) and return a null/`ok:false`
  * sentinel instead of throwing. This lets `run402 wallets new|rename|import`
  * stay fully functional locally and before the gateway endpoint ships — the
@@ -18,9 +23,73 @@
  * label)` form is deprecated (see the `sdk-call-shape-conventions` change).
  */
 import type { Client } from "../kernel.js";
+export interface WalletStatusResult {
+    address: string;
+    created?: string;
+    /**
+     * True once the faucet has been invoked on this wallet. This tracks
+     * "faucet has been used," not "account can pay right now" — the two diverge
+     * once funds are spent or expire. Callers wanting a real pay-readiness
+     * check should call `wallets balance`.
+     */
+    faucet_used?: boolean;
+    lastFaucet?: string;
+    path?: string;
+    /** The persisted payment rail (`x402` when unset). */
+    rail?: "x402" | "mpp" | "lightning";
+    /** The Lightning wallet, without its pairing secret. */
+    lightning?: {
+        wallet_id: string;
+        lightning_address: string | null;
+        budget_sats: number;
+        starter_sats: number;
+        custody: "run402_hub";
+        has_pairing: true;
+        minted_at: string;
+    };
+    /** true when the local provider holds a wallet, false otherwise. */
+    configured: boolean;
+}
+export interface WalletCreateResult {
+    address: string;
+    created: string;
+    path?: string;
+}
+export interface FaucetResult {
+    /** Present on gateways that wait for on-chain confirmation. */
+    fundingStatus?: "confirmed";
+    transactionHash: string;
+    /** Display-formatted amount, e.g. `"0.25"`. Computed from `amountUsdMicros`. */
+    amount: string;
+    /** Raw amount in micro-USD (1_000_000 = $1.00). */
+    amountUsdMicros: number;
+    token: string;
+    network: string;
+}
+export interface FaucetOptions {
+    address?: string;
+    idempotencyKey?: string;
+}
 export declare class Wallets {
     private readonly client;
     constructor(client: Client);
+    /** Inspect the local wallet. Returns `{configured: false}` when absent. */
+    status(): Promise<WalletStatusResult>;
+    /**
+     * Generate a new wallet keypair and persist it. Throws when the
+     * provider already holds a wallet (don't overwrite silently) or
+     * when the provider doesn't support local wallet management.
+     */
+    create(): Promise<WalletCreateResult>;
+    /** Return the wallet address (safe to share). Throws if none is configured. */
+    export(): Promise<string>;
+    /**
+     * Request testnet USDC from the Run402 faucet. When `address` is omitted,
+     * the SDK uses the provider's local wallet address. Updates the
+     * wallet's internal `funded` marker on success (surfaced as
+     * `faucet_used` in `status()`).
+     */
+    faucet(addressOrOptions?: string | FaucetOptions): Promise<FaucetResult>;
     /**
      * Read a wallet's server-side label, or null on any error (unset, 404,
      * offline). Public read — no auth required.

package/dist/namespaces/wallets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wallets.d.ts","sourceRoot":"","sources":["../../src/namespaces/wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAiC3C,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGxD;AAED;;;;GAIG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAU,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAxC,MAAM,EAAE,MAAM,EAAmB,OAAO,EAAE,MAAM;IAE7E,qDAAqD;IACrD,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIlC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC;CAGlD"}
+{"version":3,"file":"wallets.d.ts","sourceRoot":"","sources":["../../src/namespaces/wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAI3C,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,sDAAsD;IACtD,IAAI,CAAC,EAAE,MAAM,GAAG,KAAK,GAAG,WAAW,CAAC;IACpC,wDAAwD;IACxD,SAAS,CAAC,EAAE;QACV,SAAS,EAAE,MAAM,CAAC;QAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;QACjC,WAAW,EAAE,MAAM,CAAC;QACpB,YAAY,EAAE,MAAM,CAAC;QACrB,OAAO,EAAE,YAAY,CAAC;QACtB,WAAW,EAAE,IAAI,CAAC;QAClB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;IACF,oEAAoE;IACpE,UAAU,EAAE,OAAO,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,YAAY;IAC3B,+DAA+D;IAC/D,aAAa,CAAC,EAAE,WAAW,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,gFAAgF;IAChF,MAAM,EAAE,MAAM,CAAC;IACf,mDAAmD;IACnD,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,aAAa;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAyCD,qBAAa,OAAO;IACN,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,2EAA2E;IACrE,MAAM,IAAI,OAAO,CAAC,kBAAkB,CAAC;IAkC3C;;;;OAIG;IACG,MAAM,IAAI,OAAO,CAAC,kBAAkB,CAAC;IA8B3C,+EAA+E;IACzE,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;IAe/B;;;;;OAKG;IACG,MAAM,CAAC,gBAAgB,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,OAAO,CAAC,YAAY,CAAC;IA8D9E;;;OAGG;IACG,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAGxD;AAED;;;;GAIG;AACH,qBAAa,YAAY;IACX,OAAO,CAAC,QAAQ,CAAC,MAAM;IAAU,OAAO,CAAC,QAAQ,CAAC,OAAO;gBAAxC,MAAM,EAAE,MAAM,EAAmB,OAAO,EAAE,MAAM;IAE7E,qDAAqD;IACrD,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAIlC,sEAAsE;IACtE,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,EAAE,EAAE,OAAO,CAAA;KAAE,CAAC;CAGlD"}

package/dist/namespaces/wallets.js

@@ -1,12 +1,17 @@
 /**
- * `wallets` namespace — server-side wallet display label.
+ * `wallets` namespace — the agent's local wallet and its server-side label.
+ *
+ * `status`, `create`, and `export` touch the local wallet file (`wallet.json`)
+ * through optional provider methods; sandbox providers that don't implement
+ * them report `{configured: false}` or throw a descriptive error. `faucet`
+ * requests testnet USDC into the wallet and works in any environment.
  *
  * The label is the cross-machine / WEB-visible human name for a wallet (e.g.
  * "kychon"), stored server-side keyed by the wallet address and authenticated
- * by the wallet's allowance signature. It is display metadata only — never key
+ * by the wallet's SIWX signature. It is display metadata only — never key
  * material, no custody.
  *
- * Both methods are intentionally BEST-EFFORT: they swallow errors (including a
+ * Both label methods are intentionally BEST-EFFORT: they swallow errors (including a
  * not-yet-deployed endpoint / 404 / offline) and return a null/`ok:false`
  * sentinel instead of throwing. This lets `run402 wallets new|rename|import`
  * stay fully functional locally and before the gateway endpoint ships — the
@@ -17,6 +22,7 @@
  * `.getLabel()` / `.setLabel(label)`. The two-string `r.wallets.setLabel(address,
  * label)` form is deprecated (see the `sdk-call-shape-conventions` change).
  */
+import { LocalError } from "../errors.js";
 /** Shared read impl — used by both `Wallets.getLabel` and `ScopedWallet.getLabel`. */
 async function readLabel(client, address) {
     try {
@@ -42,6 +48,138 @@ export class Wallets {
     constructor(client) {
         this.client = client;
     }
+    /** Inspect the local wallet. Returns `{configured: false}` when absent. */
+    async status() {
+        const reader = this.client.credentials.readWallet;
+        if (!reader) {
+            return { address: "", configured: false };
+        }
+        const data = await reader.call(this.client.credentials);
+        if (!data)
+            return { address: "", configured: false };
+        return {
+            address: data.address,
+            created: data.created,
+            // Map the on-disk `funded` marker (which only tracks faucet invocations)
+            // to `faucet_used` in the output. `!!` coerces undefined → false so
+            // callers can branch cleanly.
+            faucet_used: !!data.funded,
+            lastFaucet: data.lastFaucet,
+            path: this.client.credentials.getWalletPath?.call(this.client.credentials),
+            rail: data.rail ?? "x402",
+            ...(data.lightning
+                ? {
+                    lightning: {
+                        wallet_id: data.lightning.wallet_id,
+                        lightning_address: data.lightning.lightning_address,
+                        budget_sats: data.lightning.budget_sats,
+                        starter_sats: data.lightning.starter_sats,
+                        custody: data.lightning.custody,
+                        has_pairing: true,
+                        minted_at: data.lightning.minted_at,
+                    },
+                }
+                : {}),
+            configured: true,
+        };
+    }
+    /**
+     * Generate a new wallet keypair and persist it. Throws when the
+     * provider already holds a wallet (don't overwrite silently) or
+     * when the provider doesn't support local wallet management.
+     */
+    async create() {
+        const reader = this.client.credentials.readWallet;
+        const creator = this.client.credentials.createWallet;
+        const saver = this.client.credentials.saveWallet;
+        if (!creator || !saver) {
+            throw new LocalError("This credential provider does not support wallet creation. Use @run402/sdk/node for local wallet management.", "creating wallet");
+        }
+        if (reader) {
+            const existing = await reader.call(this.client.credentials);
+            if (existing) {
+                throw new LocalError(`Wallet already exists at ${this.client.credentials.getWalletPath?.call(this.client.credentials) ?? "(local path unknown)"}. Delete it manually to regenerate.`, "creating wallet");
+            }
+        }
+        const data = await creator.call(this.client.credentials);
+        await saver.call(this.client.credentials, data);
+        return {
+            address: data.address,
+            created: data.created ?? new Date().toISOString(),
+            path: this.client.credentials.getWalletPath?.call(this.client.credentials),
+        };
+    }
+    /** Return the wallet address (safe to share). Throws if none is configured. */
+    async export() {
+        const reader = this.client.credentials.readWallet;
+        if (!reader) {
+            throw new LocalError("This credential provider does not expose the local wallet.", "exporting wallet");
+        }
+        const data = await reader.call(this.client.credentials);
+        if (!data) {
+            throw new LocalError("No local wallet is configured.", "exporting wallet");
+        }
+        return data.address;
+    }
+    /**
+     * Request testnet USDC from the Run402 faucet. When `address` is omitted,
+     * the SDK uses the provider's local wallet address. Updates the
+     * wallet's internal `funded` marker on success (surfaced as
+     * `faucet_used` in `status()`).
+     */
+    async faucet(addressOrOptions) {
+        const opts = typeof addressOrOptions === "string"
+            ? { address: addressOrOptions }
+            : addressOrOptions ?? {};
+        let resolvedAddress = opts.address;
+        if (!resolvedAddress) {
+            const reader = this.client.credentials.readWallet;
+            if (!reader) {
+                throw new LocalError("No address provided and no local wallet is available.", "requesting faucet funds");
+            }
+            const data = await reader.call(this.client.credentials);
+            if (!data) {
+                throw new LocalError("No address provided and no local wallet is configured.", "requesting faucet funds");
+            }
+            resolvedAddress = data.address;
+        }
+        // Wire shape is snake_case (`transaction_hash`, `amount_usd_micros`);
+        // normalize to the typed camelCase surface.
+        const wire = await this.client.request("/faucet/v1", {
+            method: "POST",
+            ...(opts.idempotencyKey ? { headers: { "Idempotency-Key": opts.idempotencyKey } } : {}),
+            body: { address: resolvedAddress },
+            withAuth: false,
+            context: "requesting faucet funds",
+        });
+        const result = {
+            ...(wire.funding_status ? { fundingStatus: wire.funding_status } : {}),
+            transactionHash: wire.transaction_hash,
+            amountUsdMicros: wire.amount_usd_micros,
+            amount: (wire.amount_usd_micros / 1_000_000).toFixed(2),
+            token: wire.token,
+            network: wire.network,
+        };
+        // Best-effort update of the local wallet's funded/lastFaucet fields.
+        const reader = this.client.credentials.readWallet;
+        const saver = this.client.credentials.saveWallet;
+        if (reader && saver) {
+            try {
+                const data = await reader.call(this.client.credentials);
+                if (data) {
+                    await saver.call(this.client.credentials, {
+                        ...data,
+                        funded: true,
+                        lastFaucet: new Date().toISOString(),
+                    });
+                }
+            }
+            catch {
+                // non-fatal — the on-chain transfer succeeded
+            }
+        }
+        return result;
+    }
     /**
      * Read a wallet's server-side label, or null on any error (unset, 404,
      * offline). Public read — no auth required.

package/dist/namespaces/wallets.js.map

@@ -1 +1 @@
-{"version":3,"file":"wallets.js","sourceRoot":"","sources":["../../src/namespaces/wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AASH,sFAAsF;AACtF,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAe;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACrD,CAAC;QACF,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CACrF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,OAAO;IACW;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACM;IAAiC;IAA9D,YAA6B,MAAc,EAAmB,OAAe;QAAhD,WAAM,GAAN,MAAM,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEjF,qDAAqD;IACrD,QAAQ;QACN,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,sEAAsE;IACtE,QAAQ,CAAC,KAAa;QACpB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;CACF"}
+{"version":3,"file":"wallets.js","sourceRoot":"","sources":["../../src/namespaces/wallets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAIH,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAkE1C,sFAAsF;AACtF,KAAK,UAAU,SAAS,CAAC,MAAc,EAAE,OAAe;IACtD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAC9B,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,KAAK,EAAE,CACrD,CAAC;QACF,OAAO,GAAG,EAAE,KAAK,IAAI,IAAI,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,KAAK,UAAU,QAAQ,CAAC,MAAc,EAAE,OAAe,EAAE,KAAa;IACpE,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,OAAO,CAClB,eAAe,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAClD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,sBAAsB,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,CACrF,CAAC;QACF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,OAAO,OAAO;IACW;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,2EAA2E;IAC3E,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QAC5C,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;QACrD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,yEAAyE;YACzE,oEAAoE;YACpE,8BAA8B;YAC9B,WAAW,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;YAC1B,UAAU,EAAE,IAAI,CAAC,UAAU;YAC3B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;YAC1E,IAAI,EAAE,IAAI,CAAC,IAAI,IAAI,MAAM;YACzB,GAAG,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC;oBACA,SAAS,EAAE;wBACT,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;wBACnC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,iBAAiB;wBACnD,WAAW,EAAE,IAAI,CAAC,SAAS,CAAC,WAAW;wBACvC,YAAY,EAAE,IAAI,CAAC,SAAS,CAAC,YAAY;wBACzC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO;wBAC/B,WAAW,EAAE,IAAa;wBAC1B,SAAS,EAAE,IAAI,CAAC,SAAS,CAAC,SAAS;qBACpC;iBACF;gBACD,CAAC,CAAC,EAAE,CAAC;YACP,UAAU,EAAE,IAAI;SACjB,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QAClD,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,YAAY,CAAC;QACrD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QACjD,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,IAAI,UAAU,CAClB,8GAA8G,EAC9G,iBAAiB,CAClB,CAAC;QACJ,CAAC;QACD,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5D,IAAI,QAAQ,EAAE,CAAC;gBACb,MAAM,IAAI,UAAU,CAClB,4BACE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI,sBAC1E,qCAAqC,EACrC,iBAAiB,CAClB,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAe,MAAM,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACrE,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;QAChD,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACjD,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC;SAC3E,CAAC;IACJ,CAAC;IAED,+EAA+E;IAC/E,KAAK,CAAC,MAAM;QACV,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QAClD,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,UAAU,CAClB,4DAA4D,EAC5D,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,CAAC,IAAI,EAAE,CAAC;YACV,MAAM,IAAI,UAAU,CAAC,gCAAgC,EAAE,kBAAkB,CAAC,CAAC;QAC7E,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,MAAM,CAAC,gBAAyC;QACpD,MAAM,IAAI,GAAkB,OAAO,gBAAgB,KAAK,QAAQ;YAC9D,CAAC,CAAC,EAAE,OAAO,EAAE,gBAAgB,EAAE;YAC/B,CAAC,CAAC,gBAAgB,IAAI,EAAE,CAAC;QAC3B,IAAI,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC;QACnC,IAAI,CAAC,eAAe,EAAE,CAAC;YACrB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;YAClD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,uDAAuD,EACvD,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,CAAC,IAAI,EAAE,CAAC;gBACV,MAAM,IAAI,UAAU,CAClB,wDAAwD,EACxD,yBAAyB,CAC1B,CAAC;YACJ,CAAC;YACD,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC;QACjC,CAAC;QAED,sEAAsE;QACtE,4CAA4C;QAC5C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAiB,YAAY,EAAE;YACnE,MAAM,EAAE,MAAM;YACd,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,iBAAiB,EAAE,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvF,IAAI,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;YAClC,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;QACH,MAAM,MAAM,GAAiB;YAC3B,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,eAAe,EAAE,IAAI,CAAC,gBAAgB;YACtC,eAAe,EAAE,IAAI,CAAC,iBAAiB;YACvC,MAAM,EAAE,CAAC,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YACvD,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,OAAO,EAAE,IAAI,CAAC,OAAO;SACtB,CAAC;QAEF,qEAAqE;QACrE,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QAClD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC;QACjD,IAAI,MAAM,IAAI,KAAK,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;gBACxD,IAAI,IAAI,EAAE,CAAC;oBACT,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE;wBACxC,GAAG,IAAI;wBACP,MAAM,EAAE,IAAI;wBACZ,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;qBACrC,CAAC,CAAC;gBACL,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,8CAA8C;YAChD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,CAAC;IAChB,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,QAAQ,CAAC,OAAe;QAC5B,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACzC,CAAC;CACF;AAED;;;;GAIG;AACH,MAAM,OAAO,YAAY;IACM;IAAiC;IAA9D,YAA6B,MAAc,EAAmB,OAAe;QAAhD,WAAM,GAAN,MAAM,CAAQ;QAAmB,YAAO,GAAP,OAAO,CAAQ;IAAG,CAAC;IAEjF,qDAAqD;IACrD,QAAQ;QACN,OAAO,SAAS,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,sEAAsE;IACtE,QAAQ,CAAC,KAAa;QACpB,OAAO,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACpD,CAAC;CACF"}

package/dist/namespaces/write-approval.d.ts

@@ -0,0 +1,101 @@
+/**
+ * `writeApproval` — the passkey-signed, target-scoped credential a person
+ * signed in on the command line needs to provision, deploy, or write secrets
+ * without a wallet. Reached as `r.writeApproval.*`.
+ *
+ * The ceremony: {@link WriteApproval.requestChallenge} opens a passkey approval
+ * scoped to one `(action, target)` and returns a same-origin `confirm_url`; the
+ * person approves with their passkey in the browser; the confirm page redirects
+ * to the CLI's `127.0.0.1` loopback with a one-time `code`;
+ * {@link WriteApproval.exchangeClaimCode} (PKCE) mints the token. The token is
+ * sent as `X-Run402-Write-Approval: Bearer <write_approval_token>` beside the
+ * sign-in session bearer, and dies with that session. A write approval never
+ * satisfies step-up.
+ *
+ * Isomorphic seams — the loopback server and PKCE generation live in the Node
+ * CLI (`run402 approve`).
+ */
+import type { Client } from "../kernel.js";
+import type { WriteApprovalCapability } from "../credentials.js";
+/** Input to {@link WriteApproval.requestChallenge}. */
+export interface WriteApprovalChallengeInput {
+    /** The capability to approve. Determines whether `orgId` or `projectId` is required. */
+    action: WriteApprovalCapability;
+    /** Required for `org.project.create`. */
+    orgId?: string;
+    /** Required for the project-scoped capabilities (`project.deploy`, `project.secret.write`, …). */
+    projectId?: string;
+    /** The CLI's loopback redirect, e.g. `http://127.0.0.1:54321/callback`. */
+    cliRedirectUri: string;
+    /** PKCE S256 challenge = base64url(sha256(verifier)). */
+    codeChallenge: string;
+    /** Opaque CSRF state echoed back on the loopback redirect. */
+    state: string;
+    /**
+     * The sign-in session bearer. Falls back to the client's default auth when
+     * omitted — pass it explicitly unless the client was constructed with
+     * sign-in session credentials.
+     */
+    token?: string;
+}
+/** Result of {@link WriteApproval.requestChallenge}. Forward-compatible. */
+export interface WriteApprovalChallengeResult {
+    challenge_id: string;
+    confirm_url: string;
+    expires_at?: string;
+    action?: string;
+    org_id?: string | null;
+    project_id?: string | null;
+    delivery?: "cli_loopback" | "postmessage" | (string & {});
+    [key: string]: unknown;
+}
+/** Input to {@link WriteApproval.exchangeClaimCode}. */
+export interface WriteApprovalClaimInput {
+    /** Authorization code received on the loopback redirect. */
+    code: string;
+    /** The PKCE verifier whose hash was sent as `codeChallenge`. */
+    codeVerifier: string;
+    /** Must match the `state` used at challenge time. */
+    state: string;
+}
+/** One write approval's metadata as the gateway reports it (never the token). */
+export interface WriteApprovalSessionInfo {
+    write_approval_session_id: string;
+    authenticator_class?: string;
+    org_id?: string | null;
+    project_id?: string | null;
+    capabilities?: string[];
+    risk_ceiling?: string;
+    /** ISO-8601 idle expiry — the token's usable life. */
+    idle_expires_at?: string;
+    /** ISO-8601 absolute expiry. */
+    absolute_expires_at?: string;
+    [key: string]: unknown;
+}
+/** Minted write-approval token payload, returned ONCE. Forward-compatible. */
+export interface WriteApprovalTokenResult {
+    write_approval_token: string;
+    /** Always `"write_approval"`. */
+    token_type?: string;
+    /** Always `"X-Run402-Write-Approval"`. */
+    header?: string;
+    session?: WriteApprovalSessionInfo | null;
+    [key: string]: unknown;
+}
+export declare class WriteApproval {
+    private readonly client;
+    constructor(client: Client);
+    /**
+     * Open a scoped approval (`POST /agent/v1/control-plane/write-approval/challenges`).
+     * Carries the sign-in session bearer; a `device`-grade session is refused.
+     */
+    requestChallenge(input: WriteApprovalChallengeInput): Promise<WriteApprovalChallengeResult>;
+    /**
+     * Exchange the loopback claim `code` (+ PKCE verifier + `state`) for the
+     * write-approval token (`POST …/write-approval/cli/token`). No `redirect_uri`
+     * — it is bound at challenge time. Unauthenticated (code + verifier are the
+     * credential); the minted token is still bound to the issuing sign-in session.
+     */
+    exchangeClaimCode(input: WriteApprovalClaimInput): Promise<WriteApprovalTokenResult>;
+}
+//# sourceMappingURL=write-approval.d.ts.map

package/dist/namespaces/write-approval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-approval.d.ts","sourceRoot":"","sources":["../../src/namespaces/write-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,mBAAmB,CAAC;AAEjE,uDAAuD;AACvD,MAAM,WAAW,2BAA2B;IAC1C,wFAAwF;IACxF,MAAM,EAAE,uBAAuB,CAAC;IAChC,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,kGAAkG;IAClG,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,4EAA4E;AAC5E,MAAM,WAAW,4BAA4B;IAC3C,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,aAAa,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IAC1D,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wDAAwD;AACxD,MAAM,WAAW,uBAAuB;IACtC,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,iFAAiF;AACjF,MAAM,WAAW,wBAAwB;IACvC,yBAAyB,EAAE,MAAM,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,sDAAsD;IACtD,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gCAAgC;IAChC,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,8EAA8E;AAC9E,MAAM,WAAW,wBAAwB;IACvC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,0CAA0C;IAC1C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,wBAAwB,GAAG,IAAI,CAAC;IAC1C,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,qBAAa,aAAa;IACZ,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;OAGG;IACG,gBAAgB,CAAC,KAAK,EAAE,2BAA2B,GAAG,OAAO,CAAC,4BAA4B,CAAC;IAsBjG;;;;;OAKG;IACG,iBAAiB,CAAC,KAAK,EAAE,uBAAuB,GAAG,OAAO,CAAC,wBAAwB,CAAC;CAW3F"}

package/dist/namespaces/write-approval.js

@@ -0,0 +1,62 @@
+/**
+ * `writeApproval` — the passkey-signed, target-scoped credential a person
+ * signed in on the command line needs to provision, deploy, or write secrets
+ * without a wallet. Reached as `r.writeApproval.*`.
+ *
+ * The ceremony: {@link WriteApproval.requestChallenge} opens a passkey approval
+ * scoped to one `(action, target)` and returns a same-origin `confirm_url`; the
+ * person approves with their passkey in the browser; the confirm page redirects
+ * to the CLI's `127.0.0.1` loopback with a one-time `code`;
+ * {@link WriteApproval.exchangeClaimCode} (PKCE) mints the token. The token is
+ * sent as `X-Run402-Write-Approval: Bearer <write_approval_token>` beside the
+ * sign-in session bearer, and dies with that session. A write approval never
+ * satisfies step-up.
+ *
+ * Isomorphic seams — the loopback server and PKCE generation live in the Node
+ * CLI (`run402 approve`).
+ */
+export class WriteApproval {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Open a scoped approval (`POST /agent/v1/control-plane/write-approval/challenges`).
+     * Carries the sign-in session bearer; a `device`-grade session is refused.
+     */
+    async requestChallenge(input) {
+        const body = {
+            action: input.action,
+            cli_redirect_uri: input.cliRedirectUri,
+            code_challenge: input.codeChallenge,
+            state: input.state,
+        };
+        if (input.orgId !== undefined)
+            body.org_id = input.orgId;
+        if (input.projectId !== undefined)
+            body.project_id = input.projectId;
+        return this.client.request("/agent/v1/control-plane/write-approval/challenges", {
+            method: "POST",
+            body,
+            ...(input.token
+                ? { headers: { Authorization: `Bearer ${input.token}` }, withAuth: false }
+                : {}),
+            context: "requesting a write approval challenge",
+        });
+    }
+    /**
+     * Exchange the loopback claim `code` (+ PKCE verifier + `state`) for the
+     * write-approval token (`POST …/write-approval/cli/token`). No `redirect_uri`
+     * — it is bound at challenge time. Unauthenticated (code + verifier are the
+     * credential); the minted token is still bound to the issuing sign-in session.
+     */
+    async exchangeClaimCode(input) {
+        return this.client.request("/agent/v1/control-plane/write-approval/cli/token", {
+            method: "POST",
+            body: { code: input.code, code_verifier: input.codeVerifier, state: input.state },
+            withAuth: false,
+            context: "exchanging a write approval claim code",
+        });
+    }
+}
+//# sourceMappingURL=write-approval.js.map

package/dist/namespaces/write-approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"write-approval.js","sourceRoot":"","sources":["../../src/namespaces/write-approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AA2EH,MAAM,OAAO,aAAa;IACK;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;OAGG;IACH,KAAK,CAAC,gBAAgB,CAAC,KAAkC;QACvD,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QACzD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACrE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,mDAAmD,EACnD;YACE,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,uCAAuC;SACjD,CACF,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAA8B;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,kDAAkD,EAClD;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YACjF,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,wCAAwC;SAClD,CACF,CAAC;IACJ,CAAC;CACF"}

package/dist/node/actions-node.d.ts

@@ -25,17 +25,17 @@ export declare class NodeActions implements Run402Actions {
     up(input?: Omit<Run402UpActionInput, "type">, opts?: Run402ActionRunOptions): Promise<Run402ActionResult<Run402UpResult>>;
 }
 /**
- * Slug a human project name into a claimable `<name>.run402.com` label
+ * Slug a human project name into an addable `<name>.run402.com` label
  * (3-63 chars, lowercase alphanumeric + hyphens), or null when it cannot be.
  */
 export declare function subdomainSlugFromProjectName(name: string | null | undefined): string | null;
 /**
  * The `missing_public_origin` remedy: a path check cannot resolve without a
  * public origin, and the fix is to bind a subdomain — either right now via
- * `run402 subdomains claim <name>` (which binds the live release with no
+ * `run402 subdomains add <name>` (which binds the live release with no
  * further flags) or declaratively in the manifest's `subdomains.set`.
  */
-export declare function claimSubdomainNextAction(projectName: string | null, checkId: string): Run402AppUpNextAction;
+export declare function addSubdomainNextAction(projectName: string | null, checkId: string): Run402AppUpNextAction;
 /** Resolve only local destination intent. Approval and global active state are never selectors. */
 export declare function resolveDeploymentTarget(input: {
     appRoot: string;

package/dist/node/actions-node.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions-node.d.ts","sourceRoot":"","sources":["../../src/node/actions-node.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAIV,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EAGb,kCAAkC,EAClC,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EAGf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAaL,KAAK,qBAAqB,EAG3B,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAU1C,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAY,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAUrE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAwKD;;;GAGG;AAEH,qBAAa,WAAY,YAAW,aAAa;;IAE7C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,kBAAuB;IAG1C,GAAG,CACP,KAAK,EAAE,kCAAkC,EACzC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACzC,GAAG,CACP,KAAK,EAAE,wBAAwB,EAC/B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACvC,GAAG,CACP,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IA0CxC,EAAE,CACN,KAAK,GAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAM,EAC7C,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;CA8rE/C;AA6bD;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAU3F;AAED;;;;;GAKG;AACH,wBAAgB,wBAAwB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAU3G;AA6jBD,mGAAmG;AACnG,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACtH,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC/F,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAA;CAAE,CAAC,CAmBpJ"}
+{"version":3,"file":"actions-node.d.ts","sourceRoot":"","sources":["../../src/node/actions-node.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAIV,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EAGb,kCAAkC,EAClC,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EAGf,MAAM,eAAe,CAAC;AAEvB,OAAO,EAaL,KAAK,qBAAqB,EAG3B,MAAM,cAAc,CAAC;AAGtB,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAU1C,OAAO,KAAK,EAAkB,eAAe,EAAE,MAAM,iCAAiC,CAAC;AACvF,OAAO,KAAK,EAAY,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAUrE,MAAM,MAAM,oBAAoB,GAAG,OAAO,GAAG,MAAM,GAAG,SAAS,CAAC;AAEhE,MAAM,WAAW,kBAAkB;IACjC,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAwKD;;;GAGG;AAEH,qBAAa,WAAY,YAAW,aAAa;;IAE7C,OAAO,CAAC,QAAQ,CAAC,GAAG;IACpB,OAAO,CAAC,QAAQ,CAAC,IAAI;gBADJ,GAAG,EAAE,MAAM,EACX,IAAI,GAAE,kBAAuB;IAG1C,GAAG,CACP,KAAK,EAAE,kCAAkC,EACzC,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC,CAAC;IACzC,GAAG,CACP,KAAK,EAAE,wBAAwB,EAC/B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,aAAa,CAAC,CAAC;IACvC,GAAG,CACP,KAAK,EAAE,mBAAmB,EAC1B,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;IA0CxC,EAAE,CACN,KAAK,GAAE,IAAI,CAAC,mBAAmB,EAAE,MAAM,CAAM,EAC7C,IAAI,CAAC,EAAE,sBAAsB,GAC5B,OAAO,CAAC,kBAAkB,CAAC,cAAc,CAAC,CAAC;CA8rE/C;AA6bD;;;GAGG;AACH,wBAAgB,4BAA4B,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,MAAM,GAAG,IAAI,CAU3F;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,EAAE,MAAM,GAAG,qBAAqB,CAUzG;AA6jBD,mGAAmG;AACnG,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACtH,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,eAAe,CAAC,EAAE,OAAO,CAAC;CAC/F,GAAG,OAAO,CAAC;IAAE,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,UAAU,GAAG,gBAAgB,GAAG,UAAU,GAAG,QAAQ,GAAG,YAAY,CAAA;CAAE,CAAC,CAmBpJ"}