@run402/sdk 4.93.2 → 4.95.0

package/dist/namespaces/operator.d.ts

@@ -1,359 +0,0 @@
-/**
- * `operator` namespace — the *human* (email) principal, distinct from the
- * agent's per-wallet SIWX identity.
- *
- * The human authenticates in the browser via an OAuth 2.0 device-authorization
- * grant (RFC 8628, the `aws sso login` model): `deviceStart` returns a
- * user-facing code + URL, the human approves it via the existing magic-link or
- * passkey web flow, and `devicePoll` brokers the resulting operator-session
- * token. `overview` reads the email-union account view with that token, and
- * `revoke` ends the session server-side.
- *
- * Bearer auth is passed explicitly (`opts.token`) rather than sourced from a
- * credential provider, because the operator session is a Node-only on-disk
- * cache (`core/operator-session.ts`) and this namespace stays isomorphic. The
- * `device*` endpoints are unauthenticated (the `device_code` in the body is the
- * credential), so they send no auth headers.
- *
- * Gateway contract: the RFC 8628 device-auth bridge.
- */
-import type { Client } from "../kernel.js";
-import type { WriteAuthCapability } from "../credentials.js";
-import { OperatorSession } from "./operator-session.js";
-/** RFC 8628 device-authorization start response. */
-export interface DeviceAuthStart {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    /** Pre-fills the user_code so the human can click straight through. */
-    verification_uri_complete?: string;
-    expires_in: number;
-    /** Minimum seconds between `devicePoll` calls. */
-    interval: number;
-}
-/** The operator-session token payload (wire shape; relative `expires_in`). */
-export interface OperatorSessionToken {
-    operator_session_token: string;
-    token_type: string;
-    expires_in: number;
-    absolute_expires_at: string;
-    email: string;
-    wallets: string[];
-}
-/**
- * Result of one `devicePoll`. The non-approved states are the RFC 8628 token
- * error codes — they are expected polling states, NOT thrown errors, so callers
- * can run the poll loop without try/catch.
- */
-export type DevicePollResult = {
-    kind: "approved";
-    session: OperatorSessionToken;
-} | {
-    kind: "authorization_pending";
-} | {
-    kind: "slow_down";
-} | {
-    kind: "access_denied";
-} | {
-    kind: "expired_token";
-};
-/**
- * Organization overview. Forward-compatible: the gateway owns the exact shape and
- * may add fields, so unknown keys are preserved via the index signature.
- * `scope.kind` is `"email"` for the operator-session (email-union) and
- * `"wallet"` for a SIWX slice.
- */
-export interface OperatorOverview {
-    scope?: {
-        kind?: "email" | "wallet" | string;
-        principal?: string;
-    };
-    rollup?: Record<string, unknown>;
-    organizations?: unknown[];
-    wallets?: unknown[];
-    advisories?: unknown[];
-    [key: string]: unknown;
-}
-/**
- * A control-plane session minted by the loopback-PKCE flow
- * (`POST /agent/v1/control-plane/cli/token`). Distinct from the device-flow
- * {@link OperatorSessionToken} (read-only): this carries `provenance` and `amr`.
- * It authorizes most control-plane ops, but `provision` / `deploy` / secrets
- * additionally require a passkey-fresh operator approval (v1.85/v1.87) — see
- * `r.operator.approval`. Forward-compatible.
- */
-export interface ControlPlaneSession {
-    control_plane_session_token: string;
-    token_type?: string;
-    /** Relative lifetime in seconds. */
-    expires_in?: number;
-    /** How it was minted — `loopback_pkce` for the CLI write-login. */
-    provenance?: string;
-    /** The control-plane principal id. */
-    principal_id?: string;
-    /** Auth methods satisfied (e.g. `["passkey"]`). */
-    amr?: string[];
-    [key: string]: unknown;
-}
-/** Parameters for {@link Operator.buildCliAuthorizeUrl}. */
-export interface CliAuthorizeParams {
-    /** The CLI's loopback redirect, e.g. `http://127.0.0.1:54321/callback`. */
-    redirectUri: string;
-    /** PKCE S256 challenge = base64url(sha256(verifier)). */
-    codeChallenge: string;
-    /** Opaque CSRF state echoed back on the redirect. */
-    state: string;
-    /** Replay nonce. */
-    nonce: string;
-}
-/** Parameters for {@link Operator.exchangeCliToken}. */
-export interface CliTokenExchange {
-    /** Authorization code received on the loopback redirect. */
-    code: string;
-    /** The PKCE verifier whose hash was sent as `codeChallenge`. */
-    codeVerifier: string;
-    /** Must match the `redirectUri` used at authorize time. */
-    redirectUri: string;
-    /** Must match the `state` used at authorize time. */
-    state: string;
-}
-/**
- * A claim challenge (`POST …/claim-wallet-org/challenge`). The wallet must sign a
- * fresh SIWX message carrying {@link ClaimChallenge.nonce}; that signed message
- * becomes the `SIGN-IN-WITH-X` header on {@link ClaimWalletOrg.submit}. Reveals
- * nothing about the wallet's orgs — control is proven only at claim time.
- */
-export interface ClaimChallenge {
-    challenge_id: string;
-    nonce: string;
-    expires_at: string;
-    sign_instructions?: {
-        scheme?: string;
-        nonce?: string;
-        note?: string;
-        [key: string]: unknown;
-    };
-    [key: string]: unknown;
-}
-/** Input to {@link ClaimWalletOrg.challenge}. */
-export interface ClaimChallengeInput {
-    /** The wallet (0x EVM address) whose agent-owned org is being claimed. */
-    wallet: string;
-    /**
-     * The human's write-capable control-plane session bearer. Falls back to the
-     * client's default auth when omitted — pass it explicitly unless the client was
-     * constructed with control-plane-session credentials.
-     */
-    token?: string;
-}
-/** Input to {@link ClaimWalletOrg.submit}. */
-export interface ClaimSubmitInput {
-    /**
-     * The fresh SIWX proof over the challenge nonce — the value of the
-     * `SIGN-IN-WITH-X` header (the wallet proof). In Node, build it with
-     * `signWalletOrgClaim` from `@run402/sdk/node`.
-     */
-    siwx: string;
-    /** The human's control-plane session bearer (see {@link ClaimChallengeInput.token}). */
-    token?: string;
-    /**
-     * Target org id. Omit on the first submit; supply it on the second round when
-     * the first returned `select_org` (the wallet's agent owns more than one org).
-     * The same `token` + `siwx` are reused — no re-challenge, no re-sign.
-     */
-    orgId?: string;
-    /** Optional label to set on the claimed org at the same time. `null`/`""` clears. */
-    displayName?: string | null;
-}
-/** One org offered for selection when a wallet's agent owns more than one (`select_org`). */
-export interface SelectableOrg {
-    org_id: string;
-    display_name: string | null;
-    tier: string;
-    [key: string]: unknown;
-}
-/**
- * Result of {@link ClaimWalletOrg.submit}. A discriminated union: `"claimed"` on
- * success, or `"select_org"` when the wallet's agent owns more than one org and
- * the caller must re-submit with a chosen `orgId`. `select_org` is a normal
- * (non-error) result — it is returned, never thrown.
- */
-export type ClaimResult = {
-    status: "claimed";
-    org_id: string;
-    display_name: string | null;
-    role: string;
-    /** True when the human already owned the org (idempotent re-claim). */
-    already_owned?: boolean;
-    [key: string]: unknown;
-} | {
-    status: "select_org";
-    selectable_orgs: SelectableOrg[];
-    [key: string]: unknown;
-};
-/**
- * Wallet-owned org claim — `r.operator.claimWalletOrg.*`. The isomorphic
- * (raw-proof) seam: `challenge` issues a nonce; `submit` posts the dual proof
- * (control-plane session bearer + a fresh `SIGN-IN-WITH-X` wallet signature). The
- * Node convenience `signWalletOrgClaim` / `claimWalletOrg` in `@run402/sdk/node`
- * runs the whole dance (read session → challenge → sign → submit).
- */
-export declare class ClaimWalletOrg {
-    private readonly client;
-    constructor(client: Client);
-    /** Request a single-use challenge nonce the wallet must sign (`POST …/claim-wallet-org/challenge`). */
-    challenge(input: ClaimChallengeInput): Promise<ClaimChallenge>;
-    /**
-     * Execute the claim (`POST …/claim-wallet-org`) carrying both proofs: the
-     * control-plane session bearer (the human) and the `SIGN-IN-WITH-X` wallet
-     * signature. Returns a discriminated {@link ClaimResult}; a `select_org` result
-     * is returned (not thrown). Throws {@link StepUpRequiredError} when the session
-     * is not passkey-fresh, and `ApiError` (`WALLET_PROOF_INVALID`) on a bad proof.
-     */
-    submit(input: ClaimSubmitInput): Promise<ClaimResult>;
-}
-/** Input to {@link Approval.requestChallenge}. */
-export interface ApprovalChallengeInput {
-    /** The capability to approve. Determines whether `orgId` or `projectId` is required. */
-    action: WriteAuthCapability;
-    /** Required for `org.project.create`. */
-    orgId?: string;
-    /** Required for `project.deploy` / `project.secret.write`. */
-    projectId?: string;
-    /** The CLI's loopback redirect, e.g. `http://127.0.0.1:54321/callback`. */
-    cliRedirectUri: string;
-    /** PKCE S256 challenge = base64url(sha256(verifier)). */
-    codeChallenge: string;
-    /** Opaque CSRF state echoed back on the loopback redirect. */
-    state: string;
-    /**
-     * The human's control-plane session bearer. Falls back to the client's
-     * default auth when omitted — pass it explicitly unless the client was
-     * constructed with control-plane-session credentials.
-     */
-    token?: string;
-}
-/** Result of {@link Approval.requestChallenge}. Forward-compatible. */
-export interface ApprovalChallengeResult {
-    challenge_id: string;
-    confirm_url: string;
-    expires_at?: string;
-    action?: string;
-    org_id?: string | null;
-    project_id?: string | null;
-    delivery?: "cli_loopback" | "postmessage" | string;
-    [key: string]: unknown;
-}
-/** Input to {@link Approval.exchangeClaimCode}. */
-export interface ApprovalClaimInput {
-    /** Authorization code received on the loopback redirect. */
-    code: string;
-    /** The PKCE verifier whose hash was sent as `codeChallenge`. */
-    codeVerifier: string;
-    /** Must match the `state` used at challenge time. */
-    state: string;
-}
-/** Minted approval token payload. Expiry lives inside `session` as ISO-8601 strings. Forward-compatible. */
-export interface ApprovalTokenResult {
-    write_auth_token: string;
-    token_type?: string;
-    header?: string;
-    session?: {
-        expires_at?: string;
-        absolute_expires_at?: string;
-        amr?: string[];
-        [k: string]: unknown;
-    } | null;
-    [key: string]: unknown;
-}
-/**
- * Operator-approval ceremony seams — `r.operator.approval.*`. Isomorphic
- * (raw-request) seams: `requestChallenge` opens a passkey approval scoped to an
- * `(action, target)`; the human approves in the browser; the confirm page
- * redirects to the CLI loopback with a one-time `code`; `exchangeClaimCode`
- * (PKCE) mints the token. The loopback server + PKCE generation live in the
- * Node CLI (`run402 operator approve`).
- */
-export declare class Approval {
-    private readonly client;
-    constructor(client: Client);
-    /** Begin a scoped approval (`POST …/write-auth/challenges`). Carries the cp-session bearer. */
-    requestChallenge(input: ApprovalChallengeInput): Promise<ApprovalChallengeResult>;
-    /**
-     * Exchange the loopback claim `code` (+ PKCE verifier + `state`) for the
-     * approval token (`POST …/write-auth/cli/token`). No `redirect_uri` — it is
-     * bound at challenge time. Unauthenticated (code+verifier are the credential).
-     */
-    exchangeClaimCode(input: ApprovalClaimInput): Promise<ApprovalTokenResult>;
-}
-export declare class Operator {
-    private readonly client;
-    /**
-     * The hosted/browser control-plane **session** surface (gateway v1.78):
-     * `r.operator.session.email`, `verifyEmail`, `passkeyVerify`, `whoami`,
-     * `refresh`, `revoke`, and the step-up / authenticator helpers.
-     * The write-capable human login + step-up + authenticators, distinct from the
-     * read-only device/overview methods on this class and the loopback-PKCE
-     * CLI write-login below. See {@link OperatorSession}.
-     */
-    readonly session: OperatorSession;
-    /**
-     * Wallet-owned org claim (v1.82): `r.operator.claimWalletOrg.challenge()` +
-     * `.submit()`. The raw dual-proof seam; the Node convenience `claimWalletOrg`
-     * in `@run402/sdk/node` runs the full dance.
-     */
-    readonly claimWalletOrg: ClaimWalletOrg;
-    /**
-     * Operator-approval (write-auth) ceremony: `r.operator.approval.requestChallenge()`
-     * + `.exchangeClaimCode()`. The Node CLI (`run402 operator approve`) runs the
-     * loopback + PKCE around these isomorphic seams.
-     */
-    readonly approval: Approval;
-    constructor(client: Client);
-    /**
-     * Begin the device-authorization flow. Unauthenticated. Returns the codes the
-     * CLI prints (`user_code` + `verification_uri`) plus the poll `interval` and
-     * `expires_in`.
-     */
-    deviceStart(opts?: {
-        clientName?: string;
-    }): Promise<DeviceAuthStart>;
-    /**
-     * Poll once for approval. Bypasses the kernel's error mapping on purpose: the
-     * RFC 8628 error codes (`authorization_pending`, `slow_down`, ...) are normal
-     * polling states returned as data, not exceptions. Only an unexpected
-     * response shape throws.
-     */
-    devicePoll(deviceCode: string): Promise<DevicePollResult>;
-    /**
-     * Fetch the organization overview. With `opts.token` the request carries the
-     * operator-session bearer and returns the email-union; without it the request
-     * falls back to the credential provider's default auth (SIWX) and returns
-     * that wallet's slice. The CLI always passes a token (human-only surface); the
-     * SDK supports both because the gateway endpoint accepts both principals.
-     */
-    overview(opts?: {
-        token?: string;
-    }): Promise<OperatorOverview>;
-    /**
-     * Revoke the operator session server-side (the server half of
-     * `operator logout`). Idempotent on the gateway; returns 204. The local cache
-     * is cleared separately by the CLI.
-     */
-    revoke(opts: {
-        token: string;
-    }): Promise<void>;
-    /**
-     * Build the loopback-PKCE authorize URL the CLI opens in the browser. Pure —
-     * no network, no Node APIs — so it is safe in any runtime. The caller
-     * generates `codeChallenge`/`state`/`nonce` and runs the redirect server.
-     */
-    buildCliAuthorizeUrl(params: CliAuthorizeParams): string;
-    /**
-     * Exchange the loopback authorization code (+ PKCE verifier) for a
-     * write-capable {@link ControlPlaneSession}. Unauthenticated — the code +
-     * verifier are the credential.
-     */
-    exchangeCliToken(params: CliTokenExchange): Promise<ControlPlaneSession>;
-}
-//# sourceMappingURL=operator.d.ts.map

package/dist/namespaces/operator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAE7D,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,aAAa,CAAC,EAAE,OAAO,EAAE,CAAC;IAC1B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AAWD;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,YAAY,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAC/F,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iDAAiD;AACjD,MAAM,WAAW,mBAAmB;IAClC,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,gBAAgB;IAC/B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;IACb,wFAAwF;IACxF,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,qFAAqF;IACrF,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,6FAA6F;AAC7F,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,MAAM,WAAW,GACnB;IACE,MAAM,EAAE,SAAS,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,uEAAuE;IACvE,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,GACD;IACE,MAAM,EAAE,YAAY,CAAC;IACrB,eAAe,EAAE,aAAa,EAAE,CAAC;IACjC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB,CAAC;AAEN;;;;;;GAMG;AACH,qBAAa,cAAc;IACb,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,uGAAuG;IACjG,SAAS,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,cAAc,CAAC;IAYpE;;;;;;OAMG;IACG,MAAM,CAAC,KAAK,EAAE,gBAAgB,GAAG,OAAO,CAAC,WAAW,CAAC;CAiB5D;AAOD,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC,wFAAwF;IACxF,MAAM,EAAE,mBAAmB,CAAC;IAC5B,yCAAyC;IACzC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,8DAA8D;IAC9D,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,2EAA2E;IAC3E,cAAc,EAAE,MAAM,CAAC;IACvB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,8DAA8D;IAC9D,KAAK,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,uEAAuE;AACvE,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,QAAQ,CAAC,EAAE,cAAc,GAAG,aAAa,GAAG,MAAM,CAAC;IACnD,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,mDAAmD;AACnD,MAAM,WAAW,kBAAkB;IACjC,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AAED,4GAA4G;AAC5G,MAAM,WAAW,mBAAmB;IAClC,gBAAgB,EAAE,MAAM,CAAC;IACzB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,mBAAmB,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;QAAC,CAAC,CAAC,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,GAAG,IAAI,CAAC;IAC7G,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;;;GAOG;AACH,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C,+FAA+F;IACzF,gBAAgB,CAAC,KAAK,EAAE,sBAAsB,GAAG,OAAO,CAAC,uBAAuB,CAAC;IAsBvF;;;;OAIG;IACG,iBAAiB,CAAC,KAAK,EAAE,kBAAkB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAWjF;AAED,qBAAa,QAAQ;IAyBP,OAAO,CAAC,QAAQ,CAAC,MAAM;IAxBnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;IAElC;;;;OAIG;IACH,QAAQ,CAAC,cAAc,EAAE,cAAc,CAAC;IAExC;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAEC,MAAM,EAAE,MAAM;IAM3C;;;;OAIG;IACG,WAAW,CAAC,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IAS/E;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC/D;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAaxE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;;;OAIG;IACH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAWxD;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAa/E"}

package/dist/namespaces/operator.js

@@ -1,272 +0,0 @@
-/**
- * `operator` namespace — the *human* (email) principal, distinct from the
- * agent's per-wallet SIWX identity.
- *
- * The human authenticates in the browser via an OAuth 2.0 device-authorization
- * grant (RFC 8628, the `aws sso login` model): `deviceStart` returns a
- * user-facing code + URL, the human approves it via the existing magic-link or
- * passkey web flow, and `devicePoll` brokers the resulting operator-session
- * token. `overview` reads the email-union account view with that token, and
- * `revoke` ends the session server-side.
- *
- * Bearer auth is passed explicitly (`opts.token`) rather than sourced from a
- * credential provider, because the operator session is a Node-only on-disk
- * cache (`core/operator-session.ts`) and this namespace stays isomorphic. The
- * `device*` endpoints are unauthenticated (the `device_code` in the body is the
- * credential), so they send no auth headers.
- *
- * Gateway contract: the RFC 8628 device-auth bridge.
- */
-import { ApiError, LocalError, NetworkError } from "../errors.js";
-import { OperatorSession } from "./operator-session.js";
-const POLL_ERROR_CODES = new Set([
-    "authorization_pending",
-    "slow_down",
-    "access_denied",
-    "expired_token",
-]);
-/**
- * Wallet-owned org claim — `r.operator.claimWalletOrg.*`. The isomorphic
- * (raw-proof) seam: `challenge` issues a nonce; `submit` posts the dual proof
- * (control-plane session bearer + a fresh `SIGN-IN-WITH-X` wallet signature). The
- * Node convenience `signWalletOrgClaim` / `claimWalletOrg` in `@run402/sdk/node`
- * runs the whole dance (read session → challenge → sign → submit).
- */
-export class ClaimWalletOrg {
-    client;
-    constructor(client) {
-        this.client = client;
-    }
-    /** Request a single-use challenge nonce the wallet must sign (`POST …/claim-wallet-org/challenge`). */
-    async challenge(input) {
-        if (!input?.wallet) {
-            throw new LocalError("claimWalletOrg.challenge requires { wallet }", "requesting wallet-org claim challenge");
-        }
-        return this.client.request("/agent/v1/operator/claim-wallet-org/challenge", {
-            method: "POST",
-            body: { wallet: input.wallet },
-            ...(input.token ? { headers: { Authorization: `Bearer ${input.token}` }, withAuth: false } : {}),
-            context: "requesting wallet-org claim challenge",
-        });
-    }
-    /**
-     * Execute the claim (`POST …/claim-wallet-org`) carrying both proofs: the
-     * control-plane session bearer (the human) and the `SIGN-IN-WITH-X` wallet
-     * signature. Returns a discriminated {@link ClaimResult}; a `select_org` result
-     * is returned (not thrown). Throws {@link StepUpRequiredError} when the session
-     * is not passkey-fresh, and `ApiError` (`WALLET_PROOF_INVALID`) on a bad proof.
-     */
-    async submit(input) {
-        if (!input?.siwx) {
-            throw new LocalError("claimWalletOrg.submit requires { siwx } (the SIGN-IN-WITH-X proof)", "claiming wallet org");
-        }
-        const headers = { "SIGN-IN-WITH-X": input.siwx };
-        if (input.token)
-            headers.Authorization = `Bearer ${input.token}`;
-        const body = {};
-        if (input.orgId !== undefined)
-            body.org_id = input.orgId;
-        if (input.displayName !== undefined)
-            body.display_name = input.displayName;
-        return this.client.request("/agent/v1/operator/claim-wallet-org", {
-            method: "POST",
-            body,
-            headers,
-            withAuth: !input.token,
-            context: "claiming wallet org",
-        });
-    }
-}
-/**
- * Operator-approval ceremony seams — `r.operator.approval.*`. Isomorphic
- * (raw-request) seams: `requestChallenge` opens a passkey approval scoped to an
- * `(action, target)`; the human approves in the browser; the confirm page
- * redirects to the CLI loopback with a one-time `code`; `exchangeClaimCode`
- * (PKCE) mints the token. The loopback server + PKCE generation live in the
- * Node CLI (`run402 operator approve`).
- */
-export class Approval {
-    client;
-    constructor(client) {
-        this.client = client;
-    }
-    /** Begin a scoped approval (`POST …/write-auth/challenges`). Carries the cp-session bearer. */
-    async requestChallenge(input) {
-        const body = {
-            action: input.action,
-            cli_redirect_uri: input.cliRedirectUri,
-            code_challenge: input.codeChallenge,
-            state: input.state,
-        };
-        if (input.orgId !== undefined)
-            body.org_id = input.orgId;
-        if (input.projectId !== undefined)
-            body.project_id = input.projectId;
-        return this.client.request("/agent/v1/control-plane/write-auth/challenges", {
-            method: "POST",
-            body,
-            ...(input.token
-                ? { headers: { Authorization: `Bearer ${input.token}` }, withAuth: false }
-                : {}),
-            context: "requesting operator approval challenge",
-        });
-    }
-    /**
-     * Exchange the loopback claim `code` (+ PKCE verifier + `state`) for the
-     * approval token (`POST …/write-auth/cli/token`). No `redirect_uri` — it is
-     * bound at challenge time. Unauthenticated (code+verifier are the credential).
-     */
-    async exchangeClaimCode(input) {
-        return this.client.request("/agent/v1/control-plane/write-auth/cli/token", {
-            method: "POST",
-            body: { code: input.code, code_verifier: input.codeVerifier, state: input.state },
-            withAuth: false,
-            context: "exchanging operator approval claim code",
-        });
-    }
-}
-export class Operator {
-    client;
-    /**
-     * The hosted/browser control-plane **session** surface (gateway v1.78):
-     * `r.operator.session.email`, `verifyEmail`, `passkeyVerify`, `whoami`,
-     * `refresh`, `revoke`, and the step-up / authenticator helpers.
-     * The write-capable human login + step-up + authenticators, distinct from the
-     * read-only device/overview methods on this class and the loopback-PKCE
-     * CLI write-login below. See {@link OperatorSession}.
-     */
-    session;
-    /**
-     * Wallet-owned org claim (v1.82): `r.operator.claimWalletOrg.challenge()` +
-     * `.submit()`. The raw dual-proof seam; the Node convenience `claimWalletOrg`
-     * in `@run402/sdk/node` runs the full dance.
-     */
-    claimWalletOrg;
-    /**
-     * Operator-approval (write-auth) ceremony: `r.operator.approval.requestChallenge()`
-     * + `.exchangeClaimCode()`. The Node CLI (`run402 operator approve`) runs the
-     * loopback + PKCE around these isomorphic seams.
-     */
-    approval;
-    constructor(client) {
-        this.client = client;
-        this.session = new OperatorSession(client);
-        this.claimWalletOrg = new ClaimWalletOrg(client);
-        this.approval = new Approval(client);
-    }
-    /**
-     * Begin the device-authorization flow. Unauthenticated. Returns the codes the
-     * CLI prints (`user_code` + `verification_uri`) plus the poll `interval` and
-     * `expires_in`.
-     */
-    async deviceStart(opts = {}) {
-        return this.client.request("/agent/v1/operator/session/device", {
-            method: "POST",
-            body: opts.clientName ? { client_name: opts.clientName } : {},
-            withAuth: false,
-            context: "starting operator device authorization",
-        });
-    }
-    /**
-     * Poll once for approval. Bypasses the kernel's error mapping on purpose: the
-     * RFC 8628 error codes (`authorization_pending`, `slow_down`, ...) are normal
-     * polling states returned as data, not exceptions. Only an unexpected
-     * response shape throws.
-     */
-    async devicePoll(deviceCode) {
-        const url = `${this.client.apiBase}/agent/v1/operator/session/device/token`;
-        let res;
-        try {
-            res = await this.client.fetch(url, {
-                method: "POST",
-                headers: { "Content-Type": "application/json" },
-                body: JSON.stringify({ device_code: deviceCode }),
-            });
-        }
-        catch (err) {
-            throw new NetworkError(`Network error while polling operator device token: ${err.message}`, err, "polling operator device token");
-        }
-        const body = (await res.json().catch(() => null));
-        if (res.ok && body && typeof body.operator_session_token === "string") {
-            return { kind: "approved", session: body };
-        }
-        const error = body && typeof body.error === "string" ? body.error : null;
-        if (error && POLL_ERROR_CODES.has(error)) {
-            return { kind: error };
-        }
-        throw new ApiError(`Unexpected operator device-token response (HTTP ${res.status})`, res.status, body, "polling operator device token");
-    }
-    /**
-     * Fetch the organization overview. With `opts.token` the request carries the
-     * operator-session bearer and returns the email-union; without it the request
-     * falls back to the credential provider's default auth (SIWX) and returns
-     * that wallet's slice. The CLI always passes a token (human-only surface); the
-     * SDK supports both because the gateway endpoint accepts both principals.
-     */
-    async overview(opts = {}) {
-        if (opts.token) {
-            return this.client.request("/agent/v1/operator/overview", {
-                headers: { Authorization: `Bearer ${opts.token}` },
-                withAuth: false,
-                context: "fetching operator overview",
-            });
-        }
-        return this.client.request("/agent/v1/operator/overview", {
-            context: "fetching operator overview",
-        });
-    }
-    /**
-     * Revoke the operator session server-side (the server half of
-     * `operator logout`). Idempotent on the gateway; returns 204. The local cache
-     * is cleared separately by the CLI.
-     */
-    async revoke(opts) {
-        await this.client.request("/agent/v1/operator/session/revoke", {
-            method: "POST",
-            headers: { Authorization: `Bearer ${opts.token}` },
-            withAuth: false,
-            context: "revoking operator session",
-        });
-    }
-    // ── Loopback-PKCE write-login (v1.78, RFC 8252 §7.3) ──────────────────────
-    // The aws-sso-style write login: the CLI starts a `127.0.0.1` server, opens
-    // the browser to the authorize URL (the console runs the passkey ceremony +
-    // approves), receives the code on the loopback redirect, then exchanges it
-    // here for a write-capable, passkey-fresh control-plane session
-    // (`provenance=loopback_pkce`). PKCE generation + the loopback server live in
-    // the Node CLI; these two methods are the isomorphic SDK seam.
-    /**
-     * Build the loopback-PKCE authorize URL the CLI opens in the browser. Pure —
-     * no network, no Node APIs — so it is safe in any runtime. The caller
-     * generates `codeChallenge`/`state`/`nonce` and runs the redirect server.
-     */
-    buildCliAuthorizeUrl(params) {
-        const q = new URLSearchParams({
-            redirect_uri: params.redirectUri,
-            code_challenge: params.codeChallenge,
-            code_challenge_method: "S256",
-            state: params.state,
-            nonce: params.nonce,
-        });
-        return `${this.client.apiBase}/agent/v1/control-plane/cli/authorize?${q.toString()}`;
-    }
-    /**
-     * Exchange the loopback authorization code (+ PKCE verifier) for a
-     * write-capable {@link ControlPlaneSession}. Unauthenticated — the code +
-     * verifier are the credential.
-     */
-    async exchangeCliToken(params) {
-        return this.client.request("/agent/v1/control-plane/cli/token", {
-            method: "POST",
-            body: {
-                code: params.code,
-                code_verifier: params.codeVerifier,
-                redirect_uri: params.redirectUri,
-                state: params.state,
-            },
-            withAuth: false,
-            context: "exchanging CLI authorization code",
-        });
-    }
-}
-//# sourceMappingURL=operator.js.map

package/dist/namespaces/operator.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAiGxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAgFH;;;;;;GAMG;AACH,MAAM,OAAO,cAAc;IACI;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,uGAAuG;IACvG,KAAK,CAAC,SAAS,CAAC,KAA0B;QACxC,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,CAAC;YACnB,MAAM,IAAI,UAAU,CAAC,8CAA8C,EAAE,uCAAuC,CAAC,CAAC;QAChH,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAiB,+CAA+C,EAAE;YAC1F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE;YAC9B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAChG,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,MAAM,CAAC,KAAuB;QAClC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;YACjB,MAAM,IAAI,UAAU,CAAC,oEAAoE,EAAE,qBAAqB,CAAC,CAAC;QACpH,CAAC;QACD,MAAM,OAAO,GAA2B,EAAE,gBAAgB,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC;QACzE,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,CAAC,aAAa,GAAG,UAAU,KAAK,CAAC,KAAK,EAAE,CAAC;QACjE,MAAM,IAAI,GAA4B,EAAE,CAAC;QACzC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QACzD,IAAI,KAAK,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,KAAK,CAAC,WAAW,CAAC;QAC3E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAc,qCAAqC,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,OAAO;YACP,QAAQ,EAAE,CAAC,KAAK,CAAC,KAAK;YACtB,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;IACL,CAAC;CACF;AA4DD;;;;;;;GAOG;AACH,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,+FAA+F;IAC/F,KAAK,CAAC,gBAAgB,CAAC,KAA6B;QAClD,MAAM,IAAI,GAA4B;YACpC,MAAM,EAAE,KAAK,CAAC,MAAM;YACpB,gBAAgB,EAAE,KAAK,CAAC,cAAc;YACtC,cAAc,EAAE,KAAK,CAAC,aAAa;YACnC,KAAK,EAAE,KAAK,CAAC,KAAK;SACnB,CAAC;QACF,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC;QACzD,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;YAAE,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,SAAS,CAAC;QACrE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,+CAA+C,EAC/C;YACE,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,GAAG,CAAC,KAAK,CAAC,KAAK;gBACb,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;gBAC1E,CAAC,CAAC,EAAE,CAAC;YACP,OAAO,EAAE,wCAAwC;SAClD,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB,CAAC,KAAyB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,8CAA8C,EAC9C;YACE,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,KAAK,CAAC,YAAY,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YACjF,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,yCAAyC;SACnD,CACF,CAAC;IACJ,CAAC;CACF;AAED,MAAM,OAAO,QAAQ;IAyBU;IAxB7B;;;;;;;OAOG;IACM,OAAO,CAAkB;IAElC;;;;OAIG;IACM,cAAc,CAAiB;IAExC;;;;OAIG;IACM,QAAQ,CAAW;IAE5B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,IAAI,cAAc,CAAC,MAAM,CAAC,CAAC;QACjD,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgC,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,mCAAmC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC;QAC5E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,sDAAuD,GAAa,CAAC,OAAO,EAAE,EAC9E,GAAG,EACH,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAuC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,KAAsD,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,mDAAmD,GAAG,CAAC,MAAM,GAAG,EAChE,GAAG,CAAC,MAAM,EACV,IAAI,EACJ,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;gBAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;gBAClD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;YAC1E,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,mCAAmC,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,gEAAgE;IAChE,8EAA8E;IAC9E,+DAA+D;IAE/D;;;;OAIG;IACH,oBAAoB,CAAC,MAA0B;QAC7C,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAwB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,mCAAmC,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;YACD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/node/bearer-claim-key.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"bearer-claim-key.d.ts","sourceRoot":"","sources":["../../src/node/bearer-claim-key.ts"],"names":[],"mappings":"AAsCA,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,QAAQ,GAAG,MAAM,CAAC;AAEtD,MAAM,WAAW,qBAAqB;IACpC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,gJAAgJ;IAChJ,WAAW,EAAE,MAAM,CAAC;IACpB,uGAAuG;IACvG,SAAS,EAAE,MAAM,CAAC;IAClB;;;;;;OAMG;IACH,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,4HAA4H;IAC5H,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,2EAA2E;IAC3E,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,qBAAqB,EAIhE,CAAC;AAcF,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,SAAS,CAAC;IAChB,QAAQ,EAAE,UAAU,CAAC;IACrB,uGAAuG;IACvG,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED,8EAA8E;AAC9E,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,SAAS,CAAC;IAChB,gBAAgB,EAAE,UAAU,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED,iGAAiG;AACjG,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,QAAQ,CAAC;IACf,eAAe,EAAE,UAAU,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,UAAU,CAAC;CAC3B;AAED,sJAAsJ;AACtJ,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAC;IACb,eAAe,EAAE,UAAU,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,UAAU,CAAC;CAC3B;AASD,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,SAAe,GAAG,UAAU,CAM1E;AAED,+KAA+K;AAC/K,wBAAgB,aAAa,IAAI,MAAM,CAKtC;AAUD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,YAAY,GAAE,UAA6C,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,gBAAgB,EAAE,UAAU,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,CAG3L;AAED,sFAAsF;AACtF,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,GAAE,UAA6C,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,UAAU,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,CAGxL;AAED;;;;;;GAMG;AACH,wBAAgB,qBAAqB,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,GAAE,UAA6C,GAAG;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,eAAe,EAAE,UAAU,CAAC;IAAC,aAAa,EAAE,UAAU,CAAA;CAAE,CAG5L;AAED;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,SAAS,GAAG,aAAa,CA4BjF;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,eAAe,CAG5D;AAED,mFAAmF;AACnF,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CAG1D;AAED,2GAA2G;AAC3G,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,kBAAkB,CAGlE;AAID,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,UAAU,CAAC;IACxB,QAAQ,EAAE,UAAU,CAAC;IACrB,wGAAwG;IACxG,aAAa,EAAE,MAAM,CAAC;CACvB;AAmBD,iIAAiI;AACjI,wBAAgB,oBAAoB,CAAC,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,cAAc,CAEzG;AAED,kNAAkN;AAClN,wBAAgB,mBAAmB,CAAC,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,cAAc,CAEvG;AAgBD,kJAAkJ;AAClJ,wBAAgB,0BAA0B,CAAC,aAAa,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,GAAG,UAAU,CAE1G;AAED,uLAAuL;AACvL,wBAAgB,yBAAyB,CAAC,UAAU,EAAE,UAAU,GAAG,MAAM,CAExE"}