@uluops/ops-sdk 6.1.0 → 6.4.1

package/dist/config/validators.js.map

@@ -1 +1 @@
-{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/config/validators.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,mCAAmC,EACnC,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IAFlB,YACE,OAAe,EACC,MAA4B;QAE5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAsB;QAG5C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,CAA+B;IACrD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,GAAG,KAAK,oBAAoB,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAI,MAAoB,EAAE,IAAa,EAAE,OAAe;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,IAAI,oBAAoB,CAAC,WAAW,OAAO,KAAK,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,+CAA+C;AAC/C,kBAAkB;AAClB,+CAA+C;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,OAAO,QAAQ,CAAC,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,OAAO,QAAQ,CAAC,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,OAAO,QAAQ,CAAC,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC;AAED,+CAA+C;AAC/C,qBAAqB;AACrB,+CAA+C;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC;AAED,+CAA+C;AAC/C,iBAAiB;AACjB,+CAA+C;AAE/C;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,OAAO,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,OAAO,QAAQ,CAAC,oBAAoB,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,IAA+B,CAAC;QAC7C,MAAM,SAAS,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC3F,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAChF,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,2BAA2B,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAED,+CAA+C;AAC/C,mBAAmB;AACnB,+CAA+C;AAE/C;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACxD,OAAO,QAAQ,CAAC,0BAA0B,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAAa;IAC1D,OAAO,QAAQ,CAAC,4BAA4B,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACxD,OAAO,QAAQ,CAAC,0BAA0B,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,OAAO,QAAQ,CAAC,2BAA2B,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAGD,+CAA+C;AAC/C,oBAAoB;AACpB,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,8DAA8D;AAC9D,6EAA6E;AAC7E,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAiB;IAC3D,MAAM,SAAS,GAAG,4EAA4E,CAAC;IAC/F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,WAAW,SAAS,wBAAwB,EAAE;YAC3E,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,SAAiB;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,oBAAoB,CAAC,GAAG,SAAS,cAAc,EAAE;YACzD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,SAAiB;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,oBAAoB,CAAC,GAAG,SAAS,6BAA6B,EAAE;YACxE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"validators.js","sourceRoot":"","sources":["../../src/config/validators.ts"],"names":[],"mappings":"AACA,OAAO,EACL,wBAAwB,EACxB,wBAAwB,EACxB,kBAAkB,EAClB,0BAA0B,EAC1B,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,oBAAoB,EACpB,2BAA2B,EAC3B,mCAAmC,EACnC,mBAAmB,EACnB,gBAAgB,EAChB,wBAAwB,EACxB,yBAAyB,EACzB,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,2BAA2B,EAC3B,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IAG3B;IAFlB,YACE,OAAe,EACC,MAA4B;QAE5C,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAsB;QAG5C,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED;;GAEG;AACH,SAAS,cAAc,CAAC,CAA+B;IACrD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC;IAC3C,IAAI,CAAC,CAAC,IAAI,KAAK,eAAe,IAAI,QAAQ,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,OAAO,GAAG,KAAK,oBAAoB,IAAI,EAAE,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AAClC,CAAC;AAED,SAAS,QAAQ,CAAI,MAAoB,EAAE,IAAa,EAAE,OAAe;IACvE,MAAM,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpE,MAAM,IAAI,oBAAoB,CAAC,WAAW,OAAO,KAAK,QAAQ,EAAE,EAAE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED,+CAA+C;AAC/C,kBAAkB;AAClB,+CAA+C;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAa;IACjD,OAAO,QAAQ,CAAC,mBAAmB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAAa;IAC9C,OAAO,QAAQ,CAAC,gBAAgB,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAa;IACvD,OAAO,QAAQ,CAAC,yBAAyB,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAa;IACrD,OAAO,QAAQ,CAAC,uBAAuB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACrE,CAAC;AAED,+CAA+C;AAC/C,qBAAqB;AACrB,+CAA+C;AAE/C;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAa;IACtD,OAAO,QAAQ,CAAC,wBAAwB,EAAE,IAAI,EAAE,iBAAiB,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAa;IAC3D,OAAO,QAAQ,CAAC,6BAA6B,EAAE,IAAI,EAAE,uBAAuB,CAAC,CAAC;AAChF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,OAAO,QAAQ,CAAC,oBAAoB,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED,+CAA+C;AAC/C,iBAAiB;AACjB,+CAA+C;AAE/C;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAa;IAChD,OAAO,QAAQ,CAAC,kBAAkB,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAa;IAClD,OAAO,QAAQ,CAAC,oBAAoB,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtE,MAAM,IAAI,GAAG,IAA+B,CAAC;QAC7C,MAAM,SAAS,GAAG,mCAAmC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;QAC3F,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,oBAAoB,CAC5B,0DAA0D,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAChF,EAAE,CACH,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC,2BAA2B,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAED,+CAA+C;AAC/C,mBAAmB;AACnB,+CAA+C;AAE/C;;;;;;;;GAQG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACxD,OAAO,QAAQ,CAAC,0BAA0B,EAAE,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACtE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAa;IACpD,OAAO,QAAQ,CAAC,sBAAsB,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC;AAChE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,8BAA8B,CAAC,IAAa;IAC1D,OAAO,QAAQ,CAAC,4BAA4B,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAAC,IAAa;IACxD,OAAO,QAAQ,CAAC,0BAA0B,EAAE,IAAI,EAAE,YAAY,CAAC,CAAC;AAClE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,6BAA6B,CAAC,IAAa;IACzD,OAAO,QAAQ,CAAC,2BAA2B,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAGD,+CAA+C;AAC/C,oBAAoB;AACpB,+CAA+C;AAC/C,EAAE;AACF,uEAAuE;AACvE,8DAA8D;AAC9D,6EAA6E;AAC7E,gFAAgF;AAEhF;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,KAAa,EAAE,SAAiB;IAC3D,MAAM,SAAS,GAAG,4EAA4E,CAAC;IAC/F,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,oBAAoB,CAAC,WAAW,SAAS,wBAAwB,EAAE;YAC3E,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,sBAAsB,EAAE;SACvE,CAAC,CAAC;IACL,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAc,EAAE,SAAiB;IACtE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,oBAAoB,CAAC,GAAG,SAAS,cAAc,EAAE;YACzD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE;SAC9D,CAAC,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAc,EAAE,SAAiB;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC1B,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,oBAAoB,CAAC,GAAG,SAAS,6BAA6B,EAAE;YACxE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,4BAA4B,EAAE;SAC7E,CAAC,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/config/workspace-org.d.ts

@@ -0,0 +1,77 @@
+/** The workspace file name, found by walking upward from cwd. */
+export declare const WORKSPACE_ORG_FILE = ".uluops.json";
+/** Reserved `org` value: stop the walk here and use the personal org. */
+export declare const PERSONAL_ORG_SENTINEL = "personal";
+export type WorkspaceOrgSource = 'explicit' | 'workspace' | 'env' | 'personal';
+export interface WorkspaceOrgResolution {
+    /** The org slug to send, or `undefined` for the personal org (no header). */
+    org: string | undefined;
+    /** Which rung answered. `'personal'` also covers a workspace file that says `"personal"`. */
+    source: WorkspaceOrgSource;
+    /** The workspace file that answered, when `source` is `'workspace'` or a `"personal"` stop. */
+    path?: string;
+}
+export interface ResolveWorkspaceOrgOptions {
+    /** A per-call / per-invocation value; wins over everything when set. */
+    explicit?: string;
+    /** Directory to walk upward from. Defaults to `process.cwd()`. */
+    cwd?: string;
+    /** Environment to read `ULUOPS_ORG_SLUG` from. Defaults to `process.env`. */
+    env?: NodeJS.ProcessEnv;
+    /**
+     * Directory at which the walk stops (inclusive). Defaults to the running
+     * user's home directory when `cwd` is under it (a file at `/` or `/Users`
+     * can never answer), else the filesystem root. Tests pass a temp dir so a
+     * real `.uluops.json` above it cannot leak in.
+     */
+    stopAt?: string;
+    /** Home directory used for the default `stopAt`. Defaults to `os.homedir()`. Injectable for tests. */
+    home?: string;
+    /**
+     * Numeric uid the answering file must be owned by. Defaults to
+     * `process.getuid()`; `undefined` on platforms without uids (Windows)
+     * disables the check. Injectable for tests (chown is not available to them).
+     */
+    uid?: number;
+}
+/**
+ * Find the nearest `.uluops.json` at or above `cwd`, stopping at `stopAt`.
+ * With no `stopAt`, the walk is bounded by `home` (default `os.homedir()`)
+ * when `cwd` is under it: security audit run #187 (all four agents) — an
+ * unbounded walk makes a file at `/`, `/Users` or a container image root
+ * the silent default for every checkout beneath it, which is the
+ * single-default leak D13 exists to remove, one layer down. Outside the
+ * home directory the walk still reaches the filesystem root; the ownership
+ * check in `readWorkspaceOrgFile` is the guard there.
+ */
+export declare function findWorkspaceOrgFile(cwd: string, stopAt?: string, home?: string): string | undefined;
+/**
+ * Read one workspace file. Returns the `org` it declares (`"personal"` is
+ * returned verbatim — the caller decides what it means), or `undefined` when
+ * the file exists but declares no `org`.
+ *
+ * A file not owned by `uid` (default: the running user) is REFUSED, not
+ * skipped: a shared parent directory another user can write to is the
+ * planting vector (run #187, circumvention A2), and a silently skipped file
+ * is a silently wrong org. Pass `uid: undefined` explicitly only on
+ * platforms with no uids.
+ *
+ * @throws {InputValidationError} on unreadable JSON, a non-object body, a
+ *   key other than `org`/`$schema`, a file owned by another user, or an
+ *   `org` that is not a valid slug (other than the sentinel).
+ */
+export declare function readWorkspaceOrgFile(path: string, uid?: number | undefined): string | undefined;
+/**
+ * Resolve the org for a call: explicit > nearest workspace file > env > personal.
+ *
+ * Never returns the sentinel — a `"personal"` file yields `{ org: undefined,
+ * source: 'personal', path }`. Never consults a cache; the walk is a handful
+ * of `existsSync` calls and a resolver that remembered would reintroduce the
+ * process-level default the spec rejects.
+ *
+ * @throws {InputValidationError} for an invalid `explicit` slug, or a
+ *   malformed / forbidden workspace file (loud on purpose: a silently ignored
+ *   file is a silently wrong org).
+ */
+export declare function resolveWorkspaceOrg(options?: ResolveWorkspaceOrgOptions): WorkspaceOrgResolution;
+//# sourceMappingURL=workspace-org.d.ts.map

package/dist/config/workspace-org.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-org.d.ts","sourceRoot":"","sources":["../../src/config/workspace-org.ts"],"names":[],"mappings":"AAuCA,iEAAiE;AACjE,eAAO,MAAM,kBAAkB,iBAAiB,CAAC;AAEjD,yEAAyE;AACzE,eAAO,MAAM,qBAAqB,aAAa,CAAC;AAehD,MAAM,MAAM,kBAAkB,GAAG,UAAU,GAAG,WAAW,GAAG,KAAK,GAAG,UAAU,CAAC;AAE/E,MAAM,WAAW,sBAAsB;IACrC,6EAA6E;IAC7E,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,6FAA6F;IAC7F,MAAM,EAAE,kBAAkB,CAAC;IAC3B,+FAA+F;IAC/F,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,0BAA0B;IACzC,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kEAAkE;IAClE,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,sGAAsG;IACtG,IAAI,CAAC,EAAE,MAAM,CAAC;IACd;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAkBD;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,MAAM,GAAG,SAAS,CAY/G;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,GAAG,SAA8B,GAAG,MAAM,GAAG,SAAS,CA8CnH;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,GAAE,0BAA+B,GAAG,sBAAsB,CAwBpG"}

package/dist/config/workspace-org.js

@@ -0,0 +1,182 @@
+/**
+ * Workspace org resolution — D13 of the project-org-routing-and-rehome spec.
+ *
+ * "Where you are" decides which org a tracker call lands in. The unit that
+ * distinguishes personal work from work-org work on one machine is the
+ * CHECKOUT, not the process or the person: an env var or a profile leaks the
+ * last-set org into whatever repo is opened next (spec §2.0 S3/S7). So the
+ * default comes from a file in the tree, found by walking upward from `cwd`
+ * to the nearest `.uluops.json` — the way `.npmrc` and `.gitignore` are found.
+ *
+ * Precedence, highest first:
+ *   1. `explicit`  — a per-call / per-invocation value (`--org`, an MCP tool's
+ *                    `org` argument);
+ *   2. the nearest `.uluops.json` above `cwd` whose `org` is set — including
+ *                    the reserved value `"personal"`, which STOPS the walk and
+ *                    resolves to no org (a personal repo cloned under a work
+ *                    tree carries it so the outer file does not win);
+ *   3. `ULUOPS_ORG_SLUG` in `env` — kept as the lowest fall-through for
+ *                    headless environments with no checkout;
+ *   4. undefined     — no header; the API key holder's personal org.
+ *
+ * The file may carry ONLY `org`. Credentials, base URLs and profiles are
+ * refused, not ignored: a `.env` in cwd once retargeted the CLI's base URL,
+ * and the one thing that keeps that footgun from transferring is that this
+ * file cannot name a target or an identity. An org slug is server-relative —
+ * the same file against a different base URL names a different org or none —
+ * so callers that print "where it landed" should print the base URL beside
+ * the org.
+ *
+ * Runtime-agnostic: reads are synchronous `fs` calls, no `process.cwd()` is
+ * consulted unless the caller passes none, and `env` is injectable so tests
+ * never touch the real environment.
+ */
+import { existsSync, readFileSync, statSync } from 'fs';
+import { homedir } from 'os';
+import { dirname, join, resolve, relative, isAbsolute } from 'path';
+import { InputValidationError } from './validators.js';
+import { ENV_VARS } from './constants.js';
+/** The workspace file name, found by walking upward from cwd. */
+export const WORKSPACE_ORG_FILE = '.uluops.json';
+/** Reserved `org` value: stop the walk here and use the personal org. */
+export const PERSONAL_ORG_SENTINEL = 'personal';
+/** Same pattern as `OpsHttpClient`'s `orgSlug` — it is a header value. */
+const ORG_SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/;
+/**
+ * The ONLY keys a workspace file may carry. An allowlist, not a denylist:
+ * until 6.3.1 this was a list of ten forbidden names while the error message
+ * said "may carry only org" — `baseURL`, `apikey`, `token` and anything
+ * unlisted passed (security audit run #187, agentic-security-analyst F10).
+ * Inert then (only `org` was ever read), but the stated invariant must be
+ * the enforced one. `$schema` is allowed for editor tooling.
+ */
+const ALLOWED_KEYS = new Set(['org', '$schema']);
+function assertSlug(value, where) {
+    if (typeof value !== 'string' || !ORG_SLUG_PATTERN.test(value)) {
+        throw new InputValidationError(`Invalid org in ${where}: must be 1-100 alphanumeric characters, hyphens, or underscores`, [{ code: 'custom', path: ['org'], message: 'must be 1-100 alphanumeric characters, hyphens, or underscores' }]);
+    }
+    return value;
+}
+/** True when `child` is `parent` or lies beneath it. */
+function isUnder(child, parent) {
+    const rel = relative(parent, child);
+    return rel === '' || (!rel.startsWith('..') && !isAbsolute(rel));
+}
+/**
+ * Find the nearest `.uluops.json` at or above `cwd`, stopping at `stopAt`.
+ * With no `stopAt`, the walk is bounded by `home` (default `os.homedir()`)
+ * when `cwd` is under it: security audit run #187 (all four agents) — an
+ * unbounded walk makes a file at `/`, `/Users` or a container image root
+ * the silent default for every checkout beneath it, which is the
+ * single-default leak D13 exists to remove, one layer down. Outside the
+ * home directory the walk still reaches the filesystem root; the ownership
+ * check in `readWorkspaceOrgFile` is the guard there.
+ */
+export function findWorkspaceOrgFile(cwd, stopAt, home = homedir()) {
+    let dir = resolve(cwd);
+    const homeAbs = resolve(home);
+    const stop = stopAt !== undefined ? resolve(stopAt) : isUnder(dir, homeAbs) ? homeAbs : undefined;
+    for (;;) {
+        const candidate = join(dir, WORKSPACE_ORG_FILE);
+        if (existsSync(candidate))
+            return candidate;
+        if (stop !== undefined && dir === stop)
+            return undefined;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return undefined;
+        dir = parent;
+    }
+}
+/**
+ * Read one workspace file. Returns the `org` it declares (`"personal"` is
+ * returned verbatim — the caller decides what it means), or `undefined` when
+ * the file exists but declares no `org`.
+ *
+ * A file not owned by `uid` (default: the running user) is REFUSED, not
+ * skipped: a shared parent directory another user can write to is the
+ * planting vector (run #187, circumvention A2), and a silently skipped file
+ * is a silently wrong org. Pass `uid: undefined` explicitly only on
+ * platforms with no uids.
+ *
+ * @throws {InputValidationError} on unreadable JSON, a non-object body, a
+ *   key other than `org`/`$schema`, a file owned by another user, or an
+ *   `org` that is not a valid slug (other than the sentinel).
+ */
+export function readWorkspaceOrgFile(path, uid = process.getuid?.()) {
+    if (uid !== undefined) {
+        let ownerUid;
+        try {
+            ownerUid = statSync(path).uid;
+        }
+        catch (err) {
+            throw new InputValidationError(`Unreadable ${WORKSPACE_ORG_FILE} at ${path}: ${err instanceof Error ? err.message : String(err)}`, [{ code: 'custom', path: [], message: 'cannot stat' }]);
+        }
+        if (ownerUid !== uid) {
+            throw new InputValidationError(`Refusing ${WORKSPACE_ORG_FILE} at ${path}: owned by uid ${String(ownerUid)}, not you (uid ${String(uid)}). ` +
+                'A workspace file decides which org your writes land in; only your own may answer.', [{ code: 'custom', path: [], message: 'not owned by the running user' }]);
+        }
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(path, 'utf8'));
+    }
+    catch (err) {
+        throw new InputValidationError(`Unreadable ${WORKSPACE_ORG_FILE} at ${path}: ${err instanceof Error ? err.message : String(err)}`, [{ code: 'custom', path: [], message: 'invalid JSON' }]);
+    }
+    if (parsed === null || typeof parsed !== 'object' || Array.isArray(parsed)) {
+        throw new InputValidationError(`Invalid ${WORKSPACE_ORG_FILE} at ${path}: expected an object`, [{ code: 'custom', path: [], message: 'expected an object' }]);
+    }
+    const body = parsed;
+    const forbidden = Object.keys(body).filter((k) => !ALLOWED_KEYS.has(k));
+    if (forbidden.length > 0) {
+        throw new InputValidationError(`Refusing ${WORKSPACE_ORG_FILE} at ${path}: it may carry only "org"; found ${forbidden.map((k) => `"${k}"`).join(', ')}. ` +
+            'Credentials and targets belong in ~/.uluops/credentials.json or the environment, never in the checkout.', forbidden.map((k) => ({ code: 'custom', path: [k], message: 'forbidden in the workspace file' })));
+    }
+    if (!('org' in body) || body['org'] === undefined || body['org'] === null)
+        return undefined;
+    if (body['org'] === PERSONAL_ORG_SENTINEL)
+        return PERSONAL_ORG_SENTINEL;
+    return assertSlug(body['org'], `${WORKSPACE_ORG_FILE} at ${path}`);
+}
+/**
+ * Resolve the org for a call: explicit > nearest workspace file > env > personal.
+ *
+ * Never returns the sentinel — a `"personal"` file yields `{ org: undefined,
+ * source: 'personal', path }`. Never consults a cache; the walk is a handful
+ * of `existsSync` calls and a resolver that remembered would reintroduce the
+ * process-level default the spec rejects.
+ *
+ * @throws {InputValidationError} for an invalid `explicit` slug, or a
+ *   malformed / forbidden workspace file (loud on purpose: a silently ignored
+ *   file is a silently wrong org).
+ */
+export function resolveWorkspaceOrg(options = {}) {
+    if (options.explicit !== undefined) {
+        // The sentinel is honoured on the explicit path too (6.3.1, run #187
+        // circumvention A3): a caller told "omit org for your personal org" will
+        // sometimes write `org: personal`, and until now that went to the wire
+        // as a slug (404, or a real org if anyone registers the name).
+        if (options.explicit === PERSONAL_ORG_SENTINEL)
+            return { org: undefined, source: 'explicit' };
+        return { org: assertSlug(options.explicit, 'explicit org'), source: 'explicit' };
+    }
+    const cwd = options.cwd ?? process.cwd();
+    const path = findWorkspaceOrgFile(cwd, options.stopAt, options.home);
+    if (path !== undefined) {
+        const declared = readWorkspaceOrgFile(path, 'uid' in options ? options.uid : process.getuid?.());
+        if (declared === PERSONAL_ORG_SENTINEL)
+            return { org: undefined, source: 'personal', path };
+        if (declared !== undefined)
+            return { org: declared, source: 'workspace', path };
+        // A file with no `org` is not an answer; keep walking would be surprising
+        // ("the nearest file wins" is the rule), so fall through to env.
+    }
+    const env = options.env ?? process.env;
+    const fromEnv = env[ENV_VARS.ORG_SLUG];
+    if (fromEnv !== undefined && fromEnv !== '') {
+        return { org: assertSlug(fromEnv, `env ${ENV_VARS.ORG_SLUG}`), source: 'env' };
+    }
+    return { org: undefined, source: 'personal' };
+}
+//# sourceMappingURL=workspace-org.js.map

package/dist/config/workspace-org.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-org.js","sourceRoot":"","sources":["../../src/config/workspace-org.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,IAAI,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,MAAM,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACvD,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C,iEAAiE;AACjE,MAAM,CAAC,MAAM,kBAAkB,GAAG,cAAc,CAAC;AAEjD,yEAAyE;AACzE,MAAM,CAAC,MAAM,qBAAqB,GAAG,UAAU,CAAC;AAEhD,0EAA0E;AAC1E,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAE5D;;;;;;;GAOG;AACH,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;AAqCjD,SAAS,UAAU,CAAC,KAAc,EAAE,KAAa;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,oBAAoB,CAC5B,kBAAkB,KAAK,kEAAkE,EACzF,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAC/G,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wDAAwD;AACxD,SAAS,OAAO,CAAC,KAAa,EAAE,MAAc;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;IACpC,OAAO,GAAG,KAAK,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,GAAW,EAAE,MAAe,EAAE,OAAe,OAAO,EAAE;IACzF,IAAI,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAClG,SAAS,CAAC;QACR,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,IAAI,IAAI,KAAK,SAAS,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QACzD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,OAAO,SAAS,CAAC;QACrC,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,MAA0B,OAAO,CAAC,MAAM,EAAE,EAAE;IAC7F,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC;QAChC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,oBAAoB,CAC5B,cAAc,kBAAkB,OAAO,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAClG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC,CACvD,CAAC;QACJ,CAAC;QACD,IAAI,QAAQ,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,IAAI,oBAAoB,CAC5B,YAAY,kBAAkB,OAAO,IAAI,kBAAkB,MAAM,CAAC,QAAQ,CAAC,kBAAkB,MAAM,CAAC,GAAG,CAAC,KAAK;gBAC7G,mFAAmF,EACnF,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,+BAA+B,EAAE,CAAC,CACzE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAY,CAAC;IAC7D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,oBAAoB,CAC5B,cAAc,kBAAkB,OAAO,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,EAClG,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,cAAc,EAAE,CAAC,CACxD,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,oBAAoB,CAC5B,WAAW,kBAAkB,OAAO,IAAI,sBAAsB,EAC9D,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAC,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAiC,CAAC;IAC/C,MAAM,SAAS,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACxE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,oBAAoB,CAC5B,YAAY,kBAAkB,OAAO,IAAI,oCAAoC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI;YAC1H,yGAAyG,EACzG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAiB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,iCAAiC,EAAE,CAAC,CAAC,CAC3G,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5F,IAAI,IAAI,CAAC,KAAK,CAAC,KAAK,qBAAqB;QAAE,OAAO,qBAAqB,CAAC;IACxE,OAAO,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,kBAAkB,OAAO,IAAI,EAAE,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAsC,EAAE;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QACnC,qEAAqE;QACrE,yEAAyE;QACzE,uEAAuE;QACvE,+DAA+D;QAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,qBAAqB;YAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAC9F,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,MAAM,IAAI,GAAG,oBAAoB,CAAC,GAAG,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACrE,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,QAAQ,GAAG,oBAAoB,CAAC,IAAI,EAAE,KAAK,IAAI,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjG,IAAI,QAAQ,KAAK,qBAAqB;YAAE,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;QAC5F,IAAI,QAAQ,KAAK,SAAS;YAAE,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QAChF,0EAA0E;QAC1E,iEAAiE;IACnE,CAAC;IACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC;IACvC,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QAC5C,OAAO,EAAE,GAAG,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACjF,CAAC;IACD,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;AAChD,CAAC"}

package/dist/errors/errors.d.ts

@@ -53,4 +53,122 @@ export declare class AnalysisEchoMismatchError extends Error {
         analysisWrite: unknown;
     });
 }
+import { SdkApiError as _SdkApiError } from '@uluops/sdk-core/errors';
+/**
+ * 403 — the caller is a member of the org but below the write floor
+ * (`publisher`). On tracker writes the API rewrites the body: `details.applied`
+ * is `false` and the message forbids retrying without `org`. DO NOT retry the
+ * same call without an org: an org-less retry does not "fall back", it files
+ * the work in the caller's PERSONAL org (spec §3.1, S6).
+ */
+export declare const INSUFFICIENT_ORG_ROLE: "INSUFFICIENT_ORG_ROLE";
+/** 403 — the caller is not a member of the org named by `org` / `orgSlug`, or the key is bound to a different org. */
+export declare const ORG_ACCESS_DENIED: "ORG_ACCESS_DENIED";
+/**
+ * 410 — the project this name once denoted in this org has been RE-HOMED to
+ * another org (spec D14). `details.target_org.slug` is where it lives now:
+ * pass it as `org` and the same call succeeds. Do not create a new project
+ * at the old address — the tombstone exists precisely to refuse that fork.
+ */
+export declare const PROJECT_REHOMED: "PROJECT_REHOMED";
+/** `details` on an `INSUFFICIENT_ORG_ROLE` rejection from a tracker write. */
+export interface InsufficientOrgRoleDetails {
+    currentRole?: string;
+    requiredRole?: string;
+    /** Present on tracker writes: the org the write was refused in. */
+    orgSlug?: string | null;
+    /** Present on tracker writes: always `false` — nothing was applied. */
+    applied?: boolean;
+}
+/** `details` on a `PROJECT_REHOMED` rejection (spec §4.4a). */
+export interface ProjectRehomedDetails {
+    project_id: string;
+    target_org: {
+        id: string;
+        slug: string;
+    };
+    rehomed_at?: string;
+    reason?: string | null;
+}
+/** Type guard: the org write floor refused this call (403 `INSUFFICIENT_ORG_ROLE`). Terminal — do not retry without `org`. */
+export declare function isInsufficientOrgRoleError(err: unknown): err is _SdkApiError & {
+    details?: InsufficientOrgRoleDetails;
+};
+/** Type guard: not a member of the named org, or the key is bound elsewhere (403 `ORG_ACCESS_DENIED`). Terminal. */
+export declare function isOrgAccessDeniedError(err: unknown): err is _SdkApiError;
+/** Type guard: the project was re-homed; `err.details.target_org.slug` is the org to pass (410 `PROJECT_REHOMED`). */
+export declare function isProjectRehomedError(err: unknown): err is _SdkApiError & {
+    details: ProjectRehomedDetails;
+};
+/**
+ * 403 — the route is session-only (D20): platform-admin writes that mint or
+ * re-point identity, and the two cross-tenant project moves, refuse a `ulr_`
+ * key even when its user is a platform admin. Terminal for a key-authenticated
+ * client: log in (`OpsClient.login`, completing MFA with `loginWithTotp` if
+ * challenged) and retry with the session — never by minting another key.
+ */
+export declare const SESSION_REQUIRED: "SESSION_REQUIRED";
+/** 403 — the caller lacks the PLATFORM role (`users.role`) the admin path requires; distinct from the org-role codes above. */
+export declare const INSUFFICIENT_ROLE: "INSUFFICIENT_ROLE";
+/** Type guard: session-only route refused an API key (403 `SESSION_REQUIRED`). Terminal for key auth. */
+export declare function isSessionRequiredError(err: unknown): err is _SdkApiError;
+/** Type guard: the caller's PLATFORM role is below what the admin path requires (403 `INSUFFICIENT_ROLE`). Terminal — no org argument changes it. */
+export declare function isInsufficientRoleError(err: unknown): err is _SdkApiError;
+/**
+ * The refusal reasons a re-home can answer with, as `details.reason` on a
+ * 400 (`VALIDATION_ERROR`) or 409 (`CONFLICT`). Enumerated here because the
+ * Phase 4 runbook (spec §4.7 item 3) assigns each a disposition, and a script
+ * that switches on a string it typed itself will misspell one:
+ *
+ * - `same_org` — already there. Idempotent re-run over a finished row; count as done.
+ * - `moved_during_request` / `deadlock_retry` / `concurrent_modification` — re-read and retry once.
+ * - `name_collision` / `soft_deleted_conflict` / `rehomed_away_conflict` — skip and report.
+ * - `export_in_progress` — an export job holds either org; wait, then retry.
+ * - `project_soft_deleted` / `project_has_no_org` — the source row is not movable as-is; stop and look.
+ */
+export declare const REHOME_REFUSAL_REASONS: readonly ["same_org", "moved_during_request", "deadlock_retry", "concurrent_modification", "name_collision", "soft_deleted_conflict", "rehomed_away_conflict", "export_in_progress", "project_soft_deleted", "project_has_no_org"];
+export type RehomeRefusalReason = (typeof REHOME_REFUSAL_REASONS)[number];
+/**
+ * The re-home refusal reason carried by a rejection, or `null` when the error
+ * is not one of the enumerated re-home refusals (a 403 org code, a 402
+ * `PROJECT_LIMIT`, a network failure). Reads `details.reason`; an unknown
+ * reason string returns null rather than a widened type — a new server reason
+ * should reach the caller as "not one I know", not as a silently-handled case.
+ *
+ * `null` therefore means "not a re-home refusal I can name", NOT "safe to
+ * retry": a `TimeoutError` / `NetworkError` after the server committed the
+ * move also reads `null`, and a blind retry on the admin path answers
+ * `same_org` (fine) while on the member path it answers 404 (see
+ * `projects.rehome`). Branch on `isTimeoutError` / `isNetworkError` first.
+ */
+export declare function rehomeRefusalReason(err: unknown): RehomeRefusalReason | null;
+/**
+ * Thrown by `OpsClient.login` / `auth.login` when the account has MFA enabled:
+ * the API answers `200 { mfa_required: true, mfa_challenge_token, ... }` and no
+ * session. Until 6.4.0 this surfaced as a raw `ZodError` on `sessionToken`,
+ * which made the SDK unable to log in ANY MFA account. Complete the login with
+ * `OpsClient.loginWithTotp(err.mfaChallengeToken, code)` before the challenge
+ * expires (`expiresAt`). WebAuthn completion is not offered by this SDK.
+ *
+ * **The token is single-use and is consumed before the code is verified** —
+ * a mistyped code burns it; do not loop on `loginWithTotp` with the same
+ * token, call `login()` again for a new challenge. And this error is raised
+ * only by `login()` / `auth.login()`: a client constructed with
+ * `{ email, password }` (or autoloaded credentials) logs in inside sdk-core,
+ * which cannot see the challenge and surfaces a generic `UnauthorizedError`
+ * — MFA accounts must use the two-step `login()` → `loginWithTotp()` path.
+ */
+export declare class MfaRequiredError extends Error {
+    readonly name = "MfaRequiredError";
+    readonly mfaChallengeToken: string;
+    readonly expiresAt: string;
+    readonly mfaMethods: readonly string[];
+    constructor(challenge: {
+        mfaChallengeToken: string;
+        expiresAt: string;
+        mfaMethods: readonly string[];
+    });
+}
+/** Type guard for {@link MfaRequiredError}. */
+export declare function isMfaRequiredError(err: unknown): err is MfaRequiredError;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACpC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;QACnE,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,GAAG,EAAE,OAAO,CAAC;QACb,aAAa,EAAE,OAAO,CAAC;KACxB;CASF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACpC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;QACnE,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,GAAG,EAAE,OAAO,CAAC;QACb,aAAa,EAAE,OAAO,CAAC;KACxB;CASF;AAMD,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAG,uBAAgC,CAAC;AACtE,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAG,iBAA0B,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAMD,8HAA8H;AAC9H,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,GAAG;IAAE,OAAO,CAAC,EAAE,0BAA0B,CAAA;CAAE,CAEvH;AAED,oHAAoH;AACpH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAExE;AAED,sHAAsH;AACtH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,GAAG;IAAE,OAAO,EAAE,qBAAqB,CAAA;CAAE,CAI5G;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAG,kBAA2B,CAAC;AAC5D,+HAA+H;AAC/H,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAC;AAE9D,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAExE;AAED,qJAAqJ;AACrJ,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAEzE;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oOAWzB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAM5E;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE3B,SAAS,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE;CASvG;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAExE"}

package/dist/errors/errors.js

@@ -56,4 +56,142 @@ export class AnalysisEchoMismatchError extends Error {
         this.analysisWrite = details.analysisWrite;
     }
 }
+// ---------------------------------------------------------------------------
+// Org routing (project-org-routing-and-rehome spec, 6.2.0)
+// ---------------------------------------------------------------------------
+import { SdkApiError as _SdkApiError } from '@uluops/sdk-core/errors';
+/**
+ * 403 — the caller is a member of the org but below the write floor
+ * (`publisher`). On tracker writes the API rewrites the body: `details.applied`
+ * is `false` and the message forbids retrying without `org`. DO NOT retry the
+ * same call without an org: an org-less retry does not "fall back", it files
+ * the work in the caller's PERSONAL org (spec §3.1, S6).
+ */
+export const INSUFFICIENT_ORG_ROLE = 'INSUFFICIENT_ORG_ROLE';
+/** 403 — the caller is not a member of the org named by `org` / `orgSlug`, or the key is bound to a different org. */
+export const ORG_ACCESS_DENIED = 'ORG_ACCESS_DENIED';
+/**
+ * 410 — the project this name once denoted in this org has been RE-HOMED to
+ * another org (spec D14). `details.target_org.slug` is where it lives now:
+ * pass it as `org` and the same call succeeds. Do not create a new project
+ * at the old address — the tombstone exists precisely to refuse that fork.
+ */
+export const PROJECT_REHOMED = 'PROJECT_REHOMED';
+function hasCode(err, code) {
+    return err instanceof _SdkApiError && err.code === code;
+}
+/** Type guard: the org write floor refused this call (403 `INSUFFICIENT_ORG_ROLE`). Terminal — do not retry without `org`. */
+export function isInsufficientOrgRoleError(err) {
+    return hasCode(err, INSUFFICIENT_ORG_ROLE);
+}
+/** Type guard: not a member of the named org, or the key is bound elsewhere (403 `ORG_ACCESS_DENIED`). Terminal. */
+export function isOrgAccessDeniedError(err) {
+    return hasCode(err, ORG_ACCESS_DENIED);
+}
+/** Type guard: the project was re-homed; `err.details.target_org.slug` is the org to pass (410 `PROJECT_REHOMED`). */
+export function isProjectRehomedError(err) {
+    if (!hasCode(err, PROJECT_REHOMED))
+        return false;
+    const d = err.details;
+    return typeof d?.target_org?.slug === 'string' && typeof d.project_id === 'string';
+}
+// ---------------------------------------------------------------------------
+// Re-home surfaces (spec §4, 6.4.0)
+// ---------------------------------------------------------------------------
+/**
+ * 403 — the route is session-only (D20): platform-admin writes that mint or
+ * re-point identity, and the two cross-tenant project moves, refuse a `ulr_`
+ * key even when its user is a platform admin. Terminal for a key-authenticated
+ * client: log in (`OpsClient.login`, completing MFA with `loginWithTotp` if
+ * challenged) and retry with the session — never by minting another key.
+ */
+export const SESSION_REQUIRED = 'SESSION_REQUIRED';
+/** 403 — the caller lacks the PLATFORM role (`users.role`) the admin path requires; distinct from the org-role codes above. */
+export const INSUFFICIENT_ROLE = 'INSUFFICIENT_ROLE';
+/** Type guard: session-only route refused an API key (403 `SESSION_REQUIRED`). Terminal for key auth. */
+export function isSessionRequiredError(err) {
+    return hasCode(err, SESSION_REQUIRED);
+}
+/** Type guard: the caller's PLATFORM role is below what the admin path requires (403 `INSUFFICIENT_ROLE`). Terminal — no org argument changes it. */
+export function isInsufficientRoleError(err) {
+    return hasCode(err, INSUFFICIENT_ROLE);
+}
+/**
+ * The refusal reasons a re-home can answer with, as `details.reason` on a
+ * 400 (`VALIDATION_ERROR`) or 409 (`CONFLICT`). Enumerated here because the
+ * Phase 4 runbook (spec §4.7 item 3) assigns each a disposition, and a script
+ * that switches on a string it typed itself will misspell one:
+ *
+ * - `same_org` — already there. Idempotent re-run over a finished row; count as done.
+ * - `moved_during_request` / `deadlock_retry` / `concurrent_modification` — re-read and retry once.
+ * - `name_collision` / `soft_deleted_conflict` / `rehomed_away_conflict` — skip and report.
+ * - `export_in_progress` — an export job holds either org; wait, then retry.
+ * - `project_soft_deleted` / `project_has_no_org` — the source row is not movable as-is; stop and look.
+ */
+export const REHOME_REFUSAL_REASONS = [
+    'same_org',
+    'moved_during_request',
+    'deadlock_retry',
+    'concurrent_modification',
+    'name_collision',
+    'soft_deleted_conflict',
+    'rehomed_away_conflict',
+    'export_in_progress',
+    'project_soft_deleted',
+    'project_has_no_org',
+];
+/**
+ * The re-home refusal reason carried by a rejection, or `null` when the error
+ * is not one of the enumerated re-home refusals (a 403 org code, a 402
+ * `PROJECT_LIMIT`, a network failure). Reads `details.reason`; an unknown
+ * reason string returns null rather than a widened type — a new server reason
+ * should reach the caller as "not one I know", not as a silently-handled case.
+ *
+ * `null` therefore means "not a re-home refusal I can name", NOT "safe to
+ * retry": a `TimeoutError` / `NetworkError` after the server committed the
+ * move also reads `null`, and a blind retry on the admin path answers
+ * `same_org` (fine) while on the member path it answers 404 (see
+ * `projects.rehome`). Branch on `isTimeoutError` / `isNetworkError` first.
+ */
+export function rehomeRefusalReason(err) {
+    if (!(err instanceof _SdkApiError))
+        return null;
+    const reason = err.details?.reason;
+    return typeof reason === 'string' && REHOME_REFUSAL_REASONS.includes(reason)
+        ? reason
+        : null;
+}
+/**
+ * Thrown by `OpsClient.login` / `auth.login` when the account has MFA enabled:
+ * the API answers `200 { mfa_required: true, mfa_challenge_token, ... }` and no
+ * session. Until 6.4.0 this surfaced as a raw `ZodError` on `sessionToken`,
+ * which made the SDK unable to log in ANY MFA account. Complete the login with
+ * `OpsClient.loginWithTotp(err.mfaChallengeToken, code)` before the challenge
+ * expires (`expiresAt`). WebAuthn completion is not offered by this SDK.
+ *
+ * **The token is single-use and is consumed before the code is verified** —
+ * a mistyped code burns it; do not loop on `loginWithTotp` with the same
+ * token, call `login()` again for a new challenge. And this error is raised
+ * only by `login()` / `auth.login()`: a client constructed with
+ * `{ email, password }` (or autoloaded credentials) logs in inside sdk-core,
+ * which cannot see the challenge and surfaces a generic `UnauthorizedError`
+ * — MFA accounts must use the two-step `login()` → `loginWithTotp()` path.
+ */
+export class MfaRequiredError extends Error {
+    name = 'MfaRequiredError';
+    mfaChallengeToken;
+    expiresAt;
+    mfaMethods;
+    constructor(challenge) {
+        super(`Login requires a second factor (${challenge.mfaMethods.join(', ') || 'unknown method'}); ` +
+            'complete it with loginWithTotp(mfaChallengeToken, code) before the challenge expires');
+        this.mfaChallengeToken = challenge.mfaChallengeToken;
+        this.expiresAt = challenge.expiresAt;
+        this.mfaMethods = challenge.mfaMethods;
+    }
+}
+/** Type guard for {@link MfaRequiredError}. */
+export function isMfaRequiredError(err) {
+    return err instanceof MfaRequiredError;
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,sBAAsB;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IAC1E,MAAM,CAA6D;IAC5E,kFAAkF;IACzE,kBAAkB,CAAS;IACpC,0EAA0E;IACjE,gBAAgB,CAAgB;IACzC,yEAAyE;IAChE,GAAG,CAAU;IACtB,qEAAqE;IAC5D,aAAa,CAAU;IAEhC,YAAY,OAAe,EAAE,OAM5B;QACC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;CACF"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,sBAAsB;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IAC1E,MAAM,CAA6D;IAC5E,kFAAkF;IACzE,kBAAkB,CAAS;IACpC,0EAA0E;IACjE,gBAAgB,CAAgB;IACzC,yEAAyE;IAChE,GAAG,CAAU;IACtB,qEAAqE;IAC5D,aAAa,CAAU;IAEhC,YAAY,OAAe,EAAE,OAM5B;QACC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;CACF;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAgC,CAAC;AACtE,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAA4B,CAAC;AAC9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAA0B,CAAC;AAoB1D,SAAS,OAAO,CAAC,GAAY,EAAE,IAAY;IACzC,OAAO,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1D,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,OAAO,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAC7C,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACzC,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAqD,CAAC;IACpE,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;AACrF,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAA2B,CAAC;AAC5D,+HAA+H;AAC/H,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAA4B,CAAC;AAE9D,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;AACxC,CAAC;AAED,qJAAqJ;AACrJ,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,gBAAgB;IAChB,uBAAuB;IACvB,uBAAuB;IACvB,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;CACZ,CAAC;AAGX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,MAAM,GAAI,GAAG,CAAC,OAA4C,EAAE,MAAM,CAAC;IACzE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAK,sBAA4C,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjG,CAAC,CAAE,MAA8B;QACjC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IACnC,iBAAiB,CAAS;IAC1B,SAAS,CAAS;IAClB,UAAU,CAAoB;IAEvC,YAAY,SAA0F;QACpG,KAAK,CACH,mCAAmC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,KAAK;YAC3F,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;IACzC,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,OAAO,GAAG,YAAY,gBAAgB,CAAC;AACzC,CAAC"}