@uluops/ops-sdk 6.1.0 → 6.4.1

package/dist/http/http-client.d.ts

@@ -68,6 +68,10 @@ export interface HttpClientConfig {
     /** Org slug for multi-tenancy — sets X-Org-Slug header on all requests */
     orgSlug?: string;
 }
+/** Alphanumeric + hyphens/underscores, 1–100 chars */
+export declare const ORG_SLUG_PATTERN: RegExp;
+/** The header the tracker's org-context middleware reads (after `:slug` and `X-Org-Id`). */
+export declare const ORG_SLUG_HEADER = "X-Org-Slug";
 /**
  * HTTP client for ops-uluops-api using native fetch
  */
@@ -82,6 +86,48 @@ export declare class OpsHttpClient extends HttpClient {
      * @throws {InputValidationError} If `orgSlug` is present but not 1–100
      *   alphanumeric characters, hyphens, or underscores.
      */
+    /**
+     * Per-call org override (project-org-routing-and-rehome spec §3.2, 6.2.0).
+     * Set only on views minted by {@link withOrg}; the root client never has one.
+     */
+    private orgOverride?;
+    /**
+     * Set instead of throwing when `withOrg` is handed an invalid slug: every
+     * method on OpsClient returns a Promise, so the caller's `.catch`/`await`
+     * must see the error — a synchronous throw from inside a non-async arrow
+     * would escape both. Surfaced as a rejection of the view's first request.
+     */
+    private orgInvalid?;
     constructor(config?: HttpClientConfig);
+    /**
+     * A view of this client whose every request carries `X-Org-Slug: <org>`,
+     * overriding the constructor-level `orgSlug` (per-request headers win over
+     * `defaultHeaders` in sdk-core). The view shares this client's auth
+     * strategy, fetch adapter and configuration — it is the same client, seen
+     * through one org — so a session installed on the root is honoured here.
+     *
+     * Precedence on the wire, lowest to highest: personal org (no header) <
+     * constructor `orgSlug` < this per-call `org`. An API key BOUND to an org
+     * ignores both headers and 403s (`ORG_ACCESS_DENIED`) if they name a
+     * different org — that is the platform's rule, surfaced verbatim.
+     *
+     * An invalid `org` (not 1–100 alphanumeric characters, hyphens, or
+     * underscores — the same pattern as `orgSlug`; it is a header value, so
+     * CRLF/whitespace can never reach the wire) does not throw here: the view's
+     * requests REJECT with `InputValidationError` before anything is sent, so
+     * `await client.projects.list({ org })` fails the way every other input
+     * error does.
+     */
+    withOrg(org: string): OpsHttpClient;
+    /** The org this view is scoped to, or `undefined` on the root client. */
+    get scopedOrg(): string | undefined;
+    request<T>(method: 'GET' | 'POST' | 'PATCH' | 'PUT' | 'DELETE', endpoint: string, data?: object, options?: {
+        params?: object;
+        retries?: number;
+        retryMutations?: boolean;
+        headers?: Record<string, string>;
+        skipAuth?: boolean;
+        rawEnvelope?: boolean;
+    }): Promise<T>;
 }
 //# sourceMappingURL=http-client.d.ts.map

package/dist/http/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/http/http-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAKlE,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAKzF,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,KAAK,WAAW,IAAI,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAGjE;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,CAiBrE;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,kBAAkB,EAAE,aAAa,KAAK,IAAI,CAAC;IAClF,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAClG;;;;OAIG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAKD;;GAEG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C;;;;;;;;;OASG;gBACS,MAAM,GAAE,gBAAqB;CAkB1C"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../src/http/http-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACnD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,uBAAuB,CAAC;AAKlE,OAAO,EAAE,OAAO,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAKzF,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAE/B,OAAO,EAAE,KAAK,WAAW,IAAI,GAAG,EAAE,MAAM,wBAAwB,CAAC;AAGjE;;;;;;;;;;;;GAYG;AACH,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,GAAG,GAAG,SAAS,CAiBrE;AAED;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sFAAsF;IACtF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,4BAA4B;IAC5B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,6CAA6C;IAC7C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,6CAA6C;IAC7C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,mCAAmC;IACnC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,sCAAsC;IACtC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,6BAA6B;IAC7B,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,+CAA+C;IAC/C,cAAc,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAC;IACzC,4EAA4E;IAC5E,sBAAsB,CAAC,EAAE,CAAC,IAAI,EAAE,OAAO,kBAAkB,EAAE,aAAa,KAAK,IAAI,CAAC;IAClF,oFAAoF;IACpF,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,2EAA2E;IAC3E,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,KAAK,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,KAAK,IAAI,CAAC;IAClG;;;;OAIG;IACH,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,0EAA0E;IAC1E,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,sDAAsD;AACtD,eAAO,MAAM,gBAAgB,QAAqC,CAAC;AAEnE,4FAA4F;AAC5F,eAAO,MAAM,eAAe,eAAe,CAAC;AAW5C;;GAEG;AACH,qBAAa,aAAc,SAAQ,UAAU;IAC3C;;;;;;;;;OASG;IACH;;;OAGG;IACH,OAAO,CAAC,WAAW,CAAC,CAAS;IAC7B;;;;;OAKG;IACH,OAAO,CAAC,UAAU,CAAC,CAAuB;gBAE9B,MAAM,GAAE,gBAAqB;IAczC;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa;IAqBnC,yEAAyE;IACzE,IAAI,SAAS,IAAI,MAAM,GAAG,SAAS,CAElC;IAEQ,OAAO,CAAC,CAAC,EAChB,MAAM,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,EACnD,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,cAAc,CAAC,EAAE,OAAO,CAAC;QACzB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,QAAQ,CAAC,EAAE,OAAO,CAAC;QACnB,WAAW,CAAC,EAAE,OAAO,CAAC;KACvB,GACA,OAAO,CAAC,CAAC,CAAC;CAqBd"}

package/dist/http/http-client.js

@@ -47,7 +47,14 @@ export function toApiQuery(query) {
     return Object.keys(params).length > 0 ? params : undefined;
 }
 /** Alphanumeric + hyphens/underscores, 1–100 chars */
-const ORG_SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/;
+export const ORG_SLUG_PATTERN = /^[a-zA-Z0-9][a-zA-Z0-9_-]{0,99}$/;
+/** The header the tracker's org-context middleware reads (after `:slug` and `X-Org-Id`). */
+export const ORG_SLUG_HEADER = 'X-Org-Slug';
+function assertOrgSlug(value, path) {
+    if (!ORG_SLUG_PATTERN.test(value)) {
+        throw new InputValidationError(`Invalid ${path}: must be 1-100 alphanumeric characters, hyphens, or underscores`, [{ code: 'custom', path: [path], message: 'must be 1-100 alphanumeric characters, hyphens, or underscores' }]);
+    }
+}
 /**
  * HTTP client for ops-uluops-api using native fetch
  */
@@ -62,10 +69,21 @@ export class OpsHttpClient extends HttpClient {
      * @throws {InputValidationError} If `orgSlug` is present but not 1–100
      *   alphanumeric characters, hyphens, or underscores.
      */
+    /**
+     * Per-call org override (project-org-routing-and-rehome spec §3.2, 6.2.0).
+     * Set only on views minted by {@link withOrg}; the root client never has one.
+     */
+    orgOverride;
+    /**
+     * Set instead of throwing when `withOrg` is handed an invalid slug: every
+     * method on OpsClient returns a Promise, so the caller's `.catch`/`await`
+     * must see the error — a synchronous throw from inside a non-async arrow
+     * would escape both. Surfaced as a rejection of the view's first request.
+     */
+    orgInvalid;
     constructor(config = {}) {
-        if (config.orgSlug && !ORG_SLUG_PATTERN.test(config.orgSlug)) {
-            throw new InputValidationError('Invalid orgSlug: must be 1-100 alphanumeric characters, hyphens, or underscores', [{ code: 'custom', path: ['orgSlug'], message: 'must be 1-100 alphanumeric characters, hyphens, or underscores' }]);
-        }
+        if (config.orgSlug)
+            assertOrgSlug(config.orgSlug, 'orgSlug');
         super({
             ...config,
             baseUrl: config.baseUrl ?? DEFAULT_BASE_URL,
@@ -73,9 +91,74 @@ export class OpsHttpClient extends HttpClient {
             sdkVersion: SDK_VERSION,
             loggerPrefix: '[ops-sdk:http]',
             defaultHeaders: {
-                ...(config.orgSlug ? { 'X-Org-Slug': config.orgSlug } : {}),
+                ...(config.orgSlug ? { [ORG_SLUG_HEADER]: config.orgSlug } : {}),
             },
         });
     }
+    /**
+     * A view of this client whose every request carries `X-Org-Slug: <org>`,
+     * overriding the constructor-level `orgSlug` (per-request headers win over
+     * `defaultHeaders` in sdk-core). The view shares this client's auth
+     * strategy, fetch adapter and configuration — it is the same client, seen
+     * through one org — so a session installed on the root is honoured here.
+     *
+     * Precedence on the wire, lowest to highest: personal org (no header) <
+     * constructor `orgSlug` < this per-call `org`. An API key BOUND to an org
+     * ignores both headers and 403s (`ORG_ACCESS_DENIED`) if they name a
+     * different org — that is the platform's rule, surfaced verbatim.
+     *
+     * An invalid `org` (not 1–100 alphanumeric characters, hyphens, or
+     * underscores — the same pattern as `orgSlug`; it is a header value, so
+     * CRLF/whitespace can never reach the wire) does not throw here: the view's
+     * requests REJECT with `InputValidationError` before anything is sent, so
+     * `await client.projects.list({ org })` fails the way every other input
+     * error does.
+     */
+    withOrg(org) {
+        // `"personal"` is the reserved no-org value (the same sentinel the
+        // workspace file uses): the root client, no per-call header. It does not
+        // cancel a constructor-level `orgSlug` — that is a defaultHeader sdk-core
+        // always sends; callers that need "personal despite a constructor org"
+        // construct without one (the tracker MCP has none since 2.1.0).
+        if (org === 'personal')
+            return this;
+        // Prototype-chained view: reads (auth strategy, adapter, config) fall
+        // through to this instance; only the override fields are set on the view.
+        // sdk-core's verbs (get/post/patch/put/delete) all delegate to `request`,
+        // so the override below covers every operation without touching them.
+        const view = Object.create(this);
+        try {
+            assertOrgSlug(org, 'org');
+            view.orgOverride = org;
+        }
+        catch (err) {
+            view.orgInvalid = err;
+        }
+        return view;
+    }
+    /** The org this view is scoped to, or `undefined` on the root client. */
+    get scopedOrg() {
+        return this.orgOverride;
+    }
+    request(method, endpoint, data, options) {
+        if (this.orgInvalid)
+            return Promise.reject(this.orgInvalid);
+        if (this.orgOverride === undefined)
+            return super.request(method, endpoint, data, options);
+        // The per-call org is set LAST so a caller-supplied header cannot outrank
+        // it, and an org header in `options.headers` is refused outright: until
+        // 6.3.1 the spread order let `options.headers` win, and `X-Org-Id`
+        // outranks `X-Org-Slug` on the server, so a smuggled header would have
+        // silently redirected a scoped call (run #187, circumvention A7 /
+        // trust-boundary F7 — no live caller did this; the invariant held by luck).
+        const smuggled = Object.keys(options?.headers ?? {}).find((h) => /^x-org-(slug|id)$/i.test(h));
+        if (smuggled !== undefined) {
+            return Promise.reject(new InputValidationError(`Refusing request header ${smuggled} on an org-scoped call: the per-call org (${this.orgOverride}) is the only org channel`, [{ code: 'custom', path: ['headers', smuggled], message: 'org headers may not be set per request on a scoped view' }]));
+        }
+        return super.request(method, endpoint, data, {
+            ...options,
+            headers: { ...(options?.headers ?? {}), [ORG_SLUG_HEADER]: this.orgOverride },
+        });
+    }
 }
 //# sourceMappingURL=http-client.js.map

package/dist/http/http-client.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../src/http/http-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,2EAA2E;AAC3E,OAAO,EAAE,OAAO,EAA0C,MAAM,wBAAwB,CAAC;AAiBzF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC3G,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,qEAAqE;YACrE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YACrF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,mEAAmE;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAyCD,sDAAsD;AACtD,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAE5D;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,UAAU;IAC3C;;;;;;;;;OASG;IACH,YAAY,SAA2B,EAAE;QACvC,IAAI,MAAM,CAAC,OAAO,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,oBAAoB,CAC5B,iFAAiF,EACjF,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CACnH,CAAC;QACJ,CAAC;QACD,KAAK,CAAC;YACJ,GAAG,MAAM;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB;YAC3C,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,gBAAgB;YAC9B,cAAc,EAAE;gBACd,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC5D;SACF,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"http-client.js","sourceRoot":"","sources":["../../src/http/http-client.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,wBAAwB,CAAC;AACvE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D,2EAA2E;AAC3E,OAAO,EAAE,OAAO,EAA0C,MAAM,wBAAwB,CAAC;AAiBzF,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,UAAU,CAAC,KAAyB;IAClD,IAAI,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC7B,MAAM,MAAM,GAAQ,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;YAC3G,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,KAAK,CAAC;QACnC,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,qEAAqE;YACrE,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;YACrF,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClD,CAAC;QACH,CAAC;QACD,mEAAmE;IACrE,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAyCD,sDAAsD;AACtD,MAAM,CAAC,MAAM,gBAAgB,GAAG,kCAAkC,CAAC;AAEnE,4FAA4F;AAC5F,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,SAAS,aAAa,CAAC,KAAa,EAAE,IAAY;IAChD,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,oBAAoB,CAC5B,WAAW,IAAI,kEAAkE,EACjF,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,gEAAgE,EAAE,CAAC,CAC9G,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,OAAO,aAAc,SAAQ,UAAU;IAC3C;;;;;;;;;OASG;IACH;;;OAGG;IACK,WAAW,CAAU;IAC7B;;;;;OAKG;IACK,UAAU,CAAwB;IAE1C,YAAY,SAA2B,EAAE;QACvC,IAAI,MAAM,CAAC,OAAO;YAAE,aAAa,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC7D,KAAK,CAAC;YACJ,GAAG,MAAM;YACT,OAAO,EAAE,MAAM,CAAC,OAAO,IAAI,gBAAgB;YAC3C,OAAO,EAAE,iBAAiB;YAC1B,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,gBAAgB;YAC9B,cAAc,EAAE;gBACd,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjE;SACF,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,OAAO,CAAC,GAAW;QACjB,mEAAmE;QACnE,yEAAyE;QACzE,0EAA0E;QAC1E,uEAAuE;QACvE,gEAAgE;QAChE,IAAI,GAAG,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QACpC,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,sEAAsE;QACtE,MAAM,IAAI,GAAkB,MAAM,CAAC,MAAM,CAAC,IAAI,CAAkB,CAAC;QACjE,IAAI,CAAC;YACH,aAAa,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAC1B,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC,UAAU,GAAG,GAA2B,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,yEAAyE;IACzE,IAAI,SAAS;QACX,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IAEQ,OAAO,CACd,MAAmD,EACnD,QAAgB,EAChB,IAAa,EACb,OAOC;QAED,IAAI,IAAI,CAAC,UAAU;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAC5D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,OAAO,CAAI,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAC7F,0EAA0E;QAC1E,wEAAwE;QACxE,mEAAmE;QACnE,uEAAuE;QACvE,kEAAkE;QAClE,4EAA4E;QAC5E,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,oBAAoB,CAC5C,2BAA2B,QAAQ,6CAA6C,IAAI,CAAC,WAAW,2BAA2B,EAC3H,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,OAAO,EAAE,yDAAyD,EAAE,CAAC,CACtH,CAAC,CAAC;QACL,CAAC;QACD,OAAO,KAAK,CAAC,OAAO,CAAI,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE;YAC9C,GAAG,OAAO;YACV,OAAO,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,WAAW,EAAE;SAC9E,CAAC,CAAC;IACL,CAAC;CACF"}

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * - Types: All domain interfaces (Run, Issue, AgentInput, SaveRunInput, etc.)
  * - Config: Credential loading and environment variable helpers
  */
-export { OpsClient, type OpsClientConfig } from './client.js';
+export { OpsClient, type OpsClientConfig, type LoginOptions } from './client.js';
 export { OpsHttpClient, type HttpClientConfig, type QueryParams, type QueryParamValue } from './http/http-client.js';
 export type { SecurityEvent, SecurityEventType, SecurityEventHandler, AuthType, AuthFailureEvent, RedirectRejectedEvent, TokenRefreshFailedEvent, AuthStrategyReplacedEvent, } from './http/http-client.js';
 export { ApiKeyAuth, JwtSessionAuth, createAuthStrategy, type AuthStrategy, type AuthConfig } from './http/auth-strategy.js';
@@ -16,4 +16,5 @@ export * from './types/index.js';
 export { isValidMetric, ANALYTICS_METRICS, type AnalyticsMetric } from './operations/analytics.js';
 export { loadCredentials, loadConfig, loadEnvFiles, type Credentials, type SdkConfig } from './config/loaders.js';
 export { DEFAULT_BASE_URL, API_KEY_PREFIX, ENV_VARS } from './config/constants.js';
+export { resolveWorkspaceOrg, findWorkspaceOrgFile, readWorkspaceOrgFile, WORKSPACE_ORG_FILE, PERSONAL_ORG_SENTINEL, type WorkspaceOrgResolution, type WorkspaceOrgSource, type ResolveWorkspaceOrgOptions, } from './config/workspace-org.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrH,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG7H,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGnG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAGjF,OAAO,EAAE,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrH,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG7H,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGnG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -21,4 +21,5 @@ export { isValidMetric, ANALYTICS_METRICS } from './operations/analytics.js';
 // Config — credential loading from env vars, .env files, and ~/.uluops/credentials.json
 export { loadCredentials, loadConfig, loadEnvFiles } from './config/loaders.js';
 export { DEFAULT_BASE_URL, API_KEY_PREFIX, ENV_VARS } from './config/constants.js';
+export { resolveWorkspaceOrg, findWorkspaceOrgFile, readWorkspaceOrgFile, WORKSPACE_ORG_FILE, PERSONAL_ORG_SENTINEL, } from './config/workspace-org.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2DAA2D;AAC3D,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAE9D,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAiE,MAAM,uBAAuB,CAAC;AAWrH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAsC,MAAM,yBAAyB,CAAC;AAE7H,0EAA0E;AAC1E,cAAc,oBAAoB,CAAC;AAEnC,gEAAgE;AAChE,cAAc,kBAAkB,CAAC;AAEjC,mEAAmE;AACnE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AAEnG,wFAAwF;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAoC,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2DAA2D;AAC3D,OAAO,EAAE,SAAS,EAA2C,MAAM,aAAa,CAAC;AAEjF,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAiE,MAAM,uBAAuB,CAAC;AAWrH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAsC,MAAM,yBAAyB,CAAC;AAE7H,0EAA0E;AAC1E,cAAc,oBAAoB,CAAC;AAEnC,gEAAgE;AAChE,cAAc,kBAAkB,CAAC;AAEjC,mEAAmE;AACnE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AAEnG,wFAAwF;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAoC,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GAItB,MAAM,2BAA2B,CAAC"}

package/dist/operations/admin.d.ts

@@ -0,0 +1,100 @@
+import type { OpsHttpClient } from '../http/http-client.js';
+import type { AdminRehomeProjectInput, RehomeResponse, ProjectRehomeList, ProjectRehomeListQuery, ProjectRehomeEventList, ProjectRehomeEventListQuery } from '../types/rehome.js';
+/**
+ * Platform-admin project re-home surface (project-org-routing-and-rehome spec
+ * §4.1 D8, §4.7, D20, D21). Every call here requires `users.role = 'admin'` —
+ * a PLATFORM role, not an org role — and the two writes additionally require
+ * a login-issued SESSION (D20): a `ulr_` key, even an admin's, gets
+ * `403 SESSION_REQUIRED` (`isSessionRequiredError`). Log in with
+ * `OpsClient.login` (completing MFA via `loginWithTotp` if challenged) and the
+ * session bearer is what these calls send. There is deliberately no MCP tool
+ * for any of this.
+ *
+ * `admin.` is a namespace, not an escalation: the same client, the same auth
+ * strategy. If the credential cannot do it the server says so.
+ */
+/**
+ * Move ANY project between ANY two orgs — `POST /admin/projects/:id/rehome`.
+ * No source-membership and no target-membership requirement (the platform role
+ * is the authority), so `reason` is REQUIRED: on this path the target org's
+ * only standing is the `rehome_in` audit row plus that text. Resolves the
+ * project by id UNSCOPED (the admin router has no org context) — the route
+ * takes a UUID and answers 400 to anything else, so unlike `projects.*` a
+ * NAME is refused here, client-side, before the request.
+ *
+ * Session-only (D20). Phase 4 of the spec runs this once per row of the OQ-4
+ * table, sequentially, with the row reference as `reason`. On THIS path a
+ * re-run over a finished row answers `same_org` (the lookup is by id, so the
+ * moved project is found wherever it is) — read it as "already done" via
+ * `rehomeRefusalReason`. That is not true of the member path, whose lookup is
+ * source-scoped (see `projects.rehome`).
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param projectId - Project UUID (a name is an `InputValidationError`)
+ * @param input - `{ targetOrg, reason }` — both required
+ * @returns The project after the move (`orgId` is the target) plus the `rehome` block
+ * @throws {InputValidationError} If `projectId` is not a UUID, `targetOrg` is not a slug, or `reason` is missing
+ * @example
+ * ```typescript
+ * await client.login(email, password); // or loginWithTotp after an MfaRequiredError
+ * const moved = await client.admin.rehomeProject(projectId, { targetOrg: 'ulu-labs', reason: 'OQ-4 row 7' });
+ * moved.rehome.to_org.slug; // 'ulu-labs'
+ * ```
+ */
+export declare function rehomeProject(client: OpsHttpClient, projectId: string, input: AdminRehomeProjectInput): Promise<RehomeResponse>;
+/**
+ * The reservation table — `GET /admin/projects/rehomes`: every vacated
+ * `(org, name)` address and where it redirects. Key-readable. This is the
+ * CURRENT redirect state, not the history — a reversal annihilates its row and
+ * a release deletes it; for "what happened" read {@link listProjectRehomeEvents}.
+ *
+ * `org` takes a UUID or a slug; `total` is the matching count, `returned` the page.
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, since?, limit? }`
+ * @returns `{ data, total, returned }` — reservation rows, camelCase
+ */
+export declare function listProjectRehomes(client: OpsHttpClient, query?: ProjectRehomeListQuery): Promise<ProjectRehomeList>;
+/**
+ * The append-only ledger (D21) — `GET /admin/projects/rehome-events`: every
+ * move, re-point, annihilation, degenerate drop, release and hard-delete
+ * release, written in the same transaction as the change; nothing the API
+ * offers removes a row. Key-readable. Pages by `seq` (insertion order) —
+ * `nextCursor` is the `seq` to continue strictly below; pass it back verbatim.
+ * This, not the reservation listing and not a script's own log, is what a
+ * migration reconciles against (spec §4.7 item 4).
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, event?, since?, cursor?, limit? }`
+ * @returns `{ data, total, returned, hasMore, nextCursor }` — ledger rows, camelCase, newest `seq` first
+ * @example
+ * ```typescript
+ * let cursor: string | undefined;
+ * do {
+ *   const page = await client.admin.listProjectRehomeEvents({ org: 'ulu-labs', event: 'moved', cursor });
+ *   for (const ev of page.data) console.log(ev.seq, ev.projectName, ev.fromOrgId, '→', ev.toOrgId);
+ *   cursor = page.nextCursor ?? undefined;
+ * } while (cursor);
+ * ```
+ */
+export declare function listProjectRehomeEvents(client: OpsHttpClient, query?: ProjectRehomeEventListQuery): Promise<ProjectRehomeEventList>;
+/**
+ * Release a vacated address — `DELETE /admin/projects/rehomes/:id`. After
+ * this the old `(org, name)` is creatable again: a by-name writer there gets a
+ * NEW project instead of `410 PROJECT_REHOMED`. Deliberate, audited (`released`
+ * ledger row), never done by time. Session-only (D20): release is the step that
+ * empties the queryable record.
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param rehomeId - The reservation row id (from {@link listProjectRehomes}); a non-UUID is refused client-side
+ * @returns `{ released: true }`
+ * @throws {InputValidationError} If `rehomeId` is not a UUID
+ * @throws {ZodError} If the 200 body does not say `released: true` — the same signal every other
+ *   shape mismatch in this SDK gives. Note the server sends 200 AFTER the row is gone, so a
+ *   shape failure here means the release most likely HAPPENED; re-read `listProjectRehomes`
+ *   before retrying (a retry answers 404).
+ */
+export declare function releaseProjectRehome(client: OpsHttpClient, rehomeId: string): Promise<{
+    released: true;
+}>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/operations/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/operations/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EACV,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAS5B;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,EACrB,KAAK,GAAE,sBAA2B,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAO5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,aAAa,EACrB,KAAK,GAAE,2BAAgC,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAUjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAG7B"}

package/dist/operations/admin.js

@@ -0,0 +1,130 @@
+import { RehomeResponseSchema, ProjectRehomeListResponseSchema, ProjectRehomeEventListResponseSchema, } from '../types/rehome.js';
+import { z } from 'zod';
+import { validateAdminRehomeProjectInput, validateUuid } from '../config/validators.js';
+/**
+ * Platform-admin project re-home surface (project-org-routing-and-rehome spec
+ * §4.1 D8, §4.7, D20, D21). Every call here requires `users.role = 'admin'` —
+ * a PLATFORM role, not an org role — and the two writes additionally require
+ * a login-issued SESSION (D20): a `ulr_` key, even an admin's, gets
+ * `403 SESSION_REQUIRED` (`isSessionRequiredError`). Log in with
+ * `OpsClient.login` (completing MFA via `loginWithTotp` if challenged) and the
+ * session bearer is what these calls send. There is deliberately no MCP tool
+ * for any of this.
+ *
+ * `admin.` is a namespace, not an escalation: the same client, the same auth
+ * strategy. If the credential cannot do it the server says so.
+ */
+/**
+ * Move ANY project between ANY two orgs — `POST /admin/projects/:id/rehome`.
+ * No source-membership and no target-membership requirement (the platform role
+ * is the authority), so `reason` is REQUIRED: on this path the target org's
+ * only standing is the `rehome_in` audit row plus that text. Resolves the
+ * project by id UNSCOPED (the admin router has no org context) — the route
+ * takes a UUID and answers 400 to anything else, so unlike `projects.*` a
+ * NAME is refused here, client-side, before the request.
+ *
+ * Session-only (D20). Phase 4 of the spec runs this once per row of the OQ-4
+ * table, sequentially, with the row reference as `reason`. On THIS path a
+ * re-run over a finished row answers `same_org` (the lookup is by id, so the
+ * moved project is found wherever it is) — read it as "already done" via
+ * `rehomeRefusalReason`. That is not true of the member path, whose lookup is
+ * source-scoped (see `projects.rehome`).
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param projectId - Project UUID (a name is an `InputValidationError`)
+ * @param input - `{ targetOrg, reason }` — both required
+ * @returns The project after the move (`orgId` is the target) plus the `rehome` block
+ * @throws {InputValidationError} If `projectId` is not a UUID, `targetOrg` is not a slug, or `reason` is missing
+ * @example
+ * ```typescript
+ * await client.login(email, password); // or loginWithTotp after an MfaRequiredError
+ * const moved = await client.admin.rehomeProject(projectId, { targetOrg: 'ulu-labs', reason: 'OQ-4 row 7' });
+ * moved.rehome.to_org.slug; // 'ulu-labs'
+ * ```
+ */
+export async function rehomeProject(client, projectId, input) {
+    validateUuid(projectId, 'projectId');
+    const valid = validateAdminRehomeProjectInput(input);
+    return RehomeResponseSchema.parse(await client.post(`/admin/projects/${encodeURIComponent(projectId)}/rehome`, { target_org: valid.targetOrg, reason: valid.reason }));
+}
+/**
+ * The reservation table — `GET /admin/projects/rehomes`: every vacated
+ * `(org, name)` address and where it redirects. Key-readable. This is the
+ * CURRENT redirect state, not the history — a reversal annihilates its row and
+ * a release deletes it; for "what happened" read {@link listProjectRehomeEvents}.
+ *
+ * `org` takes a UUID or a slug; `total` is the matching count, `returned` the page.
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, since?, limit? }`
+ * @returns `{ data, total, returned }` — reservation rows, camelCase
+ */
+export async function listProjectRehomes(client, query = {}) {
+    return ProjectRehomeListResponseSchema.parse(await client.request('GET', '/admin/projects/rehomes', rehomeListParams(query), { rawEnvelope: true }));
+}
+/**
+ * The append-only ledger (D21) — `GET /admin/projects/rehome-events`: every
+ * move, re-point, annihilation, degenerate drop, release and hard-delete
+ * release, written in the same transaction as the change; nothing the API
+ * offers removes a row. Key-readable. Pages by `seq` (insertion order) —
+ * `nextCursor` is the `seq` to continue strictly below; pass it back verbatim.
+ * This, not the reservation listing and not a script's own log, is what a
+ * migration reconciles against (spec §4.7 item 4).
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, event?, since?, cursor?, limit? }`
+ * @returns `{ data, total, returned, hasMore, nextCursor }` — ledger rows, camelCase, newest `seq` first
+ * @example
+ * ```typescript
+ * let cursor: string | undefined;
+ * do {
+ *   const page = await client.admin.listProjectRehomeEvents({ org: 'ulu-labs', event: 'moved', cursor });
+ *   for (const ev of page.data) console.log(ev.seq, ev.projectName, ev.fromOrgId, '→', ev.toOrgId);
+ *   cursor = page.nextCursor ?? undefined;
+ * } while (cursor);
+ * ```
+ */
+export async function listProjectRehomeEvents(client, query = {}) {
+    const params = rehomeListParams(query);
+    if (query.event !== undefined)
+        params['event'] = query.event;
+    if (query.cursor !== undefined)
+        params['cursor'] = query.cursor;
+    return ProjectRehomeEventListResponseSchema.parse(await client.request('GET', '/admin/projects/rehome-events', params, { rawEnvelope: true }));
+}
+/**
+ * Release a vacated address — `DELETE /admin/projects/rehomes/:id`. After
+ * this the old `(org, name)` is creatable again: a by-name writer there gets a
+ * NEW project instead of `410 PROJECT_REHOMED`. Deliberate, audited (`released`
+ * ledger row), never done by time. Session-only (D20): release is the step that
+ * empties the queryable record.
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param rehomeId - The reservation row id (from {@link listProjectRehomes}); a non-UUID is refused client-side
+ * @returns `{ released: true }`
+ * @throws {InputValidationError} If `rehomeId` is not a UUID
+ * @throws {ZodError} If the 200 body does not say `released: true` — the same signal every other
+ *   shape mismatch in this SDK gives. Note the server sends 200 AFTER the row is gone, so a
+ *   shape failure here means the release most likely HAPPENED; re-read `listProjectRehomes`
+ *   before retrying (a retry answers 404).
+ */
+export async function releaseProjectRehome(client, rehomeId) {
+    validateUuid(rehomeId, 'rehomeId');
+    return ReleaseResponseSchema.parse(await client.delete(`/admin/projects/rehomes/${encodeURIComponent(rehomeId)}`));
+}
+/** `DELETE /admin/projects/rehomes/:id` answers `{ data: { released: true } }`; anything else is a contract break. */
+const ReleaseResponseSchema = z.object({ released: z.literal(true) });
+/** Shared filter serialisation for the two listings — snake_case on the wire (`project_id`), strings throughout. */
+function rehomeListParams(query) {
+    const params = {};
+    if (query.projectId !== undefined)
+        params['project_id'] = query.projectId;
+    if (query.org !== undefined)
+        params['org'] = query.org;
+    if (query.since !== undefined)
+        params['since'] = query.since;
+    if (query.limit !== undefined)
+        params['limit'] = String(query.limit);
+    return params;
+}
+//# sourceMappingURL=admin.js.map

package/dist/operations/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/operations/admin.ts"],"names":[],"mappings":"AASA,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAExF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,SAAiB,EACjB,KAA8B;IAE9B,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,oBAAoB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CACjD,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EACzD,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACtD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAqB,EACrB,QAAgC,EAAE;IAElC,OAAO,+BAA+B,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CAC/D,KAAK,EACL,yBAAyB,EACzB,gBAAgB,CAAC,KAAK,CAAC,EACvB,EAAE,WAAW,EAAE,IAAI,EAAE,CACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAqB,EACrB,QAAqC,EAAE;IAEvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IAChE,OAAO,oCAAoC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CACpE,KAAK,EACL,+BAA+B,EAC/B,MAAM,EACN,EAAE,WAAW,EAAE,IAAI,EAAE,CACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAqB,EACrB,QAAgB;IAEhB,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,CAAU,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,sHAAsH;AACtH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEtE,oHAAoH;AACpH,SAAS,gBAAgB,CAAC,KAA6B;IACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1E,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;IACvD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/operations/auth.d.ts

@@ -1,5 +1,5 @@
 import type { OpsHttpClient } from '../http/http-client.js';
-import type { RegisterInput, LoginInput, LoginResponse, RegisterResponse, UpdateProfileInput, ChangePasswordInput, ResetPasswordInput, CreateApiKeyInput, ApiKeyCreatedResponse, PublicApiKey, PublicSession, AuthUser, PublicUser } from '../types/auth.js';
+import type { RegisterInput, LoginInput, LoginResponse, TotpLoginInput, RegisterResponse, UpdateProfileInput, ChangePasswordInput, ResetPasswordInput, CreateApiKeyInput, ApiKeyCreatedResponse, PublicApiKey, PublicSession, AuthUser, PublicUser } from '../types/auth.js';
 import type { MessageResponse } from '../types/responses.js';
 /**
  * Register a new user account. Does not require authentication.
@@ -23,8 +23,28 @@ export declare function register(client: OpsHttpClient, input: RegisterInput): P
  * @returns `{ user, sessionToken }` — token must be manually installed on the client
  * @throws {InputValidationError} If email or password is missing
  * @throws {UnauthorizedError} If credentials are invalid
+ * @throws {MfaRequiredError} If the account has TOTP or a passkey enrolled — the API answered a
+ *   challenge, not a session; complete it with `totpLogin` / `OpsClient.loginWithTotp`
  */
 export declare function login(client: OpsHttpClient, input: LoginInput): Promise<LoginResponse>;
+/**
+ * Complete an MFA-challenged login with a TOTP code (`POST /auth/totp/login`).
+ * Returns the same `{ user, sessionToken, expiresAt }` a password login does.
+ * Like `login`, this only RETURNS the session — `OpsClient.loginWithTotp`
+ * installs it.
+ *
+ * **The challenge is single-use and is consumed BEFORE the code is checked**
+ * (`totp-service.verifyLogin`: consume, then verify). A wrong code therefore
+ * burns the token: retrying `totpLogin` with the same `mfaChallengeToken` is a
+ * 401 every time. Recovery is a fresh `login()` for a fresh challenge.
+ *
+ * @param client - HTTP client instance
+ * @param input - `{ mfaChallengeToken, code, rememberMe? }`
+ * @returns `{ user, sessionToken, expiresAt }` — token must be manually installed on the client
+ * @throws {InputValidationError} If the token is empty or the code is not six digits
+ * @throws {UnauthorizedError} If the code is wrong, or the challenge expired or was already consumed
+ */
+export declare function totpLogin(client: OpsHttpClient, input: TotpLoginInput): Promise<LoginResponse>;
 /**
  * Revoke all sessions for the current user (not just the current session).
  *

package/dist/operations/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/operations/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAuB7D;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,KAAK,CACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtC;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAErF;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAG/B;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAMrD;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,YAAY,EAAE,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,CAAC,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC,CAE1B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/operations/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA0B7D;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,KAAK,CACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CAIxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,aAAa,CAAC,CAWxB;AAoBD;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtC;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAErF;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAG/B;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAMrD;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,YAAY,EAAE,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,CAAC,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC,CAE1B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/operations/auth.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
-import { AuthUserResponseSchema, PublicUserResponseSchema, LoginResponseSchema, RegisterResponseSchema, PublicApiKeyResponseSchema, ApiKeyCreatedResponseSchema, PublicSessionResponseSchema, MessageResponseSchema, } from '../types/response-schemas.js';
-import { validateRegisterInput, validateLoginInput, validateUpdateProfileInput, validateChangePasswordInput, validateResetPasswordInput, validateSetPasswordInput, validateCreateApiKeyInput, } from '../config/validators.js';
+import { AuthUserResponseSchema, PublicUserResponseSchema, LoginResponseSchema, MfaChallengeResponseSchema, RegisterResponseSchema, PublicApiKeyResponseSchema, ApiKeyCreatedResponseSchema, PublicSessionResponseSchema, MessageResponseSchema, } from '../types/response-schemas.js';
+import { validateRegisterInput, validateLoginInput, validateTotpLoginInput, validateUpdateProfileInput, validateChangePasswordInput, validateResetPasswordInput, validateSetPasswordInput, validateCreateApiKeyInput, } from '../config/validators.js';
+import { MfaRequiredError } from '../errors/errors.js';
 const ProfileResponseSchema = z.object({ user: PublicUserResponseSchema });
 /**
  * Register a new user account. Does not require authentication.
@@ -27,10 +28,55 @@ export async function register(client, input) {
  * @returns `{ user, sessionToken }` — token must be manually installed on the client
  * @throws {InputValidationError} If email or password is missing
  * @throws {UnauthorizedError} If credentials are invalid
+ * @throws {MfaRequiredError} If the account has TOTP or a passkey enrolled — the API answered a
+ *   challenge, not a session; complete it with `totpLogin` / `OpsClient.loginWithTotp`
  */
 export async function login(client, input) {
     validateLoginInput(input);
-    return LoginResponseSchema.parse(await client.post('/auth/login', input, { skipAuth: true }));
+    const body = await client.post('/auth/login', input, { skipAuth: true });
+    return parseLoginOrChallenge(body);
+}
+/**
+ * Complete an MFA-challenged login with a TOTP code (`POST /auth/totp/login`).
+ * Returns the same `{ user, sessionToken, expiresAt }` a password login does.
+ * Like `login`, this only RETURNS the session — `OpsClient.loginWithTotp`
+ * installs it.
+ *
+ * **The challenge is single-use and is consumed BEFORE the code is checked**
+ * (`totp-service.verifyLogin`: consume, then verify). A wrong code therefore
+ * burns the token: retrying `totpLogin` with the same `mfaChallengeToken` is a
+ * 401 every time. Recovery is a fresh `login()` for a fresh challenge.
+ *
+ * @param client - HTTP client instance
+ * @param input - `{ mfaChallengeToken, code, rememberMe? }`
+ * @returns `{ user, sessionToken, expiresAt }` — token must be manually installed on the client
+ * @throws {InputValidationError} If the token is empty or the code is not six digits
+ * @throws {UnauthorizedError} If the code is wrong, or the challenge expired or was already consumed
+ */
+export async function totpLogin(client, input) {
+    const valid = validateTotpLoginInput(input);
+    return LoginResponseSchema.parse(await client.post('/auth/totp/login', {
+        mfa_challenge_token: valid.mfaChallengeToken,
+        code: valid.code,
+        ...(valid.rememberMe !== undefined ? { rememberMe: valid.rememberMe } : {}),
+    }, { skipAuth: true }));
+}
+/**
+ * A 200 from `/auth/login` is one of two shapes; the challenge is tried FIRST
+ * because it is the narrower literal, and a session body can never carry
+ * `mfa_required: true`. Anything else falls through to the strict session
+ * parse, whose ZodError names what was actually missing.
+ */
+function parseLoginOrChallenge(body) {
+    const challenge = MfaChallengeResponseSchema.safeParse(body);
+    if (challenge.success) {
+        throw new MfaRequiredError({
+            mfaChallengeToken: challenge.data.mfa_challenge_token,
+            expiresAt: challenge.data.expires_at,
+            mfaMethods: challenge.data.mfa_methods,
+        });
+    }
+    return LoginResponseSchema.parse(body);
 }
 /**
  * Revoke all sessions for the current user (not just the current session).

package/dist/operations/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/operations/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAkBxB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AAEjC,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAqB,EACrB,KAAoB;IAEpB,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,gBAAgB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAqB,EACrB,KAAiB;IAEjB,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1B,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,aAAa,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB;IAErB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB,EACrB,KAAa;IAEb,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,uBAAuB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,KAAyB;IAEzB,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,sBAAsB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACpH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB,EACrB,KAA0B;IAE1B,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAqB,EACrB,QAAgB;IAEhB,wBAAwB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,MAAqB;IAC/C,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB;IACpD,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,KAAyB;IAEzB,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAU,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAqB;IACtD,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAqB;IAErB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AACzG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,KAAyB;IAEzB,IAAI,KAAK;QAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,KAAa;IAEb,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB;IAErB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/operations/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAmBxB,OAAO,EACL,sBAAsB,EACtB,wBAAwB,EACxB,mBAAmB,EACnB,0BAA0B,EAC1B,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,sBAAsB,EACtB,0BAA0B,EAC1B,2BAA2B,EAC3B,0BAA0B,EAC1B,wBAAwB,EACxB,yBAAyB,GAC1B,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAEvD,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,wBAAwB,EAAE,CAAC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,MAAqB,EACrB,KAAoB;IAEpB,qBAAqB,CAAC,KAAK,CAAC,CAAC;IAC7B,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,gBAAgB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AAC/G,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CACzB,MAAqB,EACrB,KAAiB;IAEjB,kBAAkB,CAAC,KAAK,CAAC,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,IAAI,CAAU,aAAa,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAClF,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB,EACrB,KAAqB;IAErB,MAAM,KAAK,GAAG,sBAAsB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,mBAAmB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAChD,kBAAkB,EAClB;QACE,mBAAmB,EAAE,KAAK,CAAC,iBAAiB;QAC5C,IAAI,EAAE,KAAK,CAAC,IAAI;QAChB,GAAG,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC5E,EACD,EAAE,QAAQ,EAAE,IAAI,EAAE,CACnB,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,IAAa;IAC1C,MAAM,SAAS,GAAG,0BAA0B,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7D,IAAI,SAAS,CAAC,OAAO,EAAE,CAAC;QACtB,MAAM,IAAI,gBAAgB,CAAC;YACzB,iBAAiB,EAAE,SAAS,CAAC,IAAI,CAAC,mBAAmB;YACrD,SAAS,EAAE,SAAS,CAAC,IAAI,CAAC,UAAU;YACpC,UAAU,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW;SACvC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,mBAAmB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB;IAErB,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,eAAe,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,kBAAkB,EAAE,SAAS,CAAC,CAAC,CAAC;AACtH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB,EACrB,KAAa;IAEb,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,uBAAuB,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACzH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,KAAyB;IAEzB,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,sBAAsB,EAAE,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;AACpH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAqB,EACrB,KAA0B;IAE1B,2BAA2B,CAAC,KAAK,CAAC,CAAC;IACnC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,EAAE,KAAK,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAqB,EACrB,QAAgB;IAEhB,wBAAwB,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IACvC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,gBAAgB,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,MAAqB;IAC/C,OAAO,sBAAsB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,MAAqB;IACpD,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,eAAe,EAAE,SAAS,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,KAAyB;IAEzB,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAClC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,KAAK,CAAU,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,MAAqB;IAErB,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;IACnE,OAAO;QACL,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAqB;IACtD,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;AACtC,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAqB;IAErB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,YAAY,EAAE,SAAS,CAAC,CAAC,CAAC;AACzG,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,KAAyB;IAEzB,IAAI,KAAK;QAAE,yBAAyB,CAAC,KAAK,CAAC,CAAC;IAC5C,OAAO,2BAA2B,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CAAU,YAAY,EAAE,KAAK,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB,EACrB,KAAa;IAEb,MAAM,MAAM,CAAC,MAAM,CAAC,cAAc,kBAAkB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACjE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,MAAqB;IAErB,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,GAAG,CAAU,gBAAgB,EAAE,SAAS,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,MAAM,CAAC,MAAM,CAAC,kBAAkB,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACzE,CAAC"}