@uluops/ops-sdk 6.3.1 → 6.5.0

package/dist/errors/errors.d.ts

@@ -100,4 +100,75 @@ export declare function isOrgAccessDeniedError(err: unknown): err is _SdkApiErro
 export declare function isProjectRehomedError(err: unknown): err is _SdkApiError & {
     details: ProjectRehomedDetails;
 };
+/**
+ * 403 — the route is session-only (D20): platform-admin writes that mint or
+ * re-point identity, and the two cross-tenant project moves, refuse a `ulr_`
+ * key even when its user is a platform admin. Terminal for a key-authenticated
+ * client: log in (`OpsClient.login`, completing MFA with `loginWithTotp` if
+ * challenged) and retry with the session — never by minting another key.
+ */
+export declare const SESSION_REQUIRED: "SESSION_REQUIRED";
+/** 403 — the caller lacks the PLATFORM role (`users.role`) the admin path requires; distinct from the org-role codes above. */
+export declare const INSUFFICIENT_ROLE: "INSUFFICIENT_ROLE";
+/** Type guard: session-only route refused an API key (403 `SESSION_REQUIRED`). Terminal for key auth. */
+export declare function isSessionRequiredError(err: unknown): err is _SdkApiError;
+/** Type guard: the caller's PLATFORM role is below what the admin path requires (403 `INSUFFICIENT_ROLE`). Terminal — no org argument changes it. */
+export declare function isInsufficientRoleError(err: unknown): err is _SdkApiError;
+/**
+ * The refusal reasons a re-home can answer with, as `details.reason` on a
+ * 400 (`VALIDATION_ERROR`) or 409 (`CONFLICT`). Enumerated here because the
+ * Phase 4 runbook (spec §4.7 item 3) assigns each a disposition, and a script
+ * that switches on a string it typed itself will misspell one:
+ *
+ * - `same_org` — already there. Idempotent re-run over a finished row; count as done.
+ * - `moved_during_request` / `deadlock_retry` / `concurrent_modification` — re-read and retry once.
+ * - `name_collision` / `soft_deleted_conflict` / `rehomed_away_conflict` — skip and report.
+ * - `export_in_progress` — an export job holds either org; wait, then retry.
+ * - `project_soft_deleted` / `project_has_no_org` — the source row is not movable as-is; stop and look.
+ */
+export declare const REHOME_REFUSAL_REASONS: readonly ["same_org", "moved_during_request", "deadlock_retry", "concurrent_modification", "name_collision", "soft_deleted_conflict", "rehomed_away_conflict", "export_in_progress", "project_soft_deleted", "project_has_no_org"];
+export type RehomeRefusalReason = (typeof REHOME_REFUSAL_REASONS)[number];
+/**
+ * The re-home refusal reason carried by a rejection, or `null` when the error
+ * is not one of the enumerated re-home refusals (a 403 org code, a 402
+ * `PROJECT_LIMIT`, a network failure). Reads `details.reason`; an unknown
+ * reason string returns null rather than a widened type — a new server reason
+ * should reach the caller as "not one I know", not as a silently-handled case.
+ *
+ * `null` therefore means "not a re-home refusal I can name", NOT "safe to
+ * retry": a `TimeoutError` / `NetworkError` after the server committed the
+ * move also reads `null`, and a blind retry on the admin path answers
+ * `same_org` (fine) while on the member path it answers 404 (see
+ * `projects.rehome`). Branch on `isTimeoutError` / `isNetworkError` first.
+ */
+export declare function rehomeRefusalReason(err: unknown): RehomeRefusalReason | null;
+/**
+ * Thrown by `OpsClient.login` / `auth.login` when the account has MFA enabled:
+ * the API answers `200 { mfa_required: true, mfa_challenge_token, ... }` and no
+ * session. Until 6.4.0 this surfaced as a raw `ZodError` on `sessionToken`,
+ * which made the SDK unable to log in ANY MFA account. Complete the login with
+ * `OpsClient.loginWithTotp(err.mfaChallengeToken, code)` before the challenge
+ * expires (`expiresAt`). WebAuthn completion is not offered by this SDK.
+ *
+ * **The token is single-use and is consumed before the code is verified** —
+ * a mistyped code burns it; do not loop on `loginWithTotp` with the same
+ * token, call `login()` again for a new challenge. And this error is raised
+ * only by `login()` / `auth.login()`: a client constructed with
+ * `{ email, password }` (or autoloaded credentials) logs in inside sdk-core,
+ * which cannot see the challenge and surfaces a generic `UnauthorizedError`
+ * — MFA accounts must use the two-step `login()` → `loginWithTotp()` path.
+ */
+export declare class MfaRequiredError extends Error {
+    readonly name = "MfaRequiredError";
+    readonly mfaChallengeToken: string;
+    readonly expiresAt: string;
+    readonly mfaMethods: readonly string[];
+    constructor(challenge: {
+        mfaChallengeToken: string;
+        expiresAt: string;
+        mfaMethods: readonly string[];
+    });
+}
+/** Type guard for {@link MfaRequiredError}. */
+export declare function isMfaRequiredError(err: unknown): err is MfaRequiredError;
 //# sourceMappingURL=errors.d.ts.map

package/dist/errors/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACpC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;QACnE,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,GAAG,EAAE,OAAO,CAAC;QACb,aAAa,EAAE,OAAO,CAAC;KACxB;CASF;AAMD,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAG,uBAAgC,CAAC;AACtE,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAG,iBAA0B,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAMD,8HAA8H;AAC9H,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,GAAG;IAAE,OAAO,CAAC,EAAE,0BAA0B,CAAA;CAAE,CAEvH;AAED,oHAAoH;AACpH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAExE;AAED,sHAAsH;AACtH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,GAAG;IAAE,OAAO,EAAE,qBAAqB,CAAA;CAAE,CAI5G"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAGhE,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IACnF,QAAQ,CAAC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;IAC5E,kFAAkF;IAClF,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,0EAA0E;IAC1E,QAAQ,CAAC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IACzC,yEAAyE;IACzE,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,qEAAqE;IACrE,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;gBAEpB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE;QACpC,MAAM,EAAE,cAAc,GAAG,eAAe,GAAG,uBAAuB,CAAC;QACnE,kBAAkB,EAAE,MAAM,CAAC;QAC3B,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,GAAG,EAAE,OAAO,CAAC;QACb,aAAa,EAAE,OAAO,CAAC;KACxB;CASF;AAMD,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,EAAG,uBAAgC,CAAC;AACtE,sHAAsH;AACtH,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAC;AAC9D;;;;;GAKG;AACH,eAAO,MAAM,eAAe,EAAG,iBAA0B,CAAC;AAE1D,8EAA8E;AAC9E,MAAM,WAAW,0BAA0B;IACzC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mEAAmE;IACnE,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,uEAAuE;IACvE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED,+DAA+D;AAC/D,MAAM,WAAW,qBAAqB;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;IACzC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACxB;AAMD,8HAA8H;AAC9H,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,GAAG;IAAE,OAAO,CAAC,EAAE,0BAA0B,CAAA;CAAE,CAEvH;AAED,oHAAoH;AACpH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAExE;AAED,sHAAsH;AACtH,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,GAAG;IAAE,OAAO,EAAE,qBAAqB,CAAA;CAAE,CAI5G;AAMD;;;;;;GAMG;AACH,eAAO,MAAM,gBAAgB,EAAG,kBAA2B,CAAC;AAC5D,+HAA+H;AAC/H,eAAO,MAAM,iBAAiB,EAAG,mBAA4B,CAAC;AAE9D,yGAAyG;AACzG,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAExE;AAED,qJAAqJ;AACrJ,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,YAAY,CAEzE;AAED;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,sBAAsB,oOAWzB,CAAC;AACX,MAAM,MAAM,mBAAmB,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE1E;;;;;;;;;;;;GAYG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,OAAO,GAAG,mBAAmB,GAAG,IAAI,CAM5E;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAkB,IAAI,sBAAsB;IAC5C,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;IACnC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;gBAE3B,SAAS,EAAE;QAAE,iBAAiB,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAA;KAAE;CASvG;AAED,+CAA+C;AAC/C,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,GAAG,IAAI,gBAAgB,CAExE"}

package/dist/errors/errors.js

@@ -95,4 +95,103 @@ export function isProjectRehomedError(err) {
     const d = err.details;
     return typeof d?.target_org?.slug === 'string' && typeof d.project_id === 'string';
 }
+// ---------------------------------------------------------------------------
+// Re-home surfaces (spec §4, 6.4.0)
+// ---------------------------------------------------------------------------
+/**
+ * 403 — the route is session-only (D20): platform-admin writes that mint or
+ * re-point identity, and the two cross-tenant project moves, refuse a `ulr_`
+ * key even when its user is a platform admin. Terminal for a key-authenticated
+ * client: log in (`OpsClient.login`, completing MFA with `loginWithTotp` if
+ * challenged) and retry with the session — never by minting another key.
+ */
+export const SESSION_REQUIRED = 'SESSION_REQUIRED';
+/** 403 — the caller lacks the PLATFORM role (`users.role`) the admin path requires; distinct from the org-role codes above. */
+export const INSUFFICIENT_ROLE = 'INSUFFICIENT_ROLE';
+/** Type guard: session-only route refused an API key (403 `SESSION_REQUIRED`). Terminal for key auth. */
+export function isSessionRequiredError(err) {
+    return hasCode(err, SESSION_REQUIRED);
+}
+/** Type guard: the caller's PLATFORM role is below what the admin path requires (403 `INSUFFICIENT_ROLE`). Terminal — no org argument changes it. */
+export function isInsufficientRoleError(err) {
+    return hasCode(err, INSUFFICIENT_ROLE);
+}
+/**
+ * The refusal reasons a re-home can answer with, as `details.reason` on a
+ * 400 (`VALIDATION_ERROR`) or 409 (`CONFLICT`). Enumerated here because the
+ * Phase 4 runbook (spec §4.7 item 3) assigns each a disposition, and a script
+ * that switches on a string it typed itself will misspell one:
+ *
+ * - `same_org` — already there. Idempotent re-run over a finished row; count as done.
+ * - `moved_during_request` / `deadlock_retry` / `concurrent_modification` — re-read and retry once.
+ * - `name_collision` / `soft_deleted_conflict` / `rehomed_away_conflict` — skip and report.
+ * - `export_in_progress` — an export job holds either org; wait, then retry.
+ * - `project_soft_deleted` / `project_has_no_org` — the source row is not movable as-is; stop and look.
+ */
+export const REHOME_REFUSAL_REASONS = [
+    'same_org',
+    'moved_during_request',
+    'deadlock_retry',
+    'concurrent_modification',
+    'name_collision',
+    'soft_deleted_conflict',
+    'rehomed_away_conflict',
+    'export_in_progress',
+    'project_soft_deleted',
+    'project_has_no_org',
+];
+/**
+ * The re-home refusal reason carried by a rejection, or `null` when the error
+ * is not one of the enumerated re-home refusals (a 403 org code, a 402
+ * `PROJECT_LIMIT`, a network failure). Reads `details.reason`; an unknown
+ * reason string returns null rather than a widened type — a new server reason
+ * should reach the caller as "not one I know", not as a silently-handled case.
+ *
+ * `null` therefore means "not a re-home refusal I can name", NOT "safe to
+ * retry": a `TimeoutError` / `NetworkError` after the server committed the
+ * move also reads `null`, and a blind retry on the admin path answers
+ * `same_org` (fine) while on the member path it answers 404 (see
+ * `projects.rehome`). Branch on `isTimeoutError` / `isNetworkError` first.
+ */
+export function rehomeRefusalReason(err) {
+    if (!(err instanceof _SdkApiError))
+        return null;
+    const reason = err.details?.reason;
+    return typeof reason === 'string' && REHOME_REFUSAL_REASONS.includes(reason)
+        ? reason
+        : null;
+}
+/**
+ * Thrown by `OpsClient.login` / `auth.login` when the account has MFA enabled:
+ * the API answers `200 { mfa_required: true, mfa_challenge_token, ... }` and no
+ * session. Until 6.4.0 this surfaced as a raw `ZodError` on `sessionToken`,
+ * which made the SDK unable to log in ANY MFA account. Complete the login with
+ * `OpsClient.loginWithTotp(err.mfaChallengeToken, code)` before the challenge
+ * expires (`expiresAt`). WebAuthn completion is not offered by this SDK.
+ *
+ * **The token is single-use and is consumed before the code is verified** —
+ * a mistyped code burns it; do not loop on `loginWithTotp` with the same
+ * token, call `login()` again for a new challenge. And this error is raised
+ * only by `login()` / `auth.login()`: a client constructed with
+ * `{ email, password }` (or autoloaded credentials) logs in inside sdk-core,
+ * which cannot see the challenge and surfaces a generic `UnauthorizedError`
+ * — MFA accounts must use the two-step `login()` → `loginWithTotp()` path.
+ */
+export class MfaRequiredError extends Error {
+    name = 'MfaRequiredError';
+    mfaChallengeToken;
+    expiresAt;
+    mfaMethods;
+    constructor(challenge) {
+        super(`Login requires a second factor (${challenge.mfaMethods.join(', ') || 'unknown method'}); ` +
+            'complete it with loginWithTotp(mfaChallengeToken, code) before the challenge expires');
+        this.mfaChallengeToken = challenge.mfaChallengeToken;
+        this.expiresAt = challenge.expiresAt;
+        this.mfaMethods = challenge.mfaMethods;
+    }
+}
+/** Type guard for {@link MfaRequiredError}. */
+export function isMfaRequiredError(err) {
+    return err instanceof MfaRequiredError;
+}
 //# sourceMappingURL=errors.js.map

package/dist/errors/errors.js.map

@@ -1 +1 @@
-{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,sBAAsB;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IAC1E,MAAM,CAA6D;IAC5E,kFAAkF;IACzE,kBAAkB,CAAS;IACpC,0EAA0E;IACjE,gBAAgB,CAAgB;IACzC,yEAAyE;IAChE,GAAG,CAAU;IACtB,qEAAqE;IAC5D,aAAa,CAAU;IAEhC,YAAY,OAAe,EAAE,OAM5B;QACC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;CACF;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAgC,CAAC;AACtE,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAA4B,CAAC;AAC9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAA0B,CAAC;AAoB1D,SAAS,OAAO,CAAC,GAAY,EAAE,IAAY;IACzC,OAAO,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1D,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,OAAO,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAC7C,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACzC,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAqD,CAAC;IACpE,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;AACrF,CAAC"}
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../src/errors/errors.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EACL,WAAW,IAAI,WAAW,EAC1B,eAAe,EACf,iBAAiB,EACjB,cAAc,EACd,aAAa,EACb,aAAa,EACb,oBAAoB,EACpB,kBAAkB,EAClB,cAAc,EACd,uBAAuB,EACvB,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,aAAa,IAAI,aAAa,EAC9B,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,oBAAoB,EACpB,gBAAgB,EAChB,mBAAmB,EACnB,gBAAgB,EAChB,sBAAsB,EACtB,yBAAyB,EACzB,cAAc,EACd,eAAe,EACf,cAAc,GACf,MAAM,yBAAyB,CAAC;AAEjC;;;;GAIG;AACH,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,sBAAsB;AACtB,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAE/D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAClD,mFAAmF;IAC1E,MAAM,CAA6D;IAC5E,kFAAkF;IACzE,kBAAkB,CAAS;IACpC,0EAA0E;IACjE,gBAAgB,CAAgB;IACzC,yEAAyE;IAChE,GAAG,CAAU;IACtB,qEAAqE;IAC5D,aAAa,CAAU;IAEhC,YAAY,OAAe,EAAE,OAM5B;QACC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;QAC7B,IAAI,CAAC,kBAAkB,GAAG,OAAO,CAAC,kBAAkB,CAAC;QACrD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,CAAC;QACjD,IAAI,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC;QACvB,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,CAAC;IAC7C,CAAC;CACF;AAED,8EAA8E;AAC9E,2DAA2D;AAC3D,8EAA8E;AAE9E,OAAO,EAAE,WAAW,IAAI,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,uBAAgC,CAAC;AACtE,sHAAsH;AACtH,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAA4B,CAAC;AAC9D;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,iBAA0B,CAAC;AAoB1D,SAAS,OAAO,CAAC,GAAY,EAAE,IAAY;IACzC,OAAO,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC;AAC1D,CAAC;AAED,8HAA8H;AAC9H,MAAM,UAAU,0BAA0B,CAAC,GAAY;IACrD,OAAO,OAAO,CAAC,GAAG,EAAE,qBAAqB,CAAC,CAAC;AAC7C,CAAC;AAED,oHAAoH;AACpH,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACzC,CAAC;AAED,sHAAsH;AACtH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IACjD,MAAM,CAAC,GAAG,GAAG,CAAC,OAAqD,CAAC;IACpE,OAAO,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC;AACrF,CAAC;AAED,8EAA8E;AAC9E,oCAAoC;AACpC,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAA2B,CAAC;AAC5D,+HAA+H;AAC/H,MAAM,CAAC,MAAM,iBAAiB,GAAG,mBAA4B,CAAC;AAE9D,yGAAyG;AACzG,MAAM,UAAU,sBAAsB,CAAC,GAAY;IACjD,OAAO,OAAO,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;AACxC,CAAC;AAED,qJAAqJ;AACrJ,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,OAAO,OAAO,CAAC,GAAG,EAAE,iBAAiB,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG;IACpC,UAAU;IACV,sBAAsB;IACtB,gBAAgB;IAChB,yBAAyB;IACzB,gBAAgB;IAChB,uBAAuB;IACvB,uBAAuB;IACvB,oBAAoB;IACpB,sBAAsB;IACtB,oBAAoB;CACZ,CAAC;AAGX;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAY;IAC9C,IAAI,CAAC,CAAC,GAAG,YAAY,YAAY,CAAC;QAAE,OAAO,IAAI,CAAC;IAChD,MAAM,MAAM,GAAI,GAAG,CAAC,OAA4C,EAAE,MAAM,CAAC;IACzE,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAK,sBAA4C,CAAC,QAAQ,CAAC,MAAM,CAAC;QACjG,CAAC,CAAE,MAA8B;QACjC,CAAC,CAAC,IAAI,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACvB,IAAI,GAAG,kBAAkB,CAAC;IACnC,iBAAiB,CAAS;IAC1B,SAAS,CAAS;IAClB,UAAU,CAAoB;IAEvC,YAAY,SAA0F;QACpG,KAAK,CACH,mCAAmC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,KAAK;YAC3F,sFAAsF,CACvF,CAAC;QACF,IAAI,CAAC,iBAAiB,GAAG,SAAS,CAAC,iBAAiB,CAAC;QACrD,IAAI,CAAC,SAAS,GAAG,SAAS,CAAC,SAAS,CAAC;QACrC,IAAI,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CAAC;IACzC,CAAC;CACF;AAED,+CAA+C;AAC/C,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,OAAO,GAAG,YAAY,gBAAgB,CAAC;AACzC,CAAC"}

package/dist/index.d.ts

@@ -7,7 +7,7 @@
  * - Types: All domain interfaces (Run, Issue, AgentInput, SaveRunInput, etc.)
  * - Config: Credential loading and environment variable helpers
  */
-export { OpsClient, type OpsClientConfig } from './client.js';
+export { OpsClient, type OpsClientConfig, type LoginOptions } from './client.js';
 export { OpsHttpClient, type HttpClientConfig, type QueryParams, type QueryParamValue } from './http/http-client.js';
 export type { SecurityEvent, SecurityEventType, SecurityEventHandler, AuthType, AuthFailureEvent, RedirectRejectedEvent, TokenRefreshFailedEvent, AuthStrategyReplacedEvent, } from './http/http-client.js';
 export { ApiKeyAuth, JwtSessionAuth, createAuthStrategy, type AuthStrategy, type AuthConfig } from './http/auth-strategy.js';
@@ -16,5 +16,5 @@ export * from './types/index.js';
 export { isValidMetric, ANALYTICS_METRICS, type AnalyticsMetric } from './operations/analytics.js';
 export { loadCredentials, loadConfig, loadEnvFiles, type Credentials, type SdkConfig } from './config/loaders.js';
 export { DEFAULT_BASE_URL, API_KEY_PREFIX, ENV_VARS } from './config/constants.js';
-export { resolveWorkspaceOrg, findWorkspaceOrgFile, readWorkspaceOrgFile, WORKSPACE_ORG_FILE, PERSONAL_ORG_SENTINEL, type WorkspaceOrgResolution, type WorkspaceOrgSource, type ResolveWorkspaceOrgOptions, } from './config/workspace-org.js';
+export { resolveWorkspaceOrg, findWorkspaceOrgFile, readWorkspaceOrgFile, readWorkspaceFile, WORKSPACE_ORG_FILE, PERSONAL_ORG_SENTINEL, type WorkspaceFile, type WorkspaceOrgResolution, type WorkspaceOrgSource, type ResolveWorkspaceOrgOptions, } from './config/workspace-org.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAG9D,OAAO,EAAE,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrH,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG7H,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGnG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EAAE,SAAS,EAAE,KAAK,eAAe,EAAE,KAAK,YAAY,EAAE,MAAM,aAAa,CAAC;AAGjF,OAAO,EAAE,aAAa,EAAE,KAAK,gBAAgB,EAAE,KAAK,WAAW,EAAE,KAAK,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACrH,YAAY,EACV,aAAa,EACb,iBAAiB,EACjB,oBAAoB,EACpB,QAAQ,EACR,gBAAgB,EAChB,qBAAqB,EACrB,uBAAuB,EACvB,yBAAyB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,KAAK,YAAY,EAAE,KAAK,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG7H,cAAc,oBAAoB,CAAC;AAGnC,cAAc,kBAAkB,CAAC;AAGjC,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAE,KAAK,eAAe,EAAE,MAAM,2BAA2B,CAAC;AAGnG,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAE,KAAK,WAAW,EAAE,KAAK,SAAS,EAAE,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,EACrB,KAAK,aAAa,EAClB,KAAK,sBAAsB,EAC3B,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,GAChC,MAAM,2BAA2B,CAAC"}

package/dist/index.js

@@ -21,5 +21,5 @@ export { isValidMetric, ANALYTICS_METRICS } from './operations/analytics.js';
 // Config — credential loading from env vars, .env files, and ~/.uluops/credentials.json
 export { loadCredentials, loadConfig, loadEnvFiles } from './config/loaders.js';
 export { DEFAULT_BASE_URL, API_KEY_PREFIX, ENV_VARS } from './config/constants.js';
-export { resolveWorkspaceOrg, findWorkspaceOrgFile, readWorkspaceOrgFile, WORKSPACE_ORG_FILE, PERSONAL_ORG_SENTINEL, } from './config/workspace-org.js';
+export { resolveWorkspaceOrg, findWorkspaceOrgFile, readWorkspaceOrgFile, readWorkspaceFile, WORKSPACE_ORG_FILE, PERSONAL_ORG_SENTINEL, } from './config/workspace-org.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2DAA2D;AAC3D,OAAO,EAAE,SAAS,EAAwB,MAAM,aAAa,CAAC;AAE9D,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAiE,MAAM,uBAAuB,CAAC;AAWrH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAsC,MAAM,yBAAyB,CAAC;AAE7H,0EAA0E;AAC1E,cAAc,oBAAoB,CAAC;AAEnC,gEAAgE;AAChE,cAAc,kBAAkB,CAAC;AAEjC,mEAAmE;AACnE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AAEnG,wFAAwF;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAoC,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,kBAAkB,EAClB,qBAAqB,GAItB,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,2DAA2D;AAC3D,OAAO,EAAE,SAAS,EAA2C,MAAM,aAAa,CAAC;AAEjF,oFAAoF;AACpF,OAAO,EAAE,aAAa,EAAiE,MAAM,uBAAuB,CAAC;AAWrH,OAAO,EAAE,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAsC,MAAM,yBAAyB,CAAC;AAE7H,0EAA0E;AAC1E,cAAc,oBAAoB,CAAC;AAEnC,gEAAgE;AAChE,cAAc,kBAAkB,CAAC;AAEjC,mEAAmE;AACnE,OAAO,EAAE,aAAa,EAAE,iBAAiB,EAAwB,MAAM,2BAA2B,CAAC;AAEnG,wFAAwF;AACxF,OAAO,EAAE,eAAe,EAAE,UAAU,EAAE,YAAY,EAAoC,MAAM,qBAAqB,CAAC;AAClH,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AACnF,OAAO,EACL,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EACpB,iBAAiB,EACjB,kBAAkB,EAClB,qBAAqB,GAKtB,MAAM,2BAA2B,CAAC"}

package/dist/operations/admin.d.ts

@@ -0,0 +1,100 @@
+import type { OpsHttpClient } from '../http/http-client.js';
+import type { AdminRehomeProjectInput, RehomeResponse, ProjectRehomeList, ProjectRehomeListQuery, ProjectRehomeEventList, ProjectRehomeEventListQuery } from '../types/rehome.js';
+/**
+ * Platform-admin project re-home surface (project-org-routing-and-rehome spec
+ * §4.1 D8, §4.7, D20, D21). Every call here requires `users.role = 'admin'` —
+ * a PLATFORM role, not an org role — and the two writes additionally require
+ * a login-issued SESSION (D20): a `ulr_` key, even an admin's, gets
+ * `403 SESSION_REQUIRED` (`isSessionRequiredError`). Log in with
+ * `OpsClient.login` (completing MFA via `loginWithTotp` if challenged) and the
+ * session bearer is what these calls send. There is deliberately no MCP tool
+ * for any of this.
+ *
+ * `admin.` is a namespace, not an escalation: the same client, the same auth
+ * strategy. If the credential cannot do it the server says so.
+ */
+/**
+ * Move ANY project between ANY two orgs — `POST /admin/projects/:id/rehome`.
+ * No source-membership and no target-membership requirement (the platform role
+ * is the authority), so `reason` is REQUIRED: on this path the target org's
+ * only standing is the `rehome_in` audit row plus that text. Resolves the
+ * project by id UNSCOPED (the admin router has no org context) — the route
+ * takes a UUID and answers 400 to anything else, so unlike `projects.*` a
+ * NAME is refused here, client-side, before the request.
+ *
+ * Session-only (D20). Phase 4 of the spec runs this once per row of the OQ-4
+ * table, sequentially, with the row reference as `reason`. On THIS path a
+ * re-run over a finished row answers `same_org` (the lookup is by id, so the
+ * moved project is found wherever it is) — read it as "already done" via
+ * `rehomeRefusalReason`. That is not true of the member path, whose lookup is
+ * source-scoped (see `projects.rehome`).
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param projectId - Project UUID (a name is an `InputValidationError`)
+ * @param input - `{ targetOrg, reason }` — both required
+ * @returns The project after the move (`orgId` is the target) plus the `rehome` block
+ * @throws {InputValidationError} If `projectId` is not a UUID, `targetOrg` is not a slug, or `reason` is missing
+ * @example
+ * ```typescript
+ * await client.login(email, password); // or loginWithTotp after an MfaRequiredError
+ * const moved = await client.admin.rehomeProject(projectId, { targetOrg: 'ulu-labs', reason: 'OQ-4 row 7' });
+ * moved.rehome.to_org.slug; // 'ulu-labs'
+ * ```
+ */
+export declare function rehomeProject(client: OpsHttpClient, projectId: string, input: AdminRehomeProjectInput): Promise<RehomeResponse>;
+/**
+ * The reservation table — `GET /admin/projects/rehomes`: every vacated
+ * `(org, name)` address and where it redirects. Key-readable. This is the
+ * CURRENT redirect state, not the history — a reversal annihilates its row and
+ * a release deletes it; for "what happened" read {@link listProjectRehomeEvents}.
+ *
+ * `org` takes a UUID or a slug; `total` is the matching count, `returned` the page.
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, since?, limit? }`
+ * @returns `{ data, total, returned }` — reservation rows, camelCase
+ */
+export declare function listProjectRehomes(client: OpsHttpClient, query?: ProjectRehomeListQuery): Promise<ProjectRehomeList>;
+/**
+ * The append-only ledger (D21) — `GET /admin/projects/rehome-events`: every
+ * move, re-point, annihilation, degenerate drop, release and hard-delete
+ * release, written in the same transaction as the change; nothing the API
+ * offers removes a row. Key-readable. Pages by `seq` (insertion order) —
+ * `nextCursor` is the `seq` to continue strictly below; pass it back verbatim.
+ * This, not the reservation listing and not a script's own log, is what a
+ * migration reconciles against (spec §4.7 item 4).
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, event?, since?, cursor?, limit? }`
+ * @returns `{ data, total, returned, hasMore, nextCursor }` — ledger rows, camelCase, newest `seq` first
+ * @example
+ * ```typescript
+ * let cursor: string | undefined;
+ * do {
+ *   const page = await client.admin.listProjectRehomeEvents({ org: 'ulu-labs', event: 'moved', cursor });
+ *   for (const ev of page.data) console.log(ev.seq, ev.projectName, ev.fromOrgId, '→', ev.toOrgId);
+ *   cursor = page.nextCursor ?? undefined;
+ * } while (cursor);
+ * ```
+ */
+export declare function listProjectRehomeEvents(client: OpsHttpClient, query?: ProjectRehomeEventListQuery): Promise<ProjectRehomeEventList>;
+/**
+ * Release a vacated address — `DELETE /admin/projects/rehomes/:id`. After
+ * this the old `(org, name)` is creatable again: a by-name writer there gets a
+ * NEW project instead of `410 PROJECT_REHOMED`. Deliberate, audited (`released`
+ * ledger row), never done by time. Session-only (D20): release is the step that
+ * empties the queryable record.
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param rehomeId - The reservation row id (from {@link listProjectRehomes}); a non-UUID is refused client-side
+ * @returns `{ released: true }`
+ * @throws {InputValidationError} If `rehomeId` is not a UUID
+ * @throws {ZodError} If the 200 body does not say `released: true` — the same signal every other
+ *   shape mismatch in this SDK gives. Note the server sends 200 AFTER the row is gone, so a
+ *   shape failure here means the release most likely HAPPENED; re-read `listProjectRehomes`
+ *   before retrying (a retry answers 404).
+ */
+export declare function releaseProjectRehome(client: OpsHttpClient, rehomeId: string): Promise<{
+    released: true;
+}>;
+//# sourceMappingURL=admin.d.ts.map

package/dist/operations/admin.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.d.ts","sourceRoot":"","sources":["../../src/operations/admin.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EACV,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAS5B;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,uBAAuB,GAC7B,OAAO,CAAC,cAAc,CAAC,CAOzB;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,kBAAkB,CACtC,MAAM,EAAE,aAAa,EACrB,KAAK,GAAE,sBAA2B,GACjC,OAAO,CAAC,iBAAiB,CAAC,CAO5B;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,aAAa,EACrB,KAAK,GAAE,2BAAgC,GACtC,OAAO,CAAC,sBAAsB,CAAC,CAUjC;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,oBAAoB,CACxC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC;IAAE,QAAQ,EAAE,IAAI,CAAA;CAAE,CAAC,CAG7B"}

package/dist/operations/admin.js

@@ -0,0 +1,130 @@
+import { RehomeResponseSchema, ProjectRehomeListResponseSchema, ProjectRehomeEventListResponseSchema, } from '../types/rehome.js';
+import { z } from 'zod';
+import { validateAdminRehomeProjectInput, validateUuid } from '../config/validators.js';
+/**
+ * Platform-admin project re-home surface (project-org-routing-and-rehome spec
+ * §4.1 D8, §4.7, D20, D21). Every call here requires `users.role = 'admin'` —
+ * a PLATFORM role, not an org role — and the two writes additionally require
+ * a login-issued SESSION (D20): a `ulr_` key, even an admin's, gets
+ * `403 SESSION_REQUIRED` (`isSessionRequiredError`). Log in with
+ * `OpsClient.login` (completing MFA via `loginWithTotp` if challenged) and the
+ * session bearer is what these calls send. There is deliberately no MCP tool
+ * for any of this.
+ *
+ * `admin.` is a namespace, not an escalation: the same client, the same auth
+ * strategy. If the credential cannot do it the server says so.
+ */
+/**
+ * Move ANY project between ANY two orgs — `POST /admin/projects/:id/rehome`.
+ * No source-membership and no target-membership requirement (the platform role
+ * is the authority), so `reason` is REQUIRED: on this path the target org's
+ * only standing is the `rehome_in` audit row plus that text. Resolves the
+ * project by id UNSCOPED (the admin router has no org context) — the route
+ * takes a UUID and answers 400 to anything else, so unlike `projects.*` a
+ * NAME is refused here, client-side, before the request.
+ *
+ * Session-only (D20). Phase 4 of the spec runs this once per row of the OQ-4
+ * table, sequentially, with the row reference as `reason`. On THIS path a
+ * re-run over a finished row answers `same_org` (the lookup is by id, so the
+ * moved project is found wherever it is) — read it as "already done" via
+ * `rehomeRefusalReason`. That is not true of the member path, whose lookup is
+ * source-scoped (see `projects.rehome`).
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param projectId - Project UUID (a name is an `InputValidationError`)
+ * @param input - `{ targetOrg, reason }` — both required
+ * @returns The project after the move (`orgId` is the target) plus the `rehome` block
+ * @throws {InputValidationError} If `projectId` is not a UUID, `targetOrg` is not a slug, or `reason` is missing
+ * @example
+ * ```typescript
+ * await client.login(email, password); // or loginWithTotp after an MfaRequiredError
+ * const moved = await client.admin.rehomeProject(projectId, { targetOrg: 'ulu-labs', reason: 'OQ-4 row 7' });
+ * moved.rehome.to_org.slug; // 'ulu-labs'
+ * ```
+ */
+export async function rehomeProject(client, projectId, input) {
+    validateUuid(projectId, 'projectId');
+    const valid = validateAdminRehomeProjectInput(input);
+    return RehomeResponseSchema.parse(await client.post(`/admin/projects/${encodeURIComponent(projectId)}/rehome`, { target_org: valid.targetOrg, reason: valid.reason }));
+}
+/**
+ * The reservation table — `GET /admin/projects/rehomes`: every vacated
+ * `(org, name)` address and where it redirects. Key-readable. This is the
+ * CURRENT redirect state, not the history — a reversal annihilates its row and
+ * a release deletes it; for "what happened" read {@link listProjectRehomeEvents}.
+ *
+ * `org` takes a UUID or a slug; `total` is the matching count, `returned` the page.
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, since?, limit? }`
+ * @returns `{ data, total, returned }` — reservation rows, camelCase
+ */
+export async function listProjectRehomes(client, query = {}) {
+    return ProjectRehomeListResponseSchema.parse(await client.request('GET', '/admin/projects/rehomes', rehomeListParams(query), { rawEnvelope: true }));
+}
+/**
+ * The append-only ledger (D21) — `GET /admin/projects/rehome-events`: every
+ * move, re-point, annihilation, degenerate drop, release and hard-delete
+ * release, written in the same transaction as the change; nothing the API
+ * offers removes a row. Key-readable. Pages by `seq` (insertion order) —
+ * `nextCursor` is the `seq` to continue strictly below; pass it back verbatim.
+ * This, not the reservation listing and not a script's own log, is what a
+ * migration reconciles against (spec §4.7 item 4).
+ *
+ * @param client - HTTP client instance (a platform-admin key suffices)
+ * @param query - `{ projectId?, org?, event?, since?, cursor?, limit? }`
+ * @returns `{ data, total, returned, hasMore, nextCursor }` — ledger rows, camelCase, newest `seq` first
+ * @example
+ * ```typescript
+ * let cursor: string | undefined;
+ * do {
+ *   const page = await client.admin.listProjectRehomeEvents({ org: 'ulu-labs', event: 'moved', cursor });
+ *   for (const ev of page.data) console.log(ev.seq, ev.projectName, ev.fromOrgId, '→', ev.toOrgId);
+ *   cursor = page.nextCursor ?? undefined;
+ * } while (cursor);
+ * ```
+ */
+export async function listProjectRehomeEvents(client, query = {}) {
+    const params = rehomeListParams(query);
+    if (query.event !== undefined)
+        params['event'] = query.event;
+    if (query.cursor !== undefined)
+        params['cursor'] = query.cursor;
+    return ProjectRehomeEventListResponseSchema.parse(await client.request('GET', '/admin/projects/rehome-events', params, { rawEnvelope: true }));
+}
+/**
+ * Release a vacated address — `DELETE /admin/projects/rehomes/:id`. After
+ * this the old `(org, name)` is creatable again: a by-name writer there gets a
+ * NEW project instead of `410 PROJECT_REHOMED`. Deliberate, audited (`released`
+ * ledger row), never done by time. Session-only (D20): release is the step that
+ * empties the queryable record.
+ *
+ * @param client - HTTP client instance carrying a SESSION
+ * @param rehomeId - The reservation row id (from {@link listProjectRehomes}); a non-UUID is refused client-side
+ * @returns `{ released: true }`
+ * @throws {InputValidationError} If `rehomeId` is not a UUID
+ * @throws {ZodError} If the 200 body does not say `released: true` — the same signal every other
+ *   shape mismatch in this SDK gives. Note the server sends 200 AFTER the row is gone, so a
+ *   shape failure here means the release most likely HAPPENED; re-read `listProjectRehomes`
+ *   before retrying (a retry answers 404).
+ */
+export async function releaseProjectRehome(client, rehomeId) {
+    validateUuid(rehomeId, 'rehomeId');
+    return ReleaseResponseSchema.parse(await client.delete(`/admin/projects/rehomes/${encodeURIComponent(rehomeId)}`));
+}
+/** `DELETE /admin/projects/rehomes/:id` answers `{ data: { released: true } }`; anything else is a contract break. */
+const ReleaseResponseSchema = z.object({ released: z.literal(true) });
+/** Shared filter serialisation for the two listings — snake_case on the wire (`project_id`), strings throughout. */
+function rehomeListParams(query) {
+    const params = {};
+    if (query.projectId !== undefined)
+        params['project_id'] = query.projectId;
+    if (query.org !== undefined)
+        params['org'] = query.org;
+    if (query.since !== undefined)
+        params['since'] = query.since;
+    if (query.limit !== undefined)
+        params['limit'] = String(query.limit);
+    return params;
+}
+//# sourceMappingURL=admin.js.map

package/dist/operations/admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"admin.js","sourceRoot":"","sources":["../../src/operations/admin.ts"],"names":[],"mappings":"AASA,OAAO,EACL,oBAAoB,EACpB,+BAA+B,EAC/B,oCAAoC,GACrC,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,+BAA+B,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAExF;;;;;;;;;;;;GAYG;AAEH;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAqB,EACrB,SAAiB,EACjB,KAA8B;IAE9B,YAAY,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,+BAA+B,CAAC,KAAK,CAAC,CAAC;IACrD,OAAO,oBAAoB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,IAAI,CACjD,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EACzD,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CACtD,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAqB,EACrB,QAAgC,EAAE;IAElC,OAAO,+BAA+B,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CAC/D,KAAK,EACL,yBAAyB,EACzB,gBAAgB,CAAC,KAAK,CAAC,EACvB,EAAE,WAAW,EAAE,IAAI,EAAE,CACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAqB,EACrB,QAAqC,EAAE;IAEvC,MAAM,MAAM,GAAG,gBAAgB,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7D,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS;QAAE,MAAM,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;IAChE,OAAO,oCAAoC,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,OAAO,CACpE,KAAK,EACL,+BAA+B,EAC/B,MAAM,EACN,EAAE,WAAW,EAAE,IAAI,EAAE,CACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,MAAqB,EACrB,QAAgB;IAEhB,YAAY,CAAC,QAAQ,EAAE,UAAU,CAAC,CAAC;IACnC,OAAO,qBAAqB,CAAC,KAAK,CAAC,MAAM,MAAM,CAAC,MAAM,CAAU,2BAA2B,kBAAkB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED,sHAAsH;AACtH,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAEtE,oHAAoH;AACpH,SAAS,gBAAgB,CAAC,KAA6B;IACrD,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,KAAK,CAAC,SAAS,KAAK,SAAS;QAAE,MAAM,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;IAC1E,IAAI,KAAK,CAAC,GAAG,KAAK,SAAS;QAAE,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;IACvD,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;IAC7D,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACrE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/operations/auth.d.ts

@@ -1,5 +1,5 @@
 import type { OpsHttpClient } from '../http/http-client.js';
-import type { RegisterInput, LoginInput, LoginResponse, RegisterResponse, UpdateProfileInput, ChangePasswordInput, ResetPasswordInput, CreateApiKeyInput, ApiKeyCreatedResponse, PublicApiKey, PublicSession, AuthUser, PublicUser } from '../types/auth.js';
+import type { RegisterInput, LoginInput, LoginResponse, TotpLoginInput, RegisterResponse, UpdateProfileInput, ChangePasswordInput, ResetPasswordInput, CreateApiKeyInput, ApiKeyCreatedResponse, PublicApiKey, PublicSession, AuthUser, PublicUser } from '../types/auth.js';
 import type { MessageResponse } from '../types/responses.js';
 /**
  * Register a new user account. Does not require authentication.
@@ -23,8 +23,28 @@ export declare function register(client: OpsHttpClient, input: RegisterInput): P
  * @returns `{ user, sessionToken }` — token must be manually installed on the client
  * @throws {InputValidationError} If email or password is missing
  * @throws {UnauthorizedError} If credentials are invalid
+ * @throws {MfaRequiredError} If the account has TOTP or a passkey enrolled — the API answered a
+ *   challenge, not a session; complete it with `totpLogin` / `OpsClient.loginWithTotp`
  */
 export declare function login(client: OpsHttpClient, input: LoginInput): Promise<LoginResponse>;
+/**
+ * Complete an MFA-challenged login with a TOTP code (`POST /auth/totp/login`).
+ * Returns the same `{ user, sessionToken, expiresAt }` a password login does.
+ * Like `login`, this only RETURNS the session — `OpsClient.loginWithTotp`
+ * installs it.
+ *
+ * **The challenge is single-use and is consumed BEFORE the code is checked**
+ * (`totp-service.verifyLogin`: consume, then verify). A wrong code therefore
+ * burns the token: retrying `totpLogin` with the same `mfaChallengeToken` is a
+ * 401 every time. Recovery is a fresh `login()` for a fresh challenge.
+ *
+ * @param client - HTTP client instance
+ * @param input - `{ mfaChallengeToken, code, rememberMe? }`
+ * @returns `{ user, sessionToken, expiresAt }` — token must be manually installed on the client
+ * @throws {InputValidationError} If the token is empty or the code is not six digits
+ * @throws {UnauthorizedError} If the code is wrong, or the challenge expired or was already consumed
+ */
+export declare function totpLogin(client: OpsHttpClient, input: TotpLoginInput): Promise<LoginResponse>;
 /**
  * Revoke all sessions for the current user (not just the current session).
  *

package/dist/operations/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/operations/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAuB7D;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAsB,KAAK,CACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CAGxB;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtC;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAErF;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAG/B;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAMrD;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,YAAY,EAAE,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,CAAC,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC,CAE1B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAEf"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/operations/auth.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAC5D,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,UAAU,EACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA0B7D;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAC5B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,aAAa,GACnB,OAAO,CAAC,gBAAgB,CAAC,CAG3B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,KAAK,CACzB,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,UAAU,GAChB,OAAO,CAAC,aAAa,CAAC,CAIxB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,cAAc,GACpB,OAAO,CAAC,aAAa,CAAC,CAWxB;AAoBD;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,eAAe,EAAE,MAAM,CAAA;CAAE,CAAC,CAEtC;AAED;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,eAAe,CAAC,CAE1B;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAClC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,eAAe,CAAC,CAG1B;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,QAAQ,CAAC,CAEpE;AAED;;;;;GAKG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAErF;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC;IAAE,IAAI,EAAE,UAAU,CAAA;CAAE,CAAC,CAG/B;AAED;;;;;GAKG;AACH,wBAAsB,SAAS,CAC7B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,CAAC,CAMrD;AAED;;;;GAIG;AACH,wBAAsB,YAAY,CAAC,MAAM,EAAE,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,CAEvE;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,YAAY,EAAE,CAAC,CAEzB;AAED;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,CAAC,EAAE,iBAAiB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAGhC;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,EACrB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,IAAI,CAAC,CAEf;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,MAAM,EAAE,aAAa,GACpB,OAAO,CAAC,aAAa,EAAE,CAAC,CAE1B;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,aAAa,EACrB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAEf"}

package/dist/operations/auth.js

@@ -1,6 +1,7 @@
 import { z } from 'zod';
-import { AuthUserResponseSchema, PublicUserResponseSchema, LoginResponseSchema, RegisterResponseSchema, PublicApiKeyResponseSchema, ApiKeyCreatedResponseSchema, PublicSessionResponseSchema, MessageResponseSchema, } from '../types/response-schemas.js';
-import { validateRegisterInput, validateLoginInput, validateUpdateProfileInput, validateChangePasswordInput, validateResetPasswordInput, validateSetPasswordInput, validateCreateApiKeyInput, } from '../config/validators.js';
+import { AuthUserResponseSchema, PublicUserResponseSchema, LoginResponseSchema, MfaChallengeResponseSchema, RegisterResponseSchema, PublicApiKeyResponseSchema, ApiKeyCreatedResponseSchema, PublicSessionResponseSchema, MessageResponseSchema, } from '../types/response-schemas.js';
+import { validateRegisterInput, validateLoginInput, validateTotpLoginInput, validateUpdateProfileInput, validateChangePasswordInput, validateResetPasswordInput, validateSetPasswordInput, validateCreateApiKeyInput, } from '../config/validators.js';
+import { MfaRequiredError } from '../errors/errors.js';
 const ProfileResponseSchema = z.object({ user: PublicUserResponseSchema });
 /**
  * Register a new user account. Does not require authentication.
@@ -27,10 +28,55 @@ export async function register(client, input) {
  * @returns `{ user, sessionToken }` — token must be manually installed on the client
  * @throws {InputValidationError} If email or password is missing
  * @throws {UnauthorizedError} If credentials are invalid
+ * @throws {MfaRequiredError} If the account has TOTP or a passkey enrolled — the API answered a
+ *   challenge, not a session; complete it with `totpLogin` / `OpsClient.loginWithTotp`
  */
 export async function login(client, input) {
     validateLoginInput(input);
-    return LoginResponseSchema.parse(await client.post('/auth/login', input, { skipAuth: true }));
+    const body = await client.post('/auth/login', input, { skipAuth: true });
+    return parseLoginOrChallenge(body);
+}
+/**
+ * Complete an MFA-challenged login with a TOTP code (`POST /auth/totp/login`).
+ * Returns the same `{ user, sessionToken, expiresAt }` a password login does.
+ * Like `login`, this only RETURNS the session — `OpsClient.loginWithTotp`
+ * installs it.
+ *
+ * **The challenge is single-use and is consumed BEFORE the code is checked**
+ * (`totp-service.verifyLogin`: consume, then verify). A wrong code therefore
+ * burns the token: retrying `totpLogin` with the same `mfaChallengeToken` is a
+ * 401 every time. Recovery is a fresh `login()` for a fresh challenge.
+ *
+ * @param client - HTTP client instance
+ * @param input - `{ mfaChallengeToken, code, rememberMe? }`
+ * @returns `{ user, sessionToken, expiresAt }` — token must be manually installed on the client
+ * @throws {InputValidationError} If the token is empty or the code is not six digits
+ * @throws {UnauthorizedError} If the code is wrong, or the challenge expired or was already consumed
+ */
+export async function totpLogin(client, input) {
+    const valid = validateTotpLoginInput(input);
+    return LoginResponseSchema.parse(await client.post('/auth/totp/login', {
+        mfa_challenge_token: valid.mfaChallengeToken,
+        code: valid.code,
+        ...(valid.rememberMe !== undefined ? { rememberMe: valid.rememberMe } : {}),
+    }, { skipAuth: true }));
+}
+/**
+ * A 200 from `/auth/login` is one of two shapes; the challenge is tried FIRST
+ * because it is the narrower literal, and a session body can never carry
+ * `mfa_required: true`. Anything else falls through to the strict session
+ * parse, whose ZodError names what was actually missing.
+ */
+function parseLoginOrChallenge(body) {
+    const challenge = MfaChallengeResponseSchema.safeParse(body);
+    if (challenge.success) {
+        throw new MfaRequiredError({
+            mfaChallengeToken: challenge.data.mfa_challenge_token,
+            expiresAt: challenge.data.expires_at,
+            mfaMethods: challenge.data.mfa_methods,
+        });
+    }
+    return LoginResponseSchema.parse(body);
 }
 /**
  * Revoke all sessions for the current user (not just the current session).