@uluops/ops-sdk 6.4.1 → 6.5.1

package/CHANGELOG.md

@@ -4,6 +4,55 @@ All notable changes to `@uluops/ops-sdk` will be documented in this file.
 
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/).
 
+## [Unreleased]
+
+## [6.5.1] - 2026-09-16
+
+Patch: the ship-run-#48 fixes — three runtime defects under the org-scoped and session paths, the README/JSDoc corrections from consumer-validate run #47, and package metadata. No new surface; `client.runs.save`'s declared return type widens to what it already returned.
+
+### Changed
+
+- **README: the Quick Start's "Requires a `plus` tier subscription or higher" notice on Project Analytics is gone.** Every tracker analytics feature moved to `free` in `@uluops/tier-gate` 0.5.0/0.6.0 (2026-08-21; the API pins 0.6.0), so the notice described a `ForbiddenError` no caller has been able to receive for weeks. No SDK behavior changes — the methods, the `ForbiddenError` class and the 403 mapping are unchanged; only the claim about who gets one.
+- **The no-credentials warning now says where to get a key** — `https://app.uluops.ai` (Settings → API keys) is in the runtime message, not only in README prose. Message text only; the condition and log level are unchanged (consumer-validate run #47, dx-validator).
+
+### Fixed
+
+- **README API-reference examples caught up with the 6.0.0 envelope change** (consumer-validate run #47 — docs-validator and public-interface-validator, the latter's AF-003). `projects.list`, `projects.listIssues` and `runs.listByProject` return `{data, total}` since 6.0.0 but three examples still iterated the raw result (`TypeError: … is not iterable` on copy-paste); `runs.getAgentRunsAnalysis` was destructured as `{items}` after the 6.0.0 `items → data` rename; and `projects.listIssuesWithCount` — removed in 6.0.0 — still had a full section and a stale prose mention. The section is gone, the examples show the envelope, and the prose names the two surviving list methods. Also added the two methods that had no README presence at all — `projects.mergeProjects` (spec v0.3.4) and `auth.totpLogin` — plus `ULUOPS_ORG_SLUG` in the environment-variables table and the `orgs`/`admin` domains in the Features list (8 domains, not 7). The Quick Start guards the nullable `correlation` so it typechecks under `strict`.
+- **CHANGELOG hygiene**: the `[Unreleased]` section had drifted to the middle of the file (below six released versions) and three headers used an em dash before the date; both normalized.
+- **README: the `runs.update` example passed a nested `tokens` object** — `UpdateAgentInput` is flat by design (`inputTokens`, `outputTokens`, …) and the update path forwards `agents` verbatim, so the documented example sent a key the server drops and reported success. The example now shows the flat fields (ship run #48 — anxiety-reader F1, release-readiness). Also: "Three org-routing errors" above a five-row table; the `#org-routing` anchor pointed at a slug that does not exist; the idempotency-key row states that the content hash is key-order-sensitive inside caller-supplied objects; the "Type-Safe" feature bullet says what write-side validation does and does not do; `findWorkspaceOrgFile` / `WORKSPACE_ORG_FILE` / `PERSONAL_ORG_SENTINEL` and `ApiKeyAuth` / `JwtSessionAuth` are named where their documented siblings are.
+- **`client.runs.save` is typed `Promise<SaveRunResponseWithEcho>`** — what the operation has returned since 5.22.0 (`analysisWrite: AnalysisWriteEcho | null`); the facade narrowed it to `SaveRunResponse`, so the echo the 5.22.0 entry advertises was unreachable through the typed client. Type-only widening; no runtime change.
+- **JSDoc**: `runs.getAgentRunsAnalysis` `@returns` said `items` (the 6.0.0 rename made it `data`); `analytics.getVelocity` `@returns` named a `period` the parsed shape does not carry. A sweep of every `@returns` mentioning `items` found only these two.
+- **`withOrg`'s catch guards the error type** (`instanceof InputValidationError`) instead of asserting it, matching every other catch site; and its comment no longer claims the override covers `requestRaw` / `requestBinary` / `requestStream` (it does not — see Known below).
+- **package.json** carries `homepage`, `bugs` and `sideEffects: false` (the npm page had no Homepage/Issues links; bundlers could not tree-shake an ESM-only package without the flag).
+- **Tests**: `issues.get(id, { org })` is now actually exercised (the previous test's name promised it and the body called only `analytics.getAgentPerformance`); the update-preview scope guard's documented explicit-`null` rejection is pinned; `validateUuid`'s version/variant nibbles are pinned against a widened regex.
+
+### Fixed (runtime — ship run #48, code-auditor; each verified against source and `dist/` before the fix, each pinned by a test written first and watched fail)
+
+- **`logout()` now clears the installed session.** It revoked every session server-side and returned, leaving the `JwtSessionAuth` — token and, with `autoRefresh` (the default), the password — in place: `isAuthenticated()` stayed true on a revoked token, and the next 401 re-logged-in and silently undid the logout. It now calls the strategy's `clearSession()` after `logoutAll` resolves; the next request fails `UnauthorizedError` before it is sent and `login()` is the only way back. An API-key strategy is left alone (keys are not sessions). Behaviour change on the auth lifecycle; test: `client.test.ts` "logout() clears the local session".
+- **Org-scoped views share the root client's resilience state.** `withOrg` returns a prototype-chained view, and sdk-core writes its token-refresh dedup gate (`refreshPromise`), the last rate-limit headers and the once-per-threshold warning latch through `this` — so each per-call view got its own copy: N concurrent scoped 401s started N re-logins (which revoke each other under the API's single-session default), and `getRateLimitInfo()` / `onRateLimitApproaching` never saw org-scoped traffic. Views now forward those fields (and `authStrategy`) to the one root by accessor; views of views chain to the root, not to each other. The field list is the census of sdk-core 0.17.0's mutable instance fields, and the new org-scope tests exercise refresh dedup and rate-limit visibility THROUGH views rather than trusting the list. The pre-existing dedup test only ever hit the root client.
+- **`save()` uses the same analysis-bearing predicate as `update()`.** Its own copy tested `analysisSummary !== undefined`, so `analysisSummary: []` demanded an echo the server does not emit for an empty write and threw `AnalysisEchoMismatchError` ("the run WAS saved, do not retry") on a wholly successful save. The empty-array boundary is now pinned on the save path too.
+
+### Known, not fixed here
+
+- **`requestRaw` / `requestBinary` / `requestStream` bypass the org override** — they reach fetch without `request()`, so on a scoped view they send no `X-Org-Slug` and skip the `orgInvalid` rejection. No ops-sdk operation uses them on a scoped path; the `withOrg` comment now says so instead of claiming full coverage (ship run #48).
+
+## [6.5.0] - 2026-09-15
+
+ulu log, Phase 3 (spec v0.1.13 §3.2/§3.3/§3.5/§3.6; checklist Phase 3). Additive — nothing existing changes shape or signature; one existing function changes what it *accepts* (below, under Changed, because that is the kind of change a signature does not show).
+
+### Added
+
+- **`projects.getLog(idOrName, query?, options?)`** — the project log: `run`, `decision` and `regression` events interleaved newest first, keyset-paged (`{ data, count, hasMore, nextCursor? }`; pass `nextCursor` back verbatim). The event union is closed (`LogEvent`, discriminated on `type`) and parsed strictly; `counts` on a `run` is typed `... | null` and IS null on runs saved before migration 065. **Query keys go to the wire as named** (`workflowType`, `includeArchived`) — the API's log schema is camelCase and non-strict, so a snake_cased key is silently ignored with a 200 (the filter vanishes); this call therefore does not use the SDK's generic `toApiQuery`, and the test carries the control showing the generic path would have produced `workflow_type`.
+- **`projects.getLogStat(idOrName, query?, options?)`** — the rollup (`ProjectLogStat`): two frames on two clocks, `decided` = current status of the found issues (sums to `found.issues`), D12's `cameBack.detected` / `reopened` as distinct issues with row counts beside them, D13's `activity.restated`, D14's seven-key `byStatus`.
+- **`orgs.list()`** — `GET /orgs`: the orgs the key holder belongs to, personal included (`OrgListEntry`). What `ulu log --orgs` iterates.
+- **`orgs.getLogStat(slug, query?)`** — the org rollup (`OrgLogStat`): the same body over the org's live projects plus `projects[]` (D15's summary shape, capped at 100 with `hasMoreProjects`) and **`computedAt`** — the org rollup is served from a 60 s TTL cache per (org, window) (D16), and this field is required by the parse: an older API that omits it fails loudly rather than reporting numbers of unknown age.
+- **`readWorkspaceFile(path, uid?)`** → `{ org?, project? } | undefined` — the full workspace file, beside the unchanged `readWorkspaceOrgFile`, which now delegates to it. `project` is validated like the API validates a project name (1–200 chars, no control characters) and is **not** trimmed — a name is matched exactly. **A file carrying `project` without `org` throws** (`"project" requires "org"; use "personal" for no org`), so a project-only file can never shadow an outer org. No resolver is added here: the read-only ladder (`--project` → file → `ULUOPS_PROJECT` → error) belongs to the one command that reads it (D5).
+- Types: `LogEvent` / `LogRunEvent` / `LogDecisionEvent` / `LogRegressionEvent`, `ProjectLogPage`, `ProjectLogQuery`, `LogStatQuery`, `LogStatBody`, `ProjectLogStat`, `OrgLogStat`, `OrgLogProjectSummary`, `OrgListEntry`, `WorkspaceFile`; the Zod schemas beside them.
+
+### Changed
+
+- **`readWorkspaceOrgFile` no longer throws on a `.uluops.json` that carries `project`** — the allowlist is `org`, `project`, `$schema` (was `org`, `$schema`), and the refusal message now names all three. Same signature, same return; a file that was refused in 6.4.x is read in 6.5.0. This is a semantics-without-signature change and this entry is the only place it shows. **Rollout rule (spec §3.5, by provenance):** because every 6.4.x-and-older reader throws on the key — for every command, not only `ulu log` — `project` may not be written into any checkout, and no docs may describe writing it, until every *installed* copy of this package in that tree is ≥ 6.5.0. The checklist carries the enumeration (`find … -path '*/@uluops/ops-sdk/dist/config/workspace-org.js'`) and the 13-consumer census.
+
 ## [6.4.1] - 2026-09-15
 
 6.4.0 reached Verdaccio only; the review of that change set (anxiety-reader 84 / docs-validator 81 / dx-validator 83 / code-auditor 98, all on the `feat/rehome-surfaces` diff) folded into this release before npm. What changed against 6.4.0:
@@ -182,9 +231,7 @@ deploys; SDK 6.0.0 (after the flip) re-pins the new shapes strictly.
   wire always carried. This is the nullable-score class one ring out from the
   run schemas, which were fixed earlier (fix the pattern, not the citation).
 
-## [Unreleased]
-
-## [5.22.0] — 2026-08-21
+## [5.22.0] - 2026-08-21
 
 > Numbered past 5.21.0, which is reserved by the in-flight per-key-scopes train
 > (staged on Verdaccio 2026-08-21). If this train merges first, scopes rebases and
@@ -217,7 +264,7 @@ deploys; SDK 6.0.0 (after the flip) re-pins the new shapes strictly.
   not throw (nothing was written). Return type is `SaveRunResponseWithEcho` (a superset of
   the previous `SaveRunResponse` — source-compatible).
 
-## [5.21.0] — 2026-08-22
+## [5.21.0] - 2026-08-22
 
 ### Added — per-key scope on API keys (platform v1.27.0)
 
@@ -236,7 +283,7 @@ deploys; SDK 6.0.0 (after the flip) re-pins the new shapes strictly.
   job. (A `.strict()` was tried and reverted after review, 2026-08-22.)
 - `--json` output carries `scope` automatically (plain stringify, no re-parse).
 
-## [5.20.0] — 2026-08-21
+## [5.20.0] - 2026-08-21
 
 ### Changed
 

package/README.md

@@ -1,4 +1,4 @@
-**[UluOps](https://uluops.ai)** · Operating Intelligence as Infrastructure
+**[UluOps](https://uluops.ai)** · The operations layer for agentic work
 
 ---
 
@@ -45,7 +45,8 @@ const result = await client.runs.save({
   ],
 });
 
-console.log(`Run #${result.run.runNumber} saved: ${result.correlation.newIssues} new issues`);
+// `correlation` is null on an idempotent replay of a run saved before correlation persistence
+console.log(`Run #${result.run.runNumber} saved: ${result.correlation?.newIssues ?? 'n/a'} new issues`);
 ```
 
 ### Search Issues
@@ -64,12 +65,6 @@ for (const issue of issues) {
 
 ### Project Analytics
 
-> **Requires a `plus` tier subscription or higher.** Every method under
-> [Analytics Operations](#analytics-operations) is tier-gated server-side. On a `free`
-> account — which is the default for a newly registered user — these calls reject with
-> `ForbiddenError: This feature requires plus tier or higher.` The rest of this Quick Start
-> works on any tier; this section does not.
-
 ```typescript
 const burndown = await client.analytics.getBurndown({
   project: 'my-project',
@@ -115,12 +110,12 @@ The UluOps SDK provides programmatic access to the UluOps platform API, enabling
 - **Analyze Trends**: Get burndown charts, velocity metrics, and taxonomy distribution analytics
 - **Automate Workflows**: Integrate execution tracking into CI/CD and agent pipelines
 
-The SDK covers the full platform API surface across 7 operation domains with full TypeScript support.
+The SDK covers the full platform API surface across 8 operation domains with full TypeScript support.
 
 ## Features
 
-- **Full API Coverage**: auth, projects, runs, issues, analytics, and taxonomy domains
-- **Type-Safe**: Complete TypeScript definitions with Zod runtime validation
+- **Full API Coverage**: auth, projects, runs, issues, analytics, taxonomy, orgs, and admin domains
+- **Type-Safe**: Complete TypeScript definitions; every response is Zod-parsed before it is returned. Write inputs are Zod-validated as a gate (the raw input is what goes to the wire, and the primary writers may pass `_skipClientValidation`) — see [Runs Operations](#runs-operations) for which fields each write validates
 - **Dual Authentication**: API key (preferred) and JWT session support
 - **Automatic Retries**: Exponential backoff for transient errors (502, 503, 504, 429, network failures)
 - **Error Hierarchy**: Typed errors for precise error handling
@@ -186,7 +181,7 @@ const { sessionToken, user } = await client.login(
 );
 
 // Client is now authenticated — subsequent requests use the session token
-const projects = await client.projects.list();
+const { data: projects } = await client.projects.list();
 
 // Logout when done
 await client.logout();
@@ -379,7 +374,7 @@ await client.projects.list();                                  // → constructo
 name: a call that names no org creates or targets the *personal* project of that name, even when
 a work org has one by the same name (spec D2). Name the org.
 
-Three org-routing errors are worth branching on (all exported with type guards):
+These org-routing errors are worth branching on (all exported with type guards):
 
 | Code | Status | Guard | What to do |
 |---|---|---|---|
@@ -395,13 +390,22 @@ Low-level: `new OpsHttpClient(cfg).withOrg('acme')` returns a view of the client
 MCP), `resolveWorkspaceOrg({ explicit, cwd })` implements the spec's D13 rule: an explicit value
 wins; else the nearest `.uluops.json` above `cwd` (`{ "org": "ulu-labs" }`, or `{ "org": "personal" }`
 to stop the walk in a personal repo nested under a work tree); else `ULUOPS_ORG_SLUG`; else your
-personal org. The file may carry only `org` (and `$schema`) — any other key is refused, not ignored.
+personal org. The file may carry only `org`, `project` and `$schema` — any other key is refused, not ignored.
+**`project` (6.5.0, ulu log D5)** is the project name a *read* command resolves when given none —
+`ulu log` today; it governs reads only (no write path consumes it; `ulu exec` keeps flag → env →
+inferred basename). Read it with `readWorkspaceFile(path)` → `{ org?, project? }`; a file carrying
+`project` **must** carry `org` (`"personal"` allowed) or the reader throws, so a project-only file can
+never shadow an outer org. `readWorkspaceOrgFile(path)` keeps its signature and now returns the org
+of such a file instead of refusing it. **Do not write `project` into a checkout until every installed
+`@uluops/ops-sdk` in that tree is ≥ 6.5.0** — older readers throw on the key, for every command.
 Two more refusals since 6.3.1 (security audit run #187): the walk never rises above your home
 directory (a file at `/` or `/Users` cannot become everyone's default), and a file owned by another
 user is refused (a shared parent directory is the planting vector). `"personal"` is also honoured as
 an explicit value — `{ org: 'personal' }` sends no header. On a scoped call the per-call org header
 is set last and an `X-Org-Slug`/`X-Org-Id` in `options.headers` is refused.
 
+The pieces it is built from are exported too: `findWorkspaceOrgFile(cwd)` (the bounded upward walk, returning the path of the `.uluops.json` that answered), `WORKSPACE_ORG_FILE` (the file name, `.uluops.json`) and `PERSONAL_ORG_SENTINEL` (`"personal"`, the value that stops the walk and means "no org"). Reach for them when a tool wants to report *which* file answered, as the CLI does.
+
 ---
 
 ### Security Events
@@ -471,6 +475,25 @@ const { user, sessionToken } = await client.auth.login({
 });
 ```
 
+#### `client.auth.totpLogin(input)`
+
+Complete an MFA challenge with a TOTP code. Returns the session **without installing it** on the
+client — use the top-level [`client.loginWithTotp()`](#authentication) wrapper when you want the
+session installed. The challenge token is single-use and is consumed before the code is checked.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `mfaChallengeToken` | `string` | Yes | From the `MfaRequiredError` thrown by `login()` |
+| `code` | `string` | Yes | Six-digit TOTP code |
+| `rememberMe` | `boolean` | No | Long-lived session |
+
+```typescript
+const { sessionToken, expiresAt } = await client.auth.totpLogin({
+  mfaChallengeToken: err.mfaChallengeToken,
+  code: '123456',
+});
+```
+
 #### `client.auth.logoutAll()`
 
 Revoke all active sessions for the current user.
@@ -654,7 +677,7 @@ Manage projects.
 List all projects.
 
 ```typescript
-const projects = await client.projects.list();
+const { data: projects, total } = await client.projects.list();
 for (const project of projects) {
   console.log(project.id, project.name, project.createdAt);
 }
@@ -772,6 +795,58 @@ for (const point of trends) {
 }
 ```
 
+#### `client.projects.getLog(idOrName, query?, options?)` — the project log (ulu log §3.2)
+
+The project's second history: `run` events (what was examined) and `decision` / `regression`
+events (what was decided, with reasons — and what came back) interleaved newest first,
+keyset-paged. Pass `nextCursor` back verbatim. Three things to keep straight when rendering:
+`reason: null` is *no reason recorded*; `source: null` is *unattributed*, never *human*; a
+`regression` is a row a **run** re-detected, while a `resolved → open` `decision` with no run is
+*reopened by decision* (D12) — the SDK types both and does not collapse them. `counts` is `null`
+on runs saved before migration 065.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `since` / `until` | `string` | No | ISO 8601 window; `since <= until` or 400 |
+| `limit` | `number` | No | 1–500, default 50; outside the range is a 400 |
+| `cursor` | `string` | No | A `nextCursor` from the previous page, verbatim |
+| `kind` | `('run'\|'decision'\|'regression')[]` | No | Subset of event kinds |
+| `workflowType` | `string` | No | Filters `run` events only |
+| `agent` | `string` | No | Runs by snapshot agent name; ledger rows by `issues.agent` |
+| `includeArchived` | `boolean` | No | Archived runs are excluded unless `true` |
+
+Query keys go to the wire as named (`workflowType`, not `workflow_type`): the API's schema is
+camelCase and silently ignores a snake_cased key, so this call does not use the SDK's generic
+snake_casing.
+
+```typescript
+let cursor: string | undefined;
+do {
+  const page = await client.projects.getLog('my-project', { limit: 100, cursor }, { org: 'ulu-labs' });
+  for (const e of page.data) {
+    if (e.type === 'run') console.log(e.at, `run #${e.runNumber}`, e.workflowType, e.counts ?? '-');
+    else if (e.type === 'decision') console.log(e.at, e.fingerprint, `${e.from} -> ${e.to}`, e.reason ?? 'no reason recorded');
+    else console.log(e.at, e.fingerprint, 'regressed', e.viaRunNumber === null ? 'via run ?' : `via run #${e.viaRunNumber}`);
+  }
+  cursor = page.hasMore ? page.nextCursor : undefined;
+} while (cursor);
+```
+
+#### `client.projects.getLogStat(idOrName, query?, options?)` — the rollup (§3.3)
+
+`{ projectId, window, examined, found, decided, cameBack, activity }`. Two frames on two clocks:
+the **cohort** frame (`examined`, `found`, `decided`) windows on run timestamps; the **activity**
+frame (`activity`, `cameBack`) on ledger timestamps. `decided` is the *current* status of each
+found issue and sums to `found.issues` — it is not "decisions made in the window"; that is
+`activity.decisions`. `activity.byStatus.open` counts transitions **into** open (render it
+*reopened*). `cameBack.detected` / `reopened` are distinct issues with the row counts beside
+them; `lastDetectedAtAllTime` ignores the window by definition. `since` / `until` as above.
+
+```typescript
+const stat = await client.projects.getLogStat('my-project');
+console.log(`${stat.examined.runs} runs, ${stat.found.issues} findings, ${stat.decided.completed} fixed, ${stat.cameBack.detected} regressions caught by re-running`);
+```
+
 #### `client.projects.listIssues(idOrName, query)`
 
 List issues for a project with filters.
@@ -793,34 +868,21 @@ List issues for a project with filters.
 
 > **Filter convention:** Passing `'all'` for any filter (e.g., `status: 'all'`) is equivalent to omitting the parameter — the SDK strips `'all'` values before sending the request. This applies to all query methods across the SDK.
 >
-> **The table above is the canonical filter set** for `projects.listIssues`,
-> `projects.listIssuesWithCount`, and `issues.listByProject` — all three take the same
-> query shape. `issues.search` is the exception: it accepts `failureDomains` (an array)
+> **The table above is the canonical filter set** for `projects.listIssues` and
+> `issues.listByProject` — both take the same query shape. `issues.search` is the exception: it accepts `failureDomains` (an array)
 > and **does not accept `failureMode` at all**, because the server-side search path has no
-> mode predicate. If you need to filter by mode, use one of the three list methods.
+> mode predicate. If you need to filter by mode, use one of the two list methods.
 
 ```typescript
-const issues = await client.projects.listIssues('my-project', {
+// {data, total} since 6.0.0 — `total` is the full matching count, for pagination
+const { data: issues, total } = await client.projects.listIssues('my-project', {
   status: 'open',
   priority: 'critical',
   limit: 10,
 });
+console.log(`Showing ${issues.length} of ${total} open critical issues`);
 ```
 
-#### `client.projects.listIssuesWithCount(idOrName, query)`
-
-List issues with total count for pagination. Same filters as `listIssues`.
-
-```typescript
-const { issues, count } = await client.projects.listIssuesWithCount('my-project', {
-  status: 'open',
-  limit: 10,
-});
-console.log(`Showing ${issues.length} of ${count} total issues`);
-```
-
-> **Note:** Returns both the issues array and the total count for building paginated UIs.
-
 #### `client.projects.bulkUpdateIssueStatus(idOrName, updates)`
 
 Bulk update issue statuses.
@@ -850,6 +912,35 @@ const result = await client.projects.mergeIssues('my-project', {
 });
 ```
 
+#### `client.projects.mergeProjects(input)`
+
+Merge one project into another (merge-projects spec v0.3.4). The source's runs and issues are
+re-keyed into the target inside one advisory-locked transaction; the source is soft-deleted by
+default. Pairwise only — chain calls for multi-source merges. Dry-run first.
+
+| Parameter | Type | Required | Description |
+|-----------|------|----------|-------------|
+| `source` | `string` | Yes | Source project name or UUID (consumed by the merge) |
+| `target` | `string` | Yes | Target project name or UUID (survives, absorbs the source) |
+| `dryRun` | `boolean` | No | Preview only — the merge transaction is rolled back (default `false`) |
+| `deleteSource` | `boolean` | No | Soft-delete the source after the merge (default `true`) |
+| `confirmCrossOrg` | `boolean` | No | Required `true` for system-actor cross-org merges; human cross-org merges are always rejected |
+
+```typescript
+const preview = await client.projects.mergeProjects({
+  source: 'old-project',
+  target: 'my-project',
+  dryRun: true,
+});
+console.log(`Would move ${preview.moved.runs} runs and ${preview.moved.issues} issues`);
+if (preview.conflicts.length === 0) {
+  const result = await client.projects.mergeProjects({ source: 'old-project', target: 'my-project' });
+  console.log(result.source.statusAfter); // 'soft-deleted'
+}
+```
+
+Returns `{ source, target, moved, conflicts }` — `source.statusAfter` is `'soft-deleted' | 'retained' | 'dry-run'`, `moved` counts runs, issues, dedupes and reparented occurrences/notes/history.
+
 #### `client.projects.rehome(idOrName, input, options?)` — move a project to another org
 
 Moves the project and its whole history (runs, issues, analytics) into another org
@@ -914,7 +1005,7 @@ Save a new execution run. Pass `{ _skipClientValidation: true }` as the second a
 | `recommendations` | `Recommendation[]` | Yes | Array of issues/recommendations (use `[]` for empty). Multi-agent pipelines: see [Convergence clustering](#convergence-clustering-clusterkey) before collapsing findings |
 | `summary` | `object` | No | Summary statistics |
 | `rawMarkdown` | `string` | No | Raw markdown report |
-| `idempotencyKey` | `string` | No | Key for duplicate prevention. When omitted, the SDK derives it from the payload content (sha256), so a byte-identical retry returns the original run (`deduplicated: true`) instead of creating a second one. Pass explicit distinct keys to deliberately save identical payloads twice |
+| `idempotencyKey` | `string` | No | Key for duplicate prevention. When omitted, the SDK derives it from the payload content (sha256), so a byte-identical retry returns the original run (`deduplicated: true`) instead of creating a second one. The hash is over `JSON.stringify` of the payload, so it is key-order-sensitive inside caller-supplied objects (`agents[]`, `recommendations[]`, `analysisRecords[].data`): a retry that rebuilds those with a different insertion order is a different key and writes a second run. Pass an explicit key when the retry path does not preserve object shape; pass explicit distinct keys to deliberately save identical payloads twice |
 | `definitionType` | `string` | No | Definition type (`'agent'`, `'command'`, `'workflow'`, `'pipeline'`) |
 | `definitionName` | `string` | No | Definition name (e.g., `'code-validator'`) |
 | `definitionVersion` | `string` | No | Definition version (e.g., `'1.2.0'`) |
@@ -1056,7 +1147,8 @@ List runs for a project.
 | `offset` | `number` | No | Pagination offset |
 
 ```typescript
-const runs = await client.runs.listByProject('my-project', {
+// {data, total} since 6.0.0
+const { data: runs, total } = await client.runs.listByProject('my-project', {
   workflowType: 'ship',
   limit: 10,
 });
@@ -1141,7 +1233,8 @@ const run = await client.runs.update({
   project: 'my-project',
   runNumber: 5,
   agents: [
-    { name: 'code-validator', score: 90, tokens: { inputTokens: 1500 } },
+    // Token fields are FLAT on update (UpdateAgentInput) — a nested `tokens` object is not a field the update path sends
+    { name: 'code-validator', score: 90, inputTokens: 1500 },
   ],
 });
 ```
@@ -1328,11 +1421,11 @@ Get analysis summaries with run context for a specific agent. Returns analysis d
 | `query.offset` | `number` | No | Pagination offset |
 
 ```typescript
-const { items, total } = await client.runs.getAgentRunsAnalysis('epictetus-validator', {
+const { data, total } = await client.runs.getAgentRunsAnalysis('epictetus-validator', {
   project: 'my-project',
   limit: 10,
 });
-// items[0]: { decision, score, categoryScores, runNumber, runTimestamp, workflowType, snapshotScore, ... }
+// data[0]: { decision, score, categoryScores, runNumber, runTimestamp, workflowType, snapshotScore, ... }
 ```
 
 ---
@@ -1944,6 +2037,29 @@ target's). A non-member gets `403 ORG_ACCESS_DENIED`.
 
 ---
 
+#### `client.orgs.list()` — the orgs you belong to
+
+`GET /orgs`: every org the key holder is a member of, personal org included (`isPersonal: true`),
+each with `slug`, `role`, `memberCount`, `subscriptionTier`. A key bound to one org still lists all
+of its holder's orgs; the binding governs what it may *read*.
+
+#### `client.orgs.getLogStat(slug, query?)` — the org rollup (ulu log §3.6)
+
+The same body as `projects.getLogStat` computed over the org's live projects, plus `projects[]` —
+the summary shape `{ name, runs, issues, fixed, regressions, lastRunAt }` where each column is that
+project's own rollup measure (`regressions` = `cameBack.detected`, run-caught only), ordered by last
+run desc then name, capped at 100 with `hasMoreProjects`. Any member reads. Served from a **60 s
+TTL cache** per (org, window) — `computedAt` says how old the numbers are. Unknown slug → 404
+`ORG_NOT_FOUND`; a key bound to another org → 403 `ORG_ACCESS_DENIED`. The slug in the path is the
+org — no `OrgScopedOptions` here.
+
+```typescript
+for (const org of await client.orgs.list()) {
+  const s = await client.orgs.getLogStat(org.slug);
+  console.log(org.slug, `${s.projects.length}${s.hasMoreProjects ? '+' : ''} projects`, `${s.examined.runs} runs`, `${s.found.issues} findings`, `${s.decided.completed} fixed`, `${s.cameBack.detected} regressions`, `(as of ${s.computedAt})`);
+}
+```
+
 ### Admin Operations
 
 The **platform-admin** surface (`users.role = 'admin'` — a platform role, not an org role). The two
@@ -2041,6 +2157,7 @@ For command-line usage, see the dedicated CLI package: [`@uluops/cli`](https://w
 | `ULUOPS_EMAIL` | Email for session auth | - |
 | `ULUOPS_PASSWORD` | Password for session auth | - |
 | `ULUOPS_SESSION_TOKEN` | Session token for auth | - |
+| `ULUOPS_ORG_SLUG` | Org slug for org-scoped requests (lowest precedence in [Org routing](#org-routing--which-org-a-call-lands-in)) | personal org |
 | `ULUOPS_BASE_URL` | API base URL | `https://api.uluops.ai/api/v1` (localhost:3100 when `NODE_ENV=development`) |
 | `ULUOPS_DEBUG` | Enable debug logging | `false` |
 
@@ -2207,6 +2324,8 @@ const raw = await http.requestRaw('GET', '/endpoint'); // Without data unwrappin
 
 ### Custom Authentication Strategy
 
+The two strategies the client installs itself — `ApiKeyAuth` and `JwtSessionAuth` — are exported at the package root (re-exports of `@uluops/sdk-core/http`) for callers that construct one directly instead of through `createAuthStrategy`; the factory is the documented path and the constructors' signatures are sdk-core's.
+
 ```typescript
 import { OpsHttpClient, createAuthStrategy } from '@uluops/ops-sdk';
 

package/dist/client.d.ts

@@ -2,7 +2,8 @@ import { type HttpClientConfig } from './http/http-client.js';
 import * as analyticsOps from './operations/analytics.js';
 import type { RegisterInput, LoginInput, TotpLoginInput, LoginResponse, RegisterResponse, UpdateProfileInput, ChangePasswordInput, ResetPasswordInput, CreateApiKeyInput, ApiKeyCreatedResponse, PublicApiKey, PublicSession, AuthUser, PublicUser } from './types/auth.js';
 import type { Project, CreateProjectInput, UpdateProjectInput, DeleteProjectInput, RenameProjectInput, ProjectSummaryResponse, ProjectTrends, ProjectTrendsQuery, ListProjectIssuesQuery, BulkIssueStatusUpdate, BulkIssueStatusResult, MergeIssuesInput, MergeIssuesResult, MergeProjectsInput, MergeProjectsResult } from './types/projects.js';
-import type { Run, RunSummary, RunAnalysis, ProjectAnalysisList, AnalysisRecordsList, AgentRunsAnalysis, SaveRunInput, SaveRunResponse, ValidateRunResponse, RunDiffQuery, RunDiffResult, ArchiveRunsInput, ArchiveRunsResult, UpdateRunInput, UpdateRunByNumberInput, UpdateRunPreviewInput, UpdateRunPreviewByNumberInput, RunUpdatePreview, UpdateRunWithEchoResult, ListRunsQuery, RunDetails, ProjectAnalysisQuery, AnalysisRecordsQuery, AgentRunsAnalysisQuery, RunWriteEcho } from './types/runs.js';
+import type { ProjectLogQuery, ProjectLogPage, LogStatQuery, ProjectLogStat, OrgLogStat, OrgListEntry } from './types/log.js';
+import type { Run, RunSummary, RunAnalysis, ProjectAnalysisList, AnalysisRecordsList, AgentRunsAnalysis, SaveRunInput, SaveRunResponseWithEcho, ValidateRunResponse, RunDiffQuery, RunDiffResult, ArchiveRunsInput, ArchiveRunsResult, UpdateRunInput, UpdateRunByNumberInput, UpdateRunPreviewInput, UpdateRunPreviewByNumberInput, RunUpdatePreview, UpdateRunWithEchoResult, ListRunsQuery, RunDetails, ProjectAnalysisQuery, AnalysisRecordsQuery, AgentRunsAnalysisQuery, RunWriteEcho } from './types/runs.js';
 import type { Issue, CreateUserIssueInput, UpdateIssueInput, UpdateIssueStatusInput, CreateIssueNoteInput, IssueNote, IssueDetails, IssueHistoryEnvelope, IssueSearchQuery, ListIssuesQuery, BulkStatusUpdateItem, StatusUpdateResult } from './types/issues.js';
 import type { AnalyticsQuery, AgentPerformance, AgentInfo, AgentLifecycleEntry, AgentReliabilityQuery, BurndownQuery, VelocityQuery, DiscoveryQuery, AgentMatrixQuery, TaxonomyResponse, AgentReliabilityResult, ResolutionRateResult, FileHotspotResult, TaxonomyDistributionResult, FullTaxonomyAnalyticsResult, BurndownResultResponse, VelocityResultResponse, DiscoveryResultResponse, AgentMatrixResultResponse, TrendSummaryResult } from './types/analytics.js';
 import type { MessageResponse, DeleteResult } from './types/responses.js';
@@ -91,6 +92,11 @@ export declare class OpsClient {
     /**
      * Logout current session (revokes all sessions for this user).
      *
+     * Revoke every session for the current user server-side AND clear the
+     * session installed on this client (token and retained password), so
+     * `isAuthenticated()` is false afterwards and no automatic re-login can
+     * follow. An API-key strategy is untouched — keys are not sessions.
+     *
      * @returns Number of sessions revoked
      * @throws {UnauthorizedError} If client is not authenticated
      * @throws {OpsApiError} On network or server errors
@@ -215,6 +221,19 @@ export declare class OpsClient {
          * address becomes a `410 PROJECT_REHOMED` tombstone, not a fork.
          */
         rehome: (idOrName: string, input: RehomeProjectInput, options?: OrgScopedOptions) => Promise<RehomeResponse>;
+        /**
+         * The project log (ulu log spec §3.2) — runs, decisions and regressions
+         * interleaved newest first, keyset-paged; pass `nextCursor` back verbatim.
+         * A `regression` is a row a run re-detected; a `resolved → open` decision
+         * with no run is *reopened by decision* (D12) — keep them apart.
+         */
+        getLog: (idOrName: string, query?: ProjectLogQuery, options?: OrgScopedOptions) => Promise<ProjectLogPage>;
+        /**
+         * The log's rollup (§3.3): examined / found / decided / cameBack /
+         * activity — a cohort frame on run timestamps and an activity frame on
+         * ledger timestamps; `decided` is the CURRENT status of the found issues.
+         */
+        getLogStat: (idOrName: string, query?: LogStatQuery, options?: OrgScopedOptions) => Promise<ProjectLogStat>;
     };
     /** Org reads a member can make. (Org CRUD and membership are dashboard/platform surfaces, not wrapped here.) */
     readonly orgs: {
@@ -225,6 +244,16 @@ export declare class OpsClient {
          * `readRehomeAuditDetails()`.
          */
         getVisibleAuditLog: (slug: string, query?: OrgAuditFeedQuery) => Promise<OrgAuditFeed>;
+        /** The orgs the caller belongs to (personal included) — what `ulu log --orgs` iterates. */
+        list: () => Promise<OrgListEntry[]>;
+        /**
+         * The org rollup (ulu log §3.6): the §3.3 body over the org's live projects
+         * plus a per-project table (`projects[]`, capped at 100). Any member reads;
+         * cached 60 s server-side — `computedAt` says how old. The slug in the
+         * path is the org; no `OrgScopedOptions` here for the same reason as
+         * `getVisibleAuditLog`.
+         */
+        getLogStat: (slug: string, query?: LogStatQuery) => Promise<OrgLogStat>;
     };
     /**
      * Platform-admin surface. Requires `users.role = 'admin'`; the writes also
@@ -250,7 +279,7 @@ export declare class OpsClient {
     /** Execution run save, preview, diff, archive, and retrieval */
     readonly runs: {
         /** Save an execution run (agents, scores, recommendations). */
-        save: (input: SaveRunInput, options?: RunCallOptions) => Promise<SaveRunResponse>;
+        save: (input: SaveRunInput, options?: RunCallOptions) => Promise<SaveRunResponseWithEcho>;
         /** Preview a save without persisting (dry-run). */
         validate: (input: SaveRunInput, options?: RunCallOptions) => Promise<ValidateRunResponse>;
         /** Diff two runs to surface regressions/improvements. */

package/dist/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAS7E,OAAO,KAAK,YAAY,MAAM,2BAA2B,CAAC;AAI1D,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,UAAU,EACX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EACV,OAAO,EACP,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EACV,GAAG,EACH,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAE3C;;;;OAIG;gBACS,MAAM,GAAE,eAAoB;IAgCxC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAiBhG;;;;;;;;;;OAUG;IACG,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAa1G;;;;;;OAMG;IACG,MAAM,IAAI,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAIpD;;;;OAIG;IACH,eAAe,IAAI,OAAO;IAK1B;;;;OAIG;IACH,WAAW,IAAI,SAAS,GAAG,SAAS,GAAG,IAAI;IAK3C;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAQb,sEAAsE;IACtE,QAAQ,CAAC,IAAI;QACX,mCAAmC;0BACjB,aAAa,KAAG,OAAO,CAAC,gBAAgB,CAAC;QAG3D,sHAAsH;uBACvG,UAAU,KAAG,OAAO,CAAC,aAAa,CAAC;QAGlD,yHAAyH;2BACtG,cAAc,KAAG,OAAO,CAAC,aAAa,CAAC;QAG1D,uDAAuD;yBACxC,OAAO,CAAC;YAAE,eAAe,EAAE,MAAM,CAAA;SAAE,CAAC;QAGnD,4DAA4D;gCACpC,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC;QAGzD,oEAAoE;+BAC7C,kBAAkB,KAAG,OAAO,CAAC,eAAe,CAAC;QAGpE,sEAAsE;gCAC9C,mBAAmB,KAAG,OAAO,CAAC,eAAe,CAAC;QAGtE,kEAAkE;gCAC1C,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC;QAGzD,qDAAqD;qBAC1C,OAAO,CAAC,QAAQ,CAAC;QAG5B,6CAA6C;0BAC7B,OAAO,CAAC;YAAE,IAAI,EAAE,UAAU,CAAA;SAAE,CAAC;QAG7C,uEAAuE;+BAChD,kBAAkB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,UAAU,CAAA;SAAE,CAAC;QAGzE,8DAA8D;yBAC/C,OAAO,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;QAGlE,wCAAwC;4BACtB,OAAO,CAAC,IAAI,CAAC;QAG/B,wDAAwD;2BACvC,OAAO,CAAC,YAAY,EAAE,CAAC;QAGxC,mEAAmE;+BAC5C,iBAAiB,KAAG,OAAO,CAAC,qBAAqB,CAAC;QAGzE,+BAA+B;8BACT,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QAG5C,+CAA+C;4BAC7B,OAAO,CAAC,aAAa,EAAE,CAAC;QAG1C,qCAAqC;mCACV,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;MAEjD;IAMF,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ;QACf,4EAA4E;yBAC3D,gBAAgB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAG/E,mCAAmC;wBACnB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGrE,4BAA4B;wBACZ,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGjF,mCAAmC;2BAChB,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGnG,4DAA4D;2BACzC,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAGxG,yDAAyD;+BAClC,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAG5G,sCAAsC;4BAClB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGzE,wBAAwB;wBACR,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGjF,iDAAiD;+BAC1B,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAG3F,4CAA4C;8BACtB,MAAM,UAAU,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,aAAa,CAAC;QAG7G;;2CAEmC;+BACZ,MAAM,UAAU,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAGrI,0DAA0D;0CACxB,MAAM,WAAW,qBAAqB,EAAE,YAAY,gBAAgB,KAAG,OAAO,CAAC,qBAAqB,CAAC;QAGvI,+CAA+C;gCACvB,MAAM,SAAS,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,CAAC;QAGhH;;;;;WAKG;+BACoB,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAGpG;;;;;;WAMG;2BACgB,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,cAAc,CAAC;MAE1G;IAMF,gHAAgH;IAChH,QAAQ,CAAC,IAAI;QACX;;;;;WAKG;mCACwB,MAAM,UAAU,iBAAiB,KAAG,OAAO,CAAC,YAAY,CAAC;MAEpF;IAMF;;;;;OAKG;IACH,QAAQ,CAAC,KAAK;QACZ;;;WAGG;mCACwB,MAAM,SAAS,uBAAuB,KAAG,OAAO,CAAC,cAAc,CAAC;QAG3F,iGAAiG;qCACpE,sBAAsB,KAAG,OAAO,CAAC,iBAAiB,CAAC;QAGhF,6GAA6G;0CAC3E,2BAA2B,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAG/F,2GAA2G;yCAC1E,MAAM,KAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,IAAI,CAAA;SAAE,CAAC;MAErE;IAMF,gEAAgE;IAChE,QAAQ,CAAC,IAAI;QACX,+DAA+D;sBACjD,YAAY,YAAY,cAAc,KAAG,OAAO,CAAC,eAAe,CAAC;QAG/E,mDAAmD;0BACjC,YAAY,YAAY,cAAc,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAGvF,yDAAyD;sBAC3C,YAAY,YAAY,gBAAgB,KAAG,OAAO,CAAC,aAAa,CAAC;QAG/E,wDAAwD;yBACvC,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,CAAC;QAG1F,wLAAwL;wBACxK,sBAAsB,YAAY,cAAc,KAAG,OAAO,CAAC,YAAY,CAAC;QAGxF,sKAAsK;+BAC/I,6BAA6B,YAAY,cAAc,KAAG,OAAO,CAAC,gBAAgB,CAAC;QAG1G,qJAAqJ;gCAC7H,sBAAsB,YAAY,cAAc,KAAG,OAAO,CAAC,uBAAuB,CAAC;QAG3G,qEAAqE;mCAC1C,MAAM,UAAU,aAAa,YAAY,gBAAgB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAGrI,sEAAsE;+BAC/C,MAAM,iBAAiB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,GAAG,CAAC;QAG/F,8EAA8E;gCACtD,MAAM,cAAc,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;QAGpG,kCAAkC;qBACrB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,GAAG,CAAC;QAG9D,2KAA2K;4BACvJ,MAAM,SAAS,cAAc,YAAY,cAAc,KAAG,OAAO,CAAC,YAAY,CAAC;QAGnG,qFAAqF;mCAC1D,MAAM,SAAS,qBAAqB,YAAY,cAAc,KAAG,OAAO,CAAC,gBAAgB,CAAC;QAGrH,6CAA6C;oCACjB,MAAM,SAAS,cAAc,YAAY,cAAc,KAAG,OAAO,CAAC,uBAAuB,CAAC;QAGtH,0BAA0B;wBACV,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAI1E,qDAAqD;6BAChC,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,WAAW,CAAC;QAG9E,6CAA6C;wCACb,MAAM,UAAU,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAG/H,qDAAqD;uCACtB,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAG9G,uDAAuD;0CACrB,MAAM,SAAS,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,CAAC;MAEhI;IAMF,wEAAwE;IACxE,QAAQ,CAAC,MAAM;QACb,qCAAqC;wBACrB,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGjF,qCAAqC;wBACrB,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAG/E,wDAAwD;wCACxB,MAAM,WAAW,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGpG,yDAAyD;iDAChB,MAAM,WAAW,MAAM,SAAS,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC,kBAAkB,CAAC;QAGzJ,0BAA0B;uBACX,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGlE,kDAAkD;8BAC5B,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAGhF,qCAAqC;8BACf,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,oBAAoB,CAAC;QAGxF,sCAAsC;gCACd,MAAM,SAAS,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAG1G,wCAAwC;0BACtB,MAAM,SAAS,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAG9F,8BAA8B;2BACX,MAAM,SAAS,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAAC;QAGvG,oCAAoC;2BACjB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGtE,+DAA+D;8BACzC,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAGhF,+CAA+C;kCACrB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAG7E,iEAAiE;oCACrC,oBAAoB,EAAE,YAAY,gBAAgB,KAAG,OAAO,CAAC,qBAAqB,CAAC;QAG/G,wDAAwD;mCAC7B,MAAM,UAAU,eAAe,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,EAAE,CAAC;MAEzG;IAMF,+EAA+E;IAC/E,QAAQ,CAAC,SAAS;QAChB,yCAAyC;sCACX,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAGtG,8DAA8D;sCAChC,qBAAqB,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAGjH,yCAAyC;uCACV,MAAM,UAAU,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAG1H,yCAAyC;qCACZ,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAGzG,gDAAgD;kCACtB,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAGnG,kEAAkE;0CAChC,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;QAGpH,iDAAiD;kCACvB,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,2BAA2B,CAAC;QAG3G,oCAAoC;8BACd,aAAa,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAGjG,yCAAyC;8BACnB,aAAa,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAGjG,wCAAwC;+BACjB,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,uBAAuB,CAAC;QAGpG,uCAAuC;iCACd,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,yBAAyB,CAAC;QAG1G,sCAAsC;kCACZ,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAGpG;;;;WAIG;8BACmB,YAAY,CAAC,eAAe,UAAU,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGzH,gDAAgD;6BAC3B,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;MAGtF;IAMF,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ;QACf,oEAAoE;mBAC3D,OAAO,CAAC,gBAAgB,CAAC;MAElC;CAEH"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAiB,KAAK,gBAAgB,EAAE,MAAM,uBAAuB,CAAC;AAS7E,OAAO,KAAK,YAAY,MAAM,2BAA2B,CAAC;AAI1D,OAAO,KAAK,EACV,aAAa,EACb,UAAU,EACV,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,kBAAkB,EAClB,mBAAmB,EACnB,kBAAkB,EAClB,iBAAiB,EACjB,qBAAqB,EACrB,YAAY,EACZ,aAAa,EACb,QAAQ,EACR,UAAU,EACX,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EACV,OAAO,EACP,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,kBAAkB,EAClB,sBAAsB,EACtB,aAAa,EACb,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,qBAAqB,EACrB,gBAAgB,EAChB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACpB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9H,OAAO,KAAK,EACV,GAAG,EACH,UAAU,EACV,WAAW,EACX,mBAAmB,EACnB,mBAAmB,EACnB,iBAAiB,EACjB,YAAY,EACZ,uBAAuB,EACvB,mBAAmB,EACnB,YAAY,EACZ,aAAa,EACb,gBAAgB,EAChB,iBAAiB,EACjB,cAAc,EACd,sBAAsB,EACtB,qBAAqB,EACrB,6BAA6B,EAC7B,gBAAgB,EAChB,uBAAuB,EACvB,aAAa,EACb,UAAU,EACV,oBAAoB,EACpB,oBAAoB,EACpB,sBAAsB,EACtB,YAAY,EACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,KAAK,EACV,KAAK,EACL,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,SAAS,EACT,YAAY,EACZ,oBAAoB,EACpB,gBAAgB,EAChB,eAAe,EACf,oBAAoB,EACpB,kBAAkB,EACnB,MAAM,mBAAmB,CAAC;AAE3B,OAAO,KAAK,EACV,cAAc,EACd,gBAAgB,EAChB,SAAS,EACT,mBAAmB,EACnB,qBAAqB,EACrB,aAAa,EACb,aAAa,EACb,cAAc,EACd,gBAAgB,EAChB,gBAAgB,EAChB,sBAAsB,EACtB,oBAAoB,EACpB,iBAAiB,EACjB,0BAA0B,EAC1B,2BAA2B,EAC3B,sBAAsB,EACtB,sBAAsB,EACtB,uBAAuB,EACvB,yBAAyB,EACzB,kBAAkB,EACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,eAAe,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAC1E,OAAO,KAAK,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,gBAAgB,CAAC;AACvE,OAAO,KAAK,EACV,kBAAkB,EAClB,uBAAuB,EACvB,cAAc,EACd,iBAAiB,EACjB,sBAAsB,EACtB,sBAAsB,EACtB,2BAA2B,EAC3B,YAAY,EACZ,iBAAiB,EAClB,MAAM,mBAAmB,CAAC;AAE3B;;;;;;;;GAQG;AACH,MAAM,MAAM,eAAe,GAAG,gBAAgB,CAAC;AAE/C;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,qBAAa,SAAS;IACpB,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAgB;IAE3C;;;;OAIG;gBACS,MAAM,GAAE,eAAoB;IAiCxC;;;;;;OAMG;IACG,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,aAAa,CAAC;IAiBhG;;;;;;;;;;OAUG;IACG,aAAa,CAAC,iBAAiB,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC;IAa1G;;;;;;;;;;;OAWG;IACG,MAAM,IAAI,OAAO,CAAC;QAAE,eAAe,EAAE,MAAM,CAAA;KAAE,CAAC;IAepD;;;;OAIG;IACH,eAAe,IAAI,OAAO;IAK1B;;;;OAIG;IACH,WAAW,IAAI,SAAS,GAAG,SAAS,GAAG,IAAI;IAK3C;;;;OAIG;IACH,OAAO,CAAC,KAAK;IAQb,sEAAsE;IACtE,QAAQ,CAAC,IAAI;QACX,mCAAmC;0BACjB,aAAa,KAAG,OAAO,CAAC,gBAAgB,CAAC;QAG3D,sHAAsH;uBACvG,UAAU,KAAG,OAAO,CAAC,aAAa,CAAC;QAGlD,yHAAyH;2BACtG,cAAc,KAAG,OAAO,CAAC,aAAa,CAAC;QAG1D,uDAAuD;yBACxC,OAAO,CAAC;YAAE,eAAe,EAAE,MAAM,CAAA;SAAE,CAAC;QAGnD,4DAA4D;gCACpC,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC;QAGzD,oEAAoE;+BAC7C,kBAAkB,KAAG,OAAO,CAAC,eAAe,CAAC;QAGpE,sEAAsE;gCAC9C,mBAAmB,KAAG,OAAO,CAAC,eAAe,CAAC;QAGtE,kEAAkE;gCAC1C,MAAM,KAAG,OAAO,CAAC,eAAe,CAAC;QAGzD,qDAAqD;qBAC1C,OAAO,CAAC,QAAQ,CAAC;QAG5B,6CAA6C;0BAC7B,OAAO,CAAC;YAAE,IAAI,EAAE,UAAU,CAAA;SAAE,CAAC;QAG7C,uEAAuE;+BAChD,kBAAkB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,UAAU,CAAA;SAAE,CAAC;QAGzE,8DAA8D;yBAC/C,OAAO,CAAC;YAAE,IAAI,EAAE,WAAW,CAAC;YAAC,WAAW,EAAE,MAAM,CAAA;SAAE,CAAC;QAGlE,wCAAwC;4BACtB,OAAO,CAAC,IAAI,CAAC;QAG/B,wDAAwD;2BACvC,OAAO,CAAC,YAAY,EAAE,CAAC;QAGxC,mEAAmE;+BAC5C,iBAAiB,KAAG,OAAO,CAAC,qBAAqB,CAAC;QAGzE,+BAA+B;8BACT,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;QAG5C,+CAA+C;4BAC7B,OAAO,CAAC,aAAa,EAAE,CAAC;QAG1C,qCAAqC;mCACV,MAAM,KAAG,OAAO,CAAC,IAAI,CAAC;MAEjD;IAMF,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ;QACf,4EAA4E;yBAC3D,gBAAgB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,OAAO,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAG/E,mCAAmC;wBACnB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGrE,4BAA4B;wBACZ,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGjF,mCAAmC;2BAChB,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGnG,4DAA4D;2BACzC,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAGxG,yDAAyD;+BAClC,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAG5G,sCAAsC;4BAClB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGzE,wBAAwB;wBACR,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGjF,iDAAiD;+BAC1B,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAG3F,4CAA4C;8BACtB,MAAM,UAAU,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,aAAa,CAAC;QAG7G;;2CAEmC;+BACZ,MAAM,UAAU,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,KAAK,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAGrI,0DAA0D;0CACxB,MAAM,WAAW,qBAAqB,EAAE,YAAY,gBAAgB,KAAG,OAAO,CAAC,qBAAqB,CAAC;QAGvI,+CAA+C;gCACvB,MAAM,SAAS,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,CAAC;QAGhH;;;;;WAKG;+BACoB,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAGpG;;;;;;WAMG;2BACgB,MAAM,SAAS,kBAAkB,YAAY,gBAAgB,KAAG,OAAO,CAAC,cAAc,CAAC;QAG1G;;;;;WAKG;2BACgB,MAAM,UAAU,eAAe,YAAY,gBAAgB,KAAG,OAAO,CAAC,cAAc,CAAC;QAGxG;;;;WAIG;+BACoB,MAAM,UAAU,YAAY,YAAY,gBAAgB,KAAG,OAAO,CAAC,cAAc,CAAC;MAEzG;IAMF,gHAAgH;IAChH,QAAQ,CAAC,IAAI;QACX;;;;;WAKG;mCACwB,MAAM,UAAU,iBAAiB,KAAG,OAAO,CAAC,YAAY,CAAC;QAGpF,2FAA2F;oBACjF,OAAO,CAAC,YAAY,EAAE,CAAC;QAEjC;;;;;;WAMG;2BACgB,MAAM,UAAU,YAAY,KAAG,OAAO,CAAC,UAAU,CAAC;MAErE;IAMF;;;;;OAKG;IACH,QAAQ,CAAC,KAAK;QACZ;;;WAGG;mCACwB,MAAM,SAAS,uBAAuB,KAAG,OAAO,CAAC,cAAc,CAAC;QAG3F,iGAAiG;qCACpE,sBAAsB,KAAG,OAAO,CAAC,iBAAiB,CAAC;QAGhF,6GAA6G;0CAC3E,2BAA2B,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAG/F,2GAA2G;yCAC1E,MAAM,KAAG,OAAO,CAAC;YAAE,QAAQ,EAAE,IAAI,CAAA;SAAE,CAAC;MAErE;IAMF,gEAAgE;IAChE,QAAQ,CAAC,IAAI;QACX,+DAA+D;sBACjD,YAAY,YAAY,cAAc,KAAG,OAAO,CAAC,uBAAuB,CAAC;QAGvF,mDAAmD;0BACjC,YAAY,YAAY,cAAc,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAGvF,yDAAyD;sBAC3C,YAAY,YAAY,gBAAgB,KAAG,OAAO,CAAC,aAAa,CAAC;QAG/E,wDAAwD;yBACvC,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,CAAC;QAG1F,wLAAwL;wBACxK,sBAAsB,YAAY,cAAc,KAAG,OAAO,CAAC,YAAY,CAAC;QAGxF,sKAAsK;+BAC/I,6BAA6B,YAAY,cAAc,KAAG,OAAO,CAAC,gBAAgB,CAAC;QAG1G,qJAAqJ;gCAC7H,sBAAsB,YAAY,cAAc,KAAG,OAAO,CAAC,uBAAuB,CAAC;QAG3G,qEAAqE;mCAC1C,MAAM,UAAU,aAAa,YAAY,gBAAgB,KAAG,OAAO,CAAC;YAAE,IAAI,EAAE,UAAU,EAAE,CAAC;YAAC,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAGrI,sEAAsE;+BAC/C,MAAM,iBAAiB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,GAAG,CAAC;QAG/F,8EAA8E;gCACtD,MAAM,cAAc,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,UAAU,CAAC;QAGpG,kCAAkC;qBACrB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,GAAG,CAAC;QAG9D,2KAA2K;4BACvJ,MAAM,SAAS,cAAc,YAAY,cAAc,KAAG,OAAO,CAAC,YAAY,CAAC;QAGnG,qFAAqF;mCAC1D,MAAM,SAAS,qBAAqB,YAAY,cAAc,KAAG,OAAO,CAAC,gBAAgB,CAAC;QAGrH,6CAA6C;oCACjB,MAAM,SAAS,cAAc,YAAY,cAAc,KAAG,OAAO,CAAC,uBAAuB,CAAC;QAGtH,0BAA0B;wBACV,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAI1E,qDAAqD;6BAChC,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,WAAW,CAAC;QAG9E,6CAA6C;wCACb,MAAM,UAAU,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAG/H,qDAAqD;uCACtB,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,CAAC;QAG9G,uDAAuD;0CACrB,MAAM,SAAS,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,CAAC;MAEhI;IAMF,wEAAwE;IACxE,QAAQ,CAAC,MAAM;QACb,qCAAqC;wBACrB,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGjF,qCAAqC;wBACrB,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,EAAE,CAAC;QAG/E,wDAAwD;wCACxB,MAAM,WAAW,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGpG,yDAAyD;iDAChB,MAAM,WAAW,MAAM,SAAS,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC,kBAAkB,CAAC;QAGzJ,0BAA0B;uBACX,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGlE,kDAAkD;8BAC5B,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAGhF,qCAAqC;8BACf,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,oBAAoB,CAAC;QAGxF,sCAAsC;gCACd,MAAM,SAAS,sBAAsB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAG1G,wCAAwC;0BACtB,MAAM,SAAS,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAG9F,8BAA8B;2BACX,MAAM,SAAS,oBAAoB,YAAY,gBAAgB,KAAG,OAAO,CAAC,SAAS,CAAC;QAGvG,oCAAoC;2BACjB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAGtE,+DAA+D;8BACzC,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,YAAY,CAAC;QAGhF,+CAA+C;kCACrB,MAAM,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,CAAC;QAG7E,iEAAiE;oCACrC,oBAAoB,EAAE,YAAY,gBAAgB,KAAG,OAAO,CAAC,qBAAqB,CAAC;QAG/G,wDAAwD;mCAC7B,MAAM,UAAU,eAAe,YAAY,gBAAgB,KAAG,OAAO,CAAC,KAAK,EAAE,CAAC;MAEzG;IAMF,+EAA+E;IAC/E,QAAQ,CAAC,SAAS;QAChB,yCAAyC;sCACX,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAGtG,8DAA8D;sCAChC,qBAAqB,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAGjH,yCAAyC;uCACV,MAAM,UAAU,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,mBAAmB,EAAE,CAAC;QAG1H,yCAAyC;qCACZ,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,oBAAoB,EAAE,CAAC;QAGzG,gDAAgD;kCACtB,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,iBAAiB,EAAE,CAAC;QAGnG,kEAAkE;0CAChC,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,0BAA0B,EAAE,CAAC;QAGpH,iDAAiD;kCACvB,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,2BAA2B,CAAC;QAG3G,oCAAoC;8BACd,aAAa,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAGjG,yCAAyC;8BACnB,aAAa,YAAY,gBAAgB,KAAG,OAAO,CAAC,sBAAsB,CAAC;QAGjG,wCAAwC;+BACjB,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,uBAAuB,CAAC;QAGpG,uCAAuC;iCACd,gBAAgB,YAAY,gBAAgB,KAAG,OAAO,CAAC,yBAAyB,CAAC;QAG1G,sCAAsC;kCACZ,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAGpG;;;;WAIG;8BACmB,YAAY,CAAC,eAAe,UAAU,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,OAAO,CAAC;QAGzH,gDAAgD;6BAC3B,cAAc,YAAY,gBAAgB,KAAG,OAAO,CAAC,SAAS,EAAE,CAAC;MAGtF;IAMF,2DAA2D;IAC3D,QAAQ,CAAC,QAAQ;QACf,oEAAoE;mBAC3D,OAAO,CAAC,gBAAgB,CAAC;MAElC;CAEH"}

package/dist/client.js

@@ -59,7 +59,8 @@ export class OpsClient {
         }
         if (!this.isAuthenticated() && !(config.email && config.password)) {
             logger.warn(`No credentials found (checked: constructor config, ${ENV_VARS.API_KEY} env, .env files, ~/.uluops/credentials.json). ` +
-                'Call client.login() or set ULUOPS_API_KEY before making API requests.');
+                'Call client.login() or set ULUOPS_API_KEY before making API requests. ' +
+                'Create a key at https://app.uluops.ai (Settings → API keys).');
         }
     }
     // ============================================
@@ -101,12 +102,29 @@ export class OpsClient {
     /**
      * Logout current session (revokes all sessions for this user).
      *
+     * Revoke every session for the current user server-side AND clear the
+     * session installed on this client (token and retained password), so
+     * `isAuthenticated()` is false afterwards and no automatic re-login can
+     * follow. An API-key strategy is untouched — keys are not sessions.
+     *
      * @returns Number of sessions revoked
      * @throws {UnauthorizedError} If client is not authenticated
      * @throws {OpsApiError} On network or server errors
      */
     async logout() {
-        return authOps.logoutAll(this.httpClient);
+        const result = await authOps.logoutAll(this.httpClient);
+        // The server has revoked every session; forget ours too. Until ship run
+        // #48 this returned without touching the installed strategy, so
+        // `isAuthenticated()` stayed true on a revoked token and — with
+        // `autoRefresh` (the default) — the next 401 re-logged-in with the
+        // retained password, silently undoing the logout. `clearSession()` drops
+        // the token AND the password, so the next request fails `UnauthorizedError`
+        // before it is sent, and a fresh `login()` is the only way back. An API-key
+        // strategy is not a session and is left alone.
+        const strategy = this.httpClient.getAuthStrategy();
+        if (strategy instanceof JwtSessionAuth)
+            strategy.clearSession();
+        return result;
     }
     /**
      * Check if client has valid credentials installed (API key or session token).
@@ -224,6 +242,19 @@ export class OpsClient {
          * address becomes a `410 PROJECT_REHOMED` tombstone, not a fork.
          */
         rehome: (idOrName, input, options) => projectOps.rehome(this.scope(options), idOrName, input),
+        /**
+         * The project log (ulu log spec §3.2) — runs, decisions and regressions
+         * interleaved newest first, keyset-paged; pass `nextCursor` back verbatim.
+         * A `regression` is a row a run re-detected; a `resolved → open` decision
+         * with no run is *reopened by decision* (D12) — keep them apart.
+         */
+        getLog: (idOrName, query, options) => projectOps.getLog(this.scope(options), idOrName, query),
+        /**
+         * The log's rollup (§3.3): examined / found / decided / cameBack /
+         * activity — a cohort frame on run timestamps and an activity frame on
+         * ledger timestamps; `decided` is the CURRENT status of the found issues.
+         */
+        getLogStat: (idOrName, query, options) => projectOps.getLogStat(this.scope(options), idOrName, query),
     };
     // ============================================
     // ORG OPERATIONS
@@ -237,6 +268,16 @@ export class OpsClient {
          * `readRehomeAuditDetails()`.
          */
         getVisibleAuditLog: (slug, query) => orgOps.getVisibleAuditLog(this.httpClient, slug, query),
+        /** The orgs the caller belongs to (personal included) — what `ulu log --orgs` iterates. */
+        list: () => orgOps.list(this.httpClient),
+        /**
+         * The org rollup (ulu log §3.6): the §3.3 body over the org's live projects
+         * plus a per-project table (`projects[]`, capped at 100). Any member reads;
+         * cached 60 s server-side — `computedAt` says how old. The slug in the
+         * path is the org; no `OrgScopedOptions` here for the same reason as
+         * `getVisibleAuditLog`.
+         */
+        getLogStat: (slug, query) => orgOps.getLogStat(this.httpClient, slug, query),
     };
     // ============================================
     // ADMIN OPERATIONS (platform role)