run402-mcp 2.40.0 → 2.41.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402-mcp",
-  "version": "2.40.0",
+  "version": "2.41.0",
   "description": "MCP server for Run402 — AI-native Postgres databases with REST API, auth, storage, and row-level security. Pay with x402 USDC micropayments.",
   "type": "module",
   "main": "dist/index.js",

package/sdk/README.md

@@ -81,7 +81,7 @@ The `CredentialsProvider` interface has two required methods (`getAuth`, `getPro
 | `allowance` | `status`, `create`, `export`, `faucet` |
 | `service` | `status`, `health` (no auth, no setup — works on a fresh install) |
 | `admin` | Operator/admin endpoints: messages/contact, per-project finance (`getProjectFinance`) |
-| `operator` | **The human / email principal** — the *operator session*, distinct from the agent's per-wallet SIWX identity (and from platform-`admin`). `deviceStart`, `devicePoll`, `overview({ token })`, `revoke({ token })`: browser-delegated device-authorization (RFC 8628, the `aws sso login` model). `overview` returns the email-union across every wallet that verified the email; a single wallet's own view stays `run402 status`. Drives `run402 operator login/overview/whoami/logout`. No MCP tool by design — MCP authenticates as the agent, not the human. |
+| `operator` | **The human / email principal** — distinct from the agent's per-wallet SIWX identity (and from platform-`admin`). Read session: `deviceStart`, `devicePoll`, `overview({ token })`, `revoke({ token })` — browser-delegated device-authorization (RFC 8628, the `aws sso login` model); `overview` returns the email-union across every wallet that verified the email. Write session (v1.78): `buildCliAuthorizeUrl`/`exchangeCliToken` (loopback-PKCE CLI login) + the hosted `operator.session.*` surface (email magic-link / passkey / OAuth login, `whoami`/`refresh`/`revoke`, step-up, authenticators, recovery) — carry a minted session SDK-wide with `controlPlaneSessionCredentials({ token })`. Drives `run402 operator login[/--loopback]/overview/whoami/logout`. No MCP tool by design — MCP authenticates as the agent, not the human. |
 
 CLI-style aliases are available for agent ergonomics: `r.image` aliases `r.ai`,
 and common command names such as `r.billing.balance`, `r.auth.magicLink`,

package/sdk/dist/control-plane-credentials.d.ts

@@ -0,0 +1,45 @@
+/**
+ * Control-plane **session** credential provider (gateway v1.78). Carries a
+ * write-capable `control_plane_session` bearer so the whole SDK authenticates as
+ * the human principal — the token is "accepted everywhere a SIWX wallet is", so
+ * `r.org.*`, `r.admin.transfers.*`, and `r.operator.session.*` all act as that
+ * principal.
+ *
+ * Isomorphic — no Node APIs. Mint a session with `r.operator.session.verifyEmail`
+ * / `passkeyVerify` / the loopback-PKCE `exchangeCliToken`, then:
+ *
+ *   const r = run402({ credentials: controlPlaneSessionCredentials({ token }) });
+ *   await r.org.whoami();            // resolves the principal + memberships
+ *
+ * High-stakes writes still require a fresh passkey — an `email`/`oauth` session
+ * gets {@link StepUpRequiredError}; run the step-up ceremony
+ * (`r.operator.session.stepUpOptions`/`stepUpVerify`) and retry.
+ *
+ * This credential authenticates control-plane operations only; it carries no
+ * project anon/service keys, so {@link CredentialsProvider.getProject} returns
+ * null (project-key operations need the keystore/wallet).
+ */
+import type { CredentialsProvider } from "./credentials.js";
+/** Brand marking a provider as control-plane-session-backed. */
+export declare const CONTROL_PLANE_SESSION_CREDENTIALS: unique symbol;
+export interface ControlPlaneSessionMarkedCredentialsProvider extends CredentialsProvider {
+    readonly [CONTROL_PLANE_SESSION_CREDENTIALS]: true;
+}
+export interface ControlPlaneSessionCredentialsOptions {
+    /** A `control_plane_session` bearer token. Provide this OR `getToken`. */
+    token?: string;
+    /**
+     * Lazily resolve the current token (e.g. read a cache, or rotate via
+     * `r.operator.session.refresh`). Called before every authenticated request.
+     */
+    getToken?: () => string | Promise<string>;
+}
+/** True if `credentials` was created by {@link controlPlaneSessionCredentials}. */
+export declare function isControlPlaneSessionCredentials(credentials: CredentialsProvider): credentials is ControlPlaneSessionMarkedCredentialsProvider;
+/**
+ * Build a {@link CredentialsProvider} that authenticates every request with a
+ * `control_plane_session` bearer. Pass a static `token`, or a `getToken`
+ * resolver for rotation.
+ */
+export declare function controlPlaneSessionCredentials(opts: ControlPlaneSessionCredentialsOptions): ControlPlaneSessionMarkedCredentialsProvider;
+//# sourceMappingURL=control-plane-credentials.d.ts.map

package/sdk/dist/control-plane-credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-credentials.d.ts","sourceRoot":"","sources":["../src/control-plane-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAe,MAAM,kBAAkB,CAAC;AAGzE,gEAAgE;AAChE,eAAO,MAAM,iCAAiC,eAE7C,CAAC;AAEF,MAAM,WAAW,4CAA6C,SAAQ,mBAAmB;IACvF,QAAQ,CAAC,CAAC,iCAAiC,CAAC,EAAE,IAAI,CAAC;CACpD;AAED,MAAM,WAAW,qCAAqC;IACpD,0EAA0E;IAC1E,KAAK,CAAC,EAAE,MAAM,CAAC;IACf;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;CAC3C;AAED,mFAAmF;AACnF,wBAAgB,gCAAgC,CAC9C,WAAW,EAAE,mBAAmB,GAC/B,WAAW,IAAI,4CAA4C,CAM7D;AAED;;;;GAIG;AACH,wBAAgB,8BAA8B,CAC5C,IAAI,EAAE,qCAAqC,GAC1C,4CAA4C,CA8B9C"}

package/sdk/dist/control-plane-credentials.js

@@ -0,0 +1,57 @@
+/**
+ * Control-plane **session** credential provider (gateway v1.78). Carries a
+ * write-capable `control_plane_session` bearer so the whole SDK authenticates as
+ * the human principal — the token is "accepted everywhere a SIWX wallet is", so
+ * `r.org.*`, `r.admin.transfers.*`, and `r.operator.session.*` all act as that
+ * principal.
+ *
+ * Isomorphic — no Node APIs. Mint a session with `r.operator.session.verifyEmail`
+ * / `passkeyVerify` / the loopback-PKCE `exchangeCliToken`, then:
+ *
+ *   const r = run402({ credentials: controlPlaneSessionCredentials({ token }) });
+ *   await r.org.whoami();            // resolves the principal + memberships
+ *
+ * High-stakes writes still require a fresh passkey — an `email`/`oauth` session
+ * gets {@link StepUpRequiredError}; run the step-up ceremony
+ * (`r.operator.session.stepUpOptions`/`stepUpVerify`) and retry.
+ *
+ * This credential authenticates control-plane operations only; it carries no
+ * project anon/service keys, so {@link CredentialsProvider.getProject} returns
+ * null (project-key operations need the keystore/wallet).
+ */
+import { LocalError } from "./errors.js";
+/** Brand marking a provider as control-plane-session-backed. */
+export const CONTROL_PLANE_SESSION_CREDENTIALS = Symbol.for("@run402/sdk/control-plane-session-credentials");
+/** True if `credentials` was created by {@link controlPlaneSessionCredentials}. */
+export function isControlPlaneSessionCredentials(credentials) {
+    return Boolean(credentials[CONTROL_PLANE_SESSION_CREDENTIALS]);
+}
+/**
+ * Build a {@link CredentialsProvider} that authenticates every request with a
+ * `control_plane_session` bearer. Pass a static `token`, or a `getToken`
+ * resolver for rotation.
+ */
+export function controlPlaneSessionCredentials(opts) {
+    if (!opts?.token && !opts?.getToken) {
+        throw new LocalError("controlPlaneSessionCredentials requires token or getToken", "creating control-plane session credentials");
+    }
+    const provider = {
+        async getAuth() {
+            const token = opts.getToken ? await opts.getToken() : opts.token;
+            if (!token) {
+                throw new LocalError("control-plane session credentials did not return a token", "authenticating with control-plane session");
+            }
+            return { Authorization: `Bearer ${token}` };
+        },
+        async getProject() {
+            // A control-plane session carries no project anon/service keys.
+            return null;
+        },
+    };
+    Object.defineProperty(provider, CONTROL_PLANE_SESSION_CREDENTIALS, {
+        value: true,
+        enumerable: false,
+    });
+    return provider;
+}
+//# sourceMappingURL=control-plane-credentials.js.map

package/sdk/dist/control-plane-credentials.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"control-plane-credentials.js","sourceRoot":"","sources":["../src/control-plane-credentials.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAGH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,gEAAgE;AAChE,MAAM,CAAC,MAAM,iCAAiC,GAAG,MAAM,CAAC,GAAG,CACzD,+CAA+C,CAChD,CAAC;AAgBF,mFAAmF;AACnF,MAAM,UAAU,gCAAgC,CAC9C,WAAgC;IAEhC,OAAO,OAAO,CACX,WAAqE,CACpE,iCAAiC,CAClC,CACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,8BAA8B,CAC5C,IAA2C;IAE3C,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAClB,2DAA2D,EAC3D,4CAA4C,CAC7C,CAAC;IACJ,CAAC;IAED,MAAM,QAAQ,GAAwB;QACpC,KAAK,CAAC,OAAO;YACX,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC;YACjE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,IAAI,UAAU,CAClB,0DAA0D,EAC1D,2CAA2C,CAC5C,CAAC;YACJ,CAAC;YACD,OAAO,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE,CAAC;QAC9C,CAAC;QACD,KAAK,CAAC,UAAU;YACd,gEAAgE;YAChE,OAAO,IAAI,CAAC;QACd,CAAC;KACF,CAAC;IAEF,MAAM,CAAC,cAAc,CAAC,QAAQ,EAAE,iCAAiC,EAAE;QACjE,KAAK,EAAE,IAAI;QACX,UAAU,EAAE,KAAK;KAClB,CAAC,CAAC;IACH,OAAO,QAAwD,CAAC;AAClE,CAAC"}

package/sdk/dist/index.d.ts

@@ -181,6 +181,8 @@ export type * from "./credentials.js";
 export type * from "./kernel.js";
 export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
 export type * from "./ci-credentials.js";
+export { CONTROL_PLANE_SESSION_CREDENTIALS, controlPlaneSessionCredentials, isControlPlaneSessionCredentials, } from "./control-plane-credentials.js";
+export type * from "./control-plane-credentials.js";
 export { Deploy } from "./namespaces/deploy.js";
 export { EMPTY_STATIC_MANIFEST_METADATA, ROUTE_HTTP_METHODS, buildDeployResolveSummary, isDeployResolveRouteHit, isDeployResolveStaticHit, normalizeDeployResolveRequest, normalizeStaticManifestMetadata, summarizeDeployResult, } from "./namespaces/deploy.types.js";
 export { Ci, CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, assertCiDeployableSpec, buildCiDelegationResourceUri, buildCiDelegationStatement, normalizeCiRouteScopes, normalizeCiDelegationValues, validateCiNonce, validateCiRouteScope, validateCiSubjectMatch, } from "./namespaces/ci.js";
@@ -204,6 +206,8 @@ export type * from "./namespaces/email.js";
 export type * from "./namespaces/functions.types.js";
 export type * from "./namespaces/jobs.js";
 export type * from "./namespaces/operator.js";
+export { OperatorSession } from "./namespaces/operator-session.js";
+export type * from "./namespaces/operator-session.js";
 export { Org, OrgMembers, OrgInvites } from "./namespaces/org.js";
 export type * from "./namespaces/org.types.js";
 export { Grants } from "./namespaces/grants.js";

package/sdk/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAIZ,IAAI,EAAE,aAAa;IAmE/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,8BAA8B,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,0BAA0B,CAAC;AAC9C,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAClE,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B;;;;;OAKG;IACH,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC;IAClB;;;OAGG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;gBAIZ,IAAI,EAAE,aAAa;IAmE/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,4EAA4E;IAC5E,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AACxC,mBAAmB,gCAAgC,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,8BAA8B,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,0BAA0B,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AACnE,mBAAmB,kCAAkC,CAAC;AACtD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAClE,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC"}

package/sdk/dist/index.js

@@ -241,11 +241,13 @@ export function run402(opts) {
 export { Run402Error, PaymentRequired, ProjectNotFound, Unauthorized, NotAuthorizedError, ApiError, NetworkError, LocalError, Run402DeployError, TransferFreezeError, StepUpRequiredError, isRun402Error, isPaymentRequired, isProjectNotFound, isUnauthorized, isNotAuthorized, isApiError, isNetworkError, isLocalError, isDeployError, isTransferFreezeError, isStepUpRequired, isRetryableRun402Error, getQuotaScope, } from "./errors.js";
 export { withRetry } from "./retry.js";
 export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
+export { CONTROL_PLANE_SESSION_CREDENTIALS, controlPlaneSessionCredentials, isControlPlaneSessionCredentials, } from "./control-plane-credentials.js";
 export { Deploy } from "./namespaces/deploy.js";
 export { EMPTY_STATIC_MANIFEST_METADATA, ROUTE_HTTP_METHODS, buildDeployResolveSummary, isDeployResolveRouteHit, isDeployResolveStaticHit, normalizeDeployResolveRequest, normalizeStaticManifestMetadata, summarizeDeployResult, } from "./namespaces/deploy.types.js";
 export { Ci, CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, assertCiDeployableSpec, buildCiDelegationResourceUri, buildCiDelegationStatement, normalizeCiRouteScopes, normalizeCiDelegationValues, validateCiNonce, validateCiRouteScope, validateCiSubjectMatch, } from "./namespaces/ci.js";
 export { ScopedRun402 } from "./scoped.js";
 export { Transfers } from "./namespaces/transfers.js";
+export { OperatorSession } from "./namespaces/operator-session.js";
 export { Org, OrgMembers, OrgInvites } from "./namespaces/org.js";
 export { Grants } from "./namespaces/grants.js";
 //# sourceMappingURL=index.js.map

package/sdk/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,MAAM,CAAS;IACf,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACtB;;;;;;OAMG;IACM,YAAY,CAAS;IACrB,EAAE,CAAK;IACP,IAAI,CAAO;IACpB;;;OAGG;IACM,QAAQ,CAAW;IAC5B;;;;;OAKG;IACM,GAAG,CAAM;IAClB;;;OAGG;IACM,MAAM,CAAS;IAEf,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,IAAI,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC;QACT,OAAO;YACL,WAAW,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;YACnC,YAAY,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;YACrC,OAAO;YACP,aAAa,EAAE,aAAa,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;CACF;AAcD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiBtD,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,qBAAqB,CAAC;AAC1C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,MAAM,CAAS;IACf,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACtB;;;;;;OAMG;IACM,YAAY,CAAS;IACrB,EAAE,CAAK;IACP,IAAI,CAAO;IACpB;;;OAGG;IACM,QAAQ,CAAW;IAC5B;;;;;OAKG;IACM,GAAG,CAAM;IAClB;;;OAGG;IACM,MAAM,CAAS;IAEf,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,IAAI,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC;QACT,OAAO;YACL,WAAW,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;YACnC,YAAY,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;YACrC,OAAO;YACP,aAAa,EAAE,aAAa,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;CACF;AAcD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,kBAAkB,EAClB,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,eAAe,EACf,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,gBAAgB,EAChB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,iCAAiC,EACjC,8BAA8B,EAC9B,gCAAgC,GACjC,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AAiBtD,OAAO,EAAE,eAAe,EAAE,MAAM,kCAAkC,CAAC;AAEnE,OAAO,EAAE,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC"}

package/sdk/dist/namespaces/operator-session.d.ts

@@ -0,0 +1,223 @@
+/**
+ * `operator.session` — the hosted/browser control-plane **session** surface
+ * (gateway v1.78 `passkey-principals-onboarding`). The write-capable human
+ * principal: log in (email magic-link / passkey / Google / GitHub), manage the
+ * session (whoami / refresh / revoke), enrol a passkey, run a step-up ceremony,
+ * and manage authenticators + recovery codes.
+ *
+ * Reached as `r.operator.session.*`. Distinct from the read-only operator
+ * overview session (`r.operator.deviceStart`/`overview`) and from the CLI
+ * loopback-PKCE write-login (`r.operator.buildCliAuthorizeUrl`/`exchangeCliToken`,
+ * which is the headless variant of this same browser ceremony). All three are
+ * the one human principal; this group is the browser/console front door that the
+ * hosted login pages and `@run402/sdk` consumers call.
+ *
+ * Isomorphic — no Node APIs. The token model mirrors {@link Operator.overview}:
+ * the public *mint* methods (`email`/`verifyEmail`/`passkey*`/`consumeRecoveryCode`)
+ * send no auth (the body or the magic-link token IS the credential); the
+ * *session-bound* methods take `opts.token` to send the `control_plane_session`
+ * bearer explicitly, and fall back to the credential provider's default auth
+ * (e.g. {@link controlPlaneSessionCredentials} or a SIWX wallet) when omitted.
+ *
+ * WebAuthn option/assertion payloads are opaque passthroughs (`unknown`) — the
+ * browser runs the actual ceremony; a headless client cannot.
+ *
+ * High-stakes writes (invite, membership, handoff, delete) require a **fresh
+ * passkey** — a magic-link/OAuth session does NOT satisfy step-up, so the
+ * gateway returns {@link StepUpRequiredError}; `stepUpOptions`/`stepUpVerify`
+ * are how a long-lived session re-establishes that freshness.
+ */
+import type { Client } from "../kernel.js";
+import type { ControlPlaneSession } from "./operator.js";
+import type { Principal, OrgMembership } from "./org.types.js";
+/** OAuth identity providers bridged for control-plane login. */
+export type ControlPlaneOAuthProvider = "google" | "github";
+/** Generic, non-enumerating response from {@link OperatorSession.email}. */
+export interface MagicLinkSendResult {
+    status: string;
+    message: string;
+    [key: string]: unknown;
+}
+/**
+ * Result of {@link OperatorSession.consumeRecoveryCode} — a minted session that
+ * cannot perform high-stakes ops until a passkey is enrolled
+ * (`must_enroll_passkey: true`). Recovery `amr` never satisfies step-up.
+ */
+export interface RecoveryConsumeResult extends ControlPlaneSession {
+    must_enroll_passkey?: boolean;
+    note?: string;
+}
+/**
+ * Result of {@link OperatorSession.whoami} (`GET /agent/v1/control-plane/session`)
+ * — the live session's principal, every org membership (newly-active rows here
+ * are the auto-claimed invites), and the freshness substrate (`amr` + per-AMR
+ * `amr_times`) the step-up gate reads. Forward-compatible.
+ */
+export interface ControlPlaneWhoAmI {
+    principal: Principal;
+    memberships: OrgMembership[];
+    /** Auth methods satisfied on this session, e.g. `["passkey"]`. */
+    amr: string[];
+    /** Per-AMR last-proven time (epoch ms or ISO), the step-up freshness source. */
+    amr_times?: Record<string, unknown>;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.refresh} (`POST …/session/refresh`). */
+export interface ControlPlaneRefreshResult {
+    control_plane_session_token: string;
+    token_type?: string;
+    expires_in?: number;
+    [key: string]: unknown;
+}
+/** WebAuthn options envelope (`{ options }`) — opaque; handed to the browser. */
+export interface WebAuthnOptionsResult {
+    options: unknown;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.enrollPasskeyVerify}. */
+export interface EnrollPasskeyResult {
+    status: string;
+    credential_id: string;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.stepUpVerify}. */
+export interface StepUpVerifyResult {
+    status: string;
+    stepped_up: boolean;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.issueRecoveryCodes} — shown ONCE. */
+export interface RecoveryCodesResult {
+    status: string;
+    recovery_codes: string[];
+    note?: string;
+    [key: string]: unknown;
+}
+/** One active authenticator (no secret material). Forward-compatible. */
+export interface Authenticator {
+    id: string;
+    kind: string;
+    [key: string]: unknown;
+}
+/** Result of {@link OperatorSession.revokeAuthenticator}. */
+export interface AuthenticatorRevokeResult {
+    status: string;
+    kind: string;
+    [key: string]: unknown;
+}
+/** Options bag carrying the optional `control_plane_session` bearer. */
+export interface SessionTokenOpts {
+    /**
+     * The `control_plane_session` bearer. When omitted, the request falls back to
+     * the credential provider's default auth (e.g. {@link controlPlaneSessionCredentials}).
+     */
+    token?: string;
+}
+export declare class OperatorSession {
+    private readonly client;
+    constructor(client: Client);
+    /**
+     * Send a control-plane sign-in magic link to `email`
+     * (`POST /agent/v1/control-plane/session/email`). Non-enumerating: an
+     * identical response whether or not the email can sign in. Rate-limited.
+     */
+    email(input: {
+        email: string;
+    }): Promise<MagicLinkSendResult>;
+    /**
+     * Exchange a magic-link token for a control-plane session
+     * (`POST …/session/email/verify`). Verifies the email, resolves/creates the
+     * principal, **auto-claims any pending invites**, and mints the session
+     * (`amr: ["email"]`).
+     */
+    verifyEmail(input: {
+        token: string;
+    }): Promise<ControlPlaneSession>;
+    /**
+     * Get WebAuthn login options for an email's passkeys
+     * (`POST …/session/passkey/options`). Opaque — pass `options` to the browser's
+     * `navigator.credentials.get`.
+     */
+    passkeyOptions(input: {
+        email: string;
+    }): Promise<WebAuthnOptionsResult>;
+    /**
+     * Verify a WebAuthn assertion and mint a session (`amr: ["passkey"]`)
+     * (`POST …/session/passkey/verify`). `response` is the opaque assertion from
+     * the browser.
+     */
+    passkeyVerify(input: {
+        email: string;
+        response: unknown;
+    }): Promise<ControlPlaneSession>;
+    /**
+     * Build the browser OAuth start URL for `provider`
+     * (`GET …/oauth/:provider/start`). Pure — no network. Open it in a browser;
+     * the gateway 302s to the provider, then the callback lands on the console
+     * with the session token in the URL fragment.
+     *
+     * Note: the live bridge can return `503` until the gateway provisions the
+     * provider's `CONTROL_PLANE_{GOOGLE,GITHUB}_*` client credentials.
+     */
+    oauthUrl(provider: ControlPlaneOAuthProvider): string;
+    /**
+     * Run the recovery-code ceremony (`POST …/recovery/consume`). Mints a session
+     * with `amr: ["recovery_code"]` which **cannot** do high-stakes ops
+     * (`must_enroll_passkey: true`) — enrol a passkey to restore full access.
+     */
+    consumeRecoveryCode(input: {
+        code: string;
+    }): Promise<RecoveryConsumeResult>;
+    /**
+     * Resolve the current session's principal + memberships + freshness
+     * (`GET /agent/v1/control-plane/session`). The `memberships` reflect any
+     * invites auto-claimed at login.
+     */
+    whoami(opts?: SessionTokenOpts): Promise<ControlPlaneWhoAmI>;
+    /** Rotate the access token (`POST …/session/refresh`). */
+    refresh(opts?: SessionTokenOpts): Promise<ControlPlaneRefreshResult>;
+    /** Sign out — revoke the session server-side (`POST …/session/revoke`). Idempotent. */
+    revoke(opts?: SessionTokenOpts): Promise<{
+        status: string;
+        [key: string]: unknown;
+    }>;
+    /** WebAuthn registration options for a new passkey (`POST …/passkey/enroll/options`). */
+    enrollPasskeyOptions(opts?: SessionTokenOpts): Promise<WebAuthnOptionsResult>;
+    /** Verify a passkey registration (`POST …/passkey/enroll/verify`). `label` names the authenticator. */
+    enrollPasskeyVerify(input: {
+        response: unknown;
+        label?: string | null;
+    } & SessionTokenOpts): Promise<EnrollPasskeyResult>;
+    /**
+     * WebAuthn step-up options for a high-stakes op (`POST …/step-up/options`).
+     * `opClass` binds the elevation, e.g. `"org.invite"` / `"org.membership"` /
+     * `"project.transfer"` (see {@link StepUpRequiredError.requiredAmr}).
+     */
+    stepUpOptions(input?: {
+        opClass?: string;
+    } & SessionTokenOpts): Promise<WebAuthnOptionsResult>;
+    /**
+     * Verify a step-up assertion (`POST …/step-up/verify`) → refreshes session
+     * passkey-freshness and records an action-bound elevation when `opClass` (and
+     * optionally `objectKind`/`objectId`) are given. Retry the gated write after.
+     */
+    stepUpVerify(input: {
+        response: unknown;
+        opClass?: string;
+        objectKind?: string | null;
+        objectId?: string | null;
+    } & SessionTokenOpts): Promise<StepUpVerifyResult>;
+    /** (Re)issue recovery codes — shown ONCE (`POST …/recovery/issue`). */
+    issueRecoveryCodes(opts?: SessionTokenOpts): Promise<RecoveryCodesResult>;
+    /** List my active authenticators — no secret material (`GET …/authenticators`). */
+    listAuthenticators(opts?: SessionTokenOpts): Promise<Authenticator[]>;
+    /**
+     * Revoke an authenticator (`DELETE …/authenticators/:id`). Step-up enforced;
+     * the gateway refuses to remove the last passkey of a sole org owner
+     * (`OWNER_NEEDS_PASSKEY`).
+     */
+    revokeAuthenticator(input: {
+        id: string;
+    } & SessionTokenOpts): Promise<AuthenticatorRevokeResult>;
+}
+//# sourceMappingURL=operator-session.d.ts.map

package/sdk/dist/namespaces/operator-session.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-session.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,eAAe,CAAC;AACzD,OAAO,KAAK,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/D,gEAAgE;AAChE,MAAM,MAAM,yBAAyB,GAAG,QAAQ,GAAG,QAAQ,CAAC;AAE5D,4EAA4E;AAC5E,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;GAIG;AACH,MAAM,WAAW,qBAAsB,SAAQ,mBAAmB;IAChE,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,SAAS,CAAC;IACrB,WAAW,EAAE,aAAa,EAAE,CAAC;IAC7B,kEAAkE;IAClE,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,gFAAgF;IAChF,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4EAA4E;AAC5E,MAAM,WAAW,yBAAyB;IACxC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,iFAAiF;AACjF,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,sDAAsD;AACtD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,OAAO,CAAC;IACpB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,yEAAyE;AACzE,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,6DAA6D;AAC7D,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,wEAAwE;AACxE,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,eAAe;IACd,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAI3C;;;;OAIG;IACG,KAAK,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IASnE;;;;;OAKG;IACG,WAAW,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IASzE;;;;OAIG;IACG,cAAc,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAS9E;;;;OAIG;IACG,aAAa,CAAC,KAAK,EAAE;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAS9F;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAQ,EAAE,yBAAyB,GAAG,MAAM;IAIrD;;;;OAIG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAWlF;;;;OAIG;IACG,MAAM,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAOtE,0DAA0D;IACpD,OAAO,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,yBAAyB,CAAC;IAQ9E,uFAAuF;IACjF,MAAM,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC;IAU9F,yFAAyF;IACnF,oBAAoB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAQvF,uGAAuG;IACjG,mBAAmB,CACvB,KAAK,EAAE;QAAE,QAAQ,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,gBAAgB,GACrE,OAAO,CAAC,mBAAmB,CAAC;IAY/B;;;;OAIG;IACG,aAAa,CAAC,KAAK,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAqB,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAUxG;;;;OAIG;IACG,YAAY,CAChB,KAAK,EAAE;QACL,QAAQ,EAAE,OAAO,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC1B,GAAG,gBAAgB,GACnB,OAAO,CAAC,kBAAkB,CAAC;IAiB9B,uEAAuE;IACjE,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAUnF,mFAAmF;IAC7E,kBAAkB,CAAC,IAAI,GAAE,gBAAqB,GAAG,OAAO,CAAC,aAAa,EAAE,CAAC;IAQ/E;;;;OAIG;IACG,mBAAmB,CAAC,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,gBAAgB,GAAG,OAAO,CAAC,yBAAyB,CAAC;CAOxG"}

package/sdk/dist/namespaces/operator-session.js

@@ -0,0 +1,230 @@
+/**
+ * `operator.session` — the hosted/browser control-plane **session** surface
+ * (gateway v1.78 `passkey-principals-onboarding`). The write-capable human
+ * principal: log in (email magic-link / passkey / Google / GitHub), manage the
+ * session (whoami / refresh / revoke), enrol a passkey, run a step-up ceremony,
+ * and manage authenticators + recovery codes.
+ *
+ * Reached as `r.operator.session.*`. Distinct from the read-only operator
+ * overview session (`r.operator.deviceStart`/`overview`) and from the CLI
+ * loopback-PKCE write-login (`r.operator.buildCliAuthorizeUrl`/`exchangeCliToken`,
+ * which is the headless variant of this same browser ceremony). All three are
+ * the one human principal; this group is the browser/console front door that the
+ * hosted login pages and `@run402/sdk` consumers call.
+ *
+ * Isomorphic — no Node APIs. The token model mirrors {@link Operator.overview}:
+ * the public *mint* methods (`email`/`verifyEmail`/`passkey*`/`consumeRecoveryCode`)
+ * send no auth (the body or the magic-link token IS the credential); the
+ * *session-bound* methods take `opts.token` to send the `control_plane_session`
+ * bearer explicitly, and fall back to the credential provider's default auth
+ * (e.g. {@link controlPlaneSessionCredentials} or a SIWX wallet) when omitted.
+ *
+ * WebAuthn option/assertion payloads are opaque passthroughs (`unknown`) — the
+ * browser runs the actual ceremony; a headless client cannot.
+ *
+ * High-stakes writes (invite, membership, handoff, delete) require a **fresh
+ * passkey** — a magic-link/OAuth session does NOT satisfy step-up, so the
+ * gateway returns {@link StepUpRequiredError}; `stepUpOptions`/`stepUpVerify`
+ * are how a long-lived session re-establishes that freshness.
+ */
+export class OperatorSession {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    // ── login / mint (public — no auth; the body or link token is the credential) ──
+    /**
+     * Send a control-plane sign-in magic link to `email`
+     * (`POST /agent/v1/control-plane/session/email`). Non-enumerating: an
+     * identical response whether or not the email can sign in. Rate-limited.
+     */
+    async email(input) {
+        return this.client.request("/agent/v1/control-plane/session/email", {
+            method: "POST",
+            body: { email: input.email },
+            withAuth: false,
+            context: "sending control-plane magic link",
+        });
+    }
+    /**
+     * Exchange a magic-link token for a control-plane session
+     * (`POST …/session/email/verify`). Verifies the email, resolves/creates the
+     * principal, **auto-claims any pending invites**, and mints the session
+     * (`amr: ["email"]`).
+     */
+    async verifyEmail(input) {
+        return this.client.request("/agent/v1/control-plane/session/email/verify", {
+            method: "POST",
+            body: { token: input.token },
+            withAuth: false,
+            context: "verifying control-plane magic link",
+        });
+    }
+    /**
+     * Get WebAuthn login options for an email's passkeys
+     * (`POST …/session/passkey/options`). Opaque — pass `options` to the browser's
+     * `navigator.credentials.get`.
+     */
+    async passkeyOptions(input) {
+        return this.client.request("/agent/v1/control-plane/session/passkey/options", {
+            method: "POST",
+            body: { email: input.email },
+            withAuth: false,
+            context: "requesting control-plane passkey login options",
+        });
+    }
+    /**
+     * Verify a WebAuthn assertion and mint a session (`amr: ["passkey"]`)
+     * (`POST …/session/passkey/verify`). `response` is the opaque assertion from
+     * the browser.
+     */
+    async passkeyVerify(input) {
+        return this.client.request("/agent/v1/control-plane/session/passkey/verify", {
+            method: "POST",
+            body: { email: input.email, response: input.response },
+            withAuth: false,
+            context: "verifying control-plane passkey login",
+        });
+    }
+    /**
+     * Build the browser OAuth start URL for `provider`
+     * (`GET …/oauth/:provider/start`). Pure — no network. Open it in a browser;
+     * the gateway 302s to the provider, then the callback lands on the console
+     * with the session token in the URL fragment.
+     *
+     * Note: the live bridge can return `503` until the gateway provisions the
+     * provider's `CONTROL_PLANE_{GOOGLE,GITHUB}_*` client credentials.
+     */
+    oauthUrl(provider) {
+        return `${this.client.apiBase}/agent/v1/control-plane/oauth/${encodeURIComponent(provider)}/start`;
+    }
+    /**
+     * Run the recovery-code ceremony (`POST …/recovery/consume`). Mints a session
+     * with `amr: ["recovery_code"]` which **cannot** do high-stakes ops
+     * (`must_enroll_passkey: true`) — enrol a passkey to restore full access.
+     */
+    async consumeRecoveryCode(input) {
+        return this.client.request("/agent/v1/control-plane/recovery/consume", {
+            method: "POST",
+            body: { code: input.code },
+            withAuth: false,
+            context: "consuming control-plane recovery code",
+        });
+    }
+    // ── session lifecycle (bearer; falls back to credential provider) ──
+    /**
+     * Resolve the current session's principal + memberships + freshness
+     * (`GET /agent/v1/control-plane/session`). The `memberships` reflect any
+     * invites auto-claimed at login.
+     */
+    async whoami(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/session", {
+            ...authFor(opts),
+            context: "resolving control-plane session",
+        });
+    }
+    /** Rotate the access token (`POST …/session/refresh`). */
+    async refresh(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/session/refresh", {
+            method: "POST",
+            ...authFor(opts),
+            context: "refreshing control-plane session",
+        });
+    }
+    /** Sign out — revoke the session server-side (`POST …/session/revoke`). Idempotent. */
+    async revoke(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/session/revoke", {
+            method: "POST",
+            ...authFor(opts),
+            context: "revoking control-plane session",
+        });
+    }
+    // ── passkey enrollment (bearer + step-up, enforced by the gateway) ──
+    /** WebAuthn registration options for a new passkey (`POST …/passkey/enroll/options`). */
+    async enrollPasskeyOptions(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/passkey/enroll/options", {
+            method: "POST",
+            ...authFor(opts),
+            context: "requesting control-plane passkey enrollment options",
+        });
+    }
+    /** Verify a passkey registration (`POST …/passkey/enroll/verify`). `label` names the authenticator. */
+    async enrollPasskeyVerify(input) {
+        const { token, response, label } = input;
+        return this.client.request("/agent/v1/control-plane/passkey/enroll/verify", {
+            method: "POST",
+            body: { response, ...(label !== undefined ? { label } : {}) },
+            ...authFor({ token }),
+            context: "verifying control-plane passkey enrollment",
+        });
+    }
+    // ── step-up ceremony (bearer) ──
+    /**
+     * WebAuthn step-up options for a high-stakes op (`POST …/step-up/options`).
+     * `opClass` binds the elevation, e.g. `"org.invite"` / `"org.membership"` /
+     * `"project.transfer"` (see {@link StepUpRequiredError.requiredAmr}).
+     */
+    async stepUpOptions(input = {}) {
+        const { token, opClass } = input;
+        return this.client.request("/agent/v1/control-plane/step-up/options", {
+            method: "POST",
+            body: opClass ? { op_class: opClass } : {},
+            ...authFor({ token }),
+            context: "requesting control-plane step-up options",
+        });
+    }
+    /**
+     * Verify a step-up assertion (`POST …/step-up/verify`) → refreshes session
+     * passkey-freshness and records an action-bound elevation when `opClass` (and
+     * optionally `objectKind`/`objectId`) are given. Retry the gated write after.
+     */
+    async stepUpVerify(input) {
+        const { token, response, opClass, objectKind, objectId } = input;
+        return this.client.request("/agent/v1/control-plane/step-up/verify", {
+            method: "POST",
+            body: {
+                response,
+                ...(opClass !== undefined ? { op_class: opClass } : {}),
+                ...(objectKind !== undefined ? { object_kind: objectKind } : {}),
+                ...(objectId !== undefined ? { object_id: objectId } : {}),
+            },
+            ...authFor({ token }),
+            context: "verifying control-plane step-up",
+        });
+    }
+    // ── recovery codes (bearer + step-up) ──
+    /** (Re)issue recovery codes — shown ONCE (`POST …/recovery/issue`). */
+    async issueRecoveryCodes(opts = {}) {
+        return this.client.request("/agent/v1/control-plane/recovery/issue", {
+            method: "POST",
+            ...authFor(opts),
+            context: "issuing control-plane recovery codes",
+        });
+    }
+    // ── authenticator management (bearer) ──
+    /** List my active authenticators — no secret material (`GET …/authenticators`). */
+    async listAuthenticators(opts = {}) {
+        const res = await this.client.request("/agent/v1/control-plane/authenticators", { ...authFor(opts), context: "listing control-plane authenticators" });
+        return res.authenticators ?? [];
+    }
+    /**
+     * Revoke an authenticator (`DELETE …/authenticators/:id`). Step-up enforced;
+     * the gateway refuses to remove the last passkey of a sole org owner
+     * (`OWNER_NEEDS_PASSKEY`).
+     */
+    async revokeAuthenticator(input) {
+        const { token, id } = input;
+        return this.client.request(`/agent/v1/control-plane/authenticators/${encodeURIComponent(id)}`, { method: "DELETE", ...authFor({ token }), context: "revoking control-plane authenticator" });
+    }
+}
+/**
+ * Build the auth half of a request: explicit `Authorization: Bearer <token>`
+ * (and `withAuth: false`) when a token is passed, else fall through to the
+ * credential provider (`withAuth` defaults true). Mirrors {@link Operator.overview}.
+ */
+function authFor(opts) {
+    return opts.token
+        ? { headers: { Authorization: `Bearer ${opts.token}` }, withAuth: false }
+        : {};
+}
+//# sourceMappingURL=operator-session.js.map

package/sdk/dist/namespaces/operator-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator-session.js","sourceRoot":"","sources":["../../src/namespaces/operator-session.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAqGH,MAAM,OAAO,eAAe;IACG;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,kFAAkF;IAElF;;;;OAIG;IACH,KAAK,CAAC,KAAK,CAAC,KAAwB;QAClC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,uCAAuC,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,WAAW,CAAC,KAAwB;QACxC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,8CAA8C,EAAE;YAC9F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,oCAAoC;SAC9C,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,cAAc,CAAC,KAAwB;QAC3C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,iDAAiD,EAAE;YACnG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;YAC5B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,gDAAgD;SAC1D,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,KAA2C;QAC7D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,gDAAgD,EAAE;YAChG,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE;YACtD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED;;;;;;;;OAQG;IACH,QAAQ,CAAC,QAAmC;QAC1C,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,iCAAiC,kBAAkB,CAAC,QAAQ,CAAC,QAAQ,CAAC;IACrG,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAuB;QAC/C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,0CAA0C,EAAE;YAC5F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE;YAC1B,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,sEAAsE;IAEtE;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,OAAyB,EAAE;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,iCAAiC,EAAE;YAChF,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,iCAAiC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,0DAA0D;IAC1D,KAAK,CAAC,OAAO,CAAC,OAAyB,EAAE;QACvC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAA4B,yCAAyC,EAAE;YAC/F,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,kCAAkC;SAC5C,CAAC,CAAC;IACL,CAAC;IAED,uFAAuF;IACvF,KAAK,CAAC,MAAM,CAAC,OAAyB,EAAE;QACtC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,wCAAwC,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,uEAAuE;IAEvE,yFAAyF;IACzF,KAAK,CAAC,oBAAoB,CAAC,OAAyB,EAAE;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,gDAAgD,EAAE;YAClG,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,qDAAqD;SAC/D,CAAC,CAAC;IACL,CAAC;IAED,uGAAuG;IACvG,KAAK,CAAC,mBAAmB,CACvB,KAAsE;QAEtE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,KAAK,CAAC;QACzC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,+CAA+C,EAAE;YAC/F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;YAC7D,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,4CAA4C;SACtD,CAAC,CAAC;IACL,CAAC;IAED,kCAAkC;IAElC;;;;OAIG;IACH,KAAK,CAAC,aAAa,CAAC,QAAiD,EAAE;QACrE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;QACjC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAwB,yCAAyC,EAAE;YAC3F,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE;YAC1C,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,0CAA0C;SACpD,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,YAAY,CAChB,KAKoB;QAEpB,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,QAAQ,EAAE,GAAG,KAAK,CAAC;QACjE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,wCAAwC,EAAE;YACvF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,QAAQ;gBACR,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChE,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC3D;YACD,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC;YACrB,OAAO,EAAE,iCAAiC;SAC3C,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAE1C,uEAAuE;IACvE,KAAK,CAAC,kBAAkB,CAAC,OAAyB,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,wCAAwC,EAAE;YACxF,MAAM,EAAE,MAAM;YACd,GAAG,OAAO,CAAC,IAAI,CAAC;YAChB,OAAO,EAAE,sCAAsC;SAChD,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAE1C,mFAAmF;IACnF,KAAK,CAAC,kBAAkB,CAAC,OAAyB,EAAE;QAClD,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACnC,wCAAwC,EACxC,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CACtE,CAAC;QACF,OAAO,GAAG,CAAC,cAAc,IAAI,EAAE,CAAC;IAClC,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,mBAAmB,CAAC,KAAwC;QAChE,MAAM,EAAE,KAAK,EAAE,EAAE,EAAE,GAAG,KAAK,CAAC;QAC5B,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,0CAA0C,kBAAkB,CAAC,EAAE,CAAC,EAAE,EAClE,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,sCAAsC,EAAE,CAC7F,CAAC;IACJ,CAAC;CACF;AAED;;;;GAIG;AACH,SAAS,OAAO,CAAC,IAAsB;IACrC,OAAO,IAAI,CAAC,KAAK;QACf,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE;QACzE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC"}

package/sdk/dist/namespaces/operator.d.ts

@@ -18,6 +18,7 @@
  * Gateway contract: kychee-com/run402-private#443 (RFC 8628 device-auth bridge).
  */
 import type { Client } from "../kernel.js";
+import { OperatorSession } from "./operator-session.js";
 /** RFC 8628 device-authorization start response. */
 export interface DeviceAuthStart {
     device_code: string;
@@ -115,6 +116,15 @@ export interface CliTokenExchange {
 }
 export declare class Operator {
     private readonly client;
+    /**
+     * The hosted/browser control-plane **session** surface (gateway v1.78):
+     * `r.operator.session.email`, `verifyEmail`, `passkeyVerify`, `whoami`,
+     * `refresh`, `revoke`, and the step-up / authenticator helpers.
+     * The write-capable human login + step-up + authenticators, distinct from the
+     * read-only device/overview methods on this class and the loopback-PKCE
+     * CLI write-login below. See {@link OperatorSession}.
+     */
+    readonly session: OperatorSession;
     constructor(client: Client);
     /**
      * Begin the device-authorization flow. Unauthenticated. Returns the codes the

package/sdk/dist/namespaces/operator.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AASD,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,WAAW,CAAC,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IAS/E;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC/D;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAaxE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;;;OAIG;IACH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAWxD;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAa/E"}
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAExD,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,mBAAmB;IAClC,2BAA2B,EAAE,MAAM,CAAC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,oCAAoC;IACpC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,mEAAmE;IACnE,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sCAAsC;IACtC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,mDAAmD;IACnD,GAAG,CAAC,EAAE,MAAM,EAAE,CAAC;IACf,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,4DAA4D;AAC5D,MAAM,WAAW,kBAAkB;IACjC,2EAA2E;IAC3E,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,aAAa,EAAE,MAAM,CAAC;IACtB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;IACd,oBAAoB;IACpB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,wDAAwD;AACxD,MAAM,WAAW,gBAAgB;IAC/B,4DAA4D;IAC5D,IAAI,EAAE,MAAM,CAAC;IACb,gEAAgE;IAChE,YAAY,EAAE,MAAM,CAAC;IACrB,2DAA2D;IAC3D,WAAW,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,KAAK,EAAE,MAAM,CAAC;CACf;AASD,qBAAa,QAAQ;IAWP,OAAO,CAAC,QAAQ,CAAC,MAAM;IAVnC;;;;;;;OAOG;IACH,QAAQ,CAAC,OAAO,EAAE,eAAe,CAAC;gBAEL,MAAM,EAAE,MAAM;IAI3C;;;;OAIG;IACG,WAAW,CAAC,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IAS/E;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC/D;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAaxE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;IAiBpD;;;;OAIG;IACH,oBAAoB,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM;IAWxD;;;;OAIG;IACG,gBAAgB,CAAC,MAAM,EAAE,gBAAgB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAa/E"}

package/sdk/dist/namespaces/operator.js

@@ -18,6 +18,7 @@
  * Gateway contract: kychee-com/run402-private#443 (RFC 8628 device-auth bridge).
  */
 import { ApiError, NetworkError } from "../errors.js";
+import { OperatorSession } from "./operator-session.js";
 const POLL_ERROR_CODES = new Set([
     "authorization_pending",
     "slow_down",
@@ -26,8 +27,18 @@ const POLL_ERROR_CODES = new Set([
 ]);
 export class Operator {
     client;
+    /**
+     * The hosted/browser control-plane **session** surface (gateway v1.78):
+     * `r.operator.session.email`, `verifyEmail`, `passkeyVerify`, `whoami`,
+     * `refresh`, `revoke`, and the step-up / authenticator helpers.
+     * The write-capable human login + step-up + authenticators, distinct from the
+     * read-only device/overview methods on this class and the loopback-PKCE
+     * CLI write-login below. See {@link OperatorSession}.
+     */
+    session;
     constructor(client) {
         this.client = client;
+        this.session = new OperatorSession(client);
     }
     /**
      * Begin the device-authorization flow. Unauthenticated. Returns the codes the

package/sdk/dist/namespaces/operator.js.map

@@ -1 +1 @@
-{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AA+FtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgC,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,mCAAmC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC;QAC5E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,sDAAuD,GAAa,CAAC,OAAO,EAAE,EAC9E,GAAG,EACH,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAuC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,KAAsD,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,mDAAmD,GAAG,CAAC,MAAM,GAAG,EAChE,GAAG,CAAC,MAAM,EACV,IAAI,EACJ,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;gBAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;gBAClD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;YAC1E,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,mCAAmC,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,gEAAgE;IAChE,8EAA8E;IAC9E,+DAA+D;IAE/D;;;;OAIG;IACH,oBAAoB,CAAC,MAA0B;QAC7C,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAwB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,mCAAmC,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;YACD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF"}
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACtD,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AA+FxD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,QAAQ;IAWU;IAV7B;;;;;;;OAOG;IACM,OAAO,CAAkB;IAElC,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgC,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,mCAAmC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC;QAC5E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,sDAAuD,GAAa,CAAC,OAAO,EAAE,EAC9E,GAAG,EACH,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAuC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,KAAsD,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,mDAAmD,GAAG,CAAC,MAAM,GAAG,EAChE,GAAG,CAAC,MAAM,EACV,IAAI,EACJ,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;gBAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;gBAClD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;YAC1E,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,mCAAmC,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,gEAAgE;IAChE,8EAA8E;IAC9E,+DAA+D;IAE/D;;;;OAIG;IACH,oBAAoB,CAAC,MAA0B;QAC7C,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC;YAC5B,YAAY,EAAE,MAAM,CAAC,WAAW;YAChC,cAAc,EAAE,MAAM,CAAC,aAAa;YACpC,qBAAqB,EAAE,MAAM;YAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;IACvF,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,gBAAgB,CAAC,MAAwB;QAC7C,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,mCAAmC,EAAE;YACnF,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,aAAa,EAAE,MAAM,CAAC,YAAY;gBAClC,YAAY,EAAE,MAAM,CAAC,WAAW;gBAChC,KAAK,EAAE,MAAM,CAAC,KAAK;aACpB;YACD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,mCAAmC;SAC7C,CAAC,CAAC;IACL,CAAC;CACF"}