run402 1.54.3 → 1.55.0

package/sdk/dist/index.js

@@ -25,6 +25,7 @@ import { Email } from "./namespaces/email.js";
 import { Contracts } from "./namespaces/contracts.js";
 import { Admin } from "./namespaces/admin.js";
 import { Deploy } from "./namespaces/deploy.js";
+import { Ci } from "./namespaces/ci.js";
 import { ScopedRun402 } from "./scoped.js";
 import { LocalError } from "./errors.js";
 export class Run402 {
@@ -48,6 +49,7 @@ export class Run402 {
     contracts;
     admin;
     deploy;
+    ci;
     #client;
     constructor(opts) {
         if (!opts || typeof opts !== "object") {
@@ -93,6 +95,7 @@ export class Run402 {
         this.contracts = new Contracts(client);
         this.admin = new Admin(client);
         this.deploy = new Deploy(client);
+        this.ci = new Ci(client);
     }
     /**
      * Return a project-scoped sub-client where every project-id-bearing namespace
@@ -171,6 +174,8 @@ export function run402(opts) {
 }
 export { Run402Error, PaymentRequired, ProjectNotFound, Unauthorized, ApiError, NetworkError, LocalError, Run402DeployError, isRun402Error, isPaymentRequired, isProjectNotFound, isUnauthorized, isApiError, isNetworkError, isLocalError, isDeployError, isRetryableRun402Error, } from "./errors.js";
 export { withRetry } from "./retry.js";
+export { CI_SESSION_CREDENTIALS, createCiSessionCredentials, githubActionsCredentials, isCiSessionCredentials, } from "./ci-credentials.js";
 export { Deploy } from "./namespaces/deploy.js";
+export { Ci, CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, assertCiDeployableSpec, buildCiDelegationResourceUri, buildCiDelegationStatement, normalizeCiDelegationValues, validateCiNonce, validateCiSubjectMatch, } from "./namespaces/ci.js";
 export { ScopedRun402 } from "./scoped.js";
 //# sourceMappingURL=index.js.map

package/sdk/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACb,MAAM,CAAS;IAEf,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AAExC,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACb,MAAM,CAAS;IACf,EAAE,CAAK;IAEP,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;CACF;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAMrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAM7B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,2BAA2B,EAC3B,eAAe,EACf,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC"}

package/sdk/dist/namespaces/ci.d.ts

@@ -0,0 +1,21 @@
+/** CI/OIDC federation namespace and canonical delegation helpers. */
+import type { Client } from "../kernel.js";
+import type { PlanRequest, ReleaseSpec } from "./deploy.types.js";
+import type { CiBindingRow, CiCreateBindingInput, CiDelegationValues, CiListBindingsInput, CiListBindingsResult, CiTokenExchangeInput, CiTokenExchangeResponse, NormalizedCiDelegationValues } from "./ci.types.js";
+export { CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, } from "./ci.types.js";
+export declare class Ci {
+    private readonly client;
+    constructor(client: Client);
+    createBinding(input: CiCreateBindingInput): Promise<CiBindingRow>;
+    listBindings(input: CiListBindingsInput): Promise<CiListBindingsResult>;
+    getBinding(bindingId: string): Promise<CiBindingRow>;
+    revokeBinding(bindingId: string): Promise<CiBindingRow>;
+    exchangeToken(input: CiTokenExchangeInput): Promise<CiTokenExchangeResponse>;
+}
+export declare function normalizeCiDelegationValues(values: CiDelegationValues): NormalizedCiDelegationValues;
+export declare function buildCiDelegationStatement(values: CiDelegationValues): string;
+export declare function buildCiDelegationResourceUri(values: CiDelegationValues): string;
+export declare function validateCiSubjectMatch(subject: string): string;
+export declare function validateCiNonce(nonce: string): string;
+export declare function assertCiDeployableSpec(specOrPlanBody: ReleaseSpec | PlanRequest | unknown): void;
+//# sourceMappingURL=ci.d.ts.map

package/sdk/dist/namespaces/ci.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.d.ts","sourceRoot":"","sources":["../../src/namespaces/ci.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAErE,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,KAAK,EAAE,WAAW,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EACV,YAAY,EACZ,oBAAoB,EACpB,kBAAkB,EAClB,mBAAmB,EACnB,oBAAoB,EACpB,oBAAoB,EAEpB,uBAAuB,EACvB,4BAA4B,EAC7B,MAAM,eAAe,CAAC;AAUvB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AAkBvB,qBAAa,EAAE;IACD,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAErC,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,YAAY,CAAC;IA+BjE,YAAY,CAAC,KAAK,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAcvE,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAUpD,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAUvD,aAAa,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,uBAAuB,CAAC;CAoBnF;AAED,wBAAgB,2BAA2B,CACzC,MAAM,EAAE,kBAAkB,GACzB,4BAA4B,CA4B9B;AAED,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CA2B7E;AAED,wBAAgB,4BAA4B,CAAC,MAAM,EAAE,kBAAkB,GAAG,MAAM,CAuB/E;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CA6B9D;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAQrD;AAED,wBAAgB,sBAAsB,CAAC,cAAc,EAAE,WAAW,GAAG,WAAW,GAAG,OAAO,GAAG,IAAI,CA4BhG"}

package/sdk/dist/namespaces/ci.js

@@ -0,0 +1,253 @@
+/** CI/OIDC federation namespace and canonical delegation helpers. */
+import { LocalError, Run402DeployError } from "../errors.js";
+import { CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, } from "./ci.types.js";
+export { CI_AUDIENCE, CI_GITHUB_ACTIONS_ISSUER, CI_GITHUB_ACTIONS_PROVIDER, DEFAULT_CI_DELEGATION_CHAIN_ID, V1_CI_ALLOWED_ACTIONS, V1_CI_ALLOWED_EVENTS_DEFAULT, } from "./ci.types.js";
+const TOKEN_EXCHANGE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:token-exchange";
+const TOKEN_EXCHANGE_SUBJECT_TOKEN_TYPE = "urn:ietf:params:oauth:token-type:jwt";
+const MAX_SUBJECT_MATCH_CHARS = 256;
+const MAX_RESOURCE_URI_BYTES = 4096;
+const MAX_STATEMENT_BYTES = 8192;
+const NONCE_RE = /^[0-9a-f]{16,64}$/;
+const CI_DEPLOY_SPEC_ALLOWED_KEYS = new Set([
+    "project",
+    "database",
+    "functions",
+    "site",
+    "base",
+]);
+export class Ci {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    async createBinding(input) {
+        if (input?.provider !== CI_GITHUB_ACTIONS_PROVIDER) {
+            throw new LocalError('ci.createBinding provider must be "github-actions" in v1', "creating CI binding");
+        }
+        if (!input.signed_delegation) {
+            throw new LocalError("ci.createBinding requires signed_delegation", "creating CI binding");
+        }
+        const values = normalizeCiDelegationValues(input);
+        return this.client.request("/ci/v1/bindings", {
+            method: "POST",
+            body: {
+                project_id: values.project_id,
+                provider: input.provider,
+                subject_match: values.subject_match,
+                allowed_actions: values.allowed_actions,
+                allowed_events: values.allowed_events,
+                github_repository_id: values.github_repository_id,
+                expires_at: values.expires_at,
+                nonce: values.nonce,
+                signed_delegation: input.signed_delegation,
+            },
+            context: "creating CI binding",
+        });
+    }
+    async listBindings(input) {
+        if (!input?.project) {
+            throw new LocalError("ci.listBindings requires { project }", "listing CI bindings");
+        }
+        const qs = new URLSearchParams({ project: input.project });
+        return this.client.request(`/ci/v1/bindings?${qs.toString()}`, { context: "listing CI bindings" });
+    }
+    async getBinding(bindingId) {
+        if (!bindingId) {
+            throw new LocalError("ci.getBinding requires a binding id", "getting CI binding");
+        }
+        return this.client.request(`/ci/v1/bindings/${encodeURIComponent(bindingId)}`, { context: "getting CI binding" });
+    }
+    async revokeBinding(bindingId) {
+        if (!bindingId) {
+            throw new LocalError("ci.revokeBinding requires a binding id", "revoking CI binding");
+        }
+        return this.client.request(`/ci/v1/bindings/${encodeURIComponent(bindingId)}/revoke`, { method: "POST", context: "revoking CI binding" });
+    }
+    async exchangeToken(input) {
+        if (!input?.project_id || !input.subject_token) {
+            throw new LocalError("ci.exchangeToken requires { project_id, subject_token }", "exchanging CI OIDC token");
+        }
+        const body = {
+            grant_type: TOKEN_EXCHANGE_GRANT_TYPE,
+            subject_token: input.subject_token,
+            subject_token_type: TOKEN_EXCHANGE_SUBJECT_TOKEN_TYPE,
+            project_id: input.project_id,
+        };
+        return this.client.request("/ci/v1/token-exchange", {
+            method: "POST",
+            body,
+            withAuth: false,
+            context: "exchanging CI OIDC token",
+        });
+    }
+}
+export function normalizeCiDelegationValues(values) {
+    if (!values || typeof values !== "object") {
+        throw new LocalError("CI delegation values must be an object", "validating CI delegation");
+    }
+    if (!values.project_id) {
+        throw new LocalError("CI delegation project_id is required", "validating CI delegation");
+    }
+    const subject_match = validateCiSubjectMatch(values.subject_match);
+    const nonce = validateCiNonce(values.nonce);
+    const allowed_actions = normalizeAllowedActions(values.allowed_actions);
+    const allowed_events = normalizeAllowedList(values.allowed_events, "allowed_events");
+    if (allowed_events.length === 0) {
+        throw new LocalError("CI delegation allowed_events must contain at least one event", "validating CI delegation");
+    }
+    return {
+        project_id: values.project_id,
+        issuer: values.issuer ?? CI_GITHUB_ACTIONS_ISSUER,
+        audience: values.audience ?? CI_AUDIENCE,
+        subject_match,
+        allowed_actions,
+        allowed_events,
+        expires_at: values.expires_at ?? null,
+        github_repository_id: values.github_repository_id ?? null,
+        nonce,
+    };
+}
+export function buildCiDelegationStatement(values) {
+    const v = normalizeCiDelegationValues(values);
+    const statement = [
+        `Authorize GitHub Actions workflows whose OIDC subject matches ${v.subject_match} to deploy to run402 project ${v.project_id}.`,
+        "",
+        "The workflows can:",
+        "  - deploy function code that runs with this project's runtime authority, including the project's service-role key, the adminDb() bypass-RLS surface, and configured runtime secrets read via process.env;",
+        "  - deploy database migrations, RLS/expose changes, and schema-altering SQL via spec.database.",
+        "",
+        "The workflows cannot directly call secrets, domain, subdomain, lifecycle, billing, contracts, or faucet endpoints. They cannot ship spec.secrets, spec.subdomains, spec.routes, spec.checks, or non-current spec.base.",
+        "",
+        `Audience: ${v.audience}`,
+        `Allowed events: ${v.allowed_events.join(",")}`,
+        `Repository ID: ${v.github_repository_id ?? "none-soft-bound"}`,
+        `Expires: ${v.expires_at ?? "never"}`,
+        `Nonce: ${v.nonce}`,
+        "",
+        "Revoke at any time via the run402 CLI or POST /ci/v1/bindings/:id/revoke. Revocation stops future CI gateway requests but does not undo already-deployed code, stop in-flight deploy operations, rotate exfiltrated keys, or remove deployed functions. Recovery from a compromise: revoke the binding, then SIWE-deploy a known-good release that overwrites the malicious code, and rotate any service-role key the deployed code may have read.",
+    ].join("\n");
+    if (new TextEncoder().encode(statement).byteLength > MAX_STATEMENT_BYTES) {
+        throw new LocalError(`CI delegation Statement exceeds ${MAX_STATEMENT_BYTES} bytes`, "building CI delegation statement");
+    }
+    return statement;
+}
+export function buildCiDelegationResourceUri(values) {
+    const v = normalizeCiDelegationValues(values);
+    const parts = [
+        `project_id=${encodeRfc3986(v.project_id)}`,
+        `issuer=${encodeRfc3986(v.issuer)}`,
+        `audience=${encodeRfc3986(v.audience)}`,
+        `subject_match=${encodeRfc3986(v.subject_match)}`,
+        `allowed_actions=${v.allowed_actions.map(encodeRfc3986).join(",")}`,
+        `allowed_events=${v.allowed_events.map(encodeRfc3986).join(",")}`,
+    ];
+    if (v.expires_at !== null)
+        parts.push(`expires_at=${encodeRfc3986(v.expires_at)}`);
+    if (v.github_repository_id !== null) {
+        parts.push(`github_repository_id=${encodeRfc3986(v.github_repository_id)}`);
+    }
+    parts.push(`nonce=${encodeRfc3986(v.nonce)}`);
+    const uri = `run402-ci-delegation:v1?${parts.join("&")}`;
+    if (new TextEncoder().encode(uri).byteLength > MAX_RESOURCE_URI_BYTES) {
+        throw new LocalError(`CI delegation Resource URI exceeds ${MAX_RESOURCE_URI_BYTES} bytes`, "building CI delegation resource URI");
+    }
+    return uri;
+}
+export function validateCiSubjectMatch(subject) {
+    if (typeof subject !== "string" || subject.length === 0) {
+        throw new LocalError("CI subject_match must be a non-empty string", "validating CI subject");
+    }
+    if (subject.length > MAX_SUBJECT_MATCH_CHARS) {
+        throw new LocalError(`CI subject_match must be ${MAX_SUBJECT_MATCH_CHARS} characters or fewer`, "validating CI subject");
+    }
+    if (/[\x00-\x1f\x7f]/.test(subject)) {
+        throw new LocalError("CI subject_match must not contain control characters", "validating CI subject");
+    }
+    const firstWildcard = subject.indexOf("*");
+    if (firstWildcard >= 0) {
+        if (subject === "*") {
+            throw new LocalError("CI subject_match cannot be a bare wildcard", "validating CI subject");
+        }
+        if (firstWildcard !== subject.length - 1) {
+            throw new LocalError("CI subject_match wildcard is only allowed as the final character", "validating CI subject");
+        }
+        if (subject.indexOf("*", firstWildcard + 1) >= 0) {
+            throw new LocalError("CI subject_match can contain at most one wildcard", "validating CI subject");
+        }
+    }
+    return subject;
+}
+export function validateCiNonce(nonce) {
+    if (typeof nonce !== "string" || !NONCE_RE.test(nonce)) {
+        throw new LocalError("CI delegation nonce must be lowercase hex between 16 and 64 characters", "validating CI nonce");
+    }
+    return nonce;
+}
+export function assertCiDeployableSpec(specOrPlanBody) {
+    const { spec, manifestRef } = unwrapSpecOrPlanBody(specOrPlanBody);
+    if (manifestRef !== undefined && manifestRef !== null) {
+        throwCiDeploySpecError("manifest_ref", "CI deploys must use inline specs under the gateway body cap; manifest_ref is not allowed.");
+    }
+    if (!spec || typeof spec !== "object" || Array.isArray(spec)) {
+        throwCiDeploySpecError("spec", "CI deploy requires a ReleaseSpec object.");
+    }
+    const obj = spec;
+    for (const key of Object.keys(obj)) {
+        if (!CI_DEPLOY_SPEC_ALLOWED_KEYS.has(key)) {
+            throwCiDeploySpecError(key, `CI deploy cannot ship spec.${key}; only project, database, functions, site, and base:{release:"current"} are allowed.`);
+        }
+    }
+    if (Object.prototype.hasOwnProperty.call(obj, "base") && !isCurrentBase(obj.base)) {
+        throwCiDeploySpecError("base", 'CI deploy base must be absent or exactly { release: "current" }.');
+    }
+}
+function normalizeAllowedActions(values) {
+    const actions = normalizeAllowedList(values, "allowed_actions");
+    if (actions.length !== 1 || actions[0] !== "deploy") {
+        throw new LocalError('CI delegation allowed_actions must be exactly ["deploy"] in v1', "validating CI delegation");
+    }
+    return ["deploy"];
+}
+function normalizeAllowedList(values, field) {
+    if (!Array.isArray(values)) {
+        throw new LocalError(`CI delegation ${field} must be an array`, "validating CI delegation");
+    }
+    const cleaned = values.map((value) => {
+        if (typeof value !== "string" || value.length === 0) {
+            throw new LocalError(`CI delegation ${field} must contain only non-empty strings`, "validating CI delegation");
+        }
+        return value;
+    });
+    return Array.from(new Set(cleaned)).sort();
+}
+function encodeRfc3986(value) {
+    return encodeURIComponent(value).replace(/[!'()*]/g, (char) => `%${char.charCodeAt(0).toString(16).toUpperCase()}`);
+}
+function unwrapSpecOrPlanBody(value) {
+    if (value &&
+        typeof value === "object" &&
+        !Array.isArray(value) &&
+        "spec" in value &&
+        !("project" in value)) {
+        const body = value;
+        return { spec: body.spec, manifestRef: body.manifest_ref };
+    }
+    return { spec: value };
+}
+function isCurrentBase(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    const obj = value;
+    const keys = Object.keys(obj);
+    return keys.length === 1 && obj.release === "current";
+}
+function throwCiDeploySpecError(resource, message) {
+    throw new Run402DeployError(message, {
+        code: "forbidden_spec_field",
+        phase: "validate",
+        resource,
+        retryable: false,
+        context: "validating CI deploy spec",
+    });
+}
+//# sourceMappingURL=ci.js.map

package/sdk/dist/namespaces/ci.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.js","sourceRoot":"","sources":["../../src/namespaces/ci.ts"],"names":[],"mappings":"AAAA,qEAAqE;AAGrE,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAa7D,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,0BAA0B,GAI3B,MAAM,eAAe,CAAC;AAEvB,OAAO,EACL,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,GAC7B,MAAM,eAAe,CAAC;AAEvB,MAAM,yBAAyB,GAC7B,iDAA0D,CAAC;AAC7D,MAAM,iCAAiC,GACrC,sCAA+C,CAAC;AAClD,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACjC,MAAM,QAAQ,GAAG,mBAAmB,CAAC;AACrC,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,SAAS;IACT,UAAU;IACV,WAAW;IACX,MAAM;IACN,MAAM;CACP,CAAC,CAAC;AAEH,MAAM,OAAO,EAAE;IACgB;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C,KAAK,CAAC,aAAa,CAAC,KAA2B;QAC7C,IAAI,KAAK,EAAE,QAAQ,KAAK,0BAA0B,EAAE,CAAC;YACnD,MAAM,IAAI,UAAU,CAClB,0DAA0D,EAC1D,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,KAAK,CAAC,iBAAiB,EAAE,CAAC;YAC7B,MAAM,IAAI,UAAU,CAClB,6CAA6C,EAC7C,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAG,2BAA2B,CAAC,KAAK,CAAC,CAAC;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAe,iBAAiB,EAAE;YAC1D,MAAM,EAAE,MAAM;YACd,IAAI,EAAE;gBACJ,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,QAAQ,EAAE,KAAK,CAAC,QAAQ;gBACxB,aAAa,EAAE,MAAM,CAAC,aAAa;gBACnC,eAAe,EAAE,MAAM,CAAC,eAAe;gBACvC,cAAc,EAAE,MAAM,CAAC,cAAc;gBACrC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB;gBACjD,UAAU,EAAE,MAAM,CAAC,UAAU;gBAC7B,KAAK,EAAE,MAAM,CAAC,KAAK;gBACnB,iBAAiB,EAAE,KAAK,CAAC,iBAAiB;aAC3C;YACD,OAAO,EAAE,qBAAqB;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,KAA0B;QAC3C,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC;YACpB,MAAM,IAAI,UAAU,CAClB,sCAAsC,EACtC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,EAAE,GAAG,IAAI,eAAe,CAAC,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;QAC3D,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,mBAAmB,EAAE,CAAC,QAAQ,EAAE,EAAE,EAClC,EAAE,OAAO,EAAE,qBAAqB,EAAE,CACnC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,UAAU,CAAC,SAAiB;QAChC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,qCAAqC,EAAE,oBAAoB,CAAC,CAAC;QACpF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,EAAE,EAClD,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAClC,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,SAAiB;QACnC,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,MAAM,IAAI,UAAU,CAAC,wCAAwC,EAAE,qBAAqB,CAAC,CAAC;QACxF,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,mBAAmB,kBAAkB,CAAC,SAAS,CAAC,SAAS,EACzD,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,qBAAqB,EAAE,CACnD,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,KAA2B;QAC7C,IAAI,CAAC,KAAK,EAAE,UAAU,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,UAAU,CAClB,yDAAyD,EACzD,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAA+B;YACvC,UAAU,EAAE,yBAAyB;YACrC,aAAa,EAAE,KAAK,CAAC,aAAa;YAClC,kBAAkB,EAAE,iCAAiC;YACrD,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACF,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAA0B,uBAAuB,EAAE;YAC3E,MAAM,EAAE,MAAM;YACd,IAAI;YACJ,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,0BAA0B;SACpC,CAAC,CAAC;IACL,CAAC;CACF;AAED,MAAM,UAAU,2BAA2B,CACzC,MAA0B;IAE1B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,UAAU,CAAC,wCAAwC,EAAE,0BAA0B,CAAC,CAAC;IAC7F,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,IAAI,UAAU,CAAC,sCAAsC,EAAE,0BAA0B,CAAC,CAAC;IAC3F,CAAC;IACD,MAAM,aAAa,GAAG,sBAAsB,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IAC5C,MAAM,eAAe,GAAG,uBAAuB,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IACxE,MAAM,cAAc,GAAG,oBAAoB,CAAC,MAAM,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAC;IACrF,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,UAAU,CAClB,8DAA8D,EAC9D,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO;QACL,UAAU,EAAE,MAAM,CAAC,UAAU;QAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,wBAAwB;QACjD,QAAQ,EAAE,MAAM,CAAC,QAAQ,IAAI,WAAW;QACxC,aAAa;QACb,eAAe;QACf,cAAc;QACd,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;QACrC,oBAAoB,EAAE,MAAM,CAAC,oBAAoB,IAAI,IAAI;QACzD,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CAAC,MAA0B;IACnE,MAAM,CAAC,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,SAAS,GAAG;QAChB,iEAAiE,CAAC,CAAC,aAAa,gCAAgC,CAAC,CAAC,UAAU,GAAG;QAC/H,EAAE;QACF,oBAAoB;QACpB,4MAA4M;QAC5M,gGAAgG;QAChG,EAAE;QACF,wNAAwN;QACxN,EAAE;QACF,aAAa,CAAC,CAAC,QAAQ,EAAE;QACzB,mBAAmB,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QAC/C,kBAAkB,CAAC,CAAC,oBAAoB,IAAI,iBAAiB,EAAE;QAC/D,YAAY,CAAC,CAAC,UAAU,IAAI,OAAO,EAAE;QACrC,UAAU,CAAC,CAAC,KAAK,EAAE;QACnB,EAAE;QACF,obAAob;KACrb,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,UAAU,GAAG,mBAAmB,EAAE,CAAC;QACzE,MAAM,IAAI,UAAU,CAClB,mCAAmC,mBAAmB,QAAQ,EAC9D,kCAAkC,CACnC,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAA0B;IACrE,MAAM,CAAC,GAAG,2BAA2B,CAAC,MAAM,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG;QACZ,cAAc,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE;QAC3C,UAAU,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE;QACnC,YAAY,aAAa,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE;QACvC,iBAAiB,aAAa,CAAC,CAAC,CAAC,aAAa,CAAC,EAAE;QACjD,mBAAmB,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;QACnE,kBAAkB,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;KAClE,CAAC;IACF,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI;QAAE,KAAK,CAAC,IAAI,CAAC,cAAc,aAAa,CAAC,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;IACnF,IAAI,CAAC,CAAC,oBAAoB,KAAK,IAAI,EAAE,CAAC;QACpC,KAAK,CAAC,IAAI,CAAC,wBAAwB,aAAa,CAAC,CAAC,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9E,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,SAAS,aAAa,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC9C,MAAM,GAAG,GAAG,2BAA2B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;IACzD,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,GAAG,sBAAsB,EAAE,CAAC;QACtE,MAAM,IAAI,UAAU,CAClB,sCAAsC,sBAAsB,QAAQ,EACpE,qCAAqC,CACtC,CAAC;IACJ,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,UAAU,CAAC,6CAA6C,EAAE,uBAAuB,CAAC,CAAC;IAC/F,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,uBAAuB,EAAE,CAAC;QAC7C,MAAM,IAAI,UAAU,CAClB,4BAA4B,uBAAuB,sBAAsB,EACzE,uBAAuB,CACxB,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,UAAU,CAAC,sDAAsD,EAAE,uBAAuB,CAAC,CAAC;IACxG,CAAC;IACD,MAAM,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,aAAa,IAAI,CAAC,EAAE,CAAC;QACvB,IAAI,OAAO,KAAK,GAAG,EAAE,CAAC;YACpB,MAAM,IAAI,UAAU,CAAC,4CAA4C,EAAE,uBAAuB,CAAC,CAAC;QAC9F,CAAC;QACD,IAAI,aAAa,KAAK,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,MAAM,IAAI,UAAU,CAClB,kEAAkE,EAClE,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,IAAI,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,aAAa,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,UAAU,CAAC,mDAAmD,EAAE,uBAAuB,CAAC,CAAC;QACrG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,KAAa;IAC3C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,UAAU,CAClB,wEAAwE,EACxE,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,cAAmD;IACxF,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;IACnE,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI,EAAE,CAAC;QACtD,sBAAsB,CACpB,cAAc,EACd,2FAA2F,CAC5F,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,sBAAsB,CAAC,MAAM,EAAE,0CAA0C,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,2BAA2B,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1C,sBAAsB,CACpB,GAAG,EACH,8BAA8B,GAAG,sFAAsF,CACxH,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClF,sBAAsB,CACpB,MAAM,EACN,kEAAkE,CACnE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,uBAAuB,CAAC,MAAqC;IACpE,MAAM,OAAO,GAAG,oBAAoB,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QACpD,MAAM,IAAI,UAAU,CAClB,gEAAgE,EAChE,0BAA0B,CAC3B,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,QAAQ,CAAC,CAAC;AACpB,CAAC;AAED,SAAS,oBAAoB,CAAC,MAAqC,EAAE,KAAa;IAChF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,UAAU,CAAC,iBAAiB,KAAK,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;IAC9F,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,UAAU,CAClB,iBAAiB,KAAK,sCAAsC,EAC5D,0BAA0B,CAC3B,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC,CAAC;IACH,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,KAAa;IAClC,OAAO,kBAAkB,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,EAAE,CAC5D,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CACpD,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAC3B,KAA0C;IAE1C,IACE,KAAK;QACL,OAAO,KAAK,KAAK,QAAQ;QACzB,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACrB,MAAM,IAAI,KAAK;QACf,CAAC,CAAC,SAAS,IAAI,KAAK,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,GAAG,KAAmD,CAAC;QACjE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,CAAC,YAAY,EAAE,CAAC;IAC7D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACzB,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,sBAAsB,CAAC,QAAgB,EAAE,OAAe;IAC/D,MAAM,IAAI,iBAAiB,CAAC,OAAO,EAAE;QACnC,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,UAAU;QACjB,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,OAAO,EAAE,2BAA2B;KACrC,CAAC,CAAC;AACL,CAAC"}

package/sdk/dist/namespaces/ci.types.d.ts

@@ -0,0 +1,91 @@
+/** Types and constants for GitHub Actions OIDC federation (`/ci/v1/*`). */
+export declare const CI_GITHUB_ACTIONS_PROVIDER: "github-actions";
+export declare const CI_GITHUB_ACTIONS_ISSUER: "https://token.actions.githubusercontent.com";
+export declare const CI_AUDIENCE: "https://api.run402.com";
+export declare const DEFAULT_CI_DELEGATION_CHAIN_ID: "eip155:84532";
+export declare const V1_CI_ALLOWED_ACTIONS: readonly ["deploy"];
+export declare const V1_CI_ALLOWED_EVENTS_DEFAULT: readonly ["push", "workflow_dispatch"];
+export type CiProvider = typeof CI_GITHUB_ACTIONS_PROVIDER;
+export type CiAllowedAction = (typeof V1_CI_ALLOWED_ACTIONS)[number];
+export type CiAllowedEvent = (typeof V1_CI_ALLOWED_EVENTS_DEFAULT)[number] | (string & {});
+export type CiBindingErrorCode = "nonce_replay" | "delegation_statement_mismatch" | "delegation_resource_uri_mismatch" | "signer_mismatch" | "delegation_oversized" | "delegation_parse_failed" | "delegation_signature_invalid" | "delegation_nonce_invalid" | "duplicate";
+export type CiTokenExchangeErrorCode = "invalid_request" | "invalid_token" | "access_denied" | "event_not_allowed" | "repository_id_mismatch" | "ambiguous_binding";
+export type CiDeployErrorCode = "payment_required" | "insufficient_scope" | "forbidden_spec_field" | "forbidden_plan";
+export type CiErrorCode = CiBindingErrorCode | CiTokenExchangeErrorCode | CiDeployErrorCode | (string & {});
+export interface ParsedDelegation {
+    payload: Record<string, unknown>;
+    raw: string;
+    signer: string;
+    verified_at: string;
+}
+export interface CiBindingRow {
+    id: string;
+    project_id: string;
+    issuer: string;
+    subject_match: string;
+    allowed_actions: string[];
+    allowed_events: string[];
+    github_repository_id: string | null;
+    created_by: string;
+    nonce: string;
+    created_sig?: ParsedDelegation | null;
+    created_at: string;
+    expires_at: string | null;
+    revoked_at: string | null;
+    last_used_at: string | null;
+    use_count: number;
+}
+export interface CiCreateBindingInput {
+    project_id: string;
+    provider: CiProvider;
+    subject_match: string;
+    allowed_actions: readonly CiAllowedAction[];
+    allowed_events: readonly CiAllowedEvent[];
+    github_repository_id?: string | null;
+    expires_at?: string | null;
+    nonce: string;
+    signed_delegation: string;
+}
+export interface CiListBindingsInput {
+    project: string;
+}
+export interface CiListBindingsResult {
+    bindings: CiBindingRow[];
+}
+export interface CiTokenExchangeInput {
+    project_id: string;
+    subject_token: string;
+}
+export interface CiTokenExchangeRequestBody extends CiTokenExchangeInput {
+    grant_type: "urn:ietf:params:oauth:grant-type:token-exchange";
+    subject_token_type: "urn:ietf:params:oauth:token-type:jwt";
+}
+export interface CiTokenExchangeResponse {
+    access_token: string;
+    token_type: "Bearer" | (string & {});
+    expires_in: number;
+    scope: string;
+}
+export interface CiDelegationValues {
+    project_id: string;
+    issuer?: string;
+    audience?: string;
+    subject_match: string;
+    allowed_actions: readonly string[];
+    allowed_events: readonly string[];
+    expires_at?: string | null;
+    github_repository_id?: string | null;
+    nonce: string;
+}
+export interface NormalizedCiDelegationValues {
+    project_id: string;
+    issuer: string;
+    audience: string;
+    subject_match: string;
+    allowed_actions: CiAllowedAction[];
+    allowed_events: string[];
+    expires_at: string | null;
+    github_repository_id: string | null;
+    nonce: string;
+}
+//# sourceMappingURL=ci.types.d.ts.map

package/sdk/dist/namespaces/ci.types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.types.d.ts","sourceRoot":"","sources":["../../src/namespaces/ci.types.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,eAAO,MAAM,0BAA0B,EAAG,gBAAyB,CAAC;AACpE,eAAO,MAAM,wBAAwB,EAAG,6CAAsD,CAAC;AAC/F,eAAO,MAAM,WAAW,EAAG,wBAAiC,CAAC;AAC7D,eAAO,MAAM,8BAA8B,EAAG,cAAuB,CAAC;AAEtE,eAAO,MAAM,qBAAqB,qBAAsB,CAAC;AACzD,eAAO,MAAM,4BAA4B,wCAAyC,CAAC;AAEnF,MAAM,MAAM,UAAU,GAAG,OAAO,0BAA0B,CAAC;AAC3D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,qBAAqB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,MAAM,MAAM,cAAc,GACtB,CAAC,OAAO,4BAA4B,CAAC,CAAC,MAAM,CAAC,GAC7C,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,MAAM,kBAAkB,GAC1B,cAAc,GACd,+BAA+B,GAC/B,kCAAkC,GAClC,iBAAiB,GACjB,sBAAsB,GACtB,yBAAyB,GACzB,8BAA8B,GAC9B,0BAA0B,GAC1B,WAAW,CAAC;AAEhB,MAAM,MAAM,wBAAwB,GAChC,iBAAiB,GACjB,eAAe,GACf,eAAe,GACf,mBAAmB,GACnB,wBAAwB,GACxB,mBAAmB,CAAC;AAExB,MAAM,MAAM,iBAAiB,GACzB,kBAAkB,GAClB,oBAAoB,GACpB,sBAAsB,GACtB,gBAAgB,CAAC;AAErB,MAAM,MAAM,WAAW,GACnB,kBAAkB,GAClB,wBAAwB,GACxB,iBAAiB,GACjB,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;AAElB,MAAM,WAAW,gBAAgB;IAC/B,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,CAAC,EAAE,gBAAgB,GAAG,IAAI,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,UAAU,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,SAAS,eAAe,EAAE,CAAC;IAC5C,cAAc,EAAE,SAAS,cAAc,EAAE,CAAC;IAC1C,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,oBAAoB;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,0BAA2B,SAAQ,oBAAoB;IACtE,UAAU,EAAE,iDAAiD,CAAC;IAC9D,kBAAkB,EAAE,sCAAsC,CAAC;CAC5D;AAED,MAAM,WAAW,uBAAuB;IACtC,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,QAAQ,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IACnC,cAAc,EAAE,SAAS,MAAM,EAAE,CAAC;IAClC,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,oBAAoB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,4BAA4B;IAC3C,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,eAAe,EAAE,eAAe,EAAE,CAAC;IACnC,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,oBAAoB,EAAE,MAAM,GAAG,IAAI,CAAC;IACpC,KAAK,EAAE,MAAM,CAAC;CACf"}

package/sdk/dist/namespaces/ci.types.js

@@ -0,0 +1,8 @@
+/** Types and constants for GitHub Actions OIDC federation (`/ci/v1/*`). */
+export const CI_GITHUB_ACTIONS_PROVIDER = "github-actions";
+export const CI_GITHUB_ACTIONS_ISSUER = "https://token.actions.githubusercontent.com";
+export const CI_AUDIENCE = "https://api.run402.com";
+export const DEFAULT_CI_DELEGATION_CHAIN_ID = "eip155:84532";
+export const V1_CI_ALLOWED_ACTIONS = ["deploy"];
+export const V1_CI_ALLOWED_EVENTS_DEFAULT = ["push", "workflow_dispatch"];
+//# sourceMappingURL=ci.types.js.map

package/sdk/dist/namespaces/ci.types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci.types.js","sourceRoot":"","sources":["../../src/namespaces/ci.types.ts"],"names":[],"mappings":"AAAA,2EAA2E;AAE3E,MAAM,CAAC,MAAM,0BAA0B,GAAG,gBAAyB,CAAC;AACpE,MAAM,CAAC,MAAM,wBAAwB,GAAG,6CAAsD,CAAC;AAC/F,MAAM,CAAC,MAAM,WAAW,GAAG,wBAAiC,CAAC;AAC7D,MAAM,CAAC,MAAM,8BAA8B,GAAG,cAAuB,CAAC;AAEtE,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,QAAQ,CAAU,CAAC;AACzD,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,MAAM,EAAE,mBAAmB,CAAU,CAAC"}

package/sdk/dist/namespaces/deploy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,OAAO,KAAK,EACV,YAAY,EAKZ,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,YAAY,EAWZ,iBAAiB,EAGjB,YAAY,EACZ,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAwB3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IA4B9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAIxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;KACb,GACL,OAAO,CAAC,YAAY,CAAC;IAMxB;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAQ7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,kBAAkB,CAAC;IAsB9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMrD;;OAEG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAMjE;AAqmBD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}
+{"version":3,"file":"deploy.d.ts","sourceRoot":"","sources":["../../src/namespaces/deploy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAa3C,OAAO,KAAK,EACV,YAAY,EAKZ,WAAW,EACX,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,YAAY,EAWZ,iBAAiB,EAGjB,YAAY,EACZ,WAAW,EACX,YAAY,EACb,MAAM,mBAAmB,CAAC;AAwB3B,qBAAa,MAAM;IACL,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,YAAY,CAAC;IA4B9E;;;OAGG;IACH,KAAK,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,GAAE,YAAiB,GAAG,OAAO,CAAC,eAAe,CAAC;IAI3E;;;;OAIG;IACG,IAAI,CACR,IAAI,EAAE,WAAW,EACjB,IAAI,GAAE;QAAE,cAAc,CAAC,EAAE,MAAM,CAAA;KAAO,GACrC,OAAO,CAAC;QAAE,IAAI,EAAE,YAAY,CAAC;QAAC,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAA;KAAE,CAAC;IAIxE;;;;;OAKG;IACG,MAAM,CACV,IAAI,EAAE,YAAY,EAClB,IAAI,EAAE;QACJ,OAAO,EAAE,MAAM,CAAC;QAChB,WAAW,EAAE,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QACrC,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;KACxC,GACA,OAAO,CAAC,IAAI,CAAC;IAWhB;;;;;OAKG;IACG,MAAM,CACV,MAAM,EAAE,MAAM,EACd,IAAI,GAAE;QACJ,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QACvC,cAAc,CAAC,EAAE,MAAM,CAAC;QACxB,OAAO,CAAC,EAAE,MAAM,CAAC;KACb,GACL,OAAO,CAAC,YAAY,CAAC;IAMxB;;;;;;;;;OASG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;QAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GACtE,OAAO,CAAC,YAAY,CAAC;IAqBxB;;;;OAIG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,GAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAA;KAAO,GAC9B,OAAO,CAAC,iBAAiB,CAAC;IAQ7B;;;;;;OAMG;IACG,IAAI,CACR,IAAI,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GACjD,OAAO,CAAC,kBAAkB,CAAC;IAsB9B;;;;;;;;OAQG;IACG,MAAM,CACV,WAAW,EAAE,MAAM,EACnB,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,GACxB,OAAO,CAAC,oBAAoB,CAAC;IAmBhC;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAMrD;;OAEG;IACG,IAAI,CAAC,IAAI,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,OAAO,CAAC;CAMjE;AAqnBD;;;;;GAKG;AACH,MAAM,WAAW,UAAU;IACzB,IAAI,OAAO,CAAC,UAAU,CAAC,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;CACtB"}

package/sdk/dist/namespaces/deploy.js

@@ -18,7 +18,9 @@
  * See `unified-deploy` and `cas-content` capability specs for normative
  * behavior; this file is the implementation.
  */
-import { ApiError, LocalError, NetworkError, Run402DeployError, } from "../errors.js";
+import { isCiSessionCredentials } from "../ci-credentials.js";
+import { assertCiDeployableSpec } from "./ci.js";
+import { ApiError, LocalError, NetworkError, PaymentRequired, Run402DeployError, Unauthorized, } from "../errors.js";
 // ─── Constants ───────────────────────────────────────────────────────────────
 const PLAN_BODY_LIMIT_BYTES = 5 * 1024 * 1024;
 const COMMIT_POLL_INITIAL_MS = 1_000;
@@ -212,6 +214,9 @@ export class Deploy {
 }
 // ─── Internal pipeline ───────────────────────────────────────────────────────
 async function planInternal(client, spec, idempotencyKey) {
+    const ciCredentials = isCiClient(client);
+    if (ciCredentials)
+        assertCiDeployableSpec(spec);
     validateSpec(spec);
     const { normalized, byteReaders } = await normalizeReleaseSpec(client, spec);
     // The gateway expects { spec, manifest_ref?, idempotency_key? } with
@@ -228,6 +233,15 @@ async function planInternal(client, spec, idempotencyKey) {
         body = inlineBody;
     }
     else {
+        if (ciCredentials) {
+            throw new Run402DeployError("CI deploys must use inline specs under the gateway body cap; the normalized deploy plan would require manifest_ref.", {
+                code: "forbidden_spec_field",
+                phase: "validate",
+                resource: "manifest_ref",
+                retryable: false,
+                context: "validating CI deploy spec",
+            });
+        }
         // Upload the normalized manifest itself as a CAS object so the gateway
         // can pick it up via `manifest_ref`. The body still carries a minimal
         // `spec` so the gateway has the project for auth + plan persistence.
@@ -285,6 +299,7 @@ async function uploadMissing(client, projectId, presence, byteReaders, emit) {
     // refs, it issues an upload session per ref with presigned PUT URLs,
     // then we PUT the bytes and commit the content plan.
     const headers = await apikeyHeaders(client, projectId);
+    const ciCredentials = isCiClient(client);
     const contentRequest = needsUpload.map((p) => {
         const reader = byteReaders.get(p.sha256);
         return {
@@ -296,7 +311,9 @@ async function uploadMissing(client, projectId, presence, byteReaders, emit) {
     const planRes = await client.request("/content/v1/plans", {
         method: "POST",
         headers,
-        body: { content: contentRequest },
+        body: ciCredentials
+            ? { project_id: projectId, content: contentRequest }
+            : { content: contentRequest },
         context: "planning content upload",
     });
     const total = planRes.missing.length;
@@ -313,26 +330,25 @@ async function uploadMissing(client, projectId, presence, byteReaders, emit) {
         }
         const bytes = await reader();
         await uploadOneWithRetry(client.fetch, session, bytes);
-        // Per-session completion — promotes the staged object to CAS via
-        // services/cas-promote.ts. The plan-level `/content/v1/plans/:id/commit`
-        // call below is the plan-level finalize; per-session promotion happens
-        // here through the existing /storage/v1/uploads/:id/complete handler,
-        // which knows how to handle `kind='cas'` sessions and write the
-        // internal.content_objects + internal.plan_claims rows the deploy
-        // commit's FK constraints rely on.
-        const completeBody = {};
-        if (session.mode === "multipart" && session.parts.length > 1) {
-            // Multipart completion needs per-part ETags. The SDK doesn't capture
-            // ETags during the PUT loop today (it would need a multi-PUT
-            // helper); for the common single-PUT case below this is empty.
-            // TODO: collect part ETags during uploadOne for true multipart.
+        if (!ciCredentials) {
+            // Per-session completion — legacy non-CI promotion path via
+            // /storage/v1/uploads/:id/complete. CI sessions skip this route because
+            // the gateway contract only allows /content/v1/plans*; under CI the
+            // plan-level content commit performs the CAS promotion.
+            const completeBody = {};
+            if (session.mode === "multipart" && session.parts.length > 1) {
+                // Multipart completion needs per-part ETags. The SDK doesn't capture
+                // ETags during the PUT loop today (it would need a multi-PUT
+                // helper); for the common single-PUT case below this is empty.
+                // TODO: collect part ETags during uploadOne for true multipart.
+            }
+            await client.request(`/storage/v1/uploads/${encodeURIComponent(session.upload_id)}/complete`, {
+                method: "POST",
+                headers,
+                body: completeBody,
+                context: "completing content upload session",
+            });
         }
-        await client.request(`/storage/v1/uploads/${encodeURIComponent(session.upload_id)}/complete`, {
-            method: "POST",
-            headers,
-            body: completeBody,
-            context: "completing content upload session",
-        });
         done += 1;
         emit({
             type: "content.upload.progress",
@@ -1043,11 +1059,16 @@ async function uploadInlineCas(client, projectId, bytes, contentType) {
  * projects in any of today's other apikey-auth tools).
  */
 async function apikeyHeaders(client, projectId) {
+    if (isCiClient(client))
+        return {};
     const project = await client.getProject(projectId);
     if (!project)
         return {};
     return { apikey: project.anon_key };
 }
+function isCiClient(client) {
+    return isCiSessionCredentials(client.credentials);
+}
 function makeEmitter(cb) {
     if (!cb)
         return () => { };
@@ -1199,6 +1220,9 @@ function translateDeployError(err, phase, planId, operationId) {
     // Re-throw other Run402Error subclasses (PaymentRequired, Unauthorized, etc.)
     // as-is — the consumer handles them at a different layer than
     // deploy-state-machine errors.
+    if (err instanceof PaymentRequired || err instanceof Unauthorized) {
+        throw err;
+    }
     if (err instanceof Error) {
         return new Run402DeployError(err.message, {
             code: "INTERNAL_ERROR",