run402 2.29.0 → 2.31.0

package/cli.mjs

@@ -48,6 +48,7 @@ Commands:
   billing     Email billing accounts, Stripe tier checkout, email packs
   contracts   KMS contract wallets ($0.04/day rental + $0.000005/sign)
   agent       Manage agent identity (contact info)
+  operator    Operator (human/email) session — login, then overview across your wallets
   service     Run402 service health and availability (status, health)
   cache       Inspect and invalidate the SSR origin cache (inspect, invalidate)
   doctor      Health and config diagnostics (machine-readable with --json)
@@ -244,6 +245,11 @@ switch (cmd) {
     await run(sub, rest);
     break;
   }
+  case "operator": {
+    const { run } = await import("./lib/operator.mjs");
+    await run(sub, rest);
+    break;
+  }
   case "auth": {
     const { run } = await import("./lib/auth.mjs");
     await run(sub, rest);

package/core-dist/operator-session.js

@@ -0,0 +1,154 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync, statSync, rmSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { getConfigBaseDir } from "./config.js";
+/**
+ * Path to the cached operator session: `{base}/operator-session.json`, at the
+ * BASE config dir — NOT the per-profile dir, because the session is email-
+ * scoped and shared across all local named wallets. `RUN402_OPERATOR_SESSION_PATH`
+ * overrides for testing, mirroring `RUN402_ALLOWANCE_PATH`.
+ */
+export function getOperatorSessionPath() {
+    return process.env.RUN402_OPERATOR_SESSION_PATH || join(getConfigBaseDir(), "operator-session.json");
+}
+/**
+ * If the session file is readable by group or other (any low 0o077 bit set),
+ * tighten it to 0600 and warn once on stderr — the bearer token is as sensitive
+ * as the allowance private key. Best-effort: POSIX-only, silent elsewhere.
+ * Mirrors the self-heal in `allowance.ts`.
+ */
+function selfHealPermissions(p) {
+    if (process.platform === "win32")
+        return;
+    try {
+        const mode = statSync(p).mode & 0o777;
+        if ((mode & 0o077) !== 0) {
+            chmodSync(p, 0o600);
+            process.stderr.write(`warning: tightened permissions on ${p} from ${mode.toString(8)} to 600 (was readable by other users).\n`);
+        }
+    }
+    catch {
+        // Best-effort; never block a read on a chmod/stat failure.
+    }
+}
+/**
+ * Load the cached operator session from disk.
+ *
+ * Returns `null` for the "no session cached" cases (file absent, unreadable, or
+ * unparseable JSON) — callers treat that as "not logged in" and point at
+ * `run402 operator login`. Throws a structured `Error` when the file parses as
+ * JSON but the shape is wrong, so a corrupted cache surfaces a clear fix-it
+ * instead of a downstream `TypeError`.
+ */
+export function readOperatorSession(path) {
+    const p = path ?? getOperatorSessionPath();
+    if (!existsSync(p))
+        return null;
+    selfHealPermissions(p);
+    let raw;
+    try {
+        raw = readFileSync(p, "utf-8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // Unparseable input reads as "no session" rather than an error — consumers
+        // already handle null with a friendly "run 'run402 operator login'".
+        return null;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`operator-session.json must contain a JSON object (got ${Array.isArray(parsed) ? "array" : parsed === null ? "null" : typeof parsed}). Delete the file and run 'run402 operator login' to recreate it.`);
+    }
+    const data = parsed;
+    if (typeof data.operator_session_token !== "string" || data.operator_session_token.length === 0) {
+        throw new Error("operator-session.json missing valid 'operator_session_token'. Run 'run402 operator login' to refresh it.");
+    }
+    if (typeof data.email !== "string" || data.email.length === 0) {
+        throw new Error("operator-session.json missing valid 'email'. Run 'run402 operator login' to refresh it.");
+    }
+    if (typeof data.expires_at !== "number" || !Number.isFinite(data.expires_at)) {
+        throw new Error("operator-session.json missing valid 'expires_at'. Run 'run402 operator login' to refresh it.");
+    }
+    if (!Array.isArray(data.wallets) || data.wallets.some((w) => typeof w !== "string")) {
+        throw new Error("operator-session.json has an invalid 'wallets' list. Run 'run402 operator login' to refresh it.");
+    }
+    return {
+        operator_session_token: data.operator_session_token,
+        token_type: typeof data.token_type === "string" ? data.token_type : "Bearer",
+        email: data.email,
+        wallets: data.wallets,
+        expires_at: data.expires_at,
+        absolute_expires_at: typeof data.absolute_expires_at === "string" ? data.absolute_expires_at : "",
+    };
+}
+/** Persist an operator session atomically (temp-file + rename), mode 0600. */
+export function saveOperatorSession(data, path) {
+    const p = path ?? getOperatorSessionPath();
+    const dir = dirname(p);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.operator-session.${randomBytes(4).toString("hex")}.tmp`);
+    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+    renameSync(tmp, p);
+    chmodSync(p, 0o600);
+}
+/**
+ * Delete the cached operator session — the local half of `operator logout`.
+ * Best-effort and idempotent: a missing file is a no-op.
+ */
+export function clearOperatorSession(path) {
+    const p = path ?? getOperatorSessionPath();
+    try {
+        rmSync(p, { force: true });
+    }
+    catch {
+        // Best-effort: a failed unlink should never crash logout.
+    }
+}
+/**
+ * Whether a cached session is past its usable life. The access token
+ * (`expires_at`, ~30m) always expires before the absolute cap (~12h), so
+ * checking it is sufficient; the absolute cap is honored defensively. A small
+ * skew buffer treats a session expiring within `skewMs` as already expired, so
+ * we never send a token that dies mid-flight.
+ */
+export function isOperatorSessionExpired(session, nowMs = Date.now(), skewMs = 10_000) {
+    if (nowMs + skewMs >= session.expires_at)
+        return true;
+    if (session.absolute_expires_at) {
+        const cap = Date.parse(session.absolute_expires_at);
+        if (Number.isFinite(cap) && nowMs + skewMs >= cap)
+            return true;
+    }
+    return false;
+}
+/**
+ * Read the cached session and return it only if still usable; `null` if absent
+ * or expired. The bearer fetch path and `operator overview` use this so an
+ * expired cache surfaces as "not logged in" instead of a server 401.
+ */
+export function loadLiveOperatorSession(path, nowMs = Date.now()) {
+    const s = readOperatorSession(path);
+    if (!s)
+        return null;
+    return isOperatorSessionExpired(s, nowMs) ? null : s;
+}
+/**
+ * Map a gateway token payload (relative `expires_in`) into the cached shape
+ * (absolute `expires_at`). `nowMs` is injectable for deterministic tests.
+ */
+export function operatorSessionFromTokenResponse(resp, nowMs = Date.now()) {
+    return {
+        operator_session_token: resp.operator_session_token,
+        token_type: resp.token_type ?? "Bearer",
+        email: resp.email ?? "",
+        wallets: Array.isArray(resp.wallets) ? resp.wallets.filter((w) => typeof w === "string") : [],
+        expires_at: nowMs + (typeof resp.expires_in === "number" ? resp.expires_in : 0) * 1000,
+        absolute_expires_at: resp.absolute_expires_at ?? "",
+    };
+}
+//# sourceMappingURL=operator-session.js.map

package/lib/auth.mjs

@@ -24,7 +24,7 @@ Subcommands:
   set-password --token <bearer> --new <password> [--current <password>] [--project <id>]
     Change, reset, or set a user's password. Requires the user's access_token.
 
-  settings [--allow-password-set <true|false>] [--preferred <method|null>] [--public-signup <policy>] [--require-admin-passkey <true|false>] [--project <id>]
+  settings [--allow-password-set <true|false>] [--preferred <method|null>] [--public-signup <policy>] [--require-admin-passkey <true|false>] [--allowed-email-domains <csv|none>] [--project <id>]
     Update project auth settings (requires service_key).
 
   passkey-register-options --token <bearer> --app-origin <origin> [--project <id>]
@@ -147,14 +147,19 @@ Options:
   --preferred <method|null>             password, magic_link, oauth_google, passkey, or null
   --public-signup <policy>              open, known_email, or invite_only
   --require-admin-passkey <true|false>  Require passkey auth for project_admin sessions
+  --allowed-email-domains <csv|none>    Restrict hosted Google sign-in to these domains; 'none' clears (unrestricted)
   --project <id>                        Project ID (defaults to active project)
 
 Notes:
   Requires the project's service_key (admin-level).
+  --allowed-email-domains is comma-separated (e.g. kychee.com,example.com); pass 'none' to clear.
+  Domains are normalized + validated server-side; hosted Google sign-in from any
+  other domain is rejected at token issuance (R402_AUTH_DOMAIN_NOT_ALLOWED).
 
 Examples:
   run402 auth settings --allow-password-set true
   run402 auth settings --preferred passkey --require-admin-passkey true
+  run402 auth settings --allowed-email-domains kychee.com,example.com
 `,
   "passkey-register-options": `run402 auth passkey-register-options — Create passkey registration options
 
@@ -253,8 +258,8 @@ const AUTH_FLAGS = {
     values: ["--token", "--new", "--current", "--project"],
   },
   settings: {
-    known: ["--allow-password-set", "--preferred", "--public-signup", "--require-admin-passkey", "--project", "--help", "-h"],
-    values: ["--allow-password-set", "--preferred", "--public-signup", "--require-admin-passkey", "--project"],
+    known: ["--allow-password-set", "--preferred", "--public-signup", "--require-admin-passkey", "--allowed-email-domains", "--project", "--help", "-h"],
+    values: ["--allow-password-set", "--preferred", "--public-signup", "--require-admin-passkey", "--allowed-email-domains", "--project"],
   },
   "passkey-register-options": {
     known: ["--token", "--app-origin", "--project", "--help", "-h"],
@@ -460,12 +465,14 @@ async function settings(args) {
   const requireAdminPasskey = parseOptionalBool(args, "--require-admin-passkey");
   const preferredRaw = parseFlag(args, "--preferred");
   const publicSignup = parseFlag(args, "--public-signup");
+  const domainsRaw = parseFlag(args, "--allowed-email-domains");
 
   if (
     allow === undefined &&
     requireAdminPasskey === undefined &&
     preferredRaw === null &&
-    publicSignup === null
+    publicSignup === null &&
+    domainsRaw === null
   ) {
     fail({
       code: "BAD_USAGE",
@@ -488,12 +495,23 @@ async function settings(args) {
     });
   }
 
+  // --allowed-email-domains: comma-separated list; the literal `none` clears the
+  // restriction (→ []); omitted preserves. Server normalizes + validates each entry.
+  let allowedEmailDomains;
+  if (domainsRaw !== null) {
+    allowedEmailDomains =
+      domainsRaw.trim().toLowerCase() === "none"
+        ? []
+        : domainsRaw.split(",").map((d) => d.trim()).filter((d) => d.length > 0);
+  }
+
   try {
     const patch = {
       allow_password_set: allow,
       preferred_sign_in_method: preferredRaw === "null" ? null : preferredRaw ?? undefined,
       public_signup: publicSignup ?? undefined,
       require_passkey_for_project_admin: requireAdminPasskey,
+      allowed_email_domains: allowedEmailDomains,
     };
     const data = await getSdk().auth.settings(projectId, patch);
     console.log(JSON.stringify({ ...patch, ...data }));

package/lib/operator.mjs

@@ -0,0 +1,261 @@
+/**
+ * run402 operator — the operator (human / email) session.
+ *
+ * The operator is YOU, the human, identified by email — distinct from the
+ * AGENT (your wallet / SIWX identity). One browser login spans every wallet
+ * that verified your email, so `operator overview` returns the cross-wallet
+ * union. For a single wallet's account state, use `run402 status`.
+ *
+ * Auth: browser-delegated device-authorization grant (RFC 8628, the
+ * `aws sso login` model). The CLI never performs WebAuthn — the browser does,
+ * via the existing magic-link / passkey flows — and the CLI brokers the
+ * resulting operator-session token, cached at the BASE config dir (shared
+ * across named wallets, since the session is email-scoped).
+ *
+ * Agent-first: JSON to stdout. `login` additionally prints the verification URL
+ * + user code to stderr (human-in-the-loop) and degrades gracefully when not a
+ * TTY. Gated on the gateway device-auth bridge (kychee-com/run402-private#443).
+ */
+
+import { setTimeout as sleep } from "node:timers/promises";
+import { spawn } from "node:child_process";
+import { fail, reportSdkError } from "./sdk-errors.mjs";
+import { getSdk } from "./sdk.mjs";
+import { normalizeArgv, hasHelp, assertKnownFlags } from "./argparse.mjs";
+import {
+  saveOperatorSession,
+  clearOperatorSession,
+  loadLiveOperatorSession,
+  readOperatorSession,
+  isOperatorSessionExpired,
+  operatorSessionFromTokenResponse,
+} from "../core-dist/operator-session.js";
+
+const CLIENT_NAME = "run402 CLI";
+
+const HELP = `run402 operator — operator (human / email) session
+
+The operator is YOU, the human, identified by email — distinct from the agent
+(your wallet). One browser login spans every wallet that verified your email.
+For a single wallet's account state, use 'run402 status'.
+
+Usage:
+  run402 operator login [--no-open]
+  run402 operator overview
+  run402 operator whoami
+  run402 operator logout
+
+Subcommands:
+  login      Sign in via the browser (device-authorization, like 'aws sso login')
+  overview   Account view across ALL wallets controlling your email (requires login)
+  whoami     Show the cached session (email, wallets, expiry) — local, no network
+  logout     Revoke the session server-side and clear the local cache
+
+Options:
+  --no-open  (login) Do not auto-open the browser; just print the URL + code.
+
+Notes:
+  - The session is cached at the base config dir, shared across named wallets.
+  - 'overview' requires 'login' and never falls back to a single wallet.
+  - JSON to stdout; 'login' prints the URL + code to stderr (human-in-the-loop).
+`;
+
+/** Shared output shape for `whoami` and the `login` success result. */
+function sessionView(session, nowMs = Date.now()) {
+  return {
+    logged_in: true,
+    email: session.email,
+    wallets: session.wallets,
+    wallet_count: session.wallets.length,
+    expires_at: new Date(session.expires_at).toISOString(),
+    absolute_expires_at: session.absolute_expires_at || null,
+    expires_in_seconds: Math.max(0, Math.round((session.expires_at - nowMs) / 1000)),
+  };
+}
+
+/** Best-effort, cross-platform browser open. Never throws. */
+function openBrowser(url) {
+  try {
+    let cmd;
+    let cmdArgs;
+    if (process.platform === "darwin") {
+      cmd = "open";
+      cmdArgs = [url];
+    } else if (process.platform === "win32") {
+      cmd = "cmd";
+      cmdArgs = ["/c", "start", "", url];
+    } else {
+      cmd = "xdg-open";
+      cmdArgs = [url];
+    }
+    const child = spawn(cmd, cmdArgs, { stdio: "ignore", detached: true });
+    child.on("error", () => {}); // ignore: the URL is also printed to stderr
+    child.unref();
+  } catch {
+    // Best-effort only — the human can always copy the printed URL.
+  }
+}
+
+async function login(args) {
+  assertKnownFlags(args, ["--help", "-h", "--no-open"]);
+  const noOpen = args.includes("--no-open");
+  const sdk = getSdk();
+
+  let start;
+  try {
+    start = await sdk.operator.deviceStart({ clientName: CLIENT_NAME });
+  } catch (err) {
+    return reportSdkError(err);
+  }
+
+  // Human-in-the-loop prompt → stderr, so stdout stays clean for the final JSON.
+  const target = start.verification_uri_complete || start.verification_uri;
+  process.stderr.write(
+    `\nTo authorize the ${CLIENT_NAME}, open:\n  ${start.verification_uri}\n` +
+      `and enter the code:  ${start.user_code}\n\n`,
+  );
+  if (!noOpen && process.stderr.isTTY) {
+    openBrowser(target);
+    process.stderr.write("(opening your browser…)\n\n");
+  }
+  process.stderr.write("Waiting for approval…\n");
+
+  // Poll loop — honor the server interval, back off on slow_down, and stop at
+  // the device-code deadline. if/else (not switch) so the sync scanner doesn't
+  // mistake the poll states for CLI subcommands.
+  let intervalMs = Math.max(1, Number(start.interval) || 5) * 1000;
+  const deadline = Date.now() + Math.max(1, Number(start.expires_in) || 600) * 1000;
+
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    let result;
+    try {
+      result = await sdk.operator.devicePoll(start.device_code);
+    } catch (err) {
+      return reportSdkError(err);
+    }
+    if (result.kind === "approved") {
+      const session = operatorSessionFromTokenResponse(result.session);
+      saveOperatorSession(session);
+      process.stderr.write(`\nSigned in as ${session.email}.\n`);
+      console.log(JSON.stringify(sessionView(session)));
+      return;
+    }
+    if (result.kind === "authorization_pending") continue;
+    if (result.kind === "slow_down") {
+      intervalMs += 5000;
+      continue;
+    }
+    if (result.kind === "access_denied") {
+      fail({
+        code: "OPERATOR_LOGIN_DENIED",
+        message: "Authorization was denied in the browser.",
+        hint: "Run 'run402 operator login' to try again.",
+      });
+    }
+    if (result.kind === "expired_token") {
+      fail({
+        code: "OPERATOR_LOGIN_EXPIRED",
+        message: "The device code expired before approval.",
+        hint: "Run 'run402 operator login' to get a fresh code.",
+      });
+    }
+    fail({ code: "OPERATOR_LOGIN_FAILED", message: `Unexpected device poll result: ${result.kind}` });
+  }
+  fail({
+    code: "OPERATOR_LOGIN_TIMEOUT",
+    message: "Timed out waiting for browser approval.",
+    hint: "Run 'run402 operator login' to try again.",
+  });
+}
+
+async function logout(args) {
+  assertKnownFlags(args, ["--help", "-h"]);
+  const session = loadLiveOperatorSession();
+  let revoked = false;
+  if (session) {
+    try {
+      await getSdk().operator.revoke({ token: session.operator_session_token });
+      revoked = true;
+    } catch {
+      // Best-effort: a failed server revoke (expired token, offline) must not
+      // block clearing the local cache. The local token is removed regardless.
+      revoked = false;
+    }
+  }
+  clearOperatorSession();
+  console.log(JSON.stringify({ revoked, cleared: true }));
+}
+
+async function overview(args) {
+  assertKnownFlags(args, ["--help", "-h"]);
+  const session = loadLiveOperatorSession();
+  if (!session) {
+    fail({
+      code: "OPERATOR_LOGIN_REQUIRED",
+      message: "No operator session. Run 'run402 operator login' to sign in.",
+      hint: "operator overview shows the union across all wallets controlling your email; for a single wallet use 'run402 status'.",
+    });
+  }
+  try {
+    const result = await getSdk().operator.overview({ token: session.operator_session_token });
+    console.log(JSON.stringify(result, null, 2));
+  } catch (err) {
+    // 401/403 means the session was revoked or expired server-side. Clear the
+    // stale cache and point at re-login instead of leaving a dead token behind.
+    if (err && (err.status === 401 || err.status === 403)) {
+      clearOperatorSession();
+      fail({
+        code: "OPERATOR_SESSION_INVALID",
+        message: "Operator session is no longer valid (revoked or expired).",
+        hint: "Run 'run402 operator login' to sign in again.",
+      });
+    }
+    reportSdkError(err);
+  }
+}
+
+async function whoami(args) {
+  assertKnownFlags(args, ["--help", "-h"]);
+  const now = Date.now();
+  const session = readOperatorSession();
+  if (!session) {
+    console.log(JSON.stringify({ logged_in: false, reason: "no_session", hint: "Run 'run402 operator login' to sign in." }));
+    process.exitCode = 1;
+    return;
+  }
+  if (isOperatorSessionExpired(session, now)) {
+    console.log(JSON.stringify({ logged_in: false, reason: "expired", email: session.email, hint: "Run 'run402 operator login' to sign in again." }));
+    process.exitCode = 1;
+    return;
+  }
+  console.log(JSON.stringify(sessionView(session, now)));
+}
+
+export async function run(sub, args = []) {
+  args = normalizeArgv(args);
+  if (!sub || sub === "--help" || sub === "-h" || hasHelp(args)) {
+    console.log(HELP);
+    process.exit(0);
+  }
+  switch (sub) {
+    case "login":
+      await login(args);
+      break;
+    case "logout":
+      await logout(args);
+      break;
+    case "overview":
+      await overview(args);
+      break;
+    case "whoami":
+      await whoami(args);
+      break;
+    default:
+      fail({
+        code: "BAD_USAGE",
+        message: `Unknown subcommand: operator ${sub}`,
+        hint: "Run 'run402 operator --help' for usage.",
+      });
+  }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "run402",
-  "version": "2.29.0",
+  "version": "2.31.0",
   "description": "CLI for Run402 — provision Postgres databases, deploy static sites, generate images, and manage wallets via x402 and MPP micropayments.",
   "type": "module",
   "bin": {

package/sdk/core-dist/operator-session.js

@@ -0,0 +1,154 @@
+import { readFileSync, writeFileSync, mkdirSync, existsSync, chmodSync, renameSync, statSync, rmSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { randomBytes } from "node:crypto";
+import { getConfigBaseDir } from "./config.js";
+/**
+ * Path to the cached operator session: `{base}/operator-session.json`, at the
+ * BASE config dir — NOT the per-profile dir, because the session is email-
+ * scoped and shared across all local named wallets. `RUN402_OPERATOR_SESSION_PATH`
+ * overrides for testing, mirroring `RUN402_ALLOWANCE_PATH`.
+ */
+export function getOperatorSessionPath() {
+    return process.env.RUN402_OPERATOR_SESSION_PATH || join(getConfigBaseDir(), "operator-session.json");
+}
+/**
+ * If the session file is readable by group or other (any low 0o077 bit set),
+ * tighten it to 0600 and warn once on stderr — the bearer token is as sensitive
+ * as the allowance private key. Best-effort: POSIX-only, silent elsewhere.
+ * Mirrors the self-heal in `allowance.ts`.
+ */
+function selfHealPermissions(p) {
+    if (process.platform === "win32")
+        return;
+    try {
+        const mode = statSync(p).mode & 0o777;
+        if ((mode & 0o077) !== 0) {
+            chmodSync(p, 0o600);
+            process.stderr.write(`warning: tightened permissions on ${p} from ${mode.toString(8)} to 600 (was readable by other users).\n`);
+        }
+    }
+    catch {
+        // Best-effort; never block a read on a chmod/stat failure.
+    }
+}
+/**
+ * Load the cached operator session from disk.
+ *
+ * Returns `null` for the "no session cached" cases (file absent, unreadable, or
+ * unparseable JSON) — callers treat that as "not logged in" and point at
+ * `run402 operator login`. Throws a structured `Error` when the file parses as
+ * JSON but the shape is wrong, so a corrupted cache surfaces a clear fix-it
+ * instead of a downstream `TypeError`.
+ */
+export function readOperatorSession(path) {
+    const p = path ?? getOperatorSessionPath();
+    if (!existsSync(p))
+        return null;
+    selfHealPermissions(p);
+    let raw;
+    try {
+        raw = readFileSync(p, "utf-8");
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        // Unparseable input reads as "no session" rather than an error — consumers
+        // already handle null with a friendly "run 'run402 operator login'".
+        return null;
+    }
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`operator-session.json must contain a JSON object (got ${Array.isArray(parsed) ? "array" : parsed === null ? "null" : typeof parsed}). Delete the file and run 'run402 operator login' to recreate it.`);
+    }
+    const data = parsed;
+    if (typeof data.operator_session_token !== "string" || data.operator_session_token.length === 0) {
+        throw new Error("operator-session.json missing valid 'operator_session_token'. Run 'run402 operator login' to refresh it.");
+    }
+    if (typeof data.email !== "string" || data.email.length === 0) {
+        throw new Error("operator-session.json missing valid 'email'. Run 'run402 operator login' to refresh it.");
+    }
+    if (typeof data.expires_at !== "number" || !Number.isFinite(data.expires_at)) {
+        throw new Error("operator-session.json missing valid 'expires_at'. Run 'run402 operator login' to refresh it.");
+    }
+    if (!Array.isArray(data.wallets) || data.wallets.some((w) => typeof w !== "string")) {
+        throw new Error("operator-session.json has an invalid 'wallets' list. Run 'run402 operator login' to refresh it.");
+    }
+    return {
+        operator_session_token: data.operator_session_token,
+        token_type: typeof data.token_type === "string" ? data.token_type : "Bearer",
+        email: data.email,
+        wallets: data.wallets,
+        expires_at: data.expires_at,
+        absolute_expires_at: typeof data.absolute_expires_at === "string" ? data.absolute_expires_at : "",
+    };
+}
+/** Persist an operator session atomically (temp-file + rename), mode 0600. */
+export function saveOperatorSession(data, path) {
+    const p = path ?? getOperatorSessionPath();
+    const dir = dirname(p);
+    mkdirSync(dir, { recursive: true });
+    const tmp = join(dir, `.operator-session.${randomBytes(4).toString("hex")}.tmp`);
+    writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 0o600 });
+    renameSync(tmp, p);
+    chmodSync(p, 0o600);
+}
+/**
+ * Delete the cached operator session — the local half of `operator logout`.
+ * Best-effort and idempotent: a missing file is a no-op.
+ */
+export function clearOperatorSession(path) {
+    const p = path ?? getOperatorSessionPath();
+    try {
+        rmSync(p, { force: true });
+    }
+    catch {
+        // Best-effort: a failed unlink should never crash logout.
+    }
+}
+/**
+ * Whether a cached session is past its usable life. The access token
+ * (`expires_at`, ~30m) always expires before the absolute cap (~12h), so
+ * checking it is sufficient; the absolute cap is honored defensively. A small
+ * skew buffer treats a session expiring within `skewMs` as already expired, so
+ * we never send a token that dies mid-flight.
+ */
+export function isOperatorSessionExpired(session, nowMs = Date.now(), skewMs = 10_000) {
+    if (nowMs + skewMs >= session.expires_at)
+        return true;
+    if (session.absolute_expires_at) {
+        const cap = Date.parse(session.absolute_expires_at);
+        if (Number.isFinite(cap) && nowMs + skewMs >= cap)
+            return true;
+    }
+    return false;
+}
+/**
+ * Read the cached session and return it only if still usable; `null` if absent
+ * or expired. The bearer fetch path and `operator overview` use this so an
+ * expired cache surfaces as "not logged in" instead of a server 401.
+ */
+export function loadLiveOperatorSession(path, nowMs = Date.now()) {
+    const s = readOperatorSession(path);
+    if (!s)
+        return null;
+    return isOperatorSessionExpired(s, nowMs) ? null : s;
+}
+/**
+ * Map a gateway token payload (relative `expires_in`) into the cached shape
+ * (absolute `expires_at`). `nowMs` is injectable for deterministic tests.
+ */
+export function operatorSessionFromTokenResponse(resp, nowMs = Date.now()) {
+    return {
+        operator_session_token: resp.operator_session_token,
+        token_type: resp.token_type ?? "Bearer",
+        email: resp.email ?? "",
+        wallets: Array.isArray(resp.wallets) ? resp.wallets.filter((w) => typeof w === "string") : [],
+        expires_at: nowMs + (typeof resp.expires_in === "number" ? resp.expires_in : 0) * 1000,
+        absolute_expires_at: resp.absolute_expires_at ?? "",
+    };
+}
+//# sourceMappingURL=operator-session.js.map

package/sdk/dist/index.d.ts

@@ -29,6 +29,7 @@ import { Admin } from "./namespaces/admin.js";
 import { Deploy } from "./namespaces/deploy.js";
 import { Ci } from "./namespaces/ci.js";
 import { Jobs } from "./namespaces/jobs.js";
+import { Operator } from "./namespaces/operator.js";
 import type { ContentSource, FileSet } from "./namespaces/deploy.types.js";
 import { ScopedRun402 } from "./scoped.js";
 export interface Run402Options {
@@ -76,6 +77,11 @@ export declare class Run402 {
     readonly _applyEngine: Deploy;
     readonly ci: Ci;
     readonly jobs: Jobs;
+    /**
+     * The *human* (email) principal — browser-delegated operator session (RFC
+     * 8628 device flow), distinct from the agent's per-wallet SIWX identity.
+     */
+    readonly operator: Operator;
     constructor(opts: Run402Options);
     /**
      * Return a project-scoped sub-client where every project-id-bearing namespace
@@ -183,6 +189,7 @@ export type * from "./namespaces/domains.js";
 export type * from "./namespaces/email.js";
 export type * from "./namespaces/functions.types.js";
 export type * from "./namespaces/jobs.js";
+export type * from "./namespaces/operator.js";
 export type * from "./namespaces/projects.types.js";
 export type * from "./namespaces/secrets.js";
 export type * from "./namespaces/sender-domain.js";

package/sdk/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;gBAIR,IAAI,EAAE,aAAa;IAgE/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,8BAA8B,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAC5D,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,MAAM,WAAW,aAAa;IAC5B,mDAAmD;IACnD,OAAO,EAAE,MAAM,CAAC;IAChB,mFAAmF;IACnF,WAAW,EAAE,mBAAmB,CAAC;IACjC;;;;OAIG;IACH,KAAK,CAAC,EAAE,OAAO,UAAU,CAAC,KAAK,CAAC;CACjC;AAED,qBAAa,MAAM;;IACjB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAChC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,KAAK,EAAG,EAAE,CAAC;IACpB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,YAAY,EAAE,YAAY,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,SAAS,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,EAAE,EAAE,CAAC;IAChB,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAIhB,IAAI,EAAE,aAAa;IAiE/B;;;;;;;;;;;;;;;;OAgBG;IACG,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAsBjD;;;;;;;;;;;OAWG;IACG,UAAU,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC;IAKnD;;;;;;;;;OASG;IACG,MAAM,IAAI,OAAO,CAAC,MAAM,CAAC;CAiBhC;AAED,uCAAuC;AACvC,MAAM,WAAW,MAAM;IACrB,8EAA8E;IAC9E,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,+DAA+D;IAC/D,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,4EAA4E;IAC5E,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,wDAAwD;IACxD,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,GAAG,OAAO,CAEpE;AAED;;;GAGG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,aAAa,GAAG,MAAM,CAElD;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,qBAAqB,EACrB,oBAAoB,EACpB,eAAe,EACf,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AACvC,mBAAmB,YAAY,CAAC;AAChC,mBAAmB,kBAAkB,CAAC;AACtC,mBAAmB,aAAa,CAAC;AACjC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAC7B,mBAAmB,qBAAqB,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,2BAA2B,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,mBAAmB,oBAAoB,CAAC;AACxC,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,8BAA8B,CAAC;AAClD,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,2BAA2B,CAAC;AAC/C,mBAAmB,8BAA8B,CAAC;AAClD,YAAY,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACzD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,iCAAiC,CAAC;AACrD,mBAAmB,sBAAsB,CAAC;AAC1C,mBAAmB,0BAA0B,CAAC;AAC9C,mBAAmB,gCAAgC,CAAC;AACpD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,+BAA+B,CAAC;AACnD,mBAAmB,yBAAyB,CAAC;AAC7C,mBAAmB,uBAAuB,CAAC;AAC3C,mBAAmB,4BAA4B,CAAC;AAChD,mBAAmB,sBAAsB,CAAC"}

package/sdk/dist/index.js

@@ -29,6 +29,7 @@ import { Admin } from "./namespaces/admin.js";
 import { Deploy } from "./namespaces/deploy.js";
 import { Ci } from "./namespaces/ci.js";
 import { Jobs } from "./namespaces/jobs.js";
+import { Operator } from "./namespaces/operator.js";
 import { ScopedRun402 } from "./scoped.js";
 import { LocalError } from "./errors.js";
 export class Run402 {
@@ -63,6 +64,11 @@ export class Run402 {
     _applyEngine;
     ci;
     jobs;
+    /**
+     * The *human* (email) principal — browser-delegated operator session (RFC
+     * 8628 device flow), distinct from the agent's per-wallet SIWX identity.
+     */
+    operator;
     #client;
     constructor(opts) {
         if (!opts || typeof opts !== "object") {
@@ -112,6 +118,7 @@ export class Run402 {
         this._applyEngine = new Deploy(client);
         this.ci = new Ci(client);
         this.jobs = new Jobs(client);
+        this.operator = new Operator(client);
     }
     /**
      * Return a project-scoped sub-client where every project-id-bearing namespace

package/sdk/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAE5C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,MAAM,CAAS;IACf,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACtB;;;;;;OAMG;IACM,YAAY,CAAS;IACrB,EAAE,CAAK;IACP,IAAI,CAAO;IAEX,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;IAC/B,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,IAAI,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC;QACT,OAAO;YACL,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;YAC5B,OAAO;YACP,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;YAC9B,aAAa,EAAE,aAAa,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;CACF;AAcD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,WAAW,EAAkC,MAAM,aAAa,CAAC;AAE1E,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,4BAA4B,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAC7D,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC;AACtD,OAAO,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EAAE,EAAE,EAAE,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,sBAAsB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,0BAA0B,CAAC;AAEpD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAezC,MAAM,OAAO,MAAM;IACR,QAAQ,CAAW;IACnB,MAAM,CAAS;IACf,SAAS,CAAY;IACrB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,UAAU,CAAa;IACvB,OAAO,CAAU;IACjB,KAAK,CAAQ;IACb,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,SAAS,CAAY;IACrB,EAAE,CAAK;IACP,KAAK,CAAM;IACX,IAAI,CAAO;IACX,YAAY,CAAe;IAC3B,OAAO,CAAU;IACjB,OAAO,CAAU;IACjB,IAAI,CAAO;IACX,KAAK,CAAQ;IACb,SAAS,CAAY;IACrB,KAAK,CAAQ;IACtB;;;;;;OAMG;IACM,YAAY,CAAS;IACrB,EAAE,CAAK;IACP,IAAI,CAAO;IACpB;;;OAGG;IACM,QAAQ,CAAW;IAEnB,OAAO,CAAS;IAEzB,YAAY,IAAmB;QAC7B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mCAAmC,EACnC,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;YACtD,MAAM,IAAI,UAAU,CAClB,mDAAmD,EACnD,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC;YACtB,MAAM,IAAI,UAAU,CAClB,gKAAgK,EAChK,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,IACE,OAAO,IAAI,CAAC,WAAW,CAAC,OAAO,KAAK,UAAU;YAC9C,OAAO,IAAI,CAAC,WAAW,CAAC,UAAU,KAAK,UAAU,EACjD,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,qBAAqB,CACtB,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GAAiB;YAC3B,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC;YACtD,WAAW,EAAE,IAAI,CAAC,WAAW;SAC9B,CAAC;QACF,MAAM,MAAM,GAAW,WAAW,CAAC,MAAM,CAAC,CAAC;QAC3C,IAAI,CAAC,OAAO,GAAG,MAAM,CAAC;QACtB,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACjC,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,UAAU,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,MAAM,CAAC,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE;YACnC,KAAK,EAAE,IAAI,CAAC,EAAE;YACd,UAAU,EAAE,KAAK;SAClB,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,YAAY,GAAG,IAAI,YAAY,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,OAAO,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC,CAAC;QACnC,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,SAAS,GAAG,IAAI,SAAS,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC;QAC/B,IAAI,CAAC,YAAY,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,GAAG,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;QACzB,IAAI,CAAC,IAAI,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC;QAC7B,IAAI,CAAC,QAAQ,GAAG,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,KAAK,CAAC,OAAO,CAAC,EAAW;QACvB,IAAI,UAAU,GAAG,EAAE,CAAC;QACpB,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACzD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC;YAC3D,IAAI,CAAC,MAAM,EAAE,CAAC;gBACZ,MAAM,IAAI,UAAU,CAClB,yIAAyI,EACzI,2BAA2B,CAC5B,CAAC;YACJ,CAAC;YACD,UAAU,GAAG,MAAM,CAAC;QACtB,CAAC;QACD,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IAC1D,CAAC;IAED;;;;;;;;;;;OAWG;IACH,KAAK,CAAC,UAAU,CAAC,EAAU;QACzB,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC5B,OAAO,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,CAAC,MAAM;QACV,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;QACvC,MAAM,QAAQ,GAAG,KAAK,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,iBAAiB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC5F,IAAI,OAAO,GAAG,QAAQ,EAAE,OAAO,IAAI,IAAI,CAAC;QACxC,IAAI,OAAO,IAAI,IAAI,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC;YAC3C,OAAO,GAAG,CAAC,MAAM,KAAK,CAAC,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,IAAI,IAAI,CAAC;QACrE,CAAC;QACD,MAAM,aAAa,GAAG,KAAK,CAAC,gBAAgB;YAC1C,CAAC,CAAC,MAAM,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAC1C,CAAC,CAAC,IAAI,CAAC;QACT,OAAO;YACL,IAAI,EAAE,QAAQ,EAAE,IAAI,IAAI,IAAI;YAC5B,OAAO;YACP,KAAK,EAAE,QAAQ,EAAE,KAAK,IAAI,IAAI;YAC9B,aAAa,EAAE,aAAa,IAAI,IAAI;SACrC,CAAC;IACJ,CAAC;CACF;AAcD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,KAAK,CAAC,MAAqC;IACzD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CAAC,IAAmB;IACxC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,OAAO,EACL,WAAW,EACX,eAAe,EACf,eAAe,EACf,YAAY,EACZ,QAAQ,EACR,YAAY,EACZ,UAAU,EACV,iBAAiB,EACjB,mBAAmB,EACnB,aAAa,EACb,iBAAiB,EACjB,iBAAiB,EACjB,cAAc,EACd,UAAU,EACV,cAAc,EACd,YAAY,EACZ,aAAa,EACb,qBAAqB,EACrB,sBAAsB,EACtB,aAAa,GACd,MAAM,aAAa,CAAC;AAOrB,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAIvC,OAAO,EACL,sBAAsB,EACtB,0BAA0B,EAC1B,wBAAwB,EACxB,sBAAsB,GACvB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAChD,OAAO,EACL,8BAA8B,EAC9B,kBAAkB,EAClB,yBAAyB,EACzB,uBAAuB,EACvB,wBAAwB,EACxB,6BAA6B,EAC7B,+BAA+B,EAC/B,qBAAqB,GACtB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EACL,EAAE,EACF,WAAW,EACX,wBAAwB,EACxB,0BAA0B,EAC1B,8BAA8B,EAC9B,qBAAqB,EACrB,4BAA4B,EAC5B,sBAAsB,EACtB,4BAA4B,EAC5B,0BAA0B,EAC1B,sBAAsB,EACtB,2BAA2B,EAC3B,eAAe,EACf,oBAAoB,EACpB,sBAAsB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAG3C,OAAO,EAAE,SAAS,EAAE,MAAM,2BAA2B,CAAC"}

package/sdk/dist/namespaces/auth.d.ts

@@ -40,12 +40,21 @@ export interface AuthSettings {
     preferred_sign_in_method?: "password" | "magic_link" | "oauth_google" | "passkey" | null;
     public_signup?: "open" | "known_email" | "invite_only";
     require_passkey_for_project_admin?: boolean;
+    /**
+     * Restrict hosted Google sign-in to these email domains, enforced at token
+     * issuance. `[]` or omitted = unrestricted. Entries are normalized
+     * (lowercased, leading `@` stripped, trimmed, deduped) and domain-validated
+     * server-side; pass an explicit `[]` to clear an existing restriction.
+     */
+    allowed_email_domains?: string[];
 }
 export interface AuthSettingsResult {
     allow_password_set: boolean;
     preferred_sign_in_method: "password" | "magic_link" | "oauth_google" | "passkey" | null;
     public_signup: "open" | "known_email" | "invite_only";
     require_passkey_for_project_admin: boolean;
+    /** Normalized email-domain allowlist for hosted Google sign-in; `[]` = unrestricted. */
+    allowed_email_domains: string[];
 }
 export interface CreateAuthUserOptions {
     email: string;

package/sdk/dist/namespaces/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/namespaces/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;QACnD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,YAAY,EAAE,WAAW,GAAG,aAAa,CAAC;QAC1C,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wBAAwB,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IACzF,aAAa,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC;IACvD,iCAAiC,CAAC,EAAE,OAAO,CAAC;CAC7C;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,wBAAwB,EAAE,UAAU,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IACxF,aAAa,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC;IACtD,iCAAiC,EAAE,OAAO,CAAC;CAC5C;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,qBAAqB;IAC9D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,eAAe,CAAC;CACjC;AAoDD,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,IAAI;IAOH,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,QAAQ,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtF,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;gBAE5C,MAAM,EAAE,MAAM;IAQ3C,qEAAqE;IAC/D,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiChF,+DAA+D;IACzD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmBvF;;;;OAIG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BjF,gEAAgE;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsBtF,2DAA2D;IACrD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAqC9F,kFAAkF;IAC5E,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIlH,uEAAuE;IACjE,gCAAgC,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC;IAqBhC,wDAAwD;IAClD,yBAAyB,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,aAAa,CAAC;IA2BzB,qCAAqC;IAC/B,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwB5G,0EAA0E;IACpE,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBxG,qDAAqD;IAC/C,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAoBvG,mDAAmD;IAC7C,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjF,iFAAiF;IAC3E,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpD,0EAA0E;IACpE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAe9D,8EAA8E;IACxE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAc9D"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/namespaces/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAS3C,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;IACpD,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,IAAI,EAAE,aAAa,CAAC;IACpB,UAAU,CAAC,EAAE;QACX,MAAM,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,CAAC;QACnD,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;QAC5B,YAAY,EAAE,WAAW,GAAG,aAAa,CAAC;QAC1C,aAAa,EAAE,OAAO,CAAC;KACxB,CAAC;CACH;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,oFAAoF;IACpF,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY;IAC3B,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,wBAAwB,CAAC,EAAE,UAAU,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IACzF,aAAa,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC;IACvD,iCAAiC,CAAC,EAAE,OAAO,CAAC;IAC5C;;;;;OAKG;IACH,qBAAqB,CAAC,EAAE,MAAM,EAAE,CAAC;CAClC;AAED,MAAM,WAAW,kBAAkB;IACjC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,wBAAwB,EAAE,UAAU,GAAG,YAAY,GAAG,cAAc,GAAG,SAAS,GAAG,IAAI,CAAC;IACxF,aAAa,EAAE,MAAM,GAAG,aAAa,GAAG,aAAa,CAAC;IACtD,iCAAiC,EAAE,OAAO,CAAC;IAC3C,wFAAwF;IACxF,qBAAqB,EAAE,MAAM,EAAE,CAAC;CACjC;AAED,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,OAAO,CAAC;IAClB,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,OAAO,EAAE,OAAO,CAAC;IACjB,WAAW,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,iBAAkB,SAAQ,qBAAqB;IAC9D,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,eAAe,CAAC,EAAE,SAAS,CAAC;IAC5B,cAAc,CAAC,EAAE,eAAe,CAAC;IACjC,aAAa,CAAC,EAAE,eAAe,CAAC;CACjC;AAgED,MAAM,WAAW,oBAAoB;IACnC,YAAY,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,MAAM,WAAW,aAAa;IAC5B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,sBAAsB,EAAE,MAAM,GAAG,IAAI,CAAC;IACtC,oBAAoB,EAAE,OAAO,GAAG,IAAI,CAAC;IACrC,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;CAC7B;AAED,MAAM,WAAW,0BAA0B;IACzC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gCAAgC;IAC/C,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,yBAAyB;IACxC,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,oBAAoB;IACnC,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,IAAI;IAOH,OAAO,CAAC,QAAQ,CAAC,MAAM;IANnC,QAAQ,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACjF,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACtF,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACrF,QAAQ,CAAC,WAAW,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1E,QAAQ,CAAC,UAAU,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;gBAE5C,MAAM,EAAE,MAAM;IAQ3C,qEAAqE;IAC/D,gBAAgB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,gBAAgB,GAAG,OAAO,CAAC,IAAI,CAAC;IAiChF,+DAA+D;IACzD,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,CAAC;IAmBvF;;;;OAIG;IACG,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC,IAAI,CAAC;IA6BjF,gEAAgE;IAC1D,QAAQ,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAsBtF,2DAA2D;IACrD,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,qBAAqB,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAqC9F,kFAAkF;IAC5E,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,qBAAqB,EAAE,YAAY,CAAC,GAAG,OAAO,CAAC,mBAAmB,CAAC;IAIlH,uEAAuE;IACjE,gCAAgC,CACpC,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,0BAA0B,GAC/B,OAAO,CAAC,oBAAoB,CAAC;IAqBhC,wDAAwD;IAClD,yBAAyB,CAC7B,SAAS,EAAE,MAAM,EACjB,IAAI,EAAE,gCAAgC,GACrC,OAAO,CAAC,aAAa,CAAC;IA2BzB,qCAAqC;IAC/B,yBAAyB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,mBAAmB,GAAG,OAAO,CAAC,oBAAoB,CAAC;IAwB5G,0EAA0E;IACpE,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAwBxG,qDAAqD;IAC/C,YAAY,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,kBAAkB,GAAG,OAAO,CAAC;QAAE,QAAQ,EAAE,aAAa,EAAE,CAAA;KAAE,CAAC;IAoBvG,mDAAmD;IAC7C,aAAa,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,oBAAoB,GAAG,OAAO,CAAC,IAAI,CAAC;IAoBjF,iFAAiF;IAC3E,SAAS,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC;IAcpD,0EAA0E;IACpE,OAAO,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAe9D,8EAA8E;IACxE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;CAc9D"}

package/sdk/dist/namespaces/auth.js

@@ -13,6 +13,7 @@ const AUTH_SETTINGS_FIELDS = [
     "preferred_sign_in_method",
     "public_signup",
     "require_passkey_for_project_admin",
+    "allowed_email_domains",
 ];
 const SIGN_IN_METHODS = ["password", "magic_link", "oauth_google", "passkey"];
 const PUBLIC_SIGNUP_POLICIES = ["open", "known_email", "invite_only"];
@@ -37,6 +38,12 @@ function validateAuthSettings(settings) {
     if (raw.public_signup !== undefined) {
         assertStringInSet(raw.public_signup, PUBLIC_SIGNUP_POLICIES, "public_signup", "updating auth settings");
     }
+    if (raw.allowed_email_domains !== undefined) {
+        if (!Array.isArray(raw.allowed_email_domains) ||
+            !raw.allowed_email_domains.every((d) => typeof d === "string")) {
+            throw new LocalError('allowed_email_domains must be an array of strings (e.g., ["example.com"]); pass [] to clear.', "updating auth settings");
+        }
+    }
 }
 export class Auth {
     client;

package/sdk/dist/namespaces/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/namespaces/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAyE1B,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAC9E,MAAM,oBAAoB,GAAG;IAC3B,oBAAoB;IACpB,0BAA0B;IAC1B,eAAe;IACf,mCAAmC;CAC3B,CAAC;AACX,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,CAAU,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAU,CAAC;AAE/E,SAAS,oBAAoB,CAAC,QAAsB;IAClD,MAAM,GAAG,GAAG,QAAmC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAE,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,UAAU,CAAC,gCAAgC,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IACE,GAAG,CAAC,kBAAkB,KAAK,SAAS;QACpC,OAAO,GAAG,CAAC,kBAAkB,KAAK,SAAS,EAC3C,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,wBAAwB,CAAC,CAAC;IAC1F,CAAC;IACD,IACE,GAAG,CAAC,iCAAiC,KAAK,SAAS;QACnD,OAAO,GAAG,CAAC,iCAAiC,KAAK,SAAS,EAC1D,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,sDAAsD,EACtD,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,wBAAwB,KAAK,SAAS,IAAI,GAAG,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;QACxF,iBAAiB,CACf,GAAG,CAAC,wBAAwB,EAC5B,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpC,iBAAiB,CACf,GAAG,CAAC,aAAa,EACjB,sBAAsB,EACtB,eAAe,EACf,wBAAwB,CACzB,CAAC;IACJ,CAAC;AACH,CAAC;AAmDD,MAAM,OAAO,IAAI;IAOc;IANpB,SAAS,CAA+D;IACxE,MAAM,CAAuE;IAC7E,WAAW,CAAiE;IAC5E,WAAW,CAAsD;IACjE,UAAU,CAAsD;IAEzE,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,IAAsB;QAC9D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,qHAAqH,EACrH,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACjE,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE5E,MAAM,IAAI,GAA4B;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,WAAW;SAC/B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QAEzE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,qBAAqB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;aAC7F;YACD,IAAI;YACJ,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,KAAa;QACpD,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,sCAAsC,EACtC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE,EAAE,KAAK,EAAE;YACf,OAAO,EAAE,sBAAsB;SAChC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAwB;QAC/D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,0HAA0H,EAC1H,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC/E,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC/E,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,oBAAoB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE5E,MAAM,IAAI,GAA2B,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC;QAErF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,wBAAwB,EAAE;YAC3D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,QAAsB;QACtD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,UAAU,CAClB,0HAA0H,EAC1H,wBAAwB,CACzB,CAAC;QACJ,CAAC;QACD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;QAE7E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,mBAAmB,EAAE;YAClE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;aAC/C;YACD,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAA2B;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,2GAA2G,EAC3G,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,UAAU,CAAC,0CAA0C,EAAE,oBAAoB,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1E,MAAM,IAAI,UAAU,CAAC,6CAA6C,EAAE,oBAAoB,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAEzE,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QACpE,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACzE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QAEzE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,sBAAsB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;aAC/C;YACD,IAAI;YACJ,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAA+C;QACjF,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,gCAAgC,CACpC,SAAiB,EACjB,IAAgC;QAEhC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,8FAA8F,EAC9F,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;QAE5F,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAuB,oCAAoC,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE;YACpC,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,yBAAyB,CAC7B,SAAiB,EACjB,IAAsC;QAEtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mGAAmG,EACnG,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAErF,MAAM,IAAI,GAA4B;YACpC,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAExC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAgB,mCAAmC,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,yBAAyB,CAAC,SAAiB,EAAE,IAAyB;QAC1E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,0EAA0E,EAC1E,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAErF,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAExC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAuB,iCAAiC,EAAE;YAClF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,IAA+B;QACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAE9E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAoB,gCAAgC,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;YACD,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,IAAwB;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,+DAA+D,EAC/D,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAgC,mBAAmB,EAAE;YAC7E,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,OAAO,EAAE,kBAAkB;YAC3B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAA0B;QAC/D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,2EAA2E,EAC3E,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;YAC5F,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;QAE7E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,oBAAoB,EAAE;YACxD,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,OAAO,EAAE,wBAAwB;YACjC,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,KAAa;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAErE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACvB,sBAAsB,SAAS,eAAe,EAC9C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI,EAAE,EAAE,KAAK,EAAE;YACf,OAAO,EAAE,gBAAgB;SAC1B,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAAa;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEpE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACvB,sBAAsB,SAAS,cAAc,EAC7C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI,EAAE,EAAE,KAAK,EAAE;YACf,OAAO,EAAE,eAAe;SACzB,CACF,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/namespaces/auth.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAGH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAC3D,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,oBAAoB,EACpB,iBAAiB,GAClB,MAAM,kBAAkB,CAAC;AAkF1B,MAAM,kBAAkB,GAAG,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AAC9E,MAAM,oBAAoB,GAAG;IAC3B,oBAAoB;IACpB,0BAA0B;IAC1B,eAAe;IACf,mCAAmC;IACnC,uBAAuB;CACf,CAAC;AACX,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,YAAY,EAAE,cAAc,EAAE,SAAS,CAAU,CAAC;AACvF,MAAM,sBAAsB,GAAG,CAAC,MAAM,EAAE,aAAa,EAAE,aAAa,CAAU,CAAC;AAE/E,SAAS,oBAAoB,CAAC,QAAsB;IAClD,MAAM,GAAG,GAAG,QAAmC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnC,IAAI,CAAE,oBAA0C,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/D,MAAM,IAAI,UAAU,CAAC,gCAAgC,GAAG,EAAE,EAAE,wBAAwB,CAAC,CAAC;QACxF,CAAC;IACH,CAAC;IACD,IACE,GAAG,CAAC,kBAAkB,KAAK,SAAS;QACpC,OAAO,GAAG,CAAC,kBAAkB,KAAK,SAAS,EAC3C,CAAC;QACD,MAAM,IAAI,UAAU,CAAC,uCAAuC,EAAE,wBAAwB,CAAC,CAAC;IAC1F,CAAC;IACD,IACE,GAAG,CAAC,iCAAiC,KAAK,SAAS;QACnD,OAAO,GAAG,CAAC,iCAAiC,KAAK,SAAS,EAC1D,CAAC;QACD,MAAM,IAAI,UAAU,CAClB,sDAAsD,EACtD,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,wBAAwB,KAAK,SAAS,IAAI,GAAG,CAAC,wBAAwB,KAAK,IAAI,EAAE,CAAC;QACxF,iBAAiB,CACf,GAAG,CAAC,wBAAwB,EAC5B,eAAe,EACf,0BAA0B,EAC1B,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,aAAa,KAAK,SAAS,EAAE,CAAC;QACpC,iBAAiB,CACf,GAAG,CAAC,aAAa,EACjB,sBAAsB,EACtB,eAAe,EACf,wBAAwB,CACzB,CAAC;IACJ,CAAC;IACD,IAAI,GAAG,CAAC,qBAAqB,KAAK,SAAS,EAAE,CAAC;QAC5C,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,qBAAqB,CAAC;YACzC,CAAC,GAAG,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAC9D,CAAC;YACD,MAAM,IAAI,UAAU,CAClB,8FAA8F,EAC9F,wBAAwB,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAmDD,MAAM,OAAO,IAAI;IAOc;IANpB,SAAS,CAA+D;IACxE,MAAM,CAAuE;IAC7E,WAAW,CAAiE;IAC5E,WAAW,CAAsD;IACjE,UAAU,CAAsD;IAEzE,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;QACzC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClD,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC9C,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC3C,IAAI,CAAC,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3C,CAAC;IAED,qEAAqE;IACrE,KAAK,CAAC,gBAAgB,CAAC,SAAiB,EAAE,IAAsB;QAC9D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,qHAAqH,EACrH,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,uBAAuB,CAAC,CAAC;QACjE,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QACxE,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YAC9B,iBAAiB,CAAC,IAAI,CAAC,MAAM,EAAE,kBAAkB,EAAE,QAAQ,EAAE,uBAAuB,CAAC,CAAC;QACxF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE5E,MAAM,IAAI,GAA4B;YACpC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,YAAY,EAAE,IAAI,CAAC,WAAW;SAC/B,CAAC;QACF,IAAI,IAAI,CAAC,MAAM;YAAE,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC3C,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QAEzE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,qBAAqB,EAAE;YACxD,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE;aAC7F;YACD,IAAI;YACJ,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,+DAA+D;IAC/D,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,KAAa;QACpD,oBAAoB,CAAC,KAAK,EAAE,OAAO,EAAE,sBAAsB,CAAC,CAAC;QAC7D,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,sBAAsB,CAAC,CAAC;QAE3E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CACxB,sCAAsC,EACtC;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE,EAAE,KAAK,EAAE;YACf,OAAO,EAAE,sBAAsB;SAChC,CACF,CAAC;IACJ,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,eAAe,CAAC,SAAiB,EAAE,IAAwB;QAC/D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,0HAA0H,EAC1H,uBAAuB,CACxB,CAAC;QACJ,CAAC;QACD,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC/E,oBAAoB,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,uBAAuB,CAAC,CAAC;QAC/E,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS,EAAE,CAAC;YACvC,oBAAoB,CAAC,IAAI,CAAC,eAAe,EAAE,iBAAiB,EAAE,uBAAuB,CAAC,CAAC;QACzF,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;QAE5E,MAAM,IAAI,GAA2B,EAAE,YAAY,EAAE,IAAI,CAAC,WAAW,EAAE,CAAC;QACxE,IAAI,IAAI,CAAC,eAAe,KAAK,SAAS;YAAE,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,eAAe,CAAC;QAErF,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,wBAAwB,EAAE;YAC3D,MAAM,EAAE,KAAK;YACb,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,uBAAuB;SACjC,CAAC,CAAC;IACL,CAAC;IAED,gEAAgE;IAChE,KAAK,CAAC,QAAQ,CAAC,SAAiB,EAAE,QAAsB;QACtD,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,UAAU,CAClB,0HAA0H,EAC1H,wBAAwB,CACzB,CAAC;QACJ,CAAC;QACD,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;QAE7E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAqB,mBAAmB,EAAE;YAClE,MAAM,EAAE,OAAO;YACf,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;aAC/C;YACD,IAAI,EAAE,QAAQ;YACd,OAAO,EAAE,wBAAwB;SAClC,CAAC,CAAC;IACL,CAAC;IAED,2DAA2D;IAC3D,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAA2B;QAC7D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,UAAU,CAClB,2GAA2G,EAC3G,oBAAoB,CACrB,CAAC;QACJ,CAAC;QACD,kBAAkB,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,oBAAoB,CAAC,CAAC;QAC9D,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;YACnC,aAAa,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,EAAE,oBAAoB,CAAC,CAAC;QACvE,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACpE,MAAM,IAAI,UAAU,CAAC,0CAA0C,EAAE,oBAAoB,CAAC,CAAC;QACzF,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;YAC1E,MAAM,IAAI,UAAU,CAAC,6CAA6C,EAAE,oBAAoB,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;QAEzE,MAAM,IAAI,GAA4B,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC;QAC5D,IAAI,OAAO,IAAI,CAAC,OAAO,KAAK,SAAS;YAAE,IAAI,CAAC,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC;QACpE,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,SAAS;YAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,UAAU,CAAC;QAC7E,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QACzE,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;YAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC;QAEzE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAsB,sBAAsB,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE;aAC/C;YACD,IAAI;YACJ,OAAO,EAAE,oBAAoB;SAC9B,CAAC,CAAC;IACL,CAAC;IAED,kFAAkF;IAClF,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,IAA+C;QACjF,OAAO,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE,EAAE,GAAG,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACnE,CAAC;IAED,uEAAuE;IACvE,KAAK,CAAC,gCAAgC,CACpC,SAAiB,EACjB,IAAgC;QAEhC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,8FAA8F,EAC9F,uCAAuC,CACxC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,uCAAuC,CAAC,CAAC;QAE5F,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAuB,oCAAoC,EAAE;YACrF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,IAAI,EAAE,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE;YACpC,OAAO,EAAE,uCAAuC;SACjD,CAAC,CAAC;IACL,CAAC;IAED,wDAAwD;IACxD,KAAK,CAAC,yBAAyB,CAC7B,SAAiB,EACjB,IAAsC;QAEtC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,mGAAmG,EACnG,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAErF,MAAM,IAAI,GAA4B;YACpC,YAAY,EAAE,IAAI,CAAC,WAAW;YAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;QACF,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAExC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAgB,mCAAmC,EAAE;YAC7E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,qCAAqC;IACrC,KAAK,CAAC,yBAAyB,CAAC,SAAiB,EAAE,IAAyB;QAC1E,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,0EAA0E,EAC1E,gCAAgC,CACjC,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gCAAgC,CAAC,CAAC;QAErF,MAAM,IAAI,GAA4B,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC;QACrE,IAAI,IAAI,CAAC,KAAK;YAAE,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QAExC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAuB,iCAAiC,EAAE;YAClF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI;YACJ,OAAO,EAAE,gCAAgC;SAC1C,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,IAA+B;QACzE,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,+EAA+E,EAC/E,yBAAyB,CAC1B,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,yBAAyB,CAAC,CAAC;QAE9E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAoB,gCAAgC,EAAE;YAC9E,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,IAAI,EAAE;gBACJ,YAAY,EAAE,IAAI,CAAC,WAAW;gBAC9B,QAAQ,EAAE,IAAI,CAAC,QAAQ;aACxB;YACD,OAAO,EAAE,yBAAyB;SACnC,CAAC,CAAC;IACL,CAAC;IAED,qDAAqD;IACrD,KAAK,CAAC,YAAY,CAAC,SAAiB,EAAE,IAAwB;QAC5D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,+DAA+D,EAC/D,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAgC,mBAAmB,EAAE;YAC7E,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,OAAO,EAAE,kBAAkB;YAC3B,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,aAAa,CAAC,SAAiB,EAAE,IAA0B;QAC/D,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,UAAU,CAClB,2EAA2E,EAC3E,kBAAkB,CACnB,CAAC;QACJ,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,kBAAkB,CAAC,CAAC;QAEvE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,qBAAqB,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE;YAC5F,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,IAAI,CAAC,WAAW,EAAE;aAC5C;YACD,OAAO,EAAE,kBAAkB;SAC5B,CAAC,CAAC;IACL,CAAC;IAED,iFAAiF;IACjF,KAAK,CAAC,SAAS,CAAC,SAAiB;QAC/B,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,wBAAwB,CAAC,CAAC;QAE7E,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,oBAAoB,EAAE;YACxD,OAAO,EAAE;gBACP,MAAM,EAAE,OAAO,CAAC,QAAQ;gBACxB,aAAa,EAAE,UAAU,OAAO,CAAC,QAAQ,EAAE;aAC5C;YACD,OAAO,EAAE,wBAAwB;YACjC,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAED,0EAA0E;IAC1E,KAAK,CAAC,OAAO,CAAC,SAAiB,EAAE,KAAa;QAC5C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QAErE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACvB,sBAAsB,SAAS,eAAe,EAC9C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI,EAAE,EAAE,KAAK,EAAE;YACf,OAAO,EAAE,gBAAgB;SAC1B,CACF,CAAC;IACJ,CAAC;IAED,8EAA8E;IAC9E,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,KAAa;QAC3C,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;QACxD,IAAI,CAAC,OAAO;YAAE,MAAM,IAAI,eAAe,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;QAEpE,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CACvB,sBAAsB,SAAS,cAAc,EAC7C;YACE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,WAAW,EAAE,EAAE;YAC3D,IAAI,EAAE,EAAE,KAAK,EAAE;YACf,OAAO,EAAE,eAAe;SACzB,CACF,CAAC;IACJ,CAAC;CACF"}

package/sdk/dist/namespaces/operator.d.ts

@@ -0,0 +1,112 @@
+/**
+ * `operator` namespace — the *human* (email) principal, distinct from the
+ * agent's per-wallet SIWX identity.
+ *
+ * The human authenticates in the browser via an OAuth 2.0 device-authorization
+ * grant (RFC 8628, the `aws sso login` model): `deviceStart` returns a
+ * user-facing code + URL, the human approves it via the existing magic-link or
+ * passkey web flow, and `devicePoll` brokers the resulting operator-session
+ * token. `overview` reads the email-union account view with that token, and
+ * `revoke` ends the session server-side.
+ *
+ * Bearer auth is passed explicitly (`opts.token`) rather than sourced from a
+ * credential provider, because the operator session is a Node-only on-disk
+ * cache (`core/operator-session.ts`) and this namespace stays isomorphic. The
+ * `device*` endpoints are unauthenticated (the `device_code` in the body is the
+ * credential), so they send no auth headers.
+ *
+ * Gateway contract: kychee-com/run402-private#443 (RFC 8628 device-auth bridge).
+ */
+import type { Client } from "../kernel.js";
+/** RFC 8628 device-authorization start response. */
+export interface DeviceAuthStart {
+    device_code: string;
+    user_code: string;
+    verification_uri: string;
+    /** Pre-fills the user_code so the human can click straight through. */
+    verification_uri_complete?: string;
+    expires_in: number;
+    /** Minimum seconds between `devicePoll` calls. */
+    interval: number;
+}
+/** The operator-session token payload (wire shape; relative `expires_in`). */
+export interface OperatorSessionToken {
+    operator_session_token: string;
+    token_type: string;
+    expires_in: number;
+    absolute_expires_at: string;
+    email: string;
+    wallets: string[];
+}
+/**
+ * Result of one `devicePoll`. The non-approved states are the RFC 8628 token
+ * error codes — they are expected polling states, NOT thrown errors, so callers
+ * can run the poll loop without try/catch.
+ */
+export type DevicePollResult = {
+    kind: "approved";
+    session: OperatorSessionToken;
+} | {
+    kind: "authorization_pending";
+} | {
+    kind: "slow_down";
+} | {
+    kind: "access_denied";
+} | {
+    kind: "expired_token";
+};
+/**
+ * Account overview. Forward-compatible: the gateway owns the exact shape and
+ * may add fields, so unknown keys are preserved via the index signature.
+ * `scope.kind` is `"email"` for the operator-session (email-union) and
+ * `"wallet"` for a SIWX slice.
+ */
+export interface OperatorOverview {
+    scope?: {
+        kind?: "email" | "wallet" | string;
+        principal?: string;
+    };
+    rollup?: Record<string, unknown>;
+    billing_accounts?: unknown[];
+    wallets?: unknown[];
+    advisories?: unknown[];
+    [key: string]: unknown;
+}
+export declare class Operator {
+    private readonly client;
+    constructor(client: Client);
+    /**
+     * Begin the device-authorization flow. Unauthenticated. Returns the codes the
+     * CLI prints (`user_code` + `verification_uri`) plus the poll `interval` and
+     * `expires_in`.
+     */
+    deviceStart(opts?: {
+        clientName?: string;
+    }): Promise<DeviceAuthStart>;
+    /**
+     * Poll once for approval. Bypasses the kernel's error mapping on purpose: the
+     * RFC 8628 error codes (`authorization_pending`, `slow_down`, ...) are normal
+     * polling states returned as data, not exceptions. Only an unexpected
+     * response shape throws.
+     */
+    devicePoll(deviceCode: string): Promise<DevicePollResult>;
+    /**
+     * Fetch the account overview. With `opts.token` the request carries the
+     * operator-session bearer and returns the email-union; without it the request
+     * falls back to the credential provider's default auth (SIWX) and returns
+     * that wallet's slice. The CLI always passes a token (human-only surface); the
+     * SDK supports both because the gateway endpoint accepts both principals.
+     */
+    overview(opts?: {
+        token?: string;
+    }): Promise<OperatorOverview>;
+    /**
+     * Revoke the operator session server-side (the server half of
+     * `operator logout`). Idempotent on the gateway; returns 204. The local cache
+     * is cleared separately by the CLI.
+     */
+    revoke(opts: {
+        token: string;
+    }): Promise<void>;
+}
+//# sourceMappingURL=operator.d.ts.map

package/sdk/dist/namespaces/operator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.d.ts","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAG3C,oDAAoD;AACpD,MAAM,WAAW,eAAe;IAC9B,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uEAAuE;IACvE,yBAAyB,CAAC,EAAE,MAAM,CAAC;IACnC,UAAU,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,8EAA8E;AAC9E,MAAM,WAAW,oBAAoB;IACnC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED;;;;GAIG;AACH,MAAM,MAAM,gBAAgB,GACxB;IAAE,IAAI,EAAE,UAAU,CAAC;IAAC,OAAO,EAAE,oBAAoB,CAAA;CAAE,GACnD;IAAE,IAAI,EAAE,uBAAuB,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,WAAW,CAAA;CAAE,GACrB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,GACzB;IAAE,IAAI,EAAE,eAAe,CAAA;CAAE,CAAC;AAE9B;;;;;GAKG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,CAAC,EAAE;QAAE,IAAI,CAAC,EAAE,OAAO,GAAG,QAAQ,GAAG,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IACnE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,gBAAgB,CAAC,EAAE,OAAO,EAAE,CAAC;IAC7B,OAAO,CAAC,EAAE,OAAO,EAAE,CAAC;IACpB,UAAU,CAAC,EAAE,OAAO,EAAE,CAAC;IACvB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AASD,qBAAa,QAAQ;IACP,OAAO,CAAC,QAAQ,CAAC,MAAM;gBAAN,MAAM,EAAE,MAAM;IAE3C;;;;OAIG;IACG,WAAW,CAAC,IAAI,GAAE;QAAE,UAAU,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,eAAe,CAAC;IAS/E;;;;;OAKG;IACG,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAgC/D;;;;;;OAMG;IACG,QAAQ,CAAC,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,MAAM,CAAA;KAAO,GAAG,OAAO,CAAC,gBAAgB,CAAC;IAaxE;;;;OAIG;IACG,MAAM,CAAC,IAAI,EAAE;QAAE,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,OAAO,CAAC,IAAI,CAAC;CAQrD"}

package/sdk/dist/namespaces/operator.js

@@ -0,0 +1,107 @@
+/**
+ * `operator` namespace — the *human* (email) principal, distinct from the
+ * agent's per-wallet SIWX identity.
+ *
+ * The human authenticates in the browser via an OAuth 2.0 device-authorization
+ * grant (RFC 8628, the `aws sso login` model): `deviceStart` returns a
+ * user-facing code + URL, the human approves it via the existing magic-link or
+ * passkey web flow, and `devicePoll` brokers the resulting operator-session
+ * token. `overview` reads the email-union account view with that token, and
+ * `revoke` ends the session server-side.
+ *
+ * Bearer auth is passed explicitly (`opts.token`) rather than sourced from a
+ * credential provider, because the operator session is a Node-only on-disk
+ * cache (`core/operator-session.ts`) and this namespace stays isomorphic. The
+ * `device*` endpoints are unauthenticated (the `device_code` in the body is the
+ * credential), so they send no auth headers.
+ *
+ * Gateway contract: kychee-com/run402-private#443 (RFC 8628 device-auth bridge).
+ */
+import { ApiError, NetworkError } from "../errors.js";
+const POLL_ERROR_CODES = new Set([
+    "authorization_pending",
+    "slow_down",
+    "access_denied",
+    "expired_token",
+]);
+export class Operator {
+    client;
+    constructor(client) {
+        this.client = client;
+    }
+    /**
+     * Begin the device-authorization flow. Unauthenticated. Returns the codes the
+     * CLI prints (`user_code` + `verification_uri`) plus the poll `interval` and
+     * `expires_in`.
+     */
+    async deviceStart(opts = {}) {
+        return this.client.request("/agent/v1/operator/session/device", {
+            method: "POST",
+            body: opts.clientName ? { client_name: opts.clientName } : {},
+            withAuth: false,
+            context: "starting operator device authorization",
+        });
+    }
+    /**
+     * Poll once for approval. Bypasses the kernel's error mapping on purpose: the
+     * RFC 8628 error codes (`authorization_pending`, `slow_down`, ...) are normal
+     * polling states returned as data, not exceptions. Only an unexpected
+     * response shape throws.
+     */
+    async devicePoll(deviceCode) {
+        const url = `${this.client.apiBase}/agent/v1/operator/session/device/token`;
+        let res;
+        try {
+            res = await this.client.fetch(url, {
+                method: "POST",
+                headers: { "Content-Type": "application/json" },
+                body: JSON.stringify({ device_code: deviceCode }),
+            });
+        }
+        catch (err) {
+            throw new NetworkError(`Network error while polling operator device token: ${err.message}`, err, "polling operator device token");
+        }
+        const body = (await res.json().catch(() => null));
+        if (res.ok && body && typeof body.operator_session_token === "string") {
+            return { kind: "approved", session: body };
+        }
+        const error = body && typeof body.error === "string" ? body.error : null;
+        if (error && POLL_ERROR_CODES.has(error)) {
+            return { kind: error };
+        }
+        throw new ApiError(`Unexpected operator device-token response (HTTP ${res.status})`, res.status, body, "polling operator device token");
+    }
+    /**
+     * Fetch the account overview. With `opts.token` the request carries the
+     * operator-session bearer and returns the email-union; without it the request
+     * falls back to the credential provider's default auth (SIWX) and returns
+     * that wallet's slice. The CLI always passes a token (human-only surface); the
+     * SDK supports both because the gateway endpoint accepts both principals.
+     */
+    async overview(opts = {}) {
+        if (opts.token) {
+            return this.client.request("/agent/v1/operator/overview", {
+                headers: { Authorization: `Bearer ${opts.token}` },
+                withAuth: false,
+                context: "fetching operator overview",
+            });
+        }
+        return this.client.request("/agent/v1/operator/overview", {
+            context: "fetching operator overview",
+        });
+    }
+    /**
+     * Revoke the operator session server-side (the server half of
+     * `operator logout`). Idempotent on the gateway; returns 204. The local cache
+     * is cleared separately by the CLI.
+     */
+    async revoke(opts) {
+        await this.client.request("/agent/v1/operator/session/revoke", {
+            method: "POST",
+            headers: { Authorization: `Bearer ${opts.token}` },
+            withAuth: false,
+            context: "revoking operator session",
+        });
+    }
+}
+//# sourceMappingURL=operator.js.map

package/sdk/dist/namespaces/operator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"operator.js","sourceRoot":"","sources":["../../src/namespaces/operator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAGH,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAmDtD,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,uBAAuB;IACvB,WAAW;IACX,eAAe;IACf,eAAe;CAChB,CAAC,CAAC;AAEH,MAAM,OAAO,QAAQ;IACU;IAA7B,YAA6B,MAAc;QAAd,WAAM,GAAN,MAAM,CAAQ;IAAG,CAAC;IAE/C;;;;OAIG;IACH,KAAK,CAAC,WAAW,CAAC,OAAgC,EAAE;QAClD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAkB,mCAAmC,EAAE;YAC/E,MAAM,EAAE,MAAM;YACd,IAAI,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE;YAC7D,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,wCAAwC;SAClD,CAAC,CAAC;IACL,CAAC;IAED;;;;;OAKG;IACH,KAAK,CAAC,UAAU,CAAC,UAAkB;QACjC,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,OAAO,yCAAyC,CAAC;QAC5E,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE;gBACjC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;aAClD,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,YAAY,CACpB,sDAAuD,GAAa,CAAC,OAAO,EAAE,EAC9E,GAAG,EACH,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAmC,CAAC;QACpF,IAAI,GAAG,CAAC,EAAE,IAAI,IAAI,IAAI,OAAO,IAAI,CAAC,sBAAsB,KAAK,QAAQ,EAAE,CAAC;YACtE,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAuC,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;QACzE,IAAI,KAAK,IAAI,gBAAgB,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YACzC,OAAO,EAAE,IAAI,EAAE,KAAsD,EAAE,CAAC;QAC1E,CAAC;QACD,MAAM,IAAI,QAAQ,CAChB,mDAAmD,GAAG,CAAC,MAAM,GAAG,EAChE,GAAG,CAAC,MAAM,EACV,IAAI,EACJ,+BAA+B,CAChC,CAAC;IACJ,CAAC;IAED;;;;;;OAMG;IACH,KAAK,CAAC,QAAQ,CAAC,OAA2B,EAAE;QAC1C,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;YACf,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;gBAC1E,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;gBAClD,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,4BAA4B;aACtC,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAmB,6BAA6B,EAAE;YAC1E,OAAO,EAAE,4BAA4B;SACtC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,MAAM,CAAC,IAAuB;QAClC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAU,mCAAmC,EAAE;YACtE,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,IAAI,CAAC,KAAK,EAAE,EAAE;YAClD,QAAQ,EAAE,KAAK;YACf,OAAO,EAAE,2BAA2B;SACrC,CAAC,CAAC;IACL,CAAC;CACF"}